Merge webkit.org at R49305 : Automatic merge by git.

Change-Id: I8968561bc1bfd72b8923b7118d3728579c6dbcc7

2348 files changed, 147745 insertions, 32292 deletions

diff --git a/JavaScriptCore/API/JSBase.h b/JavaScriptCore/API/JSBase.h
index 9f3d88e..d1ce9b3 100644
--- a/JavaScriptCore/API/JSBase.h
+++ b/JavaScriptCore/API/JSBase.h
@@ -67,7 +67,7 @@ typedef struct OpaqueJSValue* JSObjectRef;
 #undef JS_EXPORT
 #if defined(BUILDING_WX__)
     #define JS_EXPORT
-#elif defined(__GNUC__)
+#elif defined(__GNUC__) && !defined(__CC_ARM) && !defined(__ARMCC__)
     #define JS_EXPORT __attribute__((visibility("default")))
 #elif defined(_WIN32_WCE)
     #if defined(JS_BUILDING_JS)
diff --git a/JavaScriptCore/API/JSCallbackConstructor.cpp b/JavaScriptCore/API/JSCallbackConstructor.cpp
index 64c83cb..1c33962 100644
--- a/JavaScriptCore/API/JSCallbackConstructor.cpp
+++ b/JavaScriptCore/API/JSCallbackConstructor.cpp
@@ -36,7 +36,7 @@ namespace JSC {
 
 const ClassInfo JSCallbackConstructor::info = { "CallbackConstructor", 0, 0, 0 };
 
-JSCallbackConstructor::JSCallbackConstructor(PassRefPtr<Structure> structure, JSClassRef jsClass, JSObjectCallAsConstructorCallback callback)
+JSCallbackConstructor::JSCallbackConstructor(NonNullPassRefPtr<Structure> structure, JSClassRef jsClass, JSObjectCallAsConstructorCallback callback)
     : JSObject(structure)
     , m_class(jsClass)
     , m_callback(callback)
diff --git a/JavaScriptCore/API/JSCallbackConstructor.h b/JavaScriptCore/API/JSCallbackConstructor.h
index 1f06249..202b119 100644
--- a/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/JavaScriptCore/API/JSCallbackConstructor.h
@@ -33,7 +33,7 @@ namespace JSC {
 
 class JSCallbackConstructor : public JSObject {
 public:
-    JSCallbackConstructor(PassRefPtr<Structure>, JSClassRef, JSObjectCallAsConstructorCallback);
+    JSCallbackConstructor(NonNullPassRefPtr<Structure>, JSClassRef, JSObjectCallAsConstructorCallback);
     virtual ~JSCallbackConstructor();
     JSClassRef classRef() const { return m_class; }
     JSObjectCallAsConstructorCallback callback() const { return m_callback; }
@@ -41,7 +41,7 @@ public:
     
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot)); 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames)); 
     }
 
 private:
diff --git a/JavaScriptCore/API/JSCallbackFunction.cpp b/JavaScriptCore/API/JSCallbackFunction.cpp
index 1b3217b..b7dd768 100644
--- a/JavaScriptCore/API/JSCallbackFunction.cpp
+++ b/JavaScriptCore/API/JSCallbackFunction.cpp
@@ -28,6 +28,7 @@
 #include "JSCallbackFunction.h"
 
 #include "APICast.h"
+#include "CodeBlock.h"
 #include "JSFunction.h"
 #include "FunctionPrototype.h"
 #include <runtime/JSGlobalObject.h>
diff --git a/JavaScriptCore/API/JSCallbackFunction.h b/JavaScriptCore/API/JSCallbackFunction.h
index 7dd87b5..3a17fa2 100644
--- a/JavaScriptCore/API/JSCallbackFunction.h
+++ b/JavaScriptCore/API/JSCallbackFunction.h
@@ -41,7 +41,7 @@ public:
     // refactor the code so this override isn't necessary
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot)); 
+        return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark)); 
     }
 
 private:
diff --git a/JavaScriptCore/API/JSCallbackObject.h b/JavaScriptCore/API/JSCallbackObject.h
index 9d22ad9..86f2f32 100644
--- a/JavaScriptCore/API/JSCallbackObject.h
+++ b/JavaScriptCore/API/JSCallbackObject.h
@@ -36,7 +36,7 @@ namespace JSC {
 template <class Base>
 class JSCallbackObject : public Base {
 public:
-    JSCallbackObject(ExecState*, PassRefPtr<Structure>, JSClassRef, void* data);
+    JSCallbackObject(ExecState*, NonNullPassRefPtr<Structure>, JSClassRef, void* data);
     JSCallbackObject(JSClassRef);
     virtual ~JSCallbackObject();
 
@@ -66,7 +66,7 @@ private:
 
     virtual bool hasInstance(ExecState* exec, JSValue value, JSValue proto);
 
-    virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
     virtual double toNumber(ExecState*) const;
     virtual UString toString(ExecState*) const;
diff --git a/JavaScriptCore/API/JSCallbackObjectFunctions.h b/JavaScriptCore/API/JSCallbackObjectFunctions.h
index 1abed3f..9b726e8 100644
--- a/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -47,7 +47,7 @@ inline JSCallbackObject<Base>* JSCallbackObject<Base>::asCallbackObject(JSValue
 }
 
 template <class Base>
-JSCallbackObject<Base>::JSCallbackObject(ExecState* exec, PassRefPtr<Structure> structure, JSClassRef jsClass, void* data)
+JSCallbackObject<Base>::JSCallbackObject(ExecState* exec, NonNullPassRefPtr<Structure> structure, JSClassRef jsClass, void* data)
     : Base(structure)
     , m_callbackObjectData(new JSCallbackObjectData(data, jsClass))
 {
@@ -373,7 +373,7 @@ JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject,
 }
 
 template <class Base>
-void JSCallbackObject<Base>::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef thisRef = toRef(this);
@@ -407,7 +407,7 @@ void JSCallbackObject<Base>::getPropertyNames(ExecState* exec, PropertyNameArray
         }
     }
     
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 template <class Base>
diff --git a/JavaScriptCore/API/JSObjectRef.cpp b/JavaScriptCore/API/JSObjectRef.cpp
index 87d36ec..06ef578 100644
--- a/JavaScriptCore/API/JSObjectRef.cpp
+++ b/JavaScriptCore/API/JSObjectRef.cpp
@@ -28,6 +28,7 @@
 #include "JSObjectRef.h"
 
 #include "APICast.h"
+#include "CodeBlock.h"
 #include "DateConstructor.h"
 #include "ErrorConstructor.h"
 #include "FunctionConstructor.h"
diff --git a/JavaScriptCore/API/JSStringRef.h b/JavaScriptCore/API/JSStringRef.h
index 8b17ee2..c58b958 100644
--- a/JavaScriptCore/API/JSStringRef.h
+++ b/JavaScriptCore/API/JSStringRef.h
@@ -37,7 +37,7 @@
 extern "C" {
 #endif
 
-#if !defined(WIN32) && !defined(_WIN32)
+#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__)
 /*!
 @typedef JSChar
 @abstract A Unicode character.
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 1afea5f..7cf56bd 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,5058 @@
+2009-10-08  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for JIT'ed op_call instructions (evals, constructs, etc.)
+        when !ENABLE(JIT_OPTIMIZE_CALL) && USE(JSVALUE32_64)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30201
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed no longer exported symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+        
+        Removed the optional lock from Heap::protect, Heap::unprotect, and friends,
+        since WebCore no longer uses it.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::protectedGlobalObjectCount):
+        (JSC::Heap::protectedObjectCount):
+        (JSC::Heap::protectedObjectTypeCounts):
+        * runtime/Collector.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's IdentifierArena
+        https://bugs.webkit.org/show_bug.cgi?id=30158
+
+        Inherits IdentifierArena class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/ParserArena.cpp:36.
+
+        * parser/ParserArena.h:
+
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Export DateInstance::info in a way that works on Windows
+
+        Fixes <http://webkit.org/b/30171>
+        fast/dom/Window/window-postmessage-clone.html fails on Windows
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed the export of DateInstance::info from here.
+
+        * runtime/DateInstance.h: Use JS_EXPORTDATA to export
+        DateInstance::info, which is the required way of exporting data on
+        Windows.
+
+2009-10-07  Jørgen Lind  <jorgen.lind@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        When enabling or disabling the JIT through .qmake.cache, make sure
+        to also toggle ENABLE_YARR_JIT.
+
+        * JavaScriptCore.pri:
+
+2009-10-06  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Linking fails with "relocation R_X86_64_PC32 against symbol
+        `cti_vm_throw'"
+        https://bugs.webkit.org/show_bug.cgi?id=28422
+
+        * jit/JITStubs.cpp:
+        Mark cti_vm_throw symbol as PLT-indirect symbol, so it doesn't end up
+        in text segment causing relocation errors on amd64 architecture.
+        Introduced new define SYMBOL_STRING_RELOCATION for such symbols.
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Windows linking fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Windows build fix.
+
+        * runtime/DateInstance.cpp:
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Expose helpers to throw correct exceptions during object graph walk
+        used for cloning and add a helper function to create Date instances
+        without going through the JS Date constructor function.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createTypeError):
+        * runtime/ExceptionHelpers.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        * wtf/CrossThreadRefCounted.h:
+        Removed an unused function and assert improvement.
+        (WTF::CrossThreadRefCounted::isOwnedByCurrentThread): Moved out common code from asserts.
+        (WTF::CrossThreadRefCounted::ref): Changed assert to use the common method.
+        (WTF::CrossThreadRefCounted::deref): Changed assert to use the common method.
+        (WTF::CrossThreadRefCounted::crossThreadCopy): Since this includes a potentially
+        non-threadsafe operation, add an assert that the class is owned by the current thread.
+
+2009-10-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add Symbian files to the list of excludes.
+
+        * wscript:
+
+2009-10-05  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove precompiled header from JavaScriptCore compilation to
+        prevent qmake warning during autonomous compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=30069
+
+        * JavaScriptCore.pro:
+
+2009-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the concept of a "fast access cutoff" in arrays, because it
+        punished some patterns of array access too much, and made things too
+        complex for inlining in some cases.
+        
+        1.3% speedup on SunSpider.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::): Check m_vectorLength instead of m_fastAccessCutoff when
+        getting / putting from / to an array. Inline putting past the end of
+        the array.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::canSetIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::markChildrenDirect): Removed m_fastAccessCutoff, and
+        replaced with checks for JSValue() to detect reads and writes from / to
+        uninitialized parts of the array.
+
+2009-10-02  Jonni Rainisto  <jonni.rainisto@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Math.random() gives too low values on Win32 when _CRT_RAND_S is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=29956
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Added PLATFORM(WIN_OS) to handle 15bit rand()
+
+2009-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Take one branch instead of two to test for JSValue().
+        
+        1.1% SunSpider speedup.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_create_arguments):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val): Test for the empty value tag, instead
+        of testing for the cell tag with a 0 payload.
+
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description): Added support for dumping the new empty value,
+        and deleted values, in debug builds.
+
+        * runtime/JSValue.h:
+        (JSC::JSValue::JSValue()): Construct JSValue() with the empty value tag.
+
+        (JSC::JSValue::JSValue(JSCell*)): Convert null pointer to the empty value
+        tag, to avoid having two different c++ versions of null / empty.
+
+        (JSC::JSValue::operator bool): Test for the empty value tag, instead
+        of testing for the cell tag with a 0 payload.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Fix the Qt on Mac OS X build.
+
+        * wtf/FastMalloc.cpp:
+
+2009-10-02  Jørgen Lind  <jorgen.lind@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow enabling and disabling of the JIT through a qmake variable.
+
+        Qt's configure may set this variable through .qmake.cache if a
+        commandline option is given and/or the compile test for hwcap.h
+        failed/succeeded.
+
+        * JavaScriptCore.pri:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29187
+
+        Don't inline ~ListRefPtr() to work around winscw compiler forward declaration
+        bug regarding templated classes.
+
+        The compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812
+
+        The change will be reverted when the above bug is fixed in winscw compiler.
+
+        * wtf/ListRefPtr.h:
+        (WTF::::~ListRefPtr):
+
+2009-10-01  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow custom memory allocation control for the whole JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=27029
+
+        Since in JavaScriptCore almost every class which has been instantiated by operator new is
+        inherited from FastAllocBase (bug #20422), we disable customizing global operator new for the Qt-port
+        when USE_SYSTEM_MALLOC=0.
+
+        Add #include <unistd.h> to FastMalloc.cpp because it's used by TCMalloc_PageHeap::scavengerThread().
+        (It's needed for the functionality of TCmalloc.)
+
+        Add TCSystemAlloc.cpp to JavaScriptCore.pri if USE_SYSTEM_MALLOC is disabled.
+
+        * JavaScriptCore.pri:
+        * wtf/FastMalloc.cpp:
+        (WTF::sleep):
+        * wtf/FastMalloc.h:
+
+2009-09-30  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by George Staikos.
+
+        Defines two pseudo-platforms for ARM and Thumb-2 instruction set.
+        https://bugs.webkit.org/show_bug.cgi?id=29122
+
+        Introduces WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2
+        macros on ARM platforms. The PLATFORM(ARM_THUMB2) should be used
+        when Thumb-2 instruction set is the required target. The
+        PLATFORM(ARM_TRADITIONAL) is for generic ARM instruction set. In
+        case where the code is common the PLATFORM(ARM) have to be used.
+
+        Modified by George Wright  <gwright@rim.com> to correctly work
+        with the RVCT-defined __TARGET_ARCH_ARM and __TARGET_ARCH_THUMB
+        compiler macros, as well as adding readability changes.
+
+        * wtf/Platform.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Devirtualise array toString conversion
+
+        Tweak the implementation of Array.prototype.toString to have a fast path
+        when acting on a true JSArray.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+
+2009-09-30  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Buildfix for platforms using JSVALUE32.
+        https://bugs.webkit.org/show_bug.cgi?id=29915
+
+        After http://trac.webkit.org/changeset/48905 the build broke in JSVALUE32 case.
+        Also removed unreachable code.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+         - Declaration of "OperandTypes types" moved before first use.
+         - Typos fixed: dst modified to result, regT2 added.
+         - Unreachable code removed.
+        (JSC::JIT::emitSlow_op_add):
+         - Missing declaration of "OperandTypes types" added.
+
+2009-09-30  Janne Koskinen  <janne.p.koskinen@digia.com> 
+
+        Reviewed by Simon Hausmann.
+
+        Reduce heap size on Symbian from 64MB to 8MB.
+
+        This is not a perfect fix, it requires more fine tuning.
+        But this makes it possible again to debug in the emulator,
+        which is more important in order to be able to fix other
+        run-time issues.
+
+        * runtime/Collector.h:
+
+2009-09-30  Janne Koskinen  <janne.p.koskinen@digia.com> 
+
+        Reviewed by Simon Hausmann.
+
+        Fix CRASH() macro for Symbian build.
+
+        * wtf/Assertions.h: Added missing }
+
+2009-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Inlined a few math operations.
+        
+        ~1% SunSpider speedup.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub): Don't take a stub call when operating on
+        a constant int and a double.
+
+2009-09-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Tidy up codeblock sampler
+        https://bugs.webkit.org/show_bug.cgi?id=29836
+
+        Some rather simple refactoring of codeblock sampler so that
+        it's easier for us to use it to find problems in non-jsc
+        environments
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.h:
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::enableSampler):
+        (JSC::Interpreter::dumpSampleData):
+        (JSC::Interpreter::startSampling):
+        (JSC::Interpreter::stopSampling):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::sampler):
+        * jit/JIT.h:
+        * jsc.cpp:
+        (runWithScripts):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::startSampling):
+        (JSC::JSGlobalData::stopSampling):
+        (JSC::JSGlobalData::dumpSampleData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29895
+
+        The following files are generated by JavaScriptCore's GYP file and should be ignored:
+
+        pcre.mk
+        wtf.scons
+        wtf.mk
+        SConstruct
+        wtf_config.scons
+        wtf_config.mk
+        pcre.scons
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Standardized an optimization for adding non-numbers.
+        
+        SunSpider says maybe a tiny speedup.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+
+2009-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export a new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
+        fix-ups when accessing JSGlobalObject::d.
+        
+        Replaced with an explicit destructor function pointer.
+        
+        6% speedup on bench-alloc-nonretained.js.
+
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::destroyJSGlobalObjectData):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::JSGlobalObject):
+
+2009-09-29  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by David Kilzer.
+
+        [Qt] Assert messages prints visible in Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29808
+
+        Asserts use vprintf to print the messages to stderr.
+        In Symbian Open C it is not possible to see stderr so
+        I routed the messages to stdout instead.
+
+        * wtf/Assertions.cpp:
+
+2009-09-29  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] Symbian CRASH macro implementation
+
+        Added Symbian specific crash macro that
+        stops to crash line if JIT debugging is used.
+        Additional differentiation of access violation
+        (KERN-EXEC 3) and CRASH panic.
+
+        * wtf/Assertions.h:
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Fix the PowerPC build.
+
+        * JavaScriptCore.exp:
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/7195704> JavaScriptCore fails to mark registers when built for x86_64 using LLVM GCC.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markCurrentThreadConservatively): Force jmp_buf to use the appropriate alignment for a pointer
+        to ensure that we correctly interpret the contents of registers during marking.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added new exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed exports that no longer exist.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
+        https://bugs.webkit.org/show_bug.cgi?id=29822
+        
+        Added NotNullPassRefPtr, and deployed it in all places that initialize
+        JavaScript objects.
+        
+        2.2% speedup on bench-allocate-nonretained.js.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::JSCallbackObject):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFunctionDecl):
+        (JSC::CodeBlock::addFunctionExpr):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/FunctionPrototype.h:
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        * runtime/GlobalEvalFunction.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::JSONObject):
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::setStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PrototypeFunction.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        * wtf/PassRefPtr.h:
+        (WTF::NotNullPassRefPtr::NotNullPassRefPtr):
+        (WTF::NotNullPassRefPtr::~NotNullPassRefPtr):
+        (WTF::NotNullPassRefPtr::get):
+        (WTF::NotNullPassRefPtr::clear):
+        (WTF::NotNullPassRefPtr::releaseRef):
+        (WTF::NotNullPassRefPtr::operator*):
+        (WTF::NotNullPassRefPtr::operator->):
+        (WTF::NotNullPassRefPtr::operator!):
+        (WTF::NotNullPassRefPtr::operator UnspecifiedBoolType):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::operator==):
+
+2009-09-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Hard dependency on SSE2 instruction set with JIT
+        https://bugs.webkit.org/show_bug.cgi?id=29779
+
+        Add floating point support checks to op_jfalse and op_jtrue, and
+        fix the logic for the slow case of op_add
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_add):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium port - recognize we are being built independently
+        of chromium and look for dependencies under webkit/chromium rather
+        than chromium/src.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29722
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement XSLT support with QtXmlPatterns.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        * wtf/Platform.h: Add a WTF_USE_QXMLQUERY #define.
+
+2009-09-28  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Remove __clear_cache which is an internal function of GCC
+        https://bugs.webkit.org/show_bug.cgi?id=28886
+
+        Although __clear_cache is exported from GCC, this is an internal
+        function. GCC makes no promises about it.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix an absolute path to somewhere in Oliver's machine to a relative path
+        for derived JSONObject.lut.h.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-09-28  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add ARM version detection for Windows CE.
+
+        * wtf/Platform.h:
+
+2009-09-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add MarkStackSymbian.cpp to build JavascriptCore for Symbian.
+
+        Re-use Windows shrinkAllocation implementation because Symbian doesn't
+        support releasing part of memory region.
+        
+        Use fastMalloc and fastFree to implement allocateStack and releaseStack
+        for Symbian port.
+
+        * JavaScriptCore.pri:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackSymbian.cpp: Added.
+        (JSC::MarkStack::initializePagesize):
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+2009-09-25  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix unaligned data access in YARR_JIT on ARMv5 and below.
+        https://bugs.webkit.org/show_bug.cgi?id=29695
+
+        On ARMv5 and below all data access should be naturally aligned.
+        In the YARR_JIT there is a case when character pairs are
+        loaded from the input string, but this data access is not
+        naturally aligned. This fix introduces load32WithUnalignedHalfWords
+        and branch32WithUnalignedHalfWords functions which contain
+        naturally aligned memory loads - half word loads - on ARMv5 and below.
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARMv7::branch32):
+        (JSC::MacroAssemblerARMv7::branch32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerX86Common::branch32WithUnalignedHalfWords):
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
+
+2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        This is breaking Chromium try bots, so I'm counting this as a build fix.
+
+        Add more svn:ignore exceptions.  On different platforms, these files are
+        generated with different case for JavaScriptCore.  Also there are some
+        wtf project files that get built apparently.
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-25  Ada Chan  <adachan@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Inlined some object creation code, including lexicalGlobalObject access
+        https://bugs.webkit.org/show_bug.cgi?id=29750
+        
+        SunSpider says 0.5% faster.
+        
+        0.8% speedup on bench-alloc-nonretained.js.
+        2.5% speedup on v8-splay.js.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::lexicalGlobalObject):
+        (JSC::ExecState::globalThisValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainNode::push):
+        (JSC::ScopeChain::ScopeChain):
+        (JSC::ScopeChain::globalObject): Added a globalObject data member to ScopeChainNode.
+        Replaced accessor function for globalObject() with data member. Replaced
+        globalThisObject() accessor with direct access to globalThis, to match.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h: Inlined array and object construction.
+
+2009-09-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add ARM version detection rules for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29715
+
+        * wtf/Platform.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark "Do It!" Rowe.
+
+        Some GCC versions don't like C++-style comments in preprocessor
+        directives, change to C-style to shut them up.
+
+        * wtf/Platform.h:
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Division is needlessly slow in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=29723
+
+        Add codegen for op_div on x86-64
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_div):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::isOperandConstantImmediateDouble):
+        (JSC::JIT::addressFor):
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateNumber):
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29724
+
+        Adding the following files to the svn:ignore list (all in the
+        JavaScriptCore/JavaScriptCore.gyp directory)
+
+        JavaScriptCore.xcodeproj
+        JavaScriptCore.sln
+        JavaScriptCore.vcproj
+        JavaScriptCore_Debug.rules
+        JavaScriptCore_Release.rules
+        JavaScriptCore_Release - no tcmalloc.rules
+        JavaScriptCore_Purify.rules
+        JavaScriptCore.mk
+        JavaScriptCore_Debug_rules.mk
+        JavaScriptCore_Release_rules.mk
+        JavaScriptCore_Release - no tcmalloc_rules.mk
+        JavaScriptCore_Purify_rules.mk
+        JavaScriptCore.scons
+        JavaScriptCore_main.scons
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-24  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        Replace platform-dependent code with WTF::currentTime()
+        https://bugs.webkit.org/show_bug.cgi?id=29148
+
+        * jsc.cpp:
+        (StopWatch::start):
+        (StopWatch::stop):
+        (StopWatch::getElapsedMS):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2009-09-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7215058> FastMalloc scavenging thread should be named
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavengerThread): Set the thread name.
+        * wtf/Platform.h: Move the knowledge of whether pthread_setname_np exists to here as HAVE(PTHREAD_SETNAME_NP).
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::setThreadNameInternal): Use HAVE(PTHREAD_SETNAME_NP).
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed clear to removeAll, as suggested by Darin Adler.
+
+        * wtf/HashCountedSet.h:
+        (WTF::::removeAll):
+
+2009-09-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix FastMalloc to build with assertions enabled.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_Central_FreeList::ReleaseToSpans):
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::IsHeld):
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Darin Adler.
+
+        Removed some unnecessary parameter names.
+
+        * wtf/HashCountedSet.h:
+
+2009-09-24  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        On Windows JSChar is typedef'ed to wchar_t.
+
+        When building with WINSCW for Symbian we need to do the
+        same typedef.
+
+        * API/JSStringRef.h:
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        A piece of my last patch that I forgot.
+
+        * wtf/HashCountedSet.h:
+        (WTF::::clear): Added HashCountedSet::clear.
+
+2009-09-24  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Avoid __clear_cache built-in function if DISABLE_BUILTIN_CLEAR_CACHE define is set
+        https://bugs.webkit.org/show_bug.cgi?id=28886
+
+        There are some GCC packages (for example GCC-2006q3 from CodeSourcery)
+        which contain __clear_cache built-in function only for C while the C++
+        version of __clear_cache is missing on ARM architectures.
+
+        Fixed a small bug in the inline assembly of cacheFlush function on
+        ARM_TRADITIONAL.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added the ability to swap vectors with inline capacities, so you can
+        store a vector with inline capacity in a hash table.
+
+        * wtf/Vector.h:
+        (WTF::swap):
+        (WTF::VectorBuffer::swap):
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        Move definition of USE(PLUGIN_HOST_PROCESS) from WebKitPrefix.h to Platform.h
+
+        Reviewed by Mark Rowe.
+
+        * wtf/Platform.h: Define WTF_USE_PLUGIN_HOST_PROCESS to 1 when
+        building on 64-bit SnowLeopard.  Define to 0 elsewhere.
+
+2009-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Code sampling builds are broken.
+        https://bugs.webkit.org/show_bug.cgi?id=29662
+
+        Fix build.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/SamplingTool.cpp:
+        (JSC::ScriptSampleRecord::sample):
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::notifyOfScope):
+        (JSC::compareScriptSampleRecords):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::ScriptSampleRecord::ScriptSampleRecord):
+        (JSC::ScriptSampleRecord::~ScriptSampleRecord):
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/Forward.h: Added PassOwnPtr.
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ported chromium.org's javascriptcore.gyp for the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Added.
+
+2009-09-22  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with WINSCW: no varargs macros
+
+        Disable variadic arguments for WINSCW just like we do
+        for MSVC7.
+
+        * wtf/Assertions.h:
+
+2009-09-22  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Disable variadic macros on MSVC7.
+
+        This was originally added in r26589 but not extended
+        when LOG_DISABLED/ASSERT_DISABLED was introduced.
+
+        * wtf/Assertions.h:
+
+2009-09-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix for Windows CE < 5
+
+        Define WINCEBASIC to disable the IsDebuggerPresent() code in
+        wtf/Assertions.cpp.
+
+        * JavaScriptCore.pri:
+
+2009-09-22  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix major memory leak in JavaScriptCore RegisterFile on Windows CE
+
+        https://bugs.webkit.org/show_bug.cgi?id=29367
+
+        On Widows CE we must decommit all committed pages before we release
+        them. See VirtualFree documentation.
+        Desktop Windows behaves much smoother in this situation.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+
+2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser & Sam Weinig.
+
+        Add ENABLE(ORIENTATION_EVENTS)
+        https://bugs.webkit.org/show_bug.cgi?id=29508
+
+        * wtf/Platform.h: Also sort PLATFORM(IPHONE) #defines.
+
+2009-09-21  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Fix] SourceCode's uninitialized member
+        
+        Potential source of crashes and bugs was fixed. Default constructor
+        didn't initialized m_provider member.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29364
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+
+2009-09-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=29599
+
+        It is unsafe to attempt to cache new property transitions on
+        dictionaries of any type.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+
+2009-09-21  Oliver Hunt  <oliver@apple.com>
+
+        RS=Maciej Stachowiak.
+
+        Re-land SNES fix with corrected assertion.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::isDictionary):
+        (JSC::Structure::isUncacheableDictionary):
+        (JSC::Structure::):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-21  Adam Roben  <aroben@apple.com>
+
+        Revert r48573, as it caused many assertion failures
+
+        * interpreter/Interpreter.cpp:
+        * jit/JITStubs.cpp:
+        * runtime/BatchedTransitionOptimizer.h:
+        * runtime/JSObject.cpp:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix. Missing files.
+
+        * GNUmakefile.am:
+
+2009-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam 'Cabin Boy' Weinig.
+
+        Fix stack alignment with ARM THUMB2 JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=29526
+        
+        Stack is currently being decremented by 0x3c, bump this to 0x40 to make this a
+        multiple of 16 bytes.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+
+2009-09-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        SNES is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=29534
+
+        The problem was that the emulator used multiple classes with
+        more properties than our dictionary cutoff allowed, this resulted
+        in more or less all critical logic inside the emulator requiring
+        uncached property access.
+
+        Rather than simply bumping the dictionary cutoff, this patch
+        recognises that there are two ways to create a "dictionary"
+        structure.  Either by adding a large number of properties, or
+        by removing a property.  In the case of adding properties we
+        know all the existing properties will maintain their existing
+        offsets, so we could cache access to those properties, if we
+        know they won't be removed.
+
+        To make this possible, this patch adds the logic required to
+        distinguish a dictionary created by addition from one created
+        by removal.  With this logic in place we can now cache access
+        to objects with large numbers of properties.
+
+        SNES performance improved by more than 6x.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::isDictionary):
+        (JSC::Structure::isUncacheableDictionary):
+        (JSC::Structure::):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement ES5 Object.create function
+        https://bugs.webkit.org/show_bug.cgi?id=29524
+
+        Implement Object.create.  Very simple patch, effectively Object.defineProperties
+        only creating the target object itself.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorCreate):
+
+2009-09-19  Dan Bernstein  <mitz@apple.com>
+
+        Fix clean debug builds.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-19  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by George Staikos.
+
+        QtWebKit Windows CE compile fix
+
+        https://bugs.webkit.org/show_bug.cgi?id=29379
+
+        There is no _aligned_alloc or _aligned_free on Windows CE.
+        We just use the Windows code that was there before and use VirtualAlloc.
+        But that also means that the BLOCK_SIZE must be 64K as this function
+        allocates on 64K boundaries.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        * runtime/Collector.h:
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement ES5 Object.defineProperties function
+        https://bugs.webkit.org/show_bug.cgi?id=29522
+
+        Implement Object.defineProperties.  Fairly simple patch, simply makes use of
+        existing functionality used for defineProperty.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::defineProperties):
+        (JSC::objectConstructorDefineProperties):
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Windows build fix part2
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Windows build fix part 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement ES5 Object.defineProperty function
+        https://bugs.webkit.org/show_bug.cgi?id=29503
+
+        Implement Object.defineProperty.  This requires adding the API to
+        ObjectConstructor, along with a helper function that implements the
+        ES5 internal [[ToPropertyDescriptor]] function.  It then adds
+        JSObject::defineOwnProperty that implements the appropriate ES5 semantics.
+        Currently defineOwnProperty uses a delete followed by a put to redefine
+        attributes of a property, clearly this is less efficient than it could be
+        but we can improve this if it needs to be possible in future.
+
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::defineGetter):
+        (JSC::DebuggerActivation::defineSetter):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+          Update defineGetter/Setter calls
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::defineGetter):
+        (JSC::JSGlobalObject::defineSetter):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::writable):
+        (JSC::PropertyDescriptor::enumerable):
+        (JSC::PropertyDescriptor::configurable):
+        (JSC::PropertyDescriptor::isDataDescriptor):
+        (JSC::PropertyDescriptor::isGenericDescriptor):
+        (JSC::PropertyDescriptor::isAccessorDescriptor):
+        (JSC::PropertyDescriptor::getter):
+        (JSC::PropertyDescriptor::setter):
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        (JSC::PropertyDescriptor::setWritable):
+        (JSC::PropertyDescriptor::setEnumerable):
+        (JSC::PropertyDescriptor::setConfigurable):
+        (JSC::PropertyDescriptor::setSetter):
+        (JSC::PropertyDescriptor::setGetter):
+        (JSC::PropertyDescriptor::equalTo):
+        (JSC::PropertyDescriptor::attributesEqual):
+        (JSC::PropertyDescriptor::attributesWithOverride):
+        * runtime/PropertyDescriptor.h:
+        (JSC::PropertyDescriptor::PropertyDescriptor):
+        (JSC::PropertyDescriptor::value):
+        (JSC::PropertyDescriptor::setValue):
+        (JSC::PropertyDescriptor::isEmpty):
+        (JSC::PropertyDescriptor::writablePresent):
+        (JSC::PropertyDescriptor::enumerablePresent):
+        (JSC::PropertyDescriptor::configurablePresent):
+        (JSC::PropertyDescriptor::setterPresent):
+        (JSC::PropertyDescriptor::getterPresent):
+        (JSC::PropertyDescriptor::operator==):
+        (JSC::PropertyDescriptor::):
+
+2009-09-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Build fix to enable ARM_THUMB2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/JITStubs.cpp:
+        * wtf/Platform.h:
+
+2009-09-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Defines two pseudo-platforms for ARM and Thumb-2 instruction set.
+        https://bugs.webkit.org/show_bug.cgi?id=29122
+
+        Introduces WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2
+        macros on ARM platforms. The PLATFORM(ARM_THUMB2) should be used
+        when Thumb-2 instruction set is the required target. The
+        PLATFORM(ARM_TRADITIONAL) is for generic ARM instruction set. In
+        case where the code is common the PLATFORM(ARM) have to be used.
+
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * jit/ExecutableAllocator.h:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::preserveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+
+2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt/Windows CE build.
+
+        * JavaScriptCore.pri: Build the ce_time.cpp functions from
+        within Qt externally.
+        * wtf/DateMath.cpp: Removed unnecessary Qt #ifdef, for the
+        Qt build these functions are no external, too.
+
+2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian/WINSCW build fox.
+
+        Repeat Q_OS_WIN wchar_t hack for WINSCW, similar to
+        revision 24774.
+
+        WINSCW defines wchar_t, thus UChar has to be wchar_t
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian/WINSCW build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29186
+
+        WINSCW Template specialisation name in declaration must the be the same as in implementation.
+
+        * runtime/LiteralParser.h:
+
+2009-09-15  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27060
+
+        Symbian compiler for emulator target (WINSCW) fails with
+        "illegal operand" for m_attributesInPrevious in structure.ccp
+        (when calling make_pair functions).
+        This error is apparently due to the compiler not properly
+        resolving the unsigned type of the declared bitfield.
+
+        Initial patch explicitly casted m_attributesInPrevious
+        to unsigned, but since bitfield optimization is not critical for
+        the emulator target, this conditional change in header file
+        appears to be least intrusive.
+
+        * runtime/Structure.h:
+
+2009-09-16  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Fix GCC warnings on ARM_THUMB2 platform
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=29260
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(CONTEXT_MENUS)
+        https://bugs.webkit.org/show_bug.cgi?id=29225
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        The webkit stdint and stdbool headers exists because
+        the compiler MSVC doesn't include them.  The check
+        should not check for PLATFORM(WIN_OS) but for MSVC.
+
+        * os-win32/stdbool.h:
+        * os-win32/stdint.h:
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=29233
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix after flag was moved to correct place.
+
+        * wscript:
+
+2009-09-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build fix for 64-bit Qt on Mac OS X
+
+        * wtf/Platform.h: Use JSVALUE64 on DARWIN, not only on MAC
+
+2009-09-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix wtf/ThreadSpecific.h under Qt to free thread local objects.
+        https://bugs.webkit.org/show_bug.cgi?id=29295
+
+        This is an important fix when JavaScript workers are in use, since
+        unfreed ThreadGlobalDatas leak a big amount of memory (50-100k each).
+        QThreadStorage calls the destructor of a given object, which is the
+        ThreadSpecific::Data. Unlike pthread, Qt is object oriented, and does
+        not support the calling of a static utility function when the thread
+        is about to close. In this patch we call the ThreadSpecific::destroy()
+        utility function from the destructor of ThreadSpecific::Data. Moreover,
+        since Qt resets all thread local values to 0 before the calling of the
+        appropriate destructors, we set back the pointer to its original value.
+        This is necessary because the get() method of the ThreadSpecific
+        object may be called during the exuction of the destructor.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::ThreadSpecific::Data::~Data):
+        (WTF::::~ThreadSpecific):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Allow anonymous storage inside JSObject
+        https://bugs.webkit.org/show_bug.cgi?id=29168
+
+        Add the concept of anonymous slots to Structures so that it is
+        possible to store references to values that need marking in the
+        standard JSObject storage buffer.  This allows us to reduce the
+        malloc overhead of some objects (by allowing them to store JS
+        values in the inline storage of the object) and reduce the 
+        dependence of custom mark functions (if all an objects children
+        are in the standard object property storage there's no need to
+        mark them manually).
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        (JSC::JSObject::addAnonymousSlots):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::TransitionTable::addSlotTransition):
+        (JSC::StructureTransitionTable::TransitionTable::removeSlotTransition):
+        (JSC::StructureTransitionTable::TransitionTable::getSlotTransition):
+        (JSC::StructureTransitionTable::getAnonymousSlotTransition):
+        (JSC::StructureTransitionTable::addAnonymousSlotTransition):
+        (JSC::StructureTransitionTable::removeAnonymousSlotTransition):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added the ENABLE_MATHML define to the features
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-15 Csaba Osztrogonac <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for windows.
+
+        After http://trac.webkit.org/changeset/47795 the MinGW build broke,
+        because MinGW has __mingw_aligned_malloc instead of _aligned_malloc.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock): MinGW case added.
+        (JSC::Heap::freeBlock): MinGW case added.
+
+2009-09-15  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for Windows/MinGW
+
+        https://bugs.webkit.org/show_bug.cgi?id=29268
+
+        * wtf/Platform.h: JSVALUE32_64 temporarily disabled on PLATFORM(WIN_OS) with COMPILER(MINGW)
+
+2009-09-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Detect VFP at runtime in generic ARM port on Linux platform.
+        https://bugs.webkit.org/show_bug.cgi?id=29076
+
+        * JavaScriptCore.pri:
+        * assembler/MacroAssemblerARM.cpp: Added.
+        (JSC::isVFPPresent):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+
+2009-09-14  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for windows build.
+
+        * JavaScriptCore.pri: Correct a logic error.
+        * pcre/dftables: Add missing paranthesis for tmpdir function.
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build fix for windows exports (again).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build fix for windows exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Correct fix for non-allinonefile builds
+
+        * runtime/ObjectConstructor.cpp:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix non-allinonefile builds
+
+        * runtime/ObjectConstructor.cpp:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        This patch basically requires two separate steps, the first is to split getPropertyNames
+        into two functions -- getOwnPropertyNames and getPropertyNames, basically making them behave
+        in the same way as getOwnPropertySlot and getPropertySlot.  In essence getOwnPropertyNames
+        produces the list of properties on an object excluding its prototype chain and getPropertyNames
+        just iterates the the object and its prototype chain calling getOwnPropertyNames at each level.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * debugger/DebuggerActivation.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSByteArray.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSVariableObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorKeys):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringObject.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::getOwnEnumerablePropertyNames):
+        (JSC::Structure::getEnumerablePropertyNames):
+        * runtime/Structure.h:
+
+2009-09-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        getPropertyNames caching is invalid when the prototype chain contains objects with custom getPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=29214
+
+        Add a flag to TypeInfo to indicate whether a type overrides getPropertyNames.
+        This flag is used to make sure that caching of the property name data is safe.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::hasDefaultGetPropertyNames):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29207
+        Add checks for using WebCore JS context on secondary threads
+
+        * runtime/JSGlobalData.cpp: (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        Added a new mainThreadOnly flag that WebCore would set.
+
+        * runtime/Collector.cpp: (JSC::Heap::registerThread): JSC API methods always call this,
+        so this is a good place to check that the API isn't used form a wrong thread.
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compiling JavaScriptCore on sparc 64 with gcc fails.
+
+        ThreadSafeShared uses the atomic __gnu_cxx::__exchange_and_add with an int,
+        however on sparc 64 the _Atomic_word argument is typedefed to long (8 bytes).
+
+        The patch disables WTF_USE_LOCKFREE_THREADSAFESHARED in ThreadSafeShared to use
+        a mutex instead when compiling for sparc 64 with gcc.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29175
+
+        * wtf/Platform.h:
+        __sparc64__ is not defined on all OS.
+        Uses instead: __sparc__ && __arch64__ || __sparcv9
+        * wtf/Threading.h:
+
+2009-09-11  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compile error on Windows7(64Bit) with latest SDK.
+
+        Added the missing include file.
+
+        * runtime/UString.cpp:
+
+2009-09-11  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Qt/Windows CE compile fix, include the executable allocator and
+        markstack implementation in the windows build.
+
+        * JavaScriptCore.pri:
+
+2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded define for ActiveX.
+        https://bugs.webkit.org/show_bug.cgi?id=29054
+
+        * wtf/Platform.h:
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Update JavaScriptCore and WebKit's FeatureDefines.xcconfig so that they are in sync with WebCore as they need to be.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Export WTF::tryFastMalloc used in WebSocketChannel.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Make StructureTransitionTable use an enum for the PtrAndFlags member
+        used for the single transition slot optimisation.
+
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::StructureTransitionTable):
+        (JSC::StructureTransitionTable::usingSingleTransitionSlot):
+        (JSC::StructureTransitionTable::):
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Refactor StructureTransitionTable and Structure to unify handling of the single slot optimization
+        https://bugs.webkit.org/show_bug.cgi?id=29141
+
+        Make StructureTransitionTable encapsulate the single transition slot optimization.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::StructureTransitionTable::hasTransition):
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::StructureTransitionTable):
+        (JSC::StructureTransitionTable::~StructureTransitionTable):
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+        (JSC::StructureTransitionTable::table):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::usingSingleTransitionSlot):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        (JSC::StructureTransitionTable::setTransitionTable):
+        (JSC::StructureTransitionTable::):
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+
+2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Implement fastDeleteSkippingDestructor for FastAllocBase and fastDeleteAllValues for HashSet
+        https://bugs.webkit.org/show_bug.cgi?id=25930
+
+        FastAllocBase has been extended with fastDeleteSkippingDestructor function which
+        releases memory without destructor call. fastDeleteAllValues has been implemented 
+        similar as deleteAllValues but it uses fastDelete function to release memory.
+
+        * wtf/FastAllocBase.h:
+        (WTF::fastDeleteSkippingDestructor):
+        * wtf/HashSet.h:
+        (WTF::fastDeleteAllValues):
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        ARM compiler does not understand GCC visibility attribute
+        https://bugs.webkit.org/show_bug.cgi?id=29079
+
+        * API/JSBase.h: Make the test more specific to hit only
+        the GCC compiler
+
+2009-09-10  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed revert of the previous change.  It broke the tests.
+
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+
+2009-09-10  Ben Laurie  <benl@google.com>
+
+        Reviewed by Adam Barth.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26836>
+
+        If dtoa was given a small buffer and the number was either infinite or
+        NaN, then the buffer would be overflowed.
+
+        * wtf/dtoa.cpp:
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Change reinterpret_cast to static_cast in r48212.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove WTF_PLATFORM_FORCE_PACK as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=29066
+
+        * wtf/Platform.h:
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Implement flushing the instruction cache for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29075
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush): Call IMB_Range to flush
+        the instruction cache on Symbian
+
+2009-09-09  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29024
+        Make JavaScriptCore compile on platforms with case-insensitive file systems and typeinfo.h in STL
+
+        These platforms include Microsoft Visual Studio 2003, and Symbian with Metrowerks compiler.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSTypeInfo.h: Copied from JavaScriptCore/runtime/TypeInfo.h.
+        * runtime/Structure.h:
+        * runtime/TypeInfo.h: Removed.
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSON.stringify(Date) loses the milliseconds information
+        https://bugs.webkit.org/show_bug.cgi?id=29063
+
+        Make sure we include milliseconds in the output of toISOString.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, generate derived sources earlier in order to make sure
+        they're found by the build system when generating the list of sources to build.
+
+        * wscript:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build fix when USE(LOCKFREE_THREADSAFESHARED) is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=29011
+
+        * wtf/Threading.h: Use LOCKFREE_THREADSAFESHARED guard for 
+        atomicIncrement and atomicDecrement
+
+2009-09-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control in Yarr's RegexInterpreter
+        https://bugs.webkit.org/show_bug.cgi?id=29025
+
+        Inherits RegexInterpreter classes from FastAllocBase (bug #20422), which has
+        been instantiated by 'new':
+
+        class ByteDisjunction
+        -> instantiated in JavaScriptCore/yarr/RegexInterpreter.cpp:1462
+
+        struct BytecodePattern
+        -> instantiated in JavaScriptCore/yarr/RegexInterpreter.cpp:1279
+
+        * yarr/RegexInterpreter.h:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reverting r48121 to fix Windows build errors.
+
+        * JavaScriptCore.exp:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Export WTF::tryFastMalloc used in WebSocketChannel.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+
+        * JavaScriptCore.exp:
+
+2009-09-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix windows export files
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [[ToString]] conversion should use the actual toString function for String objects.
+
+        Remove incorrect specialisations of toString conversions on StringObject.
+
+        * JavaScriptCore.exp:
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+
+2009-09-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Add new export.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Add new export.
+
+2009-09-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove unneeded export.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Remove unneeded export.
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        DateInstance object collected on ARM JIT (JSValue: WTF_USE_JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=28909
+
+        Part two.
+
+        Make some improvements to garbage collection code:
+
+            1) Create a runtime assertion that catches any classes that
+               override markChildren but have the HasDefaultMark bit set.
+            2) Remove checks of the mark bit outside the MarkStack::append
+               function; they are redundant.
+            3) Improve the efficiency of the asObject and asArray functions
+               when called on JSCell* to avoid a round trip to JSValue.
+            4) Make more callers use the checked asCell and asObject
+               casting functions rather than unchecked casts.
+            5) Removed the JSCell::marked function and other GC-related
+               functions because these operations are no longer things that
+               code other than the core GC code needs to do directly. Fixed
+               callers that were calling them.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively): Removed unneeded call to MarkStack::drain.
+        (JSC::Heap::markProtectedObjects): Removed unneeded check of the mark
+        bit and call to MarkStack::drain.
+        (JSC::Heap::collect): Removed unneeded checks of the mark bit and also
+        changed call to SmallStrings::mark to call markChildren instead to match
+        the rest of the objects.
+        (JSC::typeName): Removed unneeded cast to JSObject*.
+
+        * runtime/JSArray.h:
+        (JSC::asArray): Added an overload for JSCell* and changed the JSValue
+        version to call it. Removed some unneeded casts.
+        (JSC::JSArray::markChildrenDirect): Marked this function inline. It's in
+        a header, and if not marked inline this could lead to linking problems.
+        (JSC::MarkStack::markChildren): Added. This helper function is used by
+        the drain function to avoid repating code. Also added the code here to
+        check fro default mark violations in debug code. If a markChildren
+        function adds something to the mark stack, but the type info claimed
+        hasDefaultMark was true, then we will get an assertion now. Also fixed
+        the assertion about the mark bit to use the Heap function directly
+        because we don't have a JSCell::marked function any more.
+        (JSC::MarkStack::drain): Changed a local variable from "v" to "value",
+        and from "currentCell" to "cell". Changed to call markChildren in two
+        places instead of repeating a chain of if statements twice. Changed
+        code that reads and writes the mark bit to use Heap::isCellMarked and
+        Heap::markCell so we can eliminate the JSCell::marked and
+        JSCell::markCellDirect functions.
+
+        * runtime/JSCell.h: Removed JSCell's markCellDirect and marked member
+        functions. Added a comment explaining that asCell should be deprecated
+        in favor of the JSValue asCell member function.
+        (JSC::MarkStack::append): Added the assertion that catches callers
+        that have set the HasDefaultMark bit incorrectly. Changed
+        code that reads and writes the mark bit to use Heap::isCellMarked and
+        Heap::markCell so we can eliminate the JSCell::marked and
+        JSCell::markCellDirect functions. Moved the overload of
+        MarkStack::append for JSValue here so it can call through to the cell
+        version. The old version had a copy of all the code instead, but that
+        repeated the conversion from JSValue to JSCell* and the check for
+        whether a value is a cell multiple times.
+        (JSC::Structure::markAggregate): Moved this function here to avoid
+        dependencies for Structure.h, since this calls MarkStack::append.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren): Added code to clear
+        m_isCheckingForDefaultMarkViolation so the marking done by JSObject
+        doesn't trigger the assertion.
+
+        * runtime/JSValue.h: Moved some stray includes that were outside the
+        header guard inside it. Not sure how that happened! Removed the
+        GC-related member functions markChildren, hasChildren, marked, and
+        markDirect.
+
+        * runtime/JSWrapperObject.h: Made markChildren private.
+        (JSC::JSWrapperObject::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set.
+
+        * runtime/MarkStack.h: Added m_isCheckingForDefaultMarkViolation and
+        initialized it to false. Moved the append function body from here to
+        JSCell.h. Added a declaration of a private markChildren function used
+        inside the drain function.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Changed the name and style of this
+        function to match other functions. This allows us to share the normal
+        mark stack code path.
+
+        * runtime/SmallStrings.h: Changed the name and interface of mark to
+        the more-normal markChildren style.
+
+        * runtime/Structure.h: Moved the body of markAggregate into the
+        JSCell.h to avoid a circular dependency with JSCell.h.
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        DateInstance object collected on ARM JIT (JSValue: WTF_USE_JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=28909
+
+        Part one.
+
+        Make some improvements to garbage collection code:
+
+            1) Fix the two classes that had the default mark bit set but
+               should not.
+            2) Remove checks of the mark bit outside the MarkStack::append
+               function; they are redundant.
+            3) Make more callers use the checked asCell and asObject
+               casting functions rather than unchecked casts.
+            4) Removed some GC-related functions because these operations are
+               no longer things that code other than the core GC code needs
+               to do directly. Fixed callers that were calling them.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate): Removed unneeded check of the mark
+        bit before calling MarkStack::append.
+
+        * interpreter/Register.h: Removed unneeded marked and markChildren
+        functions.
+
+        * jit/JITStubs.cpp:
+        (op_eq): Removed unneeded assertions, instead using checked casting
+        functions such as asObject.
+
+        * runtime/ArgList.h: Added now-needed forward declaration of MarkStack.
+
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren): Remmoved unneeded check of the mark bit.
+
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set.
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getObject): Use asObject to avoid a direct static_cast.
+
+        * runtime/JSObject.h:
+        (JSC::asObject): Added an overload for JSCell* and changed the JSValue
+        version to call it.
+        (JSC::JSValue::get): Use asObject to avoid a direct static_cast.
+
+        * runtime/JSWrapperObject.h: Made markChildren private.
+        (JSC::JSWrapperObject::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set. Later we may want to optimize this for
+        wrapper types that never have cells in their internal values, but there
+        is no measured performance regression in SunSpider or V8 doing this
+        all the time.
+
+        * runtime/MarkStack.cpp: Tweaked formatting.
+
+2009-09-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switch USE_ defines over to the compiler so that they can be
+        checked by files not including config.h (like WebCorePrefix.h).
+
+        * wtf/Platform.h:
+
+2009-09-03  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Remove unnecessary dependency on unistd.h
+        https://bugs.webkit.org/show_bug.cgi?id=28962
+
+        * runtime/Completion.cpp:
+
+2009-09-03  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add strnstr for Linux and Windows in StringExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=28901
+
+        * wtf/StringExtras.h:
+        (strnstr):
+
+2009-09-03  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's HashEntry class
+        https://bugs.webkit.org/show_bug.cgi?id=27830
+
+        Inherits HashEntry class from FastAllocBase because it has been
+        instantiated by 'new' JavaScriptCore/runtime/Lookup.cpp:32.
+
+        * runtime/Lookup.h:
+
+2009-09-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Should crash if JIT code buffer allocation fails.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28926
+        <rdar://problem/7031922>
+
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorWin.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * wscript:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for building on Windows.
+
+        * wtf/ThreadingPthreads.cpp:
+
+2009-09-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Use fastMalloc when neither MMAP nor VIRTUALALLOC are enabled
+        
+        RegisterFile constructor currently throws #error when both
+        MMAP and VIRTUALALLOC conditions fail.
+        On any platform that does not provide these features
+        (for instance, Symbian),
+        the fallback should be regular malloc (or fastMalloc).
+        It is functionally equivalent in this case, even though it may
+        have certain drawbacks such as lack of dynamic pre-allocation.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+
+2009-08-31  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed typo.
+        https://bugs.webkit.org/show_bug.cgi?id=28691
+
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSON Stringifier does not follow ES5 spec for handling of Number, String and Boolean objects
+        https://bugs.webkit.org/show_bug.cgi?id=28797
+
+        Fixed unwrapBoxedPrimitive to do the right thing, which necessitated a couple of new exception
+        checks, and corrected the logic in gap to correctly convert Number and String objects.
+
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive):
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        JSON.stringify replacer array does not accept values that are not string primitives.
+        https://bugs.webkit.org/show_bug.cgi?id=28788
+
+        Update the JSON stringifier to initialise its replacer array according to the most
+        recent version of the spec.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::from):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28753
+        <rdar://problem/7173448> Excessive number of threads (and a crash)
+
+        * wtf/Threading.h: (WTF::atomicIncrement): Changed atomicIncrement to match decrement
+        and return the new value. Also added using directives for these functions, to match
+        te rest of WTF.
+
+2009-08-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Link the testapi against CFLite when building the WinCairo port.
+
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add new Release_CFLite
+          target.  Update all targets to inherit from either the
+          JavaScriptCF.vsprops (Apple target) or the JavaScriptCFLite.vsprops
+          file (WinCairo target).
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Remove
+          input file CoreFoundation.lib. This is provided by either the
+          JavaScriptCF.vsprops or JavaScriptCFLite.vsprops file.
+
+2009-08-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        Fix Windows-specific crash due to missing memory clearing call.
+        
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+
+2009-08-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix: JavaScriptCore_debug.def missing some exports.  Apple
+        Windows build does not use this file, so it was not noticed previously.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        x86-64 GTK broken due to code offsets changing, pointers sometimes packed into immediates.
+        https://bugs.webkit.org/show_bug.cgi?id=28317
+
+        Missed one, fix part II.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        * assembler/X86Assembler.h:
+        (JSC::CAN_SIGN_EXTEND_8_32):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        JSON.stringify replacer array does not accept values that are not string primitives.
+        https://bugs.webkit.org/show_bug.cgi?id=28788
+
+        Update the JSON stringifier to initialise its replacer array according to the most
+        recent version of the spec.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::from):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JSON parser accepts trailing comma in array literals
+        https://bugs.webkit.org/show_bug.cgi?id=28779
+
+        Update parser to correctly fail if there's a trailing comma.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        'this' in JSON.parse reviver is the global object
+        https://bugs.webkit.org/show_bug.cgi?id=28752
+
+        This is a technically simple change, we merely update the code for calling
+        the reviver function to pass the correct this object.  Doing so however
+        exposes the holder to arbitrary mutation by the reviver function so it is
+        necessary for us to now guard all property accesses against the possibility
+        of failure.
+
+        * runtime/JSArray.h:
+          JSON needs to delete a property from the array, so we friend its 
+          Walker class so that we can make a non-virtual call to the arrays
+          delete and getOwnPropertySlot methods.
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::callReviver):
+          We need to pass the correct this object
+        (JSC::Walker::walk):
+          Update calls to callReviver, and update property logic logic
+          to correctly handle the holder being mutated by the reviver
+          function.
+
+2009-08-26  Alice Liu  <alice.liu@apple.com>
+
+        Windows build fix: added some exported symbols
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed some exported symbols that no longer exist.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliejver Hunt.
+
+        x86-64 GTK broken due to code offsets changing, pointers sometimes packed into immediates.
+        https://bugs.webkit.org/show_bug.cgi?id=28317
+
+        We rely on a slightly OS X specific behaviour, that x86-64 applications have a 4Gb zero page,
+        so pointers are never representable as a 32-bit integer, and always have to be represented by
+        a separate immediate load instruction, rather than within the immediate field of an arithmetic
+        or memory operation.
+
+        We explicitly check for a couple of cases where a value might be representable in 32-bit, but
+        these probably never kick in on Mac OS, and only kick in to hose GTK.  Deleting these does not
+        show a performance degradation on SunSpider.  Remove.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A bit of Collector refatoring.
+        
+        SunSpider says no change. v8 says 1.003x faster (1.02x faster on splay).
+
+        * JavaScriptCore.exp:
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toPrimitive):
+        (JSC::JSCell::getPrimitiveNumber):
+        (JSC::JSCell::toBoolean):
+        (JSC::JSCell::toNumber):
+        (JSC::JSCell::toString):
+        (JSC::JSCell::toObject): Removed pure virtual functions from
+        JSCell, so the collector can construct one. This allowed
+        me to remove a bunch of ASSERT_NOT_REACHED throughout the
+        code, too.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell): ditto
+        (JSC::Heap::heap): Inlined this function because it's trivial.
+
+        * JavaScriptCore.exp:
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks): Renamed freeHeap to freeBlocks, since
+        it doesn't actually free the Heap object.
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::sweep):
+        * runtime/Collector.h: Refactored block allocation and destruction
+        into helper functions.
+        
+        * runtime/GetterSetter.cpp:
+        * runtime/JSAPIValueWrapper.cpp:
+        * runtime/JSPropertyNameIterator.cpp: Removed dummy implementations
+        of pure virtual functions. (See above.)
+
+=== End re-roll-in of r47738:47740 with Windows crash fixed ===
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: start out with a 32-bit value to avoid a shortening warning.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::sweep):
+
+2009-08-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Substantially reduced VM thrash in the GC heap.
+        
+        1.08x faster on v8 (1.60x faster on v8-splay).
+        
+        1.40x faster on bench-alloc-nonretained.
+        
+        1.90x faster on bench-alloc-retained.
+        
+        SunSpider says no change.
+        
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate): Fixed a long-standing bug: update a few local
+        variables unconditionally after calling collect(), since they may be used
+        even if we don't "goto scan". (In the bug I saw, usedBlocks got out of
+        sync with heap.usedBlocks).
+        (JSC::Heap::sweep): Keep enough free heap space to accomodate 
+        the number of objects we'll allocate before the next GC, plus 25%, for
+        good measure.
+        * runtime/Collector.h: Bumped the block size to 256k. This seems to give
+        the best cache performance, and it prevents us from initiating lots of
+        VM traffic to recover very small chunks of memory.
+
+=== Begin re-roll-in of r47738:47740 with Windows crash fixed ===
+
+2009-08-25  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        postMessage() spec now supports sending arrays of ports
+        https://bugs.webkit.org/show_bug.cgi?id=26902
+
+        Added OwnPtr to VectorTraits so we can store OwnPtrs in Vectors.
+
+        * wtf/VectorTraits.h:
+
+2009-08-26  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Remove duplicated files from file list.
+
+        * GNUmakefile.am:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More export fixes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Hopefully fix all the exports from JSC on windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fixes).
+
+        Forgot I added files to JavaScriptCore. 
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+
+2009-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=28724
+
+        Implement the core runtime support for getOwnPropertyDescriptor.
+        This adds a virtual getOwnPropertyDescriptor method to every class
+        that implements getOwnPropertySlot that shadows the behaviour of
+        getOwnPropertySlot.  The alternative would be to make getOwnPropertySlot
+        (or PropertySlots in general) provide property attribute information,
+        but quick testing showed this to be a regression.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertyDescriptor):
+        * runtime/ArrayPrototype.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertyDescriptor):
+        * runtime/DatePrototype.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyDescriptor):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyDescriptor):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        (JSC::JSONObject::getOwnPropertyDescriptor):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::JSObject::getPropertyDescriptor):
+        * runtime/JSObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        (JSC::JSString::getOwnPropertyDescriptor):
+        * runtime/JSString.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/JSVariableObject.h:
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertyDescriptor):
+        (JSC::getStaticFunctionDescriptor):
+        (JSC::getStaticValueDescriptor):
+          Add property descriptor equivalents of the lookup
+          table access functions
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        (JSC::MathObject::getOwnPropertyDescriptor):
+        * runtime/MathObject.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertyDescriptor):
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/PropertyDescriptor.cpp: Added.
+        (JSC::PropertyDescriptor::writable):
+        (JSC::PropertyDescriptor::enumerable):
+        (JSC::PropertyDescriptor::configurable):
+        (JSC::PropertyDescriptor::hasAccessors):
+        (JSC::PropertyDescriptor::setUndefined):
+        (JSC::PropertyDescriptor::getter):
+        (JSC::PropertyDescriptor::setter):
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        * runtime/PropertyDescriptor.h: Added.
+        (JSC::PropertyDescriptor::PropertyDescriptor):
+        (JSC::PropertyDescriptor::attributes):
+        (JSC::PropertyDescriptor::isValid):
+        (JSC::PropertyDescriptor::value):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertyDescriptor):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+        * runtime/RegExpObject.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyDescriptor):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::getOwnPropertyDescriptor):
+        * runtime/StringPrototype.h:
+
+2009-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        How many copies of the parameters do you need?
+        https://bugs.webkit.org/show_bug.cgi?id=28701
+
+        The function parameters in JSC get copied a lot - and unnecessarily so.
+
+        Originally this happened due to duplicating FunctionBodyNodes on recompilation,
+        though the problem has been exacerbated by copying the parameters from the
+        original function body onto the executable, then back onto the real body that
+        will be generated (this happens on every function).  And this is all made worse
+        since the data structures in question are a little ugly - C style arrays of C++
+        objects containing ref counts, so they need a full copy-construct (rather than
+        a simple memcpy).
+
+        This can all be greatly simplified by just punting the parameters off into
+        their own ref-counted object, and forgoing all the copying.
+
+        ~no performance change, possible slight progression.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::finishParsing):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::parameters):
+        (JSC::FunctionBodyNode::parameterCount):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::FunctionExecutable::compile):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::FunctionExecutable::paramString):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::parameterCount):
+
+2009-08-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by NOBODY (Buildfix).
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add Debug_CFLite target
+          that inherits from the debug_wincairo property sheet and therefore
+          links to the proper debug library.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add Debug_CFLite target
+          that inherits from the debug_wincairo property sheet and therefore
+          links to the proper debug library.
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Export tryFastMalloc for Canvas3D work
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * JavaScriptCore.exp:
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        PLATFORM(CFNETWORK) should be USE(CFNETWORK).
+        https://bugs.webkit.org/show_bug.cgi?id=28713
+
+        * wtf/Platform.h: Added a #define to catch this issue in the
+        future. The define would generate an error on gcc without the
+        space in the expansion, but Visual C++ needs the space to cause an error.
+
+2009-08-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Revise CFLite Debug build to emit DLL's with _debug label.
+        https://bugs.webkit.org/show_bug.cgi?id=28695.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Modify
+          Cairo debug build to inherit from new debug_cairo property sheet.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops:
+          Modify to look for debug CFLite when in debug build.
+
+2009-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Adler & Darin Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28691
+        Do not retain ScopeNodes outside of parsing
+        
+        There is now no need for these to exist outside of parsing - their use in the runtime is replaced by Executable types.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::adoptData):
+        (JSC::FunctionBodyNode::parameterCount):
+        * parser/Parser.cpp:
+        * parser/Parser.h:
+        (JSC::Parser::arena):
+        (JSC::Parser::Parser):
+        (JSC::Parser::parse):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        (JSC::arrayProtoFuncSort):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compile):
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCode):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::FunctionExecutable::copyParameters):
+        (JSC::FunctionExecutable::paramString):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::sourceID):
+        (JSC::ScriptExecutable::sourceURL):
+        (JSC::ScriptExecutable::lineNo):
+        (JSC::ScriptExecutable::lastLine):
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::ScriptExecutable::recordParse):
+        (JSC::EvalExecutable::bytecode):
+        (JSC::EvalExecutable::jitCode):
+        (JSC::ProgramExecutable::bytecode):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        (JSC::ProgramExecutable::jitCode):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::make):
+        (JSC::FunctionExecutable::bytecode):
+        (JSC::FunctionExecutable::isGenerated):
+        (JSC::FunctionExecutable::name):
+        (JSC::FunctionExecutable::parameterCount):
+        (JSC::FunctionExecutable::jitCode):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-08-24  Darin Adler  <darin@apple.com>
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put): Landed revised version I had tested but forgot
+        to land. Leave out the branch, since we don't need one.
+
+2009-08-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Array index miss case creates a string every time
+        https://bugs.webkit.org/show_bug.cgi?id=28664
+
+        SunSpider test results I saw:
+
+            0.5% faster overall
+            1% faster on crypto-aes
+            20% faster on crypto-md5
+            13% faster on crypto-sha1
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype): Initialize m_hasNoPropertiesWithUInt32Names
+        to true.
+        (JSC::ObjectPrototype::put): Clearly m_hasNoPropertiesWithUInt32Names if the new
+        property has a name that is the string form of a UInt32.
+        (JSC::ObjectPrototype::getOwnPropertySlot): Don't call JSObject::getOwnPropertySlot
+        if m_hasNoPropertiesWithUInt32Names is true, and it is highly likely to be true.
+
+        * runtime/ObjectPrototype.h: Added declarations for the above.
+
+2009-08-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Fix a typo in my distcheck build fix.
+
+        * GNUmakefile.am:
+
+2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix for make distcheck.
+
+        * GNUmakefile.am: Added files required for the build.
+
+2009-08-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        REGRESSION(r47639-r47660): Webkit crashes on launch on PowerPC
+        https://bugs.webkit.org/show_bug.cgi?id=28655
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction): Initialize properly with a VPtrHackExecutable.
+        * wtf/Platform.h:
+
+2009-08-22  Darin Adler  <darin@apple.com>
+
+        Fix storage leak from syntax tree arena allocation patch.
+
+        * parser/Nodes.h: CommaNode needs to inherit from ParserArenaDeletable
+        because it has a vector.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData): Made non-inline again.
+        This is used outside Nodes.cpp so can't be inline unless
+        it is in the header.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Two loose ends from the last commit.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made ParserArena.h
+        and create_hash_table project-internal instead of "private".
+        * runtime/Executable.h: Removed accidentally-added constructor.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Use an actual arena now. 0.6% speedup on SunSpider.
+
+        New and improved with 100% less leaking of the universe.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed all exports involving the class FunctionBodyNode, which no
+        longer needs to be used outside JavaScriptCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made Nodes.h and
+        Executable.h project-internal instead of "private".
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Updated since VarStack
+        contains const Identifier* now.
+
+        * parser/Grammar.y: Made identifiers from the lexer be const
+        Identifier* and updated since VarStack contains const Identifier* now.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Pass in ParserArena, used for identifiers.
+        (JSC::Lexer::makeIdentifier): Changed return type to const Identifier*
+        and changed to call ParserArena.
+        (JSC::Lexer::clear): Removed the code to manage m_identifiers and
+        added code to set m_arena to 0.
+        * parser/Lexer.h: Updated for changes above.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaFreeable::operator new): Added. Calls allocateFreeable
+        on the arena.
+        (JSC::ParserArenaDeletable::operator new): Changed to call the
+        allocateDeletable function on the arena instead of deleteWithArena.
+        (JSC::PropertyNode::PropertyNode): Added new constructor that makes
+        numeric identifiers. Some day we might want to optimize this for
+        integers so it doesn't create a string for each one.
+        (JSC::ContinueNode::ContinueNode): Initialize m_ident to nullIdentifier
+        since it's now a const Identifier& so it can't be left uninitialized.
+        (JSC::BreakNode::BreakNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Updated to use SourceElements*
+        to keep track of the statements rather than a separate statement vector.
+        (JSC::BlockNode::BlockNode): Ditto.
+        (JSC::ForInNode::ForInNode): Initialize m_ident to nullIdentifier.
+
+        * parser/Nodes.cpp: Moved the comment explaining emitBytecode in here.
+        It seemed strangely out of place in the header.
+        (JSC::ThrowableExpressionData::emitThrowError): Added an overload for
+        UString as well as Identifier.
+        (JSC::SourceElements::singleStatement): Added.
+        (JSC::SourceElements::lastStatement): Added.
+        (JSC::RegExpNode::emitBytecode): Changed the throwError code to use
+        the substitution mechanism instead of doing a string append.
+        (JSC::SourceElements::emitBytecode): Added. Replaces the old
+        statementListEmitCode function, since we now keep the SourceElements
+        objects around.
+        (JSC::BlockNode::lastStatement): Added.
+        (JSC::BlockNode::emitBytecode): Changed to use emitBytecode instead of
+        statementListEmitCode.
+        (JSC::CaseClauseNode::emitBytecode): Added.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Changed to use emitBytecode
+        instead of statementListEmitCode.
+        (JSC::ScopeNodeData::ScopeNodeData): Changed to store the
+        SourceElements* instead of using releaseContentsIntoVector.
+        (JSC::ScopeNode::emitStatementsBytecode): Added.
+        (JSC::ScopeNode::singleStatement): Added.
+        (JSC::ProgramNode::emitBytecode): Call emitStatementsBytecode instead
+        of statementListEmitCode.
+        (JSC::EvalNode::emitBytecode): Ditto.
+        (JSC::FunctionBodyNode::emitBytecode): Call emitStatementsBytecode
+        insetad of statementListEmitCode and check for the return node using
+        the new functions.
+
+        * parser/Nodes.h: Changed VarStack to store const Identifier* instead
+        of Identifier and rely on the arena to control lifetime. Added a new
+        ParserArenaFreeable class. Made ParserArenaDeletable inherit from
+        FastAllocBase instead of having its own operator new. Base the Node
+        class on ParserArenaFreeable. Changed the various Node classes
+        to use const Identifier& instead of Identifier to avoid the need to
+        call their destructors and allow them to function as "freeable" in the
+        arena. Removed extraneous JSC_FAST_CALL on definitions of inline functions.
+        Changed ElementNode, PropertyNode, ArgumentsNode, ParameterNode,
+        CaseClauseNode, ClauseListNode, and CaseBlockNode to use ParserArenaFreeable
+        as a base class since they do not descend from Node. Eliminated the
+        StatementVector type and instead have various classes use SourceElements*
+        instead of StatementVector. This prevents those classes from having to
+        use ParserArenaDeletable to make sure the vector destructor is called.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Pass the arena to the lexer.
+
+        * parser/Parser.h: Added an include of ParserArena.h, which is no longer
+        included by Nodes.h.
+        (JSC::Parser::parseFunctionFromGlobalCode): Changed to use the
+        singleStatement function, since there is no longer any children function.
+        Removed some unneeded use of RefPtr.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena): Added. Initializes the new members,
+        m_freeableMemory, m_freeablePoolEnd, and m_identifiers.
+        (JSC::ParserArena::freeablePool): Added. Computes the pool pointer,
+        since we store only the current pointer and the end of pool pointer.
+        (JSC::ParserArena::deallocateObjects): Added. Contains the common
+        memory-deallocation logic used by both the destructor and the
+        reset function.
+        (JSC::ParserArena::~ParserArena): Changed to call deallocateObjects.
+        (JSC::ParserArena::reset): Ditto. Also added code to zero out the
+        new structures, and switched to use clear() instead of shrink(0) since
+        we don't really reuse arenas.
+        (JSC::ParserArena::makeNumericIdentifier): Added.
+        (JSC::ParserArena::allocateFreeablePool): Added. Used when the pool
+        is empty.
+        (JSC::ParserArena::isEmpty): Added. No longer inline, which is fine
+        since this is used only for assertions at the moment.
+        (JSC::ParserArena::derefWithArena): Make non-inline.
+
+        * parser/ParserArena.h: Added an actual arena of "freeable" objects,
+        ones that don't need destructors to be called. Also added a separate
+        IdentifierArena object, a segmented vector of identifiers that used
+        to be in the Lexer.
+
+        * runtime/Executable.h: Moved the definition of the
+        FunctionExecutable::make function here. It can't go in JSFunction.h
+        since that header has to be used outside JavaScriptCore and so can't
+        include this, which includes Nodes.h. The function could be moved
+        elswhere if we don't want to include JSFunction.h in this header, but
+        for now this seems to be the best place.
+
+        * runtime/JSFunction.h: Removed the include of Executable.h and
+        definition of the FunctionExecutable::make function.
+
+        * wtf/FastMalloc.cpp: Fixed an incorrect comment.
+
+2009-08-21  Mark Rowe  <mrowe@apple.com>
+
+        Fix the non-JIT build.
+
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative QuickTime build fix.
+
+        * runtime/JSArray.cpp:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative QT build fix.
+
+        * runtime/StringPrototype.cpp:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restructure Executable types so that host functions do not hold a FunctionExecutable.
+        https://bugs.webkit.org/show_bug.cgi?id=28621
+
+        All JSFunction objects have a pointer to an Executable*.  This is currently always a
+        FunctionExecutable, however this has a couple of drawbacks.  Host functions do not
+        store a range of information that the FunctionExecutable provides (source, name,
+        CodeBlock & information presently held on the FunctionBodyNode). 
+
+        [ * nearly all... see below! ]
+
+        Instead, make JSFunctions hold a pointer to an ExecutableBase, move fields specific
+        to JS sourced executable types (source, node) into a new subclass (ScriptExecutable),
+        and create a new NativeExecutable type.  We now provide a new method in JSFunction
+        to access & downcast to FunctionExecutable, but in doing so we can make an early
+        check (with an ASSERT) to ensure that the Executable read from a function will only
+        be treated as a FunctionExecutable (and thus the JS sepcific fields will only be
+        accessed) if the JSFunction is not a host function.
+
+        There is one JSFunction that currently does not have an Executable, which is the
+        object created to allow us to read out the vtable pointer.  By making this change
+        we can also add a new Executable type fror this object (VPtrHackExecutable).
+        Since this means that really all JSFunctions have an Executable we no longer have
+        to null-check m_executable before us it - particularly in isHostFunction().
+
+        This patch removes CacheableEvalExecutable, since all subclasses of ExecutableBase
+        can now be ref-counted - since both JSFunction holds (and ref-counts) an ExecutableBase
+        that might be a FunctionExecutable or a NativeExecutable.  This does now mean that all
+        ProgramExecutables and EvalExecutables (unnecessarily) provide an interface to be
+        ref-counted, however this seems less-bad than host functions unnecessarily providing
+        interface to access non-host specific information.
+
+        The class hierarcy has changed from this:
+        
+        - ExecutableBase
+            - ProgramExecutable
+            - EvalExecutable
+                - CacheableEvalExecutable (also RefCounted by multiple-inheritance)
+            - FunctionExecutable (also RefCounted by multiple-inheritance, 'special' FunctionExecutable also used for host functions)
+
+        To this:
+        
+        - RefCounted
+            - ExecutableBase
+                - NativeExecutable
+                - VPtrHackExecutable
+                - ScriptExecutable
+                    - ProgramExecutable
+                    - EvalExecutable
+                    - FunctionExecutable
+
+        This patch speeds up sunspidey by a couple of ms (presumably due to the changes to isHostFunction()).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/Profiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments):
+        * runtime/Executable.cpp:
+        (JSC::NativeExecutable::~NativeExecutable):
+        (JSC::VPtrHackExecutable::~VPtrHackExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::~ExecutableBase):
+        (JSC::ExecutableBase::isHostFunction):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::VPtrHackExecutable::VPtrHackExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::source):
+        (JSC::ScriptExecutable::sourceID):
+        (JSC::ScriptExecutable::sourceURL):
+        (JSC::ScriptExecutable::lineNo):
+        (JSC::ScriptExecutable::lastLine):
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::executable):
+        (JSC::JSFunction::jsExecutable):
+        (JSC::JSFunction::isHostFunction):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Browser hangs on opening Web Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=28438
+
+        Code generation needs to be able to walk the entire scopechain in some
+        cases, however the symbol table used by activations was a member of the
+        codeblock.  Following recompilation this may no longer exist, leading
+        to a crash or hang on lookup.
+
+        We fix this by introducing a refcounted SymbolTable subclass, SharedSymbolTable,
+        for the CodeBlocks used by function code.  This allows activations to
+        maintain ownership of a copy of the symbol table even after recompilation so
+        they can continue to work.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::symbolTable):
+        (JSC::CodeBlock::sharedSymbolTable):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::FunctionCodeBlock::~FunctionCodeBlock):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArguments):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::generateBytecode):
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        (JSC::JSActivation::JSActivationData::~JSActivationData):
+        * runtime/SymbolTable.h:
+
+2009-08-20  Xan Lopez  <xlopez@igalia.com>
+
+        Add new file to GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-08-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added a number => string cache.
+        
+        1.07x faster on v8 (1.7x faster on v8-splay).
+        1.004x faster on SunSpider.
+
+        * runtime/JSCell.h: Moved JSValue::toString to JSString.h.
+        * runtime/JSGlobalData.h: Holds the cache.
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toString):
+        (JSC::JSNumberCell::toThisString): Removed -0 special case.
+        UString handles this now, since too many clients were
+        special-casing it.
+
+        * runtime/JSString.h:
+        (JSC::JSValue::toString): Use the cache when converting
+        an int or double to string.
+
+        * runtime/Operations.h:
+        (JSC::concatenateStrings): Call toString to take advantage
+        of the cache.
+
+        * runtime/SmallStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookup): The cache.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from): Added -0 special case mentioned above.
+        Removed appendNumeric because it's mutually exclusive with the
+        cache.
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: fast/profiler/call.html is crashing occasionally
+        https://bugs.webkit.org/show_bug.cgi?id=28476
+
+        Using the codeblock for information about how many parameters and
+        locals a function has is unsafe in certain circumstances.  The
+        basic scenario is all function code being cleared in response to
+        the debugger or profiler being enabled, and then an activation is
+        marked before its associated function is re-executed.
+
+        To deal with this scenario we store the variable count of a function
+        directly in the FunctionExecutable, and then use that information.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::generateBytecode):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::variableCount):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+
+2009-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Numbering of arguments to emitGetJITStubArg/emitPutJITStubArg incorrect
+        <bug lost in the great bug disasteroony of 08/20/09!>
+
+        The argumentNumber argument to emitGetJITStubArg/emitPutJITStubArg should match
+        the argument number used within the stub functions in JITStubs.cpp, but it doesn't.
+
+        Firstly, all the numbers changed when we added a void* 'reserved' as the first slot
+        (rather than leaving argument 0 unused), and secondly in 32_64 builds the index to
+        peek/poke needs to be multiplies by 2 (since the argument to peek/poke is a number
+        of machine words, and on 32_64 build the argument slots to stub functions are two
+        words wide).
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION: significant slowdown on Celtic Kane "AJAX declaration" subtest
+        https://bugs.webkit.org/show_bug.cgi?id=28332
+
+        Follow up style fixes that were missed in review.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::StructureTransitionTable::contains):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::add):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Add new exports to windows jsc build
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: significant slowdown on Celtic Kane "AJAX declaration" subtest
+        https://bugs.webkit.org/show_bug.cgi?id=28332
+
+        The method check optimisation made transitions aware of the value being
+        assigned when a transition was assigning a function.  This had the side
+        effect of making every assignment of a function expression result in a
+        new transition, and thus a new Structure.  The net result of this is that
+        the common JS idiom of
+
+            function MyObject() {
+                this.myFunction = function(...){...};
+            }
+            new MyObject();
+
+        Will produce a unique structure on every iteration, meaning that all
+        caching is defeated and there is a significant amount of structure churn.
+
+        The fix is to return the transition to its original form where it is
+        keyed off a property name + attributes tuple, but have each transition
+        support an optional transition on a specific value.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::transitionedFor):
+        (JSC::Structure::hasTransition):
+        (JSC::Structure::):
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHashTraits::emptyValue):
+        (JSC::StructureTransitionTable::hasTransition):
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+
+2009-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove FunctionCodeBlock.
+        https://bugs.webkit.org/show_bug.cgi?id=28502
+
+        These only exist to allow JIT code to dereference properties off the
+        CodeBlock for any callee, regardless of whether it is a host function.
+
+        Instead just use the FunctionExecutable.  Copy the m_parameters field
+        from the CodeBlock into the Executable, and use this to distinguish
+        between host functions, functions that have been bytecompiled, and
+        functions that have not.
+
+        m_parameters is moved to ExecutableBase rather than FunctionExecutable
+        so that (as a separate change) we can move make a separate class of
+        executable for host code, which is not devived from FunctionExecutable
+        (host code does not feature any of the properties that normal executable
+        do and will provide, such as source, attributes, and a parsed name).
+
+        1% win on v8 tests, 0.5% on sunspider.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CodeBlock::source):
+        (JSC::CodeBlock::sourceOffset):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::createRareDataIfNecessary):
+        
+            remove NativeCodeBlocks and the NativeCode code type.
+        
+        * jit/JIT.cpp:
+        (JSC::JIT::linkCall):
+
+            Revert to previous behaviour (as currently still commented!) that Hhost functions have a null codeblock.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+
+            Bring the 32_64 & non-32_64 JITs into line with each other, callee in regT0.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+            Rewrite call trampolines to not use the CodeBlock.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+            Make call_JSFunction & call_arityCheck return the callee, don't expect to be passed the CodeBlock.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::):
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::FunctionExecutable::isHostFunction):
+
+            Add m_numParameters.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+
+            Only call generatedBytecode() on JSFunctions non-host FunctionExecutables.
+
+2009-08-20  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+       
+        Use a helper function to work around winscw compiler forward declaration bug
+        regarding templated classes.
+
+        Add parenthesis around (PassRefPtr::*UnspecifiedBoolType) to make winscw compiler
+        work with the default UnSpecifiedBoolType() operator, which removes the winscw
+        specific bool cast hack.
+
+        * wtf/PassRefPtr.h:
+        (WTF::derefIfNotNull):
+        (WTF::PassRefPtr::~PassRefPtr):
+
+2009-08-19  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Change namespace ARM to ARMRegisters
+        X86 to X86Registers to avoid conflict with macros
+        https://bugs.webkit.org/show_bug.cgi?id=28428
+
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes.cpp:
+        * wrec/WRECGenerator.cpp:
+        * wrec/WRECGenerator.h:
+        * yarr/RegexJIT.cpp:
+
+2009-08-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        We actually need to mark the value in a number object if we're using the
+        32bit number representation.
+
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+
+2009-08-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+         We probably shouldn't be keeping the AST for eval nodes around forevar.
+        https://bugs.webkit.org/show_bug.cgi?id=28469
+
+        EvalNodes don't destroyData() (delete their parser data) since they need to hold onto
+        their varStack.  Copy a list of variable onto EvalCodeBlock, and this can go away.
+
+        * bytecode/CodeBlock.h:
+        (JSC::EvalCodeBlock::variable):
+        (JSC::EvalCodeBlock::numVariables):
+        (JSC::EvalCodeBlock::adoptVariables):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::generateBytecode):
+        * runtime/Executable.h:
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        http://bugs.webkit.org/show_bug.cgi?id=28441
+
+        Fix a build issue with ICU 4.2 or later on Windows with Visual C++. 
+        Instead of defining all isXXX and toupper/tolower as 
+          WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h,
+        #define them to be different by prepending 'WTF_...ASCIIType_h' with
+        the originial names like 'toupper_WTF_...ASCIIType_h'. 
+
+        * wtf/DisallowCType.h:
+
+2009-08-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Assigning a function to an object should always use the existing transition, even if the transition is not specialized
+        https://bugs.webkit.org/show_bug.cgi?id=28442
+
+        Check for an unspecialized transition as an alternative to always failing if specialisation does not match.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+
+2009-08-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Added additional getter to ByteArray with an unsigned char as return.
+        ByteArray can take unsigned char directly now.
+
+        * wtf/ByteArray.h:
+        (WTF::ByteArray::set):
+        (WTF::ByteArray::get):
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        
+2009-08-18  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-08-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        No, silly runtime, AST nodes are not for you.
+
+        We still use AST nodes (ScopeNodes, particularly FunctionBodyNodes) within
+        the runtime, which means that these nodes must be persisted outside of the
+        arena, contain both parser & runtime data, etc.  This is all a bit of a mess.
+
+        Move functionality into a new FunctionExecutable class.
+
+        * API/JSCallbackFunction.cpp:
+        * API/JSObjectRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::markAggregate):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::discardBytecode):
+        (JSC::CodeBlock::instructionCount):
+        (JSC::CodeBlock::getJITCode):
+        (JSC::CodeBlock::executablePool):
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::CodeBlock::extractExceptionInfo):
+        (JSC::CodeBlock::addFunctionDecl):
+        (JSC::CodeBlock::functionDecl):
+        (JSC::CodeBlock::numberOfFunctionDecls):
+        (JSC::CodeBlock::addFunctionExpr):
+        (JSC::CodeBlock::functionExpr):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::NativeCodeBlock::NativeCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrameClosure.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::debug):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_new_func_exp):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::reparseDataIfNecessary):
+        * parser/Nodes.h:
+        (JSC::EvalNode::partialDestroyData):
+        * parser/Parser.h:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments):
+        (JSC::JSActivation::copyRegisters):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/CallData.h:
+        (JSC::):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/ConstructData.h:
+        (JSC::):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        * runtime/Executable.cpp: Added.
+        (JSC::EvalExecutable::generateBytecode):
+        (JSC::ProgramExecutable::generateBytecode):
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCode):
+        (JSC::FunctionExecutable::isHostFunction):
+        (JSC::FunctionExecutable::markAggregate):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::~ExecutableBase):
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::source):
+        (JSC::ExecutableBase::sourceID):
+        (JSC::ExecutableBase::lastLine):
+        (JSC::ExecutableBase::usesEval):
+        (JSC::ExecutableBase::usesArguments):
+        (JSC::ExecutableBase::needsActivation):
+        (JSC::ExecutableBase::astNode):
+        (JSC::ExecutableBase::generatedJITCode):
+        (JSC::ExecutableBase::getExecutablePool):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::bytecode):
+        (JSC::EvalExecutable::varStack):
+        (JSC::EvalExecutable::evalNode):
+        (JSC::EvalExecutable::jitCode):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        (JSC::ProgramExecutable::bytecode):
+        (JSC::ProgramExecutable::programNode):
+        (JSC::ProgramExecutable::jitCode):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::name):
+        (JSC::FunctionExecutable::bytecode):
+        (JSC::FunctionExecutable::generatedBytecode):
+        (JSC::FunctionExecutable::usesEval):
+        (JSC::FunctionExecutable::usesArguments):
+        (JSC::FunctionExecutable::parameterCount):
+        (JSC::FunctionExecutable::paramString):
+        (JSC::FunctionExecutable::isGenerated):
+        (JSC::FunctionExecutable::body):
+        (JSC::FunctionExecutable::jitCode):
+        (JSC::FunctionExecutable::createNativeThunk):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::isDynamicScope):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::isHostFunction):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::executable):
+        (JSC::FunctionExecutable::make):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalData.h:
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix 300,000+ leaks seen during the regression tests.
+
+        EvalCodeCache::get was heap-allocating an EvalExecutable instance without adopting the initial reference.
+        While fixing this we noticed that EvalExecutable was a RefCounted type that was sometimes stack allocated.
+        To make this cleaner and to prevent clients from attempting to ref a stack-allocated instance, we move the
+        refcounting down to a new CacheableEvalExecutable class that derives from EvalExecutable. EvalCodeCache::get
+        now uses CacheableEvalExecutable::create and avoids the leak.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * runtime/Executable.h:
+        (JSC::CacheableEvalExecutable::create):
+        (JSC::CacheableEvalExecutable::CacheableEvalExecutable):
+
+2009-08-17  Oliver Hunt  <oliver@apple.com>
+
+        RS=Mark Rowe.
+
+        REGRESSION (r47292): Prototype.js is broken by ES5 Arguments changes
+        https://bugs.webkit.org/show_bug.cgi?id=28341
+        <rdar://problem/7145615>
+
+        Reverting r47292.  Alas Prototype.js breaks with Arguments inheriting
+        from Array as ES5 attempted.  Prototype.js defines $A in terms of a 
+        function it places on (among other global objects) the Array prototype,
+        thus breaking $A for arrays.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * tests/mozilla/ecma_3/Function/arguments-001.js:
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+
+2009-08-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix build with FAST_MALLOC_MATCH_VALIDATION enabled.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastRealloc):
+
+2009-08-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix crash on ./ecma_2/RegExp/exec-002.js.
+        https://bugs.webkit.org/show_bug.cgi?id=28353
+
+        Change the order of freeParenthesesDisjunctionContext and
+        popParenthesesDisjunctionContext on all call sites as the pop
+        method is accessing backTrack->lastContext which is the context
+        that is about to be freed.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+
+2009-08-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28352
+
+        Fix coding style violations. Use m_ for C++ class members. Remove
+        trailing whitespace on empty lines.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::tryConsumeCharacter):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::popParenthesesStack):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::alterantiveBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2009-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build with JIT disabled.
+
+        * runtime/Arguments.h: Only compile the jitCode method when the JIT is enabled.
+        * runtime/Executable.h: Include PrototypeFunction.h so the compiler knows what
+        NativeFunctionWrapper is when the JIT is disabled.
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added ENABLE_EVENTSOURCE flag.
+        https://bugs.webkit.org/show_bug.cgi?id=14997
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-14  Gavin Barraclough  <barraclough@apple.com>
+
+        * parser/Parser.h:
+        (JSC::EvalExecutable::parse):
+        (JSC::ProgramExecutable::parse):
+        * runtime/Executable.h:
+
+2009-08-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove AST nodes from use within the Runtime (outside of parsing), stage 1
+        https://bugs.webkit.org/show_bug.cgi?id=28330
+
+        Remove the EvalNode and ProgramNode from use in the runtime.  They still exist
+        after this patch, but are hidden behind EvalExecutable and FunctionExecutable,
+        and are also still reachable behind CodeBlock::m_ownerNode.
+
+        The next step will be to beat back FunctionBodyNode in the same fashion.
+        Then remove the usage via CodeBlock, then only construct these nodes only on
+        demand during bytecode generation.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::GlobalCodeBlock::~GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::NativeCodeBlock::NativeCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::execute):
+        * interpreter/Interpreter.h:
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateBytecode):
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        (JSC::Parser::reparse):
+        (JSC::Parser::parseFunctionFromGlobalCode):
+        (JSC::::parse):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Error.cpp:
+        (JSC::throwError):
+        * runtime/Error.h:
+        * runtime/Executable.h: Added.
+        (JSC::TemplateExecutable::TemplateExecutable):
+        (JSC::TemplateExecutable::markAggregate):
+        (JSC::TemplateExecutable::sourceURL):
+        (JSC::TemplateExecutable::lineNo):
+        (JSC::TemplateExecutable::bytecode):
+        (JSC::TemplateExecutable::jitCode):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::codeBlocks):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::arrayConstructorIsArray): Removed unneeded isObject call
+        and updated remaining isObject call to new name, inherits.
+
+        * runtime/JSCell.h: Renamed isObject(<class>) to inherits(<class>)
+        but more importantly, made it non-virtual (it was already inline)
+        so it is now as fast as JSObject::inherits was.
+
+        * runtime/JSObject.h: Removed inherits function since the one
+        in the base class is fine as-is. Also made various JSCell functions
+        that should not be called on JSObject uncallable by making them
+        both private and not implemented.
+        (JSC::JSCell::inherits): Updated name.
+        (JSC::JSValue::inherits): Ditto.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncConcat):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSValue.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChain::localDepth):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSplit):
+        Updated to new name, inherits, from old name, isObject.
+
+2009-07-31  Harald Fernengel  <harald.fernengel@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Adding QNX as a platform. Currently only tested with Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27885
+
+        * JavaScriptCore/runtime/Collector.cpp: Added retrieving of stack base
+          since QNX doesn't have the pthread _nt functions
+        * JavaScriptCore/wtf/Platform.h: Added WTF_PLATFORM_QNX and corresponding
+          defines
+        * WebCore/bridge/npapi.h: Build fix for missing typedefs on QNX
+
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Currently generic ARM and ARMv7 platforms work only with JSVALUE32
+        https://bugs.webkit.org/show_bug.cgi?id=28300
+
+        * wtf/Platform.h:
+
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Enable JIT on ARM for QT by default
+        https://bugs.webkit.org/show_bug.cgi?id=28259
+
+        * wtf/Platform.h:
+
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Enable YARR_JIT on ARM for QT by default
+        https://bugs.webkit.org/show_bug.cgi?id=28259
+
+        * wtf/Platform.h:
+
+2009-08-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Arguments object should inherit from Array
+        https://bugs.webkit.org/show_bug.cgi?id=28298
+
+        Make the Arguments object conform to the behaviour specified in ES5.
+        The simple portion of this is to make Arguments use Array.prototype
+        as its prototype rather than Object.prototype.
+
+        The spec then requires us to set instance.constructor to the pristine
+        Object constructor, and instance.toString and instance.toLocaleString
+        to the pristine versions from Object.prototype.  To do this we now 
+        make the ObjectPrototype constructor return its toString and
+        toLocaleString functions (similar to the call and apply functions
+        from FunctionPrototype).
+
+        Oddly enough this reports itself as a slight win, but given the code
+        isn't hit in the tests that claim to have improved I put this down to
+        code motion.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::initializeStandardProperties):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::objectConstructor):
+        (JSC::JSGlobalObject::objectToStringFunction):
+        (JSC::JSGlobalObject::objectToLocaleStringFunction):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * tests/mozilla/ecma_3/Function/arguments-001.js:
+          Update test to new es5 behaviour
+
+2009-08-14  Oliver Hunt  <oliver@apple.com>
+
+        Remove MarkStack::drain from the JSC exports file
+
+        MarkStack::drain is now marked inline, the including it in the exports file
+        produces an ld warning
+
+        * JavaScriptCore.exp:
+
+2009-08-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove accidentally left in debugging statement.
+
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Array.isArray
+        https://bugs.webkit.org/show_bug.cgi?id=28296
+
+        Add support for Array.isArray to the Array constructor
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::arrayConstructorIsArray):
+        * runtime/ArrayConstructor.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Attempt to fix windows build
+
+        * runtime/Collector.cpp:
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        Add a bit to TypeInfo to indicate that an object uses the standard
+        JSObject::markChildren method.  This allows us to devirtualise marking
+        of most objects (though a branch is still needed).  We also add a branch
+        to identify arrays thus devirtualising marking in that case as well.
+
+        In order to make the best use of this devirtualisation I've also reworked
+        the MarkStack::drain() logic to make the iteration more efficient.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * JavaScriptCore.exp:
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::markChildren):
+        * runtime/JSArray.h:
+        (JSC::JSArray::markChildrenDirect):
+        (JSC::MarkStack::drain):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::MarkStack::append):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        (JSC::JSObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSType.h:
+        (JSC::):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::MarkSet::MarkSet):
+        (JSC::MarkStack::MarkStackArray::last):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/TypeInfo.h:
+        (JSC::TypeInfo::hasDefaultMark):
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Some small bits of housekeeping.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make Parser.h
+        project instead of private. Remove JSONObject.lut.h.
+
+        * assembler/ARMAssembler.h: Remove unneeded WTF prefix.
+        * assembler/AssemblerBufferWithConstantPool.h: Ditto.
+        * bytecompiler/BytecodeGenerator.h: Ditto.
+
+        * wtf/SegmentedVector.h: Add a "using" statement as we do
+        with the other WTF headers.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Fix Tiger build.
+
+        * parser/Grammar.y: Use a template function so we can compile
+        setStatementLocation even if it comes before YYLTYPE is defined.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Too much use of void* in Grammar.y
+        https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Changed all the helper functions to
+        take a JSGlobalData* instead of a void*. A couple formatting
+        tweaks that I missed when breaking this into pieces.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Reduced and sorted includes. Tweaked comment
+        format. Marked a few more functions inline.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Pass the number to the PropertyNode instead of
+        first turning it into an Identifier.
+
+        * parser/NodeConstructors.h:
+        (JSC::PropertyNode::PropertyNode): Add an overload that takes a double
+        so the code to convert to a string can be here instead of Grammar.y.
+        * parser/Nodes.h: Ditto.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Eliminate the DBG macro.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Eliminate the SET_EXCEPTION_LOCATION macro.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        George asked me to break the patch from
+        https://bugs.webkit.org/show_bug.cgi?id=28287
+        into smaller pieces and land it in stages.
+
+        * parser/Grammar.y: Eliminate the LEXER macro.
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try some more to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export a new symbol.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Ditto.
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export a new symbol.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Ditto.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        JavaScriptCore tweaks to get ready for the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=28243
+
+        Eliminate dependencies on Nodes.h outside JavaScriptCore,
+        and cut down on them inside JavaScriptCore.
+
+        Change regular expression parsing to use identifiers as
+        with other strings we parse.
+
+        Fix a couple things that are needed to use const Identifier
+        more, which will be part of the parser arena work.
+
+        * JavaScriptCore.exp: Resorted and updated.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Changed
+        CollectorHeapIterator.h to be project-internal.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushNewScope): Added const.
+        * bytecompiler/BytecodeGenerator.h: Ditto.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Moved this function
+        here from WebCore. Here is better since it uses so many internals.
+        Removed unimportant optimization for the no listener case.
+        * debugger/Debugger.h: Ditto. Also removed unneeded include
+        and tweaked formatting and comments.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName): Call asFunction instead
+        of doing the unchecked static_cast.
+        (JSC::DebuggerCallFrame::calculatedFunctionName): Ditto.
+
+        * jit/JITStubs.cpp:
+        (JSC::op_call_JSFunction): Call isHostFunction on the body rather
+        than on the JSFunction.
+        (JSC::vm_lazyLinkCall): Ditto.
+        (JSC::op_construct_JSConstruct): Ditto.
+
+        * parser/Grammar.y: Changed callers to use new scanRegExp with
+        out arguments instead of relying on state in the Lexer. And
+        callers that just want to skip a regular expression to use
+        skipRegExp.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::scanRegExp): Changed to use out arguments, and to
+        add a prefix argument so we can add in the "=" character as needed.
+        Also rewrote to streamline the logic a bit inspired by suggestions
+        by David Levin.
+        (JSC::Lexer::skipRegExp): Added. Version of the function above that
+        does not actually put the regular expression into a string.
+        (JSC::Lexer::clear): Removed code to clear m_pattern and m_flags.
+        * parser/Lexer.h: Changed scanRegExp to have out arguments. Added
+        skipRegExp. Eliminated pattern, flags, m_pattern, and m_flags.
+
+        * parser/NodeConstructors.h:
+        (JSC::RegExpNode::RegExpNode): Changed to take const Identifier&.
+        * parser/Nodes.cpp:
+        (JSC::RegExpNode::emitBytecode): Changed since m_pattern and
+        m_flags are now Identifier instead of UString.
+        (JSC::FunctionBodyNode::make): Moved this function here instead
+        of putting it in the JSFunction.h header.
+        * parser/Nodes.h: Changed RegExpNode to use Identifier.
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier): Changed to use isHostFunction
+        on the body instead of on the JSFunction object.
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Ditto.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::isHostFunction): Moved here from header.
+        (JSC::JSFunction::isHostFunctionNonInline): Added.
+        (JSC::JSFunction::JSFunction): Removed unneeded initialization of
+        m_body to 0.
+        (JSC::JSFunction::setBody): Moved here from header.
+
+        * runtime/JSFunction.h: Removed unneeded includes. Moved private
+        constructor down to the private section. Made virtual functions
+        private. Removed unneeded overload of setBody and moved the body
+        of the function into the .cpp file. Changed assertions to use
+        the non-inline version of isHostFunction.
+
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter): Use asFunction instead
+        of doing the unchecked static_cast.
+
+        * wtf/SegmentedVector.h:
+        (WTF::SegmentedVector::isEmpty): Added.
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Use the version of operator new that takes a JSGlobalData when allocating FuncDeclNode and FuncExprNode
+        from within the grammar to prevent these nodes from being leaked.
+
+        * parser/Grammar.y:
+
+2009-08-13  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Remove the special-case for Qt wrt JSVALUE_32 introduced in
+        r46709. It must've been a dependency issue on the bot, as
+        after a manual build all the tests pass on amd64 and ia32.
+
+        * wtf/Platform.h:
+
+2009-08-12  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add optimize call and property access support for ARM JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        For tightly coupled sequences the BEGIN_UNINTERRUPTED_SEQUENCE and
+        END_UNINTERRUPTED_SEQUENCE macros have been introduced which ensure
+        space for instructions and constants of the named sequence. This
+        method is vital for those architecture which are using constant pool.
+
+        The 'latePatch' method - which was linked to JmpSrc - is replaced with
+        a port specific solution (each calls are marked to place their address
+        on the constant pool).
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::linkBranch):
+        (JSC::ARMAssembler::executableCopy): Add extra align for constant pool.
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::JmpSrc::JmpSrc):
+        (JSC::ARMAssembler::sizeOfConstantPool):
+        (JSC::ARMAssembler::jmp):
+        (JSC::ARMAssembler::linkCall):
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::flushIfNoSpaceFor): Fix the
+        computation of the remaining space.
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::ensureSpace):
+        (JSC::MacroAssemblerARM::sizeOfConstantPool):
+        (JSC::MacroAssemblerARM::prepareCall):
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::endUninterruptedSequence):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Dave Kilzer.
+
+        Disable WTF_USE_JSVALUE32_64 on iPhone for now (support not yet added for ARMv7).
+
+        * wtf/Platform.h:
+
+2009-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachoviak.
+
+        Ooops - moved code that had been accidentally added to op_new_func instead of
+        op_new_func_exp, to where it shoulds be.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * wtf/Platform.h:
+
+2009-08-12  Ada Chan  <adachan@apple.com>
+
+        Added workaround for the limitation that VirtualFree with MEM_RELEASE
+        can only accept the base address returned by VirtualAlloc when the region
+        was reserved and it can only free the entire region, and not a part of it.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackWin.cpp:
+        (JSC::MarkStack::releaseStack):
+
+2009-08-12  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Ariya Hidayat.
+
+        Build fix: use std::numeric_limits<long long>::min() instead of LLONG_MIN
+        since LLONG_MIN is not defined in standard c++.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+
+2009-08-12  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Buildfix for Gtk platforms debug builds.
+
+        * GNUmakefile.am: Choose MarkStackPosix.cpp or MarkStackWin.cpp
+        depending on platform.
+
+2009-08-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective build fix for Mac and 32-bit Windows.
+
+        * runtime/UString.cpp: Include wtf/StringExtras.h for snprintf.
+        (JSC::UString::from): Use %lld instead of %I64d for snprintf
+        on non-windows platforms.
+
+2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compile error on 64Bit Windows, when UString::from
+        is called with an intptr_t.
+
+        Added new UString::From overload with long long parameter.
+
+        Thanks to Holger for the long long idea.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+        * runtime/UString.h:
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Minor style fixes.
+
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        * wtf/FastMalloc.h:
+        (WTF::TryMallocReturnValue::getValue):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Jump through a few hoops to make it much harder to accidentally
+        miss null-checking of values returned by the try-* allocation
+        routines.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::allocChars):
+        (JSC::reallocChars):
+        (JSC::expandCapacity):
+        (JSC::UString::Rep::reserveCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::createRep):
+        (JSC::concatenate):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+        (WTF::TCMallocStats::tryFastMalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        * wtf/FastMalloc.h:
+        (WTF::TryMallocReturnValue::TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::~TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::operator PossiblyNull<T>):
+        (WTF::TryMallocReturnValue::getValue):
+        * wtf/Platform.h:
+        * wtf/PossiblyNull.h: Added.
+        (WTF::PossiblyNull::PossiblyNull):
+        (WTF::PossiblyNull::~PossiblyNull):
+        (WTF::::getValue):
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix part deux).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restrict use of FuncDeclNode & FuncExprNode to the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=28209
+
+        These objects were also being referenced from the CodeBlock.  By changing this
+        to just retain pointers to FunctionBodyNodes these classes can be restricted to
+        use during parsing.
+
+        No performance impact (or sub-percent progression).
+
+        * JavaScriptCore.exp:
+            Update symbols.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::mark):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFunction):
+        (JSC::CodeBlock::function):
+            Unify m_functions & m_functionExpressions into a single Vector<RefPtr<FuncExprNode> >.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+            FunctionStacks now contain FunctionBodyNodes not FuncDeclNodes.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+            Update to reflect chnages in CodeBlock.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func_exp):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+            Update to reflect chnages in CodeBlock.
+
+        * parser/Grammar.y:
+            FunctionStacks now contain FunctionBodyNodes not FuncDeclNodes.
+
+        * parser/NodeConstructors.h:
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::mark):
+        (JSC::FunctionBodyNode::finishParsing):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::ident):
+            Move m_ident & make methods from FuncDeclNode & FuncExprNode to FunctionBodyNode.
+
+        * runtime/JSFunction.h:
+        (JSC::FunctionBodyNode::make):
+            Make this method inline (was FuncDeclNode::makeFunction).
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Native JSON.stringify does not omit functions
+        https://bugs.webkit.org/show_bug.cgi?id=28117
+
+        Objects that are callable should be treated as undefined when
+        serialising to JSON.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION: Hang/crash in BytecodeGenerator::constRegisterFor loading simple page
+        https://bugs.webkit.org/show_bug.cgi?id=28169
+
+        Handle the case where someone has attempted to shadow a property
+        on the global object with a constant.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::constRegisterFor):
+        * parser/Nodes.cpp:
+        (JSC::ConstDeclNode::emitCodeSingle):
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25463
+
+        Adds ENABLE_NOTIFICATION flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Modifications on JavaScriptCore to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28121
+
+        * runtime/Collector.cpp: Haiku doesn't have sys/mman.h, using OS.h instead.
+        (JSC::currentThreadStackBase): Haiku uses its own threading system.
+        * wtf/Platform.h: Defining all Haiku platform values.
+        * wtf/haiku/MainThreadHaiku.cpp: Adding a missing header (NotImplemented.h).
+
+2009-08-11  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Buildfix for Qt-win platforms.
+
+        * JavaScriptCore.pri: Choose MarkStackPosix.cpp or MarkStackWin.cpp depend on platform.
+
 2009-08-10  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by NOBODY (And another build fix).
@@ -19,8 +5074,6 @@
 
 2009-08-10  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         Add includes needed for non-allinonefile builds
 
         * runtime/GetterSetter.h:
@@ -28,16 +5081,12 @@
 
 2009-08-10  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         Fix export file for last build fix
 
         * JavaScriptCore.exp:
 
 2009-08-10  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         Hoist page size initialization into platform specific code.
 
         * jit/ExecutableAllocatorPosix.cpp:
@@ -608,8 +5657,6 @@
 
 2009-08-04  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (build fix).
-
         PPC64 Build fix
 
         * wtf/Platform.h:
@@ -864,8 +5911,6 @@
 
 2009-07-30  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by NOBODY (build fix).
-
         Temporarily revert r46618 since this is b0rking on Linux.
 
 2009-07-23  Gavin Barraclough  <barraclough@apple.com>
@@ -3901,8 +8946,6 @@
 
 2009-07-20  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         Build fix attempt #2
 
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
@@ -3910,8 +8953,6 @@
 
 2009-07-20  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         Build fix attempt #1
 
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
@@ -4927,8 +9968,6 @@
 
 2009-07-09  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         * interpreter/Interpreter.cpp:
         (JSC::Interpreter::privateExecute):
 
@@ -5563,8 +10602,6 @@
 
 2009-06-21  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         Remove dead code.
 
         * runtime/LiteralParser.cpp:
diff --git a/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 10328e8..ed387aa 100644
--- a/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -28,6 +28,10 @@
 
 // Set any ENABLE_FEATURE_NAME macro to an empty string to disable that feature.
 
+ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(MAC_OS_X_VERSION_MAJOR));
+ENABLE_3D_CANVAS_1050 = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS_1060 = ENABLE_3D_CANVAS;
+
 ENABLE_3D_RENDERING = $(ENABLE_3D_RENDERING_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_RENDERING_1050 = ENABLE_3D_RENDERING;
 ENABLE_3D_RENDERING_1060 = ENABLE_3D_RENDERING;
@@ -35,14 +39,18 @@ ENABLE_3D_RENDERING_1060 = ENABLE_3D_RENDERING;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_DATABASE = ENABLE_DATABASE;
 ENABLE_DATAGRID = ENABLE_DATAGRID;
+ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
+ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
 ENABLE_FILTERS = ;
 ENABLE_GEOLOCATION = ;
 ENABLE_ICONDATABASE = ENABLE_ICONDATABASE;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_MATHML = ;
+ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
 ENABLE_RUBY = ENABLE_RUBY;
-ENABLE_SHARED_WORKERS = ;
+ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_ANIMATION = ENABLE_SVG_ANIMATION;
 ENABLE_SVG_AS_IMAGE = ENABLE_SVG_AS_IMAGE;
@@ -57,4 +65,4 @@ ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DOM_STORAGE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/JavaScriptCore/Configurations/Version.xcconfig b/JavaScriptCore/Configurations/Version.xcconfig
index d07d57f..66d574b 100644
--- a/JavaScriptCore/Configurations/Version.xcconfig
+++ b/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 0;
+MINOR_VERSION = 2;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/JavaScriptCore/GNUmakefile.am b/JavaScriptCore/GNUmakefile.am
index 6b4dc6d..32e2642 100644
--- a/JavaScriptCore/GNUmakefile.am
+++ b/JavaScriptCore/GNUmakefile.am
@@ -96,8 +96,6 @@ javascriptcore_sources += \
 	JavaScriptCore/bytecode/JumpTable.cpp \
 	JavaScriptCore/bytecode/JumpTable.h \
 	JavaScriptCore/bytecode/EvalCodeCache.h \
-	JavaScriptCore/runtime/ExceptionHelpers.cpp \
-	JavaScriptCore/runtime/ExceptionHelpers.h \
 	JavaScriptCore/bytecode/Instruction.h \
 	JavaScriptCore/bytecompiler/Label.h \
 	JavaScriptCore/interpreter/Interpreter.cpp \
@@ -173,8 +171,10 @@ javascriptcore_sources += \
 	JavaScriptCore/interpreter/CallFrame.cpp \
 	JavaScriptCore/interpreter/CallFrame.h \
 	JavaScriptCore/interpreter/CallFrameClosure.h \
-	JavaScriptCore/runtime/TimeoutChecker.cpp \
-	JavaScriptCore/runtime/TimeoutChecker.h \
+	JavaScriptCore/runtime/ExceptionHelpers.cpp \
+	JavaScriptCore/runtime/ExceptionHelpers.h \
+	JavaScriptCore/runtime/Executable.cpp \
+	JavaScriptCore/runtime/Executable.h \
 	JavaScriptCore/runtime/InitializeThreading.cpp \
 	JavaScriptCore/runtime/InitializeThreading.h \
 	JavaScriptCore/runtime/JSActivation.cpp \
@@ -193,7 +193,9 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/LiteralParser.h \
 	JavaScriptCore/runtime/MarkStack.cpp \
 	JavaScriptCore/runtime/MarkStack.h \
-	JavaScriptCore/runtime/MarkStackPosix.cpp \
+	JavaScriptCore/runtime/NumericStrings.h \
+	JavaScriptCore/runtime/PropertyDescriptor.h \
+	JavaScriptCore/runtime/PropertyDescriptor.cpp \
 	JavaScriptCore/runtime/SmallStrings.cpp \
 	JavaScriptCore/runtime/SmallStrings.h \
 	JavaScriptCore/runtime/Structure.cpp \
@@ -201,7 +203,9 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/StructureChain.cpp \
 	JavaScriptCore/runtime/StructureChain.h \
 	JavaScriptCore/runtime/StructureTransitionTable.h \
-	JavaScriptCore/runtime/TypeInfo.h \
+	JavaScriptCore/runtime/TimeoutChecker.cpp \
+	JavaScriptCore/runtime/TimeoutChecker.h \
+	JavaScriptCore/runtime/JSTypeInfo.h \
 	JavaScriptCore/wrec/CharacterClass.h \
 	JavaScriptCore/wrec/CharacterClassConstructor.h \
 	JavaScriptCore/wrec/Escapes.h \
@@ -252,6 +256,7 @@ javascriptcore_sources += \
 	JavaScriptCore/wtf/PassOwnPtr.h \
 	JavaScriptCore/wtf/PassRefPtr.h \
 	JavaScriptCore/wtf/Platform.h \
+	JavaScriptCore/wtf/PossiblyNull.h \
 	JavaScriptCore/wtf/PtrAndFlags.h \
 	JavaScriptCore/wtf/RandomNumber.cpp \
 	JavaScriptCore/wtf/RandomNumber.h \
@@ -288,10 +293,12 @@ javascriptcore_sources += \
 if TARGET_WIN32
 javascriptcore_sources += \
 	JavaScriptCore/wtf/ThreadSpecificWin.cpp \
-	JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+	JavaScriptCore/jit/ExecutableAllocatorWin.cpp \
+	JavaScriptCore/runtime/MarkStackWin.cpp
 else
 javascriptcore_sources += \
-	JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+	JavaScriptCore/jit/ExecutableAllocatorPosix.cpp \
+	JavaScriptCore/runtime/MarkStackPosix.cpp
 endif
 
 # ----
@@ -439,9 +446,6 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/JSWrapperObject.h \
 	JavaScriptCore/runtime/Lookup.cpp \
 	JavaScriptCore/runtime/Lookup.h \
-	JavaScriptCore/runtime/MarkStack.cpp \
-	JavaScriptCore/runtime/MarkStack.h \
-	JavaScriptCore/runtime/MarkStackWin.cpp \
 	JavaScriptCore/runtime/MathObject.cpp \
 	JavaScriptCore/runtime/MathObject.h \
 	JavaScriptCore/runtime/NativeErrorConstructor.cpp \
diff --git a/JavaScriptCore/JavaScriptCore.exp b/JavaScriptCore/JavaScriptCore.exp
index 3a2acd7..2934655 100644
--- a/JavaScriptCore/JavaScriptCore.exp
+++ b/JavaScriptCore/JavaScriptCore.exp
@@ -95,32 +95,34 @@ __ZN3JSC10Identifier24checkSameIdentifierTableEPNS_12JSGlobalDataEPNS_7UString3R
 __ZN3JSC10Identifier24checkSameIdentifierTableEPNS_9ExecStateEPNS_7UString3RepE 
 __ZN3JSC10Identifier3addEPNS_9ExecStateEPKc
 __ZN3JSC10Identifier5equalEPKNS_7UString3RepEPKc
-__ZN3JSC10JSFunction4infoE
-__ZN3JSC10JSFunctionC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RKNS_7ArgListEE
+__ZN3JSC10JSFunctionC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RKNS_7ArgListEE
 __ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeE
 __ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
 __ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringE
 __ZN3JSC11JSByteArray15createStructureENS_7JSValueE
-__ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
+__ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
 __ZN3JSC11ParserArena5resetEv
 __ZN3JSC11checkSyntaxEPNS_9ExecStateERKNS_10SourceCodeE
 __ZN3JSC12DateInstance4infoE
+__ZN3JSC12DateInstanceC1EPNS_9ExecStateEd
 __ZN3JSC12JSGlobalData10ClientDataD2Ev
 __ZN3JSC12JSGlobalData12createLeakedEv
+__ZN3JSC12JSGlobalData12stopSamplingEv
+__ZN3JSC12JSGlobalData13startSamplingEv
+__ZN3JSC12JSGlobalData14dumpSampleDataEPNS_9ExecStateE
 __ZN3JSC12JSGlobalData14sharedInstanceEv
 __ZN3JSC12JSGlobalData6createEb
 __ZN3JSC12JSGlobalDataD1Ev
-__ZN3JSC12SamplingTool4dumpEPNS_9ExecStateE
 __ZN3JSC12SamplingTool5setupEv
 __ZN3JSC12SmallStrings17createEmptyStringEPNS_12JSGlobalDataE
 __ZN3JSC12StringObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3JSC12StringObject14toThisJSStringEPNS_9ExecStateE
-__ZN3JSC12StringObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
 __ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
 __ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC12StringObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC12StringObject24getOwnPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC12StringObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSC12StringObject4infoE
-__ZN3JSC12StringObjectC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEERKNS_7UStringE
+__ZN3JSC12StringObjectC2EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_7UStringE
 __ZN3JSC12jsNumberCellEPNS_9ExecStateEd
 __ZN3JSC12nonInlineNaNEv
 __ZN3JSC13SamplingFlags4stopEv
@@ -129,53 +131,60 @@ __ZN3JSC13SamplingFlags7s_flagsE
 __ZN3JSC13StatementNode6setLocEii
 __ZN3JSC13jsOwnedStringEPNS_12JSGlobalDataERKNS_7UStringE
 __ZN3JSC14JSGlobalObject10globalExecEv
-__ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
-__ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
+__ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectEj
+__ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectEj
 __ZN3JSC14JSGlobalObject12markChildrenERNS_9MarkStackE
 __ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
+__ZN3JSC14JSGlobalObject25destroyJSGlobalObjectDataEPv
 __ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE  
 __ZN3JSC14JSGlobalObject4initEPNS_8JSObjectE
 __ZN3JSC14JSGlobalObjectD2Ev
 __ZN3JSC14JSGlobalObjectnwEmPNS_12JSGlobalDataE
 __ZN3JSC14SamplingThread4stopEv
 __ZN3JSC14SamplingThread5startEj
+__ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
 __ZN3JSC14TimeoutChecker5resetEv
-__ZN3JSC14constructArrayEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC15createTypeErrorEPNS_9ExecStateEPKc
 __ZN3JSC15JSWrapperObject12markChildrenERNS_9MarkStackE
 __ZN3JSC15toInt32SlowCaseEdRb
-__ZN3JSC16FunctionBodyNode13finishParsingEPNS_10IdentifierEm
-__ZN3JSC16FunctionBodyNode14copyParametersEv
-__ZN3JSC16FunctionBodyNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_IPNS_12FuncDeclNodeELm0EEERKNS_10SourceCodeEji
 __ZN3JSC16InternalFunction4infoE
 __ZN3JSC16InternalFunction4nameEPNS_12JSGlobalDataE
-__ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEN3WTF10PassRefPtrINS_9StructureEEERKNS_10IdentifierE
+__ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_10IdentifierE
 __ZN3JSC16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3JSC16JSVariableObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC16JSVariableObject14symbolTableGetERKNS_10IdentifierERNS_18PropertyDescriptorE
+__ZN3JSC16JSVariableObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
 __ZN3JSC16toUInt32SlowCaseEdRb
 __ZN3JSC17BytecodeGenerator21setDumpsGeneratedCodeEb
 __ZN3JSC17PropertyNameArray3addEPNS_7UString3RepE
-__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RKNS_7ArgListEE
+__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RKNS_7ArgListEE
 __ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectES6_RKNS_7ArgListEE
 __ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
 __ZN3JSC18DebuggerActivationC1EPNS_8JSObjectE
-__ZN3JSC19constructEmptyArrayEPNS_9ExecStateE
+__ZN3JSC18PropertyDescriptor11setWritableEb
+__ZN3JSC18PropertyDescriptor12setUndefinedEv
+__ZN3JSC18PropertyDescriptor13setDescriptorENS_7JSValueEj
+__ZN3JSC18PropertyDescriptor13setEnumerableEb
+__ZN3JSC18PropertyDescriptor15setConfigurableEb
+__ZN3JSC18PropertyDescriptor17defaultAttributesE
+__ZN3JSC18PropertyDescriptor21setAccessorDescriptorENS_7JSValueES1_j
+__ZN3JSC18PropertyDescriptor9setGetterENS_7JSValueE
+__ZN3JSC18PropertyDescriptor9setSetterENS_7JSValueE
 __ZN3JSC19initializeThreadingEv
 __ZN3JSC20MarkedArgumentBuffer10slowAppendENS_7JSValueE
-__ZN3JSC20constructEmptyObjectEPNS_9ExecStateE
 __ZN3JSC23AbstractSamplingCounter4dumpEv
 __ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
 __ZN3JSC25evaluateInGlobalCallFrameERKNS_7UStringERNS_7JSValueEPNS_14JSGlobalObjectE
+__ZN3JSC35createInterruptedExecutionExceptionEPNS_12JSGlobalDataE
 __ZN3JSC4Heap11objectCountEv
 __ZN3JSC4Heap14primaryHeapEndEv
 __ZN3JSC4Heap15recordExtraCostEm
 __ZN3JSC4Heap16primaryHeapBeginEv
 __ZN3JSC4Heap17globalObjectCountEv
 __ZN3JSC4Heap20protectedObjectCountEv
-__ZN3JSC4Heap24setGCProtectNeedsLockingEv
 __ZN3JSC4Heap25protectedObjectTypeCountsEv
 __ZN3JSC4Heap26protectedGlobalObjectCountEv
-__ZN3JSC4Heap4heapENS_7JSValueE  
 __ZN3JSC4Heap6isBusyEv
 __ZN3JSC4Heap7collectEv
 __ZN3JSC4Heap7destroyEv
@@ -192,12 +201,13 @@ __ZN3JSC6JSCell14toThisJSStringEPNS_9ExecStateE
 __ZN3JSC6JSCell16getConstructDataERNS_13ConstructDataE
 __ZN3JSC6JSCell18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
 __ZN3JSC6JSCell18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC6JSCell18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
 __ZN3JSC6JSCell3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSC6JSCell3putEPNS_9ExecStateEjNS_7JSValueE  
 __ZN3JSC6JSCell9getObjectEv
 __ZN3JSC6JSCellnwEmPNS_9ExecStateE
-__ZN3JSC6JSLock12DropAllLocksC1EPNS_9ExecStateE
 __ZN3JSC6JSLock12DropAllLocksC1ENS_14JSLockBehaviorE
+__ZN3JSC6JSLock12DropAllLocksC1EPNS_9ExecStateE
 __ZN3JSC6JSLock12DropAllLocksD1Ev
 __ZN3JSC6JSLock4lockENS_14JSLockBehaviorE
 __ZN3JSC6JSLock6unlockENS_14JSLockBehaviorE
@@ -207,6 +217,9 @@ __ZN3JSC6Parser5parseEPNS_12JSGlobalDataEPiPNS_7UStringE
 __ZN3JSC7CStringD1Ev
 __ZN3JSC7CStringaSERKS0_
 __ZN3JSC7JSArray4infoE
+__ZN3JSC7JSArray9setLengthEj
+__ZN3JSC7JSArrayC1EN3WTF17NonNullPassRefPtrINS_9StructureEEE
+__ZN3JSC7JSArrayC1EN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_7ArgListE
 __ZN3JSC7Profile10restoreAllEv
 __ZN3JSC7Profile5focusEPKNS_11ProfileNodeE
 __ZN3JSC7Profile7excludeEPKNS_11ProfileNodeE
@@ -227,13 +240,13 @@ __ZN3JSC7UString6appendERKS0_
 __ZN3JSC7UStringC1EPKc
 __ZN3JSC7UStringC1EPKti
 __ZN3JSC7UStringaSEPKc
+__ZN3JSC8Debugger23recompileAllJSFunctionsEPNS_12JSGlobalDataE
 __ZN3JSC8Debugger6attachEPNS_14JSGlobalObjectE
 __ZN3JSC8Debugger6detachEPNS_14JSGlobalObjectE
-__ZN3JSC8DebuggerC2Ev
 __ZN3JSC8DebuggerD2Ev
 __ZN3JSC8JSObject11hasInstanceEPNS_9ExecStateENS_7JSValueES3_
-__ZN3JSC8JSObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
-__ZN3JSC8JSObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
+__ZN3JSC8JSObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPS0_j
+__ZN3JSC8JSObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPS0_j
 __ZN3JSC8JSObject12lookupGetterEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC8JSObject12lookupSetterEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC8JSObject12markChildrenERNS_9MarkStackE
@@ -242,14 +255,18 @@ __ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateEj
 __ZN3JSC8JSObject15unwrappedObjectEv
 __ZN3JSC8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
 __ZN3JSC8JSObject17createInheritorIDEv
+__ZN3JSC8JSObject17defineOwnPropertyEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorEb
 __ZN3JSC8JSObject17putDirectFunctionEPNS_9ExecStateEPNS_16InternalFunctionEj
 __ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
 __ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEjbRNS_15PutPropertySlotE
 __ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateEjNS_7JSValueEj
 __ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
 __ZN3JSC8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZN3JSC8JSObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC8JSObject21getPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPNS_7JSValueE  
 __ZN3JSC8JSObject23allocatePropertyStorageEmm
+__ZN3JSC8JSObject24getOwnPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC8JSObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSC8JSObject3putEPNS_9ExecStateEjNS_7JSValueE  
 __ZN3JSC8Profiler13stopProfilingEPNS_9ExecStateERKNS_7UStringE
@@ -263,11 +280,13 @@ __ZN3JSC9MarkStack10s_pageSizeE
 __ZN3JSC9MarkStack12releaseStackEPvm
 __ZN3JSC9MarkStack13allocateStackEm
 __ZN3JSC9MarkStack18initializePagesizeEv
+__ZN3JSC9Structure13hasTransitionEPNS_7UString3RepEj
 __ZN3JSC9Structure17stopIgnoringLeaksEv
 __ZN3JSC9Structure18startIgnoringLeaksEv
 __ZN3JSC9Structure21addPropertyTransitionEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
 __ZN3JSC9Structure22materializePropertyMapEv
 __ZN3JSC9Structure25changePrototypeTransitionEPS0_NS_7JSValueE
+__ZN3JSC9Structure27addAnonymousSlotsTransitionEPS0_j
 __ZN3JSC9Structure27despecifyDictionaryFunctionERKNS_10IdentifierE
 __ZN3JSC9Structure27despecifyFunctionTransitionEPS0_RKNS_10IdentifierE
 __ZN3JSC9Structure28addPropertyWithoutTransitionERKNS_10IdentifierEjPNS_6JSCellE
@@ -290,6 +309,7 @@ __ZN3WTF12isMainThreadEv
 __ZN3WTF12randomNumberEv
 __ZN3WTF13currentThreadEv
 __ZN3WTF13tryFastCallocEmm
+__ZN3WTF13tryFastMallocEm
 __ZN3WTF15ThreadCondition4waitERNS_5MutexE
 __ZN3WTF15ThreadCondition6signalEv
 __ZN3WTF15ThreadCondition9broadcastEv
@@ -324,14 +344,11 @@ __ZN3WTF8CollatorC1EPKc
 __ZN3WTF8CollatorD1Ev
 __ZN3WTF8fastFreeEPv
 __ZN3WTF9ByteArray6createEm
+__ZNK3JSC10JSFunction23isHostFunctionNonInlineEv
 __ZNK3JSC11Interpreter14retrieveCallerEPNS_9ExecStateEPNS_16InternalFunctionE
 __ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7JSValueE  
 __ZNK3JSC12DateInstance7getTimeERdRi
-__ZNK3JSC12StringObject12toThisStringEPNS_9ExecStateE
-__ZNK3JSC12StringObject8toStringEPNS_9ExecStateE
 __ZNK3JSC14JSGlobalObject14isDynamicScopeEv
-
-__ZNK3JSC16FunctionBodyNode14isHostFunctionEv
 __ZNK3JSC16InternalFunction9classInfoEv
 __ZNK3JSC16JSVariableObject16isVariableObjectEv
 __ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
@@ -340,14 +357,26 @@ __ZNK3JSC17DebuggerCallFrame12functionNameEv
 __ZNK3JSC17DebuggerCallFrame22calculatedFunctionNameEv
 __ZNK3JSC17DebuggerCallFrame4typeEv
 __ZNK3JSC17DebuggerCallFrame8evaluateERKNS_7UStringERNS_7JSValueE
+__ZNK3JSC18PropertyDescriptor10enumerableEv
+__ZNK3JSC18PropertyDescriptor12configurableEv
+__ZNK3JSC18PropertyDescriptor16isDataDescriptorEv
+__ZNK3JSC18PropertyDescriptor20isAccessorDescriptorEv
+__ZNK3JSC18PropertyDescriptor6getterEv
+__ZNK3JSC18PropertyDescriptor6setterEv
+__ZNK3JSC18PropertyDescriptor8writableEv
 __ZNK3JSC4Heap10statisticsEv
+__ZNK3JSC6JSCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
 __ZNK3JSC6JSCell12toThisObjectEPNS_9ExecStateE
 __ZNK3JSC6JSCell12toThisStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell14isGetterSetterEv
+__ZNK3JSC6JSCell8toNumberEPNS_9ExecStateE
+__ZNK3JSC6JSCell8toObjectEPNS_9ExecStateE
+__ZNK3JSC6JSCell8toStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell9classInfoEv
 __ZNK3JSC6JSCell9getStringERNS_7UStringE
 __ZNK3JSC6JSCell9getStringEv
 __ZNK3JSC6JSCell9getUInt32ERj
+__ZNK3JSC6JSCell9toBooleanEPNS_9ExecStateE
 __ZNK3JSC7ArgList8getSliceEiRS0_
 __ZNK3JSC7JSValue16toObjectSlowCaseEPNS_9ExecStateE
 __ZNK3JSC7JSValue19synthesizePrototypeEPNS_9ExecStateE
@@ -378,7 +407,7 @@ __ZTVN3JSC14JSGlobalObjectE
 __ZTVN3JSC15JSWrapperObjectE
 __ZTVN3JSC16InternalFunctionE
 __ZTVN3JSC16JSVariableObjectE
-__ZTVN3JSC17JSAPIValueWrapperE
+__ZTVN3JSC8DebuggerE
 __ZTVN3JSC8JSObjectE
 __ZTVN3JSC8JSStringE
 _jscore_fastmalloc_introspection
diff --git a/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp b/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
new file mode 100644
index 0000000..88fe484
--- /dev/null
+++ b/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
@@ -0,0 +1,205 @@
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+{
+  'includes': [
+    # FIXME: Sense whether upstream or downstream build, and
+    # include the right features.gypi
+    '../../WebKit/chromium/features.gypi',
+    '../JavaScriptCore.gypi',
+  ],
+  'variables': {
+    # Location of the chromium src directory.
+    'conditions': [
+      ['inside_chromium_build==0', {
+        # Webkit is being built outside of the full chromium project.
+        'chromium_src_dir': '../../WebKit/chromium',
+      },{
+        # WebKit is checked out in src/chromium/third_party/WebKit
+        'chromium_src_dir': '../../../..',
+      }],
+    ],
+  },
+  'targets': [
+    {
+      # This target sets up defines and includes that are required by WTF and
+      # its dependents.
+      'target_name': 'wtf_config',
+      'type': 'none',
+      'msvs_guid': '2E2D3301-2EC4-4C0F-B889-87073B30F673',
+      'direct_dependent_settings': {
+        'defines': [
+          # Import features_defines from features.gypi
+          '<@(feature_defines)',
+          
+          # Turns on #if PLATFORM(CHROMIUM)
+          'BUILDING_CHROMIUM__=1',
+          # Controls wtf/FastMalloc
+          # FIXME: consider moving into config.h
+          'USE_SYSTEM_MALLOC=1',
+        ],
+        'conditions': [
+          ['OS=="win"', {
+            'defines': [
+              '__STD_C',
+              '_CRT_SECURE_NO_DEPRECATE',
+              '_SCL_SECURE_NO_DEPRECATE',
+              'CRASH=__debugbreak',
+            ],
+            'include_dirs': [
+              '../os-win32',
+              '<(chromium_src_dir)/webkit/build/JavaScriptCore',
+            ],
+          }],
+          ['OS=="mac"', {
+            'defines': [
+              # Ensure that only Leopard features are used when doing the
+              # Mac build.
+              'BUILDING_ON_LEOPARD',
+
+              # Use USE_NEW_THEME on Mac.
+              'WTF_USE_NEW_THEME=1',
+            ],
+          }],
+          ['OS=="linux" or OS=="freebsd"', {
+            'defines': [
+              'WTF_USE_PTHREADS=1',
+            ],
+          }],
+        ],
+      }
+    },
+    {
+      'target_name': 'wtf',
+      'type': '<(library)',
+      'msvs_guid': 'AA8A5A85-592B-4357-BC60-E0E91E026AF6',
+      'dependencies': [
+        'wtf_config',
+        '<(chromium_src_dir)/third_party/icu/icu.gyp:icui18n',
+        '<(chromium_src_dir)/third_party/icu/icu.gyp:icuuc',
+      ],
+      'include_dirs': [
+        '../',
+        '../wtf',
+        '../wtf/unicode',
+      ],
+      'sources': [
+        '<@(javascriptcore_files)',
+      ],
+      'sources/': [
+        # First exclude everything ...
+        ['exclude', '../'],
+        # ... Then include what we want.
+        ['include', '../wtf/'],
+        # GLib/GTK, even though its name doesn't really indicate.
+        ['exclude', '/(GOwnPtr|glib/.*)\\.(cpp|h)$'],
+        ['exclude', '(Default|Gtk|Mac|None|Qt|Win|Wx)\\.(cpp|mm)$'],
+      ],
+      'direct_dependent_settings': {
+        'include_dirs': [
+          '../',
+          '../wtf',
+        ],
+      },
+      'export_dependent_settings': [
+        'wtf_config',
+        '<(chromium_src_dir)/third_party/icu/icu.gyp:icui18n',
+        '<(chromium_src_dir)/third_party/icu/icu.gyp:icuuc',
+      ],
+      'msvs_disabled_warnings': [4127, 4355, 4510, 4512, 4610, 4706],
+      'conditions': [
+        ['OS=="win"', {
+          'sources/': [
+            ['exclude', 'ThreadingPthreads\\.cpp$'],
+            ['include', 'Thread(ing|Specific)Win\\.cpp$']
+          ],
+          'include_dirs': [
+            '<(chromium_src_dir)/webkit/build',
+            '../kjs',
+            '../API',
+            # These 3 do not seem to exist.
+            '../bindings',
+            '../bindings/c',
+            '../bindings/jni',
+            # FIXME: removed these - don't seem to exist
+            'pending',
+            'pending/wtf',
+          ],
+          'include_dirs!': [
+            '<(SHARED_INTERMEDIATE_DIR)/webkit',
+          ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'pcre',
+      'type': '<(library)',
+      'dependencies': [
+        'wtf',
+      ],
+      'conditions': [
+        ['OS=="win"', {
+          'dependencies': ['<(chromium_src_dir)/build/win/system.gyp:cygwin'],
+        }],
+      ],
+      'msvs_guid': '49909552-0B0C-4C14-8CF6-DB8A2ADE0934',
+      'actions': [
+        {
+          'action_name': 'dftables',
+          'inputs': [
+            '../pcre/dftables',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/chartables.c',
+          ],
+          'action': ['perl', '-w', '<@(_inputs)', '<@(_outputs)'],
+        },
+      ],
+      'include_dirs': [
+        '<(INTERMEDIATE_DIR)',
+      ],
+      'sources': [
+        '<@(javascriptcore_files)',
+      ],
+      'sources/': [
+        # First exclude everything ...
+        ['exclude', '../'],
+        # ... Then include what we want.
+        ['include', '../pcre/'],
+        # ucptable.cpp is #included by pcre_ucp_searchfunchs.cpp and is not
+        # intended to be compiled directly.
+        ['exclude', '../pcre/ucptable.cpp$'],
+      ],
+      'export_dependent_settings': [
+        'wtf',
+      ],
+    },
+  ], # targets
+}
diff --git a/JavaScriptCore/JavaScriptCore.gypi b/JavaScriptCore/JavaScriptCore.gypi
index 462c38f..15a0c0f 100644
--- a/JavaScriptCore/JavaScriptCore.gypi
+++ b/JavaScriptCore/JavaScriptCore.gypi
@@ -255,6 +255,7 @@
             'runtime/JSString.cpp',
             'runtime/JSString.h',
             'runtime/JSType.h',
+            'runtime/JSTypeInfo.h',
             'runtime/JSValue.cpp',
             'runtime/JSValue.h',
             'runtime/JSVariableObject.cpp',
@@ -287,6 +288,8 @@
             'runtime/ObjectPrototype.h',
             'runtime/Operations.cpp',
             'runtime/Operations.h',
+            'runtime/PropertyDescriptor.cpp',
+            'runtime/PropertyDescriptor.h',
             'runtime/PropertyMapHashTable.h',
             'runtime/PropertyNameArray.cpp',
             'runtime/PropertyNameArray.h',
@@ -326,7 +329,6 @@
             'runtime/TimeoutChecker.cpp',
             'runtime/TimeoutChecker.h',
             'runtime/Tracing.h',
-            'runtime/TypeInfo.h',
             'runtime/UString.cpp',
             'runtime/UString.h',
             'wrec/CharacterClass.cpp',
diff --git a/JavaScriptCore/JavaScriptCore.pri b/JavaScriptCore/JavaScriptCore.pri
index dd48c9a..d69bccb 100644
--- a/JavaScriptCore/JavaScriptCore.pri
+++ b/JavaScriptCore/JavaScriptCore.pri
@@ -36,6 +36,14 @@ GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
 win32-* {
     LIBS += -lwinmm
 }
+contains(JAVASCRIPTCORE_JIT,yes) {
+    DEFINES+=ENABLE_JIT=1
+    DEFINES+=ENABLE_YARR_JIT=1
+}
+contains(JAVASCRIPTCORE_JIT,no) {
+    DEFINES+=ENABLE_JIT=0
+    DEFINES+=ENABLE_YARR_JIT=0
+}
 
 # In debug mode JIT disabled until crash fixed
 win32-* {
@@ -50,6 +58,11 @@ win32-* {
     }
 }
 
+wince* {
+    SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.cpp
+    DEFINES += WINCEBASIC
+}
+
 include(pcre/pcre.pri)
 
 LUT_FILES += \
@@ -99,12 +112,12 @@ SOURCES += \
     runtime/JSONObject.cpp \
     runtime/LiteralParser.cpp \
     runtime/MarkStack.cpp \
-    runtime/MarkStackPosix.cpp \
     runtime/TimeoutChecker.cpp \
     bytecode/CodeBlock.cpp \
     bytecode/StructureStubInfo.cpp \
     bytecode/JumpTable.cpp \
     assembler/ARMAssembler.cpp \
+    assembler/MacroAssemblerARM.cpp \
     jit/JIT.cpp \
     jit/JITCall.cpp \
     jit/JITArithmetic.cpp \
@@ -123,8 +136,21 @@ SOURCES += \
     yarr/RegexJIT.cpp \
     interpreter/RegisterFile.cpp
 
-win32-*: SOURCES += jit/ExecutableAllocatorWin.cpp
-else: SOURCES += jit/ExecutableAllocatorPosix.cpp
+symbian {
+    SOURCES += runtime/MarkStackSymbian.cpp
+} else {
+    win32-*|wince* {
+        SOURCES += jit/ExecutableAllocatorWin.cpp \
+                  runtime/MarkStackWin.cpp
+    } else {
+        SOURCES += jit/ExecutableAllocatorPosix.cpp \
+                  runtime/MarkStackPosix.cpp
+    }
+}
+
+!contains(DEFINES, USE_SYSTEM_MALLOC) {
+    SOURCES += wtf/TCSystemAlloc.cpp
+}
 
 # AllInOneFile.cpp helps gcc analize and optimize code
 # Other compilers may be able to do this at link time
@@ -154,6 +180,7 @@ SOURCES += \
     runtime/ErrorInstance.cpp \
     runtime/ErrorPrototype.cpp \
     interpreter/CallFrame.cpp \
+    runtime/Executable.cpp \
     runtime/FunctionConstructor.cpp \
     runtime/FunctionPrototype.cpp \
     runtime/GetterSetter.cpp \
@@ -188,6 +215,7 @@ SOURCES += \
     runtime/Operations.cpp \
     parser/Parser.cpp \
     parser/ParserArena.cpp \
+    runtime/PropertyDescriptor.cpp \
     runtime/PropertyNameArray.cpp \
     runtime/PropertySlot.cpp \
     runtime/PrototypeFunction.cpp \
diff --git a/JavaScriptCore/JavaScriptCore.pro b/JavaScriptCore/JavaScriptCore.pro
index 0cd2e1a..a1affd4 100644
--- a/JavaScriptCore/JavaScriptCore.pro
+++ b/JavaScriptCore/JavaScriptCore.pro
@@ -16,7 +16,6 @@ CONFIG(QTDIR_build) {
     include($$QT_SOURCE_TREE/src/qbase.pri)
     INSTALLS =
     DESTDIR = $$OLDDESTDIR
-    PRECOMPILED_HEADER = $$PWD/../WebKit/qt/WebKit_pch.h
     DEFINES *= NDEBUG
 }
 
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index 0de51bf..a580b98 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -1,22 +1,18 @@
 LIBRARY    "JavaScriptCore"
 
 EXPORTS
-	?from@UString@JSC@@SA?AV12@N@Z
-	?nonInlineNaN@JSC@@YANXZ
-	?synthesizePrototype@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
-	?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
-	?toThisObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
     ??0Collator@WTF@@QAE@PBD@Z
-    ??0Debugger@JSC@@QAE@XZ
+    ??0DateInstance@JSC@@QAE@PAVExecState@1@N@Z
     ??0DropAllLocks@JSLock@JSC@@QAE@W4JSLockBehavior@2@@Z
-    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
-    ??0JSByteArray@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@PAVByteArray@4@PBUClassInfo@1@@Z
-    ??0JSFunction@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
+    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
+    ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@@Z
+    ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVArgList@1@@Z
+    ??0JSByteArray@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@PAVByteArray@4@PBUClassInfo@1@@Z
+    ??0JSFunction@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
     ??0Mutex@WTF@@QAE@XZ
     ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V41@ABVArgList@1@@Z@Z
-    ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
     ??0RefCountedLeakCounter@WTF@@QAE@PBD@Z
-    ??0StringObject@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@ABVUString@1@@Z
+    ??0StringObject@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVUString@1@@Z
     ??0Structure@JSC@@AAE@VJSValue@1@ABVTypeInfo@1@@Z
     ??0ThreadCondition@WTF@@QAE@XZ
     ??0UString@JSC@@QAE@PBD@Z
@@ -47,7 +43,6 @@ EXPORTS
     ?allocate@Heap@JSC@@QAEPAXI@Z
     ?allocatePropertyStorage@JSObject@JSC@@QAEXII@Z
     ?allocateStack@MarkStack@JSC@@CAPAXI@Z
-    ?allocateStack@MarkStack@JSC@@CAPAXI@Z
     ?append@UString@JSC@@QAEAAV12@ABV12@@Z
     ?append@UString@JSC@@QAEAAV12@PBD@Z
     ?ascii@UString@JSC@@QBEPADXZ
@@ -67,33 +62,37 @@ EXPORTS
     ?collect@Heap@JSC@@QAE_NXZ
     ?computeHash@Rep@UString@JSC@@SAIPBDH@Z
     ?computeHash@Rep@UString@JSC@@SAIPB_WH@Z
+    ?configurable@PropertyDescriptor@JSC@@QBE_NXZ
     ?construct@JSC@@YAPAVJSObject@1@PAVExecState@1@VJSValue@1@W4ConstructType@1@ABTConstructData@1@ABVArgList@1@@Z
     ?constructArray@JSC@@YAPAVJSArray@1@PAVExecState@1@ABVArgList@1@@Z
     ?constructEmptyArray@JSC@@YAPAVJSArray@1@PAVExecState@1@@Z
     ?constructEmptyObject@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
     ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
     ?convertUTF16ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPB_WPB_WPAPADPAD_N@Z
-    ?copyParameters@FunctionBodyNode@JSC@@QAEPAVIdentifier@2@XZ
     ?create@ByteArray@WTF@@SA?AV?$PassRefPtr@VByteArray@WTF@@@2@I@Z
-    ?create@FunctionBodyNode@JSC@@SA?AV?$PassRefPtr@VFunctionBodyNode@JSC@@@WTF@@PAVJSGlobalData@2@PAVSourceElements@2@PAV?$Vector@U?$pair@VIdentifier@JSC@@I@std@@$0A@@4@PAV?$Vector@PAVFuncDeclNode@JSC@@$0A@@4@ABVSourceCode@2@IH@Z
     ?create@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@_N@Z
     ?create@OpaqueJSString@@SA?AV?$PassRefPtr@UOpaqueJSString@@@WTF@@ABVUString@JSC@@@Z
     ?create@Rep@UString@JSC@@SA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PA_WHV?$PassRefPtr@V?$CrossThreadRefCounted@V?$OwnFastMallocPtr@_W@WTF@@@WTF@@@5@@Z
     ?createEmptyString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@@Z
     ?createInheritorID@JSObject@JSC@@AAEPAVStructure@2@XZ
+    ?createInterruptedExecutionException@JSC@@YA?AVJSValue@1@PAVJSGlobalData@1@@Z
     ?createLeaked@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@XZ
+    ?createStackOverflowError@JSC@@YA?AVJSValue@1@PAVExecState@1@@Z
     ?createStructure@JSByteArray@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@VJSValue@2@@Z
     ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
+    ?createTypeError@JSC@@YA?AVJSValue@1@PAVExecState@1@PBD@Z
     ?currentThread@WTF@@YAIXZ
     ?currentTime@WTF@@YANXZ
     ?decrement@RefCountedLeakCounter@WTF@@QAEXXZ
+    ?defaultAttributes@PropertyDescriptor@JSC@@0IA
     ?defaultValue@JSObject@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
-    ?defineGetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@@Z
-    ?defineGetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@@Z
-    ?defineSetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@@Z
-    ?defineSetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@@Z
+    ?defineGetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@I@Z
+    ?defineGetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@I@Z
+    ?defineOwnProperty@JSObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@_N@Z
+    ?defineSetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@I@Z
+    ?defineSetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@I@Z
     ?deleteOwnedPtr@WTF@@YAXPAUHBITMAP__@@@Z
     ?deleteOwnedPtr@WTF@@YAXPAUHRGN__@@@Z
     ?deleteProperty@JSCell@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
@@ -107,8 +106,12 @@ EXPORTS
     ?despecifyFunctionTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@@Z
     ?destroy@Heap@JSC@@QAEXXZ
     ?destroy@Rep@UString@JSC@@QAEXXZ
+    ?destroyJSGlobalObjectData@JSGlobalObject@JSC@@CAXPAX@Z
     ?detach@Debugger@JSC@@UAEXPAVJSGlobalObject@2@@Z
     ?detachThread@WTF@@YAXI@Z
+    ?didTimeOut@TimeoutChecker@JSC@@QAE_NPAVExecState@2@@Z
+    ?dumpSampleData@JSGlobalData@JSC@@QAEXPAVExecState@2@@Z
+    ?enumerable@PropertyDescriptor@JSC@@QBE_NXZ
     ?equal@Identifier@JSC@@SA_NPBURep@UString@2@PBD@Z
     ?equal@JSC@@YA_NPBURep@UString@1@0@Z
     ?evaluate@DebuggerCallFrame@JSC@@QBE?AVJSValue@2@ABVUString@2@AAV32@@Z
@@ -120,16 +123,22 @@ EXPORTS
     ?fastRealloc@WTF@@YAPAXPAXI@Z
     ?fastZeroedMalloc@WTF@@YAPAXI@Z
     ?fillGetterPropertySlot@JSObject@JSC@@QAEXAAVPropertySlot@2@PAVJSValue@2@@Z
-    ?finishParsing@FunctionBodyNode@JSC@@QAEXPAVIdentifier@2@I@Z
     ?focus@Profile@JSC@@QAEXPBVProfileNode@2@@Z
     ?from@UString@JSC@@SA?AV12@H@Z
     ?from@UString@JSC@@SA?AV12@I@Z
+    ?from@UString@JSC@@SA?AV12@N@Z
     ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
     ?get@Structure@JSC@@QAEIPBURep@UString@2@AAIAAPAVJSCell@2@@Z
     ?getCallData@JSCell@JSC@@UAE?AW4CallType@2@AATCallData@2@@Z
     ?getConstructData@JSCell@JSC@@UAE?AW4ConstructType@2@AATConstructData@2@@Z
     ?getJSNumber@JSCell@JSC@@UAE?AVJSValue@2@XZ
     ?getObject@JSCell@JSC@@QAEPAVJSObject@2@XZ
+    ?getOwnPropertyDescriptor@JSObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
+    ?getOwnPropertyDescriptor@JSString@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
+    ?getOwnPropertyDescriptor@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
+    ?getOwnPropertyNames@JSObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
+    ?getOwnPropertyNames@JSVariableObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
+    ?getOwnPropertyNames@StringObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
     ?getOwnPropertySlot@JSCell@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
     ?getOwnPropertySlot@JSCell@JSC@@EAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
     ?getOwnPropertySlot@JSObject@JSC@@UAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
@@ -137,23 +146,24 @@ EXPORTS
     ?getOwnPropertySlot@JSString@JSC@@EAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
     ?getOwnPropertySlot@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
     ?getOwnPropertySlot@StringObject@JSC@@UAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
-    ?getPrimitiveNumber@JSAPIValueWrapper@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
+    ?getPrimitiveNumber@JSCell@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
     ?getPrimitiveNumber@JSObject@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
     ?getPrimitiveNumber@JSString@JSC@@EAE_NPAVExecState@2@AANAAVJSValue@2@@Z
     ?getPropertyAttributes@JSObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
     ?getPropertyAttributes@JSVariableObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
+    ?getPropertyDescriptor@JSObject@JSC@@QAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
     ?getPropertyNames@JSObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
-    ?getPropertyNames@JSVariableObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
-    ?getPropertyNames@StringObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
     ?getSlice@ArgList@JSC@@QBEXHAAV12@@Z
     ?getString@JSCell@JSC@@QBE?AVUString@2@XZ
     ?getString@JSCell@JSC@@QBE_NAAVUString@2@@Z
     ?getUInt32@JSCell@JSC@@UBE_NAAI@Z
+    ?getter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
     ?globalExec@JSGlobalObject@JSC@@UAEPAVExecState@2@XZ
     ?globalObjectCount@Heap@JSC@@QAEIXZ
     ?hasInstance@JSObject@JSC@@UAE_NPAVExecState@2@VJSValue@2@1@Z
     ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@ABVIdentifier@2@@Z
     ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@I@Z
+    ?hasTransition@Structure@JSC@@QAE_NPAURep@UString@2@I@Z
     ?heap@Heap@JSC@@SAPAV12@VJSValue@2@@Z
     ?increment@RefCountedLeakCounter@WTF@@QAEXXZ
     ?init@JSGlobalObject@JSC@@AAEXPAVJSObject@2@@Z
@@ -161,10 +171,12 @@ EXPORTS
     ?initializeThreading@JSC@@YAXXZ
     ?initializeThreading@WTF@@YAXXZ
     ?is8Bit@UString@JSC@@QBE_NXZ
+    ?isAccessorDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
     ?isBusy@Heap@JSC@@QAE_NXZ
+    ?isDataDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
     ?isDynamicScope@JSGlobalObject@JSC@@UBE_NXZ
     ?isGetterSetter@JSCell@JSC@@UBE_NXZ
-    ?isHostFunction@FunctionBodyNode@JSC@@QBE_NXZ
+    ?isHostFunctionNonInline@JSFunction@JSC@@ABE_NXZ
     ?isMainThread@WTF@@YA_NXZ
     ?isVariableObject@JSVariableObject@JSC@@UBE_NXZ
     ?jsNumberCell@JSC@@YA?AVJSValue@1@PAVExecState@1@N@Z
@@ -180,9 +192,10 @@ EXPORTS
     ?lookupSetter@JSObject@JSC@@UAE?AVJSValue@2@PAVExecState@2@ABVIdentifier@2@@Z
     ?markChildren@JSGlobalObject@JSC@@UAEXAAVMarkStack@2@@Z
     ?markChildren@JSObject@JSC@@UAEXAAVMarkStack@2@@Z
-    ?markChildren@JSWrapperObject@JSC@@UAEXAAVMarkStack@2@@Z
+    ?markChildren@JSWrapperObject@JSC@@EAEXAAVMarkStack@2@@Z
     ?materializePropertyMap@Structure@JSC@@AAEXXZ
     ?name@InternalFunction@JSC@@QAEABVUString@2@PAVJSGlobalData@2@@Z
+    ?nonInlineNaN@JSC@@YANXZ
     ?objectCount@Heap@JSC@@QAEIXZ
     ?objectProtoFuncToString@JSC@@YI?AVJSValue@1@PAVExecState@1@PAVJSObject@1@V21@ABVArgList@1@@Z
     ?parse@Parser@JSC@@AAEXPAVJSGlobalData@2@PAHPAVUString@2@@Z
@@ -206,6 +219,7 @@ EXPORTS
     ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I_NAAVPutPropertySlot@2@@Z
     ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@IVJSValue@2@I@Z
     ?randomNumber@WTF@@YANXZ
+    ?recompileAllJSFunctions@Debugger@JSC@@QAEXPAVJSGlobalData@2@@Z
     ?recordExtraCost@Heap@JSC@@AAEXI@Z
     ?releaseStack@MarkStack@JSC@@CAXPAXI@Z
     ?reset@ParserArena@JSC@@QAEXXZ
@@ -213,21 +227,34 @@ EXPORTS
     ?restoreAll@Profile@JSC@@QAEXXZ
     ?retrieveCaller@Interpreter@JSC@@QBE?AVJSValue@2@PAVExecState@2@PAVInternalFunction@2@@Z
     ?retrieveLastCaller@Interpreter@JSC@@QBEXPAVExecState@2@AAH1AAVUString@2@AAVJSValue@2@@Z
+    ?setAccessorDescriptor@PropertyDescriptor@JSC@@QAEXVJSValue@2@0I@Z
+    ?setConfigurable@PropertyDescriptor@JSC@@QAEX_N@Z
+    ?setDescriptor@PropertyDescriptor@JSC@@QAEXVJSValue@2@I@Z
     ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z
-    ?setGCProtectNeedsLocking@Heap@JSC@@QAEXXZ
+    ?setEnumerable@PropertyDescriptor@JSC@@QAEX_N@Z
+    ?setGetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
+    ?setLength@JSArray@JSC@@QAEXI@Z
     ?setLoc@StatementNode@JSC@@QAEXHH@Z
     ?setMainThreadCallbacksPaused@WTF@@YAX_N@Z
     ?setOrderLowerFirst@Collator@WTF@@QAEX_N@Z
+    ?setSetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
+    ?setUndefined@PropertyDescriptor@JSC@@QAEXXZ
     ?setUpStaticFunctionSlot@JSC@@YAXPAVExecState@1@PBVHashEntry@1@PAVJSObject@1@ABVIdentifier@1@AAVPropertySlot@1@@Z
+    ?setWritable@PropertyDescriptor@JSC@@QAEX_N@Z
+    ?setter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
     ?sharedBuffer@Rep@UString@JSC@@QAEPAV?$CrossThreadRefCounted@V?$OwnFastMallocPtr@_W@WTF@@@WTF@@XZ
     ?signal@ThreadCondition@WTF@@QAEXXZ
     ?slowAppend@MarkedArgumentBuffer@JSC@@AAEXVJSValue@2@@Z
     ?startIgnoringLeaks@Structure@JSC@@SAXXZ
     ?startProfiling@Profiler@JSC@@QAEXPAVExecState@2@ABVUString@2@@Z
+    ?startSampling@JSGlobalData@JSC@@QAEXXZ
     ?stopIgnoringLeaks@Structure@JSC@@SAXXZ
     ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVUString@2@@Z
+    ?stopSampling@JSGlobalData@JSC@@QAEXXZ
     ?strtod@WTF@@YANPBDPAPAD@Z
     ?substr@UString@JSC@@QBE?AV12@HH@Z
+    ?symbolTableGet@JSVariableObject@JSC@@IAE_NABVIdentifier@2@AAVPropertyDescriptor@2@@Z
+    ?synthesizePrototype@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
     ?thisObject@DebuggerCallFrame@JSC@@QBEPAVJSObject@2@XZ
     ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@@Z
     ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@ABVUString@1@@Z
@@ -235,36 +262,36 @@ EXPORTS
     ?timedWait@ThreadCondition@WTF@@QAE_NAAVMutex@2@N@Z
     ?tlsKeyCount@WTF@@YAAAJXZ
     ?tlsKeys@WTF@@YAPAKXZ
-    ?toBoolean@JSAPIValueWrapper@JSC@@UBE_NPAVExecState@2@@Z
+    ?toBoolean@JSCell@JSC@@UBE_NPAVExecState@2@@Z
     ?toBoolean@JSObject@JSC@@UBE_NPAVExecState@2@@Z
     ?toBoolean@JSString@JSC@@EBE_NPAVExecState@2@@Z
     ?toInt32SlowCase@JSC@@YAHNAA_N@Z
-    ?toNumber@JSAPIValueWrapper@JSC@@UBENPAVExecState@2@@Z
+    ?toNumber@JSCell@JSC@@UBENPAVExecState@2@@Z
     ?toNumber@JSObject@JSC@@UBENPAVExecState@2@@Z
     ?toNumber@JSString@JSC@@EBENPAVExecState@2@@Z
-    ?toObject@JSAPIValueWrapper@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
+    ?toObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
     ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
     ?toObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toPrimitive@JSAPIValueWrapper@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
+    ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
+    ?toPrimitive@JSCell@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
     ?toPrimitive@JSString@JSC@@EBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
     ?toStrictUInt32@UString@JSC@@QBEIPA_N@Z
-    ?toString@JSAPIValueWrapper@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
+    ?toString@JSCell@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
     ?toString@JSObject@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
     ?toString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
-    ?toString@StringObject@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
     ?toThisJSString@JSCell@JSC@@UAEPAVJSString@2@PAVExecState@2@@Z
     ?toThisJSString@JSString@JSC@@EAEPAV12@PAVExecState@2@@Z
-    ?toThisJSString@StringObject@JSC@@EAEPAVJSString@2@PAVExecState@2@@Z
     ?toThisObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
     ?toThisObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
     ?toThisObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
+    ?toThisObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
     ?toThisString@JSCell@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
     ?toThisString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
-    ?toThisString@StringObject@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
     ?toUInt32@UString@JSC@@QBEIPA_N@Z
     ?toUInt32@UString@JSC@@QBEIPA_N_N@Z
     ?toUInt32SlowCase@JSC@@YAINAA_N@Z
-    ?tryFastCalloc@WTF@@YAPAXII@Z
+    ?tryFastCalloc@WTF@@YA?AUTryMallocReturnValue@1@II@Z
+    ?tryFastMalloc@WTF@@YA?AUTryMallocReturnValue@1@I@Z
     ?tryLock@Mutex@WTF@@QAE_NXZ
     ?type@DebuggerCallFrame@JSC@@QBE?AW4Type@12@XZ
     ?unlock@JSLock@JSC@@SAXW4JSLockBehavior@2@@Z
@@ -274,6 +301,7 @@ EXPORTS
     ?unwrappedObject@JSObject@JSC@@UAEPAV12@XZ
     ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
     ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
+    ?writable@PropertyDescriptor@JSC@@QBE_NXZ
     WTFLog
     WTFLogVerbose
     WTFReportArgumentAssertionFailure
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc
index bb2b0fe..f2b0dd3 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc
@@ -14,8 +14,8 @@ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION __VERSION_MAJOR__,__BUILD_NUMBER_MAJOR__,__BUILD_NUMBER_MINOR__,__BUILD_NUMBER_VARIANT__
- PRODUCTVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,0
+ FILEVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,__VERSION_BUILD__
+ PRODUCTVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,__VERSION_BUILD__
  FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -37,7 +37,7 @@ BEGIN
             VALUE "LegalCopyright", "Copyright Apple Inc. 2003-2009"
             VALUE "OriginalFilename", "JavaScriptCore.dll"
             VALUE "ProductName", " JavaScriptCore"
-            VALUE "ProductVersion", __BUILD_NUMBER_SHORT__
+            VALUE "ProductVersion", __VERSION_TEXT__
         END
     END
     BLOCK "VarFileInfo"
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 1c5e963..c86ef7c 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -328,7 +328,7 @@
 		<Configuration

 			Name="Debug_CFLite|Win32"

 			ConfigurationType="2"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\debug_wincairo.vsprops;$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

@@ -644,6 +644,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\runtime\Executable.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\..\runtime\FunctionConstructor.cpp"

 				>

 			</File>

@@ -884,11 +888,11 @@
 				>

 			</File>

 			<File

-				RelativePath="..\..\runtime\MarkStack.h"

+				RelativePath="..\..\runtime\MarkStack.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\..\runtime\MarkStack.cpp"

+				RelativePath="..\..\runtime\MarkStack.h"

 				>

 			</File>

 			<File

@@ -948,6 +952,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\runtime\NumericStrings.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\runtime\ObjectConstructor.cpp"

 				>

 			</File>

@@ -972,6 +980,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\runtime\PropertyDescriptor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\PropertyDescriptor.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\..\runtime\PropertyMapHashTable.h"

 				>

 			</File>

@@ -1632,15 +1648,11 @@
 				>

 			</File>

 			<File

-				RelativePath="..\..\assembler\LinkBuffer.h"

-				>

-			</File>

-			<File

-				RelativePath="..\..\assembler\RepatchBuffer.h"

+				RelativePath="..\..\assembler\AssemblerBuffer.h"

 				>

 			</File>

 			<File

-				RelativePath="..\..\assembler\AssemblerBuffer.h"

+				RelativePath="..\..\assembler\LinkBuffer.h"

 				>

 			</File>

 			<File

@@ -1656,6 +1668,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\assembler\RepatchBuffer.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\assembler\X86Assembler.h"

 				>

 			</File>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops
index 02f213b..8c9e31f 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops
@@ -6,6 +6,6 @@
 	>

 	<Tool

 		Name="VCLinkerTool"

-		AdditionalDependencies="CFLite$(LibraryConfigSuffix).lib"

+		AdditionalDependencies="CFLite$(WebKitConfigSuffix).lib"

 	/>

 </VisualStudioPropertySheet>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
index 5f90011..ba6bbfd 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
@@ -21,7 +21,7 @@
 	/>
 	<Tool
 		Name="VCPreBuildEventTool"
-		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"
+		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"
 	/>
 	<Tool
 		Name="VCPreLinkEventTool"
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
index 954045e..0360c4e 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
@@ -1,53 +1,53 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreGenerated"
-	ProjectGUID="{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"
-	RootNamespace="JavaScriptCoreGenerated"
-	Keyword="MakeFileProj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory="$(WebKitOutputDir)\lib"
-			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"
-			ConfigurationType="0"
-			>
-			<Tool
-				Name="VCNMakeTool"
-				BuildCommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make"
-				ReBuildCommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean&#x0D;&#x0A;nmake -f JavaScriptCoreGenerated.make"
-				CleanCommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean"
-				Output=""
-				PreprocessorDefinitions="WIN32;NDEBUG"
-				IncludeSearchPath=""
-				ForcedIncludes=""
-				AssemblySearchPath=""
-				ForcedUsingAssemblies=""
-				CompileAsManaged=""
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<File
-			RelativePath=".\build-generated-files.sh"
-			>
-		</File>
-		<File
-			RelativePath=".\JavaScriptCoreGenerated.make"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreGenerated"

+	ProjectGUID="{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"

+	RootNamespace="JavaScriptCoreGenerated"

+	Keyword="MakeFileProj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Release|Win32"

+			OutputDirectory="$(WebKitOutputDir)\lib"

+			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

+			ConfigurationType="0"

+			>

+			<Tool

+				Name="VCNMakeTool"

+				BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make"

+				ReBuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean&#x0D;&#x0A;nmake -f JavaScriptCoreGenerated.make"

+				CleanCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean"

+				Output=""

+				PreprocessorDefinitions="WIN32;NDEBUG"

+				IncludeSearchPath=""

+				ForcedIncludes=""

+				AssemblySearchPath=""

+				ForcedUsingAssemblies=""

+				CompileAsManaged=""

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<File

+			RelativePath=".\build-generated-files.sh"

+			>

+		</File>

+		<File

+			RelativePath=".\JavaScriptCoreGenerated.make"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def
index 65998ca..b91e7b5 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def
@@ -1,22 +1,18 @@
 LIBRARY    "JavaScriptCore_debug"
 
 EXPORTS
-	?from@UString@JSC@@SA?AV12@N@Z
-	?nonInlineNaN@JSC@@YANXZ
-	?synthesizePrototype@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
-	?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
-	?toThisObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
     ??0Collator@WTF@@QAE@PBD@Z
-    ??0Debugger@JSC@@QAE@XZ
+    ??0DateInstance@JSC@@QAE@PAVExecState@1@N@Z
     ??0DropAllLocks@JSLock@JSC@@QAE@W4JSLockBehavior@2@@Z
-    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
-    ??0JSByteArray@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@PAVByteArray@4@PBUClassInfo@1@@Z
-    ??0JSFunction@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
+    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
+    ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@@Z
+    ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVArgList@1@@Z
+    ??0JSByteArray@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@PAVByteArray@4@PBUClassInfo@1@@Z
+    ??0JSFunction@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
     ??0Mutex@WTF@@QAE@XZ
     ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V41@ABVArgList@1@@Z@Z
-    ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
     ??0RefCountedLeakCounter@WTF@@QAE@PBD@Z
-    ??0StringObject@JSC@@QAE@PAVExecState@1@V?$PassRefPtr@VStructure@JSC@@@WTF@@ABVUString@1@@Z
+    ??0StringObject@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVUString@1@@Z
     ??0Structure@JSC@@AAE@VJSValue@1@ABVTypeInfo@1@@Z
     ??0ThreadCondition@WTF@@QAE@XZ
     ??0UString@JSC@@QAE@PBD@Z
@@ -46,6 +42,7 @@ EXPORTS
     ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVJSGlobalData@2@PAURep@UString@2@@Z
     ?allocate@Heap@JSC@@QAEPAXI@Z
     ?allocatePropertyStorage@JSObject@JSC@@QAEXII@Z
+    ?allocateStack@MarkStack@JSC@@CAPAXI@Z
     ?append@UString@JSC@@QAEAAV12@ABV12@@Z
     ?append@UString@JSC@@QAEAAV12@PBD@Z
     ?ascii@UString@JSC@@QBEPADXZ
@@ -65,33 +62,37 @@ EXPORTS
     ?collect@Heap@JSC@@QAE_NXZ
     ?computeHash@Rep@UString@JSC@@SAIPBDH@Z
     ?computeHash@Rep@UString@JSC@@SAIPB_WH@Z
+    ?configurable@PropertyDescriptor@JSC@@QBE_NXZ
     ?construct@JSC@@YAPAVJSObject@1@PAVExecState@1@VJSValue@1@W4ConstructType@1@ABTConstructData@1@ABVArgList@1@@Z
     ?constructArray@JSC@@YAPAVJSArray@1@PAVExecState@1@ABVArgList@1@@Z
     ?constructEmptyArray@JSC@@YAPAVJSArray@1@PAVExecState@1@@Z
     ?constructEmptyObject@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
     ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
     ?convertUTF16ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPB_WPB_WPAPADPAD_N@Z
-    ?copyParameters@FunctionBodyNode@JSC@@QAEPAVIdentifier@2@XZ
     ?create@ByteArray@WTF@@SA?AV?$PassRefPtr@VByteArray@WTF@@@2@I@Z
-    ?create@FunctionBodyNode@JSC@@SA?AV?$PassRefPtr@VFunctionBodyNode@JSC@@@WTF@@PAVJSGlobalData@2@PAVSourceElements@2@PAV?$Vector@U?$pair@VIdentifier@JSC@@I@std@@$0A@@4@PAV?$Vector@PAVFuncDeclNode@JSC@@$0A@@4@ABVSourceCode@2@IH@Z
     ?create@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@_N@Z
     ?create@OpaqueJSString@@SA?AV?$PassRefPtr@UOpaqueJSString@@@WTF@@ABVUString@JSC@@@Z
     ?create@Rep@UString@JSC@@SA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PA_WHV?$PassRefPtr@V?$CrossThreadRefCounted@V?$OwnFastMallocPtr@_W@WTF@@@WTF@@@5@@Z
     ?createEmptyString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@@Z
     ?createInheritorID@JSObject@JSC@@AAEPAVStructure@2@XZ
+    ?createInterruptedExecutionException@JSC@@YA?AVJSValue@1@PAVJSGlobalData@1@@Z
     ?createLeaked@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@XZ
+    ?createStackOverflowError@JSC@@YA?AVJSValue@1@PAVExecState@1@@Z
     ?createStructure@JSByteArray@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@VJSValue@2@@Z
     ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
+    ?createTypeError@JSC@@YA?AVJSValue@1@PAVExecState@1@PBD@Z
     ?currentThread@WTF@@YAIXZ
     ?currentTime@WTF@@YANXZ
     ?decrement@RefCountedLeakCounter@WTF@@QAEXXZ
+    ?defaultAttributes@PropertyDescriptor@JSC@@0IA
     ?defaultValue@JSObject@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
-    ?defineGetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@@Z
-    ?defineGetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@@Z
-    ?defineSetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@@Z
-    ?defineSetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@@Z
+    ?defineGetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@I@Z
+    ?defineGetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@I@Z
+    ?defineOwnProperty@JSObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@_N@Z
+    ?defineSetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@I@Z
+    ?defineSetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@I@Z
     ?deleteOwnedPtr@WTF@@YAXPAUHBITMAP__@@@Z
     ?deleteOwnedPtr@WTF@@YAXPAUHRGN__@@@Z
     ?deleteProperty@JSCell@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
@@ -105,8 +106,12 @@ EXPORTS
     ?despecifyFunctionTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@@Z
     ?destroy@Heap@JSC@@QAEXXZ
     ?destroy@Rep@UString@JSC@@QAEXXZ
+    ?destroyJSGlobalObjectData@JSGlobalObject@JSC@@CAXPAX@Z
     ?detach@Debugger@JSC@@UAEXPAVJSGlobalObject@2@@Z
     ?detachThread@WTF@@YAXI@Z
+    ?didTimeOut@TimeoutChecker@JSC@@QAE_NPAVExecState@2@@Z
+    ?dumpSampleData@JSGlobalData@JSC@@QAEXPAVExecState@2@@Z
+    ?enumerable@PropertyDescriptor@JSC@@QBE_NXZ
     ?equal@Identifier@JSC@@SA_NPBURep@UString@2@PBD@Z
     ?equal@JSC@@YA_NPBURep@UString@1@0@Z
     ?evaluate@DebuggerCallFrame@JSC@@QBE?AVJSValue@2@ABVUString@2@AAV32@@Z
@@ -118,16 +123,22 @@ EXPORTS
     ?fastRealloc@WTF@@YAPAXPAXI@Z
     ?fastZeroedMalloc@WTF@@YAPAXI@Z
     ?fillGetterPropertySlot@JSObject@JSC@@QAEXAAVPropertySlot@2@PAVJSValue@2@@Z
-    ?finishParsing@FunctionBodyNode@JSC@@QAEXPAVIdentifier@2@I@Z
     ?focus@Profile@JSC@@QAEXPBVProfileNode@2@@Z
     ?from@UString@JSC@@SA?AV12@H@Z
     ?from@UString@JSC@@SA?AV12@I@Z
+    ?from@UString@JSC@@SA?AV12@N@Z
     ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
     ?get@Structure@JSC@@QAEIPBURep@UString@2@AAIAAPAVJSCell@2@@Z
     ?getCallData@JSCell@JSC@@UAE?AW4CallType@2@AATCallData@2@@Z
     ?getConstructData@JSCell@JSC@@UAE?AW4ConstructType@2@AATConstructData@2@@Z
     ?getJSNumber@JSCell@JSC@@UAE?AVJSValue@2@XZ
     ?getObject@JSCell@JSC@@QAEPAVJSObject@2@XZ
+    ?getOwnPropertyDescriptor@JSObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
+    ?getOwnPropertyDescriptor@JSString@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
+    ?getOwnPropertyDescriptor@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
+    ?getOwnPropertyNames@JSObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
+    ?getOwnPropertyNames@JSVariableObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
+    ?getOwnPropertyNames@StringObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
     ?getOwnPropertySlot@JSCell@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
     ?getOwnPropertySlot@JSCell@JSC@@EAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
     ?getOwnPropertySlot@JSObject@JSC@@UAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
@@ -135,23 +146,24 @@ EXPORTS
     ?getOwnPropertySlot@JSString@JSC@@EAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
     ?getOwnPropertySlot@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
     ?getOwnPropertySlot@StringObject@JSC@@UAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
-    ?getPrimitiveNumber@JSAPIValueWrapper@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
+    ?getPrimitiveNumber@JSCell@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
     ?getPrimitiveNumber@JSObject@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
     ?getPrimitiveNumber@JSString@JSC@@EAE_NPAVExecState@2@AANAAVJSValue@2@@Z
     ?getPropertyAttributes@JSObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
     ?getPropertyAttributes@JSVariableObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
+    ?getPropertyDescriptor@JSObject@JSC@@QAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
     ?getPropertyNames@JSObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
-    ?getPropertyNames@JSVariableObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
-    ?getPropertyNames@StringObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
     ?getSlice@ArgList@JSC@@QBEXHAAV12@@Z
     ?getString@JSCell@JSC@@QBE?AVUString@2@XZ
     ?getString@JSCell@JSC@@QBE_NAAVUString@2@@Z
     ?getUInt32@JSCell@JSC@@UBE_NAAI@Z
+    ?getter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
     ?globalExec@JSGlobalObject@JSC@@UAEPAVExecState@2@XZ
     ?globalObjectCount@Heap@JSC@@QAEIXZ
     ?hasInstance@JSObject@JSC@@UAE_NPAVExecState@2@VJSValue@2@1@Z
     ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@ABVIdentifier@2@@Z
     ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@I@Z
+    ?hasTransition@Structure@JSC@@QAE_NPAURep@UString@2@I@Z
     ?heap@Heap@JSC@@SAPAV12@VJSValue@2@@Z
     ?increment@RefCountedLeakCounter@WTF@@QAEXXZ
     ?init@JSGlobalObject@JSC@@AAEXPAVJSObject@2@@Z
@@ -159,10 +171,12 @@ EXPORTS
     ?initializeThreading@JSC@@YAXXZ
     ?initializeThreading@WTF@@YAXXZ
     ?is8Bit@UString@JSC@@QBE_NXZ
+    ?isAccessorDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
     ?isBusy@Heap@JSC@@QAE_NXZ
+    ?isDataDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
     ?isDynamicScope@JSGlobalObject@JSC@@UBE_NXZ
     ?isGetterSetter@JSCell@JSC@@UBE_NXZ
-    ?isHostFunction@FunctionBodyNode@JSC@@QBE_NXZ
+    ?isHostFunctionNonInline@JSFunction@JSC@@ABE_NXZ
     ?isMainThread@WTF@@YA_NXZ
     ?isVariableObject@JSVariableObject@JSC@@UBE_NXZ
     ?jsNumberCell@JSC@@YA?AVJSValue@1@PAVExecState@1@N@Z
@@ -178,9 +192,10 @@ EXPORTS
     ?lookupSetter@JSObject@JSC@@UAE?AVJSValue@2@PAVExecState@2@ABVIdentifier@2@@Z
     ?markChildren@JSGlobalObject@JSC@@UAEXAAVMarkStack@2@@Z
     ?markChildren@JSObject@JSC@@UAEXAAVMarkStack@2@@Z
-    ?markChildren@JSWrapperObject@JSC@@UAEXAAVMarkStack@2@@Z
+    ?markChildren@JSWrapperObject@JSC@@EAEXAAVMarkStack@2@@Z
     ?materializePropertyMap@Structure@JSC@@AAEXXZ
     ?name@InternalFunction@JSC@@QAEABVUString@2@PAVJSGlobalData@2@@Z
+    ?nonInlineNaN@JSC@@YANXZ
     ?objectCount@Heap@JSC@@QAEIXZ
     ?objectProtoFuncToString@JSC@@YI?AVJSValue@1@PAVExecState@1@PAVJSObject@1@V21@ABVArgList@1@@Z
     ?parse@Parser@JSC@@AAEXPAVJSGlobalData@2@PAHPAVUString@2@@Z
@@ -204,6 +219,7 @@ EXPORTS
     ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I_NAAVPutPropertySlot@2@@Z
     ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@IVJSValue@2@I@Z
     ?randomNumber@WTF@@YANXZ
+    ?recompileAllJSFunctions@Debugger@JSC@@QAEXPAVJSGlobalData@2@@Z
     ?recordExtraCost@Heap@JSC@@AAEXI@Z
     ?releaseStack@MarkStack@JSC@@CAXPAXI@Z
     ?reset@ParserArena@JSC@@QAEXXZ
@@ -211,21 +227,34 @@ EXPORTS
     ?restoreAll@Profile@JSC@@QAEXXZ
     ?retrieveCaller@Interpreter@JSC@@QBE?AVJSValue@2@PAVExecState@2@PAVInternalFunction@2@@Z
     ?retrieveLastCaller@Interpreter@JSC@@QBEXPAVExecState@2@AAH1AAVUString@2@AAVJSValue@2@@Z
+    ?setAccessorDescriptor@PropertyDescriptor@JSC@@QAEXVJSValue@2@0I@Z
+    ?setConfigurable@PropertyDescriptor@JSC@@QAEX_N@Z
+    ?setDescriptor@PropertyDescriptor@JSC@@QAEXVJSValue@2@I@Z
     ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z
-    ?setGCProtectNeedsLocking@Heap@JSC@@QAEXXZ
+    ?setEnumerable@PropertyDescriptor@JSC@@QAEX_N@Z
+    ?setGetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
+    ?setLength@JSArray@JSC@@QAEXI@Z
     ?setLoc@StatementNode@JSC@@QAEXHH@Z
     ?setMainThreadCallbacksPaused@WTF@@YAX_N@Z
     ?setOrderLowerFirst@Collator@WTF@@QAEX_N@Z
+    ?setSetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
+    ?setUndefined@PropertyDescriptor@JSC@@QAEXXZ
     ?setUpStaticFunctionSlot@JSC@@YAXPAVExecState@1@PBVHashEntry@1@PAVJSObject@1@ABVIdentifier@1@AAVPropertySlot@1@@Z
+    ?setWritable@PropertyDescriptor@JSC@@QAEX_N@Z
+    ?setter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
     ?sharedBuffer@Rep@UString@JSC@@QAEPAV?$CrossThreadRefCounted@V?$OwnFastMallocPtr@_W@WTF@@@WTF@@XZ
     ?signal@ThreadCondition@WTF@@QAEXXZ
     ?slowAppend@MarkedArgumentBuffer@JSC@@AAEXVJSValue@2@@Z
     ?startIgnoringLeaks@Structure@JSC@@SAXXZ
     ?startProfiling@Profiler@JSC@@QAEXPAVExecState@2@ABVUString@2@@Z
+    ?startSampling@JSGlobalData@JSC@@QAEXXZ
     ?stopIgnoringLeaks@Structure@JSC@@SAXXZ
     ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVUString@2@@Z
+    ?stopSampling@JSGlobalData@JSC@@QAEXXZ
     ?strtod@WTF@@YANPBDPAPAD@Z
     ?substr@UString@JSC@@QBE?AV12@HH@Z
+    ?symbolTableGet@JSVariableObject@JSC@@IAE_NABVIdentifier@2@AAVPropertyDescriptor@2@@Z
+    ?synthesizePrototype@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
     ?thisObject@DebuggerCallFrame@JSC@@QBEPAVJSObject@2@XZ
     ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@@Z
     ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@ABVUString@1@@Z
@@ -233,36 +262,36 @@ EXPORTS
     ?timedWait@ThreadCondition@WTF@@QAE_NAAVMutex@2@N@Z
     ?tlsKeyCount@WTF@@YAAAJXZ
     ?tlsKeys@WTF@@YAPAKXZ
-    ?toBoolean@JSAPIValueWrapper@JSC@@UBE_NPAVExecState@2@@Z
+    ?toBoolean@JSCell@JSC@@UBE_NPAVExecState@2@@Z
     ?toBoolean@JSObject@JSC@@UBE_NPAVExecState@2@@Z
     ?toBoolean@JSString@JSC@@EBE_NPAVExecState@2@@Z
     ?toInt32SlowCase@JSC@@YAHNAA_N@Z
-    ?toNumber@JSAPIValueWrapper@JSC@@UBENPAVExecState@2@@Z
+    ?toNumber@JSCell@JSC@@UBENPAVExecState@2@@Z
     ?toNumber@JSObject@JSC@@UBENPAVExecState@2@@Z
     ?toNumber@JSString@JSC@@EBENPAVExecState@2@@Z
-    ?toObject@JSAPIValueWrapper@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
+    ?toObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
     ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
     ?toObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toPrimitive@JSAPIValueWrapper@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
+    ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
+    ?toPrimitive@JSCell@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
     ?toPrimitive@JSString@JSC@@EBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
     ?toStrictUInt32@UString@JSC@@QBEIPA_N@Z
-    ?toString@JSAPIValueWrapper@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
+    ?toString@JSCell@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
     ?toString@JSObject@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
     ?toString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
-    ?toString@StringObject@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
     ?toThisJSString@JSCell@JSC@@UAEPAVJSString@2@PAVExecState@2@@Z
     ?toThisJSString@JSString@JSC@@EAEPAV12@PAVExecState@2@@Z
-    ?toThisJSString@StringObject@JSC@@EAEPAVJSString@2@PAVExecState@2@@Z
     ?toThisObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
     ?toThisObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
     ?toThisObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
+    ?toThisObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
     ?toThisString@JSCell@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
     ?toThisString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
-    ?toThisString@StringObject@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
     ?toUInt32@UString@JSC@@QBEIPA_N@Z
     ?toUInt32@UString@JSC@@QBEIPA_N_N@Z
     ?toUInt32SlowCase@JSC@@YAINAA_N@Z
-    ?tryFastCalloc@WTF@@YAPAXII@Z
+    ?tryFastCalloc@WTF@@YA?AUTryMallocReturnValue@1@II@Z
+    ?tryFastMalloc@WTF@@YA?AUTryMallocReturnValue@1@I@Z
     ?tryLock@Mutex@WTF@@QAE_NXZ
     ?type@DebuggerCallFrame@JSC@@QBE?AW4Type@12@XZ
     ?unlock@JSLock@JSC@@SAXW4JSLockBehavior@2@@Z
@@ -272,6 +301,7 @@ EXPORTS
     ?unwrappedObject@JSObject@JSC@@UAEPAV12@XZ
     ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
     ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
+    ?writable@PropertyDescriptor@JSC@@QBE_NXZ
     WTFLog
     WTFLogVerbose
     WTFReportArgumentAssertionFailure
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops
index 20b32f3..d78ff43 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops
+++ b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops
@@ -1,26 +1,26 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="WTFCommon"
-	OutputDirectory="$(WebKitOutputDir)\lib"
-	>
-	<Tool
-		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../parser/;../../wtf/;../../wtf/unicode/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;../../bindings;../../bindings/c;../../bindings/jni;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
-		PreprocessorDefinitions="__STD_C"
-	/>
-	<Tool
-		Name="VCLibrarianTool"
-		AdditionalDependencies="user32.lib"
-		OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).lib"
-	/>
-	<Tool
-		Name="VCPostBuildEventTool"
-		CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"
-	/>
-	<Tool
-		Name="VCPreBuildEventTool"
-		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WTFCommon"

+	OutputDirectory="$(WebKitOutputDir)\lib"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../parser/;../../wtf/;../../wtf/unicode/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;../../../icu/include;../../bindings;../../bindings/c;../../bindings/jni;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"

+		PreprocessorDefinitions="__STD_C"

+	/>

+	<Tool

+		Name="VCLibrarianTool"

+		AdditionalDependencies="user32.lib"

+		OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).lib"

+	/>

+	<Tool

+		Name="VCPostBuildEventTool"

+		CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

+	/>

+	<Tool

+		Name="VCPreBuildEventTool"

+		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c"

+	/>

+</VisualStudioPropertySheet>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
index ce2fe04..dd18269 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
@@ -199,6 +199,67 @@
 				Name="VCPostBuildEventTool"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_CFLite|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_wincairo.vsprops;.\jscCommon.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
index 3a1e42e..7e8a193 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
+++ b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
@@ -20,6 +20,6 @@
 	/>
 	<Tool
 		Name="VCPreBuildEventTool"
-		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
+		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
 	/>
 </VisualStudioPropertySheet>
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
index ef45c5b..fbc4672 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
@@ -18,7 +18,7 @@
 		<Configuration

 			Name="Debug|Win32"

 			ConfigurationType="1"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

@@ -79,7 +79,7 @@
 		<Configuration

 			Name="Release|Win32"

 			ConfigurationType="1"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\testapiCommon.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"

 			CharacterSet="1"

 			WholeProgramOptimization="1"

 			>

@@ -141,7 +141,7 @@
 		<Configuration

 			Name="Debug_Internal|Win32"

 			ConfigurationType="1"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\testapiCommon.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

@@ -199,6 +199,129 @@
 				Name="VCPostBuildEventTool"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_CFLite|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_wincairo.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_CFLite|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

@@ -230,6 +353,22 @@
 					CompileAs="2"

 				/>

 			</FileConfiguration>

+			<FileConfiguration

+				Name="Debug_CFLite|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					CompileAs="2"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release_CFLite|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					CompileAs="2"

+				/>

+			</FileConfiguration>

 		</File>

 		<File

 			RelativePath="..\..\API\tests\testapi.js"

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
index 2a36c18..7c6d126 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
+++ b/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
@@ -12,7 +12,7 @@
 	/>
 	<Tool
 		Name="VCLinkerTool"
-		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WTF$(WebKitConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib"
+		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WTF$(WebKitConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib"
 		SubSystem="1"
 	/>
 	<Tool
@@ -21,6 +21,6 @@
 	/>
 	<Tool
 		Name="VCPreBuildEventTool"
-		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
+		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
 	/>
 </VisualStudioPropertySheet>
diff --git a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 6c3d49f..f108b77 100644
--- a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -67,6 +67,7 @@
 		1429DAC00ED263E700B89619 /* WRECParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429DABE0ED263E700B89619 /* WRECParser.cpp */; };
 		1429DAE00ED2645B00B89619 /* WRECGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 1429DADE0ED2645B00B89619 /* WRECGenerator.h */; };
 		1429DAE10ED2645B00B89619 /* WRECGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429DADF0ED2645B00B89619 /* WRECGenerator.cpp */; };
+		142D3939103E4560007DCB52 /* NumericStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D3938103E4560007DCB52 /* NumericStrings.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		143A97E60A4A06E200456B66 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */; };
 		1440057F0A5335640005F061 /* JSNode.c in Sources */ = {isa = PBXBuildFile; fileRef = 1440F6420A4F8B6A0005F061 /* JSNode.c */; };
 		144005CB0A5338D10005F061 /* JSNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 1440F6410A4F8B6A0005F061 /* JSNode.h */; };
@@ -95,7 +96,7 @@
 		14BD5A300A3E91F600BAF59C /* JSContextRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14BD5A290A3E91F600BAF59C /* JSContextRef.cpp */; };
 		14BD5A320A3E91F600BAF59C /* JSValueRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */; };
 		14C5242B0F5355E900BA3D04 /* JITStubs.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A6581A0F4E36F4000150FD /* JITStubs.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		14F3488F0E95EF8A003648BC /* CollectorHeapIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 14F3488E0E95EF8A003648BC /* CollectorHeapIterator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14F3488F0E95EF8A003648BC /* CollectorHeapIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 14F3488E0E95EF8A003648BC /* CollectorHeapIterator.h */; settings = {ATTRIBUTES = (); }; };
 		180B9B080F16D94F009BDBC5 /* CurrentTime.h in Headers */ = {isa = PBXBuildFile; fileRef = 180B9AF00F16C569009BDBC5 /* CurrentTime.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		180B9BFE0F16E94D009BDBC5 /* CurrentTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 180B9AEF0F16C569009BDBC5 /* CurrentTime.cpp */; };
 		1C61516C0EBAC7A00031376F /* ProfilerServer.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1C61516A0EBAC7A00031376F /* ProfilerServer.mm */; settings = {COMPILER_FLAGS = "-fno-strict-aliasing"; }; };
@@ -109,8 +110,8 @@
 		5D5D8AB60E0D0A7200F9C692 /* jsc in Copy Into Framework */ = {isa = PBXBuildFile; fileRef = 932F5BE10822A1C700736975 /* jsc */; };
 		5D5D8AD10E0D0EBE00F9C692 /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
 		5D6A566B0F05995500266145 /* Threading.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D6A566A0F05995500266145 /* Threading.cpp */; };
-		5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */ = {isa = PBXBuildFile; fileRef = F692A8540255597D01FF60F7 /* create_hash_table */; settings = {ATTRIBUTES = (Private, ); }; };
-		6507D29E0E871E5E00D7D896 /* TypeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 6507D2970E871E4A00D7D896 /* TypeInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */ = {isa = PBXBuildFile; fileRef = F692A8540255597D01FF60F7 /* create_hash_table */; settings = {ATTRIBUTES = (); }; };
+		6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 6507D2970E871E4A00D7D896 /* JSTypeInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		659126BD0BDD1728001921FB /* AllInOneFile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 659126BC0BDD1728001921FB /* AllInOneFile.cpp */; };
 		65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65DFC92D08EA173A00F7300B /* HashTable.cpp */; };
 		65FDE49C0BDD1D4A00E80111 /* Assertions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B808E7EECC0023E5F6 /* Assertions.cpp */; settings = {COMPILER_FLAGS = "-Wno-missing-format-attribute"; }; };
@@ -132,6 +133,8 @@
 		86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */; };
 		86ADD1460FDDEA980006EEC2 /* MacroAssemblerARMv7.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ADD1440FDDEA980006EEC2 /* MacroAssemblerARMv7.h */; };
 		86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */; };
+		86CA032E1038E8440028A609 /* Executable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86CA032D1038E8440028A609 /* Executable.cpp */; };
+		86CAFEE31035DDE60028A609 /* Executable.h in Headers */ = {isa = PBXBuildFile; fileRef = 86CAFEE21035DDE60028A609 /* Executable.h */; settings = {ATTRIBUTES = (); }; };
 		86CC85A10EE79A4700288682 /* JITInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = 86CC85A00EE79A4700288682 /* JITInlineMethods.h */; };
 		86CC85A30EE79B7400288682 /* JITCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86CC85A20EE79B7400288682 /* JITCall.cpp */; };
 		86CC85C40EE7A89400288682 /* JITPropertyAccess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86CC85C30EE7A89400288682 /* JITPropertyAccess.cpp */; };
@@ -155,7 +158,7 @@
 		905B02AE0E28640F006DF882 /* RefCountedLeakCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 905B02AD0E28640F006DF882 /* RefCountedLeakCounter.cpp */; };
 		90D3469C0E285280009492EE /* RefCountedLeakCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 90D3469B0E285280009492EE /* RefCountedLeakCounter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93052C320FB792190048FDC3 /* ParserArena.cpp */; };
-		93052C350FB792190048FDC3 /* ParserArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 93052C330FB792190048FDC3 /* ParserArena.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		93052C350FB792190048FDC3 /* ParserArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 93052C330FB792190048FDC3 /* ParserArena.h */; settings = {ATTRIBUTES = (); }; };
 		930754C108B0F68000AB3056 /* pcre_compile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 930754BF08B0F68000AB3056 /* pcre_compile.cpp */; };
 		930754D008B0F74600AB3056 /* pcre_tables.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 930754CE08B0F74500AB3056 /* pcre_tables.cpp */; };
 		930754EB08B0F78500AB3056 /* pcre_exec.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 930754E908B0F78500AB3056 /* pcre_exec.cpp */; settings = {COMPILER_FLAGS = "-fno-move-loop-invariants"; }; };
@@ -207,11 +210,13 @@
 		A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */; };
 		A7C530E4102A3813005BC741 /* MarkStackPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */; };
+		A7D649AA1015224E009B2E1B /* PossiblyNull.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D649A91015224E009B2E1B /* PossiblyNull.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E2EA690FB460CF00601F06 /* LiteralParser.h */; };
 		A7E2EA6C0FB460CF00601F06 /* LiteralParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */; };
 		A7F9935F0FD7325100A0B2D0 /* JSONObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F9935D0FD7325100A0B2D0 /* JSONObject.h */; };
 		A7F993600FD7325100A0B2D0 /* JSONObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7F9935E0FD7325100A0B2D0 /* JSONObject.cpp */; };
-		A7F9949B0FD746A300A0B2D0 /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F9949A0FD746A300A0B2D0 /* JSONObject.lut.h */; };
+		A7FB60A4103F7DC20017A286 /* PropertyDescriptor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7FB60A3103F7DC20017A286 /* PropertyDescriptor.cpp */; };
+		A7FB61001040C38B0017A286 /* PropertyDescriptor.h in Headers */ = {isa = PBXBuildFile; fileRef = A7FB604B103F5EAB0017A286 /* PropertyDescriptor.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC02E90D0E1839DB000F9297 /* ErrorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9050E1839DB000F9297 /* ErrorConstructor.h */; };
 		BC02E90F0E1839DB000F9297 /* ErrorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9070E1839DB000F9297 /* ErrorPrototype.h */; };
 		BC02E9110E1839DB000F9297 /* NativeErrorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9090E1839DB000F9297 /* NativeErrorConstructor.h */; };
@@ -240,7 +245,7 @@
 		BC18C3FC0E16F5CD00B34460 /* Deque.h in Headers */ = {isa = PBXBuildFile; fileRef = 5186111D0CC824830081412B /* Deque.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3FD0E16F5CD00B34460 /* DisallowCType.h in Headers */ = {isa = PBXBuildFile; fileRef = 938C4F6B0CA06BCE00D9310A /* DisallowCType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3FE0E16F5CD00B34460 /* dtoa.h in Headers */ = {isa = PBXBuildFile; fileRef = 651F6413039D5B5F0078395C /* dtoa.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4000E16F5CD00B34460 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; };
+		BC18C4000E16F5CD00B34460 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4020E16F5CD00B34460 /* FastMalloc.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E217BA08E7EECC0023E5F6 /* FastMalloc.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4030E16F5CD00B34460 /* Forward.h in Headers */ = {isa = PBXBuildFile; fileRef = 935AF46909E9D9DB00ACD1D8 /* Forward.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4040E16F5CD00B34460 /* FunctionConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C10E16D4E900A06E92 /* FunctionConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -293,7 +298,7 @@
 		BC18C43B0E16F5CD00B34460 /* MathExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF6553B0A2048DE0038A194 /* MathExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A86B0255597D01FF60F7 /* MathObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C43E0E16F5CD00B34460 /* MessageQueue.h in Headers */ = {isa = PBXBuildFile; fileRef = E1EE798B0D6CA53D00FEA3BA /* MessageQueue.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C43F0E16F5CD00B34460 /* Nodes.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A86E0255597D01FF60F7 /* Nodes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C43F0E16F5CD00B34460 /* Nodes.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A86E0255597D01FF60F7 /* Nodes.h */; settings = {ATTRIBUTES = (); }; };
 		BC18C4400E16F5CD00B34460 /* Noncopyable.h in Headers */ = {isa = PBXBuildFile; fileRef = 9303F5690991190000AD71B8 /* Noncopyable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4410E16F5CD00B34460 /* NumberConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C30E16D4E900A06E92 /* NumberConstructor.h */; };
 		BC18C4420E16F5CD00B34460 /* NumberConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */; };
@@ -304,7 +309,7 @@
 		BC18C4480E16F5CD00B34460 /* Operations.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8780255597D01FF60F7 /* Operations.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4490E16F5CD00B34460 /* OwnArrayPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 9303F5A409911A5800AD71B8 /* OwnArrayPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C44A0E16F5CD00B34460 /* OwnPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 9303F567099118FA00AD71B8 /* OwnPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */ = {isa = PBXBuildFile; fileRef = 93F0B3AA09BB4DC00068FCE3 /* Parser.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */ = {isa = PBXBuildFile; fileRef = 93F0B3AA09BB4DC00068FCE3 /* Parser.h */; settings = {ATTRIBUTES = (); }; };
 		BC18C44C0E16F5CD00B34460 /* PassRefPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 6580F795094070560082C219 /* PassRefPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C44D0E16F5CD00B34460 /* pcre.h in Headers */ = {isa = PBXBuildFile; fileRef = 6541720F039E08B90058BFEB /* pcre.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C44E0E16F5CD00B34460 /* pcre_internal.h in Headers */ = {isa = PBXBuildFile; fileRef = 93E26BE508B1517100F85226 /* pcre_internal.h */; };
@@ -362,6 +367,7 @@
 		BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; };
 		BC7F8FB90E19D1C3008632C0 /* JSNumberCell.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7F8FB80E19D1C3008632C0 /* JSNumberCell.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; };
 		BC9041480EB9250900FE26FA /* StructureTransitionTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9041470EB9250900FE26FA /* StructureTransitionTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC95437D0EBA70FD0072B6D3 /* PropertyMapHashTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC95437C0EBA70FD0072B6D3 /* PropertyMapHashTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCCF0D080EF0AAB900413C8F /* StructureStubInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */; };
@@ -502,6 +508,7 @@
 		1429DABE0ED263E700B89619 /* WRECParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WRECParser.cpp; sourceTree = "<group>"; };
 		1429DADE0ED2645B00B89619 /* WRECGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WRECGenerator.h; sourceTree = "<group>"; };
 		1429DADF0ED2645B00B89619 /* WRECGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WRECGenerator.cpp; sourceTree = "<group>"; };
+		142D3938103E4560007DCB52 /* NumericStrings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumericStrings.h; sourceTree = "<group>"; };
 		1440051F0A531D3B0005F061 /* Node.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Node.h; path = tests/Node.h; sourceTree = "<group>"; };
 		144005200A531D3B0005F061 /* Node.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = Node.c; path = tests/Node.c; sourceTree = "<group>"; };
 		144007480A536CC20005F061 /* NodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NodeList.h; path = tests/NodeList.h; sourceTree = "<group>"; };
@@ -584,7 +591,7 @@
 		5DA479650CFBCF56009328A0 /* TCPackedCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TCPackedCache.h; sourceTree = "<group>"; };
 		5DBD18AF0C5401A700C15EAE /* MallocZoneSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MallocZoneSupport.h; sourceTree = "<group>"; };
 		5DE3D0F40DD8DDFB00468714 /* WebKitAvailability.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAvailability.h; sourceTree = "<group>"; };
-		6507D2970E871E4A00D7D896 /* TypeInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeInfo.h; sourceTree = "<group>"; };
+		6507D2970E871E4A00D7D896 /* JSTypeInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypeInfo.h; sourceTree = "<group>"; };
 		651F6412039D5B5F0078395C /* dtoa.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = dtoa.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		651F6413039D5B5F0078395C /* dtoa.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = dtoa.h; sourceTree = "<group>"; tabWidth = 8; };
 		652246A40C8D7A0E007BDAF7 /* HashIterators.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashIterators.h; sourceTree = "<group>"; };
@@ -646,6 +653,8 @@
 		86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ARMv7Assembler.h; sourceTree = "<group>"; };
 		86ADD1440FDDEA980006EEC2 /* MacroAssemblerARMv7.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerARMv7.h; sourceTree = "<group>"; };
 		86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssembler.h; sourceTree = "<group>"; };
+		86CA032D1038E8440028A609 /* Executable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Executable.cpp; sourceTree = "<group>"; };
+		86CAFEE21035DDE60028A609 /* Executable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Executable.h; sourceTree = "<group>"; };
 		86CC85A00EE79A4700288682 /* JITInlineMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITInlineMethods.h; sourceTree = "<group>"; };
 		86CC85A20EE79B7400288682 /* JITCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITCall.cpp; sourceTree = "<group>"; };
 		86CC85C30EE7A89400288682 /* JITPropertyAccess.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITPropertyAccess.cpp; sourceTree = "<group>"; };
@@ -752,6 +761,7 @@
 		A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutableAllocator.h; sourceTree = "<group>"; };
 		A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocator.cpp; sourceTree = "<group>"; };
 		A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStackPosix.cpp; sourceTree = "<group>"; };
+		A7D649A91015224E009B2E1B /* PossiblyNull.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PossiblyNull.h; sourceTree = "<group>"; };
 		A7E2EA690FB460CF00601F06 /* LiteralParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LiteralParser.h; sourceTree = "<group>"; };
 		A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LiteralParser.cpp; sourceTree = "<group>"; };
 		A7E42C180E3938830065A544 /* JSStaticScopeObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStaticScopeObject.h; sourceTree = "<group>"; };
@@ -760,7 +770,8 @@
 		A7F869EC0F95C2EC00558697 /* CallFrameClosure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallFrameClosure.h; sourceTree = "<group>"; };
 		A7F9935D0FD7325100A0B2D0 /* JSONObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSONObject.h; sourceTree = "<group>"; };
 		A7F9935E0FD7325100A0B2D0 /* JSONObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSONObject.cpp; sourceTree = "<group>"; };
-		A7F9949A0FD746A300A0B2D0 /* JSONObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSONObject.lut.h; path = /Users/oliver/builds/Debug/DerivedSources/JavaScriptCore/JSONObject.lut.h; sourceTree = "<absolute>"; };
+		A7FB604B103F5EAB0017A286 /* PropertyDescriptor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyDescriptor.h; sourceTree = "<group>"; };
+		A7FB60A3103F7DC20017A286 /* PropertyDescriptor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertyDescriptor.cpp; sourceTree = "<group>"; };
 		A8E894310CD0602400367179 /* JSCallbackObjectFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackObjectFunctions.h; sourceTree = "<group>"; };
 		A8E894330CD0603F00367179 /* JSGlobalObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObject.h; sourceTree = "<group>"; };
 		BC02E9040E1839DB000F9297 /* ErrorConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ErrorConstructor.cpp; sourceTree = "<group>"; };
@@ -831,6 +842,7 @@
 		BC7952350E15EB5600A898AB /* BooleanPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BooleanPrototype.h; sourceTree = "<group>"; };
 		BC7F8FB80E19D1C3008632C0 /* JSNumberCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNumberCell.h; sourceTree = "<group>"; };
 		BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCell.cpp; sourceTree = "<group>"; };
+		BC87CDB810712ACA000614CF /* JSONObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSONObject.lut.h; sourceTree = "<group>"; };
 		BC8F3CCF0DAF17BA00577A80 /* ConstructData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstructData.h; sourceTree = "<group>"; };
 		BC9041470EB9250900FE26FA /* StructureTransitionTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureTransitionTable.h; sourceTree = "<group>"; };
 		BC95437C0EBA70FD0072B6D3 /* PropertyMapHashTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyMapHashTable.h; sourceTree = "<group>"; };
@@ -1176,7 +1188,7 @@
 				BCD203E70E1718F4002C7E82 /* DatePrototype.lut.h */,
 				65FB3F4809D11B2400F49DEB /* grammar.cpp */,
 				BC18C52F0E16FCEB00B34460 /* grammar.h */,
-				A7F9949A0FD746A300A0B2D0 /* JSONObject.lut.h */,
+				BC87CDB810712ACA000614CF /* JSONObject.lut.h */,
 				BC18C52D0E16FCE100B34460 /* lexer.lut.h */,
 				BC18C5290E16FCC200B34460 /* MathObject.lut.h */,
 				BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */,
@@ -1242,6 +1254,7 @@
 				44DD48520FAEA85000D6B4EB /* PassOwnPtr.h */,
 				6580F795094070560082C219 /* PassRefPtr.h */,
 				65D6D87E09B5A32E0002E4D7 /* Platform.h */,
+				A7D649A91015224E009B2E1B /* PossiblyNull.h */,
 				0B1F921B0F17502D0036468E /* PtrAndFlags.h */,
 				088FA5B90EF76D4300578E6F /* RandomNumber.cpp */,
 				088FA5BA0EF76D4300578E6F /* RandomNumber.h */,
@@ -1330,6 +1343,7 @@
 		7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
 			isa = PBXGroup;
 			children = (
+				A7FB604B103F5EAB0017A286 /* PropertyDescriptor.h */,
 				BCF605110E203EF800B9A64D /* ArgList.cpp */,
 				BCF605120E203EF800B9A64D /* ArgList.h */,
 				BC257DE50E1F51C50016B6C9 /* Arguments.cpp */,
@@ -1375,6 +1389,8 @@
 				BC02E9070E1839DB000F9297 /* ErrorPrototype.h */,
 				1429D8770ED21ACD00B89619 /* ExceptionHelpers.cpp */,
 				A72701B30DADE94900E548D7 /* ExceptionHelpers.h */,
+				86CA032D1038E8440028A609 /* Executable.cpp */,
+				86CAFEE21035DDE60028A609 /* Executable.h */,
 				BC2680C00E16D4E900A06E92 /* FunctionConstructor.cpp */,
 				BC2680C10E16D4E900A06E92 /* FunctionConstructor.h */,
 				F692A85C0255597D01FF60F7 /* FunctionPrototype.cpp */,
@@ -1447,6 +1463,7 @@
 				F692A8710255597D01FF60F7 /* NumberObject.h */,
 				BC2680C40E16D4E900A06E92 /* NumberPrototype.cpp */,
 				BC2680C50E16D4E900A06E92 /* NumberPrototype.h */,
+				142D3938103E4560007DCB52 /* NumericStrings.h */,
 				BC2680C60E16D4E900A06E92 /* ObjectConstructor.cpp */,
 				BC2680C70E16D4E900A06E92 /* ObjectConstructor.h */,
 				BC2680C80E16D4E900A06E92 /* ObjectPrototype.cpp */,
@@ -1493,12 +1510,13 @@
 				14A42E3E0F4F60EE00599099 /* TimeoutChecker.h */,
 				5D53726D0E1C546B0021E549 /* Tracing.d */,
 				5D53726E0E1C54880021E549 /* Tracing.h */,
-				6507D2970E871E4A00D7D896 /* TypeInfo.h */,
+				6507D2970E871E4A00D7D896 /* JSTypeInfo.h */,
 				F692A8850255597D01FF60F7 /* UString.cpp */,
 				F692A8860255597D01FF60F7 /* UString.h */,
 				A779558F101A74D500114E55 /* MarkStack.h */,
 				A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */,
 				A74B3498102A5F8E0032AB98 /* MarkStack.cpp */,
+				A7FB60A3103F7DC20017A286 /* PropertyDescriptor.cpp */,
 			);
 			path = runtime;
 			sourceTree = "<group>";
@@ -1760,7 +1778,6 @@
 				BC18C4240E16F5CD00B34460 /* JSObject.h in Headers */,
 				BC18C4250E16F5CD00B34460 /* JSObjectRef.h in Headers */,
 				A7F9935F0FD7325100A0B2D0 /* JSONObject.h in Headers */,
-				A7F9949B0FD746A300A0B2D0 /* JSONObject.lut.h in Headers */,
 				9534AAFB0E5B7A9600B8A45B /* JSProfilerPrivate.h in Headers */,
 				BC18C4260E16F5CD00B34460 /* JSRetainPtr.h in Headers */,
 				BC18C4270E16F5CD00B34460 /* JSString.h in Headers */,
@@ -1884,7 +1901,7 @@
 				BC18C4710E16F5CD00B34460 /* ThreadSpecific.h in Headers */,
 				14A42E400F4F60EE00599099 /* TimeoutChecker.h in Headers */,
 				5D53726F0E1C54880021E549 /* Tracing.h in Headers */,
-				6507D29E0E871E5E00D7D896 /* TypeInfo.h in Headers */,
+				6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */,
 				0B4D7E630F319AC800AD7E58 /* TypeTraits.h in Headers */,
 				BC18C4720E16F5CD00B34460 /* ucpinternal.h in Headers */,
 				BC18C4730E16F5CD00B34460 /* Unicode.h in Headers */,
@@ -1902,6 +1919,11 @@
 				1429DABF0ED263E700B89619 /* WRECParser.h in Headers */,
 				9688CB160ED12B4E001D649F /* X86Assembler.h in Headers */,
 				A7795590101A74D500114E55 /* MarkStack.h in Headers */,
+				A7D649AA1015224E009B2E1B /* PossiblyNull.h in Headers */,
+				86CAFEE31035DDE60028A609 /* Executable.h in Headers */,
+				142D3939103E4560007DCB52 /* NumericStrings.h in Headers */,
+				A7FB61001040C38B0017A286 /* PropertyDescriptor.h in Headers */,
+				BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2270,6 +2292,8 @@
 				1429DAC00ED263E700B89619 /* WRECParser.cpp in Sources */,
 				A7C530E4102A3813005BC741 /* MarkStackPosix.cpp in Sources */,
 				A74B3499102A5F8E0032AB98 /* MarkStack.cpp in Sources */,
+				86CA032E1038E8440028A609 /* Executable.cpp in Sources */,
+				A7FB60A4103F7DC20017A286 /* PropertyDescriptor.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/JavaScriptCore/JavaScriptCoreSources.bkl b/JavaScriptCore/JavaScriptCoreSources.bkl
index 1bdf251..1852d12 100644
--- a/JavaScriptCore/JavaScriptCoreSources.bkl
+++ b/JavaScriptCore/JavaScriptCoreSources.bkl
@@ -134,6 +134,7 @@ Source files for JSCore.
         runtime/ObjectConstructor.cpp
         runtime/ObjectPrototype.cpp
         runtime/Operations.cpp
+        runtime/PropertyDescriptor.cpp
         runtime/PropertyNameArray.cpp
         runtime/PropertySlot.cpp
         runtime/PrototypeFunction.cpp
diff --git a/JavaScriptCore/assembler/ARMAssembler.cpp b/JavaScriptCore/assembler/ARMAssembler.cpp
index 69daa16..1324586 100644
--- a/JavaScriptCore/assembler/ARMAssembler.cpp
+++ b/JavaScriptCore/assembler/ARMAssembler.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM)
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #include "ARMAssembler.h"
 
@@ -49,11 +49,11 @@ ARMWord* ARMAssembler::getLdrImmAddress(ARMWord* insn, uint32_t* constPool)
         return reinterpret_cast<ARMWord*>(addr - (*insn & SDT_OFFSET_MASK));
 }
 
-void ARMAssembler::linkBranch(void* code, JmpSrc from, void* to)
+void ARMAssembler::linkBranch(void* code, JmpSrc from, void* to, int useConstantPool)
 {
     ARMWord* insn = reinterpret_cast<ARMWord*>(code) + (from.m_offset / sizeof(ARMWord));
 
-    if (!from.m_latePatch) {
+    if (!useConstantPool) {
         int diff = reinterpret_cast<ARMWord*>(to) - reinterpret_cast<ARMWord*>(insn + 2);
 
         if ((diff <= BOFFSET_MAX && diff >= BOFFSET_MIN)) {
@@ -291,10 +291,10 @@ void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID bas
         if (offset <= 0xfff)
             dtr_u(isLoad, srcDst, base, offset);
         else if (offset <= 0xfffff) {
-            add_r(ARM::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_u(isLoad, srcDst, ARM::S0, offset & 0xfff);
+            add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
+            dtr_u(isLoad, srcDst, ARMRegisters::S0, offset & 0xfff);
         } else {
-            ARMWord reg = getImm(offset, ARM::S0);
+            ARMWord reg = getImm(offset, ARMRegisters::S0);
             dtr_ur(isLoad, srcDst, base, reg);
         }
     } else {
@@ -302,10 +302,10 @@ void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID bas
         if (offset <= 0xfff)
             dtr_d(isLoad, srcDst, base, offset);
         else if (offset <= 0xfffff) {
-            sub_r(ARM::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_d(isLoad, srcDst, ARM::S0, offset & 0xfff);
+            sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
+            dtr_d(isLoad, srcDst, ARMRegisters::S0, offset & 0xfff);
         } else {
-            ARMWord reg = getImm(offset, ARM::S0);
+            ARMWord reg = getImm(offset, ARMRegisters::S0);
             dtr_dr(isLoad, srcDst, base, reg);
         }
     }
@@ -319,19 +319,19 @@ void ARMAssembler::baseIndexTransfer32(bool isLoad, RegisterID srcDst, RegisterI
     op2 = lsl(index, scale);
 
     if (offset >= 0 && offset <= 0xfff) {
-        add_r(ARM::S0, base, op2);
-        dtr_u(isLoad, srcDst, ARM::S0, offset);
+        add_r(ARMRegisters::S0, base, op2);
+        dtr_u(isLoad, srcDst, ARMRegisters::S0, offset);
         return;
     }
     if (offset <= 0 && offset >= -0xfff) {
-        add_r(ARM::S0, base, op2);
-        dtr_d(isLoad, srcDst, ARM::S0, -offset);
+        add_r(ARMRegisters::S0, base, op2);
+        dtr_d(isLoad, srcDst, ARMRegisters::S0, -offset);
         return;
     }
 
-    ldr_un_imm(ARM::S0, offset);
-    add_r(ARM::S0, ARM::S0, op2);
-    dtr_ur(isLoad, srcDst, base, ARM::S0);
+    ldr_un_imm(ARMRegisters::S0, offset);
+    add_r(ARMRegisters::S0, ARMRegisters::S0, op2);
+    dtr_ur(isLoad, srcDst, base, ARMRegisters::S0);
 }
 
 void ARMAssembler::doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID base, int32_t offset)
@@ -342,8 +342,8 @@ void ARMAssembler::doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID b
             return;
         }
         if (offset <= 0x3ffff && offset >= 0) {
-            add_r(ARM::S0, base, OP2_IMM | (offset >> 10) | (11 << 8));
-            fdtr_u(isLoad, srcDst, ARM::S0, (offset >> 2) & 0xff);
+            add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 10) | (11 << 8));
+            fdtr_u(isLoad, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
             return;
         }
         offset = -offset;
@@ -353,27 +353,36 @@ void ARMAssembler::doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID b
             return;
         }
         if (offset <= 0x3ffff && offset >= 0) {
-            sub_r(ARM::S0, base, OP2_IMM | (offset >> 10) | (11 << 8));
-            fdtr_d(isLoad, srcDst, ARM::S0, (offset >> 2) & 0xff);
+            sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 10) | (11 << 8));
+            fdtr_d(isLoad, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
             return;
         }
         offset = -offset;
     }
 
-    ldr_un_imm(ARM::S0, offset);
-    add_r(ARM::S0, ARM::S0, base);
-    fdtr_u(isLoad, srcDst, ARM::S0, 0);
+    ldr_un_imm(ARMRegisters::S0, offset);
+    add_r(ARMRegisters::S0, ARMRegisters::S0, base);
+    fdtr_u(isLoad, srcDst, ARMRegisters::S0, 0);
 }
 
 void* ARMAssembler::executableCopy(ExecutablePool* allocator)
 {
+    // 64-bit alignment is required for next constant pool and JIT code as well
+    m_buffer.flushWithoutBarrier(true);
+    if (m_buffer.uncheckedSize() & 0x7)
+        bkpt(0);
+
     char* data = reinterpret_cast<char*>(m_buffer.executableCopy(allocator));
 
     for (Jumps::Iterator iter = m_jumps.begin(); iter != m_jumps.end(); ++iter) {
-        ARMWord* ldrAddr = reinterpret_cast<ARMWord*>(data + *iter);
-        ARMWord* offset = getLdrImmAddress(ldrAddr);
-        if (*offset != 0xffffffff)
-            linkBranch(data, JmpSrc(*iter), data + *offset);
+        // The last bit is set if the constant must be placed on constant pool.
+        int pos = (*iter) & (~0x1);
+        ARMWord* ldrAddr = reinterpret_cast<ARMWord*>(data + pos);
+        ARMWord offset = *getLdrImmAddress(ldrAddr);
+        if (offset != 0xffffffff) {
+            JmpSrc jmpSrc(pos);
+            linkBranch(data, jmpSrc, data + offset, ((*iter) & 1));
+        }
     }
 
     return data;
@@ -381,4 +390,4 @@ void* ARMAssembler::executableCopy(ExecutablePool* allocator)
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM)
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
diff --git a/JavaScriptCore/assembler/ARMAssembler.h b/JavaScriptCore/assembler/ARMAssembler.h
index d3fe782..9f9a450 100644
--- a/JavaScriptCore/assembler/ARMAssembler.h
+++ b/JavaScriptCore/assembler/ARMAssembler.h
@@ -29,55 +29,55 @@
 
 #include <wtf/Platform.h>
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM)
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #include "AssemblerBufferWithConstantPool.h"
 #include <wtf/Assertions.h>
 namespace JSC {
 
-typedef uint32_t ARMWord;
-
-namespace ARM {
-    typedef enum {
-        r0 = 0,
-        r1,
-        r2,
-        r3,
-        S0 = r3,
-        r4,
-        r5,
-        r6,
-        r7,
-        r8,
-        S1 = r8,
-        r9,
-        r10,
-        r11,
-        r12,
-        r13,
-        sp = r13,
-        r14,
-        lr = r14,
-        r15,
-        pc = r15
-    } RegisterID;
-
-    typedef enum {
-        d0,
-        d1,
-        d2,
-        d3,
-        SD0 = d3
-    } FPRegisterID;
-
-} // namespace ARM
+    typedef uint32_t ARMWord;
+
+    namespace ARMRegisters {
+        typedef enum {
+            r0 = 0,
+            r1,
+            r2,
+            r3,
+            S0 = r3,
+            r4,
+            r5,
+            r6,
+            r7,
+            r8,
+            S1 = r8,
+            r9,
+            r10,
+            r11,
+            r12,
+            r13,
+            sp = r13,
+            r14,
+            lr = r14,
+            r15,
+            pc = r15
+        } RegisterID;
+
+        typedef enum {
+            d0,
+            d1,
+            d2,
+            d3,
+            SD0 = d3
+        } FPRegisterID;
+
+    } // namespace ARMRegisters
 
     class ARMAssembler {
     public:
-        typedef ARM::RegisterID RegisterID;
-        typedef ARM::FPRegisterID FPRegisterID;
+        typedef ARMRegisters::RegisterID RegisterID;
+        typedef ARMRegisters::FPRegisterID FPRegisterID;
         typedef AssemblerBufferWithConstantPool<2048, 4, 4, ARMAssembler> ARMBuffer;
-        typedef WTF::SegmentedVector<int, 64> Jumps;
+        typedef SegmentedVector<int, 64> Jumps;
 
         ARMAssembler() { }
 
@@ -180,20 +180,16 @@ namespace ARM {
         public:
             JmpSrc()
                 : m_offset(-1)
-                , m_latePatch(false)
             {
             }
 
-            void enableLatePatch() { m_latePatch = true; }
         private:
             JmpSrc(int offset)
                 : m_offset(offset)
-                , m_latePatch(false)
             {
             }
 
-            int m_offset : 31;
-            int m_latePatch : 1;
+            int m_offset;
         };
 
         class JmpDst {
@@ -334,12 +330,12 @@ namespace ARM {
 
         void mov_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MOV, rd, ARM::r0, op2);
+            emitInst(static_cast<ARMWord>(cc) | MOV, rd, ARMRegisters::r0, op2);
         }
 
         void movs_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MOV | SET_CC, rd, ARM::r0, op2);
+            emitInst(static_cast<ARMWord>(cc) | MOV | SET_CC, rd, ARMRegisters::r0, op2);
         }
 
         void bic_r(int rd, int rn, ARMWord op2, Condition cc = AL)
@@ -354,12 +350,12 @@ namespace ARM {
 
         void mvn_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MVN, rd, ARM::r0, op2);
+            emitInst(static_cast<ARMWord>(cc) | MVN, rd, ARMRegisters::r0, op2);
         }
 
         void mvns_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MVN | SET_CC, rd, ARM::r0, op2);
+            emitInst(static_cast<ARMWord>(cc) | MVN | SET_CC, rd, ARMRegisters::r0, op2);
         }
 
         void mul_r(int rd, int rn, int rm, Condition cc = AL)
@@ -399,12 +395,12 @@ namespace ARM {
 
         void ldr_imm(int rd, ARMWord imm, Condition cc = AL)
         {
-            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARM::pc) | RD(rd), imm, true);
+            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm, true);
         }
 
         void ldr_un_imm(int rd, ARMWord imm, Condition cc = AL)
         {
-            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARM::pc) | RD(rd), imm);
+            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm);
         }
 
         void dtr_u(bool isLoad, int rd, int rb, ARMWord op2, Condition cc = AL)
@@ -462,23 +458,23 @@ namespace ARM {
         void push_r(int reg, Condition cc = AL)
         {
             ASSERT(ARMWord(reg) <= 0xf);
-            m_buffer.putInt(cc | DTR | DT_WB | RN(ARM::sp) | RD(reg) | 0x4);
+            m_buffer.putInt(cc | DTR | DT_WB | RN(ARMRegisters::sp) | RD(reg) | 0x4);
         }
 
         void pop_r(int reg, Condition cc = AL)
         {
             ASSERT(ARMWord(reg) <= 0xf);
-            m_buffer.putInt(cc | (DTR ^ DT_PRE) | DT_LOAD | DT_UP | RN(ARM::sp) | RD(reg) | 0x4);
+            m_buffer.putInt(cc | (DTR ^ DT_PRE) | DT_LOAD | DT_UP | RN(ARMRegisters::sp) | RD(reg) | 0x4);
         }
 
         inline void poke_r(int reg, Condition cc = AL)
         {
-            dtr_d(false, ARM::sp, 0, reg, cc);
+            dtr_d(false, ARMRegisters::sp, 0, reg, cc);
         }
 
         inline void peek_r(int reg, Condition cc = AL)
         {
-            dtr_u(true, reg, ARM::sp, 0, cc);
+            dtr_u(true, reg, ARMRegisters::sp, 0, cc);
         }
 
         void fmsr_r(int dd, int rn, Condition cc = AL)
@@ -509,49 +505,49 @@ namespace ARM {
             m_buffer.putInt(BKPT | ((value & 0xff0) << 4) | (value & 0xf));
 #else
             // Cannot access to Zero memory address
-            dtr_dr(true, ARM::S0, ARM::S0, ARM::S0);
+            dtr_dr(true, ARMRegisters::S0, ARMRegisters::S0, ARMRegisters::S0);
 #endif
         }
 
         static ARMWord lsl(int reg, ARMWord value)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             ASSERT(value <= 0x1f);
             return reg | (value << 7) | 0x00;
         }
 
         static ARMWord lsr(int reg, ARMWord value)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             ASSERT(value <= 0x1f);
             return reg | (value << 7) | 0x20;
         }
 
         static ARMWord asr(int reg, ARMWord value)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             ASSERT(value <= 0x1f);
             return reg | (value << 7) | 0x40;
         }
 
         static ARMWord lsl_r(int reg, int shiftReg)
         {
-            ASSERT(reg <= ARM::pc);
-            ASSERT(shiftReg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(shiftReg <= ARMRegisters::pc);
             return reg | (shiftReg << 8) | 0x10;
         }
 
         static ARMWord lsr_r(int reg, int shiftReg)
         {
-            ASSERT(reg <= ARM::pc);
-            ASSERT(shiftReg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(shiftReg <= ARMRegisters::pc);
             return reg | (shiftReg << 8) | 0x30;
         }
 
         static ARMWord asr_r(int reg, int shiftReg)
         {
-            ASSERT(reg <= ARM::pc);
-            ASSERT(shiftReg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(shiftReg <= ARMRegisters::pc);
             return reg | (shiftReg << 8) | 0x50;
         }
 
@@ -567,6 +563,11 @@ namespace ARM {
             m_buffer.ensureSpace(insnSpace, constSpace);
         }
 
+        int sizeOfConstantPool()
+        {
+            return m_buffer.sizeOfConstantPool();
+        }
+
         JmpDst label()
         {
             return JmpDst(m_buffer.size());
@@ -575,16 +576,17 @@ namespace ARM {
         JmpDst align(int alignment)
         {
             while (!m_buffer.isAligned(alignment))
-                mov_r(ARM::r0, ARM::r0);
+                mov_r(ARMRegisters::r0, ARMRegisters::r0);
 
             return label();
         }
 
-        JmpSrc jmp(Condition cc = AL)
+        JmpSrc jmp(Condition cc = AL, int useConstantPool = 0)
         {
-            int s = size();
-            ldr_un_imm(ARM::pc, 0xffffffff, cc);
-            m_jumps.append(s);
+            ensureSpace(sizeof(ARMWord), sizeof(ARMWord));
+            int s = m_buffer.uncheckedSize();
+            ldr_un_imm(ARMRegisters::pc, 0xffffffff, cc);
+            m_jumps.append(s | (useConstantPool & 0x1));
             return JmpSrc(s);
         }
 
@@ -593,7 +595,7 @@ namespace ARM {
         // Patching helpers
 
         static ARMWord* getLdrImmAddress(ARMWord* insn, uint32_t* constPool = 0);
-        static void linkBranch(void* code, JmpSrc from, void* to);
+        static void linkBranch(void* code, JmpSrc from, void* to, int useConstantPool = 0);
 
         static void patchPointerInternal(intptr_t from, void* to)
         {
@@ -660,7 +662,7 @@ namespace ARM {
 
         static void linkCall(void* code, JmpSrc from, void* to)
         {
-            linkBranch(code, from, to);
+            linkBranch(code, from, to, true);
         }
 
         static void relinkCall(void* from, void* to)
@@ -727,25 +729,25 @@ namespace ARM {
     private:
         ARMWord RM(int reg)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             return reg;
         }
 
         ARMWord RS(int reg)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             return reg << 8;
         }
 
         ARMWord RD(int reg)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             return reg << 12;
         }
 
         ARMWord RN(int reg)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             return reg << 16;
         }
 
@@ -762,6 +764,6 @@ namespace ARM {
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM)
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #endif // ARMAssembler_h
diff --git a/JavaScriptCore/assembler/ARMv7Assembler.h b/JavaScriptCore/assembler/ARMv7Assembler.h
index f7e2fb4..078de44 100644
--- a/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -28,7 +28,7 @@
 
 #include <wtf/Platform.h>
 
-#if ENABLE(ASSEMBLER) && PLATFORM_ARM_ARCH(7)
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_THUMB2)
 
 #include "AssemblerBuffer.h"
 #include <wtf/Assertions.h>
@@ -37,7 +37,7 @@
 
 namespace JSC {
 
-namespace ARM {
+namespace ARMRegisters {
     typedef enum {
         r0,
         r1,
@@ -199,7 +199,7 @@ class ARMThumbImmediate {
         };
     } PatternBytes;
 
-    ALWAYS_INLINE static int32_t countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
+    ALWAYS_INLINE static void countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
     {
         if (value & ~((1<<N)-1)) /* check for any of the top N bits (of 2N bits) are set */ \
             value >>= N;         /* if any were set, lose the bottom N */ \
@@ -407,8 +407,8 @@ register writeback
 
 class ARMv7Assembler {
 public:
-    typedef ARM::RegisterID RegisterID;
-    typedef ARM::FPRegisterID FPRegisterID;
+    typedef ARMRegisters::RegisterID RegisterID;
+    typedef ARMRegisters::FPRegisterID FPRegisterID;
 
     // (HS, LO, HI, LS) -> (AE, B, A, BE)
     // (VS, VC) -> (O, NO)
@@ -442,7 +442,6 @@ public:
         {
         }
 
-        void enableLatePatch() { }
     private:
         JmpSrc(int offset)
             : m_offset(offset)
@@ -481,7 +480,7 @@ private:
     // ARMv7, Appx-A.6.3
     bool BadReg(RegisterID reg)
     {
-        return (reg == ARM::sp) || (reg == ARM::pc);
+        return (reg == ARMRegisters::sp) || (reg == ARMRegisters::pc);
     }
 
     bool isSingleRegister(FPRegisterID reg)
@@ -693,16 +692,16 @@ public:
     void add(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
     {
         // Rd can only be SP if Rn is also SP.
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isValid());
 
-        if (rn == ARM::sp) {
+        if (rn == ARMRegisters::sp) {
             if (!(rd & 8) && imm.isUInt10()) {
                 m_formatter.oneWordOp5Reg3Imm8(OP_ADD_SP_imm_T1, rd, imm.getUInt10() >> 2);
                 return;
-            } else if ((rd == ARM::sp) && imm.isUInt9()) {
+            } else if ((rd == ARMRegisters::sp) && imm.isUInt9()) {
                 m_formatter.oneWordOp9Imm7(OP_ADD_SP_imm_T2, imm.getUInt9() >> 2);
                 return;
             }
@@ -726,9 +725,9 @@ public:
 
     void add(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         m_formatter.twoWordOp12Reg4FourFours(OP_ADD_reg_T3, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
     }
@@ -750,9 +749,9 @@ public:
     void add_S(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
     {
         // Rd can only be SP if Rn is also SP.
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isEncodedImm());
 
         if (!((rd | rn) & 8)) {
@@ -771,9 +770,9 @@ public:
     // Not allowed in an IT (if then) block?
     void add_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         m_formatter.twoWordOp12Reg4FourFours(OP_ADD_S_reg_T3, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
     }
@@ -839,7 +838,7 @@ public:
     // Only allowed in IT (if then) block if last instruction.
     JmpSrc blx(RegisterID rm)
     {
-        ASSERT(rm != ARM::pc);
+        ASSERT(rm != ARMRegisters::pc);
         m_formatter.oneWordOp8RegReg143(OP_BLX, rm, (RegisterID)8);
         return JmpSrc(m_formatter.size());
     }
@@ -858,7 +857,7 @@ public:
 
     void cmn(RegisterID rn, ARMThumbImmediate imm)
     {
-        ASSERT(rn != ARM::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isEncodedImm());
 
         m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_CMN_imm, rn, (RegisterID)0xf, imm);
@@ -866,7 +865,7 @@ public:
 
     void cmp(RegisterID rn, ARMThumbImmediate imm)
     {
-        ASSERT(rn != ARM::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isEncodedImm());
 
         if (!(rn & 8) && imm.isUInt8())
@@ -877,7 +876,7 @@ public:
 
     void cmp(RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
-        ASSERT(rn != ARM::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         m_formatter.twoWordOp12Reg4FourFours(OP_CMP_reg_T2, rn, FourFours(shift.hi4(), 0xf, shift.lo4(), rm));
     }
@@ -939,15 +938,15 @@ public:
         m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if, inst3if, inst4if));
     }
 
-    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
     void ldr(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
     {
-        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
         ASSERT(imm.isUInt12());
 
         if (!((rt | rn) & 8) && imm.isUInt7())
             m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDR_imm_T1, imm.getUInt7() >> 2, rn, rt);
-        else if ((rn == ARM::sp) && !(rt & 8) && imm.isUInt10())
+        else if ((rn == ARMRegisters::sp) && !(rt & 8) && imm.isUInt10())
             m_formatter.oneWordOp5Reg3Imm8(OP_LDR_imm_T2, rt, imm.getUInt10() >> 2);
         else
             m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T3, rn, rt, imm.getUInt12());
@@ -966,8 +965,8 @@ public:
     // if (wback) REG[rn] = _tmp
     void ldr(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
     {
-        ASSERT(rt != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(index || wback);
         ASSERT(!wback | (rt != rn));
     
@@ -986,10 +985,10 @@ public:
         m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T4, rn, rt, offset);
     }
 
-    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
     void ldr(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
     {
-        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
         ASSERT(!BadReg(rm));
         ASSERT(shift <= 3);
 
@@ -999,10 +998,10 @@ public:
             m_formatter.twoWordOp12Reg4FourFours(OP_LDR_reg_T2, rn, FourFours(rt, 0, shift, rm));
     }
 
-    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
     void ldrh(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
     {
-        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
         ASSERT(imm.isUInt12());
 
         if (!((rt | rn) & 8) && imm.isUInt6())
@@ -1024,8 +1023,8 @@ public:
     // if (wback) REG[rn] = _tmp
     void ldrh(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
     {
-        ASSERT(rt != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(index || wback);
         ASSERT(!wback | (rt != rn));
     
@@ -1047,7 +1046,7 @@ public:
     void ldrh(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
     {
         ASSERT(!BadReg(rt));   // Memory hint
-        ASSERT(rn != ARM::pc); // LDRH (literal)
+        ASSERT(rn != ARMRegisters::pc); // LDRH (literal)
         ASSERT(!BadReg(rm));
         ASSERT(shift <= 3);
 
@@ -1198,16 +1197,16 @@ public:
         m_formatter.twoWordOp12Reg4FourFours(OP_SMULL_T1, rn, FourFours(rdLo, rdHi, 0, rm));
     }
 
-    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
     void str(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
     {
-        ASSERT(rt != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isUInt12());
 
         if (!((rt | rn) & 8) && imm.isUInt7())
             m_formatter.oneWordOp5Imm5Reg3Reg3(OP_STR_imm_T1, imm.getUInt7() >> 2, rn, rt);
-        else if ((rn == ARM::sp) && !(rt & 8) && imm.isUInt10())
+        else if ((rn == ARMRegisters::sp) && !(rt & 8) && imm.isUInt10())
             m_formatter.oneWordOp5Reg3Imm8(OP_STR_imm_T2, rt, imm.getUInt10() >> 2);
         else
             m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STR_imm_T3, rn, rt, imm.getUInt12());
@@ -1226,8 +1225,8 @@ public:
     // if (wback) REG[rn] = _tmp
     void str(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
     {
-        ASSERT(rt != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(index || wback);
         ASSERT(!wback | (rt != rn));
     
@@ -1246,10 +1245,10 @@ public:
         m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STR_imm_T4, rn, rt, offset);
     }
 
-    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
     void str(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
     {
-        ASSERT(rn != ARM::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         ASSERT(shift <= 3);
 
@@ -1262,12 +1261,12 @@ public:
     void sub(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
     {
         // Rd can only be SP if Rn is also SP.
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isValid());
 
-        if ((rn == ARM::sp) && (rd == ARM::sp) && imm.isUInt9()) {
+        if ((rn == ARMRegisters::sp) && (rd == ARMRegisters::sp) && imm.isUInt9()) {
             m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, imm.getUInt9() >> 2);
             return;
         } else if (!((rd | rn) & 8)) {
@@ -1290,9 +1289,9 @@ public:
 
     void sub(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         m_formatter.twoWordOp12Reg4FourFours(OP_SUB_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
     }
@@ -1310,12 +1309,12 @@ public:
     void sub_S(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
     {
         // Rd can only be SP if Rn is also SP.
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isValid());
 
-        if ((rn == ARM::sp) && (rd == ARM::sp) && imm.isUInt9()) {
+        if ((rn == ARMRegisters::sp) && (rd == ARMRegisters::sp) && imm.isUInt9()) {
             m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, imm.getUInt9() >> 2);
             return;
         } else if (!((rd | rn) & 8)) {
@@ -1334,9 +1333,9 @@ public:
     // Not allowed in an IT (if then) block?
     void sub_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         m_formatter.twoWordOp12Reg4FourFours(OP_SUB_S_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
     }
@@ -1754,6 +1753,6 @@ private:
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM_ARM_ARCH(7)
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_THUMB2)
 
 #endif // ARMAssembler_h
diff --git a/JavaScriptCore/assembler/AbstractMacroAssembler.h b/JavaScriptCore/assembler/AbstractMacroAssembler.h
index f927ed2..525fe98 100644
--- a/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -320,11 +320,6 @@ public:
             return Call(jump.m_jmp, Linkable);
         }
 
-        void enableLatePatch()
-        {
-            m_jmp.enableLatePatch();
-        }
-
         JmpSrc m_jmp;
     private:
         Flags m_flags;
@@ -361,11 +356,6 @@ public:
             masm->m_assembler.linkJump(m_jmp, label.m_label);
         }
 
-        void enableLatePatch()
-        {
-            m_jmp.enableLatePatch();
-        }
-
     private:
         JmpSrc m_jmp;
     };
diff --git a/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index f15b7f3..af3c3be 100644
--- a/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -34,6 +34,8 @@
 #include "AssemblerBuffer.h"
 #include <wtf/SegmentedVector.h>
 
+#define ASSEMBLER_HAS_CONSTANT_POOL 1
+
 namespace JSC {
 
 /*
@@ -84,7 +86,7 @@ namespace JSC {
 
 template <int maxPoolSize, int barrierSize, int maxInstructionSize, class AssemblerType>
 class AssemblerBufferWithConstantPool: public AssemblerBuffer {
-    typedef WTF::SegmentedVector<uint32_t, 512> LoadOffsets;
+    typedef SegmentedVector<uint32_t, 512> LoadOffsets;
 public:
     enum {
         UniqueConst,
@@ -177,6 +179,11 @@ public:
         return AssemblerBuffer::size();
     }
 
+    int uncheckedSize()
+    {
+        return AssemblerBuffer::size();
+    }
+
     void* executableCopy(ExecutablePool* allocator)
     {
         flushConstantPool(false);
@@ -207,10 +214,10 @@ public:
     }
 
     // This flushing mechanism can be called after any unconditional jumps.
-    void flushWithoutBarrier()
+    void flushWithoutBarrier(bool isForced = false)
     {
         // Flush if constant pool is more than 60% full to avoid overuse of this function.
-        if (5 * m_numConsts > 3 * maxPoolSize / sizeof(uint32_t))
+        if (isForced || 5 * m_numConsts > 3 * maxPoolSize / sizeof(uint32_t))
             flushConstantPool(false);
     }
 
@@ -219,6 +226,11 @@ public:
         return m_pool;
     }
 
+    int sizeOfConstantPool()
+    {
+        return m_numConsts;
+    }
+
 private:
     void correctDeltas(int insnSize)
     {
@@ -276,7 +288,8 @@ private:
     {
         if (m_numConsts == 0)
             return;
-        if ((m_maxDistance < nextInsnSize + m_lastConstDelta + barrierSize + (int)sizeof(uint32_t)))
+        int lastConstDelta = m_lastConstDelta > nextInsnSize ? m_lastConstDelta - nextInsnSize : 0;
+        if ((m_maxDistance < nextInsnSize + lastConstDelta + barrierSize + (int)sizeof(uint32_t)))
             flushConstantPool();
     }
 
@@ -284,8 +297,8 @@ private:
     {
         if (m_numConsts == 0)
             return;
-        if ((m_maxDistance < nextInsnSize + m_lastConstDelta + barrierSize + (int)sizeof(uint32_t)) ||
-            (m_numConsts + nextConstSize / sizeof(uint32_t) >= maxPoolSize))
+        if ((m_maxDistance < nextInsnSize + m_lastConstDelta + nextConstSize + barrierSize + (int)sizeof(uint32_t)) ||
+            (m_numConsts * sizeof(uint32_t) + nextConstSize >= maxPoolSize))
             flushConstantPool();
     }
 
diff --git a/JavaScriptCore/assembler/MacroAssembler.h b/JavaScriptCore/assembler/MacroAssembler.h
index 9e1c5d3..2743ab4 100644
--- a/JavaScriptCore/assembler/MacroAssembler.h
+++ b/JavaScriptCore/assembler/MacroAssembler.h
@@ -30,11 +30,11 @@
 
 #if ENABLE(ASSEMBLER)
 
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
 #include "MacroAssemblerARMv7.h"
 namespace JSC { typedef MacroAssemblerARMv7 MacroAssemblerBase; };
 
-#elif PLATFORM(ARM)
+#elif PLATFORM(ARM_TRADITIONAL)
 #include "MacroAssemblerARM.h"
 namespace JSC { typedef MacroAssemblerARM MacroAssemblerBase; };
 
diff --git a/JavaScriptCore/assembler/MacroAssemblerARM.cpp b/JavaScriptCore/assembler/MacroAssemblerARM.cpp
new file mode 100644
index 0000000..d726ecd
--- /dev/null
+++ b/JavaScriptCore/assembler/MacroAssemblerARM.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2009 University of Szeged
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+
+#include "MacroAssemblerARM.h"
+
+#if PLATFORM(LINUX)
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <elf.h>
+#include <asm/hwcap.h>
+#endif
+
+namespace JSC {
+
+static bool isVFPPresent()
+{
+#if PLATFORM(LINUX)
+    int fd = open("/proc/self/auxv", O_RDONLY);
+    if (fd > 0) {
+        Elf32_auxv_t aux;
+        while (read(fd, &aux, sizeof(Elf32_auxv_t))) {
+            if (aux.a_type == AT_HWCAP) {
+                close(fd);
+                return aux.a_un.a_val & HWCAP_VFP;
+            }
+        }
+        close(fd);
+    }
+#endif
+
+    return false;
+}
+
+const bool MacroAssemblerARM::s_isVFPPresent = isVFPPresent();
+
+#if defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_REQUIRE_NATURAL_ALIGNMENT
+void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+{
+    ARMWord op2;
+
+    ASSERT(address.scale >= 0 && address.scale <= 3);
+    op2 = m_assembler.lsl(address.index, static_cast<int>(address.scale));
+
+    if (address.offset >= 0 && address.offset + 0x2 <= 0xff) {
+        m_assembler.add_r(ARMRegisters::S0, address.base, op2);
+        m_assembler.ldrh_u(dest, ARMRegisters::S0, ARMAssembler::getOp2Byte(address.offset));
+        m_assembler.ldrh_u(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(address.offset + 0x2));
+    } else if (address.offset < 0 && address.offset >= -0xff) {
+        m_assembler.add_r(ARMRegisters::S0, address.base, op2);
+        m_assembler.ldrh_d(dest, ARMRegisters::S0, ARMAssembler::getOp2Byte(-address.offset));
+        m_assembler.ldrh_d(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(-address.offset - 0x2));
+    } else {
+        m_assembler.ldr_un_imm(ARMRegisters::S0, address.offset);
+        m_assembler.add_r(ARMRegisters::S0, ARMRegisters::S0, op2);
+        m_assembler.ldrh_r(dest, address.base, ARMRegisters::S0);
+        m_assembler.add_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::OP2_IMM | 0x2);
+        m_assembler.ldrh_r(ARMRegisters::S0, address.base, ARMRegisters::S0);
+    }
+    m_assembler.orr_r(dest, dest, m_assembler.lsl(ARMRegisters::S0, 16));
+}
+#endif
+
+}
+
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
diff --git a/JavaScriptCore/assembler/MacroAssemblerARM.h b/JavaScriptCore/assembler/MacroAssemblerARM.h
index b04ed13..aa8cbb0 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -30,7 +30,7 @@
 
 #include <wtf/Platform.h>
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM)
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #include "ARMAssembler.h"
 #include "AbstractMacroAssembler.h"
@@ -64,7 +64,7 @@ public:
         DoubleLessThanOrEqual = ARMAssembler::LE,
     };
 
-    static const RegisterID stackPointerRegister = ARM::sp;
+    static const RegisterID stackPointerRegister = ARMRegisters::sp;
 
     static const Scale ScalePtr = TimesFour;
 
@@ -75,20 +75,20 @@ public:
 
     void add32(Imm32 imm, Address address)
     {
-        load32(address, ARM::S1);
-        add32(imm, ARM::S1);
-        store32(ARM::S1, address);
+        load32(address, ARMRegisters::S1);
+        add32(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
     }
 
     void add32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.adds_r(dest, dest, m_assembler.getImm(imm.m_value, ARM::S0));
+        m_assembler.adds_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void add32(Address src, RegisterID dest)
     {
-        load32(src, ARM::S1);
-        add32(ARM::S1, dest);
+        load32(src, ARMRegisters::S1);
+        add32(ARMRegisters::S1, dest);
     }
 
     void and32(RegisterID src, RegisterID dest)
@@ -98,7 +98,7 @@ public:
 
     void and32(Imm32 imm, RegisterID dest)
     {
-        ARMWord w = m_assembler.getImm(imm.m_value, ARM::S0, true);
+        ARMWord w = m_assembler.getImm(imm.m_value, ARMRegisters::S0, true);
         if (w & ARMAssembler::OP2_INV_IMM)
             m_assembler.bics_r(dest, dest, w & ~ARMAssembler::OP2_INV_IMM);
         else
@@ -118,16 +118,16 @@ public:
     void mul32(RegisterID src, RegisterID dest)
     {
         if (src == dest) {
-            move(src, ARM::S0);
-            src = ARM::S0;
+            move(src, ARMRegisters::S0);
+            src = ARMRegisters::S0;
         }
         m_assembler.muls_r(dest, dest, src);
     }
 
     void mul32(Imm32 imm, RegisterID src, RegisterID dest)
     {
-        move(imm, ARM::S0);
-        m_assembler.muls_r(dest, src, ARM::S0);
+        move(imm, ARMRegisters::S0);
+        m_assembler.muls_r(dest, src, ARMRegisters::S0);
     }
 
     void not32(RegisterID dest)
@@ -142,7 +142,7 @@ public:
 
     void or32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.orrs_r(dest, dest, m_assembler.getImm(imm.m_value, ARM::S0));
+        m_assembler.orrs_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void rshift32(RegisterID shift_amount, RegisterID dest)
@@ -162,20 +162,20 @@ public:
 
     void sub32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.subs_r(dest, dest, m_assembler.getImm(imm.m_value, ARM::S0));
+        m_assembler.subs_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void sub32(Imm32 imm, Address address)
     {
-        load32(address, ARM::S1);
-        sub32(imm, ARM::S1);
-        store32(ARM::S1, address);
+        load32(address, ARMRegisters::S1);
+        sub32(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
     }
 
     void sub32(Address src, RegisterID dest)
     {
-        load32(src, ARM::S1);
-        sub32(ARM::S1, dest);
+        load32(src, ARMRegisters::S1);
+        sub32(ARMRegisters::S1, dest);
     }
 
     void xor32(RegisterID src, RegisterID dest)
@@ -185,7 +185,7 @@ public:
 
     void xor32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARM::S0));
+        m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void load32(ImplicitAddress address, RegisterID dest)
@@ -198,11 +198,20 @@ public:
         m_assembler.baseIndexTransfer32(true, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
+#if defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_REQUIRE_NATURAL_ALIGNMENT
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest);
+#else
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        load32(address, dest);
+    }
+#endif
+
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
         DataLabel32 dataLabel(this);
-        m_assembler.ldr_un_imm(ARM::S0, 0);
-        m_assembler.dtr_ur(true, dest, address.base, ARM::S0);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, 0);
+        m_assembler.dtr_ur(true, dest, address.base, ARMRegisters::S0);
         return dataLabel;
     }
 
@@ -215,18 +224,18 @@ public:
 
     void load16(BaseIndex address, RegisterID dest)
     {
-        m_assembler.add_r(ARM::S0, address.base, m_assembler.lsl(address.index, address.scale));
+        m_assembler.add_r(ARMRegisters::S0, address.base, m_assembler.lsl(address.index, address.scale));
         if (address.offset>=0)
-            m_assembler.ldrh_u(dest, ARM::S0, ARMAssembler::getOp2Byte(address.offset));
+            m_assembler.ldrh_u(dest, ARMRegisters::S0, ARMAssembler::getOp2Byte(address.offset));
         else
-            m_assembler.ldrh_d(dest, ARM::S0, ARMAssembler::getOp2Byte(-address.offset));
+            m_assembler.ldrh_d(dest, ARMRegisters::S0, ARMAssembler::getOp2Byte(-address.offset));
     }
 
     DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
     {
         DataLabel32 dataLabel(this);
-        m_assembler.ldr_un_imm(ARM::S0, 0);
-        m_assembler.dtr_ur(false, src, address.base, ARM::S0);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, 0);
+        m_assembler.dtr_ur(false, src, address.base, ARMRegisters::S0);
         return dataLabel;
     }
 
@@ -243,26 +252,26 @@ public:
     void store32(Imm32 imm, ImplicitAddress address)
     {
         if (imm.m_isPointer)
-            m_assembler.ldr_un_imm(ARM::S1, imm.m_value);
+            m_assembler.ldr_un_imm(ARMRegisters::S1, imm.m_value);
         else
-            move(imm, ARM::S1);
-        store32(ARM::S1, address);
+            move(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
     }
 
     void store32(RegisterID src, void* address)
     {
-        m_assembler.ldr_un_imm(ARM::S0, reinterpret_cast<ARMWord>(address));
-        m_assembler.dtr_u(false, src, ARM::S0, 0);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
+        m_assembler.dtr_u(false, src, ARMRegisters::S0, 0);
     }
 
     void store32(Imm32 imm, void* address)
     {
-        m_assembler.ldr_un_imm(ARM::S0, reinterpret_cast<ARMWord>(address));
+        m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
         if (imm.m_isPointer)
-            m_assembler.ldr_un_imm(ARM::S1, imm.m_value);
+            m_assembler.ldr_un_imm(ARMRegisters::S1, imm.m_value);
         else
-            m_assembler.moveImm(imm.m_value, ARM::S1);
-        m_assembler.dtr_u(false, ARM::S1, ARM::S0, 0);
+            m_assembler.moveImm(imm.m_value, ARMRegisters::S1);
+        m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
     void pop(RegisterID dest)
@@ -277,14 +286,14 @@ public:
 
     void push(Address address)
     {
-        load32(address, ARM::S1);
-        push(ARM::S1);
+        load32(address, ARMRegisters::S1);
+        push(ARMRegisters::S1);
     }
 
     void push(Imm32 imm)
     {
-        move(imm, ARM::S0);
-        push(ARM::S0);
+        move(imm, ARMRegisters::S0);
+        push(ARMRegisters::S0);
     }
 
     void move(Imm32 imm, RegisterID dest)
@@ -307,9 +316,9 @@ public:
 
     void swap(RegisterID reg1, RegisterID reg2)
     {
-        m_assembler.mov_r(ARM::S0, reg1);
+        m_assembler.mov_r(ARMRegisters::S0, reg1);
         m_assembler.mov_r(reg1, reg2);
-        m_assembler.mov_r(reg2, ARM::S0);
+        m_assembler.mov_r(reg2, ARMRegisters::S0);
     }
 
     void signExtend32ToPtr(RegisterID src, RegisterID dest)
@@ -324,44 +333,50 @@ public:
             move(src, dest);
     }
 
-    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    Jump branch32(Condition cond, RegisterID left, RegisterID right, int useConstantPool = 0)
     {
         m_assembler.cmp_r(left, right);
-        return Jump(m_assembler.jmp(ARMCondition(cond)));
+        return Jump(m_assembler.jmp(ARMCondition(cond), useConstantPool));
     }
 
-    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    Jump branch32(Condition cond, RegisterID left, Imm32 right, int useConstantPool = 0)
     {
         if (right.m_isPointer) {
-            m_assembler.ldr_un_imm(ARM::S0, right.m_value);
-            m_assembler.cmp_r(left, ARM::S0);
+            m_assembler.ldr_un_imm(ARMRegisters::S0, right.m_value);
+            m_assembler.cmp_r(left, ARMRegisters::S0);
         } else
-            m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARM::S0));
-        return Jump(m_assembler.jmp(ARMCondition(cond)));
+            m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
+        return Jump(m_assembler.jmp(ARMCondition(cond), useConstantPool));
     }
 
     Jump branch32(Condition cond, RegisterID left, Address right)
     {
-        load32(right, ARM::S1);
-        return branch32(cond, left, ARM::S1);
+        load32(right, ARMRegisters::S1);
+        return branch32(cond, left, ARMRegisters::S1);
     }
 
     Jump branch32(Condition cond, Address left, RegisterID right)
     {
-        load32(left, ARM::S1);
-        return branch32(cond, ARM::S1, right);
+        load32(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
     }
 
     Jump branch32(Condition cond, Address left, Imm32 right)
     {
-        load32(left, ARM::S1);
-        return branch32(cond, ARM::S1, right);
+        load32(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
     }
 
     Jump branch32(Condition cond, BaseIndex left, Imm32 right)
     {
-        load32(left, ARM::S1);
-        return branch32(cond, ARM::S1, right);
+        load32(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    {
+        load32WithUnalignedHalfWords(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
     }
 
     Jump branch16(Condition cond, BaseIndex left, RegisterID right)
@@ -375,9 +390,9 @@ public:
 
     Jump branch16(Condition cond, BaseIndex left, Imm32 right)
     {
-        load16(left, ARM::S0);
-        move(right, ARM::S1);
-        m_assembler.cmp_r(ARM::S0, ARM::S1);
+        load16(left, ARMRegisters::S0);
+        move(right, ARMRegisters::S1);
+        m_assembler.cmp_r(ARMRegisters::S0, ARMRegisters::S1);
         return m_assembler.jmp(ARMCondition(cond));
     }
 
@@ -391,9 +406,9 @@ public:
     Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
-        ARMWord w = m_assembler.getImm(mask.m_value, ARM::S0, true);
+        ARMWord w = m_assembler.getImm(mask.m_value, ARMRegisters::S0, true);
         if (w & ARMAssembler::OP2_INV_IMM)
-            m_assembler.bics_r(ARM::S0, reg, w & ~ARMAssembler::OP2_INV_IMM);
+            m_assembler.bics_r(ARMRegisters::S0, reg, w & ~ARMAssembler::OP2_INV_IMM);
         else
             m_assembler.tst_r(reg, w);
         return Jump(m_assembler.jmp(ARMCondition(cond)));
@@ -401,14 +416,14 @@ public:
 
     Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
     {
-        load32(address, ARM::S1);
-        return branchTest32(cond, ARM::S1, mask);
+        load32(address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask);
     }
 
     Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
     {
-        load32(address, ARM::S1);
-        return branchTest32(cond, ARM::S1, mask);
+        load32(address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask);
     }
 
     Jump jump()
@@ -418,12 +433,12 @@ public:
 
     void jump(RegisterID target)
     {
-        move(target, ARM::pc);
+        move(target, ARMRegisters::pc);
     }
 
     void jump(Address address)
     {
-        load32(address, ARM::pc);
+        load32(address, ARMRegisters::pc);
     }
 
     Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
@@ -443,11 +458,11 @@ public:
     void mull32(RegisterID src1, RegisterID src2, RegisterID dest)
     {
         if (src1 == dest) {
-            move(src1, ARM::S0);
-            src1 = ARM::S0;
+            move(src1, ARMRegisters::S0);
+            src1 = ARMRegisters::S0;
         }
-        m_assembler.mull_r(ARM::S1, dest, src2, src1);
-        m_assembler.cmp_r(ARM::S1, m_assembler.asr(dest, 31));
+        m_assembler.mull_r(ARMRegisters::S1, dest, src2, src1);
+        m_assembler.cmp_r(ARMRegisters::S1, m_assembler.asr(dest, 31));
     }
 
     Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
@@ -466,8 +481,8 @@ public:
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         if (cond == Overflow) {
-            move(imm, ARM::S0);
-            mull32(ARM::S0, src, dest);
+            move(imm, ARMRegisters::S0);
+            mull32(ARMRegisters::S0, src, dest);
             cond = NonZero;
         }
         else
@@ -497,13 +512,13 @@ public:
     Call nearCall()
     {
         prepareCall();
-        return Call(m_assembler.jmp(), Call::LinkableNear);
+        return Call(m_assembler.jmp(ARMAssembler::AL, true), Call::LinkableNear);
     }
 
     Call call(RegisterID target)
     {
         prepareCall();
-        move(ARM::pc, target);
+        move(ARMRegisters::pc, target);
         JmpSrc jmpSrc;
         return Call(jmpSrc, Call::None);
     }
@@ -515,7 +530,7 @@ public:
 
     void ret()
     {
-        pop(ARM::pc);
+        pop(ARMRegisters::pc);
     }
 
     void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
@@ -527,67 +542,67 @@ public:
 
     void set32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
     {
-        m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARM::S0));
+        m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
     void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
-        load32(address, ARM::S1);
+        load32(address, ARMRegisters::S1);
         if (mask.m_value == -1)
-            m_assembler.cmp_r(0, ARM::S1);
+            m_assembler.cmp_r(0, ARMRegisters::S1);
         else
-            m_assembler.tst_r(ARM::S1, m_assembler.getImm(mask.m_value, ARM::S0));
+            m_assembler.tst_r(ARMRegisters::S1, m_assembler.getImm(mask.m_value, ARMRegisters::S0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
     void add32(Imm32 imm, RegisterID src, RegisterID dest)
     {
-        m_assembler.add_r(dest, src, m_assembler.getImm(imm.m_value, ARM::S0));
+        m_assembler.add_r(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void add32(Imm32 imm, AbsoluteAddress address)
     {
-        m_assembler.ldr_un_imm(ARM::S1, reinterpret_cast<ARMWord>(address.m_ptr));
-        m_assembler.dtr_u(true, ARM::S1, ARM::S1, 0);
-        add32(imm, ARM::S1);
-        m_assembler.ldr_un_imm(ARM::S0, reinterpret_cast<ARMWord>(address.m_ptr));
-        m_assembler.dtr_u(false, ARM::S1, ARM::S0, 0);
+        m_assembler.ldr_un_imm(ARMRegisters::S1, reinterpret_cast<ARMWord>(address.m_ptr));
+        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        add32(imm, ARMRegisters::S1);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address.m_ptr));
+        m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
     void sub32(Imm32 imm, AbsoluteAddress address)
     {
-        m_assembler.ldr_un_imm(ARM::S1, reinterpret_cast<ARMWord>(address.m_ptr));
-        m_assembler.dtr_u(true, ARM::S1, ARM::S1, 0);
-        sub32(imm, ARM::S1);
-        m_assembler.ldr_un_imm(ARM::S0, reinterpret_cast<ARMWord>(address.m_ptr));
-        m_assembler.dtr_u(false, ARM::S1, ARM::S0, 0);
+        m_assembler.ldr_un_imm(ARMRegisters::S1, reinterpret_cast<ARMWord>(address.m_ptr));
+        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        sub32(imm, ARMRegisters::S1);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address.m_ptr));
+        m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
     void load32(void* address, RegisterID dest)
     {
-        m_assembler.ldr_un_imm(ARM::S0, reinterpret_cast<ARMWord>(address));
-        m_assembler.dtr_u(true, dest, ARM::S0, 0);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
+        m_assembler.dtr_u(true, dest, ARMRegisters::S0, 0);
     }
 
     Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
     {
-        load32(left.m_ptr, ARM::S1);
-        return branch32(cond, ARM::S1, right);
+        load32(left.m_ptr, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
     }
 
     Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
     {
-        load32(left.m_ptr, ARM::S1);
-        return branch32(cond, ARM::S1, right);
+        load32(left.m_ptr, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
     }
 
     Call call()
     {
         prepareCall();
-        return Call(m_assembler.jmp(), Call::Linkable);
+        return Call(m_assembler.jmp(ARMAssembler::AL, true), Call::Linkable);
     }
 
     Call tailRecursiveCall()
@@ -609,25 +624,23 @@ public:
 
     Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
     {
-        dataLabel = moveWithPatch(initialRightValue, ARM::S1);
-        Jump jump = branch32(cond, left, ARM::S1);
-        jump.enableLatePatch();
+        dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S1);
+        Jump jump = branch32(cond, left, ARMRegisters::S1, true);
         return jump;
     }
 
     Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
     {
-        load32(left, ARM::S1);
-        dataLabel = moveWithPatch(initialRightValue, ARM::S0);
-        Jump jump = branch32(cond, ARM::S0, ARM::S1);
-        jump.enableLatePatch();
+        load32(left, ARMRegisters::S1);
+        dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S0);
+        Jump jump = branch32(cond, ARMRegisters::S0, ARMRegisters::S1, true);
         return jump;
     }
 
     DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
     {
-        DataLabelPtr dataLabel = moveWithPatch(initialValue, ARM::S1);
-        store32(ARM::S1, address);
+        DataLabelPtr dataLabel = moveWithPatch(initialValue, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
         return dataLabel;
     }
 
@@ -639,8 +652,7 @@ public:
     // Floating point operators
     bool supportsFloatingPoint() const
     {
-        // FIXME: should be a dynamic test: VFP, FPA, or nothing
-        return false;
+        return s_isVFPPresent;
     }
 
     bool supportsFloatingPointTruncate() const
@@ -665,8 +677,8 @@ public:
 
     void addDouble(Address src, FPRegisterID dest)
     {
-        loadDouble(src, ARM::SD0);
-        addDouble(ARM::SD0, dest);
+        loadDouble(src, ARMRegisters::SD0);
+        addDouble(ARMRegisters::SD0, dest);
     }
 
     void subDouble(FPRegisterID src, FPRegisterID dest)
@@ -676,8 +688,8 @@ public:
 
     void subDouble(Address src, FPRegisterID dest)
     {
-        loadDouble(src, ARM::SD0);
-        subDouble(ARM::SD0, dest);
+        loadDouble(src, ARMRegisters::SD0);
+        subDouble(ARMRegisters::SD0, dest);
     }
 
     void mulDouble(FPRegisterID src, FPRegisterID dest)
@@ -687,8 +699,8 @@ public:
 
     void mulDouble(Address src, FPRegisterID dest)
     {
-        loadDouble(src, ARM::SD0);
-        mulDouble(ARM::SD0, dest);
+        loadDouble(src, ARMRegisters::SD0);
+        mulDouble(ARMRegisters::SD0, dest);
     }
 
     void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
@@ -722,46 +734,56 @@ protected:
         return static_cast<ARMAssembler::Condition>(cond);
     }
 
+    void ensureSpace(int insnSpace, int constSpace)
+    {
+        m_assembler.ensureSpace(insnSpace, constSpace);
+    }
+
+    int sizeOfConstantPool()
+    {
+        return m_assembler.sizeOfConstantPool();
+    }
+
     void prepareCall()
     {
-        m_assembler.ensureSpace(3 * sizeof(ARMWord), sizeof(ARMWord));
+        ensureSpace(3 * sizeof(ARMWord), sizeof(ARMWord));
 
         // S0 might be used for parameter passing
-        m_assembler.add_r(ARM::S1, ARM::pc, ARMAssembler::OP2_IMM | 0x4);
-        m_assembler.push_r(ARM::S1);
+        m_assembler.add_r(ARMRegisters::S1, ARMRegisters::pc, ARMAssembler::OP2_IMM | 0x4);
+        m_assembler.push_r(ARMRegisters::S1);
     }
 
     void call32(RegisterID base, int32_t offset)
     {
-        if (base == ARM::sp)
+        if (base == ARMRegisters::sp)
             offset += 4;
 
         if (offset >= 0) {
             if (offset <= 0xfff) {
                 prepareCall();
-                m_assembler.dtr_u(true, ARM::pc, base, offset);
+                m_assembler.dtr_u(true, ARMRegisters::pc, base, offset);
             } else if (offset <= 0xfffff) {
-                m_assembler.add_r(ARM::S0, base, ARMAssembler::OP2_IMM | (offset >> 12) | (10 << 8));
+                m_assembler.add_r(ARMRegisters::S0, base, ARMAssembler::OP2_IMM | (offset >> 12) | (10 << 8));
                 prepareCall();
-                m_assembler.dtr_u(true, ARM::pc, ARM::S0, offset & 0xfff);
+                m_assembler.dtr_u(true, ARMRegisters::pc, ARMRegisters::S0, offset & 0xfff);
             } else {
-                ARMWord reg = m_assembler.getImm(offset, ARM::S0);
+                ARMWord reg = m_assembler.getImm(offset, ARMRegisters::S0);
                 prepareCall();
-                m_assembler.dtr_ur(true, ARM::pc, base, reg);
+                m_assembler.dtr_ur(true, ARMRegisters::pc, base, reg);
             }
         } else  {
             offset = -offset;
             if (offset <= 0xfff) {
                 prepareCall();
-                m_assembler.dtr_d(true, ARM::pc, base, offset);
+                m_assembler.dtr_d(true, ARMRegisters::pc, base, offset);
             } else if (offset <= 0xfffff) {
-                m_assembler.sub_r(ARM::S0, base, ARMAssembler::OP2_IMM | (offset >> 12) | (10 << 8));
+                m_assembler.sub_r(ARMRegisters::S0, base, ARMAssembler::OP2_IMM | (offset >> 12) | (10 << 8));
                 prepareCall();
-                m_assembler.dtr_d(true, ARM::pc, ARM::S0, offset & 0xfff);
+                m_assembler.dtr_d(true, ARMRegisters::pc, ARMRegisters::S0, offset & 0xfff);
             } else {
-                ARMWord reg = m_assembler.getImm(offset, ARM::S0);
+                ARMWord reg = m_assembler.getImm(offset, ARMRegisters::S0);
                 prepareCall();
-                m_assembler.dtr_dr(true, ARM::pc, base, reg);
+                m_assembler.dtr_dr(true, ARMRegisters::pc, base, reg);
             }
         }
     }
@@ -785,10 +807,11 @@ private:
         ARMAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
     }
 
+    static const bool s_isVFPPresent;
 };
 
 }
 
-#endif
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
 
 #endif // MacroAssemblerARM_h
diff --git a/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index f7a8402..a549604 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -39,9 +39,9 @@ class MacroAssemblerARMv7 : public AbstractMacroAssembler<ARMv7Assembler> {
     // FIXME: switch dataTempRegister & addressTempRegister, or possibly use r7?
     //        - dTR is likely used more than aTR, and we'll get better instruction
     //        encoding if it's in the low 8 registers.
-    static const ARM::RegisterID dataTempRegister = ARM::ip;
-    static const RegisterID addressTempRegister = ARM::r3;
-    static const FPRegisterID fpTempRegister = ARM::d7;
+    static const ARMRegisters::RegisterID dataTempRegister = ARMRegisters::ip;
+    static const RegisterID addressTempRegister = ARMRegisters::r3;
+    static const FPRegisterID fpTempRegister = ARMRegisters::d7;
 
     struct ArmAddress {
         enum AddressType {
@@ -102,8 +102,8 @@ public:
         DoubleLessThanOrEqual = ARMv7Assembler::ConditionLS,
     };
 
-    static const RegisterID stackPointerRegister = ARM::sp;
-    static const RegisterID linkRegister = ARM::lr;
+    static const RegisterID stackPointerRegister = ARMRegisters::sp;
+    static const RegisterID linkRegister = ARMRegisters::lr;
 
     // Integer arithmetic operations:
     //
@@ -375,6 +375,11 @@ public:
         load32(setupArmAddress(address), dest);
     }
 
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        load32(setupArmAddress(address), dest);
+    }
+
     void load32(void* address, RegisterID dest)
     {
         move(ImmPtr(address), addressTempRegister);
@@ -532,6 +537,7 @@ public:
     Jump branchTruncateDoubleToInt32(FPRegisterID, RegisterID)
     {
         ASSERT_NOT_REACHED();
+        return jump();
     }
 
 
@@ -546,13 +552,13 @@ public:
     void pop(RegisterID dest)
     {
         // store postindexed with writeback
-        m_assembler.ldr(dest, ARM::sp, sizeof(void*), false, true);
+        m_assembler.ldr(dest, ARMRegisters::sp, sizeof(void*), false, true);
     }
 
     void push(RegisterID src)
     {
         // store preindexed with writeback
-        m_assembler.str(src, ARM::sp, -sizeof(void*), true, true);
+        m_assembler.str(src, ARMRegisters::sp, -sizeof(void*), true, true);
     }
 
     void push(Address address)
@@ -716,6 +722,13 @@ public:
         return branch32(cond, addressTempRegister, right);
     }
 
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32WithUnalignedHalfWords(left, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
     Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
     {
         load32(left.m_ptr, dataTempRegister);
@@ -1038,7 +1051,7 @@ protected:
         return addressTempRegister;
     }
 
-    DataLabel32 moveFixedWidthEncoding(Imm32 imm, RegisterID dst)
+    void moveFixedWidthEncoding(Imm32 imm, RegisterID dst)
     {
         uint32_t value = imm.m_value;
         m_assembler.movT3(dst, ARMThumbImmediate::makeUInt16(value & 0xffff));
diff --git a/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 341a7ff..568260a 100644
--- a/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -37,7 +37,7 @@
 
 // ASSERT_VALID_CODE_POINTER checks that ptr is a non-null pointer, and that it is a valid
 // instruction address on the platform (for example, check any alignment requirements).
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
 // ARM/thumb instructions must be 16-bit aligned, but all code pointers to be loaded
 // into the processor are decorated with the bottom bit set, indicating that this is
 // thumb code (as oposed to 32-bit traditional ARM).  The first test checks for both
@@ -124,7 +124,7 @@ public:
     }
 
     explicit MacroAssemblerCodePtr(void* value)
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
         // Decorate the pointer as a thumb code pointer.
         : m_value(reinterpret_cast<char*>(value) + 1)
 #else
@@ -141,7 +141,7 @@ public:
     }
 
     void* executableAddress() const { return m_value; }
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
     // To use this pointer as a data address remove the decoration.
     void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return reinterpret_cast<char*>(m_value) - 1; }
 #else
diff --git a/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index c9e3569..5ebefa7 100644
--- a/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -64,7 +64,7 @@ public:
         DoubleLessThanOrEqual = X86Assembler::ConditionBE,
     };
 
-    static const RegisterID stackPointerRegister = X86::esp;
+    static const RegisterID stackPointerRegister = X86Registers::esp;
 
     // Integer arithmetic operations:
     //
@@ -132,20 +132,20 @@ public:
     {
         // On x86 we can only shift by ecx; if asked to shift by another register we'll
         // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
+        if (shift_amount != X86Registers::ecx) {
+            swap(shift_amount, X86Registers::ecx);
 
             // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
             if (dest == shift_amount)
-                m_assembler.shll_CLr(X86::ecx);
+                m_assembler.shll_CLr(X86Registers::ecx);
             // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
+            else if (dest == X86Registers::ecx)
                 m_assembler.shll_CLr(shift_amount);
             // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
             else
                 m_assembler.shll_CLr(dest);
         
-            swap(shift_amount, X86::ecx);
+            swap(shift_amount, X86Registers::ecx);
         } else
             m_assembler.shll_CLr(dest);
     }
@@ -214,20 +214,20 @@ public:
     {
         // On x86 we can only shift by ecx; if asked to shift by another register we'll
         // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
+        if (shift_amount != X86Registers::ecx) {
+            swap(shift_amount, X86Registers::ecx);
 
             // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
             if (dest == shift_amount)
-                m_assembler.sarl_CLr(X86::ecx);
+                m_assembler.sarl_CLr(X86Registers::ecx);
             // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
+            else if (dest == X86Registers::ecx)
                 m_assembler.sarl_CLr(shift_amount);
             // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
             else
                 m_assembler.sarl_CLr(dest);
         
-            swap(shift_amount, X86::ecx);
+            swap(shift_amount, X86Registers::ecx);
         } else
             m_assembler.sarl_CLr(dest);
     }
@@ -306,6 +306,11 @@ public:
         m_assembler.movl_mr(address.offset, address.base, address.index, address.scale, dest);
     }
 
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        load32(address, dest);
+    }
+
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
         m_assembler.movl_mr_disp32(address.offset, address.base, dest);
@@ -499,10 +504,7 @@ public:
 
     void move(ImmPtr imm, RegisterID dest)
     {
-        if (CAN_SIGN_EXTEND_U32_64(imm.asIntptr()))
-            m_assembler.movl_i32r(static_cast<int32_t>(imm.asIntptr()), dest);
-        else
-            m_assembler.movq_i64r(imm.asIntptr(), dest);
+        m_assembler.movq_i64r(imm.asIntptr(), dest);
     }
 
     void swap(RegisterID reg1, RegisterID reg2)
@@ -607,6 +609,11 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    {
+        return branch32(cond, left, right);
+    }
+
     Jump branch16(Condition cond, BaseIndex left, RegisterID right)
     {
         m_assembler.cmpw_rm(right, left.offset, left.base, left.index, left.scale);
diff --git a/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index e3d296c..0f95fe6 100644
--- a/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -38,7 +38,7 @@ namespace JSC {
 
 class MacroAssemblerX86_64 : public MacroAssemblerX86Common {
 protected:
-    static const X86::RegisterID scratchRegister = X86::r11;
+    static const X86Registers::RegisterID scratchRegister = X86Registers::r11;
 
 public:
     static const Scale ScalePtr = TimesEight;
@@ -79,12 +79,12 @@ public:
 
     void load32(void* address, RegisterID dest)
     {
-        if (dest == X86::eax)
+        if (dest == X86Registers::eax)
             m_assembler.movl_mEAX(address);
         else {
-            move(X86::eax, dest);
+            move(X86Registers::eax, dest);
             m_assembler.movl_mEAX(address);
-            swap(X86::eax, dest);
+            swap(X86Registers::eax, dest);
         }
     }
 
@@ -102,10 +102,10 @@ public:
 
     void store32(Imm32 imm, void* address)
     {
-        move(X86::eax, scratchRegister);
-        move(imm, X86::eax);
+        move(X86Registers::eax, scratchRegister);
+        move(imm, X86Registers::eax);
         m_assembler.movl_EAXm(address);
-        move(scratchRegister, X86::eax);
+        move(scratchRegister, X86Registers::eax);
     }
 
     Call call()
@@ -196,20 +196,20 @@ public:
     {
         // On x86 we can only shift by ecx; if asked to shift by another register we'll
         // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
+        if (shift_amount != X86Registers::ecx) {
+            swap(shift_amount, X86Registers::ecx);
 
             // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
             if (dest == shift_amount)
-                m_assembler.sarq_CLr(X86::ecx);
+                m_assembler.sarq_CLr(X86Registers::ecx);
             // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
+            else if (dest == X86Registers::ecx)
                 m_assembler.sarq_CLr(shift_amount);
             // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
             else
                 m_assembler.sarq_CLr(dest);
         
-            swap(shift_amount, X86::ecx);
+            swap(shift_amount, X86Registers::ecx);
         } else
             m_assembler.sarq_CLr(dest);
     }
@@ -258,12 +258,12 @@ public:
 
     void loadPtr(void* address, RegisterID dest)
     {
-        if (dest == X86::eax)
+        if (dest == X86Registers::eax)
             m_assembler.movq_mEAX(address);
         else {
-            move(X86::eax, dest);
+            move(X86Registers::eax, dest);
             m_assembler.movq_mEAX(address);
-            swap(X86::eax, dest);
+            swap(X86Registers::eax, dest);
         }
     }
 
@@ -285,24 +285,19 @@ public:
     
     void storePtr(RegisterID src, void* address)
     {
-        if (src == X86::eax)
+        if (src == X86Registers::eax)
             m_assembler.movq_EAXm(address);
         else {
-            swap(X86::eax, src);
+            swap(X86Registers::eax, src);
             m_assembler.movq_EAXm(address);
-            swap(X86::eax, src);
+            swap(X86Registers::eax, src);
         }
     }
 
     void storePtr(ImmPtr imm, ImplicitAddress address)
     {
-        intptr_t ptr = imm.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(ptr))
-            m_assembler.movq_i32m(static_cast<int>(ptr), address.offset, address.base);
-        else {
-            move(imm, scratchRegister);
-            storePtr(scratchRegister, address);
-        }
+        move(imm, scratchRegister);
+        storePtr(scratchRegister, address);
     }
 
     DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
@@ -339,17 +334,8 @@ public:
 
     Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
     {
-        intptr_t imm = right.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            if (!imm)
-                m_assembler.testq_rr(left, left);
-            else
-                m_assembler.cmpq_ir(imm, left);
-            return Jump(m_assembler.jCC(x86Condition(cond)));
-        } else {
-            move(right, scratchRegister);
-            return branchPtr(cond, left, scratchRegister);
-        }
+        move(right, scratchRegister);
+        return branchPtr(cond, left, scratchRegister);
     }
 
     Jump branchPtr(Condition cond, RegisterID left, Address right)
diff --git a/JavaScriptCore/assembler/X86Assembler.h b/JavaScriptCore/assembler/X86Assembler.h
index fb58361..cbbaaa5 100644
--- a/JavaScriptCore/assembler/X86Assembler.h
+++ b/JavaScriptCore/assembler/X86Assembler.h
@@ -38,12 +38,8 @@
 namespace JSC {
 
 inline bool CAN_SIGN_EXTEND_8_32(int32_t value) { return value == (int32_t)(signed char)value; }
-#if PLATFORM(X86_64)
-inline bool CAN_SIGN_EXTEND_32_64(intptr_t value) { return value == (intptr_t)(int32_t)value; }
-inline bool CAN_SIGN_EXTEND_U32_64(intptr_t value) { return value == (intptr_t)(uint32_t)value; }
-#endif
 
-namespace X86 {
+namespace X86Registers {
     typedef enum {
         eax,
         ecx,
@@ -80,8 +76,8 @@ namespace X86 {
 
 class X86Assembler {
 public:
-    typedef X86::RegisterID RegisterID;
-    typedef X86::XMMRegisterID XMMRegisterID;
+    typedef X86Registers::RegisterID RegisterID;
+    typedef X86Registers::XMMRegisterID XMMRegisterID;
     typedef XMMRegisterID FPRegisterID;
 
     typedef enum {
@@ -231,7 +227,6 @@ public:
         {
         }
 
-        void enableLatePatch() { }
     private:
         JmpSrc(int offset)
             : m_offset(offset)
@@ -1119,7 +1114,7 @@ public:
 #else
     void movl_rm(RegisterID src, void* addr)
     {
-        if (src == X86::eax)
+        if (src == X86Registers::eax)
             movl_EAXm(addr);
         else 
             m_formatter.oneByteOp(OP_MOV_EvGv, src, addr);
@@ -1127,7 +1122,7 @@ public:
     
     void movl_mr(void* addr, RegisterID dst)
     {
-        if (dst == X86::eax)
+        if (dst == X86Registers::eax)
             movl_mEAX(addr);
         else
             m_formatter.oneByteOp(OP_MOV_GvEv, dst, addr);
@@ -1893,23 +1888,23 @@ private:
 
         // Internals; ModRm and REX formatters.
 
-        static const RegisterID noBase = X86::ebp;
-        static const RegisterID hasSib = X86::esp;
-        static const RegisterID noIndex = X86::esp;
+        static const RegisterID noBase = X86Registers::ebp;
+        static const RegisterID hasSib = X86Registers::esp;
+        static const RegisterID noIndex = X86Registers::esp;
 #if PLATFORM(X86_64)
-        static const RegisterID noBase2 = X86::r13;
-        static const RegisterID hasSib2 = X86::r12;
+        static const RegisterID noBase2 = X86Registers::r13;
+        static const RegisterID hasSib2 = X86Registers::r12;
 
         // Registers r8 & above require a REX prefixe.
         inline bool regRequiresRex(int reg)
         {
-            return (reg >= X86::r8);
+            return (reg >= X86Registers::r8);
         }
 
         // Byte operand register spl & above require a REX prefix (to prevent the 'H' registers be accessed).
         inline bool byteRegRequiresRex(int reg)
         {
-            return (reg >= X86::esp);
+            return (reg >= X86Registers::esp);
         }
 
         // Format a REX prefix byte.
diff --git a/JavaScriptCore/bytecode/CodeBlock.cpp b/JavaScriptCore/bytecode/CodeBlock.cpp
index e22f25a..6bac9b9 100644
--- a/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -33,6 +33,8 @@
 #include "JIT.h"
 #include "JSValue.h"
 #include "Interpreter.h"
+#include "JSFunction.h"
+#include "JSStaticScopeObject.h"
 #include "Debugger.h"
 #include "BytecodeGenerator.h"
 #include <stdio.h>
@@ -1246,43 +1248,22 @@ void CodeBlock::dumpStatistics()
 #endif
 }
 
-CodeBlock::CodeBlock(ScopeNode* ownerNode)
+CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, SymbolTable* symTab)
     : m_numCalleeRegisters(0)
     , m_numVars(0)
     , m_numParameters(0)
-    , m_ownerNode(ownerNode)
+    , m_ownerExecutable(ownerExecutable)
     , m_globalData(0)
 #ifndef NDEBUG
     , m_instructionCount(0)
 #endif
-    , m_needsFullScopeChain(false)
-    , m_usesEval(false)
-    , m_isNumericCompareFunction(false)
-    , m_codeType(NativeCode)
-    , m_source(0)
-    , m_sourceOffset(0)
-    , m_exceptionInfo(0)
-{
-#if DUMP_CODE_BLOCK_STATISTICS
-    liveCodeBlockSet.add(this);
-#endif
-}
-
-CodeBlock::CodeBlock(ScopeNode* ownerNode, CodeType codeType, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset)
-    : m_numCalleeRegisters(0)
-    , m_numVars(0)
-    , m_numParameters(0)
-    , m_ownerNode(ownerNode)
-    , m_globalData(0)
-#ifndef NDEBUG
-    , m_instructionCount(0)
-#endif
-    , m_needsFullScopeChain(ownerNode->needsActivation())
-    , m_usesEval(ownerNode->usesEval())
+    , m_needsFullScopeChain(ownerExecutable->needsActivation())
+    , m_usesEval(ownerExecutable->usesEval())
     , m_isNumericCompareFunction(false)
     , m_codeType(codeType)
     , m_source(sourceProvider)
     , m_sourceOffset(sourceOffset)
+    , m_symbolTable(symTab)
     , m_exceptionInfo(new ExceptionInfo)
 {
     ASSERT(m_source);
@@ -1350,7 +1331,6 @@ void CodeBlock::unlinkCallers()
 
 void CodeBlock::derefStructures(Instruction* vPC) const
 {
-    ASSERT(m_codeType != NativeCode);
     Interpreter* interpreter = m_globalData->interpreter;
 
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
@@ -1396,7 +1376,6 @@ void CodeBlock::derefStructures(Instruction* vPC) const
 
 void CodeBlock::refStructures(Instruction* vPC) const
 {
-    ASSERT(m_codeType != NativeCode);
     Interpreter* interpreter = m_globalData->interpreter;
 
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
@@ -1430,25 +1409,16 @@ void CodeBlock::refStructures(Instruction* vPC) const
 
 void CodeBlock::markAggregate(MarkStack& markStack)
 {
-    for (size_t i = 0; i < m_constantRegisters.size(); ++i) {
-        if (!m_constantRegisters[i].marked())
-            markStack.append(m_constantRegisters[i].jsValue());
-    }
-
-    for (size_t i = 0; i < m_functionExpressions.size(); ++i)
-        m_functionExpressions[i]->body()->markAggregate(markStack);
-
-    if (m_rareData) {
-        for (size_t i = 0; i < m_rareData->m_functions.size(); ++i)
-            m_rareData->m_functions[i]->body()->markAggregate(markStack);
-
-        m_rareData->m_evalCodeCache.markAggregate(markStack);
-    }
+    for (size_t i = 0; i < m_constantRegisters.size(); ++i)
+        markStack.append(m_constantRegisters[i].jsValue());
+    for (size_t i = 0; i < m_functionExprs.size(); ++i)
+        m_functionExprs[i]->markAggregate(markStack);
+    for (size_t i = 0; i < m_functionDecls.size(); ++i)
+        m_functionDecls[i]->markAggregate(markStack);
 }
 
 void CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
 {
-    ASSERT(m_codeType != NativeCode);
     if (m_exceptionInfo)
         return;
 
@@ -1465,61 +1435,11 @@ void CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
             scopeChain = scopeChain->next;
     }
 
-    switch (m_codeType) {
-        case FunctionCode: {
-            FunctionBodyNode* ownerFunctionBodyNode = static_cast<FunctionBodyNode*>(m_ownerNode);
-            RefPtr<FunctionBodyNode> newFunctionBody = m_globalData->parser->reparse<FunctionBodyNode>(m_globalData, ownerFunctionBodyNode);
-            ASSERT(newFunctionBody);
-            newFunctionBody->finishParsing(ownerFunctionBodyNode->copyParameters(), ownerFunctionBodyNode->parameterCount());
-
-            m_globalData->scopeNodeBeingReparsed = newFunctionBody.get();
-
-            CodeBlock& newCodeBlock = newFunctionBody->bytecodeForExceptionInfoReparse(scopeChain, this);
-            ASSERT(newCodeBlock.m_exceptionInfo);
-            ASSERT(newCodeBlock.m_instructionCount == m_instructionCount);
-
-#if ENABLE(JIT)
-            JIT::compile(m_globalData, &newCodeBlock);
-            ASSERT(newFunctionBody->generatedJITCode().size() == ownerNode()->generatedJITCode().size());
-#endif
-
-            m_exceptionInfo.set(newCodeBlock.m_exceptionInfo.release());
-
-            m_globalData->scopeNodeBeingReparsed = 0;
-
-            break;
-        }
-        case EvalCode: {
-            EvalNode* ownerEvalNode = static_cast<EvalNode*>(m_ownerNode);
-            RefPtr<EvalNode> newEvalBody = m_globalData->parser->reparse<EvalNode>(m_globalData, ownerEvalNode);
-
-            m_globalData->scopeNodeBeingReparsed = newEvalBody.get();
-
-            EvalCodeBlock& newCodeBlock = newEvalBody->bytecodeForExceptionInfoReparse(scopeChain, this);
-            ASSERT(newCodeBlock.m_exceptionInfo);
-            ASSERT(newCodeBlock.m_instructionCount == m_instructionCount);
-
-#if ENABLE(JIT)
-            JIT::compile(m_globalData, &newCodeBlock);
-            ASSERT(newEvalBody->generatedJITCode().size() == ownerNode()->generatedJITCode().size());
-#endif
-
-            m_exceptionInfo.set(newCodeBlock.m_exceptionInfo.release());
-
-            m_globalData->scopeNodeBeingReparsed = 0;
-
-            break;
-        }
-        default:
-            // CodeBlocks for Global code blocks are transient and therefore to not gain from 
-            // from throwing out there exception information.
-            ASSERT_NOT_REACHED();
-    }
+    m_exceptionInfo.set(m_ownerExecutable->reparseExceptionInfo(m_globalData, scopeChain, this));
 }
 
 HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 {
-    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     if (!m_rareData)
@@ -1538,14 +1458,13 @@ HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 
 int CodeBlock::lineNumberForBytecodeOffset(CallFrame* callFrame, unsigned bytecodeOffset)
 {
-    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     reparseForExceptionInfoIfNecessary(callFrame);
     ASSERT(m_exceptionInfo);
 
     if (!m_exceptionInfo->m_lineInfo.size())
-        return m_ownerNode->source().firstLine(); // Empty function
+        return m_ownerExecutable->source().firstLine(); // Empty function
 
     int low = 0;
     int high = m_exceptionInfo->m_lineInfo.size();
@@ -1558,13 +1477,12 @@ int CodeBlock::lineNumberForBytecodeOffset(CallFrame* callFrame, unsigned byteco
     }
     
     if (!low)
-        return m_ownerNode->source().firstLine();
+        return m_ownerExecutable->source().firstLine();
     return m_exceptionInfo->m_lineInfo[low - 1].lineNumber;
 }
 
 int CodeBlock::expressionRangeForBytecodeOffset(CallFrame* callFrame, unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset)
 {
-    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     reparseForExceptionInfoIfNecessary(callFrame);
@@ -1604,7 +1522,6 @@ int CodeBlock::expressionRangeForBytecodeOffset(CallFrame* callFrame, unsigned b
 
 bool CodeBlock::getByIdExceptionInfoForBytecodeOffset(CallFrame* callFrame, unsigned bytecodeOffset, OpcodeID& opcodeID)
 {
-    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     reparseForExceptionInfoIfNecessary(callFrame);
@@ -1633,7 +1550,6 @@ bool CodeBlock::getByIdExceptionInfoForBytecodeOffset(CallFrame* callFrame, unsi
 #if ENABLE(JIT)
 bool CodeBlock::functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int& functionRegisterIndex)
 {
-    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     if (!m_rareData || !m_rareData->m_functionRegisterInfos.size())
@@ -1660,7 +1576,6 @@ bool CodeBlock::functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int&
 #if !ENABLE(JIT)
 bool CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOffset)
 {
-    ASSERT(m_codeType != NativeCode);
     if (m_globalResolveInstructions.isEmpty())
         return false;
 
@@ -1681,7 +1596,6 @@ bool CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOff
 #else
 bool CodeBlock::hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset)
 {
-    ASSERT(m_codeType != NativeCode);
     if (m_globalResolveInfos.isEmpty())
         return false;
 
@@ -1701,18 +1615,6 @@ bool CodeBlock::hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset)
 }
 #endif
 
-#if ENABLE(JIT)
-void CodeBlock::setJITCode(JITCode jitCode)
-{
-    ASSERT(m_codeType != NativeCode); 
-    ownerNode()->setJITCode(jitCode);
-#if !ENABLE(OPCODE_SAMPLING)
-    if (!BytecodeGenerator::dumpsGeneratedCode())
-        m_instructions.clear();
-#endif
-}
-#endif
-
 void CodeBlock::shrinkToFit()
 {
     m_instructions.shrinkToFit();
@@ -1728,7 +1630,8 @@ void CodeBlock::shrinkToFit()
 #endif
 
     m_identifiers.shrinkToFit();
-    m_functionExpressions.shrinkToFit();
+    m_functionDecls.shrinkToFit();
+    m_functionExprs.shrinkToFit();
     m_constantRegisters.shrinkToFit();
 
     if (m_exceptionInfo) {
@@ -1739,7 +1642,6 @@ void CodeBlock::shrinkToFit()
 
     if (m_rareData) {
         m_rareData->m_exceptionHandlers.shrinkToFit();
-        m_rareData->m_functions.shrinkToFit();
         m_rareData->m_regexps.shrinkToFit();
         m_rareData->m_immediateSwitchJumpTables.shrinkToFit();
         m_rareData->m_characterSwitchJumpTables.shrinkToFit();
diff --git a/JavaScriptCore/bytecode/CodeBlock.h b/JavaScriptCore/bytecode/CodeBlock.h
index 39b1db3..4ba58d7 100644
--- a/JavaScriptCore/bytecode/CodeBlock.h
+++ b/JavaScriptCore/bytecode/CodeBlock.h
@@ -61,7 +61,7 @@ namespace JSC {
 
     class ExecState;
 
-    enum CodeType { GlobalCode, EvalCode, FunctionCode, NativeCode };
+    enum CodeType { GlobalCode, EvalCode, FunctionCode };
 
     static ALWAYS_INLINE int missingThisObjectMarker() { return std::numeric_limits<int>::max(); }
 
@@ -248,12 +248,22 @@ namespace JSC {
     }
 #endif
 
+    struct ExceptionInfo : FastAllocBase {
+        Vector<ExpressionRangeInfo> m_expressionInfo;
+        Vector<LineInfo> m_lineInfo;
+        Vector<GetByIdExceptionInfo> m_getByIdExceptionInfo;
+
+#if ENABLE(JIT)
+        Vector<CallReturnOffsetToBytecodeIndex> m_callReturnIndexVector;
+#endif
+    };
+
     class CodeBlock : public FastAllocBase {
         friend class JIT;
+    protected:
+        CodeBlock(ScriptExecutable* ownerExecutable, CodeType, PassRefPtr<SourceProvider>, unsigned sourceOffset, SymbolTable* symbolTable);
     public:
-        CodeBlock(ScopeNode* ownerNode);
-        CodeBlock(ScopeNode* ownerNode, CodeType, PassRefPtr<SourceProvider>, unsigned sourceOffset);
-        ~CodeBlock();
+        virtual ~CodeBlock();
 
         void markAggregate(MarkStack&);
         void refStructures(Instruction* vPC) const;
@@ -329,7 +339,7 @@ namespace JSC {
         unsigned getBytecodeIndex(CallFrame* callFrame, ReturnAddressPtr returnAddress)
         {
             reparseForExceptionInfoIfNecessary(callFrame);
-            return binaryChop<CallReturnOffsetToBytecodeIndex, unsigned, getCallReturnOffset>(callReturnIndexVector().begin(), callReturnIndexVector().size(), ownerNode()->generatedJITCode().offsetOf(returnAddress.value()))->bytecodeIndex;
+            return binaryChop<CallReturnOffsetToBytecodeIndex, unsigned, getCallReturnOffset>(callReturnIndexVector().begin(), callReturnIndexVector().size(), ownerExecutable()->generatedJITCode().offsetOf(returnAddress.value()))->bytecodeIndex;
         }
         
         bool functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int& functionRegisterIndex);
@@ -339,17 +349,19 @@ namespace JSC {
         bool isNumericCompareFunction() { return m_isNumericCompareFunction; }
 
         Vector<Instruction>& instructions() { return m_instructions; }
+        void discardBytecode() { m_instructions.clear(); }
+
 #ifndef NDEBUG
+        unsigned instructionCount() { return m_instructionCount; }
         void setInstructionCount(unsigned instructionCount) { m_instructionCount = instructionCount; }
 #endif
 
 #if ENABLE(JIT)
-        JITCode& getJITCode() { return ownerNode()->generatedJITCode(); }
-        void setJITCode(JITCode);
-        ExecutablePool* executablePool() { return ownerNode()->getExecutablePool(); }
+        JITCode& getJITCode() { return ownerExecutable()->generatedJITCode(); }
+        ExecutablePool* executablePool() { return ownerExecutable()->getExecutablePool(); }
 #endif
 
-        ScopeNode* ownerNode() const { return m_ownerNode; }
+        ScriptExecutable* ownerExecutable() const { return m_ownerExecutable; }
 
         void setGlobalData(JSGlobalData* globalData) { m_globalData = globalData; }
 
@@ -365,8 +377,8 @@ namespace JSC {
 
         CodeType codeType() const { return m_codeType; }
 
-        SourceProvider* source() const { ASSERT(m_codeType != NativeCode); return m_source.get(); }
-        unsigned sourceOffset() const { ASSERT(m_codeType != NativeCode); return m_sourceOffset; }
+        SourceProvider* source() const { return m_source.get(); }
+        unsigned sourceOffset() const { return m_sourceOffset; }
 
         size_t numberOfJumpTargets() const { return m_jumpTargets.size(); }
         void addJumpTarget(unsigned jumpTarget) { m_jumpTargets.append(jumpTarget); }
@@ -404,6 +416,7 @@ namespace JSC {
 
         bool hasExceptionInfo() const { return m_exceptionInfo; }
         void clearExceptionInfo() { m_exceptionInfo.clear(); }
+        ExceptionInfo* extractExceptionInfo() { ASSERT(m_exceptionInfo); return m_exceptionInfo.release(); }
 
         void addExpressionInfo(const ExpressionRangeInfo& expressionInfo) { ASSERT(m_exceptionInfo); m_exceptionInfo->m_expressionInfo.append(expressionInfo); }
         void addGetByIdExceptionInfo(const GetByIdExceptionInfo& info) { ASSERT(m_exceptionInfo); m_exceptionInfo->m_getByIdExceptionInfo.append(info); }
@@ -428,13 +441,11 @@ namespace JSC {
         ALWAYS_INLINE bool isConstantRegisterIndex(int index) { return index >= FirstConstantRegisterIndex; }
         ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].jsValue(); }
 
-        unsigned addFunctionExpression(FuncExprNode* n) { unsigned size = m_functionExpressions.size(); m_functionExpressions.append(n); return size; }
-        FuncExprNode* functionExpression(int index) const { return m_functionExpressions[index].get(); }
-
-        unsigned addFunction(FuncDeclNode* n) { createRareDataIfNecessary(); unsigned size = m_rareData->m_functions.size(); m_rareData->m_functions.append(n); return size; }
-        FuncDeclNode* function(int index) const { ASSERT(m_rareData); return m_rareData->m_functions[index].get(); }
-
-        bool hasFunctions() const { return m_functionExpressions.size() || (m_rareData && m_rareData->m_functions.size()); }
+        unsigned addFunctionDecl(NonNullPassRefPtr<FunctionExecutable> n) { unsigned size = m_functionDecls.size(); m_functionDecls.append(n); return size; }
+        FunctionExecutable* functionDecl(int index) { return m_functionDecls[index].get(); }
+        int numberOfFunctionDecls() { return m_functionDecls.size(); }
+        unsigned addFunctionExpr(NonNullPassRefPtr<FunctionExecutable> n) { unsigned size = m_functionExprs.size(); m_functionExprs.append(n); return size; }
+        FunctionExecutable* functionExpr(int index) { return m_functionExprs[index].get(); }
 
         unsigned addRegExp(RegExp* r) { createRareDataIfNecessary(); unsigned size = m_rareData->m_regexps.size(); m_rareData->m_regexps.append(r); return size; }
         RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
@@ -455,9 +466,10 @@ namespace JSC {
         StringJumpTable& stringSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_stringSwitchJumpTables[tableIndex]; }
 
 
-        SymbolTable& symbolTable() { return m_symbolTable; }
+        SymbolTable* symbolTable() { return m_symbolTable; }
+        SharedSymbolTable* sharedSymbolTable() { ASSERT(m_codeType == FunctionCode); return static_cast<SharedSymbolTable*>(m_symbolTable); }
 
-        EvalCodeCache& evalCodeCache() { ASSERT(m_codeType != NativeCode); createRareDataIfNecessary(); return m_rareData->m_evalCodeCache; }
+        EvalCodeCache& evalCodeCache() { createRareDataIfNecessary(); return m_rareData->m_evalCodeCache; }
 
         void shrinkToFit();
 
@@ -476,12 +488,11 @@ namespace JSC {
 
         void createRareDataIfNecessary()
         {
-            ASSERT(m_codeType != NativeCode); 
             if (!m_rareData)
                 m_rareData.set(new RareData);
         }
 
-        ScopeNode* m_ownerNode;
+        ScriptExecutable* m_ownerExecutable;
         JSGlobalData* m_globalData;
 
         Vector<Instruction> m_instructions;
@@ -517,26 +528,17 @@ namespace JSC {
         // Constant Pool
         Vector<Identifier> m_identifiers;
         Vector<Register> m_constantRegisters;
-        Vector<RefPtr<FuncExprNode> > m_functionExpressions;
-
-        SymbolTable m_symbolTable;
+        Vector<RefPtr<FunctionExecutable> > m_functionDecls;
+        Vector<RefPtr<FunctionExecutable> > m_functionExprs;
 
-        struct ExceptionInfo : FastAllocBase {
-            Vector<ExpressionRangeInfo> m_expressionInfo;
-            Vector<LineInfo> m_lineInfo;
-            Vector<GetByIdExceptionInfo> m_getByIdExceptionInfo;
+        SymbolTable* m_symbolTable;
 
-#if ENABLE(JIT)
-            Vector<CallReturnOffsetToBytecodeIndex> m_callReturnIndexVector;
-#endif
-        };
         OwnPtr<ExceptionInfo> m_exceptionInfo;
 
         struct RareData : FastAllocBase {
             Vector<HandlerInfo> m_exceptionHandlers;
 
             // Rare Constants
-            Vector<RefPtr<FuncDeclNode> > m_functions;
             Vector<RefPtr<RegExp> > m_regexps;
 
             // Jump Tables
@@ -556,16 +558,16 @@ namespace JSC {
     // Program code is not marked by any function, so we make the global object
     // responsible for marking it.
 
-    class ProgramCodeBlock : public CodeBlock {
+    class GlobalCodeBlock : public CodeBlock {
     public:
-        ProgramCodeBlock(ScopeNode* ownerNode, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider)
-            : CodeBlock(ownerNode, codeType, sourceProvider, 0)
+        GlobalCodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, JSGlobalObject* globalObject)
+            : CodeBlock(ownerExecutable, codeType, sourceProvider, sourceOffset, &m_unsharedSymbolTable)
             , m_globalObject(globalObject)
         {
             m_globalObject->codeBlocks().add(this);
         }
 
-        ~ProgramCodeBlock()
+        ~GlobalCodeBlock()
         {
             if (m_globalObject)
                 m_globalObject->codeBlocks().remove(this);
@@ -575,20 +577,54 @@ namespace JSC {
 
     private:
         JSGlobalObject* m_globalObject; // For program and eval nodes, the global object that marks the constant pool.
+        SymbolTable m_unsharedSymbolTable;
     };
 
-    class EvalCodeBlock : public ProgramCodeBlock {
+    class ProgramCodeBlock : public GlobalCodeBlock {
     public:
-        EvalCodeBlock(ScopeNode* ownerNode, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, int baseScopeDepth)
-            : ProgramCodeBlock(ownerNode, EvalCode, globalObject, sourceProvider)
+        ProgramCodeBlock(ProgramExecutable* ownerExecutable, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider)
+            : GlobalCodeBlock(ownerExecutable, codeType, sourceProvider, 0, globalObject)
+        {
+        }
+    };
+
+    class EvalCodeBlock : public GlobalCodeBlock {
+    public:
+        EvalCodeBlock(EvalExecutable* ownerExecutable, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, int baseScopeDepth)
+            : GlobalCodeBlock(ownerExecutable, EvalCode, sourceProvider, 0, globalObject)
             , m_baseScopeDepth(baseScopeDepth)
         {
         }
 
         int baseScopeDepth() const { return m_baseScopeDepth; }
 
+        const Identifier& variable(unsigned index) { return m_variables[index]; }
+        unsigned numVariables() { return m_variables.size(); }
+        void adoptVariables(Vector<Identifier>& variables)
+        {
+            ASSERT(m_variables.isEmpty());
+            m_variables.swap(variables);
+        }
+
     private:
         int m_baseScopeDepth;
+        Vector<Identifier> m_variables;
+    };
+
+    class FunctionCodeBlock : public CodeBlock {
+    public:
+        // Rather than using the usual RefCounted::create idiom for SharedSymbolTable we just use new
+        // as we need to initialise the CodeBlock before we could initialise any RefPtr to hold the shared
+        // symbol table, so we just pass as a raw pointer with a ref count of 1.  We then manually deref
+        // in the destructor.
+        FunctionCodeBlock(FunctionExecutable* ownerExecutable, CodeType codeType, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset)
+            : CodeBlock(ownerExecutable, codeType, sourceProvider, sourceOffset, new SharedSymbolTable)
+        {
+        }
+        ~FunctionCodeBlock()
+        {
+            sharedSymbolTable()->deref();
+        }
     };
 
     inline Register& ExecState::r(int index)
diff --git a/JavaScriptCore/bytecode/EvalCodeCache.h b/JavaScriptCore/bytecode/EvalCodeCache.h
index 986525c..05834fc 100644
--- a/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -29,6 +29,7 @@
 #ifndef EvalCodeCache_h
 #define EvalCodeCache_h
 
+#include "Executable.h"
 #include "JSGlobalObject.h"
 #include "Nodes.h"
 #include "Parser.h"
@@ -41,44 +42,33 @@ namespace JSC {
 
     class EvalCodeCache {
     public:
-        PassRefPtr<EvalNode> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
+        PassRefPtr<EvalExecutable> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
         {
-            RefPtr<EvalNode> evalNode;
+            RefPtr<EvalExecutable> evalExecutable;
 
             if (evalSource.size() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject())
-                evalNode = m_cacheMap.get(evalSource.rep());
+                evalExecutable = m_cacheMap.get(evalSource.rep());
 
-            if (!evalNode) {
-                int errorLine;
-                UString errorMessage;
-                
-                SourceCode source = makeSource(evalSource);
-                evalNode = exec->globalData().parser->parse<EvalNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errorLine, &errorMessage);
-                if (evalNode) {
-                    if (evalSource.size() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject() && m_cacheMap.size() < maxCacheEntries)
-                        m_cacheMap.set(evalSource.rep(), evalNode);
-                } else {
-                    exceptionValue = Error::create(exec, SyntaxError, errorMessage, errorLine, source.provider()->asID(), 0);
+            if (!evalExecutable) {
+                evalExecutable = EvalExecutable::create(exec, makeSource(evalSource));
+                exceptionValue = evalExecutable->compile(exec, scopeChain);
+                if (exceptionValue)
                     return 0;
-                }
+
+                if (evalSource.size() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject() && m_cacheMap.size() < maxCacheEntries)
+                    m_cacheMap.set(evalSource.rep(), evalExecutable);
             }
 
-            return evalNode.release();
+            return evalExecutable.release();
         }
 
         bool isEmpty() const { return m_cacheMap.isEmpty(); }
 
-        void markAggregate(MarkStack& markStack)
-        {
-            EvalCacheMap::iterator end = m_cacheMap.end();
-            for (EvalCacheMap::iterator ptr = m_cacheMap.begin(); ptr != end; ++ptr)
-                ptr->second->markAggregate(markStack);
-        }
     private:
         static const int maxCacheableSourceLength = 256;
         static const int maxCacheEntries = 64;
 
-        typedef HashMap<RefPtr<UString::Rep>, RefPtr<EvalNode> > EvalCacheMap;
+        typedef HashMap<RefPtr<UString::Rep>, RefPtr<EvalExecutable> > EvalCacheMap;
         EvalCacheMap m_cacheMap;
     };
 
diff --git a/JavaScriptCore/bytecode/SamplingTool.cpp b/JavaScriptCore/bytecode/SamplingTool.cpp
index 8651723..865c919 100644
--- a/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -157,7 +157,7 @@ void SamplingThread::stop()
 }
 
 
-void ScopeSampleRecord::sample(CodeBlock* codeBlock, Instruction* vPC)
+void ScriptSampleRecord::sample(CodeBlock* codeBlock, Instruction* vPC)
 {
     if (!m_samples) {
         m_size = codeBlock->instructions().size();
@@ -196,8 +196,8 @@ void SamplingTool::doRun()
 
 #if ENABLE(CODEBLOCK_SAMPLING)
     if (CodeBlock* codeBlock = sample.codeBlock()) {
-        MutexLocker locker(m_scopeSampleMapMutex);
-        ScopeSampleRecord* record = m_scopeSampleMap->get(codeBlock->ownerNode());
+        MutexLocker locker(m_scriptSampleMapMutex);
+        ScriptSampleRecord* record = m_scopeSampleMap->get(codeBlock->ownerExecutable());
         ASSERT(record);
         record->sample(codeBlock, sample.vPC());
     }
@@ -209,13 +209,13 @@ void SamplingTool::sample()
     s_samplingTool->doRun();
 }
 
-void SamplingTool::notifyOfScope(ScopeNode* scope)
+void SamplingTool::notifyOfScope(ScriptExecutable* script)
 {
 #if ENABLE(CODEBLOCK_SAMPLING)
-    MutexLocker locker(m_scopeSampleMapMutex);
-    m_scopeSampleMap->set(scope, new ScopeSampleRecord(scope));
+    MutexLocker locker(m_scriptSampleMapMutex);
+    m_scopeSampleMap->set(script, new ScriptSampleRecord(script));
 #else
-    UNUSED_PARAM(scope);
+    UNUSED_PARAM(script);
 #endif
 }
 
@@ -254,10 +254,10 @@ static int compareLineCountInfoSampling(const void* left, const void* right)
     return (leftLineCount->line > rightLineCount->line) ? 1 : (leftLineCount->line < rightLineCount->line) ? -1 : 0;
 }
 
-static int compareScopeSampleRecords(const void* left, const void* right)
+static int compareScriptSampleRecords(const void* left, const void* right)
 {
-    const ScopeSampleRecord* const leftValue = *static_cast<const ScopeSampleRecord* const *>(left);
-    const ScopeSampleRecord* const rightValue = *static_cast<const ScopeSampleRecord* const *>(right);
+    const ScriptSampleRecord* const leftValue = *static_cast<const ScriptSampleRecord* const *>(left);
+    const ScriptSampleRecord* const rightValue = *static_cast<const ScriptSampleRecord* const *>(right);
 
     return (leftValue->m_sampleCount < rightValue->m_sampleCount) ? 1 : (leftValue->m_sampleCount > rightValue->m_sampleCount) ? -1 : 0;
 }
@@ -318,26 +318,26 @@ void SamplingTool::dump(ExecState* exec)
     // (3) Build and sort 'codeBlockSamples' array.
 
     int scopeCount = m_scopeSampleMap->size();
-    Vector<ScopeSampleRecord*> codeBlockSamples(scopeCount);
-    ScopeSampleRecordMap::iterator iter = m_scopeSampleMap->begin();
+    Vector<ScriptSampleRecord*> codeBlockSamples(scopeCount);
+    ScriptSampleRecordMap::iterator iter = m_scopeSampleMap->begin();
     for (int i = 0; i < scopeCount; ++i, ++iter)
         codeBlockSamples[i] = iter->second;
 
-    qsort(codeBlockSamples.begin(), scopeCount, sizeof(ScopeSampleRecord*), compareScopeSampleRecords);
+    qsort(codeBlockSamples.begin(), scopeCount, sizeof(ScriptSampleRecord*), compareScriptSampleRecords);
 
     // (4) Print data from 'codeBlockSamples' array.
 
     printf("\nCodeBlock samples\n\n"); 
 
     for (int i = 0; i < scopeCount; ++i) {
-        ScopeSampleRecord* record = codeBlockSamples[i];
+        ScriptSampleRecord* record = codeBlockSamples[i];
         CodeBlock* codeBlock = record->m_codeBlock;
 
         double blockPercent = (record->m_sampleCount * 100.0) / m_sampleCount;
 
         if (blockPercent >= 1) {
             //Instruction* code = codeBlock->instructions().begin();
-            printf("#%d: %s:%d: %d / %lld (%.3f%%)\n", i + 1, record->m_scope->sourceURL().UTF8String().c_str(), codeBlock->lineNumberForBytecodeOffset(exec, 0), record->m_sampleCount, m_sampleCount, blockPercent);
+            printf("#%d: %s:%d: %d / %lld (%.3f%%)\n", i + 1, record->m_executable->sourceURL().UTF8String().c_str(), codeBlock->lineNumberForBytecodeOffset(exec, 0), record->m_sampleCount, m_sampleCount, blockPercent);
             if (i < 10) {
                 HashMap<unsigned,unsigned> lineCounts;
                 codeBlock->dump(exec);
diff --git a/JavaScriptCore/bytecode/SamplingTool.h b/JavaScriptCore/bytecode/SamplingTool.h
index 1a3f7cf..8e3ed9e 100644
--- a/JavaScriptCore/bytecode/SamplingTool.h
+++ b/JavaScriptCore/bytecode/SamplingTool.h
@@ -38,6 +38,8 @@
 
 namespace JSC {
 
+    class ScriptExecutable;
+
     class SamplingFlags {
         friend class JIT;
     public:
@@ -92,9 +94,9 @@ namespace JSC {
     class ScopeNode;
     struct Instruction;
 
-    struct ScopeSampleRecord {
-        ScopeSampleRecord(ScopeNode* scope)
-            : m_scope(scope)
+    struct ScriptSampleRecord {
+        ScriptSampleRecord(ScriptExecutable* executable)
+            : m_executable(executable)
             , m_codeBlock(0)
             , m_sampleCount(0)
             , m_opcodeSampleCount(0)
@@ -103,7 +105,7 @@ namespace JSC {
         {
         }
         
-        ~ScopeSampleRecord()
+        ~ScriptSampleRecord()
         {
             if (m_samples)
                 free(m_samples);
@@ -111,7 +113,7 @@ namespace JSC {
         
         void sample(CodeBlock*, Instruction*);
 
-        RefPtr<ScopeNode> m_scope;
+        RefPtr<ScriptExecutable> m_executable;
         CodeBlock* m_codeBlock;
         int m_sampleCount;
         int m_opcodeSampleCount;
@@ -119,7 +121,7 @@ namespace JSC {
         unsigned m_size;
     };
 
-    typedef WTF::HashMap<ScopeNode*, ScopeSampleRecord*> ScopeSampleRecordMap;
+    typedef WTF::HashMap<ScriptExecutable*, ScriptSampleRecord*> ScriptSampleRecordMap;
 
     class SamplingThread {
     public:
@@ -193,7 +195,7 @@ namespace JSC {
             , m_sampleCount(0)
             , m_opcodeSampleCount(0)
 #if ENABLE(CODEBLOCK_SAMPLING)
-            , m_scopeSampleMap(new ScopeSampleRecordMap())
+            , m_scopeSampleMap(new ScriptSampleRecordMap())
 #endif
         {
             memset(m_opcodeSamples, 0, sizeof(m_opcodeSamples));
@@ -210,7 +212,7 @@ namespace JSC {
         void setup();
         void dump(ExecState*);
 
-        void notifyOfScope(ScopeNode* scope);
+        void notifyOfScope(ScriptExecutable* scope);
 
         void sample(CodeBlock* codeBlock, Instruction* vPC)
         {
@@ -266,8 +268,8 @@ namespace JSC {
         unsigned m_opcodeSamplesInCTIFunctions[numOpcodeIDs];
         
 #if ENABLE(CODEBLOCK_SAMPLING)
-        Mutex m_scopeSampleMapMutex;
-        OwnPtr<ScopeSampleRecordMap> m_scopeSampleMap;
+        Mutex m_scriptSampleMapMutex;
+        OwnPtr<ScriptSampleRecordMap> m_scopeSampleMap;
 #endif
     };
 
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 59537b6..8951ce3 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -256,15 +256,15 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
         m_nextGlobalIndex -= symbolTable->size();
 
         for (size_t i = 0; i < functionStack.size(); ++i) {
-            FuncDeclNode* funcDecl = functionStack[i];
-            globalObject->removeDirect(funcDecl->m_ident); // Make sure our new function is not shadowed by an old property.
-            emitNewFunction(addGlobalVar(funcDecl->m_ident, false), funcDecl);
+            FunctionBodyNode* function = functionStack[i];
+            globalObject->removeDirect(function->ident()); // Make sure our new function is not shadowed by an old property.
+            emitNewFunction(addGlobalVar(function->ident(), false), function);
         }
 
         Vector<RegisterID*, 32> newVars;
         for (size_t i = 0; i < varStack.size(); ++i)
-            if (!globalObject->hasProperty(exec, varStack[i].first))
-                newVars.append(addGlobalVar(varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant));
+            if (!globalObject->hasProperty(exec, *varStack[i].first))
+                newVars.append(addGlobalVar(*varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant));
 
         preserveLastVar();
 
@@ -272,16 +272,16 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
             emitLoad(newVars[i], jsUndefined());
     } else {
         for (size_t i = 0; i < functionStack.size(); ++i) {
-            FuncDeclNode* funcDecl = functionStack[i];
-            globalObject->putWithAttributes(exec, funcDecl->m_ident, funcDecl->makeFunction(exec, scopeChain.node()), DontDelete);
+            FunctionBodyNode* function = functionStack[i];
+            globalObject->putWithAttributes(exec, function->ident(), new (exec) JSFunction(exec, makeFunction(exec, function), scopeChain.node()), DontDelete);
         }
         for (size_t i = 0; i < varStack.size(); ++i) {
-            if (globalObject->hasProperty(exec, varStack[i].first))
+            if (globalObject->hasProperty(exec, *varStack[i].first))
                 continue;
             int attributes = DontDelete;
             if (varStack[i].second & DeclarationStacks::IsConstant)
                 attributes |= ReadOnly;
-            globalObject->putWithAttributes(exec, varStack[i].first, jsUndefined(), attributes);
+            globalObject->putWithAttributes(exec, *varStack[i].first, jsUndefined(), attributes);
         }
 
         preserveLastVar();
@@ -339,18 +339,18 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
 
     const DeclarationStacks::FunctionStack& functionStack = functionBody->functionStack();
     for (size_t i = 0; i < functionStack.size(); ++i) {
-        FuncDeclNode* funcDecl = functionStack[i];
-        const Identifier& ident = funcDecl->m_ident;
+        FunctionBodyNode* function = functionStack[i];
+        const Identifier& ident = function->ident();
         m_functions.add(ident.ustring().rep());
-        emitNewFunction(addVar(ident, false), funcDecl);
+        emitNewFunction(addVar(ident, false), function);
     }
 
     const DeclarationStacks::VarStack& varStack = functionBody->varStack();
     for (size_t i = 0; i < varStack.size(); ++i)
-        addVar(varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant);
+        addVar(*varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant);
 
-    const Identifier* parameters = functionBody->parameters();
-    size_t parameterCount = functionBody->parameterCount();
+    FunctionParameters& parameters = *functionBody->parameters();
+    size_t parameterCount = parameters.size();
     m_nextParameterIndex = -RegisterFile::CallFrameHeaderSize - parameterCount - 1;
     m_parameters.grow(1 + parameterCount); // reserve space for "this"
 
@@ -397,6 +397,18 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, const Debugger* debugge
     codeBlock->setGlobalData(m_globalData);
     m_codeBlock->m_numParameters = 1; // Allocate space for "this"
 
+    const DeclarationStacks::FunctionStack& functionStack = evalNode->functionStack();
+    for (size_t i = 0; i < functionStack.size(); ++i)
+        m_codeBlock->addFunctionDecl(makeFunction(m_globalData, functionStack[i]));
+
+    const DeclarationStacks::VarStack& varStack = evalNode->varStack();
+    unsigned numVariables = varStack.size();
+    Vector<Identifier> variables;
+    variables.reserveCapacity(numVariables);
+    for (size_t i = 0; i < numVariables; ++i)
+        variables.append(*varStack[i].first);
+    codeBlock->adoptVariables(variables);
+
     preserveLastVar();
 }
 
@@ -470,7 +482,8 @@ RegisterID* BytecodeGenerator::constRegisterFor(const Identifier& ident)
         return 0;
 
     SymbolTableEntry entry = symbolTable().get(ident.ustring().rep());
-    ASSERT(!entry.isNull());
+    if (entry.isNull())
+        return 0;
 
     return &registerFor(entry.getIndex());
 }
@@ -765,18 +778,6 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond
     return target;
 }
 
-unsigned BytecodeGenerator::addConstant(FuncDeclNode* n)
-{
-    // No need to explicitly unique function body nodes -- they're unique already.
-    return m_codeBlock->addFunction(n);
-}
-
-unsigned BytecodeGenerator::addConstant(FuncExprNode* n)
-{
-    // No need to explicitly unique function expression nodes -- they're unique already.
-    return m_codeBlock->addFunctionExpression(n);
-}
-
 unsigned BytecodeGenerator::addConstant(const Identifier& ident)
 {
     UString::Rep* rep = ident.ustring().rep();
@@ -1313,11 +1314,13 @@ RegisterID* BytecodeGenerator::emitNewArray(RegisterID* dst, ElementNode* elemen
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitNewFunction(RegisterID* dst, FuncDeclNode* n)
+RegisterID* BytecodeGenerator::emitNewFunction(RegisterID* dst, FunctionBodyNode* function)
 {
+    unsigned index = m_codeBlock->addFunctionDecl(makeFunction(m_globalData, function));
+
     emitOpcode(op_new_func);
     instructions().append(dst->index());
-    instructions().append(addConstant(n));
+    instructions().append(index);
     return dst;
 }
 
@@ -1332,9 +1335,12 @@ RegisterID* BytecodeGenerator::emitNewRegExp(RegisterID* dst, RegExp* regExp)
 
 RegisterID* BytecodeGenerator::emitNewFunctionExpression(RegisterID* r0, FuncExprNode* n)
 {
+    FunctionBodyNode* function = n->body();
+    unsigned index = m_codeBlock->addFunctionExpr(makeFunction(m_globalData, function));
+
     emitOpcode(op_new_func_exp);
     instructions().append(r0->index());
-    instructions().append(addConstant(n));
+    instructions().append(index);
     return r0;
 }
 
@@ -1805,7 +1811,7 @@ void BytecodeGenerator::emitSubroutineReturn(RegisterID* retAddrSrc)
     instructions().append(retAddrSrc->index());
 }
 
-void BytecodeGenerator::emitPushNewScope(RegisterID* dst, Identifier& property, RegisterID* value)
+void BytecodeGenerator::emitPushNewScope(RegisterID* dst, const Identifier& property, RegisterID* value)
 {
     ControlFlowContext context;
     context.isFinallyBlock = false;
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index c273597..1a83ce9 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -61,7 +61,7 @@ namespace JSC {
         FinallyContext finallyContext;
     };
 
-    class BytecodeGenerator : public WTF::FastAllocBase {
+    class BytecodeGenerator : public FastAllocBase {
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
@@ -254,7 +254,7 @@ namespace JSC {
         RegisterID* emitNewObject(RegisterID* dst);
         RegisterID* emitNewArray(RegisterID* dst, ElementNode*); // stops at first elision
 
-        RegisterID* emitNewFunction(RegisterID* dst, FuncDeclNode* func);
+        RegisterID* emitNewFunction(RegisterID* dst, FunctionBodyNode* body);
         RegisterID* emitNewFunctionExpression(RegisterID* dst, FuncExprNode* func);
         RegisterID* emitNewRegExp(RegisterID* dst, RegExp* regExp);
 
@@ -318,7 +318,7 @@ namespace JSC {
         RegisterID* emitCatch(RegisterID*, Label* start, Label* end);
         void emitThrow(RegisterID* exc) { emitUnaryNoDstOp(op_throw, exc); }
         RegisterID* emitNewError(RegisterID* dst, ErrorType type, JSValue message);
-        void emitPushNewScope(RegisterID* dst, Identifier& property, RegisterID* value);
+        void emitPushNewScope(RegisterID* dst, const Identifier& property, RegisterID* value);
 
         RegisterID* emitPushScope(RegisterID* scope);
         void emitPopScope();
@@ -413,12 +413,20 @@ namespace JSC {
             return m_globals[-index - 1];
         }
 
-        unsigned addConstant(FuncDeclNode*);
-        unsigned addConstant(FuncExprNode*);
         unsigned addConstant(const Identifier&);
         RegisterID* addConstantValue(JSValue);
         unsigned addRegExp(RegExp*);
 
+        PassRefPtr<FunctionExecutable> makeFunction(ExecState* exec, FunctionBodyNode* body)
+        {
+            return FunctionExecutable::create(exec, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+        }
+
+        PassRefPtr<FunctionExecutable> makeFunction(JSGlobalData* globalData, FunctionBodyNode* body)
+        {
+            return FunctionExecutable::create(globalData, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+        }
+
         Vector<Instruction>& instructions() { return m_codeBlock->instructions(); }
         SymbolTable& symbolTable() { return *m_symbolTable; }
 
@@ -445,12 +453,12 @@ namespace JSC {
         RegisterID m_thisRegister;
         RegisterID m_argumentsRegister;
         int m_activationRegisterIndex;
-        WTF::SegmentedVector<RegisterID, 32> m_constantPoolRegisters;
-        WTF::SegmentedVector<RegisterID, 32> m_calleeRegisters;
-        WTF::SegmentedVector<RegisterID, 32> m_parameters;
-        WTF::SegmentedVector<RegisterID, 32> m_globals;
-        WTF::SegmentedVector<Label, 32> m_labels;
-        WTF::SegmentedVector<LabelScope, 8> m_labelScopes;
+        SegmentedVector<RegisterID, 32> m_constantPoolRegisters;
+        SegmentedVector<RegisterID, 32> m_calleeRegisters;
+        SegmentedVector<RegisterID, 32> m_parameters;
+        SegmentedVector<RegisterID, 32> m_globals;
+        SegmentedVector<Label, 32> m_labels;
+        SegmentedVector<LabelScope, 8> m_labelScopes;
         RefPtr<RegisterID> m_lastVar;
         int m_finallyDepth;
         int m_dynamicScopeDepth;
diff --git a/JavaScriptCore/debugger/Debugger.cpp b/JavaScriptCore/debugger/Debugger.cpp
index 7d791e7..902a802 100644
--- a/JavaScriptCore/debugger/Debugger.cpp
+++ b/JavaScriptCore/debugger/Debugger.cpp
@@ -22,16 +22,16 @@
 #include "config.h"
 #include "Debugger.h"
 
-#include "JSGlobalObject.h"
+#include "CollectorHeapIterator.h"
+#include "Error.h"
 #include "Interpreter.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
 #include "Parser.h"
+#include "Protect.h"
 
 namespace JSC {
 
-Debugger::Debugger()
-{
-}
-
 Debugger::~Debugger()
 {
     HashSet<JSGlobalObject*>::iterator end = m_globalObjects.end();
@@ -53,18 +53,59 @@ void Debugger::detach(JSGlobalObject* globalObject)
     globalObject->setDebugger(0);
 }
 
+void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
+{
+    // If JavaScript is running, it's not safe to recompile, since we'll end
+    // up throwing away code that is live on the stack.
+    ASSERT(!globalData->dynamicGlobalObject);
+    if (globalData->dynamicGlobalObject)
+        return;
+
+    typedef HashSet<FunctionExecutable*> FunctionExecutableSet;
+    typedef HashMap<SourceProvider*, ExecState*> SourceProviderMap;
+
+    FunctionExecutableSet functionExecutables;
+    SourceProviderMap sourceProviders;
+
+    Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
+    for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
+        if (!(*it)->inherits(&JSFunction::info))
+            continue;
+
+        JSFunction* function = asFunction(*it);
+        if (function->executable()->isHostFunction())
+            continue;
+
+        FunctionExecutable* executable = function->jsExecutable();
+
+        // Check if the function is already in the set - if so,
+        // we've already retranslated it, nothing to do here.
+        if (!functionExecutables.add(executable).second)
+            continue;
+
+        ExecState* exec = function->scope().globalObject()->JSGlobalObject::globalExec();
+        executable->recompile(exec);
+        if (function->scope().globalObject()->debugger() == this)
+            sourceProviders.add(executable->source().provider(), exec);
+    }
+
+    // Call sourceParsed() after reparsing all functions because it will execute
+    // JavaScript in the inspector.
+    SourceProviderMap::const_iterator end = sourceProviders.end();
+    for (SourceProviderMap::const_iterator iter = sourceProviders.begin(); iter != end; ++iter)
+        sourceParsed(iter->second, SourceCode(iter->first), -1, 0);
+}
+
 JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
 {
     CallFrame* globalCallFrame = globalObject->globalExec();
 
-    int errLine;
-    UString errMsg;
-    SourceCode source = makeSource(script);
-    RefPtr<EvalNode> evalNode = globalObject->globalData()->parser->parse<EvalNode>(globalCallFrame, globalObject->debugger(), source, &errLine, &errMsg);
-    if (!evalNode)
-        return Error::create(globalCallFrame, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
+    RefPtr<EvalExecutable> eval = EvalExecutable::create(globalCallFrame, makeSource(script));
+    JSObject* error = eval->compile(globalCallFrame, globalCallFrame->scopeChain());
+    if (error)
+        return error;
 
-    return globalObject->globalData()->interpreter->execute(evalNode.get(), globalCallFrame, globalObject, globalCallFrame->scopeChain(), &exception);
+    return globalObject->globalData()->interpreter->execute(eval.get(), globalCallFrame, globalObject, globalCallFrame->scopeChain(), &exception);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/debugger/Debugger.h b/JavaScriptCore/debugger/Debugger.h
index 98d0935..3ee9767 100644
--- a/JavaScriptCore/debugger/Debugger.h
+++ b/JavaScriptCore/debugger/Debugger.h
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -22,40 +22,42 @@
 #ifndef Debugger_h
 #define Debugger_h
 
-#include "Protect.h"
+#include <wtf/HashSet.h>
 
 namespace JSC {
 
     class DebuggerCallFrame;
     class ExecState;
+    class JSGlobalData;
     class JSGlobalObject;
+    class JSValue;
     class SourceCode;
     class UString;
 
     class Debugger {
     public:
-        Debugger();
         virtual ~Debugger();
 
         void attach(JSGlobalObject*);
         virtual void detach(JSGlobalObject*);
 
-        virtual void sourceParsed(ExecState*, const SourceCode&, int errorLine, const UString& errorMsg) = 0;
-        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
-        virtual void atStatement(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
-        virtual void callEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
-        virtual void returnEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
+        virtual void sourceParsed(ExecState*, const SourceCode&, int errorLineNumber, const UString& errorMessage) = 0;
+        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void atStatement(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void callEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void returnEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
 
-        virtual void willExecuteProgram(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
-        virtual void didExecuteProgram(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
-        virtual void didReachBreakpoint(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
+        virtual void willExecuteProgram(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void didExecuteProgram(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void didReachBreakpoint(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+
+        void recompileAllJSFunctions(JSGlobalData*);
 
     private:
         HashSet<JSGlobalObject*> m_globalObjects;
     };
 
-    // This method exists only for backwards compatibility with existing
-    // WebScriptDebugger clients
+    // This function exists only for backwards compatibility with existing WebScriptDebugger clients.
     JSValue evaluateInGlobalCallFrame(const UString&, JSValue& exception, JSGlobalObject*);
 
 } // namespace JSC
diff --git a/JavaScriptCore/debugger/DebuggerActivation.cpp b/JavaScriptCore/debugger/DebuggerActivation.cpp
index 34d0447..5cc9a9f 100644
--- a/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -71,7 +71,7 @@ bool DebuggerActivation::deleteProperty(ExecState* exec, const Identifier& prope
     return m_activation->deleteProperty(exec, propertyName);
 }
 
-void DebuggerActivation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void DebuggerActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     m_activation->getPropertyNames(exec, propertyNames);
 }
@@ -81,14 +81,14 @@ bool DebuggerActivation::getPropertyAttributes(JSC::ExecState* exec, const Ident
     return m_activation->getPropertyAttributes(exec, propertyName, attributes);
 }
 
-void DebuggerActivation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void DebuggerActivation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
-    m_activation->defineGetter(exec, propertyName, getterFunction);
+    m_activation->defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
-void DebuggerActivation::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void DebuggerActivation::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
-    m_activation->defineSetter(exec, propertyName, setterFunction);
+    m_activation->defineSetter(exec, propertyName, setterFunction, attributes);
 }
 
 JSValue DebuggerActivation::lookupGetter(ExecState* exec, const Identifier& propertyName)
diff --git a/JavaScriptCore/debugger/DebuggerActivation.h b/JavaScriptCore/debugger/DebuggerActivation.h
index 82cde4d..dd34265 100644
--- a/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/JavaScriptCore/debugger/DebuggerActivation.h
@@ -42,16 +42,16 @@ namespace JSC {
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue, unsigned attributes);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
         virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
-        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
-        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
+        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes);
+        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes);
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
         virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         {
-            return Structure::create(prototype, TypeInfo(ObjectType)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames)); 
         }
 
     private:
diff --git a/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index cd8702b..c9d7cc6 100644
--- a/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -41,7 +41,7 @@ const UString* DebuggerCallFrame::functionName() const
     if (!m_callFrame->codeBlock())
         return 0;
 
-    JSFunction* function = static_cast<JSFunction*>(m_callFrame->callee());
+    JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
         return 0;
     return &function->name(&m_callFrame->globalData());
@@ -52,7 +52,7 @@ UString DebuggerCallFrame::calculatedFunctionName() const
     if (!m_callFrame->codeBlock())
         return 0;
     
-    JSFunction* function = static_cast<JSFunction*>(m_callFrame->callee());
+    JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
         return 0;
     return function->calculatedDisplayName(&m_callFrame->globalData());
@@ -79,14 +79,12 @@ JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) c
     if (!m_callFrame->codeBlock())
         return JSValue();
 
-    int errLine;
-    UString errMsg;
-    SourceCode source = makeSource(script);
-    RefPtr<EvalNode> evalNode = m_callFrame->scopeChain()->globalData->parser->parse<EvalNode>(m_callFrame, m_callFrame->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
-    if (!evalNode)
-        return Error::create(m_callFrame, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
+    RefPtr<EvalExecutable> eval = EvalExecutable::create(m_callFrame, makeSource(script));
+    JSObject* error = eval->compile(m_callFrame, m_callFrame->scopeChain());
+    if (error)
+        return error;
 
-    return m_callFrame->scopeChain()->globalData->interpreter->execute(evalNode.get(), m_callFrame, thisObject(), m_callFrame->scopeChain(), &exception);
+    return m_callFrame->scopeChain()->globalData->interpreter->execute(eval.get(), m_callFrame, thisObject(), m_callFrame->scopeChain(), &exception);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/interpreter/CachedCall.h b/JavaScriptCore/interpreter/CachedCall.h
index 767c262..e903b79 100644
--- a/JavaScriptCore/interpreter/CachedCall.h
+++ b/JavaScriptCore/interpreter/CachedCall.h
@@ -38,9 +38,10 @@ namespace JSC {
             : m_valid(false)
             , m_interpreter(callFrame->interpreter())
             , m_exception(exception)
-            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().node()->globalObject())
+            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().globalObject())
         {
-            m_closure = m_interpreter->prepareForRepeatCall(function->body(), callFrame, function, argCount, function->scope().node(), exception);
+            ASSERT(!function->isHostFunction());
+            m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope().node(), exception);
             m_valid = !*exception;
         }
         
diff --git a/JavaScriptCore/interpreter/CallFrame.h b/JavaScriptCore/interpreter/CallFrame.h
index 92ec06e..b4d49db 100644
--- a/JavaScriptCore/interpreter/CallFrame.h
+++ b/JavaScriptCore/interpreter/CallFrame.h
@@ -51,14 +51,14 @@ namespace JSC  {
         // Differs from dynamicGlobalObject() during function calls across web browser frames.
         JSGlobalObject* lexicalGlobalObject() const
         {
-            return scopeChain()->globalObject();
+            return scopeChain()->globalObject;
         }
 
         // Differs from lexicalGlobalObject because this will have DOM window shell rather than
         // the actual DOM window, which can't be "this" for security reasons.
         JSObject* globalThisValue() const
         {
-            return scopeChain()->globalThisObject();
+            return scopeChain()->globalThis;
         }
 
         // FIXME: Elsewhere, we use JSGlobalData* rather than JSGlobalData&.
diff --git a/JavaScriptCore/interpreter/CallFrameClosure.h b/JavaScriptCore/interpreter/CallFrameClosure.h
index 9085327..a301060 100644
--- a/JavaScriptCore/interpreter/CallFrameClosure.h
+++ b/JavaScriptCore/interpreter/CallFrameClosure.h
@@ -32,7 +32,7 @@ struct CallFrameClosure {
     CallFrame* oldCallFrame;
     CallFrame* newCallFrame;
     JSFunction* function;
-    FunctionBodyNode* functionBody;
+    FunctionExecutable* functionExecutable;
     JSGlobalData* globalData;
     Register* oldEnd;
     ScopeChainNode* scopeChain;
diff --git a/JavaScriptCore/interpreter/Interpreter.cpp b/JavaScriptCore/interpreter/Interpreter.cpp
index f102739..847b1fa 100644
--- a/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/JavaScriptCore/interpreter/Interpreter.cpp
@@ -169,7 +169,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
+        if (slot.isCacheable() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             if (vPC[4].u.structure)
                 vPC[4].u.structure->deref();
             globalObject->structure()->ref();
@@ -350,24 +350,26 @@ NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* r
     LiteralParser preparser(callFrame, programSource, LiteralParser::NonStrictJSON);
     if (JSValue parsedObject = preparser.tryLiteralParse())
         return parsedObject;
-    
-    
+
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     CodeBlock* codeBlock = callFrame->codeBlock();
-    RefPtr<EvalNode> evalNode = codeBlock->evalCodeCache().get(callFrame, programSource, scopeChain, exceptionValue);
+    RefPtr<EvalExecutable> eval = codeBlock->evalCodeCache().get(callFrame, programSource, scopeChain, exceptionValue);
 
     JSValue result = jsUndefined();
-    if (evalNode)
-        result = callFrame->globalData().interpreter->execute(evalNode.get(), callFrame, callFrame->thisValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain, &exceptionValue);
+    if (eval)
+        result = callFrame->globalData().interpreter->execute(eval.get(), callFrame, callFrame->thisValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain, &exceptionValue);
 
     return result;
 }
 
 Interpreter::Interpreter()
-    : m_sampler(0)
+    : m_sampleEntryDepth(0)
     , m_reentryDepth(0)
 {
     privateExecute(InitializeAndReturn, 0, 0, 0);
+#if ENABLE(OPCODE_SAMPLING)
+    enableSampler();
+#endif
 }
 
 #ifndef NDEBUG
@@ -386,7 +388,7 @@ void Interpreter::dumpRegisters(CallFrame* callFrame)
     printf("-----------------------------------------------------------------------------\n");
 
     CodeBlock* codeBlock = callFrame->codeBlock();
-    RegisterFile* registerFile = &callFrame->scopeChain()->globalObject()->globalData()->interpreter->registerFile();
+    RegisterFile* registerFile = &callFrame->scopeChain()->globalObject->globalData()->interpreter->registerFile();
     const Register* it;
     const Register* end;
     JSValue v;
@@ -490,21 +492,21 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue ex
     if (Debugger* debugger = callFrame->dynamicGlobalObject()->debugger()) {
         DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
         if (callFrame->callee())
-            debugger->returnEvent(debuggerCallFrame, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->lastLine());
+            debugger->returnEvent(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->lastLine());
         else
-            debugger->didExecuteProgram(debuggerCallFrame, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->lastLine());
+            debugger->didExecuteProgram(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->lastLine());
     }
 
     if (Profiler* profiler = *Profiler::enabledProfilerReference()) {
         if (callFrame->callee())
             profiler->didExecute(callFrame, callFrame->callee());
         else
-            profiler->didExecute(callFrame, codeBlock->ownerNode()->sourceURL(), codeBlock->ownerNode()->lineNo());
+            profiler->didExecute(callFrame, codeBlock->ownerExecutable()->sourceURL(), codeBlock->ownerExecutable()->lineNo());
     }
 
     // If this call frame created an activation or an 'arguments' object, tear it off.
     if (oldCodeBlock->codeType() == FunctionCode && oldCodeBlock->needsFullScopeChain()) {
-        while (!scopeChain->object->isObject(&JSActivation::info))
+        while (!scopeChain->object->inherits(&JSActivation::info))
             scopeChain = scopeChain->pop();
         static_cast<JSActivation*>(scopeChain->object)->copyRegisters(callFrame->optionalCalleeArguments());
     } else if (Arguments* arguments = callFrame->optionalCalleeArguments()) {
@@ -555,8 +557,8 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
                     exception->putWithAttributes(callFrame, Identifier(callFrame, expressionEndOffsetPropertyName), jsNumber(callFrame, divotPoint + endOffset), ReadOnly | DontDelete);
                 } else
                     exception->putWithAttributes(callFrame, Identifier(callFrame, "line"), jsNumber(callFrame, codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset)), ReadOnly | DontDelete);
-                exception->putWithAttributes(callFrame, Identifier(callFrame, "sourceId"), jsNumber(callFrame, codeBlock->ownerNode()->sourceID()), ReadOnly | DontDelete);
-                exception->putWithAttributes(callFrame, Identifier(callFrame, "sourceURL"), jsOwnedString(callFrame, codeBlock->ownerNode()->sourceURL()), ReadOnly | DontDelete);
+                exception->putWithAttributes(callFrame, Identifier(callFrame, "sourceId"), jsNumber(callFrame, codeBlock->ownerExecutable()->sourceID()), ReadOnly | DontDelete);
+                exception->putWithAttributes(callFrame, Identifier(callFrame, "sourceURL"), jsOwnedString(callFrame, codeBlock->ownerExecutable()->sourceURL()), ReadOnly | DontDelete);
             }
             
             if (exception->isWatchdogException()) {
@@ -570,7 +572,7 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
 
     if (Debugger* debugger = callFrame->dynamicGlobalObject()->debugger()) {
         DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
-        debugger->exception(debuggerCallFrame, codeBlock->ownerNode()->sourceID(), codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset));
+        debugger->exception(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset));
     }
 
     // If we throw in the middle of a call instruction, we need to notify
@@ -610,7 +612,7 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     return handler;
 }
 
-JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValue* exception)
+JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
@@ -621,7 +623,7 @@ JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, Sco
         }
     }
 
-    CodeBlock* codeBlock = &programNode->bytecode(scopeChain);
+    CodeBlock* codeBlock = &program->bytecode(callFrame, scopeChain);
 
     Register* oldEnd = m_registerFile.end();
     Register* newEnd = oldEnd + codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize + codeBlock->m_numCalleeRegisters;
@@ -630,7 +632,7 @@ JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, Sco
         return jsNull();
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject());
+    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     JSGlobalObject* lastGlobalObject = m_registerFile.globalObject();
     JSGlobalObject* globalObject = callFrame->dynamicGlobalObject();
@@ -645,15 +647,15 @@ JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, Sco
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
-        (*profiler)->willExecute(newCallFrame, programNode->sourceURL(), programNode->lineNo());
+        (*profiler)->willExecute(newCallFrame, program->sourceURL(), program->lineNo());
 
     JSValue result;
     {
-        SamplingTool::CallRecord callRecord(m_sampler);
+        SamplingTool::CallRecord callRecord(m_sampler.get());
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        result = programNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = program->jitCode(newCallFrame, scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -661,7 +663,7 @@ JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, Sco
     }
 
     if (*profiler)
-        (*profiler)->didExecute(callFrame, programNode->sourceURL(), programNode->lineNo());
+        (*profiler)->didExecute(callFrame, program->sourceURL(), program->lineNo());
 
     if (m_reentryDepth && lastGlobalObject && globalObject != lastGlobalObject)
         lastGlobalObject->copyGlobalsTo(m_registerFile);
@@ -671,7 +673,7 @@ JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, Sco
     return result;
 }
 
-JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, JSObject* thisObj, const ArgList& args, ScopeChainNode* scopeChain, JSValue* exception)
+JSValue Interpreter::execute(FunctionExecutable* functionExecutable, CallFrame* callFrame, JSFunction* function, JSObject* thisObj, const ArgList& args, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
@@ -690,7 +692,7 @@ JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* call
         return jsNull();
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject());
+    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
@@ -699,7 +701,7 @@ JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* call
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
         newCallFrame->r(++dst) = *it;
 
-    CodeBlock* codeBlock = &functionBodyNode->bytecode(scopeChain);
+    CodeBlock* codeBlock = &functionExecutable->bytecode(callFrame, scopeChain);
     newCallFrame = slideRegisterWindowForCall(codeBlock, &m_registerFile, newCallFrame, argc + RegisterFile::CallFrameHeaderSize, argc);
     if (UNLIKELY(!newCallFrame)) {
         *exception = createStackOverflowError(callFrame);
@@ -715,11 +717,11 @@ JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* call
 
     JSValue result;
     {
-        SamplingTool::CallRecord callRecord(m_sampler);
+        SamplingTool::CallRecord callRecord(m_sampler.get());
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        result = functionBodyNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = functionExecutable->jitCode(newCallFrame, scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -733,7 +735,7 @@ JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* call
     return result;
 }
 
-CallFrameClosure Interpreter::prepareForRepeatCall(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, int argCount, ScopeChainNode* scopeChain, JSValue* exception)
+CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* FunctionExecutable, CallFrame* callFrame, JSFunction* function, int argCount, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
     
@@ -757,7 +759,7 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionBodyNode* functionBod
     for (int i = 0; i < argc; ++i)
         newCallFrame->r(++dst) = jsUndefined();
     
-    CodeBlock* codeBlock = &functionBodyNode->bytecode(scopeChain);
+    CodeBlock* codeBlock = &FunctionExecutable->bytecode(callFrame, scopeChain);
     newCallFrame = slideRegisterWindowForCall(codeBlock, &m_registerFile, newCallFrame, argc + RegisterFile::CallFrameHeaderSize, argc);
     if (UNLIKELY(!newCallFrame)) {
         *exception = createStackOverflowError(callFrame);
@@ -767,10 +769,10 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionBodyNode* functionBod
     // a 0 codeBlock indicates a built-in caller
     newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), 0, argc, function);
 #if ENABLE(JIT)
-    functionBodyNode->jitCode(scopeChain);
+    FunctionExecutable->jitCode(newCallFrame, scopeChain);
 #endif
 
-    CallFrameClosure result = { callFrame, newCallFrame, function, functionBodyNode, scopeChain->globalData, oldEnd, scopeChain, codeBlock->m_numParameters, argc };
+    CallFrameClosure result = { callFrame, newCallFrame, function, FunctionExecutable, scopeChain->globalData, oldEnd, scopeChain, codeBlock->m_numParameters, argc };
     return result;
 }
 
@@ -783,11 +785,11 @@ JSValue Interpreter::execute(CallFrameClosure& closure, JSValue* exception)
     
     JSValue result;
     {
-        SamplingTool::CallRecord callRecord(m_sampler);
+        SamplingTool::CallRecord callRecord(m_sampler.get());
         
         m_reentryDepth++;
 #if ENABLE(JIT)
-        result = closure.functionBody->generatedJITCode().execute(&m_registerFile, closure.newCallFrame, closure.globalData, exception);
+        result = closure.functionExecutable->generatedJITCode().execute(&m_registerFile, closure.newCallFrame, closure.globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, closure.newCallFrame, exception);
 #endif
@@ -804,12 +806,12 @@ void Interpreter::endRepeatCall(CallFrameClosure& closure)
     m_registerFile.shrink(closure.oldEnd);
 }
 
-JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception)
+JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception)
 {
-    return execute(evalNode, callFrame, thisObj, m_registerFile.size() + evalNode->bytecode(scopeChain).m_numParameters + RegisterFile::CallFrameHeaderSize, scopeChain, exception);
+    return execute(eval, callFrame, thisObj, m_registerFile.size() + eval->bytecode(callFrame, scopeChain).m_numParameters + RegisterFile::CallFrameHeaderSize, scopeChain, exception);
 }
 
-JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValue* exception)
+JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
@@ -820,9 +822,9 @@ JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject*
         }
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject());
+    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
 
-    EvalCodeBlock* codeBlock = &evalNode->bytecode(scopeChain);
+    EvalCodeBlock* codeBlock = &eval->bytecode(callFrame, scopeChain);
 
     JSVariableObject* variableObject;
     for (ScopeChainNode* node = scopeChain; ; node = node->next) {
@@ -837,21 +839,20 @@ JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject*
 
         BatchedTransitionOptimizer optimizer(variableObject);
 
-        const DeclarationStacks::VarStack& varStack = codeBlock->ownerNode()->varStack();
-        DeclarationStacks::VarStack::const_iterator varStackEnd = varStack.end();
-        for (DeclarationStacks::VarStack::const_iterator it = varStack.begin(); it != varStackEnd; ++it) {
-            const Identifier& ident = (*it).first;
+        unsigned numVariables = codeBlock->numVariables();
+        for (unsigned i = 0; i < numVariables; ++i) {
+            const Identifier& ident = codeBlock->variable(i);
             if (!variableObject->hasProperty(callFrame, ident)) {
                 PutPropertySlot slot;
                 variableObject->put(callFrame, ident, jsUndefined(), slot);
             }
         }
 
-        const DeclarationStacks::FunctionStack& functionStack = codeBlock->ownerNode()->functionStack();
-        DeclarationStacks::FunctionStack::const_iterator functionStackEnd = functionStack.end();
-        for (DeclarationStacks::FunctionStack::const_iterator it = functionStack.begin(); it != functionStackEnd; ++it) {
+        int numFunctions = codeBlock->numberOfFunctionDecls();
+        for (int i = 0; i < numFunctions; ++i) {
+            FunctionExecutable* function = codeBlock->functionDecl(i);
             PutPropertySlot slot;
-            variableObject->put(callFrame, (*it)->m_ident, (*it)->makeFunction(callFrame, scopeChain), slot);
+            variableObject->put(callFrame, function->name(), function->make(callFrame, scopeChain), slot);
         }
 
     }
@@ -874,15 +875,15 @@ JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject*
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
-        (*profiler)->willExecute(newCallFrame, evalNode->sourceURL(), evalNode->lineNo());
+        (*profiler)->willExecute(newCallFrame, eval->sourceURL(), eval->lineNo());
 
     JSValue result;
     {
-        SamplingTool::CallRecord callRecord(m_sampler);
+        SamplingTool::CallRecord callRecord(m_sampler.get());
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        result = evalNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = eval->jitCode(newCallFrame, scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -890,7 +891,7 @@ JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject*
     }
 
     if (*profiler)
-        (*profiler)->didExecute(callFrame, evalNode->sourceURL(), evalNode->lineNo());
+        (*profiler)->didExecute(callFrame, eval->sourceURL(), eval->lineNo());
 
     m_registerFile.shrink(oldEnd);
     return result;
@@ -904,22 +905,22 @@ NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHook
 
     switch (debugHookID) {
         case DidEnterCallFrame:
-            debugger->callEvent(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), firstLine);
+            debugger->callEvent(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine);
             return;
         case WillLeaveCallFrame:
-            debugger->returnEvent(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), lastLine);
+            debugger->returnEvent(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine);
             return;
         case WillExecuteStatement:
-            debugger->atStatement(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), firstLine);
+            debugger->atStatement(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine);
             return;
         case WillExecuteProgram:
-            debugger->willExecuteProgram(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), firstLine);
+            debugger->willExecuteProgram(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine);
             return;
         case DidExecuteProgram:
-            debugger->didExecuteProgram(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), lastLine);
+            debugger->didExecuteProgram(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine);
             return;
         case DidReachBreakpoint:
-            debugger->didReachBreakpoint(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), lastLine);
+            debugger->didReachBreakpoint(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine);
             return;
     }
 }
@@ -955,7 +956,7 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
     JSCell* baseCell = asCell(baseValue);
     Structure* structure = baseCell->structure();
 
-    if (structure->isDictionary()) {
+    if (structure->isUncacheableDictionary()) {
         vPC[0] = getOpcode(op_put_by_id_generic);
         return;
     }
@@ -990,6 +991,10 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
 
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
+        if (structure->isDictionary()) {
+            vPC[0] = getOpcode(op_put_by_id_generic);
+            return;
+        }
         vPC[0] = getOpcode(op_put_by_id_transition);
         vPC[4] = structure->previousID();
         vPC[5] = structure;
@@ -1042,7 +1047,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
 
     Structure* structure = asCell(baseValue)->structure();
 
-    if (structure->isDictionary()) {
+    if (structure->isUncacheableDictionary()) {
         vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
@@ -1240,7 +1245,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         int dst = (++vPC)->u.operand;
         int regExp = (++vPC)->u.operand;
-        callFrame->r(dst) = JSValue(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject()->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
+        callFrame->r(dst) = JSValue(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2921,7 +2926,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         int func = (++vPC)->u.operand;
 
-        callFrame->r(dst) = JSValue(callFrame->codeBlock()->function(func)->makeFunction(callFrame, callFrame->scopeChain()));
+        callFrame->r(dst) = JSValue(callFrame->codeBlock()->functionDecl(func)->make(callFrame, callFrame->scopeChain()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2935,9 +2940,24 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        int func = (++vPC)->u.operand;
+        int funcIndex = (++vPC)->u.operand;
 
-        callFrame->r(dst) = JSValue(callFrame->codeBlock()->functionExpression(func)->makeFunction(callFrame, callFrame->scopeChain()));
+        FunctionExecutable* function = callFrame->codeBlock()->functionExpr(funcIndex);
+        JSFunction* func = function->make(callFrame, callFrame->scopeChain());
+
+        /* 
+            The Identifier in a FunctionExpression can be referenced from inside
+            the FunctionExpression's FunctionBody to allow the function to call
+            itself recursively. However, unlike in a FunctionDeclaration, the
+            Identifier in a FunctionExpression cannot be referenced from and
+            does not affect the scope enclosing the FunctionExpression.
+         */
+        if (!function->name().isNull()) {
+            JSStaticScopeObject* functionScopeObject = new (callFrame) JSStaticScopeObject(callFrame, function->name(), func, ReadOnly | DontDelete);
+            func->scope().push(functionScopeObject);
+        }
+
+        callFrame->r(dst) = JSValue(func);
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2964,7 +2984,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         Register* newCallFrame = callFrame->registers() + registerOffset;
         Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
         JSValue thisValue = argv[0].jsValue();
-        JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
+        JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject;
 
         if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
             JSValue result = callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
@@ -3003,8 +3023,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         if (callType == CallTypeJS) {
             ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
-            FunctionBodyNode* functionBodyNode = callData.js.functionBody;
-            CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
+            CodeBlock* newCodeBlock = &callData.js.functionExecutable->bytecode(callFrame, callDataScopeChain);
 
             CallFrame* previousCallFrame = callFrame;
 
@@ -3040,7 +3059,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
             JSValue returnValue;
             {
-                SamplingTool::HostCallRecord callRecord(m_sampler);
+                SamplingTool::HostCallRecord callRecord(m_sampler.get());
                 returnValue = callData.native.function(newCallFrame, asObject(v), thisValue, args);
             }
             CHECK_FOR_EXCEPTION();
@@ -3070,7 +3089,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 exceptionValue = createStackOverflowError(callFrame);
                 goto vm_throw;
             }
-            int32_t expectedParams = callFrame->callee()->body()->parameterCount();
+            ASSERT(!callFrame->callee()->isHostFunction());
+            int32_t expectedParams = callFrame->callee()->jsExecutable()->parameterCount();
             int32_t inplaceArgs = min(argCount, expectedParams);
             int32_t i = 0;
             Register* argStore = callFrame->registers() + argsOffset;
@@ -3157,8 +3177,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         
         if (callType == CallTypeJS) {
             ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
-            FunctionBodyNode* functionBodyNode = callData.js.functionBody;
-            CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
+            CodeBlock* newCodeBlock = &callData.js.functionExecutable->bytecode(callFrame, callDataScopeChain);
             
             CallFrame* previousCallFrame = callFrame;
             
@@ -3194,7 +3213,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             
             JSValue returnValue;
             {
-                SamplingTool::HostCallRecord callRecord(m_sampler);
+                SamplingTool::HostCallRecord callRecord(m_sampler.get());
                 returnValue = callData.native.function(newCallFrame, asObject(v), thisValue, args);
             }
             CHECK_FOR_EXCEPTION();
@@ -3320,7 +3339,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(i) = jsUndefined();
 
         int dst = (++vPC)->u.operand;
-        JSActivation* activation = new (globalData) JSActivation(callFrame, static_cast<FunctionBodyNode*>(codeBlock->ownerNode()));
+        JSActivation* activation = new (globalData) JSActivation(callFrame, static_cast<FunctionExecutable*>(codeBlock->ownerExecutable()));
         callFrame->r(dst) = JSValue(activation);
         callFrame->setScopeChain(callFrame->scopeChain()->copy()->push(activation));
 
@@ -3406,15 +3425,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         if (constructType == ConstructTypeJS) {
             ScopeChainNode* callDataScopeChain = constructData.js.scopeChain;
-            FunctionBodyNode* functionBodyNode = constructData.js.functionBody;
-            CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
+            CodeBlock* newCodeBlock = &constructData.js.functionExecutable->bytecode(callFrame, callDataScopeChain);
 
             Structure* structure;
             JSValue prototype = callFrame->r(proto).jsValue();
             if (prototype.isObject())
                 structure = asObject(prototype)->inheritorID();
             else
-                structure = callDataScopeChain->globalObject()->emptyObjectStructure();
+                structure = callDataScopeChain->globalObject->emptyObjectStructure();
             JSObject* newObject = new (globalData) JSObject(structure);
 
             callFrame->r(thisRegister) = JSValue(newObject); // "this" value
@@ -3447,7 +3465,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
             JSValue returnValue;
             {
-                SamplingTool::HostCallRecord callRecord(m_sampler);
+                SamplingTool::HostCallRecord callRecord(m_sampler.get());
                 returnValue = constructData.native.function(newCallFrame, asObject(v), args);
             }
             CHECK_FOR_EXCEPTION();
@@ -3657,7 +3675,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int message = (++vPC)->u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
-        callFrame->r(dst) = JSValue(Error::create(callFrame, (ErrorType)type, callFrame->r(message).jsValue().toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL()));
+        callFrame->r(dst) = JSValue(Error::create(callFrame, (ErrorType)type, callFrame->r(message).jsValue().toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3720,7 +3738,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSObject* baseObj = asObject(callFrame->r(base).jsValue());
         Identifier& ident = callFrame->codeBlock()->identifier(property);
         ASSERT(callFrame->r(function).jsValue().isObject());
-        baseObj->defineSetter(callFrame, ident, asObject(callFrame->r(function).jsValue()));
+        baseObj->defineSetter(callFrame, ident, asObject(callFrame->r(function).jsValue()), 0);
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3832,7 +3850,7 @@ JSValue Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* functio
     CodeBlock* codeBlock = functionCallFrame->codeBlock();
     if (codeBlock->usesArguments()) {
         ASSERT(codeBlock->codeType() == FunctionCode);
-        SymbolTable& symbolTable = codeBlock->symbolTable();
+        SymbolTable& symbolTable = *codeBlock->symbolTable();
         int argumentsIndex = symbolTable.get(functionCallFrame->propertyNames().arguments.ustring().rep()).getIndex();
         if (!functionCallFrame->r(argumentsIndex).jsValue()) {
             Arguments* arguments = new (callFrame) Arguments(functionCallFrame);
@@ -3885,8 +3903,8 @@ void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intp
 
     unsigned bytecodeOffset = bytecodeOffsetForPC(callerFrame, callerCodeBlock, callFrame->returnPC());
     lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(callerFrame, bytecodeOffset - 1);
-    sourceID = callerCodeBlock->ownerNode()->sourceID();
-    sourceURL = callerCodeBlock->ownerNode()->sourceURL();
+    sourceID = callerCodeBlock->ownerExecutable()->sourceID();
+    sourceURL = callerCodeBlock->ownerExecutable()->sourceURL();
     function = callerFrame->callee();
 }
 
@@ -3899,4 +3917,40 @@ CallFrame* Interpreter::findFunctionCallFrame(CallFrame* callFrame, InternalFunc
     return 0;
 }
 
+void Interpreter::enableSampler()
+{
+#if ENABLE(OPCODE_SAMPLING)
+    if (!m_sampler) {
+        m_sampler.set(new SamplingTool(this));
+        m_sampler->setup();
+    }
+#endif
+}
+void Interpreter::dumpSampleData(ExecState* exec)
+{
+#if ENABLE(OPCODE_SAMPLING)
+    if (m_sampler)
+        m_sampler->dump(exec);
+#else
+    UNUSED_PARAM(exec);
+#endif
+}
+void Interpreter::startSampling()
+{
+#if ENABLE(SAMPLING_THREAD)
+    if (!m_sampleEntryDepth)
+        SamplingThread::start();
+
+    m_sampleEntryDepth++;
+#endif
+}
+void Interpreter::stopSampling()
+{
+#if ENABLE(SAMPLING_THREAD)
+    m_sampleEntryDepth--;
+    if (!m_sampleEntryDepth)
+        SamplingThread::stop();
+#endif
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/interpreter/Interpreter.h b/JavaScriptCore/interpreter/Interpreter.h
index 519c508..3046b28 100644
--- a/JavaScriptCore/interpreter/Interpreter.h
+++ b/JavaScriptCore/interpreter/Interpreter.h
@@ -42,12 +42,12 @@
 namespace JSC {
 
     class CodeBlock;
-    class EvalNode;
-    class FunctionBodyNode;
+    class EvalExecutable;
+    class FunctionExecutable;
     class InternalFunction;
     class JSFunction;
     class JSGlobalObject;
-    class ProgramNode;
+    class ProgramExecutable;
     class Register;
     class ScopeChainNode;
     class SamplingTool;
@@ -95,9 +95,9 @@ namespace JSC {
 
         bool isOpcode(Opcode);
         
-        JSValue execute(ProgramNode*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValue* exception);
-        JSValue execute(FunctionBodyNode*, CallFrame*, JSFunction*, JSObject* thisObj, const ArgList& args, ScopeChainNode*, JSValue* exception);
-        JSValue execute(EvalNode* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception);
+        JSValue execute(ProgramExecutable*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValue* exception);
+        JSValue execute(FunctionExecutable*, CallFrame*, JSFunction*, JSObject* thisObj, const ArgList& args, ScopeChainNode*, JSValue* exception);
+        JSValue execute(EvalExecutable* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception);
 
         JSValue retrieveArguments(CallFrame*, JSFunction*) const;
         JSValue retrieveCaller(CallFrame*, InternalFunction*) const;
@@ -105,21 +105,23 @@ namespace JSC {
         
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         
-        void setSampler(SamplingTool* sampler) { m_sampler = sampler; }
-        SamplingTool* sampler() { return m_sampler; }
+        SamplingTool* sampler() { return m_sampler.get(); }
 
         NEVER_INLINE JSValue callEval(CallFrame*, RegisterFile*, Register* argv, int argc, int registerOffset, JSValue& exceptionValue);
         NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValue&, unsigned bytecodeOffset, bool);
         NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
 
+        void dumpSampleData(ExecState* exec);
+        void startSampling();
+        void stopSampling();
     private:
         enum ExecutionFlag { Normal, InitializeAndReturn };
 
-        CallFrameClosure prepareForRepeatCall(FunctionBodyNode*, CallFrame*, JSFunction*, int argCount, ScopeChainNode*, JSValue* exception);
+        CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, JSFunction*, int argCount, ScopeChainNode*, JSValue* exception);
         void endRepeatCall(CallFrameClosure&);
         JSValue execute(CallFrameClosure&, JSValue* exception);
 
-        JSValue execute(EvalNode*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValue* exception);
+        JSValue execute(EvalExecutable*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValue* exception);
 
 #if USE(INTERPRETER)
         NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValue& exceptionValue);
@@ -149,7 +151,9 @@ namespace JSC {
         
         bool isCallBytecode(Opcode opcode) { return opcode == getOpcode(op_call) || opcode == getOpcode(op_construct) || opcode == getOpcode(op_call_eval); }
 
-        SamplingTool* m_sampler;
+        void enableSampler();
+        int m_sampleEntryDepth;
+        OwnPtr<SamplingTool> m_sampler;
 
         int m_reentryDepth;
 
diff --git a/JavaScriptCore/interpreter/Register.h b/JavaScriptCore/interpreter/Register.h
index 95ae5f6..76184ba 100644
--- a/JavaScriptCore/interpreter/Register.h
+++ b/JavaScriptCore/interpreter/Register.h
@@ -54,9 +54,6 @@ namespace JSC {
         Register(JSValue);
 
         JSValue jsValue() const;
-
-        bool marked() const;
-        void markChildren(MarkStack&);
         
         Register(JSActivation*);
         Register(CallFrame*);
@@ -114,11 +111,6 @@ namespace JSC {
     {
         return JSValue::decode(u.value);
     }
-    
-    ALWAYS_INLINE bool Register::marked() const
-    {
-        return jsValue().marked();
-    }
 
     // Interpreter functions
 
diff --git a/JavaScriptCore/interpreter/RegisterFile.cpp b/JavaScriptCore/interpreter/RegisterFile.cpp
index cfcf1d3..5424199 100644
--- a/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -36,9 +36,12 @@ RegisterFile::~RegisterFile()
 #if HAVE(MMAP)
     munmap(m_buffer, ((m_max - m_start) + m_maxGlobals) * sizeof(Register));
 #elif HAVE(VIRTUALALLOC)
+#if PLATFORM(WINCE)
+    VirtualFree(m_buffer, DWORD(m_commitEnd) - DWORD(m_buffer), MEM_DECOMMIT);
+#endif
     VirtualFree(m_buffer, 0, MEM_RELEASE);
 #else
-    #error "Don't know how to release virtual memory on this platform."
+    fastFree(m_buffer);
 #endif
 }
 
diff --git a/JavaScriptCore/interpreter/RegisterFile.h b/JavaScriptCore/interpreter/RegisterFile.h
index b5f7452..953c70f 100644
--- a/JavaScriptCore/interpreter/RegisterFile.h
+++ b/JavaScriptCore/interpreter/RegisterFile.h
@@ -204,8 +204,16 @@ namespace JSC {
             CRASH();
         }
         m_commitEnd = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_buffer) + committedSize);
-    #else
-        #error "Don't know how to reserve virtual memory on this platform."
+    #else 
+        /* 
+         * If neither MMAP nor VIRTUALALLOC are available - use fastMalloc instead.
+         *
+         * Please note that this is the fallback case, which is non-optimal.
+         * If any possible, the platform should provide for a better memory
+         * allocation mechanism that allows for "lazy commit" or dynamic
+         * pre-allocation, similar to mmap or VirtualAlloc, to avoid waste of memory.
+         */
+        m_buffer = static_cast<Register*>(fastMalloc(bufferLength));
     #endif
         m_start = m_buffer + maxGlobals;
         m_end = m_start;
diff --git a/JavaScriptCore/jit/ExecutableAllocator.h b/JavaScriptCore/jit/ExecutableAllocator.h
index 4ed47e3..3274fcc 100644
--- a/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/JavaScriptCore/jit/ExecutableAllocator.h
@@ -38,6 +38,10 @@
 #include <sys/mman.h>
 #endif
 
+#if PLATFORM(SYMBIAN)
+#include <e32std.h>
+#endif
+
 #define JIT_ALLOCATOR_PAGE_SIZE (ExecutableAllocator::pageSize)
 #define JIT_ALLOCATOR_LARGE_ALLOC_SIZE (ExecutableAllocator::pageSize * 4)
 
@@ -176,30 +180,35 @@ public:
     static void cacheFlush(void*, size_t)
     {
     }
-#elif PLATFORM_ARM_ARCH(7) && PLATFORM(IPHONE)
+#elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
     static void cacheFlush(void* code, size_t size)
     {
         sys_dcache_flush(code, size);
         sys_icache_invalidate(code, size);
     }
-#elif PLATFORM(ARM)
+#elif PLATFORM(SYMBIAN)
+    static void cacheFlush(void* code, size_t size)
+    {
+        User::IMB_Range(code, static_cast<char*>(code) + size);
+    }
+#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
     static void cacheFlush(void* code, size_t size)
     {
-    #if COMPILER(GCC) && (GCC_VERSION >= 30406)
-        __clear_cache(reinterpret_cast<char*>(code), reinterpret_cast<char*>(code) + size);
-    #else
-        const int syscall = 0xf0002;
-        __asm __volatile (
-               "mov     r0, %0\n"
-               "mov     r1, %1\n"
-               "mov     r7, %2\n"
-               "mov     r2, #0x0\n"
-               "swi     0x00000000\n"
-           :
-           :   "r" (code), "r" (reinterpret_cast<char*>(code) + size), "r" (syscall)
-           :   "r0", "r1", "r7");
-    #endif // COMPILER(GCC) && (GCC_VERSION >= 30406)
+        asm volatile (
+            "push    {r7}\n"
+            "mov     r0, %0\n"
+            "mov     r1, %1\n"
+            "mov     r7, #0xf0000\n"
+            "add     r7, r7, #0x2\n"
+            "mov     r2, #0x0\n"
+            "svc     0x0\n"
+            "pop     {r7}\n"
+            :
+            : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
+            : "r0", "r1");
     }
+#else
+    #error "The cacheFlush support is missing on this platform."
 #endif
 
 private:
diff --git a/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp b/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
index 4bd5a2c..13a8626 100644
--- a/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+++ b/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
@@ -44,7 +44,10 @@ void ExecutableAllocator::intializePageSize()
 
 ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t n)
 {
-    ExecutablePool::Allocation alloc = { reinterpret_cast<char*>(mmap(NULL, n, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0)), n };
+    void* allocation = mmap(NULL, n, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0);
+    if (allocation == MAP_FAILED)
+        CRASH();
+    ExecutablePool::Allocation alloc = { reinterpret_cast<char*>(allocation), n };
     return alloc;
 }
 
diff --git a/JavaScriptCore/jit/ExecutableAllocatorWin.cpp b/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
index a9ba7d0..e6ac855 100644
--- a/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+++ b/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
@@ -42,7 +42,10 @@ void ExecutableAllocator::intializePageSize()
 
 ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t n)
 {
-    ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(VirtualAlloc(0, n, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)), n};
+    void* allocation = VirtualAlloc(0, n, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
+    if (!allocation)
+        CRASH();
+    ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(allocation), n};
     return alloc;
 }
 
diff --git a/JavaScriptCore/jit/JIT.cpp b/JavaScriptCore/jit/JIT.cpp
index 0d6d1b8..ea8434e 100644
--- a/JavaScriptCore/jit/JIT.cpp
+++ b/JavaScriptCore/jit/JIT.cpp
@@ -195,7 +195,7 @@ void JIT::privateCompileMainPass()
 
         switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
         DEFINE_BINARY_OP(op_del_by_val)
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE32)
         DEFINE_BINARY_OP(op_div)
 #endif
         DEFINE_BINARY_OP(op_in)
@@ -230,7 +230,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_create_arguments)
         DEFINE_OP(op_debug)
         DEFINE_OP(op_del_by_id)
-#if USE(JSVALUE32_64)
+#if !USE(JSVALUE32)
         DEFINE_OP(op_div)
 #endif
         DEFINE_OP(op_end)
@@ -379,7 +379,7 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_construct)
         DEFINE_SLOWCASE_OP(op_construct_verify)
         DEFINE_SLOWCASE_OP(op_convert_this)
-#if USE(JSVALUE32_64)
+#if !USE(JSVALUE32)
         DEFINE_SLOWCASE_OP(op_div)
 #endif
         DEFINE_SLOWCASE_OP(op_eq)
@@ -438,7 +438,7 @@ void JIT::privateCompileSlowCases()
 #endif
 }
 
-void JIT::privateCompile()
+JITCode JIT::privateCompile()
 {
     sampleCodeBlock(m_codeBlock);
 #if ENABLE(OPCODE_SAMPLING)
@@ -552,7 +552,7 @@ void JIT::privateCompile()
         info.callReturnLocation = m_codeBlock->structureStubInfo(m_methodCallCompilationInfo[i].propertyAccessIndex).callReturnLocation;
     }
 
-    m_codeBlock->setJITCode(patchBuffer.finalizeCode());
+    return patchBuffer.finalizeCode();
 }
 
 #if !USE(JSVALUE32_64)
@@ -587,12 +587,11 @@ void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
 
 void JIT::linkCall(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* calleeCodeBlock, JITCode& code, CallLinkInfo* callLinkInfo, int callerArgCount, JSGlobalData* globalData)
 {
-    ASSERT(calleeCodeBlock);
     RepatchBuffer repatchBuffer(callerCodeBlock);
 
     // Currently we only link calls with the exact number of arguments.
     // If this is a native call calleeCodeBlock is null so the number of parameters is unimportant
-    if (callerArgCount == calleeCodeBlock->m_numParameters || calleeCodeBlock->codeType() == NativeCode) {
+    if (!calleeCodeBlock || (callerArgCount == calleeCodeBlock->m_numParameters)) {
         ASSERT(!callLinkInfo->isLinked());
     
         if (calleeCodeBlock)
diff --git a/JavaScriptCore/jit/JIT.h b/JavaScriptCore/jit/JIT.h
index 93f47d9..0712743 100644
--- a/JavaScriptCore/jit/JIT.h
+++ b/JavaScriptCore/jit/JIT.h
@@ -191,82 +191,82 @@ namespace JSC {
         // MacroAssembler will need to plant register swaps if it is not -
         // however the code will still function correctly.
 #if PLATFORM(X86_64)
-        static const RegisterID returnValueRegister = X86::eax;
-        static const RegisterID cachedResultRegister = X86::eax;
-        static const RegisterID firstArgumentRegister = X86::edi;
-
-        static const RegisterID timeoutCheckRegister = X86::r12;
-        static const RegisterID callFrameRegister = X86::r13;
-        static const RegisterID tagTypeNumberRegister = X86::r14;
-        static const RegisterID tagMaskRegister = X86::r15;
-
-        static const RegisterID regT0 = X86::eax;
-        static const RegisterID regT1 = X86::edx;
-        static const RegisterID regT2 = X86::ecx;
-        static const RegisterID regT3 = X86::ebx;
-
-        static const FPRegisterID fpRegT0 = X86::xmm0;
-        static const FPRegisterID fpRegT1 = X86::xmm1;
-        static const FPRegisterID fpRegT2 = X86::xmm2;
+        static const RegisterID returnValueRegister = X86Registers::eax;
+        static const RegisterID cachedResultRegister = X86Registers::eax;
+        static const RegisterID firstArgumentRegister = X86Registers::edi;
+
+        static const RegisterID timeoutCheckRegister = X86Registers::r12;
+        static const RegisterID callFrameRegister = X86Registers::r13;
+        static const RegisterID tagTypeNumberRegister = X86Registers::r14;
+        static const RegisterID tagMaskRegister = X86Registers::r15;
+
+        static const RegisterID regT0 = X86Registers::eax;
+        static const RegisterID regT1 = X86Registers::edx;
+        static const RegisterID regT2 = X86Registers::ecx;
+        static const RegisterID regT3 = X86Registers::ebx;
+
+        static const FPRegisterID fpRegT0 = X86Registers::xmm0;
+        static const FPRegisterID fpRegT1 = X86Registers::xmm1;
+        static const FPRegisterID fpRegT2 = X86Registers::xmm2;
 #elif PLATFORM(X86)
-        static const RegisterID returnValueRegister = X86::eax;
-        static const RegisterID cachedResultRegister = X86::eax;
+        static const RegisterID returnValueRegister = X86Registers::eax;
+        static const RegisterID cachedResultRegister = X86Registers::eax;
         // On x86 we always use fastcall conventions = but on
         // OS X if might make more sense to just use regparm.
-        static const RegisterID firstArgumentRegister = X86::ecx;
-
-        static const RegisterID timeoutCheckRegister = X86::esi;
-        static const RegisterID callFrameRegister = X86::edi;
-
-        static const RegisterID regT0 = X86::eax;
-        static const RegisterID regT1 = X86::edx;
-        static const RegisterID regT2 = X86::ecx;
-        static const RegisterID regT3 = X86::ebx;
-
-        static const FPRegisterID fpRegT0 = X86::xmm0;
-        static const FPRegisterID fpRegT1 = X86::xmm1;
-        static const FPRegisterID fpRegT2 = X86::xmm2;
-#elif PLATFORM_ARM_ARCH(7)
-        static const RegisterID returnValueRegister = ARM::r0;
-        static const RegisterID cachedResultRegister = ARM::r0;
-        static const RegisterID firstArgumentRegister = ARM::r0;
-
-        static const RegisterID regT0 = ARM::r0;
-        static const RegisterID regT1 = ARM::r1;
-        static const RegisterID regT2 = ARM::r2;
-        static const RegisterID regT3 = ARM::r4;
-
-        static const RegisterID callFrameRegister = ARM::r5;
-        static const RegisterID timeoutCheckRegister = ARM::r6;
-
-        static const FPRegisterID fpRegT0 = ARM::d0;
-        static const FPRegisterID fpRegT1 = ARM::d1;
-        static const FPRegisterID fpRegT2 = ARM::d2;
-#elif PLATFORM(ARM)
-        static const RegisterID returnValueRegister = ARM::r0;
-        static const RegisterID cachedResultRegister = ARM::r0;
-        static const RegisterID firstArgumentRegister = ARM::r0;
-
-        static const RegisterID timeoutCheckRegister = ARM::r5;
-        static const RegisterID callFrameRegister = ARM::r4;
-        static const RegisterID ctiReturnRegister = ARM::r6;
-
-        static const RegisterID regT0 = ARM::r0;
-        static const RegisterID regT1 = ARM::r1;
-        static const RegisterID regT2 = ARM::r2;
+        static const RegisterID firstArgumentRegister = X86Registers::ecx;
+
+        static const RegisterID timeoutCheckRegister = X86Registers::esi;
+        static const RegisterID callFrameRegister = X86Registers::edi;
+
+        static const RegisterID regT0 = X86Registers::eax;
+        static const RegisterID regT1 = X86Registers::edx;
+        static const RegisterID regT2 = X86Registers::ecx;
+        static const RegisterID regT3 = X86Registers::ebx;
+
+        static const FPRegisterID fpRegT0 = X86Registers::xmm0;
+        static const FPRegisterID fpRegT1 = X86Registers::xmm1;
+        static const FPRegisterID fpRegT2 = X86Registers::xmm2;
+#elif PLATFORM(ARM_THUMB2)
+        static const RegisterID returnValueRegister = ARMRegisters::r0;
+        static const RegisterID cachedResultRegister = ARMRegisters::r0;
+        static const RegisterID firstArgumentRegister = ARMRegisters::r0;
+
+        static const RegisterID regT0 = ARMRegisters::r0;
+        static const RegisterID regT1 = ARMRegisters::r1;
+        static const RegisterID regT2 = ARMRegisters::r2;
+        static const RegisterID regT3 = ARMRegisters::r4;
+
+        static const RegisterID callFrameRegister = ARMRegisters::r5;
+        static const RegisterID timeoutCheckRegister = ARMRegisters::r6;
+
+        static const FPRegisterID fpRegT0 = ARMRegisters::d0;
+        static const FPRegisterID fpRegT1 = ARMRegisters::d1;
+        static const FPRegisterID fpRegT2 = ARMRegisters::d2;
+#elif PLATFORM(ARM_TRADITIONAL)
+        static const RegisterID returnValueRegister = ARMRegisters::r0;
+        static const RegisterID cachedResultRegister = ARMRegisters::r0;
+        static const RegisterID firstArgumentRegister = ARMRegisters::r0;
+
+        static const RegisterID timeoutCheckRegister = ARMRegisters::r5;
+        static const RegisterID callFrameRegister = ARMRegisters::r4;
+        static const RegisterID ctiReturnRegister = ARMRegisters::r6;
+
+        static const RegisterID regT0 = ARMRegisters::r0;
+        static const RegisterID regT1 = ARMRegisters::r1;
+        static const RegisterID regT2 = ARMRegisters::r2;
         // Callee preserved
-        static const RegisterID regT3 = ARM::r7;
+        static const RegisterID regT3 = ARMRegisters::r7;
 
-        static const RegisterID regS0 = ARM::S0;
+        static const RegisterID regS0 = ARMRegisters::S0;
         // Callee preserved
-        static const RegisterID regS1 = ARM::S1;
+        static const RegisterID regS1 = ARMRegisters::S1;
 
-        static const RegisterID regStackPtr = ARM::sp;
-        static const RegisterID regLink = ARM::lr;
+        static const RegisterID regStackPtr = ARMRegisters::sp;
+        static const RegisterID regLink = ARMRegisters::lr;
 
-        static const FPRegisterID fpRegT0 = ARM::d0;
-        static const FPRegisterID fpRegT1 = ARM::d1;
-        static const FPRegisterID fpRegT2 = ARM::d2;
+        static const FPRegisterID fpRegT0 = ARMRegisters::d0;
+        static const FPRegisterID fpRegT1 = ARMRegisters::d1;
+        static const FPRegisterID fpRegT2 = ARMRegisters::d2;
 #else
     #error "JIT not supported on this platform."
 #endif
@@ -277,10 +277,9 @@ namespace JSC {
         static const int patchGetByIdDefaultOffset = 256;
 
     public:
-        static void compile(JSGlobalData* globalData, CodeBlock* codeBlock)
+        static JITCode compile(JSGlobalData* globalData, CodeBlock* codeBlock)
         {
-            JIT jit(globalData, codeBlock);
-            jit.privateCompile();
+            return JIT(globalData, codeBlock).privateCompile();
         }
 
         static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress)
@@ -353,7 +352,7 @@ namespace JSC {
         void privateCompileMainPass();
         void privateCompileLinkPass();
         void privateCompileSlowCases();
-        void privateCompile();
+        JITCode privateCompile();
         void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
         void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, size_t cachedOffset);
         void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame);
@@ -380,14 +379,18 @@ namespace JSC {
 
         enum CompileOpStrictEqType { OpStrictEq, OpNStrictEq };
         void compileOpStrictEq(Instruction* instruction, CompileOpStrictEqType type);
+        bool isOperandConstantImmediateDouble(unsigned src);
+        
+        void emitLoadDouble(unsigned index, FPRegisterID value);
+        void emitLoadInt32ToDouble(unsigned index, FPRegisterID value);
+
+        Address addressFor(unsigned index, RegisterID base = callFrameRegister);
 
 #if USE(JSVALUE32_64)
         Address tagFor(unsigned index, RegisterID base = callFrameRegister);
         Address payloadFor(unsigned index, RegisterID base = callFrameRegister);
-        Address addressFor(unsigned index, RegisterID base = callFrameRegister);
 
         bool getOperandConstantImmediateInt(unsigned op1, unsigned op2, unsigned& op, int32_t& constant);
-        bool isOperandConstantImmediateDouble(unsigned src);
 
         void emitLoadTag(unsigned index, RegisterID tag);
         void emitLoadPayload(unsigned index, RegisterID payload);
@@ -395,8 +398,6 @@ namespace JSC {
         void emitLoad(const JSValue& v, RegisterID tag, RegisterID payload);
         void emitLoad(unsigned index, RegisterID tag, RegisterID payload, RegisterID base = callFrameRegister);
         void emitLoad2(unsigned index1, RegisterID tag1, RegisterID payload1, unsigned index2, RegisterID tag2, RegisterID payload2);
-        void emitLoadDouble(unsigned index, FPRegisterID value);
-        void emitLoadInt32ToDouble(unsigned index, FPRegisterID value);
 
         void emitStore(unsigned index, RegisterID tag, RegisterID payload, RegisterID base = callFrameRegister);
         void emitStore(unsigned index, const JSValue constant, RegisterID base = callFrameRegister);
@@ -500,6 +501,7 @@ namespace JSC {
         JIT::Jump emitJumpIfNotImmediateInteger(RegisterID);
         JIT::Jump emitJumpIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
         void emitJumpSlowCaseIfNotImmediateInteger(RegisterID);
+        void emitJumpSlowCaseIfNotImmediateNumber(RegisterID);
         void emitJumpSlowCaseIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
 
 #if !USE(JSVALUE64)
@@ -512,7 +514,11 @@ namespace JSC {
 
         void emitTagAsBoolImmediate(RegisterID reg);
         void compileBinaryArithOp(OpcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
-        void compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
+#if USE(JSVALUE64)
+        void compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned dst, unsigned src1, unsigned src2, OperandTypes, bool op1HasImmediateIntFastCase, bool op2HasImmediateIntFastCase);
+#else
+        void compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned dst, unsigned src1, unsigned src2, OperandTypes);
+#endif
 
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
         void compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier* ident, unsigned propertyAccessInstructionIndex);
@@ -536,7 +542,7 @@ namespace JSC {
         static const int patchOffsetGetByIdPropertyMapOffset = 31;
         static const int patchOffsetGetByIdPutResult = 31;
 #if ENABLE(OPCODE_SAMPLING)
-        static const int patchOffsetGetByIdSlowCaseCall = 63;
+        static const int patchOffsetGetByIdSlowCaseCall = 64;
 #else
         static const int patchOffsetGetByIdSlowCaseCall = 41;
 #endif
@@ -572,7 +578,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 11;
         static const int patchOffsetMethodCheckProtoStruct = 18;
         static const int patchOffsetMethodCheckPutFunction = 29;
-#elif PLATFORM_ARM_ARCH(7)
+#elif PLATFORM(ARM_THUMB2)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
         static const int patchOffsetPutByIdExternalLoad = 20;
@@ -595,9 +601,62 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 18;
         static const int patchOffsetMethodCheckProtoStruct = 28;
         static const int patchOffsetMethodCheckPutFunction = 46;
+#elif PLATFORM(ARM_TRADITIONAL)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 4;
+        static const int patchOffsetPutByIdExternalLoad = 16;
+        static const int patchLengthPutByIdExternalLoad = 4;
+        static const int patchOffsetPutByIdPropertyMapOffset = 20;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 4;
+        static const int patchOffsetGetByIdBranchToSlowCase = 16;
+        static const int patchOffsetGetByIdExternalLoad = 16;
+        static const int patchLengthGetByIdExternalLoad = 4;
+        static const int patchOffsetGetByIdPropertyMapOffset = 20;
+        static const int patchOffsetGetByIdPutResult = 28;
+#if ENABLE(OPCODE_SAMPLING)
+        #error "OPCODE_SAMPLING is not yet supported"
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 36;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 12;
+
+        static const int patchOffsetMethodCheckProtoObj = 12;
+        static const int patchOffsetMethodCheckProtoStruct = 20;
+        static const int patchOffsetMethodCheckPutFunction = 32;
 #endif
 #endif // USE(JSVALUE32_64)
 
+#if PLATFORM(ARM_TRADITIONAL)
+        // sequenceOpCall
+        static const int sequenceOpCallInstructionSpace = 12;
+        static const int sequenceOpCallConstantSpace = 2;
+        // sequenceMethodCheck
+        static const int sequenceMethodCheckInstructionSpace = 40;
+        static const int sequenceMethodCheckConstantSpace = 6;
+        // sequenceGetByIdHotPath
+        static const int sequenceGetByIdHotPathInstructionSpace = 28;
+        static const int sequenceGetByIdHotPathConstantSpace = 3;
+        // sequenceGetByIdSlowCase
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 40;
+        static const int sequenceGetByIdSlowCaseConstantSpace = 2;
+        // sequencePutById
+        static const int sequencePutByIdInstructionSpace = 28;
+        static const int sequencePutByIdConstantSpace = 3;
+#endif
+
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+#define BEGIN_UNINTERRUPTED_SEQUENCE(name) beginUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace)
+#define END_UNINTERRUPTED_SEQUENCE(name) endUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace)
+
+        void beginUninterruptedSequence(int, int);
+        void endUninterruptedSequence(int, int);
+
+#else
+#define BEGIN_UNINTERRUPTED_SEQUENCE(name)
+#define END_UNINTERRUPTED_SEQUENCE(name)
+#endif
+
         void emit_op_add(Instruction*);
         void emit_op_bitand(Instruction*);
         void emit_op_bitnot(Instruction*);
@@ -741,6 +800,7 @@ namespace JSC {
         /* These functions are deprecated: Please use JITStubCall instead. */
         void emitPutJITStubArg(RegisterID src, unsigned argumentNumber);
 #if USE(JSVALUE32_64)
+        void emitPutJITStubArg(RegisterID tag, RegisterID payload, unsigned argumentNumber);
         void emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch1, RegisterID scratch2);
 #else
         void emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch);
@@ -835,6 +895,13 @@ namespace JSC {
         int m_lastResultBytecodeRegister;
         unsigned m_jumpTargetsPosition;
 #endif
+
+#ifndef NDEBUG
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+        Label m_uninterruptedInstructionSequenceBegin;
+        int m_uninterruptedConstantSequenceBegin;
+#endif
+#endif
     } JIT_CLASS_ALIGNMENT;
 } // namespace JSC
 
diff --git a/JavaScriptCore/jit/JITArithmetic.cpp b/JavaScriptCore/jit/JITArithmetic.cpp
index ea343d8..7afc1f2 100644
--- a/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/JavaScriptCore/jit/JITArithmetic.cpp
@@ -566,6 +566,14 @@ void JIT::emit_op_add(Instruction* currentInstruction)
     unsigned op2 = currentInstruction[3].u.operand;
     OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
+    if (!types.first().mightBeNumber() || !types.second().mightBeNumber()) {
+        JITStubCall stubCall(this, cti_op_add);
+        stubCall.addArgument(op1);
+        stubCall.addArgument(op2);
+        stubCall.call(dst);
+        return;
+    }
+
     JumpList notInt32Op1;
     JumpList notInt32Op2;
 
@@ -630,19 +638,21 @@ void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>
     unsigned op2 = currentInstruction[3].u.operand;
     OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
+    if (!types.first().mightBeNumber() || !types.second().mightBeNumber())
+        return;
+
     unsigned op;
     int32_t constant;
     if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
         linkSlowCase(iter); // overflow check
 
-        if (!supportsFloatingPoint()) {
+        if (!supportsFloatingPoint())
             linkSlowCase(iter); // non-sse case
-            return;
+        else {
+            ResultType opType = op == op1 ? types.first() : types.second();
+            if (!opType.definitelyIsNumber())
+                linkSlowCase(iter); // double check
         }
-
-        ResultType opType = op == op1 ? types.first() : types.second();
-        if (!opType.definitelyIsNumber())
-            linkSlowCase(iter); // double check
     } else {
         linkSlowCase(iter); // overflow check
 
@@ -1053,33 +1063,33 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op2 = currentInstruction[3].u.operand;
 
     if (isOperandConstantImmediateInt(op2) && getConstantOperand(op2).asInt32() != 0) {
-        emitLoad(op1, X86::edx, X86::eax);
-        move(Imm32(getConstantOperand(op2).asInt32()), X86::ecx);
-        addSlowCase(branch32(NotEqual, X86::edx, Imm32(JSValue::Int32Tag)));
+        emitLoad(op1, X86Registers::edx, X86Registers::eax);
+        move(Imm32(getConstantOperand(op2).asInt32()), X86Registers::ecx);
+        addSlowCase(branch32(NotEqual, X86Registers::edx, Imm32(JSValue::Int32Tag)));
         if (getConstantOperand(op2).asInt32() == -1)
-            addSlowCase(branch32(Equal, X86::eax, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
+            addSlowCase(branch32(Equal, X86Registers::eax, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
     } else {
-        emitLoad2(op1, X86::edx, X86::eax, op2, X86::ebx, X86::ecx);
-        addSlowCase(branch32(NotEqual, X86::edx, Imm32(JSValue::Int32Tag)));
-        addSlowCase(branch32(NotEqual, X86::ebx, Imm32(JSValue::Int32Tag)));
+        emitLoad2(op1, X86Registers::edx, X86Registers::eax, op2, X86Registers::ebx, X86Registers::ecx);
+        addSlowCase(branch32(NotEqual, X86Registers::edx, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, X86Registers::ebx, Imm32(JSValue::Int32Tag)));
 
-        addSlowCase(branch32(Equal, X86::eax, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
-        addSlowCase(branch32(Equal, X86::ecx, Imm32(0))); // divide by 0
+        addSlowCase(branch32(Equal, X86Registers::eax, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
+        addSlowCase(branch32(Equal, X86Registers::ecx, Imm32(0))); // divide by 0
     }
 
-    move(X86::eax, X86::ebx); // Save dividend payload, in case of 0.
+    move(X86Registers::eax, X86Registers::ebx); // Save dividend payload, in case of 0.
     m_assembler.cdq();
-    m_assembler.idivl_r(X86::ecx);
+    m_assembler.idivl_r(X86Registers::ecx);
     
     // If the remainder is zero and the dividend is negative, the result is -0.
-    Jump storeResult1 = branchTest32(NonZero, X86::edx);
-    Jump storeResult2 = branchTest32(Zero, X86::ebx, Imm32(0x80000000)); // not negative
+    Jump storeResult1 = branchTest32(NonZero, X86Registers::edx);
+    Jump storeResult2 = branchTest32(Zero, X86Registers::ebx, Imm32(0x80000000)); // not negative
     emitStore(dst, jsNumber(m_globalData, -0.0));
     Jump end = jump();
 
     storeResult1.link(this);
     storeResult2.link(this);
-    emitStoreInt32(dst, X86::edx, (op1 == dst || op2 == dst));
+    emitStoreInt32(dst, X86Registers::edx, (op1 == dst || op2 == dst));
     end.link(this);
 }
 
@@ -1847,21 +1857,21 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
-    emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-    emitJumpSlowCaseIfNotImmediateInteger(X86::ecx);
+    emitGetVirtualRegisters(op1, X86Registers::eax, op2, X86Registers::ecx);
+    emitJumpSlowCaseIfNotImmediateInteger(X86Registers::eax);
+    emitJumpSlowCaseIfNotImmediateInteger(X86Registers::ecx);
 #if USE(JSVALUE64)
-    addSlowCase(branchPtr(Equal, X86::ecx, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))));
+    addSlowCase(branchPtr(Equal, X86Registers::ecx, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))));
     m_assembler.cdq();
-    m_assembler.idivl_r(X86::ecx);
+    m_assembler.idivl_r(X86Registers::ecx);
 #else
-    emitFastArithDeTagImmediate(X86::eax);
-    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(X86::ecx));
+    emitFastArithDeTagImmediate(X86Registers::eax);
+    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(X86Registers::ecx));
     m_assembler.cdq();
-    m_assembler.idivl_r(X86::ecx);
-    signExtend32ToPtr(X86::edx, X86::edx);
+    m_assembler.idivl_r(X86Registers::ecx);
+    signExtend32ToPtr(X86Registers::edx, X86Registers::edx);
 #endif
-    emitFastArithReTagImmediate(X86::edx, X86::eax);
+    emitFastArithReTagImmediate(X86Registers::edx, X86Registers::eax);
     emitPutVirtualRegister(result);
 }
 
@@ -1877,14 +1887,14 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
     Jump notImm1 = getSlowCase(iter);
     Jump notImm2 = getSlowCase(iter);
     linkSlowCase(iter);
-    emitFastArithReTagImmediate(X86::eax, X86::eax);
-    emitFastArithReTagImmediate(X86::ecx, X86::ecx);
+    emitFastArithReTagImmediate(X86Registers::eax, X86Registers::eax);
+    emitFastArithReTagImmediate(X86Registers::ecx, X86Registers::ecx);
     notImm1.link(this);
     notImm2.link(this);
 #endif
     JITStubCall stubCall(this, cti_op_mod);
-    stubCall.addArgument(X86::eax);
-    stubCall.addArgument(X86::ecx);
+    stubCall.addArgument(X86Registers::eax);
+    stubCall.addArgument(X86Registers::ecx);
     stubCall.call(result);
 }
 
@@ -1932,55 +1942,87 @@ void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned, unsigned op1, unsign
     emitFastArithIntToImmNoCheck(regT0, regT0);
 }
 
-void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned result, unsigned op1, unsigned, OperandTypes types)
+void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned result, unsigned op1, unsigned op2, OperandTypes types, bool op1HasImmediateIntFastCase, bool op2HasImmediateIntFastCase)
 {
     // We assume that subtracting TagTypeNumber is equivalent to adding DoubleEncodeOffset.
     COMPILE_ASSERT(((JSImmediate::TagTypeNumber + JSImmediate::DoubleEncodeOffset) == 0), TagTypeNumber_PLUS_DoubleEncodeOffset_EQUALS_0);
-
-    Jump notImm1 = getSlowCase(iter);
-    Jump notImm2 = getSlowCase(iter);
+    
+    Jump notImm1;
+    Jump notImm2;
+    if (op1HasImmediateIntFastCase) {
+        notImm2 = getSlowCase(iter);
+    } else if (op2HasImmediateIntFastCase) {
+        notImm1 = getSlowCase(iter);
+    } else {
+        notImm1 = getSlowCase(iter);
+        notImm2 = getSlowCase(iter);
+    }
 
     linkSlowCase(iter); // Integer overflow case - we could handle this in JIT code, but this is likely rare.
-    if (opcodeID == op_mul) // op_mul has an extra slow case to handle 0 * negative number.
+    if (opcodeID == op_mul && !op1HasImmediateIntFastCase && !op2HasImmediateIntFastCase) // op_mul has an extra slow case to handle 0 * negative number.
         linkSlowCase(iter);
     emitGetVirtualRegister(op1, regT0);
 
     Label stubFunctionCall(this);
     JITStubCall stubCall(this, opcodeID == op_add ? cti_op_add : opcodeID == op_sub ? cti_op_sub : cti_op_mul);
+    if (op1HasImmediateIntFastCase || op2HasImmediateIntFastCase) {
+        emitGetVirtualRegister(op1, regT0);
+        emitGetVirtualRegister(op2, regT1);
+    }
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
     stubCall.call(result);
     Jump end = jump();
 
-    // if we get here, eax is not an int32, edx not yet checked.
-    notImm1.link(this);
-    if (!types.first().definitelyIsNumber())
-        emitJumpIfNotImmediateNumber(regT0).linkTo(stubFunctionCall, this);
-    if (!types.second().definitelyIsNumber())
-        emitJumpIfNotImmediateNumber(regT1).linkTo(stubFunctionCall, this);
-    addPtr(tagTypeNumberRegister, regT0);
-    movePtrToDouble(regT0, fpRegT1);
-    Jump op2isDouble = emitJumpIfNotImmediateInteger(regT1);
-    convertInt32ToDouble(regT1, fpRegT2);
-    Jump op2wasInteger = jump();
-
-    // if we get here, eax IS an int32, edx is not.
-    notImm2.link(this);
-    if (!types.second().definitelyIsNumber())
-        emitJumpIfNotImmediateNumber(regT1).linkTo(stubFunctionCall, this);
-    convertInt32ToDouble(regT0, fpRegT1);
-    op2isDouble.link(this);
-    addPtr(tagTypeNumberRegister, regT1);
-    movePtrToDouble(regT1, fpRegT2);
-    op2wasInteger.link(this);
+    if (op1HasImmediateIntFastCase) {
+        notImm2.link(this);
+        if (!types.second().definitelyIsNumber())
+            emitJumpIfNotImmediateNumber(regT0).linkTo(stubFunctionCall, this);
+        emitGetVirtualRegister(op1, regT1);
+        convertInt32ToDouble(regT1, fpRegT1);
+        addPtr(tagTypeNumberRegister, regT0);
+        movePtrToDouble(regT0, fpRegT2);
+    } else if (op2HasImmediateIntFastCase) {
+        notImm1.link(this);
+        if (!types.first().definitelyIsNumber())
+            emitJumpIfNotImmediateNumber(regT0).linkTo(stubFunctionCall, this);
+        emitGetVirtualRegister(op2, regT1);
+        convertInt32ToDouble(regT1, fpRegT1);
+        addPtr(tagTypeNumberRegister, regT0);
+        movePtrToDouble(regT0, fpRegT2);
+    } else {
+        // if we get here, eax is not an int32, edx not yet checked.
+        notImm1.link(this);
+        if (!types.first().definitelyIsNumber())
+            emitJumpIfNotImmediateNumber(regT0).linkTo(stubFunctionCall, this);
+        if (!types.second().definitelyIsNumber())
+            emitJumpIfNotImmediateNumber(regT1).linkTo(stubFunctionCall, this);
+        addPtr(tagTypeNumberRegister, regT0);
+        movePtrToDouble(regT0, fpRegT1);
+        Jump op2isDouble = emitJumpIfNotImmediateInteger(regT1);
+        convertInt32ToDouble(regT1, fpRegT2);
+        Jump op2wasInteger = jump();
+
+        // if we get here, eax IS an int32, edx is not.
+        notImm2.link(this);
+        if (!types.second().definitelyIsNumber())
+            emitJumpIfNotImmediateNumber(regT1).linkTo(stubFunctionCall, this);
+        convertInt32ToDouble(regT0, fpRegT1);
+        op2isDouble.link(this);
+        addPtr(tagTypeNumberRegister, regT1);
+        movePtrToDouble(regT1, fpRegT2);
+        op2wasInteger.link(this);
+    }
 
     if (opcodeID == op_add)
         addDouble(fpRegT2, fpRegT1);
     else if (opcodeID == op_sub)
         subDouble(fpRegT2, fpRegT1);
-    else {
-        ASSERT(opcodeID == op_mul);
+    else if (opcodeID == op_mul)
         mulDouble(fpRegT2, fpRegT1);
+    else {
+        ASSERT(opcodeID == op_div);
+        divDouble(fpRegT2, fpRegT1);
     }
     moveDoubleToPtr(fpRegT1, regT0);
     subPtr(tagTypeNumberRegister, regT0);
@@ -2025,16 +2067,14 @@ void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
-    if (isOperandConstantImmediateInt(op1) || isOperandConstantImmediateInt(op2)) {
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_add);
-        stubCall.addArgument(op1, regT2);
-        stubCall.addArgument(op2, regT2);
-        stubCall.call(result);
-    } else
-        compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+    if (!types.first().mightBeNumber() || !types.second().mightBeNumber())
+        return;
+
+    bool op1HasImmediateIntFastCase = isOperandConstantImmediateInt(op1);
+    bool op2HasImmediateIntFastCase = !op1HasImmediateIntFastCase && isOperandConstantImmediateInt(op2);
+    compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand), op1HasImmediateIntFastCase, op2HasImmediateIntFastCase);
 }
 
 void JIT::emit_op_mul(Instruction* currentInstruction)
@@ -2069,17 +2109,106 @@ void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>
     unsigned op2 = currentInstruction[3].u.operand;
     OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
-    if ((isOperandConstantImmediateInt(op1) && (getConstantOperandImmediateInt(op1) > 0))
-        || (isOperandConstantImmediateInt(op2) && (getConstantOperandImmediateInt(op2) > 0))) {
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
-        JITStubCall stubCall(this, cti_op_mul);
-        stubCall.addArgument(op1, regT2);
-        stubCall.addArgument(op2, regT2);
-        stubCall.call(result);
-    } else
-        compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, types);
+    bool op1HasImmediateIntFastCase = isOperandConstantImmediateInt(op1) && getConstantOperandImmediateInt(op1) > 0;
+    bool op2HasImmediateIntFastCase = !op1HasImmediateIntFastCase && isOperandConstantImmediateInt(op2) && getConstantOperandImmediateInt(op2) > 0;
+    compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand), op1HasImmediateIntFastCase, op2HasImmediateIntFastCase);
+}
+
+void JIT::emit_op_div(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    if (isOperandConstantImmediateDouble(op1)) {
+        emitGetVirtualRegister(op1, regT0);
+        addPtr(tagTypeNumberRegister, regT0);
+        movePtrToDouble(regT0, fpRegT0);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitLoadInt32ToDouble(op1, fpRegT0);
+    } else {
+        emitGetVirtualRegister(op1, regT0);
+        if (!types.first().definitelyIsNumber())
+            emitJumpSlowCaseIfNotImmediateNumber(regT0);
+        Jump notInt = emitJumpIfNotImmediateInteger(regT0);
+        convertInt32ToDouble(regT0, fpRegT0);
+        Jump skipDoubleLoad = jump();
+        notInt.link(this);
+        addPtr(tagTypeNumberRegister, regT0);
+        movePtrToDouble(regT0, fpRegT0);
+        skipDoubleLoad.link(this);
+    }
+    
+    if (isOperandConstantImmediateDouble(op2)) {
+        emitGetVirtualRegister(op2, regT1);
+        addPtr(tagTypeNumberRegister, regT1);
+        movePtrToDouble(regT1, fpRegT1);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitLoadInt32ToDouble(op2, fpRegT1);
+    } else {
+        emitGetVirtualRegister(op2, regT1);
+        if (!types.second().definitelyIsNumber())
+            emitJumpSlowCaseIfNotImmediateNumber(regT1);
+        Jump notInt = emitJumpIfNotImmediateInteger(regT1);
+        convertInt32ToDouble(regT1, fpRegT1);
+        Jump skipDoubleLoad = jump();
+        notInt.link(this);
+        addPtr(tagTypeNumberRegister, regT1);
+        movePtrToDouble(regT1, fpRegT1);
+        skipDoubleLoad.link(this);
+    }
+    divDouble(fpRegT1, fpRegT0);
+
+    JumpList doubleResult;
+    Jump end;
+    bool attemptIntConversion = (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) && isOperandConstantImmediateInt(op2);
+    if (attemptIntConversion) {
+        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
+        doubleResult.append(branchTest32(Zero, regT0));
+        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
+        
+        doubleResult.append(m_assembler.jne());
+        doubleResult.append(m_assembler.jp());
+        emitFastArithIntToImmNoCheck(regT0, regT0);
+        end = jump();
+    }
+
+    // Double result.
+    doubleResult.link(this);
+    moveDoubleToPtr(fpRegT0, regT0);
+    subPtr(tagTypeNumberRegister, regT0);
+
+    if (attemptIntConversion)
+        end.link(this);
+    emitPutVirtualRegister(dst, regT0);
+}
+
+void JIT::emitSlow_op_div(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+    if (types.first().definitelyIsNumber() && types.second().definitelyIsNumber()) {
+#ifndef NDEBUG
+        breakpoint();
+#endif
+        return;
+    }
+    if (!isOperandConstantImmediateDouble(op1) && !isOperandConstantImmediateInt(op1)) {
+        if (!types.first().definitelyIsNumber())
+            linkSlowCase(iter);
+    }
+    if (!isOperandConstantImmediateDouble(op2) && !isOperandConstantImmediateInt(op2)) {
+        if (!types.second().definitelyIsNumber())
+            linkSlowCase(iter);
+    }
+    // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
+    JITStubCall stubCall(this, cti_op_div);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
 }
 
 void JIT::emit_op_sub(Instruction* currentInstruction)
@@ -2090,7 +2219,6 @@ void JIT::emit_op_sub(Instruction* currentInstruction)
     OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
     compileBinaryArithOp(op_sub, result, op1, op2, types);
-
     emitPutVirtualRegister(result);
 }
 
@@ -2101,7 +2229,7 @@ void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>
     unsigned op2 = currentInstruction[3].u.operand;
     OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
-    compileBinaryArithOpSlowCase(op_sub, iter, result, op1, op2, types);
+    compileBinaryArithOpSlowCase(op_sub, iter, result, op1, op2, types, false, false);
 }
 
 #else // USE(JSVALUE64)
@@ -2284,6 +2412,15 @@ void JIT::emit_op_add(Instruction* currentInstruction)
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    if (!types.first().mightBeNumber() || !types.second().mightBeNumber()) {
+        JITStubCall stubCall(this, cti_op_add);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+        return;
+    }
 
     if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT0);
@@ -2298,15 +2435,7 @@ void JIT::emit_op_add(Instruction* currentInstruction)
         signExtend32ToPtr(regT0, regT0);
         emitPutVirtualRegister(result);
     } else {
-        OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-        if (types.first().mightBeNumber() && types.second().mightBeNumber())
-            compileBinaryArithOp(op_add, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
-        else {
-            JITStubCall stubCall(this, cti_op_add);
-            stubCall.addArgument(op1, regT2);
-            stubCall.addArgument(op2, regT2);
-            stubCall.call(result);
-        }
+        compileBinaryArithOp(op_add, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
     }
 }
 
@@ -2316,6 +2445,10 @@ void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+    if (!types.first().mightBeNumber() || !types.second().mightBeNumber())
+        return;
+
     if (isOperandConstantImmediateInt(op1)) {
         Jump notImm = getSlowCase(iter);
         linkSlowCase(iter);
diff --git a/JavaScriptCore/jit/JITCall.cpp b/JavaScriptCore/jit/JITCall.cpp
index 7fdb845..cfaa69f 100644
--- a/JavaScriptCore/jit/JITCall.cpp
+++ b/JavaScriptCore/jit/JITCall.cpp
@@ -64,10 +64,9 @@ void JIT::compileOpCallSetupArgs(Instruction* instruction)
     int argCount = instruction[3].u.operand;
     int registerOffset = instruction[4].u.operand;
 
-    emitPutJITStubArg(regT0, 1);
-    emitPutJITStubArg(regT1, 2);
-    emitPutJITStubArgConstant(registerOffset, 3);
-    emitPutJITStubArgConstant(argCount, 5);
+    emitPutJITStubArg(regT1, regT0, 0);
+    emitPutJITStubArgConstant(registerOffset, 1);
+    emitPutJITStubArgConstant(argCount, 2);
 }
           
 void JIT::compileOpConstructSetupArgs(Instruction* instruction)
@@ -77,20 +76,18 @@ void JIT::compileOpConstructSetupArgs(Instruction* instruction)
     int proto = instruction[5].u.operand;
     int thisRegister = instruction[6].u.operand;
 
-    emitPutJITStubArg(regT0, 1);
-    emitPutJITStubArg(regT1, 2);
-    emitPutJITStubArgConstant(registerOffset, 3);
-    emitPutJITStubArgConstant(argCount, 5);
-    emitPutJITStubArgFromVirtualRegister(proto, 7, regT2, regT3);
-    emitPutJITStubArgConstant(thisRegister, 9);
+    emitPutJITStubArg(regT1, regT0, 0);
+    emitPutJITStubArgConstant(registerOffset, 1);
+    emitPutJITStubArgConstant(argCount, 2);
+    emitPutJITStubArgFromVirtualRegister(proto, 3, regT2, regT3);
+    emitPutJITStubArgConstant(thisRegister, 4);
 }
 
 void JIT::compileOpCallVarargsSetupArgs(Instruction*)
 {
-    emitPutJITStubArg(regT0, 1);
-    emitPutJITStubArg(regT1, 2);
-    emitPutJITStubArg(regT3, 3); // registerOffset
-    emitPutJITStubArg(regT2, 5); // argCount
+    emitPutJITStubArg(regT1, regT0, 0);
+    emitPutJITStubArg(regT3, 1); // registerOffset
+    emitPutJITStubArg(regT2, 2); // argCount
 }
 
 void JIT::compileOpCallVarargs(Instruction* instruction)
@@ -239,19 +236,17 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
     int argCount = instruction[3].u.operand;
     int registerOffset = instruction[4].u.operand;
 
-    Jump wasEval1;
-    Jump wasEval2;
+    Jump wasEval;
     if (opcodeID == op_call_eval) {
         JITStubCall stubCall(this, cti_op_call_eval);
         stubCall.addArgument(callee);
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval1 = branchTest32(NonZero, regT0);
-        wasEval2 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+        wasEval = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
     }
 
-    emitLoad(callee, regT1, regT2);
+    emitLoad(callee, regT1, regT0);
 
     if (opcodeID == op_call)
         compileOpCallSetupArgs(instruction);
@@ -259,12 +254,12 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         compileOpConstructSetupArgs(instruction);
 
     emitJumpSlowCaseIfNotJSCell(callee, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
         JITStubCall(this, cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitLoad(callee, regT1, regT2);
+        emitLoad(callee, regT1, regT0);
     }
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
@@ -274,12 +269,10 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
 
     emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
 
-    if (opcodeID == op_call_eval) {
-        wasEval1.link(this);
-        wasEval2.link(this);
-    }
+    if (opcodeID == op_call_eval)
+        wasEval.link(this);
 
-    emitStore(dst, regT1, regT0);;
+    emitStore(dst, regT1, regT0);
 
     sampleCodeBlock(m_codeBlock);
 }
@@ -309,16 +302,14 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     int argCount = instruction[3].u.operand;
     int registerOffset = instruction[4].u.operand;
 
-    Jump wasEval1;
-    Jump wasEval2;
+    Jump wasEval;
     if (opcodeID == op_call_eval) {
         JITStubCall stubCall(this, cti_op_call_eval);
         stubCall.addArgument(callee);
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval1 = branchTest32(NonZero, regT0);
-        wasEval2 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+        wasEval = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
     }
 
     emitLoad(callee, regT1, regT0);
@@ -362,10 +353,8 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Call to the callee
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
     
-    if (opcodeID == op_call_eval) {
-        wasEval1.link(this);
-        wasEval2.link(this);
-    }
+    if (opcodeID == op_call_eval)
+        wasEval.link(this);
 
     // Put the return value in dst. In the interpreter, op_ret does this.
     emitStore(dst, regT1, regT0);
@@ -439,10 +428,10 @@ void JIT::compileOpCallInitializeCallFrame()
 {
     store32(regT1, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
 
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
 
     storePtr(ImmPtr(JSValue::encode(JSValue())), Address(callFrameRegister, RegisterFile::OptionalCalleeArguments * static_cast<int>(sizeof(Register))));
-    storePtr(regT2, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
+    storePtr(regT0, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
     storePtr(regT1, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register))));
 }
 
@@ -452,9 +441,9 @@ void JIT::compileOpCallSetupArgs(Instruction* instruction)
     int registerOffset = instruction[4].u.operand;
 
     // ecx holds func
-    emitPutJITStubArg(regT2, 1);
-    emitPutJITStubArgConstant(argCount, 3);
-    emitPutJITStubArgConstant(registerOffset, 2);
+    emitPutJITStubArg(regT0, 0);
+    emitPutJITStubArgConstant(argCount, 2);
+    emitPutJITStubArgConstant(registerOffset, 1);
 }
           
 void JIT::compileOpCallVarargsSetupArgs(Instruction* instruction)
@@ -462,10 +451,10 @@ void JIT::compileOpCallVarargsSetupArgs(Instruction* instruction)
     int registerOffset = instruction[4].u.operand;
     
     // ecx holds func
+    emitPutJITStubArg(regT0, 0);
+    emitPutJITStubArg(regT1, 2);
+    addPtr(Imm32(registerOffset), regT1, regT2);
     emitPutJITStubArg(regT2, 1);
-    emitPutJITStubArg(regT1, 3);
-    addPtr(Imm32(registerOffset), regT1, regT0);
-    emitPutJITStubArg(regT0, 2);
 }
 
 void JIT::compileOpConstructSetupArgs(Instruction* instruction)
@@ -476,11 +465,11 @@ void JIT::compileOpConstructSetupArgs(Instruction* instruction)
     int thisRegister = instruction[6].u.operand;
 
     // ecx holds func
-    emitPutJITStubArg(regT2, 1);
-    emitPutJITStubArgConstant(registerOffset, 2);
-    emitPutJITStubArgConstant(argCount, 3);
-    emitPutJITStubArgFromVirtualRegister(proto, 4, regT0);
-    emitPutJITStubArgConstant(thisRegister, 5);
+    emitPutJITStubArg(regT0, 0);
+    emitPutJITStubArgConstant(registerOffset, 1);
+    emitPutJITStubArgConstant(argCount, 2);
+    emitPutJITStubArgFromVirtualRegister(proto, 3, regT2);
+    emitPutJITStubArgConstant(thisRegister, 4);
 }
 
 void JIT::compileOpCallVarargs(Instruction* instruction)
@@ -490,20 +479,20 @@ void JIT::compileOpCallVarargs(Instruction* instruction)
     int argCountRegister = instruction[3].u.operand;
 
     emitGetVirtualRegister(argCountRegister, regT1);
-    emitGetVirtualRegister(callee, regT2);
+    emitGetVirtualRegister(callee, regT0);
     compileOpCallVarargsSetupArgs(instruction);
 
     // Check for JSFunctions.
-    emitJumpSlowCaseIfNotJSCell(regT2);
-    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
-    
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+
     // Speculatively roll the callframe, assuming argCount will match the arity.
-    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    mul32(Imm32(sizeof(Register)), regT2, regT2);
     intptr_t offset = (intptr_t)sizeof(Register) * (intptr_t)RegisterFile::CallerFrame;
-    addPtr(Imm32((int32_t)offset), regT0, regT3);
+    addPtr(Imm32((int32_t)offset), regT2, regT3);
     addPtr(callFrameRegister, regT3);
     storePtr(callFrameRegister, regT3);
-    addPtr(regT0, callFrameRegister);
+    addPtr(regT2, callFrameRegister);
     emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
 
     // Put the return value in dst. In the interpreter, op_ret does this.
@@ -539,14 +528,14 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
     Jump wasEval;
     if (opcodeID == op_call_eval) {
         JITStubCall stubCall(this, cti_op_call_eval);
-        stubCall.addArgument(callee, regT2);
+        stubCall.addArgument(callee, regT0);
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
         wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
     }
 
-    emitGetVirtualRegister(callee, regT2);
+    emitGetVirtualRegister(callee, regT0);
     // The arguments have been set up on the hot path for op_call_eval
     if (opcodeID == op_call)
         compileOpCallSetupArgs(instruction);
@@ -554,13 +543,13 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         compileOpConstructSetupArgs(instruction);
 
     // Check for JSFunctions.
-    emitJumpSlowCaseIfNotJSCell(regT2);
-    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
         JITStubCall(this, cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitGetVirtualRegister(callee, regT2);
+        emitGetVirtualRegister(callee, regT0);
     }
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
@@ -606,7 +595,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     Jump wasEval;
     if (opcodeID == op_call_eval) {
         JITStubCall stubCall(this, cti_op_call_eval);
-        stubCall.addArgument(callee, regT2);
+        stubCall.addArgument(callee, regT0);
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
@@ -615,9 +604,15 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
 
     // This plants a check for a cached JSFunction value, so we can plant a fast link to the callee.
     // This deliberately leaves the callee in ecx, used when setting up the stack frame below
-    emitGetVirtualRegister(callee, regT2);
+    emitGetVirtualRegister(callee, regT0);
     DataLabelPtr addressOfLinkedFunctionCheck;
-    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT2, addressOfLinkedFunctionCheck, ImmPtr(JSValue::encode(JSValue())));
+
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
+    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(JSValue::encode(JSValue())));
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
     addSlowCase(jumpToSlow);
     ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
@@ -629,18 +624,18 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
         int proto = instruction[5].u.operand;
         int thisRegister = instruction[6].u.operand;
 
-        emitPutJITStubArg(regT2, 1);
-        emitPutJITStubArgFromVirtualRegister(proto, 4, regT0);
+        emitPutJITStubArg(regT0, 0);
+        emitPutJITStubArgFromVirtualRegister(proto, 3, regT2);
         JITStubCall stubCall(this, cti_op_construct_JSConstruct);
         stubCall.call(thisRegister);
-        emitGetVirtualRegister(callee, regT2);
+        emitGetVirtualRegister(callee, regT0);
     }
 
     // Fast version of stack frame initialization, directly relative to edi.
     // Note that this omits to set up RegisterFile::CodeBlock, which is set in the callee
     storePtr(ImmPtr(JSValue::encode(JSValue())), Address(callFrameRegister, (registerOffset + RegisterFile::OptionalCalleeArguments) * static_cast<int>(sizeof(Register))));
-    storePtr(regT2, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
+    storePtr(regT0, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
     store32(Imm32(argCount), Address(callFrameRegister, (registerOffset + RegisterFile::ArgumentCount) * static_cast<int>(sizeof(Register))));
     storePtr(callFrameRegister, Address(callFrameRegister, (registerOffset + RegisterFile::CallerFrame) * static_cast<int>(sizeof(Register))));
     storePtr(regT1, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
@@ -674,13 +669,13 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
         compileOpConstructSetupArgs(instruction);
 
     // Fast check for JS function.
-    Jump callLinkFailNotObject = emitJumpIfNotJSCell(regT2);
-    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr));
+    Jump callLinkFailNotObject = emitJumpIfNotJSCell(regT0);
+    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
         JITStubCall(this, cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitGetVirtualRegister(callee, regT2);
+        emitGetVirtualRegister(callee, regT0);
     }
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
@@ -688,6 +683,8 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
     move(Imm32(argCount), regT1);
 
+    move(regT0, regT2);
+
     m_callStructureStubCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_globalData->jitStubs.ctiVirtualCallLink());
 
     // Put the return value in dst.
diff --git a/JavaScriptCore/jit/JITInlineMethods.h b/JavaScriptCore/jit/JITInlineMethods.h
index b5aaafc..f26457a 100644
--- a/JavaScriptCore/jit/JITInlineMethods.h
+++ b/JavaScriptCore/jit/JITInlineMethods.h
@@ -37,28 +37,37 @@ namespace JSC {
 // puts an arg onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID src, unsigned argumentNumber)
 {
-    poke(src, argumentNumber);
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    poke(src, argumentStackOffset);
 }
 
 /* Deprecated: Please use JITStubCall instead. */
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(unsigned value, unsigned argumentNumber)
 {
-    poke(Imm32(value), argumentNumber);
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    poke(Imm32(value), argumentStackOffset);
 }
 
 /* Deprecated: Please use JITStubCall instead. */
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(void* value, unsigned argumentNumber)
 {
-    poke(ImmPtr(value), argumentNumber);
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    poke(ImmPtr(value), argumentStackOffset);
 }
 
 /* Deprecated: Please use JITStubCall instead. */
 
 ALWAYS_INLINE void JIT::emitGetJITStubArg(unsigned argumentNumber, RegisterID dst)
 {
-    peek(dst, argumentNumber);
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    peek(dst, argumentStackOffset);
+}
+
+ALWAYS_INLINE bool JIT::isOperandConstantImmediateDouble(unsigned src)
+{
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isDouble();
 }
 
 ALWAYS_INLINE JSValue JIT::getConstantOperand(unsigned src)
@@ -102,38 +111,71 @@ ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
     return nakedCall;
 }
 
-#if PLATFORM(X86) || PLATFORM(X86_64) || (PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7))
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+
+ALWAYS_INLINE void JIT::beginUninterruptedSequence(int insnSpace, int constSpace)
+{
+#if PLATFORM(ARM_TRADITIONAL)
+#ifndef NDEBUG
+    // Ensure the label after the sequence can also fit
+    insnSpace += sizeof(ARMWord);
+    constSpace += sizeof(uint64_t);
+#endif
+
+    ensureSpace(insnSpace, constSpace);
+
+#endif
+
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+#ifndef NDEBUG
+    m_uninterruptedInstructionSequenceBegin = label();
+    m_uninterruptedConstantSequenceBegin = sizeOfConstantPool();
+#endif
+#endif
+}
+
+ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
+{
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+    ASSERT(differenceBetween(m_uninterruptedInstructionSequenceBegin, label()) == insnSpace);
+    ASSERT(sizeOfConstantPool() - m_uninterruptedConstantSequenceBegin == constSpace);
+#endif
+}
+
+#endif
+
+#if PLATFORM(ARM_THUMB2)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
-    pop(reg);
+    move(linkRegister, reg);
 }
 
 ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
 {
-    push(reg);
+    move(reg, linkRegister);
 }
 
 ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
 {
-    push(address);
+    loadPtr(address, linkRegister);
 }
 
-#elif PLATFORM_ARM_ARCH(7)
+#else // PLATFORM(X86) || PLATFORM(X86_64) || PLATFORM(ARM_TRADITIONAL)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
-    move(linkRegister, reg);
+    pop(reg);
 }
 
 ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
 {
-    move(reg, linkRegister);
+    push(reg);
 }
 
 ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
 {
-    loadPtr(address, linkRegister);
+    push(address);
 }
 
 #endif
@@ -149,8 +191,8 @@ ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
     move(stackPointerRegister, firstArgumentRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
-#if PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
-    move(ctiReturnRegister, ARM::lr);
+#if PLATFORM(ARM_TRADITIONAL)
+    move(ctiReturnRegister, ARMRegisters::lr);
 #endif
 }
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
@@ -158,7 +200,7 @@ ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 #if PLATFORM(X86)
     // Within a trampoline the return address will be on the stack at this point.
     addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
-#elif PLATFORM_ARM_ARCH(7)
+#elif PLATFORM(ARM_THUMB2)
     move(stackPointerRegister, firstArgumentRegister);
 #endif
     // In the trampoline on x86-64, the first argument register is not overwritten.
@@ -242,8 +284,8 @@ ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t cou
 #if PLATFORM(X86_64)
 ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
 {
-    move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86::ecx);
-    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86::ecx);
+    move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86Registers::ecx);
+    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86Registers::ecx);
 }
 #else
 ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
@@ -257,8 +299,8 @@ ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostF
 #if PLATFORM(X86_64)
 ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
 {
-    move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86::ecx);
-    storePtr(ImmPtr(codeBlock), X86::ecx);
+    move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86Registers::ecx);
+    storePtr(ImmPtr(codeBlock), X86Registers::ecx);
 }
 #else
 ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
@@ -268,6 +310,11 @@ ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
 #endif
 #endif
 
+inline JIT::Address JIT::addressFor(unsigned index, RegisterID base)
+{
+    return Address(base, (index * sizeof(Register)));
+}
+
 #if USE(JSVALUE32_64)
 
 inline JIT::Address JIT::tagFor(unsigned index, RegisterID base)
@@ -280,11 +327,6 @@ inline JIT::Address JIT::payloadFor(unsigned index, RegisterID base)
     return Address(base, (index * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.payload));
 }
 
-inline JIT::Address JIT::addressFor(unsigned index, RegisterID base)
-{
-    return Address(base, (index * sizeof(Register)));
-}
-
 inline void JIT::emitLoadTag(unsigned index, RegisterID tag)
 {
     RegisterID mappedTag;
@@ -542,23 +584,28 @@ ALWAYS_INLINE bool JIT::getOperandConstantImmediateInt(unsigned op1, unsigned op
     return false;
 }
 
-ALWAYS_INLINE bool JIT::isOperandConstantImmediateDouble(unsigned src)
+/* Deprecated: Please use JITStubCall instead. */
+
+ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, unsigned argumentNumber)
 {
-    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isDouble();
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    poke(payload, argumentStackOffset);
+    poke(tag, argumentStackOffset + 1);
 }
 
 /* Deprecated: Please use JITStubCall instead. */
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch1, RegisterID scratch2)
 {
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue constant = m_codeBlock->getConstant(src);
-        poke(Imm32(constant.payload()), argumentNumber);
-        poke(Imm32(constant.tag()), argumentNumber + 1);
+        poke(Imm32(constant.payload()), argumentStackOffset);
+        poke(Imm32(constant.tag()), argumentStackOffset + 1);
     } else {
         emitLoad(src, scratch1, scratch2);
-        poke(scratch2, argumentNumber);
-        poke(scratch1, argumentNumber + 1);
+        poke(scratch2, argumentStackOffset);
+        poke(scratch1, argumentStackOffset + 1);
     }
 }
 
@@ -685,6 +732,24 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateNumber(RegisterID reg)
 {
     return branchTestPtr(Zero, reg, tagTypeNumberRegister);
 }
+
+inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        loadDouble(&inConstantPool, value);
+    } else
+        loadDouble(addressFor(index), value);
+}
+
+inline void JIT::emitLoadInt32ToDouble(unsigned index, FPRegisterID value)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        convertInt32ToDouble(AbsoluteAddress(&inConstantPool), value);
+    } else
+        convertInt32ToDouble(addressFor(index), value);
+}
 #endif
 
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateInteger(RegisterID reg)
@@ -722,6 +787,11 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateIntegers(RegisterID reg1,
     addSlowCase(emitJumpIfNotImmediateIntegers(reg1, reg2, scratch));
 }
 
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateNumber(RegisterID reg)
+{
+    addSlowCase(emitJumpIfNotImmediateNumber(reg));
+}
+
 #if !USE(JSVALUE64)
 ALWAYS_INLINE void JIT::emitFastArithDeTagImmediate(RegisterID reg)
 {
@@ -779,12 +849,13 @@ ALWAYS_INLINE void JIT::emitTagAsBoolImmediate(RegisterID reg)
 // get arg puts an arg from the SF register array onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch)
 {
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue value = m_codeBlock->getConstant(src);
-        emitPutJITStubArgConstant(JSValue::encode(value), argumentNumber);
+        poke(ImmPtr(JSValue::encode(value)), argumentStackOffset);
     } else {
         loadPtr(Address(callFrameRegister, src * sizeof(Register)), scratch);
-        emitPutJITStubArg(scratch, argumentNumber);
+        poke(scratch, argumentStackOffset);
     }
 
     killLastResultRegister();
diff --git a/JavaScriptCore/jit/JITOpcodes.cpp b/JavaScriptCore/jit/JITOpcodes.cpp
index 13fc981..f362d75 100644
--- a/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/JavaScriptCore/jit/JITOpcodes.cpp
@@ -64,90 +64,77 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // (2) Trampolines for the slow cases of op_call / op_call_eval / op_construct.
 
 #if ENABLE(JIT_OPTIMIZE_CALL)
-    /* VirtualCallLink Trampoline */
+    // VirtualCallLink Trampoline
+    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
     Label virtualCallLinkBegin = align();
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    // regT0 holds callee, regT1 holds argCount.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_body)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionBodyNode, m_code)), regT2);
-    Jump hasCodeBlock2 = branchTestPtr(NonZero, regT2);
+    Jump isNativeFunc2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
 
-    // Lazily generate a CodeBlock.
-    preserveReturnAddressAfterCall(regT3); // return address
+    Jump hasCodeBlock2 = branch32(GreaterThan, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+    preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callJSFunction2 = call();
-    move(regT0, regT2);
-    emitGetJITStubArg(1, regT0); // callee
-    emitGetJITStubArg(5, regT1); // argCount
-    restoreReturnAddressBeforeReturn(regT3); // return address
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
     hasCodeBlock2.link(this);
 
-    // regT2 holds codeBlock.
-    Jump isNativeFunc2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(CodeBlock, m_codeType)), Imm32(NativeCode));
-
     // Check argCount matches callee arity.
-    Jump arityCheckOkay2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(CodeBlock, m_numParameters)), regT1);
+    Jump arityCheckOkay2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), regT1);
     preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 3); // return address
-    emitPutJITStubArg(regT2, 7); // codeBlock
+    emitPutJITStubArg(regT3, 1); // return address
     restoreArgumentReference();
     Call callArityCheck2 = call();
     move(regT1, callFrameRegister);
-    emitGetJITStubArg(1, regT0); // callee
-    emitGetJITStubArg(5, regT1); // argCount
-    restoreReturnAddressBeforeReturn(regT3); // return address
-
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
     arityCheckOkay2.link(this);
+
     isNativeFunc2.link(this);
 
     compileOpCallInitializeCallFrame();
 
     preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 3);
+    emitPutJITStubArg(regT3, 1); // return address
     restoreArgumentReference();
     Call callLazyLinkCall = call();
     restoreReturnAddressBeforeReturn(regT3);
     jump(regT0);
 #endif // ENABLE(JIT_OPTIMIZE_CALL)
 
-    /* VirtualCall Trampoline */
+    // VirtualCall Trampoline
+    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
     Label virtualCallBegin = align();
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    // regT0 holds callee, regT1 holds argCount.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_body)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionBodyNode, m_code)), regT2);
-    Jump hasCodeBlock3 = branchTestPtr(NonZero, regT2);
+    Jump isNativeFunc3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
 
-    // Lazily generate a CodeBlock.
-    preserveReturnAddressAfterCall(regT3); // return address
+    Jump hasCodeBlock3 = branch32(GreaterThan, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+    preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callJSFunction1 = call();
-    move(regT0, regT2);
-    emitGetJITStubArg(1, regT0); // callee
-    emitGetJITStubArg(5, regT1); // argCount
-    restoreReturnAddressBeforeReturn(regT3); // return address
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
     hasCodeBlock3.link(this);
     
-    // regT2 holds codeBlock.
-    Jump isNativeFunc3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(CodeBlock, m_codeType)), Imm32(NativeCode));
-    
-    // Check argCount matches callee.
-    Jump arityCheckOkay3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(CodeBlock, m_numParameters)), regT1);
+    // Check argCount matches callee arity.
+    Jump arityCheckOkay3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), regT1);
     preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 3); // return address
-    emitPutJITStubArg(regT2, 7); // codeBlock
+    emitPutJITStubArg(regT3, 1); // return address
     restoreArgumentReference();
     Call callArityCheck1 = call();
     move(regT1, callFrameRegister);
-    emitGetJITStubArg(1, regT0); // callee
-    emitGetJITStubArg(5, regT1); // argCount
-    restoreReturnAddressBeforeReturn(regT3); // return address
-
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
     arityCheckOkay3.link(this);
+
     isNativeFunc3.link(this);
+
     compileOpCallInitializeCallFrame();
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_body)), regT0);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(FunctionBodyNode, m_jitCode)), regT0);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCode)), regT0);
     jump(regT0);
 
 #if PLATFORM(X86)
@@ -237,23 +224,23 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
 #if COMPILER(MSVC) || PLATFORM(LINUX)
     // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
-    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86::ecx);
+    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
 
     // Plant callee
-    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::eax);
-    storePtr(X86::eax, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, callee)));
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::eax);
+    storePtr(X86Registers::eax, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, callee)));
 
     // Plant callframe
-    move(callFrameRegister, X86::edx);
+    move(callFrameRegister, X86Registers::edx);
 
-    call(Address(X86::eax, OBJECT_OFFSETOF(JSFunction, m_data)));
+    call(Address(X86Registers::eax, OBJECT_OFFSETOF(JSFunction, m_data)));
 
     // JSValue is a non-POD type, so eax points to it
-    emitLoad(0, regT1, regT0, X86::eax);
+    emitLoad(0, regT1, regT0, X86Registers::eax);
 #else
-    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::edx); // callee
-    move(callFrameRegister, X86::ecx); // callFrame
-    call(Address(X86::edx, OBJECT_OFFSETOF(JSFunction, m_data)));
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::edx); // callee
+    move(callFrameRegister, X86Registers::ecx); // callFrame
+    call(Address(X86Registers::edx, OBJECT_OFFSETOF(JSFunction, m_data)));
 #endif
 
     // We've put a few temporaries on the stack in addition to the actual arguments
@@ -261,10 +248,8 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
     // Check for an exception
-    // FIXME: Maybe we can optimize this comparison to JSValue().
     move(ImmPtr(&globalData->exception), regT2);
-    Jump sawException1 = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::CellTag));
-    Jump sawException2 = branch32(NonZero, payloadFor(0, regT2), Imm32(0));
+    Jump sawException = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::EmptyValueTag));
 
     // Grab the return address.
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT3);
@@ -277,8 +262,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     ret();
 
     // Handle an exception
-    sawException1.link(this);
-    sawException2.link(this);
+    sawException.link(this);
     // Grab the return address.
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     move(ImmPtr(&globalData->exceptionLocation), regT2);
@@ -544,7 +528,7 @@ void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCas
 void JIT::emit_op_new_func(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_func);
-    stubCall.addArgument(ImmPtr(m_codeBlock->function(currentInstruction[2].u.operand)));
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -807,14 +791,17 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
     Jump isTrue2 = branch32(NotEqual, regT0, Imm32(0));
     addJump(jump(), target + 2);
 
-    isNotInteger.link(this);
+    if (supportsFloatingPoint()) {
+        isNotInteger.link(this);
 
-    addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+
+        zeroDouble(fpRegT0);
+        emitLoadDouble(cond, fpRegT1);
+        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target + 2);
+    } else
+        addSlowCase(isNotInteger);
 
-    zeroDouble(fpRegT0);
-    emitLoadDouble(cond, fpRegT1);
-    addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target + 2);
-    
     isTrue.link(this);
     isTrue2.link(this);
 }
@@ -845,14 +832,17 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
     Jump isFalse2 = branch32(Equal, regT0, Imm32(0));
     addJump(jump(), target + 2);
 
-    isNotInteger.link(this);
+    if (supportsFloatingPoint()) {
+        isNotInteger.link(this);
 
-    addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+
+        zeroDouble(fpRegT0);
+        emitLoadDouble(cond, fpRegT1);
+        addJump(branchDouble(DoubleNotEqual, fpRegT0, fpRegT1), target + 2);
+    } else
+        addSlowCase(isNotInteger);
 
-    zeroDouble(fpRegT0);
-    emitLoadDouble(cond, fpRegT1);
-    addJump(branchDouble(DoubleNotEqual, fpRegT0, fpRegT1), target + 2);
-    
     isFalse.link(this);
     isFalse2.link(this);
 }
@@ -1180,7 +1170,7 @@ void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_func_exp);
-    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpression(currentInstruction[2].u.operand)));
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -1244,7 +1234,7 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
     emitLoad(src, regT1, regT0);
 
     Jump isInt32 = branch32(Equal, regT1, Imm32(JSValue::Int32Tag));
-    addSlowCase(branch32(AboveOrEqual, regT1, Imm32(JSValue::DeletedValueTag)));
+    addSlowCase(branch32(AboveOrEqual, regT1, Imm32(JSValue::EmptyValueTag)));
     isInt32.link(this);
 
     if (src != dst)
@@ -1388,8 +1378,7 @@ void JIT::emit_op_enter_with_activation(Instruction* currentInstruction)
 
 void JIT::emit_op_create_arguments(Instruction*)
 {
-    Jump argsNotCell = branch32(NotEqual, tagFor(RegisterFile::ArgumentsRegister, callFrameRegister), Imm32(JSValue::CellTag));
-    Jump argsNotNull = branchTestPtr(NonZero, payloadFor(RegisterFile::ArgumentsRegister, callFrameRegister));
+    Jump argsCreated = branch32(NotEqual, tagFor(RegisterFile::ArgumentsRegister, callFrameRegister), Imm32(JSValue::EmptyValueTag));
 
     // If we get here the arguments pointer is a null cell - i.e. arguments need lazy creation.
     if (m_codeBlock->m_numParameters == 1)
@@ -1397,8 +1386,7 @@ void JIT::emit_op_create_arguments(Instruction*)
     else
         JITStubCall(this, cti_op_create_arguments).call();
 
-    argsNotCell.link(this);
-    argsNotNull.link(this);
+    argsCreated.link(this);
 }
     
 void JIT::emit_op_init_arguments(Instruction*)
@@ -1484,85 +1472,77 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // (3) Trampolines for the slow cases of op_call / op_call_eval / op_construct.
     COMPILE_ASSERT(sizeof(CodeType) == 4, CodeTypeEnumMustBe32Bit);
 
+    // VirtualCallLink Trampoline
+    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
     Label virtualCallLinkBegin = align();
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    // Load the callee CodeBlock* into eax
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3);
-    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_code)), regT0);
-    Jump hasCodeBlock2 = branchTestPtr(NonZero, regT0);
+    Jump isNativeFunc2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+
+    Jump hasCodeBlock2 = branch32(GreaterThan, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
     preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callJSFunction2 = call();
-    emitGetJITStubArg(1, regT2);
-    emitGetJITStubArg(3, regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    emitGetJITStubArg(2, regT1); // argCount
     restoreReturnAddressBeforeReturn(regT3);
     hasCodeBlock2.link(this);
 
-    Jump isNativeFunc2 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_codeType)), Imm32(NativeCode));
-
     // Check argCount matches callee arity.
-    Jump arityCheckOkay2 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_numParameters)), regT1);
+    Jump arityCheckOkay2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), regT1);
     preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 2);
-    emitPutJITStubArg(regT0, 4);
+    emitPutJITStubArg(regT3, 1); // return address
     restoreArgumentReference();
     Call callArityCheck2 = call();
     move(regT1, callFrameRegister);
-    emitGetJITStubArg(1, regT2);
-    emitGetJITStubArg(3, regT1);
+    emitGetJITStubArg(2, regT1); // argCount
     restoreReturnAddressBeforeReturn(regT3);
     arityCheckOkay2.link(this);
+
     isNativeFunc2.link(this);
 
     compileOpCallInitializeCallFrame();
-
     preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 2);
+    emitPutJITStubArg(regT3, 1); // return address
     restoreArgumentReference();
     Call callLazyLinkCall = call();
     restoreReturnAddressBeforeReturn(regT3);
-
     jump(regT0);
 
+    // VirtualCall Trampoline
+    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
     Label virtualCallBegin = align();
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    // Load the callee CodeBlock* into eax
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3);
-    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_code)), regT0);
-    Jump hasCodeBlock3 = branchTestPtr(NonZero, regT0);
+    Jump isNativeFunc3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+
+    Jump hasCodeBlock3 = branch32(GreaterThan, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
     preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callJSFunction1 = call();
-    emitGetJITStubArg(1, regT2);
-    emitGetJITStubArg(3, regT1);
+    emitGetJITStubArg(2, regT1); // argCount
     restoreReturnAddressBeforeReturn(regT3);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3); // reload the function body nody, so we can reload the code pointer.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
     hasCodeBlock3.link(this);
     
-    Jump isNativeFunc3 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_codeType)), Imm32(NativeCode));
-
     // Check argCount matches callee arity.
-    Jump arityCheckOkay3 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_numParameters)), regT1);
+    Jump arityCheckOkay3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), regT1);
     preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 2);
-    emitPutJITStubArg(regT0, 4);
+    emitPutJITStubArg(regT3, 1); // return address
     restoreArgumentReference();
     Call callArityCheck1 = call();
     move(regT1, callFrameRegister);
-    emitGetJITStubArg(1, regT2);
-    emitGetJITStubArg(3, regT1);
+    emitGetJITStubArg(2, regT1); // argCount
     restoreReturnAddressBeforeReturn(regT3);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3); // reload the function body nody, so we can reload the code pointer.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
     arityCheckOkay3.link(this);
+
     isNativeFunc3.link(this);
 
-    // load ctiCode from the new codeBlock.
-    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_jitCode)), regT0);
-    
     compileOpCallInitializeCallFrame();
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCode)), regT0);
     jump(regT0);
 
-    
     Label nativeCallThunk = align();
     preserveReturnAddressAfterCall(regT0);
     emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
@@ -1575,39 +1555,39 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     
 
 #if PLATFORM(X86_64)
-    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, X86::ecx);
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, X86Registers::ecx);
 
     // Allocate stack space for our arglist
     subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
     COMPILE_ASSERT((sizeof(ArgList) & 0xf) == 0, ArgList_should_by_16byte_aligned);
     
     // Set up arguments
-    subPtr(Imm32(1), X86::ecx); // Don't include 'this' in argcount
+    subPtr(Imm32(1), X86Registers::ecx); // Don't include 'this' in argcount
 
     // Push argcount
-    storePtr(X86::ecx, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_argCount)));
+    storePtr(X86Registers::ecx, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_argCount)));
 
     // Calculate the start of the callframe header, and store in edx
-    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), callFrameRegister, X86::edx);
+    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), callFrameRegister, X86Registers::edx);
     
     // Calculate start of arguments as callframe header - sizeof(Register) * argcount (ecx)
-    mul32(Imm32(sizeof(Register)), X86::ecx, X86::ecx);
-    subPtr(X86::ecx, X86::edx);
+    mul32(Imm32(sizeof(Register)), X86Registers::ecx, X86Registers::ecx);
+    subPtr(X86Registers::ecx, X86Registers::edx);
 
     // push pointer to arguments
-    storePtr(X86::edx, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
+    storePtr(X86Registers::edx, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
     
     // ArgList is passed by reference so is stackPointerRegister
-    move(stackPointerRegister, X86::ecx);
+    move(stackPointerRegister, X86Registers::ecx);
     
     // edx currently points to the first argument, edx-sizeof(Register) points to 'this'
-    loadPtr(Address(X86::edx, -(int32_t)sizeof(Register)), X86::edx);
+    loadPtr(Address(X86Registers::edx, -(int32_t)sizeof(Register)), X86Registers::edx);
     
-    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::esi);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::esi);
 
-    move(callFrameRegister, X86::edi); 
+    move(callFrameRegister, X86Registers::edi); 
 
-    call(Address(X86::esi, OBJECT_OFFSETOF(JSFunction, m_data)));
+    call(Address(X86Registers::esi, OBJECT_OFFSETOF(JSFunction, m_data)));
     
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
 #elif PLATFORM(X86)
@@ -1676,33 +1656,33 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
 #if COMPILER(MSVC) || PLATFORM(LINUX)
     // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
-    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86::ecx);
+    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
 
     // Plant callee
-    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::eax);
-    storePtr(X86::eax, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, callee)));
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::eax);
+    storePtr(X86Registers::eax, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, callee)));
 
     // Plant callframe
-    move(callFrameRegister, X86::edx);
+    move(callFrameRegister, X86Registers::edx);
 
-    call(Address(X86::eax, OBJECT_OFFSETOF(JSFunction, m_data)));
+    call(Address(X86Registers::eax, OBJECT_OFFSETOF(JSFunction, m_data)));
 
     // JSValue is a non-POD type
-    loadPtr(Address(X86::eax), X86::eax);
+    loadPtr(Address(X86Registers::eax), X86Registers::eax);
 #else
     // Plant callee
-    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::edx);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::edx);
 
     // Plant callframe
-    move(callFrameRegister, X86::ecx);
-    call(Address(X86::edx, OBJECT_OFFSETOF(JSFunction, m_data)));
+    move(callFrameRegister, X86Registers::ecx);
+    call(Address(X86Registers::edx, OBJECT_OFFSETOF(JSFunction, m_data)));
 #endif
 
     // We've put a few temporaries on the stack in addition to the actual arguments
     // so pull them off now
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
-#elif PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+#elif PLATFORM(ARM_TRADITIONAL)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     // Allocate stack space for our arglist
@@ -1736,9 +1716,9 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     move(callFrameRegister, regT0);
 
     // Setup arg4: This is a plain hack
-    move(stackPointerRegister, ARM::S0);
+    move(stackPointerRegister, ARMRegisters::S0);
 
-    move(ctiReturnRegister, ARM::lr);
+    move(ctiReturnRegister, ARMRegisters::lr);
     call(Address(regT1, OBJECT_OFFSETOF(JSFunction, m_data)));
 
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
@@ -1971,7 +1951,7 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
 void JIT::emit_op_new_func(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_func);
-    stubCall.addArgument(ImmPtr(m_codeBlock->function(currentInstruction[2].u.operand)));
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -2325,7 +2305,7 @@ void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_func_exp);
-    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpression(currentInstruction[2].u.operand)));
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -2711,32 +2691,20 @@ void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowC
 
 void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    // The slow void JIT::emitSlow_that handles accesses to arrays (below) may jump back up to here. 
-    Label beginGetByValSlow(this);
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
 
-    Jump notImm = getSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    emitFastArithIntToImmNoCheck(regT1, regT1);
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
 
-    notImm.link(this);
     JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(regT0);
-    stubCall.addArgument(regT1);
-    stubCall.call(currentInstruction[1].u.operand);
-    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-    // This is slow void JIT::emitSlow_that handles accesses to arrays above the fast cut-off.
-    // First, check if this is an access to the vector
-    linkSlowCase(iter);
-    branch32(AboveOrEqual, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength)), beginGetByValSlow);
-
-    // okay, missed the fast region, but it is still in the vector.  Get the value.
-    loadPtr(BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT2);
-    // Check whether the value loaded is zero; if so we need to return undefined.
-    branchTestPtr(Zero, regT2, beginGetByValSlow);
-    move(regT2, regT0);
-    emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
+    stubCall.addArgument(base, regT2);
+    stubCall.addArgument(property, regT2);
+    stubCall.call(dst);
 }
 
 void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2793,30 +2761,20 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
 
 void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    // Normal slow cases - either is not an immediate imm, or is an array.
-    Jump notImm = getSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    emitFastArithIntToImmNoCheck(regT1, regT1);
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
 
-    notImm.link(this); {
-        JITStubCall stubCall(this, cti_op_put_by_val);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(regT1);
-        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
-        stubCall.call();
-        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_put_by_val));
-    }
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base not array check
+    linkSlowCase(iter); // in vector check
 
-    // slow cases for immediate int accesses to arrays
-    linkSlowCase(iter);
-    linkSlowCase(iter); {
-        JITStubCall stubCall(this, cti_op_put_by_val_array);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(regT1);
-        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
-        stubCall.call();
-    }
+    JITStubCall stubPutByValCall(this, cti_op_put_by_val);
+    stubPutByValCall.addArgument(regT0);
+    stubPutByValCall.addArgument(property, regT2);
+    stubPutByValCall.addArgument(value, regT2);
+    stubPutByValCall.call();
 }
 
 void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
diff --git a/JavaScriptCore/jit/JITPropertyAccess.cpp b/JavaScriptCore/jit/JITPropertyAccess.cpp
index 9dba2e2..9edfd01 100644
--- a/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -273,11 +273,14 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
     emitJumpSlowCaseIfNotJSCell(base, regT1);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff))));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT0);
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
+
     emitStore(dst, regT1, regT0);
     map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
 }
@@ -288,35 +291,16 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     unsigned base = currentInstruction[2].u.operand;
     unsigned property = currentInstruction[3].u.operand;
 
-    // The slow void JIT::emitSlow_that handles accesses to arrays (below) may jump back up to here. 
-    Label callGetByValJITStub(this);
-
     linkSlowCase(iter); // property int32 check
     linkSlowCaseIfNotJSCell(iter, base); // base cell check
     linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
 
     JITStubCall stubCall(this, cti_op_get_by_val);
     stubCall.addArgument(base);
     stubCall.addArgument(property);
     stubCall.call(dst);
-
-    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-    linkSlowCase(iter); // array fast cut-off check
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT0);
-    branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength)), callGetByValJITStub);
-
-    // Missed the fast region, but it is still in the vector.
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
-
-    // FIXME: Maybe we can optimize this comparison to JSValue().
-    Jump skip = branch32(NotEqual, regT0, Imm32(0));
-    branch32(Equal, regT1, Imm32(JSValue::CellTag), callGetByValJITStub);
-
-    skip.link(this);
-    emitStore(dst, regT1, regT0);
 }
 
 void JIT::emit_op_put_by_val(Instruction* currentInstruction)
@@ -330,24 +314,27 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
     emitJumpSlowCaseIfNotJSCell(base, regT1);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-
-    Jump inFastVector = branch32(Below, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff)));
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
 
-    // Check if the access is within the vector.
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength))));
-
-    // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
-    // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-    Jump skip = branch32(NotEqual, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::CellTag));
-    addSlowCase(branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), Imm32(0)));
-    skip.link(this);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
 
-    inFastVector.link(this);
+    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
 
+    Label storeResult(this);
     emitLoad(value, regT1, regT0);
     store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
     store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
+    Jump end = jump();
+
+    empty.link(this);
+    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
+
+    add32(Imm32(1), regT2, regT0);
+    store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+    jump().linkTo(storeResult, this);
+
+    end.link(this);
 }
 
 void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -359,24 +346,13 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
     linkSlowCase(iter); // property int32 check
     linkSlowCaseIfNotJSCell(iter, base); // base cell check
     linkSlowCase(iter); // base not array check
+    linkSlowCase(iter); // in vector check
 
     JITStubCall stubPutByValCall(this, cti_op_put_by_val);
     stubPutByValCall.addArgument(base);
     stubPutByValCall.addArgument(property);
     stubPutByValCall.addArgument(value);
     stubPutByValCall.call();
-
-    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-    // Slow cases for immediate int accesses to arrays.
-    linkSlowCase(iter); // in vector check
-    linkSlowCase(iter); // written to slot check
-
-    JITStubCall stubCall(this, cti_op_put_by_val_array);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(regT2);
-    stubCall.addArgument(value);
-    stubCall.call();
 }
 
 void JIT::emit_op_get_by_id(Instruction* currentInstruction)
@@ -958,12 +934,16 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 {
-    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(base, regT0, property, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT1);
 #if USE(JSVALUE64)
     // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
-    // We check the value as if it was a uint32 against the m_fastAccessCutoff - which will always fail if
-    // number was signed since m_fastAccessCutoff is always less than intmax (since the total allocation
+    // We check the value as if it was a uint32 against the m_vectorLength - which will always fail if
+    // number was signed since m_vectorLength is always less than intmax (since the total allocation
     // size is always less than 4Gb).  As such zero extending wil have been correct (and extending the value
     // to 64-bits is necessary since it's used in the address calculation.  We zero extend rather than sign
     // extending since it makes it easier to re-tag the value in the slow case.
@@ -971,21 +951,25 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 #else
     emitFastArithImmToInt(regT1);
 #endif
-    emitJumpSlowCaseIfNotJSCell(regT0);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
 
-    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff))));
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
 
-    // Get the value from the vector
     loadPtr(BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0);
-    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    addSlowCase(branchTestPtr(Zero, regT0));
+
+    emitPutVirtualRegister(dst);
 }
 
 void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 {
-    emitGetVirtualRegisters(currentInstruction[1].u.operand, regT0, currentInstruction[2].u.operand, regT1);
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(base, regT0, property, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT1);
 #if USE(JSVALUE64)
     // See comment in op_get_by_val.
@@ -993,23 +977,29 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 #else
     emitFastArithImmToInt(regT1);
 #endif
-    emitJumpSlowCaseIfNotJSCell(regT0);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
 
-    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    Jump inFastVector = branch32(Below, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff)));
-    // No; oh well, check if the access if within the vector - if so, we may still be okay.
-    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength))));
 
-    // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
-    // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-    addSlowCase(branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))));
+    Jump empty = branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
 
-    // All good - put the value into the array.
-    inFastVector.link(this);
-    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    Label storeResult(this);
+    emitGetVirtualRegister(value, regT0);
     storePtr(regT0, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+    Jump end = jump();
+    
+    empty.link(this);
+    add32(Imm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    branch32(Below, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
+
+    move(regT1, regT0);
+    add32(Imm32(1), regT0);
+    store32(regT0, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+    jump().linkTo(storeResult, this);
+
+    end.link(this);
 }
 
 void JIT::emit_op_put_by_index(Instruction* currentInstruction)
@@ -1122,13 +1112,20 @@ void JIT::emit_op_method_check(Instruction* currentInstruction)
     // Do the method check - check the object & its prototype's structure inline (this is the common case).
     m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
     MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
+
     Jump notCell = emitJumpIfNotJSCell(regT0);
+
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+
     Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT1);
     Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
 
     // This will be relinked to load the function without doing a load.
     DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+
     Jump match = jump();
 
     ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
@@ -1192,6 +1189,8 @@ void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propert
 
     emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
 
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+
     Label hotPathBegin(this);
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
 
@@ -1210,6 +1209,9 @@ void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propert
     ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetGetByIdPropertyMapOffset);
 
     Label putResult(this);
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+
     ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
 }
 
@@ -1233,6 +1235,8 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
     linkSlowCaseIfNotJSCell(iter, baseVReg);
     linkSlowCase(iter);
 
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+
 #ifndef NDEBUG
     Label coldPathBegin(this);
 #endif
@@ -1241,6 +1245,8 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
     stubCall.addArgument(ImmPtr(ident));
     Call call = stubCall.call(resultVReg);
 
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+
     ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
 
     // Track the location of the call; this will be used to recover patch information.
@@ -1264,6 +1270,8 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     // Jump to a slow case if either the base object is an immediate, or if the Structure does not match.
     emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
 
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequencePutById);
+
     Label hotPathBegin(this);
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
 
@@ -1279,6 +1287,9 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
 
     DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(regT1, Address(regT0, patchGetByIdDefaultOffset));
+
+    END_UNINTERRUPTED_SEQUENCE(sequencePutById);
+
     ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetPutByIdPropertyMapOffset);
 }
 
@@ -1382,7 +1393,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
         stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
         stubCall.call(regT0);
-        emitGetJITStubArg(3, regT1);
+        emitGetJITStubArg(2, regT1);
 
         restoreReturnAddressBeforeReturn(regT3);
     }
diff --git a/JavaScriptCore/jit/JITStubs.cpp b/JavaScriptCore/jit/JITStubs.cpp
index d563f58..c7257af 100644
--- a/JavaScriptCore/jit/JITStubs.cpp
+++ b/JavaScriptCore/jit/JITStubs.cpp
@@ -69,6 +69,18 @@ namespace JSC {
 #define SYMBOL_STRING(name) #name
 #endif
 
+#if PLATFORM(IPHONE)
+#define THUMB_FUNC_PARAM(name) SYMBOL_STRING(name)
+#else
+#define THUMB_FUNC_PARAM(name)
+#endif
+
+#if PLATFORM(LINUX) && PLATFORM(X86_64)
+#define SYMBOL_STRING_RELOCATION(name) #name "@plt"
+#else
+#define SYMBOL_STRING_RELOCATION(name) SYMBOL_STRING(name)
+#endif
+
 #if USE(JSVALUE32_64)
 
 #if COMPILER(GCC) && PLATFORM(X86)
@@ -106,7 +118,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
 #endif
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addl $0x3c, %esp" "\n"
     "popl %ebx" "\n"
     "popl %edi" "\n"
@@ -169,7 +181,7 @@ asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addq $0x48, %rsp" "\n"
     "popq %rbx" "\n"
     "popq %r15" "\n"
@@ -193,7 +205,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM_ARM_ARCH(7)
+#elif COMPILER(GCC) && PLATFORM(ARM_THUMB2)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
@@ -204,7 +216,7 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiTrampoline) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "sub sp, sp, #0x3c" "\n"
     "str lr, [sp, #0x20]" "\n"
@@ -230,10 +242,10 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "ldr r6, [sp, #0x2c]" "\n"
     "ldr r5, [sp, #0x28]" "\n"
     "ldr r4, [sp, #0x24]" "\n"
@@ -247,7 +259,7 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ldr r6, [sp, #0x2c]" "\n"
     "ldr r5, [sp, #0x28]" "\n"
@@ -359,7 +371,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
 #endif
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addl $0x1c, %esp" "\n"
     "popl %ebx" "\n"
     "popl %edi" "\n"
@@ -428,7 +440,7 @@ asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addq $0x78, %rsp" "\n"
     "popq %rbx" "\n"
     "popq %r15" "\n"
@@ -452,7 +464,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM_ARM_ARCH(7)
+#elif COMPILER(GCC) && PLATFORM(ARM_THUMB2)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
@@ -463,9 +475,9 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiTrampoline) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "sub sp, sp, #0x3c" "\n"
+    "sub sp, sp, #0x40" "\n"
     "str lr, [sp, #0x20]" "\n"
     "str r4, [sp, #0x24]" "\n"
     "str r5, [sp, #0x28]" "\n"
@@ -480,7 +492,7 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "ldr r5, [sp, #0x28]" "\n"
     "ldr r4, [sp, #0x24]" "\n"
     "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
+    "add sp, sp, #0x40" "\n"
     "bx lr" "\n"
 );
 
@@ -489,15 +501,15 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "ldr r6, [sp, #0x2c]" "\n"
     "ldr r5, [sp, #0x28]" "\n"
     "ldr r4, [sp, #0x24]" "\n"
     "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
+    "add sp, sp, #0x40" "\n"
     "bx lr" "\n"
 );
 
@@ -506,7 +518,7 @@ asm volatile (
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
 ".thumb" "\n"
-".thumb_func " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ldr r6, [sp, #0x2c]" "\n"
     "ldr r5, [sp, #0x28]" "\n"
@@ -516,7 +528,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "bx lr" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM(ARM)
+#elif COMPILER(GCC) && PLATFORM(ARM_TRADITIONAL)
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
@@ -548,7 +560,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "mov lr, r6" "\n"
     "add r8, pc, #4" "\n"
     "str r8, [sp, #-4]!" "\n"
-    "b " SYMBOL_STRING(cti_vm_throw) "\n"
+    "b " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
 
 // Both has the same return sequence
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
@@ -636,7 +648,7 @@ JITThunks::JITThunks(JSGlobalData* globalData)
 {
     JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallLink, &m_ctiVirtualCall, &m_ctiNativeCallThunk);
 
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
     // Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it contains non POD types),
     // and the OBJECT_OFFSETOF macro does not appear constantish enough for it to be happy with its use in COMPILE_ASSERT
     // macros.
@@ -649,7 +661,7 @@ JITThunks::JITThunks(JSGlobalData* globalData)
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == 0x34);
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, exception) == 0x38);
     // The fifth argument is the first item already on the stack.
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == 0x3c);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == 0x40);
 
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == 0x1C);
 #endif
@@ -673,7 +685,7 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
     JSCell* baseCell = asCell(baseValue);
     Structure* structure = baseCell->structure();
 
-    if (structure->isDictionary()) {
+    if (structure->isUncacheableDictionary()) {
         ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
         return;
     }
@@ -689,7 +701,7 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
         StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-        if (!prototypeChain->isCacheable()) {
+        if (!prototypeChain->isCacheable() || structure->isDictionary()) {
             ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
             return;
         }
@@ -737,7 +749,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
     JSCell* baseCell = asCell(baseValue);
     Structure* structure = baseCell->structure();
 
-    if (structure->isDictionary()) {
+    if (structure->isUncacheableDictionary()) {
         ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
         return;
     }
@@ -876,7 +888,7 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         } \
     } while (0)
 
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM_THUMB2)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
@@ -887,7 +899,7 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         ".align 2" "\n" \
         ".globl " SYMBOL_STRING(cti_##op) "\n" \
         ".thumb" "\n" \
-        ".thumb_func " SYMBOL_STRING(cti_##op) "\n" \
+        ".thumb_func " THUMB_FUNC_PARAM(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
         "str lr, [sp, #0x1c]" "\n" \
         "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
@@ -1148,7 +1160,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     JSObject* slotBaseObject;
     if (baseValue.isCell()
         && slot.isCacheable()
-        && !(structure = asCell(baseValue)->structure())->isDictionary()
+        && !(structure = asCell(baseValue)->structure())->isUncacheableDictionary()
         && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
         && specific
         ) {
@@ -1176,7 +1188,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
         // for now.  For now it performs a check on a special object on the global object only used for this
         // purpose.  The object is in no way exposed, and as such the check will always pass.
         if (slot.slotBase() == baseValue) {
-            JIT::patchMethodCallProto(codeBlock, methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject()->methodCallDummy(), STUB_RETURN_ADDRESS);
+            JIT::patchMethodCallProto(codeBlock, methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject->methodCallDummy(), STUB_RETURN_ADDRESS);
             return JSValue::encode(result);
         }
     }
@@ -1222,7 +1234,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
 
     if (baseValue.isCell()
         && slot.isCacheable()
-        && !asCell(baseValue)->structure()->isDictionary()
+        && !asCell(baseValue)->structure()->isUncacheableDictionary()
         && slot.slotBase() == baseValue) {
 
         CodeBlock* codeBlock = callFrame->codeBlock();
@@ -1293,7 +1305,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
     CHECK_FOR_EXCEPTION();
 
-    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
+    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isUncacheableDictionary()) {
         ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
         return JSValue::encode(result);
     }
@@ -1467,7 +1479,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_new_func)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return stackFrame.args[0].funcDeclNode()->makeFunction(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
+    return stackFrame.args[0].function()->make(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
 }
 
 DEFINE_STUB_FUNCTION(void*, op_call_JSFunction)
@@ -1481,11 +1493,11 @@ DEFINE_STUB_FUNCTION(void*, op_call_JSFunction)
 
     JSFunction* function = asFunction(stackFrame.args[0].jsValue());
     ASSERT(!function->isHostFunction());
-    FunctionBodyNode* body = function->body();
+    FunctionExecutable* executable = function->jsExecutable();
     ScopeChainNode* callDataScopeChain = function->scope().node();
-    body->jitCode(callDataScopeChain);
+    executable->jitCode(stackFrame.callFrame, callDataScopeChain);
 
-    return &(body->generatedBytecode());
+    return function;
 }
 
 DEFINE_STUB_FUNCTION(VoidPtrPair, op_call_arityCheck)
@@ -1493,8 +1505,9 @@ DEFINE_STUB_FUNCTION(VoidPtrPair, op_call_arityCheck)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
-    CodeBlock* newCodeBlock = stackFrame.args[3].codeBlock();
-    ASSERT(newCodeBlock->codeType() != NativeCode);
+    JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
+    ASSERT(!callee->isHostFunction());
+    CodeBlock* newCodeBlock = &callee->jsExecutable()->generatedBytecode();
     int argCount = stackFrame.args[2].int32();
 
     ASSERT(argCount != newCodeBlock->m_numParameters);
@@ -1531,7 +1544,7 @@ DEFINE_STUB_FUNCTION(VoidPtrPair, op_call_arityCheck)
         callFrame->setCallerFrame(oldCallFrame);
     }
 
-    RETURN_POINTER_PAIR(newCodeBlock, callFrame);
+    RETURN_POINTER_PAIR(callee, callFrame);
 }
 
 #if ENABLE(JIT_OPTIMIZE_CALL)
@@ -1539,13 +1552,12 @@ DEFINE_STUB_FUNCTION(void*, vm_lazyLinkCall)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
     JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
-    JITCode& jitCode = callee->body()->generatedJITCode();
+    ExecutableBase* executable = callee->executable();
+    JITCode& jitCode = executable->generatedJITCode();
     
     CodeBlock* codeBlock = 0;
-    if (!callee->isHostFunction())
-        codeBlock = &callee->body()->bytecode(callee->scope().node());
-    else
-        codeBlock = &callee->body()->generatedBytecode();
+    if (!executable->isHostFunction())
+        codeBlock = &static_cast<FunctionExecutable*>(executable)->bytecode(stackFrame.callFrame, callee->scope().node());
     CallLinkInfo* callLinkInfo = &stackFrame.callFrame->callerFrame()->codeBlock()->getCallLinkInfo(stackFrame.args[1].returnAddress());
 
     if (!callLinkInfo->seenOnce())
@@ -1561,7 +1573,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_push_activation)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSActivation* activation = new (stackFrame.globalData) JSActivation(stackFrame.callFrame, static_cast<FunctionBodyNode*>(stackFrame.callFrame->codeBlock()->ownerNode()));
+    JSActivation* activation = new (stackFrame.globalData) JSActivation(stackFrame.callFrame, static_cast<FunctionExecutable*>(stackFrame.callFrame->codeBlock()->ownerExecutable()));
     stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->copy()->push(activation));
     return activation;
 }
@@ -1732,7 +1744,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_construct_JSConstruct)
     if (stackFrame.args[3].jsValue().isObject())
         structure = asObject(stackFrame.args[3].jsValue())->inheritorID();
     else
-        structure = constructor->scope().node()->globalObject()->emptyObjectStructure();
+        structure = constructor->scope().node()->globalObject->emptyObjectStructure();
     return new (stackFrame.globalData) JSObject(structure);
 }
 
@@ -1936,28 +1948,6 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val)
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-DEFINE_STUB_FUNCTION(void, op_put_by_val_array)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    JSValue baseValue = stackFrame.args[0].jsValue();
-    int i = stackFrame.args[1].int32();
-    JSValue value = stackFrame.args[2].jsValue();
-
-    ASSERT(isJSArray(stackFrame.globalData, baseValue));
-
-    if (LIKELY(i >= 0))
-        asArray(baseValue)->JSArray::put(callFrame, i, value);
-    else {
-        Identifier property(callFrame, UString::from(i));
-        PutPropertySlot slot;
-        baseValue.put(callFrame, property, value, slot);
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
 DEFINE_STUB_FUNCTION(void, op_put_by_val_byte_array)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2042,7 +2032,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
             stackFrame.globalData->exception = createStackOverflowError(callFrame);
             VM_THROW_EXCEPTION();
         }
-        int32_t expectedParams = callFrame->callee()->body()->parameterCount();
+        int32_t expectedParams = callFrame->callee()->jsExecutable()->parameterCount();
         int32_t inplaceArgs = min(providedParams, expectedParams);
         
         Register* inplaceArgsDst = callFrame->registers() + argsOffset;
@@ -2182,7 +2172,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
+        if (slot.isCacheable() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
             if (globalResolveInfo.structure)
                 globalResolveInfo.structure->deref();
@@ -2358,8 +2348,6 @@ DEFINE_STUB_FUNCTION(int, op_eq)
     if (src1.isNull())
         return src2.isCell() && asCell(src2)->structure()->typeInfo().masqueradesAsUndefined();
 
-    ASSERT(src1.isCell());
-
     JSCell* cell1 = asCell(src1);
 
     if (cell1->isString()) {
@@ -2375,21 +2363,18 @@ DEFINE_STUB_FUNCTION(int, op_eq)
         if (src2.isFalse())
             return static_cast<JSString*>(cell1)->value().toDouble() == 0.0;
 
-        ASSERT(src2.isCell());
         JSCell* cell2 = asCell(src2);
         if (cell2->isString())
             return static_cast<JSString*>(cell1)->value() == static_cast<JSString*>(cell2)->value();
 
-        ASSERT(cell2->isObject());
-        src2 = static_cast<JSObject*>(cell2)->toPrimitive(stackFrame.callFrame);
+        src2 = asObject(cell2)->toPrimitive(stackFrame.callFrame);
         CHECK_FOR_EXCEPTION();
         goto start;
     }
 
-    ASSERT(cell1->isObject());
     if (src2.isObject())
-        return static_cast<JSObject*>(cell1) == asObject(src2);
-    src1 = static_cast<JSObject*>(cell1)->toPrimitive(stackFrame.callFrame);
+        return asObject(cell1) == asObject(src2);
+    src1 = asObject(cell1)->toPrimitive(stackFrame.callFrame);
     CHECK_FOR_EXCEPTION();
     goto start;
 }
@@ -2517,8 +2502,24 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_base)
 DEFINE_STUB_FUNCTION(JSObject*, op_new_func_exp)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    FunctionExecutable* function = stackFrame.args[0].function();
+    JSFunction* func = function->make(callFrame, callFrame->scopeChain());
+
+    /* 
+        The Identifier in a FunctionExpression can be referenced from inside
+        the FunctionExpression's FunctionBody to allow the function to call
+        itself recursively. However, unlike in a FunctionDeclaration, the
+        Identifier in a FunctionExpression cannot be referenced from and
+        does not affect the scope enclosing the FunctionExpression.
+     */
+    if (!function->name().isNull()) {
+        JSStaticScopeObject* functionScopeObject = new (callFrame) JSStaticScopeObject(callFrame, function->name(), func, ReadOnly | DontDelete);
+        func->scope().push(functionScopeObject);
+    }
 
-    return stackFrame.args[0].funcExprNode()->makeFunction(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
+    return func;
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_mod)
@@ -2624,7 +2625,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_eval)
     Register* newCallFrame = callFrame->registers() + registerOffset;
     Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
     JSValue thisValue = argv[0].jsValue();
-    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
+    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject;
 
     if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
         JSValue exceptionValue;
@@ -2978,7 +2979,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_new_error)
     unsigned bytecodeOffset = stackFrame.args[2].int32();
 
     unsigned lineNumber = codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset);
-    return Error::create(callFrame, static_cast<ErrorType>(type), message.toString(callFrame), lineNumber, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+    return Error::create(callFrame, static_cast<ErrorType>(type), message.toString(callFrame), lineNumber, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
 }
 
 DEFINE_STUB_FUNCTION(void, op_debug)
diff --git a/JavaScriptCore/jit/JITStubs.h b/JavaScriptCore/jit/JITStubs.h
index 8f02435..daae043 100644
--- a/JavaScriptCore/jit/JITStubs.h
+++ b/JavaScriptCore/jit/JITStubs.h
@@ -42,6 +42,7 @@ namespace JSC {
 
     class CodeBlock;
     class ExecutablePool;
+    class FunctionExecutable;
     class Identifier;
     class JSGlobalData;
     class JSGlobalData;
@@ -53,8 +54,6 @@ namespace JSC {
     class PropertySlot;
     class PutPropertySlot;
     class RegisterFile;
-    class FuncDeclNode;
-    class FuncExprNode;
     class JSGlobalObject;
     class RegExp;
 
@@ -67,8 +66,7 @@ namespace JSC {
         Identifier& identifier() { return *static_cast<Identifier*>(asPointer); }
         int32_t int32() { return asInt32; }
         CodeBlock* codeBlock() { return static_cast<CodeBlock*>(asPointer); }
-        FuncDeclNode* funcDeclNode() { return static_cast<FuncDeclNode*>(asPointer); }
-        FuncExprNode* funcExprNode() { return static_cast<FuncExprNode*>(asPointer); }
+        FunctionExecutable* function() { return static_cast<FunctionExecutable*>(asPointer); }
         RegExp* regExp() { return static_cast<RegExp*>(asPointer); }
         JSPropertyNameIterator* propertyNameIterator() { return static_cast<JSPropertyNameIterator*>(asPointer); }
         JSGlobalObject* globalObject() { return static_cast<JSGlobalObject*>(asPointer); }
@@ -131,7 +129,7 @@ namespace JSC {
 #if COMPILER(MSVC)
 #pragma pack(pop)
 #endif // COMPILER(MSVC)
-#elif PLATFORM_ARM_ARCH(7)
+#elif PLATFORM(ARM_THUMB2)
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -151,13 +149,15 @@ namespace JSC {
         CallFrame* callFrame;
         JSValue* exception;
 
+        void* padding2;
+
         // These arguments passed on the stack.
         Profiler** enabledProfilerReference;
         JSGlobalData* globalData;
         
         ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
     };
-#elif PLATFORM(ARM)
+#elif PLATFORM(ARM_TRADITIONAL)
     struct JITStackFrame {
         JITStubArg padding; // Unused
         JITStubArg args[7];
@@ -345,7 +345,6 @@ extern "C" {
     void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_by_index(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_by_val(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_val_array(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_getter(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_setter(STUB_ARGS_DECLARATION);
diff --git a/JavaScriptCore/jsc.cpp b/JavaScriptCore/jsc.cpp
index 92b1e58..9399b1a 100644
--- a/JavaScriptCore/jsc.cpp
+++ b/JavaScriptCore/jsc.cpp
@@ -24,6 +24,7 @@
 
 #include "BytecodeGenerator.h"
 #include "Completion.h"
+#include "CurrentTime.h"
 #include "InitializeThreading.h"
 #include "JSArray.h"
 #include "JSFunction.h"
@@ -118,53 +119,23 @@ public:
     long getElapsedMS(); // call stop() first
 
 private:
-#if PLATFORM(QT)
-    uint m_startTime;
-    uint m_stopTime;
-#elif PLATFORM(WIN_OS)
-    DWORD m_startTime;
-    DWORD m_stopTime;
-#else
-    // Windows does not have timeval, disabling this class for now (bug 7399)
-    timeval m_startTime;
-    timeval m_stopTime;
-#endif
+    double m_startTime;
+    double m_stopTime;
 };
 
 void StopWatch::start()
 {
-#if PLATFORM(QT)
-    QDateTime t = QDateTime::currentDateTime();
-    m_startTime = t.toTime_t() * 1000 + t.time().msec();
-#elif PLATFORM(WIN_OS)
-    m_startTime = timeGetTime();
-#else
-    gettimeofday(&m_startTime, 0);
-#endif
+    m_startTime = currentTime();
 }
 
 void StopWatch::stop()
 {
-#if PLATFORM(QT)
-    QDateTime t = QDateTime::currentDateTime();
-    m_stopTime = t.toTime_t() * 1000 + t.time().msec();
-#elif PLATFORM(WIN_OS)
-    m_stopTime = timeGetTime();
-#else
-    gettimeofday(&m_stopTime, 0);
-#endif
+    m_stopTime = currentTime();
 }
 
 long StopWatch::getElapsedMS()
 {
-#if PLATFORM(WIN_OS) || PLATFORM(QT)
-    return m_stopTime - m_startTime;
-#else
-    timeval elapsedTime;
-    timersub(&m_stopTime, &m_startTime, &elapsedTime);
-
-    return elapsedTime.tv_sec * 1000 + lroundf(elapsedTime.tv_usec / 1000.0f);
-#endif
+    return static_cast<long>((m_stopTime - m_startTime) * 1000);
 }
 
 class GlobalObject : public JSGlobalObject {
@@ -389,11 +360,8 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scr
     if (dump)
         BytecodeGenerator::setDumpsGeneratedCode(true);
 
-#if ENABLE(OPCODE_SAMPLING)
-    Interpreter* interpreter = globalObject->globalData()->interpreter;
-    interpreter->setSampler(new SamplingTool(interpreter));
-    interpreter->sampler()->setup();
-#endif
+    JSGlobalData* globalData = globalObject->globalData();
+
 #if ENABLE(SAMPLING_FLAGS)
     SamplingFlags::start();
 #endif
@@ -410,9 +378,7 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scr
             fileName = "[Command Line]";
         }
 
-#if ENABLE(SAMPLING_THREAD)
-        SamplingThread::start();
-#endif
+        globalData->startSampling();
 
         Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script, fileName));
         success = success && completion.complType() != Throw;
@@ -423,20 +389,14 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scr
                 printf("End: %s\n", completion.value().toString(globalObject->globalExec()).ascii());
         }
 
-#if ENABLE(SAMPLING_THREAD)
-        SamplingThread::stop();
-#endif
-
+        globalData->stopSampling();
         globalObject->globalExec()->clearException();
     }
 
 #if ENABLE(SAMPLING_FLAGS)
     SamplingFlags::stop();
 #endif
-#if ENABLE(OPCODE_SAMPLING)
-    interpreter->sampler()->dump(globalObject->globalExec());
-    delete interpreter->sampler();
-#endif
+    globalData->dumpSampleData(globalObject->globalExec());
 #if ENABLE(SAMPLING_COUNTERS)
     AbstractSamplingCounter::dump();
 #endif
diff --git a/JavaScriptCore/os-win32/stdbool.h b/JavaScriptCore/os-win32/stdbool.h
index 8e7bace..fc8ee28 100644
--- a/JavaScriptCore/os-win32/stdbool.h
+++ b/JavaScriptCore/os-win32/stdbool.h
@@ -21,8 +21,8 @@
 #ifndef STDBOOL_WIN32_H
 #define STDBOOL_WIN32_H
 
-#if !PLATFORM(WIN_OS)
-#error "This stdbool.h file should only be compiled under Windows"
+#if !COMPILER(MSVC)
+#error "This stdbool.h file should only be compiled with MSVC"
 #endif
 
 #ifndef __cplusplus
diff --git a/JavaScriptCore/os-win32/stdint.h b/JavaScriptCore/os-win32/stdint.h
index efab2ae..1d8787e 100644
--- a/JavaScriptCore/os-win32/stdint.h
+++ b/JavaScriptCore/os-win32/stdint.h
@@ -23,10 +23,11 @@
 
 #include <wtf/Platform.h>
 
-/* This file emulates enough of stdint.h on Windows to make JavaScriptCore and WebCore compile. */
+/* This file emulates enough of stdint.h on Windows to make JavaScriptCore and WebCore
+   compile using MSVC which does not ship with the stdint.h header. */
 
-#if !PLATFORM(WIN_OS)
-#error "This stdint.h file should only be compiled under Windows"
+#if !COMPILER(MSVC)
+#error "This stdint.h file should only be compiled with MSVC"
 #endif
 
 #include <limits.h>
diff --git a/JavaScriptCore/parser/Grammar.y b/JavaScriptCore/parser/Grammar.y
index 354c786..85fd163 100644
--- a/JavaScriptCore/parser/Grammar.y
+++ b/JavaScriptCore/parser/Grammar.y
@@ -25,18 +25,12 @@
 
 #include "config.h"
 
-#include <string.h>
-#include <stdlib.h>
-#include "JSValue.h"
 #include "JSObject.h"
-#include "NodeConstructors.h"
-#include "Lexer.h"
 #include "JSString.h"
-#include "JSGlobalData.h"
-#include "CommonIdentifiers.h"
+#include "NodeConstructors.h"
 #include "NodeInfo.h"
-#include "Parser.h"
-#include <wtf/FastMalloc.h>
+#include <stdlib.h>
+#include <string.h>
 #include <wtf/MathExtras.h>
 
 #define YYMALLOC fastMalloc
@@ -45,46 +39,44 @@
 #define YYMAXDEPTH 10000
 #define YYENABLE_NLS 0
 
-/* default values for bison */
+// Default values for bison.
 #define YYDEBUG 0 // Set to 1 to debug a parse error.
 #define jscyydebug 0 // Set to 1 to debug a parse error.
 #if !PLATFORM(DARWIN)
-    // avoid triggering warnings in older bison
+// Avoid triggering warnings in older bison by not setting this on the Darwin platform.
+// FIXME: Is this still needed?
 #define YYERROR_VERBOSE
 #endif
 
 int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
+
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
 
 #define GLOBAL_DATA static_cast<JSGlobalData*>(globalPtr)
-#define LEXER (GLOBAL_DATA->lexer)
-
-#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*LEXER, yychar)) YYABORT; } while (0)
-#define SET_EXCEPTION_LOCATION(node, start, divot, end) node->setExceptionSourceCode((divot), (divot) - (start), (end) - (divot))
-#define DBG(l, s, e) (l)->setLoc((s).first_line, (e).last_line)
+#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*GLOBAL_DATA->lexer, yychar)) YYABORT; } while (0)
 
 using namespace JSC;
 using namespace std;
 
-static ExpressionNode* makeAssignNode(void*, ExpressionNode* loc, Operator, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end);
-static ExpressionNode* makePrefixNode(void*, ExpressionNode* expr, Operator, int start, int divot, int end);
-static ExpressionNode* makePostfixNode(void*, ExpressionNode* expr, Operator, int start, int divot, int end);
-static PropertyNode* makeGetterOrSetterPropertyNode(void*, const Identifier &getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
-static ExpressionNodeInfo makeFunctionCallNode(void*, ExpressionNodeInfo func, ArgumentsNodeInfo, int start, int divot, int end);
-static ExpressionNode* makeTypeOfNode(void*, ExpressionNode*);
-static ExpressionNode* makeDeleteNode(void*, ExpressionNode*, int start, int divot, int end);
-static ExpressionNode* makeNegateNode(void*, ExpressionNode*);
-static NumberNode* makeNumberNode(void*, double);
-static ExpressionNode* makeBitwiseNotNode(void*, ExpressionNode*);
-static ExpressionNode* makeMultNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeDivNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeAddNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
+static ExpressionNode* makeAssignNode(JSGlobalData*, ExpressionNode* left, Operator, ExpressionNode* right, bool leftHasAssignments, bool rightHasAssignments, int start, int divot, int end);
+static ExpressionNode* makePrefixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
+static ExpressionNode* makePostfixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
+static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData*, const Identifier& getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
+static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData*, ExpressionNodeInfo function, ArgumentsNodeInfo, int start, int divot, int end);
+static ExpressionNode* makeTypeOfNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* makeDeleteNode(JSGlobalData*, ExpressionNode*, int start, int divot, int end);
+static ExpressionNode* makeNegateNode(JSGlobalData*, ExpressionNode*);
+static NumberNode* makeNumberNode(JSGlobalData*, double);
+static ExpressionNode* makeBitwiseNotNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* makeMultNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeDivNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeAddNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeSubNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeLeftShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeRightShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static StatementNode* makeVarStatementNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* combineCommaNodes(JSGlobalData*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -97,17 +89,17 @@ static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, Expression
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
-                                                                       CodeFeatures info,
-                                                                       int numConstants) 
+template <typename T> inline NodeDeclarationInfo<T> createNodeDeclarationInfo(T node,
+    ParserArenaData<DeclarationStacks::VarStack>* varDecls,
+    ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
+    CodeFeatures info, int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
     NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
-template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
+template <typename T> inline NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
     NodeInfo<T> result = { node, info, numConstants };
@@ -133,21 +125,20 @@ template <typename T> inline T mergeDeclarationLists(T decls1, T decls2)
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-
-    varDecls->data.append(make_pair(ident, attrs));
+        varDecls = new (globalData) ParserArenaData<DeclarationStacks::VarStack>;
 
+    varDecls->data.append(make_pair(&ident, attrs));
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
     if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
+    appendToVarDeclarationList(globalData, varDecls, decl->ident(), attrs);
 }
 
 %}
@@ -155,7 +146,7 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<D
 %union {
     int                 intValue;
     double              doubleValue;
-    Identifier*         ident;
+    const Identifier*   ident;
 
     // expression subtrees
     ExpressionNodeInfo  expressionNode;
@@ -184,6 +175,20 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<D
     Operator            op;
 }
 
+%{
+
+template <typename T> inline void setStatementLocation(StatementNode* statement, const T& start, const T& end)
+{
+    statement->setLoc(start.first_line, end.last_line);
+}
+
+static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned start, unsigned divot, unsigned end)
+{
+    node->setExceptionSourceCode(divot, divot - start, end - divot);
+}
+
+%}
+
 %start Program
 
 /* literals */
@@ -291,21 +296,25 @@ Literal:
   | NUMBER                              { $$ = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, $1), 0, 1); }
   | STRING                              { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *$1), 0, 1); }
   | '/' /* regexp */                    {
-                                            Lexer& l = *LEXER;
-                                            if (!l.scanRegExp())
+                                            Lexer& l = *GLOBAL_DATA->lexer;
+                                            const Identifier* pattern;
+                                            const Identifier* flags;
+                                            if (!l.scanRegExp(pattern, flags))
                                                 YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
-                                            int size = l.pattern().size() + 2; // + 2 for the two /'s
-                                            SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
+                                            int size = pattern->size() + 2; // + 2 for the two /'s
+                                            setExceptionLocation(node, @1.first_column, @1.first_column + size, @1.first_column + size);
                                             $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
                                         }
   | DIVEQUAL /* regexp with /= */       {
-                                            Lexer& l = *LEXER;
-                                            if (!l.scanRegExp())
+                                            Lexer& l = *GLOBAL_DATA->lexer;
+                                            const Identifier* pattern;
+                                            const Identifier* flags;
+                                            if (!l.scanRegExp(pattern, flags, '='))
                                                 YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
-                                            int size = l.pattern().size() + 2; // + 2 for the two /'s
-                                            SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
+                                            int size = pattern->size() + 2; // + 2 for the two /'s
+                                            setExceptionLocation(node, @1.first_column, @1.first_column + size, @1.first_column + size);
                                             $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
                                         }
 ;
@@ -313,14 +322,14 @@ Literal:
 Property:
     IDENT ':' AssignmentExpr            { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
   | STRING ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from($1)), $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | IDENT IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE    { $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *$1, *$2, 0, $6, LEXER->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); DBG($6, @5, @7); if (!$$.m_node) YYABORT; }
+  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, $1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+  | IDENT IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE    { $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *$1, *$2, 0, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); setStatementLocation($6, @5, @7); if (!$$.m_node) YYABORT; }
   | IDENT IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
                                                              {
-                                                                 $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *$1, *$2, $4.m_node.head, $7, LEXER->sourceCode($6, $8, @6.first_line)), $4.m_features | ClosureFeature, 0); 
+                                                                 $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *$1, *$2, $4.m_node.head, $7, GLOBAL_DATA->lexer->sourceCode($6, $8, @6.first_line)), $4.m_features | ClosureFeature, 0); 
                                                                  if ($4.m_features & ArgumentsFeature)
                                                                      $7->setUsesArguments(); 
-                                                                 DBG($7, @6, @8); 
+                                                                 setStatementLocation($7, @6, @8); 
                                                                  if (!$$.m_node) 
                                                                      YYABORT; 
                                                              }
@@ -385,15 +394,15 @@ MemberExpr:
     PrimaryExpr
   | FunctionExpr                        { $$ = createNodeInfo<ExpressionNode*>($1.m_node, $1.m_features, $1.m_numConstants); }
   | MemberExpr '[' Expr ']'             { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
   | MemberExpr '.' IDENT                { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
                                         }
   | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
                                         }
 ;
@@ -401,15 +410,15 @@ MemberExpr:
 MemberExprNoBF:
     PrimaryExprNoBrace
   | MemberExprNoBF '[' Expr ']'         { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
   | MemberExprNoBF '.' IDENT            { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
                                         }
   | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
                                         }
 ;
@@ -417,7 +426,7 @@ MemberExprNoBF:
 NewExpr:
     MemberExpr
   | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants); 
                                         }
 ;
@@ -425,32 +434,32 @@ NewExpr:
 NewExprNoBF:
     MemberExprNoBF
   | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants);
                                         }
 ;
 
 CallExpr:
-    MemberExpr Arguments                { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExpr Arguments                  { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
+    MemberExpr Arguments                { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
+  | CallExpr Arguments                  { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
   | CallExpr '[' Expr ']'               { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
   | CallExpr '.' IDENT                  { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); }
 ;
 
 CallExprNoBF:
-    MemberExprNoBF Arguments            { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExprNoBF Arguments              { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
+    MemberExprNoBF Arguments            { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
+  | CallExprNoBF Arguments              { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
   | CallExprNoBF '[' Expr ']'           { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
   | CallExprNoBF '.' IDENT              { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); 
                                         }
 ;
@@ -568,10 +577,10 @@ RelationalExpr:
   | RelationalExpr LE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExpr GE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExpr INSTANCEOF ShiftExpr { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
+                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExpr INTOKEN ShiftExpr    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
+                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
@@ -583,7 +592,7 @@ RelationalExprNoIn:
   | RelationalExprNoIn GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoIn INSTANCEOF ShiftExpr
                                         { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
+                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
@@ -595,11 +604,11 @@ RelationalExprNoBF:
   | RelationalExprNoBF GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoBF INSTANCEOF ShiftExpr
                                         { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
+                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoBF INTOKEN ShiftExpr 
                                         { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
+                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
@@ -810,17 +819,17 @@ Statement:
 ;
 
 Block:
-    OPENBRACE CLOSEBRACE                             { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @2); }
-  | OPENBRACE SourceElements CLOSEBRACE              { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          DBG($$.m_node, @1, @3); }
+    OPENBRACE CLOSEBRACE                { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
+                                          setStatementLocation($$.m_node, @1, @2); }
+  | OPENBRACE SourceElements CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+                                          setStatementLocation($$.m_node, @1, @3); }
 ;
 
 VariableStatement:
     VAR VariableDeclarationList ';'     { $$ = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          DBG($$.m_node, @1, @3); }
+                                          setStatementLocation($$.m_node, @1, @3); }
   | VAR VariableDeclarationList error   { $$ = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          DBG($$.m_node, @1, @2);
+                                          setStatementLocation($$.m_node, @1, @2);
                                           AUTO_SEMICOLON; }
 ;
 
@@ -833,7 +842,7 @@ VariableDeclarationList:
                                           $$.m_numConstants = 0;
                                         }
   | IDENT Initializer                   { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.first_column + 1, @2.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.first_column + 1, @2.last_column);
                                           $$.m_node = node;
                                           $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
@@ -851,7 +860,7 @@ VariableDeclarationList:
                                         }
   | VariableDeclarationList ',' IDENT Initializer
                                         { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
+                                          setExceptionLocation(node, @3.first_column, @4.first_column + 1, @4.last_column);
                                           $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
@@ -870,7 +879,7 @@ VariableDeclarationListNoIn:
                                           $$.m_numConstants = 0;
                                         }
   | IDENT InitializerNoIn               { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.first_column + 1, @2.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.first_column + 1, @2.last_column);
                                           $$.m_node = node;
                                           $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
@@ -888,7 +897,7 @@ VariableDeclarationListNoIn:
                                         }
   | VariableDeclarationListNoIn ',' IDENT InitializerNoIn
                                         { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
+                                          setExceptionLocation(node, @3.first_column, @4.first_column + 1, @4.last_column);
                                           $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
@@ -900,10 +909,10 @@ VariableDeclarationListNoIn:
 
 ConstStatement:
     CONSTTOKEN ConstDeclarationList ';' { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          DBG($$.m_node, @1, @3); }
+                                          setStatementLocation($$.m_node, @1, @3); }
   | CONSTTOKEN ConstDeclarationList error
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 ConstDeclarationList:
@@ -945,36 +954,36 @@ EmptyStatement:
 
 ExprStatement:
     ExprNoBF ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
   | ExprNoBF error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
-                                          DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+                                          setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
 ;
 
 IfStatement:
     IF '(' Expr ')' Statement %prec IF_WITHOUT_ELSE
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
-                                          DBG($$.m_node, @1, @4); }
+                                          setStatementLocation($$.m_node, @1, @4); }
   | IF '(' Expr ')' Statement ELSE Statement
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node), 
                                                                                          mergeDeclarationLists($5.m_varDeclarations, $7.m_varDeclarations),
                                                                                          mergeDeclarationLists($5.m_funcDeclarations, $7.m_funcDeclarations),
                                                                                          $3.m_features | $5.m_features | $7.m_features,
                                                                                          $3.m_numConstants + $5.m_numConstants + $7.m_numConstants); 
-                                          DBG($$.m_node, @1, @4); }
+                                          setStatementLocation($$.m_node, @1, @4); }
 ;
 
 IterationStatement:
     DO Statement WHILE '(' Expr ')' ';'    { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
-                                             DBG($$.m_node, @1, @3); }
+                                             setStatementLocation($$.m_node, @1, @3); }
   | DO Statement WHILE '(' Expr ')' error  { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
-                                             DBG($$.m_node, @1, @3); } // Always performs automatic semicolon insertion.
+                                             setStatementLocation($$.m_node, @1, @3); } // Always performs automatic semicolon insertion.
   | WHILE '(' Expr ')' Statement        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
-                                          DBG($$.m_node, @1, @4); }
+                                          setStatementLocation($$.m_node, @1, @4); }
   | FOR '(' ExprNoInOpt ';' ExprOpt ';' ExprOpt ')' Statement
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node, $9.m_node, false), $9.m_varDeclarations, $9.m_funcDeclarations, 
                                                                                          $3.m_features | $5.m_features | $7.m_features | $9.m_features,
                                                                                          $3.m_numConstants + $5.m_numConstants + $7.m_numConstants + $9.m_numConstants);
-                                          DBG($$.m_node, @1, @8); 
+                                          setStatementLocation($$.m_node, @1, @8); 
                                         }
   | FOR '(' VAR VariableDeclarationListNoIn ';' ExprOpt ';' ExprOpt ')' Statement
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $4.m_node, $6.m_node, $8.m_node, $10.m_node, true),
@@ -982,30 +991,30 @@ IterationStatement:
                                                                                          mergeDeclarationLists($4.m_funcDeclarations, $10.m_funcDeclarations),
                                                                                          $4.m_features | $6.m_features | $8.m_features | $10.m_features,
                                                                                          $4.m_numConstants + $6.m_numConstants + $8.m_numConstants + $10.m_numConstants);
-                                          DBG($$.m_node, @1, @9); }
+                                          setStatementLocation($$.m_node, @1, @9); }
   | FOR '(' LeftHandSideExpr INTOKEN Expr ')' Statement
                                         {
                                             ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node);
-                                            SET_EXCEPTION_LOCATION(node, @3.first_column, @3.last_column, @5.last_column);
+                                            setExceptionLocation(node, @3.first_column, @3.last_column, @5.last_column);
                                             $$ = createNodeDeclarationInfo<StatementNode*>(node, $7.m_varDeclarations, $7.m_funcDeclarations,
                                                                                            $3.m_features | $5.m_features | $7.m_features,
                                                                                            $3.m_numConstants + $5.m_numConstants + $7.m_numConstants);
-                                            DBG($$.m_node, @1, @6);
+                                            setStatementLocation($$.m_node, @1, @6);
                                         }
   | FOR '(' VAR IDENT INTOKEN Expr ')' Statement
                                         { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, 0, $6.m_node, $8.m_node, @5.first_column, @5.first_column - @4.first_column, @6.last_column - @5.first_column);
-                                          SET_EXCEPTION_LOCATION(forIn, @4.first_column, @5.first_column + 1, @6.last_column);
+                                          setExceptionLocation(forIn, @4.first_column, @5.first_column + 1, @6.last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, $8.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $8.m_varDeclarations, $8.m_funcDeclarations, ((*$4 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $6.m_features | $8.m_features, $6.m_numConstants + $8.m_numConstants);
-                                          DBG($$.m_node, @1, @7); }
+                                          setStatementLocation($$.m_node, @1, @7); }
   | FOR '(' VAR IDENT InitializerNoIn INTOKEN Expr ')' Statement
                                         { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, $5.m_node, $7.m_node, $9.m_node, @5.first_column, @5.first_column - @4.first_column, @5.last_column - @5.first_column);
-                                          SET_EXCEPTION_LOCATION(forIn, @4.first_column, @6.first_column + 1, @7.last_column);
+                                          setExceptionLocation(forIn, @4.first_column, @6.first_column + 1, @7.last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, $9.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $9.m_varDeclarations, $9.m_funcDeclarations,
                                                                                          ((*$4 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $5.m_features | $7.m_features | $9.m_features,
                                                                                          $5.m_numConstants + $7.m_numConstants + $9.m_numConstants);
-                                          DBG($$.m_node, @1, @8); }
+                                          setStatementLocation($$.m_node, @1, @8); }
 ;
 
 ExprOpt:
@@ -1020,63 +1029,63 @@ ExprNoInOpt:
 
 ContinueStatement:
     CONTINUE ';'                        { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
   | CONTINUE error                      { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+                                          setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
   | CONTINUE IDENT ';'                  { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @3); }
+                                          setStatementLocation($$.m_node, @1, @3); }
   | CONTINUE IDENT error                { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 BreakStatement:
     BREAK ';'                           { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @2); }
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @2); }
   | BREAK error                         { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
   | BREAK IDENT ';'                     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @3); }
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @3); }
   | BREAK IDENT error                   { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 ReturnStatement:
     RETURN ';'                          { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @2); }
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @2); }
   | RETURN error                        { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
   | RETURN Expr ';'                     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @3); }
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @3); }
   | RETURN Expr error                   { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column); 
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 WithStatement:
     WITH '(' Expr ')' Statement         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, $3.m_node, $5.m_node, @3.last_column, @3.last_column - @3.first_column),
                                                                                          $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features | WithFeature, $3.m_numConstants + $5.m_numConstants);
-                                          DBG($$.m_node, @1, @4); }
+                                          setStatementLocation($$.m_node, @1, @4); }
 ;
 
 SwitchStatement:
     SWITCH '(' Expr ')' CaseBlock       { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations,
                                                                                          $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
-                                          DBG($$.m_node, @1, @4); }
+                                          setStatementLocation($$.m_node, @1, @4); }
 ;
 
 CaseBlock:
@@ -1090,7 +1099,7 @@ CaseBlock:
 ;
 
 CaseClausesOpt:
-/* nothing */                       { $$.m_node.head = 0; $$.m_node.tail = 0; $$.m_varDeclarations = 0; $$.m_funcDeclarations = 0; $$.m_features = 0; $$.m_numConstants = 0; }
+  /* nothing */                         { $$.m_node.head = 0; $$.m_node.tail = 0; $$.m_varDeclarations = 0; $$.m_funcDeclarations = 0; $$.m_features = 0; $$.m_numConstants = 0; }
   | CaseClauses
 ;
 
@@ -1122,18 +1131,18 @@ DefaultClause:
 
 LabelledStatement:
     IDENT ':' Statement                 { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *$1, $3.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
 ;
 
 ThrowStatement:
     THROW Expr ';'                      { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @2);
                                         }
   | THROW Expr error                    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; 
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; 
                                         }
 ;
 
@@ -1143,57 +1152,57 @@ TryStatement:
                                                                                          mergeDeclarationLists($2.m_funcDeclarations, $4.m_funcDeclarations),
                                                                                          $2.m_features | $4.m_features,
                                                                                          $2.m_numConstants + $4.m_numConstants);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
   | TRY Block CATCH '(' IDENT ')' Block { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, 0),
                                                                                          mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations),
                                                                                          mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations),
                                                                                          $2.m_features | $7.m_features | CatchFeature,
                                                                                          $2.m_numConstants + $7.m_numConstants);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
   | TRY Block CATCH '(' IDENT ')' Block FINALLY Block
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, $9.m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations), $9.m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations), $9.m_funcDeclarations),
                                                                                          $2.m_features | $7.m_features | $9.m_features | CatchFeature,
                                                                                          $2.m_numConstants + $7.m_numConstants + $9.m_numConstants);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
 ;
 
 DebuggerStatement:
     DEBUGGER ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
   | DEBUGGER error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+                                          setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
 ;
 
 FunctionDeclaration:
-    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $6, LEXER->sourceCode($5, $7, @5.first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)); }
+    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *$2, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)->body()); }
   | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
-      { 
-          $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $7, LEXER->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0); 
+      {
+          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *$2, $7, GLOBAL_DATA->lexer->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0);
           if ($4.m_features & ArgumentsFeature)
-              $7->setUsesArguments(); 
-          DBG($7, @6, @8);
-          $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node));
+              $7->setUsesArguments();
+          setStatementLocation($7, @6, @8);
+          $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)->body());
       }
 ;
 
 FunctionExpr:
-    FUNCTION '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, $5, LEXER->sourceCode($4, $6, @4.first_line)), ClosureFeature, 0); DBG($5, @4, @6); }
-    | FUNCTION '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE 
-      { 
-          $$ = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, $6, LEXER->sourceCode($5, $7, @5.first_line), $3.m_node.head), $3.m_features | ClosureFeature, 0); 
-          if ($3.m_features & ArgumentsFeature) 
+    FUNCTION '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, $5, GLOBAL_DATA->lexer->sourceCode($4, $6, @4.first_line)), ClosureFeature, 0); setStatementLocation($5, @4, @6); }
+    | FUNCTION '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
+      {
+          $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line), $3.m_node.head), $3.m_features | ClosureFeature, 0);
+          if ($3.m_features & ArgumentsFeature)
               $6->setUsesArguments();
-          DBG($6, @5, @7); 
+          setStatementLocation($6, @5, @7);
       }
-  | FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *$2, $6, LEXER->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); DBG($6, @5, @7); }
-  | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE 
-      { 
-          $$ = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *$2, $7, LEXER->sourceCode($6, $8, @6.first_line), $4.m_node.head), $4.m_features | ClosureFeature, 0); 
+  | FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *$2, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); setStatementLocation($6, @5, @7); }
+  | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
+      {
+          $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *$2, $7, GLOBAL_DATA->lexer->sourceCode($6, $8, @6.first_line), $4.m_node.head), $4.m_features | ClosureFeature, 0); 
           if ($4.m_features & ArgumentsFeature)
               $7->setUsesArguments();
-          DBG($7, @6, @8); 
+          setStatementLocation($7, @6, @8);
       }
 ;
 
@@ -1241,8 +1250,8 @@ Literal_NoNode:
   | FALSETOKEN
   | NUMBER { }
   | STRING { }
-  | '/' /* regexp */ { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; }
-  | DIVEQUAL /* regexp with /= */ { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; }
+  | '/' /* regexp */ { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; }
+  | DIVEQUAL /* regexp with /= */ { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; }
 ;
 
 Property_NoNode:
@@ -1824,26 +1833,28 @@ SourceElements_NoNode:
 
 %%
 
-static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
+#undef GLOBAL_DATA
+
+static ExpressionNode* makeAssignNode(JSGlobalData* globalData, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (globalData) AssignErrorNode(globalData, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
-            SET_EXCEPTION_LOCATION(node, start, divot, end);
+            AssignResolveNode* node = new (globalData) AssignResolveNode(globalData, resolve->identifier(), expr, exprHasAssignments);
+            setExceptionLocation(node, start, divot, end);
             return node;
         } else
-            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (globalData) ReadModifyResolveNode(globalData, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (globalData) AssignBracketNode(globalData, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (globalData) ReadModifyBracketNode(globalData, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -1851,117 +1862,117 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (globalData) AssignDotNode(globalData, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (globalData) ReadModifyDotNode(globalData, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
 
-static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
+static ExpressionNode* makePrefixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (globalData) PrefixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (globalData) PrefixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (globalData) PrefixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (globalData) PrefixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
 
-static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
+static ExpressionNode* makePostfixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (globalData) PostfixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (globalData) PostfixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (globalData) PostfixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (globalData) PostfixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
 
-static ExpressionNodeInfo makeFunctionCallNode(void* globalPtr, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
+static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData* globalData, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
 {
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallValueNode(globalData, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
-        if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        if (identifier == globalData->propertyNames->eval)
+            return createNodeInfo<ExpressionNode*>(new (globalData) EvalFunctionCallNode(globalData, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallResolveNode(globalData, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (globalData) FunctionCallBracketNode(globalData, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
     FunctionCallDotNode* node;
-    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
-        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
-        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    if (dot->identifier() == globalData->propertyNames->call)
+        node = new (globalData) CallFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == globalData->propertyNames->apply)
+        node = new (globalData) ApplyFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     else
-        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+        node = new (globalData) FunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
 
-static ExpressionNode* makeTypeOfNode(void* globalPtr, ExpressionNode* expr)
+static ExpressionNode* makeTypeOfNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (globalData) TypeOfResolveNode(globalData, resolve->identifier());
     }
-    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (globalData) TypeOfValueNode(globalData, expr);
 }
 
-static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
+static ExpressionNode* makeDeleteNode(JSGlobalData* globalData, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
+        return new (globalData) DeleteValueNode(globalData, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (globalData) DeleteResolveNode(globalData, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (globalData) DeleteBracketNode(globalData, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (globalData) DeleteDotNode(globalData, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
-static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
+static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
 {
     PropertyNode::Type type;
     if (getOrSet == "get")
@@ -1970,10 +1981,10 @@ static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Ident
         type = PropertyNode::Setter;
     else
         return 0;
-    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (globalData) PropertyNode(globalData, name, new (globalData) FuncExprNode(globalData, globalData->propertyNames->nullIdentifier, body, source, params), type);
 }
 
-static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
+static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
         NumberNode* number = static_cast<NumberNode*>(n);
@@ -1984,92 +1995,92 @@ static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
         }
     }
 
-    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
+    return new (globalData) NegateNode(globalData, n);
 }
 
-static NumberNode* makeNumberNode(void* globalPtr, double d)
+static NumberNode* makeNumberNode(JSGlobalData* globalData, double d)
 {
-    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
+    return new (globalData) NumberNode(globalData, d);
 }
 
-static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
+static ExpressionNode* makeBitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (expr->isNumber())
-        return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
+        return makeNumberNode(globalData, ~toInt32(static_cast<NumberNode*>(expr)->value()));
+    return new (globalData) BitwiseNotNode(globalData, expr);
 }
 
-static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeMultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (globalData) UnaryPlusNode(globalData, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (globalData) UnaryPlusNode(globalData, expr1);
 
-    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (globalData) MultNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeDivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) DivNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeAddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) AddNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeSubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) SubNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeLeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (globalData) LeftShiftNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (globalData) RightShiftNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-/* called by yyparse on error */
-int yyerror(const char *)
+// Called by yyparse on error.
+int yyerror(const char*)
 {
     return 1;
 }
 
-/* may we automatically insert a semicolon ? */
+// May we automatically insert a semicolon?
 static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
 {
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
+static ExpressionNode* combineCommaNodes(JSGlobalData* globalData, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
@@ -2077,17 +2088,15 @@ static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list,
         static_cast<CommaNode*>(list)->append(init);
         return list;
     }
-    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
+    return new (globalData) CommaNode(globalData, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
 // statements (which later get stripped out), because the actual
 // declaration work is hoisted up to the start of the function body
-static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
+static StatementNode* makeVarStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (!expr)
-        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
-    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
+        return new (globalData) EmptyStatementNode(globalData);
+    return new (globalData) VarStatementNode(globalData, expr);
 }
-
-#undef GLOBAL_DATA
diff --git a/JavaScriptCore/parser/Lexer.cpp b/JavaScriptCore/parser/Lexer.cpp
index 8e89c18..785b219 100644
--- a/JavaScriptCore/parser/Lexer.cpp
+++ b/JavaScriptCore/parser/Lexer.cpp
@@ -141,8 +141,10 @@ ALWAYS_INLINE void Lexer::shift4()
     m_code += 4;
 }
 
-void Lexer::setCode(const SourceCode& source)
+void Lexer::setCode(const SourceCode& source, ParserArena& arena)
 {
+    m_arena = &arena.identifierArena();
+
     m_lineNumber = source.firstLine();
     m_delimited = false;
     m_lastToken = -1;
@@ -204,10 +206,9 @@ void Lexer::shiftLineTerminator()
     ++m_lineNumber;
 }
 
-ALWAYS_INLINE Identifier* Lexer::makeIdentifier(const UChar* characters, size_t length)
+ALWAYS_INLINE const Identifier* Lexer::makeIdentifier(const UChar* characters, size_t length)
 {
-    m_identifiers.append(Identifier(m_globalData, characters, length));
-    return &m_identifiers.last();
+    return &m_arena->makeIdentifier(m_globalData, characters, length);
 }
 
 inline bool Lexer::lastTokenWasRestrKeyword() const
@@ -908,48 +909,110 @@ returnError:
     return -1;
 }
 
-bool Lexer::scanRegExp()
+bool Lexer::scanRegExp(const Identifier*& pattern, const Identifier*& flags, UChar patternPrefix)
 {
     ASSERT(m_buffer16.isEmpty());
 
     bool lastWasEscape = false;
     bool inBrackets = false;
 
+    if (patternPrefix) {
+        ASSERT(!isLineTerminator(patternPrefix));
+        ASSERT(patternPrefix != '/');
+        ASSERT(patternPrefix != '[');
+        record16(patternPrefix);
+    }
+
     while (true) {
-        if (isLineTerminator(m_current) || m_current == -1)
-            return false;
-        if (m_current != '/' || lastWasEscape || inBrackets) {
-            // keep track of '[' and ']'
-            if (!lastWasEscape) {
-                if (m_current == '[' && !inBrackets)
-                    inBrackets = true;
-                if (m_current == ']' && inBrackets)
-                    inBrackets = false;
-            }
-            record16(m_current);
-            lastWasEscape = !lastWasEscape && m_current == '\\';
-        } else { // end of regexp
-            m_pattern = UString(m_buffer16);
+        int current = m_current;
+
+        if (isLineTerminator(current) || current == -1) {
             m_buffer16.resize(0);
-            shift1();
-            break;
+            return false;
         }
+
         shift1();
+
+        if (current == '/' && !lastWasEscape && !inBrackets)
+            break;
+
+        record16(current);
+
+        if (lastWasEscape) {
+            lastWasEscape = false;
+            continue;
+        }
+
+        switch (current) {
+        case '[':
+            inBrackets = true;
+            break;
+        case ']':
+            inBrackets = false;
+            break;
+        case '\\':
+            lastWasEscape = true;
+            break;
+        }
     }
 
+    pattern = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+    m_buffer16.resize(0);
+
     while (isIdentPart(m_current)) {
         record16(m_current);
         shift1();
     }
-    m_flags = UString(m_buffer16);
+
+    flags = makeIdentifier(m_buffer16.data(), m_buffer16.size());
     m_buffer16.resize(0);
 
     return true;
 }
 
+bool Lexer::skipRegExp()
+{
+    bool lastWasEscape = false;
+    bool inBrackets = false;
+
+    while (true) {
+        int current = m_current;
+
+        if (isLineTerminator(current) || current == -1)
+            return false;
+
+        shift1();
+
+        if (current == '/' && !lastWasEscape && !inBrackets)
+            break;
+
+        if (lastWasEscape) {
+            lastWasEscape = false;
+            continue;
+        }
+
+        switch (current) {
+        case '[':
+            inBrackets = true;
+            break;
+        case ']':
+            inBrackets = false;
+            break;
+        case '\\':
+            lastWasEscape = true;
+            break;
+        }
+    }
+
+    while (isIdentPart(m_current))
+        shift1();
+
+    return true;
+}
+
 void Lexer::clear()
 {
-    m_identifiers.clear();
+    m_arena = 0;
     m_codeWithoutBOMs.clear();
 
     Vector<char> newBuffer8;
@@ -961,9 +1024,6 @@ void Lexer::clear()
     m_buffer16.swap(newBuffer16);
 
     m_isReparsing = false;
-
-    m_pattern = UString();
-    m_flags = UString();
 }
 
 SourceCode Lexer::sourceCode(int openBrace, int closeBrace, int firstLine)
diff --git a/JavaScriptCore/parser/Lexer.h b/JavaScriptCore/parser/Lexer.h
index 2583162..174e05a 100644
--- a/JavaScriptCore/parser/Lexer.h
+++ b/JavaScriptCore/parser/Lexer.h
@@ -23,6 +23,7 @@
 #define Lexer_h
 
 #include "Lookup.h"
+#include "ParserArena.h"
 #include "SourceCode.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/SegmentedVector.h>
@@ -42,7 +43,7 @@ namespace JSC {
         static UChar convertUnicode(int c1, int c2, int c3, int c4);
 
         // Functions to set up parsing.
-        void setCode(const SourceCode&);
+        void setCode(const SourceCode&, ParserArena&);
         void setIsReparsing() { m_isReparsing = true; }
 
         // Functions for the parser itself.
@@ -50,9 +51,8 @@ namespace JSC {
         int lineNumber() const { return m_lineNumber; }
         bool prevTerminator() const { return m_terminator; }
         SourceCode sourceCode(int openBrace, int closeBrace, int firstLine);
-        bool scanRegExp();
-        const UString& pattern() const { return m_pattern; }
-        const UString& flags() const { return m_flags; }
+        bool scanRegExp(const Identifier*& pattern, const Identifier*& flags, UChar patternPrefix = 0);
+        bool skipRegExp();
 
         // Functions for use after parsing.
         bool sawError() const { return m_error; }
@@ -79,12 +79,11 @@ namespace JSC {
         int currentOffset() const;
         const UChar* currentCharacter() const;
 
-        JSC::Identifier* makeIdentifier(const UChar* buffer, size_t length);
+        const Identifier* makeIdentifier(const UChar* characters, size_t length);
 
         bool lastTokenWasRestrKeyword() const;
 
         static const size_t initialReadBufferCapacity = 32;
-        static const size_t initialIdentifierTableCapacity = 64;
 
         int m_lineNumber;
 
@@ -108,13 +107,10 @@ namespace JSC {
         int m_next2;
         int m_next3;
         
-        WTF::SegmentedVector<JSC::Identifier, initialIdentifierTableCapacity> m_identifiers;
+        IdentifierArena* m_arena;
 
         JSGlobalData* m_globalData;
 
-        UString m_pattern;
-        UString m_flags;
-
         const HashTable m_keywordTable;
 
         Vector<UChar> m_codeWithoutBOMs;
diff --git a/JavaScriptCore/parser/NodeConstructors.h b/JavaScriptCore/parser/NodeConstructors.h
index 780a624..dd3b981 100644
--- a/JavaScriptCore/parser/NodeConstructors.h
+++ b/JavaScriptCore/parser/NodeConstructors.h
@@ -27,21 +27,14 @@
 
 namespace JSC {
 
-    inline void* ParserArenaDeletable::operator new(size_t size, JSGlobalData* globalData)
+    inline void* ParserArenaFreeable::operator new(size_t size, JSGlobalData* globalData)
     {
-        ParserArenaDeletable* deletable = static_cast<ParserArenaDeletable*>(fastMalloc(size));
-        globalData->parser->arena().deleteWithArena(deletable);
-        return deletable;
+        return globalData->parser->arena().allocateFreeable(size);
     }
 
-    inline void* ParserArenaDeletable::operator new(size_t size)
-    {
-        return fastMalloc(size);
-    }
-
-    inline void ParserArenaDeletable::operator delete(void* p)
+    inline void* ParserArenaDeletable::operator new(size_t size, JSGlobalData* globalData)
     {
-        fastFree(p);
+        return globalData->parser->arena().allocateDeletable(size);
     }
 
     inline ParserArenaRefCounted::ParserArenaRefCounted(JSGlobalData* globalData)
@@ -77,19 +70,19 @@ namespace JSC {
     {
     }
 
-    inline NumberNode::NumberNode(JSGlobalData* globalData, double v)
+    inline NumberNode::NumberNode(JSGlobalData* globalData, double value)
         : ExpressionNode(globalData, ResultType::numberType())
-        , m_double(v)
+        , m_value(value)
     {
     }
 
-    inline StringNode::StringNode(JSGlobalData* globalData, const Identifier& v)
+    inline StringNode::StringNode(JSGlobalData* globalData, const Identifier& value)
         : ExpressionNode(globalData, ResultType::stringType())
-        , m_value(v)
+        , m_value(value)
     {
     }
 
-    inline RegExpNode::RegExpNode(JSGlobalData* globalData, const UString& pattern, const UString& flags)
+    inline RegExpNode::RegExpNode(JSGlobalData* globalData, const Identifier& pattern, const Identifier& flags)
         : ExpressionNode(globalData)
         , m_pattern(pattern)
         , m_flags(flags)
@@ -154,6 +147,13 @@ namespace JSC {
     {
     }
 
+    inline PropertyNode::PropertyNode(JSGlobalData* globalData, double name, ExpressionNode* assign, Type type)
+        : m_name(globalData->parser->arena().identifierArena().makeNumericIdentifier(globalData, name))
+        , m_assign(assign)
+        , m_type(type)
+    {
+    }
+
     inline PropertyListNode::PropertyListNode(JSGlobalData* globalData, PropertyNode* node)
         : Node(globalData)
         , m_node(node)
@@ -741,6 +741,7 @@ namespace JSC {
 
     inline ContinueNode::ContinueNode(JSGlobalData* globalData)
         : StatementNode(globalData)
+        , m_ident(globalData->propertyNames->nullIdentifier)
     {
     }
 
@@ -752,6 +753,7 @@ namespace JSC {
     
     inline BreakNode::BreakNode(JSGlobalData* globalData)
         : StatementNode(globalData)
+        , m_ident(globalData->propertyNames->nullIdentifier)
     {
     }
 
@@ -814,32 +816,22 @@ namespace JSC {
 
     inline FuncExprNode::FuncExprNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
         : ExpressionNode(globalData)
-        , ParserArenaRefCounted(globalData)
-        , m_ident(ident)
         , m_body(body)
     {
-        m_body->finishParsing(source, parameter);
+        m_body->finishParsing(source, parameter, ident);
     }
 
     inline FuncDeclNode::FuncDeclNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
         : StatementNode(globalData)
-        , ParserArenaRefCounted(globalData)
-        , m_ident(ident)
         , m_body(body)
     {
-        m_body->finishParsing(source, parameter);
-    }
-
-    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr)
-        : m_expr(expr)
-    {
+        m_body->finishParsing(source, parameter, ident);
     }
 
-    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr, SourceElements* children)
+    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr, SourceElements* statements)
         : m_expr(expr)
+        , m_statements(statements)
     {
-        if (children)
-            children->releaseContentsIntoVector(m_children);
     }
 
     inline ClauseListNode::ClauseListNode(JSGlobalData*, CaseClauseNode* clause)
@@ -877,15 +869,15 @@ namespace JSC {
     {
     }
 
-    inline BlockNode::BlockNode(JSGlobalData* globalData, SourceElements* children)
+    inline BlockNode::BlockNode(JSGlobalData* globalData, SourceElements* statements)
         : StatementNode(globalData)
+        , m_statements(statements)
     {
-        if (children)
-            children->releaseContentsIntoVector(m_children);
     }
 
     inline ForInNode::ForInNode(JSGlobalData* globalData, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
         : StatementNode(globalData)
+        , m_ident(globalData->propertyNames->nullIdentifier)
         , m_init(0)
         , m_lexpr(l)
         , m_expr(expr)
diff --git a/JavaScriptCore/parser/Nodes.cpp b/JavaScriptCore/parser/Nodes.cpp
index 4324a06..3bd318a 100644
--- a/JavaScriptCore/parser/Nodes.cpp
+++ b/JavaScriptCore/parser/Nodes.cpp
@@ -49,7 +49,28 @@ using namespace WTF;
 
 namespace JSC {
 
-static void substitute(UString& string, const UString& substring);
+/*
+    Details of the emitBytecode function.
+
+    Return value: The register holding the production's value.
+             dst: An optional parameter specifying the most efficient destination at
+                  which to store the production's value. The callee must honor dst.
+
+    The dst argument provides for a crude form of copy propagation. For example,
+
+        x = 1
+
+    becomes
+    
+        load r[x], 1
+    
+    instead of 
+
+        load r0, 1
+        mov r[x], r0
+    
+    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
+*/
 
 // ------------------------------ ThrowableExpressionData --------------------------------
 
@@ -63,24 +84,29 @@ static void substitute(UString& string, const UString& substring)
     string = newString;
 }
 
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType e, const char* msg)
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
 {
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), e, jsString(generator.globalData(), msg));
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
     generator.emitThrow(exception);
     return exception;
 }
 
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType e, const char* msg, const Identifier& label)
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
 {
-    UString message = msg;
-    substitute(message, label.ustring());
+    UString message = messageTemplate;
+    substitute(message, label);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), e, jsString(generator.globalData(), message));
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
     generator.emitThrow(exception);
     return exception;
 }
 
+inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
+{
+    return emitThrowError(generator, type, messageTemplate, label.ustring());
+}
+
 // ------------------------------ StatementNode --------------------------------
 
 void StatementNode::setLoc(int firstLine, int lastLine)
@@ -98,6 +124,18 @@ void SourceElements::append(StatementNode* statement)
     m_statements.append(statement);
 }
 
+inline StatementNode* SourceElements::singleStatement() const
+{
+    size_t size = m_statements.size();
+    return size == 1 ? m_statements[0] : 0;
+}
+
+inline StatementNode* SourceElements::lastStatement() const
+{
+    size_t size = m_statements.size();
+    return size ? m_statements[size - 1] : 0;
+}
+
 // ------------------------------ NullNode -------------------------------------
 
 RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
@@ -122,7 +160,7 @@ RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 {
     if (dst == generator.ignoredResult())
         return 0;
-    return generator.emitLoad(dst, m_double);
+    return generator.emitLoad(dst, m_value);
 }
 
 // ------------------------------ StringNode -----------------------------------
@@ -138,9 +176,9 @@ RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern, m_flags);
+    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern.ustring(), m_flags.ustring());
     if (!regExp->isValid())
-        return emitThrowError(generator, SyntaxError, ("Invalid regular expression: " + UString(regExp->errorMessage())).UTF8String().c_str());
+        return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
     if (dst == generator.ignoredResult())
         return 0;
     return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
@@ -596,7 +634,9 @@ RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterI
 
 RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus ? "Postfix ++ operator applied to value that is not a reference." : "Postfix -- operator applied to value that is not a reference.");
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Postfix ++ operator applied to value that is not a reference."
+        : "Postfix -- operator applied to value that is not a reference.");
 }
 
 // ------------------------------ DeleteResolveNode -----------------------------------
@@ -758,7 +798,9 @@ RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus ? "Prefix ++ operator applied to value that is not a reference." : "Prefix -- operator applied to value that is not a reference.");
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Prefix ++ operator applied to value that is not a reference."
+        : "Prefix -- operator applied to value that is not a reference.");
 }
 
 // ------------------------------ Unary Operation Nodes -----------------------------------
@@ -1205,7 +1247,13 @@ RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
 
         return generator.emitNode(local, m_init);
     }
-    
+
+    if (generator.codeType() != EvalCode) {
+        if (m_init)
+            return generator.emitNode(m_init);
+        else
+            return generator.emitResolve(generator.newTemporary(), m_ident);
+    }
     // FIXME: While this code should only be hit in eval code, it will potentially
     // assign to the wrong base if m_ident exists in an intervening dynamic scope.
     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
@@ -1230,20 +1278,26 @@ RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, Regis
     return generator.emitNode(m_next);
 }
 
-// ------------------------------ Helper functions for handling Vectors of StatementNode -------------------------------
+// ------------------------------ SourceElements -------------------------------
 
-static inline void statementListEmitCode(const StatementVector& statements, BytecodeGenerator& generator, RegisterID* dst)
+inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    size_t size = statements.size();
+    size_t size = m_statements.size();
     for (size_t i = 0; i < size; ++i)
-        generator.emitNode(dst, statements[i]);
+        generator.emitNode(dst, m_statements[i]);
 }
 
 // ------------------------------ BlockNode ------------------------------------
 
+inline StatementNode* BlockNode::lastStatement() const
+{
+    return m_statements ? m_statements->lastStatement() : 0;
+}
+
 RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    statementListEmitCode(m_children, generator, dst);
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
     return 0;
 }
 
@@ -1545,6 +1599,14 @@ RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst
     return result;
 }
 
+// ------------------------------ CaseClauseNode --------------------------------
+
+inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
+}
+
 // ------------------------------ CaseBlockNode --------------------------------
 
 enum SwitchKind { 
@@ -1664,17 +1726,17 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
     size_t i = 0;
     for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
         generator.emitLabel(labelVector[i++].get());
-        statementListEmitCode(list->getClause()->children(), generator, dst);
+        list->getClause()->emitBytecode(generator, dst);
     }
 
     if (m_defaultClause) {
         generator.emitLabel(defaultLabel.get());
-        statementListEmitCode(m_defaultClause->children(), generator, dst);
+        m_defaultClause->emitBytecode(generator, dst);
     }
 
     for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
         generator.emitLabel(labelVector[i++].get());
-        statementListEmitCode(list->getClause()->children(), generator, dst);
+        list->getClause()->emitBytecode(generator, dst);
     }
     if (!m_defaultClause)
         generator.emitLabel(defaultLabel.get());
@@ -1806,27 +1868,15 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
 // -----------------------------ScopeNodeData ---------------------------
 
-ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, int numConstants)
+ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* statements, VarStack* varStack, FunctionStack* funcStack, int numConstants)
     : m_numConstants(numConstants)
+    , m_statements(statements)
 {
     m_arena.swap(arena);
     if (varStack)
         m_varStack.swap(*varStack);
     if (funcStack)
         m_functionStack.swap(*funcStack);
-    if (children)
-        children->releaseContentsIntoVector(m_children);
-}
-
-void ScopeNodeData::markAggregate(MarkStack& markStack)
-{
-    FunctionStack::iterator end = m_functionStack.end();
-    for (FunctionStack::iterator ptr = m_functionStack.begin(); ptr != end; ++ptr) {
-        FunctionBodyNode* body = (*ptr)->body();
-        if (!body->isGenerated())
-            continue;
-        body->generatedBytecode().markAggregate(markStack);
-    }
 }
 
 // ------------------------------ ScopeNode -----------------------------
@@ -1836,10 +1886,6 @@ ScopeNode::ScopeNode(JSGlobalData* globalData)
     , ParserArenaRefCounted(globalData)
     , m_features(NoFeatures)
 {
-#if ENABLE(CODEBLOCK_SAMPLING)
-    if (SamplingTool* sampler = globalData->interpreter->sampler())
-        sampler->notifyOfScope(this);
-#endif
 }
 
 ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, CodeFeatures features, int numConstants)
@@ -1849,10 +1895,17 @@ ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceE
     , m_features(features)
     , m_source(source)
 {
-#if ENABLE(CODEBLOCK_SAMPLING)
-    if (SamplingTool* sampler = globalData->interpreter->sampler())
-        sampler->notifyOfScope(this);
-#endif
+}
+
+inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_data->m_statements)
+        m_data->m_statements->emitBytecode(generator, dst);
+}
+
+StatementNode* ScopeNode::singleStatement() const
+{
+    return m_data->m_statements ? m_data->m_statements->singleStatement() : 0;
 }
 
 // ------------------------------ ProgramNode -----------------------------
@@ -1879,37 +1932,13 @@ RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 
     RefPtr<RegisterID> dstRegister = generator.newTemporary();
     generator.emitLoad(dstRegister.get(), jsUndefined());
-    statementListEmitCode(children(), generator, dstRegister.get());
+    emitStatementsBytecode(generator, dstRegister.get());
 
     generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
     generator.emitEnd(dstRegister.get());
     return 0;
 }
 
-void ProgramNode::generateBytecode(ScopeChainNode* scopeChainNode)
-{
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
-    
-    m_code.set(new ProgramCodeBlock(this, GlobalCode, globalObject, source().provider()));
-    
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &globalObject->symbolTable(), m_code.get()));
-    generator->generate();
-
-    destroyData();
-}
-
-#if ENABLE(JIT)
-void ProgramNode::generateJITCode(ScopeChainNode* scopeChainNode)
-{
-    bytecode(scopeChainNode);
-    ASSERT(m_code);
-    ASSERT(!m_jitCode);
-    JIT::compile(scopeChainNode->globalData, m_code.get());
-    ASSERT(m_jitCode);
-}
-#endif
-
 // ------------------------------ EvalNode -----------------------------
 
 inline EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
@@ -1934,122 +1963,42 @@ RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 
     RefPtr<RegisterID> dstRegister = generator.newTemporary();
     generator.emitLoad(dstRegister.get(), jsUndefined());
-    statementListEmitCode(children(), generator, dstRegister.get());
+    emitStatementsBytecode(generator, dstRegister.get());
 
     generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
     generator.emitEnd(dstRegister.get());
     return 0;
 }
 
-void EvalNode::generateBytecode(ScopeChainNode* scopeChainNode)
-{
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
-
-    m_code.set(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
-
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
-    generator->generate();
-
-    // Eval code needs to hang on to its declaration stacks to keep declaration info alive until Interpreter::execute time,
-    // so the entire ScopeNodeData cannot be destoyed.
-    children().clear();
-}
-
-EvalCodeBlock& EvalNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode, CodeBlock* codeBlockBeingRegeneratedFrom)
-{
-    ASSERT(!m_code);
-
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
-
-    m_code.set(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
-
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
-    generator->setRegeneratingForExceptionInfo(codeBlockBeingRegeneratedFrom);
-    generator->generate();
-
-    return *m_code;
-}
-
-void EvalNode::markAggregate(MarkStack& markStack)
-{
-    // We don't need to mark our own CodeBlock as the JSGlobalObject takes care of that
-    data()->markAggregate(markStack);
-}
+// ------------------------------ FunctionBodyNode -----------------------------
 
-#if ENABLE(JIT)
-void EvalNode::generateJITCode(ScopeChainNode* scopeChainNode)
+FunctionParameters::FunctionParameters(ParameterNode* firstParameter)
 {
-    bytecode(scopeChainNode);
-    ASSERT(m_code);
-    ASSERT(!m_jitCode);
-    JIT::compile(scopeChainNode->globalData, m_code.get());
-    ASSERT(m_jitCode);
+    for (ParameterNode* parameter = firstParameter; parameter; parameter = parameter->nextParam())
+        append(parameter->ident());
 }
-#endif
-
-// ------------------------------ FunctionBodyNode -----------------------------
 
 inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData)
     : ScopeNode(globalData)
-    , m_parameters(0)
-    , m_parameterCount(0)
 {
 }
 
 inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, sourceCode, children, varStack, funcStack, features, numConstants)
-    , m_parameters(0)
-    , m_parameterCount(0)
 {
 }
 
-FunctionBodyNode::~FunctionBodyNode()
+void FunctionBodyNode::finishParsing(const SourceCode& source, ParameterNode* firstParameter, const Identifier& ident)
 {
-    for (size_t i = 0; i < m_parameterCount; ++i)
-        m_parameters[i].~Identifier();
-    fastFree(m_parameters);
-}
-
-void FunctionBodyNode::finishParsing(const SourceCode& source, ParameterNode* firstParameter)
-{
-    Vector<Identifier> parameters;
-    for (ParameterNode* parameter = firstParameter; parameter; parameter = parameter->nextParam())
-        parameters.append(parameter->ident());
-    size_t count = parameters.size();
-
     setSource(source);
-    finishParsing(parameters.releaseBuffer(), count);
+    finishParsing(FunctionParameters::create(firstParameter), ident);
 }
 
-void FunctionBodyNode::finishParsing(Identifier* parameters, size_t parameterCount)
+void FunctionBodyNode::finishParsing(PassRefPtr<FunctionParameters> parameters, const Identifier& ident)
 {
     ASSERT(!source().isNull());
     m_parameters = parameters;
-    m_parameterCount = parameterCount;
-}
-
-void FunctionBodyNode::markAggregate(MarkStack& markStack)
-{
-    if (m_code)
-        m_code->markAggregate(markStack);
-}
-
-#if ENABLE(JIT)
-PassRefPtr<FunctionBodyNode> FunctionBodyNode::createNativeThunk(JSGlobalData* globalData)
-{
-    RefPtr<FunctionBodyNode> body = new FunctionBodyNode(globalData);
-    globalData->parser->arena().reset();
-    body->m_code.set(new CodeBlock(body.get()));
-    body->m_jitCode = JITCode(JITCode::HostFunction(globalData->jitStubs.ctiNativeCallThunk()));
-    return body.release();
-}
-#endif
-
-bool FunctionBodyNode::isHostFunction() const
-{
-    return m_code && m_code->codeType() == NativeCode;
+    m_ident = ident;
 }
 
 FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData)
@@ -2068,59 +2017,14 @@ PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData,
     return node.release();
 }
 
-void FunctionBodyNode::generateBytecode(ScopeChainNode* scopeChainNode)
-{
-    // This branch is only necessary since you can still create a non-stub FunctionBodyNode by
-    // calling Parser::parse<FunctionBodyNode>().   
-    if (!data())
-        scopeChainNode->globalData->parser->reparseInPlace(scopeChainNode->globalData, this);
-    ASSERT(data());
-
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
-
-    m_code.set(new CodeBlock(this, FunctionCode, source().provider(), source().startOffset()));
-
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
-    generator->generate();
-
-    destroyData();
-}
-
-#if ENABLE(JIT)
-void FunctionBodyNode::generateJITCode(ScopeChainNode* scopeChainNode)
-{
-    bytecode(scopeChainNode);
-    ASSERT(m_code);
-    ASSERT(!m_jitCode);
-    JIT::compile(scopeChainNode->globalData, m_code.get());
-    ASSERT(m_jitCode);
-}
-#endif
-
-CodeBlock& FunctionBodyNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode, CodeBlock* codeBlockBeingRegeneratedFrom)
-{
-    ASSERT(!m_code);
-
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
-
-    m_code.set(new CodeBlock(this, FunctionCode, source().provider(), source().startOffset()));
-
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
-    generator->setRegeneratingForExceptionInfo(codeBlockBeingRegeneratedFrom);
-    generator->generate();
-
-    return *m_code;
-}
-
 RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
-    statementListEmitCode(children(), generator, generator.ignoredResult());
-    if (children().size() && children().last()->isBlock()) {
-        BlockNode* blockNode = static_cast<BlockNode*>(children().last());
-        if (blockNode->children().size() && blockNode->children().last()->isReturnNode())
+    emitStatementsBytecode(generator, generator.ignoredResult());
+    StatementNode* singleStatement = this->singleStatement();
+    if (singleStatement && singleStatement->isBlock()) {
+        StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
+        if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
             return 0;
     }
 
@@ -2130,32 +2034,8 @@ RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, Registe
     return 0;
 }
 
-UString FunctionBodyNode::paramString() const
-{
-    UString s("");
-    for (size_t pos = 0; pos < m_parameterCount; ++pos) {
-        if (!s.isEmpty())
-            s += ", ";
-        s += parameters()[pos].ustring();
-    }
-
-    return s;
-}
-
-Identifier* FunctionBodyNode::copyParameters()
-{
-    Identifier* parameters = static_cast<Identifier*>(fastMalloc(m_parameterCount * sizeof(Identifier)));
-    VectorCopier<false, Identifier>::uninitializedCopy(m_parameters, m_parameters + m_parameterCount, parameters);
-    return parameters;
-}
-
 // ------------------------------ FuncDeclNode ---------------------------------
 
-JSFunction* FuncDeclNode::makeFunction(ExecState* exec, ScopeChainNode* scopeChain)
-{
-    return new (exec) JSFunction(exec, m_ident, m_body.get(), scopeChain);
-}
-
 RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult())
@@ -2170,24 +2050,4 @@ RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
     return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
 }
 
-JSFunction* FuncExprNode::makeFunction(ExecState* exec, ScopeChainNode* scopeChain)
-{
-    JSFunction* func = new (exec) JSFunction(exec, m_ident, m_body.get(), scopeChain);
-
-    /* 
-        The Identifier in a FunctionExpression can be referenced from inside
-        the FunctionExpression's FunctionBody to allow the function to call
-        itself recursively. However, unlike in a FunctionDeclaration, the
-        Identifier in a FunctionExpression cannot be referenced from and
-        does not affect the scope enclosing the FunctionExpression.
-     */
-
-    if (!m_ident.isNull()) {
-        JSStaticScopeObject* functionScopeObject = new (exec) JSStaticScopeObject(exec, m_ident, func, ReadOnly | DontDelete);
-        func->scope().push(functionScopeObject);
-    }
-
-    return func;
-}
-
 } // namespace JSC
diff --git a/JavaScriptCore/parser/Nodes.h b/JavaScriptCore/parser/Nodes.h
index 703b384..be84c4a 100644
--- a/JavaScriptCore/parser/Nodes.h
+++ b/JavaScriptCore/parser/Nodes.h
@@ -34,21 +34,17 @@
 #include "SourceCode.h"
 #include "SymbolTable.h"
 #include <wtf/MathExtras.h>
-#include <wtf/OwnPtr.h>
 
 namespace JSC {
 
     class ArgumentListNode;
-    class CodeBlock;
     class BytecodeGenerator;
-    class FuncDeclNode;
-    class EvalCodeBlock;
-    class JSFunction;
-    class ProgramCodeBlock;
+    class FunctionBodyNode;
     class PropertyListNode;
     class ReadModifyResolveNode;
     class RegisterID;
     class ScopeChainNode;
+    class ScopeNode;
 
     typedef unsigned CodeFeatures;
 
@@ -86,8 +82,8 @@ namespace JSC {
 
     namespace DeclarationStacks {
         enum VarAttrs { IsConstant = 1, HasInitializer = 2 };
-        typedef Vector<std::pair<Identifier, unsigned> > VarStack;
-        typedef Vector<FuncDeclNode*> FunctionStack;
+        typedef Vector<std::pair<const Identifier*, unsigned> > VarStack;
+        typedef Vector<FunctionBodyNode*> FunctionStack;
     }
 
     struct SwitchInfo {
@@ -96,24 +92,23 @@ namespace JSC {
         SwitchType switchType;
     };
 
-    class ParserArenaDeletable {
-    protected:
-        ParserArenaDeletable() { }
+    class ParserArenaFreeable {
+    public:
+        // ParserArenaFreeable objects are are freed when the arena is deleted.
+        // Destructors are not called. Clients must not call delete on such objects.
+        void* operator new(size_t, JSGlobalData*);
+    };
 
+    class ParserArenaDeletable {
     public:
         virtual ~ParserArenaDeletable() { }
 
-        // Objects created with this version of new are deleted when the arena is deleted.
+        // ParserArenaDeletable objects are deleted when the arena is deleted.
+        // Clients must not call delete directly on such objects.
         void* operator new(size_t, JSGlobalData*);
-
-        // Objects created with this version of new are not deleted when the arena is deleted.
-        // Other arrangements must be made.
-        void* operator new(size_t);
-
-        void operator delete(void*);
     };
 
-    class ParserArenaRefCounted : public RefCountedCustomAllocated<ParserArenaRefCounted> {
+    class ParserArenaRefCounted : public RefCounted<ParserArenaRefCounted> {
     protected:
         ParserArenaRefCounted(JSGlobalData*);
 
@@ -124,34 +119,14 @@ namespace JSC {
         }
     };
 
-    class Node : public ParserArenaDeletable {
+    class Node : public ParserArenaFreeable {
     protected:
         Node(JSGlobalData*);
 
     public:
-        /*
-            Return value: The register holding the production's value.
-                     dst: An optional parameter specifying the most efficient
-                          destination at which to store the production's value.
-                          The callee must honor dst.
-
-            dst provides for a crude form of copy propagation. For example,
-
-            x = 1
+        virtual ~Node() { }
 
-            becomes
-            
-            load r[x], 1
-            
-            instead of 
-
-            load r0, 1
-            mov r[x], r0
-            
-            because the assignment node, "x =", passes r[x] as dst to the number
-            node, "1".
-        */
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) = 0;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* destination = 0) = 0;
 
         int lineNo() const { return m_line; }
 
@@ -160,9 +135,10 @@ namespace JSC {
     };
 
     class ExpressionNode : public Node {
-    public:
+    protected:
         ExpressionNode(JSGlobalData*, ResultType = ResultType::unknownType());
 
+    public:
         virtual bool isNumber() const { return false; }
         virtual bool isString() const { return false; }
         virtual bool isNull() const { return false; }
@@ -180,18 +156,16 @@ namespace JSC {
 
         ResultType resultDescriptor() const { return m_resultType; }
 
-        // This needs to be in public in order to compile using GCC 3.x 
-        typedef enum { EvalOperator, FunctionCall } CallerType;
-
     private:
         ResultType m_resultType;
     };
 
     class StatementNode : public Node {
-    public:
+    protected:
         StatementNode(JSGlobalData*);
 
-        void setLoc(int line0, int line1);
+    public:
+        void setLoc(int firstLine, int lastLine);
         int firstLine() const { return lineNo(); }
         int lastLine() const { return m_lastLine; }
 
@@ -229,10 +203,10 @@ namespace JSC {
 
     class NumberNode : public ExpressionNode {
     public:
-        NumberNode(JSGlobalData*, double v);
+        NumberNode(JSGlobalData*, double value);
 
-        double value() const { return m_double; }
-        void setValue(double d) { m_double = d; }
+        double value() const { return m_value; }
+        void setValue(double value) { m_value = value; }
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -240,22 +214,23 @@ namespace JSC {
         virtual bool isNumber() const { return true; }
         virtual bool isPure(BytecodeGenerator&) const { return true; }
 
-        double m_double;
+        double m_value;
     };
 
     class StringNode : public ExpressionNode {
     public:
-        StringNode(JSGlobalData*, const Identifier& v);
+        StringNode(JSGlobalData*, const Identifier&);
 
         const Identifier& value() { return m_value; }
-        virtual bool isPure(BytecodeGenerator&) const { return true; }
 
     private:
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
+
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
         
         virtual bool isString() const { return true; }
 
-        Identifier m_value;
+        const Identifier& m_value;
     };
     
     class ThrowableExpressionData {
@@ -286,8 +261,9 @@ namespace JSC {
         uint16_t endOffset() const { return m_endOffset; }
 
     protected:
-        RegisterID* emitThrowError(BytecodeGenerator&, ErrorType, const char* msg);
-        RegisterID* emitThrowError(BytecodeGenerator&, ErrorType, const char* msg, const Identifier&);
+        RegisterID* emitThrowError(BytecodeGenerator&, ErrorType, const char* message);
+        RegisterID* emitThrowError(BytecodeGenerator&, ErrorType, const char* message, const UString&);
+        RegisterID* emitThrowError(BytecodeGenerator&, ErrorType, const char* message, const Identifier&);
 
     private:
         uint32_t m_divot;
@@ -298,8 +274,7 @@ namespace JSC {
     class ThrowableSubExpressionData : public ThrowableExpressionData {
     public:
         ThrowableSubExpressionData()
-            : ThrowableExpressionData()
-            , m_subexpressionDivotOffset(0)
+            : m_subexpressionDivotOffset(0)
             , m_subexpressionEndOffset(0)
         {
         }
@@ -328,8 +303,7 @@ namespace JSC {
     class ThrowablePrefixedSubExpressionData : public ThrowableExpressionData {
     public:
         ThrowablePrefixedSubExpressionData()
-            : ThrowableExpressionData()
-            , m_subexpressionDivotOffset(0)
+            : m_subexpressionDivotOffset(0)
             , m_subexpressionStartOffset(0)
         {
         }
@@ -357,13 +331,13 @@ namespace JSC {
 
     class RegExpNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        RegExpNode(JSGlobalData*, const UString& pattern, const UString& flags);
+        RegExpNode(JSGlobalData*, const Identifier& pattern, const Identifier& flags);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        UString m_pattern;
-        UString m_flags;
+        const Identifier& m_pattern;
+        const Identifier& m_flags;
     };
 
     class ThisNode : public ExpressionNode {
@@ -387,11 +361,11 @@ namespace JSC {
         virtual bool isLocation() const { return true; }
         virtual bool isResolveNode() const { return true; }
 
-        Identifier m_ident;
+        const Identifier& m_ident;
         int32_t m_startOffset;
     };
 
-    class ElementNode : public ParserArenaDeletable {
+    class ElementNode : public ParserArenaFreeable {
     public:
         ElementNode(JSGlobalData*, int elision, ExpressionNode*);
         ElementNode(JSGlobalData*, ElementNode*, int elision, ExpressionNode*);
@@ -424,17 +398,18 @@ namespace JSC {
         bool m_optional;
     };
 
-    class PropertyNode : public ParserArenaDeletable {
+    class PropertyNode : public ParserArenaFreeable {
     public:
         enum Type { Constant, Getter, Setter };
 
         PropertyNode(JSGlobalData*, const Identifier& name, ExpressionNode* value, Type);
+        PropertyNode(JSGlobalData*, double name, ExpressionNode* value, Type);
 
         const Identifier& name() const { return m_name; }
 
     private:
         friend class PropertyListNode;
-        Identifier m_name;
+        const Identifier& m_name;
         ExpressionNode* m_assign;
         Type m_type;
     };
@@ -494,7 +469,7 @@ namespace JSC {
         virtual bool isDotAccessorNode() const { return true; }
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class ArgumentListNode : public Node {
@@ -509,7 +484,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
-    class ArgumentsNode : public ParserArenaDeletable {
+    class ArgumentsNode : public ParserArenaFreeable {
     public:
         ArgumentsNode(JSGlobalData*);
         ArgumentsNode(JSGlobalData*, ArgumentListNode*);
@@ -557,7 +532,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
         ArgumentsNode* m_args;
         size_t m_index; // Used by LocalVarFunctionCallNode.
         size_t m_scopeDepth; // Used by ScopedVarFunctionCallNode and NonLocalVarFunctionCallNode
@@ -584,7 +559,7 @@ namespace JSC {
 
     protected:
         ExpressionNode* m_base;
-        const Identifier m_ident;
+        const Identifier& m_ident;
         ArgumentsNode* m_args;
     };
 
@@ -609,7 +584,7 @@ namespace JSC {
         PrePostResolveNode(JSGlobalData*, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     protected:
-        const Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class PostfixResolveNode : public PrePostResolveNode {
@@ -642,7 +617,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
         Operator m_operator;
     };
 
@@ -664,7 +639,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class DeleteBracketNode : public ExpressionNode, public ThrowableExpressionData {
@@ -686,7 +661,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class DeleteValueNode : public ExpressionNode {
@@ -718,7 +693,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class TypeOfValueNode : public ExpressionNode {
@@ -761,7 +736,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
         Operator m_operator;
     };
 
@@ -820,7 +795,7 @@ namespace JSC {
         BinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
         BinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
 
-        RegisterID* emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs = 0, ReadModifyResolveNode* emitExpressionInfoForMe = 0);
+        RegisterID* emitStrcat(BytecodeGenerator& generator, RegisterID* destination, RegisterID* lhs = 0, ReadModifyResolveNode* emitExpressionInfoForMe = 0);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1003,7 +978,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
         ExpressionNode* m_right;
         size_t m_index; // Used by ReadModifyLocalVarNode.
         Operator m_operator;
@@ -1017,7 +992,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
         ExpressionNode* m_right;
         size_t m_index; // Used by ReadModifyLocalVarNode.
         bool m_rightHasAssignments;
@@ -1060,7 +1035,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
         ExpressionNode* m_right;
         bool m_rightHasAssignments;
     };
@@ -1073,7 +1048,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
         ExpressionNode* m_right;
         Operator m_operator : 31;
         bool m_rightHasAssignments : 1;
@@ -1093,10 +1068,12 @@ namespace JSC {
     
     typedef Vector<ExpressionNode*, 8> ExpressionVector;
 
-    class CommaNode : public ExpressionNode {
+    class CommaNode : public ExpressionNode, public ParserArenaDeletable {
     public:
         CommaNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2);
 
+        using ParserArenaDeletable::operator new;
+
         void append(ExpressionNode* expr) { m_expressions.append(expr); }
 
     private:
@@ -1117,7 +1094,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
         virtual RegisterID* emitCodeSingle(BytecodeGenerator&);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
 
     public:
         ConstDeclNode* m_next;
@@ -1136,36 +1113,33 @@ namespace JSC {
         ConstDeclNode* m_next;
     };
 
-    typedef Vector<StatementNode*> StatementVector;
-
     class SourceElements : public ParserArenaDeletable {
     public:
         SourceElements(JSGlobalData*);
 
         void append(StatementNode*);
-        void releaseContentsIntoVector(StatementVector& destination)
-        {
-            ASSERT(destination.isEmpty());
-            m_statements.swap(destination);
-            destination.shrinkToFit();
-        }
+
+        StatementNode* singleStatement() const;
+        StatementNode* lastStatement() const;
+
+        void emitBytecode(BytecodeGenerator&, RegisterID* destination);
 
     private:
-        StatementVector m_statements;
+        Vector<StatementNode*> m_statements;
     };
 
     class BlockNode : public StatementNode {
     public:
-        BlockNode(JSGlobalData*, SourceElements* children);
+        BlockNode(JSGlobalData*, SourceElements* = 0);
 
-        StatementVector& children() { return m_children; }
+        StatementNode* lastStatement() const;
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         virtual bool isBlock() const { return true; }
 
-        StatementVector m_children;
+        SourceElements* m_statements;
     };
 
     class EmptyStatementNode : public StatementNode {
@@ -1275,7 +1249,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
         ExpressionNode* m_init;
         ExpressionNode* m_lexpr;
         ExpressionNode* m_expr;
@@ -1291,7 +1265,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class BreakNode : public StatementNode, public ThrowableExpressionData {
@@ -1302,7 +1276,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class ReturnNode : public StatementNode, public ThrowableExpressionData {
@@ -1337,7 +1311,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_name;
+        const Identifier& m_name;
         StatementNode* m_statement;
     };
 
@@ -1356,16 +1330,16 @@ namespace JSC {
         TryNode(JSGlobalData*, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock);
 
     private:
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0);
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         StatementNode* m_tryBlock;
-        Identifier m_exceptionIdent;
+        const Identifier& m_exceptionIdent;
         StatementNode* m_catchBlock;
         StatementNode* m_finallyBlock;
         bool m_catchHasEval;
     };
 
-    class ParameterNode : public ParserArenaDeletable {
+    class ParameterNode : public ParserArenaFreeable {
     public:
         ParameterNode(JSGlobalData*, const Identifier&);
         ParameterNode(JSGlobalData*, ParameterNode*, const Identifier&);
@@ -1374,7 +1348,7 @@ namespace JSC {
         ParameterNode* nextParam() const { return m_next; }
 
     private:
-        Identifier m_ident;
+        const Identifier& m_ident;
         ParameterNode* m_next;
     };
 
@@ -1388,9 +1362,7 @@ namespace JSC {
         VarStack m_varStack;
         FunctionStack m_functionStack;
         int m_numConstants;
-        StatementVector m_children;
-
-        void markAggregate(MarkStack&);
+        SourceElements* m_statements;
     };
 
     class ScopeNode : public StatementNode, public ParserArenaRefCounted {
@@ -1401,6 +1373,8 @@ namespace JSC {
         ScopeNode(JSGlobalData*);
         ScopeNode(JSGlobalData*, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, CodeFeatures, int numConstants);
 
+        using ParserArenaRefCounted::operator new;
+
         void adoptData(std::auto_ptr<ScopeNodeData> data)
         {
             ASSERT(!data->m_arena.contains(this));
@@ -1426,8 +1400,6 @@ namespace JSC {
         VarStack& varStack() { ASSERT(m_data); return m_data->m_varStack; }
         FunctionStack& functionStack() { ASSERT(m_data); return m_data->m_functionStack; }
 
-        StatementVector& children() { ASSERT(m_data); return m_data->m_children; }
-
         int neededConstants()
         {
             ASSERT(m_data);
@@ -1436,33 +1408,13 @@ namespace JSC {
             return m_data->m_numConstants + 2;
         }
 
-        virtual void markAggregate(MarkStack&) { }
+        StatementNode* singleStatement() const;
 
-#if ENABLE(JIT)
-        JITCode& generatedJITCode()
-        {
-            ASSERT(m_jitCode);
-            return m_jitCode;
-        }
-
-        ExecutablePool* getExecutablePool()
-        {
-            return m_jitCode.getExecutablePool();
-        }
-
-        void setJITCode(const JITCode jitCode)
-        {
-            m_jitCode = jitCode;
-        }
-#endif
+        void emitStatementsBytecode(BytecodeGenerator&, RegisterID* destination);
 
     protected:
         void setSource(const SourceCode& source) { m_source = source; }
 
-#if ENABLE(JIT)
-        JITCode m_jitCode;
-#endif
-
     private:
         OwnPtr<ScopeNodeData> m_data;
         CodeFeatures m_features;
@@ -1473,187 +1425,99 @@ namespace JSC {
     public:
         static PassRefPtr<ProgramNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        ProgramCodeBlock& bytecode(ScopeChainNode* scopeChain) 
-        {
-            if (!m_code)
-                generateBytecode(scopeChain);
-            return *m_code;
-        }
-
-#if ENABLE(JIT)
-        JITCode& jitCode(ScopeChainNode* scopeChain)
-        {
-            if (!m_jitCode)
-                generateJITCode(scopeChain);
-            return m_jitCode;
-        }
-#endif
+        static const bool scopeIsFunction = false;
 
     private:
         ProgramNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*);
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
-
-#if ENABLE(JIT)
-        void generateJITCode(ScopeChainNode*);
-#endif
-
-        OwnPtr<ProgramCodeBlock> m_code;
     };
 
     class EvalNode : public ScopeNode {
     public:
         static PassRefPtr<EvalNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        EvalCodeBlock& bytecode(ScopeChainNode* scopeChain) 
-        {
-            if (!m_code)
-                generateBytecode(scopeChain);
-            return *m_code;
-        }
-
-        EvalCodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*);
-
-        virtual void markAggregate(MarkStack&);
-
-#if ENABLE(JIT)
-        JITCode& jitCode(ScopeChainNode* scopeChain)
-        {
-            if (!m_jitCode)
-                generateJITCode(scopeChain);
-            return m_jitCode;
-        }
-#endif
+        static const bool scopeIsFunction = false;
 
     private:
         EvalNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*);
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+    };
 
-#if ENABLE(JIT)
-        void generateJITCode(ScopeChainNode*);
-#endif
-        
-        OwnPtr<EvalCodeBlock> m_code;
+    class FunctionParameters : public Vector<Identifier>, public RefCounted<FunctionParameters> {
+    public:
+        static PassRefPtr<FunctionParameters> create(ParameterNode* firstParameter) { return adoptRef(new FunctionParameters(firstParameter)); }
+
+    private:
+        FunctionParameters(ParameterNode*);
     };
 
     class FunctionBodyNode : public ScopeNode {
-        friend class JIT;
     public:
-#if ENABLE(JIT)
-        static PassRefPtr<FunctionBodyNode> createNativeThunk(JSGlobalData*);
-#endif
         static FunctionBodyNode* create(JSGlobalData*);
         static PassRefPtr<FunctionBodyNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
-        virtual ~FunctionBodyNode();
 
-        const Identifier* parameters() const { return m_parameters; }
-        size_t parameterCount() const { return m_parameterCount; }
-        UString paramString() const ;
-        Identifier* copyParameters();
+        FunctionParameters* parameters() const { return m_parameters.get(); }
+        size_t parameterCount() const { return m_parameters->size(); }
 
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        bool isGenerated() const
-        {
-            return m_code;
-        }
-
-        bool isHostFunction() const;
-
-        virtual void markAggregate(MarkStack&);
-
-        void finishParsing(const SourceCode&, ParameterNode*);
-        void finishParsing(Identifier* parameters, size_t parameterCount);
+        void finishParsing(const SourceCode&, ParameterNode*, const Identifier&);
+        void finishParsing(PassRefPtr<FunctionParameters>, const Identifier&);
         
-        UString toSourceString() const { return source().toString(); }
+        const Identifier& ident() { return m_ident; }
 
-        CodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*);
-#if ENABLE(JIT)
-        JITCode& jitCode(ScopeChainNode* scopeChain)
-        {
-            if (!m_jitCode)
-                generateJITCode(scopeChain);
-            return m_jitCode;
-        }
-#endif
+        static const bool scopeIsFunction = true;
 
-        CodeBlock& bytecode(ScopeChainNode* scopeChain) 
-        {
-            ASSERT(scopeChain);
-            if (!m_code)
-                generateBytecode(scopeChain);
-            return *m_code;
-        }
-        
-        CodeBlock& generatedBytecode()
-        {
-            ASSERT(m_code);
-            return *m_code;
-        }
-        
     private:
         FunctionBodyNode(JSGlobalData*);
         FunctionBodyNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*);
-#if ENABLE(JIT)
-        void generateJITCode(ScopeChainNode*);
-#endif
-        Identifier* m_parameters;
-        size_t m_parameterCount;
-        OwnPtr<CodeBlock> m_code;
+        Identifier m_ident;
+        RefPtr<FunctionParameters> m_parameters;
     };
 
-    class FuncExprNode : public ExpressionNode, public ParserArenaRefCounted {
+    class FuncExprNode : public ExpressionNode {
     public:
         FuncExprNode(JSGlobalData*, const Identifier&, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0);
 
-        JSFunction* makeFunction(ExecState*, ScopeChainNode*);
-
-        FunctionBodyNode* body() { return m_body.get(); }
+        FunctionBodyNode* body() { return m_body; }
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         virtual bool isFuncExprNode() const { return true; } 
 
-        Identifier m_ident;
-        RefPtr<FunctionBodyNode> m_body;
+        FunctionBodyNode* m_body;
     };
 
-    class FuncDeclNode : public StatementNode, public ParserArenaRefCounted {
+    class FuncDeclNode : public StatementNode {
     public:
         FuncDeclNode(JSGlobalData*, const Identifier&, FunctionBodyNode*, const SourceCode&, ParameterNode* = 0);
 
-        JSFunction* makeFunction(ExecState*, ScopeChainNode*);
-
-        Identifier m_ident;
-
-        FunctionBodyNode* body() { return m_body.get(); }
+        FunctionBodyNode* body() { return m_body; }
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        RefPtr<FunctionBodyNode> m_body;
+        FunctionBodyNode* m_body;
     };
 
-    class CaseClauseNode : public ParserArenaDeletable {
+    class CaseClauseNode : public ParserArenaFreeable {
     public:
-        CaseClauseNode(JSGlobalData*, ExpressionNode*);
-        CaseClauseNode(JSGlobalData*, ExpressionNode*, SourceElements*);
+        CaseClauseNode(JSGlobalData*, ExpressionNode*, SourceElements* = 0);
 
         ExpressionNode* expr() const { return m_expr; }
-        StatementVector& children() { return m_children; }
+
+        void emitBytecode(BytecodeGenerator&, RegisterID* destination);
 
     private:
         ExpressionNode* m_expr;
-        StatementVector m_children;
+        SourceElements* m_statements;
     };
 
-    class ClauseListNode : public ParserArenaDeletable {
+    class ClauseListNode : public ParserArenaFreeable {
     public:
         ClauseListNode(JSGlobalData*, CaseClauseNode*);
         ClauseListNode(JSGlobalData*, ClauseListNode*, CaseClauseNode*);
@@ -1666,11 +1530,11 @@ namespace JSC {
         ClauseListNode* m_next;
     };
 
-    class CaseBlockNode : public ParserArenaDeletable {
+    class CaseBlockNode : public ParserArenaFreeable {
     public:
         CaseBlockNode(JSGlobalData*, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2);
 
-        RegisterID* emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* dst = 0);
+        RegisterID* emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* destination);
 
     private:
         SwitchInfo::SwitchType tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num);
diff --git a/JavaScriptCore/parser/Parser.cpp b/JavaScriptCore/parser/Parser.cpp
index da47ab2..003ca0b 100644
--- a/JavaScriptCore/parser/Parser.cpp
+++ b/JavaScriptCore/parser/Parser.cpp
@@ -60,7 +60,7 @@ void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
     *errMsg = 0;
 
     Lexer& lexer = *globalData->lexer;
-    lexer.setCode(*m_source);
+    lexer.setCode(*m_source, m_arena);
 
     int parseError = jscyyparse(globalData);
     bool lexError = lexer.sawError();
@@ -77,33 +77,6 @@ void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
 #endif
 }
 
-void Parser::reparseInPlace(JSGlobalData* globalData, FunctionBodyNode* functionBodyNode)
-{
-    ASSERT(!functionBodyNode->data());
-
-    m_source = &functionBodyNode->source();
-    globalData->lexer->setIsReparsing();
-    parse(globalData, 0, 0);
-    ASSERT(m_sourceElements);
-
-    functionBodyNode->adoptData(std::auto_ptr<ScopeNodeData>(new ScopeNodeData(globalData->parser->arena(),
-        m_sourceElements,
-        m_varDeclarations ? &m_varDeclarations->data : 0, 
-        m_funcDeclarations ? &m_funcDeclarations->data : 0,
-        m_numConstants)));
-    bool usesArguments = functionBodyNode->usesArguments();
-    functionBodyNode->setFeatures(m_features);
-    if (usesArguments && !functionBodyNode->usesArguments())
-        functionBodyNode->setUsesArguments();
-
-    ASSERT(globalData->parser->arena().isEmpty());
-
-    m_source = 0;
-    m_sourceElements = 0;
-    m_varDeclarations = 0;
-    m_funcDeclarations = 0;
-}
-
 void Parser::didFinishParsing(SourceElements* sourceElements, ParserArenaData<DeclarationStacks::VarStack>* varStack, 
                               ParserArenaData<DeclarationStacks::FunctionStack>* funcStack, CodeFeatures features, int lastLine, int numConstants)
 {
diff --git a/JavaScriptCore/parser/Parser.h b/JavaScriptCore/parser/Parser.h
index 373dc00..894f709 100644
--- a/JavaScriptCore/parser/Parser.h
+++ b/JavaScriptCore/parser/Parser.h
@@ -24,7 +24,11 @@
 #define Parser_h
 
 #include "Debugger.h"
+#include "Executable.h"
+#include "JSGlobalObject.h"
+#include "Lexer.h"
 #include "Nodes.h"
+#include "ParserArena.h"
 #include "SourceProvider.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -41,9 +45,8 @@ namespace JSC {
 
     class Parser : public Noncopyable {
     public:
-        template <class ParsedNode> PassRefPtr<ParsedNode> parse(ExecState*, Debugger*, const SourceCode&, int* errLine = 0, UString* errMsg = 0);
-        template <class ParsedNode> PassRefPtr<ParsedNode> reparse(JSGlobalData*, ParsedNode*);
-        void reparseInPlace(JSGlobalData*, FunctionBodyNode*);
+        template <class ParsedNode>
+        PassRefPtr<ParsedNode> parse(JSGlobalData* globalData, Debugger*, ExecState*, const SourceCode& source, int* errLine = 0, UString* errMsg = 0);
 
         void didFinishParsing(SourceElements*, ParserArenaData<DeclarationStacks::VarStack>*, 
                               ParserArenaData<DeclarationStacks::FunctionStack>*, CodeFeatures features, int lastLine, int numConstants);
@@ -63,55 +66,35 @@ namespace JSC {
         int m_numConstants;
     };
 
-    template <class ParsedNode> PassRefPtr<ParsedNode> Parser::parse(ExecState* exec, Debugger* debugger, const SourceCode& source, int* errLine, UString* errMsg)
+    template <class ParsedNode>
+    PassRefPtr<ParsedNode> Parser::parse(JSGlobalData* globalData, Debugger* debugger, ExecState* debuggerExecState, const SourceCode& source, int* errLine, UString* errMsg)
     {
         m_source = &source;
-        parse(&exec->globalData(), errLine, errMsg);
-        RefPtr<ParsedNode> result;
-        if (m_sourceElements) {
-            result = ParsedNode::create(&exec->globalData(),
-                                         m_sourceElements,
-                                         m_varDeclarations ? &m_varDeclarations->data : 0, 
-                                         m_funcDeclarations ? &m_funcDeclarations->data : 0,
-                                         *m_source,
-                                         m_features,
-                                         m_numConstants);
-            result->setLoc(m_source->firstLine(), m_lastLine);
-        }
-
-        m_arena.reset();
-
-        m_source = 0;
-        m_varDeclarations = 0;
-        m_funcDeclarations = 0;
+        if (ParsedNode::scopeIsFunction)
+            globalData->lexer->setIsReparsing();
+        parse(globalData, errLine, errMsg);
 
-        if (debugger)
-            debugger->sourceParsed(exec, source, *errLine, *errMsg);
-        return result.release();
-    }
-
-    template <class ParsedNode> PassRefPtr<ParsedNode> Parser::reparse(JSGlobalData* globalData, ParsedNode* oldParsedNode)
-    {
-        m_source = &oldParsedNode->source();
-        parse(globalData, 0, 0);
         RefPtr<ParsedNode> result;
         if (m_sourceElements) {
             result = ParsedNode::create(globalData,
-                                        m_sourceElements,
-                                        m_varDeclarations ? &m_varDeclarations->data : 0, 
-                                        m_funcDeclarations ? &m_funcDeclarations->data : 0,
-                                        *m_source,
-                                        oldParsedNode->features(),
-                                        m_numConstants);
+            m_sourceElements,
+            m_varDeclarations ? &m_varDeclarations->data : 0,
+            m_funcDeclarations ? &m_funcDeclarations->data : 0,
+            source,
+            m_features,
+            m_numConstants);
             result->setLoc(m_source->firstLine(), m_lastLine);
         }
 
         m_arena.reset();
 
         m_source = 0;
+        m_sourceElements = 0;
         m_varDeclarations = 0;
         m_funcDeclarations = 0;
 
+        if (debugger && !ParsedNode::scopeIsFunction)
+            debugger->sourceParsed(debuggerExecState, source, *errLine, *errMsg);
         return result.release();
     }
 
diff --git a/JavaScriptCore/parser/ParserArena.cpp b/JavaScriptCore/parser/ParserArena.cpp
index 2617506..a8e8159 100644
--- a/JavaScriptCore/parser/ParserArena.cpp
+++ b/JavaScriptCore/parser/ParserArena.cpp
@@ -30,9 +30,39 @@
 
 namespace JSC {
 
+ParserArena::ParserArena()
+    : m_freeableMemory(0)
+    , m_freeablePoolEnd(0)
+    , m_identifierArena(new IdentifierArena)
+{
+}
+
+inline void* ParserArena::freeablePool()
+{
+    ASSERT(m_freeablePoolEnd);
+    return m_freeablePoolEnd - freeablePoolSize;
+}
+
+inline void ParserArena::deallocateObjects()
+{
+    if (m_freeablePoolEnd)
+        fastFree(freeablePool());
+
+    size_t size = m_freeablePools.size();
+    for (size_t i = 0; i < size; ++i)
+        fastFree(m_freeablePools[i]);
+
+    size = m_deletableObjects.size();
+    for (size_t i = 0; i < size; ++i) {
+        ParserArenaDeletable* object = m_deletableObjects[i];
+        object->~ParserArenaDeletable();
+        fastFree(object);
+    }
+}
+
 ParserArena::~ParserArena()
 {
-    deleteAllValues(m_deletableObjects);
+    deallocateObjects();
 }
 
 bool ParserArena::contains(ParserArenaRefCounted* object) const
@@ -52,9 +82,43 @@ void ParserArena::removeLast()
 
 void ParserArena::reset()
 {
-    deleteAllValues(m_deletableObjects);
-    m_deletableObjects.shrink(0);
-    m_refCountedObjects.shrink(0);
+    // Since this code path is used only when parsing fails, it's not bothering to reuse
+    // any of the memory the arena allocated. We could improve that later if we want to
+    // efficiently reuse the same arena.
+
+    deallocateObjects();
+
+    m_freeableMemory = 0;
+    m_freeablePoolEnd = 0;
+    m_identifierArena->clear();
+    m_freeablePools.clear();
+    m_deletableObjects.clear();
+    m_refCountedObjects.clear();
+}
+
+void ParserArena::allocateFreeablePool()
+{
+    if (m_freeablePoolEnd)
+        m_freeablePools.append(freeablePool());
+
+    char* pool = static_cast<char*>(fastMalloc(freeablePoolSize));
+    m_freeableMemory = pool;
+    m_freeablePoolEnd = pool + freeablePoolSize;
+    ASSERT(freeablePool() == pool);
+}
+
+bool ParserArena::isEmpty() const
+{
+    return !m_freeablePoolEnd
+        && m_identifierArena->isEmpty()
+        && m_freeablePools.isEmpty()
+        && m_deletableObjects.isEmpty()
+        && m_refCountedObjects.isEmpty();
+}
+
+void ParserArena::derefWithArena(PassRefPtr<ParserArenaRefCounted> object)
+{
+    m_refCountedObjects.append(object);
 }
 
 }
diff --git a/JavaScriptCore/parser/ParserArena.h b/JavaScriptCore/parser/ParserArena.h
index 66c8529..eef8e93 100644
--- a/JavaScriptCore/parser/ParserArena.h
+++ b/JavaScriptCore/parser/ParserArena.h
@@ -26,35 +26,101 @@
 #ifndef ParserArena_h
 #define ParserArena_h
 
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
+#include "Identifier.h"
+#include <wtf/SegmentedVector.h>
 
 namespace JSC {
 
     class ParserArenaDeletable;
     class ParserArenaRefCounted;
 
-    class ParserArena {
+    class IdentifierArena : public FastAllocBase {
     public:
+        ALWAYS_INLINE const Identifier& makeIdentifier(JSGlobalData*, const UChar* characters, size_t length);
+        const Identifier& makeNumericIdentifier(JSGlobalData*, double number);
+
+        void clear() { m_identifiers.clear(); }
+        bool isEmpty() const { return m_identifiers.isEmpty(); }
+
+    private:
+        typedef SegmentedVector<Identifier, 64> IdentifierVector;
+        IdentifierVector m_identifiers;
+    };
+
+    ALWAYS_INLINE const Identifier& IdentifierArena::makeIdentifier(JSGlobalData* globalData, const UChar* characters, size_t length)
+    {
+        m_identifiers.append(Identifier(globalData, characters, length));
+        return m_identifiers.last();
+    }
+
+    inline const Identifier& IdentifierArena::makeNumericIdentifier(JSGlobalData* globalData, double number)
+    {
+        m_identifiers.append(Identifier(globalData, UString::from(number)));
+        return m_identifiers.last();
+    }
+
+    class ParserArena : Noncopyable {
+    public:
+        ParserArena();
+        ~ParserArena();
+
         void swap(ParserArena& otherArena)
         {
+            std::swap(m_freeableMemory, otherArena.m_freeableMemory);
+            std::swap(m_freeablePoolEnd, otherArena.m_freeablePoolEnd);
+            m_identifierArena.swap(otherArena.m_identifierArena);
+            m_freeablePools.swap(otherArena.m_freeablePools);
             m_deletableObjects.swap(otherArena.m_deletableObjects);
             m_refCountedObjects.swap(otherArena.m_refCountedObjects);
         }
-        ~ParserArena();
 
-        void deleteWithArena(ParserArenaDeletable* object) { m_deletableObjects.append(object); }
-        void derefWithArena(PassRefPtr<ParserArenaRefCounted> object) { m_refCountedObjects.append(object); }
+        void* allocateFreeable(size_t size)
+        {
+            ASSERT(size);
+            ASSERT(size <= freeablePoolSize);
+            size_t alignedSize = alignSize(size);
+            ASSERT(alignedSize <= freeablePoolSize);
+            if (UNLIKELY(static_cast<size_t>(m_freeablePoolEnd - m_freeableMemory) < alignedSize))
+                allocateFreeablePool();
+            void* block = m_freeableMemory;
+            m_freeableMemory += alignedSize;
+            return block;
+        }
+
+        void* allocateDeletable(size_t size)
+        {
+            ParserArenaDeletable* deletable = static_cast<ParserArenaDeletable*>(fastMalloc(size));
+            m_deletableObjects.append(deletable);
+            return deletable;
+        }
 
+        void derefWithArena(PassRefPtr<ParserArenaRefCounted>);
         bool contains(ParserArenaRefCounted*) const;
         ParserArenaRefCounted* last() const;
         void removeLast();
 
-        bool isEmpty() const { return m_deletableObjects.isEmpty() && m_refCountedObjects.isEmpty(); }
+        bool isEmpty() const;
         void reset();
 
+        IdentifierArena& identifierArena() { return *m_identifierArena; }
+
     private:
+        static const size_t freeablePoolSize = 8000;
+
+        static size_t alignSize(size_t size)
+        {
+            return (size + sizeof(WTF::AllocAlignmentInteger) - 1) & ~(sizeof(WTF::AllocAlignmentInteger) - 1);
+        }
+
+        void* freeablePool();
+        void allocateFreeablePool();
+        void deallocateObjects();
+
+        char* m_freeableMemory;
+        char* m_freeablePoolEnd;
+
+        OwnPtr<IdentifierArena> m_identifierArena;
+        Vector<void*> m_freeablePools;
         Vector<ParserArenaDeletable*> m_deletableObjects;
         Vector<RefPtr<ParserArenaRefCounted> > m_refCountedObjects;
     };
diff --git a/JavaScriptCore/parser/SourceCode.h b/JavaScriptCore/parser/SourceCode.h
index 84360b8..9ba4da3 100644
--- a/JavaScriptCore/parser/SourceCode.h
+++ b/JavaScriptCore/parser/SourceCode.h
@@ -37,7 +37,8 @@ namespace JSC {
     class SourceCode {
     public:
         SourceCode()
-            : m_startChar(0)
+            : m_provider(0)
+            , m_startChar(0)
             , m_endChar(0)
             , m_firstLine(0)
         {
diff --git a/JavaScriptCore/pcre/dftables b/JavaScriptCore/pcre/dftables
index 8a2d140..1f0ea01 100755
--- a/JavaScriptCore/pcre/dftables
+++ b/JavaScriptCore/pcre/dftables
@@ -244,7 +244,7 @@ sub readHeaderValues()
  
     my ($fh, $tempFile) = tempfile(
         basename($0) . "-XXXXXXXX",
-        DIR => File::Spec->tmpdir,
+        DIR => File::Spec->tmpdir(),
         SUFFIX => ".in",
         UNLINK => 0,
     );
diff --git a/JavaScriptCore/profiler/ProfileGenerator.cpp b/JavaScriptCore/profiler/ProfileGenerator.cpp
index 1a061cb..dc68ecb 100644
--- a/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -27,6 +27,7 @@
 #include "ProfileGenerator.h"
 
 #include "CallFrame.h"
+#include "CodeBlock.h"
 #include "JSGlobalObject.h"
 #include "JSStringRef.h"
 #include "JSFunction.h"
diff --git a/JavaScriptCore/profiler/Profiler.cpp b/JavaScriptCore/profiler/Profiler.cpp
index e103fd1..6f72e08 100644
--- a/JavaScriptCore/profiler/Profiler.cpp
+++ b/JavaScriptCore/profiler/Profiler.cpp
@@ -31,6 +31,7 @@
 
 #include "CommonIdentifiers.h"
 #include "CallFrame.h"
+#include "CodeBlock.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "Nodes.h"
@@ -134,26 +135,27 @@ void Profiler::didExecute(ExecState* exec, const UString& sourceURL, int startin
     dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
 }
 
-CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue function, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
 {
-    if (!function)
+    if (!functionValue)
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
-    if (!function.isObject())
+    if (!functionValue.isObject())
         return CallIdentifier("(unknown)", defaultSourceURL, defaultLineNumber);
-    if (asObject(function)->inherits(&JSFunction::info)) {
-        JSFunction* func = asFunction(function);
-        if (!func->isHostFunction())
-            return createCallIdentifierFromFunctionImp(globalData, func);
+    if (asObject(functionValue)->inherits(&JSFunction::info)) {
+        JSFunction* function = asFunction(functionValue);
+        if (!function->executable()->isHostFunction())
+            return createCallIdentifierFromFunctionImp(globalData, function);
     }
-    if (asObject(function)->inherits(&InternalFunction::info))
-        return CallIdentifier(static_cast<InternalFunction*>(asObject(function))->name(globalData), defaultSourceURL, defaultLineNumber);
-    return CallIdentifier("(" + asObject(function)->className() + " object)", defaultSourceURL, defaultLineNumber);
+    if (asObject(functionValue)->inherits(&InternalFunction::info))
+        return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(globalData), defaultSourceURL, defaultLineNumber);
+    return CallIdentifier("(" + asObject(functionValue)->className() + " object)", defaultSourceURL, defaultLineNumber);
 }
 
 CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData* globalData, JSFunction* function)
 {
+    ASSERT(!function->isHostFunction());
     const UString& name = function->calculatedDisplayName(globalData);
-    return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->body()->sourceURL(), function->body()->lineNo());
+    return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->jsExecutable()->sourceURL(), function->jsExecutable()->lineNo());
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/ArgList.h b/JavaScriptCore/runtime/ArgList.h
index ab501b6..3227770 100644
--- a/JavaScriptCore/runtime/ArgList.h
+++ b/JavaScriptCore/runtime/ArgList.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008, 2009 Apple Computer, Inc.
+ *  Copyright (C) 2003, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -23,13 +23,14 @@
 #define ArgList_h
 
 #include "Register.h"
-
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
-    
+
+    class MarkStack;
+
     class MarkedArgumentBuffer : public Noncopyable {
     private:
         static const unsigned inlineCapacity = 8;
diff --git a/JavaScriptCore/runtime/Arguments.cpp b/JavaScriptCore/runtime/Arguments.cpp
index ec9c450..86a8f0a 100644
--- a/JavaScriptCore/runtime/Arguments.cpp
+++ b/JavaScriptCore/runtime/Arguments.cpp
@@ -179,6 +179,31 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool Arguments::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool isArrayIndex;
+    unsigned i = propertyName.toArrayIndex(&isArrayIndex);
+    if (isArrayIndex && i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
+        if (i < d->numParameters) {
+            descriptor.setDescriptor(d->registers[d->firstParameterIndex + i].jsValue(), DontEnum);
+        } else
+            descriptor.setDescriptor(d->extraArguments[i - d->numParameters].jsValue(), DontEnum);
+        return true;
+    }
+    
+    if (propertyName == exec->propertyNames().length && LIKELY(!d->overrodeLength)) {
+        descriptor.setDescriptor(jsNumber(exec, d->numArguments), DontEnum);
+        return true;
+    }
+    
+    if (propertyName == exec->propertyNames().callee && LIKELY(!d->overrodeCallee)) {
+        descriptor.setDescriptor(d->callee, DontEnum);
+        return true;
+    }
+    
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void Arguments::put(ExecState* exec, unsigned i, JSValue value, PutPropertySlot& slot)
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
diff --git a/JavaScriptCore/runtime/Arguments.h b/JavaScriptCore/runtime/Arguments.h
index 79fe720..5be84a2 100644
--- a/JavaScriptCore/runtime/Arguments.h
+++ b/JavaScriptCore/runtime/Arguments.h
@@ -28,6 +28,8 @@
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "Interpreter.h"
+#include "ObjectConstructor.h"
+#include "PrototypeFunction.h"
 
 namespace JSC {
 
@@ -90,6 +92,7 @@ namespace JSC {
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
@@ -113,18 +116,17 @@ namespace JSC {
     ALWAYS_INLINE void Arguments::getArgumentsData(CallFrame* callFrame, JSFunction*& function, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc)
     {
         function = callFrame->callee();
-    
-        CodeBlock* codeBlock = &function->body()->generatedBytecode();
-        int numParameters = codeBlock->m_numParameters;
+
+        int numParameters = function->jsExecutable()->parameterCount();
         argc = callFrame->argumentCount();
 
         if (argc <= numParameters)
-            argv = callFrame->registers() - RegisterFile::CallFrameHeaderSize - numParameters + 1; // + 1 to skip "this"
+            argv = callFrame->registers() - RegisterFile::CallFrameHeaderSize - numParameters;
         else
-            argv = callFrame->registers() - RegisterFile::CallFrameHeaderSize - numParameters - argc + 1; // + 1 to skip "this"
+            argv = callFrame->registers() - RegisterFile::CallFrameHeaderSize - numParameters - argc;
 
         argc -= 1; // - 1 to skip "this"
-        firstParameterIndex = -RegisterFile::CallFrameHeaderSize - numParameters + 1; // + 1 to skip "this"
+        firstParameterIndex = -RegisterFile::CallFrameHeaderSize - numParameters;
     }
 
     inline Arguments::Arguments(CallFrame* callFrame)
@@ -137,7 +139,7 @@ namespace JSC {
         int numArguments;
         getArgumentsData(callFrame, callee, firstParameterIndex, argv, numArguments);
 
-        d->numParameters = callee->body()->parameterCount();
+        d->numParameters = callee->jsExecutable()->parameterCount();
         d->firstParameterIndex = firstParameterIndex;
         d->numArguments = numArguments;
 
@@ -168,7 +170,7 @@ namespace JSC {
         : JSObject(callFrame->lexicalGlobalObject()->argumentsStructure())
         , d(new ArgumentsData)
     {
-        ASSERT(!callFrame->callee()->body()->parameterCount());
+        ASSERT(!callFrame->callee()->jsExecutable()->parameterCount());
 
         unsigned numArguments = callFrame->argumentCount() - 1;
 
@@ -214,8 +216,8 @@ namespace JSC {
     {
         ASSERT(!d()->registerArray);
 
-        size_t numParametersMinusThis = d()->functionBody->generatedBytecode().m_numParameters - 1;
-        size_t numVars = d()->functionBody->generatedBytecode().m_numVars;
+        size_t numParametersMinusThis = d()->functionExecutable->generatedBytecode().m_numParameters - 1;
+        size_t numVars = d()->functionExecutable->generatedBytecode().m_numVars;
         size_t numLocals = numVars + numParametersMinusThis;
 
         if (!numLocals)
diff --git a/JavaScriptCore/runtime/ArrayConstructor.cpp b/JavaScriptCore/runtime/ArrayConstructor.cpp
index e96bdfc..0237fd4 100644
--- a/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -25,15 +25,19 @@
 #include "ArrayConstructor.h"
 
 #include "ArrayPrototype.h"
+#include "Error.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Lookup.h"
+#include "PrototypeFunction.h"
 
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ArrayConstructor);
+    
+static JSValue JSC_HOST_CALL arrayConstructorIsArray(ExecState*, JSObject*, JSValue, const ArgList&);
 
-ArrayConstructor::ArrayConstructor(ExecState* exec, PassRefPtr<Structure> structure, ArrayPrototype* arrayPrototype)
+ArrayConstructor::ArrayConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, ArrayPrototype* arrayPrototype, Structure* prototypeFunctionStructure)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, arrayPrototype->classInfo()->className))
 {
     // ECMA 15.4.3.1 Array.prototype
@@ -41,6 +45,9 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, PassRefPtr<Structure> struct
 
     // no. of arguments for constructor
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
+
+    // ES5
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().isArray, arrayConstructorIsArray), DontEnum);
 }
 
 static JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
@@ -82,4 +89,9 @@ CallType ArrayConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
+JSValue JSC_HOST_CALL arrayConstructorIsArray(ExecState*, JSObject*, JSValue, const ArgList& args)
+{
+    return jsBoolean(args.at(0).inherits(&JSArray::info));
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/ArrayConstructor.h b/JavaScriptCore/runtime/ArrayConstructor.h
index 8300d8c..6d25400 100644
--- a/JavaScriptCore/runtime/ArrayConstructor.h
+++ b/JavaScriptCore/runtime/ArrayConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class ArrayConstructor : public InternalFunction {
     public:
-        ArrayConstructor(ExecState*, PassRefPtr<Structure>, ArrayPrototype*);
+        ArrayConstructor(ExecState*, NonNullPassRefPtr<Structure>, ArrayPrototype*, Structure*);
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
diff --git a/JavaScriptCore/runtime/ArrayPrototype.cpp b/JavaScriptCore/runtime/ArrayPrototype.cpp
index 807e59a..7a89447 100644
--- a/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -67,7 +67,7 @@ static JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState*, JSObject*, JS
 
 namespace JSC {
 
-static inline bool isNumericCompareFunction(CallType callType, const CallData& callData)
+static inline bool isNumericCompareFunction(ExecState* exec, CallType callType, const CallData& callData)
 {
     if (callType != CallTypeJS)
         return false;
@@ -75,10 +75,10 @@ static inline bool isNumericCompareFunction(CallType callType, const CallData& c
 #if ENABLE(JIT)
     // If the JIT is enabled then we need to preserve the invariant that every
     // function with a CodeBlock also has JIT code.
-    callData.js.functionBody->jitCode(callData.js.scopeChain);
-    CodeBlock& codeBlock = callData.js.functionBody->generatedBytecode();
+    callData.js.functionExecutable->jitCode(exec, callData.js.scopeChain);
+    CodeBlock& codeBlock = callData.js.functionExecutable->generatedBytecode();
 #else
-    CodeBlock& codeBlock = callData.js.functionBody->bytecode(callData.js.scopeChain);
+    CodeBlock& codeBlock = callData.js.functionExecutable->bytecode(exec, callData.js.scopeChain);
 #endif
 
     return codeBlock.isNumericCompareFunction();
@@ -115,7 +115,7 @@ const ClassInfo ArrayPrototype::info = {"Array", &JSArray::info, 0, ExecState::a
 */
 
 // ECMA 15.4.4
-ArrayPrototype::ArrayPrototype(PassRefPtr<Structure> structure)
+ArrayPrototype::ArrayPrototype(NonNullPassRefPtr<Structure> structure)
     : JSArray(structure)
 {
 }
@@ -125,6 +125,11 @@ bool ArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticFunctionSlot<JSArray>(exec, ExecState::arrayTable(exec), this, propertyName, slot);
 }
 
+bool ArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSArray>(exec, ExecState::arrayTable(exec), this, propertyName, descriptor);
+}
+
 // ------------------------------ Array Functions ----------------------------
 
 // Helper function
@@ -144,10 +149,11 @@ static void putProperty(ExecState* exec, JSObject* obj, const Identifier& proper
 
 JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&JSArray::info))
+    bool isRealArray = isJSArray(&exec->globalData(), thisValue);
+    if (!isRealArray && !thisValue.inherits(&JSArray::info))
         return throwError(exec, TypeError);
-    JSObject* thisObj = asArray(thisValue);
-
+    JSArray* thisObj = asArray(thisValue);
+    
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
     if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
         if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
@@ -158,39 +164,53 @@ JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoiding infinite recursion.
 
-    Vector<UChar, 256> strBuffer;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned totalSize = length ? length - 1 : 0;
+    Vector<RefPtr<UString::Rep>, 256> strBuffer(length);
     for (unsigned k = 0; k < length; k++) {
-        if (k >= 1)
-            strBuffer.append(',');
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-            break;
-        }
-
-        JSValue element = thisObj->get(exec, k);
+        JSValue element;
+        if (isRealArray && thisObj->canGetIndex(k))
+            element = thisObj->getIndex(k);
+        else
+            element = thisObj->get(exec, k);
+        
         if (element.isUndefinedOrNull())
             continue;
-
+        
         UString str = element.toString(exec);
-        strBuffer.append(str.data(), str.size());
-
+        strBuffer[k] = str.rep();
+        totalSize += str.size();
+        
         if (!strBuffer.data()) {
             JSObject* error = Error::create(exec, GeneralError, "Out of memory");
             exec->setException(error);
         }
-
+        
         if (exec->hadException())
             break;
     }
     arrayVisitedElements.remove(thisObj);
-    return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
+    if (!totalSize)
+        return jsEmptyString(exec);
+    Vector<UChar> buffer;
+    buffer.reserveCapacity(totalSize);
+    if (!buffer.data())
+        return throwError(exec, GeneralError, "Out of memory");
+        
+    for (unsigned i = 0; i < length; i++) {
+        if (i)
+            buffer.append(',');
+        if (RefPtr<UString::Rep> rep = strBuffer[i])
+            buffer.append(rep->data(), rep->size());
+    }
+    ASSERT(buffer.size() == totalSize);
+    unsigned finalSize = buffer.size();
+    return jsString(exec, UString(buffer.releaseBuffer(), finalSize, false));
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&JSArray::info))
+    if (!thisValue.inherits(&JSArray::info))
         return throwError(exec, TypeError);
     JSObject* thisObj = asArray(thisValue);
 
@@ -298,7 +318,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValue t
     ArgList::const_iterator it = args.begin();
     ArgList::const_iterator end = args.end();
     while (1) {
-        if (curArg.isObject(&JSArray::info)) {
+        if (curArg.inherits(&JSArray::info)) {
             unsigned length = curArg.get(exec, exec->propertyNames().length).toUInt32(exec);
             JSObject* curObject = curArg.toObject(exec);
             for (unsigned k = 0; k < length; ++k) {
@@ -456,7 +476,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec, JSObject*, JSValue thi
     CallType callType = function.getCallData(callData);
 
     if (thisObj->classInfo() == &JSArray::info) {
-        if (isNumericCompareFunction(callType, callData))
+        if (isNumericCompareFunction(exec, callType, callData))
             asArray(thisObj)->sortNumeric(exec, function, callType, callData);
         else if (callType != CallTypeNone)
             asArray(thisObj)->sort(exec, function, callType, callData);
diff --git a/JavaScriptCore/runtime/ArrayPrototype.h b/JavaScriptCore/runtime/ArrayPrototype.h
index 2165089..e52914c 100644
--- a/JavaScriptCore/runtime/ArrayPrototype.h
+++ b/JavaScriptCore/runtime/ArrayPrototype.h
@@ -28,9 +28,10 @@ namespace JSC {
 
     class ArrayPrototype : public JSArray {
     public:
-        explicit ArrayPrototype(PassRefPtr<Structure>);
+        explicit ArrayPrototype(NonNullPassRefPtr<Structure>);
 
         bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
diff --git a/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index b9f738f..929a5e7 100644
--- a/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_object(object)
         {
             if (!m_object->structure()->isDictionary())
-                m_object->setStructure(Structure::toDictionaryTransition(m_object->structure()));
+                m_object->setStructure(Structure::toCacheableDictionaryTransition(m_object->structure()));
         }
 
         ~BatchedTransitionOptimizer()
diff --git a/JavaScriptCore/runtime/BooleanConstructor.cpp b/JavaScriptCore/runtime/BooleanConstructor.cpp
index 9fcba37..b0d8df3 100644
--- a/JavaScriptCore/runtime/BooleanConstructor.cpp
+++ b/JavaScriptCore/runtime/BooleanConstructor.cpp
@@ -28,7 +28,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(BooleanConstructor);
 
-BooleanConstructor::BooleanConstructor(ExecState* exec, PassRefPtr<Structure> structure, BooleanPrototype* booleanPrototype)
+BooleanConstructor::BooleanConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, BooleanPrototype* booleanPrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, booleanPrototype->classInfo()->className))
 {
     putDirectWithoutTransition(exec->propertyNames().prototype, booleanPrototype, DontEnum | DontDelete | ReadOnly);
diff --git a/JavaScriptCore/runtime/BooleanConstructor.h b/JavaScriptCore/runtime/BooleanConstructor.h
index d9f51ab..1d8a26a 100644
--- a/JavaScriptCore/runtime/BooleanConstructor.h
+++ b/JavaScriptCore/runtime/BooleanConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class BooleanConstructor : public InternalFunction {
     public:
-        BooleanConstructor(ExecState*, PassRefPtr<Structure>, BooleanPrototype*);
+        BooleanConstructor(ExecState*, NonNullPassRefPtr<Structure>, BooleanPrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/JavaScriptCore/runtime/BooleanObject.cpp b/JavaScriptCore/runtime/BooleanObject.cpp
index 01f695a..c9b3846 100644
--- a/JavaScriptCore/runtime/BooleanObject.cpp
+++ b/JavaScriptCore/runtime/BooleanObject.cpp
@@ -27,7 +27,7 @@ ASSERT_CLASS_FITS_IN_CELL(BooleanObject);
 
 const ClassInfo BooleanObject::info = { "Boolean", 0, 0, 0 };
 
-BooleanObject::BooleanObject(PassRefPtr<Structure> structure)
+BooleanObject::BooleanObject(NonNullPassRefPtr<Structure> structure)
     : JSWrapperObject(structure)
 {
 }
diff --git a/JavaScriptCore/runtime/BooleanObject.h b/JavaScriptCore/runtime/BooleanObject.h
index cfd55fe..28f796a 100644
--- a/JavaScriptCore/runtime/BooleanObject.h
+++ b/JavaScriptCore/runtime/BooleanObject.h
@@ -27,10 +27,15 @@ namespace JSC {
 
     class BooleanObject : public JSWrapperObject {
     public:
-        explicit BooleanObject(PassRefPtr<Structure>);
+        explicit BooleanObject(NonNullPassRefPtr<Structure>);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
+        
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+        }
     };
 
     BooleanObject* asBooleanObject(JSValue);
diff --git a/JavaScriptCore/runtime/BooleanPrototype.cpp b/JavaScriptCore/runtime/BooleanPrototype.cpp
index 703a568..8d338f9 100644
--- a/JavaScriptCore/runtime/BooleanPrototype.cpp
+++ b/JavaScriptCore/runtime/BooleanPrototype.cpp
@@ -37,7 +37,7 @@ static JSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState*, JSObject*, JSVa
 
 // ECMA 15.6.4
 
-BooleanPrototype::BooleanPrototype(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
+BooleanPrototype::BooleanPrototype(ExecState* exec, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
     : BooleanObject(structure)
 {
     setInternalValue(jsBoolean(false));
@@ -59,7 +59,7 @@ JSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec, JSObject*, JSVal
     if (thisValue == jsBoolean(true))
         return jsNontrivialString(exec, "true");
 
-    if (!thisValue.isObject(&BooleanObject::info))
+    if (!thisValue.inherits(&BooleanObject::info))
         return throwError(exec, TypeError);
 
     if (asBooleanObject(thisValue)->internalValue() == jsBoolean(false))
@@ -74,7 +74,7 @@ JSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec, JSObject*, JSValu
     if (thisValue.isBoolean())
         return thisValue;
 
-    if (!thisValue.isObject(&BooleanObject::info))
+    if (!thisValue.inherits(&BooleanObject::info))
         return throwError(exec, TypeError);
 
     return asBooleanObject(thisValue)->internalValue();
diff --git a/JavaScriptCore/runtime/BooleanPrototype.h b/JavaScriptCore/runtime/BooleanPrototype.h
index 16f80b5..cc69b3f 100644
--- a/JavaScriptCore/runtime/BooleanPrototype.h
+++ b/JavaScriptCore/runtime/BooleanPrototype.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class BooleanPrototype : public BooleanObject {
     public:
-        BooleanPrototype(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+        BooleanPrototype(ExecState*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure);
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/CallData.h b/JavaScriptCore/runtime/CallData.h
index d5b0172..24c19f9 100644
--- a/JavaScriptCore/runtime/CallData.h
+++ b/JavaScriptCore/runtime/CallData.h
@@ -35,7 +35,7 @@ namespace JSC {
 
     class ArgList;
     class ExecState;
-    class FunctionBodyNode;
+    class FunctionExecutable;
     class JSObject;
     class JSValue;
     class ScopeChainNode;
@@ -53,7 +53,7 @@ namespace JSC {
             NativeFunction function;
         } native;
         struct {
-            FunctionBodyNode* functionBody;
+            FunctionExecutable* functionExecutable;
             ScopeChainNode* scopeChain;
         } js;
     };
diff --git a/JavaScriptCore/runtime/Collector.cpp b/JavaScriptCore/runtime/Collector.cpp
index c188016..1a5eb89 100644
--- a/JavaScriptCore/runtime/Collector.cpp
+++ b/JavaScriptCore/runtime/Collector.cpp
@@ -23,8 +23,10 @@
 
 #include "ArgList.h"
 #include "CallFrame.h"
+#include "CodeBlock.h"
 #include "CollectorHeapIterator.h"
 #include "Interpreter.h"
+#include "JSArray.h"
 #include "JSGlobalObject.h"
 #include "JSLock.h"
 #include "JSONObject.h"
@@ -58,11 +60,18 @@
 #elif PLATFORM(WIN_OS)
 
 #include <windows.h>
+#include <malloc.h>
+
+#elif PLATFORM(HAIKU)
+
+#include <OS.h>
 
 #elif PLATFORM(UNIX)
 
 #include <stdlib.h>
+#if !PLATFORM(HAIKU)
 #include <sys/mman.h>
+#endif
 #include <unistd.h>
 
 #if PLATFORM(SOLARIS)
@@ -75,9 +84,15 @@
 #include <pthread_np.h>
 #endif
 
+#if PLATFORM(QNX)
+#include <fcntl.h>
+#include <sys/procfs.h>
+#include <stdio.h>
+#include <errno.h>
+#endif
+
 #endif
 
-#define DEBUG_COLLECTOR 0
 #define COLLECT_ON_EVERY_ALLOCATION 0
 
 using std::max;
@@ -86,7 +101,6 @@ namespace JSC {
 
 // tunable parameters
 
-const size_t SPARE_EMPTY_BLOCKS = 2;
 const size_t GROWTH_FACTOR = 2;
 const size_t LOW_WATER_FACTOR = 4;
 const size_t ALLOCATIONS_PER_COLLECTION = 4000;
@@ -99,8 +113,6 @@ const size_t MAX_NUM_BLOCKS = 256; // Max size of collector heap set to 16 MB
 static RHeap* userChunk = 0;
 #endif
 
-static void freeHeap(CollectorHeap*);
-
 #if ENABLE(JSC_MULTIPLE_THREADS)
 
 #if PLATFORM(DARWIN)
@@ -189,8 +201,8 @@ void Heap::destroy()
 
     ASSERT(!primaryHeap.numLiveObjects);
 
-    freeHeap(&primaryHeap);
-    freeHeap(&numberHeap);
+    freeBlocks(&primaryHeap);
+    freeBlocks(&numberHeap);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     if (m_currentThreadRegistrar) {
@@ -210,7 +222,7 @@ void Heap::destroy()
 }
 
 template <HeapType heapType>
-static NEVER_INLINE CollectorBlock* allocateBlock()
+NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 {
 #if PLATFORM(DARWIN)
     vm_address_t address = 0;
@@ -224,9 +236,15 @@ static NEVER_INLINE CollectorBlock* allocateBlock()
     uintptr_t address = reinterpret_cast<uintptr_t>(mask);
 
     memset(reinterpret_cast<void*>(address), 0, BLOCK_SIZE);
+#elif PLATFORM(WINCE)
+    void* address = VirtualAlloc(NULL, BLOCK_SIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
 #elif PLATFORM(WIN_OS)
-     // windows virtual address granularity is naturally 64k
-    LPVOID address = VirtualAlloc(NULL, BLOCK_SIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+#if COMPILER(MINGW)
+    void* address = __mingw_aligned_malloc(BLOCK_SIZE, BLOCK_SIZE);
+#else
+    void* address = _aligned_malloc(BLOCK_SIZE, BLOCK_SIZE);
+#endif
+    memset(address, 0, BLOCK_SIZE);
 #elif HAVE(POSIX_MEMALIGN)
     void* address;
     posix_memalign(&address, BLOCK_SIZE, BLOCK_SIZE);
@@ -258,18 +276,58 @@ static NEVER_INLINE CollectorBlock* allocateBlock()
     address += adjust;
     memset(reinterpret_cast<void*>(address), 0, BLOCK_SIZE);
 #endif
-    reinterpret_cast<CollectorBlock*>(address)->type = heapType;
-    return reinterpret_cast<CollectorBlock*>(address);
+
+    CollectorBlock* block = reinterpret_cast<CollectorBlock*>(address);
+    block->freeList = block->cells;
+    block->heap = this;
+    block->type = heapType;
+
+    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
+    size_t numBlocks = heap.numBlocks;
+    if (heap.usedBlocks == numBlocks) {
+        static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
+        if (numBlocks > maxNumBlocks)
+            CRASH();
+        numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
+        heap.numBlocks = numBlocks;
+        heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, numBlocks * sizeof(CollectorBlock*)));
+    }
+    heap.blocks[heap.usedBlocks++] = block;
+
+    return block;
+}
+
+template <HeapType heapType>
+NEVER_INLINE void Heap::freeBlock(size_t block)
+{
+    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
+
+    freeBlock(heap.blocks[block]);
+
+    // swap with the last block so we compact as we go
+    heap.blocks[block] = heap.blocks[heap.usedBlocks - 1];
+    heap.usedBlocks--;
+
+    if (heap.numBlocks > MIN_ARRAY_SIZE && heap.usedBlocks < heap.numBlocks / LOW_WATER_FACTOR) {
+        heap.numBlocks = heap.numBlocks / GROWTH_FACTOR; 
+        heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock*)));
+    }
 }
 
-static void freeBlock(CollectorBlock* block)
+NEVER_INLINE void Heap::freeBlock(CollectorBlock* block)
 {
 #if PLATFORM(DARWIN)    
     vm_deallocate(current_task(), reinterpret_cast<vm_address_t>(block), BLOCK_SIZE);
 #elif PLATFORM(SYMBIAN)
     userChunk->Free(reinterpret_cast<TAny*>(block));
-#elif PLATFORM(WIN_OS)
+#elif PLATFORM(WINCE)
     VirtualFree(block, 0, MEM_RELEASE);
+#elif PLATFORM(WIN_OS)
+#if COMPILER(MINGW)
+    __mingw_aligned_free(block);
+#else
+    _aligned_free(block);
+#endif
 #elif HAVE(POSIX_MEMALIGN)
     free(block);
 #else
@@ -277,7 +335,7 @@ static void freeBlock(CollectorBlock* block)
 #endif
 }
 
-static void freeHeap(CollectorHeap* heap)
+void Heap::freeBlocks(CollectorHeap* heap)
 {
     for (size_t i = 0; i < heap->usedBlocks; ++i)
         if (heap->blocks[i])
@@ -370,38 +428,23 @@ collect:
 #ifndef NDEBUG
             heap.operationInProgress = NoOperation;
 #endif
-            bool collected = collect();
+            bool foundGarbage = collect();
+            numLiveObjects = heap.numLiveObjects;
+            usedBlocks = heap.usedBlocks;
+            i = heap.firstBlockWithPossibleSpace;
 #ifndef NDEBUG
             heap.operationInProgress = Allocation;
 #endif
-            if (collected) {
-                numLiveObjects = heap.numLiveObjects;
-                usedBlocks = heap.usedBlocks;
-                i = heap.firstBlockWithPossibleSpace;
+            if (foundGarbage)
                 goto scan;
-            }
-        }
-  
-        // didn't find a block, and GC didn't reclaim anything, need to allocate a new block
-        size_t numBlocks = heap.numBlocks;
-        if (usedBlocks == numBlocks) {
-            static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
-            if (numBlocks > maxNumBlocks)
-                CRASH();
-            numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
-            heap.numBlocks = numBlocks;
-            heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, numBlocks * sizeof(CollectorBlock*)));
         }
 
+        // didn't find a block, and GC didn't reclaim anything, need to allocate a new block
         targetBlock = reinterpret_cast<Block*>(allocateBlock<heapType>());
-        targetBlock->freeList = targetBlock->cells;
-        targetBlock->heap = this;
+        heap.firstBlockWithPossibleSpace = heap.usedBlocks - 1;
         targetBlockUsedCells = 0;
-        heap.blocks[usedBlocks] = reinterpret_cast<CollectorBlock*>(targetBlock);
-        heap.usedBlocks = usedBlocks + 1;
-        heap.firstBlockWithPossibleSpace = usedBlocks;
     }
-  
+
     // find a free spot in the block and detach it from the free list
     Cell* newCell = targetBlock->freeList;
 
@@ -486,6 +529,33 @@ static void* getStackBase(void* previousFrame)
 }
 #endif
 
+#if PLATFORM(QNX)
+static inline void *currentThreadStackBaseQNX()
+{
+    static void* stackBase = 0;
+    static size_t stackSize = 0;
+    static pthread_t stackThread;
+    pthread_t thread = pthread_self();
+    if (stackBase == 0 || thread != stackThread) {
+        struct _debug_thread_info threadInfo;
+        memset(&threadInfo, 0, sizeof(threadInfo));
+        threadInfo.tid = pthread_self();
+        int fd = open("/proc/self", O_RDONLY);
+        if (fd == -1) {
+            LOG_ERROR("Unable to open /proc/self (errno: %d)", errno);
+            return 0;
+        }
+        devctl(fd, DCMD_PROC_TIDSTATUS, &threadInfo, sizeof(threadInfo), 0);
+        close(fd);
+        stackBase = reinterpret_cast<void*>(threadInfo.stkbase);
+        stackSize = threadInfo.stksize;
+        ASSERT(stackBase);
+        stackThread = thread;
+    }
+    return static_cast<char*>(stackBase) + stackSize;
+}
+#endif
+
 static inline void* currentThreadStackBase()
 {
 #if PLATFORM(DARWIN)
@@ -511,6 +581,8 @@ static inline void* currentThreadStackBase()
           : "=r" (pTib)
         );
     return static_cast<void*>(pTib->StackBase);
+#elif PLATFORM(QNX)
+    return currentThreadStackBaseQNX();
 #elif PLATFORM(SOLARIS)
     stack_t s;
     thr_stksegment(&s);
@@ -529,6 +601,10 @@ static inline void* currentThreadStackBase()
         stackBase = (void*)info.iBase;
     }
     return (void*)stackBase;
+#elif PLATFORM(HAIKU)
+    thread_info threadInfo;
+    get_thread_info(find_thread(NULL), &threadInfo);
+    return threadInfo.stack_end;
 #elif PLATFORM(UNIX)
     static void* stackBase = 0;
     static size_t stackSize = 0;
@@ -587,6 +663,8 @@ void Heap::makeUsableFromMultipleThreads()
 
 void Heap::registerThread()
 {
+    ASSERT(!m_globalData->mainThreadOnly || isMainThread());
+
     if (!m_currentThreadRegistrar || pthread_getspecific(m_currentThreadRegistrar))
         return;
 
@@ -683,7 +761,7 @@ void Heap::markConservatively(MarkStack& markStack, void* start, void* end)
             // Mark the primary heap
             for (size_t block = 0; block < usedPrimaryBlocks; block++) {
                 if ((primaryBlocks[block] == blockAddr) & (offset <= lastCellOffset)) {
-                    if (reinterpret_cast<CollectorCell*>(xAsBits)->u.freeCell.zeroIfFree != 0) {
+                    if (reinterpret_cast<CollectorCell*>(xAsBits)->u.freeCell.zeroIfFree) {
                         markStack.append(reinterpret_cast<JSCell*>(xAsBits));
                         markStack.drain();
                     }
@@ -704,10 +782,16 @@ void NEVER_INLINE Heap::markCurrentThreadConservativelyInternal(MarkStack& markS
     markConservatively(markStack, stackPointer, stackBase);
 }
 
+#if COMPILER(GCC)
+#define REGISTER_BUFFER_ALIGNMENT __attribute__ ((aligned (sizeof(void*))))
+#else
+#define REGISTER_BUFFER_ALIGNMENT
+#endif
+
 void Heap::markCurrentThreadConservatively(MarkStack& markStack)
 {
     // setjmp forces volatile registers onto the stack
-    jmp_buf registers;
+    jmp_buf registers REGISTER_BUFFER_ALIGNMENT;
 #if COMPILER(MSVC)
 #pragma warning(push)
 #pragma warning(disable: 4611)
@@ -896,16 +980,6 @@ void Heap::markStackObjectsConservatively(MarkStack& markStack)
 #endif
 }
 
-void Heap::setGCProtectNeedsLocking()
-{
-    // Most clients do not need to call this, with the notable exception of WebCore.
-    // Clients that use shared heap have JSLock protection, while others are supposed
-    // to do explicit locking. WebCore violates this contract in Database code,
-    // which calls gcUnprotect from a secondary thread.
-    if (!m_protectedValuesMutex)
-        m_protectedValuesMutex.set(new Mutex);
-}
-
 void Heap::protect(JSValue k)
 {
     ASSERT(k);
@@ -914,13 +988,7 @@ void Heap::protect(JSValue k)
     if (!k.isCell())
         return;
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     m_protectedValues.add(k.asCell());
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
 }
 
 void Heap::unprotect(JSValue k)
@@ -931,38 +999,16 @@ void Heap::unprotect(JSValue k)
     if (!k.isCell())
         return;
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     m_protectedValues.remove(k.asCell());
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
-}
-
-Heap* Heap::heap(JSValue v)
-{
-    if (!v.isCell())
-        return 0;
-    return Heap::cellBlock(v.asCell())->heap;
 }
 
 void Heap::markProtectedObjects(MarkStack& markStack)
 {
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it) {
-        JSCell* val = it->first;
-        if (!val->marked()) {
-            markStack.append(val);
-            markStack.drain();
-        }
+        markStack.append(it->first);
+        markStack.drain();
     }
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
 }
 
 template <HeapType heapType> size_t Heap::sweep()
@@ -1036,31 +1082,34 @@ template <HeapType heapType> size_t Heap::sweep()
         curBlock->freeList = freeList;
         curBlock->marked.clearAll();
         
-        if (usedCells == 0) {
-            emptyBlocks++;
-            if (emptyBlocks > SPARE_EMPTY_BLOCKS) {
-#if !DEBUG_COLLECTOR
-                freeBlock(reinterpret_cast<CollectorBlock*>(curBlock));
-#endif
-                // swap with the last block so we compact as we go
-                heap.blocks[block] = heap.blocks[heap.usedBlocks - 1];
-                heap.usedBlocks--;
-                block--; // Don't move forward a step in this case
-                
-                if (heap.numBlocks > MIN_ARRAY_SIZE && heap.usedBlocks < heap.numBlocks / LOW_WATER_FACTOR) {
-                    heap.numBlocks = heap.numBlocks / GROWTH_FACTOR; 
-                    heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock*)));
-                }
-            }
-        }
+        if (!usedCells)
+            ++emptyBlocks;
     }
     
     if (heap.numLiveObjects != numLiveObjects)
         heap.firstBlockWithPossibleSpace = 0;
-        
+    
     heap.numLiveObjects = numLiveObjects;
     heap.numLiveObjectsAtLastCollect = numLiveObjects;
     heap.extraCost = 0;
+    
+    if (!emptyBlocks)
+        return numLiveObjects;
+
+    size_t neededCells = 1.25f * (numLiveObjects + max(ALLOCATIONS_PER_COLLECTION, numLiveObjects));
+    size_t neededBlocks = (neededCells + HeapConstants<heapType>::cellsPerBlock - 1) / HeapConstants<heapType>::cellsPerBlock;
+    for (size_t block = 0; block < heap.usedBlocks; block++) {
+        if (heap.usedBlocks <= neededBlocks)
+            break;
+
+        Block* curBlock = reinterpret_cast<Block*>(heap.blocks[block]);
+        if (curBlock->usedCells)
+            continue;
+
+        freeBlock<heapType>(block);
+        block--; // Don't move forward a step in this case
+    }
+
     return numLiveObjects;
 }
 
@@ -1087,12 +1136,12 @@ bool Heap::collect()
     markProtectedObjects(markStack);
     if (m_markListSet && m_markListSet->size())
         MarkedArgumentBuffer::markLists(markStack, *m_markListSet);
-    if (m_globalData->exception && !m_globalData->exception.marked())
+    if (m_globalData->exception)
         markStack.append(m_globalData->exception);
     m_globalData->interpreter->registerFile().markCallFrames(markStack, this);
-    m_globalData->smallStrings.mark();
-    if (m_globalData->scopeNodeBeingReparsed)
-        m_globalData->scopeNodeBeingReparsed->markAggregate(markStack);
+    m_globalData->smallStrings.markChildren(markStack);
+    if (m_globalData->functionCodeBlockBeingReparsed)
+        m_globalData->functionCodeBlockBeingReparsed->markAggregate(markStack);
     if (m_globalData->firstStringifierToMark)
         JSONObject::markStringifiers(markStack, m_globalData->firstStringifierToMark);
 
@@ -1151,9 +1200,6 @@ size_t Heap::globalObjectCount()
 
 size_t Heap::protectedGlobalObjectCount()
 {
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     size_t count = 0;
     if (JSGlobalObject* head = m_globalData->head) {
         JSGlobalObject* o = head;
@@ -1164,23 +1210,12 @@ size_t Heap::protectedGlobalObjectCount()
         } while (o != head);
     }
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
-
     return count;
 }
 
 size_t Heap::protectedObjectCount()
 {
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
-    size_t result = m_protectedValues.size();
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
-
-    return result;
+    return m_protectedValues.size();
 }
 
 static const char* typeName(JSCell* cell)
@@ -1194,7 +1229,7 @@ static const char* typeName(JSCell* cell)
     if (cell->isGetterSetter())
         return "gettersetter";
     ASSERT(cell->isObject());
-    const ClassInfo* info = static_cast<JSObject*>(cell)->classInfo();
+    const ClassInfo* info = cell->classInfo();
     return info ? info->className : "Object";
 }
 
@@ -1202,16 +1237,10 @@ HashCountedSet<const char*>* Heap::protectedObjectTypeCounts()
 {
     HashCountedSet<const char*>* counts = new HashCountedSet<const char*>;
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it)
         counts->add(typeName(it->first));
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
-
     return counts;
 }
 
diff --git a/JavaScriptCore/runtime/Collector.h b/JavaScriptCore/runtime/Collector.h
index 877f890..2ce13dc 100644
--- a/JavaScriptCore/runtime/Collector.h
+++ b/JavaScriptCore/runtime/Collector.h
@@ -96,11 +96,11 @@ namespace JSC {
         };
         Statistics statistics() const;
 
-        void setGCProtectNeedsLocking();
         void protect(JSValue);
         void unprotect(JSValue);
 
         static Heap* heap(JSValue); // 0 for immediate values
+        static Heap* heap(JSCell*);
 
         size_t globalObjectCount();
         size_t protectedObjectCount();
@@ -133,6 +133,11 @@ namespace JSC {
         Heap(JSGlobalData*);
         ~Heap();
 
+        template <HeapType heapType> NEVER_INLINE CollectorBlock* allocateBlock();
+        template <HeapType heapType> NEVER_INLINE void freeBlock(size_t);
+        NEVER_INLINE void freeBlock(CollectorBlock*);
+        void freeBlocks(CollectorHeap*);
+
         void recordExtraCost(size_t);
         void markProtectedObjects(MarkStack&);
         void markCurrentThreadConservatively(MarkStack&);
@@ -145,7 +150,6 @@ namespace JSC {
         CollectorHeap primaryHeap;
         CollectorHeap numberHeap;
 
-        OwnPtr<Mutex> m_protectedValuesMutex; // Only non-null if the client explicitly requested it via setGCPrtotectNeedsLocking().
         ProtectCountSet m_protectedValues;
 
         HashSet<MarkedArgumentBuffer*>* m_markListSet;
@@ -175,7 +179,11 @@ namespace JSC {
 #endif
     template<> struct CellSize<sizeof(uint64_t)> { static const size_t m_value = 64; };
 
-    const size_t BLOCK_SIZE = 16 * 4096; // 64k
+#if PLATFORM(WINCE) || PLATFORM(SYMBIAN)
+    const size_t BLOCK_SIZE = 64 * 1024; // 64k
+#else
+    const size_t BLOCK_SIZE = 64 * 4096; // 256k
+#endif
 
     // derived constants
     const size_t BLOCK_OFFSET_MASK = BLOCK_SIZE - 1;
diff --git a/JavaScriptCore/runtime/CommonIdentifiers.h b/JavaScriptCore/runtime/CommonIdentifiers.h
index 148d3dd..abe5038 100644
--- a/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -37,17 +37,26 @@
     macro(callee) \
     macro(caller) \
     macro(compile) \
+    macro(configurable) \
     macro(constructor) \
+    macro(create) \
+    macro(defineProperty) \
+    macro(defineProperties) \
+    macro(enumerable) \
     macro(eval) \
     macro(exec) \
     macro(fromCharCode) \
     macro(global) \
+    macro(get) \
     macro(getPrototypeOf) \
+    macro(getOwnPropertyDescriptor) \
     macro(hasOwnProperty) \
     macro(ignoreCase) \
     macro(index) \
     macro(input) \
+    macro(isArray) \
     macro(isPrototypeOf) \
+    macro(keys) \
     macro(length) \
     macro(message) \
     macro(multiline) \
@@ -56,6 +65,7 @@
     macro(parse) \
     macro(propertyIsEnumerable) \
     macro(prototype) \
+    macro(set) \
     macro(source) \
     macro(test) \
     macro(toExponential) \
@@ -66,7 +76,9 @@
     macro(toPrecision) \
     macro(toString) \
     macro(UTC) \
+    macro(value) \
     macro(valueOf) \
+    macro(writable) \
     macro(displayName)
 
 namespace JSC {
diff --git a/JavaScriptCore/runtime/Completion.cpp b/JavaScriptCore/runtime/Completion.cpp
index b8b1581..2507698 100644
--- a/JavaScriptCore/runtime/Completion.cpp
+++ b/JavaScriptCore/runtime/Completion.cpp
@@ -31,40 +31,33 @@
 #include "Debugger.h"
 #include <stdio.h>
 
-#if !PLATFORM(WIN_OS)
-#include <unistd.h>
-#endif
-
 namespace JSC {
 
 Completion checkSyntax(ExecState* exec, const SourceCode& source)
 {
     JSLock lock(exec);
 
-    int errLine;
-    UString errMsg;
+    RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
+    JSObject* error = program->checkSyntax(exec);
+    if (error)
+        return Completion(Throw, error);
 
-    RefPtr<ProgramNode> progNode = exec->globalData().parser->parse<ProgramNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
-    if (!progNode)
-        return Completion(Throw, Error::create(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url()));
     return Completion(Normal);
 }
 
 Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValue thisValue)
 {
     JSLock lock(exec);
-    
-    int errLine;
-    UString errMsg;
-    RefPtr<ProgramNode> programNode = exec->globalData().parser->parse<ProgramNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
 
-    if (!programNode)
-        return Completion(Throw, Error::create(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url()));
+    RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
+    JSObject* error = program->compile(exec, scopeChain.node());
+    if (error)
+        return Completion(Throw, error);
 
     JSObject* thisObj = (!thisValue || thisValue.isUndefinedOrNull()) ? exec->dynamicGlobalObject() : thisValue.toObject(exec);
 
     JSValue exception;
-    JSValue result = exec->interpreter()->execute(programNode.get(), exec, scopeChain.node(), thisObj, &exception);
+    JSValue result = exec->interpreter()->execute(program.get(), exec, scopeChain.node(), thisObj, &exception);
 
     if (exception) {
         if (exception.isObject() && asObject(exception)->isWatchdogException())
diff --git a/JavaScriptCore/runtime/ConstructData.h b/JavaScriptCore/runtime/ConstructData.h
index 9d580d5..6b954a6 100644
--- a/JavaScriptCore/runtime/ConstructData.h
+++ b/JavaScriptCore/runtime/ConstructData.h
@@ -33,7 +33,7 @@ namespace JSC {
 
     class ArgList;
     class ExecState;
-    class FunctionBodyNode;
+    class FunctionExecutable;
     class JSObject;
     class JSValue;
     class ScopeChainNode;
@@ -51,7 +51,7 @@ namespace JSC {
             NativeConstructor function;
         } native;
         struct {
-            FunctionBodyNode* functionBody;
+            FunctionExecutable* functionExecutable;
             ScopeChainNode* scopeChain;
         } js;
     };
diff --git a/JavaScriptCore/runtime/DateConstructor.cpp b/JavaScriptCore/runtime/DateConstructor.cpp
index 2f52cff..f9b7d84 100644
--- a/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/JavaScriptCore/runtime/DateConstructor.cpp
@@ -57,7 +57,7 @@ static JSValue JSC_HOST_CALL dateParse(ExecState*, JSObject*, JSValue, const Arg
 static JSValue JSC_HOST_CALL dateNow(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL dateUTC(ExecState*, JSObject*, JSValue, const ArgList&);
 
-DateConstructor::DateConstructor(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure, DatePrototype* datePrototype)
+DateConstructor::DateConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure, DatePrototype* datePrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, datePrototype->classInfo()->className))
 {
       putDirectWithoutTransition(exec->propertyNames().prototype, datePrototype, DontEnum|DontDelete|ReadOnly);
@@ -79,7 +79,7 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
     if (numArgs == 0) // new Date() ECMA 15.9.3.3
         value = getCurrentUTCTime();
     else if (numArgs == 1) {
-        if (args.at(0).isObject(&DateInstance::info))
+        if (args.at(0).inherits(&DateInstance::info))
             value = asDateInstance(args.at(0))->internalNumber();
         else {
             JSValue primitive = args.at(0).toPrimitive(exec);
diff --git a/JavaScriptCore/runtime/DateConstructor.h b/JavaScriptCore/runtime/DateConstructor.h
index dcef3cc..10e450e 100644
--- a/JavaScriptCore/runtime/DateConstructor.h
+++ b/JavaScriptCore/runtime/DateConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class DateConstructor : public InternalFunction {
     public:
-        DateConstructor(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure, DatePrototype*);
+        DateConstructor(ExecState*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure, DatePrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/JavaScriptCore/runtime/DateInstance.cpp b/JavaScriptCore/runtime/DateInstance.cpp
index 62791ae..4cd58f5 100644
--- a/JavaScriptCore/runtime/DateInstance.cpp
+++ b/JavaScriptCore/runtime/DateInstance.cpp
@@ -22,6 +22,8 @@
 #include "config.h"
 #include "DateInstance.h"
 
+#include "JSGlobalObject.h"
+
 #include <math.h>
 #include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
@@ -39,12 +41,19 @@ struct DateInstance::Cache {
 
 const ClassInfo DateInstance::info = {"Date", 0, 0, 0};
 
-DateInstance::DateInstance(PassRefPtr<Structure> structure)
+DateInstance::DateInstance(NonNullPassRefPtr<Structure> structure)
     : JSWrapperObject(structure)
     , m_cache(0)
 {
 }
 
+DateInstance::DateInstance(ExecState* exec, double time)
+    : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
+    , m_cache(0)
+{
+    setInternalValue(jsNumber(exec, timeClip(time)));
+}
+
 DateInstance::~DateInstance()
 {
     delete m_cache;
diff --git a/JavaScriptCore/runtime/DateInstance.h b/JavaScriptCore/runtime/DateInstance.h
index 3b73521..36d90b1 100644
--- a/JavaScriptCore/runtime/DateInstance.h
+++ b/JavaScriptCore/runtime/DateInstance.h
@@ -31,7 +31,8 @@ namespace JSC {
 
     class DateInstance : public JSWrapperObject {
     public:
-        explicit DateInstance(PassRefPtr<Structure>);
+        DateInstance(ExecState*, double);
+        explicit DateInstance(NonNullPassRefPtr<Structure>);
         virtual ~DateInstance();
 
         double internalNumber() const { return internalValue().uncheckedGetNumber(); }
@@ -41,7 +42,7 @@ namespace JSC {
         bool getTime(double& milliseconds, int& offset) const;
         bool getUTCTime(double& milliseconds) const;
 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
         void msToGregorianDateTime(double, bool outputIsUTC, WTF::GregorianDateTime&) const;
 
diff --git a/JavaScriptCore/runtime/DatePrototype.cpp b/JavaScriptCore/runtime/DatePrototype.cpp
index e2482f4..e46ab67 100644
--- a/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/JavaScriptCore/runtime/DatePrototype.cpp
@@ -198,8 +198,8 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 {
 #if HAVE(LANGINFO_H)
     static const nl_item formats[] = { D_T_FMT, D_FMT, T_FMT };
-#elif PLATFORM(WINCE) && !PLATFORM(QT)
-    // strftime() we are using does not support #
+#elif (PLATFORM(WINCE) && !PLATFORM(QT)) || PLATFORM(SYMBIAN)
+     // strftime() does not support '#' on WinCE or Symbian
     static const char* const formatStrings[] = { "%c", "%x", "%X" };
 #else
     static const char* const formatStrings[] = { "%#c", "%#x", "%X" };
@@ -395,7 +395,7 @@ const ClassInfo DatePrototype::info = {"Date", &DateInstance::info, 0, ExecState
 
 // ECMA 15.9.4
 
-DatePrototype::DatePrototype(ExecState* exec, PassRefPtr<Structure> structure)
+DatePrototype::DatePrototype(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     : DateInstance(structure)
 {
     setInternalValue(jsNaN(exec));
@@ -407,11 +407,17 @@ bool DatePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticFunctionSlot<JSObject>(exec, ExecState::dateTable(exec), this, propertyName, slot);
 }
 
+
+bool DatePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, ExecState::dateTable(exec), this, propertyName, descriptor);
+}
+
 // Functions
 
 JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -428,7 +434,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -445,7 +451,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSVal
 
 JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
     
     const bool utc = true;
@@ -457,17 +463,17 @@ JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSVal
     
     GregorianDateTime t;
     thisDateObj->msToGregorianDateTime(milli, utc, t);
-    // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second)
-    // 6 for formatting and one for null termination = 23.  We add one extra character to allow us to force null termination.
-    char buffer[24];
-    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second);
+    // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second) + 4 (. + 3 digits for milliseconds)
+    // 6 for formatting and one for null termination = 27.  We add one extra character to allow us to force null termination.
+    char buffer[28];
+    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second, static_cast<int>(fmod(milli, 1000)));
     buffer[sizeof(buffer) - 1] = 0;
     return jsNontrivialString(exec, buffer);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -484,7 +490,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSVa
 
 JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -501,7 +507,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSVa
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -514,7 +520,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JS
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -527,7 +533,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -540,7 +546,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*
 
 JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -553,7 +559,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue t
 
 JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -570,7 +576,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSVal
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -587,7 +593,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JS
 
 JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -604,7 +610,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSVal
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -621,7 +627,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -638,7 +644,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSVal
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -655,7 +661,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue t
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -672,7 +678,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValu
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -689,7 +695,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue th
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -706,7 +712,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -723,7 +729,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -740,7 +746,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSVal
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -757,7 +763,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValu
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -774,7 +780,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSV
 
 JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -791,7 +797,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValu
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -808,7 +814,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSV
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -823,7 +829,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, J
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -838,7 +844,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*
 
 JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -855,7 +861,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*,
 
 JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -868,7 +874,7 @@ JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue t
 
 static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
@@ -899,7 +905,7 @@ static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const
 
 static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
@@ -1020,7 +1026,7 @@ JSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState* exec, JSObject*, JS
 
 JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -1062,7 +1068,7 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
 
 JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
diff --git a/JavaScriptCore/runtime/DatePrototype.h b/JavaScriptCore/runtime/DatePrototype.h
index 5f4d0ec..caed2d4 100644
--- a/JavaScriptCore/runtime/DatePrototype.h
+++ b/JavaScriptCore/runtime/DatePrototype.h
@@ -29,16 +29,17 @@ namespace JSC {
 
     class DatePrototype : public DateInstance {
     public:
-        DatePrototype(ExecState*, PassRefPtr<Structure>);
+        DatePrototype(ExecState*, NonNullPassRefPtr<Structure>);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames));
         }
     };
 
diff --git a/JavaScriptCore/runtime/Error.cpp b/JavaScriptCore/runtime/Error.cpp
index db1d8cc..ddd4bc4 100644
--- a/JavaScriptCore/runtime/Error.cpp
+++ b/JavaScriptCore/runtime/Error.cpp
@@ -97,6 +97,12 @@ JSObject* Error::create(ExecState* exec, ErrorType type, const char* message)
     return create(exec, type, message, -1, -1, NULL);
 }
 
+JSObject* throwError(ExecState* exec, JSObject* error)
+{
+    exec->setException(error);
+    return error;
+}
+
 JSObject* throwError(ExecState* exec, ErrorType type)
 {
     JSObject* error = Error::create(exec, type, UString(), -1, -1, NULL);
diff --git a/JavaScriptCore/runtime/Error.h b/JavaScriptCore/runtime/Error.h
index adf7fdf..e959cff 100644
--- a/JavaScriptCore/runtime/Error.h
+++ b/JavaScriptCore/runtime/Error.h
@@ -59,6 +59,7 @@ namespace JSC {
     JSObject* throwError(ExecState*, ErrorType, const UString& message);
     JSObject* throwError(ExecState*, ErrorType, const char* message);
     JSObject* throwError(ExecState*, ErrorType);
+    JSObject* throwError(ExecState*, JSObject*);
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/ErrorConstructor.cpp b/JavaScriptCore/runtime/ErrorConstructor.cpp
index 07b7e23..b9c3f58 100644
--- a/JavaScriptCore/runtime/ErrorConstructor.cpp
+++ b/JavaScriptCore/runtime/ErrorConstructor.cpp
@@ -29,7 +29,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ErrorConstructor);
 
-ErrorConstructor::ErrorConstructor(ExecState* exec, PassRefPtr<Structure> structure, ErrorPrototype* errorPrototype)
+ErrorConstructor::ErrorConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, ErrorPrototype* errorPrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, errorPrototype->classInfo()->className))
 {
     // ECMA 15.11.3.1 Error.prototype
diff --git a/JavaScriptCore/runtime/ErrorConstructor.h b/JavaScriptCore/runtime/ErrorConstructor.h
index 2dd4124..e3d789b 100644
--- a/JavaScriptCore/runtime/ErrorConstructor.h
+++ b/JavaScriptCore/runtime/ErrorConstructor.h
@@ -30,7 +30,7 @@ namespace JSC {
 
     class ErrorConstructor : public InternalFunction {
     public:
-        ErrorConstructor(ExecState*, PassRefPtr<Structure>, ErrorPrototype*);
+        ErrorConstructor(ExecState*, NonNullPassRefPtr<Structure>, ErrorPrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/JavaScriptCore/runtime/ErrorInstance.cpp b/JavaScriptCore/runtime/ErrorInstance.cpp
index 2e2cdce..1cdb87a 100644
--- a/JavaScriptCore/runtime/ErrorInstance.cpp
+++ b/JavaScriptCore/runtime/ErrorInstance.cpp
@@ -25,7 +25,7 @@ namespace JSC {
 
 const ClassInfo ErrorInstance::info = { "Error", 0, 0, 0 };
 
-ErrorInstance::ErrorInstance(PassRefPtr<Structure> structure)
+ErrorInstance::ErrorInstance(NonNullPassRefPtr<Structure> structure)
     : JSObject(structure)
 {
 }
diff --git a/JavaScriptCore/runtime/ErrorInstance.h b/JavaScriptCore/runtime/ErrorInstance.h
index 6f9d262..9f53b51 100644
--- a/JavaScriptCore/runtime/ErrorInstance.h
+++ b/JavaScriptCore/runtime/ErrorInstance.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class ErrorInstance : public JSObject {
     public:
-        explicit ErrorInstance(PassRefPtr<Structure>);
+        explicit ErrorInstance(NonNullPassRefPtr<Structure>);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
diff --git a/JavaScriptCore/runtime/ErrorPrototype.cpp b/JavaScriptCore/runtime/ErrorPrototype.cpp
index 599390e..a9a7a43 100644
--- a/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(ErrorPrototype);
 static JSValue JSC_HOST_CALL errorProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.9.4
-ErrorPrototype::ErrorPrototype(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
+ErrorPrototype::ErrorPrototype(ExecState* exec, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
     : ErrorInstance(structure)
 {
     // The constructor will be added later in ErrorConstructor's constructor
diff --git a/JavaScriptCore/runtime/ErrorPrototype.h b/JavaScriptCore/runtime/ErrorPrototype.h
index 53d12d9..a561590 100644
--- a/JavaScriptCore/runtime/ErrorPrototype.h
+++ b/JavaScriptCore/runtime/ErrorPrototype.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class ErrorPrototype : public ErrorInstance {
     public:
-        ErrorPrototype(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+        ErrorPrototype(ExecState*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure);
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/ExceptionHelpers.cpp b/JavaScriptCore/runtime/ExceptionHelpers.cpp
index e63594c..5bead90 100644
--- a/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -66,6 +66,11 @@ JSValue createStackOverflowError(ExecState* exec)
     return createError(exec, RangeError, "Maximum call stack size exceeded.");
 }
 
+JSValue createTypeError(ExecState* exec, const char* message)
+{
+    return createError(exec, TypeError, message);
+}
+
 JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
@@ -74,7 +79,7 @@ JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, u
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
     UString message = "Can't find variable: ";
     message.append(ident.ustring());
-    JSObject* exception = Error::create(exec, ReferenceError, message, line, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+    JSObject* exception = Error::create(exec, ReferenceError, message, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -136,7 +141,7 @@ JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
     UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint, divotPoint + endOffset, value, message);
-    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -157,7 +162,7 @@ JSObject* createNotAConstructorError(ExecState* exec, JSValue value, unsigned by
         startPoint++;
     
     UString errorMessage = createErrorMessage(exec, codeBlock, line, startPoint, divotPoint, value, "not a constructor");
-    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -171,7 +176,7 @@ JSValue createNotAFunctionError(ExecState* exec, JSValue value, unsigned bytecod
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
     UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint - startOffset, divotPoint, value, "not a function");
-    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());    
+    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());    
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -201,7 +206,7 @@ JSObject* createNotAnObjectError(ExecState* exec, JSNotAnObjectErrorStub* error,
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
     UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint - startOffset, divotPoint, error->isNull() ? jsNull() : jsUndefined(), "not an object");
-    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
diff --git a/JavaScriptCore/runtime/ExceptionHelpers.h b/JavaScriptCore/runtime/ExceptionHelpers.h
index 4c5bec1..e739d09 100644
--- a/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -44,6 +44,7 @@ namespace JSC {
     
     JSValue createInterruptedExecutionException(JSGlobalData*);
     JSValue createStackOverflowError(ExecState*);
+    JSValue createTypeError(ExecState*, const char* message);
     JSValue createUndefinedVariableError(ExecState*, const Identifier&, unsigned bytecodeOffset, CodeBlock*);
     JSNotAnObjectErrorStub* createNotAnObjectErrorStub(ExecState*, bool isNull);
     JSObject* createInvalidParamError(ExecState*, const char* op, JSValue, unsigned bytecodeOffset, CodeBlock*);
diff --git a/JavaScriptCore/runtime/Executable.cpp b/JavaScriptCore/runtime/Executable.cpp
new file mode 100644
index 0000000..7586746
--- /dev/null
+++ b/JavaScriptCore/runtime/Executable.cpp
@@ -0,0 +1,280 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Executable.h"
+
+#include "BytecodeGenerator.h"
+#include "CodeBlock.h"
+#include "JIT.h"
+#include "Parser.h"
+#include "Vector.h"
+
+namespace JSC {
+
+#if ENABLE(JIT)
+NativeExecutable::~NativeExecutable()
+{
+}
+#endif
+
+VPtrHackExecutable::~VPtrHackExecutable()
+{
+}
+
+EvalExecutable::~EvalExecutable()
+{
+    delete m_evalCodeBlock;
+}
+
+ProgramExecutable::~ProgramExecutable()
+{
+    delete m_programCodeBlock;
+}
+
+FunctionExecutable::~FunctionExecutable()
+{
+    delete m_codeBlock;
+}
+
+JSObject* EvalExecutable::compile(ExecState* exec, ScopeChainNode* scopeChainNode)
+{
+    int errLine;
+    UString errMsg;
+    RefPtr<EvalNode> evalNode = exec->globalData().parser->parse<EvalNode>(&exec->globalData(), exec->lexicalGlobalObject()->debugger(), exec, m_source, &errLine, &errMsg);
+    if (!evalNode)
+        return Error::create(exec, SyntaxError, errMsg, errLine, m_source.provider()->asID(), m_source.provider()->url());
+    recordParse(evalNode->features(), evalNode->lineNo(), evalNode->lastLine());
+
+    ScopeChain scopeChain(scopeChainNode);
+    JSGlobalObject* globalObject = scopeChain.globalObject();
+
+    ASSERT(!m_evalCodeBlock);
+    m_evalCodeBlock = new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth());
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(evalNode.get(), globalObject->debugger(), scopeChain, m_evalCodeBlock->symbolTable(), m_evalCodeBlock));
+    generator->generate();
+    
+    evalNode->destroyData();
+    return 0;
+}
+
+JSObject* ProgramExecutable::checkSyntax(ExecState* exec)
+{
+    int errLine;
+    UString errMsg;
+    RefPtr<ProgramNode> programNode = exec->globalData().parser->parse<ProgramNode>(&exec->globalData(), exec->lexicalGlobalObject()->debugger(), exec, m_source, &errLine, &errMsg);
+    if (!programNode)
+        return Error::create(exec, SyntaxError, errMsg, errLine, m_source.provider()->asID(), m_source.provider()->url());
+    return 0;
+}
+
+JSObject* ProgramExecutable::compile(ExecState* exec, ScopeChainNode* scopeChainNode)
+{
+    int errLine;
+    UString errMsg;
+    RefPtr<ProgramNode> programNode = exec->globalData().parser->parse<ProgramNode>(&exec->globalData(), exec->lexicalGlobalObject()->debugger(), exec, m_source, &errLine, &errMsg);
+    if (!programNode)
+        return Error::create(exec, SyntaxError, errMsg, errLine, m_source.provider()->asID(), m_source.provider()->url());
+    recordParse(programNode->features(), programNode->lineNo(), programNode->lastLine());
+
+    ScopeChain scopeChain(scopeChainNode);
+    JSGlobalObject* globalObject = scopeChain.globalObject();
+    
+    ASSERT(!m_programCodeBlock);
+    m_programCodeBlock = new ProgramCodeBlock(this, GlobalCode, globalObject, source().provider());
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(programNode.get(), globalObject->debugger(), scopeChain, &globalObject->symbolTable(), m_programCodeBlock));
+    generator->generate();
+
+    programNode->destroyData();
+    return 0;
+}
+
+void FunctionExecutable::compile(ExecState*, ScopeChainNode* scopeChainNode)
+{
+    JSGlobalData* globalData = scopeChainNode->globalData;
+    RefPtr<FunctionBodyNode> body = globalData->parser->parse<FunctionBodyNode>(globalData, 0, 0, m_source);
+    if (m_forceUsesArguments)
+        body->setUsesArguments();
+    body->finishParsing(m_parameters, m_name);
+    recordParse(body->features(), body->lineNo(), body->lastLine());
+
+    ScopeChain scopeChain(scopeChainNode);
+    JSGlobalObject* globalObject = scopeChain.globalObject();
+
+    ASSERT(!m_codeBlock);
+    m_codeBlock = new FunctionCodeBlock(this, FunctionCode, source().provider(), source().startOffset());
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(body.get(), globalObject->debugger(), scopeChain, m_codeBlock->symbolTable(), m_codeBlock));
+    generator->generate();
+    m_numParameters = m_codeBlock->m_numParameters;
+    ASSERT(m_numParameters);
+    m_numVariables = m_codeBlock->m_numVars;
+
+    body->destroyData();
+}
+
+#if ENABLE(JIT)
+
+void EvalExecutable::generateJITCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+{
+    CodeBlock* codeBlock = &bytecode(exec, scopeChainNode);
+    m_jitCode = JIT::compile(scopeChainNode->globalData, codeBlock);
+
+#if !ENABLE(OPCODE_SAMPLING)
+    if (!BytecodeGenerator::dumpsGeneratedCode())
+        codeBlock->discardBytecode();
+#endif
+}
+
+void ProgramExecutable::generateJITCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+{
+    CodeBlock* codeBlock = &bytecode(exec, scopeChainNode);
+    m_jitCode = JIT::compile(scopeChainNode->globalData, codeBlock);
+
+#if !ENABLE(OPCODE_SAMPLING)
+    if (!BytecodeGenerator::dumpsGeneratedCode())
+        codeBlock->discardBytecode();
+#endif
+}
+
+void FunctionExecutable::generateJITCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+{
+    CodeBlock* codeBlock = &bytecode(exec, scopeChainNode);
+    m_jitCode = JIT::compile(scopeChainNode->globalData, codeBlock);
+
+#if !ENABLE(OPCODE_SAMPLING)
+    if (!BytecodeGenerator::dumpsGeneratedCode())
+        codeBlock->discardBytecode();
+#endif
+}
+
+#endif
+
+void FunctionExecutable::markAggregate(MarkStack& markStack)
+{
+    if (m_codeBlock)
+        m_codeBlock->markAggregate(markStack);
+}
+
+ExceptionInfo* FunctionExecutable::reparseExceptionInfo(JSGlobalData* globalData, ScopeChainNode* scopeChainNode, CodeBlock* codeBlock)
+{
+    RefPtr<FunctionBodyNode> newFunctionBody = globalData->parser->parse<FunctionBodyNode>(globalData, 0, 0, m_source);
+    if (m_forceUsesArguments)
+        newFunctionBody->setUsesArguments();
+    newFunctionBody->finishParsing(m_parameters, m_name);
+
+    ScopeChain scopeChain(scopeChainNode);
+    JSGlobalObject* globalObject = scopeChain.globalObject();
+
+    OwnPtr<CodeBlock> newCodeBlock(new FunctionCodeBlock(this, FunctionCode, source().provider(), source().startOffset()));
+    globalData->functionCodeBlockBeingReparsed = newCodeBlock.get();
+
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(newFunctionBody.get(), globalObject->debugger(), scopeChain, newCodeBlock->symbolTable(), newCodeBlock.get()));
+    generator->setRegeneratingForExceptionInfo(static_cast<FunctionCodeBlock*>(codeBlock));
+    generator->generate();
+
+    ASSERT(newCodeBlock->instructionCount() == codeBlock->instructionCount());
+
+#if ENABLE(JIT)
+    JITCode newJITCode = JIT::compile(globalData, newCodeBlock.get());
+    ASSERT(newJITCode.size() == generatedJITCode().size());
+#endif
+
+    globalData->functionCodeBlockBeingReparsed = 0;
+
+    return newCodeBlock->extractExceptionInfo();
+}
+
+ExceptionInfo* EvalExecutable::reparseExceptionInfo(JSGlobalData* globalData, ScopeChainNode* scopeChainNode, CodeBlock* codeBlock)
+{
+    RefPtr<EvalNode> newEvalBody = globalData->parser->parse<EvalNode>(globalData, 0, 0, m_source);
+
+    ScopeChain scopeChain(scopeChainNode);
+    JSGlobalObject* globalObject = scopeChain.globalObject();
+
+    OwnPtr<EvalCodeBlock> newCodeBlock(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
+
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(newEvalBody.get(), globalObject->debugger(), scopeChain, newCodeBlock->symbolTable(), newCodeBlock.get()));
+    generator->setRegeneratingForExceptionInfo(static_cast<EvalCodeBlock*>(codeBlock));
+    generator->generate();
+
+    ASSERT(newCodeBlock->instructionCount() == codeBlock->instructionCount());
+
+#if ENABLE(JIT)
+    JITCode newJITCode = JIT::compile(globalData, newCodeBlock.get());
+    ASSERT(newJITCode.size() == generatedJITCode().size());
+#endif
+
+    return newCodeBlock->extractExceptionInfo();
+}
+
+void FunctionExecutable::recompile(ExecState*)
+{
+    delete m_codeBlock;
+    m_codeBlock = 0;
+    m_numParameters = NUM_PARAMETERS_NOT_COMPILED;
+#if ENABLE(JIT)
+    m_jitCode = JITCode();
+#endif
+}
+
+PassRefPtr<FunctionExecutable> FunctionExecutable::fromGlobalCode(const Identifier& functionName, ExecState* exec, Debugger* debugger, const SourceCode& source, int* errLine, UString* errMsg)
+{
+    RefPtr<ProgramNode> program = exec->globalData().parser->parse<ProgramNode>(&exec->globalData(), debugger, exec, source, errLine, errMsg);
+    if (!program)
+        return 0;
+
+    StatementNode* exprStatement = program->singleStatement();
+    ASSERT(exprStatement);
+    ASSERT(exprStatement->isExprStatement());
+    if (!exprStatement || !exprStatement->isExprStatement())
+        return 0;
+
+    ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
+    ASSERT(funcExpr);
+    ASSERT(funcExpr->isFuncExprNode());
+    if (!funcExpr || !funcExpr->isFuncExprNode())
+        return 0;
+
+    FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
+    ASSERT(body);
+    return FunctionExecutable::create(&exec->globalData(), functionName, body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+}
+
+UString FunctionExecutable::paramString() const
+{
+    FunctionParameters& parameters = *m_parameters;
+    UString s("");
+    for (size_t pos = 0; pos < parameters.size(); ++pos) {
+        if (!s.isEmpty())
+            s += ", ";
+        s += parameters[pos].ustring();
+    }
+
+    return s;
+}
+
+};
+
+
diff --git a/JavaScriptCore/runtime/Executable.h b/JavaScriptCore/runtime/Executable.h
new file mode 100644
index 0000000..f74abe9
--- /dev/null
+++ b/JavaScriptCore/runtime/Executable.h
@@ -0,0 +1,356 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Executable_h
+#define Executable_h
+
+#include "JSFunction.h"
+#include "Interpreter.h"
+#include "Nodes.h"
+#include "SamplingTool.h"
+
+namespace JSC {
+
+    class CodeBlock;
+    class Debugger;
+    class EvalCodeBlock;
+    class ProgramCodeBlock;
+    class ScopeChainNode;
+
+    struct ExceptionInfo;
+
+    class ExecutableBase : public RefCounted<ExecutableBase> {
+        friend class JIT;
+
+    protected:
+        static const int NUM_PARAMETERS_IS_HOST = 0;
+        static const int NUM_PARAMETERS_NOT_COMPILED = -1;
+    
+    public:
+        ExecutableBase(int numParameters)
+            : m_numParameters(numParameters)
+        {
+        }
+
+        virtual ~ExecutableBase() {}
+
+        bool isHostFunction() const { return m_numParameters == NUM_PARAMETERS_IS_HOST; }
+
+    protected:
+        int m_numParameters;
+
+#if ENABLE(JIT)
+    public:
+        JITCode& generatedJITCode()
+        {
+            ASSERT(m_jitCode);
+            return m_jitCode;
+        }
+
+        ExecutablePool* getExecutablePool()
+        {
+            return m_jitCode.getExecutablePool();
+        }
+
+    protected:
+        JITCode m_jitCode;
+#endif
+    };
+
+#if ENABLE(JIT)
+    class NativeExecutable : public ExecutableBase {
+    public:
+        NativeExecutable(ExecState* exec)
+            : ExecutableBase(NUM_PARAMETERS_IS_HOST)
+        {
+            m_jitCode = JITCode(JITCode::HostFunction(exec->globalData().jitStubs.ctiNativeCallThunk()));
+        }
+
+        ~NativeExecutable();
+    };
+#endif
+
+    class VPtrHackExecutable : public ExecutableBase {
+    public:
+        VPtrHackExecutable()
+            : ExecutableBase(NUM_PARAMETERS_IS_HOST)
+        {
+        }
+
+        ~VPtrHackExecutable();
+    };
+
+    class ScriptExecutable : public ExecutableBase {
+    public:
+        ScriptExecutable(JSGlobalData* globalData, const SourceCode& source)
+            : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
+            , m_source(source)
+            , m_features(0)
+        {
+#if ENABLE(CODEBLOCK_SAMPLING)
+            if (SamplingTool* sampler = globalData->interpreter->sampler())
+                sampler->notifyOfScope(this);
+#else
+            UNUSED_PARAM(globalData);
+#endif
+        }
+
+        ScriptExecutable(ExecState* exec, const SourceCode& source)
+            : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
+            , m_source(source)
+            , m_features(0)
+        {
+#if ENABLE(CODEBLOCK_SAMPLING)
+            if (SamplingTool* sampler = exec->globalData().interpreter->sampler())
+                sampler->notifyOfScope(this);
+#else
+            UNUSED_PARAM(exec);
+#endif
+        }
+
+        const SourceCode& source() { return m_source; }
+        intptr_t sourceID() const { return m_source.provider()->asID(); }
+        const UString& sourceURL() const { return m_source.provider()->url(); }
+        int lineNo() const { return m_firstLine; }
+        int lastLine() const { return m_lastLine; }
+
+        bool usesEval() const { return m_features & EvalFeature; }
+        bool usesArguments() const { return m_features & ArgumentsFeature; }
+        bool needsActivation() const { return m_features & (EvalFeature | ClosureFeature | WithFeature | CatchFeature); }
+
+        virtual ExceptionInfo* reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*) = 0;
+
+    protected:
+        void recordParse(CodeFeatures features, int firstLine, int lastLine)
+        {
+            m_features = features;
+            m_firstLine = firstLine;
+            m_lastLine = lastLine;
+        }
+
+        SourceCode m_source;
+        CodeFeatures m_features;
+        int m_firstLine;
+        int m_lastLine;
+    };
+
+    class EvalExecutable : public ScriptExecutable {
+    public:
+
+        ~EvalExecutable();
+
+        EvalCodeBlock& bytecode(ExecState* exec, ScopeChainNode* scopeChainNode)
+        {
+            if (!m_evalCodeBlock) {
+                JSObject* error = compile(exec, scopeChainNode);
+                ASSERT_UNUSED(!error, error);
+            }
+            return *m_evalCodeBlock;
+        }
+
+        JSObject* compile(ExecState*, ScopeChainNode*);
+
+        ExceptionInfo* reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*);
+        static PassRefPtr<EvalExecutable> create(ExecState* exec, const SourceCode& source) { return adoptRef(new EvalExecutable(exec, source)); }
+
+    private:
+        EvalExecutable(ExecState* exec, const SourceCode& source)
+            : ScriptExecutable(exec, source)
+            , m_evalCodeBlock(0)
+        {
+        }
+        EvalCodeBlock* m_evalCodeBlock;
+
+#if ENABLE(JIT)
+    public:
+        JITCode& jitCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+        {
+            if (!m_jitCode)
+                generateJITCode(exec, scopeChainNode);
+            return m_jitCode;
+        }
+
+    private:
+        void generateJITCode(ExecState*, ScopeChainNode*);
+#endif
+    };
+
+    class ProgramExecutable : public ScriptExecutable {
+    public:
+        static PassRefPtr<ProgramExecutable> create(ExecState* exec, const SourceCode& source)
+        {
+            return adoptRef(new ProgramExecutable(exec, source));
+        }
+
+        ~ProgramExecutable();
+
+        ProgramCodeBlock& bytecode(ExecState* exec, ScopeChainNode* scopeChainNode)
+        {
+            if (!m_programCodeBlock) {
+                JSObject* error = compile(exec, scopeChainNode);
+                ASSERT_UNUSED(!error, error);
+            }
+            return *m_programCodeBlock;
+        }
+
+        JSObject* checkSyntax(ExecState*);
+        JSObject* compile(ExecState*, ScopeChainNode*);
+
+        // CodeBlocks for program code are transient and therefore do not gain from from throwing out there exception information.
+        ExceptionInfo* reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*) { ASSERT_NOT_REACHED(); return 0; }
+
+    private:
+        ProgramExecutable(ExecState* exec, const SourceCode& source)
+            : ScriptExecutable(exec, source)
+            , m_programCodeBlock(0)
+        {
+        }
+        ProgramCodeBlock* m_programCodeBlock;
+
+#if ENABLE(JIT)
+    public:
+        JITCode& jitCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+        {
+            if (!m_jitCode)
+                generateJITCode(exec, scopeChainNode);
+            return m_jitCode;
+        }
+
+    private:
+        void generateJITCode(ExecState*, ScopeChainNode*);
+#endif
+    };
+
+    class FunctionExecutable : public ScriptExecutable {
+        friend class JIT;
+    public:
+        static PassRefPtr<FunctionExecutable> create(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+        {
+            return adoptRef(new FunctionExecutable(exec, name, source, forceUsesArguments, parameters, firstLine, lastLine));
+        }
+
+        static PassRefPtr<FunctionExecutable> create(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+        {
+            return adoptRef(new FunctionExecutable(globalData, name, source, forceUsesArguments, parameters, firstLine, lastLine));
+        }
+
+        ~FunctionExecutable();
+
+        JSFunction* make(ExecState* exec, ScopeChainNode* scopeChain)
+        {
+            return new (exec) JSFunction(exec, this, scopeChain);
+        }
+
+        CodeBlock& bytecode(ExecState* exec, ScopeChainNode* scopeChainNode) 
+        {
+            ASSERT(scopeChainNode);
+            if (!m_codeBlock)
+                compile(exec, scopeChainNode);
+            return *m_codeBlock;
+        }
+
+        bool isGenerated() const
+        {
+            return m_codeBlock;
+        }
+
+        CodeBlock& generatedBytecode()
+        {
+            ASSERT(m_codeBlock);
+            return *m_codeBlock;
+        }
+
+        const Identifier& name() { return m_name; }
+        size_t parameterCount() const { return m_parameters->size(); }
+        size_t variableCount() const { return m_numVariables; }
+        UString paramString() const;
+
+        void recompile(ExecState*);
+        ExceptionInfo* reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*);
+        void markAggregate(MarkStack& markStack);
+        static PassRefPtr<FunctionExecutable> fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, int* errLine = 0, UString* errMsg = 0);
+
+    private:
+        FunctionExecutable(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+            : ScriptExecutable(globalData, source)
+            , m_forceUsesArguments(forceUsesArguments)
+            , m_parameters(parameters)
+            , m_codeBlock(0)
+            , m_name(name)
+            , m_numVariables(0)
+        {
+            m_firstLine = firstLine;
+            m_lastLine = lastLine;
+        }
+
+        FunctionExecutable(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+            : ScriptExecutable(exec, source)
+            , m_forceUsesArguments(forceUsesArguments)
+            , m_parameters(parameters)
+            , m_codeBlock(0)
+            , m_name(name)
+            , m_numVariables(0)
+        {
+            m_firstLine = firstLine;
+            m_lastLine = lastLine;
+        }
+
+        void compile(ExecState*, ScopeChainNode*);
+
+        bool m_forceUsesArguments;
+        RefPtr<FunctionParameters> m_parameters;
+        CodeBlock* m_codeBlock;
+        Identifier m_name;
+        size_t m_numVariables;
+
+#if ENABLE(JIT)
+    public:
+        JITCode& jitCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+        {
+            if (!m_jitCode)
+                generateJITCode(exec, scopeChainNode);
+            return m_jitCode;
+        }
+
+    private:
+        void generateJITCode(ExecState*, ScopeChainNode*);
+#endif
+    };
+
+    inline FunctionExecutable* JSFunction::jsExecutable() const
+    {
+        ASSERT(!isHostFunctionNonInline());
+        return static_cast<FunctionExecutable*>(m_executable.get());
+    }
+
+    inline bool JSFunction::isHostFunction() const
+    {
+        ASSERT(m_executable);
+        return m_executable->isHostFunction();
+    }
+
+}
+
+#endif
diff --git a/JavaScriptCore/runtime/FunctionConstructor.cpp b/JavaScriptCore/runtime/FunctionConstructor.cpp
index f4f5cc8..9d88400 100644
--- a/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -34,7 +34,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(FunctionConstructor);
 
-FunctionConstructor::FunctionConstructor(ExecState* exec, PassRefPtr<Structure> structure, FunctionPrototype* functionPrototype)
+FunctionConstructor::FunctionConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, FunctionPrototype* functionPrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, functionPrototype->classInfo()->className))
 {
     putDirectWithoutTransition(exec->propertyNames().prototype, functionPrototype, DontEnum | DontDelete | ReadOnly);
@@ -66,32 +66,6 @@ CallType FunctionConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-FunctionBodyNode* extractFunctionBody(ProgramNode* program)
-{
-    if (!program)
-        return 0;
-
-    StatementVector& children = program->children();
-    if (children.size() != 1)
-        return 0;
-
-    StatementNode* exprStatement = children[0];
-    ASSERT(exprStatement);
-    ASSERT(exprStatement->isExprStatement());
-    if (!exprStatement || !exprStatement->isExprStatement())
-        return 0;
-
-    ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
-    ASSERT(funcExpr);
-    ASSERT(funcExpr->isFuncExprNode());
-    if (!funcExpr || !funcExpr->isFuncExprNode())
-        return 0;
-
-    FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
-    ASSERT(body);
-    return body;
-}
-
 // ECMA 15.3.2 The Function Constructor
 JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifier& functionName, const UString& sourceURL, int lineNumber)
 {
@@ -113,15 +87,13 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
     int errLine;
     UString errMsg;
     SourceCode source = makeSource(program, sourceURL, lineNumber);
-    RefPtr<ProgramNode> programNode = exec->globalData().parser->parse<ProgramNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
-
-    FunctionBodyNode* body = extractFunctionBody(programNode.get());
-    if (!body)
+    RefPtr<FunctionExecutable> function = FunctionExecutable::fromGlobalCode(functionName, exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
+    if (!function)
         return throwError(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
 
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
-    ScopeChain scopeChain(globalObject, globalObject->globalData(), exec->globalThisValue());
-    return new (exec) JSFunction(exec, functionName, body, scopeChain.node());
+    ScopeChain scopeChain(globalObject, globalObject->globalData(), globalObject, exec->globalThisValue());
+    return new (exec) JSFunction(exec, function, scopeChain.node());
 }
 
 // ECMA 15.3.2 The Function Constructor
diff --git a/JavaScriptCore/runtime/FunctionConstructor.h b/JavaScriptCore/runtime/FunctionConstructor.h
index 124b354..197f320 100644
--- a/JavaScriptCore/runtime/FunctionConstructor.h
+++ b/JavaScriptCore/runtime/FunctionConstructor.h
@@ -26,12 +26,10 @@
 namespace JSC {
 
     class FunctionPrototype;
-    class ProgramNode;
-    class FunctionBodyNode;
 
     class FunctionConstructor : public InternalFunction {
     public:
-        FunctionConstructor(ExecState*, PassRefPtr<Structure>, FunctionPrototype*);
+        FunctionConstructor(ExecState*, NonNullPassRefPtr<Structure>, FunctionPrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
@@ -41,8 +39,6 @@ namespace JSC {
     JSObject* constructFunction(ExecState*, const ArgList&, const Identifier& functionName, const UString& sourceURL, int lineNumber);
     JSObject* constructFunction(ExecState*, const ArgList&);
 
-    FunctionBodyNode* extractFunctionBody(ProgramNode*);
-
 } // namespace JSC
 
 #endif // FunctionConstructor_h
diff --git a/JavaScriptCore/runtime/FunctionPrototype.cpp b/JavaScriptCore/runtime/FunctionPrototype.cpp
index 9ba2144..45f17b1 100644
--- a/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -37,7 +37,7 @@ static JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState*, JSObject*, JS
 static JSValue JSC_HOST_CALL functionProtoFuncApply(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL functionProtoFuncCall(ExecState*, JSObject*, JSValue, const ArgList&);
 
-FunctionPrototype::FunctionPrototype(ExecState* exec, PassRefPtr<Structure> structure)
+FunctionPrototype::FunctionPrototype(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     : InternalFunction(&exec->globalData(), structure, exec->propertyNames().nullIdentifier)
 {
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 0), DontDelete | ReadOnly | DontEnum);
@@ -84,16 +84,17 @@ static inline void insertSemicolonIfNeeded(UString& functionBody)
 
 JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (thisValue.isObject(&JSFunction::info)) {
+    if (thisValue.inherits(&JSFunction::info)) {
         JSFunction* function = asFunction(thisValue);
         if (!function->isHostFunction()) {
-            UString functionBody = function->body()->toSourceString();
-            insertSemicolonIfNeeded(functionBody);
-            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + function->body()->paramString() + ") " + functionBody);
+            FunctionExecutable* executable = function->jsExecutable();
+            UString sourceString = executable->source().toString();
+            insertSemicolonIfNeeded(sourceString);
+            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + executable->paramString() + ") " + sourceString);
         }
     }
 
-    if (thisValue.isObject(&InternalFunction::info)) {
+    if (thisValue.inherits(&InternalFunction::info)) {
         InternalFunction* function = asInternalFunction(thisValue);
         return jsString(exec, "function " + function->name(&exec->globalData()) + "() {\n    [native code]\n}");
     }
diff --git a/JavaScriptCore/runtime/FunctionPrototype.h b/JavaScriptCore/runtime/FunctionPrototype.h
index 607ddab..0e38549 100644
--- a/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/JavaScriptCore/runtime/FunctionPrototype.h
@@ -29,12 +29,12 @@ namespace JSC {
 
     class FunctionPrototype : public InternalFunction {
     public:
-        FunctionPrototype(ExecState*, PassRefPtr<Structure>);
+        FunctionPrototype(ExecState*, NonNullPassRefPtr<Structure>);
         void addFunctionProperties(ExecState*, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction);
 
         static PassRefPtr<Structure> createStructure(JSValue proto)
         {
-            return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
+            return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
         }
 
     private:
diff --git a/JavaScriptCore/runtime/GetterSetter.cpp b/JavaScriptCore/runtime/GetterSetter.cpp
index cc85354..7e54053 100644
--- a/JavaScriptCore/runtime/GetterSetter.cpp
+++ b/JavaScriptCore/runtime/GetterSetter.cpp
@@ -32,50 +32,12 @@ void GetterSetter::markChildren(MarkStack& markStack)
 {
     JSCell::markChildren(markStack);
 
-    if (m_getter && !m_getter->marked())
+    if (m_getter)
         markStack.append(m_getter);
-    if (m_setter && !m_setter->marked())
+    if (m_setter)
         markStack.append(m_setter);
 }
 
-JSValue GetterSetter::toPrimitive(ExecState*, PreferredPrimitiveType) const
-{
-    ASSERT_NOT_REACHED();
-    return jsNull();
-}
-
-bool GetterSetter::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
-{
-    ASSERT_NOT_REACHED();
-    number = 0;
-    value = JSValue();
-    return true;
-}
-
-bool GetterSetter::toBoolean(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-double GetterSetter::toNumber(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return 0.0;
-}
-
-UString GetterSetter::toString(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return UString::null();
-}
-
-JSObject* GetterSetter::toObject(ExecState* exec) const
-{
-    ASSERT_NOT_REACHED();
-    return jsNull().toObject(exec);
-}
-
 bool GetterSetter::isGetterSetter() const
 {
     return true;
diff --git a/JavaScriptCore/runtime/GetterSetter.h b/JavaScriptCore/runtime/GetterSetter.h
index b7a8794..73dd854 100644
--- a/JavaScriptCore/runtime/GetterSetter.h
+++ b/JavaScriptCore/runtime/GetterSetter.h
@@ -55,13 +55,6 @@ namespace JSC {
     private:
         virtual bool isGetterSetter() const;
 
-        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
-        virtual bool toBoolean(ExecState*) const;
-        virtual double toNumber(ExecState*) const;
-        virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
-
         JSObject* m_getter;
         JSObject* m_setter;  
     };
diff --git a/JavaScriptCore/runtime/GlobalEvalFunction.cpp b/JavaScriptCore/runtime/GlobalEvalFunction.cpp
index 3074f95..c26002b 100644
--- a/JavaScriptCore/runtime/GlobalEvalFunction.cpp
+++ b/JavaScriptCore/runtime/GlobalEvalFunction.cpp
@@ -32,7 +32,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(GlobalEvalFunction);
 
-GlobalEvalFunction::GlobalEvalFunction(ExecState* exec, PassRefPtr<Structure> structure, int len, const Identifier& name, NativeFunction function, JSGlobalObject* cachedGlobalObject)
+GlobalEvalFunction::GlobalEvalFunction(ExecState* exec, NonNullPassRefPtr<Structure> structure, int len, const Identifier& name, NativeFunction function, JSGlobalObject* cachedGlobalObject)
     : PrototypeFunction(exec, structure, len, name, function)
     , m_cachedGlobalObject(cachedGlobalObject)
 {
diff --git a/JavaScriptCore/runtime/GlobalEvalFunction.h b/JavaScriptCore/runtime/GlobalEvalFunction.h
index cdba4a0..b62ad3e 100644
--- a/JavaScriptCore/runtime/GlobalEvalFunction.h
+++ b/JavaScriptCore/runtime/GlobalEvalFunction.h
@@ -32,9 +32,14 @@ namespace JSC {
 
     class GlobalEvalFunction : public PrototypeFunction {
     public:
-        GlobalEvalFunction(ExecState*, PassRefPtr<Structure>, int len, const Identifier&, NativeFunction, JSGlobalObject* expectedThisObject);
+        GlobalEvalFunction(ExecState*, NonNullPassRefPtr<Structure>, int len, const Identifier&, NativeFunction, JSGlobalObject* expectedThisObject);
         JSGlobalObject* cachedGlobalObject() const { return m_cachedGlobalObject; }
 
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        { 
+            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot));
+        }
+
     private:
         virtual void markChildren(MarkStack&);
 
diff --git a/JavaScriptCore/runtime/Identifier.h b/JavaScriptCore/runtime/Identifier.h
index 631cf42..2249179 100644
--- a/JavaScriptCore/runtime/Identifier.h
+++ b/JavaScriptCore/runtime/Identifier.h
@@ -54,6 +54,8 @@ namespace JSC {
         const char* ascii() const { return _ustring.ascii(); }
         
         static Identifier from(ExecState* exec, unsigned y) { return Identifier(exec, UString::from(y)); }
+        static Identifier from(ExecState* exec, int y) { return Identifier(exec, UString::from(y)); }
+        static Identifier from(ExecState* exec, double y) { return Identifier(exec, UString::from(y)); }
         
         bool isNull() const { return _ustring.isNull(); }
         bool isEmpty() const { return _ustring.isEmpty(); }
diff --git a/JavaScriptCore/runtime/InternalFunction.cpp b/JavaScriptCore/runtime/InternalFunction.cpp
index b5c9571..2ba2984 100644
--- a/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/JavaScriptCore/runtime/InternalFunction.cpp
@@ -37,7 +37,7 @@ const ClassInfo* InternalFunction::classInfo() const
     return &info;
 }
 
-InternalFunction::InternalFunction(JSGlobalData* globalData, PassRefPtr<Structure> structure, const Identifier& name)
+InternalFunction::InternalFunction(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure, const Identifier& name)
     : JSObject(structure)
 {
     putDirect(globalData->propertyNames->name, jsString(globalData, name.ustring()), DontDelete | ReadOnly | DontEnum);
diff --git a/JavaScriptCore/runtime/InternalFunction.h b/JavaScriptCore/runtime/InternalFunction.h
index 310644c..fdd5cc1 100644
--- a/JavaScriptCore/runtime/InternalFunction.h
+++ b/JavaScriptCore/runtime/InternalFunction.h
@@ -42,12 +42,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot)); 
+            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark)); 
         }
 
     protected:
-        InternalFunction(PassRefPtr<Structure> structure) : JSObject(structure) { }
-        InternalFunction(JSGlobalData*, PassRefPtr<Structure>, const Identifier&);
+        InternalFunction(NonNullPassRefPtr<Structure> structure) : JSObject(structure) { }
+        InternalFunction(JSGlobalData*, NonNullPassRefPtr<Structure>, const Identifier&);
 
     private:
         virtual CallType getCallData(CallData&) = 0;
diff --git a/JavaScriptCore/runtime/JSAPIValueWrapper.cpp b/JavaScriptCore/runtime/JSAPIValueWrapper.cpp
index 475fad5..e83724a 100644
--- a/JavaScriptCore/runtime/JSAPIValueWrapper.cpp
+++ b/JavaScriptCore/runtime/JSAPIValueWrapper.cpp
@@ -28,40 +28,4 @@
 
 namespace JSC {
 
-JSValue JSAPIValueWrapper::toPrimitive(ExecState*, PreferredPrimitiveType) const
-{
-    ASSERT_NOT_REACHED();
-    return JSValue();
-}
-
-bool JSAPIValueWrapper::getPrimitiveNumber(ExecState*, double&, JSValue&)
-{
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-bool JSAPIValueWrapper::toBoolean(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-double JSAPIValueWrapper::toNumber(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-UString JSAPIValueWrapper::toString(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return UString();
-}
-
-JSObject* JSAPIValueWrapper::toObject(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSAPIValueWrapper.h b/JavaScriptCore/runtime/JSAPIValueWrapper.h
index 21a9710..88a8493 100644
--- a/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -37,12 +37,6 @@ namespace JSC {
 
         virtual bool isAPIValueWrapper() const { return true; }
 
-        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
-        virtual bool toBoolean(ExecState*) const;
-        virtual double toNumber(ExecState*) const;
-        virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(CompoundType));
@@ -54,6 +48,7 @@ namespace JSC {
             : JSCell(exec->globalData().apiWrapperStructure.get())
             , m_value(value)
         {
+            ASSERT(!value.isCell());
         }
 
         JSValue m_value;
diff --git a/JavaScriptCore/runtime/JSActivation.cpp b/JavaScriptCore/runtime/JSActivation.cpp
index 87adbcd..22fdaaf 100644
--- a/JavaScriptCore/runtime/JSActivation.cpp
+++ b/JavaScriptCore/runtime/JSActivation.cpp
@@ -39,8 +39,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSActivation);
 
 const ClassInfo JSActivation::info = { "JSActivation", 0, 0, 0 };
 
-JSActivation::JSActivation(CallFrame* callFrame, PassRefPtr<FunctionBodyNode> functionBody)
-    : Base(callFrame->globalData().activationStructure, new JSActivationData(functionBody, callFrame->registers()))
+JSActivation::JSActivation(CallFrame* callFrame, NonNullPassRefPtr<FunctionExecutable> functionExecutable)
+    : Base(callFrame->globalData().activationStructure, new JSActivationData(functionExecutable, callFrame->registers()))
 {
 }
 
@@ -57,12 +57,12 @@ void JSActivation::markChildren(MarkStack& markStack)
     if (!registerArray)
         return;
 
-    size_t numParametersMinusThis = d()->functionBody->generatedBytecode().m_numParameters - 1;
+    size_t numParametersMinusThis = d()->functionExecutable->parameterCount();
 
     size_t count = numParametersMinusThis;
     markStack.appendValues(registerArray, count);
 
-    size_t numVars = d()->functionBody->generatedBytecode().m_numVars;
+    size_t numVars = d()->functionExecutable->variableCount();
 
     // Skip the call frame, which sits between the parameters and vars.
     markStack.appendValues(registerArray + count + RegisterFile::CallFrameHeaderSize, numVars, MayContainNullValues);
@@ -136,14 +136,14 @@ JSObject* JSActivation::toThisObject(ExecState* exec) const
 
 bool JSActivation::isDynamicScope() const
 {
-    return d()->functionBody->usesEval();
+    return d()->functionExecutable->usesEval();
 }
 
 JSValue JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSActivation* activation = asActivation(slot.slotBase());
 
-    if (activation->d()->functionBody->usesArguments()) {
+    if (activation->d()->functionExecutable->usesArguments()) {
         PropertySlot slot;
         activation->symbolTableGet(exec->propertyNames().arguments, slot);
         return slot.getValue(exec, exec->propertyNames().arguments);
@@ -156,7 +156,7 @@ JSValue JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const
         arguments->copyRegisters();
         callFrame->setCalleeArguments(arguments);
     }
-    ASSERT(arguments->isObject(&Arguments::info));
+    ASSERT(arguments->inherits(&Arguments::info));
 
     return arguments;
 }
diff --git a/JavaScriptCore/runtime/JSActivation.h b/JavaScriptCore/runtime/JSActivation.h
index 6a08439..583b988 100644
--- a/JavaScriptCore/runtime/JSActivation.h
+++ b/JavaScriptCore/runtime/JSActivation.h
@@ -43,7 +43,7 @@ namespace JSC {
     class JSActivation : public JSVariableObject {
         typedef JSVariableObject Base;
     public:
-        JSActivation(CallFrame*, PassRefPtr<FunctionBodyNode>);
+        JSActivation(CallFrame*, NonNullPassRefPtr<FunctionExecutable>);
         virtual ~JSActivation();
 
         virtual void markChildren(MarkStack&);
@@ -70,13 +70,20 @@ namespace JSC {
 
     private:
         struct JSActivationData : public JSVariableObjectData {
-            JSActivationData(PassRefPtr<FunctionBodyNode> functionBody, Register* registers)
-                : JSVariableObjectData(&functionBody->generatedBytecode().symbolTable(), registers)
-                , functionBody(functionBody)
+            JSActivationData(NonNullPassRefPtr<FunctionExecutable> _functionExecutable, Register* registers)
+                : JSVariableObjectData(_functionExecutable->generatedBytecode().symbolTable(), registers)
+                , functionExecutable(_functionExecutable)
             {
+                // We have to manually ref and deref the symbol table as JSVariableObjectData
+                // doesn't know about SharedSymbolTable
+                functionExecutable->generatedBytecode().sharedSymbolTable()->ref();
+            }
+            ~JSActivationData()
+            {
+                static_cast<SharedSymbolTable*>(symbolTable)->deref();
             }
 
-            RefPtr<FunctionBodyNode> functionBody;
+            RefPtr<FunctionExecutable> functionExecutable;
         };
         
         static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
diff --git a/JavaScriptCore/runtime/JSArray.cpp b/JavaScriptCore/runtime/JSArray.cpp
index 7d7d4c4..fd9e7b2 100644
--- a/JavaScriptCore/runtime/JSArray.cpp
+++ b/JavaScriptCore/runtime/JSArray.cpp
@@ -25,6 +25,8 @@
 
 #include "ArrayPrototype.h"
 #include "CachedCall.h"
+#include "Error.h"
+#include "Executable.h"
 #include "PropertyNameArray.h"
 #include <wtf/AVLTree.h>
 #include <wtf/Assertions.h>
@@ -128,27 +130,25 @@ inline void JSArray::checkConsistency(ConsistencyCheckType)
 
 #endif
 
-JSArray::JSArray(PassRefPtr<Structure> structure)
+JSArray::JSArray(NonNullPassRefPtr<Structure> structure)
     : JSObject(structure)
 {
     unsigned initialCapacity = 0;
 
     m_storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
-    m_storage->m_vectorLength = initialCapacity;
-
-    m_fastAccessCutoff = 0;
+    m_vectorLength = initialCapacity;
 
     checkConsistency();
 }
 
-JSArray::JSArray(PassRefPtr<Structure> structure, unsigned initialLength)
+JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength)
     : JSObject(structure)
 {
     unsigned initialCapacity = min(initialLength, MIN_SPARSE_ARRAY_INDEX);
 
     m_storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
     m_storage->m_length = initialLength;
-    m_storage->m_vectorLength = initialCapacity;
+    m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = 0;
     m_storage->m_sparseValueMap = 0;
     m_storage->lazyCreationData = 0;
@@ -157,21 +157,19 @@ JSArray::JSArray(PassRefPtr<Structure> structure, unsigned initialLength)
     for (size_t i = 0; i < initialCapacity; ++i)
         vector[i] = JSValue();
 
-    m_fastAccessCutoff = 0;
-
     checkConsistency();
 
     Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValue));
 }
 
-JSArray::JSArray(PassRefPtr<Structure> structure, const ArgList& list)
+JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
     : JSObject(structure)
 {
     unsigned initialCapacity = list.size();
 
     m_storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
     m_storage->m_length = initialCapacity;
-    m_storage->m_vectorLength = initialCapacity;
+    m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = initialCapacity;
     m_storage->m_sparseValueMap = 0;
 
@@ -180,8 +178,6 @@ JSArray::JSArray(PassRefPtr<Structure> structure, const ArgList& list)
     for (ArgList::const_iterator it = list.begin(); it != end; ++it, ++i)
         m_storage->m_vector[i] = *it;
 
-    m_fastAccessCutoff = initialCapacity;
-
     checkConsistency();
 
     Heap::heap(this)->reportExtraMemoryCost(storageSize(initialCapacity));
@@ -205,7 +201,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot
         return false;
     }
 
-    if (i < storage->m_vectorLength) {
+    if (i < m_vectorLength) {
         JSValue& valueSlot = storage->m_vector[i];
         if (valueSlot) {
             slot.setValueSlot(&valueSlot);
@@ -221,7 +217,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot
         }
     }
 
-    return false;
+    return JSObject::getOwnPropertySlot(exec, Identifier::from(exec, i), slot);
 }
 
 bool JSArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -239,6 +235,37 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        descriptor.setDescriptor(jsNumber(exec, length()), DontDelete | DontEnum);
+        return true;
+    }
+    
+    bool isArrayIndex;
+    unsigned i = propertyName.toArrayIndex(&isArrayIndex);
+    if (isArrayIndex) {
+        if (i >= m_storage->m_length)
+            return false;
+        if (i < m_vectorLength) {
+            JSValue& value = m_storage->m_vector[i];
+            if (value) {
+                descriptor.setDescriptor(value, 0);
+                return true;
+            }
+        } else if (SparseArrayValueMap* map = m_storage->m_sparseValueMap) {
+            if (i >= MIN_SPARSE_ARRAY_INDEX) {
+                SparseArrayValueMap::iterator it = map->find(i);
+                if (it != map->end()) {
+                    descriptor.setDescriptor(it->second, 0);
+                    return true;
+                }
+            }
+        }
+    }
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 // ECMA 15.4.5.1
 void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
@@ -272,7 +299,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValue value)
         m_storage->m_length = length;
     }
 
-    if (i < m_storage->m_vectorLength) {
+    if (i < m_vectorLength) {
         JSValue& valueSlot = m_storage->m_vector[i];
         if (valueSlot) {
             valueSlot = value;
@@ -280,8 +307,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValue value)
             return;
         }
         valueSlot = value;
-        if (++m_storage->m_numValuesInVector == m_storage->m_length)
-            m_fastAccessCutoff = m_storage->m_length;
+        ++m_storage->m_numValuesInVector;
         checkConsistency();
         return;
     }
@@ -319,8 +345,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         if (increaseVectorLength(i + 1)) {
             storage = m_storage;
             storage->m_vector[i] = value;
-            if (++storage->m_numValuesInVector == storage->m_length)
-                m_fastAccessCutoff = storage->m_length;
+            ++storage->m_numValuesInVector;
             checkConsistency();
         } else
             throwOutOfMemoryError(exec);
@@ -330,7 +355,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     // Decide how many values it would be best to move from the map.
     unsigned newNumValuesInVector = storage->m_numValuesInVector + 1;
     unsigned newVectorLength = increasedVectorLength(i + 1);
-    for (unsigned j = max(storage->m_vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
+    for (unsigned j = max(m_vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
         newNumValuesInVector += map->contains(j);
     if (i >= MIN_SPARSE_ARRAY_INDEX)
         newNumValuesInVector -= map->contains(i);
@@ -348,13 +373,12 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         }
     }
 
-    storage = static_cast<ArrayStorage*>(tryFastRealloc(storage, storageSize(newVectorLength)));
-    if (!storage) {
+    if (!tryFastRealloc(storage, storageSize(newVectorLength)).getValue(storage)) {
         throwOutOfMemoryError(exec);
         return;
     }
 
-    unsigned vectorLength = storage->m_vectorLength;
+    unsigned vectorLength = m_vectorLength;
 
     Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
 
@@ -372,7 +396,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
 
     storage->m_vector[i] = value;
 
-    storage->m_vectorLength = newVectorLength;
+    m_vectorLength = newVectorLength;
     storage->m_numValuesInVector = newNumValuesInVector;
 
     m_storage = storage;
@@ -399,7 +423,7 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
 
     ArrayStorage* storage = m_storage;
 
-    if (i < storage->m_vectorLength) {
+    if (i < m_vectorLength) {
         JSValue& valueSlot = storage->m_vector[i];
         if (!valueSlot) {
             checkConsistency();
@@ -407,8 +431,6 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
         }
         valueSlot = JSValue();
         --storage->m_numValuesInVector;
-        if (m_fastAccessCutoff > i)
-            m_fastAccessCutoff = i;
         checkConsistency();
         return true;
     }
@@ -432,7 +454,7 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
     return false;
 }
 
-void JSArray::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // FIXME: Filling PropertyNameArray with an identifier for every integer
     // is incredibly inefficient for large arrays. We need a different approach,
@@ -440,7 +462,7 @@ void JSArray::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames
 
     ArrayStorage* storage = m_storage;
 
-    unsigned usedVectorLength = min(storage->m_length, storage->m_vectorLength);
+    unsigned usedVectorLength = min(storage->m_length, m_vectorLength);
     for (unsigned i = 0; i < usedVectorLength; ++i) {
         if (storage->m_vector[i])
             propertyNames.add(Identifier::from(exec, i));
@@ -452,7 +474,7 @@ void JSArray::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames
             propertyNames.add(Identifier::from(exec, it->first));
     }
 
-    JSObject::getPropertyNames(exec, propertyNames);
+    JSObject::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSArray::increaseVectorLength(unsigned newLength)
@@ -462,17 +484,16 @@ bool JSArray::increaseVectorLength(unsigned newLength)
 
     ArrayStorage* storage = m_storage;
 
-    unsigned vectorLength = storage->m_vectorLength;
+    unsigned vectorLength = m_vectorLength;
     ASSERT(newLength > vectorLength);
     ASSERT(newLength <= MAX_STORAGE_VECTOR_INDEX);
     unsigned newVectorLength = increasedVectorLength(newLength);
 
-    storage = static_cast<ArrayStorage*>(tryFastRealloc(storage, storageSize(newVectorLength)));
-    if (!storage)
+    if (!tryFastRealloc(storage, storageSize(newVectorLength)).getValue(storage))
         return false;
 
     Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
-    storage->m_vectorLength = newVectorLength;
+    m_vectorLength = newVectorLength;
 
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
         storage->m_vector[i] = JSValue();
@@ -490,10 +511,7 @@ void JSArray::setLength(unsigned newLength)
     unsigned length = m_storage->m_length;
 
     if (newLength < length) {
-        if (m_fastAccessCutoff > newLength)
-            m_fastAccessCutoff = newLength;
-
-        unsigned usedVectorLength = min(length, storage->m_vectorLength);
+        unsigned usedVectorLength = min(length, m_vectorLength);
         for (unsigned i = newLength; i < usedVectorLength; ++i) {
             JSValue& valueSlot = storage->m_vector[i];
             bool hadValue = valueSlot;
@@ -532,20 +550,13 @@ JSValue JSArray::pop()
 
     JSValue result;
 
-    if (m_fastAccessCutoff > length) {
-        JSValue& valueSlot = m_storage->m_vector[length];
-        result = valueSlot;
-        ASSERT(result);
-        valueSlot = JSValue();
-        --m_storage->m_numValuesInVector;
-        m_fastAccessCutoff = length;
-    } else if (length < m_storage->m_vectorLength) {
+    if (length < m_vectorLength) {
         JSValue& valueSlot = m_storage->m_vector[length];
-        result = valueSlot;
-        valueSlot = JSValue();
-        if (result)
+        if (valueSlot) {
             --m_storage->m_numValuesInVector;
-        else
+            result = valueSlot;
+            valueSlot = JSValue();
+        } else
             result = jsUndefined();
     } else {
         result = jsUndefined();
@@ -573,11 +584,10 @@ void JSArray::push(ExecState* exec, JSValue value)
 {
     checkConsistency();
 
-    if (m_storage->m_length < m_storage->m_vectorLength) {
-        ASSERT(!m_storage->m_vector[m_storage->m_length]);
+    if (m_storage->m_length < m_vectorLength) {
         m_storage->m_vector[m_storage->m_length] = value;
-        if (++m_storage->m_numValuesInVector == ++m_storage->m_length)
-            m_fastAccessCutoff = m_storage->m_length;
+        ++m_storage->m_numValuesInVector;
+        ++m_storage->m_length;
         checkConsistency();
         return;
     }
@@ -587,8 +597,8 @@ void JSArray::push(ExecState* exec, JSValue value)
         if (!map || map->isEmpty()) {
             if (increaseVectorLength(m_storage->m_length + 1)) {
                 m_storage->m_vector[m_storage->m_length] = value;
-                if (++m_storage->m_numValuesInVector == ++m_storage->m_length)
-                    m_fastAccessCutoff = m_storage->m_length;
+                ++m_storage->m_numValuesInVector;
+                ++m_storage->m_length;
                 checkConsistency();
                 return;
             }
@@ -603,18 +613,7 @@ void JSArray::push(ExecState* exec, JSValue value)
 
 void JSArray::markChildren(MarkStack& markStack)
 {
-    JSObject::markChildren(markStack);
-
-    ArrayStorage* storage = m_storage;
-
-    unsigned usedVectorLength = min(storage->m_length, storage->m_vectorLength);
-    markStack.appendValues(storage->m_vector, usedVectorLength, MayContainNullValues);
-
-    if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
-        SparseArrayValueMap::iterator end = map->end();
-        for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it)
-            markStack.append(it->second);
-    }
+    markChildrenDirect(markStack);
 }
 
 static int compareNumbersForQSort(const void* a, const void* b)
@@ -817,7 +816,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     if (!m_storage->m_length)
         return;
 
-    unsigned usedVectorLength = min(m_storage->m_length, m_storage->m_vectorLength);
+    unsigned usedVectorLength = min(m_storage->m_length, m_vectorLength);
 
     AVLTree<AVLTreeAbstractorForArrayCompare, 44> tree; // Depth 44 is enough for 2^31 items
     tree.abstractor().m_exec = exec;
@@ -866,7 +865,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 
     if (SparseArrayValueMap* map = m_storage->m_sparseValueMap) {
         newUsedVectorLength += map->size();
-        if (newUsedVectorLength > m_storage->m_vectorLength) {
+        if (newUsedVectorLength > m_vectorLength) {
             // Check that it is possible to allocate an array large enough to hold all the entries.
             if ((newUsedVectorLength > MAX_STORAGE_VECTOR_LENGTH) || !increaseVectorLength(newUsedVectorLength)) {
                 throwOutOfMemoryError(exec);
@@ -906,7 +905,6 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
         m_storage->m_vector[i] = JSValue();
 
-    m_fastAccessCutoff = newUsedVectorLength;
     m_storage->m_numValuesInVector = newUsedVectorLength;
 
     checkConsistency(SortConsistencyCheck);
@@ -914,10 +912,16 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 
 void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 {
-    unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
+    JSValue* vector = m_storage->m_vector;
+    unsigned vectorEnd = min(m_storage->m_length, m_vectorLength);
     unsigned i = 0;
-    for (; i < fastAccessLength; ++i)
-        args.append(getIndex(i));
+    for (; i < vectorEnd; ++i) {
+        JSValue& v = vector[i];
+        if (!v)
+            break;
+        args.append(v);
+    }
+
     for (; i < m_storage->m_length; ++i)
         args.append(get(exec, i));
 }
@@ -926,12 +930,17 @@ void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSiz
 {
     ASSERT(m_storage->m_length == maxSize);
     UNUSED_PARAM(maxSize);
-    unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
+    JSValue* vector = m_storage->m_vector;
+    unsigned vectorEnd = min(m_storage->m_length, m_vectorLength);
     unsigned i = 0;
-    for (; i < fastAccessLength; ++i)
-        buffer[i] = getIndex(i);
-    uint32_t size = m_storage->m_length;
-    for (; i < size; ++i)
+    for (; i < vectorEnd; ++i) {
+        JSValue& v = vector[i];
+        if (!v)
+            break;
+        buffer[i] = v;
+    }
+
+    for (; i < m_storage->m_length; ++i)
         buffer[i] = get(exec, i);
 }
 
@@ -941,7 +950,7 @@ unsigned JSArray::compactForSorting()
 
     ArrayStorage* storage = m_storage;
 
-    unsigned usedVectorLength = min(m_storage->m_length, storage->m_vectorLength);
+    unsigned usedVectorLength = min(m_storage->m_length, m_vectorLength);
 
     unsigned numDefined = 0;
     unsigned numUndefined = 0;
@@ -965,7 +974,7 @@ unsigned JSArray::compactForSorting()
 
     if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
         newUsedVectorLength += map->size();
-        if (newUsedVectorLength > storage->m_vectorLength) {
+        if (newUsedVectorLength > m_vectorLength) {
             // Check that it is possible to allocate an array large enough to hold all the entries - if not,
             // exception is thrown by caller.
             if ((newUsedVectorLength > MAX_STORAGE_VECTOR_LENGTH) || !increaseVectorLength(newUsedVectorLength))
@@ -986,7 +995,6 @@ unsigned JSArray::compactForSorting()
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
         storage->m_vector[i] = JSValue();
 
-    m_fastAccessCutoff = newUsedVectorLength;
     storage->m_numValuesInVector = newUsedVectorLength;
 
     checkConsistency(SortConsistencyCheck);
@@ -1012,30 +1020,27 @@ void JSArray::checkConsistency(ConsistencyCheckType type)
     if (type == SortConsistencyCheck)
         ASSERT(!m_storage->m_sparseValueMap);
 
-    ASSERT(m_fastAccessCutoff <= m_storage->m_length);
-    ASSERT(m_fastAccessCutoff <= m_storage->m_numValuesInVector);
-
     unsigned numValuesInVector = 0;
-    for (unsigned i = 0; i < m_storage->m_vectorLength; ++i) {
+    for (unsigned i = 0; i < m_vectorLength; ++i) {
         if (JSValue value = m_storage->m_vector[i]) {
             ASSERT(i < m_storage->m_length);
             if (type != DestructorConsistencyCheck)
                 value->type(); // Likely to crash if the object was deallocated.
             ++numValuesInVector;
         } else {
-            ASSERT(i >= m_fastAccessCutoff);
             if (type == SortConsistencyCheck)
                 ASSERT(i >= m_storage->m_numValuesInVector);
         }
     }
     ASSERT(numValuesInVector == m_storage->m_numValuesInVector);
+    ASSERT(numValuesInVector <= m_storage->m_length);
 
     if (m_storage->m_sparseValueMap) {
         SparseArrayValueMap::iterator end = m_storage->m_sparseValueMap->end();
         for (SparseArrayValueMap::iterator it = m_storage->m_sparseValueMap->begin(); it != end; ++it) {
             unsigned index = it->first;
             ASSERT(index < m_storage->m_length);
-            ASSERT(index >= m_storage->m_vectorLength);
+            ASSERT(index >= m_vectorLength);
             ASSERT(index <= MAX_ARRAY_INDEX);
             ASSERT(it->second);
             if (type != DestructorConsistencyCheck)
@@ -1046,26 +1051,4 @@ void JSArray::checkConsistency(ConsistencyCheckType type)
 
 #endif
 
-JSArray* constructEmptyArray(ExecState* exec)
-{
-    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure());
-}
-
-JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
-{
-    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), initialLength);
-}
-
-JSArray* constructArray(ExecState* exec, JSValue singleItemValue)
-{
-    MarkedArgumentBuffer values;
-    values.append(singleItemValue);
-    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
-}
-
-JSArray* constructArray(ExecState* exec, const ArgList& values)
-{
-    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
-}
-
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSArray.h b/JavaScriptCore/runtime/JSArray.h
index 49df6c4..66b5a1d 100644
--- a/JavaScriptCore/runtime/JSArray.h
+++ b/JavaScriptCore/runtime/JSArray.h
@@ -29,7 +29,6 @@ namespace JSC {
 
     struct ArrayStorage {
         unsigned m_length;
-        unsigned m_vectorLength;
         unsigned m_numValuesInVector;
         SparseArrayValueMap* m_sparseValueMap;
         void* lazyCreationData; // A JSArray subclass can use this to fill the vector lazily.
@@ -38,15 +37,17 @@ namespace JSC {
 
     class JSArray : public JSObject {
         friend class JIT;
+        friend class Walker;
 
     public:
-        explicit JSArray(PassRefPtr<Structure>);
-        JSArray(PassRefPtr<Structure>, unsigned initialLength);
-        JSArray(PassRefPtr<Structure>, const ArgList& initialValues);
+        explicit JSArray(NonNullPassRefPtr<Structure>);
+        JSArray(NonNullPassRefPtr<Structure>, unsigned initialLength);
+        JSArray(NonNullPassRefPtr<Structure>, const ArgList& initialValues);
         virtual ~JSArray();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void put(ExecState*, unsigned propertyName, JSValue); // FIXME: Make protected and add setItem.
 
         static JS_EXPORTDATA const ClassInfo info;
@@ -61,18 +62,24 @@ namespace JSC {
         void push(ExecState*, JSValue);
         JSValue pop();
 
-        bool canGetIndex(unsigned i) { return i < m_fastAccessCutoff; }
+        bool canGetIndex(unsigned i) { return i < m_vectorLength && m_storage->m_vector[i]; }
         JSValue getIndex(unsigned i)
         {
             ASSERT(canGetIndex(i));
             return m_storage->m_vector[i];
         }
 
-        bool canSetIndex(unsigned i) { return i < m_fastAccessCutoff; }
-        JSValue setIndex(unsigned i, JSValue v)
+        bool canSetIndex(unsigned i) { return i < m_vectorLength; }
+        void setIndex(unsigned i, JSValue v)
         {
             ASSERT(canSetIndex(i));
-            return m_storage->m_vector[i] = v;
+            JSValue& x = m_storage->m_vector[i];
+            if (!x) {
+                ++m_storage->m_numValuesInVector;
+                if (i >= m_storage->m_length)
+                    m_storage->m_length = i + 1;
+            }
+            x = v;
         }
 
         void fillArgList(ExecState*, MarkedArgumentBuffer&);
@@ -82,12 +89,14 @@ namespace JSC {
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
+        
+        inline void markChildrenDirect(MarkStack& markStack);
 
     protected:
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
         virtual void markChildren(MarkStack&);
 
         void* lazyCreationData();
@@ -106,25 +115,110 @@ namespace JSC {
         enum ConsistencyCheckType { NormalConsistencyCheck, DestructorConsistencyCheck, SortConsistencyCheck };
         void checkConsistency(ConsistencyCheckType = NormalConsistencyCheck);
 
-        unsigned m_fastAccessCutoff;
+        unsigned m_vectorLength;
         ArrayStorage* m_storage;
     };
 
     JSArray* asArray(JSValue);
 
-    JSArray* constructEmptyArray(ExecState*);
-    JSArray* constructEmptyArray(ExecState*, unsigned initialLength);
-    JSArray* constructArray(ExecState*, JSValue singleItemValue);
-    JSArray* constructArray(ExecState*, const ArgList& values);
+    inline JSArray* asArray(JSCell* cell)
+    {
+        ASSERT(cell->inherits(&JSArray::info));
+        return static_cast<JSArray*>(cell);
+    }
 
     inline JSArray* asArray(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&JSArray::info));
-        return static_cast<JSArray*>(asObject(value));
+        return asArray(value.asCell());
+    }
+
+    inline bool isJSArray(JSGlobalData* globalData, JSValue v)
+    {
+        return v.isCell() && v.asCell()->vptr() == globalData->jsArrayVPtr;
+    }
+    inline bool isJSArray(JSGlobalData* globalData, JSCell* cell) { return cell->vptr() == globalData->jsArrayVPtr; }
+
+    inline void JSArray::markChildrenDirect(MarkStack& markStack)
+    {
+        JSObject::markChildrenDirect(markStack);
+        
+        ArrayStorage* storage = m_storage;
+
+        unsigned usedVectorLength = std::min(storage->m_length, m_vectorLength);
+        markStack.appendValues(storage->m_vector, usedVectorLength, MayContainNullValues);
+
+        if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
+            SparseArrayValueMap::iterator end = map->end();
+            for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it)
+                markStack.append(it->second);
+        }
     }
 
-    inline bool isJSArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsArrayVPtr; }
+    inline void MarkStack::markChildren(JSCell* cell)
+    {
+        ASSERT(Heap::isCellMarked(cell));
+        if (cell->structure()->typeInfo().hasDefaultMark()) {
+#ifdef NDEBUG
+            asObject(cell)->markChildrenDirect(*this);
+#else
+            ASSERT(!m_isCheckingForDefaultMarkViolation);
+            m_isCheckingForDefaultMarkViolation = true;
+            cell->markChildren(*this);
+            ASSERT(m_isCheckingForDefaultMarkViolation);
+            m_isCheckingForDefaultMarkViolation = false;
+#endif
+            return;
+        }
+        if (cell->vptr() == m_jsArrayVPtr) {
+            asArray(cell)->markChildrenDirect(*this);
+            return;
+        }
+        cell->markChildren(*this);
+    }
 
+    inline void MarkStack::drain()
+    {
+        while (!m_markSets.isEmpty() || !m_values.isEmpty()) {
+            while (!m_markSets.isEmpty() && m_values.size() < 50) {
+                ASSERT(!m_markSets.isEmpty());
+                MarkSet& current = m_markSets.last();
+                ASSERT(current.m_values);
+                JSValue* end = current.m_end;
+                ASSERT(current.m_values);
+                ASSERT(current.m_values != end);
+            findNextUnmarkedNullValue:
+                ASSERT(current.m_values != end);
+                JSValue value = *current.m_values;
+                current.m_values++;
+
+                JSCell* cell;
+                if (!value || !value.isCell() || Heap::isCellMarked(cell = value.asCell())) {
+                    if (current.m_values == end) {
+                        m_markSets.removeLast();
+                        continue;
+                    }
+                    goto findNextUnmarkedNullValue;
+                }
+
+                Heap::markCell(cell);
+                if (cell->structure()->typeInfo().type() < CompoundType) {
+                    if (current.m_values == end) {
+                        m_markSets.removeLast();
+                        continue;
+                    }
+                    goto findNextUnmarkedNullValue;
+                }
+
+                if (current.m_values == end)
+                    m_markSets.removeLast();
+
+                markChildren(cell);
+            }
+            while (!m_values.isEmpty())
+                markChildren(m_values.removeLast());
+        }
+    }
+    
 } // namespace JSC
 
 #endif // JSArray_h
diff --git a/JavaScriptCore/runtime/JSByteArray.cpp b/JavaScriptCore/runtime/JSByteArray.cpp
index 2a5e72f..90d39f0 100644
--- a/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/JavaScriptCore/runtime/JSByteArray.cpp
@@ -35,7 +35,7 @@ namespace JSC {
 
 const ClassInfo JSByteArray::s_defaultInfo = { "ByteArray", 0, 0, 0 };
 
-JSByteArray::JSByteArray(ExecState* exec, PassRefPtr<Structure> structure, ByteArray* storage, const JSC::ClassInfo* classInfo)
+JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure, ByteArray* storage, const JSC::ClassInfo* classInfo)
     : JSObject(structure)
     , m_storage(storage)
     , m_classInfo(classInfo)
@@ -45,7 +45,7 @@ JSByteArray::JSByteArray(ExecState* exec, PassRefPtr<Structure> structure, ByteA
     
 PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
-    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType));
+    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark));
     return result;
 }
 
@@ -59,7 +59,18 @@ bool JSByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& property
     }
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
-    
+
+bool JSByteArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && canAccessIndex(index)) {
+        descriptor.setDescriptor(getIndex(exec, index), DontDelete);
+        return true;
+    }
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 bool JSByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (canAccessIndex(propertyName)) {
@@ -85,12 +96,12 @@ void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
     setIndex(exec, propertyName, value);
 }
 
-void JSByteArray::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     unsigned length = m_storage->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier::from(exec, i));
-    JSObject::getPropertyNames(exec, propertyNames);
+    JSObject::getOwnPropertyNames(exec, propertyNames);
 }
 
 }
diff --git a/JavaScriptCore/runtime/JSByteArray.h b/JavaScriptCore/runtime/JSByteArray.h
index a56aca6..006f4a2 100644
--- a/JavaScriptCore/runtime/JSByteArray.h
+++ b/JavaScriptCore/runtime/JSByteArray.h
@@ -73,15 +73,16 @@ namespace JSC {
                 setIndex(i, byteValue);
         }
 
-        JSByteArray(ExecState* exec, PassRefPtr<Structure>, WTF::ByteArray* storage, const JSC::ClassInfo* = &s_defaultInfo);
+        JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure>, WTF::ByteArray* storage, const JSC::ClassInfo* = &s_defaultInfo);
         static PassRefPtr<Structure> createStructure(JSValue prototype);
         
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
 
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
         virtual const ClassInfo* classInfo() const { return m_classInfo; }
         static const ClassInfo s_defaultInfo;
diff --git a/JavaScriptCore/runtime/JSCell.cpp b/JavaScriptCore/runtime/JSCell.cpp
index c733ed9..aa93252 100644
--- a/JavaScriptCore/runtime/JSCell.cpp
+++ b/JavaScriptCore/runtime/JSCell.cpp
@@ -105,7 +105,7 @@ UString JSCell::getString() const
 
 JSObject* JSCell::getObject()
 {
-    return isObject() ? static_cast<JSObject*>(this) : 0;
+    return isObject() ? asObject(this) : 0;
 }
 
 const JSObject* JSCell::getObject() const
@@ -197,4 +197,40 @@ bool JSCell::isGetterSetter() const
     return false;
 }
 
+JSValue JSCell::toPrimitive(ExecState*, PreferredPrimitiveType) const
+{
+    ASSERT_NOT_REACHED();
+    return JSValue();
+}
+
+bool JSCell::getPrimitiveNumber(ExecState*, double&, JSValue&)
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool JSCell::toBoolean(ExecState*) const
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+double JSCell::toNumber(ExecState*) const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+UString JSCell::toString(ExecState*) const
+{
+    ASSERT_NOT_REACHED();
+    return UString();
+}
+
+JSObject* JSCell::toObject(ExecState*) const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSCell.h b/JavaScriptCore/runtime/JSCell.h
index 75ccf7f..503c6c4 100644
--- a/JavaScriptCore/runtime/JSCell.h
+++ b/JavaScriptCore/runtime/JSCell.h
@@ -23,11 +23,12 @@
 #ifndef JSCell_h
 #define JSCell_h
 
-#include <wtf/Noncopyable.h>
-#include "Structure.h"
-#include "JSValue.h"
-#include "JSImmediate.h"
 #include "Collector.h"
+#include "JSImmediate.h"
+#include "JSValue.h"
+#include "MarkStack.h"
+#include "Structure.h"
+#include <wtf/Noncopyable.h>
 
 namespace JSC {
 
@@ -45,6 +46,7 @@ namespace JSC {
 
     private:
         explicit JSCell(Structure*);
+        JSCell(); // Only used for initializing Collector blocks.
         virtual ~JSCell();
 
     public:
@@ -55,7 +57,7 @@ namespace JSC {
         bool isString() const;
         bool isObject() const;
         virtual bool isGetterSetter() const;
-        virtual bool isObject(const ClassInfo*) const;
+        bool inherits(const ClassInfo*) const;
         virtual bool isAPIValueWrapper() const { return false; }
 
         Structure* structure() const;
@@ -74,21 +76,19 @@ namespace JSC {
         virtual bool getUInt32(uint32_t&) const;
 
         // Basic conversions.
-        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const = 0;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&) = 0;
-        virtual bool toBoolean(ExecState*) const = 0;
-        virtual double toNumber(ExecState*) const = 0;
-        virtual UString toString(ExecState*) const = 0;
-        virtual JSObject* toObject(ExecState*) const = 0;
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
+        virtual bool toBoolean(ExecState*) const;
+        virtual double toNumber(ExecState*) const;
+        virtual UString toString(ExecState*) const;
+        virtual JSObject* toObject(ExecState*) const;
 
         // Garbage collection.
         void* operator new(size_t, ExecState*);
         void* operator new(size_t, JSGlobalData*);
         void* operator new(size_t, void* placementNewDestination) { return placementNewDestination; }
 
-        void markCellDirect();
         virtual void markChildren(MarkStack&);
-        bool marked() const;
 
         // Object operations, with the toObject operation included.
         virtual const ClassInfo* classInfo() const;
@@ -112,6 +112,7 @@ namespace JSC {
         Structure* m_structure;
     };
 
+    // FIXME: We should deprecate this and just use JSValue::asCell() instead.
     JSCell* asCell(JSValue);
 
     inline JSCell* asCell(JSValue value)
@@ -124,6 +125,11 @@ namespace JSC {
     {
     }
 
+    // Only used for initializing Collector blocks.
+    inline JSCell::JSCell()
+    {
+    }
+
     inline JSCell::~JSCell()
     {
     }
@@ -150,19 +156,8 @@ namespace JSC {
         return m_structure;
     }
 
-    inline bool JSCell::marked() const
-    {
-        return Heap::isCellMarked(this);
-    }
-
-    inline void JSCell::markCellDirect()
-    {
-        Heap::markCell(this);
-    }
-
     inline void JSCell::markChildren(MarkStack&)
     {
-        ASSERT(marked());
     }
 
     inline void* JSCell::operator new(size_t size, JSGlobalData* globalData)
@@ -231,23 +226,6 @@ namespace JSC {
         return false;
     }
 
-    inline void JSValue::markDirect()
-    {
-        ASSERT(!marked());
-        asCell()->markCellDirect();
-    }
-
-    inline void JSValue::markChildren(MarkStack& markStack)
-    {
-        ASSERT(marked());
-        asCell()->markChildren(markStack);
-    }
-
-    inline bool JSValue::marked() const
-    {
-        return !isCell() || asCell()->marked();
-    }
-
 #if !USE(JSVALUE32_64)
     ALWAYS_INLINE JSCell* JSValue::asCell() const
     {
@@ -315,24 +293,6 @@ namespace JSC {
         return isUndefined() ? nonInlineNaN() : 0; // null and false both convert to 0.
     }
 
-    inline UString JSValue::toString(ExecState* exec) const
-    {
-        if (isCell())
-            return asCell()->toString(exec);
-        if (isInt32())
-            return UString::from(asInt32());
-        if (isDouble())
-            return asDouble() == 0.0 ? "0" : UString::from(asDouble());
-        if (isTrue())
-            return "true";
-        if (isFalse())
-            return "false";
-        if (isNull())
-            return "null";
-        ASSERT(isUndefined());
-        return "undefined";
-    }
-
     inline bool JSValue::needsThisConversion() const
     {
         if (UNLIKELY(!isCell()))
@@ -353,12 +313,6 @@ namespace JSC {
             return asCell()->getJSNumber();
         return JSValue();
     }
-    
-    inline bool JSValue::hasChildren() const
-    {
-        return asCell()->structure()->typeInfo().type() >= CompoundType;
-    }
-    
 
     inline JSObject* JSValue::toObject(ExecState* exec) const
     {
@@ -372,37 +326,39 @@ namespace JSC {
 
     ALWAYS_INLINE void MarkStack::append(JSCell* cell)
     {
+        ASSERT(!m_isCheckingForDefaultMarkViolation);
         ASSERT(cell);
-        if (cell->marked())
+        if (Heap::isCellMarked(cell))
             return;
-        cell->markCellDirect();
+        Heap::markCell(cell);
         if (cell->structure()->typeInfo().type() >= CompoundType)
             m_values.append(cell);
     }
 
-    inline void MarkStack::drain() {
-        while (!m_markSets.isEmpty() || !m_values.isEmpty()) {
-            while ((!m_markSets.isEmpty()) && m_values.size() < 50) {
-                const MarkSet& current = m_markSets.removeLast();
-                JSValue* ptr = current.m_values;
-                JSValue* end = current.m_end;
-                if (current.m_properties == NoNullValues) {
-                    while (ptr != end)
-                        append(*ptr++);
-                } else {
-                    while (ptr != end) {
-                        if (JSValue value = *ptr++)
-                            append(value);
-                    }
-                }
-            }
-            while (!m_values.isEmpty()) {
-                JSCell* current = m_values.removeLast();
-                ASSERT(current->marked());
-                current->markChildren(*this);
-            }
-        }
+    ALWAYS_INLINE void MarkStack::append(JSValue value)
+    {
+        ASSERT(value);
+        if (value.isCell())
+            append(value.asCell());
+    }
+
+    inline void Structure::markAggregate(MarkStack& markStack)
+    {
+        markStack.append(m_prototype);
+    }
+
+    inline Heap* Heap::heap(JSValue v)
+    {
+        if (!v.isCell())
+            return 0;
+        return heap(v.asCell());
+    }
+
+    inline Heap* Heap::heap(JSCell* c)
+    {
+        return cellBlock(c)->heap;
     }
+
 } // namespace JSC
 
 #endif // JSCell_h
diff --git a/JavaScriptCore/runtime/JSFunction.cpp b/JavaScriptCore/runtime/JSFunction.cpp
index 84c6263..024e586 100644
--- a/JavaScriptCore/runtime/JSFunction.cpp
+++ b/JavaScriptCore/runtime/JSFunction.cpp
@@ -45,12 +45,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSFunction);
 
 const ClassInfo JSFunction::info = { "Function", &InternalFunction::info, 0, 0 };
 
-JSFunction::JSFunction(ExecState* exec, PassRefPtr<Structure> structure, int length, const Identifier& name, NativeFunction func)
+bool JSFunction::isHostFunctionNonInline() const
+{
+    return isHostFunction();
+}
+
+JSFunction::JSFunction(NonNullPassRefPtr<Structure> structure)
+    : Base(structure)
+    , m_executable(adoptRef(new VPtrHackExecutable()))
+{
+}
+
+JSFunction::JSFunction(ExecState* exec, NonNullPassRefPtr<Structure> structure, int length, const Identifier& name, NativeFunction func)
     : Base(&exec->globalData(), structure, name)
 #if ENABLE(JIT)
-    , m_body(FunctionBodyNode::createNativeThunk(&exec->globalData()))
-#else
-    , m_body(0)
+    , m_executable(adoptRef(new NativeExecutable(exec)))
 #endif
 {
 #if ENABLE(JIT)
@@ -63,9 +72,9 @@ JSFunction::JSFunction(ExecState* exec, PassRefPtr<Structure> structure, int len
 #endif
 }
 
-JSFunction::JSFunction(ExecState* exec, const Identifier& name, FunctionBodyNode* body, ScopeChainNode* scopeChainNode)
-    : Base(&exec->globalData(), exec->lexicalGlobalObject()->functionStructure(), name)
-    , m_body(body)
+JSFunction::JSFunction(ExecState* exec, NonNullPassRefPtr<FunctionExecutable> executable, ScopeChainNode* scopeChainNode)
+    : Base(&exec->globalData(), exec->lexicalGlobalObject()->functionStructure(), executable->name())
+    , m_executable(executable)
 {
     setScopeChain(scopeChainNode);
 }
@@ -75,20 +84,23 @@ JSFunction::~JSFunction()
     // JIT code for other functions may have had calls linked directly to the code for this function; these links
     // are based on a check for the this pointer value for this JSFunction - which will no longer be valid once
     // this memory is freed and may be reused (potentially for another, different JSFunction).
+    if (!isHostFunction()) {
 #if ENABLE(JIT_OPTIMIZE_CALL)
-    if (m_body && m_body->isGenerated())
-        m_body->generatedBytecode().unlinkCallers();
+        ASSERT(m_executable);
+        if (jsExecutable()->isGenerated())
+            jsExecutable()->generatedBytecode().unlinkCallers();
 #endif
-    if (!isHostFunction())
         scopeChain().~ScopeChain(); // FIXME: Don't we need to do this in the interpreter too?
+    }
 }
 
 void JSFunction::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    m_body->markAggregate(markStack);
-    if (!isHostFunction())
+    if (!isHostFunction()) {
+        jsExecutable()->markAggregate(markStack);
         scopeChain().markAggregate(markStack);
+    }
 }
 
 CallType JSFunction::getCallData(CallData& callData)
@@ -97,7 +109,7 @@ CallType JSFunction::getCallData(CallData& callData)
         callData.native.function = nativeFunction();
         return CallTypeHost;
     }
-    callData.js.functionBody = m_body.get();
+    callData.js.functionExecutable = jsExecutable();
     callData.js.scopeChain = scopeChain().node();
     return CallTypeJS;
 }
@@ -105,7 +117,7 @@ CallType JSFunction::getCallData(CallData& callData)
 JSValue JSFunction::call(ExecState* exec, JSValue thisValue, const ArgList& args)
 {
     ASSERT(!isHostFunction());
-    return exec->interpreter()->execute(m_body.get(), exec, this, thisValue.toThisObject(exec), args, scopeChain().node(), exec->exceptionSlot());
+    return exec->interpreter()->execute(jsExecutable(), exec, this, thisValue.toThisObject(exec), args, scopeChain().node(), exec->exceptionSlot());
 }
 
 JSValue JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -126,7 +138,7 @@ JSValue JSFunction::lengthGetter(ExecState* exec, const Identifier&, const Prope
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
     ASSERT(!thisObj->isHostFunction());
-    return jsNumber(exec, thisObj->m_body->parameterCount());
+    return jsNumber(exec, thisObj->jsExecutable()->parameterCount());
 }
 
 bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,6 +177,35 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+    bool JSFunction::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+    {
+        if (isHostFunction())
+            return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+        
+        if (propertyName == exec->propertyNames().prototype) {
+            PropertySlot slot;
+            getOwnPropertySlot(exec, propertyName, slot);
+            return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+        }
+        
+        if (propertyName == exec->propertyNames().arguments) {
+            descriptor.setDescriptor(exec->interpreter()->retrieveArguments(exec, this), ReadOnly | DontEnum | DontDelete);
+            return true;
+        }
+        
+        if (propertyName == exec->propertyNames().length) {
+            descriptor.setDescriptor(jsNumber(exec, jsExecutable()->parameterCount()), ReadOnly | DontEnum | DontDelete);
+            return true;
+        }
+        
+        if (propertyName == exec->propertyNames().caller) {
+            descriptor.setDescriptor(exec->interpreter()->retrieveCaller(exec, this), ReadOnly | DontEnum | DontDelete);
+            return true;
+        }
+        
+        return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+    }
+    
 void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (isHostFunction()) {
@@ -190,7 +231,7 @@ ConstructType JSFunction::getConstructData(ConstructData& constructData)
 {
     if (isHostFunction())
         return ConstructTypeNone;
-    constructData.js.functionBody = m_body.get();
+    constructData.js.functionExecutable = jsExecutable();
     constructData.js.scopeChain = scopeChain().node();
     return ConstructTypeJS;
 }
@@ -206,7 +247,7 @@ JSObject* JSFunction::construct(ExecState* exec, const ArgList& args)
         structure = exec->lexicalGlobalObject()->emptyObjectStructure();
     JSObject* thisObj = new (exec) JSObject(structure);
 
-    JSValue result = exec->interpreter()->execute(m_body.get(), exec, this, thisObj, args, scopeChain().node(), exec->exceptionSlot());
+    JSValue result = exec->interpreter()->execute(jsExecutable(), exec, this, thisObj, args, scopeChain().node(), exec->exceptionSlot());
     if (exec->hadException() || !result.isObject())
         return thisObj;
     return asObject(result);
diff --git a/JavaScriptCore/runtime/JSFunction.h b/JavaScriptCore/runtime/JSFunction.h
index cab1e5b..a9ac63e 100644
--- a/JavaScriptCore/runtime/JSFunction.h
+++ b/JavaScriptCore/runtime/JSFunction.h
@@ -25,14 +25,11 @@
 #define JSFunction_h
 
 #include "InternalFunction.h"
-#include "JSVariableObject.h"
-#include "SymbolTable.h"
-#include "Nodes.h"
-#include "JSObject.h"
 
 namespace JSC {
 
-    class FunctionBodyNode;
+    class ExecutableBase;
+    class FunctionExecutable;
     class FunctionPrototype;
     class JSActivation;
     class JSGlobalObject;
@@ -43,20 +40,10 @@ namespace JSC {
 
         typedef InternalFunction Base;
 
-        JSFunction(PassRefPtr<Structure> structure)
-            : InternalFunction(structure)
-        {
-            clearScopeChain();
-        }
-
     public:
-        JSFunction(ExecState*, PassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
-        JSFunction(ExecState*, const Identifier&, FunctionBodyNode*, ScopeChainNode*);
-        ~JSFunction();
-
-        virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+        JSFunction(ExecState*, NonNullPassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
+        JSFunction(ExecState*, NonNullPassRefPtr<FunctionExecutable>, ScopeChainNode*);
+        virtual ~JSFunction();
 
         JSObject* construct(ExecState*, const ArgList&);
         JSValue call(ExecState*, JSValue thisValue, const ArgList&);
@@ -64,11 +51,11 @@ namespace JSC {
         void setScope(const ScopeChain& scopeChain) { setScopeChain(scopeChain); }
         ScopeChain& scope() { return scopeChain(); }
 
-        void setBody(FunctionBodyNode* body) { m_body = body; }
-        void setBody(PassRefPtr<FunctionBodyNode> body) { m_body = body; }
-        FunctionBodyNode* body() const { return m_body.get(); }
+        ExecutableBase* executable() const { return m_executable.get(); }
 
-        virtual void markChildren(MarkStack&);
+        // To call either of these methods include Executable.h
+        inline bool isHostFunction() const;
+        FunctionExecutable* jsExecutable() const;
 
         static JS_EXPORTDATA const ClassInfo info;
 
@@ -77,11 +64,6 @@ namespace JSC {
             return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance)); 
         }
 
-#if ENABLE(JIT)
-        bool isHostFunction() const { return m_body && m_body->isHostFunction(); }
-#else
-        bool isHostFunction() const { return false; }
-#endif
         NativeFunction nativeFunction()
         {
             return *reinterpret_cast<NativeFunction*>(m_data);
@@ -91,31 +73,42 @@ namespace JSC {
         virtual CallType getCallData(CallData&);
 
     private:
+        JSFunction(NonNullPassRefPtr<Structure>);
+
+        bool isHostFunctionNonInline() const;
+
+        virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+
+        virtual void markChildren(MarkStack&);
+
         virtual const ClassInfo* classInfo() const { return &info; }
 
         static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
         static JSValue callerGetter(ExecState*, const Identifier&, const PropertySlot&);
         static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
 
-        RefPtr<FunctionBodyNode> m_body;
+        RefPtr<ExecutableBase> m_executable;
         ScopeChain& scopeChain()
         {
-            ASSERT(!isHostFunction());
+            ASSERT(!isHostFunctionNonInline());
             return *reinterpret_cast<ScopeChain*>(m_data);
         }
         void clearScopeChain()
         {
-            ASSERT(!isHostFunction());
+            ASSERT(!isHostFunctionNonInline());
             new (m_data) ScopeChain(NoScopeChain());
         }
         void setScopeChain(ScopeChainNode* sc)
         {
-            ASSERT(!isHostFunction());
+            ASSERT(!isHostFunctionNonInline());
             new (m_data) ScopeChain(sc);
         }
         void setScopeChain(const ScopeChain& sc)
         {
-            ASSERT(!isHostFunction());
+            ASSERT(!isHostFunctionNonInline());
             *reinterpret_cast<ScopeChain*>(m_data) = sc;
         }
         void setNativeFunction(NativeFunction func)
diff --git a/JavaScriptCore/runtime/JSGlobalData.cpp b/JavaScriptCore/runtime/JSGlobalData.cpp
index 03df41d..1221ef2 100644
--- a/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -144,8 +144,12 @@ JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
     , initializingLazyNumericCompareFunction(false)
     , head(0)
     , dynamicGlobalObject(0)
-    , scopeNodeBeingReparsed(0)
+    , functionCodeBlockBeingReparsed(0)
     , firstStringifierToMark(0)
+    , markStack(vptrSet.jsArrayVPtr)
+#ifndef NDEBUG
+    , mainThreadOnly(false)
+#endif
 {
 #if PLATFORM(MAC)
     startProfilerServerIfNeeded();
@@ -235,9 +239,8 @@ const Vector<Instruction>& JSGlobalData::numericCompareFunction(ExecState* exec)
 {
     if (!lazyNumericCompareFunction.size() && !initializingLazyNumericCompareFunction) {
         initializingLazyNumericCompareFunction = true;
-        RefPtr<ProgramNode> programNode = parser->parse<ProgramNode>(exec, 0, makeSource(UString("(function (v1, v2) { return v1 - v2; })")), 0, 0);
-        RefPtr<FunctionBodyNode> functionBody = extractFunctionBody(programNode.get());
-        lazyNumericCompareFunction = functionBody->bytecode(exec->scopeChain()).instructions();
+        RefPtr<FunctionExecutable> function = FunctionExecutable::fromGlobalCode(Identifier(exec, "numericCompare"), exec, 0, makeSource(UString("(function (v1, v2) { return v1 - v2; })")), 0, 0);
+        lazyNumericCompareFunction = function->bytecode(exec, exec->scopeChain()).instructions();
         initializingLazyNumericCompareFunction = false;
     }
 
@@ -248,4 +251,19 @@ JSGlobalData::ClientData::~ClientData()
 {
 }
 
+void JSGlobalData::startSampling()
+{
+    interpreter->startSampling();
+}
+
+void JSGlobalData::stopSampling()
+{
+    interpreter->stopSampling();
+}
+
+void JSGlobalData::dumpSampleData(ExecState* exec)
+{
+    interpreter->dumpSampleData(exec);
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSGlobalData.h b/JavaScriptCore/runtime/JSGlobalData.h
index 88cb516..3ad90ad 100644
--- a/JavaScriptCore/runtime/JSGlobalData.h
+++ b/JavaScriptCore/runtime/JSGlobalData.h
@@ -34,6 +34,7 @@
 #include "JITStubs.h"
 #include "JSValue.h"
 #include "MarkStack.h"
+#include "NumericStrings.h"
 #include "SmallStrings.h"
 #include "TimeoutChecker.h"
 #include <wtf/Forward.h>
@@ -45,15 +46,14 @@ struct OpaqueJSClassContextData;
 
 namespace JSC {
 
+    class CodeBlock;
     class CommonIdentifiers;
-    class FunctionBodyNode;
     class IdentifierTable;
     class Interpreter;
     class JSGlobalObject;
     class JSObject;
     class Lexer;
     class Parser;
-    class ScopeNode;
     class Stringifier;
     class Structure;
     class UString;
@@ -115,6 +115,7 @@ namespace JSC {
         CommonIdentifiers* propertyNames;
         const MarkedArgumentBuffer* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
         SmallStrings smallStrings;
+        NumericStrings numericStrings;
 
 #if ENABLE(ASSEMBLER)
         ExecutableAllocator executableAllocator;
@@ -145,10 +146,18 @@ namespace JSC {
 
         HashSet<JSObject*> arrayVisitedElements;
 
-        ScopeNode* scopeNodeBeingReparsed;
+        CodeBlock* functionCodeBlockBeingReparsed;
         Stringifier* firstStringifierToMark;
 
         MarkStack markStack;
+
+#ifndef NDEBUG
+        bool mainThreadOnly;
+#endif
+
+        void startSampling();
+        void stopSampling();
+        void dumpSampleData(ExecState* exec);
     private:
         JSGlobalData(bool isShared, const VPtrSet&);
         static JSGlobalData*& sharedInstanceInternal();
diff --git a/JavaScriptCore/runtime/JSGlobalObject.cpp b/JavaScriptCore/runtime/JSGlobalObject.cpp
index a90f18f..3bb281e 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -112,8 +112,8 @@ JSGlobalObject::~JSGlobalObject()
     if (headObject == this)
         headObject = 0;
 
-    HashSet<ProgramCodeBlock*>::const_iterator end = codeBlocks().end();
-    for (HashSet<ProgramCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
+    HashSet<GlobalCodeBlock*>::const_iterator end = codeBlocks().end();
+    for (HashSet<GlobalCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
         (*it)->clearGlobalObject();
         
     RegisterFile& registerFile = globalData()->interpreter->registerFile();
@@ -121,7 +121,7 @@ JSGlobalObject::~JSGlobalObject()
         registerFile.setGlobalObject(0);
         registerFile.setNumGlobals(0);
     }
-    delete d();
+    d()->destructor(d());
 }
 
 void JSGlobalObject::init(JSObject* thisValue)
@@ -129,7 +129,7 @@ void JSGlobalObject::init(JSObject* thisValue)
     ASSERT(JSLock::currentThreadIsHoldingLock());
 
     d()->globalData = Heap::heap(this)->globalData();
-    d()->globalScopeChain = ScopeChain(this, d()->globalData.get(), thisValue);
+    d()->globalScopeChain = ScopeChain(this, d()->globalData.get(), this, thisValue);
 
     JSGlobalObject::globalExec()->init(0, 0, d()->globalScopeChain.node(), CallFrame::noCaller(), 0, 0, 0);
 
@@ -175,18 +175,18 @@ void JSGlobalObject::putWithAttributes(ExecState* exec, const Identifier& proper
     }
 }
 
-void JSGlobalObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunc)
+void JSGlobalObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunc, unsigned attributes)
 {
     PropertySlot slot;
     if (!symbolTableGet(propertyName, slot))
-        JSVariableObject::defineGetter(exec, propertyName, getterFunc);
+        JSVariableObject::defineGetter(exec, propertyName, getterFunc, attributes);
 }
 
-void JSGlobalObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunc)
+void JSGlobalObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunc, unsigned attributes)
 {
     PropertySlot slot;
     if (!symbolTableGet(propertyName, slot))
-        JSVariableObject::defineSetter(exec, propertyName, setterFunc);
+        JSVariableObject::defineSetter(exec, propertyName, setterFunc, attributes);
 }
 
 static inline JSObject* lastInPrototypeChain(JSObject* object)
@@ -258,7 +258,7 @@ void JSGlobalObject::reset(JSValue prototype)
 
     JSCell* objectConstructor = new (exec) ObjectConstructor(exec, ObjectConstructor::createStructure(d()->functionPrototype), d()->objectPrototype, d()->prototypeFunctionStructure.get());
     JSCell* functionConstructor = new (exec) FunctionConstructor(exec, FunctionConstructor::createStructure(d()->functionPrototype), d()->functionPrototype);
-    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype);
+    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype, d()->prototypeFunctionStructure.get());
     JSCell* stringConstructor = new (exec) StringConstructor(exec, StringConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->stringPrototype);
     JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, BooleanConstructor::createStructure(d()->functionPrototype), d()->booleanPrototype);
     JSCell* numberConstructor = new (exec) NumberConstructor(exec, NumberConstructor::createStructure(d()->functionPrototype), d()->numberPrototype);
@@ -361,8 +361,8 @@ void JSGlobalObject::markChildren(MarkStack& markStack)
 {
     JSVariableObject::markChildren(markStack);
     
-    HashSet<ProgramCodeBlock*>::const_iterator end = codeBlocks().end();
-    for (HashSet<ProgramCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
+    HashSet<GlobalCodeBlock*>::const_iterator end = codeBlocks().end();
+    for (HashSet<GlobalCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
         (*it)->markAggregate(markStack);
 
     RegisterFile& registerFile = globalData()->interpreter->registerFile();
@@ -455,4 +455,9 @@ void* JSGlobalObject::operator new(size_t size, JSGlobalData* globalData)
 #endif
 }
 
+void JSGlobalObject::destroyJSGlobalObjectData(void* jsGlobalObjectData)
+{
+    delete static_cast<JSGlobalObjectData*>(jsGlobalObjectData);
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSGlobalObject.h b/JavaScriptCore/runtime/JSGlobalObject.h
index cda49bd..2106783 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/JavaScriptCore/runtime/JSGlobalObject.h
@@ -22,6 +22,7 @@
 #ifndef JSGlobalObject_h
 #define JSGlobalObject_h
 
+#include "JSArray.h"
 #include "JSGlobalData.h"
 #include "JSVariableObject.h"
 #include "NativeFunctionWrapper.h"
@@ -38,6 +39,7 @@ namespace JSC {
     class Debugger;
     class ErrorConstructor;
     class FunctionPrototype;
+    class GlobalCodeBlock;
     class GlobalEvalFunction;
     class NativeErrorConstructor;
     class ProgramCodeBlock;
@@ -50,14 +52,22 @@ namespace JSC {
     struct HashTable;
 
     typedef Vector<ExecState*, 16> ExecStateStack;
-
+    
     class JSGlobalObject : public JSVariableObject {
     protected:
         using JSVariableObject::JSVariableObjectData;
 
         struct JSGlobalObjectData : public JSVariableObjectData {
-            JSGlobalObjectData()
+            // We use an explicit destructor function pointer instead of a
+            // virtual destructor because we want to avoid adding a vtable
+            // pointer to this struct. Adding a vtable pointer would force the
+            // compiler to emit costly pointer fixup code when casting from
+            // JSVariableObjectData* to JSGlobalObjectData*.
+            typedef void (*Destructor)(void*);
+
+            JSGlobalObjectData(Destructor destructor)
                 : JSVariableObjectData(&symbolTable, 0)
+                , destructor(destructor)
                 , registerArraySize(0)
                 , globalScopeChain(NoScopeChain())
                 , regExpConstructor(0)
@@ -83,10 +93,8 @@ namespace JSC {
             {
             }
             
-            virtual ~JSGlobalObjectData()
-            {
-            }
-
+            Destructor destructor;
+            
             size_t registerArraySize;
 
             JSGlobalObject* next;
@@ -144,20 +152,20 @@ namespace JSC {
 
             RefPtr<JSGlobalData> globalData;
 
-            HashSet<ProgramCodeBlock*> codeBlocks;
+            HashSet<GlobalCodeBlock*> codeBlocks;
         };
 
     public:
         void* operator new(size_t, JSGlobalData*);
 
         explicit JSGlobalObject()
-            : JSVariableObject(JSGlobalObject::createStructure(jsNull()), new JSGlobalObjectData)
+            : JSVariableObject(JSGlobalObject::createStructure(jsNull()), new JSGlobalObjectData(destroyJSGlobalObjectData))
         {
             init(this);
         }
 
     protected:
-        JSGlobalObject(PassRefPtr<Structure> structure, JSGlobalObjectData* data, JSObject* thisValue)
+        JSGlobalObject(NonNullPassRefPtr<Structure> structure, JSGlobalObjectData* data, JSObject* thisValue)
             : JSVariableObject(structure, data)
         {
             init(thisValue);
@@ -169,12 +177,13 @@ namespace JSC {
         virtual void markChildren(MarkStack&);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual bool hasOwnPropertyForWrite(ExecState*, const Identifier&);
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes);
 
-        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunc);
-        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunc);
+        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunc, unsigned attributes);
+        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunc, unsigned attributes);
 
         // Linked list of all global objects that use the same JSGlobalData.
         JSGlobalObject*& head() { return d()->globalData->head; }
@@ -246,7 +255,7 @@ namespace JSC {
 
         virtual bool isDynamicScope() const;
 
-        HashSet<ProgramCodeBlock*>& codeBlocks() { return d()->codeBlocks; }
+        HashSet<GlobalCodeBlock*>& codeBlocks() { return d()->codeBlocks; }
 
         void copyGlobalsFrom(RegisterFile&);
         void copyGlobalsTo(RegisterFile&);
@@ -277,6 +286,8 @@ namespace JSC {
         void addStaticGlobals(GlobalPropertyInfo*, int count);
 
     private:
+        static void destroyJSGlobalObjectData(void*);
+
         // FIXME: Fold reset into init.
         void init(JSObject* thisValue);
         void reset(JSValue prototype);
@@ -325,6 +336,13 @@ namespace JSC {
         return symbolTableGet(propertyName, slot);
     }
 
+    inline bool JSGlobalObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+    {
+        if (symbolTableGet(propertyName, descriptor))
+            return true;
+        return JSVariableObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+    }
+
     inline bool JSGlobalObject::hasOwnPropertyForWrite(ExecState* exec, const Identifier& propertyName)
     {
         PropertySlot slot;
@@ -334,14 +352,6 @@ namespace JSC {
         return symbolTableGet(propertyName, slot, slotIsWriteable);
     }
 
-    inline JSGlobalObject* ScopeChainNode::globalObject() const
-    {
-        const ScopeChainNode* n = this;
-        while (n->next)
-            n = n->next;
-        return asGlobalObject(n->object);
-    }
-
     inline JSValue Structure::prototypeForLookup(ExecState* exec) const
     {
         if (typeInfo().type() == ObjectType)
@@ -396,6 +406,33 @@ namespace JSC {
         return globalData().dynamicGlobalObject;
     }
 
+    inline JSObject* constructEmptyObject(ExecState* exec)
+    {
+        return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
+    }
+
+    inline JSArray* constructEmptyArray(ExecState* exec)
+    {
+        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure());
+    }
+
+    inline JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
+    {
+        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), initialLength);
+    }
+
+    inline JSArray* constructArray(ExecState* exec, JSValue singleItemValue)
+    {
+        MarkedArgumentBuffer values;
+        values.append(singleItemValue);
+        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
+    }
+
+    inline JSArray* constructArray(ExecState* exec, const ArgList& values)
+    {
+        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
+    }
+
     class DynamicGlobalObjectScope : public Noncopyable {
     public:
         DynamicGlobalObjectScope(CallFrame* callFrame, JSGlobalObject* dynamicGlobalObject) 
diff --git a/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index affb99c..dc32718 100644
--- a/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -286,16 +286,12 @@ JSValue JSC_HOST_CALL globalFuncEval(ExecState* exec, JSObject* function, JSValu
     if (JSValue parsedObject = preparser.tryLiteralParse())
         return parsedObject;
 
-    int errLine;
-    UString errMsg;
+    RefPtr<EvalExecutable> eval = EvalExecutable::create(exec, makeSource(s));
+    JSObject* error = eval->compile(exec, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node());
+    if (error)
+        return throwError(exec, error);
 
-    SourceCode source = makeSource(s);
-    RefPtr<EvalNode> evalNode = exec->globalData().parser->parse<EvalNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
-
-    if (!evalNode)
-        return throwError(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), NULL);
-
-    return exec->interpreter()->execute(evalNode.get(), exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node(), exec->exceptionSlot());
+    return exec->interpreter()->execute(eval.get(), exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node(), exec->exceptionSlot());
 }
 
 JSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
diff --git a/JavaScriptCore/runtime/JSNotAnObject.cpp b/JavaScriptCore/runtime/JSNotAnObject.cpp
index a542a9f..c36dc10 100644
--- a/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -93,6 +93,12 @@ bool JSNotAnObject::getOwnPropertySlot(ExecState* exec, unsigned, PropertySlot&)
     return false;
 }
 
+bool JSNotAnObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier&, PropertyDescriptor&)
+{
+    ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
+    return false;
+}
+
 void JSNotAnObject::put(ExecState* exec, const Identifier& , JSValue, PutPropertySlot&)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
@@ -115,7 +121,7 @@ bool JSNotAnObject::deleteProperty(ExecState* exec, unsigned)
     return false;
 }
 
-void JSNotAnObject::getPropertyNames(ExecState* exec, PropertyNameArray&)
+void JSNotAnObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray&)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
diff --git a/JavaScriptCore/runtime/JSNotAnObject.h b/JavaScriptCore/runtime/JSNotAnObject.h
index b65ff5f..0d9aca6 100644
--- a/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/JavaScriptCore/runtime/JSNotAnObject.h
@@ -80,6 +80,7 @@ namespace JSC {
         // JSObject methods
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue);
@@ -87,7 +88,7 @@ namespace JSC {
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
         JSNotAnObjectErrorStub* m_exception;
     };
diff --git a/JavaScriptCore/runtime/JSNumberCell.cpp b/JavaScriptCore/runtime/JSNumberCell.cpp
index 0654da7..f1009b9 100644
--- a/JavaScriptCore/runtime/JSNumberCell.cpp
+++ b/JavaScriptCore/runtime/JSNumberCell.cpp
@@ -54,15 +54,11 @@ double JSNumberCell::toNumber(ExecState*) const
 
 UString JSNumberCell::toString(ExecState*) const
 {
-    if (m_value == 0.0) // +0.0 or -0.0
-        return "0";
     return UString::from(m_value);
 }
 
 UString JSNumberCell::toThisString(ExecState*) const
 {
-    if (m_value == 0.0) // +0.0 or -0.0
-        return "0";
     return UString::from(m_value);
 }
 
diff --git a/JavaScriptCore/runtime/JSNumberCell.h b/JavaScriptCore/runtime/JSNumberCell.h
index 04cccef..6a48081 100644
--- a/JavaScriptCore/runtime/JSNumberCell.h
+++ b/JavaScriptCore/runtime/JSNumberCell.h
@@ -84,7 +84,7 @@ namespace JSC {
     #endif
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion | HasDefaultMark)); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
diff --git a/JavaScriptCore/runtime/JSONObject.cpp b/JavaScriptCore/runtime/JSONObject.cpp
index d643808..297d457 100644
--- a/JavaScriptCore/runtime/JSONObject.cpp
+++ b/JavaScriptCore/runtime/JSONObject.cpp
@@ -120,38 +120,47 @@ private:
 
 // ------------------------------ helper functions --------------------------------
 
-static inline JSValue unwrapBoxedPrimitive(JSValue value)
+static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)
 {
     if (!value.isObject())
         return value;
-    if (!asObject(value)->inherits(&NumberObject::info) && !asObject(value)->inherits(&StringObject::info) && !asObject(value)->inherits(&BooleanObject::info))
-        return value;
-    return static_cast<JSWrapperObject*>(asObject(value))->internalValue();
+    JSObject* object = asObject(value);
+    if (object->inherits(&NumberObject::info))
+        return jsNumber(exec, object->toNumber(exec));
+    if (object->inherits(&StringObject::info))
+        return jsString(exec, object->toString(exec));
+    if (object->inherits(&BooleanObject::info))
+        return object->toPrimitive(exec);
+    return value;
 }
 
-static inline UString gap(JSValue space)
+static inline UString gap(ExecState* exec, JSValue space)
 {
-    space = unwrapBoxedPrimitive(space);
+    const int maxGapLength = 10;
+    space = unwrapBoxedPrimitive(exec, space);
 
     // If the space value is a number, create a gap string with that number of spaces.
     double spaceCount;
     if (space.getNumber(spaceCount)) {
-        const int maxSpaceCount = 100;
         int count;
-        if (spaceCount > maxSpaceCount)
-            count = maxSpaceCount;
+        if (spaceCount > maxGapLength)
+            count = maxGapLength;
         else if (!(spaceCount > 0))
             count = 0;
         else
             count = static_cast<int>(spaceCount);
-        UChar spaces[maxSpaceCount];
+        UChar spaces[maxGapLength];
         for (int i = 0; i < count; ++i)
             spaces[i] = ' ';
         return UString(spaces, count);
     }
 
     // If the space value is a string, use it as the gap string, otherwise use no gap string.
-    return space.getString();
+    UString spaces = space.getString();
+    if (spaces.size() > maxGapLength) {
+        spaces = spaces.substr(0, maxGapLength);
+    }
+    return spaces;
 }
 
 // ------------------------------ PropertyNameForFunctionCall --------------------------------
@@ -187,7 +196,7 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
     , m_usingArrayReplacer(false)
     , m_arrayReplacerPropertyNames(exec)
     , m_replacerCallType(CallTypeNone)
-    , m_gap(gap(space))
+    , m_gap(gap(exec, space))
 {
     exec->globalData().firstStringifierToMark = this;
 
@@ -202,12 +211,27 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
             JSValue name = array->get(exec, i);
             if (exec->hadException())
                 break;
+
             UString propertyName;
-            if (!name.getString(propertyName))
+            if (name.getString(propertyName)) {
+                m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
                 continue;
-            if (exec->hadException())
-                return;
-            m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
+            }
+
+            double value = 0;
+            if (name.getNumber(value)) {
+                m_arrayReplacerPropertyNames.add(Identifier::from(exec, value));
+                continue;
+            }
+
+            if (name.isObject()) {
+                if (!asObject(name)->inherits(&NumberObject::info) && !asObject(name)->inherits(&StringObject::info))
+                    continue;
+                propertyName = name.toString(exec);
+                if (exec->hadException())
+                    break;
+                m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
+            }
         }
         return;
     }
@@ -354,7 +378,10 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
         return StringifySucceeded;
     }
 
-    value = unwrapBoxedPrimitive(value);
+    value = unwrapBoxedPrimitive(m_exec, value);
+
+    if (m_exec->hadException())
+        return StringifyFailed;
 
     if (value.isBoolean()) {
         builder.append(value.getBoolean() ? "true" : "false");
@@ -381,6 +408,15 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
 
     JSObject* object = asObject(value);
 
+    CallData callData;
+    if (object->getCallData(callData) != CallTypeNone) {
+        if (holder->inherits(&JSArray::info)) {
+            builder.append("null");
+            return StringifySucceeded;
+        }
+        return StringifyFailedDueToUndefinedValue;
+    }
+
     // Handle cycle detection, and put the holder on the stack.
     if (!m_holderCycleDetector.add(object).second) {
         throwError(m_exec, TypeError, "JSON.stringify cannot serialize cyclic structures.");
@@ -572,13 +608,12 @@ const ClassInfo JSONObject::info = { "JSON", 0, 0, ExecState::jsonTable };
 
 bool JSONObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    const HashEntry* entry = ExecState::jsonTable(exec)->entry(exec, propertyName);
-    if (!entry)
-        return JSObject::getOwnPropertySlot(exec, propertyName, slot);
+    return getStaticFunctionSlot<JSObject>(exec, ExecState::jsonTable(exec), this, propertyName, slot);
+}
 
-    ASSERT(entry->attributes() & Function);
-    setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
-    return true;
+bool JSONObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, ExecState::jsonTable(exec), this, propertyName, descriptor);
 }
 
 void JSONObject::markStringifiers(MarkStack& markStack, Stringifier* stringifier)
@@ -597,11 +632,11 @@ public:
     }
     JSValue walk(JSValue unfiltered);
 private:
-    JSValue callReviver(JSValue property, JSValue unfiltered)
+    JSValue callReviver(JSObject* thisObj, JSValue property, JSValue unfiltered)
     {
         JSValue args[] = { property, unfiltered };
         ArgList argList(args, 2);
-        return call(m_exec, m_function, m_callType, m_callData, jsNull(), argList);
+        return call(m_exec, m_function, m_callType, m_callData, thisObj, argList);
     }
 
     friend class Holder;
@@ -611,7 +646,10 @@ private:
     CallType m_callType;
     CallData m_callData;
 };
-    
+
+// We clamp recursion well beyond anything reasonable, but we also have a timeout check
+// to guard against "infinite" execution by inserting arbitrarily large objects.
+static const unsigned maximumFilterRecursion = 40000;
 enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember, 
                                  ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
 NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
@@ -625,12 +663,21 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
     WalkerState state = StateUnknown;
     JSValue inValue = unfiltered;
     JSValue outValue = jsNull();
+    
+    TimeoutChecker localTimeoutChecker(m_exec->globalData().timeoutChecker);
+    localTimeoutChecker.reset();
+    unsigned tickCount = localTimeoutChecker.ticksUntilNextCheck();
     while (1) {
         switch (state) {
             arrayStartState:
             case ArrayStartState: {
                 ASSERT(inValue.isObject());
-                ASSERT(isJSArray(&m_exec->globalData(), asObject(inValue)));
+                ASSERT(isJSArray(&m_exec->globalData(), asObject(inValue)) || asObject(inValue)->inherits(&JSArray::info));
+                if (objectStack.size() + arrayStack.size() > maximumFilterRecursion) {
+                    m_exec->setException(createStackOverflowError(m_exec));
+                    return jsUndefined();
+                }
+
                 JSArray* array = asArray(inValue);
                 arrayStack.append(array);
                 indexStack.append(0);
@@ -638,6 +685,14 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             }
             arrayStartVisitMember:
             case ArrayStartVisitMember: {
+                if (!--tickCount) {
+                    if (localTimeoutChecker.didTimeOut(m_exec)) {
+                        m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+                        return jsUndefined();
+                    }
+                    tickCount = localTimeoutChecker.ticksUntilNextCheck();
+                }
+
                 JSArray* array = arrayStack.last();
                 uint32_t index = indexStack.last();
                 if (index == array->length()) {
@@ -646,7 +701,16 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     indexStack.removeLast();
                     break;
                 }
-                inValue = array->getIndex(index);
+                if (isJSArray(&m_exec->globalData(), array) && array->canGetIndex(index))
+                    inValue = array->getIndex(index);
+                else {
+                    PropertySlot slot;
+                    if (array->getOwnPropertySlot(m_exec, index, slot))
+                        inValue = slot.getValue(m_exec, index);
+                    else
+                        inValue = jsUndefined();
+                }
+                    
                 if (inValue.isObject()) {
                     stateStack.append(ArrayEndVisitMember);
                     goto stateUnknown;
@@ -656,7 +720,15 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             }
             case ArrayEndVisitMember: {
                 JSArray* array = arrayStack.last();
-                array->setIndex(indexStack.last(), callReviver(jsString(m_exec, UString::from(indexStack.last())), outValue));
+                JSValue filteredValue = callReviver(array, jsString(m_exec, UString::from(indexStack.last())), outValue);
+                if (filteredValue.isUndefined())
+                    array->deleteProperty(m_exec, indexStack.last());
+                else {
+                    if (isJSArray(&m_exec->globalData(), array) && array->canSetIndex(indexStack.last()))
+                        array->setIndex(indexStack.last(), filteredValue);
+                    else
+                        array->put(m_exec, indexStack.last(), filteredValue);
+                }
                 if (m_exec->hadException())
                     return jsNull();
                 indexStack.last()++;
@@ -665,7 +737,12 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             objectStartState:
             case ObjectStartState: {
                 ASSERT(inValue.isObject());
-                ASSERT(!isJSArray(&m_exec->globalData(), asObject(inValue)));
+                ASSERT(!isJSArray(&m_exec->globalData(), asObject(inValue)) && !asObject(inValue)->inherits(&JSArray::info));
+                if (objectStack.size() + arrayStack.size() > maximumFilterRecursion) {
+                    m_exec->setException(createStackOverflowError(m_exec));
+                    return jsUndefined();
+                }
+
                 JSObject* object = asObject(inValue);
                 objectStack.append(object);
                 indexStack.append(0);
@@ -675,6 +752,14 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             }
             objectStartVisitMember:
             case ObjectStartVisitMember: {
+                if (!--tickCount) {
+                    if (localTimeoutChecker.didTimeOut(m_exec)) {
+                        m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+                        return jsUndefined();
+                    }
+                    tickCount = localTimeoutChecker.ticksUntilNextCheck();
+                }
+
                 JSObject* object = objectStack.last();
                 uint32_t index = indexStack.last();
                 PropertyNameArray& properties = propertyStack.last();
@@ -686,9 +771,15 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     break;
                 }
                 PropertySlot slot;
-                object->getOwnPropertySlot(m_exec, properties[index], slot);
-                inValue = slot.getValue(m_exec, properties[index]);
-                ASSERT(!m_exec->hadException());
+                if (object->getOwnPropertySlot(m_exec, properties[index], slot))
+                    inValue = slot.getValue(m_exec, properties[index]);
+                else
+                    inValue = jsUndefined();
+
+                // The holder may be modified by the reviver function so any lookup may throw
+                if (m_exec->hadException())
+                    return jsNull();
+
                 if (inValue.isObject()) {
                     stateStack.append(ObjectEndVisitMember);
                     goto stateUnknown;
@@ -700,7 +791,11 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 JSObject* object = objectStack.last();
                 Identifier prop = propertyStack.last()[indexStack.last()];
                 PutPropertySlot slot;
-                object->put(m_exec, prop, callReviver(jsString(m_exec, prop.ustring()), outValue), slot);
+                JSValue filteredValue = callReviver(object, jsString(m_exec, prop.ustring()), outValue);
+                if (filteredValue.isUndefined())
+                    object->deleteProperty(m_exec, prop);
+                else
+                    object->put(m_exec, prop, filteredValue, slot);
                 if (m_exec->hadException())
                     return jsNull();
                 indexStack.last()++;
@@ -712,16 +807,29 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     outValue = inValue;
                     break;
                 }
-                if (isJSArray(&m_exec->globalData(), asObject(inValue)))
+                JSObject* object = asObject(inValue);
+                if (isJSArray(&m_exec->globalData(), object) || object->inherits(&JSArray::info))
                     goto arrayStartState;
                 goto objectStartState;
         }
         if (stateStack.isEmpty())
             break;
+
         state = stateStack.last();
         stateStack.removeLast();
+
+        if (!--tickCount) {
+            if (localTimeoutChecker.didTimeOut(m_exec)) {
+                m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+                return jsUndefined();
+            }
+            tickCount = localTimeoutChecker.ticksUntilNextCheck();
+        }
     }
-    return callReviver(jsEmptyString(m_exec), outValue);
+    JSObject* finalHolder = constructEmptyObject(m_exec);
+    PutPropertySlot slot;
+    finalHolder->put(m_exec, m_exec->globalData().propertyNames->emptyIdentifier, outValue, slot);
+    return callReviver(finalHolder, jsEmptyString(m_exec), outValue);
 }
 
 // ECMA-262 v5 15.12.2
diff --git a/JavaScriptCore/runtime/JSONObject.h b/JavaScriptCore/runtime/JSONObject.h
index faca7c7..65c9803 100644
--- a/JavaScriptCore/runtime/JSONObject.h
+++ b/JavaScriptCore/runtime/JSONObject.h
@@ -34,20 +34,21 @@ namespace JSC {
 
     class JSONObject : public JSObject {
     public:
-        JSONObject(PassRefPtr<Structure> structure)
+        JSONObject(NonNullPassRefPtr<Structure> structure)
             : JSObject(structure)
         {
         }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
         }
 
         static void markStringifiers(MarkStack&, Stringifier*);
 
     private:
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
diff --git a/JavaScriptCore/runtime/JSObject.cpp b/JavaScriptCore/runtime/JSObject.cpp
index 419dfe9..db2a9b2 100644
--- a/JavaScriptCore/runtime/JSObject.cpp
+++ b/JavaScriptCore/runtime/JSObject.cpp
@@ -30,6 +30,7 @@
 #include "JSGlobalObject.h"
 #include "NativeErrorConstructor.h"
 #include "ObjectPrototype.h"
+#include "PropertyDescriptor.h"
 #include "PropertyNameArray.h"
 #include "Lookup.h"
 #include "Nodes.h"
@@ -37,43 +38,22 @@
 #include <math.h>
 #include <wtf/Assertions.h>
 
-#define JSOBJECT_MARK_TRACING 0
-
-#if JSOBJECT_MARK_TRACING
-
-#define JSOBJECT_MARK_BEGIN() \
-    static int markStackDepth = 0; \
-    for (int i = 0; i < markStackDepth; i++) \
-        putchar('-'); \
-    printf("%s (%p)\n", className().UTF8String().c_str(), this); \
-    markStackDepth++; \
-
-#define JSOBJECT_MARK_END() \
-    markStackDepth--;
-
-#else // JSOBJECT_MARK_TRACING
-
-#define JSOBJECT_MARK_BEGIN()
-#define JSOBJECT_MARK_END()
-
-#endif // JSOBJECT_MARK_TRACING
-
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 
 void JSObject::markChildren(MarkStack& markStack)
 {
-    JSOBJECT_MARK_BEGIN();
+#ifndef NDEBUG
+    bool wasCheckingForDefaultMarkViolation = markStack.m_isCheckingForDefaultMarkViolation;
+    markStack.m_isCheckingForDefaultMarkViolation = false;
+#endif
 
-    JSCell::markChildren(markStack);
-    m_structure->markAggregate(markStack);
+    markChildrenDirect(markStack);
 
-    PropertyStorage storage = propertyStorage();
-    size_t storageSize = m_structure->propertyStorageSize();
-    markStack.appendValues(reinterpret_cast<JSValue*>(storage), storageSize);
-
-    JSOBJECT_MARK_END();
+#ifndef NDEBUG
+    markStack.m_isCheckingForDefaultMarkViolation = wasCheckingForDefaultMarkViolation;
+#endif
 }
 
 UString JSObject::className() const
@@ -295,7 +275,7 @@ const HashEntry* JSObject::findPropertyHashEntry(ExecState* exec, const Identifi
     return 0;
 }
 
-void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     JSValue object = getDirect(propertyName);
     if (object && object.isGetterSetter()) {
@@ -306,7 +286,7 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
 
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter(exec);
-    putDirectInternal(exec->globalData(), propertyName, getterSetter, Getter, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, getterSetter, attributes | Getter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
@@ -322,7 +302,7 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
     getterSetter->setGetter(getterFunction);
 }
 
-void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
     JSValue object = getDirect(propertyName);
     if (object && object.isGetterSetter()) {
@@ -333,7 +313,7 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
 
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter(exec);
-    putDirectInternal(exec->globalData(), propertyName, getterSetter, Setter, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, getterSetter, attributes | Setter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
@@ -447,6 +427,11 @@ void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
     m_structure->getEnumerablePropertyNames(exec, propertyNames, this);
 }
 
+void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    m_structure->getOwnEnumerablePropertyNames(exec, propertyNames, this);
+}
+
 bool JSObject::toBoolean(ExecState*) const
 {
     return true;
@@ -486,7 +471,7 @@ JSObject* JSObject::unwrappedObject()
 void JSObject::removeDirect(const Identifier& propertyName)
 {
     size_t offset;
-    if (m_structure->isDictionary()) {
+    if (m_structure->isUncacheableDictionary()) {
         offset = m_structure->removePropertyWithoutTransition(propertyName);
         if (offset != WTF::notFound)
             putDirectOffset(offset, jsUndefined());
@@ -528,9 +513,154 @@ void JSObject::allocatePropertyStorage(size_t oldSize, size_t newSize)
     allocatePropertyStorageInline(oldSize, newSize);
 }
 
-JSObject* constructEmptyObject(ExecState* exec)
+bool JSObject::getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    unsigned attributes = 0;
+    JSCell* cell = 0;
+    size_t offset = m_structure->get(propertyName, attributes, cell);
+    if (offset == WTF::notFound)
+        return false;
+    descriptor.setDescriptor(getDirectOffset(offset), attributes);
+    return true;
+}
+
+bool JSObject::getPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
+    JSObject* object = this;
+    while (true) {
+        if (object->getOwnPropertyDescriptor(exec, propertyName, descriptor))
+            return true;
+        JSValue prototype = object->prototype();
+        if (!prototype.isObject())
+            return false;
+        object = asObject(prototype);
+    }
+}
+
+static bool putDescriptor(ExecState* exec, JSObject* target, const Identifier& propertyName, PropertyDescriptor& descriptor, unsigned attributes, JSValue oldValue)
+{
+    if (descriptor.isGenericDescriptor() || descriptor.isDataDescriptor()) {
+        target->putWithAttributes(exec, propertyName, descriptor.value() ? descriptor.value() : oldValue, attributes & ~(Getter | Setter));
+        return true;
+    }
+    attributes &= ~ReadOnly;
+    if (descriptor.getter() && descriptor.getter().isObject())
+        target->defineGetter(exec, propertyName, asObject(descriptor.getter()), attributes);
+    if (exec->hadException())
+        return false;
+    if (descriptor.setter() && descriptor.setter().isObject())
+        target->defineSetter(exec, propertyName, asObject(descriptor.setter()), attributes);
+    return !exec->hadException();
+}
+
+bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool throwException)
+{
+    // If we have a new property we can just put it on normally
+    PropertyDescriptor current;
+    if (!getOwnPropertyDescriptor(exec, propertyName, current))
+        return putDescriptor(exec, this, propertyName, descriptor, descriptor.attributes(), jsUndefined());
+
+    if (descriptor.isEmpty())
+        return true;
+
+    if (current.equalTo(descriptor))
+        return true;
+
+    // Filter out invalid changes
+    if (!current.configurable()) {
+        if (descriptor.configurable()) {
+            if (throwException)
+                throwError(exec, TypeError, "Attempting to configurable attribute of unconfigurable property.");
+            return false;
+        }
+        if (descriptor.enumerablePresent() && descriptor.enumerable() != current.enumerable()) {
+            if (throwException)
+                throwError(exec, TypeError, "Attempting to change enumerable attribute of unconfigurable property.");
+            return false;
+        }
+    }
+
+    // A generic descriptor is simply changing the attributes of an existing property
+    if (descriptor.isGenericDescriptor()) {
+        if (!current.attributesEqual(descriptor)) {
+            deleteProperty(exec, propertyName);
+            putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current.value());
+        }
+        return true;
+    }
+
+    // Changing between a normal property or an accessor property
+    if (descriptor.isDataDescriptor() != current.isDataDescriptor()) {
+        if (!current.configurable()) {
+            if (throwException)
+                throwError(exec, TypeError, "Attempting to change access mechanism for an unconfigurable property.");
+            return false;
+        }
+        deleteProperty(exec, propertyName);
+        return putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current.value() ? current.value() : jsUndefined());
+    }
+
+    // Changing the value and attributes of an existing property
+    if (descriptor.isDataDescriptor()) {
+        if (!current.configurable()) {
+            if (!current.writable() && descriptor.writable()) {
+                if (throwException)
+                    throwError(exec, TypeError, "Attempting to change writable attribute of unconfigurable property.");
+                return false;
+            }
+            if (!current.writable()) {
+                if (descriptor.value() || !JSValue::strictEqual(current.value(), descriptor.value())) {
+                    if (throwException)
+                        throwError(exec, TypeError, "Attempting to change value of a readonly property.");
+                    return false;
+                }
+            }
+        } else if (current.attributesEqual(descriptor)) {
+            if (!descriptor.value())
+                return true;
+            PutPropertySlot slot;
+            put(exec, propertyName, descriptor.value(), slot);
+            if (exec->hadException())
+                return false;
+            return true;
+        }
+        deleteProperty(exec, propertyName);
+        return putDescriptor(exec, this, propertyName, descriptor, current.attributesWithOverride(descriptor), current.value());
+    }
+
+    // Changing the accessor functions of an existing accessor property
+    ASSERT(descriptor.isAccessorDescriptor());
+    if (!current.configurable()) {
+        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(current.setter(), descriptor.setter()))) {
+            if (throwException)
+                throwError(exec, TypeError, "Attempting to change the setter of an unconfigurable property.");
+            return false;
+        }
+        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(current.getter(), descriptor.getter()))) {
+            if (throwException)
+                throwError(exec, TypeError, "Attempting to change the getter of an unconfigurable property.");
+            return false;
+        }
+    }
+    JSValue accessor = getDirect(propertyName);
+    if (!accessor)
+        return false;
+    GetterSetter* getterSetter = asGetterSetter(accessor);
+    if (current.attributesEqual(descriptor)) {
+        if (descriptor.setter())
+            getterSetter->setSetter(asObject(descriptor.setter()));
+        if (descriptor.getter())
+            getterSetter->setGetter(asObject(descriptor.getter()));
+        return true;
+    }
+    deleteProperty(exec, propertyName);
+    unsigned attrs = current.attributesWithOverride(descriptor);
+    if (descriptor.setter())
+        attrs |= Setter;
+    if (descriptor.getter())
+        attrs |= Getter;
+    putDirect(propertyName, getterSetter, attrs);
+    return true;
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSObject.h b/JavaScriptCore/runtime/JSObject.h
index decd5e9..84b5f4b 100644
--- a/JavaScriptCore/runtime/JSObject.h
+++ b/JavaScriptCore/runtime/JSObject.h
@@ -27,7 +27,9 @@
 #include "ClassInfo.h"
 #include "CommonIdentifiers.h"
 #include "CallFrame.h"
+#include "JSCell.h"
 #include "JSNumberCell.h"
+#include "MarkStack.h"
 #include "PropertySlot.h"
 #include "PutPropertySlot.h"
 #include "ScopeChain.h"
@@ -46,6 +48,7 @@ namespace JSC {
     
     class HashEntry;
     class InternalFunction;
+    class PropertyDescriptor;
     class PropertyNameArray;
     class Structure;
     struct HashTable;
@@ -71,20 +74,19 @@ namespace JSC {
         friend class JSCell;
 
     public:
-        explicit JSObject(PassRefPtr<Structure>);
+        explicit JSObject(NonNullPassRefPtr<Structure>);
 
         virtual void markChildren(MarkStack&);
+        ALWAYS_INLINE void markChildrenDirect(MarkStack& markStack);
 
         // The inline virtual destructor cannot be the first virtual function declared
         // in the class as it results in the vtable being generated as a weak symbol
         virtual ~JSObject();
 
-        bool inherits(const ClassInfo* classInfo) const { return JSCell::isObject(classInfo); }
-
         JSValue prototype() const;
         void setPrototype(JSValue prototype);
         
-        void setStructure(PassRefPtr<Structure>);
+        void setStructure(NonNullPassRefPtr<Structure>);
         Structure* inheritorID();
 
         virtual UString className() const;
@@ -94,9 +96,11 @@ namespace JSC {
 
         bool getPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        bool getPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue value);
@@ -119,6 +123,7 @@ namespace JSC {
         virtual bool hasInstance(ExecState*, JSValue, JSValue prototypeProperty);
 
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
@@ -181,10 +186,11 @@ namespace JSC {
 
         void fillGetterPropertySlot(PropertySlot&, JSValue* location);
 
-        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
-        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
+        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes = 0);
+        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes = 0);
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
         virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
+        virtual bool defineOwnProperty(ExecState*, const Identifier& propertyName, PropertyDescriptor&, bool shouldThrow);
 
         virtual bool isGlobalObject() const { return false; }
         virtual bool isVariableObject() const { return false; }
@@ -201,10 +207,33 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+        }
+
+    protected:
+        void addAnonymousSlots(unsigned count);
+        void putAnonymousValue(unsigned index, JSValue value)
+        {
+            *locationForOffset(index) = value;
+        }
+        JSValue getAnonymousValue(unsigned index)
+        {
+            return *locationForOffset(index);
         }
 
     private:
+        // Nobody should ever ask any of these questions on something already known to be a JSObject.
+        using JSCell::isAPIValueWrapper;
+        using JSCell::isGetterSetter;
+        using JSCell::toObject;
+        void getObject();
+        void getString();
+        void isObject();
+        void isString();
+#if USE(JSVALUE32)
+        void isNumber();
+#endif
+
         ConstPropertyStorage propertyStorage() const { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
         PropertyStorage propertyStorage() { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
 
@@ -235,18 +264,20 @@ namespace JSC {
         RefPtr<Structure> m_inheritorID;
     };
     
-JSObject* constructEmptyObject(ExecState*);
+inline JSObject* asObject(JSCell* cell)
+{
+    ASSERT(cell->isObject());
+    return static_cast<JSObject*>(cell);
+}
 
 inline JSObject* asObject(JSValue value)
 {
-    ASSERT(asCell(value)->isObject());
-    return static_cast<JSObject*>(asCell(value));
+    return asObject(value.asCell());
 }
 
-inline JSObject::JSObject(PassRefPtr<Structure> structure)
+inline JSObject::JSObject(NonNullPassRefPtr<Structure> structure)
     : JSCell(structure.releaseRef()) // ~JSObject balances this ref()
 {
-    ASSERT(m_structure);
     ASSERT(m_structure->propertyStorageCapacity() == inlineStorageCapacity);
     ASSERT(m_structure->isEmpty());
     ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
@@ -275,7 +306,7 @@ inline void JSObject::setPrototype(JSValue prototype)
     setStructure(newStructure.release());
 }
 
-inline void JSObject::setStructure(PassRefPtr<Structure> structure)
+inline void JSObject::setStructure(NonNullPassRefPtr<Structure> structure)
 {
     m_structure->deref();
     m_structure = structure.releaseRef(); // ~JSObject balances this ref()
@@ -293,7 +324,7 @@ inline bool Structure::isUsingInlineStorage() const
     return (propertyStorageCapacity() == JSObject::inlineStorageCapacity);
 }
 
-inline bool JSCell::isObject(const ClassInfo* info) const
+inline bool JSCell::inherits(const ClassInfo* info) const
 {
     for (const ClassInfo* ci = classInfo(); ci; ci = ci->parentClass) {
         if (ci == info)
@@ -302,10 +333,10 @@ inline bool JSCell::isObject(const ClassInfo* info) const
     return false;
 }
 
-// this method is here to be after the inline declaration of JSCell::isObject
-inline bool JSValue::isObject(const ClassInfo* classInfo) const
+// this method is here to be after the inline declaration of JSCell::inherits
+inline bool JSValue::inherits(const ClassInfo* classInfo) const
 {
-    return isCell() && asCell()->isObject(classInfo);
+    return isCell() && asCell()->inherits(classInfo);
 }
 
 ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -454,7 +485,18 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         return;
     }
 
+    // If we have a specific function, we may have got to this point if there is
+    // already a transition with the correct property name and attributes, but
+    // specialized to a different function.  In this case we just want to give up
+    // and despecialize the transition.
+    // In this case we clear the value of specificFunction which will result
+    // in us adding a non-specific transition, and any subsequent lookup in
+    // Structure::addPropertyTransitionToExistingStructure will just use that.
+    if (specificFunction && m_structure->hasTransition(propertyName, attributes))
+        specificFunction = 0;
+
     RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, specificFunction, offset);
+
     if (currentCapacity != structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
@@ -480,6 +522,17 @@ inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
     putDirectInternal(propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
 }
 
+inline void JSObject::addAnonymousSlots(unsigned count)
+{
+    size_t currentCapacity = m_structure->propertyStorageCapacity();
+    RefPtr<Structure> structure = Structure::addAnonymousSlotsTransition(m_structure, count);
+
+    if (currentCapacity != structure->propertyStorageCapacity())
+        allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
+
+    setStructure(structure.release());
+}
+
 inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
     ASSERT(value);
@@ -555,8 +608,7 @@ inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName, Pro
     while (true) {
         if (cell->fastGetOwnPropertySlot(exec, propertyName, slot))
             return slot.getValue(exec, propertyName);
-        ASSERT(cell->isObject());
-        JSValue prototype = static_cast<JSObject*>(cell)->prototype();
+        JSValue prototype = asObject(cell)->prototype();
         if (!prototype.isObject())
             return jsUndefined();
         cell = asObject(prototype);
@@ -581,8 +633,7 @@ inline JSValue JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot
     while (true) {
         if (cell->getOwnPropertySlot(exec, propertyName, slot))
             return slot.getValue(exec, propertyName);
-        ASSERT(cell->isObject());
-        JSValue prototype = static_cast<JSObject*>(cell)->prototype();
+        JSValue prototype = asObject(cell)->prototype();
         if (!prototype.isObject())
             return jsUndefined();
         cell = prototype.asCell();
@@ -627,6 +678,17 @@ ALWAYS_INLINE void JSObject::allocatePropertyStorageInline(size_t oldSize, size_
     m_externalStorage = newPropertyStorage;
 }
 
+ALWAYS_INLINE void JSObject::markChildrenDirect(MarkStack& markStack)
+{
+    JSCell::markChildren(markStack);
+
+    m_structure->markAggregate(markStack);
+    
+    PropertyStorage storage = propertyStorage();
+    size_t storageSize = m_structure->propertyStorageSize();
+    markStack.appendValues(reinterpret_cast<JSValue*>(storage), storageSize);
+}
+
 } // namespace JSC
 
 #endif // JSObject_h
diff --git a/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index dc0304f..e08a3d9 100644
--- a/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -37,42 +37,6 @@ JSPropertyNameIterator::~JSPropertyNameIterator()
 {
 }
 
-JSValue JSPropertyNameIterator::toPrimitive(ExecState*, PreferredPrimitiveType) const
-{
-    ASSERT_NOT_REACHED();
-    return JSValue();
-}
-
-bool JSPropertyNameIterator::getPrimitiveNumber(ExecState*, double&, JSValue&)
-{
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-bool JSPropertyNameIterator::toBoolean(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-double JSPropertyNameIterator::toNumber(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-UString JSPropertyNameIterator::toString(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return "";
-}
-
-JSObject* JSPropertyNameIterator::toObject(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
 void JSPropertyNameIterator::markChildren(MarkStack& markStack)
 {
     JSCell::markChildren(markStack);
diff --git a/JavaScriptCore/runtime/JSPropertyNameIterator.h b/JavaScriptCore/runtime/JSPropertyNameIterator.h
index 4534528..d2849a8 100644
--- a/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -44,13 +44,6 @@ namespace JSC {
 
         virtual ~JSPropertyNameIterator();
 
-        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double&, JSValue&);
-        virtual bool toBoolean(ExecState*) const;
-        virtual double toNumber(ExecState*) const;
-        virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
-
         virtual void markChildren(MarkStack&);
 
         JSValue next(ExecState*);
diff --git a/JavaScriptCore/runtime/JSString.cpp b/JavaScriptCore/runtime/JSString.cpp
index 86f95e0..91ddaeb 100644
--- a/JavaScriptCore/runtime/JSString.cpp
+++ b/JavaScriptCore/runtime/JSString.cpp
@@ -103,6 +103,33 @@ bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return true;
 }
 
+bool JSString::getStringPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        descriptor.setDescriptor(jsNumber(exec, m_value.size()), DontEnum | DontDelete | ReadOnly);
+        return true;
+    }
+    
+    bool isStrictUInt32;
+    unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
+    if (isStrictUInt32 && i < static_cast<unsigned>(m_value.size())) {
+        descriptor.setDescriptor(jsSingleCharacterSubstring(exec, m_value, i), DontDelete | ReadOnly);
+        return true;
+    }
+    
+    return false;
+}
+
+bool JSString::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (getStringPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+    if (propertyName != exec->propertyNames().underscoreProto)
+        return false;
+    descriptor.setDescriptor(exec->lexicalGlobalObject()->stringPrototype(), DontEnum);
+    return true;
+}
+
 bool JSString::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     // The semantics here are really getPropertySlot, not getOwnPropertySlot.
diff --git a/JavaScriptCore/runtime/JSString.h b/JavaScriptCore/runtime/JSString.h
index 3daf58a..1e46551 100644
--- a/JavaScriptCore/runtime/JSString.h
+++ b/JavaScriptCore/runtime/JSString.h
@@ -27,6 +27,7 @@
 #include "CommonIdentifiers.h"
 #include "Identifier.h"
 #include "JSNumberCell.h"
+#include "PropertyDescriptor.h"
 #include "PropertySlot.h"
 
 namespace JSC {
@@ -86,11 +87,12 @@ namespace JSC {
 
         bool getStringPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getStringPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        bool getStringPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
 
         bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
         JSString* getIndex(JSGlobalData*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion | HasDefaultMark)); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -113,6 +115,7 @@ namespace JSC {
         // Actually getPropertySlot, not getOwnPropertySlot (see JSCell).
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         UString m_value;
     };
@@ -211,6 +214,26 @@ namespace JSC {
         return isCell() ? asCell()->toThisJSString(exec) : jsString(exec, toString(exec));
     }
 
+    inline UString JSValue::toString(ExecState* exec) const
+    {
+        if (isString())
+            return static_cast<JSString*>(asCell())->value();
+        if (isInt32())
+            return exec->globalData().numericStrings.add(asInt32());
+        if (isDouble())
+            return exec->globalData().numericStrings.add(asDouble());
+        if (isTrue())
+            return "true";
+        if (isFalse())
+            return "false";
+        if (isNull())
+            return "null";
+        if (isUndefined())
+            return "undefined";
+        ASSERT(isCell());
+        return asCell()->toString(exec);
+    }
+
 } // namespace JSC
 
 #endif // JSString_h
diff --git a/JavaScriptCore/runtime/JSType.h b/JavaScriptCore/runtime/JSType.h
index a118b87..882b218 100644
--- a/JavaScriptCore/runtime/JSType.h
+++ b/JavaScriptCore/runtime/JSType.h
@@ -33,7 +33,6 @@ namespace JSC {
         NumberType        = 3,
         NullType          = 4,
         StringType        = 5,
-        
         // The CompoundType value must come before any JSType that may have children
         CompoundType      = 6,
         ObjectType        = 7,
diff --git a/JavaScriptCore/runtime/TypeInfo.h b/JavaScriptCore/runtime/JSTypeInfo.h
index 70aeed3..279510b 100644
--- a/JavaScriptCore/runtime/TypeInfo.h
+++ b/JavaScriptCore/runtime/JSTypeInfo.h
@@ -24,8 +24,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef TypeInfo_h
-#define TypeInfo_h
+#ifndef JSTypeInfo_h
+#define JSTypeInfo_h
+
+// This file would be called TypeInfo.h, but that conflicts with <typeinfo.h>
+// in the STL on systems without case-sensitive file systems. 
 
 #include "JSType.h"
 
@@ -38,6 +41,8 @@ namespace JSC {
     static const unsigned ImplementsDefaultHasInstance = 1 << 3;
     static const unsigned NeedsThisConversion = 1 << 4;
     static const unsigned HasStandardGetOwnPropertySlot = 1 << 5;
+    static const unsigned HasDefaultMark = 1 << 6;
+    static const unsigned HasDefaultGetPropertyNames = 1 << 7;
 
     class TypeInfo {
         friend class JIT;
@@ -59,7 +64,8 @@ namespace JSC {
         bool overridesHasInstance() const { return m_flags & OverridesHasInstance; }
         bool needsThisConversion() const { return m_flags & NeedsThisConversion; }
         bool hasStandardGetOwnPropertySlot() const { return m_flags & HasStandardGetOwnPropertySlot; }
-
+        bool hasDefaultMark() const { return m_flags & HasDefaultMark; }
+        bool hasDefaultGetPropertyNames() const { return m_flags & HasDefaultGetPropertyNames; }
         unsigned flags() const { return m_flags; }
 
     private:
@@ -69,4 +75,4 @@ namespace JSC {
 
 }
 
-#endif // TypeInfo_h
+#endif // JSTypeInfo_h
diff --git a/JavaScriptCore/runtime/JSValue.cpp b/JavaScriptCore/runtime/JSValue.cpp
index 39a4093..699c1cd 100644
--- a/JavaScriptCore/runtime/JSValue.cpp
+++ b/JavaScriptCore/runtime/JSValue.cpp
@@ -110,7 +110,10 @@ char* JSValue::description()
 {
     static const size_t size = 32;
     static char description[size];
-    if (isInt32())
+
+    if (!*this)
+        snprintf(description, size, "<JSValue()>");
+    else if (isInt32())
         snprintf(description, size, "Int32: %d", asInt32());
     else if (isDouble())
         snprintf(description, size, "Double: %lf", asDouble());
diff --git a/JavaScriptCore/runtime/JSValue.h b/JavaScriptCore/runtime/JSValue.h
index 408c187..3c511d8 100644
--- a/JavaScriptCore/runtime/JSValue.h
+++ b/JavaScriptCore/runtime/JSValue.h
@@ -20,15 +20,14 @@
  *
  */
 
-#include <stddef.h> // for size_t
-#include <stdint.h>
-
 #ifndef JSValue_h
 #define JSValue_h
 
 #include "CallData.h"
 #include "ConstructData.h"
 #include <math.h>
+#include <stddef.h> // for size_t
+#include <stdint.h>
 #include <wtf/AlwaysInline.h>
 #include <wtf/Assertions.h>
 #include <wtf/HashTraits.h>
@@ -42,7 +41,6 @@ namespace JSC {
     class JSImmediate;
     class JSObject;
     class JSString;
-    class MarkStack;
     class PropertySlot;
     class PutPropertySlot;
     class UString;
@@ -130,7 +128,7 @@ namespace JSC {
         bool isString() const;
         bool isGetterSetter() const;
         bool isObject() const;
-        bool isObject(const ClassInfo*) const;
+        bool inherits(const ClassInfo*) const;
         
         // Extracting the value.
         bool getBoolean(bool&) const;
@@ -172,12 +170,6 @@ namespace JSC {
         // signle precision float is not a representation used in JS or JSC).
         float toFloat(ExecState* exec) const { return static_cast<float>(toNumber(exec)); }
 
-        // Garbage collection.
-        void markChildren(MarkStack&);
-        bool hasChildren() const;
-        bool marked() const;
-        void markDirect();
-
         // Object operations, with the toObject operation included.
         JSValue get(ExecState*, const Identifier& propertyName) const;
         JSValue get(ExecState*, const Identifier& propertyName, PropertySlot&) const;
@@ -221,7 +213,8 @@ namespace JSC {
         enum { FalseTag =        0xfffffffc };
         enum { NullTag =         0xfffffffb };
         enum { UndefinedTag =    0xfffffffa };
-        enum { DeletedValueTag = 0xfffffff9 };
+        enum { EmptyValueTag =   0xfffffff9 };
+        enum { DeletedValueTag = 0xfffffff8 };
 
         enum { LowestTag =  DeletedValueTag };
 
@@ -435,7 +428,7 @@ namespace JSC {
 
     inline JSValue::JSValue()
     {
-        u.asBits.tag = CellTag;
+        u.asBits.tag = EmptyValueTag;
         u.asBits.payload = 0;
     }
 
@@ -471,19 +464,26 @@ namespace JSC {
 
     inline JSValue::JSValue(JSCell* ptr)
     {
-        u.asBits.tag = CellTag;
+        if (ptr)
+            u.asBits.tag = CellTag;
+        else
+            u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(ptr);
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
     {
-        u.asBits.tag = CellTag;
+        if (ptr)
+            u.asBits.tag = CellTag;
+        else
+            u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
     }
 
     inline JSValue::operator bool() const
     {
-        return u.asBits.payload || tag() != CellTag;
+        ASSERT(tag() != DeletedValueTag);
+        return tag() != EmptyValueTag;
     }
 
     inline bool JSValue::operator==(const JSValue& other) const
diff --git a/JavaScriptCore/runtime/JSVariableObject.cpp b/JavaScriptCore/runtime/JSVariableObject.cpp
index a36cefa..6586393 100644
--- a/JavaScriptCore/runtime/JSVariableObject.cpp
+++ b/JavaScriptCore/runtime/JSVariableObject.cpp
@@ -30,6 +30,7 @@
 #include "JSVariableObject.h"
 
 #include "PropertyNameArray.h"
+#include "PropertyDescriptor.h"
 
 namespace JSC {
 
@@ -41,7 +42,7 @@ bool JSVariableObject::deleteProperty(ExecState* exec, const Identifier& propert
     return JSObject::deleteProperty(exec, propertyName);
 }
 
-void JSVariableObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSVariableObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     SymbolTable::const_iterator end = symbolTable().end();
     for (SymbolTable::const_iterator it = symbolTable().begin(); it != end; ++it) {
@@ -49,7 +50,7 @@ void JSVariableObject::getPropertyNames(ExecState* exec, PropertyNameArray& prop
             propertyNames.add(Identifier(exec, it->first.get()));
     }
     
-    JSObject::getPropertyNames(exec, propertyNames);
+    JSObject::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSVariableObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
@@ -67,4 +68,14 @@ bool JSVariableObject::isVariableObject() const
     return true;
 }
 
+bool JSVariableObject::symbolTableGet(const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    SymbolTableEntry entry = symbolTable().inlineGet(propertyName.ustring().rep());
+    if (!entry.isNull()) {
+        descriptor.setDescriptor(registerAt(entry.getIndex()).jsValue(), entry.getAttributes() | DontDelete);
+        return true;
+    }
+    return false;
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSVariableObject.h b/JavaScriptCore/runtime/JSVariableObject.h
index b969da5..66e78c3 100644
--- a/JavaScriptCore/runtime/JSVariableObject.h
+++ b/JavaScriptCore/runtime/JSVariableObject.h
@@ -49,7 +49,7 @@ namespace JSC {
         virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes) = 0;
 
         virtual bool deleteProperty(ExecState*, const Identifier&);
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
         
         virtual bool isVariableObject() const;
         virtual bool isDynamicScope() const = 0;
@@ -58,6 +58,11 @@ namespace JSC {
 
         Register& registerAt(int index) const { return d->registers[index]; }
 
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
+        }
+        
     protected:
         // Subclasses of JSVariableObject can subclass this struct to add data
         // without increasing their own size (since there's a hard limit on the
@@ -79,7 +84,7 @@ namespace JSC {
             JSVariableObjectData& operator=(const JSVariableObjectData&);
         };
 
-        JSVariableObject(PassRefPtr<Structure> structure, JSVariableObjectData* data)
+        JSVariableObject(NonNullPassRefPtr<Structure> structure, JSVariableObjectData* data)
             : JSObject(structure)
             , d(data) // Subclass owns this pointer.
         {
@@ -89,6 +94,7 @@ namespace JSC {
         void setRegisters(Register* r, Register* registerArray);
 
         bool symbolTableGet(const Identifier&, PropertySlot&);
+        bool symbolTableGet(const Identifier&, PropertyDescriptor&);
         bool symbolTableGet(const Identifier&, PropertySlot&, bool& slotIsWriteable);
         bool symbolTablePut(const Identifier&, JSValue);
         bool symbolTablePutWithAttributes(const Identifier&, JSValue, unsigned attributes);
diff --git a/JavaScriptCore/runtime/JSWrapperObject.h b/JavaScriptCore/runtime/JSWrapperObject.h
index 0b2c680..723b75d 100644
--- a/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/JavaScriptCore/runtime/JSWrapperObject.h
@@ -25,33 +25,41 @@
 #include "JSObject.h"
 
 namespace JSC {
-    
+
     // This class is used as a base for classes such as String,
     // Number, Boolean and Date which are wrappers for primitive types.
     class JSWrapperObject : public JSObject {
     protected:
-        explicit JSWrapperObject(PassRefPtr<Structure>);
+        explicit JSWrapperObject(NonNullPassRefPtr<Structure>);
 
     public:
         JSValue internalValue() const { return m_internalValue; }
         void setInternalValue(JSValue);
-        
+
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        { 
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames | HasDefaultMark));
+        }
+
+    private:
         virtual void markChildren(MarkStack&);
         
-    private:
         JSValue m_internalValue;
     };
-    
-    inline JSWrapperObject::JSWrapperObject(PassRefPtr<Structure> structure)
+
+    inline JSWrapperObject::JSWrapperObject(NonNullPassRefPtr<Structure> structure)
         : JSObject(structure)
     {
+        addAnonymousSlots(1);
+        putAnonymousValue(0, jsNull());
     }
-    
+
     inline void JSWrapperObject::setInternalValue(JSValue value)
     {
         ASSERT(value);
         ASSERT(!value.isObject());
         m_internalValue = value;
+        putAnonymousValue(0, value);
     }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/LiteralParser.cpp b/JavaScriptCore/runtime/LiteralParser.cpp
index 17ec906..d242282 100644
--- a/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/JavaScriptCore/runtime/LiteralParser.cpp
@@ -295,7 +295,10 @@ JSValue LiteralParser::parse(ParserState initialState)
             }
             doParseArrayStartExpression:
             case DoParseArrayStartExpression: {
+                TokenType lastToken = m_lexer.currentToken().type;
                 if (m_lexer.next() == TokRBracket) {
+                    if (lastToken == TokComma)
+                        return JSValue();
                     m_lexer.next();
                     lastValue = objectStack.last();
                     objectStack.removeLast();
diff --git a/JavaScriptCore/runtime/LiteralParser.h b/JavaScriptCore/runtime/LiteralParser.h
index bceee7c..0f8072b 100644
--- a/JavaScriptCore/runtime/LiteralParser.h
+++ b/JavaScriptCore/runtime/LiteralParser.h
@@ -89,7 +89,7 @@ namespace JSC {
             
         private:
             TokenType lex(LiteralParserToken&);
-            template <ParserMode parserMode> TokenType lexString(LiteralParserToken&);
+            template <ParserMode mode> TokenType lexString(LiteralParserToken&);
             TokenType lexNumber(LiteralParserToken&);
             LiteralParserToken m_currentToken;
             UString m_string;
diff --git a/JavaScriptCore/runtime/Lookup.h b/JavaScriptCore/runtime/Lookup.h
index 167f2bc..4d70689 100644
--- a/JavaScriptCore/runtime/Lookup.h
+++ b/JavaScriptCore/runtime/Lookup.h
@@ -51,7 +51,7 @@ namespace JSC {
     typedef PropertySlot::GetValueFunc GetFunction;
     typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValue value);
 
-    class HashEntry {
+    class HashEntry : public FastAllocBase {
     public:
         void initialize(UString::Rep* key, unsigned char attributes, intptr_t v1, intptr_t v2)
         {
@@ -186,6 +186,24 @@ namespace JSC {
         return true;
     }
 
+    template <class ThisImp, class ParentImp>
+    inline bool getStaticPropertyDescriptor(ExecState* exec, const HashTable* table, ThisImp* thisObj, const Identifier& propertyName, PropertyDescriptor& descriptor)
+    {
+        const HashEntry* entry = table->entry(exec, propertyName);
+        
+        if (!entry) // not found, forward to parent
+            return thisObj->ParentImp::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+ 
+        PropertySlot slot;
+        if (entry->attributes() & Function)
+            setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
+        else
+            slot.setCustom(thisObj, entry->propertyGetter());
+
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+
     /**
      * Simplified version of getStaticPropertySlot in case there are only functions.
      * Using this instead of getStaticPropertySlot allows 'this' to avoid implementing
@@ -204,6 +222,27 @@ namespace JSC {
         setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
         return true;
     }
+    
+    /**
+     * Simplified version of getStaticPropertyDescriptor in case there are only functions.
+     * Using this instead of getStaticPropertyDescriptor allows 'this' to avoid implementing
+     * a dummy getValueProperty.
+     */
+    template <class ParentImp>
+    inline bool getStaticFunctionDescriptor(ExecState* exec, const HashTable* table, JSObject* thisObj, const Identifier& propertyName, PropertyDescriptor& descriptor)
+    {
+        if (static_cast<ParentImp*>(thisObj)->ParentImp::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+            return true;
+        
+        const HashEntry* entry = table->entry(exec, propertyName);
+        if (!entry)
+            return false;
+        
+        PropertySlot slot;
+        setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
 
     /**
      * Simplified version of getStaticPropertySlot in case there are no functions, only "values".
@@ -224,6 +263,25 @@ namespace JSC {
     }
 
     /**
+     * Simplified version of getStaticPropertyDescriptor in case there are no functions, only "values".
+     * Using this instead of getStaticPropertyDescriptor removes the need for a FuncImp class.
+     */
+    template <class ThisImp, class ParentImp>
+    inline bool getStaticValueDescriptor(ExecState* exec, const HashTable* table, ThisImp* thisObj, const Identifier& propertyName, PropertyDescriptor& descriptor)
+    {
+        const HashEntry* entry = table->entry(exec, propertyName);
+        
+        if (!entry) // not found, forward to parent
+            return thisObj->ParentImp::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+        
+        ASSERT(!(entry->attributes() & Function));
+        PropertySlot slot;
+        slot.setCustom(thisObj, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+
+    /**
      * This one is for "put".
      * It looks up a hash entry for the property to be set.  If an entry
      * is found it sets the value and returns true, else it returns false.
diff --git a/JavaScriptCore/runtime/MarkStack.cpp b/JavaScriptCore/runtime/MarkStack.cpp
index 80dbb17..a350c35 100644
--- a/JavaScriptCore/runtime/MarkStack.cpp
+++ b/JavaScriptCore/runtime/MarkStack.cpp
@@ -26,8 +26,7 @@
 #include "config.h"
 #include "MarkStack.h"
 
-namespace JSC
-{
+namespace JSC {
 
 size_t MarkStack::s_pageSize = 0;
 
diff --git a/JavaScriptCore/runtime/MarkStack.h b/JavaScriptCore/runtime/MarkStack.h
index 7a7b3af..ba00057 100644
--- a/JavaScriptCore/runtime/MarkStack.h
+++ b/JavaScriptCore/runtime/MarkStack.h
@@ -27,33 +27,27 @@
 #define MarkStack_h
 
 #include "JSValue.h"
-
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
+
+    class JSGlobalData;
     class Register;
     
     enum MarkSetProperties { MayContainNullValues, NoNullValues };
     
     class MarkStack : Noncopyable {
     public:
-        MarkStack()
-            : m_markSets()
-            , m_values()
-        {
-        }
-
-        ALWAYS_INLINE void append(JSValue value)
+        MarkStack(void* jsArrayVPtr)
+            : m_jsArrayVPtr(jsArrayVPtr)
+#ifndef NDEBUG
+            , m_isCheckingForDefaultMarkViolation(false)
+#endif
         {
-            ASSERT(value);
-            if (value.marked())
-                return;
-            value.markDirect();
-            if (value.hasChildren())
-                m_values.append(value.asCell());
         }
 
-        ALWAYS_INLINE void append(JSCell* cell);
+        ALWAYS_INLINE void append(JSValue);
+        ALWAYS_INLINE void append(JSCell*);
         
         ALWAYS_INLINE void appendValues(Register* values, size_t count, MarkSetProperties properties = NoNullValues)
         {
@@ -76,12 +70,15 @@ namespace JSC {
         }
 
     private:
+        void markChildren(JSCell*);
+
         struct MarkSet {
             MarkSet(JSValue* values, JSValue* end, MarkSetProperties properties)
                 : m_values(values)
                 , m_end(end)
                 , m_properties(properties)
             {
+                ASSERT(values);
             }
             JSValue* m_values;
             JSValue* m_end;
@@ -136,6 +133,12 @@ namespace JSC {
                 ASSERT(m_top);
                 return m_data[--m_top];
             }
+            
+            inline T& last()
+            {
+                ASSERT(m_top);
+                return m_data[m_top - 1];
+            }
 
             inline bool isEmpty()
             {
@@ -150,7 +153,14 @@ namespace JSC {
                 ASSERT(0 == (size % MarkStack::pageSize()));
                 if (size == m_allocated)
                     return;
+#if PLATFORM(WIN) || PLATFORM(SYMBIAN)
+                // We cannot release a part of a region with VirtualFree.  To get around this,
+                // we'll release the entire region and reallocate the size that we want.
+                releaseStack(m_data, m_allocated);
+                m_data = reinterpret_cast<T*>(allocateStack(size));
+#else
                 releaseStack(reinterpret_cast<char*>(m_data) + size, m_allocated - size);
+#endif
                 m_allocated = size;
                 m_capacity = m_allocated / sizeof(T);
             }
@@ -162,9 +172,15 @@ namespace JSC {
             T* m_data;
         };
 
+        void* m_jsArrayVPtr;
         MarkStackArray<MarkSet> m_markSets;
         MarkStackArray<JSCell*> m_values;
         static size_t s_pageSize;
+
+#ifndef NDEBUG
+    public:
+        bool m_isCheckingForDefaultMarkViolation;
+#endif
     };
 }
 
diff --git a/JavaScriptCore/runtime/MarkStackSymbian.cpp b/JavaScriptCore/runtime/MarkStackSymbian.cpp
new file mode 100644
index 0000000..a0ce8f6
--- /dev/null
+++ b/JavaScriptCore/runtime/MarkStackSymbian.cpp
@@ -0,0 +1,44 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "MarkStack.h"
+
+#include <e32hal.h>
+
+namespace JSC {
+
+void MarkStack::initializePagesize()
+{
+    TInt page_size;
+    UserHal::PageSizeInBytes(page_size);
+    MarkStack::s_pageSize = page_size;
+}
+
+void* MarkStack::allocateStack(size_t size)
+{
+    return fastMalloc(size);
+}
+
+void MarkStack::releaseStack(void* addr, size_t size)
+{
+    return fastFree(addr);
+}
+
+}
diff --git a/JavaScriptCore/runtime/MarkStackWin.cpp b/JavaScriptCore/runtime/MarkStackWin.cpp
index dbc3306..1fdd06a 100644
--- a/JavaScriptCore/runtime/MarkStackWin.cpp
+++ b/JavaScriptCore/runtime/MarkStackWin.cpp
@@ -43,9 +43,11 @@ void* MarkStack::allocateStack(size_t size)
 {
     return VirtualAlloc(0, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
 }
-void MarkStack::releaseStack(void* addr, size_t size)
+void MarkStack::releaseStack(void* addr, size_t)
 {
-    VirtualFree(addr, size, MEM_RELEASE);
+    // According to http://msdn.microsoft.com/en-us/library/aa366892(VS.85).aspx,
+    // dwSize must be 0 if dwFreeType is MEM_RELEASE.
+    VirtualFree(addr, 0, MEM_RELEASE);
 }
 
 }
diff --git a/JavaScriptCore/runtime/MathObject.cpp b/JavaScriptCore/runtime/MathObject.cpp
index 2572bc9..e8b7b97 100644
--- a/JavaScriptCore/runtime/MathObject.cpp
+++ b/JavaScriptCore/runtime/MathObject.cpp
@@ -85,7 +85,7 @@ const ClassInfo MathObject::info = { "Math", 0, 0, ExecState::mathTable };
 @end
 */
 
-MathObject::MathObject(ExecState* exec, PassRefPtr<Structure> structure)
+MathObject::MathObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     : JSObject(structure)
 {
     putDirectWithoutTransition(Identifier(exec, "E"), jsNumber(exec, exp(1.0)), DontDelete | DontEnum | ReadOnly);
@@ -103,14 +103,12 @@ MathObject::MathObject(ExecState* exec, PassRefPtr<Structure> structure)
 
 bool MathObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot &slot)
 {
-    const HashEntry* entry = ExecState::mathTable(exec)->entry(exec, propertyName);
-
-    if (!entry)
-        return JSObject::getOwnPropertySlot(exec, propertyName, slot);
+    return getStaticFunctionSlot<JSObject>(exec, ExecState::mathTable(exec), this, propertyName, slot);
+}
 
-    ASSERT(entry->attributes() & Function);
-    setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
-    return true;
+bool MathObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, ExecState::mathTable(exec), this, propertyName, descriptor);
 }
 
 // ------------------------------ Functions --------------------------------
diff --git a/JavaScriptCore/runtime/MathObject.h b/JavaScriptCore/runtime/MathObject.h
index 3557d1e..fee5ec5 100644
--- a/JavaScriptCore/runtime/MathObject.h
+++ b/JavaScriptCore/runtime/MathObject.h
@@ -27,16 +27,17 @@ namespace JSC {
 
     class MathObject : public JSObject {
     public:
-        MathObject(ExecState*, PassRefPtr<Structure>);
+        MathObject(ExecState*, NonNullPassRefPtr<Structure>);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
         }
     };
 
diff --git a/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index 0205fc5..c655fae 100644
--- a/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -32,7 +32,7 @@ ASSERT_CLASS_FITS_IN_CELL(NativeErrorConstructor);
 
 const ClassInfo NativeErrorConstructor::info = { "Function", &InternalFunction::info, 0, 0 };
 
-NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, PassRefPtr<Structure> structure, NativeErrorPrototype* nativeErrorPrototype)
+NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, NativeErrorPrototype* nativeErrorPrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString()))
     , m_errorStructure(ErrorInstance::createStructure(nativeErrorPrototype))
 {
diff --git a/JavaScriptCore/runtime/NativeErrorConstructor.h b/JavaScriptCore/runtime/NativeErrorConstructor.h
index 118d1f4..152dbac 100644
--- a/JavaScriptCore/runtime/NativeErrorConstructor.h
+++ b/JavaScriptCore/runtime/NativeErrorConstructor.h
@@ -31,7 +31,7 @@ namespace JSC {
 
     class NativeErrorConstructor : public InternalFunction {
     public:
-        NativeErrorConstructor(ExecState*, PassRefPtr<Structure>, NativeErrorPrototype*);
+        NativeErrorConstructor(ExecState*, NonNullPassRefPtr<Structure>, NativeErrorPrototype*);
 
         static const ClassInfo info;
 
diff --git a/JavaScriptCore/runtime/NativeErrorPrototype.cpp b/JavaScriptCore/runtime/NativeErrorPrototype.cpp
index 84190a0..aa46a6a 100644
--- a/JavaScriptCore/runtime/NativeErrorPrototype.cpp
+++ b/JavaScriptCore/runtime/NativeErrorPrototype.cpp
@@ -29,7 +29,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NativeErrorPrototype);
 
-NativeErrorPrototype::NativeErrorPrototype(ExecState* exec, PassRefPtr<Structure> structure, const UString& name, const UString& message)
+NativeErrorPrototype::NativeErrorPrototype(ExecState* exec, NonNullPassRefPtr<Structure> structure, const UString& name, const UString& message)
     : JSObject(structure)
 {
     putDirect(exec->propertyNames().name, jsString(exec, name), 0);
diff --git a/JavaScriptCore/runtime/NativeErrorPrototype.h b/JavaScriptCore/runtime/NativeErrorPrototype.h
index 77bfe8a..0c65a9c 100644
--- a/JavaScriptCore/runtime/NativeErrorPrototype.h
+++ b/JavaScriptCore/runtime/NativeErrorPrototype.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class NativeErrorPrototype : public JSObject {
     public:
-        NativeErrorPrototype(ExecState*, PassRefPtr<Structure>, const UString& name, const UString& message);
+        NativeErrorPrototype(ExecState*, NonNullPassRefPtr<Structure>, const UString& name, const UString& message);
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/NumberConstructor.cpp b/JavaScriptCore/runtime/NumberConstructor.cpp
index 2840bf0..cc6c51d 100644
--- a/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -53,7 +53,7 @@ const ClassInfo NumberConstructor::info = { "Function", &InternalFunction::info,
 @end
 */
 
-NumberConstructor::NumberConstructor(ExecState* exec, PassRefPtr<Structure> structure, NumberPrototype* numberPrototype)
+NumberConstructor::NumberConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, NumberPrototype* numberPrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, numberPrototype->info.className))
 {
     // Number.Prototype
@@ -68,6 +68,11 @@ bool NumberConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, slot);
 }
 
+bool NumberConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, descriptor);
+}
+
 static JSValue numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNaN(exec);
diff --git a/JavaScriptCore/runtime/NumberConstructor.h b/JavaScriptCore/runtime/NumberConstructor.h
index b1224ec..908c55f 100644
--- a/JavaScriptCore/runtime/NumberConstructor.h
+++ b/JavaScriptCore/runtime/NumberConstructor.h
@@ -29,16 +29,17 @@ namespace JSC {
 
     class NumberConstructor : public InternalFunction {
     public:
-        NumberConstructor(ExecState*, PassRefPtr<Structure>, NumberPrototype*);
+        NumberConstructor(ExecState*, NonNullPassRefPtr<Structure>, NumberPrototype*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         JSValue getValueProperty(ExecState*, int token) const;
 
         static const ClassInfo info;
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames)); 
         }
 
         enum { NaNValue, NegInfinity, PosInfinity, MaxValue, MinValue };
diff --git a/JavaScriptCore/runtime/NumberObject.cpp b/JavaScriptCore/runtime/NumberObject.cpp
index 0e8df17..1a7e44c 100644
--- a/JavaScriptCore/runtime/NumberObject.cpp
+++ b/JavaScriptCore/runtime/NumberObject.cpp
@@ -31,7 +31,7 @@ ASSERT_CLASS_FITS_IN_CELL(NumberObject);
 
 const ClassInfo NumberObject::info = { "Number", 0, 0, 0 };
 
-NumberObject::NumberObject(PassRefPtr<Structure> structure)
+NumberObject::NumberObject(NonNullPassRefPtr<Structure> structure)
     : JSWrapperObject(structure)
 {
 }
diff --git a/JavaScriptCore/runtime/NumberObject.h b/JavaScriptCore/runtime/NumberObject.h
index d354b9b..ca3923d 100644
--- a/JavaScriptCore/runtime/NumberObject.h
+++ b/JavaScriptCore/runtime/NumberObject.h
@@ -27,10 +27,20 @@ namespace JSC {
 
     class NumberObject : public JSWrapperObject {
     public:
-        explicit NumberObject(PassRefPtr<Structure>);
+        explicit NumberObject(NonNullPassRefPtr<Structure>);
 
         static const ClassInfo info;
-
+#if USE(JSVALUE32)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames));
+        }
+#else
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+        }
+#endif
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
 
diff --git a/JavaScriptCore/runtime/NumberPrototype.cpp b/JavaScriptCore/runtime/NumberPrototype.cpp
index 947324c..df31404 100644
--- a/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -45,7 +45,7 @@ static JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState*, JSObject*, J
 
 // ECMA 15.7.4
 
-NumberPrototype::NumberPrototype(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
+NumberPrototype::NumberPrototype(ExecState* exec, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
     : NumberObject(structure)
 {
     setInternalValue(jsNumber(exec, 0));
diff --git a/JavaScriptCore/runtime/NumberPrototype.h b/JavaScriptCore/runtime/NumberPrototype.h
index 0a3a544..1fb2077 100644
--- a/JavaScriptCore/runtime/NumberPrototype.h
+++ b/JavaScriptCore/runtime/NumberPrototype.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class NumberPrototype : public NumberObject {
     public:
-        NumberPrototype(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+        NumberPrototype(ExecState*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure);
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/NumericStrings.h b/JavaScriptCore/runtime/NumericStrings.h
new file mode 100644
index 0000000..c0696a4
--- /dev/null
+++ b/JavaScriptCore/runtime/NumericStrings.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NumericStrings_h
+#define NumericStrings_h
+
+#include "UString.h"
+#include <wtf/HashFunctions.h>
+
+namespace JSC {
+
+    class NumericStrings {
+    public:
+        UString add(double d)
+        {
+            CacheEntry<double>& entry = lookup(d);
+            if (d == entry.key && !entry.value.isNull())
+                return entry.value;
+            entry.key = d;
+            entry.value = UString::from(d);
+            return entry.value;
+        }
+
+        UString add(int i)
+        {
+            CacheEntry<int>& entry = lookup(i);
+            if (i == entry.key && !entry.value.isNull())
+                return entry.value;
+            entry.key = i;
+            entry.value = UString::from(i);
+            return entry.value;
+        }
+
+    private:
+        static const size_t cacheSize = 64;
+
+        template<typename T>
+        struct CacheEntry {
+            T key;
+            UString value;
+        };
+
+        CacheEntry<double>& lookup(double d) { return doubleCache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
+        CacheEntry<int>& lookup(int i) { return intCache[WTF::IntHash<int>::hash(i) & (cacheSize - 1)]; }
+
+        CacheEntry<double> doubleCache[cacheSize];
+        CacheEntry<int> intCache[cacheSize];
+    };
+
+} // namespace JSC
+
+#endif // NumericStrings_h
diff --git a/JavaScriptCore/runtime/ObjectConstructor.cpp b/JavaScriptCore/runtime/ObjectConstructor.cpp
index 70c7cd1..a456423 100644
--- a/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -21,9 +21,13 @@
 #include "config.h"
 #include "ObjectConstructor.h"
 
+#include "Error.h"
 #include "JSFunction.h"
+#include "JSArray.h"
 #include "JSGlobalObject.h"
 #include "ObjectPrototype.h"
+#include "PropertyDescriptor.h"
+#include "PropertyNameArray.h"
 #include "PrototypeFunction.h"
 
 namespace JSC {
@@ -31,17 +35,27 @@ namespace JSC {
 ASSERT_CLASS_FITS_IN_CELL(ObjectConstructor);
 
 static JSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorKeys(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorCreate(ExecState*, JSObject*, JSValue, const ArgList&);
 
-ObjectConstructor::ObjectConstructor(ExecState* exec, PassRefPtr<Structure> structure, ObjectPrototype* objectPrototype, Structure* prototypeFunctionStructure)
-    : InternalFunction(&exec->globalData(), structure, Identifier(exec, "Object"))
+ObjectConstructor::ObjectConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, ObjectPrototype* objectPrototype, Structure* prototypeFunctionStructure)
+: InternalFunction(&exec->globalData(), structure, Identifier(exec, "Object"))
 {
     // ECMA 15.2.3.1
     putDirectWithoutTransition(exec->propertyNames().prototype, objectPrototype, DontEnum | DontDelete | ReadOnly);
-
+    
     // no. of arguments for constructor
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
-
+    
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().getPrototypeOf, objectConstructorGetPrototypeOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().getOwnPropertyDescriptor, objectConstructorGetOwnPropertyDescriptor), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().keys, objectConstructorKeys), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 3, exec->propertyNames().defineProperty, objectConstructorDefineProperty), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().defineProperties, objectConstructorDefineProperties), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().create, objectConstructorCreate), DontEnum);
 }
 
 // ECMA 15.2.2
@@ -82,4 +96,205 @@ JSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState* exec, JSObject*
     return asObject(args.at(0))->prototype();
 }
 
+JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Requested property descriptor of a value that is not an object.");
+    UString propertyName = args.at(1).toString(exec);
+    if (exec->hadException())
+        return jsNull();
+    JSObject* object = asObject(args.at(0));
+    PropertyDescriptor descriptor;
+    if (!object->getOwnPropertyDescriptor(exec, Identifier(exec, propertyName), descriptor))
+        return jsUndefined();
+    if (exec->hadException())
+        return jsUndefined();
+
+    JSObject* description = constructEmptyObject(exec);
+    if (!descriptor.isAccessorDescriptor()) {
+        description->putDirect(exec->propertyNames().value, descriptor.value() ? descriptor.value() : jsUndefined(), 0);
+        description->putDirect(exec->propertyNames().writable, jsBoolean(descriptor.writable()), 0);
+    } else {
+        description->putDirect(exec->propertyNames().get, descriptor.getter() ? descriptor.getter() : jsUndefined(), 0);
+        description->putDirect(exec->propertyNames().set, descriptor.setter() ? descriptor.setter() : jsUndefined(), 0);
+    }
+    
+    description->putDirect(exec->propertyNames().enumerable, jsBoolean(descriptor.enumerable()), 0);
+    description->putDirect(exec->propertyNames().configurable, jsBoolean(descriptor.configurable()), 0);
+
+    return description;
+}
+
+JSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Requested keys of a value that is not an object.");
+    PropertyNameArray properties(exec);
+    asObject(args.at(0))->getOwnPropertyNames(exec, properties);
+    JSArray* keys = constructEmptyArray(exec);
+    size_t numProperties = properties.size();
+    for (size_t i = 0; i < numProperties; i++)
+        keys->push(exec, jsOwnedString(exec, properties[i].ustring()));
+    return keys;
+}
+
+// ES5 8.10.5 ToPropertyDescriptor
+static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor& desc)
+{
+    if (!in.isObject()) {
+        throwError(exec, TypeError, "Property description must be an object.");
+        return false;
+    }
+    JSObject* description = asObject(in);
+
+    PropertySlot enumerableSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().enumerable, enumerableSlot)) {
+        desc.setEnumerable(enumerableSlot.getValue(exec, exec->propertyNames().enumerable).toBoolean(exec));
+        if (exec->hadException())
+            return false;
+    }
+
+    PropertySlot configurableSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().configurable, configurableSlot)) {
+        desc.setConfigurable(configurableSlot.getValue(exec, exec->propertyNames().configurable).toBoolean(exec));
+        if (exec->hadException())
+            return false;
+    }
+
+    JSValue value;
+    PropertySlot valueSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().value, valueSlot)) {
+        desc.setValue(valueSlot.getValue(exec, exec->propertyNames().value));
+        if (exec->hadException())
+            return false;
+    }
+
+    PropertySlot writableSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().writable, writableSlot)) {
+        desc.setWritable(writableSlot.getValue(exec, exec->propertyNames().writable).toBoolean(exec));
+        if (exec->hadException())
+            return false;
+    }
+
+    PropertySlot getSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().get, getSlot)) {
+        JSValue get = getSlot.getValue(exec, exec->propertyNames().get);
+        if (exec->hadException())
+            return false;
+        if (!get.isUndefined()) {
+            CallData callData;
+            if (get.getCallData(callData) == CallTypeNone) {
+                throwError(exec, TypeError, "Getter must be a function.");
+                return false;
+            }
+        } else
+            get = JSValue();
+        desc.setGetter(get);
+    }
+
+    PropertySlot setSlot;
+    if (description->getPropertySlot(exec, exec->propertyNames().set, setSlot)) {
+        JSValue set = setSlot.getValue(exec, exec->propertyNames().set);
+        if (exec->hadException())
+            return false;
+        if (!set.isUndefined()) {
+            CallData callData;
+            if (set.getCallData(callData) == CallTypeNone) {
+                throwError(exec, TypeError, "Setter must be a function.");
+                return false;
+            }
+        } else
+            set = JSValue();
+
+        desc.setSetter(set);
+    }
+
+    if (!desc.isAccessorDescriptor())
+        return true;
+
+    if (desc.value()) {
+        throwError(exec, TypeError, "Invalid property.  'value' present on property with getter or setter.");
+        return false;
+    }
+
+    if (desc.writablePresent()) {
+        throwError(exec, TypeError, "Invalid property.  'writable' present on property with getter or setter.");
+        return false;
+    }
+    return true;
+}
+
+JSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Properties can only be defined on Objects.");
+    JSObject* O = asObject(args.at(0));
+    UString propertyName = args.at(1).toString(exec);
+    if (exec->hadException())
+        return jsNull();
+    PropertyDescriptor descriptor;
+    if (!toPropertyDescriptor(exec, args.at(2), descriptor))
+        return jsNull();
+    ASSERT((descriptor.attributes() & (Getter | Setter)) || (!descriptor.isAccessorDescriptor()));
+    ASSERT(!exec->hadException());
+    O->defineOwnProperty(exec, Identifier(exec, propertyName), descriptor, true);
+    return O;
+}
+
+static JSValue defineProperties(ExecState* exec, JSObject* object, JSObject* properties)
+{
+    PropertyNameArray propertyNames(exec);
+    asObject(properties)->getOwnPropertyNames(exec, propertyNames);
+    size_t numProperties = propertyNames.size();
+    Vector<PropertyDescriptor> descriptors;
+    MarkedArgumentBuffer markBuffer;
+    for (size_t i = 0; i < numProperties; i++) {
+        PropertySlot slot;
+        JSValue prop = properties->get(exec, propertyNames[i]);
+        if (exec->hadException())
+            return jsNull();
+        PropertyDescriptor descriptor;
+        if (!toPropertyDescriptor(exec, prop, descriptor))
+            return jsNull();
+        descriptors.append(descriptor);
+        // Ensure we mark all the values that we're accumulating
+        if (descriptor.isDataDescriptor() && descriptor.value())
+            markBuffer.append(descriptor.value());
+        if (descriptor.isAccessorDescriptor()) {
+            if (descriptor.getter())
+                markBuffer.append(descriptor.getter());
+            if (descriptor.setter())
+                markBuffer.append(descriptor.setter());
+        }
+    }
+    for (size_t i = 0; i < numProperties; i++) {
+        object->defineOwnProperty(exec, propertyNames[i], descriptors[i], true);
+        if (exec->hadException())
+            return jsNull();
+    }
+    return object;
+}
+
+JSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Properties can only be defined on Objects.");
+    if (!args.at(1).isObject())
+        return throwError(exec, TypeError, "Property descriptor list must be an Object.");
+    return defineProperties(exec, asObject(args.at(0)), asObject(args.at(1)));
+}
+
+JSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject() && !args.at(0).isNull())
+        return throwError(exec, TypeError, "Object prototype may only be an Object or null.");
+    JSObject* newObject = constructEmptyObject(exec);
+    newObject->setPrototype(args.at(0));
+    if (args.at(1).isUndefined())
+        return newObject;
+    if (!args.at(1).isObject())
+        return throwError(exec, TypeError, "Property descriptor list must be an Object.");
+    return defineProperties(exec, newObject, asObject(args.at(1)));
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/ObjectConstructor.h b/JavaScriptCore/runtime/ObjectConstructor.h
index 9373781..1d2cdde 100644
--- a/JavaScriptCore/runtime/ObjectConstructor.h
+++ b/JavaScriptCore/runtime/ObjectConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class ObjectConstructor : public InternalFunction {
     public:
-        ObjectConstructor(ExecState*, PassRefPtr<Structure>, ObjectPrototype*, Structure* prototypeFunctionStructure);
+        ObjectConstructor(ExecState*, NonNullPassRefPtr<Structure>, ObjectPrototype*, Structure* prototypeFunctionStructure);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/JavaScriptCore/runtime/ObjectPrototype.cpp b/JavaScriptCore/runtime/ObjectPrototype.cpp
index 98e4713..0970b7c 100644
--- a/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -40,8 +40,9 @@ static JSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState*, JSObject*,
 static JSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
 
-ObjectPrototype::ObjectPrototype(ExecState* exec, PassRefPtr<Structure> stucture, Structure* prototypeFunctionStructure)
+ObjectPrototype::ObjectPrototype(ExecState* exec, NonNullPassRefPtr<Structure> stucture, Structure* prototypeFunctionStructure)
     : JSObject(stucture)
+    , m_hasNoPropertiesWithUInt32Names(true)
 {
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, objectProtoFuncToLocaleString), DontEnum);
@@ -57,6 +58,24 @@ ObjectPrototype::ObjectPrototype(ExecState* exec, PassRefPtr<Structure> stucture
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupSetter__, objectProtoFuncLookupSetter), DontEnum);
 }
 
+void ObjectPrototype::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    JSObject::put(exec, propertyName, value, slot);
+
+    if (m_hasNoPropertiesWithUInt32Names) {
+        bool isUInt32;
+        propertyName.toStrictUInt32(&isUInt32);
+        m_hasNoPropertiesWithUInt32Names = !isUInt32;
+    }
+}
+
+bool ObjectPrototype::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (m_hasNoPropertiesWithUInt32Names)
+        return false;
+    return JSObject::getOwnPropertySlot(exec, propertyName, slot);
+}
+
 // ------------------------------ Functions --------------------------------
 
 // ECMA 15.2.4.2, 15.2.4.4, 15.2.4.5, 15.2.4.7
diff --git a/JavaScriptCore/runtime/ObjectPrototype.h b/JavaScriptCore/runtime/ObjectPrototype.h
index 7790ae0..489d962 100644
--- a/JavaScriptCore/runtime/ObjectPrototype.h
+++ b/JavaScriptCore/runtime/ObjectPrototype.h
@@ -27,7 +27,13 @@ namespace JSC {
 
     class ObjectPrototype : public JSObject {
     public:
-        ObjectPrototype(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+        ObjectPrototype(ExecState*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+
+    private:
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+        virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+
+        bool m_hasNoPropertiesWithUInt32Names;
     };
 
     JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
diff --git a/JavaScriptCore/runtime/Operations.h b/JavaScriptCore/runtime/Operations.h
index c4900d3..5da9e38 100644
--- a/JavaScriptCore/runtime/Operations.h
+++ b/JavaScriptCore/runtime/Operations.h
@@ -308,20 +308,13 @@ namespace JSC {
             resultRep = UString::Rep::createEmptyBuffer(bufferSize);
         UString result(resultRep);
 
-        // Loop over the openards, writing them into the output buffer.
+        // Loop over the operands, writing them into the output buffer.
         for (unsigned i = 0; i < count; ++i) {
             JSValue v = strings[i].jsValue();
             if (LIKELY(v.isString()))
                 result.append(asString(v)->value());
-            else if (v.isInt32())
-                result.appendNumeric(v.asInt32());
-            else {
-                double d;
-                if (v.getNumber(d))
-                    result.appendNumeric(d);
-                else
-                    result.append(v.toString(callFrame));
-            }
+            else
+                result.append(v.toString(callFrame));
         }
 
         return jsString(callFrame, result);
diff --git a/JavaScriptCore/runtime/PropertyDescriptor.cpp b/JavaScriptCore/runtime/PropertyDescriptor.cpp
new file mode 100644
index 0000000..4db814f
--- /dev/null
+++ b/JavaScriptCore/runtime/PropertyDescriptor.cpp
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#include "config.h"
+
+#include "PropertyDescriptor.h"
+
+#include "GetterSetter.h"
+#include "JSObject.h"
+#include "Operations.h"
+
+namespace JSC {
+unsigned PropertyDescriptor::defaultAttributes = (DontDelete << 1) - 1;
+
+bool PropertyDescriptor::writable() const
+{
+    ASSERT(!isAccessorDescriptor());
+    return !(m_attributes & ReadOnly);
+}
+
+bool PropertyDescriptor::enumerable() const
+{
+    return !(m_attributes & DontEnum);
+}
+
+bool PropertyDescriptor::configurable() const
+{
+    return !(m_attributes & DontDelete);
+}
+
+bool PropertyDescriptor::isDataDescriptor() const
+{
+    return m_value || (m_seenAttributes & WritablePresent);
+}
+
+bool PropertyDescriptor::isGenericDescriptor() const
+{
+    return !isAccessorDescriptor() && !isDataDescriptor();
+}
+
+bool PropertyDescriptor::isAccessorDescriptor() const
+{
+    return m_getter || m_setter;
+}
+
+void PropertyDescriptor::setUndefined()
+{
+    m_value = jsUndefined();
+    m_attributes = ReadOnly | DontDelete | DontEnum;
+}
+
+JSValue PropertyDescriptor::getter() const
+{
+    ASSERT(isAccessorDescriptor());
+    return m_getter;
+}
+
+JSValue PropertyDescriptor::setter() const
+{
+    ASSERT(isAccessorDescriptor());
+    return m_setter;
+}
+
+void PropertyDescriptor::setDescriptor(JSValue value, unsigned attributes)
+{
+    ASSERT(value);
+    m_attributes = attributes;
+    if (attributes & (Getter | Setter)) {
+        GetterSetter* accessor = asGetterSetter(value);
+        m_getter = accessor->getter();
+        m_setter = accessor->setter();
+        ASSERT(m_getter || m_setter);
+        m_seenAttributes = EnumerablePresent | ConfigurablePresent;
+        m_attributes &= ~ReadOnly;
+    } else {
+        m_value = value;
+        m_seenAttributes = EnumerablePresent | ConfigurablePresent | WritablePresent;
+    }
+}
+
+void PropertyDescriptor::setAccessorDescriptor(JSValue getter, JSValue setter, unsigned attributes)
+{
+    ASSERT(attributes & (Getter | Setter));
+    ASSERT(getter || setter);
+    m_attributes = attributes;
+    m_getter = getter;
+    m_setter = setter;
+    m_attributes &= ~ReadOnly;
+    m_seenAttributes = EnumerablePresent | ConfigurablePresent;
+}
+
+void PropertyDescriptor::setWritable(bool writable)
+{
+    if (writable)
+        m_attributes &= ~ReadOnly;
+    else
+        m_attributes |= ReadOnly;
+    m_seenAttributes |= WritablePresent;
+}
+
+void PropertyDescriptor::setEnumerable(bool enumerable)
+{
+    if (enumerable)
+        m_attributes &= ~DontEnum;
+    else
+        m_attributes |= DontEnum;
+    m_seenAttributes |= EnumerablePresent;
+}
+
+void PropertyDescriptor::setConfigurable(bool configurable)
+{
+    if (configurable)
+        m_attributes &= ~DontDelete;
+    else
+        m_attributes |= DontDelete;
+    m_seenAttributes |= ConfigurablePresent;
+}
+
+void PropertyDescriptor::setSetter(JSValue setter)
+{
+    m_setter = setter;
+    m_attributes |= Setter;
+    m_attributes &= ~ReadOnly;
+}
+
+void PropertyDescriptor::setGetter(JSValue getter)
+{
+    m_getter = getter;
+    m_attributes |= Getter;
+    m_attributes &= ~ReadOnly;
+}
+
+bool PropertyDescriptor::equalTo(const PropertyDescriptor& other) const
+{
+    if (!other.m_value == m_value ||
+        !other.m_getter == m_getter ||
+        !other.m_setter == m_setter)
+        return false;
+    return (!m_value || JSValue::strictEqual(other.m_value, m_value)) && 
+           (!m_getter || JSValue::strictEqual(other.m_getter, m_getter)) && 
+           (!m_setter || JSValue::strictEqual(other.m_setter, m_setter)) &&
+           attributesEqual(other);
+}
+
+bool PropertyDescriptor::attributesEqual(const PropertyDescriptor& other) const
+{
+    unsigned mismatch = other.m_attributes ^ m_attributes;
+    unsigned sharedSeen = other.m_seenAttributes & m_seenAttributes;
+    if (sharedSeen & WritablePresent && mismatch & ReadOnly)
+        return false;
+    if (sharedSeen & ConfigurablePresent && mismatch & DontDelete)
+        return false;
+    if (sharedSeen & EnumerablePresent && mismatch & DontEnum)
+        return false;
+    return true;
+}
+
+unsigned PropertyDescriptor::attributesWithOverride(const PropertyDescriptor& other) const
+{
+    unsigned mismatch = other.m_attributes ^ m_attributes;
+    unsigned sharedSeen = other.m_seenAttributes & m_seenAttributes;
+    unsigned newAttributes = m_attributes & defaultAttributes;
+    if (sharedSeen & WritablePresent && mismatch & ReadOnly)
+        newAttributes ^= ReadOnly;
+    if (sharedSeen & ConfigurablePresent && mismatch & DontDelete)
+        newAttributes ^= DontDelete;
+    if (sharedSeen & EnumerablePresent && mismatch & DontEnum)
+        newAttributes ^= DontEnum;
+    return newAttributes;
+}
+
+}
diff --git a/JavaScriptCore/runtime/PropertyDescriptor.h b/JavaScriptCore/runtime/PropertyDescriptor.h
new file mode 100644
index 0000000..40bec86
--- /dev/null
+++ b/JavaScriptCore/runtime/PropertyDescriptor.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PropertyDescriptor_h
+#define PropertyDescriptor_h
+
+#include "JSValue.h"
+
+namespace JSC {
+    class PropertyDescriptor {
+    public:
+        PropertyDescriptor()
+            : m_attributes(defaultAttributes)
+            , m_seenAttributes(0)
+        {
+        }
+        bool writable() const;
+        bool enumerable() const;
+        bool configurable() const;
+        bool isDataDescriptor() const;
+        bool isGenericDescriptor() const;
+        bool isAccessorDescriptor() const;
+        unsigned attributes() const { return m_attributes; }
+        JSValue value() const { return m_value; }
+        JSValue getter() const;
+        JSValue setter() const;
+        void setUndefined();
+        void setDescriptor(JSValue value, unsigned attributes);
+        void setAccessorDescriptor(JSValue getter, JSValue setter, unsigned attributes);
+        void setWritable(bool);
+        void setEnumerable(bool);
+        void setConfigurable(bool);
+        void setValue(JSValue value) { m_value = value; }
+        void setSetter(JSValue);
+        void setGetter(JSValue);
+        bool isEmpty() const { return !(m_value || m_getter || m_setter || m_seenAttributes); }
+        bool writablePresent() const { return m_seenAttributes & WritablePresent; }
+        bool enumerablePresent() const { return m_seenAttributes & EnumerablePresent; }
+        bool configurablePresent() const { return m_seenAttributes & ConfigurablePresent; }
+        bool setterPresent() const { return m_setter; }
+        bool getterPresent() const { return m_getter; }
+        bool equalTo(const PropertyDescriptor& other) const;
+        bool attributesEqual(const PropertyDescriptor& other) const;
+        unsigned attributesWithOverride(const PropertyDescriptor& other) const;
+    private:
+        static unsigned defaultAttributes;
+        bool operator==(const PropertyDescriptor&){ return false; }
+        enum { WritablePresent = 1, EnumerablePresent = 2, ConfigurablePresent = 4};
+        // May be a getter/setter
+        JSValue m_value;
+        JSValue m_getter;
+        JSValue m_setter;
+        unsigned m_attributes;
+        unsigned m_seenAttributes;
+    };
+}
+
+#endif
diff --git a/JavaScriptCore/runtime/PropertyMapHashTable.h b/JavaScriptCore/runtime/PropertyMapHashTable.h
index 44dc2b8..5b63f79 100644
--- a/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -61,6 +61,7 @@ namespace JSC {
         unsigned size;
         unsigned keyCount;
         unsigned deletedSentinelCount;
+        unsigned anonymousSlotCount;
         unsigned lastIndexUsed;
         Vector<unsigned>* deletedOffsets;
         unsigned entryIndices[1];
diff --git a/JavaScriptCore/runtime/PropertyNameArray.h b/JavaScriptCore/runtime/PropertyNameArray.h
index b4382f4..afcc83f 100644
--- a/JavaScriptCore/runtime/PropertyNameArray.h
+++ b/JavaScriptCore/runtime/PropertyNameArray.h
@@ -44,7 +44,7 @@ namespace JSC {
         void setCachedStructure(Structure* structure) { m_cachedStructure = structure; }
         Structure* cachedStructure() const { return m_cachedStructure; }
 
-        void setCachedPrototypeChain(PassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
+        void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
         StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
 
     private:
diff --git a/JavaScriptCore/runtime/PropertySlot.cpp b/JavaScriptCore/runtime/PropertySlot.cpp
index 36fa5d8..a0a2f48 100644
--- a/JavaScriptCore/runtime/PropertySlot.cpp
+++ b/JavaScriptCore/runtime/PropertySlot.cpp
@@ -23,7 +23,6 @@
 
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
-#include "JSObject.h"
 
 namespace JSC {
 
@@ -39,7 +38,7 @@ JSValue PropertySlot::functionGetter(ExecState* exec, const Identifier&, const P
         return callData.native.function(exec, slot.m_data.getterFunc, slot.slotBase(), exec->emptyList());
     ASSERT(callType == CallTypeJS);
     // FIXME: Can this be done more efficiently using the callData?
-    return static_cast<JSFunction*>(slot.m_data.getterFunc)->call(exec, slot.slotBase(), exec->emptyList());
+    return asFunction(slot.m_data.getterFunc)->call(exec, slot.slotBase(), exec->emptyList());
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/PrototypeFunction.cpp b/JavaScriptCore/runtime/PrototypeFunction.cpp
index 8e3d107..38f8adb 100644
--- a/JavaScriptCore/runtime/PrototypeFunction.cpp
+++ b/JavaScriptCore/runtime/PrototypeFunction.cpp
@@ -40,7 +40,7 @@ PrototypeFunction::PrototypeFunction(ExecState* exec, int length, const Identifi
     putDirect(exec->propertyNames().length, jsNumber(exec, length), DontDelete | ReadOnly | DontEnum);
 }
 
-PrototypeFunction::PrototypeFunction(ExecState* exec, PassRefPtr<Structure> prototypeFunctionStructure, int length, const Identifier& name, NativeFunction function)
+PrototypeFunction::PrototypeFunction(ExecState* exec, NonNullPassRefPtr<Structure> prototypeFunctionStructure, int length, const Identifier& name, NativeFunction function)
     : InternalFunction(&exec->globalData(), prototypeFunctionStructure, name)
     , m_function(function)
 {
diff --git a/JavaScriptCore/runtime/PrototypeFunction.h b/JavaScriptCore/runtime/PrototypeFunction.h
index 99ab327..70ee034 100644
--- a/JavaScriptCore/runtime/PrototypeFunction.h
+++ b/JavaScriptCore/runtime/PrototypeFunction.h
@@ -32,7 +32,7 @@ namespace JSC {
     class PrototypeFunction : public InternalFunction {
     public:
         PrototypeFunction(ExecState*, int length, const Identifier&, NativeFunction);
-        PrototypeFunction(ExecState*, PassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
+        PrototypeFunction(ExecState*, NonNullPassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
 
     private:
         virtual CallType getCallData(CallData&);
diff --git a/JavaScriptCore/runtime/RegExpConstructor.cpp b/JavaScriptCore/runtime/RegExpConstructor.cpp
index 6a8089d..dbf2d44 100644
--- a/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -23,6 +23,7 @@
 #include "RegExpConstructor.h"
 
 #include "ArrayPrototype.h"
+#include "Error.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSString.h"
@@ -111,7 +112,7 @@ struct RegExpConstructorPrivate : FastAllocBase {
     unsigned lastOvectorIndex : 1;
 };
 
-RegExpConstructor::RegExpConstructor(ExecState* exec, PassRefPtr<Structure> structure, RegExpPrototype* regExpPrototype)
+RegExpConstructor::RegExpConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, RegExpPrototype* regExpPrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, "RegExp"))
     , d(new RegExpConstructorPrivate)
 {
@@ -233,6 +234,11 @@ bool RegExpConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<RegExpConstructor, InternalFunction>(exec, ExecState::regExpConstructorTable(exec), this, propertyName, slot);
 }
 
+bool RegExpConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<RegExpConstructor, InternalFunction>(exec, ExecState::regExpConstructorTable(exec), this, propertyName, descriptor);
+}
+
 JSValue regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 1);
@@ -329,7 +335,7 @@ JSObject* constructRegExp(ExecState* exec, const ArgList& args)
     JSValue arg0 = args.at(0);
     JSValue arg1 = args.at(1);
 
-    if (arg0.isObject(&RegExpObject::info)) {
+    if (arg0.inherits(&RegExpObject::info)) {
         if (!arg1.isUndefined())
             return throwError(exec, TypeError, "Cannot supply flags when constructing one RegExp from another.");
         return asObject(arg0);
diff --git a/JavaScriptCore/runtime/RegExpConstructor.h b/JavaScriptCore/runtime/RegExpConstructor.h
index 6823f3f..f8bccf4 100644
--- a/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/JavaScriptCore/runtime/RegExpConstructor.h
@@ -32,15 +32,16 @@ namespace JSC {
 
     class RegExpConstructor : public InternalFunction {
     public:
-        RegExpConstructor(ExecState*, PassRefPtr<Structure>, RegExpPrototype*);
+        RegExpConstructor(ExecState*, NonNullPassRefPtr<Structure>, RegExpPrototype*);
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
+            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames));
         }
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         static const ClassInfo info;
 
diff --git a/JavaScriptCore/runtime/RegExpMatchesArray.h b/JavaScriptCore/runtime/RegExpMatchesArray.h
index 9ae18b9..829f7cf 100644
--- a/JavaScriptCore/runtime/RegExpMatchesArray.h
+++ b/JavaScriptCore/runtime/RegExpMatchesArray.h
@@ -44,6 +44,13 @@ namespace JSC {
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
+        virtual bool getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+        {
+            if (lazyCreationData())
+                fillArrayInstance(exec);
+            return JSArray::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+        }
+
         virtual void put(ExecState* exec, const Identifier& propertyName, JSValue v, PutPropertySlot& slot)
         {
             if (lazyCreationData())
@@ -72,11 +79,11 @@ namespace JSC {
             return JSArray::deleteProperty(exec, propertyName);
         }
 
-        virtual void getPropertyNames(ExecState* exec, PropertyNameArray& arr)
+        virtual void getOwnPropertyNames(ExecState* exec, PropertyNameArray& arr)
         {
             if (lazyCreationData())
                 fillArrayInstance(exec);
-            JSArray::getPropertyNames(exec, arr);
+            JSArray::getOwnPropertyNames(exec, arr);
         }
 
         void fillArrayInstance(ExecState*);
diff --git a/JavaScriptCore/runtime/RegExpObject.cpp b/JavaScriptCore/runtime/RegExpObject.cpp
index 687844e..877d7b6 100644
--- a/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/JavaScriptCore/runtime/RegExpObject.cpp
@@ -57,7 +57,7 @@ const ClassInfo RegExpObject::info = { "RegExp", 0, 0, ExecState::regExpTable };
 @end
 */
 
-RegExpObject::RegExpObject(PassRefPtr<Structure> structure, PassRefPtr<RegExp> regExp)
+RegExpObject::RegExpObject(NonNullPassRefPtr<Structure> structure, NonNullPassRefPtr<RegExp> regExp)
     : JSObject(structure)
     , d(new RegExpObjectData(regExp, 0))
 {
@@ -72,6 +72,11 @@ bool RegExpObject::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, slot);
 }
 
+bool RegExpObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, descriptor);
+}
+
 JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->global());
diff --git a/JavaScriptCore/runtime/RegExpObject.h b/JavaScriptCore/runtime/RegExpObject.h
index e83e0ac..f5a9340 100644
--- a/JavaScriptCore/runtime/RegExpObject.h
+++ b/JavaScriptCore/runtime/RegExpObject.h
@@ -28,7 +28,7 @@ namespace JSC {
 
     class RegExpObject : public JSObject {
     public:
-        RegExpObject(PassRefPtr<Structure>, PassRefPtr<RegExp>);
+        RegExpObject(NonNullPassRefPtr<Structure>, NonNullPassRefPtr<RegExp>);
         virtual ~RegExpObject();
 
         void setRegExp(PassRefPtr<RegExp> r) { d->regExp = r; }
@@ -41,6 +41,7 @@ namespace JSC {
         JSValue exec(ExecState*, const ArgList&);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
@@ -48,7 +49,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
         }
 
     private:
@@ -57,7 +58,7 @@ namespace JSC {
         virtual CallType getCallData(CallData&);
 
         struct RegExpObjectData : FastAllocBase {
-            RegExpObjectData(PassRefPtr<RegExp> regExp, double lastIndex)
+            RegExpObjectData(NonNullPassRefPtr<RegExp> regExp, double lastIndex)
                 : regExp(regExp)
                 , lastIndex(lastIndex)
             {
diff --git a/JavaScriptCore/runtime/RegExpPrototype.cpp b/JavaScriptCore/runtime/RegExpPrototype.cpp
index b1ab889..bbc9e85 100644
--- a/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -22,6 +22,7 @@
 #include "RegExpPrototype.h"
 
 #include "ArrayPrototype.h"
+#include "Error.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSObject.h"
@@ -45,7 +46,7 @@ static JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState*, JSObject*, JSVa
 
 const ClassInfo RegExpPrototype::info = { "RegExpPrototype", 0, 0, 0 };
 
-RegExpPrototype::RegExpPrototype(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
+RegExpPrototype::RegExpPrototype(ExecState* exec, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
     : JSObject(structure)
 {
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
@@ -58,28 +59,28 @@ RegExpPrototype::RegExpPrototype(ExecState* exec, PassRefPtr<Structure> structur
     
 JSValue JSC_HOST_CALL regExpProtoFuncTest(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&RegExpObject::info))
+    if (!thisValue.inherits(&RegExpObject::info))
         return throwError(exec, TypeError);
     return asRegExpObject(thisValue)->test(exec, args);
 }
 
 JSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&RegExpObject::info))
+    if (!thisValue.inherits(&RegExpObject::info))
         return throwError(exec, TypeError);
     return asRegExpObject(thisValue)->exec(exec, args);
 }
 
 JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&RegExpObject::info))
+    if (!thisValue.inherits(&RegExpObject::info))
         return throwError(exec, TypeError);
 
     RefPtr<RegExp> regExp;
     JSValue arg0 = args.at(0);
     JSValue arg1 = args.at(1);
     
-    if (arg0.isObject(&RegExpObject::info)) {
+    if (arg0.inherits(&RegExpObject::info)) {
         if (!arg1.isUndefined())
             return throwError(exec, TypeError, "Cannot supply flags when constructing one RegExp from another.");
         regExp = asRegExpObject(arg0)->regExp();
@@ -99,8 +100,8 @@ JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&RegExpObject::info)) {
-        if (thisValue.isObject(&RegExpPrototype::info))
+    if (!thisValue.inherits(&RegExpObject::info)) {
+        if (thisValue.inherits(&RegExpPrototype::info))
             return jsNontrivialString(exec, "//");
         return throwError(exec, TypeError);
     }
diff --git a/JavaScriptCore/runtime/RegExpPrototype.h b/JavaScriptCore/runtime/RegExpPrototype.h
index f5db720..d3979bd 100644
--- a/JavaScriptCore/runtime/RegExpPrototype.h
+++ b/JavaScriptCore/runtime/RegExpPrototype.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class RegExpPrototype : public JSObject {
     public:
-        RegExpPrototype(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+        RegExpPrototype(ExecState*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
diff --git a/JavaScriptCore/runtime/ScopeChain.cpp b/JavaScriptCore/runtime/ScopeChain.cpp
index 5c2edab..981794b 100644
--- a/JavaScriptCore/runtime/ScopeChain.cpp
+++ b/JavaScriptCore/runtime/ScopeChain.cpp
@@ -36,8 +36,8 @@ void ScopeChainNode::print() const
     ScopeChainIterator scopeEnd = end();
     for (ScopeChainIterator scopeIter = begin(); scopeIter != scopeEnd; ++scopeIter) {
         JSObject* o = *scopeIter;
-        PropertyNameArray propertyNames(globalObject()->globalExec());
-        o->getPropertyNames(globalObject()->globalExec(), propertyNames);
+        PropertyNameArray propertyNames(globalObject->globalExec());
+        o->getPropertyNames(globalObject->globalExec(), propertyNames);
         PropertyNameArray::const_iterator propEnd = propertyNames.end();
 
         fprintf(stderr, "----- [scope %p] -----\n", o);
@@ -56,7 +56,7 @@ int ScopeChain::localDepth() const
     int scopeDepth = 0;
     ScopeChainIterator iter = this->begin();
     ScopeChainIterator end = this->end();
-    while (!(*iter)->isObject(&JSActivation::info)) {
+    while (!(*iter)->inherits(&JSActivation::info)) {
         ++iter;
         if (iter == end)
             break;
diff --git a/JavaScriptCore/runtime/ScopeChain.h b/JavaScriptCore/runtime/ScopeChain.h
index c5e16c9..0b15b67 100644
--- a/JavaScriptCore/runtime/ScopeChain.h
+++ b/JavaScriptCore/runtime/ScopeChain.h
@@ -33,14 +33,16 @@ namespace JSC {
     
     class ScopeChainNode : public FastAllocBase {
     public:
-        ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSObject* globalThis)
+        ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
             : next(next)
             , object(object)
             , globalData(globalData)
+            , globalObject(globalObject)
             , globalThis(globalThis)
             , refCount(1)
         {
             ASSERT(globalData);
+            ASSERT(globalObject);
         }
 #ifndef NDEBUG
         // Due to the number of subtle and timing dependent bugs that have occurred due
@@ -51,6 +53,7 @@ namespace JSC {
             next = 0;
             object = 0;
             globalData = 0;
+            globalObject = 0;
             globalThis = 0;
         }
 #endif
@@ -58,6 +61,7 @@ namespace JSC {
         ScopeChainNode* next;
         JSObject* object;
         JSGlobalData* globalData;
+        JSGlobalObject* globalObject;
         JSObject* globalThis;
         int refCount;
 
@@ -82,9 +86,6 @@ namespace JSC {
         ScopeChainIterator begin() const;
         ScopeChainIterator end() const;
 
-        JSGlobalObject* globalObject() const; // defined in JSGlobalObject.h
-        JSObject* globalThisObject() const { return globalThis; }
-
 #ifndef NDEBUG        
         void print() const;
 #endif
@@ -93,7 +94,7 @@ namespace JSC {
     inline ScopeChainNode* ScopeChainNode::push(JSObject* o)
     {
         ASSERT(o);
-        return new ScopeChainNode(this, o, globalData, globalThis);
+        return new ScopeChainNode(this, o, globalData, globalObject, globalThis);
     }
 
     inline ScopeChainNode* ScopeChainNode::pop()
@@ -163,8 +164,8 @@ namespace JSC {
         {
         }
 
-        ScopeChain(JSObject* o, JSGlobalData* globalData, JSObject* globalThis)
-            : m_node(new ScopeChainNode(0, o, globalData, globalThis))
+        ScopeChain(JSObject* o, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
+            : m_node(new ScopeChainNode(0, o, globalData, globalObject, globalThis))
         {
         }
 
@@ -203,7 +204,7 @@ namespace JSC {
         void pop() { m_node = m_node->pop(); }
         void clear() { m_node->deref(); m_node = 0; }
         
-        JSGlobalObject* globalObject() const { return m_node->globalObject(); }
+        JSGlobalObject* globalObject() const { return m_node->globalObject; }
 
         void markAggregate(MarkStack&) const;
 
diff --git a/JavaScriptCore/runtime/SmallStrings.cpp b/JavaScriptCore/runtime/SmallStrings.cpp
index 2f92cc1..04701cb 100644
--- a/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/JavaScriptCore/runtime/SmallStrings.cpp
@@ -82,13 +82,13 @@ SmallStrings::~SmallStrings()
 {
 }
 
-void SmallStrings::mark()
+void SmallStrings::markChildren(MarkStack& markStack)
 {
-    if (m_emptyString && !m_emptyString->marked())
-        m_emptyString->markCellDirect();
+    if (m_emptyString)
+        markStack.append(m_emptyString);
     for (unsigned i = 0; i < numCharactersToStore; ++i) {
-        if (m_singleCharacterStrings[i] && !m_singleCharacterStrings[i]->marked())
-            m_singleCharacterStrings[i]->markCellDirect();
+        if (m_singleCharacterStrings[i])
+            markStack.append(m_singleCharacterStrings[i]);
     }
 }
 
diff --git a/JavaScriptCore/runtime/SmallStrings.h b/JavaScriptCore/runtime/SmallStrings.h
index f0dd8df..efecbb0 100644
--- a/JavaScriptCore/runtime/SmallStrings.h
+++ b/JavaScriptCore/runtime/SmallStrings.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,7 +33,7 @@ namespace JSC {
 
     class JSGlobalData;
     class JSString;
-
+    class MarkStack;
     class SmallStringsStorage;
 
     class SmallStrings : public Noncopyable {
@@ -56,7 +56,7 @@ namespace JSC {
 
         UString::Rep* singleCharacterStringRep(unsigned char character);
 
-        void mark();
+        void markChildren(MarkStack&);
 
         unsigned count() const;
 
diff --git a/JavaScriptCore/runtime/StringConstructor.cpp b/JavaScriptCore/runtime/StringConstructor.cpp
index 6380445..2f3adbe 100644
--- a/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/JavaScriptCore/runtime/StringConstructor.cpp
@@ -47,7 +47,7 @@ static JSValue JSC_HOST_CALL stringFromCharCode(ExecState* exec, JSObject*, JSVa
 
 ASSERT_CLASS_FITS_IN_CELL(StringConstructor);
 
-StringConstructor::StringConstructor(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure, StringPrototype* stringPrototype)
+StringConstructor::StringConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure, StringPrototype* stringPrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, stringPrototype->classInfo()->className))
 {
     // ECMA 15.5.3.1 String.prototype
diff --git a/JavaScriptCore/runtime/StringConstructor.h b/JavaScriptCore/runtime/StringConstructor.h
index 7d52c69..e511f7b 100644
--- a/JavaScriptCore/runtime/StringConstructor.h
+++ b/JavaScriptCore/runtime/StringConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class StringConstructor : public InternalFunction {
     public:
-        StringConstructor(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure, StringPrototype*);
+        StringConstructor(ExecState*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure, StringPrototype*);
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
diff --git a/JavaScriptCore/runtime/StringObject.cpp b/JavaScriptCore/runtime/StringObject.cpp
index fb44498..7216d3a 100644
--- a/JavaScriptCore/runtime/StringObject.cpp
+++ b/JavaScriptCore/runtime/StringObject.cpp
@@ -29,19 +29,19 @@ ASSERT_CLASS_FITS_IN_CELL(StringObject);
 
 const ClassInfo StringObject::info = { "String", 0, 0, 0 };
 
-StringObject::StringObject(ExecState* exec, PassRefPtr<Structure> structure)
+StringObject::StringObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     : JSWrapperObject(structure)
 {
     setInternalValue(jsEmptyString(exec));
 }
 
-StringObject::StringObject(PassRefPtr<Structure> structure, JSString* string)
+StringObject::StringObject(NonNullPassRefPtr<Structure> structure, JSString* string)
     : JSWrapperObject(structure)
 {
     setInternalValue(string);
 }
 
-StringObject::StringObject(ExecState* exec, PassRefPtr<Structure> structure, const UString& string)
+StringObject::StringObject(ExecState* exec, NonNullPassRefPtr<Structure> structure, const UString& string)
     : JSWrapperObject(structure)
 {
     setInternalValue(jsString(exec, string));
@@ -61,6 +61,13 @@ bool StringObject::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Pr
     return JSObject::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
+bool StringObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (internalValue()->getStringPropertyDescriptor(exec, propertyName, descriptor))
+        return true;    
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void StringObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length)
@@ -75,27 +82,12 @@ bool StringObject::deleteProperty(ExecState* exec, const Identifier& propertyNam
     return JSObject::deleteProperty(exec, propertyName);
 }
 
-void StringObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void StringObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     int size = internalValue()->value().size();
     for (int i = 0; i < size; ++i)
         propertyNames.add(Identifier(exec, UString::from(i)));
-    return JSObject::getPropertyNames(exec, propertyNames);
-}
-
-UString StringObject::toString(ExecState*) const
-{
-    return internalValue()->value();
-}
-
-UString StringObject::toThisString(ExecState*) const
-{
-    return internalValue()->value();
-}
-
-JSString* StringObject::toThisJSString(ExecState*)
-{
-    return internalValue();
+    return JSObject::getOwnPropertyNames(exec, propertyNames);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/StringObject.h b/JavaScriptCore/runtime/StringObject.h
index ea3a045..944f6ba 100644
--- a/JavaScriptCore/runtime/StringObject.h
+++ b/JavaScriptCore/runtime/StringObject.h
@@ -28,17 +28,18 @@ namespace JSC {
 
     class StringObject : public JSWrapperObject {
     public:
-        StringObject(ExecState*, PassRefPtr<Structure>);
-        StringObject(ExecState*, PassRefPtr<Structure>, const UString&);
+        StringObject(ExecState*, NonNullPassRefPtr<Structure>);
+        StringObject(ExecState*, NonNullPassRefPtr<Structure>, const UString&);
 
         static StringObject* create(ExecState*, JSString*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual void put(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const JS_EXPORTDATA ClassInfo info;
@@ -51,12 +52,7 @@ namespace JSC {
         }
 
     protected:
-        StringObject(PassRefPtr<Structure>, JSString*);
-
-    private:
-        virtual UString toString(ExecState*) const;
-        virtual UString toThisString(ExecState*) const;
-        virtual JSString* toThisJSString(ExecState*);
+        StringObject(NonNullPassRefPtr<Structure>, JSString*);
   };
 
     StringObject* asStringObject(JSValue);
diff --git a/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index bc5c0a5..0cba83d 100644
--- a/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -37,14 +37,14 @@ namespace JSC {
         }
 
     private:
-        StringObjectThatMasqueradesAsUndefined(ExecState* exec, PassRefPtr<Structure> structure, const UString& string)
+        StringObjectThatMasqueradesAsUndefined(ExecState* exec, NonNullPassRefPtr<Structure> structure, const UString& string)
             : StringObject(exec, structure, string)
         {
         }
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, MasqueradesAsUndefined)); 
+            return Structure::create(proto, TypeInfo(ObjectType, MasqueradesAsUndefined | HasDefaultMark)); 
         }
 
         virtual bool toBoolean(ExecState*) const { return false; }
diff --git a/JavaScriptCore/runtime/StringPrototype.cpp b/JavaScriptCore/runtime/StringPrototype.cpp
index 531a302..b57732a 100644
--- a/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/JavaScriptCore/runtime/StringPrototype.cpp
@@ -23,6 +23,8 @@
 #include "StringPrototype.h"
 
 #include "CachedCall.h"
+#include "Error.h"
+#include "Executable.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "ObjectPrototype.h"
@@ -119,7 +121,7 @@ const ClassInfo StringPrototype::info = { "String", &StringObject::info, 0, Exec
 */
 
 // ECMA 15.5.4
-StringPrototype::StringPrototype(ExecState* exec, PassRefPtr<Structure> structure)
+StringPrototype::StringPrototype(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     : StringObject(exec, structure)
 {
     // The constructor will be added later, after StringConstructor has been built
@@ -131,6 +133,11 @@ bool StringPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticFunctionSlot<StringObject>(exec, ExecState::stringTable(exec), this, propertyName, slot);
 }
 
+bool StringPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<StringObject>(exec, ExecState::stringTable(exec), this, propertyName, descriptor);
+}
+
 // ------------------------------ Functions --------------------------
 
 static inline UString substituteBackreferences(const UString& replacement, const UString& source, const int* ovector, RegExp* reg)
@@ -220,7 +227,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
     if (callType == CallTypeNone)
         replacementString = replacement.toString(exec);
 
-    if (pattern.isObject(&RegExpObject::info)) {
+    if (pattern.inherits(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(pattern)->regExp();
         bool global = reg->global();
 
@@ -365,7 +372,7 @@ JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec, JSObject*, JSValu
     if (thisValue.isString())
         return thisValue;
 
-    if (thisValue.isObject(&StringObject::info))
+    if (thisValue.inherits(&StringObject::info))
         return asStringObject(thisValue)->internalValue();
 
     return throwError(exec, TypeError);
@@ -466,7 +473,7 @@ JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue t
     UString u = s;
     RefPtr<RegExp> reg;
     RegExpObject* imp = 0;
-    if (a0.isObject(&RegExpObject::info))
+    if (a0.inherits(&RegExpObject::info))
         reg = asRegExpObject(a0)->regExp();
     else {
         /*
@@ -516,7 +523,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec, JSObject*, JSValue
 
     UString u = s;
     RefPtr<RegExp> reg;
-    if (a0.isObject(&RegExpObject::info))
+    if (a0.inherits(&RegExpObject::info))
         reg = asRegExpObject(a0)->regExp();
     else { 
         /*
@@ -568,7 +575,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
     unsigned i = 0;
     int p0 = 0;
     unsigned limit = a1.isUndefined() ? 0xFFFFFFFFU : a1.toUInt32(exec);
-    if (a0.isObject(&RegExpObject::info)) {
+    if (a0.inherits(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(a0)->regExp();
         if (s.isEmpty() && reg->match(s, 0) >= 0) {
             // empty string matched by regexp -> empty array
@@ -821,8 +828,8 @@ JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValu
     if (a0.getUInt32(smallInteger) && smallInteger <= 9) {
         unsigned stringSize = s.size();
         unsigned bufferSize = 22 + stringSize;
-        UChar* buffer = static_cast<UChar*>(tryFastMalloc(bufferSize * sizeof(UChar)));
-        if (!buffer)
+        UChar* buffer;
+        if (!tryFastMalloc(bufferSize * sizeof(UChar)).getValue(buffer))
             return jsUndefined();
         buffer[0] = '<';
         buffer[1] = 'f';
@@ -869,8 +876,8 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     unsigned linkTextSize = linkText.size();
     unsigned stringSize = s.size();
     unsigned bufferSize = 15 + linkTextSize + stringSize;
-    UChar* buffer = static_cast<UChar*>(tryFastMalloc(bufferSize * sizeof(UChar)));
-    if (!buffer)
+    UChar* buffer;
+    if (!tryFastMalloc(bufferSize * sizeof(UChar)).getValue(buffer))
         return jsUndefined();
     buffer[0] = '<';
     buffer[1] = 'a';
diff --git a/JavaScriptCore/runtime/StringPrototype.h b/JavaScriptCore/runtime/StringPrototype.h
index 6f5344e..3a6a2a3 100644
--- a/JavaScriptCore/runtime/StringPrototype.h
+++ b/JavaScriptCore/runtime/StringPrototype.h
@@ -29,9 +29,10 @@ namespace JSC {
 
     class StringPrototype : public StringObject {
     public:
-        StringPrototype(ExecState*, PassRefPtr<Structure>);
+        StringPrototype(ExecState*, NonNullPassRefPtr<Structure>);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
diff --git a/JavaScriptCore/runtime/Structure.cpp b/JavaScriptCore/runtime/Structure.cpp
index 5dfd919..7209b5f 100644
--- a/JavaScriptCore/runtime/Structure.cpp
+++ b/JavaScriptCore/runtime/Structure.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -127,17 +127,14 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
     , m_propertyTable(0)
     , m_propertyStorageCapacity(JSObject::inlineStorageCapacity)
     , m_offset(noOffset)
-    , m_isDictionary(false)
+    , m_dictionaryKind(NoneDictionaryKind)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(false)
-    , m_usingSingleTransitionSlot(true)
     , m_attributesInPrevious(0)
 {
     ASSERT(m_prototype);
     ASSERT(m_prototype.isObject() || m_prototype.isNull());
 
-    m_transitions.singleTransition = 0;
-
 #ifndef NDEBUG
 #if ENABLE(JSC_MULTIPLE_THREADS)
     MutexLocker protect(ignoreSetMutex);
@@ -156,20 +153,16 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
 Structure::~Structure()
 {
     if (m_previous) {
-        if (m_previous->m_usingSingleTransitionSlot) {
-            m_previous->m_transitions.singleTransition = 0;
-        } else {
-            ASSERT(m_previous->m_transitions.table->contains(make_pair(m_nameInPrevious.get(), make_pair(m_attributesInPrevious, m_specificValueInPrevious))));
-            m_previous->m_transitions.table->remove(make_pair(m_nameInPrevious.get(), make_pair(m_attributesInPrevious, m_specificValueInPrevious)));
-        }
+        if (m_nameInPrevious)
+            m_previous->table.remove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious), m_specificValueInPrevious);
+        else
+            m_previous->table.removeAnonymousSlotTransition(m_anonymousSlotsInPrevious);
+
     }
 
     if (m_cachedPropertyNameArrayData)
         m_cachedPropertyNameArrayData->setCachedStructure(0);
 
-    if (!m_usingSingleTransitionSlot)
-        delete m_transitions.table;
-
     if (m_propertyTable) {
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
         for (unsigned i = 1; i <= entryCount; i++) {
@@ -279,15 +272,25 @@ void Structure::materializePropertyMap()
 
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
+        if (!structure->m_nameInPrevious) {
+            m_propertyTable->anonymousSlotCount += structure->m_anonymousSlotsInPrevious;
+            continue;
+        }
         structure->m_nameInPrevious->ref();
         PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
         insertIntoPropertyMapHashTable(entry);
     }
 }
 
+void Structure::getOwnEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
+{
+    getEnumerableNamesFromPropertyTable(propertyNames);
+    getEnumerableNamesFromClassInfoTable(exec, baseObject->classInfo(), propertyNames);
+}
+
 void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
 {
-    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || m_isDictionary);
+    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || isDictionary());
 
     if (shouldCache && m_cachedPropertyNameArrayData) {
         if (m_cachedPropertyNameArrayData->cachedPrototypeChain() == prototypeChain(exec)) {
@@ -297,12 +300,22 @@ void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& p
         clearEnumerationCache();
     }
 
-    getEnumerableNamesFromPropertyTable(propertyNames);
-    getEnumerableNamesFromClassInfoTable(exec, baseObject->classInfo(), propertyNames);
+    baseObject->getOwnPropertyNames(exec, propertyNames);
 
     if (m_prototype.isObject()) {
         propertyNames.setShouldCache(false); // No need for our prototypes to waste memory on caching, since they're not being enumerated directly.
-        asObject(m_prototype)->getPropertyNames(exec, propertyNames);
+        JSObject* prototype = asObject(m_prototype);
+        while(1) {
+            if (!prototype->structure()->typeInfo().hasDefaultGetPropertyNames()) {
+                prototype->getPropertyNames(exec, propertyNames);
+                break;
+            }
+            prototype->getOwnPropertyNames(exec, propertyNames);
+            JSValue nextProto = prototype->prototype();
+            if (!nextProto.isObject())
+                break;
+            prototype = asObject(nextProto);
+        }
     }
 
     if (shouldCache) {
@@ -336,7 +349,7 @@ void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
 
     materializePropertyMapIfNecessary();
 
-    ASSERT(m_isDictionary);
+    ASSERT(isDictionary());
     ASSERT(m_propertyTable);
 
     unsigned i = rep->computedHash();
@@ -378,25 +391,13 @@ void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
 
 PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
-    ASSERT(!structure->m_isDictionary);
+    ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
 
-    if (structure->m_usingSingleTransitionSlot) {
-        Structure* existingTransition = structure->m_transitions.singleTransition;
-        if (existingTransition && existingTransition->m_nameInPrevious.get() == propertyName.ustring().rep()
-            && existingTransition->m_attributesInPrevious == attributes
-            && existingTransition->m_specificValueInPrevious == specificValue) {
-
-            ASSERT(structure->m_transitions.singleTransition->m_offset != noOffset);
-            offset = structure->m_transitions.singleTransition->m_offset;
-            return existingTransition;
-        }
-    } else {
-        if (Structure* existingTransition = structure->m_transitions.table->get(make_pair(propertyName.ustring().rep(), make_pair(attributes, specificValue)))) {
-            ASSERT(existingTransition->m_offset != noOffset);
-            offset = existingTransition->m_offset;
-            return existingTransition;
-        }
+    if (Structure* existingTransition = structure->table.get(make_pair(propertyName.ustring().rep(), attributes), specificValue)) {
+        ASSERT(existingTransition->m_offset != noOffset);
+        offset = existingTransition->m_offset;
+        return existingTransition;
     }
 
     return 0;
@@ -404,12 +405,12 @@ PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Struct
 
 PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
-    ASSERT(!structure->m_isDictionary);
+    ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
     ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
 
     if (structure->transitionCount() > s_maxTransitionLength) {
-        RefPtr<Structure> transition = toDictionaryTransition(structure);
+        RefPtr<Structure> transition = toCacheableDictionaryTransition(structure);
         ASSERT(structure != transition);
         offset = transition->put(propertyName, attributes, specificValue);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
@@ -447,27 +448,15 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
 
     transition->m_offset = offset;
 
-    if (structure->m_usingSingleTransitionSlot) {
-        if (!structure->m_transitions.singleTransition) {
-            structure->m_transitions.singleTransition = transition.get();
-            return transition.release();
-        }
-
-        Structure* existingTransition = structure->m_transitions.singleTransition;
-        structure->m_usingSingleTransitionSlot = false;
-        StructureTransitionTable* transitionTable = new StructureTransitionTable;
-        structure->m_transitions.table = transitionTable;
-        transitionTable->add(make_pair(existingTransition->m_nameInPrevious.get(), make_pair(existingTransition->m_attributesInPrevious, existingTransition->m_specificValueInPrevious)), existingTransition);
-    }
-    structure->m_transitions.table->add(make_pair(propertyName.ustring().rep(), make_pair(attributes, specificValue)), transition.get());
+    structure->table.add(make_pair(propertyName.ustring().rep(), attributes), transition.get(), specificValue);
     return transition.release();
 }
 
 PassRefPtr<Structure> Structure::removePropertyTransition(Structure* structure, const Identifier& propertyName, size_t& offset)
 {
-    ASSERT(!structure->m_isDictionary);
+    ASSERT(!structure->isUncacheableDictionary());
 
-    RefPtr<Structure> transition = toDictionaryTransition(structure);
+    RefPtr<Structure> transition = toUncacheableDictionaryTransition(structure);
 
     offset = transition->remove(propertyName);
 
@@ -509,6 +498,47 @@ PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structur
     return transition.release();
 }
 
+PassRefPtr<Structure> Structure::addAnonymousSlotsTransition(Structure* structure, unsigned count)
+{
+    if (Structure* transition = structure->table.getAnonymousSlotTransition(count)) {
+        ASSERT(transition->storedPrototype() == structure->storedPrototype());
+        return transition;
+    }
+    ASSERT(count);
+    ASSERT(count < ((1<<6) - 2));
+    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+    
+    transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
+    transition->m_previous = structure;
+    transition->m_nameInPrevious = 0;
+    transition->m_attributesInPrevious = 0;
+    transition->m_anonymousSlotsInPrevious = count;
+    transition->m_specificValueInPrevious = 0;
+    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
+    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+
+    if (structure->m_propertyTable) {
+        if (structure->m_isPinnedPropertyTable)
+            transition->m_propertyTable = structure->copyPropertyTable();
+        else {
+            transition->m_propertyTable = structure->m_propertyTable;
+            structure->m_propertyTable = 0;
+        }
+    } else {
+        if (structure->m_previous)
+            transition->materializePropertyMap();
+        else
+            transition->createPropertyMapHashTable();
+    }
+
+    transition->addAnonymousSlots(count);
+    if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
+        transition->growPropertyStorageCapacity();
+
+    structure->table.addAnonymousSlotTransition(count, transition.get());
+    return transition.release();    
+}
+
 PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
 {
     RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
@@ -524,25 +554,35 @@ PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
     return transition.release();
 }
 
-PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure)
+PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, DictionaryKind kind)
 {
-    ASSERT(!structure->m_isDictionary);
-
+    ASSERT(!structure->isUncacheableDictionary());
+    
     RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
-    transition->m_isDictionary = true;
+    transition->m_dictionaryKind = kind;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
-
+    
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
-
+    
     return transition.release();
 }
 
+PassRefPtr<Structure> Structure::toCacheableDictionaryTransition(Structure* structure)
+{
+    return toDictionaryTransition(structure, CachedDictionaryKind);
+}
+
+PassRefPtr<Structure> Structure::toUncacheableDictionaryTransition(Structure* structure)
+{
+    return toDictionaryTransition(structure, UncachedDictionaryKind);
+}
+
 PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
 {
-    ASSERT(structure->m_isDictionary);
+    ASSERT(structure->isDictionary());
 
     // Since dictionary Structures are not shared, and no opcodes specialize
     // for them, we don't need to allocate a new Structure when transitioning
@@ -551,15 +591,13 @@ PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
     // FIMXE: We can make this more efficient by canonicalizing the Structure (draining the
     // deleted offsets vector) before transitioning from dictionary. 
     if (!structure->m_propertyTable || !structure->m_propertyTable->deletedOffsets || structure->m_propertyTable->deletedOffsets->isEmpty())
-        structure->m_isDictionary = false;
+        structure->m_dictionaryKind = NoneDictionaryKind;
 
     return structure;
 }
 
 size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
-    ASSERT(!m_transitions.singleTransition);
-
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
@@ -572,8 +610,7 @@ size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, u
 
 size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName)
 {
-    ASSERT(!m_transitions.singleTransition);
-    ASSERT(m_isDictionary);
+    ASSERT(isUncacheableDictionary());
 
     materializePropertyMapIfNecessary();
 
@@ -636,6 +673,7 @@ PropertyMapHashTable* Structure::copyPropertyTable()
     if (m_propertyTable->deletedOffsets)
         newTable->deletedOffsets = new Vector<unsigned>(*m_propertyTable->deletedOffsets);
 
+    newTable->anonymousSlotCount = m_propertyTable->anonymousSlotCount;
     return newTable;
 }
 
@@ -815,7 +853,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
         newOffset = m_propertyTable->deletedOffsets->last();
         m_propertyTable->deletedOffsets->removeLast();
     } else
-        newOffset = m_propertyTable->keyCount;
+        newOffset = m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount;
     m_propertyTable->entries()[entryIndex - 1].offset = newOffset;
 
     ++m_propertyTable->keyCount;
@@ -827,6 +865,16 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
     return newOffset;
 }
 
+void Structure::addAnonymousSlots(unsigned count)
+{
+    m_propertyTable->anonymousSlotCount += count;
+}
+
+bool Structure::hasTransition(UString::Rep* rep, unsigned attributes)
+{
+    return table.hasTransition(make_pair(rep, attributes));
+}
+
 size_t Structure::remove(const Identifier& propertyName)
 {
     ASSERT(!propertyName.isNull());
@@ -980,6 +1028,7 @@ void Structure::rehashPropertyMapHashTable(unsigned newTableSize)
     m_propertyTable = static_cast<PropertyMapHashTable*>(fastZeroedMalloc(PropertyMapHashTable::allocationSize(newTableSize)));
     m_propertyTable->size = newTableSize;
     m_propertyTable->sizeMask = newTableSize - 1;
+    m_propertyTable->anonymousSlotCount = oldTable->anonymousSlotCount;
 
     unsigned lastIndexUsed = 0;
     unsigned entryCount = oldTable->keyCount + oldTable->deletedSentinelCount;
diff --git a/JavaScriptCore/runtime/Structure.h b/JavaScriptCore/runtime/Structure.h
index f3a0c7c..ed9f6e5 100644
--- a/JavaScriptCore/runtime/Structure.h
+++ b/JavaScriptCore/runtime/Structure.h
@@ -29,11 +29,10 @@
 #include "Identifier.h"
 #include "JSType.h"
 #include "JSValue.h"
-#include "MarkStack.h"
 #include "PropertyMapHashTable.h"
 #include "StructureChain.h"
 #include "StructureTransitionTable.h"
-#include "TypeInfo.h"
+#include "JSTypeInfo.h"
 #include "UString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -46,12 +45,14 @@
 
 namespace JSC {
 
+    class MarkStack;
     class PropertyNameArray;
     class PropertyNameArrayData;
 
     class Structure : public RefCounted<Structure> {
     public:
         friend class JIT;
+        friend class StructureTransitionTable;
         static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo)
         {
             return adoptRef(new Structure(prototype, typeInfo));
@@ -66,24 +67,24 @@ namespace JSC {
         static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
         static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
         static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
-        static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);        
+        static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);
+        static PassRefPtr<Structure> addAnonymousSlotsTransition(Structure*, unsigned count);
         static PassRefPtr<Structure> getterSetterTransition(Structure*);
-        static PassRefPtr<Structure> toDictionaryTransition(Structure*);
+        static PassRefPtr<Structure> toCacheableDictionaryTransition(Structure*);
+        static PassRefPtr<Structure> toUncacheableDictionaryTransition(Structure*);
         static PassRefPtr<Structure> fromDictionaryTransition(Structure*);
 
         ~Structure();
 
-        void markAggregate(MarkStack& markStack)
-        {
-            markStack.append(m_prototype);
-        }
+        void markAggregate(MarkStack&);
 
         // These should be used with caution.  
         size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t removePropertyWithoutTransition(const Identifier& propertyName);
         void setPrototypeWithoutTransition(JSValue prototype) { m_prototype = prototype; }
-
-        bool isDictionary() const { return m_isDictionary; }
+        
+        bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
+        bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
 
         const TypeInfo& typeInfo() const { return m_typeInfo; }
 
@@ -95,7 +96,7 @@ namespace JSC {
 
         void growPropertyStorageCapacity();
         size_t propertyStorageCapacity() const { return m_propertyStorageCapacity; }
-        size_t propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
+        size_t propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
         bool isUsingInlineStorage() const;
 
         size_t get(const Identifier& propertyName);
@@ -103,10 +104,20 @@ namespace JSC {
         size_t get(const Identifier& propertyName, unsigned& attributes, JSCell*& specificValue)
         {
             ASSERT(!propertyName.isNull());
-            return get(propertyName._ustring.rep(), attributes, specificValue);
+            return get(propertyName.ustring().rep(), attributes, specificValue);
+        }
+        bool transitionedFor(const JSCell* specificValue)
+        {
+            return m_specificValueInPrevious == specificValue;
+        }
+        bool hasTransition(UString::Rep*, unsigned attributes);
+        bool hasTransition(const Identifier& propertyName, unsigned attributes)
+        {
+            return hasTransition(propertyName._ustring.rep(), attributes);
         }
 
         void getEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
+        void getOwnEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
 
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
         void setHasGetterSetterProperties(bool hasGetterSetterProperties) { m_hasGetterSetterProperties = hasGetterSetterProperties; }
@@ -118,9 +129,17 @@ namespace JSC {
 
     private:
         Structure(JSValue prototype, const TypeInfo&);
+        
+        typedef enum { 
+            NoneDictionaryKind = 0,
+            CachedDictionaryKind = 1,
+            UncachedDictionaryKind = 2
+        } DictionaryKind;
+        static PassRefPtr<Structure> toDictionaryTransition(Structure*, DictionaryKind);
 
         size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
+        void addAnonymousSlots(unsigned slotCount);
         void getEnumerableNamesFromPropertyTable(PropertyNameArray&);
         void getEnumerableNamesFromClassInfoTable(ExecState*, const ClassInfo*, PropertyNameArray&);
 
@@ -166,13 +185,10 @@ namespace JSC {
 
         RefPtr<Structure> m_previous;
         RefPtr<UString::Rep> m_nameInPrevious;
-
-        union {
-            Structure* singleTransition;
-            StructureTransitionTable* table;
-        } m_transitions;
         JSCell* m_specificValueInPrevious;
 
+        StructureTransitionTable table;
+
         RefPtr<PropertyNameArrayData> m_cachedPropertyNameArrayData;
 
         PropertyMapHashTable* m_propertyTable;
@@ -180,11 +196,18 @@ namespace JSC {
         size_t m_propertyStorageCapacity;
         signed char m_offset;
 
-        bool m_isDictionary : 1;
+        unsigned m_dictionaryKind : 2;
         bool m_isPinnedPropertyTable : 1;
         bool m_hasGetterSetterProperties : 1;
-        bool m_usingSingleTransitionSlot : 1;
+#if COMPILER(WINSCW)
+        // Workaround for Symbian WINSCW compiler that cannot resolve unsigned type of the declared 
+        // bitfield, when used as argument in make_pair() function calls in structure.ccp.
+        // This bitfield optimization is insignificant for the Symbian emulator target.
+        unsigned m_attributesInPrevious;
+#else
         unsigned m_attributesInPrevious : 7;
+#endif
+        unsigned m_anonymousSlotsInPrevious : 6;
     };
 
     inline size_t Structure::get(const Identifier& propertyName)
@@ -231,7 +254,58 @@ namespace JSC {
                 return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
+    
+    bool StructureTransitionTable::contains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+    {
+        if (usingSingleTransitionSlot()) {
+            Structure* existingTransition = singleTransition();
+            return existingTransition && existingTransition->m_nameInPrevious.get() == key.first
+                   && existingTransition->m_attributesInPrevious == key.second
+                   && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0);
+        }
+        TransitionTable::iterator find = table()->find(key);
+        if (find == table()->end())
+            return false;
+
+        return find->second.first || find->second.second->transitionedFor(specificValue);
+    }
+
+    Structure* StructureTransitionTable::get(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
+    {
+        if (usingSingleTransitionSlot()) {
+            Structure* existingTransition = singleTransition();
+            if (existingTransition && existingTransition->m_nameInPrevious.get() == key.first
+                && existingTransition->m_attributesInPrevious == key.second
+                && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0))
+                return existingTransition;
+            return 0;
+        }
+
+        Transition transition = table()->get(key);
+        if (transition.second && transition.second->transitionedFor(specificValue))
+            return transition.second;
+        return transition.first;
+    }
 
+    bool StructureTransitionTable::hasTransition(const StructureTransitionTableHash::Key& key) const
+    {
+        if (usingSingleTransitionSlot()) {
+            Structure* transition = singleTransition();
+            return transition && transition->m_nameInPrevious == key.first
+            && transition->m_attributesInPrevious == key.second;
+        }
+        return table()->contains(key);
+    }
+    
+    void StructureTransitionTable::reifySingleTransition()
+    {
+        ASSERT(usingSingleTransitionSlot());
+        Structure* existingTransition = singleTransition();
+        TransitionTable* transitionTable = new TransitionTable;
+        setTransitionTable(transitionTable);
+        if (existingTransition)
+            add(make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
+    }
 } // namespace JSC
 
 #endif // Structure_h
diff --git a/JavaScriptCore/runtime/StructureChain.cpp b/JavaScriptCore/runtime/StructureChain.cpp
index 85049b1..6e8a0ee 100644
--- a/JavaScriptCore/runtime/StructureChain.cpp
+++ b/JavaScriptCore/runtime/StructureChain.cpp
@@ -51,7 +51,10 @@ bool StructureChain::isCacheable() const
     uint32_t i = 0;
     
     while (m_vector[i]) {
-        if (m_vector[i++]->isDictionary())
+        // Both classes of dictionary structure may change arbitrarily so we can't cache them
+        if (m_vector[i]->isDictionary())
+            return false;
+        if (!m_vector[i++]->typeInfo().hasDefaultGetPropertyNames())
             return false;
     }
     return true;
diff --git a/JavaScriptCore/runtime/StructureTransitionTable.h b/JavaScriptCore/runtime/StructureTransitionTable.h
index 804cbeb..0fa7b73 100644
--- a/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,8 @@
 #include <wtf/HashFunctions.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
+#include <wtf/PtrAndFlags.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace JSC {
@@ -37,7 +39,7 @@ namespace JSC {
     class Structure;
 
     struct StructureTransitionTableHash {
-        typedef std::pair<RefPtr<UString::Rep>, std::pair<unsigned, JSCell*> > Key;
+        typedef std::pair<RefPtr<UString::Rep>, unsigned> Key;
         static unsigned hash(const Key& p)
         {
             return p.first->computedHash();
@@ -53,20 +55,159 @@ namespace JSC {
 
     struct StructureTransitionTableHashTraits {
         typedef WTF::HashTraits<RefPtr<UString::Rep> > FirstTraits;
-        typedef WTF::GenericHashTraits<unsigned> SecondFirstTraits;
-        typedef WTF::GenericHashTraits<JSCell*> SecondSecondTraits;
-        typedef std::pair<FirstTraits::TraitType, std::pair<SecondFirstTraits::TraitType, SecondSecondTraits::TraitType> > TraitType;
+        typedef WTF::GenericHashTraits<unsigned> SecondTraits;
+        typedef std::pair<FirstTraits::TraitType, SecondTraits::TraitType > TraitType;
 
-        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondFirstTraits::emptyValueIsZero && SecondSecondTraits::emptyValueIsZero;
-        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), std::make_pair(SecondFirstTraits::emptyValue(), SecondSecondTraits::emptyValue())); }
+        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondTraits::emptyValueIsZero;
+        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), SecondTraits::emptyValue()); }
 
-        static const bool needsDestruction = FirstTraits::needsDestruction || SecondFirstTraits::needsDestruction || SecondSecondTraits::needsDestruction;
+        static const bool needsDestruction = FirstTraits::needsDestruction || SecondTraits::needsDestruction;
 
         static void constructDeletedValue(TraitType& slot) { FirstTraits::constructDeletedValue(slot.first); }
         static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
     };
 
-    typedef HashMap<StructureTransitionTableHash::Key, Structure*, StructureTransitionTableHash, StructureTransitionTableHashTraits> StructureTransitionTable;
+    class StructureTransitionTable {
+        typedef std::pair<Structure*, Structure*> Transition;
+        struct TransitionTable : public HashMap<StructureTransitionTableHash::Key, Transition, StructureTransitionTableHash, StructureTransitionTableHashTraits> {
+            typedef HashMap<unsigned, Structure*> AnonymousSlotMap;
+
+            void addSlotTransition(unsigned count, Structure* structure)
+            {
+                ASSERT(!getSlotTransition(count));
+                if (!m_anonymousSlotTable)
+                    m_anonymousSlotTable.set(new AnonymousSlotMap);
+                m_anonymousSlotTable->add(count, structure);
+            }
+
+            void removeSlotTransition(unsigned count)
+            {
+                ASSERT(getSlotTransition(count));
+                m_anonymousSlotTable->remove(count);
+            }
+
+            Structure* getSlotTransition(unsigned count)
+            {
+                if (!m_anonymousSlotTable)
+                    return 0;
+
+                AnonymousSlotMap::iterator find = m_anonymousSlotTable->find(count);
+                if (find == m_anonymousSlotTable->end())
+                    return 0;
+                return find->second;
+            }
+        private:
+            OwnPtr<AnonymousSlotMap> m_anonymousSlotTable;
+        };
+    public:
+        StructureTransitionTable() {
+            m_transitions.m_singleTransition.set(0);
+            m_transitions.m_singleTransition.setFlag(usingSingleSlot);
+        }
+
+        ~StructureTransitionTable() {
+            if (!usingSingleTransitionSlot())
+                delete table();
+        }
+
+        // The contains and get methods accept imprecise matches, so if an unspecialised transition exists
+        // for the given key they will consider that transition to be a match.  If a specialised transition
+        // exists and it matches the provided specificValue, get will return the specific transition.
+        inline bool contains(const StructureTransitionTableHash::Key&, JSCell* specificValue);
+        inline Structure* get(const StructureTransitionTableHash::Key&, JSCell* specificValue) const;
+        inline bool hasTransition(const StructureTransitionTableHash::Key& key) const;
+        void remove(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+        {
+            if (usingSingleTransitionSlot()) {
+                ASSERT(contains(key, specificValue));
+                setSingleTransition(0);
+                return;
+            }
+            TransitionTable::iterator find = table()->find(key);
+            if (!specificValue)
+                find->second.first = 0;
+            else
+                find->second.second = 0;
+            if (!find->second.first && !find->second.second)
+                table()->remove(find);
+        }
+        void add(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue)
+        {
+            if (usingSingleTransitionSlot()) {
+                if (!singleTransition()) {
+                    setSingleTransition(structure);
+                    return;
+                }
+                reifySingleTransition();
+            }
+            if (!specificValue) {
+                TransitionTable::iterator find = table()->find(key);
+                if (find == table()->end())
+                    table()->add(key, Transition(structure, 0));
+                else
+                    find->second.first = structure;
+            } else {
+                // If we're adding a transition to a specific value, then there cannot be
+                // an existing transition
+                ASSERT(!table()->contains(key));
+                table()->add(key, Transition(0, structure));
+            }
+        }
+
+        Structure* getAnonymousSlotTransition(unsigned count)
+        {
+            if (usingSingleTransitionSlot())
+                return 0;
+            return table()->getSlotTransition(count);
+        }
+
+        void addAnonymousSlotTransition(unsigned count, Structure* structure)
+        {
+            if (usingSingleTransitionSlot())
+                reifySingleTransition();
+            ASSERT(!table()->getSlotTransition(count));
+            table()->addSlotTransition(count, structure);
+        }
+        
+        void removeAnonymousSlotTransition(unsigned count)
+        {
+            ASSERT(!usingSingleTransitionSlot());
+            table()->removeSlotTransition(count);
+        }
+    private:
+        TransitionTable* table() const { ASSERT(!usingSingleTransitionSlot()); return m_transitions.m_table; }
+        Structure* singleTransition() const {
+            ASSERT(usingSingleTransitionSlot());
+            return m_transitions.m_singleTransition.get();
+        }
+        bool usingSingleTransitionSlot() const { return m_transitions.m_singleTransition.isFlagSet(usingSingleSlot); }
+        void setSingleTransition(Structure* structure)
+        { 
+            ASSERT(usingSingleTransitionSlot());
+            m_transitions.m_singleTransition.set(structure);
+        }
+
+        void setTransitionTable(TransitionTable* table)
+        {
+            ASSERT(usingSingleTransitionSlot());
+#ifndef NDEBUG
+            setSingleTransition(0);
+#endif
+            m_transitions.m_table = table;
+            // This implicitly clears the flag that indicates we're using a single transition
+            ASSERT(!usingSingleTransitionSlot());
+        }
+        inline void reifySingleTransition();
+
+        enum UsingSingleSlot {
+            usingSingleSlot
+        };
+        // Last bit indicates whether we are using the single transition optimisation
+        union {
+            TransitionTable* m_table;
+            PtrAndFlagsBase<Structure, UsingSingleSlot> m_singleTransition;
+        } m_transitions;
+    };
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/SymbolTable.h b/JavaScriptCore/runtime/SymbolTable.h
index c00f95a..f5e2669 100644
--- a/JavaScriptCore/runtime/SymbolTable.h
+++ b/JavaScriptCore/runtime/SymbolTable.h
@@ -121,6 +121,10 @@ namespace JSC {
 
     typedef HashMap<RefPtr<UString::Rep>, SymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<UString::Rep> >, SymbolTableIndexHashTraits> SymbolTable;
 
+    class SharedSymbolTable : public SymbolTable, public RefCounted<SharedSymbolTable>
+    {
+    };
+    
 } // namespace JSC
 
 #endif // SymbolTable_h
diff --git a/JavaScriptCore/runtime/TimeoutChecker.cpp b/JavaScriptCore/runtime/TimeoutChecker.cpp
index 30ba6e9..2a056c9 100644
--- a/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -35,18 +35,10 @@
 
 #if PLATFORM(DARWIN)
 #include <mach/mach.h>
-#endif
-
-#if HAVE(SYS_TIME_H)
-#include <sys/time.h>
-#endif
-
-#if PLATFORM(WIN_OS)
+#elif PLATFORM(WIN_OS)
 #include <windows.h>
-#endif
-
-#if PLATFORM(QT)
-#include <QDateTime>
+#else
+#include "CurrentTime.h"
 #endif
 
 using namespace std;
@@ -75,14 +67,6 @@ static inline unsigned getCPUTime()
     time += info.system_time.seconds * 1000 + info.system_time.microseconds / 1000;
     
     return time;
-#elif HAVE(SYS_TIME_H)
-    // FIXME: This should probably use getrusage with the RUSAGE_THREAD flag.
-    struct timeval tv;
-    gettimeofday(&tv, 0);
-    return tv.tv_sec * 1000 + tv.tv_usec / 1000;
-#elif PLATFORM(QT)
-    QDateTime t = QDateTime::currentDateTime();
-    return t.toTime_t() * 1000 + t.time().msec();
 #elif PLATFORM(WIN_OS)
     union {
         FILETIME fileTime;
@@ -97,7 +81,8 @@ static inline unsigned getCPUTime()
     
     return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
 #else
-#error Platform does not have getCurrentTime function
+    // FIXME: We should return the time the current thread has spent executing.
+    return currentTime() * 1000;
 #endif
 }
 
diff --git a/JavaScriptCore/runtime/UString.cpp b/JavaScriptCore/runtime/UString.cpp
index 118751e..e66ca93 100644
--- a/JavaScriptCore/runtime/UString.cpp
+++ b/JavaScriptCore/runtime/UString.cpp
@@ -32,14 +32,17 @@
 #include <ctype.h>
 #include <float.h>
 #include <limits.h>
+#include <limits>
 #include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
+#include <wtf/StringExtras.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/UTF8.h>
+#include <wtf/StringExtras.h>
 
 #if HAVE(STRING_H)
 #include <string.h>
@@ -68,20 +71,20 @@ static const int minLengthToShare = 10;
 static inline size_t overflowIndicator() { return std::numeric_limits<size_t>::max(); }
 static inline size_t maxUChars() { return std::numeric_limits<size_t>::max() / sizeof(UChar); }
 
-static inline UChar* allocChars(size_t length)
+static inline PossiblyNull<UChar*> allocChars(size_t length)
 {
     ASSERT(length);
     if (length > maxUChars())
         return 0;
-    return static_cast<UChar*>(tryFastMalloc(sizeof(UChar) * length));
+    return tryFastMalloc(sizeof(UChar) * length);
 }
 
-static inline UChar* reallocChars(UChar* buffer, size_t length)
+static inline PossiblyNull<UChar*> reallocChars(UChar* buffer, size_t length)
 {
     ASSERT(length);
     if (length > maxUChars())
         return 0;
-    return static_cast<UChar*>(tryFastRealloc(buffer, sizeof(UChar) * length));
+    return tryFastRealloc(buffer, sizeof(UChar) * length);
 }
 
 static inline void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
@@ -480,8 +483,7 @@ static inline bool expandCapacity(UString::Rep* rep, int requiredLength)
     if (requiredLength > base->capacity) {
         size_t newCapacity = expandedSize(requiredLength, base->preCapacity);
         UChar* oldBuf = base->buf;
-        base->buf = reallocChars(base->buf, newCapacity);
-        if (!base->buf) {
+        if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
             base->buf = oldBuf;
             return false;
         }
@@ -512,8 +514,7 @@ bool UString::Rep::reserveCapacity(int capacity)
 
     size_t newCapacity = expandedSize(capacity, base->preCapacity);
     UChar* oldBuf = base->buf;
-    base->buf = reallocChars(base->buf, newCapacity);
-    if (!base->buf) {
+    if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
         base->buf = oldBuf;
         return false;
     }
@@ -540,8 +541,8 @@ void UString::expandPreCapacity(int requiredPreCap)
         size_t newCapacity = expandedSize(requiredPreCap, base->capacity);
         int delta = newCapacity - base->capacity - base->preCapacity;
 
-        UChar* newBuf = allocChars(newCapacity);
-        if (!newBuf) {
+        UChar* newBuf;
+        if (!allocChars(newCapacity).getValue(newBuf)) {
             makeNull();
             return;
         }
@@ -566,8 +567,8 @@ static PassRefPtr<UString::Rep> createRep(const char* c)
         return &UString::Rep::empty();
 
     size_t length = strlen(c);
-    UChar* d = allocChars(length);
-    if (!d)
+    UChar* d;
+    if (!allocChars(length).getValue(d))
         return &UString::Rep::null();
     else {
         for (size_t i = 0; i < length; i++)
@@ -656,8 +657,8 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
     } else {
         // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
-        UChar* d = allocChars(newCapacity);
-        if (!d)
+        UChar* d;
+        if (!allocChars(newCapacity).getValue(d))
             rep = &UString::Rep::null();
         else {
             copyChars(d, rep->data(), thisSize);
@@ -712,8 +713,8 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
     } else {
         // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
-        UChar* d = allocChars(newCapacity);
-        if (!d)
+        UChar* d;
+        if (!allocChars(newCapacity).getValue(d))
             rep = &UString::Rep::null();
         else {
             copyChars(d, rep->data(), thisSize);
@@ -800,8 +801,8 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
 
     // a does not qualify for append, and b does not qualify for prepend, gotta make a whole new string
     size_t newCapacity = expandedSize(length, 0);
-    UChar* d = allocChars(newCapacity);
-    if (!d)
+    UChar* d;
+    if (!allocChars(newCapacity).getValue(d))
         return 0;
     copyChars(d, a->data(), aSize);
     copyChars(d + aSize, b->data(), bSize);
@@ -942,6 +943,39 @@ UString UString::from(int i)
     return UString(p, static_cast<int>(end - p));
 }
 
+UString UString::from(long long i)
+{
+    UChar buf[1 + sizeof(i) * 3];
+    UChar* end = buf + sizeof(buf) / sizeof(UChar);
+    UChar* p = end;
+
+    if (i == 0)
+        *--p = '0';
+    else if (i == std::numeric_limits<long long>::min()) {
+        char minBuf[1 + sizeof(i) * 3];
+#if PLATFORM(WIN_OS)
+        snprintf(minBuf, sizeof(minBuf) - 1, "%I64d", std::numeric_limits<long long>::min());
+#else
+        snprintf(minBuf, sizeof(minBuf) - 1, "%lld", std::numeric_limits<long long>::min());
+#endif
+        return UString(minBuf);
+    } else {
+        bool negative = false;
+        if (i < 0) {
+            negative = true;
+            i = -i;
+        }
+        while (i) {
+            *--p = static_cast<unsigned short>((i % 10) + '0');
+            i /= 10;
+        }
+        if (negative)
+            *--p = '-';
+    }
+
+    return UString(p, static_cast<int>(end - p));
+}
+
 UString UString::from(unsigned int u)
 {
     UChar buf[sizeof(u) * 3];
@@ -994,6 +1028,8 @@ UString UString::from(double d)
     // avoid ever printing -NaN, in JS conceptually there is only one NaN value
     if (isnan(d))
         return "NaN";
+    if (!d)
+        return "0"; // -0 -> "0"
 
     char buf[80];
     int decimalPoint;
@@ -1076,8 +1112,8 @@ UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, in
     if (totalLength == 0)
         return "";
 
-    UChar* buffer = allocChars(totalLength);
-    if (!buffer)
+    UChar* buffer;
+    if (!allocChars(totalLength).getValue(buffer))
         return null();
 
     int maxCount = max(rangeCount, separatorCount);
@@ -1105,8 +1141,8 @@ UString UString::replaceRange(int rangeStart, int rangeLength, const UString& re
     if (totalLength == 0)
         return "";
 
-    UChar* buffer = allocChars(totalLength);
-    if (!buffer)
+    UChar* buffer;
+    if (!allocChars(totalLength).getValue(buffer))
         return null();
 
     copyChars(buffer, data(), rangeStart);
@@ -1153,8 +1189,8 @@ UString& UString::append(const UString &t)
     } else {
         // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
-        UChar* d = allocChars(newCapacity);
-        if (!d)
+        UChar* d;
+        if (!allocChars(newCapacity).getValue(d))
             makeNull();
         else {
             copyChars(d, data(), thisSize);
@@ -1176,18 +1212,6 @@ UString& UString::append(const UChar* tData, int tSize)
     return *this;
 }
 
-UString& UString::appendNumeric(int i)
-{
-    m_rep = concatenate(rep(), i);
-    return *this;
-}
-
-UString& UString::appendNumeric(double d)
-{
-    m_rep = concatenate(rep(), d);
-    return *this;
-}
-
 UString& UString::append(const char* t)
 {
     m_rep = concatenate(m_rep.release(), t);
@@ -1206,8 +1230,8 @@ UString& UString::append(UChar c)
     if (length == 0) {
         // this is empty - must make a new m_rep because we don't want to pollute the shared empty one 
         size_t newCapacity = expandedSize(1, 0);
-        UChar* d = allocChars(newCapacity);
-        if (!d)
+        UChar* d;
+        if (!allocChars(newCapacity).getValue(d))
             makeNull();
         else {
             d[0] = c;
@@ -1234,8 +1258,8 @@ UString& UString::append(UChar c)
     } else {
         // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length + 1, 0);
-        UChar* d = allocChars(newCapacity);
-        if (!d)
+        UChar* d;
+        if (!allocChars(newCapacity).getValue(d))
             makeNull();
         else {
             copyChars(d, data(), length);
@@ -1313,8 +1337,7 @@ UString& UString::operator=(const char* c)
         m_rep->_hash = 0;
         m_rep->len = l;
     } else {
-        d = allocChars(l);
-        if (!d) {
+        if (!allocChars(l).getValue(d)) {
             makeNull();
             return *this;
         }
diff --git a/JavaScriptCore/runtime/UString.h b/JavaScriptCore/runtime/UString.h
index d01b75d..c4dad2a 100644
--- a/JavaScriptCore/runtime/UString.h
+++ b/JavaScriptCore/runtime/UString.h
@@ -91,7 +91,8 @@ namespace JSC {
             {
                 // Guard against integer overflow
                 if (size < (std::numeric_limits<size_t>::max() / sizeof(UChar))) {
-                    if (void * buf = tryFastMalloc(size * sizeof(UChar)))
+                    void* buf = 0;
+                    if (tryFastMalloc(size * sizeof(UChar)).getValue(buf))
                         return adoptRef(new BaseString(static_cast<UChar*>(buf), 0, size));
                 }
                 return adoptRef(new BaseString(0, 0, 0));
@@ -256,6 +257,7 @@ namespace JSC {
         }
 
         static UString from(int);
+        static UString from(long long);
         static UString from(unsigned int);
         static UString from(long);
         static UString from(double);
@@ -285,8 +287,6 @@ namespace JSC {
         UString& append(UChar);
         UString& append(char c) { return append(static_cast<UChar>(static_cast<unsigned char>(c))); }
         UString& append(const UChar*, int size);
-        UString& appendNumeric(int);
-        UString& appendNumeric(double);
 
         bool getCString(CStringBuffer&) const;
 
diff --git a/JavaScriptCore/wrec/WRECGenerator.cpp b/JavaScriptCore/wrec/WRECGenerator.cpp
index e2e8aba..e62add3 100644
--- a/JavaScriptCore/wrec/WRECGenerator.cpp
+++ b/JavaScriptCore/wrec/WRECGenerator.cpp
@@ -42,8 +42,8 @@ void Generator::generateEnter()
 {
 #if PLATFORM(X86)
     // On x86 edi & esi are callee preserved registers.
-    push(X86::edi);
-    push(X86::esi);
+    push(X86Registers::edi);
+    push(X86Registers::esi);
     
 #if COMPILER(MSVC)
     // Move the arguments into registers.
@@ -72,8 +72,8 @@ void Generator::generateReturnSuccess()
     
     // Restore callee save registers.
 #if PLATFORM(X86)
-    pop(X86::esi);
-    pop(X86::edi);
+    pop(X86Registers::esi);
+    pop(X86Registers::edi);
 #endif
     ret();
 }
@@ -111,8 +111,8 @@ void Generator::generateReturnFailure()
     move(Imm32(-1), returnRegister);
 
 #if PLATFORM(X86)
-    pop(X86::esi);
-    pop(X86::edi);
+    pop(X86Registers::esi);
+    pop(X86Registers::edi);
 #endif
     ret();
 }
diff --git a/JavaScriptCore/wrec/WRECGenerator.h b/JavaScriptCore/wrec/WRECGenerator.h
index 8562cac..294c3d0 100644
--- a/JavaScriptCore/wrec/WRECGenerator.h
+++ b/JavaScriptCore/wrec/WRECGenerator.h
@@ -63,26 +63,26 @@ namespace JSC {
         }
 
 #if PLATFORM(X86)
-        static const RegisterID input = X86::eax;
-        static const RegisterID index = X86::edx;
-        static const RegisterID length = X86::ecx;
-        static const RegisterID output = X86::edi;
+        static const RegisterID input = X86Registers::eax;
+        static const RegisterID index = X86Registers::edx;
+        static const RegisterID length = X86Registers::ecx;
+        static const RegisterID output = X86Registers::edi;
 
-        static const RegisterID character = X86::esi;
-        static const RegisterID repeatCount = X86::ebx; // How many times the current atom repeats in the current match.
+        static const RegisterID character = X86Registers::esi;
+        static const RegisterID repeatCount = X86Registers::ebx; // How many times the current atom repeats in the current match.
 
-        static const RegisterID returnRegister = X86::eax;
+        static const RegisterID returnRegister = X86Registers::eax;
 #endif
 #if PLATFORM(X86_64)
-        static const RegisterID input = X86::edi;
-        static const RegisterID index = X86::esi;
-        static const RegisterID length = X86::edx;
-        static const RegisterID output = X86::ecx;
+        static const RegisterID input = X86Registers::edi;
+        static const RegisterID index = X86Registers::esi;
+        static const RegisterID length = X86Registers::edx;
+        static const RegisterID output = X86Registers::ecx;
 
-        static const RegisterID character = X86::eax;
-        static const RegisterID repeatCount = X86::ebx; // How many times the current atom repeats in the current match.
+        static const RegisterID character = X86Registers::eax;
+        static const RegisterID repeatCount = X86Registers::ebx; // How many times the current atom repeats in the current match.
 
-        static const RegisterID returnRegister = X86::eax;
+        static const RegisterID returnRegister = X86Registers::eax;
 #endif
 
         void generateEnter();
diff --git a/JavaScriptCore/wscript b/JavaScriptCore/wscript
index df11430..7a5ba1b 100644
--- a/JavaScriptCore/wscript
+++ b/JavaScriptCore/wscript
@@ -30,15 +30,15 @@ import commands
 from settings import *
 
 jscore_excludes = ['jsc.cpp', 'ucptable.cpp', 'GOwnPtr.cpp']
-jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp']))
+jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp', '*Symbian.cpp']))
 
 sources = []
 
 jscore_excludes.extend(get_excludes(jscore_dir, ['*Win.cpp', '*None.cpp']))
 
 if building_on_win32:
-    jscore_excludes.append('ExecutableAllocatorPosix.cpp')
-    sources.append('jit/ExecutableAllocatorWin.cpp')
+    jscore_excludes += ['ExecutableAllocatorPosix.cpp', 'MarkStackPosix.cpp']
+    sources += ['jit/ExecutableAllocatorWin.cpp', 'runtime/MarkStackWin.cpp']
 else:
     jscore_excludes.append('JSStringRefBSTR.cpp')
 
@@ -62,17 +62,14 @@ def set_options(opt):
     common_set_options(opt)
 
 def configure(conf):
-    common_configure(conf)    
+    common_configure(conf)
+    generate_jscore_derived_sources()
     
 def build(bld):
     import Options
 
-    generate_jscore_derived_sources()
-
     full_dirs = get_dirs_for_features(jscore_dir, features=[build_port], dirs=jscore_dirs)
 
-    print 'full_dirs = %r' % full_dirs
-
     includes = common_includes + full_dirs
 
     # 1. A simple program
@@ -81,7 +78,7 @@ def build(bld):
         includes = '. .. assembler wrec DerivedSources ForwardingHeaders ' + ' '.join(includes),
         source = sources,
         target = 'jscore',
-        uselib = 'WX ICU ' + waf_configname,
+        uselib = 'WX ICU ' + get_config(),
         uselib_local = '',
         install_path = output_dir)
 
@@ -92,15 +89,15 @@ def build(bld):
         includes = '. .. assembler wrec DerivedSources ForwardingHeaders ' + ' '.join(includes),
         source = 'jsc.cpp',
         target = 'jsc',
-        uselib = 'WX ICU ' + waf_configname,
+        uselib = 'WX ICU ' + get_config(),
         uselib_local = 'jscore',
         install_path = output_dir,
         )
         
     # we'll get an error if exceptions are on because of an unwind error when using __try
     if building_on_win32:
-        flags = obj.env.CPPFLAGS
+        flags = obj.env.CXXFLAGS
         flags.remove('/EHsc')
-        obj.env.CPPFLAGS = flags
+        obj.env.CXXFLAGS = flags
 
     bld.install_files(os.path.join(output_dir, 'JavaScriptCore'), 'API/*.h')
diff --git a/JavaScriptCore/wtf/Assertions.cpp b/JavaScriptCore/wtf/Assertions.cpp
index 819ed9a..6c5e2e3 100644
--- a/JavaScriptCore/wtf/Assertions.cpp
+++ b/JavaScriptCore/wtf/Assertions.cpp
@@ -105,7 +105,11 @@ static void vprintf_stderr_common(const char* format, va_list args)
         } while (size > 1024);
     }
 #endif
+#if PLATFORM(SYMBIAN)
+    vfprintf(stdout, format, args);
+#else
     vfprintf(stderr, format, args);
+#endif
 }
 
 WTF_ATTRIBUTE_PRINTF(1, 2)
diff --git a/JavaScriptCore/wtf/Assertions.h b/JavaScriptCore/wtf/Assertions.h
index 59efd84..e3340f1 100644
--- a/JavaScriptCore/wtf/Assertions.h
+++ b/JavaScriptCore/wtf/Assertions.h
@@ -50,6 +50,11 @@
 #include <inttypes.h>
 #endif
 
+#if PLATFORM(SYMBIAN)
+#include <e32def.h>
+#include <e32debug.h>
+#endif
+
 #ifdef NDEBUG
 #define ASSERTIONS_DISABLED_DEFAULT 1
 #else
@@ -120,11 +125,18 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 /* CRASH -- gets us into the debugger or the crash reporter -- signals are ignored by the crash reporter so we must do better */
 
 #ifndef CRASH
+#if PLATFORM(SYMBIAN)
+#define CRASH() do { \
+    __DEBUGGER(); \
+    User::Panic(_L("Webkit CRASH"),0); \
+    } while(false)
+#else
 #define CRASH() do { \
     *(int *)(uintptr_t)0xbbadbeef = 0; \
     ((void(*)())0)(); /* More reliable, but doesn't say BBADBEEF */ \
 } while(false)
 #endif
+#endif
 
 /* ASSERT, ASSERT_WITH_MESSAGE, ASSERT_NOT_REACHED */
 
@@ -144,7 +156,11 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 #if ASSERT_DISABLED
 
 #define ASSERT(assertion) ((void)0)
+#if COMPILER(MSVC7) || COMPILER(WINSCW)
+#define ASSERT_WITH_MESSAGE(assertion) ((void)0)
+#else
 #define ASSERT_WITH_MESSAGE(assertion, ...) ((void)0)
+#endif /* COMPILER(MSVC7) */
 #define ASSERT_NOT_REACHED() ((void)0)
 #define ASSERT_UNUSED(variable, assertion) ((void)variable)
 
@@ -156,7 +172,7 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
         CRASH(); \
     } \
 while (0)
-#if COMPILER(MSVC7)
+#if COMPILER(MSVC7) || COMPILER(WINSCW)
 #define ASSERT_WITH_MESSAGE(assertion) ((void)0)
 #else
 #define ASSERT_WITH_MESSAGE(assertion, ...) do \
@@ -199,7 +215,7 @@ while (0)
 
 /* FATAL */
 
-#if FATAL_DISABLED
+#if FATAL_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
 #define FATAL(...) ((void)0)
 #elif COMPILER(MSVC7)
 #define FATAL() ((void)0)
@@ -212,9 +228,9 @@ while (0)
 
 /* LOG_ERROR */
 
-#if ERROR_DISABLED
+#if ERROR_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
 #define LOG_ERROR(...) ((void)0)
-#elif COMPILER(MSVC7)
+#elif COMPILER(MSVC7) || COMPILER(WINSCW)
 #define LOG_ERROR() ((void)0)
 #else
 #define LOG_ERROR(...) WTFReportError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, __VA_ARGS__)
@@ -222,9 +238,9 @@ while (0)
 
 /* LOG */
 
-#if LOG_DISABLED
+#if LOG_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
 #define LOG(channel, ...) ((void)0)
-#elif COMPILER(MSVC7)
+#elif COMPILER(MSVC7) || COMPILER(WINSCW)
 #define LOG() ((void)0)
 #else
 #define LOG(channel, ...) WTFLog(&JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
@@ -234,9 +250,9 @@ while (0)
 
 /* LOG_VERBOSE */
 
-#if LOG_DISABLED
+#if LOG_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
 #define LOG_VERBOSE(channel, ...) ((void)0)
-#elif COMPILER(MSVC7)
+#elif COMPILER(MSVC7) || COMPILER(WINSCW)
 #define LOG_VERBOSE(channel) ((void)0)
 #else
 #define LOG_VERBOSE(channel, ...) WTFLogVerbose(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, &JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
diff --git a/JavaScriptCore/wtf/ByteArray.h b/JavaScriptCore/wtf/ByteArray.h
index 96e9cc2..f5f5ded 100644
--- a/JavaScriptCore/wtf/ByteArray.h
+++ b/JavaScriptCore/wtf/ByteArray.h
@@ -45,6 +45,13 @@ namespace WTF {
             m_data[index] = static_cast<unsigned char>(value + 0.5);
         }
 
+        void set(unsigned index, unsigned char value)
+        {
+            if (index >= m_size)
+                return;
+            m_data[index] = value;
+        }
+
         bool get(unsigned index, unsigned char& result) const
         {
             if (index >= m_size)
@@ -53,6 +60,12 @@ namespace WTF {
             return true;
         }
 
+        unsigned char get(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            return m_data[index];
+        }
+
         unsigned char* data() { return m_data; }
 
         void deref()
diff --git a/JavaScriptCore/wtf/CrossThreadRefCounted.h b/JavaScriptCore/wtf/CrossThreadRefCounted.h
index 6a05211..f682f0d 100644
--- a/JavaScriptCore/wtf/CrossThreadRefCounted.h
+++ b/JavaScriptCore/wtf/CrossThreadRefCounted.h
@@ -70,10 +70,6 @@ namespace WTF {
             return !m_refCounter.hasOneRef() || (m_threadSafeRefCounter && !m_threadSafeRefCounter->hasOneRef());
         }
 
-#ifndef NDEBUG
-        bool mayBePassedToAnotherThread() const { ASSERT(!m_threadId); return m_refCounter.hasOneRef(); }
-#endif
-
     private:
         CrossThreadRefCounted(T* data, ThreadSafeSharedBase* threadedCounter)
             : m_threadSafeRefCounter(threadedCounter)
@@ -92,6 +88,10 @@ namespace WTF {
 
         void threadSafeDeref();
 
+#ifndef NDEBUG
+        bool isOwnedByCurrentThread() const { return !m_threadId || m_threadId == currentThread(); }
+#endif
+
         RefCountedBase m_refCounter;
         ThreadSafeSharedBase* m_threadSafeRefCounter;
         T* m_data;
@@ -103,7 +103,7 @@ namespace WTF {
     template<class T>
     void CrossThreadRefCounted<T>::ref()
     {
-        ASSERT(!m_threadId || m_threadId == currentThread());
+        ASSERT(isOwnedByCurrentThread());
         m_refCounter.ref();
 #ifndef NDEBUG
         // Store the threadId as soon as the ref count gets to 2.
@@ -119,7 +119,7 @@ namespace WTF {
     template<class T>
     void CrossThreadRefCounted<T>::deref()
     {
-        ASSERT(!m_threadId || m_threadId == currentThread());
+        ASSERT(isOwnedByCurrentThread());
         if (m_refCounter.derefBase()) {
             threadSafeDeref();
             delete this;
@@ -146,10 +146,12 @@ namespace WTF {
     template<class T>
     PassRefPtr<CrossThreadRefCounted<T> > CrossThreadRefCounted<T>::crossThreadCopy()
     {
+        ASSERT(isOwnedByCurrentThread());
         if (m_threadSafeRefCounter)
             m_threadSafeRefCounter->ref();
         else
             m_threadSafeRefCounter = new ThreadSafeSharedBase(2);
+
         return adoptRef(new CrossThreadRefCounted<T>(m_data, m_threadSafeRefCounter));
     }
 
diff --git a/JavaScriptCore/wtf/DateMath.cpp b/JavaScriptCore/wtf/DateMath.cpp
index 6a5b22f..0386494 100644
--- a/JavaScriptCore/wtf/DateMath.cpp
+++ b/JavaScriptCore/wtf/DateMath.cpp
@@ -65,7 +65,7 @@
 #include <notify.h>
 #endif
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if PLATFORM(WINCE)
 extern "C" size_t strftime(char * const s, const size_t maxsize, const char * const format, const struct tm * const t);
 extern "C" struct tm * localtime(const time_t *timer);
 #endif
diff --git a/JavaScriptCore/wtf/DisallowCType.h b/JavaScriptCore/wtf/DisallowCType.h
index 5dccb0e..436f7f2 100644
--- a/JavaScriptCore/wtf/DisallowCType.h
+++ b/JavaScriptCore/wtf/DisallowCType.h
@@ -54,21 +54,21 @@
 #undef tolower
 #undef toupper
 
-#define isalnum WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isalpha WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isascii WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isblank WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define iscntrl WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isdigit WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isgraph WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define islower WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isprint WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define ispunct WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isspace WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isupper WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isxdigit WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define toascii WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define tolower WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define toupper WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isalnum isalnum_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isalpha isalpha_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isascii isascii_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isblank isblank_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define iscntrl iscntrl_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isdigit isdigit_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isgraph isgraph_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define islower islower_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isprint isprint_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define ispunct ispunct_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isspace isspace_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isupper isupper_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isxdigit isxdigit_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define toascii toascii_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define tolower tolower_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define toupper toupper_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
 
 #endif
diff --git a/JavaScriptCore/wtf/FastAllocBase.h b/JavaScriptCore/wtf/FastAllocBase.h
index 9fcbbc1..81b1de0 100644
--- a/JavaScriptCore/wtf/FastAllocBase.h
+++ b/JavaScriptCore/wtf/FastAllocBase.h
@@ -301,6 +301,16 @@ namespace WTF {
         fastFree(p);
     }
 
+    template <typename T>
+    inline void fastDeleteSkippingDestructor(T* p)
+    {
+        if (!p)
+            return;
+
+        fastMallocMatchValidateFree(p, Internal::AllocTypeFastNew);
+        fastFree(p);
+    }
+
     namespace Internal {
         // This is a support template for fastDeleteArray.
         // This handles the case wherein T has a trivial dtor.
@@ -397,7 +407,7 @@ namespace WTF {
 
 } // namespace WTF
 
-// Using WTF::FastAllocBase to avoid using FastAllocBase's explicit qualification by WTF::.
 using WTF::FastAllocBase;
+using WTF::fastDeleteSkippingDestructor;
 
 #endif // FastAllocBase_h
diff --git a/JavaScriptCore/wtf/FastMalloc.cpp b/JavaScriptCore/wtf/FastMalloc.cpp
index c14b755..6cd8ef0 100644
--- a/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/JavaScriptCore/wtf/FastMalloc.cpp
@@ -178,10 +178,10 @@ void* fastZeroedMalloc(size_t n)
     return result;
 }
     
-void* tryFastZeroedMalloc(size_t n) 
+TryMallocReturnValue tryFastZeroedMalloc(size_t n) 
 {
-    void* result = tryFastMalloc(n);
-    if (!result)
+    void* result;
+    if (!tryFastMalloc(n).getValue(result))
         return 0;
     memset(result, 0, n);
     return result;
@@ -200,7 +200,7 @@ void* tryFastZeroedMalloc(size_t n)
 
 namespace WTF {
 
-void* tryFastMalloc(size_t n) 
+TryMallocReturnValue tryFastMalloc(size_t n) 
 {
     ASSERT(!isForbidden());
 
@@ -226,7 +226,9 @@ void* fastMalloc(size_t n)
     ASSERT(!isForbidden());
 
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
-    void* result = tryFastMalloc(n);
+    TryMallocReturnValue returnValue = tryFastMalloc(n);
+    void* result;
+    returnValue.getValue(result);
 #else
     void* result = malloc(n);
 #endif
@@ -236,7 +238,7 @@ void* fastMalloc(size_t n)
     return result;
 }
 
-void* tryFastCalloc(size_t n_elements, size_t element_size)
+TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size)
 {
     ASSERT(!isForbidden());
 
@@ -264,7 +266,9 @@ void* fastCalloc(size_t n_elements, size_t element_size)
     ASSERT(!isForbidden());
 
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
-    void* result = tryFastCalloc(n_elements, element_size);
+    TryMallocReturnValue returnValue = tryFastCalloc(n_elements, element_size);
+    void* result;
+    returnValue.getValue(result);
 #else
     void* result = calloc(n_elements, element_size);
 #endif
@@ -291,7 +295,7 @@ void fastFree(void* p)
 #endif
 }
 
-void* tryFastRealloc(void* p, size_t n)
+TryMallocReturnValue tryFastRealloc(void* p, size_t n)
 {
     ASSERT(!isForbidden());
 
@@ -323,7 +327,9 @@ void* fastRealloc(void* p, size_t n)
     ASSERT(!isForbidden());
 
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
-    void* result = tryFastRealloc(p, n);
+    TryMallocReturnValue returnValue = tryFastRealloc(p, n);
+    void* result;
+    returnValue.getValue(result);
 #else
     void* result = realloc(p, n);
 #endif
@@ -373,6 +379,9 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdio.h>
+#if PLATFORM(UNIX)
+#include <unistd.h>
+#endif
 #if COMPILER(MSVC)
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
@@ -385,6 +394,7 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #if PLATFORM(DARWIN)
 #include "MallocZoneSupport.h"
 #include <wtf/HashSet.h>
+#include <wtf/Vector.h>
 #endif
 
 #ifndef PRIuS
@@ -539,7 +549,7 @@ static const size_t kNumClasses = 68;
 static const size_t kPageMapBigAllocationThreshold = 128 << 20;
 
 // Minimum number of pages to fetch from system at a time.  Must be
-// significantly bigger than kBlockSize to amortize system-call
+// significantly bigger than kPageSize to amortize system-call
 // overhead, and also to reduce external fragementation.  Also, we
 // should keep this value big because various incarnations of Linux
 // have small limits on the number of mmap() regions per
@@ -2268,7 +2278,7 @@ static inline TCMalloc_PageHeap* getPageHeap()
 #define pageheap getPageHeap()
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-#if PLATFORM(WIN)
+#if PLATFORM(WIN_OS)
 static void sleep(unsigned seconds)
 {
     ::Sleep(seconds * 1000);
@@ -2277,6 +2287,10 @@ static void sleep(unsigned seconds)
 
 void TCMalloc_PageHeap::scavengerThread()
 {
+#if HAVE(PTHREAD_SETNAME_NP)
+  pthread_setname_np("JavaScriptCore: FastMalloc scavenger");
+#endif
+
   while (1) {
       if (!shouldContinueScavenging()) {
           pthread_mutex_lock(&m_scavengeMutex);
@@ -2382,7 +2396,7 @@ ALWAYS_INLINE void TCMalloc_Central_FreeList::ReleaseToSpans(void* object) {
   // The following check is expensive, so it is disabled by default
   if (false) {
     // Check that object does not occur in list
-    int got = 0;
+    unsigned got = 0;
     for (void* p = span->objects; p != NULL; p = *((void**) p)) {
       ASSERT(p != object);
       got++;
@@ -3576,7 +3590,7 @@ void* fastMalloc(size_t size)
     return malloc<true>(size);
 }
 
-void* tryFastMalloc(size_t size)
+TryMallocReturnValue tryFastMalloc(size_t size)
 {
     return malloc<false>(size);
 }
@@ -3637,7 +3651,7 @@ void* fastCalloc(size_t n, size_t elem_size)
     return calloc<true>(n, elem_size);
 }
 
-void* tryFastCalloc(size_t n, size_t elem_size)
+TryMallocReturnValue tryFastCalloc(size_t n, size_t elem_size)
 {
     return calloc<false>(n, elem_size);
 }
@@ -3701,7 +3715,7 @@ void* fastRealloc(void* old_ptr, size_t new_size)
     return realloc<true>(old_ptr, new_size);
 }
 
-void* tryFastRealloc(void* old_ptr, size_t new_size)
+TryMallocReturnValue tryFastRealloc(void* old_ptr, size_t new_size)
 {
     return realloc<false>(old_ptr, new_size);
 }
diff --git a/JavaScriptCore/wtf/FastMalloc.h b/JavaScriptCore/wtf/FastMalloc.h
index 787251f..ca0961c 100644
--- a/JavaScriptCore/wtf/FastMalloc.h
+++ b/JavaScriptCore/wtf/FastMalloc.h
@@ -22,6 +22,7 @@
 #define WTF_FastMalloc_h
 
 #include "Platform.h"
+#include "PossiblyNull.h"
 #include <stdlib.h>
 #include <new>
 
@@ -33,11 +34,42 @@ namespace WTF {
     void* fastCalloc(size_t numElements, size_t elementSize);
     void* fastRealloc(void*, size_t);
 
-    // These functions return 0 if an allocation fails.
-    void* tryFastMalloc(size_t);
-    void* tryFastZeroedMalloc(size_t);
-    void* tryFastCalloc(size_t numElements, size_t elementSize);
-    void* tryFastRealloc(void*, size_t);
+    struct TryMallocReturnValue {
+        TryMallocReturnValue(void* data)
+            : m_data(data)
+        {
+        }
+        TryMallocReturnValue(const TryMallocReturnValue& source)
+            : m_data(source.m_data)
+        {
+            source.m_data = 0;
+        }
+        ~TryMallocReturnValue() { ASSERT(!m_data); }
+        template <typename T> bool getValue(T& data) WARN_UNUSED_RETURN;
+        template <typename T> operator PossiblyNull<T>()
+        { 
+            T value; 
+            getValue(value); 
+            return PossiblyNull<T>(value);
+        } 
+    private:
+        mutable void* m_data;
+    };
+    
+    template <typename T> bool TryMallocReturnValue::getValue(T& data)
+    {
+        union u { void* data; T target; } res;
+        res.data = m_data;
+        data = res.target;
+        bool returnValue = !!m_data;
+        m_data = 0;
+        return returnValue;
+    }
+
+    TryMallocReturnValue tryFastMalloc(size_t n);
+    TryMallocReturnValue tryFastZeroedMalloc(size_t n);
+    TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size);
+    TryMallocReturnValue tryFastRealloc(void* p, size_t n);
 
     void fastFree(void*);
 
@@ -181,6 +213,9 @@ using WTF::fastMallocAllow;
 // debug-only code to make sure we don't use the system malloc via the default operator
 // new by accident.
 
+// We musn't customize the global operator new and delete for the Qt port.
+#if !PLATFORM(QT)
+
 WTF_PRIVATE_INLINE void* operator new(size_t size) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new(size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void operator delete(void* p) { fastFree(p); }
@@ -192,4 +227,6 @@ WTF_PRIVATE_INLINE void operator delete[](void* p, const std::nothrow_t&) throw(
 
 #endif
 
+#endif
+
 #endif /* WTF_FastMalloc_h */
diff --git a/JavaScriptCore/wtf/Forward.h b/JavaScriptCore/wtf/Forward.h
index 67dc3be..448de7d 100644
--- a/JavaScriptCore/wtf/Forward.h
+++ b/JavaScriptCore/wtf/Forward.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2006 Apple Computer, Inc.
+ *  Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -27,6 +27,7 @@ namespace WTF {
     template<typename T> class ListRefPtr;
     template<typename T> class OwnArrayPtr;
     template<typename T> class OwnPtr;
+    template<typename T> class PassOwnPtr;
     template<typename T> class PassRefPtr;
     template<typename T> class RefPtr;
     template<typename T, size_t inlineCapacity> class Vector;
@@ -35,9 +36,9 @@ namespace WTF {
 using WTF::ListRefPtr;
 using WTF::OwnArrayPtr;
 using WTF::OwnPtr;
+using WTF::PassOwnPtr;
 using WTF::PassRefPtr;
 using WTF::RefPtr;
 using WTF::Vector;
 
 #endif // WTF_Forward_h
-
diff --git a/JavaScriptCore/wtf/HashCountedSet.h b/JavaScriptCore/wtf/HashCountedSet.h
index 1a422d8..165eb41 100644
--- a/JavaScriptCore/wtf/HashCountedSet.h
+++ b/JavaScriptCore/wtf/HashCountedSet.h
@@ -49,23 +49,28 @@ namespace WTF {
         const_iterator begin() const;
         const_iterator end() const;
         
-        iterator find(const ValueType& value);
-        const_iterator find(const ValueType& value) const;
-        bool contains(const ValueType& value) const;
-        unsigned count(const ValueType& value) const;
+        iterator find(const ValueType&);
+        const_iterator find(const ValueType&) const;
+        bool contains(const ValueType&) const;
+        unsigned count(const ValueType&) const;
 
         // increases the count if an equal value is already present
         // the return value is a pair of an interator to the new value's location, 
         // and a bool that is true if an new entry was added
-        std::pair<iterator, bool> add(const ValueType &value);
+        std::pair<iterator, bool> add(const ValueType&);
         
         // reduces the count of the value, and removes it if count
         // goes down to zero
-        void remove(const ValueType& value);
-        void remove(iterator it);
+        void remove(const ValueType&);
+        void remove(iterator);
  
-       void clear();
-        
+        // removes the value, regardless of its count
+        void removeAll(iterator);
+        void removeAll(const ValueType&);
+
+        // clears the whole set
+        void clear();
+
     private:
         ImplType m_impl;
     };
@@ -166,6 +171,21 @@ namespace WTF {
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
+    inline void HashCountedSet<Value, HashFunctions, Traits>::removeAll(const ValueType& value)
+    {
+        removeAll(find(value));
+    }
+    
+    template<typename Value, typename HashFunctions, typename Traits>
+    inline void HashCountedSet<Value, HashFunctions, Traits>::removeAll(iterator it)
+    {
+        if (it == end())
+            return;
+
+        m_impl.remove(it);
+    }
+    
+    template<typename Value, typename HashFunctions, typename Traits>
     inline void HashCountedSet<Value, HashFunctions, Traits>::clear()
     {
         m_impl.clear(); 
diff --git a/JavaScriptCore/wtf/HashSet.h b/JavaScriptCore/wtf/HashSet.h
index 990670d..f4e2cf7 100644
--- a/JavaScriptCore/wtf/HashSet.h
+++ b/JavaScriptCore/wtf/HashSet.h
@@ -29,6 +29,8 @@ namespace WTF {
     template<typename Value, typename HashFunctions, typename Traits> class HashSet;
     template<typename Value, typename HashFunctions, typename Traits>
     void deleteAllValues(const HashSet<Value, HashFunctions, Traits>&);
+    template<typename Value, typename HashFunctions, typename Traits>
+    void fastDeleteAllValues(const HashSet<Value, HashFunctions, Traits>&);
 
     template<typename T> struct IdentityExtractor;
 
@@ -91,6 +93,7 @@ namespace WTF {
 
     private:
         friend void deleteAllValues<>(const HashSet&);
+        friend void fastDeleteAllValues<>(const HashSet&);
 
         HashTableType m_impl;
     };
@@ -251,6 +254,21 @@ namespace WTF {
     {
         deleteAllValues<typename HashSet<T, U, V>::ValueType>(collection.m_impl);
     }
+
+    template<typename ValueType, typename HashTableType>
+    void fastDeleteAllValues(HashTableType& collection)
+    {
+        typedef typename HashTableType::const_iterator iterator;
+        iterator end = collection.end();
+        for (iterator it = collection.begin(); it != end; ++it)
+            fastDelete(*it);
+    }
+
+    template<typename T, typename U, typename V>
+    inline void fastDeleteAllValues(const HashSet<T, U, V>& collection)
+    {
+        fastDeleteAllValues<typename HashSet<T, U, V>::ValueType>(collection.m_impl);
+    }
     
     template<typename T, typename U, typename V, typename W>
     inline void copyToVector(const HashSet<T, U, V>& collection, W& vector)
diff --git a/JavaScriptCore/wtf/ListRefPtr.h b/JavaScriptCore/wtf/ListRefPtr.h
index 9f9a354..8bf6447 100644
--- a/JavaScriptCore/wtf/ListRefPtr.h
+++ b/JavaScriptCore/wtf/ListRefPtr.h
@@ -34,13 +34,8 @@ namespace WTF {
         ListRefPtr(const RefPtr<T>& o) : RefPtr<T>(o) {}
         // see comment in PassRefPtr.h for why this takes const reference
         template <typename U> ListRefPtr(const PassRefPtr<U>& o) : RefPtr<T>(o) {}
-
-        ~ListRefPtr()
-        {
-            RefPtr<T> reaper = this->release();
-            while (reaper && reaper->hasOneRef())
-                reaper = reaper->releaseNext(); // implicitly protects reaper->next, then derefs reaper
-        }
+        
+        ~ListRefPtr();
         
         ListRefPtr& operator=(T* optr) { RefPtr<T>::operator=(optr); return *this; }
         ListRefPtr& operator=(const RefPtr<T>& o) { RefPtr<T>::operator=(o); return *this; }
@@ -49,6 +44,20 @@ namespace WTF {
         template <typename U> ListRefPtr& operator=(const PassRefPtr<U>& o) { RefPtr<T>::operator=(o); return *this; }
     };
 
+    // Remove inline for winscw compiler to prevent the compiler agressively resolving
+    // T::ref() in RefPtr<T>'s copy constructor.  The bug is reported at:
+    // https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+    template <typename T> 
+#if !COMPILER(WINSCW)
+    inline
+#endif
+    ListRefPtr<T>::~ListRefPtr()
+    {
+        RefPtr<T> reaper = this->release();
+        while (reaper && reaper->hasOneRef())
+            reaper = reaper->releaseNext(); // implicitly protects reaper->next, then derefs reaper
+    }
+
     template <typename T> inline T* getPtr(const ListRefPtr<T>& p)
     {
         return p.get();
diff --git a/JavaScriptCore/wtf/PassRefPtr.h b/JavaScriptCore/wtf/PassRefPtr.h
index d80ed62..36ba78e 100644
--- a/JavaScriptCore/wtf/PassRefPtr.h
+++ b/JavaScriptCore/wtf/PassRefPtr.h
@@ -28,6 +28,19 @@ namespace WTF {
     template<typename T> class RefPtr;
     template<typename T> class PassRefPtr;
     template <typename T> PassRefPtr<T> adoptRef(T*);
+    
+    // Remove inline for winscw compiler to prevent the compiler agressively resolving 
+    // T::deref(), which will fail compiling when PassRefPtr<T> is used as class member 
+    // or function arguments before T is defined.
+    template<typename T> 
+#if !COMPILER(WINSCW)
+    inline 
+#endif
+    void derefIfNotNull(T* ptr)
+    {
+        if (UNLIKELY(ptr != 0))
+            ptr->deref();
+    }
 
     template<typename T> class PassRefPtr {
     public:
@@ -40,8 +53,8 @@ namespace WTF {
         PassRefPtr(const PassRefPtr& o) : m_ptr(o.releaseRef()) {}
         template <typename U> PassRefPtr(const PassRefPtr<U>& o) : m_ptr(o.releaseRef()) { }
 
-        ALWAYS_INLINE ~PassRefPtr() { if (UNLIKELY(m_ptr != 0)) m_ptr->deref(); }
-        
+        ALWAYS_INLINE ~PassRefPtr() { derefIfNotNull<T>(m_ptr); }
+
         template <class U> 
         PassRefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { if (T* ptr = m_ptr) ptr->ref(); }
         
@@ -56,12 +69,9 @@ namespace WTF {
         bool operator!() const { return !m_ptr; }
 
         // This conversion operator allows implicit conversion to bool but not to other integer types.
-#if COMPILER(WINSCW)
-        operator bool() const { return m_ptr; }
-#else
-        typedef T* PassRefPtr::*UnspecifiedBoolType;
+        typedef T* (PassRefPtr::*UnspecifiedBoolType);
         operator UnspecifiedBoolType() const { return m_ptr ? &PassRefPtr::m_ptr : 0; }
-#endif
+
         PassRefPtr& operator=(T*);
         PassRefPtr& operator=(const PassRefPtr&);
         template <typename U> PassRefPtr& operator=(const PassRefPtr<U>&);
@@ -74,6 +84,62 @@ namespace WTF {
         mutable T* m_ptr;
     };
     
+    // NonNullPassRefPtr: Optimized for passing non-null pointers. A NonNullPassRefPtr
+    // begins life non-null, and can only become null through a call to releaseRef()
+    // or clear().
+
+    // FIXME: NonNullPassRefPtr could just inherit from PassRefPtr. However,
+    // if we use inheritance, GCC's optimizer fails to realize that destruction
+    // of a released NonNullPassRefPtr is a no-op. So, for now, just copy the
+    // most important code from PassRefPtr.
+    template <typename T> class NonNullPassRefPtr {
+    public:
+        NonNullPassRefPtr(T* ptr)
+            : m_ptr(ptr)
+        {
+            ASSERT(m_ptr);
+            m_ptr->ref();
+        }
+
+        template <class U> NonNullPassRefPtr(const RefPtr<U>& o)
+            : m_ptr(o.get())
+        {
+            ASSERT(m_ptr);
+            m_ptr->ref();
+        }
+
+        NonNullPassRefPtr(const NonNullPassRefPtr& o)
+            : m_ptr(o.releaseRef())
+        {
+            ASSERT(m_ptr);
+        }
+
+        template <class U> NonNullPassRefPtr(const NonNullPassRefPtr<U>& o)
+            : m_ptr(o.releaseRef())
+        {
+            ASSERT(m_ptr);
+        }
+
+        template <class U> NonNullPassRefPtr(const PassRefPtr<U>& o)
+            : m_ptr(o.releaseRef())
+        {
+            ASSERT(m_ptr);
+        }
+
+        ALWAYS_INLINE ~NonNullPassRefPtr() { derefIfNotNull(m_ptr); }
+
+        T* get() const { return m_ptr; }
+
+        void clear() { derefIfNotNull(m_ptr); m_ptr = 0; }
+        T* releaseRef() const { T* tmp = m_ptr; m_ptr = 0; return tmp; }
+
+        T& operator*() const { return *m_ptr; }
+        T* operator->() const { return m_ptr; }
+
+    private:
+        mutable T* m_ptr;
+    };
+
     template <typename T> template <typename U> inline PassRefPtr<T>& PassRefPtr<T>::operator=(const RefPtr<U>& o) 
     {
         T* optr = o.get();
@@ -188,6 +254,7 @@ namespace WTF {
 } // namespace WTF
 
 using WTF::PassRefPtr;
+using WTF::NonNullPassRefPtr;
 using WTF::adoptRef;
 using WTF::static_pointer_cast;
 using WTF::const_pointer_cast;
diff --git a/JavaScriptCore/wtf/Platform.h b/JavaScriptCore/wtf/Platform.h
index 845684e..0f97bfe 100644
--- a/JavaScriptCore/wtf/Platform.h
+++ b/JavaScriptCore/wtf/Platform.h
@@ -108,6 +108,13 @@
 #define WTF_PLATFORM_NETBSD 1
 #endif
 
+/* PLATFORM(QNX) */
+/* Operating system level dependencies for QNX that should be used */
+/* regardless of operating environment */
+#if defined(__QNXNTO__)
+#define WTF_PLATFORM_QNX 1
+#endif
+
 /* PLATFORM(UNIX) */
 /* Operating system level dependencies for Unix-like systems that */
 /* should be used regardless of operating environment */
@@ -118,7 +125,9 @@
    || defined(unix)        \
    || defined(__unix)      \
    || defined(__unix__)    \
-   || defined(_AIX)
+   || defined(_AIX)        \
+   || defined(__HAIKU__)   \
+   || defined(__QNXNTO__)
 #define WTF_PLATFORM_UNIX 1
 #endif
 
@@ -143,6 +152,8 @@
 #define WTF_PLATFORM_WX 1
 #elif defined(BUILDING_GTK__)
 #define WTF_PLATFORM_GTK 1
+#elif defined(BUILDING_HAIKU__)
+#define WTF_PLATFORM_HAIKU 1
 #elif PLATFORM(DARWIN)
 #define WTF_PLATFORM_MAC 1
 #elif PLATFORM(WIN_OS)
@@ -189,7 +200,7 @@
 
 /* Makes PLATFORM(WIN) default to PLATFORM(CAIRO) */
 /* FIXME: This should be changed from a blacklist to a whitelist */
-#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !PLATFORM(WINCE)
+#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !PLATFORM(WINCE) && !PLATFORM(HAIKU)
 #define WTF_PLATFORM_CAIRO 1
 #endif
 
@@ -240,15 +251,27 @@
 #endif
 
 /* PLATFORM(ARM) */
+#define PLATFORM_ARM_ARCH(N) (PLATFORM(ARM) && ARM_ARCH_VERSION >= N)
+
 #if   defined(arm) \
    || defined(__arm__)
 #define WTF_PLATFORM_ARM 1
+
 #if defined(__ARMEB__)
 #define WTF_PLATFORM_BIG_ENDIAN 1
+<<<<<<< HEAD:JavaScriptCore/wtf/Platform.h
 #elif !defined(__ARM_EABI__) && !defined(__EABI__) && !defined(__VFP_FP__)
 #if !defined(ANDROID)
+=======
+
+#elif !defined(__ARM_EABI__) \
+   && !defined(__EABI__) \
+   && !defined(__VFP_FP__)
+>>>>>>> webkit.org at 49305:JavaScriptCore/wtf/Platform.h
 #define WTF_PLATFORM_MIDDLE_ENDIAN 1
+
 #endif
+<<<<<<< HEAD:JavaScriptCore/wtf/Platform.h
 #endif
 #if !defined(__ARM_EABI__) && !defined(__EABI__)
 #define WTF_PLATFORM_FORCE_PACK 1
@@ -256,26 +279,98 @@
 #define ARM_ARCH_VERSION 3
 #if defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__)
 #undef ARM_ARCH_VERSION
+=======
+
+/* Set ARM_ARCH_VERSION */
+#if   defined(__ARM_ARCH_4__) \
+   || defined(__ARM_ARCH_4T__) \
+   || defined(__MARM_ARMV4__) \
+   || defined(_ARMV4I_)
+>>>>>>> webkit.org at 49305:JavaScriptCore/wtf/Platform.h
 #define ARM_ARCH_VERSION 4
-#endif
-#if defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__) \
-        || defined(__ARM_ARCH_5E__) || defined(__ARM_ARCH_5TE__) \
-        || defined(__ARM_ARCH_5TEJ__)
-#undef ARM_ARCH_VERSION
+
+#elif defined(__ARM_ARCH_5__) \
+   || defined(__ARM_ARCH_5T__) \
+   || defined(__ARM_ARCH_5E__) \
+   || defined(__ARM_ARCH_5TE__) \
+   || defined(__ARM_ARCH_5TEJ__) \
+   || defined(__MARM_ARMV5__)
 #define ARM_ARCH_VERSION 5
-#endif
-#if defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__) \
-     || defined(__ARM_ARCH_6K__) || defined(__ARM_ARCH_6Z__) \
-     || defined(__ARM_ARCH_6ZK__)
-#undef ARM_ARCH_VERSION
+
+#elif defined(__ARM_ARCH_6__) \
+   || defined(__ARM_ARCH_6J__) \
+   || defined(__ARM_ARCH_6K__) \
+   || defined(__ARM_ARCH_6Z__) \
+   || defined(__ARM_ARCH_6ZK__) \
+   || defined(__ARM_ARCH_6T2__) \
+   || defined(__ARMV6__)
 #define ARM_ARCH_VERSION 6
-#endif
-#if defined(__ARM_ARCH_7A__)
-#undef ARM_ARCH_VERSION
+
+#elif defined(__ARM_ARCH_7A__) \
+   || defined(__ARM_ARCH_7R__)
 #define ARM_ARCH_VERSION 7
+
+/* RVCT sets _TARGET_ARCH_ARM */
+#elif defined(__TARGET_ARCH_ARM)
+#define ARM_ARCH_VERSION __TARGET_ARCH_ARM
+
+#else
+#define ARM_ARCH_VERSION 0
+
 #endif
+
+/* Set THUMB_ARM_VERSION */
+#if   defined(__ARM_ARCH_4T__)
+#define THUMB_ARCH_VERSION 1
+
+#elif defined(__ARM_ARCH_5T__) \
+   || defined(__ARM_ARCH_5TE__) \
+   || defined(__ARM_ARCH_5TEJ__)
+#define THUMB_ARCH_VERSION 2
+
+#elif defined(__ARM_ARCH_6J__) \
+   || defined(__ARM_ARCH_6K__) \
+   || defined(__ARM_ARCH_6Z__) \
+   || defined(__ARM_ARCH_6ZK__) \
+   || defined(__ARM_ARCH_6M__)
+#define THUMB_ARCH_VERSION 3
+
+#elif defined(__ARM_ARCH_6T2__) \
+   || defined(__ARM_ARCH_7__) \
+   || defined(__ARM_ARCH_7A__) \
+   || defined(__ARM_ARCH_7R__) \
+   || defined(__ARM_ARCH_7M__)
+#define THUMB_ARCH_VERSION 4
+
+/* RVCT sets __TARGET_ARCH_THUMB */
+#elif defined(__TARGET_ARCH_THUMB)
+#define THUMB_ARCH_VERSION __TARGET_ARCH_THUMB
+
+#else
+#define THUMB_ARCH_VERSION 0
+#endif
+
+/* On ARMv5 and below the natural alignment is required. */
+#if !defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_ARCH_VERSION <= 5
+#define ARM_REQUIRE_NATURAL_ALIGNMENT 1
+#endif
+
+/* Defines two pseudo-platforms for ARM and Thumb-2 instruction set. */
+#if !defined(WTF_PLATFORM_ARM_TRADITIONAL) && !defined(WTF_PLATFORM_ARM_THUMB2)
+#  if defined(thumb2) || defined(__thumb2__) \
+  || ((defined(__thumb) || defined(__thumb__)) && THUMB_ARCH_VERSION == 4)
+#    define WTF_PLATFORM_ARM_TRADITIONAL 0
+#    define WTF_PLATFORM_ARM_THUMB2 1
+#  elif PLATFORM_ARM_ARCH(4)
+#    define WTF_PLATFORM_ARM_TRADITIONAL 1
+#    define WTF_PLATFORM_ARM_THUMB2 0
+#  else
+#    error "Not supported ARM architecture"
+#  endif
+#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(ARM_THUMB2) /* Sanity Check */
+#  error "Cannot use both of WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2 platforms"
+#endif // !defined(ARM_TRADITIONAL) && !defined(ARM_THUMB2)
 #endif /* ARM */
-#define PLATFORM_ARM_ARCH(N) (PLATFORM(ARM) && ARM_ARCH_VERSION >= N)
 
 /* PLATFORM(X86) */
 #if   defined(__i386__) \
@@ -298,7 +393,7 @@
 #endif
 
 /* PLATFORM(SPARC64) */
-#if defined(__sparc64__)
+#if defined(__sparc__) && defined(__arch64__) || defined (__sparcv9)
 #define WTF_PLATFORM_SPARC64 1
 #define WTF_PLATFORM_BIG_ENDIAN 1
 #endif
@@ -411,6 +506,9 @@
 #if PLATFORM(MAC) && !PLATFORM(IPHONE)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && defined(__x86_64__)
+#define WTF_USE_PLUGIN_HOST_PROCESS 1
+#endif
 #if !defined(ENABLE_MAC_JAVA_BRIDGE)
 #define ENABLE_MAC_JAVA_BRIDGE 1
 #endif
@@ -419,8 +517,12 @@
 #endif
 #define HAVE_READLINE 1
 #define HAVE_RUNLOOP_TIMER 1
+<<<<<<< HEAD:JavaScriptCore/wtf/Platform.h
 #define HAVE_PTHREAD_RWLOCK 1
 #endif
+=======
+#endif /* PLATFORM(MAC) && !PLATFORM(IPHONE) */
+>>>>>>> webkit.org at 49305:JavaScriptCore/wtf/Platform.h
 
 #if PLATFORM(CHROMIUM) && PLATFORM(DARWIN)
 #define WTF_PLATFORM_CF 1
@@ -428,15 +530,19 @@
 #endif
 
 #if PLATFORM(IPHONE)
-#define WTF_PLATFORM_CF 1
-#define WTF_USE_PTHREADS 1
+#define ENABLE_CONTEXT_MENUS 0
+#define ENABLE_DRAG_SUPPORT 0
 #define ENABLE_FTPDIR 1
-#define ENABLE_MAC_JAVA_BRIDGE 0
-#define ENABLE_ICONDATABASE 0
 #define ENABLE_GEOLOCATION 1
+#define ENABLE_ICONDATABASE 0
+#define ENABLE_INSPECTOR 0
+#define ENABLE_MAC_JAVA_BRIDGE 0
 #define ENABLE_NETSCAPE_PLUGIN_API 0
-#define HAVE_READLINE 1
+#define ENABLE_ORIENTATION_EVENTS 1
 #define ENABLE_REPAINT_THROTTLING 1
+#define HAVE_READLINE 1
+#define WTF_PLATFORM_CF 1
+#define WTF_USE_PTHREADS 1
 #endif
 
 #if PLATFORM(WIN)
@@ -445,8 +551,6 @@
 
 #if PLATFORM(WX)
 #define ENABLE_ASSEMBLER 1
-#define WTF_USE_CURL 1
-#define WTF_USE_PTHREADS 1
 #endif
 
 #if PLATFORM(GTK)
@@ -455,6 +559,14 @@
 #endif
 #endif
 
+#if PLATFORM(HAIKU)
+#define HAVE_POSIX_MEMALIGN 1
+#define WTF_USE_CURL 1
+#define WTF_USE_PTHREADS 1
+#define USE_SYSTEM_MALLOC 1
+#define ENABLE_NETSCAPE_PLUGIN_API 0
+#endif
+
 #if !defined(HAVE_ACCESSIBILITY)
 #if PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || PLATFORM(GTK) || PLATFORM(CHROMIUM)
 #define HAVE_ACCESSIBILITY 1
@@ -465,7 +577,12 @@
 #define HAVE_SIGNAL_H 1
 #endif
 
+<<<<<<< HEAD:JavaScriptCore/wtf/Platform.h
 #if !PLATFORM(WIN_OS) && !PLATFORM(SOLARIS) && !PLATFORM(SYMBIAN) && !COMPILER(RVCT) && !PLATFORM(ANDROID)
+=======
+#if !PLATFORM(WIN_OS) && !PLATFORM(SOLARIS) && !PLATFORM(QNX) \
+    && !PLATFORM(SYMBIAN) && !PLATFORM(HAIKU) && !COMPILER(RVCT)
+>>>>>>> webkit.org at 49305:JavaScriptCore/wtf/Platform.h
 #define HAVE_TM_GMTOFF 1
 #define HAVE_TM_ZONE 1
 #define HAVE_TIMEGM 1
@@ -486,6 +603,7 @@
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
 #define HAVE_MADV_FREE_REUSE 1
 #define HAVE_MADV_FREE 1
+#define HAVE_PTHREAD_SETNAME_NP 1
 #endif
 
 #if PLATFORM(IPHONE)
@@ -515,10 +633,17 @@
 #define HAVE_SYS_PARAM_H 1
 #endif
 
+<<<<<<< HEAD:JavaScriptCore/wtf/Platform.h
 #elif PLATFORM(ANDROID)
+=======
+#elif PLATFORM(QNX)
+>>>>>>> webkit.org at 49305:JavaScriptCore/wtf/Platform.h
 
 #define HAVE_ERRNO_H 1
+<<<<<<< HEAD:JavaScriptCore/wtf/Platform.h
 #define HAVE_LANGINFO_H 0
+=======
+>>>>>>> webkit.org at 49305:JavaScriptCore/wtf/Platform.h
 #define HAVE_MMAP 1
 #define HAVE_SBRK 1
 #define HAVE_STRINGS_H 1
@@ -530,7 +655,10 @@
 /* FIXME: is this actually used or do other platforms generate their own config.h? */
 
 #define HAVE_ERRNO_H 1
+/* As long as Haiku doesn't have a complete support of locale this will be disabled. */
+#if !PLATFORM(HAIKU)
 #define HAVE_LANGINFO_H 1
+#endif
 #define HAVE_MMAP 1
 #define HAVE_SBRK 1
 #define HAVE_STRINGS_H 1
@@ -563,10 +691,22 @@
 #define ENABLE_FTPDIR 1
 #endif
 
+#if !defined(ENABLE_CONTEXT_MENUS)
+#define ENABLE_CONTEXT_MENUS 1
+#endif
+
+#if !defined(ENABLE_DRAG_SUPPORT)
+#define ENABLE_DRAG_SUPPORT 1
+#endif
+
 #if !defined(ENABLE_DASHBOARD_SUPPORT)
 #define ENABLE_DASHBOARD_SUPPORT 0
 #endif
 
+#if !defined(ENABLE_INSPECTOR)
+#define ENABLE_INSPECTOR 1
+#endif
+
 #if !defined(ENABLE_MAC_JAVA_BRIDGE)
 #define ENABLE_MAC_JAVA_BRIDGE 0
 #endif
@@ -575,6 +715,14 @@
 #define ENABLE_NETSCAPE_PLUGIN_API 1
 #endif
 
+#if !defined(WTF_USE_PLUGIN_HOST_PROCESS)
+#define WTF_USE_PLUGIN_HOST_PROCESS 0
+#endif
+
+#if !defined(ENABLE_ORIENTATION_EVENTS)
+#define ENABLE_ORIENTATION_EVENTS 0
+#endif
+
 #if !defined(ENABLE_OPCODE_STATS)
 #define ENABLE_OPCODE_STATS 0
 #endif
@@ -594,6 +742,10 @@
 #define ENABLE_GEOLOCATION 0
 #endif
 
+#if !defined(ENABLE_NOTIFICATIONS)
+#define ENABLE_NOTIFICATIONS 0
+#endif
+
 #if !defined(ENABLE_TEXT_CARET)
 #define ENABLE_TEXT_CARET 1
 #endif
@@ -608,9 +760,13 @@
 #endif
 
 #if !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64)
-#if PLATFORM(X86_64) && (PLATFORM(MAC) || (PLATFORM(LINUX) && !PLATFORM(QT)))
+#if PLATFORM(X86_64) && (PLATFORM(DARWIN) || PLATFORM(LINUX))
 #define WTF_USE_JSVALUE64 1
-#elif PLATFORM(PPC64) || PLATFORM(QT) /* All Qt layout tests crash in JSVALUE32_64 mode. */
+#elif PLATFORM(ARM) || PLATFORM(PPC64)
+#define WTF_USE_JSVALUE32 1
+#elif PLATFORM(WIN_OS) && COMPILER(MINGW)
+/* Using JSVALUE32_64 causes padding/alignement issues for JITStubArg
+on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WTF_USE_JSVALUE32 1
 #else
 #define WTF_USE_JSVALUE32_64 1
@@ -630,7 +786,7 @@
 #elif PLATFORM(X86) && PLATFORM(MAC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM_ARM_ARCH(7) && PLATFORM(IPHONE)
+#elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
     /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */
     #define ENABLE_JIT 0
     #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
@@ -639,18 +795,23 @@
     #define ENABLE_JIT 1
 #endif
 
-#if PLATFORM(X86) && PLATFORM(QT)
-#if PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100
+#if PLATFORM(QT)
+#if PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(WIN_OS) && COMPILER(MSVC)
+#elif PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
-#elif PLATFORM(LINUX) && GCC_VERSION >= 40100
+#elif PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
+#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
+    #define ENABLE_JIT 1
+    #if PLATFORM(ARM_THUMB2)
+        #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
+    #endif
 #endif
-#endif /* PLATFORM(QT) && PLATFORM(X86) */
+#endif /* PLATFORM(QT) */
 
 #endif /* !defined(ENABLE_JIT) */
 
@@ -694,16 +855,17 @@
 #if (PLATFORM(X86) && PLATFORM(MAC)) \
  || (PLATFORM(X86_64) && PLATFORM(MAC)) \
  /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */ \
- || (PLATFORM_ARM_ARCH(7) && PLATFORM(IPHONE) && 0) \
+ || (PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE) && 0) \
  || (PLATFORM(X86) && PLATFORM(WIN))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
 
-#if PLATFORM(X86) && PLATFORM(QT)
-#if (PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
- || (PLATFORM(WIN_OS) && COMPILER(MSVC)) \
- || (PLATFORM(LINUX) && GCC_VERSION >= 40100)
+#if PLATFORM(QT)
+#if (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
+ || (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)) \
+ || (PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100) \
+ || (PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
@@ -731,15 +893,11 @@
 #define ENABLE_PAN_SCROLLING 1
 #endif
 
-#if !defined(ENABLE_ACTIVEX_TYPE_CONVERSION_WMPLAYER)
-#define ENABLE_ACTIVEX_TYPE_CONVERSION_WMPLAYER 1
-#endif
-
-/* Use the QtXmlStreamReader implementation for XMLTokenizer */
+/* Use the QXmlStreamReader implementation for XMLTokenizer */
+/* Use the QXmlQuery implementation for XSLTProcessor */
 #if PLATFORM(QT)
-#if !ENABLE(XSLT)
 #define WTF_USE_QXMLSTREAM 1
-#endif
+#define WTF_USE_QXMLQUERY 1
 #endif
 
 #if !PLATFORM(QT)
@@ -757,4 +915,13 @@
 #define WTF_USE_ACCELERATED_COMPOSITING 1
 #endif
 
+#if COMPILER(GCC)
+#define WARN_UNUSED_RETURN __attribute__ ((warn_unused_result))
+#else
+#define WARN_UNUSED_RETURN
+#endif
+
+/* Set up a define for a common error that is intended to cause a build error -- thus the space after Error. */
+#define WTF_PLATFORM_CFNETWORK Error USE_macro_should_be_used_with_CFNETWORK
+
 #endif /* WTF_Platform_h */
diff --git a/JavaScriptCore/wtf/PossiblyNull.h b/JavaScriptCore/wtf/PossiblyNull.h
new file mode 100644
index 0000000..79c4d82
--- /dev/null
+++ b/JavaScriptCore/wtf/PossiblyNull.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PossiblyNull_h
+#define PossiblyNull_h
+
+#include "Assertions.h"
+
+namespace WTF {
+
+template <typename T> struct PossiblyNull {
+    PossiblyNull(T data)
+        : m_data(data)
+    {
+    }
+    PossiblyNull(const PossiblyNull<T>& source)
+        : m_data(source.m_data)
+    {
+        source.m_data = 0;
+    }
+    ~PossiblyNull() { ASSERT(!m_data); }
+    bool getValue(T& out) WARN_UNUSED_RETURN;
+private:
+    mutable T m_data;
+};
+
+template <typename T> bool PossiblyNull<T>::getValue(T& out)
+{
+    out = m_data;
+    bool result = !!m_data;
+    m_data = 0;
+    return result;
+}
+
+}
+
+#endif
diff --git a/JavaScriptCore/wtf/PtrAndFlags.h b/JavaScriptCore/wtf/PtrAndFlags.h
index 485c595..5d0bd2a 100644
--- a/JavaScriptCore/wtf/PtrAndFlags.h
+++ b/JavaScriptCore/wtf/PtrAndFlags.h
@@ -34,11 +34,8 @@
 #include <wtf/Assertions.h>
 
 namespace WTF {
-    template<class T, typename FlagEnum> class PtrAndFlags {
+    template<class T, typename FlagEnum> class PtrAndFlagsBase {
     public:
-        PtrAndFlags() : m_ptrAndFlags(0) {}
-        PtrAndFlags(T* ptr) : m_ptrAndFlags(0) { set(ptr); }
-
         bool isFlagSet(FlagEnum flagNumber) const { ASSERT(flagNumber < 2); return m_ptrAndFlags & (1 << flagNumber); }
         void setFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags |= (1 << flagNumber);}
         void clearFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags &= ~(1 << flagNumber);}
@@ -55,14 +52,28 @@ namespace WTF {
         bool operator!() const { return !get(); }
         T* operator->() const { return reinterpret_cast<T*>(m_ptrAndFlags & ~3); }
 
-    private:
+    protected:
         intptr_t m_ptrAndFlags;
 #ifndef NDEBUG
         void* m_leaksPtr; // Only used to allow tools like leaks on OSX to detect that the memory is referenced.
 #endif
     };
+
+    template<class T, typename FlagEnum> class PtrAndFlags : public PtrAndFlagsBase<T, FlagEnum> {
+    public:
+        PtrAndFlags()
+        {
+            PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
+        }
+        PtrAndFlags(T* ptr)
+        {
+            PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
+            set(ptr);
+        }
+    };
 } // namespace WTF
 
+using WTF::PtrAndFlagsBase;
 using WTF::PtrAndFlags;
 
 #endif // PtrAndFlags_h
diff --git a/JavaScriptCore/wtf/RandomNumber.cpp b/JavaScriptCore/wtf/RandomNumber.cpp
index 0e6e208..52fb130 100644
--- a/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/JavaScriptCore/wtf/RandomNumber.cpp
@@ -82,6 +82,23 @@ double randomNumber()
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #elif PLATFORM(WINCE)
     return genrand_res53();
+#elif PLATFORM(WIN_OS)
+    uint32_t part1 = rand() & (RAND_MAX - 1);
+    uint32_t part2 = rand() & (RAND_MAX - 1);
+    uint32_t part3 = rand() & (RAND_MAX - 1);
+    uint32_t part4 = rand() & (RAND_MAX - 1);
+    // rand only provides 15 bits on Win32
+    uint64_t fullRandom = part1;
+    fullRandom <<= 15;
+    fullRandom |= part2;
+    fullRandom <<= 15;
+    fullRandom |= part3;
+    fullRandom <<= 15;
+    fullRandom |= part4;
+
+    // Mask off the low 53bits
+    fullRandom &= (1LL << 53) - 1;
+    return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #else
     uint32_t part1 = rand() & (RAND_MAX - 1);
     uint32_t part2 = rand() & (RAND_MAX - 1);
diff --git a/JavaScriptCore/wtf/RefPtr.h b/JavaScriptCore/wtf/RefPtr.h
index 74cd0ea..e6d1047 100644
--- a/JavaScriptCore/wtf/RefPtr.h
+++ b/JavaScriptCore/wtf/RefPtr.h
@@ -30,6 +30,7 @@ namespace WTF {
     enum PlacementNewAdoptType { PlacementNewAdopt };
 
     template <typename T> class PassRefPtr;
+    template <typename T> class NonNullPassRefPtr;
 
     enum HashTableDeletedValueType { HashTableDeletedValue };
 
@@ -40,6 +41,7 @@ namespace WTF {
         RefPtr(const RefPtr& o) : m_ptr(o.m_ptr) { if (T* ptr = m_ptr) ptr->ref(); }
         // see comment in PassRefPtr.h for why this takes const reference
         template <typename U> RefPtr(const PassRefPtr<U>&);
+        template <typename U> RefPtr(const NonNullPassRefPtr<U>&);
 
         // Special constructor for cases where we overwrite an object in place.
         RefPtr(PlacementNewAdoptType) { }
@@ -73,8 +75,10 @@ namespace WTF {
         RefPtr& operator=(const RefPtr&);
         RefPtr& operator=(T*);
         RefPtr& operator=(const PassRefPtr<T>&);
+        RefPtr& operator=(const NonNullPassRefPtr<T>&);
         template <typename U> RefPtr& operator=(const RefPtr<U>&);
         template <typename U> RefPtr& operator=(const PassRefPtr<U>&);
+        template <typename U> RefPtr& operator=(const NonNullPassRefPtr<U>&);
 
         void swap(RefPtr&);
 
@@ -89,6 +93,11 @@ namespace WTF {
     {
     }
 
+    template <typename T> template <typename U> inline RefPtr<T>::RefPtr(const NonNullPassRefPtr<U>& o)
+        : m_ptr(o.releaseRef())
+    {
+    }
+
     template <typename T> inline RefPtr<T>& RefPtr<T>::operator=(const RefPtr<T>& o)
     {
         T* optr = o.get();
@@ -133,6 +142,15 @@ namespace WTF {
         return *this;
     }
 
+    template <typename T> inline RefPtr<T>& RefPtr<T>::operator=(const NonNullPassRefPtr<T>& o)
+    {
+        T* ptr = m_ptr;
+        m_ptr = o.releaseRef();
+        if (ptr)
+            ptr->deref();
+        return *this;
+    }
+
     template <typename T> template <typename U> inline RefPtr<T>& RefPtr<T>::operator=(const PassRefPtr<U>& o)
     {
         T* ptr = m_ptr;
@@ -142,6 +160,15 @@ namespace WTF {
         return *this;
     }
 
+    template <typename T> template <typename U> inline RefPtr<T>& RefPtr<T>::operator=(const NonNullPassRefPtr<U>& o)
+    {
+        T* ptr = m_ptr;
+        m_ptr = o.releaseRef();
+        if (ptr)
+            ptr->deref();
+        return *this;
+    }
+
     template <class T> inline void RefPtr<T>::swap(RefPtr<T>& o)
     {
         std::swap(m_ptr, o.m_ptr);
diff --git a/JavaScriptCore/wtf/SegmentedVector.h b/JavaScriptCore/wtf/SegmentedVector.h
index 065c19c..b1cbc4d 100644
--- a/JavaScriptCore/wtf/SegmentedVector.h
+++ b/JavaScriptCore/wtf/SegmentedVector.h
@@ -116,6 +116,7 @@ namespace WTF {
         }
 
         size_t size() const { return m_size; }
+        bool isEmpty() const { return !size(); }
 
         T& at(size_t index)
         {
@@ -249,4 +250,6 @@ namespace WTF {
 
 } // namespace WTF
 
+using WTF::SegmentedVector;
+
 #endif // SegmentedVector_h
diff --git a/JavaScriptCore/wtf/StringExtras.h b/JavaScriptCore/wtf/StringExtras.h
index 1c23390..559e3f2 100644
--- a/JavaScriptCore/wtf/StringExtras.h
+++ b/JavaScriptCore/wtf/StringExtras.h
@@ -85,4 +85,20 @@ inline int strcasecmp(const char* s1, const char* s2)
 
 #endif
 
+#if PLATFORM(WIN_OS) || PLATFORM(LINUX)
+
+inline char* strnstr(const char* buffer, const char* target, size_t bufferLength)
+{
+    size_t targetLength = strlen(target);
+    if (targetLength == 0)
+        return const_cast<char*>(buffer);
+    for (const char* start = buffer; *start && start + targetLength <= buffer + bufferLength; start++) {
+        if (*start == *target && strncmp(start + 1, target + 1, targetLength - 1) == 0)
+            return const_cast<char*>(start);
+    }
+    return 0;
+}
+
+#endif
+
 #endif // WTF_StringExtras_h
diff --git a/JavaScriptCore/wtf/TCSpinLock.h b/JavaScriptCore/wtf/TCSpinLock.h
index ced2283..4cf30c2 100644
--- a/JavaScriptCore/wtf/TCSpinLock.h
+++ b/JavaScriptCore/wtf/TCSpinLock.h
@@ -209,6 +209,13 @@ struct TCMalloc_SpinLock {
   inline void Unlock() {
     if (pthread_mutex_unlock(&private_lock_) != 0) CRASH();
   }
+  bool IsHeld() {
+    if (pthread_mutex_trylock(&private_lock_))
+      return true;
+
+    Unlock();
+    return false;
+  }
 };
 
 #define SPINLOCK_INITIALIZER { PTHREAD_MUTEX_INITIALIZER }
diff --git a/JavaScriptCore/wtf/ThreadSpecific.h b/JavaScriptCore/wtf/ThreadSpecific.h
index 4d5d2f7..b6f5fd3 100644
--- a/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/JavaScriptCore/wtf/ThreadSpecific.h
@@ -79,10 +79,13 @@ private:
 #if USE(PTHREADS) || PLATFORM(QT) || PLATFORM(WIN_OS)
     struct Data : Noncopyable {
         Data(T* value, ThreadSpecific<T>* owner) : value(value), owner(owner) {}
+#if PLATFORM(QT)
+        ~Data() { owner->destroy(this); }
+#endif
 
         T* value;
         ThreadSpecific<T>* owner;
-#if !USE(PTHREADS)
+#if !USE(PTHREADS) && !PLATFORM(QT)
         void (*destructor)(void*);
 #endif
     };
@@ -136,9 +139,7 @@ inline ThreadSpecific<T>::ThreadSpecific()
 template<typename T>
 inline ThreadSpecific<T>::~ThreadSpecific()
 {
-    Data* data = static_cast<Data*>(m_key.localData());
-    if (data)
-        data->destructor(data);
+    // Does not invoke destructor functions. QThreadStorage will do it
 }
 
 template<typename T>
@@ -153,7 +154,6 @@ inline void ThreadSpecific<T>::set(T* ptr)
 {
     ASSERT(!get());
     Data* data = new Data(ptr, this);
-    data->destructor = &ThreadSpecific<T>::destroy;
     m_key.setLocalData(data);
 }
 
@@ -218,21 +218,27 @@ inline void ThreadSpecific<T>::destroy(void* ptr)
     // Some pthreads implementations zero out the pointer before calling destroy(), so we temporarily reset it.
     pthread_setspecific(data->owner->m_key, ptr);
 #endif
-    
+#if PLATFORM(QT)
+    // See comment as above
+    data->owner->m_key.setLocalData(data);
+#endif
+
     data->value->~T();
     fastFree(data->value);
 
 #if USE(PTHREADS)
     pthread_setspecific(data->owner->m_key, 0);
 #elif PLATFORM(QT)
-    data->owner->m_key.setLocalData(0);
+    // Do nothing here
 #elif PLATFORM(WIN_OS)
     TlsSetValue(tlsKeys()[data->owner->m_index], 0);
 #else
 #error ThreadSpecific is not implemented for this platform.
 #endif
 
+#if !PLATFORM(QT)
     delete data;
+#endif
 }
 
 template<typename T>
diff --git a/JavaScriptCore/wtf/Threading.h b/JavaScriptCore/wtf/Threading.h
index bbfe8b5..e4a0b05 100644
--- a/JavaScriptCore/wtf/Threading.h
+++ b/JavaScriptCore/wtf/Threading.h
@@ -221,28 +221,32 @@ private:
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
 #if COMPILER(MINGW) || COMPILER(MSVC7) || PLATFORM(WINCE)
-inline void atomicIncrement(int* addend) { InterlockedIncrement(reinterpret_cast<long*>(addend)); }
+inline int atomicIncrement(int* addend) { return InterlockedIncrement(reinterpret_cast<long*>(addend)); }
 inline int atomicDecrement(int* addend) { return InterlockedDecrement(reinterpret_cast<long*>(addend)); }
 #else
-inline void atomicIncrement(int volatile* addend) { InterlockedIncrement(reinterpret_cast<long volatile*>(addend)); }
+inline int atomicIncrement(int volatile* addend) { return InterlockedIncrement(reinterpret_cast<long volatile*>(addend)); }
 inline int atomicDecrement(int volatile* addend) { return InterlockedDecrement(reinterpret_cast<long volatile*>(addend)); }
 #endif
 
 #elif PLATFORM(DARWIN)
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
-inline void atomicIncrement(int volatile* addend) { OSAtomicIncrement32Barrier(const_cast<int*>(addend)); }
+inline int atomicIncrement(int volatile* addend) { return OSAtomicIncrement32Barrier(const_cast<int*>(addend)); }
 inline int atomicDecrement(int volatile* addend) { return OSAtomicDecrement32Barrier(const_cast<int*>(addend)); }
 
+<<<<<<< HEAD:JavaScriptCore/wtf/Threading.h
 #elif defined ANDROID
 
 inline void atomicIncrement(int volatile* addend) { android_atomic_inc(addend); }
 inline int atomicDecrement(int volatile* addend) { return android_atomic_dec(addend); }
 
 #elif COMPILER(GCC)
+=======
+#elif COMPILER(GCC) && !PLATFORM(SPARC64) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
+>>>>>>> webkit.org at 49305:JavaScriptCore/wtf/Threading.h
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
-inline void atomicIncrement(int volatile* addend) { __gnu_cxx::__atomic_add(addend, 1); }
+inline int atomicIncrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, 1) + 1; }
 inline int atomicDecrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, -1) - 1; }
 
 #endif
@@ -336,6 +340,11 @@ using WTF::ThreadCondition;
 using WTF::ThreadIdentifier;
 using WTF::ThreadSafeShared;
 
+#if USE(LOCKFREE_THREADSAFESHARED)
+using WTF::atomicDecrement;
+using WTF::atomicIncrement;
+#endif
+
 using WTF::createThread;
 using WTF::currentThread;
 using WTF::isMainThread;
diff --git a/JavaScriptCore/wtf/ThreadingPthreads.cpp b/JavaScriptCore/wtf/ThreadingPthreads.cpp
index ea09a1f..abefb40 100644
--- a/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -39,8 +39,11 @@
 #include "StdLibExtras.h"
 #include "UnusedParam.h"
 #include <errno.h>
+
+#if !COMPILER(MSVC)
 #include <limits.h>
 #include <sys/time.h>
+#endif
 
 #if PLATFORM(ANDROID)
 #include "jni_utility.h"
@@ -184,7 +187,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
 
 void setThreadNameInternal(const char* threadName)
 {
-#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+#if HAVE(PTHREAD_SETNAME_NP)
     pthread_setname_np(threadName);
 #else
     UNUSED_PARAM(threadName);
diff --git a/JavaScriptCore/wtf/Vector.h b/JavaScriptCore/wtf/Vector.h
index 7cba4e4..e1fc5b4 100644
--- a/JavaScriptCore/wtf/Vector.h
+++ b/JavaScriptCore/wtf/Vector.h
@@ -63,6 +63,13 @@ namespace WTF {
     template <size_t size> struct AlignedBuffer<size, 32> { WTF_ALIGNED(AlignedBufferChar, buffer[size], 32); };
     template <size_t size> struct AlignedBuffer<size, 64> { WTF_ALIGNED(AlignedBufferChar, buffer[size], 64); };
 
+    template <size_t size, size_t alignment>
+    void swap(AlignedBuffer<size, alignment>& a, AlignedBuffer<size, alignment>& b)
+    {
+        for (size_t i = 0; i < size; ++i)
+            std::swap(a.buffer[i], b.buffer[i]);
+    }
+
     template <bool needsDestruction, typename T>
     class VectorDestructor;
 
@@ -404,6 +411,27 @@ namespace WTF {
             Base::deallocateBuffer(bufferToDeallocate);
         }
         
+        void swap(VectorBuffer<T, inlineCapacity>& other)
+        {
+            if (buffer() == inlineBuffer() && other.buffer() == other.inlineBuffer()) {
+                WTF::swap(m_inlineBuffer, other.m_inlineBuffer);
+                std::swap(m_capacity, other.m_capacity);
+            } else if (buffer() == inlineBuffer()) {
+                m_buffer = other.m_buffer;
+                other.m_buffer = other.inlineBuffer();
+                WTF::swap(m_inlineBuffer, other.m_inlineBuffer);
+                std::swap(m_capacity, other.m_capacity);
+            } else if (other.buffer() == other.inlineBuffer()) {
+                other.m_buffer = m_buffer;
+                m_buffer = inlineBuffer();
+                WTF::swap(m_inlineBuffer, other.m_inlineBuffer);
+                std::swap(m_capacity, other.m_capacity);
+            } else {
+                std::swap(m_buffer, other.m_buffer);
+                std::swap(m_capacity, other.m_capacity);
+            }
+        }
+
         void restoreInlineBufferIfNeeded()
         {
             if (m_buffer)
diff --git a/JavaScriptCore/wtf/VectorTraits.h b/JavaScriptCore/wtf/VectorTraits.h
index 7974b9a..eb4c279 100644
--- a/JavaScriptCore/wtf/VectorTraits.h
+++ b/JavaScriptCore/wtf/VectorTraits.h
@@ -21,6 +21,7 @@
 #ifndef WTF_VectorTraits_h
 #define WTF_VectorTraits_h
 
+#include "OwnPtr.h"
 #include "RefPtr.h"
 #include "TypeTraits.h"
 #include <utility>
@@ -71,11 +72,14 @@ namespace WTF {
         static const bool canCompareWithMemcmp = true;
     };
 
-    // we know RefPtr is simple enough that initializing to 0 and moving with memcpy
+    // we know OwnPtr and RefPtr are simple enough that initializing to 0 and moving with memcpy
     // (and then not destructing the original) will totally work
     template<typename P>
     struct VectorTraits<RefPtr<P> > : SimpleClassVectorTraits { };
-    
+
+    template<typename P>
+    struct VectorTraits<OwnPtr<P> > : SimpleClassVectorTraits { };
+
     template<typename P>
     struct VectorTraits<std::auto_ptr<P> > : SimpleClassVectorTraits { };
 
diff --git a/JavaScriptCore/wtf/haiku/MainThreadHaiku.cpp b/JavaScriptCore/wtf/haiku/MainThreadHaiku.cpp
index 4fd7b35..10c4248 100644
--- a/JavaScriptCore/wtf/haiku/MainThreadHaiku.cpp
+++ b/JavaScriptCore/wtf/haiku/MainThreadHaiku.cpp
@@ -30,6 +30,7 @@
 #include "config.h"
 #include "MainThread.h"
 
+#include "NotImplemented.h"
 
 namespace WTF {
 
diff --git a/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index 1531694..bdf2028 100644
--- a/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -58,7 +58,7 @@ QT_END_NAMESPACE
 #endif
 
 // ugly hack to make UChar compatible with JSChar in API/JSStringRef.h
-#if defined(Q_OS_WIN)
+#if defined(Q_OS_WIN) || COMPILER(WINSCW)
 typedef wchar_t UChar;
 #else
 typedef uint16_t UChar;
diff --git a/JavaScriptCore/yarr/RegexInterpreter.cpp b/JavaScriptCore/yarr/RegexInterpreter.cpp
index b0aae65..aafea3c 100644
--- a/JavaScriptCore/yarr/RegexInterpreter.cpp
+++ b/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -90,7 +90,7 @@ public:
             : term(0)
         {
         }
-        
+
         void* operator new(size_t, void* where)
         {
             return where;
@@ -124,7 +124,7 @@ public:
                 subpatternBackup[i] = output[(firstSubpatternId << 1) + i];
                 output[(firstSubpatternId << 1) + i] = -1;
             }
-            
+
             new(getDisjunctionContext(term)) DisjunctionContext();
         }
 
@@ -138,7 +138,7 @@ public:
             for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i)
                 output[(firstSubpatternId << 1) + i] = subpatternBackup[i];
         }
-        
+
         DisjunctionContext* getDisjunctionContext(ByteTerm& term)
         {
             return reinterpret_cast<DisjunctionContext*>(&(subpatternBackup[term.atom.parenthesesDisjunction->m_numSubpatterns << 1]));
@@ -208,7 +208,7 @@ public:
                 return input[pos - 1];
             return -1;
         }
-        
+
         unsigned getPos()
         {
             return pos;
@@ -218,7 +218,7 @@ public:
         {
             pos = p;
         }
-        
+
         bool atStart()
         {
             return pos == 0;
@@ -284,7 +284,7 @@ public:
     {
         if (input.atEnd())
             return false;
-        
+
         int ch = input.read();
 
         if (pattern->m_ignoreCase ? ((Unicode::toLower(testChar) == ch) || (Unicode::toUpper(testChar) == ch)) : (testChar == ch)) {
@@ -341,7 +341,7 @@ public:
                 return false;
             }
         }
-        
+
         return true;
     }
 
@@ -606,10 +606,10 @@ public:
 
             if (matchDisjunction(term.atom.parenthesesDisjunction, context->getDisjunctionContext(term), true))
                 return true;
-            
+
             resetMatches(term, context);
-            freeParenthesesDisjunctionContext(context);
             popParenthesesDisjunctionContext(backTrack);
+            freeParenthesesDisjunctionContext(context);
         }
 
         return false;
@@ -910,8 +910,8 @@ public:
                 }
             } else {
                 resetMatches(term, context);
-                freeParenthesesDisjunctionContext(context);
                 popParenthesesDisjunctionContext(backTrack);
+                freeParenthesesDisjunctionContext(context);
             }
 
             if (backTrack->matchAmount) {
@@ -946,11 +946,11 @@ public:
                     }
                     return true;
                 }
-                
+
                 // pop a match off the stack
                 resetMatches(term, context);
-                freeParenthesesDisjunctionContext(context);
                 popParenthesesDisjunctionContext(backTrack);
+                freeParenthesesDisjunctionContext(context);
             }
 
             return false;
@@ -1266,37 +1266,37 @@ public:
     ByteCompiler(RegexPattern& pattern)
         : m_pattern(pattern)
     {
-        bodyDisjunction = 0;
-        currentAlternativeIndex = 0;
+        m_bodyDisjunction = 0;
+        m_currentAlternativeIndex = 0;
     }
-    
+
     BytecodePattern* compile()
     {
         regexBegin(m_pattern.m_numSubpatterns, m_pattern.m_body->m_callFrameSize);
         emitDisjunction(m_pattern.m_body);
         regexEnd();
 
-        return new BytecodePattern(bodyDisjunction, m_allParenthesesInfo, m_pattern);
+        return new BytecodePattern(m_bodyDisjunction, m_allParenthesesInfo, m_pattern);
     }
-    
+
     void checkInput(unsigned count)
     {
-        bodyDisjunction->terms.append(ByteTerm::CheckInput(count));
+        m_bodyDisjunction->terms.append(ByteTerm::CheckInput(count));
     }
 
     void assertionBOL(int inputPosition)
     {
-        bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
+        m_bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
     }
 
     void assertionEOL(int inputPosition)
     {
-        bodyDisjunction->terms.append(ByteTerm::EOL(inputPosition));
+        m_bodyDisjunction->terms.append(ByteTerm::EOL(inputPosition));
     }
 
     void assertionWordBoundary(bool invert, int inputPosition)
     {
-        bodyDisjunction->terms.append(ByteTerm::WordBoundary(invert, inputPosition));
+        m_bodyDisjunction->terms.append(ByteTerm::WordBoundary(invert, inputPosition));
     }
 
     void atomPatternCharacter(UChar ch, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
@@ -1304,60 +1304,60 @@ public:
         if (m_pattern.m_ignoreCase) {
             UChar lo = Unicode::toLower(ch);
             UChar hi = Unicode::toUpper(ch);
-            
+
             if (lo != hi) {
-                bodyDisjunction->terms.append(ByteTerm(lo, hi, inputPosition, frameLocation, quantityCount, quantityType));
+                m_bodyDisjunction->terms.append(ByteTerm(lo, hi, inputPosition, frameLocation, quantityCount, quantityType));
                 return;
             }
         }
 
-        bodyDisjunction->terms.append(ByteTerm(ch, inputPosition, frameLocation, quantityCount, quantityType));
+        m_bodyDisjunction->terms.append(ByteTerm(ch, inputPosition, frameLocation, quantityCount, quantityType));
     }
-    
+
     void atomCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
     {
-        bodyDisjunction->terms.append(ByteTerm(characterClass, invert, inputPosition));
+        m_bodyDisjunction->terms.append(ByteTerm(characterClass, invert, inputPosition));
 
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
     }
 
     void atomBackReference(unsigned subpatternId, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
     {
         ASSERT(subpatternId);
 
-        bodyDisjunction->terms.append(ByteTerm::BackReference(subpatternId, inputPosition));
+        m_bodyDisjunction->terms.append(ByteTerm::BackReference(subpatternId, inputPosition));
 
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
     }
 
     void atomParenthesesSubpatternBegin(unsigned subpatternId, bool capture, int inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
     {
-        int beginTerm = bodyDisjunction->terms.size();
+        int beginTerm = m_bodyDisjunction->terms.size();
 
-        bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternOnceBegin, subpatternId, capture, inputPosition));
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
-        bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternOnceBegin, subpatternId, capture, inputPosition));
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
 
-        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, currentAlternativeIndex));
-        currentAlternativeIndex = beginTerm + 1;
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, m_currentAlternativeIndex));
+        m_currentAlternativeIndex = beginTerm + 1;
     }
 
     void atomParentheticalAssertionBegin(unsigned subpatternId, bool invert, unsigned frameLocation, unsigned alternativeFrameLocation)
     {
-        int beginTerm = bodyDisjunction->terms.size();
+        int beginTerm = m_bodyDisjunction->terms.size();
 
-        bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParentheticalAssertionBegin, subpatternId, invert, 0));
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
-        bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParentheticalAssertionBegin, subpatternId, invert, 0));
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
 
-        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, currentAlternativeIndex));
-        currentAlternativeIndex = beginTerm + 1;
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, m_currentAlternativeIndex));
+        m_currentAlternativeIndex = beginTerm + 1;
     }
 
     unsigned popParenthesesStack()
@@ -1365,12 +1365,12 @@ public:
         ASSERT(m_parenthesesStack.size());
         int stackEnd = m_parenthesesStack.size() - 1;
         unsigned beginTerm = m_parenthesesStack[stackEnd].beginTerm;
-        currentAlternativeIndex = m_parenthesesStack[stackEnd].savedAlternativeIndex;
+        m_currentAlternativeIndex = m_parenthesesStack[stackEnd].savedAlternativeIndex;
         m_parenthesesStack.shrink(stackEnd);
 
-        ASSERT(beginTerm < bodyDisjunction->terms.size());
-        ASSERT(currentAlternativeIndex < bodyDisjunction->terms.size());
-        
+        ASSERT(beginTerm < m_bodyDisjunction->terms.size());
+        ASSERT(m_currentAlternativeIndex < m_bodyDisjunction->terms.size());
+
         return beginTerm;
     }
 
@@ -1387,25 +1387,25 @@ public:
     void closeAlternative(int beginTerm)
     {
         int origBeginTerm = beginTerm;
-        ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeBegin);
-        int endIndex = bodyDisjunction->terms.size();
+        ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeBegin);
+        int endIndex = m_bodyDisjunction->terms.size();
 
-        unsigned frameLocation = bodyDisjunction->terms[beginTerm].frameLocation;
+        unsigned frameLocation = m_bodyDisjunction->terms[beginTerm].frameLocation;
 
-        if (!bodyDisjunction->terms[beginTerm].alternative.next)
-            bodyDisjunction->terms.remove(beginTerm);
+        if (!m_bodyDisjunction->terms[beginTerm].alternative.next)
+            m_bodyDisjunction->terms.remove(beginTerm);
         else {
-            while (bodyDisjunction->terms[beginTerm].alternative.next) {
-                beginTerm += bodyDisjunction->terms[beginTerm].alternative.next;
-                ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeDisjunction);
-                bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
-                bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+            while (m_bodyDisjunction->terms[beginTerm].alternative.next) {
+                beginTerm += m_bodyDisjunction->terms[beginTerm].alternative.next;
+                ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeDisjunction);
+                m_bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+                m_bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
             }
-            
-            bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
 
-            bodyDisjunction->terms.append(ByteTerm::AlternativeEnd());
-            bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+            m_bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+            m_bodyDisjunction->terms.append(ByteTerm::AlternativeEnd());
+            m_bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
         }
     }
 
@@ -1413,46 +1413,46 @@ public:
     {
         int beginTerm = 0;
         int origBeginTerm = 0;
-        ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeBegin);
-        int endIndex = bodyDisjunction->terms.size();
+        ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeBegin);
+        int endIndex = m_bodyDisjunction->terms.size();
 
-        unsigned frameLocation = bodyDisjunction->terms[beginTerm].frameLocation;
+        unsigned frameLocation = m_bodyDisjunction->terms[beginTerm].frameLocation;
 
-        while (bodyDisjunction->terms[beginTerm].alternative.next) {
-            beginTerm += bodyDisjunction->terms[beginTerm].alternative.next;
-            ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeDisjunction);
-            bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
-            bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+        while (m_bodyDisjunction->terms[beginTerm].alternative.next) {
+            beginTerm += m_bodyDisjunction->terms[beginTerm].alternative.next;
+            ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeDisjunction);
+            m_bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+            m_bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
         }
-        
-        bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
 
-        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeEnd());
-        bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+        m_bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+        m_bodyDisjunction->terms.append(ByteTerm::BodyAlternativeEnd());
+        m_bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
     }
 
     void atomParenthesesEnd(bool doInline, unsigned lastSubpatternId, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType, unsigned callFrameSize = 0)
     {
         unsigned beginTerm = popParenthesesStack();
         closeAlternative(beginTerm + 1);
-        unsigned endTerm = bodyDisjunction->terms.size();
+        unsigned endTerm = m_bodyDisjunction->terms.size();
 
-        bool isAssertion = bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParentheticalAssertionBegin;
-        bool invertOrCapture = bodyDisjunction->terms[beginTerm].invertOrCapture;
-        unsigned subpatternId = bodyDisjunction->terms[beginTerm].atom.subpatternId;
+        bool isAssertion = m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParentheticalAssertionBegin;
+        bool invertOrCapture = m_bodyDisjunction->terms[beginTerm].invertOrCapture;
+        unsigned subpatternId = m_bodyDisjunction->terms[beginTerm].atom.subpatternId;
 
-        bodyDisjunction->terms.append(ByteTerm(isAssertion ? ByteTerm::TypeParentheticalAssertionEnd : ByteTerm::TypeParenthesesSubpatternOnceEnd, subpatternId, invertOrCapture, inputPosition));
-        bodyDisjunction->terms[beginTerm].atom.parenthesesWidth = endTerm - beginTerm;
-        bodyDisjunction->terms[endTerm].atom.parenthesesWidth = endTerm - beginTerm;
-        bodyDisjunction->terms[endTerm].frameLocation = frameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm(isAssertion ? ByteTerm::TypeParentheticalAssertionEnd : ByteTerm::TypeParenthesesSubpatternOnceEnd, subpatternId, invertOrCapture, inputPosition));
+        m_bodyDisjunction->terms[beginTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        m_bodyDisjunction->terms[endTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        m_bodyDisjunction->terms[endTerm].frameLocation = frameLocation;
 
         if (doInline) {
-            bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
-            bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
-            bodyDisjunction->terms[endTerm].atom.quantityCount = quantityCount;
-            bodyDisjunction->terms[endTerm].atom.quantityType = quantityType;
+            m_bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
+            m_bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+            m_bodyDisjunction->terms[endTerm].atom.quantityCount = quantityCount;
+            m_bodyDisjunction->terms[endTerm].atom.quantityType = quantityType;
         } else {
-            ByteTerm& parenthesesBegin = bodyDisjunction->terms[beginTerm];
+            ByteTerm& parenthesesBegin = m_bodyDisjunction->terms[beginTerm];
             ASSERT(parenthesesBegin.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
 
             bool invertOrCapture = parenthesesBegin.invertOrCapture;
@@ -1463,26 +1463,26 @@ public:
 
             parenthesesDisjunction->terms.append(ByteTerm::SubpatternBegin());
             for (unsigned termInParentheses = beginTerm + 1; termInParentheses < endTerm; ++termInParentheses)
-                parenthesesDisjunction->terms.append(bodyDisjunction->terms[termInParentheses]);
+                parenthesesDisjunction->terms.append(m_bodyDisjunction->terms[termInParentheses]);
             parenthesesDisjunction->terms.append(ByteTerm::SubpatternEnd());
 
-            bodyDisjunction->terms.shrink(beginTerm);
+            m_bodyDisjunction->terms.shrink(beginTerm);
 
             m_allParenthesesInfo.append(parenthesesDisjunction);
-            bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction, invertOrCapture, inputPosition));
+            m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction, invertOrCapture, inputPosition));
 
-            bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
-            bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
-            bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+            m_bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
+            m_bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+            m_bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
         }
     }
 
     void regexBegin(unsigned numSubpatterns, unsigned callFrameSize)
     {
-        bodyDisjunction = new ByteDisjunction(numSubpatterns, callFrameSize);
-        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeBegin());
-        bodyDisjunction->terms[0].frameLocation = 0;
-        currentAlternativeIndex = 0;
+        m_bodyDisjunction = new ByteDisjunction(numSubpatterns, callFrameSize);
+        m_bodyDisjunction->terms.append(ByteTerm::BodyAlternativeBegin());
+        m_bodyDisjunction->terms[0].frameLocation = 0;
+        m_currentAlternativeIndex = 0;
     }
 
     void regexEnd()
@@ -1492,27 +1492,27 @@ public:
 
     void alterantiveBodyDisjunction()
     {
-        int newAlternativeIndex = bodyDisjunction->terms.size();
-        bodyDisjunction->terms[currentAlternativeIndex].alternative.next = newAlternativeIndex - currentAlternativeIndex;
-        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeDisjunction());
+        int newAlternativeIndex = m_bodyDisjunction->terms.size();
+        m_bodyDisjunction->terms[m_currentAlternativeIndex].alternative.next = newAlternativeIndex - m_currentAlternativeIndex;
+        m_bodyDisjunction->terms.append(ByteTerm::BodyAlternativeDisjunction());
 
-        currentAlternativeIndex = newAlternativeIndex;
+        m_currentAlternativeIndex = newAlternativeIndex;
     }
 
     void alterantiveDisjunction()
     {
-        int newAlternativeIndex = bodyDisjunction->terms.size();
-        bodyDisjunction->terms[currentAlternativeIndex].alternative.next = newAlternativeIndex - currentAlternativeIndex;
-        bodyDisjunction->terms.append(ByteTerm::AlternativeDisjunction());
+        int newAlternativeIndex = m_bodyDisjunction->terms.size();
+        m_bodyDisjunction->terms[m_currentAlternativeIndex].alternative.next = newAlternativeIndex - m_currentAlternativeIndex;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeDisjunction());
 
-        currentAlternativeIndex = newAlternativeIndex;
+        m_currentAlternativeIndex = newAlternativeIndex;
     }
 
     void emitDisjunction(PatternDisjunction* disjunction, unsigned inputCountAlreadyChecked = 0, unsigned parenthesesInputCountAlreadyChecked = 0)
     {
         for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
             unsigned currentCountAlreadyChecked = inputCountAlreadyChecked;
-        
+
             if (alt) {
                 if (disjunction == m_pattern.m_body)
                     alterantiveBodyDisjunction();
@@ -1586,7 +1586,7 @@ public:
 
                 case PatternTerm::TypeParentheticalAssertion: {
                     unsigned alternativeFrameLocation = term.inputPosition + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
-                    
+
                     atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invertOrCapture, term.frameLocation, alternativeFrameLocation);
                     emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
                     atomParenthesesEnd(true, term.parentheses.lastSubpatternId, 0, term.frameLocation, term.quantityCount, term.quantityType);
@@ -1599,8 +1599,8 @@ public:
 
 private:
     RegexPattern& m_pattern;
-    ByteDisjunction* bodyDisjunction;
-    unsigned currentAlternativeIndex;
+    ByteDisjunction* m_bodyDisjunction;
+    unsigned m_currentAlternativeIndex;
     Vector<ParenthesesStackEntry> m_parenthesesStack;
     Vector<ByteDisjunction*> m_allParenthesesInfo;
 };
diff --git a/JavaScriptCore/yarr/RegexInterpreter.h b/JavaScriptCore/yarr/RegexInterpreter.h
index a8c122a..48c9a5e 100644
--- a/JavaScriptCore/yarr/RegexInterpreter.h
+++ b/JavaScriptCore/yarr/RegexInterpreter.h
@@ -280,7 +280,7 @@ struct ByteTerm {
     }
 };
 
-class ByteDisjunction {
+class ByteDisjunction : public FastAllocBase {
 public:
     ByteDisjunction(unsigned numSubpatterns, unsigned frameSize)
         : m_numSubpatterns(numSubpatterns)
@@ -293,7 +293,7 @@ public:
     unsigned m_frameSize;
 };
 
-struct BytecodePattern {
+struct BytecodePattern : FastAllocBase {
     BytecodePattern(ByteDisjunction* body, Vector<ByteDisjunction*> allParenthesesInfo, RegexPattern& pattern)
         : m_body(body)
         , m_ignoreCase(pattern.m_ignoreCase)
diff --git a/JavaScriptCore/yarr/RegexJIT.cpp b/JavaScriptCore/yarr/RegexJIT.cpp
index 663a524..d777424 100644
--- a/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/JavaScriptCore/yarr/RegexJIT.cpp
@@ -45,35 +45,35 @@ class RegexGenerator : private MacroAssembler {
     friend void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
 
 #if PLATFORM(ARM)
-    static const RegisterID input = ARM::r0;
-    static const RegisterID index = ARM::r1;
-    static const RegisterID length = ARM::r2;
-    static const RegisterID output = ARM::r4;
+    static const RegisterID input = ARMRegisters::r0;
+    static const RegisterID index = ARMRegisters::r1;
+    static const RegisterID length = ARMRegisters::r2;
+    static const RegisterID output = ARMRegisters::r4;
 
-    static const RegisterID regT0 = ARM::r5;
-    static const RegisterID regT1 = ARM::r6;
+    static const RegisterID regT0 = ARMRegisters::r5;
+    static const RegisterID regT1 = ARMRegisters::r6;
 
-    static const RegisterID returnRegister = ARM::r0;
+    static const RegisterID returnRegister = ARMRegisters::r0;
 #elif PLATFORM(X86)
-    static const RegisterID input = X86::eax;
-    static const RegisterID index = X86::edx;
-    static const RegisterID length = X86::ecx;
-    static const RegisterID output = X86::edi;
+    static const RegisterID input = X86Registers::eax;
+    static const RegisterID index = X86Registers::edx;
+    static const RegisterID length = X86Registers::ecx;
+    static const RegisterID output = X86Registers::edi;
 
-    static const RegisterID regT0 = X86::ebx;
-    static const RegisterID regT1 = X86::esi;
+    static const RegisterID regT0 = X86Registers::ebx;
+    static const RegisterID regT1 = X86Registers::esi;
 
-    static const RegisterID returnRegister = X86::eax;
+    static const RegisterID returnRegister = X86Registers::eax;
 #elif PLATFORM(X86_64)
-    static const RegisterID input = X86::edi;
-    static const RegisterID index = X86::esi;
-    static const RegisterID length = X86::edx;
-    static const RegisterID output = X86::ecx;
+    static const RegisterID input = X86Registers::edi;
+    static const RegisterID index = X86Registers::esi;
+    static const RegisterID length = X86Registers::edx;
+    static const RegisterID output = X86Registers::ecx;
 
-    static const RegisterID regT0 = X86::eax;
-    static const RegisterID regT1 = X86::ebx;
+    static const RegisterID regT0 = X86Registers::eax;
+    static const RegisterID regT1 = X86Registers::ebx;
 
-    static const RegisterID returnRegister = X86::eax;
+    static const RegisterID returnRegister = X86Registers::eax;
 #endif
 
     void optimizeAlternative(PatternAlternative* alternative)
@@ -549,11 +549,11 @@ class RegexGenerator : private MacroAssembler {
         }
 
         if (mask) {
-            load32(BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), character);
+            load32WithUnalignedHalfWords(BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), character);
             or32(Imm32(mask), character);
             state.jumpToBacktrack(branch32(NotEqual, character, Imm32(chPair | mask)), this);
         } else
-            state.jumpToBacktrack(branch32(NotEqual, BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), Imm32(chPair)), this);
+            state.jumpToBacktrack(branch32WithUnalignedHalfWords(NotEqual, BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), Imm32(chPair)), this);
     }
 
     void generatePatternCharacterFixed(TermGenerationState& state)
@@ -1289,50 +1289,50 @@ class RegexGenerator : private MacroAssembler {
     void generateEnter()
     {
 #if PLATFORM(X86_64)
-        push(X86::ebp);
-        move(stackPointerRegister, X86::ebp);
-        push(X86::ebx);
+        push(X86Registers::ebp);
+        move(stackPointerRegister, X86Registers::ebp);
+        push(X86Registers::ebx);
 #elif PLATFORM(X86)
-        push(X86::ebp);
-        move(stackPointerRegister, X86::ebp);
+        push(X86Registers::ebp);
+        move(stackPointerRegister, X86Registers::ebp);
         // TODO: do we need spill registers to fill the output pointer if there are no sub captures?
-        push(X86::ebx);
-        push(X86::edi);
-        push(X86::esi);
+        push(X86Registers::ebx);
+        push(X86Registers::edi);
+        push(X86Registers::esi);
         // load output into edi (2 = saved ebp + return address).
     #if COMPILER(MSVC)
-        loadPtr(Address(X86::ebp, 2 * sizeof(void*)), input);
-        loadPtr(Address(X86::ebp, 3 * sizeof(void*)), index);
-        loadPtr(Address(X86::ebp, 4 * sizeof(void*)), length);
-        loadPtr(Address(X86::ebp, 5 * sizeof(void*)), output);
+        loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), input);
+        loadPtr(Address(X86Registers::ebp, 3 * sizeof(void*)), index);
+        loadPtr(Address(X86Registers::ebp, 4 * sizeof(void*)), length);
+        loadPtr(Address(X86Registers::ebp, 5 * sizeof(void*)), output);
     #else
-        loadPtr(Address(X86::ebp, 2 * sizeof(void*)), output);
+        loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), output);
     #endif
 #elif PLATFORM(ARM)
-#if !PLATFORM_ARM_ARCH(7)
-        push(ARM::lr);
+#if PLATFORM(ARM_TRADITIONAL)
+        push(ARMRegisters::lr);
 #endif
-        push(ARM::r4);
-        push(ARM::r5);
-        push(ARM::r6);
-        move(ARM::r3, output);
+        push(ARMRegisters::r4);
+        push(ARMRegisters::r5);
+        push(ARMRegisters::r6);
+        move(ARMRegisters::r3, output);
 #endif
     }
 
     void generateReturn()
     {
 #if PLATFORM(X86_64)
-        pop(X86::ebx);
-        pop(X86::ebp);
+        pop(X86Registers::ebx);
+        pop(X86Registers::ebp);
 #elif PLATFORM(X86)
-        pop(X86::esi);
-        pop(X86::edi);
-        pop(X86::ebx);
-        pop(X86::ebp);
+        pop(X86Registers::esi);
+        pop(X86Registers::edi);
+        pop(X86Registers::ebx);
+        pop(X86Registers::ebp);
 #elif PLATFORM(ARM)
-        pop(ARM::r6);
-        pop(ARM::r5);
-        pop(ARM::r4);
+        pop(ARMRegisters::r6);
+        pop(ARMRegisters::r5);
+        pop(ARMRegisters::r4);
 #endif
         ret();
     }
diff --git a/JavaScriptGlue/ChangeLog b/JavaScriptGlue/ChangeLog
index 502a764..87f87f0 100644
--- a/JavaScriptGlue/ChangeLog
+++ b/JavaScriptGlue/ChangeLog
@@ -1,3 +1,64 @@
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
+        fix-ups when accessing JSGlobalObject::d.
+        
+        Replaced with an explicit destructor function pointer.
+
+        * JSRun.cpp:
+        (JSGlueGlobalObject::destroyData):
+        * JSRun.h:
+        (JSGlueGlobalObject::Data::Data):
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        Switch over to getOwnPropertyNames instead of getPropertyNames.
+
+        * UserObjectImp.cpp:
+        (UserObjectImp::getOwnPropertyNames):
+        * UserObjectImp.h:
+
+2009-09-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        * JSValueWrapper.cpp:
+        (JSValueWrapper::JSObjectMark): Removed a check of the mark
+        bit. It's OK to do more work in this case, and there is no
+        longer a public function to access the mark bit.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * JSUtils.cpp:
+        (KJSValueToJSObject):
+        (KJSValueToCFTypeInternal):
+        Changed from isObject to inherits.
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        Continue to jump through hoops to deal with the exposed marking routines
+        in JavaScriptGlue.
+
+        * JSValueWrapper.cpp:
+        (JSValueWrapper::JSObjectMark):
+
 2009-08-07  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Sam Weinig.
diff --git a/JavaScriptGlue/Configurations/Version.xcconfig b/JavaScriptGlue/Configurations/Version.xcconfig
index d07d57f..66d574b 100644
--- a/JavaScriptGlue/Configurations/Version.xcconfig
+++ b/JavaScriptGlue/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 0;
+MINOR_VERSION = 2;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/JavaScriptGlue/JSRun.cpp b/JavaScriptGlue/JSRun.cpp
index 23d9c9c..03fc431 100644
--- a/JavaScriptGlue/JSRun.cpp
+++ b/JavaScriptGlue/JSRun.cpp
@@ -40,6 +40,11 @@ JSGlueGlobalObject::JSGlueGlobalObject(PassRefPtr<Structure> structure, JSFlags
     d()->userObjectStructure = UserObjectImp::createStructure(jsNull());
 }
 
+void JSGlueGlobalObject::destroyData(void* data)
+{
+    delete static_cast<Data*>(data);
+}
+
 JSRun::JSRun(CFStringRef source, JSFlags inFlags)
     :   JSBase(kJSRunTypeID),
         fSource(CFStringToUString(source)),
diff --git a/JavaScriptGlue/JSRun.h b/JavaScriptGlue/JSRun.h
index 44b42cc..15d495b 100644
--- a/JavaScriptGlue/JSRun.h
+++ b/JavaScriptGlue/JSRun.h
@@ -41,10 +41,17 @@ class JSGlueGlobalObject : public JSGlobalObject {
 
     private:
         struct Data : JSGlobalObjectData {
+            Data()
+                : JSGlobalObjectData(destroyData)
+            {
+            }
+            
             RefPtr<Structure> userObjectStructure;
             JSFlags flags;
         };
 
+        static void destroyData(void*);
+
         Data* d() const { return static_cast<Data*>(JSGlobalObject::d()); }
 };
 
diff --git a/JavaScriptGlue/JSUtils.cpp b/JavaScriptGlue/JSUtils.cpp
index e6078fe..862ae2e 100644
--- a/JavaScriptGlue/JSUtils.cpp
+++ b/JavaScriptGlue/JSUtils.cpp
@@ -104,7 +104,7 @@ JSUserObject* KJSValueToJSObject(JSValue inValue, ExecState *exec)
 {
     JSUserObject* result = 0;
 
-    if (inValue.isObject(&UserObjectImp::info)) {
+    if (inValue.inherits(&UserObjectImp::info)) {
         UserObjectImp* userObjectImp = static_cast<UserObjectImp *>(asObject(inValue));
         result = userObjectImp->GetJSUserObject();
         if (result)
@@ -237,8 +237,8 @@ CFTypeRef KJSValueToCFTypeInternal(JSValue inValue, ExecState *exec, ObjectImpLi
 
         if (inValue.isObject())
             {
-                            if (inValue.isObject(&UserObjectImp::info)) {
-                                UserObjectImp* userObjectImp = static_cast<UserObjectImp *>(asObject(inValue));
+                if (inValue.inherits(&UserObjectImp::info)) {
+                    UserObjectImp* userObjectImp = static_cast<UserObjectImp *>(asObject(inValue));
                     JSUserObject* ptr = userObjectImp->GetJSUserObject();
                     if (ptr)
                     {
diff --git a/JavaScriptGlue/JSValueWrapper.cpp b/JavaScriptGlue/JSValueWrapper.cpp
index d649d4a..24b6f28 100644
--- a/JavaScriptGlue/JSValueWrapper.cpp
+++ b/JavaScriptGlue/JSValueWrapper.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "JSValueWrapper.h"
 #include "JSRun.h"
+#include <JavaScriptCore/JSArray.h>
 #include <JavaScriptCore/PropertyNameArray.h>
 #include <pthread.h>
 
@@ -194,10 +195,13 @@ CFTypeRef JSValueWrapper::JSObjectCopyCFValue(void *data)
 void JSValueWrapper::JSObjectMark(void *data)
 {
     JSValueWrapper* ptr = (JSValueWrapper*)data;
-    if (ptr && !ptr->fValue.get().marked())
+    if (ptr)
     {
         // This results in recursive marking but will be otherwise safe and correct.
-        MarkStack markStack;
+        // We claim the array vptr is 0 because we don't have access to it here, and
+        // claiming 0 is functionally harmless -- it merely means that we can't
+        // devirtualise marking of arrays when recursing from this point.
+        MarkStack markStack(0);
         markStack.append(ptr->fValue.get());
         markStack.drain();
     }
diff --git a/JavaScriptGlue/UserObjectImp.cpp b/JavaScriptGlue/UserObjectImp.cpp
index 4e64ab1..125e349 100644
--- a/JavaScriptGlue/UserObjectImp.cpp
+++ b/JavaScriptGlue/UserObjectImp.cpp
@@ -94,7 +94,7 @@ JSValue UserObjectImp::callAsFunction(ExecState *exec, JSObject *thisObj, const
 }
 
 
-void UserObjectImp::getPropertyNames(ExecState *exec, PropertyNameArray& propertyNames)
+void UserObjectImp::getOwnPropertyNames(ExecState *exec, PropertyNameArray& propertyNames)
 {
     JSUserObject* ptr = GetJSUserObject();
     if (ptr) {
@@ -109,7 +109,7 @@ void UserObjectImp::getPropertyNames(ExecState *exec, PropertyNameArray& propert
             CFRelease(cfPropertyNames);
         }
     }
-    JSObject::getPropertyNames(exec, propertyNames);
+    JSObject::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue UserObjectImp::userObjectGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
diff --git a/JavaScriptGlue/UserObjectImp.h b/JavaScriptGlue/UserObjectImp.h
index 9791658..98c9276 100644
--- a/JavaScriptGlue/UserObjectImp.h
+++ b/JavaScriptGlue/UserObjectImp.h
@@ -44,7 +44,7 @@ public:
 
     virtual CallType getCallData(CallData&);
 
-    virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
     virtual JSValue callAsFunction(ExecState *exec, JSObject *thisObj, const ArgList &args);
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
diff --git a/SunSpider/ChangeLog b/SunSpider/ChangeLog
index 4a5317c..daed7ee 100644
--- a/SunSpider/ChangeLog
+++ b/SunSpider/ChangeLog
@@ -1,3 +1,22 @@
+2009-09-30  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Platform specific null device replaced with a platform independent.
+        https://bugs.webkit.org/show_bug.cgi?id=29544
+
+        * sunspider: Using File::Spec->devnull() instead of /dev/null and NUL.
+
+2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        [Qt] Make sunspider script work on Windows platform.
+        https://bugs.webkit.org/show_bug.cgi?id=29544
+
+        * sunspider:
+        Using platform specific null device instead of /dev/null.
+
 2009-06-19  Adam Treat  <adam.treat@torchmobile.com>
 
         Reviewed by Oliver Hunt.
diff --git a/SunSpider/sunspider b/SunSpider/sunspider
index 635d093..20614b1 100755
--- a/SunSpider/sunspider
+++ b/SunSpider/sunspider
@@ -160,7 +160,7 @@ sub writePrefixFile()
 sub runTestsOnce($)
 {
     my ($useShark) = @_;
-    my $shellArgs = $jsShellArgs . " -f $prefixFile -f resources/sunspider-standalone-driver.js 2> /dev/null";
+    my $shellArgs = $jsShellArgs . " -f $prefixFile -f resources/sunspider-standalone-driver.js 2> " . File::Spec->devnull();
     my $output;
     if ($useShark) {
         my $intervalArg = $useShark == 20 ? "-I 20u" : "";
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 53c2690..459204d 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,25473 @@
+2009-10-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        SVG feComposite: operator over mixes up inputs
+        [https://bugs.webkit.org/show_bug.cgi?id=30205]
+
+        SVG feComposite operator over mixed up the inputs.
+        The pixel-test svg/filters/feComposite.svg can already test this.
+        No new test result is needed as long as filters are disabled.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Move SVGURIReference ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30184
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        (WebCore::SVGMPathElement::pathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::SVGTextPathElement):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGURIReference.cpp:
+        (WebCore::SVGURIReference::SVGURIReference):
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+
+2009-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Re-add the QApplication::syncX() line for plugin windows removed
+        by r49169. Also changed the location of the sync just after the
+        creation instead of just before sending it to the plugin.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-10-08  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type):
+
+2009-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Remove unnecessary XSync for opaque mode.
+        
+        The reason for the XSync was that the plugin would not know about the
+        Drawable. It turns out that the real reason behind this is that even
+        though XCreatePixmap returns a handle, this id is unknown to the server
+        until we flush the connection.
+        
+        So, move the XSync to right after we create the Pixmap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30207
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30188
+        
+        Fixes an issue where performing a non DHTML drag-and-drop operation 
+        does not work as expected. For instance, dragging some selected text 
+        to an external application, such as TextEdit.
+        
+        This issue was a regression that arose from patching bug #30107.
+        
+        This change is covered by the manual test: 
+        drag-out-of-background-window.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag): When performing a non-DHTML drag 
+        operation then default to drag operations DragOperationGeneric and 
+        DragOperationCopy according to similar functionality removed when fixing
+        bug #30107, see: 
+        http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430 
+
+2009-10-07  Xan Lopez  <xlopez@igalia.com>
+
+        Fix more breakage in the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move PolicyChecker to it's own file
+        https://bugs.webkit.org/show_bug.cgi?id=30193
+
+        This is just moving code around and re-naming things.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCallback.cpp: Added.
+        (WebCore::PolicyCallback::PolicyCallback):
+        (WebCore::PolicyCallback::~PolicyCallback):
+        (WebCore::PolicyCallback::clear):
+        (WebCore::PolicyCallback::set):
+        (WebCore::PolicyCallback::call):
+        (WebCore::PolicyCallback::clearRequest):
+        (WebCore::PolicyCallback::cancel):
+        * loader/PolicyCallback.h: Added.
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyCheck.cpp: Removed.
+        * loader/PolicyCheck.h: Removed.
+
+2009-10-07  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Mark Rowe.
+
+        Include <limits> for std::numeric_limits.  Required by gcc-4.4
+        https://bugs.webkit.org/show_bug.cgi?id=30197
+
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasIntArray.h:
+        * html/canvas/CanvasShortArray.h:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        * html/canvas/CanvasUnsignedShortArray.h:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        This patch separates PolicyChecker from FrameLoader.  Loader policy is
+        in change of managing the FrameLoaderClient callbacks.  Ideally, it
+        shouldn't know anything about FrameLoader, but I couldn't quite remove
+        all knowledge (although we might be able to do more later).  In a
+        future patch, I'll move PolicyChecker into a separate file.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::PolicyChecker::handleUnimplementablePolicy):
+        (WebCore::PolicyChecker::cannotShowMIMEType):
+        (WebCore::PolicyChecker::PolicyChecker):
+        (WebCore::PolicyChecker::checkNavigationPolicy):
+        (WebCore::PolicyChecker::checkContentPolicy):
+        (WebCore::FrameLoader::shouldReloadToHandleUnreachableURL):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::PolicyChecker::cancelCheck):
+        (WebCore::PolicyChecker::stopCheck):
+        (WebCore::PolicyChecker::continueAfterContentPolicy):
+        (WebCore::PolicyChecker::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::PolicyChecker::checkNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        * loader/FrameLoader.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        (WebCore::FrameLoader::policy):
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didCancel):
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+
+        Changed callback objects to use a standard helper object. The helper
+        object ASSERTs that it is deleted on the main thread, so no lock is
+        required when unprotecting its members. It also centralizes some previously
+        duplicated code.
+        
+        Callback objects that might be deleted on a secondary thread use
+        callOnMainThread to delete their helper objects on the main thread.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCallbackData.cpp: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::deleteData):
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::JSCallbackData):
+        (WebCore::JSCallbackData::~JSCallbackData):
+        (WebCore::JSCallbackData::callback):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::~JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Fix StringImpl::m_buffer
+        https://bugs.webkit.org/show_bug.cgi?id=30189
+
+        Fix my previous StringImpl patch to avoid using an indefinite-length array member,
+        since MSVC doesn't like it. Instead, go back to offsetting by sizeof(StringImpl).
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::createUninitialized):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::bufferIsInternal):
+
+2009-10-07  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Update isolated worlds under v8 to support world reuse.
+        https://bugs.webkit.org/show_bug.cgi?id=30145
+
+        * bindings/v8/ScriptController.cpp:
+        Replace evaluateInNewIsolatedWorld() withe evaluateInIsolatedWorld(id).
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h: Ditto.
+        * bindings/v8/V8Proxy.cpp: Ditto.
+        (WebCore::V8Proxy::~V8Proxy): Dittio.
+        (WebCore::V8Proxy::evaluateInIsolatedWorld): Ditto.
+        * bindings/v8/V8Proxy.h: Ditto.
+        * bindings/v8/V8IsolatedWorld.cpp:
+        Add support for controlling lifetime of a world, rather than relying on GC.
+        (WebCore::V8IsolatedWorld::contextWeakReferenceCallback): Ditto.
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld): Ditto.
+        (WebCore::V8IsolatedWorld::destroy): Ditto.
+        * bindings/v8/V8IsolatedWorld.h: Ditto.
+
+2009-10-07  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for http://trac.webkit.org/changeset/49272 on Windows
+
+        * platform/text/StringImpl.h:
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimization of StringImpl:
+        - Remove unnecessary m_bufferIsInternal member (saves 4 bytes). Instead, check whether
+          m_data points to just past the end of the object's members.
+        - copy() and createWithTerminatingNullCharacter() create the string in a single malloc
+          block instead of 2 (saves ~20 bytes and considerable CPU cycles, increases locality).
+        - Move m_length next to m_hash to save 4 bytes of padding in 64-bit builds.
+          
+        https://bugs.webkit.org/show_bug.cgi?id=29500
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Re-ordered members.
+        (WebCore::StringImpl::~StringImpl): Change to is-buffer-internal check.
+        (WebCore::StringImpl::createUninitialized): Use new m_buffer member instead of sizeof()
+            to ensure chars are copied to correct location.
+        (WebCore::StringImpl::createWithTerminatingNullCharacter): Make sure copy is created
+            in a single malloc block.
+        (WebCore::StringImpl::threadsafeCopy): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::crossThreadString): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::sharedBuffer): Change to is-buffer-internal check.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::startsWith): Just fixed a confusing param name.
+        (WebCore::StringImpl::bufferIsInternal): Changed member var into accessor method.
+        (WebCore::StringImpl::m_data): Repositioned for optimal member packing in 64-bit.
+        (WebCore::StringImpl::m_buffer): Added to provide an explicit location for where internal buffer goes.
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30102
+        And
+        <rdar://problem/5015957>
+        
+        Manual test to confirm that the not-allowed cursor is shown for an
+        invalid drag-and-drop operation.
+        
+        We cannot test this using DRT because of a discrepancy between the Windows
+        API-based drop effect and the WebKit drop effect. See bug #24731 for more
+        details.
+
+        * manual-tests/drag-cursor-notallowed.html: Added.
+
+2009-10-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        This function implements showing cookies for all sub-resources of a page.
+        When the page is loaded, it populates the Storage Panel with a list of all
+        domains that were loaded as part of the full page load (iframes, ads, etc).
+        When the user selects one of the domains, the inspector calls back into the
+        controller, and the controller combines all of the cookies from that domain
+        into a list, and sends that list is sent back to the controller to render.
+        
+        A domain now needs to be passed into CookieItemsView, and CookieSidebarTreeElement.
+        
+        As a result of a previous patch, we now have detailed cookie information for
+        both Windows on CFNetwork and Mac. Additionally, this patch provides deleteCookie
+        support on Windows.
+
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::getCookies):
+        (WebCore::InspectorController::buildArrayForCookies):
+        (WebCore::InspectorController::buildObjectForCookie):
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addCookieDomainForDocument):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        (WebInspector.StoragePanel.prototype.showCookies):
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain):
+        * platform/Cookie.h:
+        (WebCore::CookieHash::hash):
+        (WebCore::CookieHash::equal):
+        (WTF::):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::deleteCookie):
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add ScriptObject::set(const char*, unsigned).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+
+2009-10-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo).
+
+        Provide implementation of new BitmapImage::create that was
+        added in @r49060.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+
+2009-10-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Refactor RenderThemeChromiumMac and RenderThemeChromiumSkia to render media controls using GraphicsContext.
+
+        Design was based on existing RenderMediaControls.cpp used by RenderThemeSafari/Win.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29987
+
+        Covered by existing layout tests as no new functionality was introduced.
+
+        * WebCore.gypi: Added RenderMediaControlsChromium.cpp/h.
+        * css/mediaControlsChromium.css: Tweaked media slider position and border style.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::toParentMediaElement): Taken from RenderMediaControls.
+        (WebCore::MediaControlElement::rendererIsNeeded): Don't call shouldRenderMediaControlPart() if element has no appearance.
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Ditto.
+        * rendering/RenderMediaControls.cpp: Moved parentMediaElement() to MediaControlElements.
+        * rendering/RenderMediaControlsChromium.cpp: Added.
+        (WebCore::platformResource): Helper to load and cache media control image resources.
+        (WebCore::mediaSliderThumbImage): Implementation refactored from RenderThemeChromiumMac/Skia.
+        (WebCore::mediaVolumeSliderThumbImage): Ditto.
+        (WebCore::paintMediaButton): Ditto.
+        (WebCore::paintMediaMuteButton): Ditto.
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSlider): Ditto.
+        (WebCore::paintMediaSliderThumb): Ditto.
+        (WebCore::paintMediaVolumeSlider): Ditto.
+        (WebCore::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::paintMediaTimelineContainer): Ditto.
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Same
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        * rendering/RenderMediaControlsChromium.h: Added.
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumMac::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground): Ditto.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Ditto.
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make plugins work with beforeload.
+
+        Added fast/dom/beforeload/flash-before-load.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-10-07  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Protect JS listener object from GC while clearing a property on it.
+        See http://crbug.com/23780.
+        https://bugs.webkit.org/show_bug.cgi?id=30137
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResourceClient class
+        https://bugs.webkit.org/show_bug.cgi?id=30165
+
+        Inherits CachedResourceClient class from FastAllocBase because (its
+        child class) CSSFontFaceSource has been instantiated by 'new' in WebCore/css/CSSFontFaceSource.h:46.
+
+        * loader/CachedResourceClient.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's IdentifierRep 
+        https://bugs.webkit.org/show_bug.cgi?id=30159                                                        
+
+        Inherits IdentifierRep class from FastAllocBase because it has been                                 
+        instantiated by 'new' in WebCore/bridge/IdentifierRep.cpp:61.  
+
+        * bridge/IdentifierRep.h:
+
+2009-10-07  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fetch pointers to C++ DOM window immediately from holder
+        object (do not search prototype chain for proper JS wrapper).
+        https://bugs.webkit.org/show_bug.cgi?id=29031
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::installDOMWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Fix typo in PluginView::load that was causing cross-origin loads to
+        be allowed
+
+        This typo was introduced in the build fix in r49213.
+
+        Fixes <http://webkit.org/b/30168> REGRESSION (r49213):
+        http/tests/plugins/local-geturl-from-remote.html is failing on Windows
+
+        Reviewed by Sam Weinig.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load): Removed a comma operator that was making
+        a condition always evaluate to true.
+
+2009-10-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Do not create valid QColor's for invalid WebCore::Color's.
+
+        * platform/graphics/qt/ColorQt.cpp:
+        (WebCore::Color::operator QColor):
+
+2009-10-07  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Symbian SBSv2 .data segment adress fix
+        https://bugs.webkit.org/show_bug.cgi?id=30157
+
+        RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
+        base address to start from 0x800000 instead of the toolchain default 0x400000
+
+        * WebCore.pro:
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate database inspection to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29788
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::databaseForId):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::getDatabaseTableNames):
+        (WebCore::InspectorBackend::reportDidDispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::selectDatabase):
+        (WebCore::InspectorController::databaseForId):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        (WebCore::InspectorDatabaseResource::database):
+        (WebCore::InspectorDatabaseResource::id):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Database.js:
+        (WebInspector.Database):
+        (WebInspector.Database.prototype.get id):
+        (WebInspector.Database.prototype.set name):
+        (WebInspector.Database.prototype.set version):
+        (WebInspector.Database.prototype.set domain):
+        (WebInspector.Database.prototype.getTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.dataGridForResult):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+
+2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins: Disable content propagation for QGraphicsView items
+        
+        We cannot support content propagation for items in QGraphicsView because
+        the contents of the backing store might be transformed. So turn it off
+        if we are not painting on QWidget.
+        
+        Note that this check will not work for a QWebView in a
+        QGraphicsProxyWidget, but I guess it's fine. Alternative is to do an
+        even uglier cast: static_cast painter's paintDevice() to QWidget and
+        check if it is the viewport() of QGraphicsView.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30149
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build by adding the missing files to the build.
+
+        * WebCore.pro:
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix incorrect convertion of double into int while assigning it to
+        a float.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix rounding error issues in height calculation in 64 bits.
+
+        Already covered by existing tests.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Dual lines in css2.1 layout tests do not match:
+        https://bugs.webkit.org/show_bug.cgi?id=23262
+
+        Now we can put a counter node as the next sibling of a reset node.
+        Re-layout the counter content when the count is updated.
+
+        Tests: fast/css/counters/t1204-increment-00-c-o.html
+               fast/css/counters/t1204-increment-01-c-o.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::recount):
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Removed unused member variable from FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30146
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        * loader/FrameLoader.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        A few small/trivial tweaks to the last build fix.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Need to adjust MessagePort, etc. code for the post clone work done.
+        https://bugs.webkit.org/show_bug.cgi?id=30147
+
+        No change in functionality so no new tests.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/SerializedScriptValue.h: Added.
+         A very simple implementation of SerializedScriptValue
+         that only works for strings.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/7271202>
+        Dispatch resource load delegate functions for the media element.
+        Since we don't get the required callbacks from the media engine,
+        just fake the parameters to the delegate functions as best as possible.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        * loader/FrameLoader.h:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More build fixes.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::getProperty):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build and formatting fix.
+
+        * ForwardingHeaders/runtime/ExceptionHelpers.h: Added.
+        * bindings/js/SerializedScriptValue.cpp:
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::operator bool):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Implement object cloning semantics for postMessage.  Currently only
+        a partial implementation of the spec -- cloning of File, FileList,
+        ImageData, and RegExp were left out as they would have significantly
+        increased patch size.
+
+        Cloning requires multiple tree walks so we use a templated tree
+        walk function, allowing us to share a single implementation for
+        serialization, deserialization, and eventual destruction of the
+        serialized object tree.
+
+        Test: fast/dom/Window/window-postmessage-clone.html
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::JSMessageEvent::initMessageEvent):
+        * bindings/js/JSMessagePortCustom.h:
+        (WebCore::handlePostMessage):
+        * bindings/js/SerializedScriptValue.cpp: Added.
+        (WebCore::SerializedObject::set):
+        (WebCore::SerializedObject::names):
+        (WebCore::SerializedObject::values):
+        (WebCore::SerializedObject::create):
+        (WebCore::SerializedObject::clear):
+        (WebCore::SerializedObject::SerializedObject):
+        (WebCore::SerializedArray::setIndex):
+        (WebCore::SerializedArray::canDoFastRead):
+        (WebCore::SerializedArray::getIndex):
+        (WebCore::SerializedArray::getSparseIndex):
+        (WebCore::SerializedArray::length):
+        (WebCore::SerializedArray::create):
+        (WebCore::SerializedArray::clear):
+        (WebCore::SerializedArray::SerializedArray):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asArray):
+        (WebCore::SharedSerializedData::asObject):
+        (WebCore::):
+        (WebCore::walk):
+        (WebCore::BaseWalker::BaseWalker):
+        (WebCore::BaseWalker::shouldTerminate):
+        (WebCore::BaseWalker::ticksUntilNextCheck):
+        (WebCore::BaseWalker::didTimeOut):
+        (WebCore::BaseWalker::throwStackOverflow):
+        (WebCore::BaseWalker::throwInterruptedException):
+        (WebCore::SerializingTreeWalker::SerializingTreeWalker):
+        (WebCore::SerializingTreeWalker::null):
+        (WebCore::SerializingTreeWalker::isArray):
+        (WebCore::SerializingTreeWalker::isObject):
+        (WebCore::SerializingTreeWalker::asInputArray):
+        (WebCore::SerializingTreeWalker::asInputObject):
+        (WebCore::SerializingTreeWalker::createOutputArray):
+        (WebCore::SerializingTreeWalker::createOutputObject):
+        (WebCore::SerializingTreeWalker::length):
+        (WebCore::SerializingTreeWalker::canDoFastRead):
+        (WebCore::SerializingTreeWalker::getIndex):
+        (WebCore::SerializingTreeWalker::getSparseIndex):
+        (WebCore::SerializingTreeWalker::getProperty):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::SerializingTreeWalker::getPropertyNames):
+        (WebCore::SerializingTreeWalker::putIndex):
+        (WebCore::SerializingTreeWalker::putProperty):
+        (WebCore::SerializingTreeWalker::startArray):
+        (WebCore::SerializingTreeWalker::endArray):
+        (WebCore::SerializingTreeWalker::startObject):
+        (WebCore::SerializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::serialize):
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::null):
+        (WebCore::DeserializingTreeWalker::isArray):
+        (WebCore::DeserializingTreeWalker::isObject):
+        (WebCore::DeserializingTreeWalker::asInputArray):
+        (WebCore::DeserializingTreeWalker::asInputObject):
+        (WebCore::DeserializingTreeWalker::createOutputArray):
+        (WebCore::DeserializingTreeWalker::createOutputObject):
+        (WebCore::DeserializingTreeWalker::length):
+        (WebCore::DeserializingTreeWalker::canDoFastRead):
+        (WebCore::DeserializingTreeWalker::getIndex):
+        (WebCore::DeserializingTreeWalker::getSparseIndex):
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::getPropertyNames):
+        (WebCore::DeserializingTreeWalker::putIndex):
+        (WebCore::DeserializingTreeWalker::putProperty):
+        (WebCore::DeserializingTreeWalker::startArray):
+        (WebCore::DeserializingTreeWalker::endArray):
+        (WebCore::DeserializingTreeWalker::startObject):
+        (WebCore::DeserializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::deserialize):
+        (WebCore::TeardownTreeWalker::shouldTerminate):
+        (WebCore::TeardownTreeWalker::ticksUntilNextCheck):
+        (WebCore::TeardownTreeWalker::didTimeOut):
+        (WebCore::TeardownTreeWalker::throwStackOverflow):
+        (WebCore::TeardownTreeWalker::throwInterruptedException):
+        (WebCore::TeardownTreeWalker::null):
+        (WebCore::TeardownTreeWalker::isArray):
+        (WebCore::TeardownTreeWalker::isObject):
+        (WebCore::TeardownTreeWalker::asInputArray):
+        (WebCore::TeardownTreeWalker::asInputObject):
+        (WebCore::TeardownTreeWalker::createOutputArray):
+        (WebCore::TeardownTreeWalker::createOutputObject):
+        (WebCore::TeardownTreeWalker::length):
+        (WebCore::TeardownTreeWalker::canDoFastRead):
+        (WebCore::TeardownTreeWalker::getIndex):
+        (WebCore::TeardownTreeWalker::getSparseIndex):
+        (WebCore::TeardownTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::getPropertyNames):
+        (WebCore::TeardownTreeWalker::putIndex):
+        (WebCore::TeardownTreeWalker::putProperty):
+        (WebCore::TeardownTreeWalker::startArray):
+        (WebCore::TeardownTreeWalker::endArray):
+        (WebCore::TeardownTreeWalker::startObject):
+        (WebCore::TeardownTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::tearDownSerializedData):
+        * bindings/js/SerializedScriptValue.h: Added.
+        (WebCore::SharedSerializedData::~SharedSerializedData):
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::type):
+        (WebCore::SerializedScriptValueData::~SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::asImmediate):
+        (WebCore::SerializedScriptValueData::asDouble):
+        (WebCore::SerializedScriptValueData::asString):
+        (WebCore::SerializedScriptValueData::asObject):
+        (WebCore::SerializedScriptValueData::asArray):
+        (WebCore::SerializedScriptValueData::operator bool ):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::deserialize):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        (WebCore::MessageEvent::data):
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::message):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::DOMWindow::postMessage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::createMessageEvent):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didReceiveMessage):
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Windows.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move FrameLoader::canLoad to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30111
+
+        * WebCore.base.exp:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        (WebCore::FrameLoader::loadPlugin):
+        (WebCore::FrameLoader::loadFrameRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::createJavaAppletWidget):
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canLoad):
+        (WebCore::SecurityOrigin::shouldHideReferrer):
+        * page/SecurityOrigin.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        These have more to do with security policies than with loading frames.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::setLocalLoadPolicy):
+        (WebCore::SecurityOrigin::restrictAccessToLocal):
+        (WebCore::SecurityOrigin::allowSubstituteDataAccessToLocal):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::):
+
+2009-10-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Preparation for <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        Implement getRawCookies for CFNetwork for Windows, so we can see more
+        than just a key/value pair for Cookies when we are on Windows.
+
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30132, make beforeload work with <link> elements and
+        XML processing instructions.
+
+        Fix up ProcessingInstruction's setData call so that it actually updates a stylesheet when the
+        data gets changed.
+
+        Move dispatchBeforeLoadedEvent to ContainerNode so all Elements (and ProcessingInstruction) can
+        access it.
+
+        Added fast/dom/beforeload/link-before-load.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/ContainerNode.h:
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        (WebCore::ProcessingInstruction::setData):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::forAttributeValue):
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+
+2009-10-06  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30028>
+        Multiple calls to SetFrontendProxyObject can leave an InspectorTimelineAgent with an invalid
+        InspectorFrontend.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject): Adds a check for an existing timeline agent.
+
+2009-10-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        Move textRects to the right category in DOM.mm. Include DOMPrivate.h to ensure that the interfaces match.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]):
+
+2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Reviewed by Ariya Hidayat.
+        
+        Match the behavior of other WebKit browser and have the first url of the drag data be the url passed in declareAndWriteDragImage and set the text of the drag data to be the title argument.
+        
+        Manual test: Drag the readability js link from http://lab.arc90.com/experiments/readability/
+        
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+
+2009-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+        
+        HTMLInputElement::max and min are not defined for COM because they
+        conflict with the standard min() and max() macros.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move m_openedByDOM to Page
+        https://bugs.webkit.org/show_bug.cgi?id=30109
+
+        We only need one instance of m_openedByDOM per page, we should move it
+        to a page-scoped object.  Notice that it's only ever touched for the
+        main frame.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::openedByDOM):
+        (WebCore::Page::setOpenedByDOM):
+        * page/Page.h:
+
+2009-10-06  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Some functions in GraphicsContext do not work
+        as expected if the associated painter has no clipping.
+        https://bugs.webkit.org/show_bug.cgi?id=29691
+
+        No new tests are associated with this because DumpRenderTree
+        always sets clipping on the painter, thus it would never hit 
+        the test case, but fast/box-shadow/basic-shadows.html is a
+        good example of what happens if the clipping is not set by
+        the user of QtWebKit.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        Fixed to handle the case that there is no clipping
+        before the call.
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30131, make beforeload fire on script elements.
+
+        Added tests in fast/dom/beforeload/.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchBeforeLoadEvent):
+        * html/HTMLScriptElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchBeforeLoadEvent):
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Enable caret movement commands also when caret browsing setting is
+        enabled.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::caretBrowsingEnabled):
+        (WebCore::enabledVisibleSelectionOrCaretBrowsing):
+        (WebCore::enabledInEditableTextOrCaretBrowsing):
+        (WebCore::CommandEntry::):
+        * manual-tests/gtk/caret-browsing.html: Added.
+
+2009-10-06  Anton Muhin  <antonm@chromium>
+
+        Reviewed by Dimitri Glazkov.
+
+        Non standard, but popular exetension allows automagically
+        turn a function into a namespace resolver.  Support that in
+        Chromium as well.
+
+        Adjust CodeGeneratorV8 to treat XPathNSResolver in a special way.
+        https://bugs.webkit.org/show_bug.cgi?id=30128
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::close):
+
+2009-10-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build by stubbing out the still image
+        support for halted plugins for the Qt build.
+
+        Bugzilla entry https://bugs.webkit.org/show_bug.cgi?id=30130
+        tracks removing this by implementing Frame::nodeImage().
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Change QImageReader usage in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Replace the ReadContext with another appoach to
+        reading the image. Attempt to only read meta information
+        like the image size and number of frames (for animations)
+        first and then when the page is getting drawn decode
+        the image with the QImageReader.
+
+        This is a huge benefit on pages with many images and saves
+        ~2GB of memory on the szeged image test page.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        (WebCore::ImageDecoderQt::failRead):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make use of RGBA32Buffer in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Use the RGBA32Buffer instead of the internal ImageData
+        to be able to use support of the base class, optionally
+        support WebCore decoders for Qt and most importantly
+        separate metadata and image data for better cache control.
+
+        Remove ImageSourceQt as everything is now shared with
+        the normal ImageSource.
+
+        Change the ownership of the NativeImagePtr/QPixmap in
+        ImageQt.cpp to delete the m_frame to be subject to cache
+        control.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::decodedImage):
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::setDecodedImage):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] ImageDecoderQt avoid QString creation.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Avoid going from CString to QString to String
+        and go directly from CString to String. Also
+        avoid going to lower case to avoid an extra
+        memory allocation.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup the ImageDecoder of Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove the various enums for partial load. The fact is
+        that this image decoder will decode everything that is
+        in the file at once. Make it look like it behaves to
+        ease fixing this core problem.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageData::ImageData):
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::hasFirstImageHeader):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Reimplement instead of overload frameCount in ImageDecoderQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Reimplement frameCount instead of overloading it.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QImageReader does not support progressive reading
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Change the ImageDecoderQt::setData to store the encoded
+        data in ImageDecoder.
+
+        Only call ReadContext when the whole Resource has been
+        loaded to avoid needless calls to reset and the
+        ReadContext as progressive loading is not supported.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove dead code from ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove unused variables and debugging code. The debug
+        code has never been used and does not provide anything
+        useful.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+
+2009-10-06  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] segfault when calling gst_video_format_parse_caps in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=30120
+
+        Fix use of gst_video_format_parse_caps()
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update mediaControls CSS
+
+        * css/mediaControlsQt.css:
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of Preferences.ignoreWhitespace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30092
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.onpopulate):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
+        * inspector/front-end/inspector.js:
+        * inspector/front-end/utilities.js:
+        (Node.prototype.rangeOfWord):
+        (traverseNextNode):
+        (traversePreviousNode):
+        (onlyTextChild):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not call nodeTitleInfo twice +
+        followup fixes for r49101.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30087
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Enable painting on printer.
+
+        The print preview dialog crashed because the depth of the drawable
+        changed owing to a bug in Qt - if you draw onto a 32-bit pixmap,
+        and set a 24-bit pixmap as source, it will convert the source to
+        32-bit.
+
+        1210fa5b2d65895ad2be1f9ca7cae586e3b29dc1 is the bug fix in Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Make painting and events work when page is zoomed.
+
+        The element gets resized when zoomed. So, we have to make sure that we resize
+        the drawable and do a setwindow call. Multiple calls to setwindow do not
+        crash plugin in windowless mode (unlike in windowed mode).
+
+        For mouse events we have to convert the pos to post-zoom position.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Add PluginQuirkRequiresDefaultScreenDepth quirk for Flash.
+
+        Flash does not use the visual provided by us to draw into the drawable.
+        It instead uses the system default visual (as returned by XDefaultVisual).
+        This means that if the screen default visual is 24-bit, Flash won't be
+        able to draw on 32-bit drawable created by us. This is a bug in Flash
+        and for the moment, the above quirk is only set for Flash.
+
+        Our strategy to create the drawable:
+        1. Create a 32-bit drawable if the default screen depth is 32 or the
+        quirk is not set (i.e not flash)
+        2. If we didn't create a 32-bit drawable (maybe the Display has no such
+        visual), we create a drawable with default screen depth.
+
+        As a result of the above changes, content propagation behavior changes as:
+        1. Content propagation is possible only if the drawable we create and
+        Qt's backing store are of the same depth.
+        2. If we created a 32-bit drawable, there is no need for content
+        propagation (Qt will take care of it).
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        * plugins/PluginQuirkSet.h:
+        (WebCore::):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Qt build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29362.
+
+        In Qt 4.5, a new function QPainter::fillRect(QRect, QColor) is
+        introduced to avoid the expensive construction of QBrush.
+        By casting WebCore::Color to QColor, we can compile on Qt 4.4
+        and use optimization for solid color fill in Qt 4.5.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::drawBorderlessRectShadow):
+
+2009-10-05  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Carlson.
+
+        Allow the platform media player to know the <video> poster URL.
+        Add MediaPlayerPrivate::prepareToPlay() to support media engines
+        that do not buffer video data automatically. This method allows
+        such media engines to start the buffering just before starting
+        playback.
+        https://bugs.webkit.org/show_bug.cgi?id=29133
+
+        All platforms that currently implement <video> return false
+        in MediaPlayerPrivate::canLoadPoster() and do nothing in
+        MediaPlayerPrivate::prepareToPlay() their behavior is
+        unchanged. The current set of media test should then be
+        sufficient to guarantee that this patch does not break anything.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        After the MediaPlayer is created, inform it what the poster URL is.
+        (WebCore::HTMLMediaElement::updatePlayState):
+        Add another case where prepareToPlay is called for the platforms
+        that do not buffer video content automatically.
+        (WebCore::HTMLMediaElement::couldPlayIfEnoughData)
+        Same as potentiallyPlaying, except that we don't check for
+        the readyState being at least HAVE_FUTURE_DATA.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::canLoadPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::NullMediaPlayerPrivate::setPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::MediaPlayer::canLoadPoster):
+        Proxy to the m_private.
+        (WebCore::MediaPlayer::setPoster):
+        Proxy to m_private.
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::canLoadPoster):
+        (WebCore::MediaPlayerPrivateInterface::setPoster):
+        Add new methods that allow the platform player to receive the poster URL.
+        (WebCore::MediaPlayerPrivateInterface::prepareToPlay):
+        Notifies the media engine that playback should start. The media engine
+        should start preparing (e.g. by initializing the player and starting to buffer)
+        and call back when the state is changed to HAVE_FUTURE_DATA.
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        All String::copy methods were changed to call either threadsafeCopy or crossThreadString. The method
+        call was made threadsafeCopy unless I could show that threadsafety wasn't needed.
+
+        No visible change in functionality so no new tests.
+
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        (WebCore::IconDatabase::iconForPageURL):
+        (WebCore::IconDatabase::iconURLForPageURL):
+        (WebCore::IconDatabase::retainIconForPageURL):
+        (WebCore::IconDatabase::releaseIconForPageURL):
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::setIconURLForPageURL):
+        (WebCore::IconDatabase::databasePath):
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin): Since this is used by SecurityOrigin::threadsafeCopy,
+        it makes threadsafe calls.
+        (WebCore::SecurityOrigin::threadsafeCopy): The only place that called this
+        needed a threadsafe method.
+        * page/SecurityOrigin.h:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/KURL.cpp:
+        (WebCore::KURL::copy):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/sql/SQLValue.cpp:
+        (WebCore::SQLValue::SQLValue):
+        (WebCore::SQLValue::string):
+        * platform/sql/SQLValue.h:
+        (WebCore::SQLValue::SQLValue):
+        All constructors now initialize the m_number which is a double. Failure to
+        do so can result in unexpected crashes when it is copied in the copy constructor.
+        See http://blogs.msdn.com/oldnewthing/archive/2008/07/02/8679191.aspx, I was that colleague.
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::threadsafeCopy):
+        (WebCore::String::crossThreadString):
+        * platform/text/StringImpl.cpp:
+        Removed StringImpl::substringCopy which was no longer being used anywhere.
+        (WebCore::StringImpl::threadsafeCopy): Changed the name to indicate that
+        it is threadsafe.
+        (WebCore::StringImpl::crossThreadString): The way to get strings for
+        another thread which is not threadsafe. This shares the underlying buffer
+        with both strings and gives them a way to do threadsafe refcounting for it.
+        * platform/text/StringImpl.h:
+        * storage/ChangeVersionWrapper.cpp:
+        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap):
+        (WebCore::Database::Database):
+        (WebCore::Database::getVersionFromDatabase):
+        (WebCore::Database::setVersionInDatabase):
+        (WebCore::Database::version):
+        (WebCore::Database::setExpectedVersion):
+        (WebCore::Database::securityOriginCopy):
+        (WebCore::Database::stringIdentifier):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::addDatabase):
+        * storage/SQLError.h:
+        (WebCore::SQLError::message):
+        (WebCore::SQLError::SQLError):
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::SQLStatement):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::syncTimerFired):
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::importItem):
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::url): Do the copy of the url in a way that is threadsafe.
+        (WebCore::SharedWorkerProxy::name):
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::DefaultSharedWorkerRepository::getProxy): Do the copy of the url in a way that is threadsafe.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::Task::Task):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Use X Pixmap instead of QPixmap.
+
+        This has the following advantages:
+        1. Allows more sharing of code between gtk and Qt ports in the future
+        2. QPixmap creates 24-bit by default. We have to later 'upgrade' it to 32-bit.
+        3. QPixmap may sometime change depth behind our back! This will require us to
+        update the plugin about the new visual and colormap.
+        4. We cannot ensure that QPixmap is backed by a X Drawable. For example, with
+        -graphicssystem raster, QPixmap uses the raster (image) backend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for windowless NPAPI plugins
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::inputEventState):
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusInEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::getPluginDisplay):
+        (WebCore::PluginView::platformStart):
+
+2009-10-05  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filters do not support source images besides "sourceGraphic"
+        [https://bugs.webkit.org/show_bug.cgi?id=6022]
+
+        Add support for SourceAlpha to SVG filters.
+
+        Test: svg/filters/sourceAlpha.svg
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect):
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+
+2009-10-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix reliablity bot crash in DateExtension.
+        https://bugs.webkit.org/show_bug.cgi?id=30033
+
+        There were a few problems using the weak persistent pointers because no one else had a
+        handle to them.  The new approach stores them as a hidden value on the Date constructor.
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::Setup):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::sleepFunction):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+2009-10-05  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash when trying to load a null stylesheet for a site specific hack. 
+        https://bugs.webkit.org/show_bug.cgi?id=30105
+
+        Created a testcase and tested in browser.  DRT doesn't test
+        site specific hacks.
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+
+2009-10-05  James Robinson  <jamesr@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix forward declaration (struct vs class mismatch)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30094
+
+        * loader/RedirectScheduler.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, last Chromium build fix corresponding to revision 49113.
+        Add include for BeforeLoadEvent to DOMObjectsInclude.h.
+
+        * bindings/v8/DOMObjectsInclude.h:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build.
+
+        * html/HTMLMediaElement.cpp:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build: MediaControllerThemeQT was renamed to MediaControllerThemeQuickTime.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add a fullscreen button to the <video> controller if the media engine,
+        and the theme have support for fullscreen, and can show appropriate controls.
+        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
+        in WebKit to do a nice animation to fullscreen, with a custom controller.
+
+        * DerivedSources.make:
+        * WebCore.Video.exp: Added.
+        New export file for when VIDEO is enabled.
+        
+        * WebCore.base.exp: Export WebCore::HTMLNames::videoTag
+        * WebCore.xcodeproj/project.pbxproj: New files
+        
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::willRemove):
+        (WebCore::HTMLMediaElement::screenRect):
+        (WebCore::HTMLMediaElement::enterFullscreen):
+        (WebCore::HTMLMediaElement::exitFullscreen):
+        (WebCore::HTMLMediaElement::platformMedia):
+        Add fullscreen logic. platformMedia returns a pointer to platform-specific playback data
+        used for fullscreen.
+        
+        * html/HTMLVideoElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen): Check with both the player and the ChromeClient
+        to see if it's possile to enter fullscreen for this element.
+        
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::supportsFullscreenForNode):
+        (WebCore::ChromeClient::enterFullscreenForNode):
+        (WebCore::ChromeClient::exitFullscreenForNode):
+        New methods
+        
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayer::platformMedia):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::platformMedia):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        New methods to return platform-specific playback data for fullscreen.
+        
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
+        Hook up the fullscreen button.
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+        Allow the RenderThemeMac to make a decision about the availability of fullscreen based
+        on the QuickTime version, since this affects what controls are availabl.e
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Export a few more methods from Settings.h
+        
+        Rubberstamped by Jon Honeycutt.
+        
+        * WebCore.base.exp:
+
+2009-10-05  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        1-char fix for obviously reverse condition.
+        https://bugs.webkit.org/show_bug.cgi?id=30100
+        No test since the only difference is a timing of GC.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::clear): Revert condition. Almost a typo.
+
+2009-09-30  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update platform-specific #ifdefs in GraphicsContext3D.h for the
+        Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=29936
+
+        * platform/graphics/GraphicsContext3D.h:
+        Changed #if PLATFORM(SKIA) to #if PLATFORM(CHROMIUM).
+
+2009-10-05  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47440): Inserting text in the middle of content in a scrolled textfield results in painting bugs
+        <rdar://problem/7269108>
+        https://bugs.webkit.org/show_bug.cgi?id=29982
+
+        Test: fast/repaint/line-in-scrolled-clipped-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Use the unclipped overflow rect
+        (including layout overflow) for the repaint rect calculation.
+
+2009-10-05  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Chromium wants to turn off SharedWorkers at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=29757
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::sharedWorker):
+        Now returns jsUndefined if isAvailable() returns false, to allow SharedWorkers to be disabled at runtime.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerRepository::isAvailable):
+        Made SharedWorkers available by default.
+        * workers/SharedWorkerRepository.h:
+        Added definition for SharedWorkerRepository::isAvailable().
+
+2009-10-05  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A super quick fix for Bug 28710.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28710
+
+        This change just resets the style sent to addStyleMarkup() to avoid an assertion error
+        and creates an empty style when computedStyleAtPosition is 0 to avoid a crash.
+        (This change is nothing but a better-than-crash change.)
+
+        Tests: editing/selection/select-crash-001.html
+               editing/selection/select-crash-002.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::editingStyleAtPosition): Resets the style sent to addStyleMarkup() if it is not valid.
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Creates an empty style if computedStyleAtPosition is 0.
+
+2009-10-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Silence duplicate errors logged for missing getComputedStyle
+        implementations. Improves the error message as well.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::logUnimplementedPropertyID):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #3.  Add V8BeforeLoadEvent.[cc|h] to derived sources.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+
+2009-10-05  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the GTK build.
+
+        * GNUmakefile.am:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #2.  Add new BEFORELOADEVENT to V8ClassIndex.
+
+        * bindings/v8/V8Index.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix.  Missing "," after entry for BeforeLoadEvent.idl. 
+
+        * WebCore.gypi:
+
+2009-10-05  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a beforeload event that will be fired before subresources load. (It isn't fired yet.)  The event
+        has one field, the URL that is going to be requested.  Setting preventDefault will stop the load
+        from occurring.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/BeforeLoadEvent.h: Added.
+        (WebCore::BeforeLoadEvent::create):
+        (WebCore::BeforeLoadEvent::initBeforeLoadEvent):
+        (WebCore::BeforeLoadEvent::url):
+        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
+        * dom/BeforeLoadEvent.idl: Added.
+        * dom/EventNames.h:
+        * page/DOMWindow.idl:
+
+2009-10-05  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Add Gentoo-specific paths for searching browser plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=30088
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::defaultPluginDirectories):
+
+2009-10-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add functionality to pause/throttle CSS transitions/animations in a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=29942
+
+        Exporting call from AnimationController
+
+        * WebCore.base.exp:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Anders Carlsson.
+        
+        * WebCore.base.exp: Update export of HaltablePlugin/PluginHalterClient.
+        * WebCore.xcodeproj/project.pbxproj: Likewise.
+
+2009-10-05  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r49104.
+        http://trac.webkit.org/changeset/49104
+
+        * html/HTMLInputElement.cpp:
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Update style immediately when validation-related values are updated.
+        https://bugs.webkit.org/show_bug.cgi?id=28868
+
+        In order to apply :valid, :invalid, :optional or :required lively,
+          - call setNeedsStyleRecalc() when properties which can change
+            willValidate state are updated, and
+             (Parent form element, name, disabled, readonly)
+          - call updateValidity() when properties which can change validity
+            state are updated. (value, pattern, required)
+
+        Tests: fast/forms/input-live-pseudo-selectors.html
+               fast/forms/textarea-live-pseudo-selectors.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::required):
+        (WebCore::HTMLFormControlElement::updateValidity):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduces
+         - new CSS pseudo selector: "-webkit-input-list-button"
+         - new CSS apperance type: "list-button"
+         - new ControlPart value: "ListButtonPart"
+        for the UI of the list attribute of the input element, and adds
+        implementation to draw ListButtonPart on Mac.
+        The code is guarded by ENABLE(DATALIST).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27794
+
+        Test: platform/mac/fast/forms/input-list-button-size.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * html/HTMLInputElement.cpp:
+        * platform/ThemeTypes.h:
+        (WebCore::):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::listButtonSizes):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::controlSize):
+        (WebCore::ThemeMac::minimumControlSize):
+        (WebCore::ThemeMac::controlBorder):
+        (WebCore::ThemeMac::paint):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-10-05  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30065>
+        nodeTitleInfo should be placed in ElementsTreeOutline.
+        
+        Move nodeTitleInfo into ElementsTreeOutline.js from utilities.js.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/utilities.js:
+
+2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Inform the application when a new request is created
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        Emit a signal each time a request is created, with the request and the frame
+        that created it.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT in updateGuidVersionMap.
+        https://bugs.webkit.org/show_bug.cgi?id=30077
+
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): ASSERT that the guidMutex() is locked.
+
+2009-10-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow V8 to throw an exception in _NPN_SetException without worrying about context
+        if we don't have enough information to find the correct context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30026
+
+        Part of the fix for Chromium's failure of LayouTests/plugins/netscape-throw-exception.html.
+
+        * bindings/v8/NPV8Object.cpp: 
+        (_NPN_SetException): Don't suppress the exception if we can't find the relevant context.
+
+2009-10-05  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Place "Close" button in docked mode on the same side as the window "Close" button in detached mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29961
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual QWebPageClient::pluginParent()
+
+        https://bugs.webkit.org/show_bug.cgi?id=29710
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] windowsKeyCodeForKeyEvent() returns a wrong value for the F10 key.
+        https://bugs.webkit.org/show_bug.cgi?id=30042
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-10-05  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for ENABLE(WEB_SOCKETS) and v8.
+
+        V8ObjectEventListener.h has been removed at r48978
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector console stops working while JS in IFRAME is paused.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29958
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce inspected object groups for console
+        and watch evaluation results so that they could be released
+        explicitly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29891
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::wrapObject):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.evaluateInCallFrame):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Move mediaControls extras for the Qt port into WebCore/css like other ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        * WebCore.pro:
+        * WebCore.qrc:
+        * css/mediaControlsQt.css: Renamed from WebCore/css/qt/mediaControls-extras.css.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Rename WebCore/css/mediaControlsQT.css and MediaControllerThemeQT
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        The QT suffix has been expanded to QuickTime, to not cause confusion
+        and name-crashes with similar files in the Qt port.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/mediaControlsQuickTime.css: Renamed from WebCore/css/mediaControlsQT.css.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet):
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30064>
+        Syntax Highlighting CSS shouldn't be duplicated.
+
+        Refactor syntax highlighting CSS into a new file, add it to the
+        projects, and have SourceFrame.js and inspector.html include the
+        new CSS file.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspectorSyntaxHighlight.css: Added.
+        * inspector/front-end/WebKit.qrc:
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30062>
+        Inspector should syntax highlight JS/CSS in elements view.
+
+        Add syntax highlighting of CSS and JavaScript tags to the elements panel.
+        Copied CSS rules from SourceFrame.js to inspector.css, and have the text nodes
+        in utilities.js call the CSS or JS Syntax highlighters if their parent is a script
+        or style tag.
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/utilities.js:
+
+2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Enable Web Sockets in chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=29917
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Revert previous patch, as the newly added test breaks other tests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fixed Function leak in V8LazyEventListener.
+        (Should fix the remaning leak in
+        https://bugs.webkit.org/show_bug.cgi?id=29093).
+        V8LazyEventListeners used to create FunctionTemplates for each
+        wrapped listener which in turn created Functions that were cached
+        forever in V8 Context. Now there is at most one such Function per
+        Context.
+        https://bugs.webkit.org/show_bug.cgi?id=30060
+
+        Added new hidden property name to store toString result:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        Switched to static FunctionTemplate:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListenerToString):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Support for WebKit's CSS Variables @variables and var()
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.CSSSourceSyntaxHighligher):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector should remember preferences for docked/undocked etc
+        https://bugs.webkit.org/show_bug.cgi?id=29089
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): toggle the preference
+        * inspector/front-end/inspector.js:
+        (WebInspector._loadPreferences): factored out loading preferences
+        (WebInspector.loaded):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Trigger the Syntax Highlighter for CSS files.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+          Factored out the Syntax Highlighting procedure into a "Class"
+          Added CSSSourceSyntaxHighlighter and JavaScriptSourceSyntaxHighlighter
+
+        (WebInspector.SourceSyntaxHighligher):
+        (WebInspector.SourceSyntaxHighligher.prototype.createSpan):
+        (WebInspector.SourceSyntaxHighligher.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighligher.prototype.process):
+        (WebInspector.CSSSourceSyntaxHighligher): the CSS Highlighter
+        (WebInspector.JavaScriptSourceSyntaxHighligher): the JS Highlighter
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Factor back-forward list methods out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30037
+
+        This change moves these back-forward related methods from FrameLoader
+        to Page.  It's possible we should move these methods into some kind of
+        "page controller" object, but we can figure that out in a future patch.
+
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/History.cpp:
+        (WebCore::History::length):
+        * page/Page.cpp:
+        (WebCore::Page::canGoBackOrForward):
+        (WebCore::Page::goBackOrForward):
+        (WebCore::Page::getHistoryLength):
+        * page/Page.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: prepare InspectorController for being used from layout tests.
+        This change adds evaluateForTestInFrontend method with the callback that
+        allows evaluating arbitrary code in the frontend context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30008
+
+        * WebCore.Inspector.exp:
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Node search mode is not getting reset on element selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30016
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30036>
+        Should be able to resize Cookie Columns.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-09-25  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Make WebCore::PluginView participate in plug-in halting.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/BitmapImage.h:
+        Declare a create() function that takes an HBITMAP.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::create):
+        Use GetObject() to fill out a DIBSECTION structure for the given
+        HBITMAP. Call CGBitmapContextCreate() to create a CG context from the
+        bits of the bitmap. Create a CG image from the context, and pass this
+        when creating a new BitmapImage.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        If we successfully started, tell our parent frame's Page.
+        (WebCore::PluginView::stop):
+        Tell our parent frame's Page that we stopped.
+        (WebCore::PluginView::node):
+
+        * plugins/PluginView.h:
+        Inherit from HaltablePlugin.
+        (WebCore::PluginView::setPlatformPluginWidget):
+        On platforms where the platform plug-in widget is the WebCore::Widget's
+        platform widget, have setPlatformPluginWidget() call
+        setPlatformWidget().
+
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::platformDestroy):
+        After destroying the window, set the platform plug-in widget to 0 to
+        ensure that Widget isn't holding a stale handle.
+        (WebCore::PluginView::halt):
+        Have our element's RenderWidget display a screenshot of the plug-in,
+        then stop the plug-in and destroy it.
+        (WebCore::PluginView::restart):
+        Clear the RenderWidget's substitute image, then start the plug-in.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::showSubstituteImage):
+        Set m_substituteImage to the passed image, and repaint.
+        (WebCore::RenderWidget::paint):
+        If we have a substitute image, paint that instead of allowing the
+        widget to paint itself.
+
+        * rendering/RenderWidget.h:
+        Declare showSubstituteImage(). Added a member to store the substitute
+        image.
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move PolicyCheck out of FrameLoader.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=30035
+
+        Purely code motion (and adding a destructor).
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCheck.cpp:
+        * loader/PolicyCheck.h:
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add NPNVToolkit value quirk in plugins for nspluginwrapper.
+        Plugin error message was:
+        ERROR: failed to initialize brower-side RPC events listener
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        (WebCore::staticPluginQuirkRequiresGtkToolKit_NPN_GetValue):
+        (WebCore::PluginPackage::load):
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] X sync our XEmbed container window creation before sending the
+        xid to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Setting zero size on a container of a video element doesn't hide the controller
+        https://bugs.webkit.org/show_bug.cgi?id=30031
+        
+        Fix a logic error in enclosingCompositingLayer() when mixing normal flow and 
+        positioned layers. This resulted in enclosingCompositingLayer() giving back a different
+        answer to the logic used to actually parent compositing layers, so layer positions
+        and layer hierarchy would be out of agreement.
+        
+        Test: compositing/geometry/clipped-video-controller.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::compositingContainer):
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingParent):
+
+2009-10-02  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Move the following methods of HTMLInputElement and HTMLTextAreaElement
+          to HTMLTextFormControlElement.
+           setSelectionStart()
+           setSelectionEnd()
+           select()
+           setSelectionRange()
+           selectionStart()
+           selectionEnd()
+           selection()
+
+        - Introduce cachedSelectionStart() and cachedSelectionEnd().
+
+        - Unify HTMLInputElement::isTextFieldWithRenderer() and
+         HTMLTextAreaElement::rendererAfterUpdateLayout() into textRendererAfterUpdateLayout().
+        
+        - Unify a part of parseMappedAttribute() of HTMLInputElement and HTMLTextAreaElement.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29782
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::textRendererAfterUpdateLayout):
+        (WebCore::HTMLTextFormControlElement::setSelectionStart):
+        (WebCore::HTMLTextFormControlElement::setSelectionEnd):
+        (WebCore::HTMLTextFormControlElement::select):
+        (WebCore::HTMLTextFormControlElement::setSelectionRange):
+        (WebCore::HTMLTextFormControlElement::selectionStart):
+        (WebCore::HTMLTextFormControlElement::selectionEnd):
+        (WebCore::HTMLTextFormControlElement::selection):
+        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::select):
+        (WebCore::HTMLInputElement::cachedSelectionStart):
+        (WebCore::HTMLInputElement::cachedSelectionEnd):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::cachedSelectionStart):
+        (WebCore::HTMLTextAreaElement::cachedSelectionEnd):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Disconnect event listeners on navigation.
+        Fixes http://crbug.com/23597.
+        https://bugs.webkit.org/show_bug.cgi?id=30027
+
+        Added V8ListenerGuard that is shared by listeners and proxy. On
+        navigation proxy sets a flag in the guard turning off listeners.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8ListenerGuard::create):
+        (WebCore::V8ListenerGuard::isDisconnected):
+        (WebCore::V8ListenerGuard::disconnectListeners):
+        (WebCore::V8ListenerGuard::V8ListenerGuard):
+        (WebCore::V8AbstractEventListener::disconnected):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::listenerGuard):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Fix WebGL build after CustomGetter constructor changes
+        https://bugs.webkit.org/show_bug.cgi?id=30020
+
+        * page/DOMWindow.idl:
+        Changed CustomGetter to JSCCustomGetter for CanvasArray constructors.
+
+2009-10-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: text in a "Request Payload" section disappears on selection
+        https://bugs.webkit.org/show_bug.cgi?id=29967
+
+        No new tests.
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Recursion guard for V8Proxy::callFunction.
+        Fixes http://crbug.com/23278.
+        https://bugs.webkit.org/show_bug.cgi?id=29974
+
+        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix test breakages by adding null checks, and putting inspector code in
+        ENABLE(INSPECTOR).
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Clean up the QNetworkReplyHandler to only apply HTTP headers
+        for protocols in the HTTP family.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Move error check into sendResponseIfNeeded() as suggested
+        by Eric Seidel. Also, remove some dead code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting.
+        <rdar://problem/7148712>
+        https://bugs.webkit.org/show_bug.cgi?id=28992
+
+        Test: editing/selection/replace-selection-crash.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Handle properly the case of
+        the destination position matching the end of the paragraph to move.
+
+2009-10-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement per-storage-area quotas for LocalStorage
+        https://bugs.webkit.org/show_bug.cgi?id=29991
+
+        I put 90% of the code in StorageMap since the decision to allow an update is
+        closely tied to quota tracking.  The quota is set via a page's Settings class.
+        Like with the local storage path and whether it's enabled, it's assumed that
+        all pages in the same group will have the same settings.  The setting defaults
+        to 5mb which is what the spec suggests, but it can easily be changed to
+        anything else--including StorageMap::noQuota.  Any values in LocalStorage are
+        grandfathered in regarudless of quota, so importItem only tracks (and will
+        never block) imports.
+
+        I believe this change is a good transition to more complex quota management.
+        For example, if we wanted to track quotas in the SQLite DB, then we'd just add
+        a function to the StorageMap that sets the quota.  This would be fine since all
+        use of LocalStorage is blocked on the import completing, so you'd never hit a
+        quota error in the mean time.  Also, if embedders wanted to ask the user
+        whether to expand the quota whenever it's hit (before deciding whether or not
+        to raise an exception), a callback via the chrome client should be fairly easy.
+        That said, I think it's best to add these features in steps rather than one
+        huge patch.  (Both of these are on my TODO list, btw.)
+
+        Included is a layout test that verifies the behavior.  It assumes the default
+        quota is 5mb (since that's what Settings defaults to).
+
+        Test: storage/domstorage/localstorage/quota.html
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setLocalStorageQuota):
+        * page/Settings.h:
+        (WebCore::Settings::localStorageQuota):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::create):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::create):
+        (WebCore::StorageMap::StorageMap):
+        (WebCore::StorageMap::copy):
+        (WebCore::StorageMap::setItem):
+        (WebCore::StorageMap::removeItem):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+        (WebCore::StorageMap::quota):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-10-02  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Database Inspector crashes Safari when table has more than 21 columns
+        https://bugs.webkit.org/show_bug.cgi?id=29924
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.dataGridForResult): adjust the minimum column width percentage to be flexible for many columns.
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/14370>.
+        Inspector's timeline should record when certain DOM events fired.
+        
+        This patch adds calls into the Web Inspector when the main frame
+        fires an load event, and when the document fires its DOMContent
+        event. Once these values are passed in, they are sent to the Web Inspector
+        as a timing change, and these are denoted by vertical lines in the resources
+        panel (blue for DOM Content, red for load event).
+
+        * English.lproj/localizedStrings.js: Added tooltip text.
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing): Added an Inspector callback for DOM Content.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent): Tell the main resource it got the event.
+        (WebCore::InspectorController::mainResourceFiredLoadEvent): Ditto.
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource): Added new variables.
+        (WebCore::InspectorResource::updateScriptObject): Send new variables to inspector.js.
+        (WebCore::InspectorResource::markDOMContentEventTime): Send a TimingChange event.
+        (WebCore::InspectorResource::markLoadEventTime): Ditto.
+        * inspector/InspectorResource.h:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.get mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Draw dividers for event timings.
+        (WebInspector.ResourceTimeCalculator.prototype.computePercentageFromEventTime):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent): Add an Inspector callback for the Load event.
+
+2009-10-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        * page/PageGroup.h:
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        * page/UserContentURLPattern.h:
+        * page/UserScript.h:
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::whitelist):
+        (WebCore::UserScript::blacklist):
+        * page/UserStyleSheet.h:
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::whitelist):
+        (WebCore::UserStyleSheet::blacklist):
+
+2009-10-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Build fix when SVG is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30011
+
+        Move TextRenderingMode related functions out from
+        the ENABLE(SVG) guard.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebGL crashes with recent CanvasArray change
+        https://bugs.webkit.org/show_bug.cgi?id=30018
+
+        Test: fast/canvas/webgl/array-unit-tests.html
+
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        Fix bug where PassRefPtr was tested after transferring value to RefPtr.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2009-10-02  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enable two point radial gradients in Chromium/Skia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30017
+
+        Covered by the following tests:
+
+        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-13-b.svg
+        LayoutTests/fast/backgrounds/svg-as-background-3.html
+        LayoutTests/fast/gradients/generated-gradients.html
+        LayoutTests/fast/gradients/simple-gradients.html
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
+        Otherwise, it is inconsistent with class declaration of QCursor.
+
+        No new tests.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        cleanup of caps handling in the video sink
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_set_caps):
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compiler warnings about unused function arguments.
+
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::initializeParserContext):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::setEndTime):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+        * platform/graphics/qt/StillImageQt.h:
+        (WebCore::StillImage::destroyDecodedData):
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::lookedUp):
+        * platform/qt/ContextMenuQt.cpp:
+        (WebCore::ContextMenu::setPlatformDescription):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::supportsFocusRing):
+        (WebCore::RenderThemeQt::systemFont):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
+        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        * platform/qt/SearchPopupMenuQt.cpp:
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::paint):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::loadChildSheet):
+        (WebCore::XSLStyleSheet::setParentStyleSheet):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTMessageHandler::handleMessage):
+        (WebCore::XSLTProcessor::transformToString):
+
+2009-10-02  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        Stale database version persists through browser refresh (changeVersion doesn't work)
+        https://bugs.webkit.org/show_bug.cgi?id=27836
+
+        Scale the cairo surface of the video sink depending on the
+        pixel-aspect-ratio of the video buffer to paint. Also
+        destruct/re-create the surface when setSize() is called with a new
+        size.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        Tests: storage/change-version-handle-reuse.html
+               storage/change-version.html
+
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Implement the V8 binding for database.changeVersion().
+        (WebCore::createTransaction): Fix a bug that was checking the wrong argument index to save the success callback.
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): Safely update the Guid/version hash map.
+        (WebCore::Database::~Database): Remove code that removes the database from the guid->database and guid->version maps.
+        (WebCore::Database::setVersionInDatabase): Add a comment to explain some behaviour.
+        (WebCore::Database::close): Move the code that updates the maps from the destructor to here.
+        (WebCore::Database::performOpenAndVerify): Call updateGuidVersionMap instead of setting the hash map directly.
+        (WebCore::Database::setExpectedVersion): Update the in memory guid->version map when we want to update the database version.
+
+2009-10-02  Janne Koskinen <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Partial WINSCW build fix.
+
+        Add parentheses around the function pointer declaration, similar to the
+        second hunk in r48825.
+
+        * loader/CachedResourceHandle.h:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempted build fix by Xcode magic.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Actually add the new files.
+
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move RedirectScheduler to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=29952
+
+        This change is purely code motion.
+
+        No behavior change.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-02  Dave MacLachlan  <dmaclach@gmail.com>
+
+        Reviewed by David Levin.
+
+        Clean up warnings in WebCore/bindings/v8/npruntime.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29971
+
+        Gets rid of warnings on gcc about using anonymous namespaces 
+          warning: 'StringKeyHashTraits' has a base
+          'WTF::GenericHashTraits<<unnamed>::StringKey>' 
+          whose type uses the anonymous namespace
+        and
+          warning: 'WTF::PairHashTraits<StringKeyHashTraits,
+          WTF::HashTraits<PrivateIdentifier*> >' has a base
+          'WTF::GenericHashTraits<std::pair<<unnamed>::StringKey,
+          PrivateIdentifier*> >' whose type uses the anonymous namespace
+
+        No tests required.
+
+        * bindings/v8/npruntime.cpp:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn on ENABLE_3D_CANVAS in TOT
+        https://bugs.webkit.org/show_bug.cgi?id=29906
+
+        Fixed a bug found when running tests with flag on
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.base.exp:
+        * bindings/js/JSCanvasArrayBufferConstructor.h:
+        (WebCore::construct):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        * html/canvas/CanvasByteArray.cpp:
+        (WebCore::CanvasByteArray::create):
+        * html/canvas/CanvasFloatArray.cpp:
+        (WebCore::CanvasFloatArray::create):
+        * html/canvas/CanvasIntArray.cpp:
+        (WebCore::CanvasIntArray::create):
+        * html/canvas/CanvasShortArray.cpp:
+        (WebCore::CanvasShortArray::create):
+        * html/canvas/CanvasUnsignedByteArray.cpp:
+        (WebCore::CanvasUnsignedByteArray::create):
+        * html/canvas/CanvasUnsignedIntArray.cpp:
+        (WebCore::CanvasUnsignedIntArray::create):
+        * html/canvas/CanvasUnsignedShortArray.cpp:
+        (WebCore::CanvasUnsignedShortArray::create):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setWebGLEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::webGLEnabled):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/7264725> Re-add a vendor prefix to box-
+        shadow (29927)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29927
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::ShadowParseContext::ShadowParseContext):
+        (WebCore::ShadowParseContext::commitValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::ShadowParseContext::commitColor):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        At bad merge at some point in the development of my patch must have 
+        put TextRenderMode.h in a weird spot in the xcodeproj. Moving it 
+        back where it belongs!
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove FrameLoader::schedule* APIs
+        https://bugs.webkit.org/show_bug.cgi?id=29950
+
+        Change clients of FrameLoader::schedule* to call redirectScheduler
+        directly.
+
+        No behavior change.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::reload):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::navigateIfAllowed):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::processHttpEquiv):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::receivedFirstData):
+        * loader/FrameLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        * page/History.cpp:
+        (WebCore::History::back):
+        (WebCore::History::forward):
+        (WebCore::History::go):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Just removing a comment I accidentally committed earlier. 
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up use of const and mutable in StorageMap
+        https://bugs.webkit.org/show_bug.cgi?id=29933
+
+        What's the point of having every single member variable be mutable and nearly
+        every method be const?  Let's clean it up.
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setIteratorToIndex):
+        (WebCore::StorageMap::key):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6934421> Support CSS for Text Kerning and 
+        ligature
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=6136
+
+        This patch makes the SVG CSS property text-rendering work with any 
+        HTML, much like it does in Firefox. It accepts four possible input 
+        values: auto, optimizeSpeed, optimizeLegibility, and 
+        geometricPrecision. Right now, in this implementation, here is what 
+        those values correspond to:
+
+        auto = optimizeSpeed = what we normally when the value's not set
+        optimizeLegibility = geometricPrecision = ligatures + kerning
+
+        Add new file TextRenderingMode.h to the project files.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS support for the new CSSPropertyTextRendering
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+        All the old SVG CSS support for this property can go away. When 
+        it's used in SVG, it will just fall into the normal HTML case.
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * css/SVGCSSValueKeywords.in:
+
+        FontDescription stores the m_textRendering bit.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::textRenderingMode):
+        (WebCore::FontDescription::setTextRenderingMode):
+        (WebCore::FontDescription::operator==):
+
+        We want to fall into the complex text rendering code path if 
+        kerning and ligatures have been enabled with this property.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache):
+
+        Now takes a TextRenderingMode as a parameter.
+        * platform/graphics/SimpleFontData.h:
+
+        New header for the enum.
+        * platform/graphics/TextRenderingMode.h: Added.
+        (WebCore::):
+
+        getCFStringAttributes() now takes a TextRenderingMode as an 
+        attribute.
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
+
+        Enable kerning and ligatures whenever the TextRenderingMode is 
+        OptimizeLegibility or GeometricPrecision
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::disableLigatures):
+        (WebCore::initializeATSUStyle):
+        (WebCore::ATSULayoutParameters::initialize):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+        More SVG CSS stuff that isn't needed anymore since SVG will use the 
+        new HTML CSS implementation.
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+        * rendering/style/SVGRenderStyleDefs.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Use isClosure property of scope proxy to decide whether the
+        scope is a closure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29965
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-10-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Odd color transitions on anchors with transition-property: all
+        https://bugs.webkit.org/show_bug.cgi?id=29911
+
+        When transitioning maybe-invalid colors, if the source and destination
+        color are both invalid, then don't animate.
+        
+        This fixes an issue where a child element of an element running a color
+        transition, with -webkit-transition-property:all, would show a color change.
+        This happened because the "maybe invalid color" logic copied the color style
+        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
+        to animate while the transition ran, and to then to disappear when the transition
+        finished.
+        
+        Test: transitions/color-transition-all.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
+        (WebCore::PropertyWrapperMaybeInvalidColor::blend):
+
+2009-10-01  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Allow dragging a node who has child nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28632
+
+        Test: fast/events/drag-parent-node.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldDragAutoNode):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] media player: better mute support
+        https://bugs.webkit.org/show_bug.cgi?id=29960
+
+        Handle volume and mute state with the two corresponding properties
+        of playbin2.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::setVolume):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] video sink pad template colorspace is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=29953
+
+        Set sink pad template colorspace depending on byte order.
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Refactored V8 event listeners:
+        (This change should fix http://crbug.com/21079 and
+        https://bugs.webkit.org/show_bug.cgi?id=29093.)
+         o All listeners use weak handles to JS objects to avoid creating
+           cycles and leaking memory.
+         o "Object" variants of listeners removed.
+         o All event accessor callbacks are generated.
+         o Custom event accessors removed.
+         o All wrappers have hidden dependencies on their listeners to
+           prevent listeners from being collected.
+         o All variats of getEventListener function grouped in V8DOMWrapper.
+         o Pointers to C++ EventListener wrappers are stored in JS objects
+           instead of event listener lists.
+        https://bugs.webkit.org/show_bug.cgi?id=29825
+
+        * WebCore.gypi: Removed "Object" listeners.
+        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
+        * bindings/v8/DOMObjectsInclude.h:
+
+        V8AbstractEventListener manages weak JS handle:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::weakEventListenerCallback):
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::setListenerObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::cast):
+        (WebCore::V8AbstractEventListener::isLazy):
+        (WebCore::V8AbstractEventListener::getListenerObject):
+        (WebCore::V8AbstractEventListener::getExistingListenerObject):
+        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
+        (WebCore::V8AbstractEventListener::disconnectFrame):
+        (WebCore::V8AbstractEventListener::disconnected):
+        (WebCore::V8AbstractEventListener::prepareListenerObject):
+        (WebCore::V8AbstractEventListener::lineNumber):
+        (WebCore::V8AbstractEventListener::virtualisAttribute):
+
+        Grouped getEventListener functions:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8DOMWrapper.h:
+
+        Removed most event listener objects bookkeeping:
+        * bindings/v8/V8EventListenerList.cpp:
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findWrapper):
+        (WebCore::V8EventListenerList::clearWrapper):
+        (WebCore::V8EventListenerList::doFindWrapper):
+        (WebCore::V8EventListenerList::getHiddenProperty):
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+
+        Added hidden properties for storing EventListener wrappers:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::listener):
+        (WebCore::V8HiddenPropertyName::attributeListener):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::isLazy):
+        * bindings/v8/V8ObjectEventListener.cpp: Removed.
+        * bindings/v8/V8ObjectEventListener.h: Removed.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
+        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::getListenerFunction):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+
+2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebGraphicsItem to QGraphicsWebView
+
+        * WebCore.pro:
+
+2009-10-01  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Read-only transactions do not change file sizes and therefore
+        should not trigger quota updates.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29945
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight):
+        (WebCore::SQLTransaction::runStatements):
+
+2009-09-30  Timothy Hatcher  <timothy@apple.com>
+
+        Fix list box scrolling by correctly overriding the scroll()
+        function on RenderBox.
+
+        <rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
+        of listboxes is broken (29756)
+
+        Reviewed by Dan Bernstein.
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scroll):
+        * rendering/RenderListBox.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::scroll):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Make a copy of listeners array before dispatching an event in
+        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
+        listener removes itself from the array next listener will be skipped.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29920
+
+        * inspector/front-end/Object.js:
+        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event
+
+2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GtkIMContext filtering interferes with DOM key events
+        https://bugs.webkit.org/show_bug.cgi?id=28733
+
+        Ensure that keyboard events filtered by the GtkIMContext still create
+        the proper DOM events.
+
+        No tests added. Instead previously skipped tests have been enabled.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] data: uri support in media player
+        https://bugs.webkit.org/show_bug.cgi?id=29842
+
+        New GStreamer element to handle data: uris. For now only base64
+        encoded data is supported. Decoded data is handed over to
+        giostreamsrc.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
+        (_do_init):
+        (webkit_data_src_base_init):
+        (webkit_data_src_class_init):
+        (webkit_data_src_reset):
+        (webkit_data_src_init):
+        (webkit_data_src_finalize):
+        (webkit_data_src_uri_get_type):
+        (webkit_data_src_uri_get_protocols):
+        (webkit_data_src_uri_get_uri):
+        (webkit_data_src_uri_set_uri):
+        (webkit_data_src_uri_handler_init):
+        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::mimeTypeCache):
+
+2009-09-30  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29944
+        
+        Reduces false positives in the XSSAuditor by explicitly allowing requests
+        that do not contain illegal URI characters.
+        
+        As a side effect of this change, the tests property-inject.html, 
+        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
+        fail because these attacks do not contain any illegal URI characters and 
+        thus are now allowed by the XSSAuditor, where previously they weren't. A future
+        change may reinstate this functionality.
+
+        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
+               http/tests/security/xssAuditor/script-tag-safe3.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Added method.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::findInRequest): Added parameter 
+        allowRequestIfNoIllegalURICharacters.
+        * page/XSSAuditor.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        reproducible freeze and crash on closing form popup at bosch-home.nl
+        https://bugs.webkit.org/show_bug.cgi?id=28948
+
+        showModalDialog calls getDirect on what is actually a window shell,
+        so ends up not getting a value (since no value can ever be placed
+        directly on the shell), which leads to incorrect behaviour.
+
+        We use a manual test rather than automatic as it was not
+        possible to get a modal run loop to work inside DRT.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog):
+        * manual-tests/showModalDialog-returnValue.html: manual testcase.
+
+2009-09-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Adds ValidityState.tooLong support for <input> and <textarea>.
+
+        Introduces tooLong() in HTMLFormControlElement and it always returns false.
+        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
+        length and maxLength.  tooLong() should work only for `dirty' values.
+        So, introduces m_isDirty flag for HTMLTextAreaElement, and
+        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.
+
+        Renames parameter names of setMaxLength().
+
+        https://bugs.webkit.org/show_bug.cgi?id=27454
+
+        Tests: fast/forms/ValidityState-tooLong-input.html
+               fast/forms/ValidityState-tooLong-textarea.html
+
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::tooLong):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::reset):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        (WebCore::HTMLTextAreaElement::tooLong):
+        * html/HTMLTextAreaElement.h:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::tooLong):
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Factor RedirectScheduler out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=29948
+
+        This change introduces a new sub-object of Frame, redirectScheduler.
+        The redirectScheduler is responsible for scheduling redirects.
+
+        This change leaves the code for the redirectScheduler in
+        FrameLoader.cpp.  A future change will move the class into its own
+        file.
+
+        No behavior change (hopefully!).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::setDefersLoading):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::didExplicitOpen):
+        (WebCore::FrameLoader::cancelAndClear):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::isScheduledLocationChangePending):
+        (WebCore::FrameLoader::scheduleHTTPRedirection):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::FrameLoader::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::FrameLoader::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::FrameLoader::provisionalLoadStarted):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        (WebCore::FrameLoader::completed):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::redirectScheduler):
+        * page/Frame.h:
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
+        Only Audio, Image, and Option should be constructable.
+        https://bugs.webkit.org/show_bug.cgi?id=29940
+
+        Test: fast/dom/dom-constructor.html
+
+        * WebCore.gypi: Added new files to project.
+        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
+          and HTMLAudioElement construction.
+        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
+        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
+        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
+        * bindings/v8/V8Index.cpp: Added new headers.
+        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
+        * bindings/v8/custom/V8CustomBinding.h: Ditto.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Added custom constructors.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        307 redirects should pass along http body and Content-Type header
+        https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        Follow-up fix for:
+        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
+        
+        Test: http/tests/loading/resources/redirect-methods-result.php
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest): Pass along http body and Content-Type header.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
+
+2009-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=29941
+        REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot
+
+        Forgot to implement a destructor for JSDOMWindowBaseData, so it was
+        leaking its RefPtr data member.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Make sure the removal of user stylesheets results in all of the WebViews being updated to
+        reflect the changes.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+
+2009-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION(r47440): drop down menus at americanexpress.com disappear on mouse out
+        https://bugs.webkit.org/show_bug.cgi?id=29209
+
+        Test: fast/inline/relative-positioned-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
+        inlines to overflow to ensure that they are included in hit-testing.
+
+2009-09-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        transforms/3d tests are not run in Release builds
+        https://bugs.webkit.org/show_bug.cgi?id=29827
+
+        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
+        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
+        WebCore was built with ENABLE_3D_RENDERING turned on.
+
+        * DerivedSources.make:
+        * WebCore.3DRendering.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for QT.  Didn't know WebCore.pro existed.
+
+        * WebCore.pro:
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a method for removal of user scripts and stylesheets by URL from a specific world.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentURLForWorld):
+        * page/PageGroup.h:
+
+2009-09-30  Chris Hawk  <hawk@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for conditionals in the WebCore gyp file, which contained two separate
+        'conditions' values for the webcore target. The first entry was ignored,
+        resulting in some missine defines.
+        https://bugs.webkit.org/show_bug.cgi?id=29907
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=29265
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are
+        destroyed.  With the current code, there actually isn't a race condition, but
+        it sure would be easy for someone to introduce one.  A bunch of
+        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
+        objects.  If it were possible any of these objects' destructors to be fired off
+        the main thread, then the you'd have a race condition.  The code should be more
+        clear and self-documenting about how things related to each other.
+
+        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
+        which is bounded by the StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
+        than pointers.  By breaking this dependency, we can eliminate the risk.
+
+        Note that we _could_ have LocalStorageThread's task queue just store
+        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
+        manually take care of deleting.  It'd probably also be possible to change
+        LocalStorageThread around so that it needn't hold onto a reference of itself
+        and have a more deterministic shutdown, but my initial attempts to do so
+        failed, and I decided it wasn't worth changing.  The queue is killed before
+        hand, so the thread is 100% impotent before the main thread continues anyway.
+
+        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
+        I'm fairly positive that it'd be impossible to hit these asserts and the fact
+        that these classes are no longer ThreadSafeShared should make it clear how
+        they're meant to be used, but I think it's worth it to be extra sure.  Of
+        course, ideally, we'd have such an assert every time a ref is incremented or
+        decremented.
+
+        Behavior should be unchanged and this is just an internal code cleanup, so no
+        new tests.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::~StorageAreaImpl):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-09-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered
+        https://bugs.webkit.org/show_bug.cgi?id=29655
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        Behavior should not change with this, so no updates to tests.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
+        (WebCore::StorageEventDispatcher::dispatch):
+        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)
+
+2009-09-30  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to check NULL frame in EventHandler::updateDragAndDrop.
+        https://bugs.webkit.org/show_bug.cgi?id=29929
+
+        Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+
+2009-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        Generalize the fix for this bug to account for cases where there may be multiple
+        containing blocks between the repaint container, and the container of the element
+        being repainted.
+
+        Test: compositing/repaint/opacity-between-absolute2.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        Call offsetFromAncestorContainer() to get the correct offset.
+        
+        (WebCore::RenderBox::computeRectForRepaint): Ditto
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint): Ditto.
+        
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetFromAncestorContainer):
+        New method that computes an offset from some object in the ancestor container() chain.
+
+2009-09-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-29  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix a couple of bugs with patterns.  Move the setting of the document URL to before the style
+        selector gets constructed so that pattern match testing gets the correct URL.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::parse):
+
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Assertion failure in http/tests/xmlhttprequest/failed-auth.html.
+
+        I couldn't find out why this only started to happen now, but it was incorrect to check
+        persistence of a credential returned by CredentialStorage::get() without checking that it
+        was non-null. When there is no credential for the protection space in storage, get()
+        returns a new object, and Credentil constructor doesn't initialize m_persistence.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Moved the
+        assertion after credential null check.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Added the same persistence
+        assertion, matching sync code (and CF one, as well).
+
+2009-09-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT for UTF8Encoding().isValid()
+        https://bugs.webkit.org/show_bug.cgi?id=29908
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::UTF8Encoding):
+
+2009-09-29  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29892
+        Add support for whitelist patterns to control conditional injection of user scripts and
+        user stylesheets.
+
+        No new tests. Not testable until WebKit portion is added in followup patch.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/UserContentURLPattern.cpp: Added.
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        (WebCore::UserContentURLPattern::parse):
+        (WebCore::UserContentURLPattern::matches):
+        (WebCore::UserContentURLPattern::matchesHost):
+        (WebCore::MatchTester::MatchTester):
+        (WebCore::MatchTester::testStringFinished):
+        (WebCore::MatchTester::patternStringFinished):
+        (WebCore::MatchTester::eatWildcard):
+        (WebCore::MatchTester::eatSameChars):
+        (WebCore::MatchTester::test):
+        (WebCore::UserContentURLPattern::matchesPath):
+        * page/UserContentURLPattern.h: Added.
+        (WebCore::UserContentURLPattern::UserContentURLPattern):
+        (WebCore::UserContentURLPattern::scheme):
+        (WebCore::UserContentURLPattern::host):
+        (WebCore::UserContentURLPattern::path):
+        (WebCore::UserContentURLPattern::matchSubdomains):
+
+2009-09-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Reproducible crash pressing return inside quoted content
+        at WebCore::BreakBlockquoteCommand::doApply.
+        <rdar://problem/7085453>
+        In some case, like the one provided in the test case, m_downStreamEnd
+        refers to a node that gets deleted when executing the DeleteSelectionCommand.
+        We shouldn't use m_downStreamEnd to recalculate the new m_endPosition when
+        pruning is needed, because it may be point to a node that has been deleted, but
+        rather rely on removeNode in CompositeEditCommand to update m_endPosition correctly.
+
+        Test: editing/selection/blockquote-crash.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Added check for invalid position
+        to avoid dereferencing a null node pointer.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Don't reset m_endPosition
+        using the value in m_downStreamEnd when it is necessary to prune the start block.
+        
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Basic authentication credentials are not sent automatically to top resources
+        https://bugs.webkit.org/show_bug.cgi?id=29901
+
+        No new tests - I don't want to pollute root directory of http tests to check for this rather
+        minor issue.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::CredentialStorage::set): Changed to always preserve leading slash.
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential): Made breaking out of the
+        loop more explicit.
+
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector REGRESSION(r47820-r47822): Profiles aren't
+        added to the inspector unless the inspector is already open
+        when the profile completes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29897
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._populateProfiles):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by David Hyatt.
+
+        Fix to logic of earlier commit 48902.
+
+        When merging two if's before committing, I forgot to invert the
+        bool check.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::ignoreHttpError):
+
+2009-09-29  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, build fix.
+
+        Fixing Chromium build, following r48884.
+
+        [https://bugs.webkit.org/show_bug.cgi?id=29894]
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-09-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Follows HTML5's maxLength change in September 2009.
+        - Change HTMLTextAreaElement.maxLength type to signed.
+        - HTMLTextAreaElement.maxLength returns -1 if maxlength= attribute is missing.
+        - HTMLTextAreaElement.maxLength and HTMLInputElement.maxLength
+          throw INDEX_SIZE_ERR for setting negative values.
+        https://bugs.webkit.org/show_bug.cgi?id=29796
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48894, because review discussion was not complete.
+        http://trac.webkit.org/changeset/48894
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+
+2009-09-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filter feComposite implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28362]
+
+        feComposite implementation for SVG.
+
+        Test: svg/filters/feComposite.svg
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::arithmetic):
+        (WebCore::FEComposite::apply):
+
+2009-09-29  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Starting all read-only transactions with an explicit BEGIN
+        DEFERRED command instead of BEGIN, since some ports (chromium)
+        might compile their own SQLite library and set BEGIN to BEGIN
+        IMMEDIATE by default; which would result in a deadlock in case of
+        two concurrent read-only transactions on the same DB, and would
+        unnecessarily delay other potential transactions to the same DB.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29729
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+
+2009-09-29  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add support for run-time flag for 3D canvas
+        https://bugs.webkit.org/show_bug.cgi?id=29826
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext): Check page settings for
+        experimental WebGL flag before returning 3D graphics context.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize new flag to false.
+        (WebCore::Settings::setExperimentalWebGLEnabled):
+        * page/Settings.h: Set new flag.
+        (WebCore::Settings::experimentalWebGLEnabled): Return new flag.
+
+2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered - part 1
+        https://bugs.webkit.org/show_bug.cgi?id=29889
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        This patch should be a no-op for all ports other than Chromium.
+
+        * WebCore.gypi:
+        * storage/StorageEventDispatcher.h: Added.
+
+2009-09-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (missed file).
+
+        Adding file missed in previous commit.
+
+        * manual-tests/gtk/resources/long_cell.cur: Copied from WebCore/dom/PositionCreationFunctions.h.
+
+2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Correct an issue with XMLHttpRequest attribute event listeners never being cleared.
+        https://bugs.webkit.org/show_bug.cgi?id=29888
+
+        Test: LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-abort-readyState-shouldDispatchEvent.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener): Added isAttribute parameter.
+        (WebCore::ACCESSOR_SETTER): Made all event listener setters create attribute listeners.
+        (WebCore::CALLBACK_FUNC_DECL): Made addEventListener create object listener.
+
+2009-09-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix corruption for non-square images.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Added an additional manual-test for this issue to the existing Gtk
+        cursor image test.
+
+        * manual-tests/gtk/cursor-image.html:
+        * manual-tests/gtk/resources/long_cell.cur: Added.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Build fix - pass a proper ScriptExecutipnContext to getEventListenerHandlerBody()
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/v8/ScriptEventListener.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+
+2009-09-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Ensure that we don't scroll lock to an anchor node after a
+        user-initiated scroll, even if that scroll doesn't propagate
+        all the way up to FrameView.
+
+        Test: fast/events/node-event-anchor-lock.html
+
+        * page/EventHandler.cpp: Call setFrameWasScrolledByUser() when a scroll is handled by a node rather than a frame.
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use setFrameWasScrolledByUser();
+        (WebCore::EventHandler::setFrameWasScrolledByUser): Split out of sendScrollEvent();
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * page/EventHandler.h: Declare setFrameWasScrolledByUser().
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Don't force EventTarget implementation on Node -
+        it doesn't work yet (it didn't quite work before this patch, too, because it assumed that
+        any object implementing EventTarget COM interface originated from WebCore).
+
+        * dom/EventListener.idl: Just like in ObjC, EventListener should be a pure interface in
+        COM bindings.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
+        fix-ups when accessing JSGlobalObject::d.
+        
+        Replaced with an explicit destructor function pointer.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::destroyJSDOMGlobalObjectData):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Don't rely on QNetworkReply::NetworkError codes, but
+        on HTTP error codes instead.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::ignoreHttpError):
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Use const references when using Qt's foreach.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix handling of QNetworkReply errors.
+
+        In the QNetworkReplyHandler::finish() a response was sent even when
+        the reply contained an error. This resulted in a sendResponseIfNeeded()
+        calling didReceiveResponse on the client, leading to the destruction
+        of the m_resourceHandle, discontinuing further processing in finish(),
+        and thus not calling didFail on the client.
+
+        Instead it continued as everything went fine, and
+        FrameLoaderClientQt::dispatchDecidePolicyForMIMEType() changed the
+        policy to PolicyDownload due to not being able to show the non existing
+        MIMEType. As the download also obviously fails, it ended up with a
+        policy change error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        The code for showing error pages when the response was
+        a 401/403/404, was not actually doing so. This patch
+        fixes that.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/7259965> REGRESSION: http/tests/xmlhttprequest/cross-origin-authorization.html
+        is failing/crashing intermittently
+        https://bugs.webkit.org/show_bug.cgi?id=29322
+
+        This was caused by CStringBuffer::encodeBase64() returning a buffer that wasn't zero terminated.
+        The code had other issues as well, so I removed it altogether:
+        - it claimed to avoid some buffer copies, but it didn't;
+        - and I don't think that base64 encoding should be part of CString interface.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::encodeBasicAuthorization): Encode username and password using Base64.h directly.
+        (WebCore::ResourceHandle::start): Use encodeBasicAuthorization().
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Extended logging
+        to synchronous case.
+        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveData:]): Ditto.
+        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didFailWithError:]): Ditto.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Matched Mac changes.
+
+        * platform/text/CString.cpp:
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+        Removed code that was added for Base64 in r48363.
+
+2009-09-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix typo in Localizations.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=29872
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementHelpText):
+
+2009-09-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make the XSLT conditional in DOMWindow.idl's xsltProcessor
+        attribute conditional in the generated files, similar to
+        r44116.
+
+        * page/DOMWindow.idl:
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann and Tor Arne Vestbø.
+
+        Use the ResourceError as it is supposed to and handle
+        not HTTP errors from QNetworkReply.
+
+        Thanks to Adam Roben for his input.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Encapsulate JS listeners specifics into ScriptEventListener.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29816
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/v8/ScriptEventListener.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+
+2009-09-29  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the build.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add experimentalWebSocketsEnabled in Settings.
+        https://bugs.webkit.org/show_bug.cgi?id=28941
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalWebSocketsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalWebSocketsEnabled):
+        
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add platform code to support WebSocket for chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29171
+
+        To build within chromium tree, it requires a patch in bug 29174.
+        Real implementation will be landed in chromium tree.
+
+        * WebCore.gypi:
+        * platform/network/chromium/SocketStreamError.h: Added.
+        (WebCore::SocketStreamError::SocketStreamError):
+        * platform/network/chromium/SocketStreamHandle.h: Added.
+        (WebCore::SocketStreamHandle::create):
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7157288> Crash in RenderStyle::computedLineHeight()
+        when Times New Roman is not installed
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): If Times New Roman is
+        not available, use the Windows default GUI font.
+
+2009-09-28  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Do not add platform-specific methods to cross-platform header
+        FileSystem.h per Darin's feedback for 29109.
+        https://bugs.webkit.org/show_bug.cgi?id=29830
+
+        * platform/FileSystem.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        * platform/chromium/FileSystemChromium.cpp:
+
+2009-09-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Register Chromium's VFSs with a proper sqlite3_io_methods
+        finder. This should only affect the POSIX implementation. The
+        Windows change is included for consistency and in case sqlite
+        starts using something similar in its Windows VFS in the future.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29743
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Change the V8 bindings' handling of window.toString(),
+        so we return [object DOMWindow] (like JSC), not [object global].
+
+        https://bugs.webkit.org/show_bug.cgi?id=29742
+
+        This will fix a couple of Chromium port test failures and enable us to
+        use the default expectations for a bunch more.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Use the DOMWindow wrapper instead
+        of the global object wrapper when it's available in the DOMWindow toString callback.
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Rubber stamped by David Levin.
+
+        Chromium build fix, add back in #include of V8Proxy.h in V8WebKitPointConstructor.cpp.
+
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Re-include V8Proxy.h.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
+        https://bugs.webkit.org/show_bug.cgi?id=29822
+        
+        Added NotNullPassRefPtr, and deployed it in all places that initialize
+        JavaScript objects.
+
+        * bindings/js/DOMObjectWithSVGContext.h:
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObject::DOMObject):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        * bridge/runtime_object.h:
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Allow V8 to handle x/y parameters in a WebKitPoint constructor.
+        https://bugs.webkit.org/show_bug.cgi?id=29823
+
+        Fixes V8's handling of LayoutTests/fast/dom/Window/webkitConvertPoint.html
+
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Allow for x/y parameters in constructor.
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build by doing something approximating reasonableness in the Xcode project.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective Tiger build fix.
+
+        * WebCore.xcodeproj/project.pbxproj: Try to use unique IDs for the new files.
+
+2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add explicit frontend event for commit load.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29814
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didCommitLoad):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDocument):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.didCommitLoad):
+
+2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium port - recognize we are being built independently
+        of chromium and look for dependencies under webkit/chromium rather
+        than chromium/src.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29722
+
+        * WebCore.gyp/WebCore.gyp: See above. Also removed a few files from
+          the sources list, since they are not supposed to be built here.
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement XSLT support with QtXmlPatterns.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::setTransformSource):
+        * dom/Document.h:
+        (WebCore::Document::transformSource):
+        * dom/TransformSource.h: Added.
+        (WebCore::TransformSource::platformSource):
+        * dom/TransformSourceLibxslt.cpp: Added.
+        (WebCore::TransformSource::TransformSource): Wraps a libxml2 document.
+        (WebCore::TransformSource::~TransformSource):
+        * dom/TransformSourceQt.cpp: Added.
+        (WebCore::TransformSource::TransformSource): Wraps a plain string.
+        (WebCore::TransformSource::~TransformSource):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::parseProcessingInstruction):
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::sheetString):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::document):
+        * xml/XSLStyleSheetQt.cpp: Added.
+        * xml/XSLTProcessor.h:
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xmlDocPtrFromNode):
+        * xml/XSLTProcessorQt.cpp: Added.
+        (WebCore::XSLTMessageHandler::XSLTMessageHandler): A subclass of QAbstractMessageHandler.
+        (WebCore::XSLTMessageHandler::handleMessage): Forwards all processor messages to the Console.
+        (WebCore::XSLTProcessor::transformToString): Uses QXmlQuery.
+
+2009-09-28  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Delegate implementation of rendererIsNeeded() for media control elements to RenderTheme.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28689
+
+        Covered by LayoutTests/media/video-no-audio.html
+
+        * rendering/MediaControlElements.cpp: Removed subclass implementations of rendererIsNeeded().
+        (WebCore::MediaControlElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
+        * rendering/MediaControlElements.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::shouldRenderMediaControlPart): New method.  Contains logic moved from subclass implementations of rendererIsNeeded().
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Override to always render mute button.
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-28  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] DragData::asURL should return file URL.
+        https://bugs.webkit.org/show_bug.cgi?id=29109
+
+        Tested by LayoutTests/fast/events/drag-to-navigate.html.
+
+        * platform/FileSystem.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::getAbsolutePath):
+        (WebCore::isDirectory):
+        (WebCore::filePathToURL):
+
+2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Add a special case to handle index arguments, because we need to be
+        able to see if they're < 0.
+        https://bugs.webkit.org/show_bug.cgi?id=29810
+
+        Test: LayoutTests/dom/html/level1/core/hc_characterdataindexsizeerrdeletedatacountnegative.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added special case (matching CodeGeneratorJS.pm)
+          for index arguments.
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Extend the MediaWiki/KHTMLFixes.css workaround to cover older MediaWiki versions
+        https://bugs.webkit.org/show_bug.cgi?id=29792
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the linked style sheet is one of two versions of the
+        MediaWiki KHTMLFixes.css. If so, remove the offending rule.
+
+2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fix an error in type logic in CodeGeneratorV8.pm, where
+        unsigned ints are accidentally used as signed.
+        https://bugs.webkit.org/show_bug.cgi?id=29810
+
+        Test: LayoutTests/fast/forms/textarea-maxlength.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Made sure "unsigned long" in IDL is
+          properly generates on "unsigned" return value.
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        In preparation for adding XSLT support with QtXmlPatterns to the Qt
+        port, rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp as we will
+        have our own implementation which most likely will not share any code
+        with the current one.
+
+        Additionally, fix some coding style issues.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * xml/XSLStyleSheet.cpp: Renamed to XSLStyleSheetLibxslt.cpp.
+        * xml/XSLStyleSheetLibxslt.cpp: Added.
+
+2009-09-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective build fix for r48812.
+
+        Forgot to remove the inline reset() implementation when reverting the indentation
+        changes in the file.
+
+        * xml/XSLTProcessor.h:
+
+2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial follow up fix), Joseph Pecoraro LGTM-ed.
+
+        Web Inspector: Follow up to r48809.
+        InspectorController.wrapObject should only be called on the inspectable page side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17429
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        (WebInspector.EventListenersSection):
+        (WebInspector.EventListenersSection.prototype.update):
+        (WebInspector.EventListenerBar):
+        (WebInspector.EventListenerBar.prototype.update):
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Move the libxslt specific part of XSLTProcessor to a separate file.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        In preparation for adding XSLT support with QtXmlPatterns to the Qt
+        port, move the libxslt part of the XSLTProcessor implementation into
+        another file and leave the part that can be reused and shared.
+
+        Additionally, fix some coding style issues.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::createDocumentFromSource): Remove trailing whitespaces.
+        (WebCore::createFragmentFromSource): Remove trailing whitespaces.
+        (WebCore::XSLTProcessor::transformToFragment): Remove trailing whitespaces.
+        (WebCore::XSLTProcessor::reset): Moved out of the class definition.
+        * xml/XSLTProcessorLibxslt.cpp: Added.
+        (WebCore::XSLTProcessor::genericErrorFunc): Moved.
+        (WebCore::XSLTProcessor::parseErrorFunc): Moved.
+        (WebCore::docLoaderFunc): Moved.
+        (WebCore::setXSLTLoadCallBack): Moved.
+        (WebCore::writeToVector): Moved.
+        (WebCore::saveResultToString): Moved.
+        (WebCore::xsltParamArrayFromParameterMap): Moved.
+        (WebCore::freeXsltParamArray): Moved.
+        (WebCore::xsltStylesheetPointer): Moved.
+        (WebCore::xmlDocPtrFromNode): Moved.
+        (WebCore::resultMIMEType): Moved.
+        (WebCore::XSLTProcessor::transformToString): Moved.
+
+2009-09-28  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix the crash of SVG that crashes when use a non-exist symbol
+        https://bugs.webkit.org/show_bug.cgi?id=27693
+
+        Test: svg/custom/use-non-existing-symbol-crash.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::shadowTreeContainsChangedNodes):
+
+2009-09-28  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Should Show Event Listeners/Handlers Registered on each Node
+        https://bugs.webkit.org/show_bug.cgi?id=17429
+        
+          Extracted a method from dispatchEvent to get the event ancestor chain
+        
+        * dom/Node.cpp:
+        (WebCore::Node::eventAncestors): the extracted method
+        (WebCore::Node::dispatchGenericEvent): use eventAncestors
+        * dom/Node.h:
+
+          Asynchronous Flow For the Inspector, Backend -> DOM Agent -> Frontend
+          The DOMAgent's getEventListenersForNode handles the logic of finding
+          all the relevant listeners in the event flow.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getEventListenersForNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        (WebCore::InspectorDOMAgent::buildObjectForNode): added localName
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::EventListenerInfo::EventListenerInfo):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        * inspector/InspectorFrontend.h:
+        (WebCore::InspectorFrontend::scriptState):
+        * inspector/front-end/DOMAgent.js: added localName to WebInspector.DOMNode from payload
+        (WebInspector.EventListeners.getEventListenersForNodeAsync.mycallback):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+
+          New Sidebar Pane in the Element's Panel
+          Includes Gear Menu for filtering the Event Listeners on the
+          "Selected Node Only" or "All Nodes"
+
+        * inspector/front-end/ElementsPanel.js: Handles refreshing the Pane when necessary
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.updateEventListeners):
+        * inspector/front-end/EventListenersSidebarPane.js: Added. 
+        (WebInspector.EventListenersSidebarPane): The 1st level in the Pane
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        (WebInspector.EventListenersSection): The 2nd level in the Pane
+        (WebInspector.EventListenersSection.prototype.update): filters on Preference
+        (WebInspector.EventListenersSection.prototype.addListener):
+        (WebInspector.EventListenerBar): The 3rd level in the Pane
+        (WebInspector.EventListenerBar.prototype._getNodeDisplayName):
+        (WebInspector.EventListenerBar.prototype._getFunctionDisplayName):
+        (WebInspector.EventListenersSidebarPane.prototype._changeSetting): For the Gear Menu
+        
+          Consolidated "appropriateSelectorForNode"
+
+        * inspector/front-end/StylesSidebarPane.js:
+        * inspector/front-end/utilities.js:
+
+          Miscellaneous Updates
+
+        * English.lproj/localizedStrings.js: "Event Listeners", "No Event Listeners", "Selected Node Only", "All Nodes"
+        * WebCore.gypi: included the new inspector files
+        * WebCore.vcproj/WebCore.vcproj: included source files that were missing
+        * inspector/front-end/Images/grayConnectorPoint.png: Added. Thanks to Timothy Hatcher.
+        * inspector/front-end/Images/whiteConnectorPoint.png: Added. Thanks to Timothy Hatcher.
+        * inspector/front-end/inspector.js: Preferences for the Gear Menu Event Listeners filter
+        * inspector/front-end/inspector.css: reused as much as possible
+        * inspector/front-end/inspector.html: include the new script
+        * inspector/front-end/WebKit.qrc: included the new inspector files
+
+2009-09-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29760
+        Implement CSSOM Range.getClientRects/getBoundingClientRect 
+
+        Tests: fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html
+               fast/dom/Range/getBoundingClientRect.html
+               fast/dom/Range/getClientRects.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::getClientRects):
+        (WebCore::Range::getBoundingClientRect):
+        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoom):
+        (WebCore::Range::getBorderAndTextQuads):
+        * dom/Range.h:
+        * dom/Range.idl:
+        Implement Range.getClientRects/getBoundingClientRect.
+
+        * dom/Element.cpp:
+        * rendering/RenderObject.h: 
+        (WebCore::adjustForAbsoluteZoom):
+        (WebCore::adjustIntRectForAbsoluteZoom):
+        (WebCore::adjustFloatPointForAbsoluteZoom):
+        (WebCore::adjustFloatQuadForAbsoluteZoom):
+        Move point/quad adjustment methods from Element.cpp to RenderObject.h
+        so that Range.cpp can use them as well.
+
+2009-09-27  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial ChangeLog fix).
+
+        Restore WebCore/ChangeLog truncated in r48778.
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM store is being unbound twice, leading to assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29770
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::unbind):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not track DOM changes while inspector window is closed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29769
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] Double Clicking Resources Fails to Open in New Window
+
+        https://bugs.webkit.org/show_bug.cgi?id=29762
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleText):
+        (InjectedScript.openInInspectedWindow):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
+
+        * DerivedSources.make: Moved Platform.h check for
+        ENABLE_ORIENTATION_EVENTS into Mac-only section and added
+        default of ENABLE_ORIENTATION_EVENTS = 0 to non-Mac section.
+        Added ifndef test to make it possible to override both
+        ENABLE_DASHBOARD_SUPPORT and ENABLE_ORIENTATION_EVENTS external
+        to the makefile.  Moved addition of ENABLE_ORIENTATION_EVENTS to
+        ADDITIONAL_IDL_DEFINES to common section.
+        * GNUmakefile.am: Added support for ENABLE_ORIENTATION_EVENTS if
+        it is ever used.
+        * WebCore.pro: Ditto.
+
+2009-09-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        Move placeholder-related code to HTMLTextFormControlElement from
+        HTMLInputElement, WMLInputElement, InputElement, and
+        HTMLTextAreaElement.
+        https://bugs.webkit.org/show_bug.cgi?id=28703
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/InputElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::~HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
+        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
+        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLTextFormControlElement::handleFocusEvent):
+        (WebCore::HTMLTextFormControlElement::handleBlurEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::handleFocusEvent):
+        (WebCore::HTMLInputElement::handleBlurEvent):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::supportsPlaceholder):
+        (WebCore::HTMLInputElement::isEmptyValue):
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::createRenderer):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::supportsPlaceholder):
+        (WebCore::HTMLTextAreaElement::isEmptyValue):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::createRenderer):
+        * wml/WMLInputElement.h:
+
+2009-09-26  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Optimize the code so only the text from start to end is scanned.
+        https://bugs.webkit.org/show_bug.cgi?id=29092
+
+        On a platform with webkit+Qt+Symbian, the parsing time for a 600K text
+        file improved from 400ms to 40ms (10x faster).
+
+        * dom/Text.cpp:
+        (WebCore::Text::createWithLengthLimit):
+
+2009-09-26  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        This Patch fixes [chromium] the drop-down is always left-aligned even
+        for RTL element.
+        https://bugs.webkit.org/show_bug.cgi?id=29612
+
+        For auto-complete, the items in drop-down should be right-aligned if
+        the directionality of <input> field is RTL.
+        For <select><option>, the items in drop-down should be right-aligned
+        if the directionality of <select> is RTL.
+
+        No automatic test is possible. Manual tests are added.
+
+        * manual-tests/autofill_alignment.html: Added.
+        * manual-tests/select_alignment.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow): Adjust the starting x-axis of text to
+        be paint if it should be right-aligned.
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION (r48775) FontList.plist written by TOT WebKit causes Safari 4
+        to crash on launch
+        https://bugs.webkit.org/show_bug.cgi?id=29759
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::writeFontDatabaseToPlist): Reverted to saving the CG font DB
+        property list at the root of FontList.plist, but with an additional
+        key for the last value of the Fonts registry key.
+        (WebCore::populateFontDatabase): Pass the FontList.plist in its entirety
+        to populatFontDatabaseFromPlist.
+
+2009-09-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix. Adding missing header files.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+
+2009-09-25  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        * DerivedSources.make: Move tests for ENABLE_CONTEXT_MENUS,
+        ENABLE_DRAG_SUPPORT and ENABLE_INSPECTOR into Mac-only section.
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Load blocks during unload should not affect targeted loads
+        https://bugs.webkit.org/show_bug.cgi?id=29747
+
+        Move the check of the unload state after checking for targeted links.
+
+        Test: fast/loader/unload-hyperlink-targeted.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+
+2009-09-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Add initial V8 bindings for WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=29664
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CanvasArrayBufferCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CanvasArrayCustom.h: Added.
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8CanvasByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasFloatArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp: Added.
+        (WebCore::jsArrayToFloatArray):
+        (WebCore::jsArrayToIntArray):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8CanvasShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        This is breaking Chromium try bots, so I'm counting this as a build fix.
+
+        Add more svn:ignore exceptions.  On different platforms, these files are
+        generated with different case for WebCore.
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reverting r48767, as it broke Windows build in a non-trivial way.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::jsFunction):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::reportError):
+        (WebCore::EventListener::jsFunction):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+
+2009-09-24  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add a gyp variable to allow building a debug webcore without debug
+        symbols.  This allows for faster compile, link, and gdb times.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29721
+
+        No new tests, build config change.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-25  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Declare RegisteredEventListener as a class instead of a struct.
+        This fixes a warning in the Chromium build.
+
+        * dom/RegisteredEventListener.h:
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebCore part of
+        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
+        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
+
+        When the Windows Fonts directory contains more than one font file for a
+        given font name, which of the fonts gets assigned to the name in the
+        Core Graphics font database was determined arbitrarily and did not
+        always match the font GDI used for the same font name. The mismatch
+        caused character-to-glyph mapping to use one font and glyph rendering to
+        use another.
+
+        The fix is to update the Core Graphics font database from the registry
+        entries (that reflect the name-to-font mapping that GDI uses) after
+        populating it with the result of scanning the Fonts directory. As a
+        consequence, the directory needs to be scanned at startup every time the
+        registry key changes, so the last value of the registry key is kept
+        in the property list on disk so that it could be compared to the current
+        value on startup.
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::populateFontDatabaseFromPlist): Now takes a property list as
+        a parameter and avoids round-tripping through XML by calling
+        wkAddFontsFromPlist() instead of wkAddFontsFromPlistRepresentation().
+        (WebCore::fontFilenamesFromRegistryKey):
+        (WebCore::cgFontDBKey):
+        (WebCore::writeFontDatabaseToPlist): Now takes the CG font DB property
+        list and a property list with the font filenames from the registry and
+        writes a dictionary with those property lists as values.
+        (WebCore::fontFilenamesFromRegistry): Added. Returns an array with the
+        values in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
+        registry key.
+        (WebCore::populateFontDatabase): Changed to read the contents of the
+        Fonts registry key and compare it with the last-saved value from the
+        property list, and to call wkAddFontsFromRegistry() after populating the
+        CG font DB from the file system. Uses wkCreateFontsPlist() instead of
+        wkCreateFontsPlistRepresentation() to avoid round-tripping through XML.
+
+2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Inlined some object creation code, including lexicalGlobalObject access
+        https://bugs.webkit.org/show_bug.cgi?id=29750
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::hasBreakpoint): Updated for JavaScriptCore
+        API changes.
+
+2009-09-25  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24399
+        Make @import work in user stylesheets.  The first bug was that the URL wasn't being set on the
+        user sheets themselves, so relative @import URLs couldn't resolve properly.  The second bug
+        was that the loads would be denied.  This is fixed by using the requestUserCSSStyleSheet method
+        instead of the normal request method.  In order to know when to do this, CSSStyleSheets now have
+        a propagated boolean, m_isUserStyleSheet, that lets them know if they are user stylesheets or not.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::setIsUserStyleSheet):
+        (WebCore::CSSStyleSheet::isUserStyleSheet):
+        * dom/Document.cpp:
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::pageGroupUserSheets):
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        It's possible for RenderObject::container() to return an object that is higher
+        in the hierarchy than the repaintContainer that is being used to repaint an
+        object. For example, this can happen when running an accelerated opacity
+        transition on an element with a position:absolute parent, and a position:absolute child.
+        
+        In this case we need to detect when RenderObject::container() will skip over
+        repaintContainer, and in that case adjust the coords to shift into repaintContainer's space.
+
+        Test: compositing/repaint/opacity-between-absolute.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::container):
+        * rendering/RenderObject.h:
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash with hardware accelerated rotation of a PDF image in a data URL
+        <rdar://problem/7250378>
+        
+        PDF images don't return a color space from CGImageGetColorSpace(),
+        so we need to null-check the return value before use.
+
+        Test: compositing/color-matching/pdf-image-match.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-09-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Null-deref when first access to an Attr node is after its Element is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=29748
+
+        Test: fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
+        long as the Attr is alive.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
+        long as the NamedNodeMap is alive.
+
+        * dom/Attr.idl: Added CustomMarkFunction attribute.
+
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
+        (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
+        have attributes hanging around that might need an Attr node created; that way
+        we won't crash with a null-dereference trying to deal with one of them. This
+        can't happen when working with JavaScript since the Element will be kept
+        alive due to the change above.
+        (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
+        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "+ 1" and added
+        missing braces.
+
+        * dom/NamedAttrMap.h: Made the element function public so it can be used by
+        the JavaScript binding to keep the Element alive.
+
+        * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
+
+2009-09-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+2009-09-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler, Dan Bernstein, Adele Peterson, and others.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29740
+        <rdar://problem/7168738> Gmail: After changing a foreground text color, pressing return doesn't apply background to new line
+
+        Change the way style is preserved when inserting a new paragraph.
+        The original code handled insertion at the beginning and at the end of a paragraph as special
+        cases. The newly created paragraph contained a set of nodes generated starting from the
+        computed style of the insertion node. This approach has two problems:
+        1. if the insertion node has a non opaque background color and one of the parent element did have
+        a solid background color the new paragraph did not have the element with the solid color in the tree.
+        2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
+        background color and some font attribute was being reproduced as span + bold + italic + font as separate tags.
+        The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
+        paragraph where the insertion point is.
+
+        Test: editing/inserting/insert-bg-font.html
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock): retrieves the list of all the ancestors
+        between the insert node and the outer block.
+        (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock): uses the list of ancestors to recreate
+        in the new paragraph the same element hierarchy present in the starting paragraph.
+        (WebCore::InsertParagraphSeparatorCommand::doApply): changed the code to handle the general case of insertion
+        in the middle of the paragraph to use the new methods. Changed the handling of the insertion at the beginning and
+        at the end of the paragraph to use the new methods instead of applying the calculated style.
+        * editing/InsertParagraphSeparatorCommand.h: added methods getAncestorsInsideBlock and cloneHierarchyUnderNewBlock.
+
+2009-09-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Content-type parameters not taken into account when building form-data
+        https://bugs.webkit.org/show_bug.cgi?id=28970
+
+        existing manual test case extended with new tests
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        * manual-tests/inspector/display-form-data.html:
+
+2009-09-25  Yuan Song  <song.yuan@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14566
+
+        Raise SECURITY_ERR exception if an attempt is made to change document.domain to an invalid value.
+
+        Test: fast/js/invalid-domain-change-throws-exception.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setDomain):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        When setTimeout is called with a string argument in an isolated
+        world, we now compile the string in the isolated world.
+
+        Last time we tried this change, we got a lot of crashes.  This
+        time we're using a fresh local handle as our context to avoid
+        trouble if the peristent handle gets disposed before we leave
+        the context.
+
+        Test: fast/dom/timer-clear-interval-in-handler-and-generate-error.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-25  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a regression in Mac Chromium popup menus, where the user's
+        selection was ignored and the popup became unresponsive.
+        https://bugs.webkit.org/show_bug.cgi?id=29726
+
+        The fix is to notify the popup's client that the popup was hidden,
+        even if the popup has no parent.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Enable Pasteboard::writePlainText for Chromium and fix code style nits.
+        https://bugs.webkit.org/show_bug.cgi?id=29734
+
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+
+2009-09-25  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28876
+        [Qt] reduce peak memory consumption of text decoding.
+
+        Chop large input buffer into small buffers to reduce peak memory
+        during decoding.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add a mechanism for automatically halting plug-ins.
+
+        Reviewed by Oliver Hunt and Alice Liu.
+
+        * GNUmakefile.am:
+
+        * WebCore.base.exp:
+        Update export of Page constructor.
+
+        * WebCore.gypi:
+
+        * WebCore.pro:
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Add PluginHalter.{h,cpp}, PluginHalterClient.h, and
+        HaltablePlugin.h.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add files to Mac project.
+
+        * loader/EmptyClients.h:
+        Added an empty PluginHalterClient.
+        (WebCore::EmptyPluginHalterClient::shouldHaltPlugin):
+        Return false.
+
+        * page/PluginHalter.cpp: Added.
+        (WebCore::PluginHalter::PluginHalter):
+        (WebCore::PluginHalter::didStartPlugin):
+        Add the object to the plug-in set. If this is the only item in the set,
+        set m_oldestStartTime to this object's time, and start the timer.
+        (WebCore::PluginHalter::didStopPlugin):
+        Remove the plug-in from the set.
+        (WebCore::PluginHalter::timerFired):
+        Find the cut-off time as the current time minus the allowed run time;
+        plug-ins older than this may be halted. Iterate over the plug-ins. Find
+        the object with the oldest start time that is too young to be halted;
+        we'll use its start time to set the timer's next fire time. For all
+        plug-ins that are candidates to be halted, call the
+        PluginHalterClient's shouldHaltPlugin(). If this function returns true,
+        call the plug-in's halt() function. Remove these objects from the set
+        of tracked plug-ins. Call startTimerIfNecessary() to restart the timer.
+        (WebCore::PluginHalter::startTimerIfNecessary):
+        If the timer is set to fire, or the set of tracked plug-ins is empty,
+        return early. Set the timer to fire after the oldest plug-in has run
+        for the allowed run time.
+
+        * page/PluginHalter.h: Added.
+        (WebCore::PluginHalter::setPluginAllowedRunTime):
+
+        * page/PluginHalterClient.h: Added.
+        (WebCore::PluginHalterClient::~PluginHalterClient):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Initialize m_pluginHalterClient. Call pluginHalterEnabledStateChanged()
+        to create the PluginHalter if necessary.
+        (WebCore::Page::pluginHalterEnabledStateChanged):
+        If plug-in halting is enabled, create the PluginHalter. If it is
+        disabled, clear it.
+        (WebCore::Page::pluginAllowedRunTimeChanged):
+        If there is a plug-in halter, call its setPluginAllowedRunTime().
+        (WebCore::Page::didStartPlugin):
+        If there is a plug-in halter, call its didStartPlugin().
+        (WebCore::Page::didStopPlugin):
+        If there is a plug-in halter, call its didStopPlugin().
+
+        * page/Page.h:
+        Add a parameter to the Page constructor for the PluginHalterClient.
+        Added declarations for didStartPlugin() and didStopPlugin(), which are
+        called when HaltablePlugins are added to or removed from the page. Adds
+        pluginAllowedRunTimeChanged() and pluginHalterEnabledStateChanged() to
+        notify the Page when these settings are changed. Added members to hold
+        the PluginHalter and the PluginHalterClient.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPluginHalterEnabled):
+        If the enabled state has changed, call the Page's
+        pluginHalterEnabledStateChanged().
+        (WebCore::Settings::setPluginAllowedRunTime):
+        Call the Page's pluginAllowedRunTimeChanged().
+
+        * page/Settings.h:
+        (WebCore::Settings::pluginHalterEnabled):
+        (WebCore::Settings::pluginAllowedRunTime):
+
+        * page/HaltablePlugin.h: Added. Defines an interface for plug-ins that
+        can be automatically halted.
+        (WebCore::HaltablePlugin::~HaltablePlugin):
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        Pass a dummy PluginHalterClient.
+
+2009-09-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: webkit-transform scale no longer works properly in nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=29730
+        
+        When the initial or final state of a scale animation does not specify a transform,
+        use a default scale of 1, rather than zero.
+
+        Test: compositing/transitions/scale-transition-no-start.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+
+2009-09-24  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Eric Seidel.
+
+        isEnabled switch for notifications (experimental) in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=28930
+
+        Adds a run-time flag in Settings object that controls whether
+        to expose desktop notifications.
+
+        No new test, but test code also modified to set this preference.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitNotifications): check preference before returning notifications object
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalNotificationsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalNotificationsEnabled):
+
+2009-09-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix <rdar://problem/7162000> Crash while trying to
+        calculate the horizontal position of image
+
+        Test: fast/inline-block/relative-positioned-rtl-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced): Corrected an
+        isInline() test to isRenderInline(). This is similar to r41259.
+
+2009-09-24  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix expanding profile call stacks being broken after sorting.
+        https://bugs.webkit.org/show_bug.cgi?id=26423
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort):
+        Set shouldRefreshChildren to true on collapsed nodes with children so that expanding it
+        causes the children to be placed in the right positions.
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Fixed sudden termination console spew due to too many calls to
+        enableSuddenTermination.
+        
+        <rdar://problem/7063125> 10A410: Safari logging enableSuddenTermination errors
+
+        * page/DOMWindow.cpp:
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners): Only
+        enableSuddenTermination if the set of listeners is empty *and* this
+        window was in the set. Otherwise, a no-op will cause us to enableSuddenTermination.
+
+2009-09-24  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebKit returns "" instead of null when getting
+        inexistent, forbidden or invalidly named headers.
+        https://bugs.webkit.org/show_bug.cgi?id=29140
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed to return null as it should according to the spec.
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29724
+
+        Adding the following files to the svn:ignore list (all in the
+        WebCore/WebCore.gyp directory)
+
+        WebCore.xcodeproj
+        WebCore.sln
+        WebCore.vcproj
+        WebCore_Debug.rules
+        WebCore_Release.rules
+        WebCore_Release - no tcmalloc.rules
+        WebCore_Purify.rules
+        WebCore.mk
+        WebCore_Debug_rules.mk
+        WebCore_Release_rules.mk
+        WebCore_Release - no tcmalloc_rules.mk
+        WebCore_Purify_rules.mk
+        WebCore.scons
+        WebCore_main.scons
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Mac build fix.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        remove unused parameter from function signature;
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Implement correct horizontal scrollbar behavior for GTK+ also on
+        styled scrollbars.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29348
+        [Gtk] Scrollwheel on horizontal scrollbars should slide horizontally
+
+        Test: platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent): on GTK+, when using the
+        wheel with the pointer on the horizontal scrollbar, scroll
+        horizontally;
+        * platform/PlatformWheelEvent.h:
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::swapOrientation): allow adding a
+        vertical scroll to the horizontal one;
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        StorageNamespace::storageArea() should take in a PassRefPtr<StorageOrigin>
+        https://bugs.webkit.org/show_bug.cgi?id=29290
+
+        Modified StorageNamespace::storageArea() to take in a PassRefPtr<StorageOrigin>
+        per http://webkit.org/coding/RefPtr.html
+
+        No behavior change, so no tests.
+
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added back enable/disableSuddenTermination() functionality I accidentally
+        removed in my last patch.
+
+        * page/DOMWindow.cpp:
+        (WebCore::addUnloadEventListener):
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::addBeforeUnloadEventListener):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg and Mark Rowe.
+
+        Don't pass -F to GCC on non-mac platforms since it is an darwin only.
+
+        * DerivedSources.make:
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Element.idl:
+
+2009-09-23  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Revert the relevant parts of r47925, and implement an alternate
+        fix (localize the coordinate check to GraphicsContext::clipPath()).
+        This fixes http://crbug.com/21174.
+
+        Covered by LayoutTests/svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates):
+
+2009-09-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Merge changes from Mozilla's FTP directory parser.
+        <rdar://problem/7227620> and https://bugs.webkit.org/show_bug.cgi?id=29294
+
+        FTP layout tests not possible at this time.
+        https://bugs.webkit.org/show_bug.cgi?id=29719 tracks making them possible.
+
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::ParsingFailed):
+        (WebCore::parseOneFTPLine):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] re-enable some media tests
+        https://bugs.webkit.org/show_bug.cgi?id=29716
+
+        make canPlayType() return "probably" if mime-type is known
+        and codecs string is not empty. If codecs is empty return
+        "maybe".
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29703
+        Add a function to element to check whether it matches a CSS selector
+
+        Implement Element.webkitMatchesSelector.
+
+        * css/CSSSelectorList.cpp:
+        (WebCore::forEachTagSelector):
+        (WebCore::forEachSelector):
+        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
+        (WebCore::CSSSelectorList::selectorsNeedNamespaceResolution):
+        * css/CSSSelectorList.h:
+        Moved code to iterate the CSSSelectorList and determine if any
+        selectors need namespace resolution from a static function in
+        Node.cpp to CSSSelectorList so that it can be used by webkitMatchesSelector
+        as well as querySelector/querySelectorAll.
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitMatchesSelector):
+        * dom/Element.h: 
+        * dom/Element.idl:
+        Implement the new function. Handles exceptional cases identically to
+        querySelector/querySelectorAll.
+
+        * dom/Node.cpp:
+        (WebCore::Node::querySelector):
+        (WebCore::Node::querySelectorAll):
+        Moved selectorsNeedNamespaceResolution to CSSSelectorList from here.
+
+2009-09-24  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fixed bindings build after http://trac.webkit.org/changeset/48701
+        https://bugs.webkit.org/show_bug.cgi?id=29713
+
+        Got rid of isWindowEvent in function signatures:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        * bindings/v8/V8LazyEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+
+        Switched to EventTarget methods of adding/removing listeners:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::toEventID):
+        (WebCore::ACCESSOR_SETTER):
+
+        * dom/EventTarget.h: Some functions were incorrectly marked
+        as JSC-specific.
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Color-code watch expression errors with red.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29707
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        * inspector/front-end/inspector.css:
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix formatting for messages derived from resource warnings,
+        couple of drive-by formatting fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29705
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Implement InspectorController::copyNode(id).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28357
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY(rollout)
+
+        Roll out r48712 as it is incorrect.
+
+        Overriding getPropertyNames is incorrect.
+
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Revert r48697, since it broke key handling notification to GTK+.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GStreamer MediaPlayer is unable to correctly querry duration
+        https://bugs.webkit.org/show_bug.cgi?id=24639
+
+        check duration returned by gst_element_query_duration() only
+        when using GStreamer < 0.10.23.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-09-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        The indices of RuntimeArray should be enumerated like for a regular array.
+        https://bugs.webkit.org/show_bug.cgi?id=29005
+
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getPropertyNames):
+        * bridge/runtime_array.h:
+
+2009-09-23  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce Pasteboard::writePlaintext(const String&) so that copying
+        of the inspected elements HTML will be possible in WebInspector.
+        https://bugs.webkit.org/show_bug.cgi?id=29634
+
+        * platform/Pasteboard.h:
+        * platform/android/TemporaryLinkStubs.cpp:
+        (Pasteboard::writePlainText):
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/haiku/PasteboardHaiku.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wince/PasteboardWince.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+
+2009-09-24  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QApp::translate() calls to provide the correct class name without
+        a trailing comma.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaTimeDescription):
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        More build fix: Removed JSSharedWorkerContextCustom.cpp from project
+        files, since it no longer exists in the repository.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Declare set/unsetPendingActivity public, so
+        SharedWorkerScriptLoader can call them.
+
+        * dom/ActiveDOMObject.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a bit of the Windows build.
+
+        * workers/SharedWorker.idl: Declare a custom mark function. (I accidentally
+        removed this in my last patch.)
+        * WebCore.xcodeproj/project.pbxproj: Added JSSharedWorkerCustom.cpp back
+        to the build. (I accidentally removed this in my last patch.)
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        32-bit build fix: restore previous cast that I thought was unnecessary.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bring a little sanity to this crazy EventTarget world of ours
+        https://bugs.webkit.org/show_bug.cgi?id=29701
+
+        Lots of EventTarget refactoring to achieve a single shared implementation
+        that fixes some of the performance and correctness bugs of the many individual
+        implementations, and makes reasoning about EventTargets and EventListeners
+        much easier.
+        
+        The basic design is this:
+            - EventTarget manages a set of EventListeners.
+            - onXXX EventListener attributes forward to standard EventTarget APIs.
+            - Since the onXXX code is repetitive, it is usually done with macros
+              of the form DEFINE_ATTRIBUTE_EVENT_LISTENER(attributeName).
+            - EventTarget provides a shared implementation of dispatchEvent,
+              which subclasses with special event dispatch rules, like Node, override.
+            - To support Node, which lazily instantiates its EventTarget data,
+              EventTarget has no data members, and instead makes a virtual call
+              to get its data from wherever its subclass chose to store it.
+              
+        Code that used to call dispatchEvent, passing an ExceptionCode paratmeter,
+        even though no exception could be thrown, has been changed not to do so,
+        to improve clarity and performance.
+        
+        Code that used to call a special dispatchXXXEvent function, which just
+        turned around and called dispatchEvent, has been changed to call
+        dispatchEvent, to improve clarity and performance.
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj: Another day in the life of a WebKit
+        engineer.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Updated for Node API change. Added
+        "is not in the document but is firing event listeners" as a condition
+        that makes a Node observable in the DOM, so that event listeners firing
+        on removed nodes are not destroyed midstream. (This was a long-standing
+        bug that was somewhat hidden by the old implementation's habit of
+        copying the RegisteredEventListener vector before firing events, which
+        would keep almost all the relevant objects from being destroyed.)
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): Removed the isWindowEvent flag
+        because it was one of the most elaborately planned no-ops in the history
+        of software crime, and one of the reasons clients thought they needed more
+        than one dispatchEvent function even though they didn't.
+        * bindings/js/JSEventListener.h:
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        (WebCore::JSMessagePort::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        * bindings/js/JSEventSourceCustom.cpp:
+        * bindings/js/JSMessagePortCustom.cpp:
+        * bindings/js/JSSharedWorkerContextCustom.cpp: Removed.
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        * bindings/js/JSWorkerCustom.cpp:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren): EventListener marking is
+        now autogenerated. Classes that still have custom mark functions for other
+        reasons now call a shared EventTarget API to mark their EventListeners.
+
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent): Bye bye isWindowEvent.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Autogeneration support for
+        marking and invalidating event listeners.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::willRemoveChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::dispatchWindowEvent):
+        (WebCore::Document::dispatchWindowLoadEvent):
+        (WebCore::Document::finishedParsing):
+        * dom/Document.h: Use dispatchEvent directly.
+
+        * dom/Element.h: Moved a few event listener attributes down from Node,
+        since they don't apply to all Nodes, only Elements.
+
+        * dom/EventListener.h: Removed isWindowEvent parameter.
+
+        * dom/EventNames.h: Added the "display" event name, so it works correctly
+        with attribute macros, and for performance.
+
+        * dom/EventTarget.cpp:
+        (WebCore::forbidEventDispatch):
+        (WebCore::allowEventDispatch):
+        (WebCore::eventDispatchForbidden): Made this code (embarrasingly) thread
+        safe, since it's now called on multiple threads. (Currently, we only forbid
+        event dispatch on the main thread. If we ever want to forbid event dispatch
+        on secondary threads, we can improve it then.)
+
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::setAttributeEventListener):
+        (WebCore::EventTarget::getAttributeEventListener):
+        (WebCore::EventTarget::clearAttributeEventListener):
+        (WebCore::EventTarget::dispatchEvent):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+        (WebCore::FiringEventEndIterator::FiringEventEndIterator):
+        (WebCore::EventTarget::ref):
+        (WebCore::EventTarget::deref):
+        (WebCore::EventTarget::markEventListeners):
+        (WebCore::EventTarget::invalidateEventListeners):
+        (WebCore::EventTarget::isFiringEventListeners):
+        (WebCore::EventTarget::hasEventListeners): The ONE TRUE IMPLEMENTATION of
+        EventTarget APIs, crafted from an amalgam of all the different versions
+        we used to have. The most significant change here is that we no longer
+        make a copy of an EventListener vector before firing the events in the
+        vector -- instead, we use a reference to the original vector, along with
+        a notification mechanism for the unlikely case when an EventListener is
+        removed from the vector. This substantially reduces malloc, copying, and
+        refcount overhead, and complexity.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create): Use dispatchEvent directly.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::eventTargetData):
+        (WebCore::MessagePort::ensureEventTargetData):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::onmessage):
+        * dom/MessagePort.idl: Removed custom EventTarget implementation.
+
+        * dom/MutationEvent.h:
+        (WebCore::MutationEvent::create): Added some default values so callers
+        can construct MutationEvents more easily, without calling a custom dispatch
+        function.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::eventTargetData):
+        (WebCore::Node::ensureEventTargetData):
+        (WebCore::Node::handleLocalEvents):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchKeyEvent):
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchWheelEvent):
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        * dom/Node.h:
+        (WebCore::Node::preDispatchEventHandler):
+        (WebCore::Node::postDispatchEventHandler):
+        * dom/Node.idl:
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::eventTargetData):
+        (WebCore::NodeRareData::ensureEventTargetData): Use the shared EventTarget
+        interface, and call dispatchEvent directly instead of custom dispatchXXXEvent
+        functions that just forwarded to dispatchEvent.
+
+        * dom/RegisteredEventListener.cpp:
+        * dom/RegisteredEventListener.h:
+        (WebCore::RegisteredEventListener::RegisteredEventListener):
+        (WebCore::operator==): This is just a simple struct now, since we no longer
+        do a complicated copy / refCount / isRemoved dance just to honor the rule
+        that an EventListener can be removed during event dispatch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Removed another custom dispatchEvent.
+
+        * html/HTMLBodyElement.cpp:
+        * html/HTMLBodyElement.h: Use the shared EventTarget API.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        (WebCore::HTMLFormControlElement::checkValidity):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::handleLocalEvents):
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        * html/HTMLFormElement.h: Use the standard dispatchEvent API.
+
+        * html/HTMLFrameSetElement.cpp:
+        * html/HTMLFrameSetElement.h: Use the shared EventTarget API.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadInternal):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::errorEventTimerFired):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished): Use the standard dispatchEvent API.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::HashChangeEventTask::performTask):
+        (WebCore::FrameLoader::pageHidden): No more isWindowEvent.
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::performTask):
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache):
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::eventTargetData):
+        (WebCore::DOMApplicationCache::ensureEventTargetData):
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl: Switched to the standard
+        EventTarget API. As a part of this, I switched this class from using a
+        custom internal event name enumeration to using the standard EventNames.
+
+        * notifications/Notification.cpp:
+        (WebCore::Notification::eventTargetData):
+        (WebCore::Notification::ensureEventTargetData):
+        * notifications/Notification.h:
+        (WebCore::Notification::scriptExecutionContext):
+        * notifications/Notification.idl: Switched to the standard EventTarget API.
+
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::event):
+        (WebCore::windowsWithUnloadEventListeners):
+        (WebCore::windowsWithBeforeUnloadEventListeners):
+        (WebCore::allowsBeforeUnloadListeners):
+        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
+        (WebCore::DOMWindow::pendingUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Changed the "pending"
+        unload / beforeunload listener tracker just to track which windows had
+        such listeners, instead of actually keeping a copy of the listeners. Now,
+        this code can use the standard EventTarget API.
+
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::postMessageTimerFired):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::dispatchLoadEvent):
+        (WebCore::DOMWindow::dispatchEvent):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        (WebCore::DOMWindow::captureEvents):
+        (WebCore::DOMWindow::releaseEvents):
+        (WebCore::DOMWindow::eventTargetData):
+        (WebCore::DOMWindow::ensureEventTargetData):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl: Use the standard EventTarget APIs.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::sendResizeEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use dispatchEvent directly.
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::stop):
+        (WebCore::EventSource::createMessageEvent):
+        (WebCore::EventSource::eventTargetData):
+        (WebCore::EventSource::ensureEventTargetData):
+        * page/EventSource.h:
+        * page/EventSource.idl: Use the standard EventTarget APIs.
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocusedFrame):
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged): Use dispatchEvent.
+
+        * svg/SVGElement.cpp:
+        (WebCore::hasLoadListener): Rewritten for new EventTarget API.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::dummyEventTargetData):
+        (WebCore::SVGElementInstance::addEventListener):
+        (WebCore::SVGElementInstance::removeEventListener):
+        (WebCore::SVGElementInstance::removeAllEventListeners):
+        (WebCore::SVGElementInstance::dispatchEvent):
+        (WebCore::SVGElementInstance::eventTargetData):
+        (WebCore::SVGElementInstance::ensureEventTargetData): Use the EventTarget API.
+
+        * svg/SVGElementInstance.h:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchErrorEvent): Use dispatchEvent directly.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Updated for
+        new EventTarget API.
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent): No more isWindowEvent.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::eventTargetData):
+        (WebCore::WebSocket::ensureEventTargetData):
+        * websockets/WebSocket.h:
+        * websockets/WebSocket.idl:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::eventTargetData):
+        (WebCore::AbstractWorker::ensureEventTargetData):
+        * workers/AbstractWorker.h:
+        * workers/AbstractWorker.idl:
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerConnectTask::performTask):
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        * workers/SharedWorker.idl:
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::createConnectEvent):
+        * workers/SharedWorkerContext.h:
+        * workers/SharedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::eventTargetData):
+        (WebCore::WorkerContext::ensureEventTargetData):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerExceptionTask::performTask):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::abort):
+        (WebCore::XMLHttpRequest::networkError):
+        (WebCore::XMLHttpRequest::abortError):
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        (WebCore::XMLHttpRequest::eventTargetData):
+        (WebCore::XMLHttpRequest::ensureEventTargetData):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestProgressEvent.h:
+        (WebCore::XMLHttpRequestProgressEvent::create):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::eventTargetData):
+        (WebCore::XMLHttpRequestUpload::ensureEventTargetData):
+        * xml/XMLHttpRequestUpload.h:
+        * xml/XMLHttpRequestUpload.idl: Use new EventTarget API.
+
+2009-09-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Support for maxLength of <textarea>
+        - Move numGraphemeClusters() and numCharactersInGraphemeClusters() from InputElement to String.
+        https://bugs.webkit.org/show_bug.cgi?id=29292
+
+        Test: fast/forms/textarea-maxlength.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::sanitizeUserInputValue):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::sanitizeUserInputValue):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::numGraphemeClusters):
+        (WebCore::String::numCharactersInGraphemeClusters):
+
+2009-09-23  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Give GDK_Backspace key events the proper text properties.
+
+        Instead of adding new tests, this change removes existing tests
+        from Gtk's skipped list.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26989
+        Should allow navigation of top-level openers
+        <rdar://problem/7034025>
+
+        Allow navigation of cross-origin window.opener if it is top-level frame.
+
+        Test: http/tests/security/frameNavigation/cross-origin-opener.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldAllowNavigation):
+
+2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Eric Seidel.
+
+        Added $(WebKitLibrariesDir)/include/cairo so cairo.h is found by
+        default when the necessary dependencies are extracted into the
+        WebKitLibrariesDir.
+        https://bugs.webkit.org/show_bug.cgi?id=29661
+
+        * WebCore.vcproj/WebCoreCairo.vsprops:
+
+2009-09-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash when website does a history.back() followed by an alert()
+        https://bugs.webkit.org/show_bug.cgi?id=29686
+        rdar://problem/6984996
+
+        When loading is deferred, we need to defer timer-based loads
+        too, not just networking-driven loads. Otherwise we can get
+        syncronouse navigation while running a script, which leads to
+        crashes and other badness.
+
+        This patch includes a manual test; an automated test may be
+        possible some time in the future.
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv): Use scheduleLocationChange
+        instead of scheduleHTTPRedirection to implement the navigation
+        needed for x-frame-options.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader): Updated for data members with
+        new names and new data members.
+        (WebCore::FrameLoader::setDefersLoading): When turning deferral
+        off, call startRedirectionTimer and startCheckCompleteTimer, since
+        either of them might have been fired and ignored while defersLoading
+        was true.
+        (WebCore::FrameLoader::clear): Updated for replacement of the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer timers.
+        (WebCore::FrameLoader::allAncestorsAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Added code to set
+        m_shouldCallCheckCompleted to false. Changed code that calls
+        startRedirectionTimer to call it unconditionally, since that
+        function now knows when to do work and doesn't expect callers
+        to handle that any more.
+        (WebCore::FrameLoader::checkTimerFired): Added. Replaces the old
+        timer fired callbacks. Calls checkCompleted and checkLoadComplete
+        as appropriate, but not when defersLoading is true.
+        (WebCore::FrameLoader::startCheckCompleteTimer): Added. Replaces
+        the two different calls to start timers before. Only starts the
+        timers if they are needed.
+        (WebCore::FrameLoader::scheduleCheckCompleted): Changed to call
+        startCheckCompleteTimer after setting boolean.
+        (WebCore::FrameLoader::scheduleCheckLoadComplete): Ditto.
+        (WebCore::FrameLoader::scheduleHistoryNavigation): Removed
+        canGoBackOrForward check. The logic works more naturally when
+        we don't do anything until the timer fires.
+        (WebCore::FrameLoader::redirectionTimerFired): Do nothing if
+        defersLoading is true. Also moved canGoBackOrForward check here.
+        (WebCore::FrameLoader::scheduleRedirection): Changed code that
+        calls startRedirectionTimer to do so unconditionally. That
+        function now handles the rules about when to start the timer
+        rather than expecting the caller to do so.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to
+        handle the case where there is no redirection scheduled,
+        where the timer is already active, or where this is a classic
+        redirection and there is an ancestor that has not yet completed
+        loading.
+        (WebCore::FrameLoader::completed): Call startRedirectionTimer
+        here directly instead of calling a cover named parentCompleted.
+        Hooray! One less function in the giant FrameLoader class!
+        (WebCore::FrameLoader::checkLoadComplete): Added code to set
+        m_shouldCallCheckLoadComplete to false.
+
+        * loader/FrameLoader.h: Replaced the two functions
+        checkCompletedTimerFired and checkLoadCompleteTimerFired with
+        one function, checkTimerFired. Removed the parentCompleted
+        function. Added the startCheckCompleteTimer and
+        allAncestorsAreComplete functions. Replaced the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer data
+        members with m_checkTimer, m_shouldCallCheckCompleted, and
+        m_shouldCallCheckLoadComplete.
+
+        * manual-tests/go-back-after-alert.html: Added.
+        * manual-tests/resources/alert-and-go-back.html: Added.
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29660> Move "Generate 64-bit Export File" build phase script into DerivedSources.make
+
+        Reviewed by Mark Rowe.
+
+        The "Generate 64-bit Export File" build phase script generated
+        the WebCore.LP64.exp export file used to link 64-bit WebCore.
+        Instead of having a separate build phase script, move its
+        generation into DerivedSources.make where WebCore.exp is
+        generated.
+
+        * DerivedSources.make: Added a rule to make WebCore.LP64.exp.
+        Added code to append WebCore.PluginHostProcess.exp to
+        $(WEBCORE_EXPORT_DEPENDENCIES) when WTF_USE_PLUGIN_HOST_PROCESS
+        is set to 1.
+        * WebCore.PluginHostProcess.exp: Renamed from WebCore/WebCore.LP64.exp.
+        * WebCore.xcodeproj/project.pbxproj: Removed the "Generate
+        64-bit Export File" build phase script. Renamed WebCore.LP64.exp
+        to WebCore.PluginHostProcess.exp.
+
+2009-09-23  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29694
+        [Chromium] Eliminate dependency on gfx::Rect from ImageSkia.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::drawResampledBitmap):
+
+2009-09-22  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent scrolling multiple elements during latched wheel events.
+
+        Reviewed by Anders Carlsson.
+
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scroll):
+        * rendering/RenderBox.h:
+
+2009-09-23  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29523
+        
+        Fixes an issue where a JavaScript URL that was URL-encoded twice can bypass the
+        XSSAuditor.
+        
+        The method FrameLoader::executeIfJavaScriptURL decodes the URL escape 
+        sequences in a JavaScript URL before it is eventually passed to the XSSAuditor.
+        Because the XSSAuditor also decodes the URL escape sequences as part of its
+        canonicalization, the double decoding of a JavaScript URL would
+        not match the canonicalization of the input parameters.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html
+               http/tests/security/xssAuditor/javascript-link-url-encoded.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Moved call to 
+        XSSAuditor::canEvaluateJavaScriptURL into FrameLoader::executeIfJavaScriptURL.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL): Modified to call 
+        XSSAuditor::canEvaluateJavaScriptURL on the JavaScript URL before it is
+        decoded.
+
+2009-09-22  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29657
+        Columns don't break properly in positioned elements with a fixed height.  Make sure that
+        a block is still considered to have columns even when the column count is 1 if the column
+        width is non-auto.
+    
+        Added fast/multicol/positioned-with-constrained-height.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
+
+2009-09-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Add a null check for the Document*. In the mirror benchmarking
+        application a crash from a call from JavaScript was observed.
+
+        I was not able to come up with a test case for this issue.
+
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+
+2009-09-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build, after the introduction of
+        the page client.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] media tests failing after their rework
+        https://bugs.webkit.org/show_bug.cgi?id=29532
+
+        Correctly advertise the mime types used by the common formats used
+        in the tests.
+
+        Tests that regressed, and will pass again:
+
+           media/video-canvas-source.html
+           media/video-controls.html
+           media/video-currentTime-set2.html
+           media/video-dom-autoplay.html
+           media/video-dom-src.html
+           media/video-error-abort.html
+           media/video-load-networkState.html
+           media/video-load-readyState.html
+           media/video-muted.html
+           media/video-no-autoplay.html
+           media/video-pause-empty-events.html
+           media/video-play-empty-events.html
+           media/video-seekable.html
+           media/video-seeking.html
+           media/video-size.html
+           media/video-source-type-params.html
+           media/video-source-type.html
+           media/video-source.html
+           media/video-src-change.html
+           media/video-src-invalid-remove.html
+           media/video-src-remove.html
+           media/video-src-set.html
+           media/video-src-source.html
+           media/video-src.html
+           media/video-timeupdate-during-playback.html
+           media/video-volume.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-09-22  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the crash problem with absolte positioned children in foreignobject
+        htts://bugs.webkit.org/show_bug.cgi?id=26342
+
+        Test: svg/custom/foreignobject-crash-with-absolute-positioned-children.svg
+
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::isSVGForeignObject):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGForeignObject):
+
+2009-09-22  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers "name" attribute is now optional.
+        https://bugs.webkit.org/show_bug.cgi?id=28897
+
+        Test: fast/workers/shared-worker-name.html
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        (WebCore::constructSharedWorker):
+        Default 'name' attribute to empty string if it is not provided.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Default 'name' attribute to empty string if it is not provided.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::matches):
+        Now matches URLs if names are empty strings.
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        Pass URL in to SharedWorkerProxy::matches().
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, another build fix.
+
+        [Chromium] Add another missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorController.cpp: Added DOMWindow.h include.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorDOMStorageResource.cpp: Added DOMWindow.h include.
+
+2009-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Tighten up the ScheduledRedirection machinery to prepare for a bug fix
+        https://bugs.webkit.org/show_bug.cgi?id=29663
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a boolean,
+        initialized to false, to keep track if the redirection has been
+        communicated to the client.
+        (WebCore::FrameLoader::stopLoading): Tweaked a comment.
+        (WebCore::FrameLoader::cancelRedirection): Removed code to clear
+        m_scheduledRedirection.clear since stopRedirectionTimer does that now.
+        (WebCore::FrameLoader::allChildrenAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Use allChildrenAreComplete
+        function for clarity.
+        (WebCore::FrameLoader::checkCallImplicitClose): Ditto.
+        (WebCore::FrameLoader::scheduleRedirection): Changed to take a PassOwnPtr.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to set the
+        toldClient flag and not call clientRedirected a second time if it is set.
+        (WebCore::FrameLoader::stopRedirectionTimer): Changed so this can be safely
+        called multiple times and it will call clientRedirectCancelledOrFinished
+        only once.
+
+        * loader/FrameLoader.h: Changed scheduleRedirection to be a PassOwnPtr.
+        Added allChildrenAreComplete function.
+
+2009-09-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        DOMStorage interaction is now serialized into JSON messages
+        and doesn't require quarantined objects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::getDOMStorageEntries):
+        (WebCore::InspectorBackend::setDOMStorageItem):
+        (WebCore::InspectorBackend::removeDOMStorageItem):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageEntries):
+        (WebCore::InspectorController::setDOMStorageItem):
+        (WebCore::InspectorController::removeDOMStorageItem):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::bind):
+        (WebCore::InspectorDOMStorageResource::unbind):
+        (WebCore::InspectorDOMStorageResource::startReportingChangesToFrontend):
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        (WebCore::InspectorDOMStorageResource::operator==):
+        * inspector/InspectorDOMStorageResource.h:
+        (WebCore::InspectorDOMStorageResource::cast):
+        (WebCore::InspectorDOMStorageResource::id):
+        (WebCore::InspectorDOMStorageResource::domStorage):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage):
+        (WebInspector.DOMStorage.prototype.get id):
+        (WebInspector.DOMStorage.prototype.get domStorage):
+        (WebInspector.DOMStorage.prototype.get isLocalStorage):
+        (WebInspector.DOMStorage.prototype.getEntriesAsync):
+        (WebInspector.DOMStorage.prototype.setItemAsync):
+        (WebInspector.DOMStorage.prototype.removeItemAsync):
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.selectDOMStorage):
+        (WebInspector.StoragePanel.prototype.updateDOMStorage):
+        (WebInspector.StoragePanel.prototype._domStorageForId):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix for XMLHttpRequest.abort() should destroy the response text.
+        https://bugs.webkit.org/show_bug.cgi?id=29658
+        <rdar://problem/5301430>
+
+        Clearing the response text after calling XMLHttpRequest.abort() is necessary
+        per spec and matches Firefox. It is also a potential memory win.
+
+        Test: http/tests/xmlhttprequest/abort-should-destroy-responseText.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::abort): Clear the response text making sure to
+        keep the actual ResourceReponse around so that the response status and response
+        status text are kept around.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48639.
+        http://trac.webkit.org/changeset/48639
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Changing the transaction coordinator to (re-)allow multiple read
+        transactions on the same database to run concurrently (without
+        risking a deadlock this time).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29115
+
+        Tests: storage/read-and-write-transactions-dont-run-together.html
+               storage/read-transactions-running-concurrently.html
+
+        * storage/SQLTransaction.h:
+        (WebCore::SQLTransaction::isReadOnly): Returns the type of the
+        transaction.
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::releaseLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::shutdown): Renamed the map.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29652
+        Support true system colors for CSS system colors in Chromium/Win.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::cssValueIdToSysColorIndex):
+        (WebCore::RenderThemeChromiumWin::systemColor):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-09-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6925121> SAP: Wrong width calculation in 
+        table with fixed layout
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29501
+
+        New Tests:
+        * fast/table/fixed-table-with-percent-inside-percent-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-auto-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-extra-large-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-fixed-width-table.html: Added.
+        * fast/table/fixed-table-with-small-percent-width.html: Added.
+
+        This new quirk is very similar to an existing one that was 
+        implemented in revision 4316.
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcPrefWidths):
+
+2009-09-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        List HTTP status code with response headers in resources tab of Web Inspector.
+        http://webkit.org/b/19945
+
+        This patch adds a new top level list in the resources tab, HTTP Information, that 
+        for now, contains the Request Method (GET, POST, etc.) and the Status Code (200, 404, etc.).
+        Additionally, it adds a colored dot next to the requested URL to show the status 
+        (green for success, orange for redirect, red for error).
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView):
+        * inspector/front-end/Images/errorRedDot.png: Added.
+        * inspector/front-end/Images/successGreenDot.png: Added.
+        * inspector/front-end/Images/warningOrangeDot.png: Added.
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.StatusTextForCode):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
+        * inspector/front-end/inspector.css:
+
+2009-09-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Back list isn't properly updated for fragment changes after a redirect.
+        <rdar://problem/6142803> and https://bugs.webkit.org/show_bug.cgi?id=20355
+
+        Test: fast/loader/fragment-after-redirect-gets-back-entry.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL): Properly reset the policy FrameLoadType before
+          consulting the policy delegate for fragment scrolling.
+
+2009-09-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects get stuck in the non-visible state and cannot be opened.
+        https://bugs.webkit.org/show_bug.cgi?id=29645
+
+        All paths that lead to hiding the popup menu must call popupDidHide on
+        the PopupMenuClient.  This change makes it so by moving all of the
+        hiding logic to PopupListBox::hidePopup.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-09-22  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector.log() function not protected if console not yet created
+        https://bugs.webkit.org/show_bug.cgi?id=29336
+        
+        No new tests.  Only affects Web Inspector developers adding logging
+        to their code during development.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.isLogAvailable):
+        (WebInspector.log.flushQueue):
+        (WebInspector.log.flushQueueIfAvailable):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ported chromium.org's webcore.gyp for the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * WebCore.gyp/WebCore.gyp: Added.
+
+2009-09-22  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Don't keep clean wrappers artificially alive        
+        We currently keep all DOM node wrappers alive, even when there are
+        no more references to them from JS, in case they have properties
+        that we need to keep around if new JS references are created.
+        This changes the policy to only keep wrappers artificially alive
+        if they have changed since they were created. Empty wrappers are
+        discarded and recreated as needed.
+        https://bugs.webkit.org/show_bug.cgi?id=29330
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: console.count and console.timeEnd
+        crash when inspector is opened.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29632
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+
+2009-09-22  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Fix bogus build fix I did last night.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI/Mac: Don't paint plugins if we don't have a CGContextRef
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reivewed by Simon Hausmann.
+
+        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)
+
+        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
+        takes a QWidget*, not a QWebPageClient*
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Attempted fix for the V8 build.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Don't re-enter JavaScript after performing access checks
+        https://bugs.webkit.org/show_bug.cgi?id=29531
+
+        Moved the access check slightly later in this functions to avoid
+        re-entering the JavaScript interpreter (typically via toString)
+        after performing the access check.
+
+        I can't really think of a meaningful test for this change.  It's more
+        security hygiene.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::if):
+        (CALLBACK_FUNC_DECL):
+        (V8Custom::WindowSetLocation):
+        (V8Custom::ClearTimeoutImpl):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make all write transaction start with a BEGIN IMMEDIATE command
+        instead of BEGIN.
+
+        We cannot test this change in a layout test, because in order to
+        test it we need to spawn two database threads and execute
+        transaction steps on these two threads in a very specific order,
+        which seems impossible to do when they share the same main thread
+        (as they would in a layout test). The SQLite docs and the case
+        described in the bug though should be enough proof that we do have
+        a problem here and that this patch will fix it.
+
+        Relevant SQLite documentation:
+        http://www.sqlite.org/lang_transaction.html
+        http://www.sqlite.org/lockingv3.html#locking
+
+        https://bugs.webkit.org/show_bug.cgi?id=29218
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::SQLiteTransaction): Added a readOnly
+        parameter.
+        (WebCore::SQLiteTransaction::begin): Changed to BEGIN IMMEDIATE
+        for write transactions.
+        * platform/sql/SQLiteTransaction.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight): Passing
+        the read-only flag to the SQLiteTransaction instance.
+
+2009-09-21  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        * DerivedSources.make: Fix the Xcode build on SnowLeopard.
+
+2009-09-15  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Prevent sleeps in unload handlers.
+        https://bugs.webkit.org/show_bug.cgi?id=29193
+
+        Test: fast/dom/Window/slow_unload_handler.html
+
+        * WebCore.gypi:
+        * bindings/v8/DateExtension.cpp: Added.
+        (WebCore::DateExtension::DateExtension):
+        (WebCore::DateExtension::get):
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::weakCallback):
+        (WebCore::DateExtension::GiveEnableSleepDetectionFunction):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h: Added.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::registerExtensionWithV8):
+        (WebCore::V8Proxy::registeredExtensionWithV8):
+        * bindings/v8/V8Proxy.h:
+
+2009-09-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the
+        worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        The previous fix was partially reverted due to a reliability build break
+        in chromium. The break happens when an exception is thrown without
+        setting a message. We need to check for this scenario and handle it.
+
+        Tested by worker-close.html.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser & Sam Weinig.
+
+        Add ENABLE(ORIENTATION_EVENTS)
+        https://bugs.webkit.org/show_bug.cgi?id=29508
+        
+        See documentation here:
+        http://developer.apple.com/safari/library/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html#//apple_ref/doc/uid/TP40006511-SW16
+
+        * DerivedSources.make: Use new WebCore.OrientationEvents.exp file if ENABLE_ORIENTATION_EVENTS.
+        Add ENABLE_ORIENTATION_EVENTS to the new ADDITIONAL_IDL_DEFINES variable that is passed to the IDL
+        code generator. This is because ENABLE_ORIENTATION_EVENTS is not in FEATURE_DEFINES.
+        * WebCore.OrientationEvents.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.OrientationEvents.exp.
+        * dom/EventNames.h: Add onorientationchange.
+        * html/HTMLAttributeNames.in: Ditto.
+        * html/HTMLBodyElement.cpp: Handle onorientationchange properly.
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        (WebCore::HTMLBodyElement::onorientationchange):
+        (WebCore::HTMLBodyElement::setOnorientationchange):
+        * html/HTMLBodyElement.h: Ditto.
+        * html/HTMLBodyElement.idl: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::onorientationchange):
+        (WebCore::HTMLFrameSetElement::setOnorientationchange):
+        * html/HTMLFrameSetElement.h: Ditto.
+        * html/HTMLFrameSetElement.idl: Ditto.
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::orientation): Calls up the to the Frame for the orientation value.
+        (WebCore::DOMWindow::onorientationchange):
+        (WebCore::DOMWindow::setOnorientationchange):
+        * page/DOMWindow.h: Handle onorientationchange properly.
+        * page/DOMWindow.idl: Ditto.
+        * page/Frame.cpp: Ditto.
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::sendOrientationChangeEvent):
+        * page/Frame.h: Ditto.
+        (WebCore::Frame::orientation):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: completions are always evaluated against
+        window (discarding call frames).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29616
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.selectedCallFrameId):
+
+2009-09-21  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo) target.
+
+        Add stubs for SocketStream classes added in @r47788, which
+        broke the WinCairo build.
+
+        No new tests. (Build failure).
+
+        * WebCore.vcproj/WebCore.vcproj:  Add references to new files
+          to Cairo build, exclude from standard Apple build.
+        * platform/network/curl/SocketStreamError.h: Added.
+        * platform/network/curl/SocketStreamHandle.h: Added.
+        * platform/network/curl/SocketStreamHandleCurl.cpp: Added.
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expose InspectorResource fields.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29537
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::sourceString):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::requestHeaderFields):
+        (WebCore::InspectorResource::responseHeaderFields):
+        (WebCore::InspectorResource::responseStatusCode):
+        (WebCore::InspectorResource::requestMethod):
+        (WebCore::InspectorResource::requestFormData):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: JS error drilling down childless node.
+        No need to dispatch double click twice - it is already handled
+        in TreeElement.treeElementDoubleClicked.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22144
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+
+2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement new QWebPageClient class and let our classes
+        QWebViewPrivate and QWebGraphicsItemPrivate inherit from it.
+
+        For Qt, platformPageClient() will now return a class derived from
+        the QWebPageClient, so the patch adapts our Qt hooks to go though
+        this class and not depend on the QWebView.
+
+        * WebCore.pro:
+        * platform/Widget.h:
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h: Added.
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Evaluating on call frame always returns "undefined".
+
+        https://bugs.webkit.org/show_bug.cgi?id=29613
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.evaluateInCallFrame):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Exception formatting is broken in console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29608
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript.createProxyObject):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console object formatting is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29607
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.wrapPrimitiveValue):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash When Logging an Element Before Opening Inspector
+
+        https://bugs.webkit.org/show_bug.cgi?id=29514
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+
+2009-09-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect clipping with accelerated compositing content, and position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29347
+        
+        Fix the compositing clipping logic to behave correctly when position:fixed
+        elements clip, by using the new backgroundClipRect() method to determine
+        when we need to clip, and to compute the clipping layer position.
+
+        Test: compositing/overflow/fixed-position-ancestor-clip.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+
+2009-09-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add back in a special case for window.top in the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29605
+
+        Fixes LayoutTests/fast/dom/Window/window-property-shadowing.html in the Chromium port.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Ensure window.top is not marked as read only, as this breaks the shadowing disabling.
+
+2009-09-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        HTMLMediaElement: media file should not reload when page comes out of page cache
+        https://bugs.webkit.org/show_bug.cgi?id=29604
+
+        Test: media/restore-from-page-cache.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::userCancelledLoad): Do nothing unless the element
+        is still loading. Only fire an 'emptied' event if the readyState is HAVE_NOTHING,
+        otherwise set the network state to NETWORK_IDLE.
+
+2009-09-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Sean/Shawn/Shaun" Garen.
+
+        Clarify two FIXMEs.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+
+2009-09-21  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects fail to close when a value is selected
+        https://bugs.webkit.org/show_bug.cgi?id=29582
+
+        Implement PopupListBox::hidePopup, which was previously
+        declared but unimplemented.  Removes the declaration of
+        showPopup since that method is not implemented.
+
+        PopupListBox::hidePopup takes care of hiding the popup,
+        by invoking hidePopup on its parent PopupContainer, and
+        then informs the PopupMenuClient that popupDidHide.
+        This mimics the old behavior prior to r48370.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Windows build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29535
+
+        * platform/network/qt/DnsPrefetchHelper.cpp: Missing #include "config.h"  added.
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix. Missing files.
+
+        * GNUmakefile.am:
+
+2009-09-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash when clicking link in unload handler
+        https://bugs.webkit.org/show_bug.cgi?id=29525
+
+        Test that the first navigation always wins when the page tries to start
+        a new navigation in an unload handler.
+
+        Tests: fast/loader/unload-form-about-blank.html
+               fast/loader/unload-form-post-about-blank.html
+               fast/loader/unload-form-post.html
+               fast/loader/unload-form.html
+               fast/loader/unload-hyperlink.html
+               fast/loader/unload-javascript-url.html
+               fast/loader/unload-reload.html
+               fast/loader/unload-window-location.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-09-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Sometimes crashes when a page is destroyed/loads another URL while playing video
+        https://bugs.webkit.org/show_bug.cgi?id=29496
+
+        Protect the video sink object, and destroy it in an idle callback
+        to hopefully avoid a race condition that leads to a crash.
+
+        This is already tested by media/video-seekable.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::idleUnref):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix for GTK+ and a blind one for Qt after r48566.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-09-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29519
+        Remove JSNameNodeCollection and just use StaticNodeList
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp: Removed.
+        * bindings/js/JSNamedNodesCollection.h: Removed.
+
+2009-09-19  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29511
+        
+        Fixes an issue where script code that contains non-ASCII characters may bypass the 
+        XSSAuditor.
+        
+        Before performing a comparison between the script source code and input parameters, we
+        remove all non-ASCII characters, including non-printable ASCII characters from the
+        script source code and input parameters.
+
+        Tests: http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter): Modified to remove all non-ASCII characters,
+        including non-printable ASCII characters.
+
+2009-09-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect animation with scale(0) transform (singular matrix)
+        https://bugs.webkit.org/show_bug.cgi?id=29465
+        
+        Make accelerated scale() and translate() animations go through the component animation
+        path (rather than just matrix animation) to avoid problems with singular scale matrices,
+        and be slightly more efficient.
+
+        Test: compositing/transitions/singular-scale-transition.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+        (WebCore::getValueFunctionNameForTransformOperation):
+
+2009-09-19  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Adds CSS styling and basic DOM element support for MathML
+
+        * DerivedSources.make:
+          Added user stylesheet and tag factory generation
+
+        * WebCore.xcodeproj/project.pbxproj:
+          Added new DOM element code
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAttr):
+          Added check for document since stylesheet can be added before there is a document
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement):
+          Added check to add MathML user agent stylesheet
+
+        * css/mathml.css: Added.
+          MathML user agent stylesheet
+
+        * dom/Document.cpp:
+        (WebCore::Document::createElement):
+          Added support for creation of MathML DOM objects
+
+        * dom/Node.h:
+        (WebCore::Node::isMathMLElement):
+          Added check method for whether the node is a MathML node
+
+        * mathml: Added.
+        * mathml/MathMLElement.cpp: Added.
+        (WebCore::MathMLElement::MathMLElement):
+        (WebCore::MathMLElement::create):
+        (WebCore::MathMLElement::createRenderer):
+        * mathml/MathMLElement.h: Added.
+        (WebCore::MathMLElement::isMathMLElement):
+          MathML DOM base class
+
+
+        * mathml/MathMLInlineContainerElement.cpp: Added.
+        (WebCore::MathMLInlineContainerElement::MathMLInlineContainerElement):
+        (WebCore::MathMLInlineContainerElement::create):
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/MathMLInlineContainerElement.h: Added.
+          Base class for non-text containers
+
+        * mathml/MathMLMathElement.cpp: Added.
+        (WebCore::MathMLMathElement::MathMLMathElement):
+        (WebCore::MathMLMathElement::create):
+        * mathml/MathMLMathElement.h: Added.
+          Root Math element
+
+        * mathml/mathtags.in: Added.
+          Element list mappings
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+          Added MathML name initialization
+2009-09-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Canvas drawn with data URL image raises SECURITY_ERR when toDataUrl() called.
+        https://bugs.webkit.org/show_bug.cgi?id=29305
+
+        We need to special-case data URLs when tainting a canvas because we
+        treat data URLs has having no security origin, unlike other
+        browsers.  The reason we do this is to help sites avoid XSS via data
+        URLs, but that consideration doesn't apply to canvas taint.
+
+        Also, we were previously incorrectly taking document.domain state
+        into account when tainting canvas.
+
+        Tests: http/tests/security/canvas-remote-read-data-url-image.html
+               http/tests/security/canvas-remote-read-data-url-svg-image.html
+               http/tests/security/canvas-remote-read-remote-image-document-domain.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::createPattern):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::taintsCanvas):
+        * page/SecurityOrigin.h:
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix stylistic issue raised in code review for previous commit.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::hasNonZeroTransformOrigin):
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Element is misplaced during opacity transition with certain configuration of transform-origin and clipping
+        https://bugs.webkit.org/show_bug.cgi?id=29495
+        
+        If an element has zero size, but has a transform origin with absolute values,
+        then the transform origin would not be applied because it is implemented via
+        anchorPoint, which is expressed as a fraction of the layer size.
+        
+        Work around this by artificially inflating the size of the backing store when we need to.
+
+        Test: compositing/geometry/transfrom-origin-on-zero-size-layer.html
+
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        Init m_artificiallyInflatedBounds to false.
+        
+        (WebCore::hasNonZeroTransformOrigin):
+        Utility function that describes whether the transform-origin contains non-percentage
+        x or y offsets.
+        
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        New wrapper method around setCompositedBounds() that applies the size inflation
+        when necessary, setting the m_artificiallyInflatedBounds as appropriate.
+        
+        (WebCore::RenderLayerBacking::updateAfterLayout): Call updateCompositedBounds().
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Ditto
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): Ditto
+
+2009-09-18  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29512
+        Don't recalculate style when restoring from the page cache
+
+        FrameLoaderClient::forceLayout() also forces style recalc. Instead call FrameView::forceLayout() 
+        directly to update the scrollbars while keeping the existing style.
+        
+        Makes back/forward really fast on complex pages (in cases where page cache works).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad):
+
+2009-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement ES5 Object.defineProperty function
+        https://bugs.webkit.org/show_bug.cgi?id=29503
+
+        Override defineOwnProperty on JSDOMWindowShell to forward appropriately,
+        and then override defineOwnProperty on JSDOMWindow to disallow cross origin
+        defineOwnProperty usage.  We also override defineOwnProperty on QuarantinedObjectWrapper
+        to ensure correct wrapping semantics of quarantined objects.
+
+        One major caveat in this patch is that it currently disallows the use
+        of Object.defineProperty on DOMObjects other than the window due to
+        the significant work involved in correctly propagating attributes and
+        ensuring correct semantics on dom objects.
+
+        Tests: fast/js/Object-defineProperty.html
+               http/tests/security/xss-DENIED-defineProperty.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMObject::defineOwnProperty):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineGetter):
+        (WebCore::JSDOMWindow::defineSetter):
+        (WebCore::JSDOMWindow::defineOwnProperty):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::defineOwnProperty):
+        (WebCore::JSDOMWindowShell::defineGetter):
+        (WebCore::JSDOMWindowShell::defineSetter):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::defineGetter):
+        (WebCore::JSLocationPrototype::defineGetter):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        (WebCore::JSQuarantinedObjectWrapper::defineOwnProperty):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29510
+        Active DOM objects should be suspended while a modal dialog is displayed
+
+        * manual-tests/js-timers-beneath-modal-dialog.html: Added a test for JS timers.
+
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        Match other platforms, and make Mac also suspend active DOM objects. Since a page that
+        currently displays a modal dialog cannot go into page cache, there is no danger of suspending
+        an object twice.        
+
+2009-09-18  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Buildfix caused by http://trac.webkit.org/changeset/48513
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+
+        * bridge/qt/qt_instance.h: createRuntimeObject method renamed to newRuntimeObject.
+        * bridge/runtime.h: Visibility of newRuntimeObject method modified to protected.
+
+2009-09-18  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix parameter substitutions in console.log().
+
+        https://bugs.webkit.org/show_bug.cgi?id=29366
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getPrototypes):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen and Brady Eidson.
+
+        Temporarily remove an assertion that was getting hit when going
+        back to a page in the page cache while a banner in Safari was visible.
+        We should re-enable this once that is fixed. See <rdar://problem/7218118>
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleRelayout):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix windows build.
+        
+        * platform/win/PopupMenuWin.cpp:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin 'BearClaw' Barraclough.
+
+        Convert another callback type object to store the global object
+        instead of the frame.
+
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29332
+        <rdar://problem/7231652> 
+        REGRESSION (r48446): While a <select> popup menu is open, the
+        rest of the WebView doesn't respond to mouse move events.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::translatePoint):
+        New helper function that translates a point between HWND coordinates.
+        
+        (WebCore::PopupMenu::show):
+        Protect the PopupMenu if someone removes the <select> in response to a mouse
+        event. Handle WM_HOST_WINDOW_MOUSEMOVE events.
+        
+        (WebCore::PopupMenu::wndProc):
+        in the WM_MOUSEMOVE handler, if the mouse is not over the popup, post a 
+        WM_HOST_WINDOW_MOUSEMOVE event so that the host window (the WebView) gets the
+        mouse move event.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Compositing layers are incorrectly positioned after scrolling with position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29262
+        
+        When scrolling a page with compositing layers inside a position:fixed element,
+        we need to update the compositing layer positions when the scroll position changes.
+
+        Test: compositing/geometry/fixed-position.html
+
+        * WebCore.base.exp:
+        Export FrameView::scrollPositionChanged()
+        
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged):
+        New method that sends the scroll event, and updates compositing layers positions if necessary.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Transformed elements inside position:fixed container are clipped incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=29346
+        
+        Fix clipping and hit testing on transformed elements inside a position:fixed element.
+        Previously, the code used the overflowClipRect of the parent clip rects, but
+        this is not correct for fixed postion elements. Instead, share code that is
+        already present in calculateRects() to get the correct rect.
+
+        Test: fast/overflow/position-fixed-transform-clipping.html
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        Call the new backgroundClipRect() to get the correct clipRect.
+        
+        (WebCore::RenderLayer::backgroundClipRect):
+        New method, factored out of calculateRects(), that computes the clip rect,
+        doing the right thing for fixed position elements.
+        
+        (WebCore::RenderLayer::calculateRects):
+        Call the new backgroundClipRect() method.
+        
+2009-09-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
+        WebCore::RenderBlock::layoutBlock()
+        https://bugs.webkit.org/show_bug.cgi?id=29498
+
+        Test: accessibility/nested-layout-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::updateBackingStore): Changed to
+            call Document::updateLayoutIgnorePendingStylesheets() instead of
+            calling RenderObject::layoutIfNeeded(). The latter requires that
+            there be no pending style recalc, which allows methods that call
+            Document::updateLayout() to be called during layout without risking
+            re-entry into layout.
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check
+            m_object after calling updateBackingStore(), since style recalc may
+            destroy the renderer, which destroys the accessibility object and
+            detaches it from the wrapper.
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+             Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+            Ditto.
+
+2009-09-18  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Simon Hausmann.
+
+        Update Qt build system for Web Socket.
+        https://bugs.webkit.org/show_bug.cgi?id=29270
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamError.h: Added.
+        * platform/network/qt/SocketStreamHandle.h: Added.
+        * platform/network/qt/SocketStreamHandleSoup.cpp: Added.
+
+2009-09-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NULL check HTMLMediaElement::m_playedTimeRanges.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29494
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::addPlayedRange): New. Create m_playedTimeRanges if
+        necessary, add range specified.
+        (WebCore::HTMLMediaElement::seek): Use addPlayedRange. 
+        (WebCore::HTMLMediaElement::played): Use addPlayedRange. Change time comparison 
+        to be more readable.
+        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
+        * html/HTMLMediaElement.h:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Don't use Document.elementFromPoint since it returns null if the point
+        is outside the viewport.  Instead, just hit test ourselves.
+
+        Test: fast/events/drag-file-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::elementUnderMouse):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Each wrapped Objective-C object should use a single RuntimeObjectImp
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+        rdar://problem/7142294
+
+        * WebCore.base.exp: Added a newly-needed exported symbol.
+
+        * bindings/objc/DOMInternal.h: Eliminated unused
+        createWrapperCacheWithIntegerKeys; it has not been needed since the
+        RGBColor wrappers were reworked.
+        * bindings/objc/DOMInternal.mm: Ditto.
+
+        * bridge/objc/objc_instance.h: Made the create function non-inline.
+        * bridge/objc/objc_instance.mm:
+        (createInstanceWrapperCache): Added. Creates an appropriate map table.
+        (ObjcInstance::create): Moved here from header. Uses NSMapGet and
+        NSMapInsert to cache the instance in a map table.
+        (ObjcInstance::~ObjcInstance): Added a call to NSMapRemove to remove
+        the instance from the map table.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance): Remove unneeded code to remove
+        the instance from cachedObjects, which no longer exists.
+        (JSC::Bindings::QtInstance::newRuntimeObject): Renamed to overload new
+        bottleneck. Caching is now handled by the base class.
+
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::Instance): Initialize m_runtimeObject to 0.
+        (JSC::Bindings::Instance::~Instance): Assert m_runtimeObject is 0.
+        (JSC::Bindings::Instance::createRuntimeObject): Use m_runtimeObject
+        if it's already set. Set m_runtimeObject and call addRuntimeObject
+        if it's not.
+        (JSC::Bindings::Instance::newRuntimeObject): Added. Virtual function,
+        used only by createRuntimeObject.
+        (JSC::Bindings::Instance::willDestroyRuntimeObject): Added.
+        Calls removeRuntimeObject and then clears m_runtimeObject.
+        (JSC::Bindings::Instance::willInvalidateRuntimeObject): Added.
+        Clears m_runtimeObject.
+
+        * bridge/runtime.h: Made createRuntimeObject non-virtual. Added
+        willDestroyRuntimeObject, willInvalidateRuntimeObject,
+        newRuntimeObject, and m_runtimeObject.
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp): Removed addRuntimeObject
+        call, now handled by caller.
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp): Replaced removeRuntimeObject
+        call with willDestroyRuntimeObject call; the latter nows calls
+        removeRuntimeObject.
+        (JSC::RuntimeObjectImp::invalidate): Added willInvalidateRuntimeObject
+        call.
+
+        * bridge/runtime_object.h: Made invalidate non-virtual.
+
+2009-09-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Make platformWindow return a PlatformPageClient
+        (for now typedef'ed to PlatformWidget)
+
+        Also, change the name of platformWindow to platformPageClient()
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::platformPageClient):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::platformPageClient):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::wheelEvent):
+        (WebCore::EventHandler::currentPlatformMouseEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::eventMayStartDrag):
+        * platform/HostWindow.h:
+        * platform/Widget.h:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        (WebCore::ScrollView::visibleContentRect):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::monitorInfoForWidget):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::calculatePositionAndSize):
+        (WebCore::PopupMenu::wndProc):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::paint):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Web inspector UI adjustments specific to the Qt platform:
+        - Hide the close button
+        - Hide the dock button
+        - Disable the draggable toolbar
+
+        https://bugs.webkit.org/show_bug.cgi?id=29384
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.toolbarDragStart):
+
+2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QtWebKit Windows CE compile fixes
+
+        Exclude certain pure-WINCE specific code paths from the Qt build.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop): Guard this code block with NETSCAPE_PLUGIN_API as
+        the corresponding PluginViewWndProc has the same guard in the header file.
+
+2009-09-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Geolocation does not correctly handle Infinity for PositionOptions properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29099
+
+        * bindings/js/JSGeolocationCustom.cpp: Modified.
+        (WebCore::createPositionOptions): Modified. If timeout or maximumAge is positive infinity, applies these values as a special case.
+        * page/PositionOptions.h: Modified.
+        (WebCore::PositionOptions::hasMaximumAge): Added. Determines whether the object has a maximum age.
+        (WebCore::PositionOptions::maximumAge): Modified. Asserts that the object has a maximum age.
+        (WebCore::PositionOptions::clearMaximumAge): Added. Clears the maximum age.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Registers that the maximum age has been set.
+        (WebCore::PositionOptions::PositionOptions): Modified. Registers that the maximum age has been set.
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Document.elementFromPoint now takes point in client space, not page space.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Reimplement default media UI for Mac Chromium to match the style
+        of the Windows and Linux versions.  Also breaks the dependency
+        on the internal wk* functions that were previously used to
+        render the media controller widgets.
+        https://bugs.webkit.org/show_bug.cgi?id=29161
+
+        No media layout tests are currently enabled in Mac Chromium, so
+        nothing needs rebaselineing, etc.
+
+        This is a recommit of r48438 with a compile fix and merges of
+        recent changes to the file.
+
+        * css/mediaControlsChromium.css:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::mediaElementParent):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+        (WebCore::mediaSliderThumbImage):
+        (WebCore::mediaVolumeSliderThumbImage):
+        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumMac::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize):
+
+2009-09-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The Console scope bar should have a divider between All and the other possible
+        values (Errors, Warnings, Logs). It will look something like:
+        
+        All | Errors Warnings Logs.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement):
+        (WebInspector.ConsoleView):
+        * inspector/front-end/inspector.css:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove additional references to JSVoidCallback which no longer exists.
+
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Remove commented out onhashchange attribute now that it is implemented.
+
+        * page/DOMWindow.idl:
+
+2009-09-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7007541> 
+        CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
+        
+        Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
+        crashes while we're calling into it).
+        
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::invalidate):
+        (JSC::RuntimeObjectImp::fallbackObjectGetter):
+        (JSC::RuntimeObjectImp::fieldGetter):
+        (JSC::RuntimeObjectImp::methodGetter):
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        (JSC::RuntimeObjectImp::put):
+        (JSC::RuntimeObjectImp::defaultValue):
+        (JSC::RuntimeObjectImp::getCallData):
+        (JSC::RuntimeObjectImp::getConstructData):
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::getInternalInstance):
+
+2009-09-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Wrap primitive values (as objects) in InspectorController::wrap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28983
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::wrapObject): objects of any type will be wrapped into proxies,
+         only object proxies will have objectId.
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions): there is InjectedScript.getCompletionsi
+         that accepts an expression and returns possible completions. This way we don't need to wrap
+         and unwrap the completions result into a proxy object.
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.createProxyObject):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-09-17  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Wrap PageTransitionEvents properly for V8's use.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29340
+
+        Fixes Chromium's failures for LayoutTests/fast/events/pageshow-pagehide.html.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object): Wrap PageTransitionEvents properly.
+
+2009-09-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Hardware-accelerated opacity transition on inline asserts
+        https://bugs.webkit.org/show_bug.cgi?id=29342
+        
+        Remove an erroneous toRenderBox() that could be called on a RenderInline; we can just
+        pass an empty size, because the box size is only required for transform animations.
+
+        Test: compositing/transitions/opacity-on-inline.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-09-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] OwnHandle might get a weak callback after destruction
+        https://bugs.webkit.org/show_bug.cgi?id=29172
+
+        Be sure to clear out weak reference so we don't get a weak callback
+        after we've destructed ourselves.  Also, removed some tricky methods
+        that had no clients.
+
+        * bindings/v8/OwnHandle.h:
+        (WebCore::OwnHandle::clear):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Partial roll out of http://trac.webkit.org/changeset/48455 to
+        fix crashes that started happening in V8Proxy::getEnteredContext().
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: labels of checkboxes should, when hit-tested, return the checkbox
+        https://bugs.webkit.org/show_bug.cgi?id=29335
+
+        When an accessibility hit test is done and it hits the label of a control element,
+        the control element should be returned instead of nothing, since the label
+        itself is usually ignored.
+
+        Test: accessibility/label-for-control-hittest.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-09-17  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Dimitri Glazkov, build fix.
+
+        Change to make RenderThemeChromiumMac compile inside of non PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+
+        Covered by existing tests.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Accessing properties/methods of an object, created with document.implementation.createDocumentType
+        creates nodes that have no document (ScriptExecutionContext), which in turn produces NULL-ref crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+              fast/dom/doctype-event-listener-crash.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Added an extra NULL-check.
+
+2009-09-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        FontDescription.h includes RenderStyleConstants.h, which violates layering
+        https://bugs.webkit.org/show_bug.cgi?id=29327
+
+        * GNUmakefile.am: Added FontSmoothingMode.h.
+        * WebCore.gypi: Added FontSmoothingMode.h.
+        * WebCore.vcproj/WebCore.vcproj: Added FontSmoothingMode.h.
+        * WebCore.xcodeproj/project.pbxproj: Added FontSmoothingMode.h and made
+            it a private header.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Get the
+            font smoothing mode via the font description.
+        * css/CSSPrimitiveValueMappings.h: Include FontSmoothingMode.h
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Updated for the rename
+            of FontSmoothing to FontSmoothingMode.
+        (WebCore::CSSPrimitiveValue::operator FontSmoothingMode): Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the font smoothing mode
+            via the font description.
+        * platform/graphics/FontDescription.h: Do not include
+            RenderStyleConstants.h.
+        (WebCore::FontDescription::fontSmoothing): Updated for the rename of
+            FontSmoothing to FontSmoothingMode.
+        (WebCore::FontDescription::setFontSmoothing): Ditto.
+        * platform/graphics/FontSmoothingMode.h: Added.
+        (WebCore::FontSmoothingMode): Moved the FontSmoothing enum from
+            RenderStyleConstants here and renamed it to this.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing): Removed this getter, since
+            this can be accessed via the font description.
+        * rendering/style/RenderStyleConstants.h: Moved the FontSmoothing enum
+            from here to FontSmoothingMode.h.
+
+2009-09-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx 2.9 build fix.
+
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements appear behind <video> when they should be in front sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=29314
+        
+        r45598 added logic that tests for overlap with <video> to determine when to throw
+        a layer into compositing mode. That logic was incorrect in some cases, and this patch
+        fixes it. When testing overlap, the layer needs to be composited iff some previous layer
+        is composited (which adds a rect to the overlay map), and there is overlap.
+
+        Test: compositing/geometry/video-opacity-overlay.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-09-17  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update the Chromium Mac theming files (RenderTheme and Theme) to be
+        up-to-date.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+        http://crbug.com/19604
+
+        Covered by existing tests.
+
+        * WebCore.gypi:
+        * platform/chromium/ThemeChromiumMac.h: Added.
+        (WebCore::ThemeChromiumMac::ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::~ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::controlRequiresPreWhiteSpace):
+        * platform/chromium/ThemeChromiumMac.mm: Added.
+        (WebCore::):
+        (WebCore::platformTheme):
+        (WebCore::controlSizeForFont):
+        (WebCore::sizeFromFont):
+        (WebCore::setControlSize):
+        (WebCore::updateStates):
+        (WebCore::inflateRect):
+        (WebCore::checkboxSizes):
+        (WebCore::checkboxMargins):
+        (WebCore::checkboxSize):
+        (WebCore::checkbox):
+        (WebCore::paintCheckbox):
+        (WebCore::radioSizes):
+        (WebCore::radioMargins):
+        (WebCore::radioSize):
+        (WebCore::radio):
+        (WebCore::paintRadio):
+        (WebCore::buttonSizes):
+        (WebCore::buttonMargins):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeChromiumMac::baselinePositionAdjustment):
+        (WebCore::ThemeChromiumMac::controlFont):
+        (WebCore::ThemeChromiumMac::controlSize):
+        (WebCore::ThemeChromiumMac::minimumControlSize):
+        (WebCore::ThemeChromiumMac::controlBorder):
+        (WebCore::ThemeChromiumMac::controlPadding):
+        (WebCore::ThemeChromiumMac::inflateControlPaintRect):
+        (WebCore::ThemeChromiumMac::paint):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/IntRect.h:
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::supportsControlTints):
+        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
+        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
+        * rendering/RenderThemeChromiumMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]):
+        (-[RTCMFlippedView isFlipped]):
+        (-[RTCMFlippedView currentEditor]):
+        (WebCore::):
+        (WebCore::FlippedView):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemFont):
+        (WebCore::convertNSColorToColor):
+        (WebCore::menuBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        (WebCore::RenderThemeChromiumMac::isControlStyled):
+        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
+        (WebCore::RenderThemeChromiumMac::inflateRect):
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
+        (WebCore::RenderThemeChromiumMac::setFontFromControlSize):
+        (WebCore::RenderThemeChromiumMac::paintTextField):
+        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeChromiumMac::paintTextArea):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::TopGradientInterpolate):
+        (WebCore::BottomGradientInterpolate):
+        (WebCore::MainGradientInterpolate):
+        (WebCore::TrackGradientInterpolate):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButtonGradients):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderTrackStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbStyle):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::setSearchCellState):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::getMediaUIPartStateFlags):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaRewindButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeChromiumMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeChromiumMac::paintMediaTimeRemaining):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+
+2009-09-16  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29306
+        
+        Fixes an issue where an attack that contains accented characters can
+        bypass the XSSAuditor.
+        
+        XSSAuditor::decodeURL used the wrong length for the input string. 
+        When the input string was decoded, the decoded result was truncated.
+        Hence, XSSAuditor was comparing the source code of the script to the 
+        truncated input parameters.
+
+        Test: http/tests/security/xssAuditor/img-onerror-accented-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeURL):
+
+2009-09-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Explore allowing pages with unload handlers into the Page Cache
+        https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        No new tests. (All previous tests continue to pass)
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): If the document is in the page cache, don't fire the unload event.
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some groups to the xcode project to make the bindings/js/ group
+        a little nicer.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29320
+        JS callback objects should store the global object
+
+        This just changes the callback objects to store the global object instead
+        of the frame. A follow up patch will change them to store the 'current' 
+        global object instead of the lexical or dynamic.
+
+        * DerivedSources.make: Remove unused VoidCallback.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        (WebCore::JSCustomPositionCallback::create):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        (WebCore::JSCustomPositionErrorCallback::create):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        (WebCore::JSCustomSQLStatementCallback::create):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        (WebCore::JSCustomSQLStatementErrorCallback::create):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::Data::Data):
+        (WebCore::JSCustomSQLTransactionCallback::Data::globalObject):
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        (WebCore::JSCustomSQLTransactionCallback::create):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        (WebCore::JSCustomSQLTransactionErrorCallback::create):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        (WebCore::JSCustomVoidCallback::create):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::createTransaction):
+        (WebCore::JSDatabase::transaction):
+        (WebCore::JSDatabase::readTransaction):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+
+2009-09-15  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <input maxlength=> should restrict only values specified by users.
+        https://bugs.webkit.org/show_bug.cgi?id=21271
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElement::sanitizeValue):
+        (WebCore::InputElement::sanitizeUserInputValue): Rename from constrainValue().
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::updateValueIfNeeded):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::value):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::sanitizeValue):
+        * html/HTMLInputElement.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::constrainValue):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::sanitizeValue):
+
+2009-09-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Reorganizing helper functions in htmlediting.h to group them by type of object they return/operate upon.
+        https://bugs.webkit.org/show_bug.cgi?id=29319
+
+        * editing/IndentOutdentCommand.cpp:
+        Removed implementation of isAtUnsplittableElement.
+
+        * editing/IndentOutdentCommand.h:
+        Removed member function isAtUnsplittableElement, because it was not class specific and belonged logically among the helper functions.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isAtUnsplittableElement): added. The code was taken from IndentOutdentCommand.
+
+        * editing/htmlediting.h:
+        Reordered functions to group them by type of object returned or operate upon.
+        Added comments.
+        Added isAtUnsplittableElement declaration.
+
+2009-09-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig and Anders Carlsson.
+
+        Removed some vestigial and potentially crashy code that makes consolidating
+        event listeners hard.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener): No need to limit when event listeners
+        can be added. Other EventTargets don't do this.
+        
+        Also, check for null when accessing document(). Technically, the JS bindings
+        do this check for us, but let's not rely on that.
+
+2009-09-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened
+        
+        Redo the way we handle events when a popup menu is shown, based on
+        http://blogs.msdn.com/oldnewthing/archive/2004/08/20/217684.aspx
+        
+        Since a non-active window can't capture the mouse, we use the owning window 
+        (the WebView) as the capture window. We then run a recursive message pump that 
+        forwards all mouse and keyboard events to the popup menu.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan.
+
+        Speculative fix for
+        <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy): Avoid calling renderArena() if node()
+        is null. Add two assertions that can help determine how this crash
+        happens (in particular, whether node() becomes null during destroy() or
+        it is null before destroy() is called).
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Speculative build fix.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7083741> Implement a CSS extension to 
+        adjust sub-pixel anti-aliasing for text
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29291
+
+        Added tests:
+        * fast/css/font-smoothing.html: Added.
+        * fast/css/parsing-webkit-font-smoothing.html: Added.
+
+        This patch adds a new CSS property called -webkit-font-smoothing 
+        that accepts the following as valid input: auto | none | 
+        antialiased | subpixel-antialiased
+
+        Return appropriate computed style for -webkit-font-smoothing
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Add a case for CSSPropertyWebkitFontSmoothing, and accept valid 
+        input.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+        Add mappings for FontSmoothing to the right CSS values.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator FontSmoothing):
+
+        Add -webkit-font-smoothing
+        * css/CSSPropertyNames.in:
+
+        Set fontSmoothing on the FontDescription.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add antialiased and subpixel-antialiased as possible new CSS 
+        values.
+        * css/CSSValueKeywords.in:
+        Store the font smoothing CSS value in the FontDescription.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::fontSmoothing):
+        (WebCore::FontDescription::setFontSmoothing):
+        (WebCore::FontDescription::operator==):
+
+        Call setShouldAntialias() and setShouldUseSmoothing() appropriately 
+        based on the CSS fontSmoothing() value.
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+        New function fontSmoothing()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing):
+
+        New enum FontSmoothing.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove style property if empty string is entered.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29163
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout): fixed null pointer exception
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleText): if styletext to apply is empty it will return an array to confirm the property removal
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Always reset m_implicitShorthand to false after parsing
+        background-repeat style property otherwise properties
+        following after it may be erroneously marked as implicit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+        https://bugs.webkit.org/show_bug.cgi?id=28973
+
+        Test: fast/backgrounds/repeat/margin-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-09-16  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Incorrect behavior of XMLHttpRequest::getAllResponseHeaders and
+        XMLHttpRequest::getResponseHeader in the
+        HEADERS_RECEIVED readyState.
+        https://bugs.webkit.org/show_bug.cgi?id=29121
+
+        Tests: http/tests/xmlhttprequest/getAllResponseHeaders.html
+               http/tests/xmlhttprequest/getResponseHeader.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getAllResponseHeaders):
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed the minimum valid state from LOADING to HEADERS_RECEIVED.
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix style violation in V8AbstractEventListener.
+        https://bugs.webkit.org/show_bug.cgi?id=29303
+
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==):
+
+2009-09-16  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add Watch Expression support to inspector
+        https://bugs.webkit.org/show_bug.cgi?id=27514
+
+        Manual test added.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertiesSection.CompareProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        * inspector/front-end/WatchExpressionsSidebarPane.js: Added.
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
+        (WebInspector.WatchExpressionsSection):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
+        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        (WebInspector.WatchExpressionsSection.CompareProperties):
+        (WebInspector.WatchExpressionTreeElement):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype._deleteButtonClicked):
+        (WebInspector.WatchExpressionTreeElement.prototype.startEditing):
+        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
+        (WebInspector.WatchExpressionTreeElement.prototype.applyExpression):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * manual-tests/inspector/debugger-watch-expressions.html: Added.
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=29260
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.Inspector.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Inspector only exports to WebCore.Inspector.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.Inspector.exp.
+        * bindings/js/JSDOMWindowBase.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::JSDOMWindowBase::supportsProfiling):
+        * bindings/js/JSInspectedObjectWrapper.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * bindings/js/JSInspectorBackendCustom.cpp: Ditto.
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Ditto.
+        * bindings/js/ScriptObject.cpp: Use ENABLE(INSPECTOR) where applicable.
+        * bindings/js/ScriptObject.h: Ditto.
+        * bindings/js/ScriptObjectQuarantine.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * dom/Document.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::addMessage):
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        (WebCore::Document::scriptImported):
+        * dom/Document.h: Ditto.
+        * dom/Node.cpp: Ditto.
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/ScriptExecutionContext.h: Ditto.
+        (WebCore::):
+        * html/HTMLDocument.cpp: Ditto.
+        (WebCore::HTMLDocument::createTokenizer):
+        * html/HTMLTokenizer.cpp: Ditto.
+        (WebCore::HTMLTokenizer::write):
+        * inspector/ConsoleMessage.cpp: Ditto.
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h: Ditto.
+        * inspector/DOMDispatchTimelineItem.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * inspector/InspectorBackend.cpp: Ditto.
+        * inspector/InspectorController.cpp: Ditto.
+        * inspector/InspectorDOMAgent.cpp: Ditto.
+        * inspector/InspectorDOMStorageResource.cpp: Ditto.
+        * inspector/InspectorDatabaseResource.cpp: Ditto.
+        * inspector/InspectorFrontend.cpp: Ditto.
+        * inspector/InspectorResource.cpp: Ditto.
+        * inspector/InspectorTimelineAgent.cpp: Ditto.
+        * inspector/TimelineItem.cpp: Ditto.
+        * loader/FrameLoader.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        (WebCore::FrameLoader::dispatchDidCommitLoad):
+        (WebCore::FrameLoader::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::FrameLoader::dispatchWillSendRequest):
+        (WebCore::FrameLoader::dispatchDidReceiveResponse):
+        (WebCore::FrameLoader::dispatchDidReceiveContentLength):
+        (WebCore::FrameLoader::dispatchDidFinishLoading):
+        * page/Chrome.cpp: Ditto.
+        (WebCore::Chrome::mouseDidMoveOverElement):
+        * page/Console.cpp: Ditto.
+        (WebCore::Console::addMessage):
+        (WebCore::Console::count):
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::time):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::groupEnd):
+        * page/ContextMenuController.cpp: Ditto.
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        * page/EventHandler.cpp: Ditto.
+        (WebCore::EventHandler::handleMousePressEvent):
+        * page/FrameView.cpp: Ditto.
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        * page/Page.h: Ditto.
+        * platform/ContextMenu.cpp: Ditto.
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h: Ditto.
+        (WebCore::):
+        * storage/Database.cpp: Ditto.
+        (WebCore::Database::openDatabase):
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp: Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(CONTEXT_MENUS)
+        https://bugs.webkit.org/show_bug.cgi?id=29225
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.ContextMenus.exp file if ENABLE_CONTEXT_MENUS.
+        * WebCore.base.exp: Move ContextMenu only exports to WebCore.ContextMenus.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.ContextMenus.exp.
+        * dom/Node.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        (WebCore::Node::defaultEventHandler):
+        * loader/EmptyClients.h: Ditto.
+        * page/ContextMenuController.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * page/EventHandler.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/EventHandlerMac.mm: Ditto.
+        * page/mac/WebCoreViewFactory.h: Ditto.
+        * platform/ContextMenu.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/LocalizedStrings.h: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * platform/mac/ContextMenuItemMac.mm: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/mac/ContextMenuMac.mm: Ditto.
+        * platform/mac/LocalizedStringsMac.mm: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Clean up invalidation for repainting.  Hoist the dirty rect intersection test in ScrollViewMac up
+        into ScrollView so that all platforms do it.
+        
+        Patch deferred repaints in FrameView::repaintContentRectangle to only add the visible portion of
+        the rectangle for repainting.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::repaintContentRectangle):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformRepaintContentRectangle):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=29233
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.DragSupport.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Drag Support only exports to WebCore.DragSupport.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.DragSupport.exp.
+        * dom/Clipboard.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * loader/EmptyClients.h: Ditto.
+        * page/DragController.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/EventHandler.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/DragControllerMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/mac/EventHandlerMac.mm: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * platform/DragData.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/DragImage.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/ClipboardMac.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * platform/mac/ClipboardMac.mm: Ditto.
+        * platform/mac/DragDataMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/DragImageMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * rendering/RenderLayer.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::RenderLayer::autoscroll):
+        * rendering/RenderObject.cpp: Ditto.
+        * rendering/RenderObject.h: Ditto.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix after adding support for high resolution times in Win.
+
+        * page/Settings.cpp:
+        * page/Settings.h:
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Added operator==() to event listeners. This fixes V8 bindings
+        build broken in http://trac.webkit.org/changeset/48402.
+        https://bugs.webkit.org/show_bug.cgi?id=29298
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Now
+        uses JSEventListenerType.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==): Only compares
+        pointers since we create at most one wrapper for a JS object.
+
+2009-09-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Crash when visiting http://flipper.googlelabs.com/
+        https://bugs.webkit.org/show_bug.cgi?id=29293
+
+        Check type for being null or empty before looking it up in the
+        hash of supported types.
+
+        Tested by http/tests/loading/redirect-with-no-location-crash.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed the notion of "disconnected nodes with event listeners" because
+        it was vestigial. The reference cycle it tried to solve was solved another
+        way in https://bugs.webkit.org/show_bug.cgi?id=21260.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        (WebCore::Node::insertedIntoDocument):
+        (WebCore::Node::removedFromDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::clearAttributeEventListener):
+
+2009-09-15  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for ranges, including the progressbar, slider, and spinbutton roles
+        https://bugs.webkit.org/show_bug.cgi?id=28841
+
+        Allow certain ARIA roles to change value with AXIncrement and AXDecrement. 
+        Consolidate increment/decrement/changeValue methods. 
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::increment):
+        (WebCore::AccessibilityRenderObject::decrement):
+        (WebCore::AccessibilityRenderObject::changeValueByPercent):
+        (WebCore::AccessibilityRenderObject::setValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        * accessibility/AccessibilitySlider.h:
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the jsEventListeners set from JSDOMGlobalObject, to simplify
+        creation and destruction of JSDOMGlobalObject and event listeners.
+        
+        Added an abstract operator==() to EventListener, to replace the
+        jsEventListeners set's role in determining if two event listeners are
+        equal from the DOM's perspective.
+        
+        Added a type field to EventListener, and casting operations, to support
+        operator==() and other abstract operations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        (WebCore::JSEventListener::operator==):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::cast):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        (WebCore::ObjCEventListener::cast):
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::ObjCEventListener):
+        (WebCore::ObjCEventListener::operator==):
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        (WebCore::EventListener::type):
+        (WebCore::EventListener::EventListener):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::addEventListener):
+        (WebCore::MessagePort::removeEventListener):
+        * dom/Node.cpp:
+        (WebCore::Node::removeEventListener):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::mainFrameDocument):
+        (WebCore::InspectorDOMAgent::operator==):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::cast):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::cast):
+        (WebCore::ImageEventListener::ImageEventListener):
+        (WebCore::ImageEventListener::operator==):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::removeEventListener):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::removeEventListener):
+        * page/EventSource.cpp:
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::cast):
+        (WebCore::ConditionEventListener::ConditionEventListener):
+        (WebCore::ConditionEventListener::operator==):
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::addEventListener):
+        (WebCore::AbstractWorker::removeEventListener):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addEventListener):
+        (WebCore::WorkerContext::removeEventListener):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::addEventListener):
+        (WebCore::XMLHttpRequest::removeEventListener):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::addEventListener):
+        (WebCore::XMLHttpRequestUpload::removeEventListener):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added ENABLE_MATHML to feature defines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-14  Andrew Richards  <randrew@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        Document.elementFromPoint() and Document.caretRangeFromPoint() erroneously returning null at points visible only after scrolling.
+        https://bugs.webkit.org/show_bug.cgi?id=29245
+
+        Use visibleContentRect() instead of boundsRect() when checking hit point bounds on viewport.
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-15  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        http://bugs.webkit.org/show_bug.cgi?id=26660
+
+        Chromium Windows: When rotated, the baseline for a span of complex
+        script is completely misaligned with that of the adjacent 
+        simple script text. It's fixed by not applying the baseline offset for
+        the Skia code path.
+
+        Test: transforms/2d/hindi-rotated.html
+
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Pass the PopupMenu pointer to CreateWindowEx and then get it from the LPCREATESTRUCT in
+        the WM_CREATE handler. This way we don't have to first create an zero size window and then size it.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::PopupMenuWndProc):
+
+2009-09-15  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        MessageEvent should not be cancelable by default
+        https://bugs.webkit.org/show_bug.cgi?id=27846
+
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        Changed constructor to set cancelable=false by default, per the HTML5 spec.
+
+2009-09-15  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Fix SVG path parsing error if a command starts with dot '.'
+        https://bugs.webkit.org/show_bug.cgi?id=29123
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+
+2009-09-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=28908
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/Popup.js: Added.
+        (WebInspector.Popup):
+        (WebInspector.Popup.prototype.show):
+        (WebInspector.Popup.prototype.hide):
+        (WebInspector.Popup.prototype.get visible):
+        (WebInspector.Popup.prototype.set element):
+        (WebInspector.Popup.prototype.get element):
+        (WebInspector.Popup.prototype.positionElement):
+        (WebInspector.Popup.prototype.set anchor):
+        (WebInspector.Popup.prototype.get anchor):
+        (WebInspector.Popup.prototype.set autoHide):
+        (WebInspector.Popup.prototype._checkNotVisible):
+        (WebInspector.Popup.prototype._keyEventHandler):
+        (WebInspector.Popup.prototype._mouseDownEventHandler):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._documentContextMenu):
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createPopupElement):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.set currentFocusElement):
+        (WebInspector.set currentPanel):
+        (WebInspector.loaded):
+        (WebInspector.contextMenu):
+        (WebInspector.elementDragStart):
+        (WebInspector.updateResource):
+        (WebInspector.drawLoadingPieChart):
+        (WebInspector.linkifyURLAsNode):
+        (WebInspector.startEditing.getContent):
+        (WebInspector.startEditing.editingCancelled):
+        (WebInspector.startEditing.editingCommitted):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.positionAt):
+        (Element.prototype.offsetRelativeToWindow):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Page cache should support pages with unload handlers as an experiment.
+        <rdar://problem/7196485> and https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        For the experiment, only allow pages with unload handlers into the Page Cache on
+        Mac and Windows.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the change in r48376 to do a null-check to fix a crashing test.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() + 436
+        
+        Avoid a crash when a mouse event handler on a <select> changes the select from a popup
+        to a list (by setting the 'size' property) inside the event handler.
+
+        Test: fast/forms/select-change-popup-to-listbox-in-event-handler.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        More PopupMenu cleanup.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Call registerClass.
+        
+        (WebCore::PopupMenu::registerClass):
+        Make this a private static member function so it can refer to PopupMenuWndProc.
+        
+        (WebCore::PopupMenu::PopupMenuWndProc):
+        Try to get the PopupMenu and call its wndProc member function.
+        
+        (WebCore::PopupMenu::wndProc):
+        Make this a member function.
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Not reviewed, maybe should've been:
+
+        Cleaning up more Windows-specific fallout from the fix for:
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::load): Don't allow empty CFStrings as the stored credentials,
+          as related checks all look at nullity when they really mean to be looking for emptiness. 
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Speculative Qt build fix.
+        
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::hidePopup):
+
+2009-09-14  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix RenderThemeChromiumWin::determineClassicState so that classic_state
+        matches the state values (and you get a single classic_state value
+        for a given {part,state} value. This change will be tested by a 
+        chromium patch that will land after this.
+
+        This will be tested by code landing downstream on Chromium.org; the
+        code does not execute on webkit.org.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineClassicState):
+        (WebCore::RenderThemeChromiumWin::getThemeData):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29138
+        Simplify popup menu handling.
+
+        * platform/PopupMenuClient.h:
+        Rename hidePopup to popupDidHide.
+        
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):        
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        Call popupDidHide instead of hidePopup.
+        
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        Ditto.
+        
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        Ditto.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        Call popupDidHide.
+        
+        (WebCore::PopupWndProc):
+        Call PopupMenu::hide.
+        
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        Call popupDidHide.
+        
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::hidePopup):
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        Set the "popup is visible" flag in popupDidHide.
+        
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::hidePopup):
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+        Ditto.
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt.
+
+        - Fix <rdar://problem/7182275>.
+
+        Make sure that the newly created scrollbar's style is up to date.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        Call setParent so that the scrollbar's parts are torn down correctly.
+        
+        (WebCore::PopupMenu::show):
+        Call styleChanged.
+
+2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7197644> WebKit should broadcast an MSAA event when
+        jumping to a named anchor
+
+        https://bugs.webkit.org/show_bug.cgi?id=28899
+
+        Reviewed by Adam Roben.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        Added declaration for handleScrolledToAnchor(). Added a new entry to
+        the enum of accessibility notifications.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
+        Code moved from AccessibilityRenderObject::internalLinkElement() and
+        refactored slightly; walks the tree until it finds a Node (with a
+        renderer) whose accessibility is not ignored.
+
+        * accessibility/AccessibilityObject.h:
+        Added a declaration for firstAccessibleObjectFromNode().
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        Code moved to AccessibilityObject::firstAccessibleObjectFromNode().
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        Add a default case that returns early for notifications that Mac
+        doesn't handle.
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Post an AXScrolledToAnchor notification for the first accessible from
+        the anchor Node.
+        (WebCore::AXObjectCache::postPlatformNotification):
+        If the notification is AXFocusedUIElementChanged, fire an
+        EVENT_OBJECT_FOCUS. If the notification is AXScrolledToAnchor, fire
+        EVENT_SYSTEM_SCROLLINGSTART, matching Firefox.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Code moved to postPlatformNotification().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+        Call AXObjectCache::handleScrolledToAnchor().
+
+2009-09-14  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Cookies are not inspectable after reloading a page
+        https://bugs.webkit.org/show_bug.cgi?id=29222
+
+        Create the cookieTreeElement on initialization instead of when the view is shown.
+        Reset the selected element of the sidebar on reset.
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Safari 4 cannot be used to update firmware on Linksys routers.
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        In http://trac.webkit.org/changeset/42483, we disabled CFNetwork's session credential storage and 
+        implemented our own in WebCore.
+
+        One feature we lost is that CFNetwork would automatically send previously authenticated credentials
+        with new connections when the paths match, as allowed by RFC 2617 for HTTP Basic and Digest Authentication.  
+
+        Even though it's optional for User Agents to do this, (some?) Linksys routers rely on this behavior for
+        HTTP Basic Authentication.  So now WebCore's CredentialStorage will track URL paths for Basic credentials.
+
+        We're not making this enhancement for Digest at this time, since we don't know of anything that broke
+        due to the change in Digest behavior.
+
+        Test: http/tests/loading/basic-credentials-sent-automatically.html
+              http/tests/loading/basic-auth-resend-wrong-credentials.html
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::isEmpty):
+        * platform/network/Credential.h:
+
+        Add a slightly more full featured CredentialStore that will track URL paths a credential belongs to:
+        * platform/network/CredentialStorage.cpp: Added.
+        (WebCore::protectionSpaceToCredentialMap):
+        (WebCore::originToDefaultCredentialMap):
+        (WebCore::originStringFromURL):
+        (WebCore::CredentialStorage::set):
+        (WebCore::CredentialStorage::get):
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential):
+        * platform/network/CredentialStorage.h: Added.
+
+        Allow ProtectionSpace to be a hash key:
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        * platform/network/ProtectionSpace.h:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        (WebCore::ProtectionSpace::isHashTableDeletedValue):
+        * platform/network/ProtectionSpaceHash.h: Added.
+        (WebCore::ProtectionSpaceHash::hash):
+        (WebCore::ProtectionSpaceHash::equal):
+
+        Allow ResourceHandles to remember the initial credential they used:
+        * platform/network/ResourceHandleInternal.h:
+
+        Allow mutable ResourceRequests to update their platform object if HTTP header fields change:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+
+        Remove WebCoreCredentialStorage:
+        * platform/network/cf/AuthenticationCF.cpp:
+        * platform/network/cf/AuthenticationCF.h:
+        * platform/network/mac/AuthenticationMac.h:
+        * platform/network/mac/AuthenticationMac.mm:
+
+        Change ResourceHandleCFNet to try to use stored credentials on new connections, if appropriate:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::WebCoreSynchronousLoader::load):
+
+        Change ResourceHandleMac to try to use stored credentials on new connections, if appropriate:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Only try the 
+          ProtectionSpace key'ed Credential if it does not match the initially used Credential.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+
+        Add base64-ability to CString:
+        * platform/text/CString.cpp:
+        (WebCore::CStringBuffer::base64Encode):
+        (WebCore::CString::base64Encode):
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <rdar://problem/6954546> Crashes in WebCore::RenderPart::setWidget below FrameLoader::loadPlugin.
+
+        The calls to FrameLoader::requestObject within RenderPartObject::updateWidget can result in a plug-in
+        being initialized.  This can run cause arbitrary JavaScript to run and may result in the RenderPartObject
+        being detached from the render tree and destroyed, causing a crash like <rdar://problem/6954546>.
+
+        No test is possible until <rdar://problem/7090444> is fixed.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Ensure that we stay alive for the duration of plug-in initialization.
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add RenderWidgetProtector to simplify protecting a RenderWidget from destruction for the
+        duration of a function.  Deploy it within RenderWidget.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+        (WebCore::RenderWidget::updateWidgetPosition): Use a RefPtr rather than explicitly
+        ref'ing and deref'ing the node.
+        * rendering/RenderWidget.h:
+        * rendering/RenderWidgetProtector.h:
+        (WebCore::RenderWidgetProtector::RenderWidgetProtector):
+        (WebCore::RenderWidgetProtector::~RenderWidgetProtector):
+
+2009-09-14  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        CodeGenerator.pm needs some cleaning up
+        https://bugs.webkit.org/show_bug.cgi?id=29238
+
+        * bindings/scripts/CodeGenerator.pm:
+        (FindParentsRecursively): Removed; its functionality is now handled in
+        AddMethodsConstantsAndAttributesFromParentClasses.
+        (ForAllParents): New function that visits an interface's ancestors and
+        invokes a callback for each one.
+        (AddMethodsConstantsAndAttributesFromParentClasses): Simplified by using
+        ForAllParents.
+        (GetMethodsAndAttributesFromParentClasses): Ditto.
+        (IDLFileForInterface): Factored out previous calls to ScanDirectory into
+        this new function, which returns the filename containing a given IDL
+        interface definition.
+        (ParseInterface): Simplified by using IDLFileForInterface.
+        (ScanDirectory): Removed in lieu of IDLFileForInterface.
+        * bindings/scripts/CodeGeneratorV8.pm: Drop call to
+        FindParentsRecursively and get the list of parents from the
+        AddMethodsConstantsAndAttributesFromParentClasses call instead.
+
+2009-09-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Assert hit when dropping a file in QtLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=29242
+
+        Qt's implementation of DropData::asURL does not return a URL encoded string
+        as expected.
+
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+
+2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, file was missed during TLS.cpp removal.
+
+        * page/wx/FrameWx.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
+
+2009-09-13  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector: Add "New Style Rule" to the localizedStrings
+        https://bugs.webkit.org/show_bug.cgi?id=29237
+
+        * English.lproj/localizedStrings.js:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Implement filesystem functions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29196
+
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::makeAllDirectories):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::homeDirectoryPath):
+        (WebCore::directoryName):
+
+2009-09-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx 2.9.
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        Switch from getPropertyNames to getOwnPropertyNames, and provide custom
+        getPropertyNames to DOMWindow, DOMWindowShell and QuarantinedObjectWrapper
+        in order to ensure correct semantics are maintained.
+
+        Test: fast/js/Object-keys.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getOwnPropertyNames):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29219
+        Document.elementFromPoint() should take page scroll into consideration
+
+        Test: fast/dom/elementFromPoint-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29217
+        Document.caretRangeFromPoint should take the scroll offset into account before hit testing
+
+        In accordance with the CSSOM View Module spec, Document.caretRangeFromPoint should interpret
+        the point passed to it as relative to the viewport, not the document.
+
+        Test: fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added some manual tests to show WebGL in action
+        https://bugs.webkit.org/show_bug.cgi?id=29215
+
+        * manual-tests/webgl: Added.
+        * manual-tests/webgl/Earth.html: Added.
+        * manual-tests/webgl/ManyPlanetsDeep.html: Added.
+        * manual-tests/webgl/SpinningBox.html: Added.
+        * manual-tests/webgl/TeapotPerPixel.html: Added.
+        * manual-tests/webgl/TeapotPerVertex.html: Added.
+        * manual-tests/webgl/resources: Added.
+        * manual-tests/webgl/resources/CanvasMatrix.js: Added.
+        * manual-tests/webgl/resources/earthmap1k.jpg: Added.
+        * manual-tests/webgl/resources/mars500x250.png: Added.
+        * manual-tests/webgl/resources/teapot.obj: Added.
+        * manual-tests/webgl/resources/utils3d.js: Added.
+ 
+2009-09-10  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        aria definition role spelled wrong "defintion"
+        https://bugs.webkit.org/show_bug.cgi?id=28840
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-09-11  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes an assert in Node::isFocusable which was causing crashes in certain cases.
+        https://bugs.webkit.org/show_bug.cgi?id=29210
+
+        * dom/Node.cpp:
+        (WebCore::Node::isFocusable):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added variants to uniform* and vertexAttrib* calls which take sequence<> in place of CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29139
+        
+        I also added a data() call to each of the CanvasArray subclasses to give back a types pointer
+        to the baseAddress().
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::toArray):
+        (WebCore::):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        (WebCore::JSCanvasRenderingContext3D::uniform1fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform1iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4iv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::data):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::data):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::data):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::data):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::data):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::data):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::data):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE(WEB_SOCKETS) guards.
+        https://bugs.webkit.org/show_bug.cgi?id=29174
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r48229.
+        http://trac.webkit.org/changeset/48229
+
+        * WebCore.base.exp:
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+        (WebCore::Clipboard::sourceOperation):
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::performDrag):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::startDrag):
+        * page/DragController.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::dragSourceMovedTo):
+        (WebCore::EventHandler::handleDrag):
+        * page/EventHandler.h:
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Fix the build.
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27456
+        Added support for static validation of url in
+        ValidityState, for url state inputs.
+        From HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#url-state
+
+        Test: fast/forms/ValidityState-typeMismatch-url.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Revert r47992: Expose functions to change the focus ring color for
+        Linux Chromium.
+
+        As Darin Fisher has pointed out, there is a better way to do this.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29207
+        Add checks for using WebCore JS context on secondary threads
+
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        Set the new debug-only mainThreadOnly flag.
+
+2009-09-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The inspector should have scope bars.
+        https://bugs.webkit.org/show_bug.cgi?id=14353
+        
+        Add scope bars to the console, so the user can choose which category
+        of messages they want to see (All, Errors, Warnings, Logs), and they
+        can choose from one or more of {Errors, Warnings, Logs}.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createFilterElement):
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        (WebInspector.ConsoleView.prototype.attach):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-09-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Added extra NULL checks for HDC. This is the second fix for issue 28707,
+        and the fix is similar to http://trac.webkit.org/changeset/45482.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make ElementTimeControl methods return void and not throw.
+        https://bugs.webkit.org/show_bug.cgi?id=28831
+
+        SVG 1.1 erratum:
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#elementtimecontrol-interface
+
+        Test: svg/dom/smil-methods.svg
+
+        * svg/ElementTimeControl.h: Change return type from bool to void and remove exception argument.
+        * svg/ElementTimeControl.idl: Change return type from bool to void and remove raises claus.
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::beginElement): Change return type from bool to void and remove exception argument.
+        (WebCore::SVGAnimationElement::beginElementAt): Ditto.
+        (WebCore::SVGAnimationElement::endElement): Ditto.
+        (WebCore::SVGAnimationElement::endElementAt): Ditto.
+        * svg/SVGAnimationElement.h: Ditto.
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added support for texImage2D which takes CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29191
+
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+
+2009-09-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow WebKit clients to opt out of high resolution timers on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=29192
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setShouldUseHighResolutionTimers): Added.
+        * page/Settings.h: Added getter/setter for shouldUseHighResolutionTimers.
+        (WebCore::Settings::shouldUseHighResolutionTimers): Added.
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::setSharedTimerFireTime): Don't run high resolution timer code if it is disabled.
+
+2009-09-11  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Share persistent context handles between events        
+        Change events to use a single ref-counted shared persistent handle
+        to the context in which to run, rather than create a new
+        persistent handle for each new event which puts pressure on the
+        gc.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29077
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/SharedPersistent.h: Added.
+        (WebCore::SharedPersistent::set):
+        (WebCore::SharedPersistent::get):
+        (WebCore::SharedPersistent::disposeHandle):
+        (WebCore::SharedPersistent::create):
+        (WebCore::SharedPersistent::SharedPersistent):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::context):
+        (WebCore::V8IsolatedWorld::shared_context):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        (WebCore::V8Proxy::isContextInitialized):
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::clearDocumentWrapperCache):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::setSecurityToken):
+        (WebCore::V8Proxy::updateDocument):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::shared_context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::shared_context):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Create a real handle (one which would save an object from GC).
+        https://bugs.webkit.org/show_bug.cgi?id=29150
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ExternalString):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Inline WebCore::v8String as it only invokes WebCore::v8ExternalString.
+        https://bugs.webkit.org/show_bug.cgi?id=29152
+
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8String):
+
+2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
+        renaming.
+
+        * ChangeLog-2009-06-16:
+
+2009-09-11  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use LIBS_PRIVATE on Qt/Mac.
+
+        On the Mac, it means "-framework ApplicationServices -framework Carbon
+        -framework AppKit" are no longer part of the default LIBS in Qt
+        applications. This required a lot of fixes where we used Mac-specific
+        code in Qt.
+
+        * WebCore.pro:
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Remove duplicated WK_{u,l}cfirst subs from CodeGeneratorV8.pm
+        https://bugs.webkit.org/show_bug.cgi?id=29165
+
+        * bindings/scripts/CodeGeneratorV8.pm: Remove WK_ucfirst and
+        WK_lcfirst, and call the ones in CodeGenerator.pm instead.
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29132
+        Symbian winscw compiler fails compiling WebCore/text/RegularExpression.cpp.
+
+        Add RegularExpression class qualifier before Private.
+
+        * platform/text/RegularExpression.cpp:
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29131
+        Use a different variadic macro format for Symbian compiler.
+        
+        Use arg... instead of ellipsis in variadic macro.        
+
+        * platform/StaticConstructors.h:
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28806
+
+        [Qt] Make the WebInspector available as a QWidget.
+
+        * WebCore.pro:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed fix for the Web Inspector with the Qt build.
+
+        Re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, remove stray semicolon from function definition.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Detect mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=29003
+
+        Detect some basic kinds of mixed content (HTTP content loaded into an
+        HTTPS context).  This new detection logic isn't perfect, but it's a
+        place to start.
+
+        Tests: http/tests/security/mixedContent/about-blank-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-script-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-main-frame.html
+               http/tests/security/mixedContent/insecure-iframe-in-iframe.html
+               http/tests/security/mixedContent/insecure-iframe-in-main-frame.html
+               http/tests/security/mixedContent/insecure-image-in-iframe.html
+               http/tests/security/mixedContent/insecure-image-in-main-frame.html
+               http/tests/security/mixedContent/insecure-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-http-to-https-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-https-to-http-script-in-iframe.html
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::canRequest):
+        (WebCore::DocLoader::requestResource):
+        (WebCore::DocLoader::checkCacheObjectStatus):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        Restore platform/mock to the header search path after it was removed in r48270.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-09-08  Timothy Hatcher  <timothy@apple.com>
+
+        Web Inspector: Move the option to create a new style rule under the Styles' gear menu.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29039
+
+        Reviewed by Sam Weinig.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane): Add "New Style Rule" option to the gear menu.
+        (WebInspector.StylesSidebarPane.prototype._update): Check instanceof BlankStylePropertiesSection instead.
+        (WebInspector.StylesSidebarPane.prototype._changeSetting): Added. Keeps the color format setting selected
+        while calling the correct action.
+        (WebInspector.StylesSidebarPane.prototype._createNewRule): Creates a new section and edits the selector.
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection): Insert the section in a cleaner way.
+        (WebInspector.StylesSidebarPane.prototype.removeSection): Added. Removes the passed in section.
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): Return an empty string if there is no node.
+        (WebInspector.StylePropertiesSection.prototype.expand): Removed the check for _blank.
+        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): No need for the context, the original selector
+        is remembered by the editing code.
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled): Do nothing. The original text is already
+        restored by the editing code.
+        (WebInspector.BlankStylePropertiesSection): Call the StylePropertiesSection constructor with appropriate data.
+        Remove event listener code.
+        (WebInspector.BlankStylePropertiesSection.prototype.expand): Added. Does nothing to prevent expanding.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback): Correctly construct the
+        WebInspector.CSSStyleDeclaration. Call editingSelectorCancelled instead of editingCancelled.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted): Renamed from editingCommitted to
+        override the base class.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCancelled): Remove the section.
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): Removed event listener code. Removed the delete lines
+        since they were doing nothing (deleting nonexistent properties that exist only on the prototype.) Change prototypes at
+        the end to correctly swtich to a real StylePropertiesSection.
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.editingCancelled): Ceck for null/undefined callbacks.
+        (WebInspector.startEditing.editingCommitted): Ditto.
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix comparison between signed and unsigned integer warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29162
+
+        No functional change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::findMethodIndex):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::duration):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2009-09-10  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for GTK+ after r48267.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded define for ActiveX.
+        https://bugs.webkit.org/show_bug.cgi?id=29054
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::createClassIdToTypeMap):
+        (WebCore::serviceTypeForClassId):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Don't copy IDL files in to the built framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-10  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implment Range.expand().
+        https://bugs.webkit.org/show_bug.cgi?id=27632
+
+        Test: fast/dom/Range/range-expand.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::expand):
+        * dom/Range.h:
+        * dom/Range.idl:
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems for GNUmakefile.am, WebCore.xcodeproj and
+        WebCore.vcproj.
+        Add websockets directory and WebSocket.idl in qt build system.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, windows build fix only.
+        
+        Spurious semicolon causing parse error in chromium build on windows.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, build fix only.
+
+        Adding in a missed include from the last patch that is breaking the
+        chromium build.
+
+        * rendering/RenderThemeChromiumMac.mm: include TimeRanges.h
+
+2009-09-10  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        HTMLMediaElement buffered attribute should report a list of time ranges
+        https://bugs.webkit.org/show_bug.cgi?id=29041
+
+        Changed MediaPlayerPrivateInterface and MediaPlayer's definition to
+        report a list of buffered time ranges as WebCore::TimeRanges. This
+        change also got rid of the maxTimeBuffered() method.
+
+        No new tests since this is a API change.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::percentLoaded):
+        Use MediaPlaier::buffered() instead of maxTimeBuffered().
+        (WebCore::HTMLMediaElement::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::buffered):
+        Use MediaPlayerPrivateInterface::buffered() instead of maxTimeBuffered().
+        (WebCore::MediaPlayer::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/MediaPlayerPrivate.h:
+        ditto.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Implements PassRefPtr<TimeRanges> buffered();
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::buffered):
+        Implementation of buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        Implements PassRefPtr<TimeRanegs> buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        Implements PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/wince/MediaPlayerPrivateWince.h:
+        ditto.
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        Use buffered() instead of maxTimeBuffered().
+        * rendering/RenderThemeChromiumSkia.cpp:
+        ditto.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        ditto.
+
+2009-09-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make bindings generators more aware of IDL dependencies
+        https://bugs.webkit.org/show_bug.cgi?id=29114
+
+        Make the JS and ObjC bindings generators able to output dependency
+        rules for DerivedSources.make to consume.  These rules make a given
+        generated binding class file header, JSWhatever.h, depend on Whatever's
+        ancestor interfaces.
+
+        * DerivedSources.make: Pass --write-dependencies to generate-bindings.pl
+        when generating JS and ObjC bindings.  Include dependency fies that are
+        generated due to that.
+        * bindings/scripts/CodeGenerator.pm: Make
+        AddMethodsConstantsAndAttributesFromParentClasses accumulate a list of
+        the ancestor interfaces that were visited.
+        * bindings/scripts/CodeGeneratorJS.pm: Optionally write out a dependency
+        file.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * bindings/scripts/generate-bindings.pl: Add a --write-dependencies
+        option.
+
+2009-09-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez and Dan Winship.
+
+        Give all requests to libsoup, to let it queue, and schedule them
+        itself, instead of throttling the number of requests in WebCore.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-09-10  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Make XMLHttpRequest.send handle File object.
+        https://bugs.webkit.org/show_bug.cgi?id=28924
+
+        Test: http/tests/local/send-dragged-file.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use fastNew and fastDelete instead of operator new and delete for CSSSelector class. 
+        https://bugs.webkit.org/show_bug.cgi?id=25930
+
+        Change using of operator new to fastNew and operator delete to
+        fastDeleteSkippingDestructor for CSSSelector class to avoid mismatched function call.
+
+        This change fixes valgrind's 'mismatched free' notification.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::createFloatingSelector):
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::adoptSelectorVector):
+
+2009-09-10  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation does not correctly handle reentrant calls from callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=29040
+
+        Tests: fast/dom/Geolocation/reentrant-error.html
+               fast/dom/Geolocation/reentrant-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::handleError): Modified. Call sendError directly, clearing notifier lists before making callback.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Call sendPosition directly, clearing notifier lists before making callback.
+        * page/Geolocation.h: Modified. Deleted sendErrorToXX and sendPositionToXXX methods.
+
+2009-09-10  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes issue where focused elements did not get blur and focus events when the window was blurred and focused.
+        https://bugs.webkit.org/show_bug.cgi?id=27105
+
+        Test: fast/events/blur-focus-window-should-blur-focus-element.html
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocused):
+        (WebCore::FocusController::setActive):
+
+2009-09-10  Adam Roben  <aroben@apple.com>
+
+        Make the play/pause button in <video> controls indicate the button's
+        action, not the movie state
+
+        This matches the Mac behavior, iTunes, and many other media players.
+
+        No test possible.
+
+        Fixes <http://webkit.org/b/29126> Play/pause button in <video>
+        controls shows the wrong image
+
+        Reviewed by Eric Carlson.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Reversed when
+        we show the play vs. pause artwork, so that the button reflects what
+        will happen when you click it, rather than the current state of the
+        movie.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Geolocation Coordinates::toString() prints bogus values for unspecified properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29080
+
+        Test: fast/dom/Geolocation/position-string.html
+
+        * GNUmakefile.am: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.gypi: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.pro: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCoreSources.bkl: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * page/Coordinates.cpp: Removed.
+        * page/Coordinates.h: Modified. Removes toString method.
+        * page/Coordinates.idl: Modified. Removes toString method.
+        * page/Geoposition.cpp: Removed.
+        * page/Geoposition.h: Modified. Removes toString method.
+        * page/Geoposition.idl: Modified. Removes toString method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Correctly applies the Geolocation timeout property.
+        https://bugs.webkit.org/show_bug.cgi?id=27256
+
+        If a timeout is specified, the timer is started as soon as the location acquistion process starts.
+        If a position fix is not obtained within the timeout interval, the position request is cancelled
+        and the error callback (if specified) is invoked. If a position fix is obtained within the timeout
+        interval, the timer is stopped. Permissions are then requested from the user if required. See
+        http://www.w3.org/TR/geolocation-API/#position-options.
+
+        Note that this logic means that the time required to obtain permissions from the user is not
+        included in the timeout interval.
+
+        Tests: fast/dom/Geolocation/timeout.html
+               fast/dom/Geolocation/timeout-zero.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Takes Geolocation object as parameter.
+        (WebCore::Geolocation::GeoNotifier::hasZeroTimeout): Added. Determines whether this request has a zero timeout.
+        (WebCore::Geolocation::GeoNotifier::startTimerIfNeeded): Renamed from startTimer. Starts the timer if a timeout was specified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Calls the error callback if specified, and reports the timeout to the Geolocation object.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::watchPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::requestTimedOut): Added. Cancels a request when it times out.
+        (WebCore::Geolocation::setIsAllowed): Modified. No longer starts timers.
+        (WebCore::Geolocation::sendPosition): Modified. No longer stops timers.
+        (WebCore::Geolocation::stopTimer): Added. Stops the timers for a vector of notifiers.
+        (WebCore::Geolocation::stopTimersForOneShots): Added. Stops the timers for all one-shots.
+        (WebCore::Geolocation::stopTimersForWatchers): Added. Stops the timers for all watchers.
+        (WebCore::Geolocation::stopTimers): Added. Stops the timers for all requests.
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modfified. Stops the timers for all requests.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::GeoNotifier::create): Modified. Takes Geolocation object as parameter.
+
+2009-09-09  Chris Fleizach  <cfleizach@apple.com>
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Build fix for Qt.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-09-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Moves AX notifications over to an ENUM type instead of
+        using the actual string values that are used on OS X.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedContents):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-09-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Missing checkout for getSVGDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=29064
+
+        The V8 code generator didn't understand SVGCheckSecurityDocument.
+
+        Tests: http/tests/security/xss-DENIED-getSVGDocument-iframe.html
+               http/tests/security/xss-DENIED-getSVGDocument-object.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement inherit from SVGLangSpace
+        https://bugs.webkit.org/show_bug.cgi?id=29058
+
+        Required by SVG 1.1 Second Edition:
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/styling.html#InterfaceSVGStyleElement
+
+        Test: svg/dom/SVGStyleElement/style-langspace.html
+
+        * svg/SVGStyleElement.cpp: Drop methods xmlspace and setXmlspace.
+        (WebCore::SVGStyleElement::SVGStyleElement): Add SVGLangSpace()
+        initializer.
+        (WebCore::SVGStyleElement::parseMappedAttribute): Call
+        parseMappedAttribute on SVGLangSpace.
+        * svg/SVGStyleElement.h: Drop xmlspace and setXmlspace declarations.
+        * svg/SVGStyleElement.idl: Drop xmlspace attribute and add SVGLangSpace
+        as a superinterface.
+
+2009-09-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unnecessary includes and forward declarations in V8Proxy.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=29111
+
+        * bindings/v8/V8Proxy.h:
+
+2009-07-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add more position constructors
+        positionBeforeNode, positionAfterNode
+        firstPositionInNode, lastPositionInNode
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        I also added a lastOffsetInNode and deployed it to a couple places.
+
+        There are no callers to these new constructors yet, but those
+        will be coming in future patches.
+
+        * dom/Position.cpp:
+        (WebCore::Position::computeOffsetInContainerNode):
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        (WebCore::lastOffsetInNode):
+        (WebCore::firstPositionInNode):
+        (WebCore::lastPositionInNode):
+        * editing/ApplyStyleCommand.cpp:
+        * editing/TextIterator.cpp:
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        * editing/htmlediting.cpp:
+        (WebCore::lastOffsetForEditing):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename positionBeforeNode to positionInParentBeforeNode
+        and positionAfterNode to positionInParentAfterNode
+        in preparation for adding a positionBeforeNode
+        which returns a neighbor-anchored position.
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        No functional changes, thus no tests.
+
+        * dom/PositionConstructors.h:
+        (WebCore::positionInParentBeforeNode):
+        (WebCore::positionInParentAfterNode):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::deleteTarget):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        (WebCore::updatePositionForNodeRemoval):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+        (WebCore::rangeCompliantEquivalent):
+        (WebCore::positionBeforeContainingSpecialElement):
+        (WebCore::positionAfterContainingSpecialElement):
+        (WebCore::positionBeforeTabSpan):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Re-organize position creation functions in preparation for adding more
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        Make position functions inline to avoid ref-churn.
+        Remove startPosition/endPosition as they were only used in one place.
+
+        No functional changes, thus no tests.
+
+        * dom/Position.cpp:
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::moveTo):
+        * editing/TypingCommand.cpp:
+        * editing/htmlediting.cpp:
+        * editing/htmlediting.h:
+        (WebCore::firstDeepEditingPositionForNode):
+        (WebCore::lastDeepEditingPositionForNode):
+        * rendering/RenderObject.cpp:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+        
+        [wx] Add wxSize conversions for IntSize.
+        https://bugs.webkit.org/show_bug.cgi?id=29104
+
+        * platform/graphics/IntSize.h:
+        * platform/graphics/wx/IntSizeWx.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator wxSize):
+
+2009-09-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+        
+        Chromium uses its own config.h file that was forked from webkit's config.h.
+        By merging in Chromium's defines, Chromium would again be able to use webkit's
+        config.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28882 
+
+        * config.h: Added chromium-specific defines. 
+
+2009-09-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize DataTransfer's effectAllowed and dropEffect properties correctly
+        according to HTML5 spec (sec. 7.9.2-7.9.3).
+        https://bugs.webkit.org/show_bug.cgi?id=26700
+        - At the start of a drag operation, the value of effectAllowed should be
+          the string "uninitialized".
+        - At end of dragstart handler, if effectAllowed hasn't been set yet, it
+          should be set to "copy".
+        - on dragenter and dragover event, dropEffect should be initialized to a
+          default value based on the value of effectAllowed.
+        - at end of dragenter and dragover the dropEffect should be set to "none"
+          if the value set by the handler doesn't match the effectAllowed.
+        - on dragleave event, dropEffect should be "none".
+        - on drop event, dropEffect should be the previously negotiated value.
+
+        Test: fast/events/drag-dropeffect.html
+
+        * WebCore.base.exp:
+            Added a parameter to EventHandler::dragSourceMovedTo.
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+            Initialize m_effectAllowed to "uninitialized".
+        (WebCore::Clipboard::sourceOperation):
+            Treat "uninitialized" as meaning no value has been set.
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+            Initialize new member m_destinationDragOperation.
+        (WebCore::DragController::dragExited):
+            Set m_destinationDragOperation to none on dragExit.
+        (WebCore::DragController::performDrag):
+            Set m_destinationDragOperation to current dropEffect.
+        (WebCore::DragController::dragEnteredOrUpdated):
+            Make sure to clear the operation if drag source doesn't allow it.
+        (WebCore::DragController::tryDHTMLDrag):
+            Set a default value for the dst drag op before sending dragEnter/Over.
+        (WebCore::DragController::startDrag):
+            Clear m_destinationDragOperation at start of drag.
+        * page/DragController.h:
+        (WebCore::DragController::destinationDragOperation):
+            Added new member m_destinationDragOperation, and its public getter.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+            dropEffect should be 'none' during dropleave handler, per spec.
+        (WebCore::EventHandler::dragSourceMovedTo):
+            Added DragOperation parameter, so the handler sees the current dropEffect.
+        (WebCore::EventHandler::handleDrag):
+            Assume DragOperationEvery for non-DHTML drags.
+        * page/EventHandler.h:
+            Added DragOperation parameter to dragSourceMovedTo().
+
+2009-09-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        1. Adding support/bindings for read-only transactions.
+        2. Disallowing the SQLITE_*_VIEW and REINDEX operations in the
+        private browsing mode.
+        3. Adding an authorizer test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28918
+
+        Test: storage/test-authorizer.html
+
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::JSDatabase::transaction): Refactored to use
+        createTransaction().
+        (WebCore::JSDatabase::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * bindings/v8/custom/V8CustomBinding.h: Added the binding for
+        Database::readTransaction().
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::transaction): Refactored to use createTransaction().
+        (WebCore::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * storage/Database.cpp:
+        (WebCore::Database::transaction): Added support for read-only
+        transactions.
+        * storage/Database.h: Added support for read-only transactions.
+        * storage/Database.idl: Added support for read-only transactions.
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::createTempTable): Make it obvious
+        that the statement will be denied in private browsing mode and
+        read-only transactions.
+        (WebCore::DatabaseAuthorizer::dropTempTable): Same.
+        (WebCore::DatabaseAuthorizer::createTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::dropTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::createTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::dropTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::createView): Deny in private
+        browsing mode and read-only transactions.
+        (WebCore::DatabaseAuthorizer::createTempView): Same.
+        (WebCore::DatabaseAuthorizer::dropView): Same.
+        (WebCore::DatabaseAuthorizer::dropTempView): Same.
+        (WebCore::DatabaseAuthorizer::allowReindex): Same.
+        * storage/DatabaseAuthorizer.h:
+        * storage/SQLTransaction.cpp: Added support for read-only
+        transactions.
+        (WebCore::SQLTransaction::create):
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::acquireLock):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Added a new
+        parameter in preparation for a change that will allow multiple
+        read-only transactions on the same DB to run concurrently.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29102, add support for user stylesheet injection.  This is similar
+        to user script injection but allows for user stylesheets to be added.  The stylesheets are applied immediately
+        to all Frames in the PageGroup.
+
+        Added userscripts/simple-stylesheet.html test case.
+
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::pageGroupUserSheets):
+        (WebCore::Document::clearPageGroupUserSheets):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userStyleSheets):
+        * page/UserStyleSheet.h: Added.
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::source):
+        (WebCore::UserStyleSheet::url):
+        (WebCore::UserStyleSheet::patterns):
+        (WebCore::UserStyleSheet::worldID):
+        * page/UserStyleSheetTypes.h: Added.
+
+2009-09-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] CSS Style -webkit-box-shadow is not rendered correctly on
+        Qt platform
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+         Added the ability to draw shadows for all these curves.
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add the qwebgraphicsitem.cpp to the build system.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28862
+
+        * WebCore.pro:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx port] Move functions in TemporaryLinkStubs.cpp out to files where
+        they belong.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29088
+
+        * editing/wx/EditorWx.cpp:
+        (WebCore::Editor::showColorPanel):
+        (WebCore::Editor::showFontPanel):
+        (WebCore::Editor::showStylesPanel):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        * platform/graphics/wx/IconWx.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::Image::drawPattern):
+        * platform/wx/CursorWx.cpp:
+        (WebCore::moveCursor):
+        * platform/wx/FileChooserWx.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/wx/KURLWx.cpp: Added.
+        (WebCore::KURL::fileSystemPath):
+        * platform/wx/SSLKeyGeneratorWx.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/wx/SearchPopupMenuWx.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        (WebCore::SearchPopupMenu::enabled):
+        * platform/wx/SharedBufferWx.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/wx/SystemTimeWx.cpp: Added.
+        (WebCore::userIdleTime):
+        * platform/wx/TemporaryLinkStubs.cpp: Removed.
+        * platform/wx/TextBreakIteratorInternalICUWx.cpp: Added.
+        (WebCore::currentSearchLocaleID):
+        (WebCore::currentTextBreakLocaleID):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::setIsSelected):
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Geolocation incorrectly calls error callback in case of exception in success callback.
+        https://bugs.webkit.org/show_bug.cgi?id=27255
+
+        Test: fast/dom/Geolocation/callback-exception.html
+
+        * bindings/js/JSCustomPositionCallback.cpp: Modified.
+        (WebCore::JSCustomPositionCallback::handleEvent): Modified. Removed raisedException out param.
+        * bindings/js/JSCustomPositionCallback.h: Modified. Removed raisedException out param from handleEvent method and made handleEvent private.
+        * bindings/js/JSCustomPositionErrorCallback.h: Modified. Made handleEvent private.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::sendPosition): Modified. No longer call error callback in case of exception in success callback.
+        * page/PositionCallback.h: Modified. Removed raisedException out param from handleEvent method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When Geolocation permission is denied, stops watches as well as one-shots.
+        https://bugs.webkit.org/show_bug.cgi?id=28305.
+
+        Tests: fast/dom/Geolocation/watch.html
+               fast/dom/Geolocation/permission-denied-stops-watches.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Marks the permission error as fatal.
+        (WebCore::Geolocation::handleError): Modified. If the error is fatal, stops watchers as well as one-shots.
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::setIsFatal): Added. Marks an error as fatal.
+        (WebCore::PositionError::isFatal): Added. Determines whether an error is fatal.
+
+2009-09-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Added getter/setter methods and trivial inline implementations for each.
+        (Note that they are not yet actually used.)
+        Once the Chromium code is changed to use them instead of directly accessing the
+        member variables, the member variables should be made private and cleaned up.
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::mainURL):
+        (WebCore::ChromiumDataObject::setMainURL):
+        (WebCore::ChromiumDataObject::mainURLTitle):
+        (WebCore::ChromiumDataObject::setMainURLTitle):
+        (WebCore::ChromiumDataObject::textPlain):
+        (WebCore::ChromiumDataObject::setTextPlain):
+        (WebCore::ChromiumDataObject::textHTML):
+        (WebCore::ChromiumDataObject::setTextHTML):
+        (WebCore::ChromiumDataObject::htmlBaseURL):
+        (WebCore::ChromiumDataObject::setHTMLBaseURL):
+        (WebCore::ChromiumDataObject::content):
+        (WebCore::ChromiumDataObject::releaseContent):
+        (WebCore::ChromiumDataObject::setContent):
+        (WebCore::ChromiumDataObject::contentFileExtension):
+        (WebCore::ChromiumDataObject::setContentFileExtension):
+        (WebCore::ChromiumDataObject::contentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::takeFileNames):
+
+2009-09-08  Pat Bradley  <vincent.bradley@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] locale date displays incorrect date format in symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=29032
+
+        strftime() in Symbian does not support #
+        Layout tests cannot be run on Symbian yet, so they are not updated.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-09-09  Rohini Ananth <rohini.ananth@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI Plugin NPP_AsFile not working on Qt Webkit
+        https://bugs.webkit.org/show_bug.cgi?id=29068
+
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::openTemporaryFile)
+        Autoremove property of QTemporaryFile has been set to false. Hence closeFile() just closes and does not delete the file.
+        This solves the deletion of created temp file in PluginStream::destroyStream() before passing to plugin in NPP_AsFile.
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Remove a few incorrect changes I left in.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support numeric index getters in bindings
+        https://bugs.webkit.org/show_bug.cgi?id=29067
+
+        Add HasNumericIndexGetter to indicate a non-custom getter that
+        returns a number.  The numeric index getter also uses PropertySlot's
+        setValue rather than setCustomIndex to avoid an additional indirect
+        call.
+
+        * bindings/js/JSCanvasByteArrayCustom.cpp:
+        * bindings/js/JSCanvasFloatArrayCustom.cpp:
+        * bindings/js/JSCanvasIntArrayCustom.cpp:
+        * bindings/js/JSCanvasShortArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::item):
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::get):
+        (WebCore::CanvasFloatArray::item):
+        * html/canvas/CanvasFloatArray.idl:
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::get):
+        (WebCore::CanvasIntArray::item):
+        * html/canvas/CanvasIntArray.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::get):
+        (WebCore::CanvasShortArray::item):
+        * html/canvas/CanvasShortArray.idl:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::get):
+        (WebCore::CanvasUnsignedByteArray::item):
+        * html/canvas/CanvasUnsignedByteArray.idl:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::get):
+        (WebCore::CanvasUnsignedIntArray::item):
+        * html/canvas/CanvasUnsignedIntArray.idl:
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::item):
+        * html/canvas/CanvasUnsignedShortArray.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        In Mac Chromium, clicking below the last line of an editable area (textarea or
+        contenteditable) should put the caret at the end of the last line, as in Mac Safari.
+
+        Tests: LayoutTests/editing/selection/click-in-margins-inside-editable-div.html
+               LayoutTests/editing/selection/click-in-padding-with-multiple-line-boxes.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Change #if PLATFORM_MAC to be Mac-Chrome-inclusive.
+
+2009-09-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Make sure not to do an early return when a data URL stylesheet successfully loads.  We need to still
+        clear the old cached sheet out of all existing Frames.  Fixes the data URL stylesheet layout test failure.
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        More robust wx build fix for 2.9.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27046
+        Implement CSSOM DocumentView.caretRangeFromPoint
+
+        Tests: fast/dom/Document/CaretRangeFromPoint/basic.html
+               fast/dom/Document/CaretRangeFromPoint/replace-element.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, generate derived sources earlier in order to make sure
+        they're found by the build system when generating the list of sources to build.
+
+        * wscript:
+
+2009-09-08  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        <iterator> include in V8Proxy.h is spurious and causing ObjC compile issues for Chromium.
+
+        Test: Chromium mac canary build is fixed.
+
+        * bindings/v8/V8Proxy.h: Remove <iterator> include.
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28987, make the Document cache the page's user stylesheet in
+        parsed form.  Allows the sheet to survive across destruction/re-creation of the CSSStyleSelector.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::attach):
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::clearPageUserSheet):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        * page/Settings.cpp:
+        (WebCore::Settings::setUserStyleSheetLocation):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed buildfix.
+
+        Fix Qt build after 48167, by adding the new cpp/h files
+        added to WebCore.gypi to WebCore.pro as well.
+
+        * WebCore.pro:
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        should not pass URI fragments to libsoup
+        https://bugs.webkit.org/show_bug.cgi?id=28687
+
+        Strip the fragment from the URI before passing it to soup, since
+        it forwards it to servers in some cases (like when using a proxy)
+        which confuses them and makes them return 403/404.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add QGraphicsScene events support to the Qt platform events.
+
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-09-08  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Cleanup: remove a few deprecated methods.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests, just syntactic sugar.
+
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/chromium/ResourceResponse.h:
+
+2009-09-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28981
+
+        [Qt] make npapi.h compile in winscw compiler.
+
+        Add XP_SYMBIAN macro to identify Symbian OS; this macro should be used for Symbian
+        specific changes in npapi.h.
+        Undefine XP_WIN when building for Symbian to avoid including Windows specific code.
+
+        * bridge/npapi.h:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Web Inspector assertion failure related to marking
+        https://bugs.webkit.org/show_bug.cgi?id=28997
+
+        When wrapping the callback the JSInspectorCallbackWrapper creator was using
+        inheritorID for the prototype structure which is unsafe for anything other
+        than a pure JS object.  Instead we now create a new structure, which while
+        inefficient is not problematic as this code is not hit frequently.
+
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing extension to the file entry in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj: Added "cpp".
+
+2009-09-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        dataTransfer.types() should not return Files if file list is empty in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28891
+
+        We change the behavior to handle the empty file list in order to match the spec.
+
+        Tested by clipboard-file-access.html.
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+
+2009-09-08  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Eric Seidel.
+
+        WebInspector: Adds a timeline agent to InspectorController that collects
+        high-level timing data about event dispatch, layout, painting and HTML
+        parsing and makes it available to Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=25503
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Document.h:
+        (WebCore::Document::inspectorTimelineAgent):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/DOMDispatchTimelineItem.cpp: Added.
+        (WebCore::DOMDispatchTimelineItem::DOMDispatchTimelineItem):
+        (WebCore::DOMDispatchTimelineItem::convertToScriptObject):
+        * inspector/DOMDispatchTimelineItem.h: Added.
+        (WebCore::DOMDispatchTimelineItem::~DOMDispatchTimelineItem):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::enableTimeline):
+        (WebCore::InspectorBackend::disableTimeline):
+        (WebCore::InspectorBackend::timelineEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::enableTimeline):
+        (WebCore::InspectorController::disableTimeline):
+        (WebCore::InspectorController::timelineEnabled):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::timelineAgent):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineWasEnabled):
+        (WebCore::InspectorFrontend::timelineWasDisabled):
+        (WebCore::InspectorFrontend::addItemToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp: Added.
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::currentTimeInMilliseconds):
+        (WebCore::InspectorTimelineAgent::sessionTimeInMilliseconds):
+        * inspector/InspectorTimelineAgent.h: Added.
+        * inspector/TimelineItem.cpp: Added.
+        (WebCore::TimelineItem::TimelineItem):
+        (WebCore::TimelineItem::addToTimeline):
+        (WebCore::TimelineItem::convertToScriptObject):
+        (WebCore::TimelineItem::convertChildrenToScriptArray):
+        (WebCore::TimelineItem::addChildItem):
+        * inspector/TimelineItem.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItem::~TimelineItem):
+        (WebCore::TimelineItem::previous):
+        (WebCore::TimelineItem::releasePrevious):
+        (WebCore::TimelineItem::setEndTime):
+        (WebCore::TimelineItem::type):
+        * inspector/front-end/TimelineAgent.js: Added.
+        (WebInspector.TimelineAgent):
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineWasEnabled):
+        (WebInspector.timelineWasDisabled):
+        * inspector/front-end/inspector.html:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h:
+        (WebCore::FrameView::inspectorTimelineAgent):
+        * page/Page.cpp:
+        (WebCore::Page::inspectorTimelineAgent):
+        * page/Page.h:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix unused variable warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29018
+
+        No functional change, no tests.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMenuList):
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Use the declaration order in initializer lists
+        https://bugs.webkit.org/show_bug.cgi?id=29017
+
+        No functional change, no new tests.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+
+2009-09-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement ValidityState::typeMismatch() for <input type=number>.
+        https://bugs.webkit.org/show_bug.cgi?id=28934
+
+        Test: fast/forms/ValidityState-typeMismatch-number.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToDouble):
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        * html/ValidityState.h:
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Another attempt of a buildfix.
+
+        * GNUmakefile.am: Modified. Remove some extra IDL files added in r48153.
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
+        https://bugs.webkit.org/show_bug.cgi?id=28865
+
+        Save the QCursor as a property in WidgetQt::setCursor
+        and actually change the cursor in QWebView::event() by making use
+        of the QEvent::DynamicPropertyChange event type.
+        When unsetCursor() is called on the QWidget we can fallback to
+        the cursor set by WebCore.
+
+        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
+                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Buildfix for build error introduced in r48150.
+
+        * GNUmakefile.am: Modified. Added missing IDL files.
+
+2009-09-08  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Buildfix. Build error caused by r48150.
+
+        * WebCore.pro: missing IDL files added
+
+2009-09-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update Canvas 3D implementation to match spec
+        https://bugs.webkit.org/show_bug.cgi?id=29010
+
+        This adds several new CanvasXXXArray classes each of which has a custom constructor
+        and custom getters and setters. Also changed CanvasRenderingContext3D and GraphicsContext3D
+        to match the new and changed API.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayBufferConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayBufferConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::bufferData):
+        (WebCore::JSCanvasRenderingContext3D::bufferSubData):
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        (WebCore::JSCanvasRenderingContext3D::texSubImage2D):
+        * bindings/js/JSCanvasShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::canvasArrayBuffer):
+        (WebCore::JSDOMWindow::canvasByteArray):
+        (WebCore::JSDOMWindow::canvasUnsignedByteArray):
+        (WebCore::JSDOMWindow::canvasIntArray):
+        (WebCore::JSDOMWindow::canvasUnsignedIntArray):
+        (WebCore::JSDOMWindow::canvasShortArray):
+        (WebCore::JSDOMWindow::canvasUnsignedShortArray):
+        (WebCore::JSDOMWindow::canvasFloatArray):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.idl: Added.
+        * html/canvas/CanvasArrayBuffer.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.idl: Added.
+        * html/canvas/CanvasByteArray.cpp:
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.idl: Added.
+        * html/canvas/CanvasIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::CanvasRenderingContext3D):
+        (WebCore::CanvasRenderingContext3D::markContextChanged):
+        (WebCore::CanvasRenderingContext3D::beginPaint):
+        (WebCore::CanvasRenderingContext3D::endPaint):
+        (WebCore::CanvasRenderingContext3D::reshape):
+        (WebCore::CanvasRenderingContext3D::sizeInBytes):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::bufferData):
+        (WebCore::CanvasRenderingContext3D::bufferSubData):
+        (WebCore::CanvasRenderingContext3D::checkFramebufferStatus):
+        (WebCore::CanvasRenderingContext3D::clear):
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        (WebCore::CanvasRenderingContext3D::deleteBuffer):
+        (WebCore::CanvasRenderingContext3D::deleteFramebuffer):
+        (WebCore::CanvasRenderingContext3D::deleteProgram):
+        (WebCore::CanvasRenderingContext3D::deleteRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::deleteShader):
+        (WebCore::CanvasRenderingContext3D::deleteTexture):
+        (WebCore::CanvasRenderingContext3D::drawArrays):
+        (WebCore::CanvasRenderingContext3D::drawElements):
+        (WebCore::CanvasRenderingContext3D::getBoolean):
+        (WebCore::CanvasRenderingContext3D::getBooleanv):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getFloat):
+        (WebCore::CanvasRenderingContext3D::getFloatv):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::CanvasRenderingContext3D::getInteger):
+        (WebCore::CanvasRenderingContext3D::getIntegerv):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getTexParameterf):
+        (WebCore::CanvasRenderingContext3D::getTexParameterfv):
+        (WebCore::CanvasRenderingContext3D::getTexParameteri):
+        (WebCore::CanvasRenderingContext3D::getTexParameteriv):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribf):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribfv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribi):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribiv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribOffset):
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texParameterf):
+        (WebCore::CanvasRenderingContext3D::texParameteri):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        (WebCore::CanvasRenderingContext3D::uniform1f):
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1i):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2f):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2i):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3f):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3i):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4f):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4i):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::useProgram):
+        (WebCore::CanvasRenderingContext3D::validateProgram):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttribPointer):
+        (WebCore::CanvasRenderingContext3D::viewport):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.idl: Added.
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::CanvasTexture):
+        * html/canvas/CanvasTexture.h:
+        (WebCore::CanvasTexture::isCubeMapRWrapModeInitialized):
+        (WebCore::CanvasTexture::setCubeMapRWrapModeInitialized):
+        * html/canvas/CanvasUnsignedByteArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedByteArray.h: Added with properties svn:eol-style and svn:mime-type.
+         * html/canvas/CanvasUnsignedByteArray.idl: Added.
+        * html/canvas/CanvasUnsignedIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.idl: Added.
+        * html/canvas/CanvasUnsignedShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.idl: Added.
+        * page/DOMWindow.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::beginPaint):
+        (WebCore::GraphicsContext3D::endPaint):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::drawArrays):
+        (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::texParameterf):
+        (WebCore::GraphicsContext3D::texParameteri):
+        (WebCore::GraphicsContext3D::uniform1f):
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2f):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3f):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4f):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1i):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2i):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3i):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4i):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1f):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2f):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3f):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4f):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        (WebCore::GraphicsContext3D::vertexAttribPointer):
+        (WebCore::GraphicsContext3D::getBoolean):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getFloat):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getInteger):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getBufferParameteri):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getProgrami):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteri):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterf):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteri):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformf):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformi):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribf):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribi):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::getVertexAttribOffset):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::sizeInBytes):
+
+2009-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Make m_windowVisible more consistent with the actual visibility of the inspector.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed speculative build fix for Snow Leopard.
+
+        * platform/GeolocationService.cpp:
+        (WebCore::createGeolocationServiceNull):
+
+2009-09-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
+        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
+        Geolocation service with DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=28264
+
+        The mock Geolocation service returns a fixed position or error. This position or error can be
+        set through static methods on the GeolocationService class. The position or error is shared
+        between all instances of the mock Geolocation service.
+
+        Implementation details.
+        The GeolocationService object maintains a pointer to a factory function which it uses to create
+        Geolocation service instances. Each platform implementing Geolocation sets this pointer
+        to the factory function for their platform's implementation. When the mock Geolocation service
+        is activated, the factory function pointer is reset to the factory function for the mock service.
+
+        Test: fast/dom/Geolocation/error.html
+
+        * WebCore.base.exp: Modified. Exports GeolocationServiceMock methods.
+        * GNUMakefile.am: Modified. Added GeolocationServiceMock files.
+        * WebCore.gypi: Modified. Added GeolocationServiceMock files.
+        * WebCore.pro: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Modified. Added mock directory to includes.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationServiceMock files and exports some headers.
+        * WebCoreSources.bkl: Modified. Added GeolocationServiceMock files.
+        * page/ChromeClient.h: Modified. Fixed comment.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Fixed error string.
+        * platform/GeolocationService.cpp: Modified.
+        (WebCore::createGeolocationServiceNull): Added. Returns null in place of a Geolocation service. Used to avoid link errors on platforms where Geolocation is not implemented.
+        (WebCore::GeolocationService::create): Added. Uses the factory function pointer to create a Geolocation service implementation.
+        (WebCore::GeolocationService::useMock): Added. Configures the GeolocationServie to use the mock implementation.
+        * platform/GeolocationService.h: Modified.
+        * platform/mock: Added.
+        * platform/mock/GeolocationServiceMock.cpp: Added.
+        (WebCore::GeolocationServiceMock::create): Added. Creates a GeolocationServiceMock object.
+        (WebCore::GeolocationServiceMock::GeolocationServiceMock): Added. Constructor.
+        (WebCore::GeolocationServiceMock::~GeolocationServiceMock): Added. Destructor.
+        (WebCore::GeolocationServiceMock::setPosition): Added. Sets the position that will be returned by the object.
+        (WebCore::GeolocationServiceMock::setError): Added. Sets the error that will be returned by the object.
+        (WebCore::GeolocationServiceMock::startUpdating): Added. GeolocationService implementation. Starts the service.
+        (WebCore::GeolocationServiceMock::stopUpdating): Added. GeolocationService implementation. Stops the service.
+        (WebCore::GeolocationServiceMock::timerFired): Added. Used to provide an asynchronous callback when the service is started.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallbackFromAllInstances): Added. Used to call back when the position or error is updated.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallback): Added. Used to call back when the service starts.
+        (WebCore::GeolocationServiceMock::initStatics): Added. Initializes statics members with constructors.
+        (WebCore::GeolocationServiceMock::cleanUpStatics): Added. Cleans up static members with constructors.
+        * platform/mock/GeolocationServiceMock.h: Added.
+        (WebCore::GeolocationServiceMock::lastPosition): Added. Returns the fixed position.
+        (WebCore::GeolocationServiceMock::lastError): Added. Returns the fixed error.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::create): Added. Creates an instance of GeolocationServiceGtk.
+        * platform/gtk/GeolocationServiceGtk.h: Modified.
+        * platform/mac/GeolocationServiceMac.h: Modified.
+        * platform/mac/GeolocationServiceMac.mm: Modified.
+        (WebCore::GeolocationServiceMac::create): Added. Creates an instance of GeolocationServiceMac.
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28985
+
+        We need to be slightly more careful about how we pick up a script
+        execution context.  In particular, we were getting the wrong document
+        for frames that had been navigated somewhere else.
+
+        In the long term, we should think about a better algorithm for
+        computing the script context.
+
+        Fixes LayoutTests/http/tests/xmlhttprequest/detaching-frame-2.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieveFrame):
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8 compilation.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Reverting r48121 to fix Windows build errors.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Removed.
+        * websockets/WebSocketChannel.h: Removed.
+        * websockets/WebSocketChannelClient.h: Removed.
+        * websockets/WebSocketHandshake.cpp: Removed.
+        * websockets/WebSocketHandshake.h: Removed.
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed speculative build fix.
+
+        Reverted previous build fix as it didn't fix the problem.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Fix build after SHARED_WORKERS are enabled by default (r48131)
+
+        * WebCore.pro:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Temporarily removed depenency between JSEventTarget.cpp and WebSocket.h in an attempt to fix a windows build break.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default.
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        Tests (enabled in a separate patch):
+               fast/workers/shared-worker-constructor.html
+               fast/workers/shared-worker-context-gc.html
+               fast/workers/shared-worker-event-listener.html
+               fast/workers/shared-worker-exception.html
+               fast/workers/shared-worker-frame-lifecycle.html
+               fast/workers/shared-worker-gc.html
+               fast/workers/shared-worker-lifecycle.html
+               fast/workers/shared-worker-load-error.html
+               fast/workers/shared-worker-location.html
+               fast/workers/shared-worker-navigator.html
+               fast/workers/shared-worker-replace-global-constructor.html
+               fast/workers/shared-worker-replace-self.html
+               fast/workers/shared-worker-shared.html
+               fast/workers/shared-worker-simple.html
+               http/tests/workers/shared-worker-importScripts.html
+               http/tests/workers/shared-worker-redirect.html
+               http/tests/xmlhttprequest/workers/shared-worker-close.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods-async.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods.html
+               http/tests/xmlhttprequest/workers/shared-worker-xhr-file-not-found.html
+
+        * config.h: Removed some whitespace/touched the file to force a full rebuild on the build-bots.
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * dom/DOMWindow.idl: Removed unnecessary whitespace to force a rebuild on the build-bots to pickup the flag change.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::load):
+        Clean up bitrot in SharedWorker code - DenyCrossOriginRedirect is now DenyCrossOriginRequests.
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::SharedWorkerContext::dispatchConnect):
+        Clean up bitrot - updated SharedWorker code to reflect new MessageEvent API.
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add new file to sources list.
+
+        * GNUmakefile.am:
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx SVN trunk. 
+
+        * config.h:
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Chris Hills <chaz@chaz6.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Use direct includes for Phonon, not the pretty ones
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26854
+        [GTK] Needs API to allow more control over outgoing requests
+
+        Add infrastructure required to provide the new
+        WebKitNetworkResponse object in our API.
+
+        * GNUmakefile.am: Add new files to the build.
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+        * platform/network/soup/ResourceResponse.h:
+        * platform/network/soup/ResourceResponseSoup.cpp: Added.
+        (WebCore::ResourceResponse::toSoupMessage):
+
+2009-09-07  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Cleanup document/frame null-checking in V8DOMWindowCustom.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29009
+
+        Be consistent in document and frame null checks.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Soup] Limit the number of connections
+        https://bugs.webkit.org/show_bug.cgi?id=18431
+
+        Increase the maximum number of per host and total connections to
+        similar values than those used by the other modern browsers. Seems
+        to significantly improve page loading time in many cases.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Various minor chromium appcache modifications.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests.
+
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+          Fix a null pointer exception.
+        (WebCore::ACCESSOR_GETTER):
+        * platform/network/chromium/ResourceRequest.h:
+          Switch from appCache 'context' to 'host' terminology.
+          Note: leaving the old deprecated accessors in place until the matching
+          change in chrome is landed to use the new accessors.
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::appCacheHostID):
+        (WebCore::ResourceRequest::setAppCacheHostID):
+        (WebCore::ResourceRequest::appCacheContextID):
+        (WebCore::ResourceRequest::setAppCacheContextID):
+        * platform/network/chromium/ResourceResponse.h:
+          Add an appCacheManifestURL getter/setter.
+          Drop the 'get' prefix from the appCacheID getter.
+          Note: leaving the old deprecated 'get' prefixed accessor in place until the matching
+          change in chrome is landed to use the new accessor.
+        (WebCore::ResourceResponse::appCacheID):
+        (WebCore::ResourceResponse::appCacheManifestURL):
+        (WebCore::ResourceResponse::setAppCacheManifestURL):
+        (WebCore::ResourceResponse::getAppCacheID):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28359
+        Cleanup: Undo some accidental changes around DOMApplicationCache.
+        - Restore support for constructing a DOMApplicationCache object with a null frame ptr.
+        - Return a non-null object for window.applicationCache when the feature is disabled.
+        - Simplify the swapCache method.
+
+        Test: http/tests/appcache/disabled.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+        (WebCore::DOMApplicationCache::swapCache):
+        (WebCore::DOMApplicationCache::scriptExecutionContext):
+        * loader/appcache/DOMApplicationCache.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::applicationCache):
+
+2009-09-06  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        handle the case of port 0.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+
+2009-09-06  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make hidden elements not focusable.
+
+        Clean up supportsFocus and isFocusable.
+        supportsFocus now strictly means that the node can be focused by default.
+        This is true for links, form controls and content editable elements for example.
+        isFocusable means that the user can actually focus it.
+        All (2) calls to supportsFocus have been updated to take this into account.
+        
+        Make a elements without href work correctly as well.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27099
+
+        Tests: fast/events/click-focus-anchor.html
+               fast/events/tab-focus-anchor.html
+               fast/events/tab-focus-hidden.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::focus):
+        * dom/Node.cpp:
+        (WebCore::Node::supportsFocus):
+        (WebCore::Node::isFocusable):
+        * dom/Node.h:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::supportsFocus):
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::supportsFocus):
+        * html/HTMLAreaElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::supportsFocus):
+        * html/HTMLElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::supportsFocus):
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::supportsFocus):
+        (WebCore::HTMLFormControlElement::isFocusable):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::supportsFocus):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::supportsFocus):
+        * html/HTMLLegendElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::supportsFocus):
+        (WebCore::HTMLOptGroupElement::isFocusable):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::supportsFocus):
+        (WebCore::HTMLOptionElement::isFocusable):
+        * html/HTMLOptionElement.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::supportsFocus):
+        (WebCore::SVGAElement::isFocusable):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::supportsFocus):
+        * wml/WMLAElement.h:
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::supportsFocus):
+        (WebCore::WMLFormControlElement::isFocusable):
+        * wml/WMLFormControlElement.h:
+
+2009-09-06  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Dimitri Glazkov.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        Default value is set to that of RenderTheme::caretBlankInterval().
+        Uses caretBlinkIntervalInternal to avoid overriding
+        RenderThemeChromiumSkia::caretBlankInterval to preserve the disabling
+        of blinking caret required for layout tests.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkIntervalInternal):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-06  Ada Chan  <adachan@apple.com>
+
+        Remove an extra </File> in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-06  Timothy Hatcher  <timothy@apple.com>
+
+        Adds a persistent setting for color format in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28889
+
+        Reviewed by Dan Bernstein.
+
+        * English.lproj/localizedStrings.js: New strings.
+        * inspector/front-end/Color.js: Minor style fixes.
+        (WebInspector.Color.prototype.toString): Added. Replaces the individual
+        "toFoo" functions. Takes a optional arguments for the color format to return.
+        * inspector/front-end/Images/paneSettingsButtons.png: Added.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat): Update the sections to show
+        the new color format.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay):
+        Use the new toString function on Color.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Use the persistent setting
+        to format colors by default. Add a tooltip for the color swatch.
+        * inspector/front-end/inspector.css: New styles for the settings menu.
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): Initilize the colorFormat preference.
+
+2009-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove Qt v4.6 check from the prefetchDNS implementation
+        https://bugs.webkit.org/show_bug.cgi?id=28993
+
+        * platform/network/qt/DnsPrefetchHelper.cpp:
+        * platform/network/qt/DnsPrefetchHelper.h:
+
+2009-09-06  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop <definition-src> support
+        https://bugs.webkit.org/show_bug.cgi?id=28991
+
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/changes.html#FontsChapter
+
+        * DerivedSources.cpp: Remove references to definition-src.
+        * DerivedSources.make: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap): Ditto.
+        * bindings/objc/DOMSVG.h: Ditto.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Ditto.
+        * bindings/v8/V8DOMWrapper.cpp: Ditto.
+        * bindings/v8/V8Index.cpp: Ditto.
+        * bindings/v8/V8Index.h: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGDefinitionSrcElement.cpp: Removed.
+        * svg/SVGDefinitionSrcElement.h: Removed.
+        * svg/SVGDefinitionSrcElement.idl: Removed.
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::rebuildFontFace): Don't search for
+        definition-src child.
+        * svg/svgtags.in: Remove definition-src.
+
+2009-09-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Roll out http://trac.webkit.org/changeset/48094, because the
+        logic of retrieving default caret blink interval was incorrect (non-existent)
+        and caused layout test flakiness.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium reliability build break).
+
+        Back up partial change in r48072 in order to fix chromium reliability build break.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+
+2009-09-05  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28975
+        Fix file upload on chrome/mac. Images that have "Hide Extension" set,
+        such as screenshots by default, can now be uploaded to sites such as
+        imgur.com.
+
+        * platform/FileSystem.h:
+        Add pathGetDisplayFileName().
+        * platform/chromium/FileChooserChromium.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        Call pathGetDisplayFileName() instead of pathGetFileName().
+        * platform/chromium/FileSystemChromiumLinux.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+        * platform/chromium/FileSystemChromiumMac.mm:
+        (WebCore::pathGetFileName):
+        Now returns a real filename instead of a presentational one, which
+        fixes the problem addressed by this change.
+        (WebCore::pathGetDisplayFileName):
+        New function that returns a presentational filename; does what
+        pathGetDisplayFileName() did prior to this patch.
+        * platform/chromium/FileSystemChromiumWin.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+
+2009-09-05  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by David Levin.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkInterval):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Prevent UI freeze in case when too many timers are in the timer queue.
+        https://bugs.webkit.org/show_bug.cgi?id=23865
+
+        The fix measures the elapsed time while executing timers. If we have too many
+        timers and it takes significant time to fire, quit the loop and reschedule.
+        This lets the run loop process user input (close the window for example).
+
+        * platform/ThreadTimers.h:
+        * platform/ThreadTimers.cpp:
+        (WebCore::ThreadTimers::sharedTimerFiredInternal):
+        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
+        Removed functions and members used before to grab a list of all expired timers.
+        Now we fetch one by one, measuring time and quitting the loop if it takes too long.
+        * platform/Timer.cpp:
+        (WebCore::TimerBase::isActive):
+        (WebCore::TimerBase::setNextFireTime):
+        Since timers are now fired one by one, there is no need to keep track of updated timers.
+        * manual-tests/input-starved-by-timers.html: Manual test that attempts to freeze browser by
+        creating of enough timers. It then keeps UI frozen and after 10 seconds starts to drain the timers
+        so the browser un-freezes. This is instead of a regular layout test because we don't have a way
+        to inject an input events via regular run loop in DRT - instead they are directly dispatched by
+        eventSender, which does not reproduce the UI freeze that happens with real input.
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7201063>
+        
+        Detach any custom scrollbars before detaching the document.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+
+2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+                Unreviewed, build fix.
+
+                Remove remaining references to UserStyleSheetLoader after r48075.
+
+                * WebCore.gypi:
+                * WebCore.xcodeproj/project.pbxproj:
+                * page/qt/FrameQt.cpp:
+                * page/wince/FrameWince.cpp:
+
+2009-09-04  Michelangelo De Simone  <micdesim@gmail.com>
+
+                Reviewed by David Levin.
+
+                https://bugs.webkit.org/show_bug.cgi?id=28988
+                Minor fix: "novalidate" attribute renamed in "noValidate", according to
+                HTML5 specs:
+                http://www.whatwg.org/specs/web-apps/current-work/#dom-fs-novalidate
+
+                * html/HTMLFormElement.cpp:
+                (WebCore::HTMLFormElement::noValidate):
+                (WebCore::HTMLFormElement::setNoValidate):
+                * html/HTMLFormElement.h:
+                * html/HTMLFormElement.idl:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unused line of code from WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=28990
+
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix assertion seen when running buildbot.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure): Create the structure without
+        the HasDefaultMark bit since this has a custom mark function.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28984, remove the remote stylesheet loader on Mac/Qt.
+        Make sure the other code path (now used by everybody) can handle data URLs.
+
+        As per the post on webkit-dev, the ability to work remotely isn't working properly anyway (it doesn't
+        hold up the pending sheet count, so you'd just FOUC on every Web page), and it's extremely unlikely
+        that anybody is relying on this support.
+        
+        Tor Arne agreed it was ok to disable (he enabled it on the Qt side), and only Mac/Qt were using this
+        code.
+
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::userStyleSheet):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * loader/UserStyleSheetLoader.cpp: Removed.
+        * loader/UserStyleSheetLoader.h: Removed.
+        * page/Frame.cpp:
+        (WebCore::Frame::reapplyStyles):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        (WebCore::Page::userStyleSheet):
+        * page/mac/FrameMac.mm:
+        * page/qt/FrameQt.cpp:
+
+2009-09-04  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add "sampling profiler" preference, simplify data display when it's set.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28969
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
+        (WebInspector.ProfileDataGridNode.prototype.get data):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        * inspector/front-end/inspector.js:
+
+2009-09-04  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        Tested by worker-close.html.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/V8Utilities.h:
+        (WebCore::getScriptExecutionContext):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove unused m_sheet variable and setCSSStyleSheet methods.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Adele Peterson.
+
+        (Based on a patch from Adele).
+        
+        Fix <rdar://problem/7185875>.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+        Detach any custom scroll bars from the old view.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Simplify the check (and make it work when body is null) by just checking that the scroll bar owner is
+        not a RenderPart object.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        ASSERT that frame() is not null here and also add a null check so that release builds won't crash.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make m_userStyleSheetLoader in Frame an OwnPtr.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        * page/Frame.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+
+2009-09-04  Timothy Hatcher  <timothy@apple.com>
+
+        Show color swatches in the Web Inspector before the color text so clicking them will not
+        shift the swatch. Also makes multiple swatches in the single property toggle the color format.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28978
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): Some refactoring to consolidate
+        the processing we do on the property value. This eliminated the old nickname code, since the new
+        WebInspector.Color class handles this. We could also simplify the color regex since more
+        is handled by the Color class. Also no longer uses innerHTML for the linkify code.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processValue): Helper function to
+        process a value given a regex and processor functions. 
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.linkifyURL): Make an anchor for the
+        URL with "url()" syntax surrounding it.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Makes a color, if
+        there was an exception just return a text node.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay.changeTo):
+        Moved from later in the file.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay): Ditto.
+        * inspector/front-end/inspector.css:
+
+2009-09-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Account for scrollbar state changes that occur during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+        Eliminate duplicated (and incorrect) scrollbar mode tracking between
+        FrameView and ScrollView.
+
+2009-09-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        Swapped the implementation of host and hostname, and made sure not to return
+        the port number if it is default for the given protocol. 
+        FireFox also avoids returning the protocol number if it is default.
+
+        Test: fast/dom/Element/hostname-host.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::hostname):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::isDefaultPortForProtocol):
+        * page/SecurityOrigin.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Steve Falkenburg.
+
+        Fix <rdar://problem/7192902>.
+
+        Add the necessary plumbing for having QTMovieWin use WebCore timers.
+        
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::TaskTimer::initialize):
+        Create the timer and call QTMovieWin::setTaskTimerFuncs.
+        
+        (WebCore::TaskTimer::setTaskTimerDelay):
+        Start the timer.
+        
+        (WebCore::TaskTimer::stopTaskTimer):
+        Stop the timer.
+        
+        (WebCore::TaskTimer::fired):
+        Call QTMovieWin::taskTimerFired().
+        
+        (WebCore::MediaPlayerPrivate::load):
+        Initialize the Task timer.
+        
+        * platform/graphics/win/QTMovieWin.cpp:
+        (updateTaskTimer):
+        Call the global stopTaskTimer function and setTaskTimerDelay.
+        
+        (QTMovieWin::taskTimerFired):
+        Make this a member function.
+        
+        (QTMovieWin::setTaskTimerFuncs):
+        Set the global function pointers.
+        
+        (QTMovieWin::initializeQuickTime):
+        (DllMain):
+        No need to use the QT shared timer.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Win compile.  Missing return statement in
+        WebCore::RenderThemeChromiumSkia::paintSliderThumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28974
+
+        No new tests, build fix.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+
+2009-09-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Rolling out http://trac.webkit.org/changeset/48035, because it broke
+        the build.
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Fix vcproj file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-03  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28890, make simple user script injection work.
+        
+        This patch adds new API for adding and removing user scripts from page groups.  User scripts
+        are bundled together in isolated worlds (you can have multiple scripts together in the same
+        world).
+
+        Added userscripts/ directory for holding new tests (along with a simple test of script injection).
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::dispatchDocumentElementAvailable):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/Frame.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::~PageGroup):
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        * page/UserScript.h: Added.
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::source):
+        (WebCore::UserScript::url):
+        (WebCore::UserScript::patterns):
+        (WebCore::UserScript::worldID):
+        (WebCore::UserScript::injectionTime):
+        * page/UserScriptTypes.h: Added.
+        (WebCore::):
+
+2009-09-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+        Crashes when using a detached DocumentType node
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+
+        DocumentType nodes are the only one that can have null document(), and they can never have
+        children, so they are a degenerate case for NodeLists.
+
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes): Don't try register node list with document if there's no
+        document. Since there are no changes possible for a DocumentType's node list, this is not
+        necessary.
+        (WebCore::Node::registerDynamicNodeList): Ditto.
+        (WebCore::Node::unregisterDynamicNodeList): Ditto. I couldn't find a scenario where this
+        was invoked for a DocumentType node, but I also couldn't prove that it can't be (the
+        de-registration code path that I saw taken was via Node destructor, and that already has
+        a null check for document).
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener): Bail out if there is no document (just as we already do
+        if there is no window).
+        (WebCore::JSNode::removeEventListener): Ditto.
+
+2009-09-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] loadFinished never emitted
+        https://bugs.webkit.org/show_bug.cgi?id=28935
+
+        Do not report errors right away from
+        ResourceHandle::start. Instead return true and schedule an error
+        to be reported in the handle later. Otherwise WebCore gets
+        confused and thinks the resource never finished loading, making it
+        not emit the finished status.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-04  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] DOM Storage bindings: Event Handler should create StorageEvents
+        https://bugs.webkit.org/show_bug.cgi?id=28942
+        
+        Tests:
+        Causes the following tests that were failing with V8 to pass:
+        * storage/domstorage/localstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/localstorage/complex-keys.html
+        * storage/domstorage/localstorage/onstorage-attribute-markup.html
+        * storage/domstorage/localstorage/simple-events.html
+        * storage/domstorage/localstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/localstorage/index-get-and-set.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-markup.html
+        * storage/domstorage/sessionstorage/simple-events.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/sessionstorage/index-get-and-set.html
+
+        Code changes:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):  Create StorageEvents.
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::storageGetter): Check if we are retrieving the length property and return the number of items in the object rather than a property named length when invoking the getItem() member of local/sessionStorage.
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28911
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        * inspector/front-end/InjectedScriptAccess.js: Added.
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.html:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement <input type="range"> for Chromium Linux by painting
+        the slider and the thumb using skia.
+        https://bugs.webkit.org/show_bug.cgi?id=28928
+
+        Covered by existing tests (we're currently hitting an assert for them).
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::adjustSliderThumbSize):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::drawVertLine):
+        (WebCore::drawHorizLine):
+        (WebCore::drawBox):
+        (WebCore::RenderThemeChromiumSkia::paintSliderTrack):
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-04  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Implement <input type=color> as a text field.
+        - ValidityState::typeMismatch supports for type=color.
+        https://bugs.webkit.org/show_bug.cgi?id=28966
+
+        Tests: fast/forms/ValidityState-patternMismatch-unsupported.html
+               fast/forms/ValidityState-typeMismatch-color.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+        (WebCore::HTMLInputElement::isTextField):
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        (WebCore::ValidityState::isValidColorString):
+        * html/ValidityState.h:
+
+2009-09-04  Mads Ager  <ager@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Crash when updating document cache
+        https://bugs.webkit.org/show_bug.cgi?id=28965
+
+        Initialization of a V8 JavaScript context can fail.  When that
+        happens, do not attempt to update the document wrapper cache.
+
+        This code path is exercised by http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocument):
+
+2009-09-04  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Two bugs:
+
+        https://bugs.webkit.org/show_bug.cgi?id=25489
+        CSS property background-position is now serialized in shorthand string as
+        background-position-x background-position-y, as the specification requires
+        (See http://www.w3.org/TR/2008/WD-css3-background-20080910/#the-background-position).
+        
+
+        https://bugs.webkit.org/show_bug.cgi?id=26541
+        CSS background-color is now be serialized before other background properties, 
+        as CSS specification requires (See http://dev.w3.org/csswg/cssom/#css-value).  
+
+        An existing layout test that accepted wrong order and skipped position test 
+        had to be modified.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add support for HTMLTextAreaElement.textLength
+        https://bugs.webkit.org/show_bug.cgi?id=28929
+
+        Test: fast/forms/textarea-textlength.html
+
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::textLength):
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
+        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+
+        Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we
+        cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a
+        DocumentType node in two documents.
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with Frames.
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached-with-frames.html
+               fast/loader/frames-with-unload-handlers-in-page-cache.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-03  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Fix a bug where subframes weren't asked if they were cacheable.
+
+        No new tests, especially since page caching for frames isn't turned on yet.
+        A layout test will come in my next patch, which enables frames in the page cache.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Added mixed content methods to FrameLoaderClient.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didDisplayInsecureContent):
+        (WebCore::EmptyFrameLoaderClient::didRunInsecureContent):
+        * loader/FrameLoaderClient.h:
+
+2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Frames support
+        https://bugs.webkit.org/show_bug.cgi?id=19041
+
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        (WebCore::RenderThemeWx::paintButton):
+        (WebCore::RenderThemeWx::paintTextField):
+        (WebCore::RenderThemeWx::paintMenuList):
+        (WebCore::RenderThemeWx::paintMenuListButton):
+        * platform/wx/ScrollbarThemeWx.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeWx::~ScrollbarThemeWx):
+        (WebCore::ScrollbarThemeWx::scrollbarThickness):
+        (WebCore::ScrollbarThemeWx::hasThumb):
+        (WebCore::ScrollbarThemeWx::buttonSize):
+        (WebCore::ScrollbarThemeWx::backButtonRect):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        (WebCore::ScrollbarThemeWx::trackRect):
+        (WebCore::ScrollbarThemeWx::paintScrollCorner):
+        (WebCore::ScrollbarThemeWx::paint):
+        * platform/wx/ScrollbarThemeWx.h: Added.
+        (WebCore::ScrollbarThemeWx::hasButtons):
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp: Added.
+        (wxStyleForPart):
+        (GetButtonWidget):
+        (wxGetGdkWindowForDC):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp: Added.
+        (wxScrollbarPartToHIPressedState):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h: Added.
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/win/scrollbar_render.cpp: Added.
+        (GraphicsHDC::GraphicsHDC):
+        (GraphicsHDC::~GraphicsHDC):
+        (GraphicsHDC::operator HDC):
+        (getTSStateForPart):
+        (wxRenderer_DrawScrollbar):
+        * webcore-wx.bkl:
+
+2009-09-03  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Page content is not displayed in case of HTTP status error
+        https://bugs.webkit.org/show_bug.cgi?id=28949
+
+        If the server sent content, show it to the user instead of an error,
+        even if the HTTP status code is not success.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::resetState):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to update v8 bindings to support passing multiple ports to postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28839
+
+        Added support for passing MessagePortArray to v8 bindings.
+
+        New tests that now pass with V8:
+               fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * WebCore.gypi:
+        Added V8MessageEventCustom.cpp and V8MessagePortCustom.h
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom postMessage() handlers for various classes.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::DOMWindowPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::DedicatedWorkerContextPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessageEventCustom.cpp: Added.
+        (WebCore::MessageEventPorts):
+        Added getter for ports attribute.
+        (WebCore::MessageEventInitMessageEvent):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::MessagePortPostMessage):
+        Added custom handler that supports MessagePortArray.
+        (WebCore::getMessagePortArray):
+        Added helper function that supports converting from a sequence-like object to a MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.h: Added.
+        Added declaration for getMessagePortArray().
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::WorkerPostMessage):
+        Added custom handler that supports MessagePortArray.
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Need to update JS bindings and IDL files to support multiple message ports in postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28460
+
+        Added new toJSSequence() API which validates that a JSValue meets the WebIDL criteria for a sequence.
+
+        Tests: fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added JSMessagePortCustom.h and JSMessageEventCustom.cpp.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::toJSSequence):
+        Added toJSSequence() API to do validation on sequence-like objects per WebIDL.
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        (WebCore::JSDedicatedWorkerContext::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSMessageEventCustom.cpp: Added.
+        (WebCore::JSMessageEvent::ports):
+        Added custom ports() getter that converts from MessagePortArray to JSArray.
+        (WebCore::JSMessageEvent::initMessageEvent):
+        Added support for passing a MessagePortArray.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        (WebCore::fillMessagePortArray):
+        New helper routine that validates/converts from a JS sequence o a WebCore::MessagePortArray.
+        * bindings/js/JSMessagePortCustom.h: Added.
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        * dom/MessageEvent.cpp:
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::ports):
+        Changed ports() to return a MessagePortArray* since this value can be null.
+        * dom/MessageEvent.idl:
+        Updated IDL to match HTML5 spec (now accepts MessagePortArrays instead of a solitary MessagePort).
+        * dom/MessagePort.cpp:
+        * dom/MessagePort.h:
+        * dom/MessagePort.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/Worker.cpp:
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do not query non-function call frames for function name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28799
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Crash after typing "clear" and pressing return in inspector console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28684
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Squeezed out some performance from string conversion.
+        https://bugs.webkit.org/show_bug.cgi?id=28945
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::string):
+        Avoid calling virtual length method. Be more explicit with
+        external memory computation. Avoid function calls in data and
+        length.
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+        (WebCore::v8NonStringValueToWebCoreString):
+        (WebCore::v8NonStringValueToAtomicWebCoreString):
+        Avoid extra calls of WebCoreStringResource::toString. When
+        AtomicString is computed pass it immediately when constructing
+        WebCoreStringResource. Use inline buffer for small strings.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toString):
+        Inline dispatch of string vs. non-string values.
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Inlined common case of V8IsolatedWorld::getEntered to speed
+        up V8Proxy lookup.
+        https://bugs.webkit.org/show_bug.cgi?id=28946
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::getEnteredImpl):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a regression bug that maxLength doesn't work for IME input.
+        https://bugs.webkit.org/show_bug.cgi?id=25253
+
+        Tests: fast/forms/input-maxlength-ime-completed.html
+               fast/forms/input-maxlength-ime-preedit.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-09-03  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement title/media/type setters do something
+        https://bugs.webkit.org/show_bug.cgi?id=28828
+
+        Test: svg/dom/style-reflect.html
+
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::setXmlspace): Actually change the attribute.
+        (WebCore::SVGStyleElement::setType): Ditto.
+        (WebCore::SVGStyleElement::setMedia): Ditto.
+        (WebCore::SVGStyleElement::setTitle): Ditto.
+
+2009-09-03  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28872
+        
+        Fixes a bug where handleEvent() in the V8 Custom SQL Statement Error binding would not return the correct result to WebCore after invoking the callback.
+
+        Test: storage/statement-error-callback.html
+
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent): Return true from handleEvent() if the callback raised an exception or the callback itself returned true.
+
+2009-09-03  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCustomPlatformData.cpp, FontCustomPlatformData.h,
+        and FontPlatformData.h
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCustomPlatformData.cpp: Added.
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/haiku/FontCustomPlatformData.h: Added.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/haiku/FontPlatformData.h: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::oblique):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading): Adopt the new enum form for FrameLoader::stopLoading().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Take an enum to decide whether to dispatch no unload events,
+          only unload, or unload and pagehide.
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::scheduleRedirection):
+        (WebCore::FrameLoader::cachePageForHistoryItem): Call pageHidden().
+        (WebCore::FrameLoader::pageHidden): Add to dispatch the pagehide event to all frames in the case
+          where a page is added to the PageCache.
+        * loader/FrameLoader.h:
+
+        * loader/FrameLoaderTypes.h: Add an UnloadEventPolicy enum.
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        - More CachedFrame destruction work.
+        - Including related Frame and FrameLoader changes and cleanup.
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Rebuild up the whole FrameTree when restoring.
+        (WebCore::CachedFrame::CachedFrame): Tear down the entire FrameTree when caching.
+        (WebCore::CachedFrame::destroy): For child frames that are being destroyed while in
+          the PageCache, do lightweight cleanup to:
+          A - Prevent referring to a stale Page object.
+          B - Prevent World Leaks of WebKit objects.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopAllLoaders): stopAllLoaders() should never be called on Frames that are
+          in the PageCache. ASSERT that fact.
+        (WebCore::FrameLoader::open): Remove a bogus release-build workaround, as the comment right above it
+          explains it is not effective, and it'd be better to see the crash locally instead of downstream.
+        (WebCore::FrameLoader::closeAndRemoveChild): Make sure the owner element has a page pointer before
+          referencing it.
+        (WebCore::FrameLoader::detachFromParent): Use the new detachViewsAndDocumentLoader() call
+        (WebCore::FrameLoader::detachViewsAndDocumentLoader): Does lightweight cleanup of client (WebKit) objects.
+        * loader/FrameLoader.h:
+
+        * page/Frame.cpp:
+        (WebCore::Frame::detachFromPage): Simply clear the Page pointer without doing any other work.
+        (WebCore::Frame::pageDestroyed): Use the new detachFromPage().
+        * page/Frame.h:
+
+2009-09-02  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Dimitri Glazkov
+
+        [Chromium] Add 'icu::' qualifier in preparation for ICU upgrade to 4.2
+        in Chromium. This is to fix a new file added in r28742 since the
+        last patch for this issue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getNormalizedTextRun):
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Correct a typo to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Changed "Unpremultipled" to "Unmultiplied".
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add a missing include to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Added SkColorPriv include.
+
+2009-09-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Implement file support for DragData.
+        https://bugs.webkit.org/show_bug.cgi?id=28896
+
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsCompatibleContent):
+
+2009-09-02  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Protect libcurl shared data with Mutex objects via curl_set_share_opt.
+        https://bugs.webkit.org/show_bug.cgi?id=28920
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::sharedResourceMutex):
+        (WebCore::curl_lock_callback):
+        (WebCore::curl_unlock_callback):
+        (WebCore::ResourceHandleManager::ResourceHandleManager):
+
+2009-09-02  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Expose functions to change the focus ring color for Linux Chromium
+
+        https://bugs.webkit.org/show_bug.cgi?id=28887
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setFocusRingColor):
+        (WebCore::RenderThemeChromiumLinux::platformFocusRingColor):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-02  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Patch to get premultiplied color support for Skia on getImageDate/putImageData.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Forget to rename openInFrameloader() to open(), which was requested in Darin's review of my last patch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::open):
+        * history/CachedFrame.h:
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        In http://trac.webkit.org/changeset/47943 I added new header dependencies to FrameLoader.h.
+        Removing them is a little trouble, but worth it going forward.
+        The pattern of creating a "CachedFrameBase" as the interface CachedFrame provides to FrameLoader
+        was suggested by Darin Adler.
+
+        No new tests. (No change in behavior)
+
+        Make CachedFrame inherit privately from CachedFrameBase, which becomes the interface FrameLoader uses:
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::CachedFrameBase):
+        (WebCore::CachedFrameBase::~CachedFrameBase):
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::openInFrameLoader):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrameBase::document):
+        (WebCore::CachedFrameBase::view):
+        (WebCore::CachedFrameBase::domWindow):
+        (WebCore::CachedFrame::create):
+        (WebCore::CachedFrame::documentLoader):
+        (WebCore::CachedFrame::mousePressNode):
+
+        Call the new ::openInFrameLoader() method on the CachedFrame, as CachedFrameBase is now the only
+        thing capable of interacting with FrameLoader::open(CachedFrameBase):
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::documentLoader):
+
+        Make ::open(CachedFrame) public, and change it to ::open(CachedFrameBase):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Cannot pres Enter to escape from bulleted list when <ul> is a child of <li>.
+        https://bugs.webkit.org/show_bug.cgi?id=24866
+
+        This patch modifies breakOutOfEmptyListItem to break out of a properly nested list
+        (a list to break out of is inside another list item).
+
+        When the empty list item appears at the end of another list item, WebKit breaks out of
+        the outer list item, and adds new item below the outer list item.
+        Otherwise, WebKit breaks out of the the inner list item and inserts new paragraph.
+
+        Test: editing/execCommand/break-out-of-empty-list-item.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        This patch is primarily about the "CachedFrame tree" and making slightly different decisions
+        based on whether a CachedFrame is the main frame or a subframe.
+
+        - Store whether a CachedFrame represents the main frame or a subframe.
+        - "Chop off the frame tree" for the main frame when creating its CachedFrame, as main frames 
+          are reused and need to start new page loads with an empty frame tree.
+        - Reattach the frame tree to the main frame when restoring it.
+        - open() the cached subframes in their respective loaders when restoring.
+        - Properly clear() and destroy() cached subframes.
+        - When committing to a new page load, and after caching the previous page, only clear the
+          FrameView for the main frame.
+
+        Note that all of above will eventually be necessary as I continue to land this work in pieces,
+        but doesn't actually change any behavior right now because we still refuse to even *try* to
+        cache pages with frames.
+
+        No new tests. No change in behavior, and current tests continue to pass.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::restore):
+        (WebCore::CachedFrame::clear):
+        (WebCore::CachedFrame::destroy):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrame::isMainFrame):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        No review, build fix.
+
+        http://trac.webkit.org/changeset/47976 broke the build.  
+        Let's try compiling before we land things, shall we?
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): Order the initialization list correctly.
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * wscript:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        Unreviewed build fix for Chromium.
+
+        Missed #including V8Proxy.h in WebCore/bindings/v8/V8Binding.cpp.
+
+        * bindings/v8/V8Binding.cpp: add V8Proxy.h as an include
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix, don't define symbols we now grab from other sources.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for PluginViewNone.cpp and a wx build fix for PluginView.cpp.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformDestroy):
+
+2009-09-02  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the build failure of WebKit for Linux/Qt when WML is enabled
+
+        No test cases needed since this just fixes the build problem.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::create):
+        * wml/WMLTableElement.cpp:
+        (WebCore::WMLTableElement::joinSuperflousColumns):
+        (WebCore::WMLTableElement::padWithEmptyColumns):
+
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: use shared buffer for custom font data
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        Refactored by Joe Mason <joe.mason@torchmobile.com>
+
+        * loader/CachedFont.cpp:
+        add WINCE to platforms using cached custom data
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameFont): implement for WinCE
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        build fixes
+        * platform/graphics/wince/FontCustomPlatformData.cpp:
+        (WebCore::setCustomFontCache): add accessor
+        (WebCore::createFontCustomPlatformData): change param to SharedBuffer
+        * platform/graphics/wince/FontCustomPlatformData.h:
+        update function signatures 
+ 
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: font-related build fixes and minor bugfixes
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/FontCache.h: declare functions added in https://bugs.webkit.org/show_bug.cgi?id=27509
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage): fix ambiguous overload error in min/max on Windows
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): initialize member vars
+        * platform/graphics/SimpleFontData.h: disable unused members on Wince to save space 
+
+2009-09-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Another pass at releasing the storage mutex.
+        https://bugs.webkit.org/show_bug.cgi?id=28904
+
+        Another pass at releasing the storage mutex (when applicable) when we finish
+        executing JavaScript.  http://dev.w3.org/html5/spec/Overview.html#storage-mutex
+        describes the required behavior.
+
+        As it turns out, https://bugs.webkit.org/show_bug.cgi?id=28789 didn't solve
+        the problem correctly.  First of all, I missed that events and timeouts go
+        through a different call path.  Second of all, I didn't consider recursion
+        correctly.  Third of all, my check to see if LocalStorage is alive actually
+        instantiates it if it isn't yet.  Fourth, I forgot DOM_STORAGE guards around
+        it.  So I'm reverting that change completely and doing it more cleanly.
+        Unfortunately, the solution isn't as portable (and thus I've left out the JSC
+        implementation for now).
+
+        NOTE: This change now tracks recursion on function callbacks in V8.  I ran this
+        by Mads Ager and Mike Belshe and they seemed to think adding the checks were
+        fine.  Most callbacks are asynchronous and thus wouldn't be nested.  The few
+        scenareos where you can have nested callbacks probably should have always been
+        protected by a recursion guard.
+
+        Unfortunately, this can't be tested without a hook added to the layout test
+        controllers since the lock is (by design) not supposed to be observable by
+        JavaScript.  https://bugs.webkit.org/show_bug.cgi?id=28906
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::runScript):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::callFunction):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::releaseStorageMutex):
+            Check to see if localStorage has been instantiated.  If so, tell it to
+            unlock all storage areas.
+        * bindings/v8/V8Proxy.h:
+        * page/PageGroup.h:
+        (WebCore::PageGroup::hasLocalStorage):  Make hasLocalStorage public.
+
+2009-09-02  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: Implement ImageBuffer for WINCE
+        Implement Image interface with a light class BufferedImage
+        for rendering ImageBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=28167
+
+        * platform/graphics/wince/ImageBufferData.h: Added.
+        * platform/graphics/wince/ImageBufferWince.cpp: Added.
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Join the various PluginView destructors into one shared implementation
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The Qt port used to delete the platform plugin widget as the last step.
+        Now this is done before cleaning up the script objects and unloading the
+        plugin package, similar to how the Win port does it.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Share PluginView::init() between ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The port-spesific bits are moved to platformStart(), which now returns
+        a bool based on the success of the platformStart.
+
+        m_hasPendingGeometryChange is now initialized in the initializer list
+        instead of in PluginViewQt's init()
+
+        PluginViewMac (currently used only by the Qt port) used to manually call
+        stop() in the case where an unsupported drawing or event model was detected.
+        This was wrong, as the m_status and m_isStarted fields should be used to
+        guard against doing operations on a plugin in this intermediate state.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28737
+        
+        Update JavaScript bindings in JSC and V8 for SQLTransaction to throw exceptions in the right places.
+
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql): Throw an exception if no parameters are passed to executeSql().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreString): Catch an exception if thrown from toString().
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Allow "arrayish objects" to be passed to executeSql.
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.isDB):
+        (WebInspector.Database.prototype.runWithTableNames.sortingCallback):
+        (WebInspector.Database.prototype.runWithTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        (WebInspector.Database.prototype.executeSql.errorCallback):
+        (WebInspector.Database.prototype.executeSql.queryTransaction):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._enterKeyPressed):
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables.withTableNames):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate.withTableNames):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate):
+
+2009-09-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (trivial followup fix). 
+        
+        Web Inspector: Trivial follow up fix to r47944.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::nodeForId):
+
+2009-09-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed a bug in handling of isReadOnly, where textareas were casted to HTMLInputElements.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+
+2009-09-01  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28047
+        add utility method to enable logging messages for inspector development
+
+        manual test case added (see below)
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement):
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.log):
+        * manual-tests/inspector/webinspector-log.html: Added.
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        * page/Console.h:
+        (WebCore::):
+
+2009-09-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21990
+        When a rare EUC-JP character is present, explicitly (and correctly) labelled EUC-JP document
+        is mistreated as Shift_JIS
+
+        <rdar://problem/5828506> Safari should not try auto-detecting if charset information exists
+
+        WebKit used to unconditionally auto-detect document encoding if it was one of Japanese ones.
+        This didn't really match any browser, and did cause problems on some sites.
+
+        Our detector is very quick to label an EUC-JP page as Shift_JIS if it notices a byte that
+        cannot be part of EUC-JP source. However, such bytes do appear in Web pages sometimes,
+        especially in comments. Also, some valid EUC-JP sequences are not known to it.
+
+        Some pages that are fixed by this change:
+
+        <rdar://problem/5934750> Encoding in incorrect at http://cocodeparis.blog45.fc2.com/. This
+        page has incorrect encoding in title, so no browser displays it 100% fine. We now match
+        Firefox and IE.
+
+        <rdar://problem/6007713> The web page http://www.sf.us.emb-japan.go.jp/top.htm is garbled
+        in Safari. There is a stray byte in comments that was makes charset detector think it can't
+        be EUC-JP.
+
+        <rdar://problem/6965711> A Japanese web page www.nippontv.studiolegend.tv is garbled in
+        Safari. Many comments on this page are encoded as Shift_JIS - IE magically displays that
+        fine in View Source mode (it doesn't seem to have an ability to switch between EUC-JP and
+        Shift_JIS in normal HTML view though).
+
+        Test: fast/encoding/japanese-encoding-mix.html
+
+        * loader/TextResourceDecoder.cpp: (WebCore::TextResourceDecoder::decode): Only invoke auto-
+        detection if there is no solid charset information yet.
+
+2009-09-01  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] FileList cannot be accessed via index in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28883
+
+        Tested by clipboard-file-access.html.
+
+        * WebCore.gypi:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8FileListCustom.cpp: Added.
+
+2009-08-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the workaround added in r47316.
+
+        Reviewed by Sam Weinig.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+
+        * accessibility/AXObjectCache.h:
+        Remove the Document argument to the AXObjectCache constructor and the
+        m_document member variable, and replace the no-parameter
+        handleFocusedUIElementChanged() with the two-parameter GTK function.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject):
+        Don't pass a null Document when constructing the AXObjectCache.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Get the document from the RenderObject; m_document was removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Don't pass the Document when constructing the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Pass the old and new focused RenderObjects when calling
+        handleFocusedUIElementChanged().
+
+2009-09-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that InspectorDOMAgent and InspectorFrontend are not null
+        before accessing them in InspectorBackend. They may be null if
+        InspectorController is closed before an asynchronous operation is
+        started.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setAttribute):
+        (WebCore::InspectorBackend::removeAttribute):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::inspectorDOMAgent):
+        (WebCore::InspectorBackend::inspectorFrontend):
+        * inspector/InspectorBackend.h:
+
+2009-09-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with frames
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Things learned in the full task that this patch addresses:
+        - The notions of clearing a CachedFrame and destroying a CachedFrame were two concepts that 
+          needed to be managed separately.
+        - Once we start restoring pages with multiple CachedFrames, we'll have to be calling
+          FrameLoader::open(CachedFrame&) multiple times with different CachedFrames, and this process
+          will be guided by the CachedFrames themselves.
+
+        No new tests. (No change in behavior, current layout tests pass)
+        
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::~CachedFrame):
+        (WebCore::CachedFrame::clear): Only clear pointers out.
+        (WebCore::CachedFrame::destroy): Perform the destructive cleanup work here - Things that shouldn't
+          occur simply by navigating back to a page with a CachedFrame.
+        * history/CachedFrame.h:
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::~CachedPage):
+        (WebCore::CachedPage::restore): Call clear() after restoring.
+        (WebCore::CachedPage::clear):
+        (WebCore::CachedPage::destroy):
+        * history/CachedPage.h:
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::releaseAutoreleasedPagesNow): destroy() CachedPages that are being pruned,
+          instead of clearing them.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad): Let the CachedPage clear() itself after restoring.
+        (WebCore::FrameLoader::open): Don't ::open() the CachedFrame, as the CachedPage does that now.
+        * loader/FrameLoader.h:  Add the friending so CachedPage and CachedFrame can better guide the process.
+          Even though CachedFrame::restore() isn't used for now, it will be soon.
+
+2009-09-01  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        Add a "lowMemoryNotification" method to the V8 ScriptController class.
+        This is needed in order to allow the host application (Android Web browser in this case)
+        to call the v8::V8::LowMemoryNotification() method added to V8 in
+        http://code.google.com/p/v8/source/detail?spec=svn2777&r=2725
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28776
+
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::lowMemoryNotification):
+        * bindings/v8/ScriptController.h:
+
+2009-09-01  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        V8 Bindings for WebSocket API.
+        https://bugs.webkit.org/show_bug.cgi?id=28844
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp: Added.
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Missed a "." -> "->" conversion.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build, take 2.  The Qt code had what looks like a
+        broken virtual function override.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-09-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Uninitialized variable in XSSAuditor
+        https://bugs.webkit.org/show_bug.cgi?id=28874
+
+        One ought to initialize variables before use even when it doesn't
+        matter.  No behavior change.
+
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build.
+
+        * platform/graphics/ImageSource.cpp:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Eliminate most of ImageSourceQt.cpp in favor of ImageSource.cpp.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Make InjectedScript self-contained (move necessary
+        methods from utilities.js into InjectedScript).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28871
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+        (Object.type):
+        (Object.hasProperties):
+        (Object.className):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/utilities.js:
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: console log message repeat count double.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28856
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk] Fix DATALIST build
+        https://bugs.webkit.org/show_bug.cgi?id=28826
+
+        Add ENABLE_DATALIST to FEATURE_DEFINES.
+
+        * GNUmakefile.am:
+
+2009-09-01  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        SVGSVGElement suspend methods argument/return types incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=28860
+
+        Also fix the style of the argument names.
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::suspendRedraw):
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+
+2009-09-01  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix bug 28808:  [Skia] Fix flaky layout test svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html [DEBUG]
+        (https://bugs.webkit.org/show_bug.cgi?id=28808)
+
+        The bug fix adds an explicit check for the validity of the path when it is 
+        transformed into local coordinates. 
+        This was the most suitable place I could find that didn't cause an inordinate 
+        amount of refactoring. Also, it seems pertinent and may also catch other cases 
+        that are not limited to clipping paths.
+
+        TEST: existing svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp: make isPathSkiaSafe accessible
+        (WebCore::):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates): check Skia safety of path
+
+2009-09-01  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Combining Diacritical Marks (U+0300..) are not handled correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=28742 
+
+        Normalize (NFC) a TextRun when the run contains combining diacritical marks
+        so that Skia can pick a correct glyph without relying on GSUB table in a font.
+        This change is for Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getTextRun): Added.
+        (WebCore::TextRunWalker::getNormalizedTextRun): Added.
+
+        This function is called when the run contains U+0300..U+036F and converts characters in
+        the run to the combined form (NFC) using ICU.
+
+2009-09-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Inlined fast paths of V8DOMWrapper::convertNodeToV8Object and
+        V8Proxy::createWrapperFromCache.
+        https://bugs.webkit.org/show_bug.cgi?id=28848
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object): Special
+        function for document wrapping.
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object): Slow case of
+        wrapping a new node.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object): Extracted fast
+        path from V8DOMWrapper.cpp.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::createWrapperFromCache): Extracted fast path
+        from V8Proxy.cpp.
+
+2009-09-01  Eric Seidel  <eric@webkit.org>
+
+        No review, windows build fix only.  Clearly I should have read the patch closer. :(
+
+        Allow excluding certain plugins from loading
+        https://bugs.webkit.org/show_bug.cgi?id=28677
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::refresh):
+
+2009-09-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector backend
+        and add frontend JavaScript stubs.
+        https://bugs.webkit.org/show_bug.cgi?id=28846
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::profiles):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::condition):
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::setCondition):
+        (WebCore::JavaScriptDebugServer::addBreakpoint):
+        (WebCore::JavaScriptDebugServer::breakpointInfo):
+        (WebCore::JavaScriptDebugServer::updateBreakpoint):
+        (WebCore::JavaScriptDebugServer::updateBreakpointInfo):
+        (WebCore::JavaScriptDebugServer::removeBreakpoint):
+        (WebCore::JavaScriptDebugServer::hasBreakpoint):
+        (WebCore::JavaScriptDebugServer::clearBreakpoints):
+        * inspector/JavaScriptDebugServer.h:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::BreakpointInfo):
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint):
+        (WebInspector.Breakpoint.prototype.get id):
+        (WebInspector.Breakpoint.prototype.get condition):
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-09-01  Marius Renn  <damarvy@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added delegate to PluginDatabase to disable loading certain plugins.
+        This is useful when you want to load from the standard plugin
+        directory, but want to exclude certain plugins. Plugins may be
+        excluded early on by name, so that no plugin code is executed (which
+        may have caused a crash).
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::PluginDatabase):
+        (WebCore::PluginDatabase::refresh):
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::setClient):
+        * plugins/PluginDatabaseClient.h: Added.
+        (WebCore::PluginDatabaseClient::~PluginDatabaseClient):
+
+2009-08-31  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        * WebCore.base.exp: Removed an unneeded symbol export.
+
+2009-08-31  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28466
+        When downloading a file, two GET requests are sent to the HTTP server
+
+        Can't think of a way to test this.
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::releaseResources): only nullify the
+        handle's client when it is the ResourceLoader, to support the case
+        in which a download API uses a different client
+
+2009-08-31  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Text Fields and Text Areas are reported as read-only by inspect32.exe.
+        https://bugs.webkit.org/show_bug.cgi?id=28854
+
+        Added another case in AcccessibiltyRenderObject::isReadOnly to test if text fields
+        and texts areas are read-only.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+
+2009-08-31  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        fast/workers/worker-lifecycle.html crashes intermittently on snowleopard
+        https://bugs.webkit.org/show_bug.cgi?id=28795
+
+        Changed WorkerContext::close() to no longer stop the worker thread.
+        It is now the parent's responsibility to shut down the worker thread when it is notified that the context is closed.
+
+        * workers/AbstractWorker.cpp:
+        Updated dispatchScriptErrorEvent to pass-through the "handled" value from dispatchEvent(), to allow event handlers added with addEventListener() to mark events as handled.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        Now shuts down the worker thread when notified that the context is closed.
+        (WebCore::SharedWorkerProxy::close):
+        Now handles being invoked when the context is already in the process of shutting down.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::close):
+        No longer calls WorkerThread::stop() to avoid race conditions with shutting down the thread while the parent is still interacting with it.
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isClosing):
+        isClosing() is now public so WorkerRunLoop can call it to determine whether to process tasks.
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::performTask):
+        Error events should still be delivered even if the worker thread is closing.
+        Also fixed problem where error events were not dispatched if error handlers were added via addEventListener().
+        (WebCore::WorkerTerminateTask::create):
+        New task that invokes terminateWorkerContext() on the parent thread when the context is closed.
+        (WebCore::WorkerTerminateTask::WorkerTerminateTask):
+        (WebCore::WorkerTerminateTask::performTask):
+        (WebCore::WorkerMessagingProxy::workerContextClosed):
+        Now fires off a WorkerTerminateTask to shut down the thread when the context is closed.
+        * workers/WorkerMessagingProxy.h:
+        WorkerMessagingProxy now overrides workerContextClosed().
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::runInMode):
+        Now drops tasks on the floor if the WorkerContext is closing.
+
+2009-08-31  Ojan Vafai  <ojan@chromium.org>
+
+        Not reviewed (build fix)
+
+        Build fix for Chromium to match r49707.
+
+        * bindings/v8/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28858
+        Element.baseURI parses xml:base attribute incorrectly
+
+        Test: fast/dom/base-attribute-parsing.xhtml
+
+        * dom/Element.cpp: (WebCore::Element::baseURI): Avoid assertion failure (no change in
+        release mode).
+
+2009-08-31  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reverting http://trac.webkit.org/changeset/47904, because it caused
+        layout test failure.
+
+        Test: fast/dom/Window/new-window-opener.html
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28852
+        Rename KURL single argument constructor to avoid confusion
+
+        * platform/KURL.h: The constructor that used to be single argument should now be invoked
+        as KURL(ParsedURLString, myString).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_EvaluateHelper):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::isSVGCursorIdentifier):
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::cachedImage):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL):
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
+        * editing/markup.cpp:
+        (WebCore::completeURLs):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::url):
+        (WebCore::HistoryItem::originalURL):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createCached):
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::requestResource):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::getSubresources):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::redirectionTimerFired):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::startRedirectionTimer):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        (WebCore::ApplicationCacheStorage::manifestURLs):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createResource):
+        (WebCore::LegacyWebArchive::create):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+        * platform/KURLHash.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::operator CFErrorRef):
+        * platform/network/cf/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse):
+        (WebCore::headerCallback):
+        * platform/network/curl/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::operator NSError*):
+        * platform/network/mac/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/qt/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+        (WebCore::ClipboardWin::setData):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLTProcessor.cpp:
+        (WebCore::docLoaderFunc):
+        Adapt to the change everywhere the single argument constructor was used. I did a very
+        cursory check of whether these locations were using this constructor properly, and didn't
+        notice any obvious mistakes. The new explicit name will hopefully suggest checking this
+        better when refactoring any such code.
+
+2009-08-31  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28635 [CSS3 
+        Backgrounds and Borders] Add support for 2-keyword values for 
+        background-repeat
+
+        This patch allows background-repeat to take two values by making 
+        background-repeat just like background-position internally. There 
+        is a little extra legwork for background-repeat because the spec 
+        indicates that its computed value should be equivalent to how it 
+        was specified. I keep track of the specified thing by setting the 
+        implicit flag whenever background-repeat is defined with only one 
+        value (since internally, we now store this as 2 values.)
+        
+        Here we can't access the implicit flag, so for backwards-
+        compatibility's sake, we always return one value when that makes 
+        sense.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fillRepeatToCSSValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Here we check for the implicit flag and return one value when it is 
+        set.
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+        (WebCore::CSSMutableStyleDeclaration::cssText):
+
+        Add support for CSSPropertyBackgroundRepeatX and 
+        CSSPropertyBackgroundRepeatY
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillShorthand):
+        (WebCore::CSSParser::parseFillRepeat):
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSParser.h:
+
+        Get rid of mappings to RepeatXFill and RepeatYFill since we don't 
+        need those parts of the EFillRepeat enum anymore.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+
+        Add CSSPropertyBackgroundRepeatX and CSSPropertyBackgroundRepeatY
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap):
+
+        Add background-repeat-x and -y.
+        * css/CSSPropertyNames.in:
+
+        Break repeat into x and y.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillRepeatX):
+        (WebCore::CSSStyleSelector::mapFillRepeatY):
+        * css/CSSStyleSelector.h:
+
+        There is no more RepeatXFill. Instead, look for 
+        fillLayer->repeatX() == RepeatFill
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+
+        Break m_repeat into m_repeatX and m_repeatY
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        (WebCore::FillLayer::cullEmptyLayers):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::repeatX):
+        (WebCore::FillLayer::repeatY):
+        (WebCore::FillLayer::isRepeatXSet):
+        (WebCore::FillLayer::isRepeatYSet):
+        (WebCore::FillLayer::setRepeatX):
+        (WebCore::FillLayer::setRepeatY):
+        (WebCore::FillLayer::clearRepeatX):
+        (WebCore::FillLayer::clearRepeatY):
+        (WebCore::FillLayer::initialFillRepeatX):
+        (WebCore::FillLayer::initialFillRepeatY):
+
+        Again, break backgroundRepeat into backgroundRepeatX and 
+        backgroundRepeatY
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundRepeatX):
+        (WebCore::InheritedFlags::backgroundRepeatY):
+        (WebCore::InheritedFlags::maskRepeatX):
+        (WebCore::InheritedFlags::maskRepeatY):
+
+        We don't need RepeatXFill or RepeatYFill. Now that we store two 
+        values, they are represented by Repeat-NoRepeat and NoRepeat-
+        Repeat, respectively.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layer size needs to take into account software reflections on children.
+        https://bugs.webkit.org/show_bug.cgi?id=28837
+        
+        When computing the bounds of a composited layer, take software-rendered
+        reflections into account.
+
+        Test: compositing/reflections/reflection-in-composited.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+
+2009-08-31  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-08-31  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Request Headers Should Show Data Sent With Request
+        https://bugs.webkit.org/show_bug.cgi?id=22920
+
+        Manual test added - see below.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateRequest):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshQueryString):
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        (WebInspector.ResourceView.prototype._getHeaderValue):
+        (WebInspector.ResourceView.prototype._refreshRequestHeaders):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.updateResource):
+        * manual-tests/inspector/display-form-data.html: Added.
+
+2009-08-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: pass call frames into the frontend as a part of
+        pausedScript event.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28847
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didPause):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+        * inspector/front-end/inspector.js:
+        (WebInspector.pausedScript):
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Un-blacklist Silverlight on Mac
+
+        Does not seem to crash anymore, probably due to how we now handle
+        drawing and event model handshake better.
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2009-08-31  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28827
+        SVGSVGElement.unsuspendRedraw() shouldn't throw
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSVGElement.idl:
+
+2009-08-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Change the reutrn type of HTMLInputElement::list so that it
+          conforms to the standard.
+        - Add HTMLInputElement::dataList()
+        https://bugs.webkit.org/show_bug.cgi?id=28769
+
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::dataList):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-31  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Remove ASSERT(frame) in ResourceHandle::start (ResourceHandleCurl.cpp)
+        https://bugs.webkit.org/show_bug.cgi?id=28802
+
+        Remove ASSERT because the frame could be null if the
+        ResourceHandle is not associated with any frame, e.g. if we are
+        downloading a file.
+        If the frame is not null but the page is null this must be an
+        attempted load from an onUnload handler, so let's just block it.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-08-31  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix for platforms which don't enable DOM_STORAGE.
+        https://bugs.webkit.org/show_bug.cgi?id=28834
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-29  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28829
+        Crash in AccessibilityRenderObject::activeDescendant when trying to set aria-activedescendant to something without a renderer
+
+        Test: accessibility/aria-activedescendant-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp: (WebCore::AccessibilityRenderObject::activeDescendant): Nil check.
+
+2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk Build broken for OSX Quartz
+        https://bugs.webkit.org/show_bug.cgi?id=28727
+
+        Check for XP_UNIX instead of GTK or X11 to ease building of the Gtk
+        port in Mac and Unix/Linux.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::init):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix positioning error when a compositing, absolutely-positioned element has an ancestor with opacity.
+        https://bugs.webkit.org/show_bug.cgi?id=28754
+        
+        For absolutely-positioned layers, convertToLayerCoords() jumps to the positioned
+        ancestor, since the layer x and y are relative to that ancestor. However, this could
+        skip over the ancestorLayer, thus giving the wrong result.
+        
+        Fix by duplicating the enclosingPositionedAncestor() logic in convertToLayerCoords(),
+        and checking for ancestorLayer along the way. If found, compute offset of both to
+        the enclosingPositionedAncestor() and subtract.
+        
+        This also fixes a positioning bug with abs. positioned elements in reflections,
+        so there is a new reflection test with a pixel result.
+
+        Tests: compositing/geometry/abs-position-inside-opacity.html
+               fast/reflections/abs-position-in-reflection.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isPositionedContainer):
+        (WebCore::RenderLayer::enclosingPositionedAncestor):
+        (WebCore::RenderLayer::enclosingTransformedAncestor):
+        (WebCore::RenderLayer::convertToLayerCoords):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe
+
+        Wrap WebkitCSSTransformValues in the correct class of DOM wrapper.
+        https://bugs.webkit.org/show_bug.cgi?id=27727
+
+        When fetching the DOM wrapper for a WebkitCSSTransformValue (which is a kind of 
+        CSSValueList), we need to ask the value list whether it's a WebkitCSSTransformValue,
+        because there is not a unique enum value for WebkitCSSTransformValue.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass):
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+        Fix some warnings introduced by r47381.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+
+2009-08-28  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21442
+        Make sure filesystemPathFromUrlOrTitle() returns a string with length
+        <= MAX_PATH - 1.
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+
+2009-08-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's VFS for Linux and Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28750
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        (WebCore::SQLiteFileSystem::deleteDatabaseFile):
+        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+
+2009-08-28  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Made bindings use Node::setOnEvent functions for Node descendants
+        instead of Node::setAttributeEventListener.
+
+        Node::setAttributeEventListener is an internal function and
+        doesn't do the forwarding to DOM window that is required for some
+        HTML elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28709
+
+        Tests added in http://trac.webkit.org/changeset/47326 now pass with V8.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Now generates EventListener accessors for Node descendants instead
+        of using custom callbacks.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Moved from V8NodeCustom.cpp.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Fixed a bug in
+        signature.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        Changed signature to accept Handle instead of Local.
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Removed custom callbacks for EventListener accessors.
+
+2009-08-28  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28803
+        
+        Implements V8CustomVoidCallback reporting any exceptions that were thrown from the callback function.
+
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallback): Checks if the callback raised an exception and reports it to WebCore if so.
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed (build fix).
+
+        * platform/graphics/qt/ImageDecoderQt.cpp: Accidentally added some spaces.
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h: Make constructor public so factory function can access it (this seemed better than making ImageDecoder a friend).
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move ImageDecoder creation function to a factory function on
+        ImageDecoder.  This is arguably where it makes the most sense anyway,
+        and it will (soon) allow ImageSourceQt.cpp to have one less dedicated
+        function.
+
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp:
+        * platform/image-decoders/ImageDecoder.h:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Combine duplicated code from ImageDecoder*.cpp into the main
+        ImageDecoder.cpp.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override setScrollbarModes to correctly forward scrollbar modes
+        policy changes to client code, via a new platform-specific method,
+        scrollbarsPolicyDidChange.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::scrollbarsPolicyDidChange):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::createScrollbar):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setScrollbarModes):
+
+2009-08-28  Cédric Luthi <cedric.luthi@gmail.com>
+
+        Reviewed by Tor Arne Vestbø
+
+        [Qt/Mac] Un-blacklist the QuickTime plugin
+
+        https://bugs.webkit.org/show_bug.cgi?id=28768
+
+        Now that the drawing model is properly negotiated, there is no need the
+        blacklist the QuickTime plugin anymore.
+
+        This revealed a bug in PluginView::performRequest: it should not initiate a
+        request if the plugin has been stopped, which is what happens when a plugin
+        only supports the QuickDraw drawing model.
+
+        * plugins/PluginView.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-08-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Set DOM agent document to 0 in InspectorController::close to
+        make DOM agent remove DOM listeners from the inspected document.
+
+        Replace windowVisible checks with m_frontend checks to as inspector
+        window lives in a different process in Chromium while frontend proxy
+        is in the inspected page process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspect):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::addProfile):
+        * inspector/InspectorController.h:
+
+2009-08-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove dependency of SummaryBar on WebInspector.resourceCategories.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28801
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get categories):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.update):
+
+2009-08-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (patching in l18n change that was missing due to
+        the git binary diff format).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+
+2009-08-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make XSSAuditor go fast
+        https://bugs.webkit.org/show_bug.cgi?id=28667
+
+        Make the XSSAuditor go faster by implementing two optimizations:
+
+        1) We avoid canonicalizing scripts that are larger than the page's URL.
+           This saves a bunch of time for large inline scripts.
+
+        2) We memoize canonicalizing the page's URL because it's silly to
+           canonicalize repeated for each inline event listener.
+
+        These optimizations have a measurable affect on the intl1 page cycler.
+
+        No behavior change.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::MemoizingURLCanonicalizer::canonicalizeURL):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Removed ASSERT_NOT_REACHED, because indeed this ASSERT is reached in
+        fast/canvas/change-context.html. And it's alright to reach it.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Removed assertion.
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for http://trac.webkit.org/changeset/47840
+
+        Peter's change forgot one m_decoder->
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex):
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Add NULL-check, since the context ain't changeable no more, and
+        thus getContext could return 0.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added NULL-check.
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        dataTransfer.types() should include type "Files" when files are present in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28780
+
+        Add dataTransfer type "Files" to the chromium port.  Add eseidel's
+        patch for same for the mac port.
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Removed GL_ from all constants, and gl prefix from all calls
+        https://bugs.webkit.org/show_bug.cgi?id=28773
+
+        This was done for the external API in CanvasRenderingContext3D and
+        the internal API in GraphicsContext3D.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+
+2009-08-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Qt and Gtk build fixes. Not reviewed.
+
+        Add CanvasRenderingContext3D.idl to the build scripts.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Release the storage mutex whenever leaving JavaScript execution.
+        https://bugs.webkit.org/show_bug.cgi?id=28789
+
+        http://dev.w3.org/html5/spec/Overview.html#storage-mutex describes the
+        required behavior.  After we leave JavaScript, we must be sure the storage
+        mutex has been released.  At the end of evaluate(), if localStorage has been
+        instantiated, tell it to release any locks that may be applicable.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28753
+        <rdar://problem/7173448> Excessive number of threads (and a crash)
+
+        Coalesce DNS prefetch requests to reduce strain on CFHost. Currently, the algorithm is as follows:
+        - when resolver is idle, the first few requests are sent immediately (they may or may not
+        hit the wire);
+        - if there are a few requests in flight already, coalesce all requests for one second;
+        - to avoid pathological cases with lots of links to different sites on a page, only ask
+        CFHost about a handful of names (dropping the rest).
+
+        Coalescing reduces the number of requests dramatically, as prefetchDNS is called for each
+        link, and these tend to have identical host name.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::DNSResolveQueue):
+        (WebCore::DNSResolveQueue::shared):
+        (WebCore::DNSResolveQueue::add):
+        (WebCore::DNSResolveQueue::decrementRequestCount):
+        (WebCore::DNSResolveQueue::fired):
+        (WebCore::clientCallback):
+        (WebCore::DNSResolveQueue::resolve):
+        (WebCore::prefetchDNS):
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Final patch for Canvas 3D support
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This hooks everything up and provides a working implementation of
+        Canvas 3D. I plumb the creation of the 3D canvas down to GraphicsLayer,
+        passing the opaque context and texture pointers so a Canvas3DLayer can be
+        created (more on that later). It also plumbs changes to the 3D canvas so
+        that Canvas3DLayer can recomposite the results.
+        
+        A 3D Canvas element needs a RenderLayer and compositing layer to render.
+        This is because it renders to an off-screen texture in the GPU and then
+        hands it to a Canvas3DLayer, which is a subclass of CAOpenGLLayer, to
+        render that texture as a 3D quad. This keeps everything in GPU memory to 
+        maximize performance. When a CanvasRenderingContext3D is created it 
+        forces a style recalc which creates the RenderLayer and compositing 
+        layer if needed. 
+        
+        I repurposed an existing flag which was put in place for animation to accomplish 
+        this. This flag is passed to setNeedsStyleRecalc(), and I renamed it from 
+        AnimationStyleChange to SyntheticStyleChange. It essentially says that you need
+        to do a complete style recalc, even though the style itself has not really
+        changed.
+        
+        This patch also fixes a couple of bugs discovered when testing with 3d-canvas
+        turned on. I also added a constructor DOMWindow.idl for CanvasRenderingContext3D.
+        This is needed when making a JS wrapper for the object so the prototype 
+        property can be set.
+
+        Test: fast/canvas/change-context.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::glDrawElements):
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::setNeedsStyleRecalc):
+        * dom/Node.h:
+        (WebCore::):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::is3D):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/CanvasBuffer.cpp:
+        (WebCore::CanvasBuffer::create):
+        (WebCore::CanvasBuffer::CanvasBuffer):
+        (WebCore::CanvasBuffer::_deleteObject):
+        * html/canvas/CanvasBuffer.h:
+        * html/canvas/CanvasFramebuffer.cpp:
+        (WebCore::CanvasFramebuffer::create):
+        (WebCore::CanvasFramebuffer::CanvasFramebuffer):
+        (WebCore::CanvasFramebuffer::_deleteObject):
+        * html/canvas/CanvasFramebuffer.h:
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::~CanvasObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+        * html/canvas/CanvasProgram.cpp:
+        (WebCore::CanvasProgram::create):
+        (WebCore::CanvasProgram::CanvasProgram):
+        (WebCore::CanvasProgram::_deleteObject):
+        * html/canvas/CanvasProgram.h:
+        * html/canvas/CanvasRenderbuffer.cpp:
+        (WebCore::CanvasRenderbuffer::create):
+        (WebCore::CanvasRenderbuffer::CanvasRenderbuffer):
+        (WebCore::CanvasRenderbuffer::_deleteObject):
+        * html/canvas/CanvasRenderbuffer.h:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        * html/canvas/CanvasShader.cpp:
+        (WebCore::CanvasShader::create):
+        (WebCore::CanvasShader::CanvasShader):
+        (WebCore::CanvasShader::_deleteObject):
+        * html/canvas/CanvasShader.h:
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::create):
+        (WebCore::CanvasTexture::CanvasTexture):
+        (WebCore::CanvasTexture::_deleteObject):
+        * html/canvas/CanvasTexture.h:
+        * page/DOMWindow.idl:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::setNeedsStyleRecalc):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::cancelAnimations):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayer::setGraphicsContext3DNeedsDisplay):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateContentsGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setGraphicsContext3DNeedsDisplay):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::requiresLayer):
+        * rendering/RenderHTMLCanvas.h:
+        (WebCore::RenderHTMLCanvas::isCanvas):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        (WebCore::RenderLayerBacking::rendererContentChanged):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isCanvas):
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageDecoder*.cpp a bit.
+
+        * platform/image-decoders/ImageDecoder.cpp: Put functions in the same
+          order as in the header file.  Also, since there's already an anonymous
+          namespace in this file, use it to enclose the local helper functions.
+        (WebCore::):
+        (WebCore::ImageDecoder::upperBoundScaledX):
+        (WebCore::ImageDecoder::lowerBoundScaledX):
+        (WebCore::ImageDecoder::scaledY):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData): Ensure m_size is set correctly.
+        (WebCore::RGBA32Buffer::asNewNativeImage): Remove unneeded temp.
+        (WebCore::RGBA32Buffer::operator=): Simplify.
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage): Try and collect spaced-out temps under loop comment to show they're all related.  Use size_t for iterating over elements of a Vector.
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageSource.* in preparation for more fixes on bug 27965.
+
+        * platform/graphics/ImageSource.cpp: Put functions in the same order as in header file.
+        (WebCore::ImageSource::isSizeAvailable): Shorten.
+        (WebCore::ImageSource::size): Shorten.
+        (WebCore::ImageSource::frameSizeAtIndex): Shorten.
+        (WebCore::ImageSource::repetitionCount): Shorten.
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+        * platform/graphics/ImageSource.h: Shorten #ifdef section a bit by sharing common typedefs.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Add ImageDecoder.cpp to various build files so platforms will be able to
+        use it.  Move an ENABLE to not cover the whole file, in preparation for
+        adding a bunch of code.  Simplify #ifdefs in ImageDecoder.h to be "Skia
+        vs. everyone else", which also gives new platforms a reasonable default
+        behavior.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::getAddr):
+
+2009-08-27  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28784
+        
+        Add an exported method to flush pending repaints.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+        (WebCore::FrameView::flushDeferredRepaints):
+        * page/FrameView.h:
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Expose files from the pasteboard in drop events.
+        https://bugs.webkit.org/show_bug.cgi?id=28782
+
+        Update chromium port to expose dataTransfer.files() as per
+        HTML5 drag drop (Aug 2009 edition).
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dmitry Glazkov.
+
+        ScriptState now keeps explicit Handle of devtools front-end
+        utility context instead of trying to retrieve it from inspected
+        Frame.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28772
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::~ScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::context):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::~ScriptValue):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::frontendScriptState):
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Console won't close.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28778
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.isAncestor):
+
+2009-08-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a typo in files() causing image drags to have junk file arrays.
+        https://bugs.webkit.org/show_bug.cgi?id=28755
+
+        Test: editing/pasteboard/files-during-page-drags.html
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::files):
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for Chromium.
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * DerivedSources.cpp: Added JSPageTransitionEvent.cpp to DerivedSources.cpp.
+
+2009-08-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28758
+        <rdar://problem/6440869> Implement pageshow and pagehide events for b/f cache (28758)
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached.html
+               fast/events/pageshow-pagehide-on-back-uncached.html
+               fast/events/pageshow-pagehide.html
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopLoading): Dispatch pagehide event
+        (this function is called both when a document goes away, and when it goes to b/f cache).
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Dispatch pagehide right before unload.
+        (WebCore::DOMWindow::dispatchPageTransitionEvent): Do what it takes to add a new event handler
+        that can be installed on Window object.
+        (WebCore::DOMWindow::onpagehide): Ditto.
+        (WebCore::DOMWindow::setOnpagehide): Ditto.
+        (WebCore::DOMWindow::onpageshow): Ditto.
+        (WebCore::DOMWindow::setOnpageshow): Ditto.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::restore): Dispatch pageshow for a page
+        that isn't being restored from cache.
+
+        * dom/PageTransitionEvent.cpp: Added.
+        (WebCore::PageTransitionEvent::PageTransitionEvent):
+        (WebCore::PageTransitionEvent::~PageTransitionEvent):
+        (WebCore::PageTransitionEvent::initPageTransitionEvent):
+        * dom/PageTransitionEvent.h: Added.
+        (WebCore::PageTransitionEvent::create):
+        (WebCore::PageTransitionEvent::isPageTransitionEvent):
+        (WebCore::PageTransitionEvent::persisted):
+        * dom/PageTransitionEvent.idl: Added.
+        Add event class implementation.
+
+        * html/HTMLBodyElement.cpp: (WebCore::HTMLBodyElement::parseMappedAttribute): Support
+        inline listener definition (note that adding listeners to document.body programmatically
+        is not supported, matching Firefox).
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Dispatch pageshow event right before load event.
+        (WebCore::Document::dispatchPageTransitionEvent): Do what it takes to add a new event for
+        Docuemnt.
+        (WebCore::Document::createEvent): Ditto.
+
+        * dom/Document.h: Added dispatchPageTransitionEvent.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventCustom.cpp: (WebCore::toJS):
+        * dom/Event.cpp: (WebCore::Event::isPageTransitionEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * html/HTMLAttributeNames.in:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Do what it takes to add a new event type.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Adding missing file from previous commit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+
+2009-08-27  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Factor out Factor out summary bar from Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.ResourcesPanel.prototype._changeSortingFunction):
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-08-26  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Start adding heap profiler to Inspector (hidden behind a flag.)
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._snapshotClicked):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js: added Preferences.heapProfilerPresent flag.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar editing is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+
+2009-08-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28767
+
+        Make KURLGoogle.cpp's decodeURLEscapeSequences decode %00 to match
+        KURL.cpp.  This makes the XSSAuditor tests pass when using KURLGoogle.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::decodeURLEscapeSequences):
+
+2009-08-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix, missing functions after r47763.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+2009-08-26  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Removing trailing whitespaces from all storage classes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28075
+
+        * storage/ChangeVersionWrapper.cpp:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseDetails.h:
+        * storage/DatabaseThread.cpp:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        * storage/OriginQuotaManager.cpp:
+        * storage/OriginUsageRecord.cpp:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLError.h:
+        * storage/SQLResultSetRowList.h:
+        * storage/SQLStatement.cpp:
+        * storage/SQLStatement.h:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        * storage/StorageEvent.h:
+        * storage/StorageMap.cpp:
+        * storage/StorageMap.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28763, flickering when opacity changes.
+
+        Make opacity changes from < 1 to 1 and from 1 to < 1 cause a relayout to happen.  We need
+        to do this in order for overflow information to be properly recomputed.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+
+2009-08-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement sometimes loses events
+        https://bugs.webkit.org/show_bug.cgi?id=28762
+        <rdar://problem/7172437>
+
+        A media element triggers the resource selection algorithm if 
+        play() is called when the networkState attribute is NETWORK_EMPTY, but
+        it also immediately queues 'play' and either 'waiting' or 'playing' events.
+        One of the steps in preparing to load is to flush pending events, so those 
+        events were lost if the load timer fired quickly enough. Fixed by deleting
+        pending events before scheduling the load timer.
+
+        Test: media/audio-play-event.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::scheduleLoad):
+            Do nothing if the load timer is already scheduled. Call prepareForLoad so queue of 
+            pending events is flushed immediately.
+        (WebCore::HTMLMediaElement::scheduleNextSourceChild):
+            New, start the load timer without flushing pending events.
+        (WebCore::HTMLMediaElement::load):
+            Call prepareForLoad();
+        (WebCore::HTMLMediaElement::prepareForLoad):
+            New, load setup code moved from loadInternal.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Moved some setup code to prepareForLoad so it can be invoked immediately before
+            arming the load timer.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Call scheduleNextSourceChild instead of scheduleLoad as the later now clears
+            pending events.
+        * html/HTMLMediaElement.h:
+            Declare scheduleNextSourceChild.
+
+2009-08-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Switch ICO decoder from a Vector of raw pointers to a Vector of
+        OwnPtrs now that that is possible.  Makes code slightly simpler.
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectory):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28718, image inside relpositioned inline doesn't paint.
+        Make sure vertical overflow is still computed across self-painting layers, even though it isn't
+        propagated to parents.
+
+        Added fast/repaint/rel-positioned-inline-with-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+
+2009-08-26  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        ResourceRequestBase::*[Aa]llowHTTPCookies shouldn't mention http.
+        https://bugs.webkit.org/show_bug.cgi?id=28735
+
+        Renaming the method to imply its wider implications of affecting cookies
+        over any protocol that supports them.
+
+        No change in functionality so no new tests.
+
+        * WebCore.order:
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        (WebCore::ResourceRequestBase::allowCookies):
+        (WebCore::ResourceRequestBase::setAllowCookies):
+        (WebCore::equalIgnoringHeaderFields):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2009-08-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Made RenderInline::clippedOverflowRectForRepaint() actually include
+        overflow.
+
+        Test: fast/repaint/inline-overflow.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox): Added. Returns
+            the bounding box of all lines’ visible overflow boxes (under the
+            assumption that the first and last lines determine the top and
+            bottom, respectively).
+        (WebCore::RenderInline::clippedOverflowRectForRepaint): Changed to use
+            linesVisibleOverflowBoundingBox() instead of linesBoundingBox().
+        * rendering/RenderInline.h:
+
+2009-08-26  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        minor style correction and include fix for notifications
+        https://bugs.webkit.org/show_bug.cgi?id=28745
+
+        No change in behavior, so no tests.
+
+        * bindings/js/JSDesktopNotificationsCustom.cpp: add include of Error.h
+        * notifications/Notification.cpp: change enum style to InterCaps
+        (WebCore::Notification::Notification):
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+
+2009-08-25  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        postMessage() spec now supports sending arrays of ports
+        https://bugs.webkit.org/show_bug.cgi?id=26902
+
+        Added support for sending multiple ports at once via postMessage(). JS bindings will be updated in an upcoming patch.
+
+        No new tests, since the new functionality is not exposed via new JS bindings yet, so the old tests suffice.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Mark MessagePort.h and MessagePortChannel.h as private since they are used by WebKit now.
+        * dom/MessageEvent.cpp:
+        Updated APIs to support passing MessagePortArrays.
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        (WebCore::MessageEvent::messagePort):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::MessageEvent::ports):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::disentanglePorts):
+        Added new static function to extract a MessagePortChannelArray from a MessagePortArray.
+        (WebCore::MessagePort::entanglePorts):
+        Added new static function to generate a MessagePortArray (entangled ports) from a MessagePortChannelArray.
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        EventData now contains a MessagePortChannelArray field instead of a single MessagePortChannel.
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::channels):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::PostMessageTimer::event):
+        (WebCore::DOMWindow::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        * page/DOMWindow.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::DedicatedWorkerContext::dispatchMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::Worker::dispatchMessage):
+        * workers/Worker.h:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        Updated WorkerObjectProxy and WorkerContextProxy API implementations to support sending multiple MessagePorts.
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+        Updated WorkerObjectProxy and WorkerContextProxy APIs to support sending multiple MessagePorts.
+
+2009-08-26  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        SocketStreamHandle interface for WebSocket API
+        https://bugs.webkit.org/show_bug.cgi?id=28037
+
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj.now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once this code is complete and functional.
+
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/SocketStreamErrorBase.cpp: Added.
+        * platform/network/SocketStreamErrorBase.h: Added.
+        * platform/network/SocketStreamHandleBase.cpp: Added.
+        * platform/network/SocketStreamHandleBase.h: Added.
+        * platform/network/SocketStreamHandleClient.h: Added.
+        * platform/network/cf/SocketStreamError.h: Added.
+        * platform/network/cf/SocketStreamHandle.h: Added.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Added.
+        * platform/network/soup/SocketStreamError.h: Added.
+        * platform/network/soup/SocketStreamHandle.h: Added.
+        * platform/network/soup/SocketStreamHandleSoup.cpp: Added.
+
+2009-08-26  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] setTimeout does not convert non-string argument to string
+        https://bugs.webkit.org/show_bug.cgi?id=28739
+
+        Convert non-string argument to setTimeout to string in the V8
+        bindings.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=28724
+
+        Implement the WebCore side of getOwnPropertyDescriptor.  This
+        requires a custom implementation of getOwnPropertyDescriptor
+        for every class with a custom implementation of getOwnPropertySlot.
+
+        The bindings generator has been updated to generate appropriate
+        versions of getOwnPropertyDescriptor for the general case where
+        a custom getOwnPropertyDescriptor is not needed.  ES5 is vague
+        about how getOwnPropertyDescriptor should work in the context of
+        "host" functions with polymorphic [[GetOwnProperty]], so it seems
+        okay that occasionally we "guess" what attributes -- eg. determining
+        whether a property is writable.
+
+        Test: fast/js/getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::getOwnPropertyDescriptor):
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyDescriptor):
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime_object.h:
+
+2009-08-26  Vincent Untz <vuntz@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        GObject checks for NULL (and not 0) in g_object_get, so use that
+        as we were already doing elsewhere to make the compiler happy.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+
+2009-08-26  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        RenderThemeMac.mm has incorrect casting for media control element.
+        https://bugs.webkit.org/show_bug.cgi?id=28730
+
+        MediaControlMuteButtonElement was incorrectly casted to
+        MediaControlPlayButtonElement. This is corrected in this patch.
+
+        No new tests because this is code cleanup and is already covered by existing
+        media layout tests.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+
+2009-08-26  Robert Sesek  <rsesek@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Multi-value select boxes cannot do non-contiguous selection on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=28670
+
+        Change the condition regarding the key modifier check for non-contiguous
+        selection on a multi-value list from just PLATFORM(MAC) to
+        PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN)).
+
+        No new tests. This patch only changes the condition on which a certain mouse
+        event modifier key is used.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        r47744 causes media/video-controls-with-mutation-event-handler.html to crash
+        https://bugs.webkit.org/show_bug.cgi?id=28732
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+            Don't call setAttribute from the construtor, any registered mutation event 
+            listener will cause a crash.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+            Set the maxAttr here instead of in the constructor.
+
+2009-08-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Timers from cached pages fire instantly rather than the after the specified timeout delay
+        https://bugs.webkit.org/show_bug.cgi?id=28683
+
+        Test: fast/dom/Window/timer-resume-on-navigation-back.html
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore): Remove duplicated Frame::restore() call, since
+            it should be done only once in FrameLoader::open(cachedFrame)
+        * page/DOMTimer.cpp: Added a debug-only flag and ASSERT to catch out-of-order suspense/restore.
+        (WebCore::DOMTimer::DOMTimer): Ditto.
+        (WebCore::DOMTimer::suspend): Ditto.
+        (WebCore::DOMTimer::resume): Ditto.
+        * page/DOMTimer.h: Ditto.
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Setting the volume of a media element has no effect if called too early
+        https://bugs.webkit.org/show_bug.cgi?id=28731
+
+        * manual-tests/audio-volume.html: 
+            Added.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+            Don't bail if metadata hasn't been loaded, it is fine to set rate and/or
+            volume as soon as the movie has been created.
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        DocumentThreadableLoader::getShouldUseCredentialStorage should allow for synchronous callbacks from SubresourceLoader::create.
+        https://bugs.webkit.org/show_bug.cgi?id=28728
+
+        Test: This code path is exercised while running xhr layout tests in chromium.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): When called
+        back synchronously, the loader is 0, so the assert is changed to allow for that.
+        (WebCore::DocumentThreadableLoader::loadRequest): Synchronous callbacks may be
+        done before SubresourceLoader::create finishes, so ensure that any previous loader
+        -- from a preflight request -- is cleared before calling SubresourceLoader::create.
+
+2009-08-25  Mark Rowe  <mrowe@apple.com>
+
+        Stop installing IDL files in to the framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for HTMLInputElement::list and HTMLInputElement::selectedOption.
+        https://bugs.webkit.org/show_bug.cgi?id=27756
+
+        Tests: fast/forms/input-list.html
+               fast/forms/input-selectedoption.html
+
+        * html/HTMLAttributeNames.in:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <video> and <audio> controller should be accessible (edit)
+        https://bugs.webkit.org/show_bug.cgi?id=28081
+
+        Test: accessibility/media-element.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+            Add AccessibilityMediaControls.cpp/.h
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::getOrCreate):
+            Create AccessibilityMediaControl. Update Copyright
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        * accessibility/AccessibilityMediaControls.h:
+            Added.
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+            Add isMediaTimeline. Update Copyright.
+
+        * accessibility/AccessibilitySlider.h:
+            Make constructor protected instead of private so AccessibilityMediaTimeline can
+            call it.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+            Add NSAccessibilityValueDescriptionAttribute to range attributes. 
+        (-[AccessibilityObjectWrapper subrole]):
+            Return NSAccessibilityTimelineSubrole for AccessibilityMediaTimeline.
+
+        * dom/Node.h:
+            add isMediaControlElement.
+
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::localizedMediaControlElementString): 
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription): 
+            New, return localized media controller strings.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+            Move inside of "#if ENABLE(VIDEO)"
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::MediaControlElement):
+            Initialize m_displayType.
+        (WebCore::MediaControlElement::MediaControlElement):
+        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement):
+            Fix style.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Set m_displayType based on pseudo style ID.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            rename local "o" to "object".
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement):
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+            Update for MediaControlInputElement constructor change.
+        (WebCore::MediaControlTimeDisplayElement::formatTime):
+            New, moved here from RenderMedia so AccessibilityMediaTimeDisplay can use it.
+        (WebCore::MediaControlTimeDisplayElement::setCurrentValue):
+            New, set text to current time.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create controls in tab order.
+        (WebCore::RenderMedia::formatTime):
+            Moved to MediaControlTimeDisplayElement::formatTime.
+        (WebCore::RenderMedia::updateTimeDisplay):
+            Call MediaControlTimeDisplayElement::setCurrentValue.
+        * rendering/RenderMedia.h:
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix Canvas layout test failures in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=28720
+
+        The previous fix r47757 does not handle the V8 object conversion correctly.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix compiling errors in Chromium build caused by Canvas3D changes from r47752.
+        https://bugs.webkit.org/show_bug.cgi?id=28717
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Implement media volume slider for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=28715
+
+        Provided the implementation of the volume slider and its container for
+        chromium port. With this change there will be a usable volume control
+        slider for chromium theme.
+
+        No new tests since this is covered by existing media layout tests.
+
+        * css/mediaControlsChromium.css: CSS style for the volume slider.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::mediaSliderThumbImage): Returns the image for slider thumb.
+        (WebCore::mediaVolumeSliderThumbImage): Returns the image for volume slider thumb.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Paints the track with one vertical white line.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Adjusts thumb sizes according to the images.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Paints slider thumb image.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Paints volume slider thumb image.
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Missed checking in 2 Canvas3D files
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSCanvasRenderingContextCustom.cpp: Implements toJS to do proper subclass binding
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp: Argument marshaling for 3D calls
+
+2009-08-25  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Exception from JavaScript propagates to main script
+        https://bugs.webkit.org/show_bug.cgi?id=26433
+
+        Make sure that exceptions thrown both at compile time and at
+        runtime in javascript URLs are isolated from the main script.
+
+        Test: fast/dom/javascript-url-exception-isolation.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Added all new Canvas3D files to the build
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This also hooks up CanvasRenderingContext as the common base class for
+        CanvasRenderingContext2D and CanvasRenderingContext3D. And it adds a bit
+        of logic throughout to support the new CanvasRenderingContext3D object.
+        But nothing is hooked up yet.
+
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore/GNUmakefile.am:
+        * WebCore/WebCore.gypi:
+        * WebCore/WebCoreSources.bkl:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::fillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::markChildren):
+        * dom/Document.cpp:
+        (WebCore::Document::getCSSCanvasContext):
+        * dom/Document.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::willDraw):
+        (WebCore::HTMLCanvasElement::reset):
+        (WebCore::HTMLCanvasElement::paint):
+        (WebCore::HTMLCanvasElement::is3D):
+        (WebCore::HTMLCanvasElement::context3D):
+        (WebCore::HTMLCanvasElement::texture3D):
+        * html/HTMLCanvasElement.h:
+        (WebCore::HTMLCanvasElement::renderingContext):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::~CanvasObject):
+        * html/canvas/CanvasRenderingContext.idl:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
+        * html/canvas/CanvasRenderingContext2D.h:
+        (WebCore::CanvasRenderingContext2D::is2d):
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-08-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION (r47630): fast/repaint/background-generated.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=28704
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Handle SizeNone.
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer): Initialize the size type to SizeNone.
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize): Changed assignment to initialization and
+            removed redundant assignment to size.
+
+2009-08-25  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Skip the NULL check of m_hdc if Windows GDI is not in use.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Media controls panel does not have a volume control slider
+        https://bugs.webkit.org/show_bug.cgi?id=28241
+
+        Introduced "-webkit-media-controls-volume-slider",
+        "-webkit-media-controls-volume-slider-container" and the supporting
+        implementation. Also added appearances of "media-volume-slider" and
+        "media-volume-slider-container".
+
+        The implementation of the controls are in WebCore::MediaControlElements.
+        Logic to trigger the display of the volume controls are in WebCore::RenderMedia.
+
+        No new tests since this change doesn't have theme implementation and the
+        volume slider is disabled by default.
+
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation): Marks that volume slider is vertical.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added corresponding CSS values.
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): ditto.
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto.
+        * css/CSSValueKeywords.in: ditto.
+        * css/mediaControls.css: Makes the volume slider disabled by default.
+        * platform/ThemeTypes.h: Defines theme parts for volume slider and its container.
+        (WebCore::):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement):
+        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement):
+        Adjust the CSS values for "display", "postion", "left" and "top" according to member variables.
+        (WebCore::MediaControlVolumeSliderContainerElement::setVisible): Affects the "display" CSS value.
+        (WebCore::MediaControlVolumeSliderContainerElement::setPosition): Affects the "left" and "top" CSS values.
+        (WebCore::MediaControlVolumeSliderContainerElement::hitTest): Hit testing this element.
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler): Modifies the volume using the slider value, allows dragging.
+        * rendering/MediaControlElements.h:
+        (WebCore::): Added definition for MediaControlVolumeSliderElement and MediaControlVolumeSliderContainerElement.
+        (WebCore::MediaControlVolumeSliderContainerElement::isVisible): Inline getter.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange): Updates styles for volume container and volume slider.
+        (WebCore::RenderMedia::createVolumeSliderContainer): Creates volume slider container and attach to panel.
+        (WebCore::RenderMedia::createVolumeSlider): Creates volume slider and attach to volume slider container.
+        (WebCore::RenderMedia::updateControls): Updates volume container and volume slider.
+        (WebCore::RenderMedia::updateVolumeSliderContainer): Sets the visibility and position of volume slider container and its child.
+        (WebCore::RenderMedia::forwardEvent):
+        Hit testing the volume slider container and volume slider to toggle the visibility and forward events to slider.
+        * rendering/RenderMedia.h:
+        Added definition for RenderMedia::updateVolumeSliderContainer().
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Not implemented.
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::createThumbStyle): Makes volume slider vertical.
+        (WebCore::RenderSlider::thumbRect): ditto.
+        (WebCore::RenderSlider::mouseEventIsInThumb): ditto.
+        (WebCore::RenderSlider::setValueForPosition): ditto.
+        (WebCore::RenderSlider::positionForOffset): ditto.
+        (WebCore::RenderSlider::currentPosition): ditto.
+        (WebCore::RenderSlider::trackSize): ditto.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle): Adjust style for volume slider thumb.
+        (WebCore::RenderTheme::paint): Paints volume control parts using theme.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaVolumeSliderContainer): Naive implementation to be overridden.
+        (WebCore::RenderTheme::paintMediaVolumeSliderTrack): ditto.
+        (WebCore::RenderTheme::paintMediaVolumeSliderThumb): ditto.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::): Constants for volume control parts.
+
+2009-08-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt/Mac] Use CONFIG+=build_all only when building libraries
+
+        If no configuration is specified when building WebKit we pass the
+        debug_and_release option to QMake which results in Makefiles for
+        both configurations being generated.
+
+        Previously we built both of these configurations by default, for
+        all targets (both the QtWebKit framework/dyldlib and the various
+        executables such as QtLauncher and tests). This makes sense for
+        the libraries, which get the _debug suffix and can be loaded on
+        demand by setting the DYLD_IMAGE_SUFFIX, but for executables we
+        ended up building the same executable twice.
+
+        We now only build one instance of each executable, and since this
+        is a developer build we build the debug-version. Passing either
+        --debug or --release to build-webkit will override this, and
+        even in the default case the release version can still be built
+        by running 'make release' in the the build directory of each
+        target.
+
+        * WebCore.pro:
+
+2009-08-25  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28690
+        Build failure in webkitgtk+-1.1.3
+
+        Do not use deprecated function to unref a pixbuf.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix Bug 27827 "[Chromium] Functions Keys don't work in google spreadsheet".
+        <https://bugs.webkit.org/show_bug.cgi?id=27827>.
+
+        Because of the lack of mappings from GDK key-codes to WebKit key-codes,
+        Chromium cannot send valid key-codes to JavaScript when a user types
+        function keys. This change just copies the mappings from 'KeyEventGtk.cpp'.
+
+        To write layout tests for this issue, added mappings from function-key
+        names to platform-specific key-codes to EventSendingController objects
+        so that eventSender.keyDown() can send function-key events without using
+        platform-specific key codes. (Unfortunately, this eventSender.keyDown() change
+        is only for Mac. So this change adds this new test to Skipped tests for other
+        platforms to prevent this change from crashing the build trees.)
+
+        Test: fast/events/keydown-function-keys.html
+
+       * platform/chromium/KeyCodeConversionGtk.cpp: Add mappings from GDK key-codes
+        to WebKit key-code for function keys.
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-08-24  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28698
+        Avoid unnecessary transformations for the window resizer rect.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setFrameRect):
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/7161900> REGRESSION: 100 MB membuster leak on windows due to 47391
+        (DNS prefetching support)
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::prefetchDNS): Use a run loop from secondary
+        thread on Windows, because there isn't one on main one.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28374
+        Cross-scheme requests should not be blocked by appcache rules
+
+        Test: http/tests/appcache/different-scheme.html
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
+        Resources with different schemes can never be loaded from appcache.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28688
+        REGRESSION(r24994): Cannot create a frame with a javascript URL
+
+        Test: http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html
+
+        * bindings/js/JSAttrCustom.cpp: (WebCore::JSAttr::setValue):
+        * bindings/js/JSElementCustom.cpp: (WebCore::allowSettingSrcToJavascriptURL):
+        * bindings/js/JSHTMLFrameElementCustom.cpp: (WebCore::allowSettingJavascriptURL):
+        * bindings/js/JSHTMLIFrameElementCustom.cpp: (WebCore::JSHTMLIFrameElement::setSrc):
+        Omit the checks if there is no document in frame yet.
+
+2009-08-24  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix crash in fast/css/rem-dynamic-scaling.html due to a freed
+        RenderStyle being accessed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28681
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle): Make currentStyle a RefPtr.
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/5743105> Long freezing during loading and selecting text
+        of a large table
+        https://bugs.webkit.org/show_bug.cgi?id=14918
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Added calls to
+            beginDeferredRepaints() and endDeferredRepaints() around the
+            invalidation of the selection, in order to better coalesce multiple
+            invalid rectangles.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Simplify findTreeElement code, get rid of potential infinite loop.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28680
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.getCachedTreeElement):
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (isAncestorNode):
+        ():
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Make sure we use the current FrameView's frame rect when
+        going back to a cached page.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28659
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+
+2009-08-24  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Darin Adler.
+
+        Modifying <text rotate=""> doesn't clear the corresponding SVGAnimatedNumberList
+        https://bugs.webkit.org/show_bug.cgi?id=28673
+
+        Test: svg/dom/text-rotate-live.html
+
+        * svg/SVGNumberList.cpp:
+        (WebCore::SVGNumberList::parse): Clear the list before adding the parsed
+        numbers.
+
+2009-08-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by NOBODY (build fix)
+
+        Turn off ENABLE_3D_CANVAS in the xconfig files.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Only expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        background-size fails to parse if a single length/percentage/auto is followed by a comma
+        https://bugs.webkit.org/show_bug.cgi?id=28674
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillSize): Added an allowComma parameter,
+            which is set to false when this method consumes a comma. Moved
+            handling of 'contain' and 'cover' from parseFillProperty into this
+            method.
+        (WebCore::CSSParser::parseFillProperty): Set allowComma to true before
+            processing the next value, and pass allowComma to parseFillSize.
+        * css/CSSParser.h:
+
+2009-08-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Support for cursors that are images
+        https://bugs.webkit.org/show_bug.cgi?id=28346
+
+        Added support for cursors which are images for CursorGtk. Added
+        a manual test for this.
+
+        * manual-tests/gtk/cursor-image.html: Added.
+        * manual-tests/gtk/resources/redcursor.cur: Added.
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Integrate GStreamer video with the graphics backend
+        https://bugs.webkit.org/show_bug.cgi?id=16356
+
+        Improves GStreamer backend implementation of MediaPlayerPrivate class.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateErrorCallback): Send proper MediaPlayer
+        error for different GStreamer errors to MediaPlayerPrivate.
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Move static
+        initialization boolean to a better place.
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::duration): Return if error occured, do not
+        consider the source as stream if duration query failed.
+        (WebCore::MediaPlayerPrivate::currentTime): Return if error occured, use
+        an early return.
+        (WebCore::MediaPlayerPrivate::seek): Return if error occured.
+        (WebCore::MediaPlayerPrivate::setEndTime): Remove implementation since this
+        function doesn't seem to be used anywhere in WebCore.
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::setRate): Seek to current time when rate is set.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Return if error occured.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytesKnown):
+        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Return if error occured, update
+        after seek ended with a successful change
+        (WebCore::MediaPlayerPrivate::didEnd): Do not pause the playbin when end is reached.
+        (WebCore::MediaPlayerPrivate::loadingFailed): Update network state with the given error.
+        (WebCore::mimeTypeCache): Gather supported mime types from GStreamer.
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen): First step towards fullscreen
+        support.
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Use playbin2 instead of playbin,
+        do not set playbin's audio sink.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func): Use C++ casts, decrease reference count of async
+        queue at the end of the idle function.
+        (webkit_video_sink_render): Increase reference count of async queue.
+        (webkit_video_sink_stop): Remove any idle functions with the sink as data.
+
+2009-08-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Remaining new files for Canvas3D
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added Canvas3D method behind an ifdef
+        * html/canvas/CanvasByteArray.cpp: Added. Efficient array of bytes for passing to GL functions
+        * html/canvas/CanvasByteArray.h: Added.
+        * html/canvas/CanvasByteArray.idl: Added.
+        * html/canvas/CanvasNumberArray.cpp: Added. Efficient array of 32 bit floats for passing to GL functions
+        * html/canvas/CanvasNumberArray.h: Added.
+        * html/canvas/CanvasNumberArray.idl: Added.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate call frames interaction to the InjectedScript-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28408
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleTextMessage):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.get domWindow):
+        (InspectorController.openInInspectedWindow):
+        (InspectorController.getCallFrames):
+        (InspectorController.evaluateInCallFrame):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.openInInspectedWindow):
+        (InjectedScript.getCallFrames):
+        (InjectedScript.evaluateInCallFrame):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype._update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane):
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+        (WebInspector.ScopeVariableTreeElement.prototype.onattach):
+        (WebInspector.ScopeVariableTreeElement.prototype.onexpand):
+        (WebInspector.ScopeVariableTreeElement.prototype.oncollapse):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused.callback):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+
+2009-08-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add support for the placeholder attribute and DOM property of the textarea element.
+        https://bugs.webkit.org/show_bug.cgi?id=21248
+
+        A DOM node for an INPUT element doesn't have a flag for placeholder
+        visibility anymore.  This patch also fixes a bug that a renderer
+        doesn't reflect a corresponding DOM value change.
+
+        Tests: fast/forms/textarea-placeholder-dom-property.html
+               fast/forms/textarea-placeholder-pseudo-style.html
+               fast/forms/textarea-placeholder-set-attribute.html
+               fast/forms/textarea-placeholder-set-value.html
+
+        * css/html.css: Add the default style for placeholder of textarea.
+        * dom/InputElement.cpp: Cleanup for m_placeholderShouldBeVisible removal
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::placeholderShouldBeVisible):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElementData::InputElementData):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::dispatchFocusEvent):
+        (WebCore::HTMLInputElement::dispatchBlurEvent):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::placeholderShouldBeVisible):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextAreaElement::updatePlaceholderVisibility):
+        (WebCore::HTMLTextAreaElement::dispatchFocusEvent):
+        (WebCore::HTMLTextAreaElement::dispatchBlurEvent):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::styleDidChange):
+        (WebCore::RenderTextControl::setInnerTextStyle):
+        (WebCore::RenderTextControl::updatePlaceholderVisibility):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        (WebCore::RenderTextControlMultiLine::updateFromElement):
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        (WebCore::RenderTextControlMultiLine::textBaseStyle):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::textBaseStyle):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::placeholderShouldBeVisible):
+
+2009-08-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Code clean-up and build fix for filters enabled builds. Moved SVGNames.h
+        into #if ENABLE(SVG) for Document.cpp and added SVGNames.h to the other
+        files. They are needed there after r47688.
+
+        * dom/Document.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+
+2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed, build fix for make distcheck on GTK+.
+
+        * GNUmakefile.am: Added files needed for the build.
+        * bindings/js/JSDOMWindowCustom.cpp: Protect SharedWorker include
+        with #if clause.
+        * bindings/js/JSEventTarget.cpp: Dito.
+        * dom/Document.cpp: Dito.
+        * loader/FrameLoader.cpp: Dito.
+
+2009-08-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Throws an Error on "null"
+        https://bugs.webkit.org/show_bug.cgi?id=28665
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+
+2009-08-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: REGRESSION Formatting Function in Console is Abbreviated Too Often
+
+        https://bugs.webkit.org/show_bug.cgi?id=28666
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getProperties):
+        (InjectedScript.createProxyObject):
+
+2009-08-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] BitmapImage::getGdkPixbuf does not handle alpha channels properly
+        https://bugs.webkit.org/show_bug.cgi?id=28345
+
+        When doing the conversion between cairo_surface_t* and GdkPixbuf*
+        account for the differences in the respective formats' in-memory
+        image format.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getCairoSurfacePixel):
+        (WebCore::getGdkPixbufPixel):
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-08-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        
+        Next step: Element, HTMLElement, HTMLAnchorElement, HTMLAppletElement,
+        HTMLAreaElement, HTMLEmbedElement, HTMLFrameElement, HTMLIFrameElement,
+        HTMLObjectElement, HTMLPlugInElement, HTMLPlugInImageElement.
+
+        * DerivedSources.make: Fix error seen every time we build by escaping the $
+        in the build rule, since you have to use $$ for that in make.
+
+        * WebCore.base.exp: Updated.
+
+        * bindings/objc/DOM.mm:
+        Added now-needed include of SVGNames.h.
+
+        * dom/Document.cpp: Added now-needed include of SVGNames.h.
+        (WebCore::Document::createElement): Use create instead of new.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Added ConstructionType argument so the caller
+        can determine whether this starts with a reference count of either 0 or 1.
+        Later we will remove this again once they are all 1.
+        (WebCore::Element::create): Added.
+
+        * dom/Element.h: Added create and made constructor protected.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::StyledElement): Added ConstructionType argument.
+        * dom/StyledElement.h: Made many functions protected or private, including
+        the constructor.
+
+        * dom/make_names.pl: Use create to create the base elements HTMLElement,
+        SVGElement, and WMLElement.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Use create instead of new.
+        * editing/UnlinkCommand.cpp:
+        (WebCore::UnlinkCommand::doApply): Ditto.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::create): Added.
+        * html/HTMLAnchorElement.h: Made constructor protected and added create.
+        Also made m_rootEditableElementForSelectionOnMouseDown a RefPtr.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::create): Added.
+        * html/HTMLAppletElement.h: Made constructor private and added create.
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::create): Added.
+        * html/HTMLAreaElement.h: Made constructor private and added create.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::create): Added.
+        * html/HTMLElement.h: Made constructor protected and added create.
+        Made other functions protected and private. Also added inline
+        definition of constructor.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::create): Added.
+        * html/HTMLEmbedElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::create): Added.
+        (WebCore::HTMLFrameElement::parseMappedAttribute):
+        * html/HTMLFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElementBase.h: Made functions protected and private.
+
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Pass
+        CreateElement so reference count starts at 1.
+
+        * html/HTMLFrameOwnerElement.h: Made functions protected and private.
+
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::create): Added.
+        * html/HTMLIFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::create): Added.
+        (WebCore::HTMLObjectElement::containsJavaApplet): Changed while loop
+        into a for loop and tweaked formatting.
+
+        * html/HTMLObjectElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLPlugInElement.h: Made constructor protected.
+        Made other functions protected and private.
+
+        * html/HTMLPlugInImageElement.h: Made constructor and another function
+        protected.
+
+        * html/HTMLTagNames.in: Removed createWithNew from all classes that
+        now have create functions. Moved conditional noscript to a separate
+        paragraph.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Use create.
+        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
+        * page/DragController.cpp:
+        (WebCore::documentFragmentFromDragData): Ditto.
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::SVGElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::SVGElement::create): Added.
+        * svg/SVGElement.h: Added create, made constructor protected, and
+        made other functions protected and private. Removed unneeded
+        SVGNames.h include.
+
+        * svg/SVGExternalResourcesRequired.h: Added now-needed SVGNames.h
+        include.
+
+        * svg/SVGStopElement.h: Added now-needed SVGNames.h include.
+        Made functions private.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::WMLElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::WMLElement::create): Added.
+        * wml/WMLElement.h: Added create and made constructor protected.
+
+        * wml/WMLTagNames.in: Removed createWithNew from WMLElement.
+
+2009-08-22  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/7161656> Crash in RenderObject::destroy when using custom scrollbars
+
+        Custom scrollbars normally get detached when a document gets detached.  In this case, a crash was happening when the document had gone into the page cache 
+        and then was getting destroyed without proper scrollbar teardown.  This change makes custom scrollbars get detached when the document enters the cache.
+
+        I couldn't figure out a way to reliably cause this to happen in DRT, since the reproducible case relies on the cache being purged at a particular time.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::CachedFrame): Detach custom scrollbars when the CachedFrame is created.  
+          They'll get reattached when the document comes out of the page cache.
+        * page/FrameView.cpp: (WebCore::FrameView::~FrameView): Added some asserts to catch this problem earlier in debug builds.
+
+2009-08-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make sure self-collapsing blocks that clear floats are still able to collapse their bottom margins with
+        the bottom of their parent blocks.  The old code prevented all collapsing, but all CSS2.1 states is that:
+        "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin."
+        
+        The implication is that the bottom margin can still collapse, and the block-inside-inline form of
+        fast/block/margin-collapse/025.html (added as fast/block/margin-collapse/block-inside-inline/025.html) depends
+        on it to get comparable results.
+
+        Added block-inside-inline tests (a whole slew of them) in fast/block/margin-collapse/block-inside-inline/
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::MarginInfo::clearMargin):
+        (WebCore::RenderBlock::MarginInfo::canCollapseBottomWithChildren):
+
+2009-08-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="listitem" and role="list"
+        https://bugs.webkit.org/show_bug.cgi?id=28606
+
+        Test: platform/mac-snowleopard/accessibility/aria-list-and-listitem.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isUnorderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Clean up fill image geometry calculation
+        https://bugs.webkit.org/show_bug.cgi?id=28652
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Renamed
+            calculateBackgroundSize() to this. Replaced separate scaledWidth and
+            scaledHeight parameters with a single scaledSize parameter. Renamed
+            parameters and local variables.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Changed
+            to use CSS3 Backgrounds and Borders terminology in comments and
+            local variable names. Renamed, clarified and consolidated some local
+            variables.
+        * rendering/RenderBoxModelObject.h: Made calculateFillTileSize() private.
+
+2009-08-22  Chris Marrin  <cmarrin@apple.com>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47669
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47671 in preparation of
+        rolling out http://trac.webkit.org/changeset/47669.
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        Build fix, add CanvasRenderingContext to build systems.
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * DerivedSources.make: Added CanvasRenderinContext.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files implementing GL buffer wrappers, and support to make them platform independent
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * html/canvas/CanvasBuffer.cpp: Added. Wrapper around GL Buffer object
+        * html/canvas/CanvasBuffer.h: Added.
+        * html/canvas/CanvasBuffer.idl: Added.
+        * html/canvas/CanvasFramebuffer.cpp: Added. Wrapper around GL Framebuffer object
+        * html/canvas/CanvasFramebuffer.h: Added.
+        * html/canvas/CanvasFramebuffer.idl: Added.
+        * html/canvas/CanvasObject.h: Expose m_context
+        * html/canvas/CanvasProgram.cpp: Added. Wrapper around GL Program object
+        * html/canvas/CanvasProgram.h: Added.
+        * html/canvas/CanvasProgram.idl: Added.
+        * html/canvas/CanvasRenderbuffer.cpp: Added. Wrapper around GL Renderbuffer object
+        * html/canvas/CanvasRenderbuffer.h: Added.
+        * html/canvas/CanvasRenderbuffer.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp: Move m_objects hash table from GraphicsContext3D to here
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasShader.cpp: Added. Wrapper around GL Shader object
+        * html/canvas/CanvasShader.h: Added.
+        * html/canvas/CanvasShader.idl: Added.
+        * html/canvas/CanvasTexture.cpp: Added. Wrapper around GL Texture object
+        * html/canvas/CanvasTexture.h: Added.
+        * html/canvas/CanvasTexture.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Removed.
+        * platform/graphics/GraphicsContext3D.h: Move m_objects hash table from here to CanvasRenderingContext3D
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Implement platform dependent code for GL object creation/destruction
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        * WebCore.vcproj/build-generated-files.sh:
+        * make-generated-sources.sh:
+        Removed obsolete code to set up CREATE_HASH_TABLE.
+
+2009-08-21  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/7162322> Custom style sheet ignored if UAC is enabled 
+
+        * platform/win/SharedBufferWin.cpp: (WebCore::SharedBuffer::createWithContentsOfFile): 
+        No need to open the file with write access.  Only read access is needed.
+
+2009-08-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7161454> Leaks seen during http/tests/xmlhttprequest/cross-origin-no-authorization.html
+
+        Also fixes leaks seen on appcache tests.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::cancel): Work around
+        something that's likely a CFNetwork issue. Note that on Windows, there is no matching API
+        to call, and we do not think that the leak occurs there anyway.
+
+2009-08-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28650
+        Remove cross-thread code from CrossOriginPreflightResultCache.
+        Removed mutexes, atomic initializer and string copy.
+
+        No new tests, the worker tests cover this.
+
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::addToAccessControlAllowList):
+        (WebCore::CrossOriginPreflightResultCache::shared):
+        (WebCore::CrossOriginPreflightResultCache::appendEntry):
+        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
+        (WebCore::CrossOriginPreflightResultCache::empty):
+        * loader/CrossOriginPreflightResultCache.h:
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Buildfix after http://trac.webkit.org/changeset/47655.
+
+        * html/HTMLFormControlElement.h:
+
+2009-08-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+          Removed Custom Bindings
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+
+          Made Non-Custom Bindings in the Backend
+
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+
+          Build the Cookie ScriptObjects, handles using document.cookie in
+          case the platform hasn't implemented raw cookie access.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getCookies):
+        (WebCore::InspectorDOMAgent::buildObjectForCookie):
+        (WebCore::InspectorDOMAgent::buildArrayForCookies):
+        * inspector/InspectorDOMAgent.h:
+
+          Complete the Asynchronous Calls
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetCookies):
+        * inspector/InspectorFrontend.h:
+
+          Asynchronous Functions to get Cookie Data
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.buildCookiesFromString): fallback behavior
+
+          Refactor to use the Asynchronous Functions
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.simpleDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Cleaned/Commented Related Code
+
+        (InspectorController.searchCanceled):
+        * inspector/front-end/InjectedScript.js:
+        * platform/Cookie.h:
+        * English.lproj/localizedStrings.js: the new strings that were supposed to have gone in last time
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28145
+        Add support for novalidate/formnovalidate attribute, from HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#attr-fs-novalidate
+
+        Tests: fast/forms/formnovalidate-attribute.html
+               fast/forms/novalidate-attribute.html
+
+        * html/HTMLAttributeNames.in: added novalidate, formnovalidate
+        * html/HTMLButtonElement.idl: formnovalidate attribute exposed
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::formNoValidate): attribute getter
+        (WebCore::HTMLFormControlElement::setFormNoValidate): attribute setter
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::novalidate): attribute getter
+        (WebCore::HTMLFormElement::setNovalidate): attribute setter
+        * html/HTMLFormElement.h:
+        * html/HTMLFormElement.idl: novalidate attribute exposed
+        * html/HTMLInputElement.idl: formNoValidate attribute exposed
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Rendering changes to complete
+        [CSS3 Backgrounds and Borders] Add support for the "contain" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27573
+        and
+        [CSS3 Backgrounds and Borders] Add support for the "cover" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27574
+
+        Test: fast/backgrounds/size/contain-and-cover.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27452
+        Add support for checkValidity() method and invalid event, from HTML5
+        specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-form-checkvalidity
+
+        Tests: fast/events/invalid-001.html
+               fast/events/invalid-002.html
+               fast/events/invalid-003.html
+               fast/events/invalid-004.html
+               fast/events/invalid-005.html
+               fast/forms/checkValidity-001.html
+               fast/forms/checkValidity-002.html
+               fast/forms/checkValidity-003.html
+               fast/forms/checkValidity-004.html
+
+        * dom/Document.idl: oninvalid event handler
+        * dom/Element.idl: ditto
+        * dom/EventNames.h: added invalid event
+        * dom/Node.cpp:
+        (WebCore::Node::oninvalid): ditto
+        (WebCore::Node::setOninvalid): ditto
+        * dom/Node.h: ditto
+        * html/HTMLAttributeNames.in: oninvalid attribute
+        * html/HTMLButtonElement.idl: added checkValidity() method
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute): parses oninvalid
+        * html/HTMLFieldSetElement.idl: added checkValidity() method
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity): checkValidity()
+        implementation
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::checkValidity): checkValidity() implementation
+        for form elements
+        * html/HTMLFormElement.h: checkValidity() definition
+        * html/HTMLFormElement.idl: added checkValidity() method
+        * html/HTMLInputElement.idl: added checkValidity() method
+        * html/HTMLSelectElement.idl: added checkValidity() method
+        * html/HTMLTextAreaElement.idl: added checkValidity() method
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::oninvalid): oninvalid event handler
+        (WebCore::DOMWindow::setOninvalid): ditto
+        * page/DOMWindow.h: ditto
+        * page/DOMWindow.idl: ditto
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27571 [CSS3 
+        Backgrounds and Borders] Add support for the "round" value for 
+        background-repeat
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27570 [CSS3 Backgrounds and 
+        Borders] Add support for the "space" value for background-repeat
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+        * css/CSSValueKeywords.in:
+        * rendering/style/FillLayer.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files for Canvas 3D feature
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This is all the new files for implementing Canvas 3D. None of them are hooked up and
+        are not even included in the build yet. This incorporates the reviews from Simon
+        and Ollie for these files.
+
+        * bindings/js/JSCanvasNumberArrayCustom.cpp: Added. Custom JS binding to do implicit conversion from JS Array
+        * html/CanvasObject.cpp: Added. Base class for all GL object containers
+        * html/CanvasObject.h: Added.
+        * html/CanvasRenderingContext.cpp: Added. Base class for CanvasRenderingContext2D and CanvasRenderingContext3D
+        * html/CanvasRenderingContext.h: Added.
+        * html/CanvasRenderingContext.idl: Added.
+        * html/CanvasRenderingContext3D.cpp: Added. 3D context returned from Canvas.getContext()
+        * html/CanvasRenderingContext3D.h: Added.
+        * html/CanvasRenderingContext3D.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Added. Platform interface between CanvasRenderingContext3D and 3D graphics engine
+        * platform/graphics/GraphicsContext3D.h: Added.
+        * platform/graphics/mac/Canvas3DLayer.h: Added. CALayer subclass to composite 3D canvas
+        * platform/graphics/mac/Canvas3DLayer.mm: Added.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Added. Mac specific interface (OpenGL based)
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Another Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::diffTextDecorations):
+
+2009-08-21  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28625, focus rings don't respect the non-strict mode
+        line box shrinking quirk.  Make sure outlines don't extend outside the lineTop and lineBottom
+        of the root line box.
+
+        Covered by existing tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::setTextDecorationProperty): Made it static
+        (WebCore::diffTextDecorations): Made it static
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand("Underline") uses CSS even when styleWithCSS has been turned off
+        https://bugs.webkit.org/show_bug.cgi?id=23892
+
+        This patch adds support for u and s in StyleChange and addInlineStyleIfNeeded so that
+        WebKit does not use CSS to decorate texts when styleWithCSS is set to false.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::copy): Added.
+        * css/CSSValueList.h: Added copy.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::applyUnderline):
+        (WebCore::StyleChange::applyLineThrough):
+        (WebCore::StyleChange::StyleChange): Added a boolean trimTextDecorations argument.
+        (WebCore::StyleChange::init): Ditto.
+        (WebCore::StyleChange::extractTextStyles): Handles text decorations.
+        (WebCore::getPropertiesNotInComputedStyle): Handles text decorations properly.
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Adds u and s if needed.
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Rename "Databases" Panel as "Storage"
+        https://bugs.webkit.org/show_bug.cgi?id=28620
+
+          Updated enum from "DatabasesPanel" to "StoragePanel" and wherever it was used.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName): string to display StoragePanel can be either "databases" or "storage"
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+          Updated All Direct Access from WebInspector.panels.databases to WebInspector.panels.storage,
+          any DatabasesPanel constructors and appropriate function names.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): updated string that comes from hiddenPanels to be "databases" or "storage"
+        (WebInspector.showStoragePanel):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.addDatabase):
+        (WebInspector.addDOMStorage):
+
+          Renamed some files and Updated Accordingly.
+
+        * inspector/front-end/StoragePanel.js: Renamed from WebCore/inspector/front-end/DatabasesPanel.js.
+        * inspector/front-end/Images/storageIcon.png: Renamed from WebCore/inspector/front-end/Images/databasesIcon.png.
+        * inspector/front-end/WebKit.qrc: use new file names
+        * inspector/front-end/inspector.css: use new images name and class names
+        * inspector/front-end/inspector.html: use new file name
+        * WebCore.gypi: use new file names
+
+          Miscellaneous Updates.
+
+        * English.lproj/localizedStrings.js: Updated Tooltip from "Databases" to "Storage"
+
+2009-08-21  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCacheHaiku.cpp, FontHaiku.cpp, and SimpleFontDataHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCacheHaiku.cpp: Added.
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::createFontPlatformData):
+        (WebCore::FontCache::getTraitsInFamily):
+        * platform/graphics/haiku/FontHaiku.cpp: Added.
+        (charUnicodeToUTF8HACK):
+        (WebCore::Font::canReturnFallbackFontsForComplexText):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Added.
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-08-21  Philippe Beauchamp  <philippe.beauchamp@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Middle click panning icon is offset by 3 pixels
+        https://bugs.webkit.org/show_bug.cgi?id=28611
+
+        * platform/ScrollView.cpp:
+        panIconSizeLength initialized to 20 instead of 16 to match icon dimension (2 pixels offset)
+        * platform/win/CursorWin.cpp:
+        (WebCore::middlePanningCursor):
+        Hotspot initialized to (8,8) instead of (7,7) (one pixel offset)
+        
+2009-08-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove inspector resources for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=28610
+
+        Based on an idea from Simon Hausmann.
+
+        * WebCore.pro:
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Inspector: Remove Unused Variable
+        https://bugs.webkit.org/show_bug.cgi?id=28616
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._checkWarning):
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Array Formatter Shows Extra Properties
+        https://bugs.webkit.org/show_bug.cgi?id=28615
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray): do not ignore hasOwnProperties
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27574 [CSS3 
+        Backgrounds and Borders] Add support for the "contain" value for 
+        background-size
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27573 [CSS3 Backgrounds and 
+        Borders] Add support for the "cover" value for background-size
+
+        Return contain or cover when appropriate, and otherwise do what we 
+        used to do.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Accept contain and cover as valid values for background-size.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+
+        Handle setting the size and the sizeLength if appropriate.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapFillSize):
+
+        Added new keywords contain and cover.
+        * css/CSSValueKeywords.in:
+
+        Use just sizeLength instead of size to match old behavior.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+        The variable m_sizeType is an EBackgroundSize, and m_sizeLength is 
+        a LengthSize (the equivalent of what m_size used to be). I got rid 
+        of m_sizeSet and made isSizeSet() dynamic. I also defined a new 
+        struct, FillSize that can be used to set or get m_size and 
+        m_sizeLength both at once. 
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize):
+        (WebCore::FillSize::operator==):
+        (WebCore::FillSize::operator!=):
+        (WebCore::FillLayer::sizeLength):
+        (WebCore::FillLayer::size):
+        (WebCore::FillLayer::isSizeSet):
+        (WebCore::FillLayer::setSizeType):
+        (WebCore::FillLayer::setSizeLength):
+        (WebCore::FillLayer::setSize):
+        (WebCore::FillLayer::clearSize):
+        (WebCore::FillLayer::initialFillSizeType):
+        (WebCore::FillLayer::initialFillSizeLength):
+        (WebCore::FillLayer::initialFillSize):
+
+        This is all boiler-plate stuff to adjust to the new size() vs. 
+        sizeType() vs. sizeLength() distinction.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundSizeType):
+        (WebCore::InheritedFlags::backgroundSizeLength):
+        (WebCore::InheritedFlags::maskSize):
+        (WebCore::InheritedFlags::setBackgroundSize):
+        (WebCore::InheritedFlags::setBackgroundSizeLength):
+        (WebCore::InheritedFlags::setMaskSize):
+
+        Definition for EBackgroundSizeType.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47580.
+
+        [Qt] Adjust the files.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Enable various "grouping" ARIA roles
+        https://bugs.webkit.org/show_bug.cgi?id=28486
+
+        Test: platform/mac/accessibility/aria-grouping-roles.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Unreviewed trivial comment fix.
+
+        Update a bug link in a comment due to bugzilla amnesia.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setResourceToRevalidate):
+
+2009-08-20  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        HTML5 media elements do not fire waiting events correctly
+        https://bugs.webkit.org/show_bug.cgi?id=28335
+
+        Fire the waiting event before seeking, and fix a case where firing of
+        the seeked event is missed when the ready state is changed during
+        a seek.
+
+        Added video-waiting-seeking.html into manual tests because not
+        all platforms allow seeking into non-buffered ranges.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): add support for
+        waiting event when seeking.
+        (WebCore::HTMLMediaElement::finishSeek): send seeked event
+        whenever seeking finishes.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): dispatch to
+        new function.
+        * html/HTMLMediaElement.h:
+        * manual-tests/video-waiting-seeking.html: Added.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fix more cases of
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        If the border box is empty, simply avoid painting instead of trying to
+        clip to the empty path.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-08-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix.  Forgot a svn add for a patch I landed.  :-(
+
+        * storage/SQLTransactionClient.cpp: Added.
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=24793>
+        Auto scroll speed is faster than in IE, Firefox.
+        
+        Changed pan scrolling speed to match Firefox's algorithm.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::adjustedScrollDelta):
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for assert in Chromium page cycler:  drawRect() was re-using
+        an SkPaint, but not resetting it before calling
+        PlatformGraphicsSkia::setupPaintForFilling() a second time.  This
+        CL fixes drawRect(), and re-enables the assert.
+        http://bugs.webkit.org/show_bug.cgi?id=28172
+        http://crbug.com/19797
+
+        Covered by Chromium page cycler tests.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7159016> Popup menus don't disappear when you click outside the window.
+        
+        Revert r47535 which introduced this.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupWndProc):
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crashes on sites with lots of images
+        https://bugs.webkit.org/show_bug.cgi?id=28473
+
+        The problem is that m_resourceToRevalidate::m_isBeingRevalidated is false while
+        CachedResource is still referring to it, so it may get deleted before
+        Cache::revalidationSucceeded calls CachedResource::clearResourceToRevalidate.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource): Added assert to verify the resource
+        being revalidated is physically in the cache.
+        (WebCore::Cache::revalidationSucceeded): Changed to do one call to switch from the revalidating
+        resource to the revalidated resource.  This allows for proper lifetime management of the
+        revalidated resource. Added assert to verify that the revalidatingResource is in the cache.
+        (WebCore::Cache::pruneDeadResources): Don't remove items from the cache that are in the
+        process of being validated (or else they can get added twice: Once through the normal mechanism
+        and then again during revalidateResource).
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::isSafeToMakePurgeable):
+        Changed m_isBeingRevalidated to m_proxyResource to allow finding out
+        who the validating resource (or proxy) is.
+
+        (WebCore::CachedResource::~CachedResource): Removed code to handle m_resourceToRevalidate
+        being non-zero because this shouldn't be possible due to checks in canDelete. Added asserts
+        as well.
+        (WebCore::CachedResource::setResourceToRevalidate): Adjusted for the change to m_proxyResource
+        and added a comment about the assert.
+        (WebCore::CachedResource::clearResourceToRevalidate):
+        Only clean up the resourceToRevalidate if it hasn't gotten a new proxy resource.
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::setInCache): Don't clear m_proxyResource because the resource
+        is still being referred to by it and the code it robust to this being switched to a new proxy
+        resource without it being cleared first.
+        (WebCore::CachedResource::canDelete): Changed m_isBeingRevalidated to m_proxyResource.
+
+2009-08-20  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix "Chromium RTL autocomplete popup is not layout correctly".
+        https://bugs.webkit.org/show_bug.cgi?id=27889
+
+        The complete fix of the issue consists 2 parts: the patch in webkit
+        and the patch in Chromium's own code.
+
+        This webkit patch only affects Chromium autofill. It
+        1. introduces a new flag in WebCore::PopupContainerSettings to
+           distinguish whether the width of the drop-down should be restricted
+           or not.
+           For autofill, the width of the drop-down is restricted to
+           be the same as that of the input field (the new flag is set in
+           Chromium's own code). But width is not restricted for <select> (same as before).
+        2. introduce a new flag in WebCore::PopContainerSettings to
+           indicate what heuristics to use when displaying text in drop-down menu.
+           For autofill, use drop-down item's directionality to display drop-down items.
+           Previously, drop-down item is displayed in the its first strong
+           directional character's directionality.
+           (drop-down item's directionality is set in Chromium's own code.
+           It is set the same as the directionality of the element. 
+           For autofill, it is the same directionality as that of the input field.)
+           For <select>, still use the text's first strong directional character's
+           directionality to display the text.
+
+
+        Since the patch only affects the chromium client, not webcore part or
+        other clients. No automatic tests is possible.
+
+        * manual-tests/autofill-popup-width-and-item-direction.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupListBox::paintRow): If list box width is restricted and 
+        an item is longer to fit in a list box, truncate it and draw part of the text and append ellipses.
+        (WebCore::PopupListBox::layout): Restrict width of list box if applicable.
+        * platform/chromium/PopupMenuChromium.h: 
+        (WebCore::PopupItem::PopupItem): style change.
+        (WebCore::PopupContainerSettings::): Add 2 new flags in PopupContainerSetting to 
+        distinguish whether to restrict width of list box and 
+        in what directionality to display the text in drop-down.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28504>. 
+        Pan Scrolling can scroll while showing the middlePanScroll icon.
+        
+        Fixed an off by one error between RenderLayer::panScrollFromPoint and EventHandler::updatePanScrollState. 
+        In RenderLayer::panScrollFromPoint, we were setting the icon to be an arrow if the difference between the start
+        of the pan scroll and the current mouseposition is > 15. However, in EventHandler::updatePanScrollState, we would
+        set our amount to scroll to 0 only if the difference in mouse position is < 15. I made this check a <= 15, to fix
+        the off by one error.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Pull the code in layoutBlockChildren for handling a normal flow block child into a helper method,
+        layoutBlockChild.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutBlockChild):
+        * rendering/RenderBlock.h:
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Made subframeForHitTargetNode a public static method, so WebView can call it
+        during hit testing.
+
+        * page/EventHandler.cpp:
+        (WebCore::subframeForHitTestResult):
+        (WebCore::EventHandler::subframeForTargetNode):
+        * page/EventHandler.h:
+
+2009-08-20  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubberstamped by Kevin Ollivier.
+
+        Check for null bundle before attempting to use it.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath): Add null check on return of
+          CFBundleGetBundleWithIdentifier.
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28497, images and inline replaced elements don't propagate overflow properly on a line.
+
+        Added fast/repaint/inline-block-overflow.html and updated another test.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        Make sure to still propagate the border box of the replaced element as layout overflow when overflow clip is set on the
+        replaced element.  Make sure to use the InlineBox x/y positions instead of the RenderBox x/y, since the position of the
+        RenderBox has not been updated to the new values yet.
+        
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        Don't use the root line box's overflow.  Use the actual line box overflow values instead.  In the case of an inline
+        with a layer, our overflow didn't propagate to the root line, so we always need to use our values.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        Make sure to clear shadow overflow when doing layout of replaced elements, so that we don't leave a stale overflow
+        value around if a box-shadow goes away.
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Another attempt to fix Chromium build.
+
+        * WebCore.gypi: now use the correct name of the image file.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Make the Windows build even fixeder
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        * WebCore.gypi: add new Webinspector image files (localStorage.png and sessionStorage.png)
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Windows build fix after the last change
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        (WebCore::GraphicsContext::drawWindowsBitmap):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace many manually-released CFTypeRefs with RetainPtrs
+        https://bugs.webkit.org/show_bug.cgi?id=28498
+
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::createCGColor):
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+        (WebCore::ImageSource::isSizeAvailable):
+        (WebCore::ImageSource::frameSizeAtIndex):
+        (WebCore::ImageSource::repetitionCount):
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameDurationAtIndex):
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::createScratchContext):
+        (WebCore::Path::contains):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/ImageMac.mm:
+        (WebCore::BitmapImage::getTIFFRepresentation):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::cocoaTypeFromMIMEType):
+        (WebCore::MIMETypeFromCocoaType):
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (stringEncodingForResource):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream):
+        (WebCore::setHTTPBody):
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::encode):
+
+2009-08-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Output actual values of counters in showTree
+        https://bugs.webkit.org/show_bug.cgi?id=28481
+
+        No new tests because this patch just improves debugging outputs.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Add file missed in last check-in.
+
+        * html/HTMLAttributeNames.in:
+
+2009-08-19  Timothy Hatcher  <timothy@apple.com>
+
+        Adds new icons to the Web Inspector for Local Storage,
+        Session Storage and Cookies.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28470
+
+        Reviewed by Eric Seidel.
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
+        (WebInspector.DOMStorageSidebarTreeElement):
+        * inspector/front-end/Images/cookie.png:
+        * inspector/front-end/Images/domStorage.png: Removed.
+        * inspector/front-end/Images/localStorage.png: Added.
+        * inspector/front-end/Images/sessionStorage.png: Added.
+        * inspector/front-end/inspector.css:
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        HTML5 media elements must fire 'loadend' progress event
+        https://bugs.webkit.org/show_bug.cgi?id=28419
+
+        * dom/EventNames.h:
+            Define loadend.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onloadend.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Post 'loadend' immediately after 'abort'.
+        (WebCore::HTMLMediaElement::noneSupported):
+            Post 'loadend' immediately after 'error'.
+        (WebCore::HTMLMediaElement::mediaEngineError):
+            Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Post 'loadend' immediately after 'load'.
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Post 'loadend' immediately after 'abort'.
+
+2009-08-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
+        https://bugs.webkit.org/show_bug.cgi?id=28474
+
+        This patch fixes a crash when indenting at right after a table.
+        The bug was caused by Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
+        where node() is equal to blockNode. Because blockNode is the enclosing block node, this patch changes it to
+        enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
+
+        Test: editing/execCommand/indent-right-after-table.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Fixed so that blockNode != endOfCurrentParagraph.deepEquivalent().node()
+
+2009-08-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Render disabled mute button during an error or if no audio is present.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28475
+
+        Covered by existing layout tests:
+        media/video-controls-visible-audio-only.html
+        media/video-no-audio.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7154605> Loading page with 1px wide <select> makes the
+        toolbar go blank
+        and
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Return early
+        if the rectangle is empty. Use RenderStyle::getBorderRadiiForRect() to
+        adjust the radii in case the sides of the rectangle are smaller than sum
+        of the radii, so that the gradient background matches the border (which
+        already uses getBorderRadiiForRect()). Check if bottomGradient is empty
+        to avoid clipping to an empty path.
+        (WebCore::RenderThemeMac::paintMenuListButton): Moved a
+        GraphicContext::save() down to avoid a save/restore imbalance in the
+        early return case.
+
+        * rendering/RenderThemeSafari.cpp: Made the same changes.
+        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk][REGRESSION] XHR test failures after r45558
+        https://bugs.webkit.org/show_bug.cgi?id=27143
+
+        Disable sniffing if it's explicitly requested. Updated patch
+        originally by Gustavo Noronha.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::statusWillBeHandledBySoup):
+        (WebCore::gotHeadersCallback):
+        (WebCore::contentSniffedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::startHttp):
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Swap the pixels since QImage expect ARGB while ImageData
+        stores them as RGBA.
+
+        This fixes the fast/canvas/canvas-copyPixels.html test.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+
+2009-08-20  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by David Levin.
+
+        [v8] Use atomic string caching for createElement
+        Extend atomic string caching to createElement.  Fix a bug in idl
+        parser that caused incorrect parsing if a function argument
+        attribute list contained a comma.
+        https://bugs.webkit.org/show_bug.cgi?id=28449
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToAtomicWebCoreStringWithNullCheck):
+        * dom/Document.idl:
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47515.
+
+        [Qt] There is no Phonon::MediaObject::hasAudio() function.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio): Assume true.
+
+2009-08-20  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28483
+        The V8 ScriptController's cleanupScriptObjectsForPlugin should take a
+        Widget* instead of void* to avoid the need for manual casting to Widget*
+        at the callsite.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
+        * bindings/v8/ScriptController.h:
+
+2009-08-19  David Levin  <levin@chromium.org>
+
+        Unreviewed speculative build fix for qt.
+
+        * page/OriginAccessEntry.cpp:
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        Tests: http/tests/xmlhttprequest/origin-whitelisting-all.html
+               http/tests/xmlhttprequest/origin-whitelisting-exact-match.html
+               http/tests/xmlhttprequest/origin-whitelisting-https.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html
+               http/tests/xmlhttprequest/origin-whitelisting-subdomains.html
+
+        * WebCore.base.exp: Export methods to manipulate origin access whitelists to enable
+        testing via layout tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Add OriginAccessEntry.*
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCoreSources.blk: Ditto.
+
+        * page/SecurityOrigin.h: Implement origin access whitelists.
+        (WebCore::originAccessMap): Static getter for access whitelists.
+        (WebCore::SecurityOrigin::canRequest): Modify request checking logic to check whitelists.
+        (WebCore::SecurityOrigin::whiteListAccessFromOrigin): Add an entry to a whitelist.
+        (WebCore::SecurityOrigin::resetOriginAccessWhiteLists): Clear all the whitelists.
+
+        * page/OriginAccessEntry.h: Added. An entry in an origin access whitelist.
+        * page/OriginAccessEntry.cpp: Ditto.
+
+2009-08-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-precomp headers build fix.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+
+2009-08-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Disable a bad SKIA assert
+        https://bugs.webkit.org/show_bug.cgi?id=28482
+
+        In http://trac.webkit.org/changeset/47386/ an assert was "fixed" in SKIA code. 
+        When this was pulled into Chromium, it started breaking the page cycler. 
+        Disable it again until we can figure out what's going on.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        queryCommandState('underline') returns false if the selected text is also bold and italic
+        https://bugs.webkit.org/show_bug.cgi?id=11022
+
+        This patch modifies stateStrikethrough and stateUnderline to use the value -webkit-text-decorations-in-effect
+        instead of text-decoration.  Because text-decoration only retrieves explicit styling at the node on which
+        the query was sent, we need to use -webkit-text-decorations-in-effect to include decorations added by ancestors
+        and also u, s, and strike tags.
+
+        Test: editing/style/text-decoration-state.html
+
+        * editing/EditorCommand.cpp:
+        (WebCore::stateStrikethrough): Use -webkit-test-decorations-in-effect instead of text-decoration.
+        (WebCore::stateUnderline): Ditto.
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - Fix <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Pass SWP_NOACTIVATE to SetWindowPos, remove AW_ACTIVATE from AnimateWindow and pass
+        SW_SHOWNOACTIVATE to ShowWindow.
+        
+        (WebCore::PopupWndProc):
+        Prevent mouse activation from activating the window.
+
+2009-08-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Images flash as you hover them on http://www.atebits.com/scribbles/
+        <rdar://problem/7143958>
+        
+        Tag images with the device colorspace with the colorspace of the main display, rather than
+        GenericRGB, so that composited images color-match those rendered via Core Graphics.
+        
+        Covered by LayoutTests/compositing/color-matching/image-color-matching.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152589> Stylable scrollbar corners aren't working.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        Initialize m_scrollCorner.
+
+        (WebCore::FrameView::~FrameView):
+        Assert that m_scrollCorner is null.
+
+        (WebCore::FrameView::detachCustomScrollbars):
+        Destroy m_scrollCorner.
+
+        (WebCore::FrameView::invalidateScrollCorner):
+        Invalidate the scroll corner.
+        
+        (WebCore::FrameView::updateScrollCorner):
+        Create/destroy the scroll corner.
+        
+        (WebCore::FrameView::paintScrollCorner):
+        Paint the scroll corner.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::isFrameViewScrollCorner):
+        Return whether a RenderScrollbarPart is the frame view scroll corner.
+        
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        Go ahead and update the scroll corner.
+        
+        (WebCore::ScrollView::setScrollbarsSuppressed):
+        Pass the scroll corner rect to invalidateRect.
+        
+        (WebCore::ScrollView::scrollCornerRect):
+        Return the scroll corner rect.
+        
+        * platform/ScrollView.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::imageChanged):
+        If this scrollbar part is the frame view scroll corner, invalidate it.
+
+2009-08-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feComponentTransfer needs to be implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=27768]
+
+        Implementation of SVG Filter feComponentTransfer.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-comptran-01-b.svg
+
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        (WebCore::FEComponentTransfer::apply):
+
+2009-08-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/7141522> Incorrect layout of product table at henry.com
+
+        Test: fast/block/basic/quirk-percent-height-table-cell.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcPercentageHeight): Tweak the quirk that allows
+        percentage-height children of auto-height blocks to look for an ancestor
+        with non-auto height and compute their height based on it. The change is
+        that if that ancestor is a table cell, it is ignored and the percent
+        height computes to zero (just like in strict mode). This matches Firefox
+        and IE.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add 'icu::' qualifier when refering to ICU C++ names to the other
+        file with this issue missed in the previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::):
+
+2009-08-19  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix for Skia).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] Remove setFont indirection
+        https://bugs.webkit.org/show_bug.cgi?id=28453
+
+        Remove the indirection and just set the font in Font::drawGlyphs.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/gtk/FontPlatformData.h:
+        (WebCore::FontPlatformData::scaledFont):
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: When adding style selector, generate default name based
+        on id / class / type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28468
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Rename combinedOverflow to visibleOverflow, since that's what it actually represents.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::topvisibleOverflow):
+        (WebCore::InlineFlowBox::bottomvisibleOverflow):
+        (WebCore::InlineFlowBox::leftvisibleOverflow):
+        (WebCore::InlineFlowBox::rightvisibleOverflow):
+        (WebCore::InlineFlowBox::visibleOverflowRect):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::visibleOverflowRect):
+        (WebCore::RenderBox::topvisibleOverflow):
+        (WebCore::RenderBox::bottomvisibleOverflow):
+        (WebCore::RenderBox::leftvisibleOverflow):
+        (WebCore::RenderBox::rightvisibleOverflow):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderOverflow.h:
+        (WebCore::RenderOverflow::visibleOverflowRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+
+2009-08-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Sound button appears in controller with movies that have no audio
+        https://bugs.webkit.org/show_bug.cgi?id=28464
+
+        Test: media/video-no-audio.html
+
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayer::hasVideo):
+            Make const.
+        (WebCore::MediaPlayer::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayerPrivate.h:
+            Add hasAudio.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/QTMovieWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasAudio):
+            Ditto.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlMuteButtonElement::disabled):
+            New, return true if media element doesn't have audio.
+        (WebCore::MediaControlMuteButtonElement::rendererIsNeeded):
+            Renderer is not needed if element has no audio.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlInputElement::disabled):
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::getMediaUIPartStateFlags):
+            Return MediaUIPartDisabledFlag if node is disabled.
+            
+
+2009-08-19  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Removed the two unnecessary overridden willValidate() methods introduced
+        in r47444.
+
+        * html/HTMLKeygenElement.h:
+        * html/HTMLObjectElement.h:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Allow dumping dangling nodes to the console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28458
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::releaseDanglingNodes):
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::bind):
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDetachedRoot):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        (WebInspector.setDetachedRoot):
+        (WebInspector.childNodeCountUpdated):
+        (InspectorController.pushNodeToFrontend):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+
+2009-08-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27464
+        Implement application cache online whitelist wildcard flag
+
+        Test: http/tests/appcache/whitelist-wildcard.html
+
+        A "*" in NETWORK section means that network loading needn't be blocked.
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::isURLInOnlineWhitelist):
+        * loader/appcache/ApplicationCache.h:
+        (WebCore::ApplicationCache::setAllowsAllNetworkRequests):
+        (WebCore::ApplicationCache::allowsAllNetworkRequests):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::openDatabase):
+        (WebCore::ApplicationCacheStorage::store):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * loader/appcache/ManifestParser.h:
+
+2009-08-19  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/7042555> Loading certain pages on Tiger will start a spurious download
+        
+        Get rid of method swizzling entirely. This created problems when lower level
+        Foundation code would call into our own swizzled method.
+        
+        * platform/network/mac/ResourceHandleMac.mm: 
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): 
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (-[NSURLResponse adjustMIMETypeIfNecessary]):
+
+2009-08-19  Adam Roben  <aroben@apple.com>
+
+        Fix linker warnings on Windows
+
+        Reviewed by Anders Carlsson.
+
+        Fixes <http://webkit.org/b/28462> WebCore causes linker warnings on
+        Windows about multiply-defined JSHTMLDataListElement symbols
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude JSHTMLDataListElement.cpp
+        from the build (just like we do for the other generated bindings
+        files) so that we don't get warnings about multiply-defined symbols in
+        JSHTMLDataListElement.cpp and DerivedSources.cpp. Also removed
+        duplicate versions of JSSVGElementWrapperFactory.cpp, and let VS
+        reorder a few files.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Add 'icu::' qualifier when refering to ICU C++ names.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::fontContainsCharacter):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Cleanup from my patch thet rewrote overflow.  Remove unused member variables from RenderTableSection and
+        move the addition of overflow from children into a separate pass after the height of the section has been
+        set.  This prevents the RenderOverflow struct from being aggressively allocated for all table sections.
+        (Not a a correctness issue, just a memory issue.)
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Remove bogus dependency rules for built sources that derive
+        from HTMLTagNames.in, HTMLAttributeNames.in and xmlattrs.in. The
+        header files should be generated regardless of whether the source
+        file changed or not. We should only rely on the *.in files being
+        changed.
+
+        * GNUmakefile.am:
+
+2009-08-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        convert FormatBlock candidate tag list from if chain to hash lookup
+        https://bugs.webkit.org/show_bug.cgi?id=28448
+
+        No behavior change, just cleanup.
+
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * editing/htmlediting.h:
+
+2009-08-19  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update GraphicsContextSkia's version of drawLine to make use of the shared
+        adjustLineToPixelBoundaries function and elimination overlapping code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-18  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::setLineDash):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28446
+        Custom request headers shouldn't be sent with cross-origin preflight request
+
+        Tests: http/tests/xmlhttprequest/access-control-preflight-headers-async.html
+               http/tests/xmlhttprequest/access-control-preflight-headers-sync.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        Don't copy headers to OPTIONS request. The spec is vague about this, but the intention was
+        that they shouldn't be sent, and Firefox doesn't send them.
+
+2009-08-18  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 Bindings for Desktop Notifications feature.
+        https://bugs.webkit.org/show_bug.cgi?id=28271
+
+        * WebCore.gypi: 
+        added notification files to build (all still behind a flag that's not on)
+        * bindings/scripts/CodeGeneratorV8.pm:
+        added special case in DOMWindow/AppCache style for named event handlers
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp: Added.
+        * notifications/Notification.h:
+        made event handler routines public (as they are in DOMWindow, eg) for
+        binding access.
+        * notifications/NotificationCenter.idl:
+        needed to make methods V8Custom to support different behaviors in 
+        worker/page context in chromium. 
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+        needed to make these methods public as well so chromium can inject
+        the notification presenter into the worker thread.
+
+2009-08-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Implement HTML5 nav element
+        https://bugs.webkit.org/show_bug.cgi?id=27937
+
+        <nav> should behave essentially the same as <div> for parsing
+        etc. This is implemented by the changes below.
+        
+        Tests: fast/html/nav-element.html
+
+        * css/html.css:
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority):
+        (WebCore::blockTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+        * html/HTMLTagNames.in:
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson, David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152727>
+
+        If a page has custom scroll bars, they will not update correctly when the window is activated/deactivated.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::hasCustomScrollbars):
+        Check if the frame view or any of its subviews have custom scroll bars.
+        
+        (WebCore::FrameView::updateControlTints):
+        Go ahead and update control tints if the frame view has custom scroll bars.
+        
+        * page/FrameView.h:
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Roll out r47477 as it introduced assertion failures and crashes on the build bots.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Removed.
+        * storage/SQLTransactionClient.h: Removed.
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the SharedTimer file for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28126
+
+        * platform/haiku/SharedTimerHaiku.cpp: Added.
+        (WebCore::):
+        (WebCore::SharedTimerHaiku::SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::~SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::instance):
+        (WebCore::SharedTimerHaiku::start):
+        (WebCore::SharedTimerHaiku::stop):
+        (WebCore::SharedTimerHaiku::Filter):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Release build fix.
+
+        * xml/XMLHttpRequest.cpp: Sprinkle some #ifndef NDEBUG around.
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+
+2009-08-18  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28412: Leak of WebCore::XMLHttpRequest object during layout tests.
+
+        No new tests: Already covered by existing tests.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Add instrumentation for this kind of leak.
+        (WebCore::XMLHttpRequest::~XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Only setPendingActivity() if we actually started a request. Also,
+        restore a call to nonCacheRequestInFlight() that got lost in a recent refactor.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Final change for v8 corresponding to http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added missing using statment
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+       More corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Make corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getIdentifierValue):
+
+2009-08-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More work on making DOM classes start with reference count of 1
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        Some related clean-up and preparation steps so the subsequent
+        patches will be as small as possible.
+
+        * WebCore.base.exp: Sorted this file.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        Use nameAttr instead of the name function.
+
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::JSHTMLFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/objc/DOM.mm: Sorted includes.
+        * dom/Document.cpp: Ditto.
+
+        * dom/StyledElement.cpp: Made invalidateStyleAttribute inline.
+        * dom/StyledElement.h: Ditto.
+
+        * dom/make_names.pl: Changed default of createWithNew to 0.
+        Eventually all elements will be created with create instead of new.
+
+        * html/HTMLTagNames.in:
+        * svg/svgtags.in:
+        * wml/WMLTagNames.in:
+        Added createWithNew for every tag. We'll remove it as we convert
+        element classes to use create.
+
+        * html/HTMLAppletElement.h: Removed unneeded forward declarations.
+        * html/HTMLFrameElement.h: Ditto.
+
+        * html/HTMLEmbedElement.cpp: Removed many attribute get and
+        set functions.
+        * html/HTMLEmbedElement.h: Ditto.
+        * html/HTMLIFrameElement.cpp: Ditto.
+        * html/HTMLIFrameElement.h: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLObjectElement.h: Ditto.
+        * html/HTMLPlugInElement.cpp: Ditto.
+        * html/HTMLPlugInElement.h: Ditto.
+
+        * html/HTMLFrameElementBase.cpp: Removed many attribute get and
+        set functions.
+        (WebCore::HTMLFrameElementBase::location): Changed to use
+        srcAttr instead of src.
+        * html/HTMLFrameElementBase.h: Removed many attribute get and set
+        functions.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::replaceMediaElementTimerFired):
+        Use srcAttr and typeAttr instead of setSrc and setType.
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::createDocumentStructure): Ditto.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Use nameAttr instead
+        of name -- this avoids an extra AtomicString round trip and a little
+        ref count churn too.
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to support loading.
+        https://bugs.webkit.org/show_bug.cgi?id=28342
+
+        Added loader support to shared workers, and refactored worker tests to also test SharedWorkers
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        Forwards load requests to an arbitrary document from the list of worker's documents.
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        Posts responses back to the shared worker thread.
+
+2009-08-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        StyleChange::init needs clean up before fixing the bug 23892
+        https://bugs.webkit.org/show_bug.cgi?id=27749
+
+        This patch simplifies StyleChange::init by removing the iteration on CSS properties,
+        and adding functions reconcileTextDecorationProperties and extractTextStyle to handle the style.
+
+        Because there is a bug in how text decorations are processes in getPropertiesNotInComputedStyle,
+        this patch simplifies the treatment in order to preserve the original behavior of WebKit.
+        However, the current implementation is not best (adds redundant text-decorations) and we should fix it later.
+
+        No test is added since there is no change in behavior.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init): Uses getPropertiesNotInComputedStyle instead of iterating through the properties
+        (WebCore::StyleChange::reconcileTextDecorationProperties): Removes -webkit-text-decorations-in-effects and redundant "none"
+        (WebCore::getIdentifierValue): Obtains the identifier of a CSSPrimitiveValue
+        (WebCore::StyleChange::extractTextStyles): Converts properties in style to m_apply* and removes the property
+        (WebCore::getPropertiesNotInComputedStyle): Fixed a bug with how text decorations are treated
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing a DB file naming bug in Chromium. The origin should come
+        before the DB name in the file name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28331
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding four image-specific files to WebCore:
+        IconHaiku.cpp, ImageBufferData.h, ImageBufferHaiku.cpp, ImageHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/Icon.h:
+        * platform/graphics/haiku/IconHaiku.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/haiku/ImageBufferData.h: Added.
+        * platform/graphics/haiku/ImageBufferHaiku.cpp: Added.
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::~ImageBuffer):
+        (WebCore::ImageBuffer::context):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageBuffer::image):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/haiku/ImageHaiku.cpp: Added.
+        (WebCore::FrameData::clear):
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::BitmapImage::initPlatformData):
+        (WebCore::BitmapImage::invalidatePlatformData):
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::BitmapImage::getBBitmap):
+
+2009-08-18  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27575 [CSS3 
+        Backgrounds and Borders] Drop the prefix from background-size
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::ensurePropertyMap):
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to forward exceptions to parent documents
+        https://bugs.webkit.org/show_bug.cgi?id=28320
+
+        Changed SharedWorkerProxy to have individual mutexes (so workers can interact with their parent documents without contention).
+
+        Updated SharedWorkerProxy to forward exceptions/console messages to all parent documents.
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        Cleaned up bitrot - added missing include.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::postExceptionTask):
+        Callback used to deliver exceptions to a document.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        Forwards exceptions to all parent documents for presentation to the user.
+        (WebCore::postConsoleMessageTask):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        Forwards console messages to all parent documents for presentation to the user.
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Grabs the mutex before accessing workerDocuments.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Grabs the mutex before accessing workerDocuments.
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
+        
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        Call FrameLoaderClient::shouldLoadMediaElementURL.
+        
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::shouldLoadMediaElementURL):
+        Return true by default.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        openDatabase() should not execute any SQL statement on the
+        database it's trying to open, unless there are no other open
+        handles to the same database. Otherwise, we might run into a
+        deadlock.
+
+        Test: storage/open-database-while-transaction-in-progress.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=28207
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify):
+
+2009-08-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feBlend implementation missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28133]
+
+        Implementation of SVG Filter feBlend.
+
+        FilterEffect.cp needed changes to optimize the rendering. With the old code
+        we drew a subEffect on the current FilterEffect by drawImage, got the PixelArray,
+        cleared the drawing area, drew the next FilterEffect with drawImage and picked this
+        PixelArray again. This was unefficient and slow. Now we calculate the requested area
+        of the subEffect and ask the FilterEffect's ImageBuffer for the PixelArray directly,
+        without any drawing operations on GraphicsContext.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-blend-01-b.svg
+
+        * html/canvas/CanvasPixelArray.h:
+        (WebCore::CanvasPixelArray::set):
+        (WebCore::CanvasPixelArray::get):
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::unknown):
+        (WebCore::normal):
+        (WebCore::multiply):
+        (WebCore::screen):
+        (WebCore::darken):
+        (WebCore::lighten):
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect):
+        * platform/graphics/filters/FilterEffect.h:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter followup: node formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format):
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar broken
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28432
+        String::createCFString() returns a non-retained empty string
+
+        No known change in functionality, so no test.
+
+        * platform/text/cf/StringCF.cpp: (WebCore::String::createCFString): Retain the CFSTR result.
+    
+2009-08-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
+        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
+        
+        Removed an early return that can cause deleteOrigin or deleteAllDatabases to fail when
+        it doesn't have to.
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::deleteOrigin):
+
+2009-08-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Support for :valid and :invalid CSS selectors, from HTML5 specs.
+        http://www.whatwg.org/specs/web-apps/current-work/#selector-valid
+
+        Tests: fast/css/pseudo-invalid-001.html
+               fast/css/pseudo-invalid-002.html
+               fast/css/pseudo-valid-001.html
+               fast/css/pseudo-valid-002.html
+               fast/css/pseudo-valid-003.html
+               fast/css/pseudo-valid-004.html
+               fast/css/pseudo-valid-005.html
+               fast/css/pseudo-valid-006.html
+               fast/css/pseudo-valid-007.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): extracts new pseudo-classes
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): Make sure we don't share style between
+form controls that have different validity states.
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        style associated to new pseudo-classes
+        * dom/Element.h:
+        (WebCore::Element::willValidate): pushed up in hierarchy
+        (WebCore::Element::isValidFormControlElement): checks for valid form
+        control elements (wraps ValidityState::valid())
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::willValidate): minor clean up
+        (WebCore::HTMLFormControlElement::isValidFormControlElement): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLKeygenElement.h:
+        (WebCore::HTMLKeygenElement::willValidate): added
+        * html/HTMLObjectElement.h:
+        (WebCore::HTMLObjectElement::willValidate): added
+        * html/HTMLObjectElement.idl:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+
+2009-08-17  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos
+
+        Replace repeated string of PLATFORM(FOO) with a single define
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+
+2009-08-16  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20329, shadows and reflections incorrectly
+        considered part of scrollable overflow.
+
+        This patch takes the engine's concept of overflow and splits it into two types:
+        layout overflow and visual overflow.
+        
+        Layout overflow is about other boxes that spill out of an enclosing box,  For example,
+        in the inline flow case a tall image could spill out of a line box. Examples of 
+        visual overflow are shadows, text stroke (and eventually outline and
+        border-image).
+
+        Three objects tracked overflow before this patch: RenderBlock had 
+        m_overflowLeft/Top/Width/Height variables.  RootInlineBox had an Overflow*
+        that also had four overflow values.  Finally RenderReplaced elements tracked shadow/reflection
+        overflow using a map that cached four values.
+        
+        This patch takes all of these different overflow models and unifies them into a single
+        new class called RenderOverflow.   This class is now a member variable in RenderBox and
+        InlineFlowBoxes.  It is only allocated if overflow actually exists.  Instead of tracking
+        four values, it tracks eight: left/top/right/bottom for layout overflow and 
+        left/top/right/bottom for visual overflow.
+        
+        Overflow computation is now done after layout is finished rather than during layout
+        (when child objects can be churning and moving around).  A number of layout tests progressed
+        by deferring overflow computation to a separate pass.
+        
+        All inline flow boxes now track overflow (and not just the root line box).  This allows
+        repainting of line boxes to actually be tight and bail early if the overflow rect of a box
+        doesn't intersect.  The old code always visited all object on a line if the root line box
+        intersected at all.
+        
+        Line box overflow no longer propagates across self-painting layers.  This fixes a number of
+        issues with incorrect scrollbars appearing when relative positioned inlines were used in a page.
+        
+        Layer bounds have been modified to exclude visual overflow.  The width/height members only really
+        have one reason for continued existence, and that is that they happen to be used in repaint()
+        when an overflow clip object's height isn't accurate.  In this case, the bounds should exclude
+        visual overflow anyway, so this change tightens that repaint up.
+        
+        Root lines have renamed m_selectionTop/Bottom to m_lineTop/Bottom and positionForPoint methods have
+        been changed to use these instead of relying on overflow (which was totally wrong).
+
+        Significant changes have been made to the "almost strict mode" line box quirk where objects with no
+        text children have no effect on the height of a line.  Instead of making the height() of the objects
+        variable and dependent on overflow, the objects now have their full height and get placed on
+        the baseline properly.  They simply don't contribute to overflow above lineTop/Bottom.
+        
+        Reflections are no longer considered overflow of any kind.  Because reflections have their own layers,
+        it is not necessary to treat them as visual or layout overflow in the RenderObject tree.  The end result
+        of not incorporating them into RenderOverflow is that they have no effect on scrolling.  transparencyClipBox
+        has been extended to support fully reflecting the entire clip box when a reflection exists.  This fixes
+        numerous repaint bugs in transparent objects with reflections when the transparent objects had self-painting
+        sublayers.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::adjustPageHeight):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustPosition):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::topCombinedOverflow):
+        (WebCore::InlineFlowBox::bottomCombinedOverflow):
+        (WebCore::InlineFlowBox::leftCombinedOverflow):
+        (WebCore::InlineFlowBox::rightCombinedOverflow):
+        (WebCore::InlineFlowBox::combinedOverflowRect):
+        (WebCore::InlineFlowBox::topLayoutOverflow):
+        (WebCore::InlineFlowBox::bottomLayoutOverflow):
+        (WebCore::InlineFlowBox::leftLayoutOverflow):
+        (WebCore::InlineFlowBox::rightLayoutOverflow):
+        (WebCore::InlineFlowBox::layoutOverflowRect):
+        (WebCore::InlineFlowBox::topVisualOverflow):
+        (WebCore::InlineFlowBox::bottomVisualOverflow):
+        (WebCore::InlineFlowBox::leftVisualOverflow):
+        (WebCore::InlineFlowBox::rightVisualOverflow):
+        (WebCore::InlineFlowBox::visualOverflowRect):
+        (WebCore::InlineFlowBox::setHorizontalOverflowPositions):
+        (WebCore::InlineFlowBox::setVerticalOverflowPositions):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::layout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromBlockChildren):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::getHeightForLineCount):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::addShadowAndReflectionOverflow):
+        (WebCore::RenderBox::addOverflowFromChild):
+        (WebCore::RenderBox::addLayoutOverflow):
+        (WebCore::RenderBox::addVisualOverflow):
+        (WebCore::RenderBox::clearLayoutOverflow):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::combinedOverflowRect):
+        (WebCore::RenderBox::topCombinedOverflow):
+        (WebCore::RenderBox::bottomCombinedOverflow):
+        (WebCore::RenderBox::leftCombinedOverflow):
+        (WebCore::RenderBox::rightCombinedOverflow):
+        (WebCore::RenderBox::layoutOverflowRect):
+        (WebCore::RenderBox::topLayoutOverflow):
+        (WebCore::RenderBox::bottomLayoutOverflow):
+        (WebCore::RenderBox::leftLayoutOverflow):
+        (WebCore::RenderBox::rightLayoutOverflow):
+        (WebCore::RenderBox::visualOverflowRect):
+        (WebCore::RenderBox::topVisualOverflow):
+        (WebCore::RenderBox::bottomVisualOverflow):
+        (WebCore::RenderBox::leftVisualOverflow):
+        (WebCore::RenderBox::rightVisualOverflow):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        * rendering/RenderOverflow.h: Added.
+        (WebCore::RenderOverflow::RenderOverflow):
+        (WebCore::RenderOverflow::topLayoutOverflow):
+        (WebCore::RenderOverflow::bottomLayoutOverflow):
+        (WebCore::RenderOverflow::leftLayoutOverflow):
+        (WebCore::RenderOverflow::rightLayoutOverflow):
+        (WebCore::RenderOverflow::topVisualOverflow):
+        (WebCore::RenderOverflow::bottomVisualOverflow):
+        (WebCore::RenderOverflow::leftVisualOverflow):
+        (WebCore::RenderOverflow::rightVisualOverflow):
+        (WebCore::RenderOverflow::setTopLayoutOverflow):
+        (WebCore::RenderOverflow::setBottomLayoutOverflow):
+        (WebCore::RenderOverflow::setLeftLayoutOverflow):
+        (WebCore::RenderOverflow::setRightLayoutOverflow):
+        (WebCore::RenderOverflow::setTopVisualOverflow):
+        (WebCore::RenderOverflow::setBottomVisualOverflow):
+        (WebCore::RenderOverflow::setLeftVisualOverflow):
+        (WebCore::RenderOverflow::setRightVisualOverflow):
+        (WebCore::RenderOverflow::layoutOverflowRect):
+        (WebCore::RenderOverflow::visualOverflowRect):
+        (WebCore::RenderOverflow::combinedOverflowRect):
+        (WebCore::RenderOverflow::move):
+        (WebCore::RenderOverflow::addLayoutOverflow):
+        (WebCore::RenderOverflow::addVisualOverflow):
+        (WebCore::RenderOverflow::resetLayoutOverflow):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::~RenderReplaced):
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::positionForPoint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::layout):
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+        (WebCore::RenderText::localCaretRect):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::addHighlightOverflow):
+        (WebCore::RootInlineBox::adjustPosition):
+        (WebCore::RootInlineBox::verticallyAlignBoxes):
+        (WebCore::RootInlineBox::selectionTop):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::nextRootBox):
+        (WebCore::RootInlineBox::prevRootBox):
+        (WebCore::RootInlineBox::lineTop):
+        (WebCore::RootInlineBox::lineBottom):
+        (WebCore::RootInlineBox::selectionBottom):
+        (WebCore::RootInlineBox::selectionHeight):
+        (WebCore::RootInlineBox::floats):
+        (WebCore::RootInlineBox::floatsPtr):
+        (WebCore::RootInlineBox::setLineTopBottomPositions):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28431
+        <rdar://problem/7137610> Application Cache doesn't work with HTTP authentication
+
+        Test: http/tests/appcache/auth.html
+
+        * loader/appcache/ApplicationCacheGroup.h:
+        (WebCore::ApplicationCacheGroup::shouldUseCredentialStorage): If appcache is enabled,
+        always allow it to use stored credentials (we can't ask WebKit client, and maybe we
+        shouldn't ask it, because it's not a document that's loading these resources).
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan and David Hyatt.
+
+        Fix <rdar://problem/7147996>
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        Update the style of the scroll bars.
+        
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::RenderScrollbar):
+        Calculate the size of the scrollbar and set it as the frame size.
+
+2009-08-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement should fire 'progress' event before 'load'
+        https://bugs.webkit.org/show_bug.cgi?id=28314
+
+        Test: media/progress-event-at-least-one.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Schedule 'progress' event before 'load'.
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        Expose WorkerThread::workerThreadCount() for DumpRenderTree so we can write worker lifecycle tests.
+
+        Tests: fast/workers/shared-worker-lifecycle.html-disabled
+               fast/workers/worker-lifecycle.html
+
+        * WebCore.base.exp:
+        Exported WorkerThread::workerThreadCount().
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/WorkerThread.cpp:
+        Added tracking of the number of worker threads.
+        (WebCore::threadCountMutex):
+        (WebCore::WorkerThread::workerThreadCount):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::~WorkerThread):
+        * workers/WorkerThread.h:
+
+2009-08-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Add new files I forgot to add in r47424.
+
+2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Implement prefetchDNS() function.
+
+        * WebCore.pro:
+        * platform/qt/TemporaryLinkStubs.cpp:
+
+2009-08-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for parsing <datalist> element and generating HTMLDataListElement nodes.
+        https://bugs.webkit.org/show_bug.cgi?id=26915
+
+        Tests: fast/forms/datalist-nonoption-child.html
+               fast/forms/datalist.html
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html.css:
+        * html/CollectionType.h:
+        (WebCore::):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::itemAfter):
+        * html/HTMLDataListElement.cpp: Added.
+        (WebCore::HTMLDataListElement::HTMLDataListElement):
+        (WebCore::HTMLDataListElement::~HTMLDataListElement):
+        (WebCore::HTMLDataListElement::checkDTD):
+        (WebCore::HTMLDataListElement::options):
+        * html/HTMLDataListElement.h: Added.
+        * html/HTMLDataListElement.idl: Added.
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLTagNames.in:
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        -webkit-box-orient:horizontal doesn't work on <button> tag
+        https://bugs.webkit.org/show_bug.cgi?id=34445
+
+        Make a flexible button's anonymous child flexible and pass the
+        parent's box-orient to the anonymous child.
+
+        Also, added a renderName for anonymous flexible boxes.
+
+        Test: fast/flexbox/box-orient-button.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createAnonymousBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::addChild):
+        (WebCore::RenderButton::setupInnerStyle):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::renderName):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        Render -webkit-mask via compositing layers when possible
+        https://bugs.webkit.org/show_bug.cgi?id=28414
+        
+        Implement accelerated compositing of -webkit-mask, when combined
+        with already-composited content.
+        
+        RenderLayerBacking now creates an additional GraphicsLayer for the mask contents,
+        and sets this as the mask on another GraphicsLayer via the setMaskLayer() method.
+        GraphicsLayerCA then applies the mask using -[CALayer setMask:].
+        
+        The enum values for GraphicsLayerPaintingPhase were renamed to avoid the
+        confusion with "mask", and a new value, GraphicsLayerPaintMask, was added which
+        indicates that just the mask is painting.
+        
+        When painting the composited mask, we need to paint with the normal compositing
+        mode rather than CompositeDestinationIn, so InlineFlowBox and RenderBox now consult
+        layer()->hasCompositedMask() to pick the mode. If the mask is composited, they no longer
+        need to make transparency layers.
+        
+        We no longer have to throw video rendering into software because of masks.
+        
+        When a masked element has composited descendants, that element needs to
+        become composited so that the mask can be applied via compositing.
+
+        Tests: compositing/masks/masked-ancestor.html
+               compositing/masks/simple-composited-mask.html
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::maskLayer):
+        (WebCore::GraphicsLayer::setMaskLayer):
+        (WebCore::GraphicsLayer::paintingPhase):
+        (WebCore::GraphicsLayer::setPaintingPhase):
+        * platform/graphics/GraphicsLayerClient.h:
+        (WebCore::):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setMaskLayer):
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateMaskLayer):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::~RenderLayerBacking):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::updateMaskLayer):
+        (WebCore::RenderLayerBacking::paintingPhaseForPrimaryLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::hasMaskLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Layer content misplaced with compositing, z-index and overflow
+        https://bugs.webkit.org/show_bug.cgi?id=28361
+        
+        The foreground GraphicsLayer (used to render element foreground when the element has 
+        negative z-order children) was misplaced when there is a clipping layer (which clips
+        children). The foreground layer is parented under the clipping layer so that the foreground
+        depth-sorts with the layer's children, so its geometry needs to be computed relative to
+        that clipping layer.
+        
+        Also clarified some FIXME comments, and corrected a debug-only layer name.
+
+        Test: compositing/geometry/clipping-foreground.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix leaks of SVGElementInstance seen during regression tests.
+
+        r47313 made TreeShared types start with a ref-count of 1, but SVGElementInstance was mistakenly
+        not updated to have a create method that adopted the initial reference.  This lead to the instances
+        of SVGElementInstance allocated by SVGUseElement being leaked.
+
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::create):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildInstanceTree):
+        (WebCore::SVGUseElement::handleDeepUseReferencing):
+
+2009-08-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some cleanup towards https://bugs.webkit.org/show_bug.cgi?id=13631
+        Page Cache should support pages with frames.
+
+        - Re-factor all remaining page cache code out of DocumentLoader, as CachedPage/CacheFrame loads
+          are solely the responsibility of FrameLoader.
+        - Enhance some page cache related Logging to help development.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::identifierForInitialRequest):
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        * loader/DocumentLoader.h:
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+
+2009-08-17  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Moved implementation of isAfterContent to RenderObject
+        (as inline method to avoid potential performance regressions).
+
+        BUG 28376 -  [Cleanup] isAfterContent() implemented twice, should be member of RenderObject
+        (https://bugs.webkit.org/show_bug.cgi?id=28376)
+
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAfterContent):
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure in WebCore::RenderHTMLCanvas::layout
+        https://bugs.webkit.org/show_bug.cgi?id=12052
+
+        Don't handle run-in if the element is not a block element.
+
+        Test: fast/runin/nonblock-runin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-08-17  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fix createImageData to raise the NOT_SUPPORTED_ERR exception when
+        either of the arguments are not finite.
+
+        According to
+        http://www.whatwg.org/specs/web-apps/current-work/#pixel-manipulation:
+        "If any of the arguments to createImageData() or getImageData() are
+        infinite or NaN, or if the createImageData()  method is invoked with
+        only one argument but that argument is null, the method must instead
+        raise a NOT_SUPPORTED_ERR  exception."
+
+        Test: http://philip.html5.org/tests/canvas/suite/tests/2d.imageData.create.nonfinite.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createImageData):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/CanvasRenderingContext2D.idl:
+
+2009-08-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add a way to release the storage lock
+        https://bugs.webkit.org/show_bug.cgi?id=28411
+
+        Two scripts within the same origin that are accessing LocalStorage must not do
+        it simultaneously, according to the spec.  There are some cases, however, where
+        a script might want to override this behavior.  navigator.getStorageUpdates()
+        was added for this reason:
+        http://dev.w3.org/html5/spec/Overview.html#manually-releasing-the-storage-mutex
+
+        Add this function to navigator and hook it up to DOM Storage.
+
+        * page/Navigator.cpp:
+        (WebCore::Navigator::getStorageUpdates):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::unlock):
+        * storage/StorageNamespaceImpl.h:
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        CFNetwork isn't present in the framework search path on Mac OS X so we can't directly include its headers.
+        We include CoreServices.h, the umbrella framework that contains CFNetwork, from the prefix header which
+        results in the CFNetwork headers being included on Mac OS X.  CoreServices.h doesn't include CFNetwork.h on
+        Windows though so we explicitly include this header from the prefix header when on Windows.
+
+        * WebCorePrefix.h:
+        * platform/network/cf/DNSCFNet.cpp: Remove #include that is no longer needed.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying a better build fix (the previous one broke Leopard bots, although it did build for me).
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFNetwork.h instead.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying to fix Windows build.
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFHost.h.
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28401
+        Add support for DNS prefetching with CFNetwork
+
+        This is just an optimization, no behavior change, so no tests.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::clientCallback):
+        (WebCore::prefetchDNS):
+        Use async CFHostStartInfoResolution() for implementation.
+
+2009-08-17  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28313: Combine ThreadableLoaderOptions::crossOriginRequestPolicy and
+        ThreadableLoaderOptions::crossOriginRedirectPolicy since they are always set the same way.
+
+        Also, tightened up behavior of XMLHttpRequest with cross-origin redirects and access control. We have not implemented
+        redirects access control, so we should never redirect across origins. But in two edge cases, we were:
+
+        * Asynchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to a resource on origin A.
+        * Synchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to another resource on origin B (this time sending access control authorization headers).
+
+        Test: http/tests/xmlhttprequest/access-control-and-redirects.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::willSendRequest): Refactor redirect checking code into shared location.
+        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
+        (WebCore::DocumentThreadableLoader::isAllowedRedirect): Ditto.
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.h:
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Remove ThreadableLoaderOptions::crossOriginRedirectPolicy.
+        * page/EventSource.cpp:
+        (WebCore::EventSource::connect): Ditto.
+        * workers/Worker.cpp: Ditto.
+        (WebCore::Worker::Worker): Ditto.
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts): Ditto.
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
+        * workers/WorkerScriptLoader.h: 
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+
+2009-08-17  Adam Langley  <agl@google.com>
+
+        Reviewed by Dan Bernstein (relanding of r47157).
+
+        Fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        This was originally fixed in r47157, however it triggered a bug in
+        Skia which caused Chromium Linux to fail layout tests in debug mode.
+        It was reverted in r47189 while we sorted it out.
+
+        The Skia bug was fixed in Skia's r321 [1] and rolled into Chromium in
+        Chromium's r23523. This is a reland of the original patch.
+
+        No new tests because it's a just typo fix.
+
+        [1] http://code.google.com/p/skia/source/detail?r=321
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Protect ResourceHandle for g_file_query_info_async call, using the
+        same technique we already use for HTTP requests that take the soup
+        path.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::finishedCallback):
+        (WebCore::):
+
+2009-08-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47255): MediaWiki's (including Wikipedia) navigation pane
+        appears below the main content
+        https://bugs.webkit.org/show_bug.cgi?id=28350
+
+        A particular version of the MediaWiki software detects WebKit through
+        user agent sniffing and imports a style sheet called KHTMLFixes.css,
+        which contains a single rule that was meant to work around some KHTML
+        bug, but currently has the sole effect of causing the float containing
+        the main article content to extend all the way to the left and thus push
+        down the left navigation pane.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the imported style sheet is the MediaWiki
+        KHTMLFixes.css. If so, remove the offending rule.
+
+2009-08-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct crash when processing local cancelled requests.
+
+        No new tests. Existing fast/images/favicon-as-image.html
+        displays the problem.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::writeCallback): Add check for m_cancelled after
+          performing local-file processing.
+        (WebCore::ResourceHandleManager::downloadTimerCallback): Add
+          check for m_cancelled after performing local-file processing.
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Reverts 47371, since it breaks GTK+.
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Allow image decoders to down-sample the image directly
+        to scaled output buffer. This can be enabled/disabled by
+        macro ENABLE(IMAGE_DECODER_DOWN_SAMPLING).
+        Only JPEG and PNG decoders are modified to support it now.
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Added.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::setSize):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: fix float literals to avoid casting warnings.
+
+        * rendering/MediaControlElements.cpp:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Use OwnPtrs for GraphicsLayers
+        https://bugs.webkit.org/show_bug.cgi?id=28399
+
+        Convert RenderLayerBacking and RenderLayerCompositor to use OwnPtrs
+        for their references to GraphicsLayers.
+
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayer::create):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateInternalHierarchy):
+        (WebCore::RenderLayerBacking::updateClippingLayers):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::graphicsLayer):
+        (WebCore::RenderLayerBacking::clippingLayer):
+        (WebCore::RenderLayerBacking::ancestorClippingLayer):
+        (WebCore::RenderLayerBacking::foregroundLayer):
+        (WebCore::RenderLayerBacking::parentForSublayers):
+        (WebCore::RenderLayerBacking::childForSuperlayers):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::~RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::rootPlatformLayer):
+        (WebCore::RenderLayerCompositor::didMoveOnscreen):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Reset InjectedScript styles cache on document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28390
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::resetInjectedScript):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._reset):
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * rendering/MediaControlElements.cpp: Removed unneeded include of CString.h,
+        resorted includes, renamed "doc" to "document" and fixed formatting.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed functions now unneeded due to use of Reflect to create
+        language bindings.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        Get at usemap attribute directly.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        Get at id attribute directly.
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Ditto.
+
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::dir): Get at dir attribute of body directly.
+        (WebCore::HTMLDocument::setDir): Ditto.
+
+        * html/HTMLElement.cpp: Deleted unused functions.
+        * html/HTMLElement.h: Ditto.
+
+        * html/HTMLImageElement.cpp: Deleted unused functions.
+        (WebCore::HTMLImageElement::alt): Changed to return const AtomicString&.
+        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Changed to
+        get at usemap attribute directly, but added a FIXME because although
+        it is what the old code did, it looks to not be entirely correct.
+
+        * html/HTMLImageElement.h: Deleted unused functions.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::altDisplayString): Get at alt attribute directly.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageMap): Get at usemap attribute directly.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Get at id attribute
+        directly.
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Removed
+        explicit HTMLNames namespace qualification.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Removed unneeded calls
+        to RefPtr::get.
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Discard DOM Node bindings on any document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28389
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+        * English.lproj/localizedStrings.js: DataGrid Headers "Name", "Value", "Size", ...
+        * WebCore.gypi: added missing files
+
+          Implemented Bindings for InspectorController.deleteCookie(name)
+
+        * inspector/InspectorBackend.idl:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        (WebCore::JSInspectorBackend::deleteCookie):
+
+          v8 Bindings Stubs
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+          Removed WebInspector.Cookie
+
+        * inspector/front-end/Cookie.js: Removed.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/WebKit.qrc:
+
+          Improved DataGrid and Kept Fallback Behavior for Platforms that don't
+          yet provide access to raw cookies.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies):
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate.callback):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate):
+        (WebInspector.CookieItemsView.prototype.fallbackBuildCookiesFromString):
+        (WebInspector.CookieItemsView.prototype.fallbackDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Interaction with the page through Injected Script (for fallback behavior)
+
+        * inspector/front-end/DOMAgent.js:
+        (InspectorController.getCookies):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleProperty): style fix
+        (InjectedScript.getCookies):
+
+          Allow alignment of text inside DataGrids.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGridNode.prototype.createCell):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        * inspector/front-end/inspector.css:
+
+          Added deleteCookie(., ., String name)
+          Modified getRawCookies to return a bool to know if its implemented
+
+        * platform/CookieJar.h:
+
+
+          Implemented deleteCookie for Macs
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+          Stub Implementations for Other Platforms
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-08-17  Adam Treat  <adam.treat@torchmobile.com>
+
+        Blind build fix for Leopard.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::adjustLineToPixelBoundaries):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextCG.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
+        (WebCore::GraphicsContext::setCompositeOperation):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContext.cpp/h, GraphicsContextCairo.cpp and GraphicsContextQt.cpp.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::save):
+        (WebCore::GraphicsContext::restore):
+        (GraphicsContext::drawText):
+        (GraphicsContext::initFocusRing):
+        (GraphicsContext::focusRingBoundingRect):
+        (GraphicsContext::drawImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::toCairoOperator):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change HTMLAreaElement to use OwnArrayPtr
+        https://bugs.webkit.org/show_bug.cgi?id=28386
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::HTMLAreaElement): Removed unneeded initializer.
+        (WebCore::HTMLAreaElement::~HTMLAreaElement): Removed unneeded delete call.
+        (WebCore::HTMLAreaElement::parseMappedAttribute): Use the set function
+        instead of deletion followed by assignment.
+        * html/HTMLAreaElement.h: Use OwnArrayPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Fix Windows build.
+
+        * dom/make_names.pl: Add back cast to (void*) needed on Windows.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move noResize from HTMLFrameElementBase to HTMLFrameElement
+        https://bugs.webkit.org/show_bug.cgi?id=28384
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement): Initialize m_noResize.
+        (WebCore::HTMLFrameElement::parseMappedAttribute): Set m_noResize to true
+        here if noresizeAttr is changed. This code was moved here from
+        HTMLFrameElementBase, but I added some FIXME comments.
+        (WebCore::HTMLFrameElement::setNoResize): Set the attribute based on
+        boolean argument. Moved here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElement.h: Moved noResize, setNoResize, and m_noResize
+        here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Removed m_noResize.
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Removed code to parse
+        noresizeAttr.
+
+        * html/HTMLFrameElementBase.h: Removed noResize, setNoResize, and m_noResize.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Tweak HTMLFrameElementBase so that m_URL can be private
+        https://bugs.webkit.org/show_bug.cgi?id=28385
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::rendererIsNeeded): Removed m_URL argument.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed): Use m_URL instead of
+        taking an argument.
+        (WebCore::HTMLFrameElementBase::openURL): Removed m_URL argument.
+        * html/HTMLFrameElementBase.h: Removed argument from isURLAllowed function.
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::rendererIsNeeded): Removed m_URL argument.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        HTMLViewSourceDocument should use smart pointers
+        https://bugs.webkit.org/show_bug.cgi?id=28378
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument): Don't initialize
+        pointers any more since RefPtr starts 0 by default.
+        (WebCore::HTMLViewSourceDocument::createContainingTable): Use more specific
+        types for local variables.
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Return a PassRefPtr,
+        and use a RefPtr of a more specific type for a local variable.
+        (WebCore::HTMLViewSourceDocument::addLine): Use more specific types for local
+        variables, and use RefPtr as well.
+        (WebCore::HTMLViewSourceDocument::addLink): Return a PassRefPtr, and use a
+        RefPtr of a more specific type for a local variable.
+
+        * html/HTMLViewSourceDocument.h: Change return types to PassRefPtr and
+        data member types to RefPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        Convert 4 more classes. These are classes I am going to make other changes
+        to soon, so it's good to have this use of Reflect in the IDL out of the way.
+
+        * html/HTMLEmbedElement.idl: Use Reflect for many attributes.
+        * html/HTMLFrameElement.idl: Ditto.
+        * html/HTMLIFrameElement.idl: Ditto.
+        * html/HTMLObjectElement.idl: Ditto.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Script to create element factory needs changes to accommodate calling create
+        https://bugs.webkit.org/show_bug.cgi?id=28379
+
+        * dom/make_names.pl: Tweak formatting. Remove lots of unneeded quotes
+        around names used inside {}. Added new createWithNew property for tags
+        that makes the factory use a create function instead of calling new.
+        Renamed functions with initialize in their name to have default in their
+        name, since they return an array full of default values and don't themselves
+        initialize anything.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        StyledElement should use ASCIICType instead of having its own toHex function
+        https://bugs.webkit.org/show_bug.cgi?id=28377
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addCSSColor): Use isASCIIHexDigit and toASCIIHexValue.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        execCommand("InsertHorizontalRule") inserts a broken <hr> element
+        https://bugs.webkit.org/show_bug.cgi?id=28375
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Create an HTMLHRElement
+        instead of just an HTMLElement.
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] <option> element & 'onpick' events - history navigation is broken
+        https://bugs.webkit.org/show_bug.cgi?id=28371
+
+        After selecting an option element with an 'onpick' event associated with a 'go' task,
+        the navigation is executed. When going back in history, the same 'onpick' event is fired
+        again. Fix that problem, add wml/option-element-onpick-recursion.html covering the bug.
+
+        Test: wml/option-element-onpick-recursion.html
+
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::WMLSelectElement):
+        (WebCore::WMLSelectElement::selectInitialOptions):
+        * wml/WMLSelectElement.h:
+        (WebCore::WMLSelectElement::initialized):
+
+2009-08-16  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Resource filtering: keyboard Navigation always uses ALL resources
+        https://bugs.webkit.org/show_bug.cgi?id=28231
+        
+        Determine if a resource is selectable on user action.
+        
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable):
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28355> Replace MAX()/MIN() macros with type-safe std::max()/min() templates
+
+        Reviewed by Dan Bernstein.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetSpelling): Changed MIN() to min().
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::Font::selectionRectForComplexText): Changed MAX() to
+        max() and MIN() to min().
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        * platform/graphics/mac/SimpleFontDataMac.mm: Added using
+        std::max statement.
+        (WebCore::SimpleFontData::platformInit): Changed MAX() to max().
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::decode): Changed MIN() to min().
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Cleanup WMLIntrinsicEventHandling code
+        https://bugs.webkit.org/show_bug.cgi?id=28358
+
+        Remove superflous "Event* evt" parameter from executeTask() methods. It's a leftover from the initial WML merge.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::defaultEventHandler):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLGoElement.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLPrevElement.h:
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+        * wml/WMLRefreshElement.h:
+        * wml/WMLTaskElement.h:
+
+2009-08-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: A handful of DOMAgent-related fixes and cleanups.
+
+        - renamed elementId to nodeId in operations on nodes.
+        - added load listeners to frame owners in InspectorDOMAgent.
+        - removed InspectorController::inspectedWindowScriptObjectCleared event.
+        - preserved isViaInspector flag for 'via inspector' marker to survive styles update.
+        - removed contentDocument-related logic from ElementsPanel since it is handled in
+            the InspectorDOMAgent.
+        - removed DOM listeners unregistration and corresponding events from InspectorController.
+        - made this.styles 'private' in ElementsPanel.
+        - added TODO for the handleCopy processing.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28356
+
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::getChildNodes):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::setTextNodeValue):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMDocument.prototype.addEventListener):
+        (WebInspector.DOMDocument.prototype.removeEventListener):
+        (WebInspector.DOMDocument.prototype._fireDomEvent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync.mycallback):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.childNodeInserted):
+        (WebInspector.childNodeRemoved):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.addStyleChange):
+        (WebInspector.ElementsPanel.prototype.removeStyleChange):
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype.onexpand):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._serializeRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/inspector.js:
+        (WebInspector.set hoveredDOMNode):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.enclosingNodeOrSelfWithNodeNameInArray):
+        (Node.prototype.enclosingNodeOrSelfWithClass):
+        (isAncestorNode):
+        (firstCommonNodeAncestor):
+        (traverseNextNode):
+        (traversePreviousNode):
+        ():
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Optimize updateFillImages() to not add/remove clients every time
+        https://bugs.webkit.org/show_bug.cgi?id=28334
+
+        Optimize the case where old and new just have a single layer pointing to the same (or no)
+        image.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Implement animations of multiple text-shadows and -webkit-box-shadows.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Test: transitions/multiple-shadow-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperShadow::equals):
+        (WebCore::PropertyWrapperShadow::blend):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Make transitions work for position and size of multiple backgrounds and masks.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Make background-position, background-size, -webkit-mask-position and -webkit-mask-size
+        properties animatable with multiple backgrounds, rather than just animating the first one.
+
+        Tests: transitions/multiple-background-size-transitions.html
+               transitions/multiple-background-transitions.html
+               transitions/multiple-mask-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayerPropertyWrapperBase::FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperBase::~FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperGetter::FillLayerPropertyWrapperGetter):
+        (WebCore::FillLayerPropertyWrapperGetter::equals):
+        (WebCore::FillLayerPropertyWrapper::FillLayerPropertyWrapper):
+        (WebCore::FillLayerPropertyWrapper::blend):
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::FillLayersPropertyWrapper::equals):
+        (WebCore::FillLayersPropertyWrapper::blend):
+        (WebCore::ensurePropertyMap):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::setXPosition):
+        (WebCore::FillLayer::setYPosition):
+        (WebCore::FillLayer::setSize):
+
+2009-08-15  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Jan Alonzo.
+
+        Don't crash in fieldset code when WML is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=28012
+
+        Test: fast/wml/html-fieldset-crash.html
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::findLegend): ++brackets
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Try and enable EventSource on Windows.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Setting attribute event listeners to the body does not set them on the window
+        https://bugs.webkit.org/show_bug.cgi?id=28343
+
+        Tests: fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html
+               fast/dom/Window/HTMLFrameSetElement-window-eventListener-attributes.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::setOnblur): Use setWindowAttributeEventListener instead of setAttributeEventListener.
+        (WebCore::HTMLBodyElement::setOnerror): Ditto.
+        (WebCore::HTMLBodyElement::setOnfocus): Ditto.
+        (WebCore::HTMLBodyElement::setOnload): Ditto.
+        (WebCore::HTMLBodyElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLBodyElement::setOnmessage): Ditto.
+        (WebCore::HTMLBodyElement::setOnoffline): Ditto.
+        (WebCore::HTMLBodyElement::setOnonline): Ditto.
+        (WebCore::HTMLBodyElement::setOnresize): Ditto.
+        (WebCore::HTMLBodyElement::setOnstorage): Ditto.
+        (WebCore::HTMLBodyElement::setOnunload): Ditto.
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::setOnblur): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnerror): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnfocus): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnmessage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnoffline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnonline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnresize): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnstorage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnunload): Ditto.
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix up some IDL comments.
+
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.idl:
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added implementation of the EventSource object that enables
+        server-sent events from HTML5.
+        http://dev.w3.org/html5/eventsource/
+        https://bugs.webkit.org/show_bug.cgi?id=14997
+
+        Tests: fast/eventsource/eventsource-attribute-listeners.html
+               fast/eventsource/eventsource-constructor.html
+               http/tests/eventsource/eventsource-bad-mime-type.html
+               http/tests/eventsource/eventsource-parse-event-stream.html
+               http/tests/eventsource/eventsource-reconnect.html
+               http/tests/eventsource/eventsource-status-code-states.html
+               http/tests/eventsource/workers/eventsource-simple.html
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::eventSource):
+        * bindings/js/JSEventSourceConstructor.cpp: Added.
+        (WebCore::):
+        (WebCore::JSEventSourceConstructor::JSEventSourceConstructor):
+        (WebCore::constructEventSource):
+        (WebCore::JSEventSourceConstructor::getConstructData):
+        * bindings/js/JSEventSourceConstructor.h: Added.
+        (WebCore::JSEventSourceConstructor::classInfo):
+        * bindings/js/JSEventSourceCustom.cpp: Added.
+        (WebCore::JSEventSource::markChildren):
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::eventSource):
+        * dom/EventNames.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toEventSource):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp: Added.
+        (WebCore::EventSource::EventSource):
+        (WebCore::EventSource::~EventSource):
+        (WebCore::EventSource::connect):
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::scheduleReconnect):
+        (WebCore::EventSource::reconnectTimerFired):
+        (WebCore::EventSource::url):
+        (WebCore::EventSource::readyState):
+        (WebCore::EventSource::close):
+        (WebCore::EventSource::scriptExecutionContext):
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        (WebCore::EventSource::dispatchEvent):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::didReceiveData):
+        (WebCore::EventSource::didFinishLoading):
+        (WebCore::EventSource::didFail):
+        (WebCore::EventSource::didFailRedirectCheck):
+        (WebCore::EventSource::parseEventStream):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::dispatchGenericEvent):
+        (WebCore::EventSource::dispatchMessageEvent):
+        (WebCore::EventSource::stop):
+        * page/EventSource.h: Added.
+        (WebCore::EventSource::create):
+        (WebCore::EventSource::):
+        (WebCore::EventSource::setOnopen):
+        (WebCore::EventSource::onopen):
+        (WebCore::EventSource::setOnmessage):
+        (WebCore::EventSource::onmessage):
+        (WebCore::EventSource::setOnerror):
+        (WebCore::EventSource::onerror):
+        (WebCore::EventSource::toEventSource):
+        (WebCore::EventSource::eventListeners):
+        (WebCore::EventSource::refEventTarget):
+        (WebCore::EventSource::derefEventTarget):
+        * page/EventSource.idl: Added.
+        * workers/WorkerContext.idl:
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Minor DOMAgent bugfixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::nodeForId):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Evaluating objects while on a breakpoint dumps string
+        representation instead of live object. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=28280
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions.this._evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame.delayedEvaluation):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+
+2009-08-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding two new files to WebCore/platform/haiku:
+        LocalizedStringsHaiku.cpp and LoggingHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28129
+
+        * platform/haiku/LocalizedStringsHaiku.cpp: Added.
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::defaultLanguage):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::fileButtonChooseFileLabel):
+        (WebCore::fileButtonNoFileSelectedLabel):
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::contextMenuItemTagInspectElement):
+        (WebCore::searchMenuNoRecentSearchesText):
+        (WebCore::searchMenuRecentSearchesText):
+        (WebCore::searchMenuClearRecentSearchesText):
+        (WebCore::unknownFileSizeText):
+        (WebCore::AXWebAreaText):
+        (WebCore::AXLinkText):
+        (WebCore::AXListMarkerText):
+        (WebCore::AXImageMapText):
+        (WebCore::AXHeadingText):
+        (WebCore::imageTitle):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+        * platform/haiku/LoggingHaiku.cpp: Added.
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix GTK build.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject): Pass 0 for document. Should be OK at least for now.
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * dom/XMLTokenizerQt.cpp: Use create functions instead of calling new
+        directly to make CDATASection and Comment nodes.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        First half, everything except for element classes.
+
+        * GNUmakefile.am: Removed DocPtr.h.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::Attr): Added a call to createTextChild here so callers don't
+        have to call it explicitly.
+        (WebCore::Attr::create): Added.
+        (WebCore::Attr::setValue): Changed to take AtomicString.
+        (WebCore::Attr::cloneNode): Use create.
+
+        * dom/Attr.h: Added a create function. Made the constructor private,
+        and a lot of other functions private as well.
+
+        * dom/Attribute.cpp:
+        (WebCore::Attribute::createAttrIfNeeded): Use Attr::create.
+
+        * dom/CDATASection.cpp:
+        (WebCore::CDATASection::create): Added.
+        (WebCore::CDATASection::cloneNode): Use create.
+        (WebCore::CDATASection::virtualCreate): Ditto.
+
+        * dom/CDATASection.h: Added a create function. Made everything private.
+        Removed unneeded destructor declaration.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::CharacterData): Replaced the multiple constructors
+        with a single one that takes ConstructionType.
+
+        * dom/CharacterData.h: Made more functions be protected and private.
+        Made m_data be private.
+
+        * dom/Comment.cpp:
+        (WebCore::Comment::Comment): Got rid of an extra constructor.
+        (WebCore::Comment::create): Added.
+        (WebCore::Comment::cloneNode): Call create.
+
+        * dom/Comment.h: Added a create function. Made everything private.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents): Use RefPtr instead of DocPtr.
+        (WebCore::dispatchChildRemovalEvents): Ditto.
+
+        * dom/ContainerNode.h: Made the constructor protected and passed
+        ConstructionType instead of an isElement boolean.
+
+        * dom/DocPtr.h: Removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::removedLastRef): Use explicit calls to selfOnlyRef
+        and selfOnlyDeref instead of a DocPtr in here.
+        (WebCore::Document::~Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::createDocumentFragment): Call create.
+        (WebCore::Document::createTextNode): Ditto.
+        (WebCore::Document::createComment): Ditto.
+        (WebCore::Document::createCDATASection): Ditto.
+        (WebCore::Document::createProcessingInstruction): Ditto.
+        (WebCore::Document::createEntityReference): Ditto.
+        (WebCore::Document::createEditingTextNode): Ditto.
+        (WebCore::Document::importNode): Call Attr::create.
+        (WebCore::Document::createAttributeNS): Ditto.
+
+        * dom/Document.h: Call adoptRef. Made a lot of functions private and
+        protected and sorted them so public functions come first.
+
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::create): Added.
+        (WebCore::DocumentFragment::cloneNode): Call create.
+        * dom/DocumentFragment.h: Added create.
+
+        * dom/DocumentType.cpp:
+        (WebCore::DocumentType::DocumentType): Pass type to Node constructor.
+        (WebCore::DocumentType::cloneNode): Use create.
+        * dom/DocumentType.h:
+        (WebCore::DocumentType::create): Call adoptRef.
+
+        * dom/EditingText.cpp:
+        (WebCore::EditingText::create): Added.
+        * dom/EditingText.h: Added a create function. Made everything private.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Pass CreateElementZeroRefCount to preserve
+        the zero reference count behavior for classes derived from Element.
+
+        * dom/EntityReference.cpp:
+        (WebCore::EntityReference::create): Added.
+        (WebCore::EntityReference::cloneNode): Call create.
+        * dom/EntityReference.h: Added create. Made everything private.
+
+        * dom/Node.cpp:
+        (WebCore::Node::initialRefCount): Added. Inline helper function for
+        the constructor.
+        (WebCore::Node::isContainer): Ditto.
+        (WebCore::Node::isElement): Ditto.
+        (WebCore::Node::isText): Ditto.
+        (WebCore::Node::Node): Changed to take a construction type argument.
+        Since m_document is now a normal pointer, added a call to selfOnlyRef.
+        (WebCore::Node::~Node): Ditto, but selfOnlyDeref.
+        (WebCore::Node::setDocument): Added selfOnlyRef/Deref calls.
+        (WebCore::Node::appendTextContent): Use the data function instead of
+        calling nodeValue functions, which do the same thing in a roundabout way.
+
+        * dom/Node.h: Made the constructor protected and replaced the multiple
+        arguments iwth a single ConstructionType argument. Sorted the public
+        things first.
+
+        * dom/Notation.h: Made most things private.
+        * dom/Notation.cpp: Removed extra constructor.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::create): Added.
+        (WebCore::ProcessingInstruction::cloneNode): Call create.
+        * dom/ProcessingInstruction.h: Added create function. Made many other
+        members private.
+
+        * dom/Range.cpp:
+        (WebCore::Range::processContents): Use DocumentFragment::create.
+
+        * dom/Text.cpp:
+        (WebCore::Text::Text): Updated for base class change.
+        (WebCore::Text::create): Added.
+        (WebCore::Text::splitText): Changed to not require access to m_data.
+        (WebCore::Text::cloneNode): Call create.
+        (WebCore::Text::createRenderer): Call dataImpl.
+        (WebCore::Text::attach): Call data.
+        (WebCore::Text::recalcStyle): Call dataImpl.
+        (WebCore::Text::virtualCreate): Call create.
+        (WebCore::Text::createWithLengthLimit): Call create.
+        (WebCore::Text::formatForDebugger): Call data.
+
+        * dom/Text.h: Added a create function. Made many other members private.
+        Renamed createNew to virtualCreate.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::enterText): Call Text::create.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::cdataBlock): Call CDATASection::create.
+        (WebCore::XMLTokenizer::comment): Call Comment::create.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        Call data instead of string.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Call Text::create.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertNode): Call DocumentFragment::create.
+
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply): Call Text::create.
+
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Call data instead of nodeValue.
+
+        * html/HTMLDocument.h:
+        (WebCore::HTMLDocument::create): Call adoptRef.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment): Call DocumentFragment::create.
+        (WebCore::replaceChildrenWithFragment): Call data instead of string.
+        (WebCore::replaceChildrenWithText): Call Text::create.
+        (WebCore::HTMLElement::setInnerText): Call DocumentFragment::create and
+        Text::create.
+        (WebCore::HTMLElement::setOuterText): Call Text::create.
+
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement): Call Text::create.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText): Call Text::create.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::textCreateErrorCheck): Call Text::create.
+        (WebCore::HTMLParser::commentCreateErrorCheck): Call Comment::create.
+        (WebCore::HTMLParser::handleIsindex): Call Text::create.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addText): Call Text::create.
+
+        * html/HTMLViewSourceDocument.h:
+        (WebCore::HTMLViewSourceDocument::create): Call adoptRef.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::appendEntry): Call Text::create.
+        (WebCore::FTPDirectoryTokenizer::createTDForFilename): Call Text::create.
+
+        * loader/FTPDirectoryDocument.h:
+        (WebCore::FTPDirectoryDocument::create): Call adoptRef.
+        * loader/ImageDocument.h:
+        (WebCore::ImageDocument::create): Ditto.
+        * loader/MediaDocument.h:
+        (WebCore::MediaDocument::create): Ditto.
+        * loader/PlaceholderDocument.h:
+        (WebCore::PlaceholderDocument::create): Ditto.
+        * loader/PluginDocument.h:
+        (WebCore::PluginDocument::create): Ditto.
+        * loader/TextDocument.h:
+        (WebCore::TextDocument::create): Ditto.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading): Use RefPtr instead of DocPtr.
+        (WebCore::Loader::Host::didFail): Ditto.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared): Added an initialRefCount argument,
+        defaulting to 1. Node still sometimes initializes it to 0 instead for now.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText): Use dataImpl instead of string.
+
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText): Use dataImpl instead of string.
+        (WebCore::RenderTextFragment::previousCharacter): Ditto.
+
+        * svg/SVGDocument.h:
+        (WebCore::SVGDocument::create): Use adoptRef.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance): Updated to take a
+        PassRefPtr.
+
+        * svg/SVGElementInstance.h: Made everything private.
+
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::create): Called adoptRef.
+
+        * xml/XPathNamespace.cpp:
+        (WebCore::XPathNamespace::XPathNamespace): Take AtomicString arguments.
+        * xml/XPathNamespace.h: Made everything private.
+
+        * xml/XSLTProcessor.cpp:
+        (WebCore::createFragmentFromSource): Use DocumentFragment::create and
+        Text::create.
+
+2009-08-13  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
+        nightly (20866)
+
+        https://bugs.webkit.org/show_bug.cgi?id=20866
+
+        Reviewed by Oliver Hunt.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner document. This is used by
+        AXObjectCache::handleFocusedUIElementChanged().
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Code moved from AccessibilityRenderObject::focusedUIElement(). Modified
+        to be a static function and to take a pointer to a Page.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Moved the code to generate the next AXID from getAXID() to here. Added
+        a #if to make this non-WIN only, because Windows has its own
+        implementation.
+        (WebCore::AXObjectCache::getAXID):
+        Ensure that we generate a positive AXID, ranging from 1 to LONG_MAX.
+
+        * accessibility/AXObjectCache.h:
+        Add a declaration for Document and Page. Removed the declaration of
+        AccessibilityObject, because we include the header. Reordered the
+        declaration of Node alphabetically. Moved the typedef for AXID to
+        AccessibilityObject. Removed some trailing whitespace. Added a member
+        variable to hold a pointer to the owner Document.
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner Document.
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Added; code moved from AccessiblityRenderObject::focusedUIElement().
+        Returns the focused element with respect to accessibility.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Declare a function to generate an AXID.
+        (WebCore::AXObjectCache::objectFromAXID):
+        Return the AccessibilityObject with the given AXID.
+
+        * accessibility/AccessibilityObject.h:
+        Moved the typedef for AXID from AXObjectCache to here. Made the m_id
+        member use the typedef.
+        (WebCore::AccessibilityObject::axObjectID):
+        Changed the return type to use the typedef.
+        (WebCore::AccessibilityObject::setAXObjectID):
+        Changed the argument type to use the typedef.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        Removed some unneeded #includes.
+        (WebCore::AccessibilityRenderObject::focusedUIElement):
+        Moved the code to AXObjectCache::focusedUIElementForPage(), which we now
+        call.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Ensure that we generate an AXID that is in the range 1 to LONG_MAX.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        If the Document has no Page, return. If the Page has not focused
+        element (respecting accessibility), return. Assert that the
+        accessibility of the focused element is not ignored, and that the
+        object's AXID will be negative and fit into a LONG when negated.
+        Broadcast a focus event for the object.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Pass this when creating the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Call AXObjectCache::handleFocusedUIElementChanged() on Windows.
+
+2009-08-14  Jiahua Huang  <jhuangjiahua@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Pasteboard/GtkClipboard can't handle the "text/html" target.
+        https://bugs.webkit.org/show_bug.cgi?id=27028
+
+        Remove the improper set of enum WebKitWebViewTargetInfo
+        by grabbing the target infos via m_helper.
+
+        * manual-tests/gtk/copy-htmltext.html: Added.
+        * platform/Pasteboard.h:
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::clipboard_get_contents_cb):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-08-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix an assertion when bringing up the Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=28318
+        
+        The fix for bug 28295 assumed that image clients count the number of times
+        addClient/removeClient is called. That was true for CachedResource clients,
+        but not StyleGeneratedImage clients, which pass the call onto CSSImageGeneratorValue.
+        
+        Fix by making CSSImageGeneratorValue count the number of times a client is
+        added/removed.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasChanged):
+        (WebCore::CSSCanvasValue::canvasResized):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::addClient):
+        (WebCore::CSSImageGeneratorValue::removeClient):
+        (WebCore::CSSImageGeneratorValue::getImage):
+        * css/CSSImageGeneratorValue.h:
+
+2009-08-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct libcurl crash when downloading local files.
+        https://bugs.webkit.org/show_bug.cgi?id=28312
+
+        No new tests. Test is covered by fast/encoding/char-encoding-mac.html.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse): New static function that
+          performs the local setting of valid URL and firing didReceiveResponse.
+          This code was moved from writeCallback.
+        (WebCore::writeCallback): Move local file handling to static function
+          (above) and use the function instead.
+        (WebCore::readCallback): Add check
+          for responseFired, and handle as a local file if it was not.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Fix RenderThemeHaiku build.
+        https://bugs.webkit.org/show_bug.cgi?id=28307
+
+        * platform/haiku/RenderThemeHaiku.cpp: Included RenderThemeHaiku.h
+        instead of RenderTheme.h.
+        (WebCore::RenderThemeHaiku::paintCheckbox): Removed the wrong 'virtual'
+        before the function.
+        (WebCore::RenderThemeHaiku::paintRadio): Removed the wrong 'virtual'
+        before the function.
+        * platform/haiku/RenderThemeHaiku.h: Corrected wrong function definitions.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding SharedBufferHaiku to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28309
+
+        * platform/haiku/SharedBufferHaiku.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/haiku/TemporaryLinkStubs.cpp: Removed unnecessary headers
+        and functions.
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::getSupportedKeySizes):
+
+2009-08-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Ensure we're getting the right v8 context in the V8 DOMWindowEvent custom getter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28311
+
+        This should fix Chromium failing LayoutTests/fast/events/set-event-in-another-frame.html.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-08-14  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        BUG 28134: Move the remaining parts of Access Control from XMLHttpRequest to ThreadableDocumentLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=28134
+
+        No new tests added since Access Control was already well tested and this is a pure refactor.
+
+        * loader/DocumentThreadableLoader.cpp: Move a lot of the access control code from XHR in, preserving its
+        basic strategy. Also, modify the synchronous path to not be a special case, but reuse more of the async
+        path.
+
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Go through the async path and pass additional flags.
+        (WebCore::DocumentThreadableLoader::create): Group enum params into an options struct.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Brought mostly from XHR.
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight): Ditto.
+        (WebCore::DocumentThreadableLoader::willSendRequest): Handle preflight case.
+        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
+        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Ditto.
+        (WebCore::DocumentThreadableLoader::preflightSuccess): Preflight handling.
+        (WebCore::DocumentThreadableLoader::preflightFailure): Ditto.
+        (WebCore::DocumentThreadableLoader::loadRequest): Common request function that handles async/sync.
+        * loader/DocumentThreadableLoader.h: Group enum params into an options struct.
+        * loader/ThreadableLoader.cpp: Ditto.
+        (WebCore::ThreadableLoader::create): Ditto.
+        (WebCore::ThreadableLoader::loadResourceSynchronously): Ditto.
+        * loader/ThreadableLoader.h: Ditto.
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Ditto.
+        * loader/WorkerThreadableLoader.cpp: Ditto.
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):Ditto.
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Ditto.
+        * loader/WorkerThreadableLoader.h: Ditto.
+        (WebCore::WorkerThreadableLoader::create): Ditto.
+        * platform/CrossThreadCopier.h: Allow ThreadableLoaderOptions to be copied across threads.
+        (WebCore::):
+        * workers/WorkerScriptLoader.cpp: More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadSynchronously): More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): More enum->struct grouping.
+        * xml/XMLHttpRequest.cpp: Remove all the access control code and some supporting state.
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveResponse): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveData): Ditto.
+        * xml/XMLHttpRequest.h: Ditto.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::toNodeFilter):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        Updated to new name, inherits, from old name, isObject.
+
+2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow Qt API to list and to remove URL schemes that were registered as
+        local URL schemes.
+        [Qt] Allow applications to register their own local URL scheme.
+        https://bugs.webkit.org/show_bug.cgi?id=28240
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::removeURLSchemeRegisteredAsLocal):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+
+2009-08-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Wrap console objects late (in the frontend) so that injected
+        script was already in place.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28297
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/InspectorFrontend.h:
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix logic in RenderObject::updateFillImages() that led to incorrect client
+        counts if an image was used twice in the background-image property.
+        https://bugs.webkit.org/show_bug.cgi?id=28295
+
+        Test: fast/backgrounds/multiple-backgrounds-assert.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+        Simplify the logic to call addClient()/removeClient() for every background
+        image, but go through the new layers first to avoid removing all the
+        clients of an image.
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        Make sure we override the JSObject createStructure method on those
+        objects that have custom marking routines.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Follow-up to earlier work to remove dependencies on JavaScriptCore.
+
+        * ForwardingHeaders/parser/Parser.h: Removed.
+        * inspector/JavaScriptDebugServer.cpp: Removed now-unneeded includes
+        of Parser.h.
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        'box-orient: block-axis' behaves like 'box-orient: horizontal', causes
+        an assertion failure in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=28279
+
+        Test: fast/flexbox/block-axis.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EBoxOrient): Map block-axis to
+        vertical.
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix crash when removing reflection on an absolutely-positioned image.
+        https://bugs.webkit.org/show_bug.cgi?id=28289
+        
+        Make sure we clean up the reflection layer when removing the reflection,
+        so that the RenderLayer tree does not contain pointers to deleted layers.
+
+        Test: fast/reflections/reflected-img-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::~RenderLayer):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::removeReflection):
+        * rendering/RenderLayer.h:
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        misalignment because of float:left of <div> tag
+        https://bugs.webkit.org/show_bug.cgi?id=15869
+
+        One section of http://edgar.sec.gov site draws to the right of the rest
+        of the content
+        <rdar://problem/7135951>
+
+        Tests: fast/block/float/avoidance-percent-width-compat.html
+               fast/block/float/avoidance-percent-width-strict.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Changed to apply the same float
+            avoidance logic in strict mode and in compatibility mode, which
+            matches Firefox and IE. Changed to compute and use the computed
+            width of the child, instead of ignoring non-fixed widths.
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation PositionOptions does not use correct default values.
+        https://bugs.webkit.org/show_bug.cgi?id=27254
+
+        Sets the correct default values for the properties of the PositionOptions object
+        passed to Geolocation methods. See http://www.w3.org/TR/geolocation-API/.
+
+        Also adds checking to throw an exception if arguments of the incorrect type are
+        passed to Geolocation methods. Adds a layout test to test this. This test should
+        pass on all platforms where Geolocation is implemented.
+
+        Test: fast/dom/Geolocation/argument-types.html
+
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback): Added. Creates the callback.
+        (WebCore::createPositionErrorCallback): Added. Creates the calback.
+        (WebCore::createPositionOptions): Added. Creates the PositionOptions object, setting defaults where required.
+        (WebCore::JSGeolocation::getCurrentPosition): Modified. Now uses above helper functions.
+        (WebCore::JSGeolocation::watchPosition): Modified. Now uses above helper functions.
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Asserts that PositionOptions object is present.
+        (WebCore::Geolocation::GeoNotifier::startTimer): Modified. Only starts timer if timeout has been set.
+        * page/PositionOptions.h:
+        (WebCore::PositionOptions::create): Modified. Creates object with default values.
+        (WebCore::PositionOptions::timeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::hasTimeout): Added. Determines whether a timeout has been set.
+        (WebCore::PositionOptions::setTimeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::maximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::PositionOptions): Modified. Creates object with default values.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed chromium build fix.
+
+        [Chromium] Let CodeGeneratorV8.pm know that RGBColor is ref-counted.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-08-13  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Merge error in SharedWorker code
+        https://bugs.webkit.org/show_bug.cgi?id=28277
+
+        Fixed merge error that prevents WebKit from compiling with SHARED_WORKERS enabled.
+        No new tests needed.
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Removed duplicated functions.
+
+2009-08-13  Kyle Prete  <kylep@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Chromium: Show a "Playback Disabled" button on media error.
+        https://bugs.webkit.org/show_bug.cgi?id=28196
+        Use a disabled play button when the media file cannot be played.
+
+        No new tests needed. Covered by LayoutTests/media/video-empty-source.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+
+2009-08-13  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Drag and drop support
+        https://bugs.webkit.org/show_bug.cgi?id=23642
+
+        Utilizes functions that are being called upon drag and drop actions.
+        Uses different GTK clipboards that hold different types
+        of drag data - images, HTML markup, text, URL, URL label.
+        Also clears each clipboard before setting new data to it.
+
+        No new tests - despite some implementations, no new functionality
+        is added until implementations of the GTK drag and drop protocol
+        in WebKit part.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::ClipboardGtk):
+        (WebCore::ClipboardGtk::~ClipboardGtk):
+        (WebCore::getCachedImage):
+        (WebCore::ClipboardGtk::declareAndWriteDragImage):
+        (WebCore::ClipboardGtk::writeURL):
+        (WebCore::ClipboardGtk::writeRange):
+        * platform/gtk/ClipboardGtk.h: ClipboardGdk -> ClipboardGtk
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        JavaScriptCore tweaks to get ready for the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=28243
+
+        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Removed.
+
+        * WebCore.xcodeproj/project.pbxproj: Exposed a couple header
+        files as Private that are now needed to compile Mac WebKit.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        * bindings/js/JSHistoryCustom.cpp:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSLazyEventListener.cpp:
+        * bindings/js/JSLocationCustom.cpp:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        * bindings/js/JSWebSocketConstructor.cpp:
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerConstructor.cpp:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        Updated includes.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::sourceParsed):
+        Change to not assert if this is called with no listeners.
+        I don't think this was guaranteed before, and we now use
+        this code path when recompiling. Slightly less efficient,
+        but this is a one-time cost when turning on the debugger.
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        Change to call Debugger::recompileAllJSFunctions.
+
+2009-08-13  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        <rdar://problem/7138591> and https://bugs.webkit.org/show_bug.cgi?id=28260
+        onhashchange property cannot be set from javascript.
+
+        Test: fast/loader/onhashchange-attribute-listeners.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::onhashchange):
+        (WebCore::HTMLBodyElement::setOnhashchange):
+        * html/HTMLBodyElement.h:
+        * html/HTMLBodyElement.idl:
+
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::onhashchange):
+        (WebCore::HTMLFrameSetElement::setOnhashchange):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onhashchange):
+        (WebCore::DOMWindow::setOnhashchange):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below SVGColor::rgbColor.
+
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::rgbColor): Return a PassRefPtr to ensure that the newly-allocated
+        RGBColor is cleaned up by the caller.
+        * svg/SVGColor.h:
+
+2009-08-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate to DOMAgent (serialized access to DOM).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::highlightDOMNode):
+        (WebCore::JSInspectorBackend::nodeForId):
+        (WebCore::JSInspectorBackend::idForNode):
+        (WebCore::JSInspectorBackend::wrapObject):
+        (WebCore::JSInspectorBackend::unwrapObject):
+        (WebCore::JSInspectorBackend::pushNodePathToFrontend):
+        (WebCore::JSInspectorBackend::selectDatabase):
+        (WebCore::JSInspectorBackend::selectDOMStorage):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptObjectQuarantine.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isObject):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptObjectQuarantine.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::isObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::clearMessages):
+        (WebCore::InspectorBackend::loaded):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::idForNode):
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::unwrapObject):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForId):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentElement):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::clearConsoleMessages):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        (WebInspector.ConsoleView.prototype._messagesClicked):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow.evalCallback):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._format):
+        (WebInspector.ConsoleView.prototype._formatfunction):
+        (WebInspector.ConsoleView.prototype._formatdate):
+        (WebInspector.ConsoleView.prototype._formatregexp):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatobject):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMDocument):
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.DOMAgent.prototype.nodeForId):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.DOMAgent.prototype._bindNodes):
+        (WebInspector.DOMAgent.prototype._childNodeInserted):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.setDocument):
+        (InspectorController.getStyles):
+        (InspectorController.getComputedStyle):
+        (InspectorController.getInlineStyle):
+        (InspectorController.applyStyleText):
+        (InspectorController.setStyleText):
+        (InspectorController.toggleStyleEnabled):
+        (InspectorController.applyStyleRuleText):
+        (InspectorController.addStyleSelector):
+        (InspectorController.setStyleProperty):
+        (InspectorController.getPrototypes):
+        (InspectorController.getProperties):
+        (InspectorController.setPropertyValue):
+        (InspectorController.evaluate):
+        (InspectorController.addInspectedNode):
+        (InspectorController.performSearch):
+        (InspectorController.searchCanceled):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCount):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCountSoon):
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        (WebInspector.ElementsTreeElement.prototype.updateChildren):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleRuleText):
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._doesSelectorAffectNode):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.evaluate):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.performSearch.matchExactItems):
+        (InjectedScript.performSearch.matchExactId.addNodesToResults.call):
+        (InjectedScript.performSearch.matchExactId):
+        (InjectedScript.performSearch):
+        (InjectedScript.performSearch.matchExactTagNames):
+        (InjectedScript.performSearch.matchExactAttributeNames):
+        (InjectedScript.performSearch.matchPartialTagNames):
+        (InjectedScript.performSearch.matchStartOfTagNames):
+        (InjectedScript.performSearch.matchPartialTagNamesAndAttributeValues):
+        (InjectedScript.performSearch.matchPartialAttributeValues):
+        (InjectedScript.performSearch.matchStyleSelector):
+        (InjectedScript.performSearch.matchPlainText):
+        (InjectedScript.performSearch.matchXPathQuery):
+        (InjectedScript.performSearch.finishedSearching):
+        (InjectedScript.performSearch.processChunk):
+        (InjectedScript.searchCanceled):
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript._createProxyObject):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update.callback):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted.callback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (WebInspector.clearConsoleMessages):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.updateFocusedNode):
+        (WebInspector.addNodesToSearchResult):
+        * inspector/front-end/utilities.js:
+        (Object.proxyType):
+        * storage/Storage.h:
+        (WebCore::Storage::frame):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below CSSPrimitiveValue::getRGBColorValue.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::getRGBColorValue): Return a PassRefPtr to ensure that the
+        newly-allocated RGBColor is cleaned up by the caller.
+        * css/CSSPrimitiveValue.h:
+
+2009-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        wrong font size when css font-family includes monospace
+        https://bugs.webkit.org/show_bug.cgi?id=19161
+
+        Firefox only uses fixed-width default size for exactly "font-family: monospace;".
+        WebKit has historically used fixed-width default size any time a
+        font-family includes monospace in the fallback list.
+
+        This patch corrects WebKit's behavior to match Firefox.
+        I also had to fix a bug in WebKit's font-family fallback behavior where
+        child elements would inherit parts of their parents fallback lists.
+
+        This patch is mostly just replacing all cases where we used to check for:
+        fontDescription.genericFontFamily() == MonospaceFamily
+        with:
+        fontDescription.useFixedDefaultSize()
+
+        Tests: fast/css/getComputedStyle/computed-style-font-family-monospace.html
+               fast/css/getComputedStyle/font-family-fallback-reset.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+           Deploy useFixedDefaultSize().  Also fix the bug where child
+           FontDescriptions would carry part of the parent font-family fallback list.
+        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
+           It's no longer alright to just check genericFontFamily(),
+           we have to check to make sure the changed style has a matching useFixedDefaultSize().
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::useFixedDefaultSize):
+           Only use the fixed default size if we have one font family and it is "monospace".
+           "-webkit-monospace" is the internal representation of the CSS identifier "monospace".
+
+2009-08-13  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-13  George Staikos  <george.staikos@torchmobile.com>
+
+        Rubberstamped by Darin Adler.
+
+        Use ASSERT_UNUSED instead of UNUSED_PARAM
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a couple of bugs in SecurityOrigin::createFromDatabaseIdentifier.
+        https://bugs.webkit.org/show_bug.cgi?id=28262
+
+        No new tests possible.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-08-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] getImageData fails on a given rect bigger than the image rect
+
+        The destination image and the source image was mixed up on creating the
+        imageData.
+
+        This is just a clean up and doesn't affect the current behavior. It's not
+        possible to test this failure in a LayoutTest. Only canvas uses getImageData
+        at the moment and returns before calling getImageData, if the image rect does
+        not contain the requested rect.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding RenderTheme to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28258
+
+        * platform/haiku/RenderThemeHaiku.cpp: Added.
+        (WebCore::RenderThemeHaiku::create):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeHaiku::RenderThemeHaiku):
+        (WebCore::RenderThemeHaiku::~RenderThemeHaiku):
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeHaiku::supportsFocusRing):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeHaiku::systemFont):
+        (WebCore::RenderThemeHaiku::paintCheckbox):
+        (WebCore::RenderThemeHaiku::setCheckboxSize):
+        (WebCore::RenderThemeHaiku::paintRadio):
+        (WebCore::RenderThemeHaiku::setRadioSize):
+        (WebCore::RenderThemeHaiku::adjustMenuListStyle):
+        (WebCore::RenderThemeHaiku::paintMenuList):
+        * platform/haiku/RenderThemeHaiku.h: Added.
+        (WebCore::RenderThemeHaiku::supportsHover):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Remove the "m_point" code from ContextMenuHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28256
+
+        * platform/haiku/ContextMenuHaiku.cpp:
+        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::insertItem):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-13  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a new gesture in Web Inspector to remove breakpoints
+        https://bugs.webkit.org/show_bug.cgi?id=19131
+        
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian target components (library and executable files)
+        require Unique Identifiers (i.e., UID3).
+        These identifiers are defined in the respective project
+        file, conditionally for "symbian" platform.
+
+        * WebCore.pro:
+
+2009-08-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        wrong calculation of overflow size for flexbox and table
+        https://bugs.webkit.org/show_bug.cgi?id=28064
+
+        RenderFlexibleBox and RenderTable were using the width of overflow
+        to update height of overflow, so height became wrong value and
+        width was not updated. As the corresponding code of RenderBlock
+        was sane, I factored it out and used from RenderFlexibleBox and
+        RenderTable.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateOverflowWithShadowAndReflection): created from code of layoutBlock
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlexibleBox.cpp: use updateOverflowWithShadowAndReflection
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout): use updateOverflowWithShadowAndReflection
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Revert r47185, the fix for <https://bugs.webkit.org/show_bug.cgi?id=28185>, as it broke the
+        Windows build in a non-obvious manner.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.idl:
+        * platform/Cookie.h: Removed.
+        * platform/CookieJar.h:
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        * platform/mac/CookieJar.mm:
+        * platform/network/chromium/CookieJarChromium.cpp:
+        * platform/network/curl/CookieJarCurl.cpp:
+        * platform/network/soup/CookieJarSoup.cpp:
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        * platform/network/win/CookieJarWin.cpp:
+        * platform/qt/CookieJarQt.cpp:
+
+2009-08-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed: build fix (for r47192), adding new file from
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * inspector/front-end/StatusBarButton.js: Added.
+
+2009-08-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduced StatusBarButton class that encapsulates glyphs support.
+        Views updated accordingly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): Updated to retrieve DOM element from StatusBarButton instance (here and in similar getters below.)
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
+        (WebInspector.DOMStorageItemsView.prototype.hide):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.get statusBarItems):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/Panel.js:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype.get statusBarItems):
+        (WebInspector.ProfileView.prototype._updatePercentButton):
+        (WebInspector.ProfileView.prototype._focusClicked):
+        (WebInspector.ProfileView.prototype._excludeClicked):
+        (WebInspector.ProfileView.prototype._resetClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        * inspector/front-end/StatusBarButton.js: Added.
+        (WebInspector.StatusBarButton):
+        (WebInspector.StatusBarButton.prototype._clicked):
+        (WebInspector.StatusBarButton.prototype.get disabled):
+        (WebInspector.StatusBarButton.prototype.set disabled):
+        (WebInspector.StatusBarButton.prototype.get title):
+        (WebInspector.StatusBarButton.prototype.set title):
+        (WebInspector.StatusBarButton.prototype.get toggled):
+        (WebInspector.StatusBarButton.prototype.set toggled):
+        (WebInspector.StatusBarButton.prototype.get visible):
+        (WebInspector.StatusBarButton.prototype.set visible):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css: For uniformity, class names are always used to identify status bar buttons. Also, fixed "Reload" button style to use glyphs.
+        * inspector/front-end/inspector.html:
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add shadow support in GraphicsContext::fillRect().
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect): Paint shadow if necessary.
+        (WebCore::GraphicsContext::setPlatformShadow): Inverse y offset.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for Chromium Linux.
+
+        Rollback r47157 as this broke debug tests of Chromium Linux.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        The chromium build broke due to r47185 which added
+        a cookies array to inspector/InspectorBackend.idl.
+
+        * bindings/v8/custom/V8CustomBinding.h: Added the declaration for the cookies callback.
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL(InspectorBackendCookies)): Stubbed out an implementation
+         for the cookies callback.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-08  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Cookies in Storage Panel
+        https://bugs.webkit.org/show_bug.cgi?id=27202
+
+          Data Structure for a Cookie. Just Key/Value for Now:
+
+        * inspector/front-end/Cookie.js: Added.
+        (WebInspector.Cookie):
+        (WebInspector.Cookie.prototype.get key):
+        (WebInspector.Cookie.prototype.set key):
+        (WebInspector.Cookie.prototype.get value):
+        (WebInspector.Cookie.prototype.set value):
+
+          A Storage View for Cookies.  Allows for Refresh/Delete:
+
+        * inspector/front-end/CookieItemsView.js: Added.
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): refresh and delete buttons
+        (WebInspector.CookieItemsView.prototype.show):
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies): parses the inspected window's document.cookie string
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies): creates a datagrid for cookies
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked): attempt at deleting the cookie (not flawless)
+        (WebInspector.CookieItemsView.prototype._refreshButtonClicked): rebuild the datagrid
+
+          Include a SidebarSection Section in the Databases Panel:
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.show): calls populateInterface
+        (WebInspector.DatabasesPanel.prototype.populateInterface): adds cookies if they don't exist
+        (WebInspector.DatabasesPanel.prototype.reset): remove cookie specific parts
+        (WebInspector.DatabasesPanel.prototype.addCookies): add cookies sidebar tree element
+        (WebInspector.DatabasesPanel.prototype.showCookies): sets the visible view to a CookiesItemView
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle): just "Cookies" at the moment
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle): no subtitle yet
+        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
+
+          New "Cookies" Image for the Sidebar:
+
+        * inspector/front-end/Images/cookie.png: Added.
+        * inspector/front-end/inspector.css:
+
+          Include the Added Files where appropriate:
+
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add SQLTransactionCoordinator.[h,cpp] to WebCore.pro.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28246
+
+        * WebCore.pro:
+
+2009-08-12  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Mark unused variables to avoid compile failures in -Werror.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-12  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Niko Zimmermann.
+
+        This is to add WCSS marquee support , which is defined by OMA and is an extension for CSS2, 
+        It extends CSS display with "display:-wap-marquee;-wap-marquee-dir:xxx;-wap-marquee-speed:xxx;-wap-marquee-style:xxx"
+        Minor fixes by Eric Seidel and George Staikos.
+        https://bugs.webkit.org/show_bug.cgi?id=23727
+
+        No new tests, the tests have already been landed at LayoutTests/fast/wcss/
+
+        * WebCore.pro:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * css/WCSSPropertyNames.in: Added.
+        * css/WCSSValueKeywords.in: Added.
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::start):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        Update the canvas renderer's intrinsic size with the zoomed
+        lengths and ensure the intrinsic size is correct when setting
+        an initial style.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26908
+
+        Test: fast/canvas/canvas-zoom.html
+
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::styleDidChange):
+
+2009-08-12  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix regression for dragging the media controller thumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28211
+
+        Modified the conditions for rejecting events on the media controller
+        to only rejecting mouse events not from the left button.
+
+        Test: media/controls-drag-timebar.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+
+2009-08-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixing a deadlock caused by two transactions that run on two
+        different database handles for the same DB. Adding a per-DB thread
+        transaction coordinator that allows the DB thread to run only one
+        transaction per DB file at any given time.
+
+        Adding a regression test for this bug.
+
+        Test: storage/multiple-transactions-on-different-handles.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=27966
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionCoordinator):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionCoordinator):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::debugStepName):
+        (WebCore::SQLTransaction::performNextStep):
+        (WebCore::SQLTransaction::aquireLock):
+        (WebCore::SQLTransaction::lockAquired):
+        (WebCore::SQLTransaction::cleanupAfterSuccessCallback):
+        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp: Added.
+        * storage/SQLTransactionCoordinator.h: Added.
+
+2009-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Custom properties on DOM objects are lost after GC (as demonstrated by the gc-9.html test)
+        https://bugs.webkit.org/show_bug.cgi?id=28194
+
+        * GNUmakefile.am: Added the two new source files.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSCSSRuleListCustom.cpp: Added.
+        (WebCore::JSCSSRuleList::markChildren): Call markDOMObjectWrapper
+        on rules in the list.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::markChildren): Added. Call
+        markDOMObjectWrapper on the CSSValue objects that are owned by the
+        declaration as values of the properties.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Added code to handle some
+        cases where nodes are observable because they own objects that
+        in turn have custom properties.
+
+        * bindings/js/JSDOMBinding.h: Fix a typo in the header.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren): Added call to markDOMObjectWrapper
+        for implementation and styleSheets.
+
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::markChildren): Added. Calls markDOMObjectWrapper
+        for attributes and style.
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added.
+        (WebCore::JSHTMLCanvasElement::markChildren): Call markDOMObjectWrapper
+        on the rendering context.
+
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren): Call markDOMObjectWrapper on
+        items in the stylesheet.
+
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::markChildren): Added. Calls
+        markDOMObjectWrapper on stylesheets in the list.
+
+        * css/CSSRuleList.idl: Added CustomMarkFunction.
+        * css/CSSStyleDeclaration.idl: Ditto.
+        * css/StyleSheetList.idl: Ditto.
+        * dom/Element.idl: Ditto.
+        * html/HTMLCanvasElement.idl: Ditto.
+
+        * dom/Element.h: Made everything private that could be.
+        Added access to the attributeMap that does returns
+        the existing map without doing any of the lazy-updating work. This
+        is needed to get at the existing attributes during garbage collection
+        without having side effects.
+
+        * html/HTMLCanvasElement.h: Cleaned up the header a bit, making
+        members private. Added renderingContext2D function for use in
+        JSHTMLCanvasElement::markChildren.
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes two bugs about Pan Scrolling - Scrolling with middle mouse button doesn't 
+        work in Expanded view on reader.google.com, and Can enter auto scroll from a non-scrollable area.
+        https://bugs.webkit.org/show_bug.cgi?id=28023
+        https://bugs.webkit.org/show_bug.cgi?id=24794
+        
+        Added a new method to RenderBox seeing if the Box can be scrolled and actually has something to
+        scroll, and use that for pan scrolling.
+
+        Test: platform/win/fast/events/panScroll-nested-divs.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::updateAutoscrollRenderer):
+        (WebCore::EventHandler::handleMousePressEvent):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://6728361> Mouse wheel scrolling on a page with expanded drop down 
+        list detaches drop down.
+
+        Added a function for Windows PopupMenu's to return their class name.
+
+         * platform/PopupMenu.h:
+         * platform/win/PopupMenuWin.cpp:
+         (WebCore::PopupMenu::popupClassName):
+
+2009-08-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        WINCE PORT: Color and Gradient
+        https://bugs.webkit.org/show_bug.cgi?id=27511
+
+        * platform/graphics/wince/ColorWince.cpp: Added.
+        * platform/graphics/wince/GradientWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        No new tests because it's a just typo fix.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-12  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27458
+        Support for the :default CSS pseudoclass, as per HTML5 spec.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/interactive-elements.html#selector-default
+
+        Tests: fast/css/pseudo-default-001.html
+               fast/css/pseudo-default-002.html
+               fast/css/pseudo-default-003.html
+               fast/css/pseudo-default-004.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): pseudoDefault
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): sharing stuff is
+        aware that only one default button can be present in a form
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        the :default CSS pseudoclass
+        * dom/Element.h:
+        (WebCore::Element::isDefaultButtonForForm): new method to determine
+        whether a FormControl is a default button for a given form
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isDefaultButtonForForm): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::defaultButton): extracts the default button
+        from the form
+        * html/HTMLFormElement.h:
+
+2009-08-12  David Levin  <levin@chromium.org>
+
+        No review, rolling out r47106.
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This patch relied on a new version of v8 which is not available
+        in chromium yet.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26993 : Geolocation::requestPermission()
+        https://bugs.webkit.org/show_bug.cgi?id=26993
+
+        Second patch to allow the Geolocation permission request to chrome to be asynchronous
+        or synchronous. Fixes a bug where callbacks were called twice when permissions
+        are granted synchronously.
+
+        No new tests required.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::setIsAllowed): Modified. Calls makeSuccessCallbacks() rather than geolocationServicePositionChanged().
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modified. Updated logic to avoid repeated callbacks when permissions are granted synchronously.
+        (WebCore::Geolocation::makeSuccessCallbacks): Added. Calls success callbacks.
+        * page/Geolocation.h: Modified. Adds makeSuccessCallbacks().
+
+2009-08-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6952336>
+        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const + 27
+
+        Make sure to set the security origin before calling dispatchWindowObjectAvailable.
+        
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+
+2009-08-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix [Chromium] drop down menu letter selection, skip selections
+        https://bugs.webkit.org/show_bug.cgi?id=28205
+
+        Not auto-testable since it is chromim platform specific code, and it involves sending a keyboard 
+        event to the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        * manual-tests/keyboard_select_elements_with_same_beginning.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent): style change.
+        (WebCore::PopupListBox::handleKeyEvent): typeAheadFind should be called only when the event is
+        a character type event to avoid calling twice for English.
+        (WebCore::PopupListBox::typeAheadFind): remove unnecessary checking of isCharacterTypeEvent() since the whole function is only called under that condition.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding GraphicsContext to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp: Added.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setPlatformFont):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::getHaikuStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Modifying WebCore/platform/graphics files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/graphics/BitmapImage.h: Adding getBBitmap() function.
+        * platform/graphics/Color.h: rgb_color is the Color struct in Haiku.
+        * platform/graphics/FloatPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/FloatRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/GraphicsContext.cpp: 
+        * platform/graphics/GraphicsContext.h: BView is the PlatformGraphicsContext
+        class for Haiku. Adding getHaikuStrokeStyle() function.
+        * platform/graphics/Icon.h: Adding an empty Icon() constructor because
+        this class isn't implemented for the moment.
+        * platform/graphics/ImageSource.h: BBitmap is the native bitmap class 
+        for Haiku.
+        * platform/graphics/IntPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/IntRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/IntSize.h: BSize is the Size class in Haiku.
+        * platform/graphics/Path.h: BRegion is the Path class in Haiku.
+        * platform/graphics/Pattern.h: Adding the GraphicsDef.h header and the 
+        native pattern type.
+        * platform/graphics/SimpleFontData.h: Adding Haiku's Font.h header.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding modification to the WebCore/platform/ files to allow
+        the Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/ContextMenuItem.h: BMenu is the PlatformMenuItemDescription
+        class of Haiku.
+        * platform/Cursor.h: BCursor is the Cursor class of Haiku.
+        * platform/DragData.h: Use a BMessage as DragDataRef.
+        * platform/DragImage.h: Use a BBitmap as DragImageRef.
+        * platform/PlatformKeyboardEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformMenuDescription.h: BMenu is the 
+        PlatformMenuDescription class of Haiku.
+        * platform/PlatformMouseEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformWheelEvent.h: Use BMessage as event vehicle.
+        * platform/PopupMenu.h: Adding a m_menu attribute for Haiku.
+        * platform/Widget.h: BView is the PlatformWidget class of Haiku.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Tiny modifications on WebCore files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * bindings/js/ScriptControllerHaiku.cpp: Style cleanup.
+        * loader/CachedFont.cpp: Haiku behaves like Qt, Gtk, or Chromium,
+        so many PLATFORM(HAIKU) were added to these functions.
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+        * page/EventHandler.cpp: Like the mac and Qt port, Haiku doesn't need the
+        invertSenseOfTabsToLinks() function.
+        * page/haiku/DragControllerHaiku.cpp: Style cleanup.
+        * platform/image-decoders/ImageDecoder.h: For image decoding Haiku
+        behaves like Cairo or Wx, (not like Skia).
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/text/PlatformString.h: Adding the String(BString&) and BString()
+        methods specific to Haiku.
+        * platform/text/UnicodeRange.h: Haiku needs to include stdint.h.
+        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp:
+        (WebCore::currentSearchLocaleID): Missing function.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the ScrollbarTheme files.
+        https://bugs.webkit.org/show_bug.cgi?id=28125
+
+        * platform/haiku/ScrollbarThemeHaiku.cpp: Added.
+        (buttonWidth):
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeHaiku::ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::~ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::scrollbarThickness):
+        (WebCore::ScrollbarThemeHaiku::hasButtons):
+        (WebCore::ScrollbarThemeHaiku::hasThumb):
+        (WebCore::ScrollbarThemeHaiku::backButtonRect):
+        (WebCore::ScrollbarThemeHaiku::forwardButtonRect):
+        (WebCore::ScrollbarThemeHaiku::trackRect):
+        (WebCore::ScrollbarThemeHaiku::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeHaiku::paintButton):
+        (WebCore::ScrollbarThemeHaiku::paintThumb):
+        * platform/haiku/ScrollbarThemeHaiku.h: Added.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding eight simple files to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28122
+
+        * platform/graphics/haiku/ColorHaiku.cpp: Added.
+        (WebCore::Color::Color):
+        (WebCore::Color::operator rgb_color):
+        (WebCore::focusRingColor):
+        * platform/graphics/haiku/FloatPointHaiku.cpp: Added.
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore::FloatPoint::operator BPoint):
+        * platform/graphics/haiku/FloatRectHaiku.cpp: Added.
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator BRect):
+        * platform/graphics/haiku/GradientHaiku.cpp: Added.
+        (WebCore::Gradient::platformDestroy):
+        (WebCore::Gradient::platformGradient):
+        (WebCore::Gradient::fill):
+        * platform/graphics/haiku/IntPointHaiku.cpp: Added.
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator BPoint):
+        * platform/graphics/haiku/IntRectHaiku.cpp: Added.
+        (WebCore::IntRect::IntRect):
+        (WebCore::IntRect::operator BRect):
+        * platform/graphics/haiku/IntSizeHaiku.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator BSize):
+        * platform/graphics/haiku/PathHaiku.cpp: Added.
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::hasCurrentPoint):
+        (WebCore::Path::contains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        (WebCore::Path::strokeBoundingRect):
+
+2009-08-12  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Implement Keygen for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/KeygenWince.cpp: Added.
+
+2009-08-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Kevin Ollivier.
+
+        Handle crash in wx due to null value passed to strlen in
+        the CString constructor.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath):  Check for null return from getenv
+        and use default CString constructor instead.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: simple stubs to make it build for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/DragDataWince.cpp: Added.
+        * platform/wince/DragImageWince.cpp: Added.
+        * platform/wince/EditorWince.cpp: Added.
+        * platform/wince/KURLWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCEPORT: FileSystem and FileChooser
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/FileChooserWince.cpp: Added.
+        * platform/wince/FileSystemWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: implement Cursor for WINCE. There's no real cursor on most
+        WinMob devices. We pass the cursor info to application, which so that 
+        can determine what to do.
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/CursorWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MIMETypeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/MIMETypeRegistryWince.cpp: Added.
+
+2009-08-12  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Pasteboard and SearchPopupMenu
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/PasteboardWince.cpp: Added.
+        * platform/wince/SearchPopupMenuWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Add SharedTimerWince.cpp and SystemTimeWince.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/SharedTimerWince.cpp: Added.
+        * platform/wince/SystemTimeWince.cpp: Added.
+
+2009-08-12  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28204
+        Allow C++ exceptions to be disabled in WebCore's V8 Mac build.
+
+        * WebCorePrefix.h:
+        Only undefine |try| and |catch| when building Objective-C[++],
+        leaving the C++ library definitions intact for C++.
+
+2009-08-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a Custom Setter for DOMWindowEvent in the V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        Tests: fast/events/set-event-in-another-frame.html
+               fast/events/set-event-to-null.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Clean up custom getter/setter code, 
+            as it currently doesn't support a custom getter 
+            and a v8-specific custom setter simultaneously.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * page/DOMWindow.idl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge wx/ImageSourceWx.cpp into ImageSource.cpp.  No changes to
+        ImageSource.cpp were needed, so this just deletes ImageSourceWx.cpp.
+
+        * WebCore.gypi:
+        * WebCoreSources.bkl:
+        * platform/graphics/wx/ImageSourceWx.cpp: Removed.
+        * webcore-wx.bkl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+        Build fix after r47099.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-08-08  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        WINCE PORT: Implement Path for WINCE. Most code can be
+        reused for other ports that don't have native path support
+        https://bugs.webkit.org/show_bug.cgi?id=28188
+
+        Written also by George Staikos (including quadCurve() and bezier())
+
+        * platform/graphics/wince/PathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.h: Added.
+        * platform/graphics/wince/WinceGraphicsExtras.h: Added.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        "Double-click to add" new style button does not always show up [quick fix]
+        https://bugs.webkit.org/show_bug.cgi?id=28187
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+2009-08-12  Crystal Zhang <crystal.zhang@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MediaPlayerProxy and MediaPlayerPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=28178
+
+        * platform/graphics/wince/MediaPlayerPrivateWince.h: Added.
+        * platform/graphics/wince/MediaPlayerProxy.cpp: Added.
+        * platform/graphics/wince/MediaPlayerProxy.h: Added.
+
+2009-08-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        HTML 5 database and LocalStorage is not persistent on the Symbian port of QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=28175
+
+        Call QDir::toNativeSeparators() before the path is passed to the OS.
+
+        Based on work by David Leong.
+        
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::pathByAppendingComponent):
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Minor build-fix for SVG Filter. Use getUnmultipliedImageData instead
+        of getImageData. This changed since r47099.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+
+2009-08-12  Viet-Trung Luu  <viettrungluu@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Explicitly set control tints for Chromium/Mac, since the controls'
+        NSCell(s) lack an NSView and hence their tint isn't updated
+        automatically when the application is activated/deactivated.
+        https://bugs.webkit.org/show_bug.cgi?id=28108
+        http://crbug.com/18199
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::updateNSCellControlTint):
+        (WebCore::RenderThemeChromiumMac::paintCheckbox):
+        (WebCore::RenderThemeChromiumMac::paintRadio):
+        (WebCore::RenderThemeChromiumMac::paintButton):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+
+2009-08-12  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Fix box-shadow painting in r47103. The edge should not be blurry.
+        Also optimize by not having to save and restore painter state.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] Fix coding style in GraphicsContextQt.cpp
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+        (WebCore::toQtLineCap):
+        (WebCore::toQtLineJoin):
+        (WebCore::GraphicsContextPlatformPrivate::p):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::pen):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+
+2009-08-12  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by Simon Hausmann and Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        [Qt] Partial support for -webkit-box-shadow. Blur is not support and
+        the shadow still does not go well with border radius.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Use AM_V_GEN in a few more places, for less noisy builds.
+
+        * GNUmakefile.am:
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Some SVG Filters need premultiplied ImageData for the calculation. Therefore getImageData
+        and putImageData of ImageBuffer need support for premultiplied colors.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::getImageData):
+        (WebCore::CanvasRenderingContext2D::putImageData):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-08-12  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Changed Number.bytesToString to support low-resolution output.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28146
+
+        * inspector/front-end/utilities.js:
+        (Number.bytesToString):
+
+2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for hooking BeginPaint/EndPaint on 64Bit Windows
+
+        Webkit uses the runtime patching trick explained by "Feng Yuan" for
+        hooking these paint functions. It currently supports only 32bit assembly
+        code. This patch adds support for 64Bit version. Since inline-assemblies
+        are not supported for 64Bit, we have use a seperate .asm file.
+
+        * WebCore.pro:
+        * plugins/win/PaintHooks.asm: Added.
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Add forwarding header for PossiblyNull type, and add missing null check
+        to ImageBuffer creation.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restrict use of FuncDeclNode & FuncExprNode to the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=28209
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+            Function signature change.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge skia/ImageSourceSkia.cpp into ImageSource.cpp.
+
+        * WebCore.gypi: Remove deleted file, plus a file that was deleted a while back.
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData): Use slightly shorter syntax.
+        (WebCore::ImageSource::filenameExtension): Use shorter syntax.
+        (WebCore::ImageSource::createFrameAtIndex): Remove redundant call, clarify comments, reject all empty images.
+        (WebCore::ImageSource::frameHasAlphaAtIndex): Clarify comments, use shorter syntax.
+        * platform/graphics/skia/ImageSourceSkia.cpp: Removed.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers do not exit when the last parent document exits
+        https://bugs.webkit.org/show_bug.cgi?id=28170
+
+        Prevents Documents from being suspended/placed in the page cache if they are associated with shared workers.
+
+        Added vector cache instead of nested hash tables for SharedWorker repository.
+
+        Added SharedWorkerRepository::documentDetached API.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Notifies SharedWorkerRepository when the document is closing.
+        * loader/FrameLoader.cpp:
+        Updated FrameLoader to not cache the Document if it is associated with a SharedWorker (since we can't suspend workers yet, we need to shut them down).
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::create):
+        (WebCore::SharedWorkerProxy::isClosing):
+        Renamed from closing().
+        (WebCore::SharedWorkerProxy::matches):
+        Added manual equality function to replace old hash lookup.
+        (WebCore::SharedWorkerProxy::isDocumentInWorkerDocuments):
+        Checks to see if a document is in the worker's list of documents. Used to determine if page is suspendable.
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Added tracking of the worker's list of documents for lifecycle purposes.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Shuts down the proxy when the last associated document is detached.
+        (WebCore::SharedWorkerProxy::close):
+        Marks the proxy as closed so it is no longer shared with new instances.
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        Removes the proxy from the repository/frees the proxy when the associated SharedWorkerContext is destroyed.
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        closing()->isClosing()
+        (WebCore::SharedWorkerRepository::documentDetached):
+        (WebCore::SharedWorkerRepository::hasSharedWorkers):
+        Used by FrameLoader to determine if a page has shared workers and so cannot be suspended/cached.
+        (WebCore::DefaultSharedWorkerRepository::hasSharedWorkers):
+        (WebCore::DefaultSharedWorkerRepository::removeProxy):
+        Invoked by workerContextDestroyed() to remove a SharedWorkerProxy from the repository.
+        (WebCore::DefaultSharedWorkerRepository::documentDetached):
+        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorkerRepository.h:
+
+2009-08-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 28200 - ListMarker should be included as part of the text value to parse
+        https://bugs.webkit.org/show_bug.cgi?id=28200
+
+        When returning text through the marker range attributes, the list marker text should
+        also be included. It isn't included by default because a TextIterator is used which
+        only looks at Nodes for text. A list marker does not have a corresponding node,
+        so its text is not returned through accessibility. That is, until now.
+
+        Test: platform/mac/accessibility/string-range-contains-listmarker.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::listMarkerTextForRange):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+        * rendering/RenderListItem.h:
+
+        Make markerText() public so that accessibility code can access it.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move cairo/ImageSourceCairo.cpp to ImageSource.cpp in preparation for
+        merging most of the other ImageSource*.cpp files with it.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/ImageSource.cpp: Copied from WebCore/platform/graphics/cairo/ImageSourceCairo.cpp.
+        * platform/graphics/cairo/ImageSourceCairo.cpp: Removed.
+
+2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Cairo-based Windows port does not handle the https protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=28171.
+
+        No new tests needed.  Existing https tests show this failure
+        for WinCairo builds.
+
+        * WebCore.vcproj/WebCoreCURL.vsprops: Add a few preprocessor
+          definitions for SSL support in cURL.
+        * platform/network/curl/ResourceHandleManager.h: Add new
+          certificate path member variable.
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificateBundlePath): New method to retrieve the
+          proper certificate resource bundle path.
+        (WebCore::ResourceHandleManager::initializeHandle): Check for
+          the resource bundle and use if available to activate SSL
+          support.
+
+2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Use Clipboard::create() instead of the constructor of Clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28127
+
+        * editing/haiku/EditorHaiku.cpp:
+        (WebCore::Editor::newGeneralClipboard):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/haiku/ClipboardHaiku.cpp: Style cleanup. There were many whitespace end of lines.
+        (WebCore::ClipboardHaiku::ClipboardHaiku):
+        (WebCore::ClipboardHaiku::clearAllData):
+        (WebCore::ClipboardHaiku::getData):
+        (WebCore::ClipboardHaiku::setData):
+        (WebCore::ClipboardHaiku::types):
+        (WebCore::ClipboardHaiku::dragLocation):
+        (WebCore::ClipboardHaiku::dragImage):
+        (WebCore::ClipboardHaiku::setDragImage):
+        (WebCore::ClipboardHaiku::dragImageElement):
+        (WebCore::ClipboardHaiku::createDragImage):
+        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
+        (WebCore::ClipboardHaiku::writeURL):
+        (WebCore::ClipboardHaiku::writeRange):
+        (WebCore::ClipboardHaiku::hasData):
+        * platform/haiku/DragDataHaiku.cpp:
+        (WebCore::DragData::createClipboard):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative GTK build fix
+
+        * GNUmakefile.am:
+        Added missing .idl file, and added notifications directory to IDL_PATH.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Added missing build steps for non-debug targets.
+
+2009-08-11  Drew Wilson <atwilson@google.com>
+
+        Reviewed by NOBODY (build break)
+
+        Speculative build fix for Qt build.
+
+        * WebCore.pro: Added /notifications to include path
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25463
+
+        Adds an implementation of desktop notifications, behind the compile-time
+        flag ENABLE(NOTIFICATIONS).  This code simply relays calls on the JavaScript
+        API through a NotificationProvider interface, which must provide the services
+        to actually notify the user and manage the desktop.  This provider is injected
+        into WebKit through the ChromeClient for normal page contexts and through the
+        WorkerThread for worker contexts.
+
+        A permissions API is defined on a per-origin basis, which allows a web page
+        to check if its origin is allowed to show desktop notifications, and to request
+        permission for its origin.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDesktopNotificationsCustom.cpp: Added.
+        (WebCore::JSNotificationCenter::requestPermission):
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::JSNotification::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toNotification):
+        * dom/EventTarget.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::notificationPresenter):
+        * notifications: Added.
+        * notifications/Notification.cpp: Added.
+        (WebCore::Notification::Notification):
+        (WebCore::Notification::~Notification):
+        (WebCore::Notification::show):
+        (WebCore::Notification::cancel):
+        (WebCore::Notification::ondisplay):
+        (WebCore::Notification::setOndisplay):
+        (WebCore::Notification::onerror):
+        (WebCore::Notification::setOnerror):
+        (WebCore::Notification::onclose):
+        (WebCore::Notification::setOnclose):
+        (WebCore::Notification::getAttributeEventListener):
+        (WebCore::Notification::setAttributeEventListener):
+        (WebCore::Notification::clearAttributeEventListener):
+        (WebCore::Notification::dispatchDisplayEvent):
+        (WebCore::Notification::dispatchErrorEvent):
+        (WebCore::Notification::dispatchCloseEvent):
+        (WebCore::Notification::addEventListener):
+        (WebCore::Notification::removeEventListener):
+        (WebCore::Notification::handleEvent):
+        (WebCore::Notification::dispatchEvent):
+        * notifications/Notification.h: Added.
+        (WebCore::Notification::create):
+        (WebCore::Notification::isHTML):
+        (WebCore::Notification::url):
+        (WebCore::Notification::contents):
+        (WebCore::Notification::scriptExecutionContext):
+        (WebCore::Notification::toNotification):
+        (WebCore::Notification::refEventTarget):
+        (WebCore::Notification::derefEventTarget):
+        * notifications/Notification.idl: Added.
+        * notifications/NotificationCenter.cpp: Added.
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h: Added.
+        (WebCore::NotificationCenter::create):
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::context):
+        (WebCore::NotificationCenter::presenter):
+        * notifications/NotificationCenter.idl: Added.
+        * notifications/NotificationContents.h: Added.
+        (WebCore::NotificationContents::NotificationContents):
+        (WebCore::NotificationContents::icon):
+        (WebCore::NotificationContents::title):
+        (WebCore::NotificationContents::body):
+        * notifications/NotificationPresenter.h: Added.
+        (WebCore::NotificationPresenter::):
+        (WebCore::NotificationPresenter::~NotificationPresenter):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::notificationPresenter):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::webkitNotifications):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/Page.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        (WebCore::WorkerContext::webkitNotifications):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+
+2009-08-11  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Drawer is Toggling instead of Staying Open
+        https://bugs.webkit.org/show_bug.cgi?id=28115
+
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.showView): ensures the drawer will be open and showing the provided view
+        * inspector/front-end/inspector.js:
+        (WebInspector.showConsole): usees the new showView to guarantee the Drawer will be open
+        (WebInspector.showChanges): uses the new showView guarantee the Drawer will be open
+
+2009-08-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] WMLPageState is not allowed to store the active card, it needs to be done per document
+        https://bugs.webkit.org/show_bug.cgi?id=28180
+
+        Don't store the active WMLCardElement in WMLPageState, but in WMLDocument.
+        Otherwhise this may lead to crashes related to intrinsic event exeuction.
+
+        Unfortunately select elements aren't testable by the layout tests, so adding
+        a new manual test reproducing the crash.
+
+        * manual-tests/wml/select-onpick-event-crash.wml: Added.
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::activeCard):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::WMLPageState):
+        * wml/WMLPageState.h:
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+
+2009-08-07  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28073
+        Treat icons with no bit count and no color count as 256-color for
+        purposes of quality ranking.  Also fix a couple cases of a style
+        violation.
+
+        Test: fast/images/icon-0colors.html
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Need to refactor WorkerObjectProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=28136
+
+        Added WorkerReportingProxy for reporting worker state (exceptions, console messages, thread exited) to the parent.
+
+        Existing tests are sufficient, as this is only a refactoring.
+
+        * GNUmakefile.am:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.gypi:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.vcproj/WebCore.vcproj:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added WorkerReportingProxy.h to build.
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        Changed constructor to pass WorkerReportingProxy to base class.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Updated SharedWorkerProxy to implement WorkerReportingProxy interface.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Now passes in WorkerReportingProxy when creating SharedWorkerThread.
+        * workers/SharedWorkerContext.cpp:
+        * workers/SharedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        Passes WorkerReportingProxy to base class constructor.
+        * workers/SharedWorkerThread.h:
+        Constructor now takes a WorkerReportingProxy.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Moved code that calls workerContextDestroyed() into base class so shared workers share this functionality.
+        (WebCore::WorkerContext::close):
+        Now notifies WorkerReportingProxy when the thread is closing.
+        (WebCore::WorkerContext::reportException):
+        Reports exceptions via WorkerReportingProxy.
+        (WebCore::WorkerContext::addMessage):
+        Reports console messages via WorkerReportingProxy.
+        * workers/WorkerContext.h:
+        * workers/WorkerObjectProxy.h:
+        (WebCore::WorkerObjectProxy::workerContextClosed):
+        Default empty implementation for dedicated workers.
+        * workers/WorkerReportingProxy.h: Added.
+        Base interface that contains APIs moved from WorkerObjectProxy.
+        (WebCore::WorkerReportingProxy::~WorkerReportingProxy):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        Updated constructor to accept a WorkerReportingProxy.
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerReportingProxy):
+
+2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Fix the Qt build after r47022.
+
+        Use the new markChildren() pattern for marking aggregate/child objects.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::markChildren):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        * bridge/qt/qt_runtime.h:
+
 2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Holger Freyther.
@@ -191,7 +25661,7 @@
         * page/DOMWindow.cpp:
         (WebCore::DOMWindow::applicationCache):
 
-2009-08-10  Crystal Zhang  <crystal.zhang@staikos.net>
+2009-08-10  Crystal Zhang  <crystal.zhang@torchmobile.com>
 
         Reviewed by George Staikos.
 
diff --git a/WebCore/ChangeLog-2009-06-16 b/WebCore/ChangeLog-2009-06-16
index 1041c90..1f283d2 100644
--- a/WebCore/ChangeLog-2009-06-16
+++ b/WebCore/ChangeLog-2009-06-16
@@ -47996,7 +47996,7 @@
 
         Rubber-stamped by Simon Hausmann.
 
-        http://www.qtsoftware.com/developer/task-tracker/index_html?id=238662&method=entry
+        http://qt.nokia.com/developer/task-tracker/index_html?id=238662&method=entry
 
         [Qt] Map function keys F1 to F24.
 
@@ -52735,7 +52735,7 @@
 
         Reviewed by Simon Hausmann.
 
-        http://www.qtsoftware.com/developer/task-tracker/index_html?id=211228&method=entry
+        http://qt.nokia.com/developer/task-tracker/index_html?id=211228&method=entry
 
         [Qt] Show focus rect when a button gets the focus for the first time.
         This is important at least for Windows style.
diff --git a/WebCore/Configurations/FeatureDefines.xcconfig b/WebCore/Configurations/FeatureDefines.xcconfig
index 37d2df6..ed387aa 100644
--- a/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/WebCore/Configurations/FeatureDefines.xcconfig
@@ -28,7 +28,9 @@
 
 // Set any ENABLE_FEATURE_NAME macro to an empty string to disable that feature.
 
-ENABLE_3D_CANVAS = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(MAC_OS_X_VERSION_MAJOR));
+ENABLE_3D_CANVAS_1050 = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS_1060 = ENABLE_3D_CANVAS;
 
 ENABLE_3D_RENDERING = $(ENABLE_3D_RENDERING_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_RENDERING_1050 = ENABLE_3D_RENDERING;
@@ -37,14 +39,18 @@ ENABLE_3D_RENDERING_1060 = ENABLE_3D_RENDERING;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_DATABASE = ENABLE_DATABASE;
 ENABLE_DATAGRID = ENABLE_DATAGRID;
+ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
+ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
 ENABLE_FILTERS = ;
 ENABLE_GEOLOCATION = ;
 ENABLE_ICONDATABASE = ENABLE_ICONDATABASE;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_MATHML = ;
+ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
 ENABLE_RUBY = ENABLE_RUBY;
-ENABLE_SHARED_WORKERS = ;
+ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_ANIMATION = ENABLE_SVG_ANIMATION;
 ENABLE_SVG_AS_IMAGE = ENABLE_SVG_AS_IMAGE;
@@ -59,4 +65,4 @@ ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DOM_STORAGE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebCore/Configurations/Version.xcconfig b/WebCore/Configurations/Version.xcconfig
index d07d57f..66d574b 100644
--- a/WebCore/Configurations/Version.xcconfig
+++ b/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 0;
+MINOR_VERSION = 2;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebCore/DerivedSources.cpp b/WebCore/DerivedSources.cpp
index b0311e2..48a67e9 100644
--- a/WebCore/DerivedSources.cpp
+++ b/WebCore/DerivedSources.cpp
@@ -28,9 +28,14 @@
 #include "JSAbstractWorker.cpp"
 #include "JSAttr.cpp"
 #include "JSBarInfo.cpp"
+#include "JSBeforeLoadEvent.cpp"
 #include "JSCanvasGradient.cpp"
 #include "JSCanvasPattern.cpp"
+#include "JSCanvasRenderingContext.cpp"
 #include "JSCanvasRenderingContext2D.cpp"
+#if ENABLE(3D_CANVAS)    
+#include "JSCanvasRenderingContext3D.cpp"
+#endif
 #include "JSCDATASection.cpp"
 #include "JSCharacterData.cpp"
 #include "JSClientRect.cpp"
@@ -73,6 +78,7 @@
 #include "JSErrorEvent.cpp"
 #include "JSEvent.cpp"
 #include "JSEventException.cpp"
+#include "JSEventSource.cpp"
 #include "JSFile.cpp"
 #include "JSFileList.cpp"
 #include "JSHistory.cpp"
@@ -92,6 +98,7 @@
 #include "JSHTMLDataGridCellElement.cpp"
 #include "JSHTMLDataGridColElement.cpp"
 #include "JSHTMLDataGridRowElement.cpp"
+#include "JSHTMLDataListElement.cpp"
 #include "JSHTMLDirectoryElement.cpp"
 #include "JSHTMLDivElement.cpp"
 #include "JSHTMLDListElement.cpp"
@@ -166,7 +173,10 @@
 #include "JSNodeIterator.cpp"
 #include "JSNodeList.cpp"
 #include "JSNotation.cpp"
+#include "JSNotificationCenter.cpp"
+#include "JSNotification.cpp"
 #include "JSOverflowEvent.cpp"
+#include "JSPageTransitionEvent.cpp"
 #include "JSPlugin.cpp"
 #include "JSPluginArray.cpp"
 #include "JSProcessingInstruction.cpp"
@@ -210,7 +220,6 @@
 #include "JSSVGColor.cpp"
 #include "JSSVGComponentTransferFunctionElement.cpp"
 #include "JSSVGCursorElement.cpp"
-#include "JSSVGDefinitionSrcElement.cpp"
 #include "JSSVGDefsElement.cpp"
 #include "JSSVGDescElement.cpp"
 #include "JSSVGDocument.cpp"
@@ -325,7 +334,6 @@
 #include "JSTreeWalker.cpp"
 #include "JSUIEvent.cpp"
 #include "JSValidityState.cpp"
-#include "JSVoidCallback.cpp"
 #include "JSWebKitAnimationEvent.cpp"
 #include "JSWebKitCSSKeyframeRule.cpp"
 #include "JSWebKitCSSKeyframesRule.cpp"
@@ -333,6 +341,7 @@
 #include "JSWebKitCSSMatrix.cpp"
 #include "JSWebKitPoint.cpp"
 #include "JSWebKitTransitionEvent.cpp"
+#include "JSWebSocket.cpp"
 #include "JSWheelEvent.cpp"
 #include "JSWorker.cpp"
 #include "JSWorkerContext.cpp"
diff --git a/WebCore/DerivedSources.make b/WebCore/DerivedSources.make
index 788c5ee..157b01a 100644
--- a/WebCore/DerivedSources.make
+++ b/WebCore/DerivedSources.make
@@ -1,5 +1,6 @@
 # Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com> 
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -35,6 +36,7 @@ VPATH = \
     $(WebCore)/html/canvas \
     $(WebCore)/inspector \
     $(WebCore)/loader/appcache \
+    $(WebCore)/notifications \
     $(WebCore)/page \
     $(WebCore)/plugins \
     $(WebCore)/storage \
@@ -50,6 +52,7 @@ DOM_CLASSES = \
     AbstractWorker \
     Attr \
     BarInfo \
+    BeforeLoadEvent \
     CDATASection \
     CSSCharsetRule \
     CSSFontFaceRule \
@@ -67,9 +70,26 @@ DOM_CLASSES = \
     CSSValueList \
     CSSVariablesRule \
     CSSVariablesDeclaration \
+    CanvasArray \
+    CanvasArrayBuffer \
+    CanvasBuffer \
+    CanvasByteArray \
+    CanvasFloatArray \
+    CanvasFramebuffer \
     CanvasGradient \
+    CanvasIntArray \
     CanvasPattern \
+    CanvasProgram \
+    CanvasRenderbuffer \
+    CanvasRenderingContext \
     CanvasRenderingContext2D \
+    CanvasRenderingContext3D \
+    CanvasShader \
+    CanvasShortArray \
+    CanvasTexture \
+    CanvasUnsignedByteArray \
+    CanvasUnsignedIntArray \
+    CanvasUnsignedShortArray \
     CharacterData \
     ClientRect \
     ClientRectList \
@@ -99,6 +119,7 @@ DOM_CLASSES = \
     Event \
     EventException \
     EventListener \
+    EventSource \
     EventTarget \
     File \
     FileList \
@@ -120,6 +141,7 @@ DOM_CLASSES = \
     HTMLDataGridCellElement \
     HTMLDataGridColElement \
     HTMLDataGridRowElement \
+    HTMLDataListElement \
     HTMLDListElement \
     HTMLDirectoryElement \
     HTMLDivElement \
@@ -194,7 +216,10 @@ DOM_CLASSES = \
     NodeIterator \
     NodeList \
     Notation \
+    Notification \
+    NotificationCenter \
     OverflowEvent \
+    PageTransitionEvent \
     Plugin \
     PluginArray \
     PositionError \
@@ -238,7 +263,6 @@ DOM_CLASSES = \
     SVGColor \
     SVGComponentTransferFunctionElement \
     SVGCursorElement \
-    SVGDefinitionSrcElement \
     SVGDefsElement \
     SVGDescElement \
     SVGDocument \
@@ -367,7 +391,6 @@ DOM_CLASSES = \
     TreeWalker \
     UIEvent \
     ValidityState \
-    VoidCallback \
     WebKitAnimationEvent \
     WebKitCSSKeyframeRule \
     WebKitCSSKeyframesRule \
@@ -396,8 +419,10 @@ DOM_CLASSES = \
 
 .PHONY : all
 
+JS_DOM_HEADERS=$(filter-out JSEventListener.h JSEventTarget.h,$(DOM_CLASSES:%=JS%.h))
+
 all : \
-    $(filter-out JSEventListener.h JSEventTarget.h,$(DOM_CLASSES:%=JS%.h)) \
+    $(JS_DOM_HEADERS) \
     \
     JSJavaScriptCallFrame.h \
     \
@@ -417,28 +442,50 @@ all : \
     UserAgentStyleSheets.h \
     XLinkNames.cpp \
     XMLNames.cpp \
+    MathMLElementFactory.cpp \
+    MathMLNames.cpp \
     XPathGrammar.cpp \
     tokenizer.cpp \
 #
 
 # --------
 
+ADDITIONAL_IDL_DEFINES :=
+
 ifeq ($(OS),MACOS)
 
-FRAMEWORK_FLAGS = $(shell echo $(FRAMEWORK_SEARCH_PATHS) | perl -e 'print "-F " . join(" -F ", split(" ", <>));')
+FRAMEWORK_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_SEARCH_PATHS) | perl -e 'print "-F " . join(" -F ", split(" ", <>));')
 
-ifeq ($(shell gcc -E -P -dM -F $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_DASHBOARD_SUPPORT | cut -d' ' -f3), 1)
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_DASHBOARD_SUPPORT | cut -d' ' -f3), 1)
     ENABLE_DASHBOARD_SUPPORT = 1
 else
     ENABLE_DASHBOARD_SUPPORT = 0
 endif
 
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_ORIENTATION_EVENTS | cut -d' ' -f3), 1)
+    ENABLE_ORIENTATION_EVENTS = 1
 else
+    ENABLE_ORIENTATION_EVENTS = 0
+endif
 
-ENABLE_DASHBOARD_SUPPORT = 0
+else
+
+ifndef ENABLE_DASHBOARD_SUPPORT
+    ENABLE_DASHBOARD_SUPPORT = 0
+endif
 
+ifndef ENABLE_ORIENTATION_EVENTS
+    ENABLE_ORIENTATION_EVENTS = 0
 endif
 
+endif # MACOS
+
+ifeq ($(ENABLE_ORIENTATION_EVENTS), 1)
+    ADDITIONAL_IDL_DEFINES := $(ADDITIONAL_IDL_DEFINES) ENABLE_ORIENTATION_EVENTS
+endif
+
+# --------
+
 # CSS property names and value keywords
 
 WEBCORE_CSS_PROPERTY_NAMES := $(WebCore)/css/CSSPropertyNames.in
@@ -458,14 +505,14 @@ endif
 # 2. Lines containing only whitespace
 # These two types of lines will be ignored by make{prop,values}.pl.
 CSSPropertyNames.h : $(WEBCORE_CSS_PROPERTY_NAMES) css/makeprop.pl
-	if sort $(WEBCORE_CSS_PROPERTY_NAMES) | uniq -d | grep -E -v '(^#)|(^[[:space:]]*$)'; then echo 'Duplicate value!'; exit 1; fi
+	if sort $(WEBCORE_CSS_PROPERTY_NAMES) | uniq -d | grep -E -v '(^#)|(^[[:space:]]*$$)'; then echo 'Duplicate value!'; exit 1; fi
 	cat $(WEBCORE_CSS_PROPERTY_NAMES) > CSSPropertyNames.in
 	perl "$(WebCore)/css/makeprop.pl"
 
 CSSValueKeywords.h : $(WEBCORE_CSS_VALUE_KEYWORDS) css/makevalues.pl
 	# Lower case all the values, as CSS values are case-insensitive
 	perl -ne 'print lc' $(WEBCORE_CSS_VALUE_KEYWORDS) > CSSValueKeywords.in
-	if sort CSSValueKeywords.in | uniq -d | grep -E -v '(^#)|(^[[:space:]]*$)'; then echo 'Duplicate value!'; exit 1; fi
+	if sort CSSValueKeywords.in | uniq -d | grep -E -v '(^#)|(^[[:space:]]*$$)'; then echo 'Duplicate value!'; exit 1; fi
 	perl "$(WebCore)/css/makevalues.pl"
 
 # --------
@@ -540,10 +587,14 @@ ifeq ($(findstring ENABLE_WML,$(FEATURE_DEFINES)), ENABLE_WML)
     USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/wml.css
 endif
 
+ifeq ($(findstring ENABLE_MATHML,$(FEATURE_DEFINES)), ENABLE_MATHML)
+    USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/mathml.css
+endif
+
 ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
     USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/mediaControls.css
 ifeq ($(OS),MACOS)
-    USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/mediaControlsQT.css
+    USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/mediaControlsQuickTime.css
 endif
 endif
 
@@ -554,6 +605,10 @@ UserAgentStyleSheets.h : css/make-css-file-arrays.pl $(USER_AGENT_STYLE_SHEETS)
 
 # HTML tag and attribute names
 
+ifeq ($(findstring ENABLE_DATALIST,$(FEATURE_DEFINES)), ENABLE_DATALIST)
+    HTML_FLAGS := $(HTML_FLAGS) ENABLE_DATALIST=1
+endif
+
 ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
     HTML_FLAGS := $(HTML_FLAGS) ENABLE_VIDEO=1
 endif
@@ -677,13 +732,33 @@ WMLNames.cpp :
 
 endif
 
+# --------
+ 
+# MathML tag and attribute names, and element factory
+
+ifeq ($(findstring ENABLE_MATHML,$(FEATURE_DEFINES)), ENABLE_MATHML)
+
+MathMLElementFactory.cpp MathMLNames.cpp : dom/make_names.pl mathml/mathtags.in
+	perl -I $(WebCore)/bindings/scripts $< --tags $(WebCore)/mathml/mathtags.in --factory --wrapperFactory
+
+else
+
+MathMLElementFactory.cpp :
+	echo > $@
+
+MathMLNames.cpp :
+	echo > $@
+
+endif
+
+
 
 # --------
 
 # JavaScript bindings
 
 GENERATE_BINDINGS = perl -I $(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl \
-    --include dom --include html --include css --include page --include xml --include svg --outputDir .
+    --include dom --include html --include css --include page --include notifications --include xml --include svg --write-dependencies --outputDir .
 
 GENERATE_BINDINGS_SCRIPTS = \
     bindings/scripts/CodeGenerator.pm \
@@ -693,7 +768,9 @@ GENERATE_BINDINGS_SCRIPTS = \
 #
 
 JS%.h : %.idl $(GENERATE_BINDINGS_SCRIPTS) bindings/scripts/CodeGeneratorJS.pm
-	$(GENERATE_BINDINGS) --defines "$(FEATURE_DEFINES) LANGUAGE_JAVASCRIPT" --generator JS $<
+	$(GENERATE_BINDINGS) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_JAVASCRIPT" --generator JS $<
+
+-include $(JS_DOM_HEADERS:.h=.dep)
 
 # ------------------------
 
@@ -701,9 +778,11 @@ JS%.h : %.idl $(GENERATE_BINDINGS_SCRIPTS) bindings/scripts/CodeGeneratorJS.pm
 
 ifeq ($(OS),MACOS)
 
-all : $(filter-out DOMDOMWindow.h DOMMimeType.h DOMPlugin.h,$(DOM_CLASSES:%=DOM%.h))
+OBJC_DOM_HEADERS=$(filter-out DOMDOMWindow.h DOMMimeType.h DOMPlugin.h,$(DOM_CLASSES:%=DOM%.h))
+
+all : $(OBJC_DOM_HEADERS)
 
-all : CharsetData.cpp WebCore.exp
+all : CharsetData.cpp WebCore.exp WebCore.LP64.exp
 
 # --------
 
@@ -716,19 +795,42 @@ CharsetData.cpp : platform/text/mac/make-charset-table.pl platform/text/mac/char
 
 # export file
 
-ifeq ($(shell gcc -E -P -dM -F $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_MAC_JAVA_BRIDGE | cut -d' ' -f3), 1)
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_MAC_JAVA_BRIDGE | cut -d' ' -f3), 1)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.JNI.exp
 endif
 
-# See also "Generate 64-bit Export File" build phase script in WebCore.xcodeproj/project.pbxproj
-ifeq ($(shell gcc -E -P -dM -F $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_NETSCAPE_PLUGIN_API | cut -d' ' -f3), 1)
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_NETSCAPE_PLUGIN_API | cut -d' ' -f3), 1)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.NPAPI.exp
 endif
 
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep WTF_USE_PLUGIN_HOST_PROCESS | cut -d' ' -f3), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.PluginHostProcess.exp
+endif
+
+ifeq ($(findstring ENABLE_3D_RENDERING,$(FEATURE_DEFINES)), ENABLE_3D_RENDERING)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.3DRendering.exp
+endif
+
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_CONTEXT_MENUS | cut -d' ' -f3), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.ContextMenus.exp
+endif
+
 ifeq ($(ENABLE_DASHBOARD_SUPPORT), 1)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.DashboardSupport.exp
 endif
 
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_DRAG_SUPPORT | cut -d' ' -f3), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.DragSupport.exp
+endif
+
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_INSPECTOR | cut -d' ' -f3), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.Inspector.exp
+endif
+
+ifeq ($(ENABLE_ORIENTATION_EVENTS), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.OrientationEvents.exp
+endif
+
 ifeq ($(findstring 10.4,$(MACOSX_DEPLOYMENT_TARGET)), 10.4)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.Tiger.exp
 endif
@@ -737,18 +839,28 @@ ifeq ($(findstring ENABLE_PLUGIN_PROXY_FOR_VIDEO,$(FEATURE_DEFINES)), ENABLE_PLU
      WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.VideoProxy.exp
 endif
 
+ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
+     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.Video.exp
+endif
+
 WebCore.exp : WebCore.base.exp $(WEBCORE_EXPORT_DEPENDENCIES)
 	cat $^ > $@
 
+# Switch NSRect, NSSize and NSPoint with their CG counterparts for 64-bit.
+WebCore.LP64.exp : WebCore.exp
+	cat $^ | sed -e s/7_NSRect/6CGRect/ -e s/7_NSSize/6CGSize/ -e s/8_NSPoint/7CGPoint/ > $@
+
 # --------
 
 # Objective-C bindings
 
 DOM%.h : %.idl $(GENERATE_BINDINGS_SCRIPTS) bindings/scripts/CodeGeneratorObjC.pm bindings/objc/PublicDOMInterfaces.h
-	$(GENERATE_BINDINGS) --defines "$(FEATURE_DEFINES) LANGUAGE_OBJECTIVE_C" --generator ObjC $<
+	$(GENERATE_BINDINGS) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_OBJECTIVE_C" --generator ObjC $<
+
+-include $(OBJC_DOM_HEADERS:.h=.dep)
 
 # --------
 
-endif
+endif # MACOS
 
 # ------------------------
diff --git a/WebCore/English.lproj/localizedStrings.js b/WebCore/English.lproj/localizedStrings.js
index a1c9dd6..3e6db09 100644
--- a/WebCore/English.lproj/localizedStrings.js
+++ b/WebCore/English.lproj/localizedStrings.js
diff --git a/WebCore/ForwardingHeaders/parser/Parser.h b/WebCore/ForwardingHeaders/parser/Parser.h
deleted file mode 100644
index 863df59..0000000
--- a/WebCore/ForwardingHeaders/parser/Parser.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Parser_h
-#define WebCore_FWD_Parser_h
-#include <JavaScriptCore/Parser.h>
-#endif
diff --git a/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h b/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
deleted file mode 100644
index fcfe26d..0000000
--- a/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CollectorHeapIterator_h
-#define WebCore_FWD_CollectorHeapIterator_h
-#include <JavaScriptCore/CollectorHeapIterator.h>
-#endif
diff --git a/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h b/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h
new file mode 100644
index 0000000..661c61a
--- /dev/null
+++ b/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ExceptionHelpers_h
+#define WebCore_FWD_ExceptionHelpers_h
+#include <JavaScriptCore/ExceptionHelpers.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/PossiblyNull.h b/WebCore/ForwardingHeaders/wtf/PossiblyNull.h
new file mode 100644
index 0000000..d52a4a0
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/PossiblyNull.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_PossiblyNull_h
+#define WebCore_FWD_PossiblyNull_h
+#include <JavaScriptCore/PossiblyNull.h>
+#endif
diff --git a/WebCore/GNUmakefile.am b/WebCore/GNUmakefile.am
index 5cc1fd6..c4ab425 100644
--- a/WebCore/GNUmakefile.am
+++ b/WebCore/GNUmakefile.am
@@ -26,6 +26,7 @@ webcore_cppflags += \
 	-I$(srcdir)/WebCore/loader/appcache \
 	-I$(srcdir)/WebCore/loader/archive \
 	-I$(srcdir)/WebCore/loader/icon \
+	-I$(srcdir)/WebCore/notifications \
 	-I$(srcdir)/WebCore/page \
 	-I$(srcdir)/WebCore/page/animation \
 	-I$(srcdir)/WebCore/platform \
@@ -40,6 +41,7 @@ webcore_cppflags += \
 	-I$(srcdir)/WebCore/platform/image-decoders/jpeg \
 	-I$(srcdir)/WebCore/platform/image-decoders/png \
 	-I$(srcdir)/WebCore/platform/image-decoders/xbm \
+	-I$(srcdir)/WebCore/platform/mock \
 	-I$(srcdir)/WebCore/platform/network \
 	-I$(srcdir)/WebCore/platform/text \
 	-I$(srcdir)/WebCore/plugins \
@@ -72,16 +74,12 @@ webcore_built_sources += \
 	DerivedSources/CSSPropertyNames.h \
 	DerivedSources/CSSValueKeywords.h \
 	DerivedSources/HTMLElementFactory.cpp \
-	DerivedSources/HTMLElementFactory.h \
 	DerivedSources/HTMLEntityNames.c \
 	DerivedSources/HTMLNames.cpp \
-	DerivedSources/HTMLNames.h \
 	DerivedSources/JSHTMLElementWrapperFactory.cpp \
-	DerivedSources/JSHTMLElementWrapperFactory.h \
 	DerivedSources/UserAgentStyleSheets.h \
 	DerivedSources/UserAgentStyleSheetsData.cpp \
-	DerivedSources/XMLNames.cpp \
-	DerivedSources/XMLNames.h
+	DerivedSources/XMLNames.cpp
 
 IDL_BINDINGS += \
 	WebCore/css/CSSCharsetRule.idl \
@@ -111,6 +109,7 @@ IDL_BINDINGS += \
 	WebCore/css/WebKitCSSMatrix.idl \
 	WebCore/css/WebKitCSSTransformValue.idl \
 	WebCore/dom/Attr.idl \
+	WebCore/dom/BeforeLoadEvent.idl \
 	WebCore/dom/CDATASection.idl \
 	WebCore/dom/CharacterData.idl \
 	WebCore/dom/ClientRect.idl \
@@ -141,6 +140,7 @@ IDL_BINDINGS += \
 	WebCore/dom/NodeList.idl \
 	WebCore/dom/Notation.idl \
 	WebCore/dom/OverflowEvent.idl \
+	WebCore/dom/PageTransitionEvent.idl \
 	WebCore/dom/ProcessingInstruction.idl \
 	WebCore/dom/ProgressEvent.idl \
 	WebCore/dom/Range.idl \
@@ -152,9 +152,20 @@ IDL_BINDINGS += \
 	WebCore/dom/WebKitAnimationEvent.idl \
 	WebCore/dom/WebKitTransitionEvent.idl \
 	WebCore/dom/WheelEvent.idl \
+	WebCore/html/canvas/CanvasArray.idl \
+	WebCore/html/canvas/CanvasArrayBuffer.idl \
+	WebCore/html/canvas/CanvasByteArray.idl \
+	WebCore/html/canvas/CanvasFloatArray.idl \
 	WebCore/html/canvas/CanvasGradient.idl \
+	WebCore/html/canvas/CanvasIntArray.idl \
 	WebCore/html/canvas/CanvasPattern.idl \
+	WebCore/html/canvas/CanvasRenderingContext.idl \
 	WebCore/html/canvas/CanvasRenderingContext2D.idl \
+	WebCore/html/canvas/CanvasRenderingContext3D.idl \
+	WebCore/html/canvas/CanvasShortArray.idl \
+	WebCore/html/canvas/CanvasUnsignedByteArray.idl \
+	WebCore/html/canvas/CanvasUnsignedIntArray.idl \
+	WebCore/html/canvas/CanvasUnsignedShortArray.idl \
 	WebCore/html/DataGridColumn.idl \
 	WebCore/html/DataGridColumnList.idl \
 	WebCore/html/File.idl \
@@ -175,6 +186,7 @@ IDL_BINDINGS += \
 	WebCore/html/HTMLDataGridCellElement.idl \
 	WebCore/html/HTMLDataGridColElement.idl \
 	WebCore/html/HTMLDataGridRowElement.idl \
+	WebCore/html/HTMLDataListElement.idl \
 	WebCore/html/HTMLDListElement.idl \
 	WebCore/html/HTMLDirectoryElement.idl \
 	WebCore/html/HTMLDivElement.idl \
@@ -234,11 +246,14 @@ IDL_BINDINGS += \
 	WebCore/html/VoidCallback.idl \
 	WebCore/inspector/JavaScriptCallFrame.idl \
 	WebCore/inspector/InspectorBackend.idl \
+	WebCore/notifications/Notification.idl \
+	WebCore/notifications/NotificationCenter.idl \
 	WebCore/page/BarInfo.idl \
 	WebCore/page/Console.idl \
 	WebCore/page/Coordinates.idl \
 	WebCore/page/DOMSelection.idl \
 	WebCore/page/DOMWindow.idl \
+	WebCore/page/EventSource.idl \
 	WebCore/page/Geolocation.idl \
 	WebCore/page/Geoposition.idl \
 	WebCore/page/History.idl \
@@ -285,6 +300,8 @@ webcore_sources += \
 	WebCore/accessibility/AccessibilityListBox.h \
 	WebCore/accessibility/AccessibilityListBoxOption.cpp \
 	WebCore/accessibility/AccessibilityListBoxOption.h \
+	WebCore/accessibility/AccessibilityMediaControls.cpp \
+	WebCore/accessibility/AccessibilityMediaControls.h \
 	WebCore/accessibility/AccessibilityObject.cpp \
 	WebCore/accessibility/AccessibilityObject.h \
 	WebCore/accessibility/AccessibilityRenderObject.cpp \
@@ -311,9 +328,13 @@ webcore_sources += \
 	WebCore/bindings/js/JSDataGridDataSource.cpp \
 	WebCore/bindings/js/JSDataGridDataSource.h \
 	WebCore/bindings/js/JSCSSRuleCustom.cpp \
+	WebCore/bindings/js/JSCSSRuleListCustom.cpp \
 	WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp \
 	WebCore/bindings/js/JSCSSStyleDeclarationCustom.h \
 	WebCore/bindings/js/JSCSSValueCustom.cpp \
+	WebCore/bindings/js/JSCallbackData.cpp \
+	WebCore/bindings/js/JSCallbackData.h \
+	WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp \
 	WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp \
 	WebCore/bindings/js/JSClipboardCustom.cpp \
 	WebCore/bindings/js/JSConsoleCustom.cpp \
@@ -342,6 +363,9 @@ webcore_sources += \
 	WebCore/bindings/js/JSEventCustom.cpp \
 	WebCore/bindings/js/JSEventListener.cpp \
 	WebCore/bindings/js/JSEventListener.h \
+	WebCore/bindings/js/JSEventSourceConstructor.cpp \
+	WebCore/bindings/js/JSEventSourceConstructor.h \
+	WebCore/bindings/js/JSEventSourceCustom.cpp \
 	WebCore/bindings/js/JSEventTarget.cpp \
 	WebCore/bindings/js/JSEventTarget.h \
 	WebCore/bindings/js/JSGeolocationCustom.cpp \
@@ -349,6 +373,7 @@ webcore_sources += \
 	WebCore/bindings/js/JSHTMLAllCollection.h \
 	WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLAppletElementCustom.h \
+	WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLCollectionCustom.cpp \
 	WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLDocumentCustom.cpp \
@@ -384,11 +409,11 @@ webcore_sources += \
 	WebCore/bindings/js/JSMessageChannelConstructor.cpp \
 	WebCore/bindings/js/JSMessageChannelConstructor.h \
 	WebCore/bindings/js/JSMessageChannelCustom.cpp \
+	WebCore/bindings/js/JSMessageEventCustom.cpp \
 	WebCore/bindings/js/JSMessagePortCustom.cpp \
+	WebCore/bindings/js/JSMessagePortCustom.h \
 	WebCore/bindings/js/JSMimeTypeArrayCustom.cpp \
 	WebCore/bindings/js/JSNamedNodeMapCustom.cpp \
-	WebCore/bindings/js/JSNamedNodesCollection.cpp \
-	WebCore/bindings/js/JSNamedNodesCollection.h \
 	WebCore/bindings/js/JSNavigatorCustom.cpp \
 	WebCore/bindings/js/JSNodeCustom.cpp \
 	WebCore/bindings/js/JSNodeFilterCondition.cpp \
@@ -448,6 +473,8 @@ webcore_sources += \
 	WebCore/bindings/js/ScriptString.h \
 	WebCore/bindings/js/ScriptValue.cpp \
 	WebCore/bindings/js/ScriptValue.h \
+	WebCore/bindings/js/SerializedScriptValue.cpp \
+	WebCore/bindings/js/SerializedScriptValue.h \
 	WebCore/bindings/js/StringSourceProvider.h \
 	WebCore/bridge/IdentifierRep.cpp \
 	WebCore/bridge/IdentifierRep.h \
@@ -654,7 +681,6 @@ webcore_sources += \
 	WebCore/dom/DOMCoreException.h \
 	WebCore/dom/DOMImplementation.cpp \
 	WebCore/dom/DOMImplementation.h \
-	WebCore/dom/DocPtr.h \
 	WebCore/dom/Document.cpp \
 	WebCore/dom/Document.h \
 	WebCore/dom/DocumentFragment.cpp \
@@ -735,6 +761,8 @@ webcore_sources += \
 	WebCore/dom/OptionElement.h \
 	WebCore/dom/OverflowEvent.cpp \
 	WebCore/dom/OverflowEvent.h \
+	WebCore/dom/PageTransitionEvent.cpp \
+	WebCore/dom/PageTransitionEvent.h \
 	WebCore/dom/Position.cpp \
 	WebCore/dom/Position.h \
 	WebCore/dom/PositionIterator.cpp \
@@ -908,6 +936,8 @@ webcore_sources += \
 	WebCore/html/canvas/CanvasPattern.h \
 	WebCore/html/canvas/CanvasPixelArray.cpp \
 	WebCore/html/canvas/CanvasPixelArray.h \
+	WebCore/html/canvas/CanvasRenderingContext.cpp \
+	WebCore/html/canvas/CanvasRenderingContext.h \
 	WebCore/html/canvas/CanvasRenderingContext2D.cpp \
 	WebCore/html/canvas/CanvasRenderingContext2D.h \
 	WebCore/html/canvas/CanvasStyle.cpp \
@@ -958,6 +988,8 @@ webcore_sources += \
 	WebCore/html/HTMLDataGridColElement.h \
 	WebCore/html/HTMLDataGridRowElement.cpp \
 	WebCore/html/HTMLDataGridRowElement.h \
+	WebCore/html/HTMLDataListElement.cpp \
+	WebCore/html/HTMLDataListElement.h \
 	WebCore/html/HTMLDListElement.cpp \
 	WebCore/html/HTMLDListElement.h \
 	WebCore/html/HTMLDirectoryElement.cpp \
@@ -1127,6 +1159,8 @@ webcore_sources += \
 	WebCore/icu/unicode/uversion.h \
 	WebCore/inspector/ConsoleMessage.cpp \
 	WebCore/inspector/ConsoleMessage.h \
+	WebCore/inspector/DOMDispatchTimelineItem.cpp \
+	WebCore/inspector/DOMDispatchTimelineItem.h \
 	WebCore/inspector/InspectorBackend.cpp \
 	WebCore/inspector/InspectorBackend.h \
 	WebCore/inspector/InspectorDatabaseResource.cpp \
@@ -1142,6 +1176,8 @@ webcore_sources += \
 	WebCore/inspector/InspectorFrontend.h \
 	WebCore/inspector/InspectorResource.cpp \
 	WebCore/inspector/InspectorResource.h \
+	WebCore/inspector/InspectorTimelineAgent.cpp \
+	WebCore/inspector/InspectorTimelineAgent.h \
 	WebCore/inspector/JavaScriptCallFrame.cpp \
 	WebCore/inspector/JavaScriptCallFrame.h \
 	WebCore/inspector/JavaScriptDebugListener.h \
@@ -1151,6 +1187,8 @@ webcore_sources += \
 	WebCore/inspector/JavaScriptProfile.h \
 	WebCore/inspector/JavaScriptProfileNode.cpp \
 	WebCore/inspector/JavaScriptProfileNode.h \
+	WebCore/inspector/TimelineItem.cpp \
+	WebCore/inspector/TimelineItem.h \
 	WebCore/loader/Cache.cpp \
 	WebCore/loader/Cache.h \
 	WebCore/loader/CachePolicy.h \
@@ -1209,8 +1247,14 @@ webcore_sources += \
 	WebCore/loader/PlaceholderDocument.h \
 	WebCore/loader/PluginDocument.cpp \
 	WebCore/loader/PluginDocument.h \
+	WebCore/loader/PolicyCallback.cpp \
+	WebCore/loader/PolicyCallback.h \
+	WebCore/loader/PolicyChecker.cpp \
+	WebCore/loader/PolicyChecker.h \
 	WebCore/loader/ProgressTracker.cpp \
 	WebCore/loader/ProgressTracker.h \
+	WebCore/loader/RedirectScheduler.cpp \
+	WebCore/loader/RedirectScheduler.h \
 	WebCore/loader/Request.cpp \
 	WebCore/loader/Request.h \
 	WebCore/loader/ResourceLoader.cpp \
@@ -1253,7 +1297,6 @@ webcore_sources += \
 	WebCore/page/ContextMenuController.cpp \
 	WebCore/page/ContextMenuController.h \
 	WebCore/page/Coordinates.h \
-	WebCore/page/Coordinates.cpp \
 	WebCore/page/DOMSelection.cpp \
 	WebCore/page/DOMSelection.h \
 	WebCore/page/DOMTimer.cpp \
@@ -1267,6 +1310,8 @@ webcore_sources += \
 	WebCore/page/EditorClient.h \
 	WebCore/page/EventHandler.cpp \
 	WebCore/page/EventHandler.h \
+	WebCore/page/EventSource.cpp \
+	WebCore/page/EventSource.h \
 	WebCore/page/FocusController.cpp \
 	WebCore/page/FocusController.h \
 	WebCore/page/FocusDirection.h \
@@ -1279,8 +1324,8 @@ webcore_sources += \
 	WebCore/page/FrameView.h \
 	WebCore/page/Geolocation.cpp \
 	WebCore/page/Geolocation.h \
-	WebCore/page/Geoposition.cpp \
 	WebCore/page/Geoposition.h \
+	WebCore/page/HaltablePlugin.h \
 	WebCore/page/History.cpp \
 	WebCore/page/History.h \
 	WebCore/page/Location.cpp \
@@ -1291,12 +1336,17 @@ webcore_sources += \
 	WebCore/page/Navigator.h \
 	WebCore/page/NavigatorBase.cpp \
 	WebCore/page/NavigatorBase.h \
+	WebCore/page/OriginAccessEntry.cpp \
+	WebCore/page/OriginAccessEntry.h \
 	WebCore/page/Page.cpp \
 	WebCore/page/Page.h \
 	WebCore/page/PageGroup.cpp \
 	WebCore/page/PageGroup.h \
   WebCore/page/PageGroupLoadDeferrer.cpp \
   WebCore/page/PageGroupLoadDeferrer.h \
+	WebCore/page/PluginHalter.cpp \
+	WebCore/page/PluginHalter.h \
+	WebCore/page/PluginHalterClient.h \
 	WebCore/page/PositionCallback.h \
 	WebCore/page/PositionError.h \
 	WebCore/page/PositionErrorCallback.h \
@@ -1310,6 +1360,12 @@ webcore_sources += \
 	WebCore/page/SecurityOriginHash.h \
 	WebCore/page/Settings.cpp \
 	WebCore/page/Settings.h \
+	WebCore/page/UserContentURLPattern.cpp \
+	WebCore/page/UserContentURLPattern.h \
+	WebCore/page/UserScript.h \
+	WebCore/page/UserScriptTypes.h \
+	WebCore/page/UserStyleSheet.h \
+	WebCore/page/UserStyleSheetTypes.h \
 	WebCore/page/WebKitPoint.h \
 	WebCore/page/WindowFeatures.cpp \
 	WebCore/page/WindowFeatures.h \
@@ -1334,6 +1390,7 @@ webcore_sources += \
 	WebCore/platform/ContextMenu.cpp \
 	WebCore/platform/ContextMenu.h \
 	WebCore/platform/ContextMenuItem.h \
+	WebCore/platform/Cookie.h \
 	WebCore/platform/CookieJar.h \
 	WebCore/platform/CrossThreadCopier.cpp \
 	WebCore/platform/CrossThreadCopier.h \
@@ -1369,6 +1426,8 @@ webcore_sources += \
 	WebCore/platform/Logging.h \
 	WebCore/platform/MIMETypeRegistry.cpp \
 	WebCore/platform/MIMETypeRegistry.h \
+	WebCore/platform/mock/GeolocationServiceMock.cpp \
+	WebCore/platform/mock/GeolocationServiceMock.h \
 	WebCore/platform/NotImplemented.h \
 	WebCore/platform/Pasteboard.h \
 	WebCore/platform/PlatformKeyboardEvent.h \
@@ -1444,6 +1503,7 @@ webcore_sources += \
 	WebCore/platform/graphics/FontFastPath.cpp \
 	WebCore/platform/graphics/FontRenderingMode.h \
 	WebCore/platform/graphics/FontSelector.h \
+	WebCore/platform/graphics/FontSmoothingMode.h \
 	WebCore/platform/graphics/FontTraitsMask.h \
 	WebCore/platform/graphics/GeneratedImage.cpp \
 	WebCore/platform/graphics/GeneratedImage.h \
@@ -1466,6 +1526,7 @@ webcore_sources += \
 	WebCore/platform/graphics/ImageBuffer.cpp \
 	WebCore/platform/graphics/ImageBuffer.h \
 	WebCore/platform/graphics/ImageObserver.h \
+	WebCore/platform/graphics/ImageSource.cpp \
 	WebCore/platform/graphics/ImageSource.h \
 	WebCore/platform/graphics/IntPoint.h \
 	WebCore/platform/graphics/IntRect.cpp \
@@ -1602,6 +1663,7 @@ webcore_sources += \
 	WebCore/plugins/PluginData.h \
 	WebCore/plugins/PluginDatabase.cpp \
 	WebCore/plugins/PluginDatabase.h \
+	WebCore/plugins/PluginDatabaseClient.h \
 	WebCore/plugins/PluginDebug.cpp \
 	WebCore/plugins/PluginDebug.h \
 	WebCore/plugins/PluginInfoStore.cpp \
@@ -1696,6 +1758,7 @@ webcore_sources += \
 	WebCore/rendering/RenderObject.h \
 	WebCore/rendering/RenderObjectChildList.cpp \
 	WebCore/rendering/RenderObjectChildList.h \
+	WebCore/rendering/RenderOverflow.h \
 	WebCore/rendering/RenderPart.cpp \
 	WebCore/rendering/RenderPart.h \
 	WebCore/rendering/RenderPartObject.cpp \
@@ -1743,6 +1806,7 @@ webcore_sources += \
 	WebCore/rendering/RenderView.h \
 	WebCore/rendering/RenderWidget.cpp \
 	WebCore/rendering/RenderWidget.h \
+	WebCore/rendering/RenderWidgetProtector.h \
 	WebCore/rendering/RenderWordBreak.cpp \
 	WebCore/rendering/RenderWordBreak.h \
 	WebCore/rendering/RootInlineBox.cpp \
@@ -1857,7 +1921,6 @@ webcoregtk_sources += \
 	WebCore/platform/graphics/cairo/ImageBufferCairo.cpp \
 	WebCore/platform/graphics/cairo/ImageBufferData.h \
 	WebCore/platform/graphics/cairo/ImageCairo.cpp \
-	WebCore/platform/graphics/cairo/ImageSourceCairo.cpp \
 	WebCore/platform/graphics/cairo/PathCairo.cpp \
 	WebCore/platform/graphics/cairo/PatternCairo.cpp \
 	WebCore/platform/graphics/cairo/TransformationMatrixCairo.cpp \
@@ -1911,6 +1974,7 @@ webcoregtk_sources += \
 	WebCore/platform/gtk/gtk2drawing.c \
 	WebCore/platform/gtk/gtkdrawing.h \
 	WebCore/platform/image-decoders/ImageDecoder.h \
+	WebCore/platform/image-decoders/ImageDecoder.cpp \
 	WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp \
 	WebCore/platform/image-decoders/bmp/BMPImageDecoder.h \
 	WebCore/platform/image-decoders/bmp/BMPImageReader.cpp \
@@ -1935,6 +1999,7 @@ webcoregtk_sources += \
 	WebCore/platform/network/soup/ResourceError.h \
 	WebCore/platform/network/soup/ResourceHandleSoup.cpp \
 	WebCore/platform/network/soup/ResourceRequestSoup.cpp \
+	WebCore/platform/network/soup/ResourceResponseSoup.cpp \
 	WebCore/platform/network/soup/ResourceRequest.h \
 	WebCore/platform/network/soup/ResourceResponse.h \
 	WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp
@@ -2111,6 +2176,10 @@ webcore_sources += \
 	WebCore/storage/SQLTransaction.cpp \
 	WebCore/storage/SQLTransaction.h \
 	WebCore/storage/SQLTransactionCallback.h \
+	WebCore/storage/SQLTransactionClient.cpp \
+	WebCore/storage/SQLTransactionClient.h \
+	WebCore/storage/SQLTransactionCoordinator.h \
+	WebCore/storage/SQLTransactionCoordinator.cpp \
 	WebCore/storage/SQLTransactionErrorCallback.h
 
 else
@@ -2119,6 +2188,31 @@ webcore_cppflags += -DENABLE_DATABASE=0
 endif # END ENABLE_DATABASE
 
 # ----
+# HTML5 datalist Support
+# ----
+if ENABLE_DATALIST
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATALIST=1
+HTML_FEATURES += ENABLE_DATALIST=1
+
+webcore_cppflags += -DENABLE_DATALIST=1
+
+endif # END ENABLE_DATALIST
+
+# ----
+# HTML5 server-sent events
+# ----
+if !ENABLE_EVENTSOURCE
+global_cppflags += -DENABLE_EVENTSOURCE=0
+endif
+
+if ENABLE_EVENTSOURCE
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
+
+webcore_cppflags += \
+	-DENABLE_EVENTSOURCE=1
+endif # ENABLE_EVENTSOURCE
+
+# ----
 # HTML5 client-side session and persistent storage
 # ----
 if ENABLE_DOM_STORAGE
@@ -2146,6 +2240,7 @@ webcore_sources += \
 	WebCore/storage/StorageAreaSync.cpp \
 	WebCore/storage/StorageAreaSync.h \
 	WebCore/storage/StorageEvent.cpp \
+	WebCore/storage/StorageEventDispatcher.cpp \
 	WebCore/storage/StorageEvent.h \
 	WebCore/storage/StorageMap.cpp \
 	WebCore/storage/StorageMap.h \
@@ -2181,6 +2276,17 @@ webcore_cppflags += -DENABLE_ICONDATABASE=0
 endif # END ENABLE_ICONDATABASE
 
 # ----
+# Orientation Events
+# ----
+if ENABLE_ORIENTATION_EVENTS
+
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
+
+webcore_cppflags += -DENABLE_ORIENTATION_EVENTS=1
+
+endif # END ENABLE_ORIENTATION_EVENTS
+
+# ----
 # Video Support
 # ----
 if ENABLE_VIDEO
@@ -2221,11 +2327,14 @@ webcoregtk_sources += \
 	WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp \
 	WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h \
 	WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp \
-	WebCore/platform/graphics/gtk/VideoSinkGStreamer.h
+	WebCore/platform/graphics/gtk/VideoSinkGStreamer.h \
+	WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp \
+	WebCore/platform/graphics/gtk/DataSourceGstreamer.h
 
 webcore_libadd += \
 	-lgstinterfaces-0.10 \
-	-lgstvideo-0.10
+	-lgstvideo-0.10 \
+	-lgstpbutils-0.10
 
 endif # END ENABLE_VIDEO
 
@@ -2318,13 +2427,16 @@ FEATURE_DEFINES_JAVASCRIPT += ENABLE_XSLT=1
 webcore_cppflags += -DENABLE_XSLT=1
 
 webcore_sources += \
+	WebCore/dom/TransformSourceLibxslt.cpp \
+	WebCore/dom/TransformSource.h \
 	WebCore/xml/XSLImportRule.cpp \
 	WebCore/xml/XSLImportRule.h \
-	WebCore/xml/XSLStyleSheet.cpp \
+	WebCore/xml/XSLStyleSheetLibxslt.cpp \
 	WebCore/xml/XSLStyleSheet.h \
 	WebCore/xml/XSLTExtensions.cpp \
 	WebCore/xml/XSLTExtensions.h \
 	WebCore/xml/XSLTProcessor.cpp \
+	WebCore/xml/XSLTProcessorLibxslt.cpp \
 	WebCore/xml/XSLTProcessor.h \
 	WebCore/xml/XSLTUnicodeSort.cpp \
 	WebCore/xml/XSLTUnicodeSort.h
@@ -2370,6 +2482,7 @@ webcore_sources += \
 	WebCore/workers/WorkerMessagingProxy.cpp \
 	WebCore/workers/WorkerMessagingProxy.h \
 	WebCore/workers/WorkerObjectProxy.h \
+	WebCore/workers/WorkerReportingProxy.h \
 	WebCore/workers/WorkerRunLoop.cpp \
 	WebCore/workers/WorkerRunLoop.h \
 	WebCore/workers/WorkerScriptLoader.cpp \
@@ -2391,7 +2504,6 @@ webcore_cppflags += \
 webcore_built_sources += \
 	WebCore/bindings/js/JSSharedWorkerConstructor.cpp \
 	WebCore/bindings/js/JSSharedWorkerConstructor.h \
-	WebCore/bindings/js/JSSharedWorkerContextCustom.cpp \
 	WebCore/bindings/js/JSSharedWorkerCustom.cpp \
 	WebCore/workers/DefaultSharedWorkerRepository.cpp \
 	WebCore/workers/DefaultSharedWorkerRepository.h \
@@ -2461,7 +2573,7 @@ webcore_sources += \
 DerivedSources/WMLNames.cpp: DerivedSources/WMLElementFactory.cpp;
 
 DerivedSources/WMLElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/wml/WMLTagNames.in $(WebCore)/wml/WMLAttributeNames.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/wml/WMLTagNames.in --attrs $(WebCore)/wml/WMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/wml/WMLTagNames.in --attrs $(WebCore)/wml/WMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
 endif # END ENABLE_WML
 
 # ----
@@ -2509,6 +2621,24 @@ webcoregtk_sources += \
 	WebCore/platform/gtk/GeolocationServiceGtk.h
 endif # END ENABLE_GEOLOCATION
 
+# ----
+# Notifications support
+# ----
+if ENABLE_NOTIFICATIONS
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_NOTIFICATIONS=1
+
+webcore_cppflags += \
+	-DENABLE_NOTIFICATIONS=1
+
+webcore_sources += \
+	WebCore/notifications/Notification.cpp \
+	WebCore/notifications/Notification.h \
+	WebCore/notifications/NotificationCenter.cpp \
+	WebCore/notifications/NotificationCenter.h \
+	WebCore/notifications/NotificationPresenter.h \
+	WebCore/notifications/NotificationContents.h
+
+endif # END ENABLE_NOTIFICATIONS
 
 # ----
 # SVG Support
@@ -2555,7 +2685,6 @@ IDL_BINDINGS += \
 	WebCore/svg/SVGColor.idl \
 	WebCore/svg/SVGComponentTransferFunctionElement.idl \
 	WebCore/svg/SVGCursorElement.idl \
-	WebCore/svg/SVGDefinitionSrcElement.idl \
 	WebCore/svg/SVGDefsElement.idl \
 	WebCore/svg/SVGDescElement.idl \
 	WebCore/svg/SVGDocument.idl \
@@ -2782,8 +2911,6 @@ webcore_sources += \
 	WebCore/svg/SVGComponentTransferFunctionElement.h \
 	WebCore/svg/SVGCursorElement.cpp \
 	WebCore/svg/SVGCursorElement.h \
-	WebCore/svg/SVGDefinitionSrcElement.cpp \
-	WebCore/svg/SVGDefinitionSrcElement.h \
 	WebCore/svg/SVGDefsElement.cpp \
 	WebCore/svg/SVGDefsElement.h \
 	WebCore/svg/SVGDescElement.cpp \
@@ -3121,10 +3248,10 @@ DerivedSources/JSSVGElementWrapperFactory.cpp: DerivedSources/SVGElementFactory.
 
 if SVG_FLAGS
 DerivedSources/SVGElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/svg/svgtags.in $(WebCore)/svg/svgattrs.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --extraDefines "$(SVG_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --extraDefines "$(SVG_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES)"
 else
 DerivedSources/SVGElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/svg/svgtags.in $(WebCore)/svg/svgattrs.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
 
 endif # SVG_FLAGS
 
@@ -3133,7 +3260,7 @@ endif # SVG_FLAGS
 DerivedSources/XLinkNames.h: DerivedSources/XLinkNames.cpp;
 
 DerivedSources/XLinkNames.cpp : $(WebCore)/dom/make_names.pl $(WebCore)/svg/xlinkattrs.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/svg/xlinkattrs.in --outputDir "$(GENSOURCES)"
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/svg/xlinkattrs.in --outputDir "$(GENSOURCES)"
 
 endif # END ENABLE_SVG
 
@@ -3154,8 +3281,23 @@ webcore_sources += \
 	WebCore/bindings/js/JSWebSocketConstructor.cpp \
 	WebCore/bindings/js/JSWebSocketConstructor.h \
 	WebCore/bindings/js/JSWebSocketCustom.cpp \
+	WebCore/platform/network/SocketStreamErrorBase.cpp \
+	WebCore/platform/network/SocketStreamErrorBase.h \
+	WebCore/platform/network/SocketStreamHandleBase.cpp \
+	WebCore/platform/network/SocketStreamHandleBase.h \
+	WebCore/platform/network/SocketStreamHandleClient.h \
 	WebCore/websockets/WebSocket.cpp \
-	WebCore/websockets/WebSocket.h
+	WebCore/websockets/WebSocket.h \
+	WebCore/websockets/WebSocketChannel.cpp \
+	WebCore/websockets/WebSocketChannel.h \
+	WebCore/websockets/WebSocketChannelClient.h \
+	WebCore/websockets/WebSocketHandshake.cpp \
+	WebCore/websockets/WebSocketHandshake.h
+
+webcoregtk_sources += \
+	WebCore/platform/network/soup/SocketStreamError.h \
+	WebCore/platform/network/soup/SocketStreamHandle.h \
+	WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
 
 else
 webcore_cppflags += -DENABLE_WEB_SOCKETS=0
@@ -3177,20 +3319,20 @@ DerivedSources/CSSValueKeywords.h : $(WEBCORE_CSS_VALUE_KEYWORDS) $(WebCore)/css
 
 # DOCTYPE strings
 DerivedSources/DocTypeStrings.cpp : $(WebCore)/html/DocTypeStrings.gperf
-	$(GPERF) -CEot -L ANSI-C -k "*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards $(WebCore)/html/DocTypeStrings.gperf > $@
+	$(AM_V_GEN)$(GPERF) -CEot -L ANSI-C -k "*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards $(WebCore)/html/DocTypeStrings.gperf > $@
 
 # HTML entity names
 DerivedSources/HTMLEntityNames.c : $(WebCore)/html/HTMLEntityNames.gperf
-	$(GPERF) -a -L ANSI-C -C -G -c -o -t -k '*' -N findEntity -D -s 2 \
+	$(AM_V_GEN)$(GPERF) -a -L ANSI-C -C -G -c -o -t -k '*' -N findEntity -D -s 2 \
 	$(WebCore)/html/HTMLEntityNames.gperf > $@
 
 # color names
 DerivedSources/ColorData.c: $(WebCore)/platform/ColorData.gperf
-	$(GPERF) -CDEot -L ANSI-C -k '*' -N findColor -D -s 2 $< > $@
+	$(AM_V_GEN)$(GPERF) -CDEot -L ANSI-C -k '*' -N findColor -D -s 2 $< > $@
 
 # CSS tokenizer
 DerivedSources/tokenizer.cpp : $(WebCore)/css/tokenizer.flex $(WebCore)/css/maketokenizer
-	$(FLEX) -t $< | $(PERL) $(WebCore)/css/maketokenizer > $@
+	$(AM_V_GEN)$(FLEX) -t $< | $(PERL) $(WebCore)/css/maketokenizer > $@
 
 # CSS grammar
 
@@ -3227,27 +3369,21 @@ SCRIPTS_BINDINGS = \
 DerivedSources/UserAgentStyleSheetsData.cpp: DerivedSources/UserAgentStyleSheets.h;
 
 DerivedSources/UserAgentStyleSheets.h: $(WebCore)/css/make-css-file-arrays.pl $(USER_AGENT_STYLE_SHEETS)
-	$(PERL) $< $@ DerivedSources/UserAgentStyleSheetsData.cpp $(USER_AGENT_STYLE_SHEETS)
+	$(AM_V_GEN)$(PERL) $< $@ DerivedSources/UserAgentStyleSheetsData.cpp $(USER_AGENT_STYLE_SHEETS)
 
 # HTML tag and attribute names
-DerivedSources/HTMLElementFactory.cpp: DerivedSources/HTMLNames.cpp;
-DerivedSources/HTMLElementFactory.h: DerivedSources/HTMLElementFactory.cpp;
-DerivedSources/HTMLNames.h: DerivedSources/HTMLNames.cpp;
-DerivedSources/JSHTMLElementWrapperFactory.cpp: DerivedSources/HTMLNames.cpp;
-DerivedSources/JSHTMLElementWrapperFactory.h: DerivedSources/JSHTMLElementWrapperFactory.cpp;
-
 if HTML_FLAGS
-DerivedSources/HTMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --extraDefines "$(HTML_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+DerivedSources/HTMLElementFactory.cpp DerivedSources/HTMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --extraDefines "$(HTML_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES)"
 else
-DerivedSources/HTMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+DerivedSources/HTMLElementFactory.cpp DerivedSources/HTMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
 endif # HTML_FLAGS
 
-DerivedSources/XMLNames.h: DerivedSources/XMLNames.cpp;
+DerivedSources/JSHTMLElementWrapperFactory.cpp: DerivedSources/HTMLNames.cpp;
 
 DerivedSources/XMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/xml/xmlattrs.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlattrs.in --outputDir "$(GENSOURCES)"
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlattrs.in --outputDir "$(GENSOURCES)"
 
 IDL_PATH := \
     $(WebCore)/bindings/js \
@@ -3257,6 +3393,7 @@ IDL_PATH := \
     $(WebCore)/html/canvas \
     $(WebCore)/inspector \
     $(WebCore)/loader/appcache \
+    $(WebCore)/notifications \
     $(WebCore)/page \
     $(WebCore)/storage \
     $(WebCore)/svg \
@@ -3271,7 +3408,7 @@ DerivedSources/JS%.h: DerivedSources/JS%.cpp;
 
 .SECONDARY:
 DerivedSources/JS%.cpp: %.idl $(SCRIPTS_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorJS.pm
-	$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES)" --defines "$(FEATURE_DEFINES_JAVASCRIPT)" --generator JS $<
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES)" --defines "$(FEATURE_DEFINES_JAVASCRIPT)" --generator JS $<
 
 IDL_BINDINGS_JS_PURE := \
 	WebCore/svg/ElementTimeControl.idl \
@@ -3381,4 +3518,3 @@ dist_webresources_DATA = \
 
 CLEANFILES += \
 	libWebCoreJS.la
-
diff --git a/WebCore/WebCore.3DRendering.exp b/WebCore/WebCore.3DRendering.exp
new file mode 100644
index 0000000..4a84c63
--- /dev/null
+++ b/WebCore/WebCore.3DRendering.exp
@@ -0,0 +1 @@
+_WebCoreHas3DRendering
diff --git a/WebCore/WebCore.ContextMenus.exp b/WebCore/WebCore.ContextMenus.exp
new file mode 100644
index 0000000..62b2c1f
--- /dev/null
+++ b/WebCore/WebCore.ContextMenus.exp
@@ -0,0 +1,5 @@
+__ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
+__ZN7WebCore12EventHandler20sendContextMenuEventEP7NSEvent
+__ZN7WebCore15ContextMenuItem26releasePlatformDescriptionEv
+__ZN7WebCore21ContextMenuController16clearContextMenuEv
+__ZNK7WebCore11ContextMenu19platformDescriptionEv
diff --git a/WebCore/WebCore.DragSupport.exp b/WebCore/WebCore.DragSupport.exp
new file mode 100644
index 0000000..2cfd076
--- /dev/null
+++ b/WebCore/WebCore.DragSupport.exp
@@ -0,0 +1,10 @@
+__ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
+__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
+__ZN7WebCore12EventHandler17eventMayStartDragEP7NSEvent
+__ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
+__ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
+__ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
+__ZN7WebCore14DragController11performDragEPNS_8DragDataE
+__ZN7WebCore14DragController14placeDragCaretERKNS_8IntPointE
+__ZN7WebCore14DragController9dragEndedEv
+__ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
diff --git a/WebCore/WebCore.Inspector.exp b/WebCore/WebCore.Inspector.exp
new file mode 100644
index 0000000..576994f
--- /dev/null
+++ b/WebCore/WebCore.Inspector.exp
@@ -0,0 +1,18 @@
+__ZN7WebCore19InspectorController10setSettingERKNS_6StringERKNS0_7SettingE
+__ZN7WebCore19InspectorController12attachWindowEv
+__ZN7WebCore19InspectorController12detachWindowEv
+__ZN7WebCore19InspectorController14enableDebuggerEv
+__ZN7WebCore19InspectorController14enableProfilerEbb
+__ZN7WebCore19InspectorController15disableDebuggerEb
+__ZN7WebCore19InspectorController15disableProfilerEb
+__ZN7WebCore19InspectorController16setWindowVisibleEbb
+__ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
+__ZN7WebCore19InspectorController27startUserInitiatedProfilingEPNS_5TimerIS0_EE
+__ZN7WebCore19InspectorController4showEv
+__ZN7WebCore19InspectorController5closeEv
+__ZN7WebCore19InspectorController7inspectEPNS_4NodeE
+__ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
+__ZN7WebCore19InspectorController25evaluateForTestInFrontendElRKNS_6StringE
+__ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
+__ZNK7WebCore19InspectorController7enabledEv
+__ZNK7WebCore19InspectorController7settingERKNS_6StringE
diff --git a/WebCore/WebCore.OrientationEvents.exp b/WebCore/WebCore.OrientationEvents.exp
new file mode 100644
index 0000000..ec0978d
--- /dev/null
+++ b/WebCore/WebCore.OrientationEvents.exp
@@ -0,0 +1 @@
+__ZN7WebCore5Frame26sendOrientationChangeEventEi
diff --git a/WebCore/WebCore.LP64.exp b/WebCore/WebCore.PluginHostProcess.exp
index cc04718..cce951f 100644
--- a/WebCore/WebCore.LP64.exp
+++ b/WebCore/WebCore.PluginHostProcess.exp
@@ -1,4 +1,4 @@
-# This file gets appended to WebCore.exp, only for 64-bit architectures.
+# This file gets appended to WebCore.exp when USE(PLUGIN_HOST_PROCESS) is 1.
 
 __ZN3JSC16RuntimeObjectImp6s_infoE
 __ZN3JSC8Bindings10RootObjectD1Ev
diff --git a/WebCore/WebCore.Video.exp b/WebCore/WebCore.Video.exp
new file mode 100644
index 0000000..596fb4b
--- /dev/null
+++ b/WebCore/WebCore.Video.exp
@@ -0,0 +1,12 @@
+__ZN7WebCore16HTMLMediaElement4playEv
+__ZN7WebCore16HTMLMediaElement5pauseEv
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
+__ZN7WebCore16HTMLMediaElement9setVolumeEfRi
+__ZN7WebCore16HTMLMediaElement6rewindEf
+__ZN7WebCore16HTMLMediaElement10screenRectEv
+__ZNK7WebCore16HTMLMediaElement11currentTimeEv
+__ZNK7WebCore16HTMLMediaElement13platformMediaEv
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
diff --git a/WebCore/WebCore.base.exp b/WebCore/WebCore.base.exp
index aac7c80..51d8ca0 100644
--- a/WebCore/WebCore.base.exp
+++ b/WebCore/WebCore.base.exp
@@ -133,6 +133,7 @@ __Z4coreP19DOMDocumentFragment
 __Z4coreP22DOMCSSStyleDeclaration
 __Z4coreP7DOMNode
 __Z4coreP8DOMRange
+__ZN3JSC8Bindings8Instance16newRuntimeObjectEPNS_9ExecStateE
 __ZN7WebCore10MouseEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9ClipboardEEEb
 __ZN7WebCore10ScrollView17setScrollbarModesENS_13ScrollbarModeES1_
 __ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
@@ -146,7 +147,6 @@ __ZN7WebCore10handCursorEv
 __ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLERKNS_6StringE
 __ZN7WebCore11CachedFrame23cachedFramePlatformDataEv
 __ZN7WebCore11CachedFrame26setCachedFramePlatformDataEPNS_23CachedFramePlatformDataE
-__ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
 __ZN7WebCore11EditCommand7reapplyEv
 __ZN7WebCore11EditCommand7unapplyEv
 __ZN7WebCore11FileChooser10chooseFileERKNS_6StringE
@@ -155,7 +155,6 @@ __ZN7WebCore11FileChooserD1Ev
 __ZN7WebCore11FrameLoader11completeURLERKNS_6StringE
 __ZN7WebCore11FrameLoader11loadArchiveEN3WTF10PassRefPtrINS_7ArchiveEEE
 __ZN7WebCore11FrameLoader11setEncodingERKNS_6StringEb
-__ZN7WebCore11FrameLoader11stopLoadingEbNS_14DatabasePolicyE
 __ZN7WebCore11FrameLoader12shouldReloadERKNS_4KURLES3_
 __ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEb
 __ZN7WebCore11FrameLoader14detachChildrenEv
@@ -165,8 +164,6 @@ __ZN7WebCore11FrameLoader16detachFromParentEv
 __ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEE
 __ZN7WebCore11FrameLoader17stopForUserCancelEb
 __ZN7WebCore11FrameLoader18currentHistoryItemEv
-__ZN7WebCore11FrameLoader18setLocalLoadPolicyENS0_15LocalLoadPolicyE
-__ZN7WebCore11FrameLoader18shouldHideReferrerERKNS_4KURLERKNS_6StringE
 __ZN7WebCore11FrameLoader21loadURLIntoChildFrameERKNS_4KURLERKNS_6StringEPNS_5FrameE
 __ZN7WebCore11FrameLoader21setCurrentHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
 __ZN7WebCore11FrameLoader22findFrameForNavigationERKNS_12AtomicStringE
@@ -180,7 +177,6 @@ __ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_6StringEb
 __ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestEb
 __ZN7WebCore11FrameLoader6reloadEb
 __ZN7WebCore11FrameLoader7addDataEPKci
-__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLERKNS_6StringEPKNS_8DocumentE
 __ZN7WebCore11Geolocation12setIsAllowedEb
 __ZN7WebCore11HistoryItem10targetItemEv
 __ZN7WebCore11HistoryItem11setReferrerERKNS_6StringE
@@ -224,12 +220,8 @@ __ZN7WebCore12EventHandler12mouseDraggedEP7NSEvent
 __ZN7WebCore12EventHandler14currentNSEventEv
 __ZN7WebCore12EventHandler14scrollOverflowENS_15ScrollDirectionENS_17ScrollGranularityE
 __ZN7WebCore12EventHandler15sendScrollEventEv
-__ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
-__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
-__ZN7WebCore12EventHandler17eventMayStartDragEP7NSEvent
 __ZN7WebCore12EventHandler20handleTextInputEventERKNS_6StringEPNS_5EventEbb
 __ZN7WebCore12EventHandler20hitTestResultAtPointERKNS_8IntPointEbbNS_17HitTestScrollbarsE
-__ZN7WebCore12EventHandler20sendContextMenuEventEP7NSEvent
 __ZN7WebCore12EventHandler27capsLockStateMayHaveChangedEv
 __ZN7WebCore12EventHandler7mouseUpEP7NSEvent
 __ZN7WebCore12EventHandler8keyEventEP7NSEvent
@@ -270,6 +262,7 @@ __ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
 __ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
 __ZN7WebCore12TextIterator7advanceEv
 __ZN7WebCore12TextIteratorC1EPKNS_5RangeEbb
+__ZN7WebCore12WorkerThread17workerThreadCountEv
 __ZN7WebCore12applyCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
 __ZN7WebCore12cacheStorageEv
 __ZN7WebCore12createMarkupEPKNS_4NodeENS_13EChildrenOnlyEPN3WTF6VectorIPS0_Lm0EEE
@@ -301,18 +294,18 @@ __ZN7WebCore14DocumentLoader8setFrameEPNS_5FrameE
 __ZN7WebCore14DocumentLoader8setTitleERKNS_6StringE
 __ZN7WebCore14DocumentLoaderC2ERKNS_15ResourceRequestERKNS_14SubstituteDataE
 __ZN7WebCore14DocumentLoaderD2Ev
-__ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
-__ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
-__ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
-__ZN7WebCore14DragController11performDragEPNS_8DragDataE
-__ZN7WebCore14DragController14placeDragCaretERKNS_8IntPointE
-__ZN7WebCore14DragController9dragEndedEv
 __ZN7WebCore14ResourceHandle12releaseProxyEv
 __ZN7WebCore14ResourceHandle20forceContentSniffingEv
 __ZN7WebCore14ResourceLoader14cancelledErrorEv
 __ZN7WebCore14ResourceLoader19setShouldBufferDataEb
+__ZN7WebCore14SecurityOrigin16createFromStringERKNS_6StringE
+__ZN7WebCore14SecurityOrigin18setLocalLoadPolicyENS0_15LocalLoadPolicyE
+__ZN7WebCore14SecurityOrigin18shouldHideReferrerERKNS_4KURLERKNS_6StringE
 __ZN7WebCore14SecurityOrigin24registerURLSchemeAsLocalERKNS_6StringE
+__ZN7WebCore14SecurityOrigin25whiteListAccessFromOriginERKS0_RKNS_6StringES5_b
+__ZN7WebCore14SecurityOrigin27resetOriginAccessWhiteListsEv
 __ZN7WebCore14SecurityOrigin6createERKNS_4KURLE
+__ZN7WebCore14SecurityOrigin7canLoadERKNS_4KURLERKNS_6StringEPNS_8DocumentE
 __ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceResponseE
 __ZN7WebCore15BackForwardList10removeItemEPNS_11HistoryItemE
 __ZN7WebCore15BackForwardList10setEnabledEb
@@ -337,7 +330,6 @@ __ZN7WebCore15BackForwardList8goToItemEPNS_11HistoryItemE
 __ZN7WebCore15BackForwardList9goForwardEv
 __ZN7WebCore15BackForwardListC1EPNS_4PageE
 __ZN7WebCore15BackForwardListD1Ev
-__ZN7WebCore15ContextMenuItem26releasePlatformDescriptionEv
 __ZN7WebCore15DatabaseTracker12deleteOriginEPNS_14SecurityOriginE
 __ZN7WebCore15DatabaseTracker14deleteDatabaseEPNS_14SecurityOriginERKNS_6StringE
 __ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
@@ -393,28 +385,18 @@ __ZN7WebCore16createFullMarkupEPKNS_5RangeE
 __ZN7WebCore16enclosingIntRectERK7_NSRect
 __ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionE
 __ZN7WebCore16threadGlobalDataEv
+__ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
 __ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
 __ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
+__ZN7WebCore17HTMLPlugInElement11getNPObjectEv
 __ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
 __ZN7WebCore18deprecatedParseURLERKNS_6StringE
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
 __ZN7WebCore19AnimationController20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
 __ZN7WebCore19AnimationController21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
+__ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
 __ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_Ri
-__ZN7WebCore19InspectorController10setSettingERKNS_6StringERKNS0_7SettingE
-__ZN7WebCore19InspectorController12attachWindowEv
-__ZN7WebCore19InspectorController12detachWindowEv
-__ZN7WebCore19InspectorController14enableDebuggerEv
-__ZN7WebCore19InspectorController14enableProfilerEbb
-__ZN7WebCore19InspectorController15disableDebuggerEb
-__ZN7WebCore19InspectorController15disableProfilerEb
-__ZN7WebCore19InspectorController16setWindowVisibleEbb
-__ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
-__ZN7WebCore19InspectorController27startUserInitiatedProfilingEPNS_5TimerIS0_EE
-__ZN7WebCore19InspectorController4showEv
-__ZN7WebCore19InspectorController5closeEv
-__ZN7WebCore19InspectorController7inspectEPNS_4NodeE
-__ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
 __ZN7WebCore19SelectionController10setFocusedEb
 __ZN7WebCore19SelectionController12setSelectionERKNS_16VisibleSelectionEbbb
 __ZN7WebCore19SelectionController16setSelectedRangeEPNS_5RangeENS_9EAffinityEb
@@ -429,7 +411,6 @@ __ZN7WebCore19TextResourceDecoderD1Ev
 __ZN7WebCore19applicationIsSafariEv
 __ZN7WebCore20ResourceResponseBase24setExpectedContentLengthEx
 __ZN7WebCore20ResourceResponseBaseC2Ev
-__ZN7WebCore21ContextMenuController16clearContextMenuEv
 __ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
 __ZN7WebCore21JavaScriptDebugServer6sharedEv
 __ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
@@ -438,13 +419,15 @@ __ZN7WebCore21WindowsLatin1EncodingEv
 __ZN7WebCore21findEventWithKeyStateEPNS_5EventE
 __ZN7WebCore21isBackForwardLoadTypeENS_13FrameLoadTypeE
 __ZN7WebCore21reportThreadViolationEPKcNS_20ThreadViolationRoundE
+__ZN7WebCore22GeolocationServiceMock11setPositionEN3WTF10PassRefPtrINS_11GeopositionEEE
+__ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErrorEEE
 __ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
 __ZN7WebCore22applicationIsAppleMailEv
 __ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
 __ZN7WebCore22externalRepresentationEPNS_12RenderObjectE
 __ZN7WebCore23ApplicationCacheStorage14setMaximumSizeEx
-__ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKNS_6StringE
 __ZN7WebCore23ApplicationCacheStorage16storeCopyOfCacheERKNS_6StringEPNS_20ApplicationCacheHostE
+__ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKNS_6StringE
 __ZN7WebCore23ApplicationCacheStorage18vacuumDatabaseFileEv
 __ZN7WebCore23ApplicationCacheStorage5emptyEv
 __ZN7WebCore23ApplicationCacheStorage14setMaximumSizeEx
@@ -452,7 +435,6 @@ __ZN7WebCore23ApplicationCacheStorage18vacuumDatabaseFileEv
 __ZN7WebCore23ReplaceSelectionCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
 __ZN7WebCore23createFragmentFromNodesEPNS_8DocumentERKN3WTF6VectorIPNS_4NodeELm0EEE
 __ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
-__ZN7WebCore24WebCoreCredentialStorage9m_storageE
 __ZN7WebCore24createFragmentFromMarkupEPNS_8DocumentERKNS_6StringES4_
 __ZN7WebCore24decodeURLEscapeSequencesERKNS_6StringE
 __ZN7WebCore24notifyHistoryItemChangedE
@@ -477,6 +459,7 @@ __ZN7WebCore31applicationIsMicrosoftMessengerEv
 __ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjb
 __ZN7WebCore33setDefaultThreadViolationBehaviorENS_23ThreadViolationBehaviorENS_20ThreadViolationRoundE
 __ZN7WebCore36InitializeLoggingChannelsIfNecessaryEv
+__ZN7WebCore3macERKNS_10CredentialE
 __ZN7WebCore3macERKNS_23AuthenticationChallengeE
 __ZN7WebCore4Font11setCodePathENS0_8CodePathE
 __ZN7WebCore4Font18shouldUseSmoothingEv
@@ -486,8 +469,8 @@ __ZN7WebCore4FontC1Ev
 __ZN7WebCore4FontD1Ev
 __ZN7WebCore4FontaSERKS0_
 __ZN7WebCore4KURL10invalidateEv
+__ZN7WebCore4KURLC1ENS_18ParsedURLStringTagERKNS_6StringE
 __ZN7WebCore4KURLC1EP5NSURL
-__ZN7WebCore4KURLC1ERKNS_6StringE
 __ZN7WebCore4Node17stopIgnoringLeaksEv
 __ZN7WebCore4Node18startIgnoringLeaksEv
 __ZN7WebCore4Page12setGroupNameERKNS_6StringE
@@ -508,13 +491,14 @@ __ZN7WebCore4Page6goBackEv
 __ZN7WebCore4Page8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
 __ZN7WebCore4Page9goForwardEv
 __ZN7WebCore4Page9initGroupEv
-__ZN7WebCore4PageC1EPNS_12ChromeClientEPNS_17ContextMenuClientEPNS_12EditorClientEPNS_10DragClientEPNS_15InspectorClientE
+__ZN7WebCore4PageC1EPNS_12ChromeClientEPNS_17ContextMenuClientEPNS_12EditorClientEPNS_10DragClientEPNS_15InspectorClientEPNS_18PluginHalterClientE
 __ZN7WebCore4PageD1Ev
+__ZN7WebCore4coreEP20NSURLProtectionSpace
 __ZN7WebCore5Cache11setDisabledEb
 __ZN7WebCore5Cache13getStatisticsEv
 __ZN7WebCore5Cache13setCapacitiesEjjj
 __ZN7WebCore5Frame10findStringERKNS_6StringEbbbb
-__ZN7WebCore5Frame11shouldCloseEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore5Frame11shouldCloseEv
 __ZN7WebCore5Frame13reapplyStylesEv
 __ZN7WebCore5Frame13setZoomFactorEfb
 __ZN7WebCore5Frame14frameForWidgetEPKNS_6WidgetE
@@ -620,7 +604,6 @@ __ZN7WebCore8Document23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
 __ZN7WebCore8Document24setShouldCreateRenderersEb
 __ZN7WebCore8Document36updateLayoutIgnorePendingStylesheetsEv
 __ZN7WebCore8Document4headEv
-__ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
 __ZN7WebCore8FormDataD1Ev
 __ZN7WebCore8IntPointC1ERK8_NSPoint
 __ZN7WebCore8PositionC1EN3WTF10PassRefPtrINS_4NodeEEEi
@@ -657,6 +640,7 @@ __ZN7WebCore8Settings25setShouldPrintBackgroundsEb
 __ZN7WebCore8Settings25setUserStyleSheetLocationERKNS_4KURLE
 __ZN7WebCore8Settings26setDefaultTextEncodingNameERKNS_6StringE
 __ZN7WebCore8Settings26setNeedsSiteSpecificQuirksEb
+__ZN7WebCore8Settings15setWebGLEnabledEb
 __ZN7WebCore8Settings27setFTPDirectoryTemplatePathERKNS_6StringE
 __ZN7WebCore8Settings27setLoadsImagesAutomaticallyEb
 __ZN7WebCore8Settings27setLocalStorageDatabasePathERKNS_6StringE
@@ -666,10 +650,12 @@ __ZN7WebCore8Settings29setWebArchiveDebugModeEnabledEb
 __ZN7WebCore8Settings31setShrinksStandaloneImagesToFitEb
 __ZN7WebCore8Settings32setAcceleratedCompositingEnabledEb
 __ZN7WebCore8Settings32setNeedsAdobeFrameReloadingQuirkEb
+__ZN7WebCore8Settings32setExperimentalWebSocketsEnabledEb
 __ZN7WebCore8Settings33setDownloadableBinaryFontsEnabledEb
 __ZN7WebCore8Settings33setEnforceCSSMIMETypeInStrictModeEb
 __ZN7WebCore8Settings34setLocalFileContentSniffingEnabledEb
 __ZN7WebCore8Settings35setAllowUniversalAccessFromFileURLsEb
+__ZN7WebCore8Settings35setExperimentalNotificationsEnabledEb
 __ZN7WebCore8Settings35setTreatsAnyTextCSSLinkAsStylesheetEb
 __ZN7WebCore8Settings36setOfflineWebApplicationCacheEnabledEb
 __ZN7WebCore8Settings40setJavaScriptCanOpenWindowsAutomaticallyEb
@@ -677,7 +663,6 @@ __ZN7WebCore8Settings40setTextDirectionSubmenuInclusionBehaviorENS_37TextDirecti
 __ZN7WebCore8Settings41setNeedsKeyboardEventDisambiguationQuirksEb
 __ZN7WebCore8blankURLEv
 __ZN7WebCore8makeRGBAEiiii
-__ZN7WebCore9DOMWindow16hasEventListenerERKNS_12AtomicStringE
 __ZN7WebCore9DOMWindow30dispatchAllPendingUnloadEventsEv
 __ZN7WebCore9DOMWindow36dispatchAllPendingBeforeUnloadEventsEv
 __ZN7WebCore9FloatRectC1ERK7_NSRect
@@ -690,20 +675,21 @@ __ZN7WebCore9FrameTree9clearNameEv
 __ZN7WebCore9FrameView11forceLayoutEb
 __ZN7WebCore9FrameView12setMediaTypeERKNS_6StringE
 __ZN7WebCore9FrameView14adjustViewSizeEv
-__ZN7WebCore9FrameView14initScrollbarsEv
 __ZN7WebCore9FrameView14setMarginWidthEi
 __ZN7WebCore9FrameView14setNeedsLayoutEv
 __ZN7WebCore9FrameView14setTransparentEb
 __ZN7WebCore9FrameView15setMarginHeightEi
 __ZN7WebCore9FrameView16adjustPageHeightEPffff
 __ZN7WebCore9FrameView18updateControlTintsEv
+__ZN7WebCore9FrameView21flushDeferredRepaintsEv
 __ZN7WebCore9FrameView22setBaseBackgroundColorENS_5ColorE
 __ZN7WebCore9FrameView23layoutIfNeededRecursiveEv
-__ZN7WebCore9FrameView29syncCompositingStateRecursiveEv
 __ZN7WebCore9FrameView29forceLayoutWithPageWidthRangeEffb
 __ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
+__ZN7WebCore9FrameView29syncCompositingStateRecursiveEv
 __ZN7WebCore9FrameView6createEPNS_5FrameE
 __ZN7WebCore9FrameView6createEPNS_5FrameERKNS_7IntSizeE
+__ZN7WebCore9FrameView21scrollPositionChangedEv
 __ZN7WebCore9HTMLNames10listingTagE
 __ZN7WebCore9HTMLNames11textareaTagE
 __ZN7WebCore9HTMLNames13blockquoteTagE
@@ -735,14 +721,21 @@ __ZN7WebCore9HTMLNames7srcAttrE
 __ZN7WebCore9HTMLNames8frameTagE
 __ZN7WebCore9HTMLNames8hrefAttrE
 __ZN7WebCore9HTMLNames8inputTagE
+__ZN7WebCore9HTMLNames8videoTagE
 __ZN7WebCore9HTMLNames9iframeTagE
 __ZN7WebCore9HTMLNames9scriptTagE
 __ZN7WebCore9PageCache11setCapacityEi
 __ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
+__ZN7WebCore9PageGroup17addUserStyleSheetERKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_j
+__ZN7WebCore9PageGroup13addUserScriptERKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_jNS_23UserScriptInjectionTimeE
 __ZN7WebCore9PageGroup14addVisitedLinkEPKtm
 __ZN7WebCore9PageGroup17closeLocalStorageEv
+__ZN7WebCore9PageGroup20removeAllUserContentEv
 __ZN7WebCore9PageGroup21removeAllVisitedLinksEv
+__ZN7WebCore9PageGroup32removeUserContentWithURLForWorldERKNS_4KURLEj
+__ZN7WebCore9PageGroup25removeUserContentForWorldEj
 __ZN7WebCore9PageGroup26setShouldTrackVisitedLinksEb
+__ZN7WebCore9PageGroup9pageGroupERKNS_6StringE
 __ZN7WebCore9TimerBase4stopEv
 __ZN7WebCore9TimerBase5startEdd
 __ZN7WebCore9TimerBaseC2Ev
@@ -764,7 +757,6 @@ __ZNK7WebCore10ScrollView12documentViewEv
 __ZNK7WebCore10ScrollView14scrollbarModesERNS_13ScrollbarModeES2_
 __ZNK7WebCore10ScrollView18visibleContentRectEb
 __ZNK7WebCore11CachedImage5imageEv
-__ZNK7WebCore11ContextMenu19platformDescriptionEv
 __ZNK7WebCore11FrameLoader10isCompleteEv
 __ZNK7WebCore11FrameLoader14frameHasLoadedEv
 __ZNK7WebCore11FrameLoader15containsPluginsEv
@@ -854,9 +846,6 @@ __ZNK7WebCore16VisibleSelection23isContentRichlyEditableEv
 __ZNK7WebCore16VisibleSelection5isAllENS_21StayInEditableContentE
 __ZNK7WebCore17ResourceErrorBase8lazyInitEv
 __ZNK7WebCore19AnimationController24numberOfActiveAnimationsEv
-__ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
-__ZNK7WebCore19InspectorController7enabledEv
-__ZNK7WebCore19InspectorController7settingERKNS_6StringE
 __ZNK7WebCore19ResourceRequestBase10httpMethodEv
 __ZNK7WebCore19ResourceRequestBase3urlEv
 __ZNK7WebCore19ResourceRequestBase7isEmptyEv
@@ -983,6 +972,10 @@ __ZTVN7WebCore12ChromeClientE
 __ZTVN7WebCore17FileChooserClientE
 __ZTVN7WebCore17FrameLoaderClientE
 __ZTVN7WebCore25HistoryPropertyListWriterE
+__ZN7WebCore4Page13didStopPluginEPNS_14HaltablePluginE
+__ZN7WebCore4Page14didStartPluginEPNS_14HaltablePluginE
+__ZN7WebCore8Settings23setPluginAllowedRunTimeEj
+__ZN7WebCore8Settings22setPluginHalterEnabledEb
 _filenameByFixingIllegalCharacters
 _hasCaseInsensitiveSubstring
 _hasCaseInsensitiveSuffix
diff --git a/WebCore/WebCore.gyp/WebCore.gyp b/WebCore/WebCore.gyp/WebCore.gyp
new file mode 100644
index 0000000..4a0c540
--- /dev/null
+++ b/WebCore/WebCore.gyp/WebCore.gyp
@@ -0,0 +1,793 @@
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+{
+  'includes': [
+    # FIXME: Sense whether upstream or downstream build, and
+    # include the right features.gypi
+    '../../WebKit/chromium/features.gypi',
+    '../WebCore.gypi',
+  ],
+  # Location of the chromium src directory.
+  'conditions': [
+    ['inside_chromium_build==0', {
+      # Webkit is being built outside of the full chromium project.
+      'variables': {'chromium_src_dir': '../../WebKit/chromium'},
+    },{
+      # WebKit is checked out in src/chromium/third_party/WebKit
+      'variables': {'chromium_src_dir': '../../../..'},
+    }],
+  ],  
+
+  'variables': {
+    # If set to 1, doesn't compile debug symbols into webcore reducing the
+    # size of the binary and increasing the speed of gdb.  gcc only.
+    'remove_webcore_debug_symbols%': 0,
+  
+    'webcore_include_dirs': [
+      '../',
+      '../accessibility',
+      '../accessibility/chromium',
+      '../bindings/v8',
+      '../bindings/v8/custom',
+      '../bridge',
+      '../css',
+      '../dom',
+      '../dom/default',
+      '../editing',
+      '../history',
+      '../html',
+      '../html/canvas',
+      '../inspector',
+      '../loader',
+      '../loader/appcache',
+      '../loader/archive',
+      '../loader/icon',
+      '../notifications',
+      '../page',
+      '../page/animation',
+      '../page/chromium',
+      '../platform',
+      '../platform/animation',
+      '../platform/chromium',
+      '../platform/graphics',
+      '../platform/graphics/chromium',
+      '../platform/graphics/opentype',
+      '../platform/graphics/skia',
+      '../platform/graphics/transforms',
+      '../platform/image-decoders',
+      '../platform/image-decoders/bmp',
+      '../platform/image-decoders/gif',
+      '../platform/image-decoders/ico',
+      '../platform/image-decoders/jpeg',
+      '../platform/image-decoders/png',
+      '../platform/image-decoders/skia',
+      '../platform/image-decoders/xbm',
+      '../platform/image-encoders/skia',
+      '../platform/mock',
+      '../platform/network',
+      '../platform/network/chromium',
+      '../platform/sql',
+      '../platform/text',
+      '../plugins',
+      '../rendering',
+      '../rendering/style',
+      '../storage',
+      '../svg',
+      '../svg/animation',
+      '../svg/graphics',
+      '../websockets',
+      '../workers',
+      '../xml',
+    ],
+    'conditions': [
+      ['OS=="mac"', {
+        'webcore_include_dirs+': [
+          # platform/graphics/cg and mac needs to come before
+          # platform/graphics/chromium so that the Mac build picks up the
+          # version of ImageBufferData.h in the cg directory and
+          # FontPlatformData.h in the mac directory.  The + prepends this
+          # directory to the list.
+          # FIXME: This shouldn't need to be prepended.
+          # FIXME: Eliminate dependency on platform/graphics/mac and
+          # related directories.
+          # platform/graphics/cg may need to stick around, though.
+          '../platform/graphics/cg',
+          '../platform/graphics/mac',
+        ],
+        'webcore_include_dirs': [
+          # FIXME: Eliminate dependency on platform/mac and related
+          # directories.
+          '../loader/archive/cf',
+          '../platform/mac',
+          '../platform/text/mac',
+        ],
+      }],
+      ['OS=="win"', {
+        'webcore_include_dirs': [
+          '../page/win',
+          '../platform/graphics/win',
+          '../platform/text/win',
+          '../platform/win',
+        ],
+      }],
+    ],
+  },
+  'targets': [
+    {
+      'target_name': 'webcore',
+      'type': '<(library)',
+      'msvs_guid': '1C16337B-ACF3-4D03-AA90-851C5B5EADA6',
+      'dependencies': [
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:pcre',
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
+        '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
+        '<(chromium_src_dir)/skia/skia.gyp:skia',
+        '<(chromium_src_dir)/third_party/libjpeg/libjpeg.gyp:libjpeg',
+        '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
+        '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
+        '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
+        '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
+        '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
+      ],
+      'defines': [
+        'WEBCORE_NAVIGATOR_VENDOR="Google Inc."', 
+      ],
+      'actions': [
+        # Actions to build derived sources.
+        {
+          'action_name': 'CSSPropertyNames',
+          'inputs': [
+            '../css/makeprop.pl',
+            '../css/CSSPropertyNames.in',
+            '../css/SVGCSSPropertyNames.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/CSSPropertyNames.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/CSSPropertyNames.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_csspropertynames.py', '<@(_outputs)', '--', '<@(_inputs)'],
+        },
+        {
+          'action_name': 'CSSValueKeywords',
+          'inputs': [
+            '../css/makevalues.pl',
+            '../css/CSSValueKeywords.in',
+            '../css/SVGCSSValueKeywords.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/CSSValueKeywords.c',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/CSSValueKeywords.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_cssvaluekeywords.py', '<@(_outputs)', '--', '<@(_inputs)'],
+        },
+        {
+          'action_name': 'HTMLNames',
+          'inputs': [
+            '../dom/make_names.pl',
+            '../html/HTMLTagNames.in',
+            '../html/HTMLAttributeNames.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/HTMLNames.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/HTMLNames.h',
+            '<(INTERMEDIATE_DIR)/HTMLElementFactory.cpp',
+            # Pass --wrapperFactory to make_names to get these (JSC build?)
+            #'<(INTERMEDIATE_DIR)/JSHTMLElementWrapperFactory.cpp',
+            #'<(INTERMEDIATE_DIR)/JSHTMLElementWrapperFactory.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--factory', '--extraDefines', '<(feature_defines)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'action_name': 'SVGNames',
+          'inputs': [
+            '../dom/make_names.pl',
+            '../svg/svgtags.in',
+            '../svg/svgattrs.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/SVGNames.cpp',
+            '<(INTERMEDIATE_DIR)/SVGNames.h',
+            '<(INTERMEDIATE_DIR)/SVGElementFactory.cpp',
+            '<(INTERMEDIATE_DIR)/SVGElementFactory.h',
+            # Pass --wrapperFactory to make_names to get these (JSC build?)
+            #'<(INTERMEDIATE_DIR)/JSSVGElementWrapperFactory.cpp',
+            #'<(INTERMEDIATE_DIR)/JSSVGElementWrapperFactory.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--factory', '--extraDefines', '<(feature_defines)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'action_name': 'UserAgentStyleSheets',
+          'inputs': [
+            '../css/make-css-file-arrays.pl',
+            '../css/html.css',
+            '../css/quirks.css',
+            '../css/view-source.css',
+            '../css/themeChromiumLinux.css',
+            '../css/themeWin.css',
+            '../css/themeWinQuirks.css',
+            '../css/svg.css',
+            '../css/mediaControls.css',
+            '../css/mediaControlsChromium.css',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/UserAgentStyleSheets.h',
+            '<(INTERMEDIATE_DIR)/UserAgentStyleSheetsData.cpp',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_useragentstylesheets.py', '<@(_outputs)', '--', '<@(_inputs)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'action_name': 'XLinkNames',
+          'inputs': [
+            '../dom/make_names.pl',
+            '../svg/xlinkattrs.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/XLinkNames.cpp',
+            '<(INTERMEDIATE_DIR)/XLinkNames.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--extraDefines', '<(feature_defines)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'action_name': 'XMLNames',
+          'inputs': [
+            '../dom/make_names.pl',
+            '../xml/xmlattrs.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/XMLNames.cpp',
+            '<(INTERMEDIATE_DIR)/XMLNames.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--extraDefines', '<(feature_defines)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'action_name': 'tokenizer',
+          'inputs': [
+            '../css/maketokenizer',
+            '../css/tokenizer.flex',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/tokenizer.cpp',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_maketokenizer.py', '<@(_outputs)', '--', '<@(_inputs)'],
+        },
+      ],
+      'rules': [
+        # Rules to build derived sources.
+        {
+          'rule_name': 'bison',
+          'extension': 'y',
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).cpp',
+            '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).h'
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/rule_bison.py', '<(RULE_INPUT_PATH)', '<(INTERMEDIATE_DIR)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'rule_name': 'gperf',
+          'extension': 'gperf',
+          # gperf output is only ever #included by other source files.  As
+          # such, process_outputs_as_sources is off.  Some gperf output is
+          # #included as *.c and some as *.cpp.  Since there's no way to tell
+          # which one will be needed in a rule definition, declare both as
+          # outputs.  The harness script will generate one file and copy it to
+          # the other.
+          #
+          # This rule places outputs in SHARED_INTERMEDIATE_DIR because glue
+          # needs access to HTMLEntityNames.c.
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/<(RULE_INPUT_ROOT).c',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/<(RULE_INPUT_ROOT).cpp',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/rule_gperf.py', '<(RULE_INPUT_PATH)', '<(SHARED_INTERMEDIATE_DIR)/webkit'],
+          'process_outputs_as_sources': 0,
+        },
+        # Rule to build generated JavaScript (V8) bindings from .idl source.
+        {
+          'rule_name': 'binding',
+          'extension': 'idl',
+          'msvs_external_rule': 1,
+          'inputs': [
+            '../bindings/scripts/generate-bindings.pl',
+            '../bindings/scripts/CodeGenerator.pm',
+            '../bindings/scripts/CodeGeneratorV8.pm',
+            '../bindings/scripts/IDLParser.pm',
+            '../bindings/scripts/IDLStructure.pm',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/bindings/V8<(RULE_INPUT_ROOT).cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings/V8<(RULE_INPUT_ROOT).h',
+          ],
+          'variables': {
+            'generator_include_dirs': [
+              '--include', '../css',
+              '--include', '../dom',
+              '--include', '../html',
+              '--include', '../notifications',
+              '--include', '../page',
+              '--include', '../plugins',
+              '--include', '../svg',
+              '--include', '../websockets',
+              '--include', '../workers',
+              '--include', '../xml',
+            ],
+          },
+          'action': ['python', '<(chromium_src_dir)/webkit/build/rule_binding.py', '<(RULE_INPUT_PATH)', '<(INTERMEDIATE_DIR)/bindings', '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings', '--', '<@(_inputs)', '--', '--defines', '<(feature_defines) LANGUAGE_JAVASCRIPT V8_BINDING', '--generator', 'V8', '<@(generator_include_dirs)'],
+          # They are included by DerivedSourcesAllInOne.cpp instead.
+          'process_outputs_as_sources': 0,
+          'message': 'Generating binding from <(RULE_INPUT_PATH)',
+        },
+      ],
+      'include_dirs': [
+        '<(INTERMEDIATE_DIR)',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
+        '<@(webcore_include_dirs)',
+      ],
+      'sources': [
+        # bison rule
+        '../css/CSSGrammar.y',
+        '../xml/XPathGrammar.y',
+
+        # gperf rule
+        '../html/DocTypeStrings.gperf',
+        '../html/HTMLEntityNames.gperf',
+        '../platform/ColorData.gperf',
+
+        # This file includes all the .cpp files generated from the .idl files
+        # in webcore_files.
+        '../bindings/v8/DerivedSourcesAllInOne.cpp',
+
+        '<@(webcore_files)',
+
+        # For WebCoreSystemInterface, Mac-only.
+        '../../WebKit/mac/WebCoreSupport/WebSystemInterface.m',
+      ],
+      'sources/': [
+        # Exclude JSC custom bindings.
+        ['exclude', 'bindings/js'],
+
+        # SVG_FILTERS only.
+        ['exclude', 'svg/SVG(FE|Filter)[^/]*\\.idl$'],
+
+        # Fortunately, many things can be excluded by using broad patterns.
+
+        # Exclude things that don't apply to the Chromium platform on the basis
+        # of their enclosing directories and tags at the ends of their
+        # filenames.
+        ['exclude', '(android|cairo|cf|cg|curl|gtk|haiku|linux|mac|opentype|posix|qt|soup|symbian|win|wx)/'],
+        ['exclude', '(?<!Chromium)(SVGAllInOne|Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
+
+        # JSC-only.
+        ['exclude', 'inspector/JavaScript[^/]*\\.cpp$'],
+
+        # ENABLE_OFFLINE_WEB_APPLICATIONS, exclude most of webcore's impl
+        ['exclude', 'loader/appcache/'],
+        ['include', 'loader/appcache/ApplicationCacheHost\.h$'],
+        ['include', 'loader/appcache/DOMApplicationCache\.(h|cpp|idl)$'],
+
+        # SVG_FILTERS only.
+        ['exclude', '(platform|svg)/graphics/filters/'],
+        ['exclude', 'svg/Filter[^/]*\\.cpp$'],
+        ['exclude', 'svg/SVG(FE|Filter)[^/]*\\.cpp$'],
+
+        # Exclude some DB-related files.
+        ['exclude', 'platform/sql/SQLiteFileSystem.cpp'],
+      ],
+      'sources!': [
+        # Custom bindings in bindings/v8/custom exist for these.
+        '../dom/EventListener.idl',
+        '../dom/EventTarget.idl',
+        '../html/VoidCallback.idl',
+
+        # JSC-only.
+        '../inspector/JavaScriptCallFrame.idl',
+
+        # ENABLE_GEOLOCATION only.
+        '../page/Geolocation.idl',
+        '../page/Geoposition.idl',
+        '../page/PositionCallback.idl',
+        '../page/PositionError.idl',
+        '../page/PositionErrorCallback.idl',
+
+        # Bindings with custom Objective-C implementations.
+        '../page/AbstractView.idl',
+
+        # FIXME: I don't know why all of these are excluded.
+        # Extra SVG bindings to exclude.
+        '../svg/ElementTimeControl.idl',
+        '../svg/SVGAnimatedPathData.idl',
+        '../svg/SVGComponentTransferFunctionElement.idl',
+        '../svg/SVGExternalResourcesRequired.idl',
+        '../svg/SVGFitToViewBox.idl',
+        '../svg/SVGHKernElement.idl',
+        '../svg/SVGLangSpace.idl',
+        '../svg/SVGLocatable.idl',
+        '../svg/SVGStylable.idl',
+        '../svg/SVGTests.idl',
+        '../svg/SVGTransformable.idl',
+        '../svg/SVGViewSpec.idl',
+        '../svg/SVGZoomAndPan.idl',
+
+        # FIXME: I don't know why these are excluded, either.
+        # Someone (me?) should figure it out and add appropriate comments.
+        '../css/CSSUnknownRule.idl',
+
+        # A few things can't be excluded by patterns.  List them individually.
+
+        # Don't build StorageNamespace.  We have our own implementation.
+        '../storage/StorageNamespace.cpp',
+
+        # Don't build StorageEventDispatcher.  We have our own implementation.
+        '../storage/StorageEventDispatcher.cpp',
+
+        # Use history/BackForwardListChromium.cpp instead.
+        '../history/BackForwardList.cpp',
+
+        # Use loader/icon/IconDatabaseNone.cpp instead.
+        '../loader/icon/IconDatabase.cpp',
+
+        # Use platform/KURLGoogle.cpp instead.
+        '../platform/KURL.cpp',
+
+        # Use platform/MIMETypeRegistryChromium.cpp instead.
+        '../platform/MIMETypeRegistry.cpp',
+
+        # Theme.cpp is used only if we're using USE_NEW_THEME. We are not for
+        # Windows and Linux. We manually include Theme.cpp for the Mac below.
+        '../platform/Theme.cpp',
+
+        # Exclude some, but not all, of plugins.
+        '../plugins/PluginDatabase.cpp',
+        '../plugins/PluginInfoStore.cpp',
+        '../plugins/PluginMainThreadScheduler.cpp',
+        '../plugins/PluginPackage.cpp',
+        '../plugins/PluginStream.cpp',
+        '../plugins/PluginView.cpp',
+        '../plugins/npapi.cpp',
+
+        # Use LinkHashChromium.cpp instead
+        '../platform/LinkHash.cpp',
+
+        # Don't build these.
+        # FIXME: I don't know exactly why these are excluded.  It would
+        # be nice to provide more explicit comments.  Some of these do actually
+        # compile.
+        '../dom/StaticStringList.cpp',
+        '../loader/icon/IconFetcher.cpp',
+        '../loader/UserStyleSheetLoader.cpp',
+        '../platform/graphics/GraphicsLayer.cpp',
+        '../platform/graphics/RenderLayerBacking.cpp',
+        '../platform/graphics/RenderLayerCompositor.cpp',
+
+        # We use a multi-process version from the WebKit API.
+        '../dom/default/PlatformMessagePortChannel.cpp',
+        '../dom/default/PlatformMessagePortChannel.h',
+
+      ],
+      'direct_dependent_settings': {
+        'include_dirs': [
+          '<(SHARED_INTERMEDIATE_DIR)/webkit',
+          '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
+          '<@(webcore_include_dirs)',
+        ],
+        'mac_framework_dirs': [
+          '$(SDKROOT)/System/Library/Frameworks/ApplicationServices.framework/Frameworks',
+        ],
+      },
+      'export_dependent_settings': [
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
+        '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
+        '<(chromium_src_dir)/skia/skia.gyp:skia',
+        '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
+      ],
+      'link_settings': {
+        'mac_bundle_resources': [
+          '../Resources/aliasCursor.png',
+          '../Resources/cellCursor.png',
+          '../Resources/contextMenuCursor.png',
+          '../Resources/copyCursor.png',
+          '../Resources/crossHairCursor.png',
+          '../Resources/eastResizeCursor.png',
+          '../Resources/eastWestResizeCursor.png',
+          '../Resources/helpCursor.png',
+          '../Resources/linkCursor.png',
+          '../Resources/missingImage.png',
+          '../Resources/moveCursor.png',
+          '../Resources/noDropCursor.png',
+          '../Resources/noneCursor.png',
+          '../Resources/northEastResizeCursor.png',
+          '../Resources/northEastSouthWestResizeCursor.png',
+          '../Resources/northResizeCursor.png',
+          '../Resources/northSouthResizeCursor.png',
+          '../Resources/northWestResizeCursor.png',
+          '../Resources/northWestSouthEastResizeCursor.png',
+          '../Resources/notAllowedCursor.png',
+          '../Resources/progressCursor.png',
+          '../Resources/southEastResizeCursor.png',
+          '../Resources/southResizeCursor.png',
+          '../Resources/southWestResizeCursor.png',
+          '../Resources/verticalTextCursor.png',
+          '../Resources/waitCursor.png',
+          '../Resources/westResizeCursor.png',
+          '../Resources/zoomInCursor.png',
+          '../Resources/zoomOutCursor.png',
+        ],
+      },
+      'hard_dependency': 1,
+      'mac_framework_dirs': [
+        '$(SDKROOT)/System/Library/Frameworks/ApplicationServices.framework/Frameworks',
+      ],
+      'msvs_disabled_warnings': [
+        4138, 4244, 4291, 4305, 4344, 4355, 4521, 4099,
+      ],
+      'scons_line_length' : 1,
+      'xcode_settings': {
+        # Some Mac-specific parts of WebKit won't compile without having this
+        # prefix header injected.
+        # FIXME: make this a first-class setting.
+        'GCC_PREFIX_HEADER': '../WebCorePrefix.h',
+      },
+      'conditions': [
+        ['javascript_engine=="v8"', {
+          'dependencies': [
+            '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
+          ],
+          'export_dependent_settings': [
+            '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
+          ],
+        }],
+        ['OS=="linux" or OS=="freebsd"', {
+          'dependencies': [
+            '<(chromium_src_dir)/build/linux/system.gyp:fontconfig',
+            '<(chromium_src_dir)/build/linux/system.gyp:gtk',
+          ],
+          'sources': [
+            '../platform/graphics/chromium/VDMXParser.cpp',
+            '../platform/graphics/chromium/HarfbuzzSkia.cpp',
+          ],
+          'sources/': [
+            # Cherry-pick files excluded by the broader regular expressions above.
+            ['include', 'platform/chromium/KeyCodeConversionGtk\\.cpp$'],
+            ['include', 'platform/graphics/chromium/FontCacheLinux\\.cpp$'],
+            ['include', 'platform/graphics/chromium/FontLinux\\.cpp$'],
+            ['include', 'platform/graphics/chromium/FontPlatformDataLinux\\.cpp$'],
+            ['include', 'platform/graphics/chromium/GlyphPageTreeNodeLinux\\.cpp$'],
+            ['include', 'platform/graphics/chromium/SimpleFontDataLinux\\.cpp$'],
+          ],
+          'cflags': [
+            # WebCore does not work with strict aliasing enabled.
+            # https://bugs.webkit.org/show_bug.cgi?id=25864
+            '-fno-strict-aliasing',
+          ],
+        }],
+        ['OS=="linux"', {
+          'defines': [
+            # Mozilla on Linux effectively uses uname -sm, but when running
+            # 32-bit x86 code on an x86_64 processor, it uses
+            # "Linux i686 (x86_64)".  Matching that would require making a
+            # run-time determination.
+            'WEBCORE_NAVIGATOR_PLATFORM="Linux i686"',
+          ],
+        }],
+        ['OS=="mac"', {
+          'defines': [
+            # Match Safari and Mozilla on Mac x86.
+            'WEBCORE_NAVIGATOR_PLATFORM="MacIntel"',
+
+            # Chromium's version of WebCore includes the following Objective-C
+            # classes. The system-provided WebCore framework may also provide
+            # these classes. Because of the nature of Objective-C binding
+            # (dynamically at runtime), it's possible for the Chromium-provided
+            # versions to interfere with the system-provided versions.  This may
+            # happen when a system framework attempts to use WebCore.framework,
+            # such as when converting an HTML-flavored string to an
+            # NSAttributedString.  The solution is to force Objective-C class
+            # names that would conflict to use alternate names.
+
+            # FIXME: This list will hopefully shrink but may also grow.
+            # Periodically run:
+            # nm libwebcore.a | grep -E '[atsATS] ([+-]\[|\.objc_class_name)'
+            # and make sure that everything listed there has the alternate
+            # ChromiumWebCoreObjC name, and that nothing extraneous is listed
+            # here. If all Objective-C can be eliminated from Chromium's WebCore
+            # library, these defines should be removed entirely.
+            'ScrollbarPrefsObserver=ChromiumWebCoreObjCScrollbarPrefsObserver',
+            'WebCoreRenderThemeNotificationObserver=ChromiumWebCoreObjCWebCoreRenderThemeNotificationObserver',
+            'WebFontCache=ChromiumWebCoreObjCWebFontCache',
+          ],
+          'actions': [
+            {
+              # Allow framework-style #include of
+              # <WebCore/WebCoreSystemInterface.h>.
+              'action_name': 'WebCoreSystemInterface.h',
+              'inputs': [
+                '../platform/mac/WebCoreSystemInterface.h',
+              ],
+              'outputs': [
+                '<(INTERMEDIATE_DIR)/WebCore/WebCoreSystemInterface.h',
+              ],
+              'action': ['cp', '<@(_inputs)', '<@(_outputs)'],
+            },
+          ],
+          'include_dirs': [
+            '../../WebKitLibraries',
+          ],
+          'sources/': [
+            # Additional files from the WebCore Mac build that are presently
+            # used in the WebCore Chromium Mac build too.
+
+            # The Mac build is PLATFORM_CF but does not use CFNetwork.
+            ['include', 'CF\\.cpp$'],
+            ['exclude', 'network/cf/'],
+
+            # The Mac build is PLATFORM_CG too.  platform/graphics/cg is the
+            # only place that CG files we want to build are located, and not
+            # all of them even have a CG suffix, so just add them by a
+            # regexp matching their directory.
+            ['include', 'platform/graphics/cg/[^/]*(?<!Win)?\\.(cpp|mm?)$'],
+
+            # Use native Mac font code from WebCore.
+            ['include', 'platform/(graphics/)?mac/[^/]*Font[^/]*\\.(cpp|mm?)$'],
+
+            # Cherry-pick some files that can't be included by broader regexps.
+            # Some of these are used instead of Chromium platform files, see
+            # the specific exclusions in the "sources!" list below.
+            ['include', 'loader/archive/cf/LegacyWebArchive\\.cpp$'],
+            ['include', 'platform/graphics/mac/ColorMac\\.mm$'],
+            ['include', 'platform/graphics/mac/FloatPointMac\\.mm$'],
+            ['include', 'platform/graphics/mac/FloatRectMac\\.mm$'],
+            ['include', 'platform/graphics/mac/FloatSizeMac\\.mm$'],
+            ['include', 'platform/graphics/mac/GlyphPageTreeNodeMac\\.cpp$'],
+            ['include', 'platform/graphics/mac/GraphicsContextMac\\.mm$'],
+            ['include', 'platform/graphics/mac/IntRectMac\\.mm$'],
+            ['include', 'platform/mac/BlockExceptions\\.mm$'],
+            ['include', 'platform/mac/LocalCurrentGraphicsContext\\.mm$'],
+            ['include', 'platform/mac/PurgeableBufferMac\\.cpp$'],
+            ['include', 'platform/mac/ScrollbarThemeMac\\.mm$'],
+            ['include', 'platform/mac/WebCoreSystemInterface\\.mm$'],
+            ['include', 'platform/mac/WebCoreTextRenderer\\.mm$'],
+            ['include', 'platform/text/mac/ShapeArabic\\.c$'],
+            ['include', 'platform/text/mac/String(Impl)?Mac\\.mm$'],
+            # Use USE_NEW_THEME on Mac.
+            ['include', 'platform/Theme\\.cpp$'],
+
+            ['include', 'WebKit/mac/WebCoreSupport/WebSystemInterface\\.m$'],
+          ],
+          'sources!': [
+            # The Mac currently uses FontCustomPlatformData.cpp from
+            # platform/graphics/mac, included by regex above, instead.
+            '../platform/graphics/chromium/FontCustomPlatformData.cpp',
+
+            # The Mac currently uses ScrollbarThemeMac.mm, included by regex
+            # above, instead of ScrollbarThemeChromium.cpp.
+            '../platform/chromium/ScrollbarThemeChromium.cpp',
+
+            # The Mac uses ImageSourceCG.cpp from platform/graphics/cg, included
+            # by regex above, instead.
+            '../platform/graphics/ImageSource.cpp',
+
+            # These Skia files aren't currently built on the Mac, which uses
+            # CoreGraphics directly for this portion of graphics handling.
+            '../platform/graphics/skia/FloatPointSkia.cpp',
+            '../platform/graphics/skia/FloatRectSkia.cpp',
+            '../platform/graphics/skia/GradientSkia.cpp',
+            '../platform/graphics/skia/GraphicsContextSkia.cpp',
+            '../platform/graphics/skia/ImageBufferSkia.cpp',
+            '../platform/graphics/skia/ImageSkia.cpp',
+            '../platform/graphics/skia/ImageSourceSkia.cpp',
+            '../platform/graphics/skia/IntPointSkia.cpp',
+            '../platform/graphics/skia/IntRectSkia.cpp',
+            '../platform/graphics/skia/PathSkia.cpp',
+            '../platform/graphics/skia/PatternSkia.cpp',
+            '../platform/graphics/skia/TransformationMatrixSkia.cpp',
+
+            # RenderThemeChromiumSkia is not used on mac since RenderThemeChromiumMac
+            # does not reference the Skia code that is used by Windows and Linux.
+            '../rendering/RenderThemeChromiumSkia.cpp',
+
+            # Skia image-decoders are also not used on mac.  CoreGraphics
+            # is used directly instead.
+            '../platform/image-decoders/ImageDecoder.h',
+            '../platform/image-decoders/bmp/BMPImageDecoder.cpp',
+            '../platform/image-decoders/bmp/BMPImageDecoder.h',
+            '../platform/image-decoders/bmp/BMPImageReader.cpp',
+            '../platform/image-decoders/bmp/BMPImageReader.h',
+            '../platform/image-decoders/gif/GIFImageDecoder.cpp',
+            '../platform/image-decoders/gif/GIFImageDecoder.h',
+            '../platform/image-decoders/gif/GIFImageReader.cpp',
+            '../platform/image-decoders/gif/GIFImageReader.h',
+            '../platform/image-decoders/ico/ICOImageDecoder.cpp',
+            '../platform/image-decoders/ico/ICOImageDecoder.h',
+            '../platform/image-decoders/jpeg/JPEGImageDecoder.cpp',
+            '../platform/image-decoders/jpeg/JPEGImageDecoder.h',
+            '../platform/image-decoders/png/PNGImageDecoder.cpp',
+            '../platform/image-decoders/png/PNGImageDecoder.h',
+            '../platform/image-decoders/skia/ImageDecoderSkia.cpp',
+            '../platform/image-decoders/xbm/XBMImageDecoder.cpp',
+            '../platform/image-decoders/xbm/XBMImageDecoder.h',
+          ],
+          'link_settings': {
+            'libraries': [
+              '../../WebKitLibraries/libWebKitSystemInterfaceLeopard.a',
+            ],
+          },
+          'direct_dependent_settings': {
+            'include_dirs': [
+              '../../WebKitLibraries',
+              '../../WebKit/mac/WebCoreSupport',
+            ],
+          },
+        }],
+        ['OS=="win"', {
+          'dependencies': ['<(chromium_src_dir)/build/win/system.gyp:cygwin'],
+          'sources/': [
+            ['exclude', 'Posix\\.cpp$'],
+            ['include', '/opentype/'],
+            ['include', '/TransparencyWin\\.cpp$'],
+            ['include', '/SkiaFontWin\\.cpp$'],
+          ],
+          'defines': [
+            # Match Safari and Mozilla on Windows.
+            'WEBCORE_NAVIGATOR_PLATFORM="Win32"',
+            '__PRETTY_FUNCTION__=__FUNCTION__',
+          ],
+          # This is needed because Event.h in this directory is blocked
+          # by a system header on windows.
+          'include_dirs++': ['../dom'],
+          'direct_dependent_settings': {
+            'include_dirs+++': ['../dom'],
+          },
+        }],
+        ['OS!="linux" and OS!="freebsd"', {'sources/': [['exclude', '(Gtk|Linux)\\.cpp$']]}],
+        ['OS!="mac"', {'sources/': [['exclude', 'Mac\\.(cpp|mm?)$']]}],
+        ['OS!="win"', {
+          'sources/': [
+            ['exclude', 'Win\\.cpp$'],
+            ['exclude', '/(Windows|Uniscribe)[^/]*\\.cpp$']
+          ],
+        }],
+        ['OS!="win" and remove_webcore_debug_symbols==1', {
+          'configurations': {
+            'Debug': {
+              'cflags!': ['-g'],
+            }
+          },
+        }],
+      ],
+    },
+  ], # targets
+}
diff --git a/WebCore/WebCore.gypi b/WebCore/WebCore.gypi
index 8738e15..a8cfeb9 100644
--- a/WebCore/WebCore.gypi
+++ b/WebCore/WebCore.gypi
@@ -31,6 +31,7 @@
             'css/WebKitCSSMatrix.idl',
             'css/WebKitCSSTransformValue.idl',
             'dom/Attr.idl',
+            'dom/BeforeLoadEvent.idl',
             'dom/CDATASection.idl',
             'dom/CharacterData.idl',
             'dom/ClientRect.idl',
@@ -64,6 +65,7 @@
             'dom/NodeList.idl',
             'dom/Notation.idl',
             'dom/OverflowEvent.idl',
+            'dom/PageTransitionEvent.idl',
             'dom/ProcessingInstruction.idl',
             'dom/ProgressEvent.idl',
             'dom/Range.idl',
@@ -75,10 +77,27 @@
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
+            'html/canvas/CanvasArray.idl',
+            'html/canvas/CanvasArrayBuffer.idl',
+            'html/canvas/CanvasBuffer.idl',
+            'html/canvas/CanvasByteArray.idl',
+            'html/canvas/CanvasFloatArray.idl',
+            'html/canvas/CanvasFramebuffer.idl',
             'html/canvas/CanvasGradient.idl',
+            'html/canvas/CanvasIntArray.idl',
             'html/canvas/CanvasPattern.idl',
             'html/canvas/CanvasPixelArray.idl',
+            'html/canvas/CanvasProgram.idl',
+            'html/canvas/CanvasRenderbuffer.idl',
+            'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
+            'html/canvas/CanvasRenderingContext3D.idl',
+            'html/canvas/CanvasShader.idl',
+            'html/canvas/CanvasShortArray.idl',
+            'html/canvas/CanvasUnsignedByteArray.idl',
+            'html/canvas/CanvasUnsignedIntArray.idl',
+            'html/canvas/CanvasUnsignedShortArray.idl',
+            'html/canvas/CanvasTexture.idl',
             'html/DataGridColumn.idl',
             'html/DataGridColumnList.idl',
             'html/File.idl',
@@ -100,6 +119,7 @@
             'html/HTMLDataGridColElement.idl',
             'html/HTMLDataGridElement.idl',
             'html/HTMLDataGridRowElement.idl',
+            'html/HTMLDataListElement.idl',
             'html/HTMLDirectoryElement.idl',
             'html/HTMLDivElement.idl',
             'html/HTMLDocument.idl',
@@ -160,6 +180,8 @@
             'inspector/InspectorBackend.idl',
             'inspector/JavaScriptCallFrame.idl',
             'loader/appcache/DOMApplicationCache.idl',
+            'notifications/Notification.idl',
+            'notifications/NotificationCenter.idl',
             'page/AbstractView.idl',
             'page/BarInfo.idl',
             'page/Console.idl',
@@ -212,7 +234,6 @@
             'svg/SVGColor.idl',
             'svg/SVGComponentTransferFunctionElement.idl',
             'svg/SVGCursorElement.idl',
-            'svg/SVGDefinitionSrcElement.idl',
             'svg/SVGDefsElement.idl',
             'svg/SVGDescElement.idl',
             'svg/SVGDocument.idl',
@@ -332,6 +353,7 @@
             'svg/SVGViewSpec.idl',
             'svg/SVGZoomAndPan.idl',
             'svg/SVGZoomEvent.idl',
+            'websockets/WebSocket.idl',
             'workers/AbstractWorker.idl',
             'workers/DedicatedWorkerContext.idl',
             'workers/SharedWorker.idl',
@@ -369,6 +391,8 @@
             'accessibility/AccessibilityListBox.h',
             'accessibility/AccessibilityListBoxOption.cpp',
             'accessibility/AccessibilityListBoxOption.h',
+            'accessibility/AccessibilityMediaControls.cpp',
+            'accessibility/AccessibilityMediaControls.h',
             'accessibility/AccessibilityObject.cpp',
             'accessibility/AccessibilityObject.h',
             'accessibility/AccessibilityRenderObject.cpp',
@@ -405,15 +429,19 @@
             'bindings/js/DOMObjectWithSVGContext.h',
             'bindings/js/GCController.cpp',
             'bindings/js/GCController.h',
+            'bindings/js/JSCallbackData.cpp',
+            'bindings/js/JSCallbackData.h',
             'bindings/js/JSAttrCustom.cpp',
             'bindings/js/JSAudioConstructor.cpp',
             'bindings/js/JSAudioConstructor.h',
+            'bindings/js/JSCanvasRenderingContextCustom.cpp',
             'bindings/js/JSCanvasRenderingContext2DCustom.cpp',
             'bindings/js/JSCDATASectionCustom.cpp',
             'bindings/js/JSClipboardCustom.cpp',
             'bindings/js/JSConsoleCustom.cpp',
             'bindings/js/JSCoordinatesCustom.cpp',
             'bindings/js/JSCSSRuleCustom.cpp',
+            'bindings/js/JSCSSRuleListCustom.cpp',
             'bindings/js/JSCSSStyleDeclarationCustom.cpp',
             'bindings/js/JSCSSStyleDeclarationCustom.h',
             'bindings/js/JSCSSValueCustom.cpp',
@@ -464,6 +492,7 @@
             'bindings/js/JSHTMLAllCollection.h',
             'bindings/js/JSHTMLAppletElementCustom.cpp',
             'bindings/js/JSHTMLAppletElementCustom.h',
+            'bindings/js/JSHTMLCanvasElementCustom.cpp',
             'bindings/js/JSHTMLCollectionCustom.cpp',
             'bindings/js/JSHTMLDataGridElementCustom.cpp',
             'bindings/js/JSHTMLDocumentCustom.cpp',
@@ -497,7 +526,9 @@
             'bindings/js/JSMessageChannelConstructor.cpp',
             'bindings/js/JSMessageChannelConstructor.h',
             'bindings/js/JSMessageChannelCustom.cpp',
+            'bindings/js/JSMessageEventCustom.cpp',
             'bindings/js/JSMessagePortCustom.cpp',
+            'bindings/js/JSMessagePortCustom.h',
             'bindings/js/JSMimeTypeArrayCustom.cpp',
             'bindings/js/JSNamedNodeMapCustom.cpp',
             'bindings/js/JSNamedNodesCollection.cpp',
@@ -521,7 +552,6 @@
             'bindings/js/JSRGBColor.h',
             'bindings/js/JSSharedWorkerConstructor.cpp',
             'bindings/js/JSSharedWorkerConstructor.h',
-            'bindings/js/JSSharedWorkerContextCustom.cpp',
             'bindings/js/JSSharedWorkerCustom.cpp',
             'bindings/js/JSSQLResultSetRowListCustom.cpp',
             'bindings/js/JSSQLTransactionCustom.cpp',
@@ -543,6 +573,9 @@
             'bindings/js/JSWebKitCSSMatrixConstructor.h',
             'bindings/js/JSWebKitPointConstructor.cpp',
             'bindings/js/JSWebKitPointConstructor.h',
+            'bindings/js/JSWebSocketConstructor.cpp',
+            'bindings/js/JSWebSocketConsuructor.h',
+            'bindings/js/JSWebSocketCustom.cpp',
             'bindings/js/JSWorkerConstructor.cpp',
             'bindings/js/JSWorkerConstructor.h',
             'bindings/js/JSWorkerContextBase.cpp',
@@ -597,7 +630,17 @@
             'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
             'bindings/v8/custom/V8AttrCustom.cpp',
             'bindings/v8/custom/V8CanvasPixelArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasArrayCustom.h',
+            'bindings/v8/custom/V8CanvasArrayBufferCustom.cpp',
+            'bindings/v8/custom/V8CanvasByteArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasIntArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasFloatArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasShortArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp',
             'bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp',
+            'bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp',
             'bindings/v8/custom/V8ClientRectListCustom.cpp',
             'bindings/v8/custom/V8ClipboardCustom.cpp',
             'bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp',
@@ -627,7 +670,9 @@
             'bindings/v8/custom/V8DocumentCustom.cpp',
             'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
+            'bindings/v8/custom/V8FileListCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
             'bindings/v8/custom/V8HTMLCanvasElementCustom.cpp',
             'bindings/v8/custom/V8HTMLCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLDataGridElementCustom.cpp',
@@ -637,8 +682,10 @@
             'bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp',
             'bindings/v8/custom/V8HTMLIFrameElementCustom.cpp',
             'bindings/v8/custom/V8HTMLImageElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLImageElementConstructor.h',
             'bindings/v8/custom/V8HTMLInputElementCustom.cpp',
             'bindings/v8/custom/V8HTMLOptionElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLOptionElementConstructor.h',
             'bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLPlugInElementCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp',
@@ -647,7 +694,9 @@
             'bindings/v8/custom/V8InspectorBackendCustom.cpp',
             'bindings/v8/custom/V8LocationCustom.cpp',
             'bindings/v8/custom/V8MessageChannelConstructor.cpp',
+            'bindings/v8/custom/V8MessageEventCustom.cpp',
             'bindings/v8/custom/V8MessagePortCustom.cpp',
+            'bindings/v8/custom/V8MessagePortCustom.h',
             'bindings/v8/custom/V8NamedNodeMapCustom.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.h',
@@ -656,6 +705,7 @@
             'bindings/v8/custom/V8NodeFilterCustom.cpp',
             'bindings/v8/custom/V8NodeIteratorCustom.cpp',
             'bindings/v8/custom/V8NodeListCustom.cpp',
+            'bindings/v8/custom/V8NotificationCenterCustom.cpp',
             'bindings/v8/custom/V8StorageCustom.cpp',
             'bindings/v8/custom/V8SQLResultSetRowListCustom.cpp',
             'bindings/v8/custom/V8SQLTransactionCustom.cpp',
@@ -667,6 +717,7 @@
             'bindings/v8/custom/V8TreeWalkerCustom.cpp',
             'bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp',
             'bindings/v8/custom/V8WebKitPointConstructor.cpp',
+            'bindings/v8/custom/V8WebSocketCustom.cpp',
             'bindings/v8/custom/V8WorkerContextCustom.cpp',
             'bindings/v8/custom/V8WorkerCustom.cpp',
             'bindings/v8/custom/V8XMLHttpRequestConstructor.cpp',
@@ -675,6 +726,8 @@
             'bindings/v8/custom/V8XMLSerializerConstructor.cpp',
             'bindings/v8/custom/V8XPathEvaluatorConstructor.cpp',
             'bindings/v8/custom/V8XSLTProcessorCustom.cpp',
+            'bindings/v8/DateExtension.cpp',
+            'bindings/v8/DateExtension.h',
             'bindings/v8/DOMData.cpp',
             'bindings/v8/DOMData.h',
             'bindings/v8/DOMDataStore.cpp',
@@ -716,6 +769,7 @@
             'bindings/v8/ScriptString.h',
             'bindings/v8/ScriptValue.cpp',
             'bindings/v8/ScriptValue.h',
+            'bindings/v8/SerializedScriptValue.h',
             'bindings/v8/StaticDOMDataStore.cpp',
             'bindings/v8/StaticDOMDataStore.h',
             'bindings/v8/V8AbstractEventListener.cpp',
@@ -752,8 +806,6 @@
             'bindings/v8/V8NPUtils.h',
             'bindings/v8/V8NodeFilterCondition.cpp',
             'bindings/v8/V8NodeFilterCondition.h',
-            'bindings/v8/V8ObjectEventListener.cpp',
-            'bindings/v8/V8ObjectEventListener.h',
             'bindings/v8/V8Proxy.cpp',
             'bindings/v8/V8Proxy.h',
             'bindings/v8/V8SVGPODTypeWrapper.h',
@@ -761,8 +813,6 @@
             'bindings/v8/V8Utilities.h',
             'bindings/v8/V8WorkerContextEventListener.cpp',
             'bindings/v8/V8WorkerContextEventListener.h',
-            'bindings/v8/V8WorkerContextObjectEventListener.cpp',
-            'bindings/v8/V8WorkerContextObjectEventListener.h',
             'bindings/v8/WorkerContextExecutionProxy.h',
             'bindings/v8/WorkerContextExecutionProxy.cpp',
             'bindings/v8/WorkerScriptController.h',
@@ -914,6 +964,7 @@
             'dom/Attribute.h',
             'dom/BeforeTextInsertedEvent.cpp',
             'dom/BeforeTextInsertedEvent.h',
+            'dom/BeforeLoadEvent.h',
             'dom/BeforeUnloadEvent.cpp',
             'dom/BeforeUnloadEvent.h',
             'dom/CDATASection.cpp',
@@ -947,7 +998,6 @@
             'dom/DOMCoreException.h',
             'dom/DOMImplementation.cpp',
             'dom/DOMImplementation.h',
-            'dom/DocPtr.h',
             'dom/Document.cpp',
             'dom/Document.h',
             'dom/DocumentFragment.cpp',
@@ -1028,6 +1078,8 @@
             'dom/OptionGroupElement.h',
             'dom/OverflowEvent.cpp',
             'dom/OverflowEvent.h',
+            'dom/PageTransitionEvent.cpp',
+            'dom/PageTransitionEvent.h',
             'dom/Position.cpp',
             'dom/Position.h',
             'dom/PositionIterator.cpp',
@@ -1067,6 +1119,8 @@
             'dom/TextEvent.cpp',
             'dom/TextEvent.h',
             'dom/Tokenizer.h',
+            'dom/TransformSourceLibxslt.cpp',
+            'dom/TransformSource.h',
             'dom/Traversal.cpp',
             'dom/Traversal.h',
             'dom/TreeWalker.cpp',
@@ -1204,16 +1258,52 @@
             'history/HistoryItem.h',
             'history/PageCache.cpp',
             'history/PageCache.h',
+            'html/canvas/CanvasArray.cpp',
+            'html/canvas/CanvasArray.h',
+            'html/canvas/CanvasArrayBuffer.cpp',
+            'html/canvas/CanvasArrayBuffer.h',
+            'html/canvas/CanvasBuffer.cpp',
+            'html/canvas/CanvasBuffer.h',
+            'html/canvas/CanvasByteArray.cpp',
+            'html/canvas/CanvasByteArray.h',
+            'html/canvas/CanvasFloatArray.cpp',
+            'html/canvas/CanvasFloatArray.h',
+            'html/canvas/CanvasFramebuffer.cpp',
+            'html/canvas/CanvasFramebuffer.h',
             'html/canvas/CanvasGradient.cpp',
             'html/canvas/CanvasGradient.h',
+            'html/canvas/CanvasIntArray.cpp',
+            'html/canvas/CanvasIntArray.h',
+            'html/canvas/CanvasObject.cpp',
+            'html/canvas/CanvasObject.h',
             'html/canvas/CanvasPattern.cpp',
             'html/canvas/CanvasPattern.h',
             'html/canvas/CanvasPixelArray.cpp',
             'html/canvas/CanvasPixelArray.h',
+            'html/canvas/CanvasProgram.cpp',
+            'html/canvas/CanvasProgram.h',
+            'html/canvas/CanvasRenderbuffer.cpp',
+            'html/canvas/CanvasRenderbuffer.h',
+            'html/canvas/CanvasRenderingContext.cpp',
+            'html/canvas/CanvasRenderingContext.h',
             'html/canvas/CanvasRenderingContext2D.cpp',
             'html/canvas/CanvasRenderingContext2D.h',
+            'html/canvas/CanvasRenderingContext3D.cpp',
+            'html/canvas/CanvasRenderingContext3D.h',
+            'html/canvas/CanvasShader.cpp',
+            'html/canvas/CanvasShader.h',
+            'html/canvas/CanvasShortArray.cpp',
+            'html/canvas/CanvasShortArray.h',
             'html/canvas/CanvasStyle.cpp',
             'html/canvas/CanvasStyle.h',
+            'html/canvas/CanvasTexture.cpp',
+            'html/canvas/CanvasTexture.h',
+            'html/canvas/CanvasUnsignedByteArray.cpp',
+            'html/canvas/CanvasUnsignedByteArray.h',
+            'html/canvas/CanvasUnsignedIntArray.cpp',
+            'html/canvas/CanvasUnsignedIntArray.h',
+            'html/canvas/CanvasUnsignedShortArray.cpp',
+            'html/canvas/CanvasUnsignedShortArray.h',
             'html/CollectionCache.cpp',
             'html/CollectionCache.h',
             'html/CollectionType.h',
@@ -1263,6 +1353,8 @@
             'html/HTMLDataGridElement.h',
             'html/HTMLDataGridRowElement.cpp',
             'html/HTMLDataGridRowElement.h',
+            'html/HTMLDataListElement.cpp',
+            'html/HTMLDataListElement.h',
             'html/HTMLDirectoryElement.cpp',
             'html/HTMLDirectoryElement.h',
             'html/HTMLDivElement.cpp',
@@ -1409,6 +1501,8 @@
             'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
+            'inspector/DOMDispatchTimelineItem.cpp',
+            'inspector/DOMDispatchTimelineItem.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
             'inspector/InspectorController.cpp',
@@ -1423,6 +1517,8 @@
             'inspector/InspectorFrontend.h',
             'inspector/InspectorResource.cpp',
             'inspector/InspectorResource.h',
+            'inspector/InspectorTimelineAgent.cpp',
+            'inspector/InspectorTimelineAgent.h',
             'inspector/JavaScriptCallFrame.cpp',
             'inspector/JavaScriptCallFrame.h',
             'inspector/JavaScriptDebugListener.h',
@@ -1432,6 +1528,8 @@
             'inspector/JavaScriptProfile.h',
             'inspector/JavaScriptProfileNode.cpp',
             'inspector/JavaScriptProfileNode.h',
+            'inspector/TimelineItem.cpp',
+            'inspector/TimelineItem.h',
             'loader/appcache/ApplicationCache.cpp',
             'loader/appcache/ApplicationCache.h',
             'loader/appcache/ApplicationCacheGroup.cpp',
@@ -1533,8 +1631,14 @@
             'loader/PlaceholderDocument.h',
             'loader/PluginDocument.cpp',
             'loader/PluginDocument.h',
+            'loader/PolicyCallback.cpp',
+            'loader/PolicyCallback.h',
+            'loader/PolicyChecker.cpp',
+            'loader/PolicyChecker.h',
             'loader/ProgressTracker.cpp',
             'loader/ProgressTracker.h',
+            'loader/RedirectScheduler.cpp',
+            'loader/RedirectScheduler.h',
             'loader/Request.cpp',
             'loader/Request.h',
             'loader/ResourceLoader.cpp',
@@ -1552,12 +1656,16 @@
             'loader/ThreadableLoader.h',
             'loader/ThreadableLoaderClient.h',
             'loader/ThreadableLoaderClientWrapper.h',
-            'loader/UserStyleSheetLoader.cpp',
-            'loader/UserStyleSheetLoader.h',
             'loader/WorkerThreadableLoader.cpp',
             'loader/WorkerThreadableLoader.h',
             'loader/loader.cpp',
             'loader/loader.h',
+            'notifications/Notification.cpp',
+            'notifications/Notification.h',
+            'notifications/NotificationCenter.cpp',
+            'notifications/NotificationCenter.h',
+            'notifications/NotificationPresenter.h',
+            'notifications/NotificationContents.h',
             'page/animation/AnimationBase.cpp',
             'page/animation/AnimationBase.h',
             'page/animation/AnimationController.cpp',
@@ -1610,7 +1718,6 @@
             'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
             'page/ContextMenuController.h',
-            'page/Coordinates.cpp',
             'page/DOMSelection.cpp',
             'page/DOMSelection.h',
             'page/DOMTimer.cpp',
@@ -1636,8 +1743,8 @@
             'page/FrameView.h',
             'page/Geolocation.cpp',
             'page/Geolocation.h',
-            'page/Geoposition.cpp',
             'page/Geoposition.h',
+            'page/HaltablePlugin.h',
             'page/History.cpp',
             'page/History.h',
             'page/Location.cpp',
@@ -1648,12 +1755,17 @@
             'page/Navigator.h',
             'page/NavigatorBase.cpp',
             'page/NavigatorBase.h',
+            'page/OriginAccessEntry.cpp',
+            'page/OriginAccessEntry.h',
             'page/Page.cpp',
             'page/Page.h',
             'page/PageGroup.cpp',
             'page/PageGroup.h',
             'page/PageGroupLoadDeferrer.cpp',
             'page/PageGroupLoadDeferrer.h',
+            'page/PluginHalter.cpp',
+            'page/PluginHalter.h',
+            'page/PluginHalterClient.h',
             'page/PositionCallback.h',
             'page/PositionError.h',
             'page/PositionErrorCallback.h',
@@ -1667,6 +1779,12 @@
             'page/SecurityOriginHash.h',
             'page/Settings.cpp',
             'page/Settings.h',
+            'page/UserContentURLPattern.cpp',
+            'page/UserContentURLPattern.h',
+            'page/UserScript.h',
+            'page/UserScriptTypes.h',
+            'page/UserStyleSheet.h',
+            'page/UserStyleSheetTypes.h',
             'page/WebKitPoint.h',
             'page/WindowFeatures.cpp',
             'page/WindowFeatures.h',
@@ -1737,6 +1855,8 @@
             'platform/chromium/SuddenTerminationChromium.cpp',
             'platform/chromium/SystemTimeChromium.cpp',
             'platform/chromium/TemporaryLinkStubs.cpp',
+            'platform/chromium/ThemeChromiumMac.h',
+            'platform/chromium/ThemeChromiumMac.mm',
             'platform/chromium/WidgetChromium.cpp',
             'platform/chromium/WindowsVersion.cpp',
             'platform/chromium/WindowsVersion.h',
@@ -1748,7 +1868,6 @@
             'platform/graphics/cairo/ImageBufferCairo.cpp',
             'platform/graphics/cairo/ImageBufferData.h',
             'platform/graphics/cairo/ImageCairo.cpp',
-            'platform/graphics/cairo/ImageSourceCairo.cpp',
             'platform/graphics/cairo/PathCairo.cpp',
             'platform/graphics/cairo/PatternCairo.cpp',
             'platform/graphics/cairo/TransformationMatrixCairo.cpp',
@@ -1912,8 +2031,6 @@
             'platform/graphics/skia/GraphicsContextSkia.cpp',
             'platform/graphics/skia/ImageBufferSkia.cpp',
             'platform/graphics/skia/ImageSkia.cpp',
-            'platform/graphics/skia/ImageSourceSkia.cpp',
-            'platform/graphics/skia/ImageSourceSkia.h',
             'platform/graphics/skia/IntPointSkia.cpp',
             'platform/graphics/skia/IntRectSkia.cpp',
             'platform/graphics/skia/NativeImageSkia.cpp',
@@ -1996,7 +2113,6 @@
             'platform/graphics/wx/GraphicsContextWx.cpp',
             'platform/graphics/wx/ImageBufferData.h',
             'platform/graphics/wx/ImageBufferWx.cpp',
-            'platform/graphics/wx/ImageSourceWx.cpp',
             'platform/graphics/wx/ImageWx.cpp',
             'platform/graphics/wx/IntPointWx.cpp',
             'platform/graphics/wx/IntRectWx.cpp',
@@ -2034,6 +2150,7 @@
             'platform/graphics/FontFastPath.cpp',
             'platform/graphics/FontRenderingMode.h',
             'platform/graphics/FontSelector.h',
+            'platform/graphics/FontSmoothingMode.h',
             'platform/graphics/FontTraitsMask.h',
             'platform/graphics/GeneratedImage.cpp',
             'platform/graphics/GeneratedImage.h',
@@ -2047,6 +2164,7 @@
             'platform/graphics/Gradient.h',
             'platform/graphics/GraphicsContext.cpp',
             'platform/graphics/GraphicsContext.h',
+            'platform/graphics/GraphicsContext3D.h',
             'platform/graphics/GraphicsContextPrivate.h',
             'platform/graphics/GraphicsLayer.cpp',
             'platform/graphics/GraphicsLayer.h',
@@ -2060,6 +2178,7 @@
             'platform/graphics/ImageBuffer.h',
             'platform/graphics/ImageObserver.h',
             'platform/graphics/ImageSource.h',
+            'platform/graphics/ImageSource.cpp',
             'platform/graphics/IntPoint.h',
             'platform/graphics/IntRect.cpp',
             'platform/graphics/IntRect.h',
@@ -2129,20 +2248,25 @@
             'platform/gtk/gtkdrawing.h',
             'platform/gtk/guriescape.h',
             'platform/image-decoders/ImageDecoder.h',
+            'platform/image-decoders/ImageDecoder.cpp',
             'platform/image-decoders/bmp/BMPImageDecoder.cpp',
             'platform/image-decoders/bmp/BMPImageDecoder.h',
             'platform/image-decoders/bmp/BMPImageReader.cpp',
             'platform/image-decoders/bmp/BMPImageReader.h',
+            'platform/image-decoders/cairo/ImageDecoderCairo.cpp',
             'platform/image-decoders/gif/GIFImageDecoder.cpp',
             'platform/image-decoders/gif/GIFImageDecoder.h',
             'platform/image-decoders/gif/GIFImageReader.cpp',
             'platform/image-decoders/gif/GIFImageReader.h',
+            'platform/image-decoders/haiku/ImageDecoderHaiku.cpp',
             'platform/image-decoders/ico/ICOImageDecoder.cpp',
             'platform/image-decoders/ico/ICOImageDecoder.h',
             'platform/image-decoders/jpeg/JPEGImageDecoder.cpp',
             'platform/image-decoders/jpeg/JPEGImageDecoder.h',
             'platform/image-decoders/png/PNGImageDecoder.cpp',
             'platform/image-decoders/png/PNGImageDecoder.h',
+            'platform/image-decoders/skia/ImageDecoderSkia.cpp',
+            'platform/image-decoders/wx/ImageDecoderWx.cpp',
             'platform/image-decoders/xbm/XBMImageDecoder.cpp',
             'platform/image-decoders/xbm/XBMImageDecoder.h',
             'platform/image-decoders/zlib/crc32.h',
@@ -2156,7 +2280,6 @@
             'platform/image-decoders/zlib/zconf.h',
             'platform/image-decoders/zlib/zlib.h',
             'platform/image-decoders/zlib/zutil.h',
-            'platform/image-decoders/skia/ImageDecoderSkia.cpp',
             'platform/image-encoders/skia/PNGImageEncoder.cpp',
             'platform/image-encoders/skia/PNGImageEncoder.h',
             'platform/mac/AutodrainedPool.mm',
@@ -2231,6 +2354,9 @@
             'platform/network/cf/ResourceResponse.h',
             'platform/network/cf/ResourceResponseCFNet.cpp',
             'platform/network/cf/ResourceResponseCFNet.h',
+            'platform/network/cf/SocketStreamError.h',
+            'platform/network/cf/SocketStreamHandle.h',
+            'platform/network/cf/SocketStreamHandleCFNet.cpp',
             'platform/network/chromium/AuthenticationChallenge.h',
             'platform/network/chromium/AuthenticationChallengeChromium.cpp',
             'platform/network/chromium/CookieJarChromium.cpp',
@@ -2240,6 +2366,8 @@
             'platform/network/chromium/ResourceError.h',
             'platform/network/chromium/ResourceRequest.h',
             'platform/network/chromium/ResourceResponse.h',
+            'platform/network/chromium/SocketStreamError.h',
+            'platform/network/chromium/SocketStreamHandle.h',
             'platform/network/curl/AuthenticationChallenge.h',
             'platform/network/curl/CookieJarCurl.cpp',
             'platform/network/curl/DNSCurl.cpp',
@@ -2282,6 +2410,9 @@
             'platform/network/soup/ResourceHandleSoup.cpp',
             'platform/network/soup/ResourceRequest.h',
             'platform/network/soup/ResourceResponse.h',
+            'platform/network/soup/SocketStreamError.h',
+            'platform/network/soup/SocketStreamHandle.h',
+            'platform/network/soup/SocketStreamHandleSoup.cpp',
             'platform/network/soup/webkit-soup-auth-dialog.c',
             'platform/network/soup/webkit-soup-auth-dialog.h',
             'platform/network/win/CookieJarCFNetWin.cpp',
@@ -2316,6 +2447,11 @@
             'platform/network/ResourceRequestBase.h',
             'platform/network/ResourceResponseBase.cpp',
             'platform/network/ResourceResponseBase.h',
+            'platform/network/SocketStreamErrorBase.cpp',
+            'platform/network/SocketStreamErrorBase.h',
+            'platform/network/SocketStreamHandleBase.cpp',
+            'platform/network/SocketStreamHandleBase.h',
+            'platform/network/SocketStreamHandleClient.h',
             'platform/posix/FileSystemPOSIX.cpp',
             'platform/qt/ClipboardQt.cpp',
             'platform/qt/ClipboardQt.h',
@@ -2367,8 +2503,7 @@
             'platform/sql/SQLiteTransaction.cpp',
             'platform/sql/SQLiteTransaction.h',
             'platform/sql/chromium/SQLiteFileSystemChromium.cpp',
-            'platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp',
-            'platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp',
+            'platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp',
             'platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp',
             'platform/symbian/FloatPointSymbian.cpp',
             'platform/symbian/FloatRectSymbian.cpp',
@@ -2541,6 +2676,7 @@
             'platform/ContextMenu.cpp',
             'platform/ContextMenu.h',
             'platform/ContextMenuItem.h',
+            'platform/Cookie.h',
             'platform/CookieJar.h',
             'platform/CrossThreadCopier.h',
             'platform/CrossThreadCopier.cpp',
@@ -2578,6 +2714,8 @@
             'platform/Logging.h',
             'platform/MIMETypeRegistry.cpp',
             'platform/MIMETypeRegistry.h',
+            'platform/mock/GeolocationServiceMock.cpp',
+            'platform/mock/GeolocationServiceMock.h',
             'platform/NotImplemented.h',
             'platform/Pasteboard.h',
             'platform/PlatformKeyboardEvent.h',
@@ -2807,6 +2945,8 @@
             'rendering/RenderMarquee.h',
             'rendering/RenderMedia.cpp',
             'rendering/RenderMedia.h',
+            'rendering/RenderMediaControlsChromium.cpp',
+            'rendering/RenderMediaControlsChromium.h',
             'rendering/RenderMenuList.cpp',
             'rendering/RenderMenuList.h',
             'rendering/RenderObject.cpp',
@@ -2963,6 +3103,10 @@
             'storage/SQLTransaction.cpp',
             'storage/SQLTransaction.h',
             'storage/SQLTransactionCallback.h',
+            'storage/SQLTransactionClient.h',
+            'storage/SQLTransactionClient.cpp',
+            'storage/SQLTransactionCoordinator.h',
+            'storage/SQLTransactionCoordinator.cpp',
             'storage/SQLTransactionErrorCallback.h',
             'storage/Storage.cpp',
             'storage/Storage.h',
@@ -2973,6 +3117,8 @@
             'storage/StorageAreaSync.h',
             'storage/StorageEvent.cpp',
             'storage/StorageEvent.h',
+            'storage/StorageEventDispatcher.cpp',
+            'storage/StorageEventDispatcher.h',
             'storage/StorageMap.cpp',
             'storage/StorageMap.h',
             'storage/StorageNamespace.cpp',
@@ -3089,8 +3235,6 @@
             'svg/SVGComponentTransferFunctionElement.h',
             'svg/SVGCursorElement.cpp',
             'svg/SVGCursorElement.h',
-            'svg/SVGDefinitionSrcElement.cpp',
-            'svg/SVGDefinitionSrcElement.h',
             'svg/SVGDefsElement.cpp',
             'svg/SVGDefsElement.h',
             'svg/SVGDescElement.cpp',
@@ -3326,6 +3470,13 @@
             'svg/SVGZoomEvent.cpp',
             'svg/SVGZoomEvent.h',
             'svg/SynchronizableTypeWrapper.h',
+            'websockets/WebSocket.cpp',
+            'websockets/WebSocket.h',
+            'websockets/WebSocketChannel.cpp',
+            'websockets/WebSocketChannel.h',
+            'websockets/WebSocketChannelClient.h',
+            'websockets/WebSocketHandshake.cpp',
+            'websockets/WebSocketHandshake.h',
             'workers/AbstractWorker.cpp',
             'workers/AbstractWorker.h',
             'workers/DedicatedWorkerContext.cpp',
@@ -3353,6 +3504,7 @@
             'workers/WorkerMessagingProxy.cpp',
             'workers/WorkerMessagingProxy.h',
             'workers/WorkerObjectProxy.h',
+            'workers/WorkerReportingProxy.h',
             'workers/WorkerRunLoop.cpp',
             'workers/WorkerRunLoop.h',
             'workers/WorkerScriptLoader.cpp',
@@ -3405,11 +3557,12 @@
             'xml/XPathVariableReference.h',
             'xml/XSLImportRule.cpp',
             'xml/XSLImportRule.h',
-            'xml/XSLStyleSheet.cpp',
+            'xml/XSLStyleSheetLibxslt.cpp',
             'xml/XSLStyleSheet.h',
             'xml/XSLTExtensions.cpp',
             'xml/XSLTExtensions.h',
             'xml/XSLTProcessor.cpp',
+            'xml/XSLTProcessorLibxslt.cpp',
             'xml/XSLTProcessor.h',
             'xml/XSLTUnicodeSort.cpp',
             'xml/XSLTUnicodeSort.h',
@@ -3425,9 +3578,9 @@
             'inspector/front-end/ChangesView.js',
             'inspector/front-end/Color.js',
             'inspector/front-end/ConsoleView.js',
+            'inspector/front-end/CookieItemsView.js',
             'inspector/front-end/Database.js',
             'inspector/front-end/DatabaseQueryView.js',
-            'inspector/front-end/DatabasesPanel.js',
             'inspector/front-end/DatabaseTableView.js',
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DOMAgent.js',
@@ -3437,9 +3590,11 @@
             'inspector/front-end/Drawer.js',
             'inspector/front-end/ElementsPanel.js',
             'inspector/front-end/ElementsTreeOutline.js',
+            'inspector/front-end/EventListenersSidebarPane.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/ImageView.js',
             'inspector/front-end/InjectedScript.js',
+            'inspector/front-end/InjectedScriptAccess.js',
             'inspector/front-end/inspector.js',
             'inspector/front-end/KeyboardShortcut.js',
             'inspector/front-end/MetricsSidebarPane.js',
@@ -3449,6 +3604,7 @@
             'inspector/front-end/Panel.js',
             'inspector/front-end/PanelEnablerView.js',
             'inspector/front-end/Placard.js',
+            'inspector/front-end/Popup.js',
             'inspector/front-end/ProfileDataGridTree.js',
             'inspector/front-end/ProfilesPanel.js',
             'inspector/front-end/ProfileView.js',
@@ -3466,13 +3622,19 @@
             'inspector/front-end/SidebarTreeElement.js',
             'inspector/front-end/SourceFrame.js',
             'inspector/front-end/SourceView.js',
+            'inspector/front-end/StatusBarButton.js',
+            'inspector/front-end/StoragePanel.js',
             'inspector/front-end/StylesSidebarPane.js',
+            'inspector/front-end/SummaryBar.js',
             'inspector/front-end/TextPrompt.js',
+            'inspector/front-end/TimelineAgent.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
             'inspector/front-end/treeoutline.js',
             'inspector/front-end/utilities.js',
             'inspector/front-end/View.js',
+            'inspector/front-end/WatchExpressionsSidebarPane.js',
             'inspector/front-end/inspector.css',
+            'inspector/front-end/inspectorSyntaxHighlight.css',
         ],
         'webinspector_image_files': [
 
@@ -3481,8 +3643,8 @@
             'inspector/front-end/Images/clearConsoleButtonGlyph.png',
             'inspector/front-end/Images/closeButtons.png',
             'inspector/front-end/Images/consoleButtonGlyph.png',
+            'inspector/front-end/Images/cookie.png',
             'inspector/front-end/Images/database.png',
-            'inspector/front-end/Images/databasesIcon.png',
             'inspector/front-end/Images/databaseTable.png',
             'inspector/front-end/Images/debuggerContinue.png',
             'inspector/front-end/Images/debuggerPause.png',
@@ -3499,7 +3661,6 @@
             'inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png',
             'inspector/front-end/Images/disclosureTriangleSmallRightWhite.png',
             'inspector/front-end/Images/dockButtonGlyph.png',
-            'inspector/front-end/Images/domStorage.png',
             'inspector/front-end/Images/elementsIcon.png',
             'inspector/front-end/Images/enableOutlineButtonGlyph.png',
             'inspector/front-end/Images/enableSolidButtonGlyph.png',
@@ -3515,7 +3676,9 @@
             'inspector/front-end/Images/goArrow.png',
             'inspector/front-end/Images/graphLabelCalloutLeft.png',
             'inspector/front-end/Images/graphLabelCalloutRight.png',
+            'inspector/front-end/Images/grayConnectorPoint.png',
             'inspector/front-end/Images/largerResourcesButtonGlyph.png',
+            'inspector/front-end/Images/localStorage.png',
             'inspector/front-end/Images/nodeSearchButtonGlyph.png',
             'inspector/front-end/Images/paneBottomGrow.png',
             'inspector/front-end/Images/paneBottomGrowActive.png',
@@ -3553,6 +3716,7 @@
             'inspector/front-end/Images/segmentHoverEnd.png',
             'inspector/front-end/Images/segmentSelected.png',
             'inspector/front-end/Images/segmentSelectedEnd.png',
+            'inspector/front-end/Images/sessionStorage.png',
             'inspector/front-end/Images/splitviewDimple.png',
             'inspector/front-end/Images/splitviewDividerBackground.png',
             'inspector/front-end/Images/statusbarBackground.png',
@@ -3562,6 +3726,7 @@
             'inspector/front-end/Images/statusbarMenuButtonSelected.png',
             'inspector/front-end/Images/statusbarResizerHorizontal.png',
             'inspector/front-end/Images/statusbarResizerVertical.png',
+            'inspector/front-end/Images/storageIcon.png',
             'inspector/front-end/Images/timelineHollowPillBlue.png',
             'inspector/front-end/Images/timelineHollowPillGray.png',
             'inspector/front-end/Images/timelineHollowPillGreen.png',
@@ -3594,6 +3759,7 @@
             'inspector/front-end/Images/warningIcon.png',
             'inspector/front-end/Images/warningMediumIcon.png',
             'inspector/front-end/Images/warningsErrors.png',
+            'inspector/front-end/Images/whiteConnectorPoint.png'
         ],
     }
 }
diff --git a/WebCore/WebCore.order b/WebCore/WebCore.order
index 31b178c..c1040e2 100644
--- a/WebCore/WebCore.order
+++ b/WebCore/WebCore.order
@@ -334,8 +334,6 @@ __ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
 __ZNK7WebCore9FrameTree12traverseNextEPKNS_5FrameE
 __ZN7WebCore6Widget21releasePlatformWidgetEv
 __ZN7WebCore6Widget20retainPlatformWidgetEv
-__ZN7WebCore9FrameView14initScrollbarsEv
-__ZN7WebCore9FrameView27updateDefaultScrollbarStateEv
 __ZNK7WebCore10ScrollView14scrollbarModesERNS_13ScrollbarModeES2_
 __ZNK7WebCore10ScrollView22platformScrollbarModesERNS_13ScrollbarModeES2_
 __ZN7WebCore10ScrollView17setScrollbarModesENS_13ScrollbarModeES1_
@@ -1267,7 +1265,7 @@ __ZNK7WebCore4KURL11createCFURLEv
 __ZNK7WebCore4KURL12copyToBufferERN3WTF6VectorIcLm512EEE
 __ZNK7WebCore19ResourceRequestBase11cachePolicyEv
 __ZNK7WebCore19ResourceRequestBase15timeoutIntervalEv
-__ZNK7WebCore19ResourceRequestBase16allowHTTPCookiesEv
+__ZNK7WebCore19ResourceRequestBase16allowCookiesEv
 __ZNK7WebCore19ResourceRequestBase16httpHeaderFieldsEv
 __ZNK7WebCore19ResourceRequestBase8httpBodyEv
 __ZN7WebCore21findEventWithKeyStateEPNS_5EventE
@@ -2290,7 +2288,6 @@ __ZN3JSC8Bindings10RootObject9gcProtectEPNS_8JSObjectE
 __ZNK3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTra
 __ZN3WTF7HashMapIPN3JSC8JSObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
 __ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTrai
-__ZN7WebCore19InspectorController34inspectedWindowScriptObjectClearedEPNS_5FrameE
 __ZN7WebCore6StringC1ERKN3JSC7UStringE
 __ZN7WebCore6StringC2ERKN3JSC7UStringE
 __ZNK7WebCore20StringSourceProvider4dataEv
@@ -5760,7 +5757,6 @@ __ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashI
 __ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
 __ZN7WebCore10ScrollView16platformAddChildEPNS_6WidgetE
 __ZN7WebCore16RenderPartObject11viewClearedEv
-__ZN7WebCore9FrameView20setCanHaveScrollbarsEb
 __ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
 __ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE6shrinkEm
@@ -7855,6 +7851,7 @@ __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalida
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
 __ZN7WebCore19InspectorController22inspectedPageDestroyedEv
+__ZN7WebCore19InspectorController25evaluateForTestInFrontendElRKNS_6StringE
 __ZN7WebCore19InspectorController5closeEv
 __ZN7WebCore15BackForwardList5closeEv
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14shrinkCapacityEm
@@ -20833,7 +20830,7 @@ __ZN7WebCore13WorkerRunLoop9runInModeEPNS_13WorkerContextERKNS_6StringE
 __ZN7WebCore22WorkerThreadableLoader16MainThreadBridge22mainThreadCreateLoaderEPNS_22ScriptExecutionContextEPS1_St8auto_ptrINS_
 __ZN7WebCore19ResourceRequestBase5adoptESt8auto_ptrINS_30CrossThreadResourceRequestDataEE
 __ZN7WebCore13HTTPHeaderMap5adoptESt8auto_ptrIN3WTF6VectorISt4pairINS_6StringES5_ELm0EEEE
-__ZN7WebCore19ResourceRequestBase19setAllowHTTPCookiesEb
+__ZN7WebCore19ResourceRequestBase19setAllowCookiesEb
 __ZN7WebCore18GenericWorkerTask5IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_St8auto_ptrINS_30CrossThreadResourceRequestD
 __ZN7WebCore22WorkerThreadableLoader16MainThreadBridge18didReceiveResponseERKNS_16ResourceResponseE
 __ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EENS_16Reso
diff --git a/WebCore/WebCore.pro b/WebCore/WebCore.pro
index 6a19309..24ce0c9 100644
--- a/WebCore/WebCore.pro
+++ b/WebCore/WebCore.pro
@@ -10,7 +10,12 @@ symbian: {
     webkitlibs.sources = QtWebKit.dll
     webkitlibs.path = /sys/bin
     DEPLOYMENT += webkitlibs
+
+    TARGET.UID3 = 0x200267C2
 }
+# RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
+# base address to start from 0x800000 instead of the toolchain default 0x400000.
+symbian-sbsv2: MMP_RULES += "LINKEROPTION  armcc --rw-base 0x800000"
 
 include($$PWD/../WebKit.pri)
 
@@ -98,7 +103,7 @@ CONFIG(QTDIR_build) {
 # Optional components (look for defs in config.h and included files!)
 
 contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
-    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0
+    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0
 }
 
 # turn off SQLITE support if we do not have sqlite3 available
@@ -106,10 +111,12 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 
 !contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
 !contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
+!contains(DEFINES, ENABLE_EVENTSOURCE=.): DEFINES += ENABLE_EVENTSOURCE=1
 !contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 !contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
 !contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
 !contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
+!contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=0
 
 # turn on SQLITE support if any of the dependent features are turned on
 !contains(DEFINES, ENABLE_SQLITE=.) {
@@ -123,10 +130,10 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 !contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
 !contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=0
 !contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
-!contains(DEFINES, ENABLE_XSLT=.): DEFINES += ENABLE_XSLT=0
 #!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
+!contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
 !contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
-!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=0
+!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=1
 !contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
 !contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
 !contains(DEFINES, ENABLE_DATAGRID=.): DEFINES += ENABLE_DATAGRID=1
@@ -152,6 +159,9 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     else:DEFINES += ENABLE_VIDEO=0
 }
 
+# HTML5 datalist support
+!contains(DEFINES, ENABLE_DATALIST=.): DEFINES += ENABLE_DATALIST=1
+
 # Nescape plugins support (NPAPI)
 !contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
     unix|win32-*:!embedded:!wince*:!symbian {
@@ -161,6 +171,15 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     }
 }
 
+# Web Socket support.
+!contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=1
+
+# XSLT support with QtXmlPatterns
+!contains(DEFINES, ENABLE_XSLT=.) {
+    contains(QT_CONFIG, xmlpatterns):!lessThan(QT_MINOR_VERSION, 5):DEFINES += ENABLE_XSLT=1
+    else:DEFINES += ENABLE_XSLT=0
+}
+
 DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
 
 # Used to compute defaults for the build-webkit script
@@ -170,9 +189,12 @@ CONFIG(compute_defaults) {
 }
 
 RESOURCES += \
-    $$PWD/../WebCore/inspector/front-end/WebKit.qrc \
     $$PWD/../WebCore/WebCore.qrc
 
+!symbian {
+    RESOURCES += $$PWD/../WebCore/inspector/front-end/WebKit.qrc
+}
+
 include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
 
 INCLUDEPATH = \
@@ -193,6 +215,7 @@ INCLUDEPATH = \
     $$PWD/loader/appcache \
     $$PWD/loader/archive \
     $$PWD/loader/icon \
+    $$PWD/notifications \
     $$PWD/page \
     $$PWD/page/animation \
     $$PWD/platform \
@@ -201,6 +224,7 @@ INCLUDEPATH = \
     $$PWD/platform/graphics/filters \
     $$PWD/platform/graphics/transforms \
     $$PWD/platform/image-decoders \
+    $$PWD/platform/mock \
     $$PWD/platform/network \
     $$PWD/platform/sql \
     $$PWD/platform/text \
@@ -212,6 +236,7 @@ INCLUDEPATH = \
     $$PWD/svg/animation \
     $$PWD/svg/graphics \
     $$PWD/svg/graphics/filters \
+    $$PWD/websockets \
     $$PWD/wml \
     $$PWD/workers \
     $$PWD/xml \
@@ -254,9 +279,16 @@ WALDOCSSVALUES = $$PWD/css/CSSValueKeywords.in
 
 DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
 
-SVGCSSPROPERTIES = $$PWD/css/SVGCSSPropertyNames.in
 
-SVGCSSVALUES = $$PWD/css/SVGCSSValueKeywords.in
+contains(DEFINES, ENABLE_SVG=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/SVGCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/SVGCSSValueKeywords.in
+}
+
+contains(DEFINES, ENABLE_WCSS=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/WCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/WCSSValueKeywords.in
+}
 
 STYLESHEETS_EMBED = \
     $$PWD/css/html.css \
@@ -264,7 +296,8 @@ STYLESHEETS_EMBED = \
     $$PWD/css/svg.css \
     $$PWD/css/view-source.css \
     $$PWD/css/wml.css \
-    $$PWD/css/mediaControls.css
+    $$PWD/css/mediaControls.css \
+    $$PWD/css/mediaControlsQt.css
 
 DOMLUT_FILES += \
     bindings/js/JSDOMWindowBase.cpp \
@@ -298,6 +331,7 @@ IDL_BINDINGS += \
     css/WebKitCSSMatrix.idl \
     css/WebKitCSSTransformValue.idl \
     dom/Attr.idl \
+    dom/BeforeLoadEvent.idl \
     dom/CharacterData.idl \
     dom/ClientRect.idl \
     dom/ClientRectList.idl \
@@ -330,6 +364,7 @@ IDL_BINDINGS += \
     dom/NodeList.idl \
     dom/Notation.idl \
     dom/OverflowEvent.idl \
+    dom/PageTransitionEvent.idl \
     dom/ProcessingInstruction.idl \
     dom/ProgressEvent.idl \
     dom/RangeException.idl \
@@ -341,9 +376,20 @@ IDL_BINDINGS += \
     dom/WebKitAnimationEvent.idl \
     dom/WebKitTransitionEvent.idl \
     dom/WheelEvent.idl \
+    html/canvas/CanvasArray.idl \
+    html/canvas/CanvasArrayBuffer.idl \
+    html/canvas/CanvasByteArray.idl \
+    html/canvas/CanvasFloatArray.idl \
     html/canvas/CanvasGradient.idl \
+    html/canvas/CanvasIntArray.idl \
     html/canvas/CanvasPattern.idl \
+    html/canvas/CanvasRenderingContext.idl \
     html/canvas/CanvasRenderingContext2D.idl \
+    html/canvas/CanvasRenderingContext3D.idl \
+    html/canvas/CanvasShortArray.idl \
+    html/canvas/CanvasUnsignedByteArray.idl \
+    html/canvas/CanvasUnsignedIntArray.idl \
+    html/canvas/CanvasUnsignedShortArray.idl \
     html/DataGridColumn.idl \
     html/DataGridColumnList.idl \
     html/File.idl \
@@ -364,6 +410,7 @@ IDL_BINDINGS += \
     html/HTMLDataGridCellElement.idl \
     html/HTMLDataGridColElement.idl \
     html/HTMLDataGridRowElement.idl \
+    html/HTMLDataListElement.idl \
     html/HTMLDirectoryElement.idl \
     html/HTMLDivElement.idl \
     html/HTMLDListElement.idl \
@@ -430,6 +477,7 @@ IDL_BINDINGS += \
     page/Coordinates.idl \
     page/DOMSelection.idl \
     page/DOMWindow.idl \
+    page/EventSource.idl \
     page/Geolocation.idl \
     page/Geoposition.idl \
     page/History.idl \
@@ -475,7 +523,6 @@ IDL_BINDINGS += \
     svg/SVGColor.idl \
     svg/SVGComponentTransferFunctionElement.idl \
     svg/SVGCursorElement.idl \
-    svg/SVGDefinitionSrcElement.idl \
     svg/SVGDefsElement.idl \
     svg/SVGDescElement.idl \
     svg/SVGDocument.idl \
@@ -583,6 +630,7 @@ IDL_BINDINGS += \
     svg/SVGUnitTypes.idl \
     svg/SVGUseElement.idl \
     svg/SVGViewElement.idl \
+    websockets/WebSocket.idl \
     workers/AbstractWorker.idl \
     workers/DedicatedWorkerContext.idl \
     workers/SharedWorker.idl \
@@ -606,6 +654,7 @@ IDL_BINDINGS += \
 
 SOURCES += \
     accessibility/AccessibilityImageMapLink.cpp \
+    accessibility/AccessibilityMediaControls.cpp \    
     accessibility/AccessibilityObject.cpp \    
     accessibility/AccessibilityList.cpp \    
     accessibility/AccessibilityListBox.cpp \    
@@ -622,12 +671,15 @@ SOURCES += \
     accessibility/AccessibilityTableRow.cpp \    
     accessibility/AXObjectCache.cpp \
     bindings/js/GCController.cpp \
+    bindings/js/JSCallbackData.cpp \
     bindings/js/JSAttrCustom.cpp \
     bindings/js/JSCDATASectionCustom.cpp \
+    bindings/js/JSCanvasRenderingContextCustom.cpp \
     bindings/js/JSCanvasRenderingContext2DCustom.cpp \
     bindings/js/JSClipboardCustom.cpp \
     bindings/js/JSConsoleCustom.cpp \
     bindings/js/JSCSSRuleCustom.cpp \
+    bindings/js/JSCSSRuleListCustom.cpp \
     bindings/js/JSCSSStyleDeclarationCustom.cpp \
     bindings/js/JSCSSValueCustom.cpp \
     bindings/js/JSCoordinatesCustom.cpp \
@@ -645,11 +697,14 @@ SOURCES += \
     bindings/js/JSDOMWindowShell.cpp \
     bindings/js/JSElementCustom.cpp \
     bindings/js/JSEventCustom.cpp \
+    bindings/js/JSEventSourceConstructor.cpp \
+    bindings/js/JSEventSourceCustom.cpp \
     bindings/js/JSEventTarget.cpp \
     bindings/js/JSGeolocationCustom.cpp \
     bindings/js/JSHTMLAllCollection.cpp \
     bindings/js/JSHistoryCustom.cpp \
     bindings/js/JSHTMLAppletElementCustom.cpp \
+    bindings/js/JSHTMLCanvasElementCustom.cpp \
     bindings/js/JSHTMLCollectionCustom.cpp \
     bindings/js/JSHTMLDataGridElementCustom.cpp \
     bindings/js/JSHTMLDocumentCustom.cpp \
@@ -670,7 +725,6 @@ SOURCES += \
     bindings/js/JSInspectorCallbackWrapper.cpp \
     bindings/js/JSLocationCustom.cpp \
     bindings/js/JSNamedNodeMapCustom.cpp \
-    bindings/js/JSNamedNodesCollection.cpp  \
     bindings/js/JSNavigatorCustom.cpp  \
     bindings/js/JSNodeCustom.cpp \
     bindings/js/JSNodeFilterCondition.cpp \
@@ -692,7 +746,9 @@ SOURCES += \
     bindings/js/JSPluginArrayCustom.cpp \
     bindings/js/JSMessageChannelConstructor.cpp \
     bindings/js/JSMessageChannelCustom.cpp \
+    bindings/js/JSMessageEventCustom.cpp \
     bindings/js/JSMessagePortCustom.cpp \
+    bindings/js/JSMessagePortCustom.h \
     bindings/js/JSMimeTypeArrayCustom.cpp \
     bindings/js/JSDOMBinding.cpp \
     bindings/js/JSEventListener.cpp \
@@ -710,6 +766,7 @@ SOURCES += \
     bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
+    bindings/js/SerializedScriptValue.cpp \
     bridge/IdentifierRep.cpp \
     bridge/NP_jsobject.cpp \
     bridge/npruntime.cpp \
@@ -836,6 +893,7 @@ SOURCES += \
     dom/OptionGroupElement.cpp \
     dom/OptionElement.cpp \
     dom/OverflowEvent.cpp \
+    dom/PageTransitionEvent.cpp \
     dom/Position.cpp \
     dom/PositionIterator.cpp \
     dom/ProcessingInstruction.cpp \
@@ -862,7 +920,6 @@ SOURCES += \
     dom/WheelEvent.cpp \
     dom/XMLTokenizer.cpp \
     dom/XMLTokenizerQt.cpp \
-    dom/XMLTokenizerScope.cpp \
     dom/default/PlatformMessagePortChannel.cpp \
     editing/AppendNodeCommand.cpp \
     editing/ApplyStyleCommand.cpp \
@@ -920,6 +977,7 @@ SOURCES += \
     html/canvas/CanvasGradient.cpp \
     html/canvas/CanvasPattern.cpp \
     html/canvas/CanvasPixelArray.cpp \
+    html/canvas/CanvasRenderingContext.cpp \
     html/canvas/CanvasRenderingContext2D.cpp \
     html/canvas/CanvasStyle.cpp \
     html/CollectionCache.cpp \
@@ -944,6 +1002,7 @@ SOURCES += \
     html/HTMLDataGridCellElement.cpp \
     html/HTMLDataGridColElement.cpp \
     html/HTMLDataGridRowElement.cpp \
+    html/HTMLDataListElement.cpp \
     html/HTMLDirectoryElement.cpp \
     html/HTMLDivElement.cpp \
     html/HTMLDListElement.cpp \
@@ -1013,17 +1072,19 @@ SOURCES += \
     html/PreloadScanner.cpp \
     html/ValidityState.cpp \
     inspector/ConsoleMessage.cpp \
+    inspector/DOMDispatchTimelineItem.cpp \
     inspector/InspectorBackend.cpp \
+    inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDOMAgent.cpp \
     inspector/InspectorDOMStorageResource.cpp \
-    inspector/InspectorController.cpp \
     inspector/InspectorFrontend.cpp \
     inspector/InspectorResource.cpp \
+    inspector/InspectorTimelineAgent.cpp \
+    inspector/TimelineItem.cpp \
     loader/archive/ArchiveFactory.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
-    loader/UserStyleSheetLoader.cpp \
     loader/Cache.cpp \
     loader/CachedCSSStyleSheet.cpp \
     loader/CachedFont.cpp \
@@ -1052,7 +1113,10 @@ SOURCES += \
     loader/NetscapePlugInStreamLoader.cpp \
     loader/PlaceholderDocument.cpp \
     loader/PluginDocument.cpp \
+    loader/PolicyCallback.cpp \
+    loader/PolicyChecker.cpp \
     loader/ProgressTracker.cpp \
+    loader/RedirectScheduler.cpp \
     loader/Request.cpp \
     loader/ResourceLoader.cpp \
     loader/SubresourceLoader.cpp \
@@ -1068,7 +1132,6 @@ SOURCES += \
     page/Chrome.cpp \
     page/Console.cpp \
     page/ContextMenuController.cpp \
-    page/Coordinates.cpp \
     page/DOMSelection.cpp \
     page/DOMTimer.cpp \
     page/DOMWindow.cpp \
@@ -1076,22 +1139,25 @@ SOURCES += \
     page/NavigatorBase.cpp \
     page/DragController.cpp \
     page/EventHandler.cpp \
+    page/EventSource.cpp \
     page/FocusController.cpp \
     page/Frame.cpp \
     page/FrameTree.cpp \
     page/FrameView.cpp \
     page/Geolocation.cpp \
-    page/Geoposition.cpp \
     page/History.cpp \
     page/Location.cpp \
     page/MouseEventWithHitTestResults.cpp \
+    page/OriginAccessEntry.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
     page/PageGroupLoadDeferrer.cpp \
+    page/PluginHalter.cpp \
     page/PrintContext.cpp \
     page/SecurityOrigin.cpp \
     page/Screen.cpp \
     page/Settings.cpp \
+    page/UserContentURLPattern.cpp \
     page/WindowFeatures.cpp \
     page/XSSAuditor.cpp \
     plugins/PluginData.cpp \
@@ -1115,6 +1181,7 @@ SOURCES += \
     platform/DragImage.cpp \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
+    platform/image-decoders/qt/RGBA32BufferQt.cpp \
     platform/graphics/FontDescription.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
@@ -1132,6 +1199,7 @@ SOURCES += \
     platform/graphics/GraphicsTypes.cpp \
     platform/graphics/Image.cpp \
     platform/graphics/ImageBuffer.cpp \
+    platform/graphics/ImageSource.cpp \
     platform/graphics/IntRect.cpp \
     platform/graphics/Path.cpp \
     platform/graphics/PathTraversalState.cpp \
@@ -1153,6 +1221,7 @@ SOURCES += \
     platform/LinkHash.cpp \
     platform/Logging.cpp \
     platform/MIMETypeRegistry.cpp \
+    platform/mock/GeolocationServiceMock.cpp \
     platform/network/AuthenticationChallengeBase.cpp \
     platform/network/Credential.cpp \
     platform/network/FormData.cpp \
@@ -1293,6 +1362,7 @@ HEADERS += \
     accessibility/AccessibilityListBox.h \
     accessibility/AccessibilityListBoxOption.h \
     accessibility/AccessibilityList.h \
+    accessibility/AccessibilityMediaControls.h \
     accessibility/AccessibilityObject.h \
     accessibility/AccessibilityRenderObject.h \
     accessibility/AccessibilitySlider.h \
@@ -1305,6 +1375,7 @@ HEADERS += \
     bindings/js/CachedScriptSourceProvider.h \
     bindings/js/DOMObjectWithSVGContext.h \
     bindings/js/GCController.h \
+    bindings/js/JSCallbackData.h \
     bindings/js/JSAudioConstructor.h \
     bindings/js/JSCSSStyleDeclarationCustom.h \
     bindings/js/JSCustomPositionCallback.h \
@@ -1323,6 +1394,7 @@ HEADERS += \
     bindings/js/JSDOMWindowCustom.h \
     bindings/js/JSDOMWindowShell.h \
     bindings/js/JSEventListener.h \
+    bindings/js/JSEventSourceConstructor.h \
     bindings/js/JSEventTarget.h \
     bindings/js/JSHistoryCustom.h \
     bindings/js/JSHTMLAllCollection.h \
@@ -1337,7 +1409,6 @@ HEADERS += \
     bindings/js/JSLazyEventListener.h \
     bindings/js/JSLocationCustom.h \
     bindings/js/JSMessageChannelConstructor.h \
-    bindings/js/JSNamedNodesCollection.h \
     bindings/js/JSNodeFilterCondition.h \
     bindings/js/JSOptionConstructor.h \
     bindings/js/JSPluginElementFunctions.h \
@@ -1365,6 +1436,7 @@ HEADERS += \
     bindings/js/ScriptSourceProvider.h \
     bindings/js/ScriptState.h \
     bindings/js/ScriptValue.h \
+    bindings/js/SerializedScriptValue.h \
     bindings/js/StringSourceProvider.h \
     bindings/js/WorkerScriptController.h \
     bridge/c/c_class.h \
@@ -1496,6 +1568,7 @@ HEADERS += \
     dom/OptionElement.h \
     dom/OptionGroupElement.h \
     dom/OverflowEvent.h \
+    dom/PageTransitionEvent.h \
     dom/Position.h \
     dom/PositionIterator.h \
     dom/ProcessingInstruction.h \
@@ -1513,6 +1586,7 @@ HEADERS += \
     dom/TagNodeList.h \
     dom/TextEvent.h \
     dom/Text.h \
+    dom/TransformSource.h \
     dom/Traversal.h \
     dom/TreeWalker.h \
     dom/UIEvent.h \
@@ -1521,7 +1595,6 @@ HEADERS += \
     dom/WebKitTransitionEvent.h \
     dom/WheelEvent.h \
     dom/XMLTokenizer.h \
-    dom/XMLTokenizerScope.h \
     editing/AppendNodeCommand.h \
     editing/ApplyStyleCommand.h \
     editing/BreakBlockquoteCommand.h \
@@ -1575,6 +1648,7 @@ HEADERS += \
     html/canvas/CanvasGradient.h \
     html/canvas/CanvasPattern.h \
     html/canvas/CanvasPixelArray.h \
+    html/canvas/CanvasRenderingContext.h \
     html/canvas/CanvasRenderingContext2D.h \
     html/canvas/CanvasStyle.h \
     html/CollectionCache.h \
@@ -1673,16 +1747,19 @@ HEADERS += \
     html/TimeRanges.h \
     html/ValidityState.h \
     inspector/ConsoleMessage.h \
+    inspector/DOMDispatchTimelineItem.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
     inspector/InspectorDatabaseResource.h \
     inspector/InspectorDOMStorageResource.h \
     inspector/InspectorFrontend.h \
     inspector/InspectorResource.h \
+    inspector/InspectorTimelineAgent.h \
     inspector/JavaScriptCallFrame.h \
     inspector/JavaScriptDebugServer.h \
     inspector/JavaScriptProfile.h \
     inspector/JavaScriptProfileNode.h \
+    inspector/TimelineItem.h \
     loader/appcache/ApplicationCacheGroup.h \
     loader/appcache/ApplicationCacheHost.h \
     loader/appcache/ApplicationCache.h \
@@ -1731,7 +1808,6 @@ HEADERS += \
     loader/TextDocument.h \
     loader/TextResourceDecoder.h \
     loader/ThreadableLoader.h \
-    loader/UserStyleSheetLoader.h \
     loader/WorkerThreadableLoader.h \
     page/animation/AnimationBase.h \
     page/animation/AnimationController.h \
@@ -1748,12 +1824,14 @@ HEADERS += \
     page/DOMWindow.h \
     page/DragController.h \
     page/EventHandler.h \
+    page/EventSource.h \
     page/FocusController.h \
     page/Frame.h \
     page/FrameTree.h \
     page/FrameView.h \
     page/Geolocation.h \
     page/Geoposition.h \
+    page/HaltablePlugin.h \
     page/History.h \
     page/Location.h \
     page/MouseEventWithHitTestResults.h \
@@ -1762,6 +1840,8 @@ HEADERS += \
     page/PageGroup.h \
     page/PageGroupLoadDeferrer.h \
     page/Page.h \
+    page/PluginHalter.h \
+    page/PluginHalterClient.h \
     page/PrintContext.h \
     page/Screen.h \
     page/SecurityOrigin.h \
@@ -1780,6 +1860,8 @@ HEADERS += \
     platform/DragImage.h \
     platform/FileChooser.h \
     platform/GeolocationService.h \
+    platform/image-decoders/ImageDecoder.h \
+    platform/mock/GeolocationServiceMock.h \
     platform/graphics/BitmapImage.h \
     platform/graphics/Color.h \
     platform/graphics/filters/FEBlend.h \
@@ -1803,6 +1885,7 @@ HEADERS += \
     platform/graphics/GraphicsContext.h \
     platform/graphics/GraphicsTypes.h \
     platform/graphics/Image.h \
+    platform/graphics/ImageSource.h \
     platform/graphics/IntRect.h \
     platform/graphics/MediaPlayer.h \
     platform/graphics/Path.h \
@@ -1842,6 +1925,7 @@ HEADERS += \
     platform/network/ResourceRequestBase.h \
     platform/network/ResourceResponseBase.h \
     platform/qt/ClipboardQt.h \
+    platform/qt/QWebPageClient.h \
     platform/qt/QWebPopup.h \
     platform/qt/RenderThemeQt.h \
     platform/qt/ScrollbarThemeQt.h \
@@ -2050,7 +2134,6 @@ HEADERS += \
     svg/SVGColor.h \
     svg/SVGComponentTransferFunctionElement.h \
     svg/SVGCursorElement.h \
-    svg/SVGDefinitionSrcElement.h \
     svg/SVGDefsElement.h \
     svg/SVGDescElement.h \
     svg/SVGDocumentExtensions.h \
@@ -2237,6 +2320,7 @@ HEADERS += \
     xml/XSLTProcessor.h \
     xml/XSLTUnicodeSort.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
+    $$PWD/platform/network/qt/DnsPrefetchHelper.h
 
 SOURCES += \
     accessibility/qt/AccessibilityObjectQt.cpp \
@@ -2260,7 +2344,6 @@ SOURCES += \
     platform/graphics/qt/ImageBufferQt.cpp \
     platform/graphics/qt/ImageDecoderQt.cpp \
     platform/graphics/qt/ImageQt.cpp \
-    platform/graphics/qt/ImageSourceQt.cpp \
     platform/graphics/qt/IntPointQt.cpp \
     platform/graphics/qt/IntRectQt.cpp \
     platform/graphics/qt/IntSizeQt.cpp \
@@ -2269,6 +2352,7 @@ SOURCES += \
     platform/graphics/qt/StillImageQt.cpp \
     platform/network/qt/ResourceHandleQt.cpp \
     platform/network/qt/ResourceRequestQt.cpp \
+    platform/network/qt/DnsPrefetchHelper.cpp \
     platform/network/qt/QNetworkReplyHandler.cpp \
     editing/qt/EditorQt.cpp \
     platform/qt/ClipboardQt.cpp \
@@ -2320,6 +2404,7 @@ SOURCES += \
     ../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp \
     ../WebKit/qt/WebCoreSupport/InspectorClientQt.cpp \
     ../WebKit/qt/Api/qwebframe.cpp \
+    ../WebKit/qt/Api/qgraphicswebview.cpp \
     ../WebKit/qt/Api/qwebpage.cpp \
     ../WebKit/qt/Api/qwebview.cpp \
     ../WebKit/qt/Api/qwebelement.cpp \
@@ -2330,6 +2415,7 @@ SOURCES += \
     ../WebKit/qt/Api/qwebpluginfactory.cpp \
     ../WebKit/qt/Api/qwebsecurityorigin.cpp \
     ../WebKit/qt/Api/qwebdatabase.cpp \
+    ../WebKit/qt/Api/qwebinspector.cpp \
     ../WebKit/qt/Api/qwebkitversion.cpp
 
 
@@ -2339,6 +2425,7 @@ SOURCES += \
         SOURCES += \
             platform/text/cf/StringCF.cpp \
             platform/text/cf/StringImplCF.cpp
+        LIBS_PRIVATE += -framework Carbon -framework AppKit
     }
 
     win32-* {
@@ -2418,6 +2505,10 @@ contains(DEFINES, ENABLE_CHANNEL_MESSAGING=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_CHANNEL_MESSAGING=1
 }
 
+contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
+}
+
 contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0) {
     DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
 }
@@ -2426,6 +2517,10 @@ contains(DEFINES, ENABLE_DATAGRID=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATAGRID=1
 }
 
+contains(DEFINES, ENABLE_EVENTSOURCE=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
+}
+
 contains(DEFINES, ENABLE_SQLITE=1) {
     !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
             # Build sqlite3 into WebCore from source
@@ -2473,6 +2568,8 @@ contains(DEFINES, ENABLE_DATABASE=1) {
         storage/SQLResultSetRowList.cpp \
         storage/SQLStatement.cpp \
         storage/SQLTransaction.cpp \
+        storage/SQLTransactionClient.cpp \
+        storage/SQLTransactionCoordinator.cpp \
         bindings/js/JSCustomSQLStatementCallback.cpp \
         bindings/js/JSCustomSQLStatementErrorCallback.cpp \
         bindings/js/JSCustomSQLTransactionCallback.cpp \
@@ -2500,10 +2597,13 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/SQLResultSetRowList.h \
         storage/SQLStatement.h \
         storage/SQLTransaction.h \
+        storage/SQLTransactionClient.h \
+        storage/SQLTransactionCoordinator.h \
         storage/StorageArea.h \
         storage/StorageAreaImpl.h \
         storage/StorageAreaSync.h \
         storage/StorageEvent.h \
+        storage/StorageEventDispatcher.h \
         storage/Storage.h \
         storage/StorageMap.h \
         storage/StorageNamespace.h \
@@ -2518,6 +2618,7 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageAreaImpl.cpp \
         storage/StorageAreaSync.cpp \
         storage/StorageEvent.cpp \
+        storage/StorageEventDispatcher.cpp \
         storage/StorageMap.cpp \
         storage/StorageNamespace.cpp \
         storage/StorageNamespaceImpl.cpp \
@@ -2559,12 +2660,11 @@ contains(DEFINES, ENABLE_WORKERS=1) {
         workers/WorkerScriptLoader.cpp
 }
 
-contains(DEFINES, SHARED_WORKERS=1) {
+contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_WORKERS=1
 
     SOURCES += \
         bindings/js/JSSharedWorkerConstructor.cpp \
-        bindings/js/JSSharedWorkerContextCustom.cpp \
         bindings/js/JSSharedWorkerCustom.cpp \
         workers/DefaultSharedWorkerRepository.cpp \
         workers/SharedWorker.cpp \
@@ -2634,25 +2734,16 @@ unix:!mac:CONFIG += link_pkgconfig
 
 contains(DEFINES, ENABLE_XSLT=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_XSLT=1
-    PKGCONFIG += libxml-2.0 libxslt
 
-    macx {
-        INCLUDEPATH += /usr/include/libxml2
-        LIBS += -lxml2 -lxslt
-    }
-
-    win32-msvc* {
-        LIBS += -llibxml2 -llibxslt
-    }
+    QT += xmlpatterns
 
     SOURCES += \
         bindings/js/JSXSLTProcessorConstructor.cpp \
         bindings/js/JSXSLTProcessorCustom.cpp \
-        xml/XSLImportRule.cpp \
-        xml/XSLStyleSheet.cpp \
-        xml/XSLTExtensions.cpp \
+        dom/TransformSourceQt.cpp \
+        xml/XSLStyleSheetQt.cpp \
         xml/XSLTProcessor.cpp \
-        xml/XSLTUnicodeSort.cpp
+        xml/XSLTProcessorQt.cpp
 }
 
 contains(DEFINES, ENABLE_XBL=1) {
@@ -2672,6 +2763,14 @@ contains(DEFINES, ENABLE_FILTERS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
 }
 
+contains(DEFINES, ENABLE_WCSS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
+    contains(DEFINES, ENABLE_XHTMLMP=0) {
+        DEFINES -= ENABLE_XHTMLMP=0
+        DEFINES += ENABLE_XHTMLMP=1
+    }
+}
+
 contains(DEFINES, ENABLE_WML=1) {
     SOURCES += \
         wml/WMLAElement.cpp \
@@ -2776,7 +2875,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGColor.cpp \
         svg/SVGComponentTransferFunctionElement.cpp \
         svg/SVGCursorElement.cpp \
-        svg/SVGDefinitionSrcElement.cpp \
         svg/SVGDefsElement.cpp \
         svg/SVGDescElement.cpp \
         svg/SVGDocument.cpp \
@@ -2980,42 +3078,25 @@ contains(DEFINES, ENABLE_SVG=1) {
         xlinknames.variable_out = GENERATED_SOURCES
         addExtraCompilerWithHeader(xlinknames)
 
-    # GENERATOR 6-A:
-    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-    cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$SVGCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
-    cssprops.CONFIG = target_predeps no_link
-    cssprops.variable_out =
-    cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES SVGCSSPROPERTIES
-    addExtraCompilerWithHeader(cssprops)
-
-    # GENERATOR 6-B:
-    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
-    cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$SVGCSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
-    cssvalues.CONFIG = target_predeps no_link
-    cssvalues.variable_out =
-    cssvalues.depend = ${QMAKE_FILE_NAME} SVGCSSVALUES
-    addExtraCompilerWithHeader(cssvalues)
-} else {
-    # GENERATOR 6-A:
-    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-    cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
-    cssprops.CONFIG = target_predeps no_link
-    cssprops.variable_out =
-    cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES
-    addExtraCompilerWithHeader(cssprops)
-
-    # GENERATOR 6-B:
-    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
-    cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
-    cssvalues.CONFIG = target_predeps no_link
-    cssvalues.variable_out =
-    cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
-    addExtraCompiler(cssvalues)
-}
+} 
+# GENERATOR 6-A:
+cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+cssprops.input = WALDOCSSPROPS
+cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$EXTRACSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+cssprops.CONFIG = target_predeps no_link
+cssprops.variable_out =
+cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES EXTRACSSPROPERTIES
+addExtraCompilerWithHeader(cssprops)
+
+# GENERATOR 6-B:
+cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
+cssvalues.input = WALDOCSSVALUES
+cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$EXTRACSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
+cssvalues.CONFIG = target_predeps no_link
+cssvalues.variable_out =
+cssvalues.depend = ${QMAKE_FILE_NAME} EXTRACSSVALUES
+cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
+addExtraCompiler(cssvalues)
 
 contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
@@ -3042,6 +3123,20 @@ SOURCES += \
     bindings/js/JSDOMApplicationCacheCustom.cpp
 }
 
+contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
+
+SOURCES += \
+    websockets/WebSocket.cpp \
+    websockets/WebSocketChannel.cpp \
+    websockets/WebSocketHandshake.cpp \
+    platform/network/SocketStreamErrorBase.cpp \
+    platform/network/SocketStreamHandleBase.cpp \
+    platform/network/qt/SocketStreamHandleSoup.cpp \
+    bindings/js/JSWebSocketCustom.cpp \
+    bindings/js/JSWebSocketConstructor.cpp
+}
+
 # GENERATOR 1: IDL compiler
 idl.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JS${QMAKE_FILE_BASE}.cpp
 idl.variable_out = GENERATED_SOURCES
@@ -3217,10 +3312,10 @@ HEADERS += $$WEBKIT_API_HEADERS
             !build_pass {
                 message("Building QtWebKit as a framework, as that's how Qt was built. You can")
                 message("override this by passing CONFIG+=webkit_no_framework to build-webkit.")
+
+                CONFIG += build_all
             } else {
-                debug_and_release:CONFIG(debug, debug|release) {
-                    TARGET = $$qtLibraryTarget($$TARGET)
-                }
+                debug_and_release:TARGET = $$qtLibraryTarget($$TARGET)
             }
 
             CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
@@ -3231,6 +3326,7 @@ HEADERS += $$WEBKIT_API_HEADERS
         }
 
         QMAKE_LFLAGS_SONAME = "$${QMAKE_LFLAGS_SONAME}$${DESTDIR}$${QMAKE_DIR_SEP}"
+        LIBS += -framework Carbon -framework AppKit
     }
 }
 
@@ -3241,3 +3337,20 @@ CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4
     CONFIG += no_debug_info
 }
 
+!win32-g++:win32:contains(QMAKE_HOST.arch, x86_64):{
+    asm_compiler.commands = ml64 /c
+    asm_compiler.commands +=  /Fo ${QMAKE_FILE_OUT} ${QMAKE_FILE_IN}
+    asm_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
+    asm_compiler.input = ASM_SOURCES
+    asm_compiler.variable_out = OBJECTS
+    asm_compiler.name = compiling[asm] ${QMAKE_FILE_IN}
+    silent:asm_compiler.commands = @echo compiling[asm] ${QMAKE_FILE_IN} && $$asm_compiler.commands
+    QMAKE_EXTRA_COMPILERS += asm_compiler
+
+    ASM_SOURCES += \
+        plugins/win/PaintHooks.asm
+   if(win32-msvc2005|win32-msvc2008):equals(TEMPLATE_PREFIX, "vc") {
+        SOURCES += \
+            plugins/win/PaintHooks.asm
+    }
+}
diff --git a/WebCore/WebCore.qrc b/WebCore/WebCore.qrc
index b3fe43a..69f860a 100644
--- a/WebCore/WebCore.qrc
+++ b/WebCore/WebCore.qrc
@@ -1,7 +1,4 @@
 <!DOCTYPE RCC><RCC version="1.0">
-<qresource prefix="/webcore/css">
-    <file alias="mediaControls-extras.css">css/qt/mediaControls-extras.css</file>
-</qresource>
 <qresource prefix="/webkit/resources">
     <file alias="missingImage.png">Resources/missingImage.png</file>
     <file alias="nullPlugin.png">Resources/nullPlugin.png</file>
diff --git a/WebCore/WebCore.vcproj/QTMovieWin.rc b/WebCore/WebCore.vcproj/QTMovieWin.rc
index 2889f4b..1ed0428 100644
--- a/WebCore/WebCore.vcproj/QTMovieWin.rc
+++ b/WebCore/WebCore.vcproj/QTMovieWin.rc
@@ -14,8 +14,8 @@ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION __VERSION_MAJOR__,__BUILD_NUMBER_MAJOR__,__BUILD_NUMBER_MINOR__,__BUILD_NUMBER_VARIANT__
- PRODUCTVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,0
+ FILEVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,__VERSION_BUILD__
+ PRODUCTVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,__VERSION_BUILD__
  FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -37,7 +37,7 @@ BEGIN
             VALUE "LegalCopyright", "Copyright Apple Inc. 2007-2009"
             VALUE "OriginalFilename", "QTMovieWin.dll"
             VALUE "ProductName", "WebKit"
-            VALUE "ProductVersion", __BUILD_NUMBER_SHORT__
+            VALUE "ProductVersion", __VERSION_TEXT__
         END
     END
     BLOCK "VarFileInfo"
diff --git a/WebCore/WebCore.vcproj/QTMovieWin.vcproj b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
index 593855b..5e54c67 100644
--- a/WebCore/WebCore.vcproj/QTMovieWin.vcproj
+++ b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
@@ -1,280 +1,280 @@
-<?xml version="1.0" encoding="windows-1251"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="QTMovieWin"
-	ProjectGUID="{E498CA9D-3BD2-4D52-8E37-C8DC76526325}"
-	RootNamespace="QuickTimeWin"
-	Keyword="Win32Proj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"
-				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"
-				DisableSpecificWarnings="4819"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				AdditionalIncludeDirectories=""
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"
-				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"
-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"
-				IgnoreDefaultLibraryNames="LIBCMT"
-				DelayLoadDLLs=""
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"
-			CharacterSet="1"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"
-				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"
-				DisableSpecificWarnings="4819"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				AdditionalIncludeDirectories=""
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"
-				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"
-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"
-				IgnoreDefaultLibraryNames="LIBCMT"
-				DelayLoadDLLs=""
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_Internal|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"
-				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"
-				DisableSpecificWarnings="4819"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				AdditionalIncludeDirectories=""
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"
-				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"
-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"
-				IgnoreDefaultLibraryNames="LIBCMT"
-				DelayLoadDLLs=""
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<Filter
-			Name="Source Files"
-			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
-			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
-			>
-			<File
-				RelativePath="..\platform\graphics\win\QTMovieWin.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\platform\graphics\win\QTMovieWinTimer.cpp"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Header Files"
-			Filter="h;hpp;hxx;hm;inl;inc;xsd"
-			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
-			>
-			<File
-				RelativePath="..\platform\graphics\win\QTMovieWin.h"
-				>
-			</File>
-			<File
-				RelativePath="..\platform\graphics\win\QTMovieWinTimer.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Resource Files"
-			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"
-			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
-			>
-			<File
-				RelativePath=".\QTMovieWin.rc"
-				>
-			</File>
-		</Filter>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="windows-1251"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="QTMovieWin"

+	ProjectGUID="{E498CA9D-3BD2-4D52-8E37-C8DC76526325}"

+	RootNamespace="QuickTimeWin"

+	Keyword="Win32Proj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Debug|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

+				DisableSpecificWarnings="4819"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+				AdditionalIncludeDirectories=""

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

+				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				IgnoreDefaultLibraryNames="LIBCMT"

+				DelayLoadDLLs=""

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

+				DisableSpecificWarnings="4819"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+				AdditionalIncludeDirectories=""

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

+				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				IgnoreDefaultLibraryNames="LIBCMT"

+				DelayLoadDLLs=""

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_Internal|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

+				DisableSpecificWarnings="4819"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+				AdditionalIncludeDirectories=""

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

+				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				IgnoreDefaultLibraryNames="LIBCMT"

+				DelayLoadDLLs=""

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<Filter

+			Name="Source Files"

+			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"

+			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"

+			>

+			<File

+				RelativePath="..\platform\graphics\win\QTMovieWin.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\platform\graphics\win\QTMovieWinTimer.cpp"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="Header Files"

+			Filter="h;hpp;hxx;hm;inl;inc;xsd"

+			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"

+			>

+			<File

+				RelativePath="..\platform\graphics\win\QTMovieWin.h"

+				>

+			</File>

+			<File

+				RelativePath="..\platform\graphics\win\QTMovieWinTimer.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="Resource Files"

+			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"

+			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"

+			>

+			<File

+				RelativePath=".\QTMovieWin.rc"

+				>

+			</File>

+		</Filter>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/WebCore/WebCore.vcproj/WebCore.vcproj b/WebCore/WebCore.vcproj/WebCore.vcproj
index 7aef730..9a9e3ec 100644
--- a/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -67,7 +67,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -123,7 +123,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -178,7 +178,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -233,7 +233,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -289,7 +289,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -566,6 +566,54 @@
 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBarInfo.h"

 				>

 			</File>

+                        <File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBeforeLoadEvent.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBeforeLoadEvent.h"

+				>

+			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasGradient.cpp"

 				>

@@ -663,6 +711,54 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasRenderingContext.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasRenderingContext.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasRenderingContext2D.cpp"

 				>

 				<FileConfiguration

@@ -2779,6 +2875,54 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEventSource.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEventSource.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFile.cpp"

 				>

 				<FileConfiguration

@@ -3787,6 +3931,54 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDataListElement.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDataListElement.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDirectoryElement.cpp"

 				>

 				<FileConfiguration

@@ -7387,7 +7579,7 @@
 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSOverflowEvent.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotification.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7431,11 +7623,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSOverflowEvent.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotification.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPlugin.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotificationCenter.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7479,11 +7671,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPlugin.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotificationCenter.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPluginArray.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSOverflowEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7527,11 +7719,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPluginArray.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSOverflowEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPageTransitionEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7575,11 +7767,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPageTransitionEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProcessingInstruction.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPlugin.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7623,11 +7815,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProcessingInstruction.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPlugin.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProgressEvent.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPluginArray.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7671,11 +7863,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProgressEvent.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPluginArray.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRange.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7719,11 +7911,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRange.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRangeException.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProcessingInstruction.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7767,11 +7959,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRangeException.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProcessingInstruction.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRect.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProgressEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7815,11 +8007,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRect.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProgressEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRGBColor.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRange.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7863,11 +8055,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRGBColor.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRange.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSScreen.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRangeException.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7911,11 +8103,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSScreen.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRangeException.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorker.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRect.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7959,11 +8151,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorker.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRect.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorkerContext.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRGBColor.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8007,11 +8199,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorkerContext.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRGBColor.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLError.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSScreen.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8055,11 +8247,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLError.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSScreen.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSet.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorker.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8103,11 +8295,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSet.h"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorker.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSetRowList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorkerContext.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8151,11 +8343,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSetRowList.h"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorkerContext.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSQLTransaction.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLError.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8199,11 +8391,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSQLTransaction.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLError.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorage.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSet.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8247,11 +8439,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorage.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSet.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorageEvent.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSetRowList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8295,11 +8487,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorageEvent.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSetRowList.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheet.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSQLTransaction.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8343,11 +8535,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheet.h"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSQLTransaction.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheetList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorage.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8391,11 +8583,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheetList.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorage.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorageEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8439,11 +8631,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorageEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAltGlyphElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheet.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8487,11 +8679,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAltGlyphElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheet.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAngle.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheetList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8535,11 +8727,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAngle.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheetList.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateColorElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8583,11 +8775,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateColorElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedAngle.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAltGlyphElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8631,11 +8823,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedAngle.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAltGlyphElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedBoolean.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAngle.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8679,11 +8871,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedBoolean.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAngle.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedEnumeration.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateColorElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8727,11 +8919,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedEnumeration.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateColorElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedInteger.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedAngle.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8775,11 +8967,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedInteger.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedAngle.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLength.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedBoolean.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8823,11 +9015,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLength.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedBoolean.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLengthList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedEnumeration.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8871,11 +9063,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLengthList.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedEnumeration.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumber.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedInteger.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8919,11 +9111,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumber.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedInteger.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumberList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLength.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8967,11 +9159,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumberList.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLength.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedPreserveAspectRatio.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLengthList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9015,11 +9207,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedPreserveAspectRatio.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLengthList.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedRect.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumber.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9063,11 +9255,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedRect.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumber.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedString.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumberList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9111,11 +9303,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedString.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumberList.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedTransformList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedPreserveAspectRatio.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9159,11 +9351,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedTransformList.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedPreserveAspectRatio.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedRect.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9207,11 +9399,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedRect.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateTransformElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedString.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9255,11 +9447,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateTransformElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedString.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimationElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedTransformList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9303,11 +9495,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimationElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedTransformList.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCircleElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9351,11 +9543,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCircleElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGClipPathElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateTransformElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9399,11 +9591,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGClipPathElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateTransformElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGColor.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimationElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9447,11 +9639,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGColor.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimationElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGComponentTransferFunctionElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCircleElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9495,11 +9687,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGComponentTransferFunctionElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCircleElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCursorElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGClipPathElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9543,11 +9735,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCursorElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGClipPathElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefinitionSrcElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGColor.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9591,11 +9783,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefinitionSrcElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGColor.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefsElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGComponentTransferFunctionElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9639,11 +9831,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefsElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGComponentTransferFunctionElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDescElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCursorElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9687,11 +9879,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDescElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCursorElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDocument.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefsElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9735,11 +9927,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDocument.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefsElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDescElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9783,11 +9975,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDescElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstance.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDocument.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9831,11 +10023,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstance.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDocument.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstanceList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9879,11 +10071,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstanceList.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementWrapperFactory.cpcpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstance.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9927,11 +10119,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementWrapperFactory.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstance.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementWrapperFactory.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstanceList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9975,6 +10167,14 @@
 				</FileConfiguration>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstanceList.h"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementWrapperFactory.cpp"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementWrapperFactory.h"

 				>

 			</File>

@@ -15163,7 +15363,7 @@
 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSVoidCallback.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15207,11 +15407,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSVoidCallback.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15255,11 +15455,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframesRule.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15303,11 +15503,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframesRule.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframesRule.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSMatrix.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15351,11 +15551,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframesRule.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSMatrix.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSMatrix.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSTransformValue.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15399,11 +15599,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSMatrix.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSTransformValue.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSTransformValue.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitPoint.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15447,11 +15647,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSTransformValue.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitPoint.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitPoint.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitTransitionEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15495,11 +15695,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitPoint.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitTransitionEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitTransitionEvent.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSWebSocket.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15543,7 +15743,7 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitTransitionEvent.h"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSWebSocket.h"

 				>

 			</File>

 			<File

@@ -16489,6 +16689,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\accessibility\AccessibilityMediaControls.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityMediaControls.h"

+				>

+			</File>

+			<File

 				RelativePath="..\accessibility\AccessibilityObject.cpp"

 				>

 			</File>

@@ -16649,10 +16857,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\page\Coordinates.cpp"

-				>

-			</File>

-			<File

 				RelativePath="..\page\Coordinates.h"

 				>

 			</File>

@@ -16717,6 +16921,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\EventSource.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\page\EventSource.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\FocusController.cpp"

 				>

 			</File>

@@ -16765,11 +16977,11 @@
 				>

 			</File>

 			<File

-				RelativePath="..\page\Geoposition.cpp"

+				RelativePath="..\page\Geoposition.h"

 				>

 			</File>

 			<File

-				RelativePath="..\page\Geoposition.h"

+				RelativePath="..\page\HaltablePlugin.h"

 				>

 			</File>

 			<File

@@ -16829,6 +17041,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\OriginAccessEntry.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\page\OriginAccessEntry.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\Page.cpp"

 				>

 			</File>

@@ -16853,6 +17073,18 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\PluginHalter.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\page\PluginHalter.h"

+				>

+			</File>

+			<File

+				RelativePath="..\page\PluginHalterClient.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\PositionCallback.h"

 				>

 			</File>

@@ -16892,6 +17124,30 @@
 				RelativePath="..\page\Settings.h"

 				>

 			</File>

+                        <File

+				RelativePath="..\page\UserContentURLPattern.cpp"

+				>

+			</File>

+                        <File

+				RelativePath="..\page\UserContentURLPattern.h"

+				>

+			</File>

+			<File

+				RelativePath="..\page\UserScript.h"

+				>

+			</File>

+			<File

+				RelativePath="..\page\UserScriptTypes.h"

+				>

+			</File>

+			<File

+				RelativePath="..\page\UserStyleSheet.h"

+				>

+			</File>

+			<File

+				RelativePath="..\page\UserStyleSheetTypes.h"

+				>

+			</File>

 			<File

 				RelativePath="..\page\WebKitPoint.h"

 				>

@@ -17233,6 +17489,22 @@
 				>

 			</File>

 			<File

+				RelativePath="..\loader\PolicyCallback.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\PolicyCallback.h"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\PolicyChecker.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\PolicyChecker.h"

+				>

+			</File>

+			<File

 				RelativePath="..\loader\ProgressTracker.cpp"

 				>

 			</File>

@@ -17241,6 +17513,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\loader\RedirectScheduler.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\RedirectScheduler.h"

+				>

+			</File>

+			<File

 				RelativePath="..\loader\Request.cpp"

 				>

 			</File>

@@ -18305,6 +18585,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\FontSmoothingMode.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\graphics\FontTraitsMask.h"

 					>

 				</File>

@@ -18389,6 +18673,34 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\ImageSource.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

 					RelativePath="..\platform\graphics\ImageSource.h"

 					>

 				</File>

@@ -19564,34 +19876,6 @@
 						</FileConfiguration>

 					</File>

 					<File

-						RelativePath="..\platform\graphics\cairo\ImageSourceCairo.cpp"

-						>

-						<FileConfiguration

-							Name="Debug|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-						<FileConfiguration

-							Name="Release|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-						<FileConfiguration

-							Name="Debug_Internal|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-					</File>

-					<File

 						RelativePath="..\platform\graphics\cairo\PathCairo.cpp"

 						>

 						<FileConfiguration

@@ -19781,6 +20065,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\network\CredentialStorage.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\CredentialStorage.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\network\FormData.cpp"

 					>

 				</File>

@@ -19829,6 +20121,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\network\ProtectionSpaceHash.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\network\ResourceErrorBase.cpp"

 					>

 				</File>

@@ -19868,6 +20164,26 @@
 					RelativePath="..\platform\network\ResourceResponseBase.h"

 					>

 				</File>

+				<File

+					RelativePath="..\platform\network\SocketStreamErrorBase.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\SocketStreamErrorBase.h"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\SocketStreamHandleBase.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\SocketStreamHandleBase.h"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\SocketStreamHandleClient.h"

+					>

+				</File>

 				<Filter

 					Name="cf"

 					>

@@ -20151,6 +20467,66 @@
 							/>

 						</FileConfiguration>

 					</File>

+					<File

+						RelativePath="..\platform\network\cf\SocketStreamError.h"

+						>

+						<FileConfiguration

+							Name="Debug_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

+					<File

+						RelativePath="..\platform\network\cf\SocketStreamHandle.h"

+						>

+						<FileConfiguration

+							Name="Debug_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

+					<File

+						RelativePath="..\platform\network\cf\SocketStreamHandleCFNet.cpp"

+						>

+						<FileConfiguration

+							Name="Debug_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

 				</Filter>

 				<Filter

 					Name="win"

@@ -20531,6 +20907,34 @@
 							/>

 						</FileConfiguration>

 					</File>

+					<File

+						RelativePath="..\platform\network\curl\SocketStreamHandleCurl.cpp"

+						>

+						<FileConfiguration

+							Name="Debug|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_Internal|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

 				</Filter>

 			</Filter>

 			<Filter

@@ -20869,6 +21273,34 @@
 				Name="image-decoders"

 				>

 				<File

+					RelativePath="..\platform\image-decoders\ImageDecoder.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

 					RelativePath="..\platform\image-decoders\ImageDecoder.h"

 					>

 					<FileConfiguration

@@ -21547,6 +21979,18 @@
 					>

 				</File>

 			</Filter>

+			<Filter

+				Name="mock"

+				>

+				<File

+					RelativePath="..\platform\mock\GeolocationServiceMock.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\mock\GeolocationServiceMock.h"

+					>

+				</File>

+			</Filter>

 		</Filter>

 		<Filter

 			Name="css"

@@ -23444,7 +23888,7 @@
 				>

 			</File>

 			<File

-				RelativePath="..\xml\XSLStyleSheet.cpp"

+				RelativePath="..\xml\XSLStyleSheetLibxslt.cpp"

 				>

 			</File>

 			<File

@@ -23464,6 +23908,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\xml\XSLTProcessorLibxslt.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\xml\XSLTProcessor.h"

 				>

 			</File>

@@ -23507,6 +23955,10 @@
 				RelativePath="..\dom\Attribute.h"

 				>

 			</File>

+                        <File

+				RelativePath="..\dom\BeforeLoadEvent.h"

+				>

+			</File>

 			<File

 				RelativePath="..\dom\BeforeTextInsertedEvent.cpp"

 				>

@@ -23632,10 +24084,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\dom\DocPtr.h"

-				>

-			</File>

-			<File

 				RelativePath="..\dom\Document.cpp"

 				>

 			</File>

@@ -23948,6 +24396,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\PageTransitionEvent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\PageTransitionEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\default\PlatformMessagePortChannel.cpp"

 				>

 			</File>

@@ -24104,6 +24560,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\TransformSourceLibxslt.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\TransformSource.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\Traversal.cpp"

 				>

 			</File>

@@ -24292,6 +24756,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\workers\WorkerReportingProxy.h"

+				>

+			</File>

+			<File

 				RelativePath="..\workers\WorkerRunLoop.cpp"

 				>

 			</File>

@@ -24321,6 +24789,34 @@
 			</File>

 		</Filter>

 		<Filter

+			Name="notifications"

+			>

+			<File

+				RelativePath="..\notifications\Notification.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\notifications\Notification.h"

+				>

+			</File>

+			<File

+				RelativePath="..\notifications\NotificationCenter.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\notifications\NotificationCenter.h"

+				>

+			</File>

+			<File

+				RelativePath="..\notifications\NotificationContents.h"

+				>

+			</File>

+			<File

+				RelativePath="..\notifications\NotificationPresenter.h"

+				>

+			</File>

+		</Filter>

+		<Filter

 			Name="editing"

 			>

 			<File

@@ -24736,6 +25232,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\canvas\CanvasRenderingContext.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\canvas\CanvasRenderingContext.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\canvas\CanvasRenderingContext2D.cpp"

 				>

 			</File>

@@ -25552,6 +26056,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\HTMLDataListElement.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLDataListElement.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\HTMLDirectoryElement.cpp"

 				>

 				<FileConfiguration

@@ -28451,6 +28963,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSCallbackData.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSCallbackData.h"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSAbstractWorkerCustom.cpp"

 					>

 				</File>

@@ -28471,6 +28991,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSCanvasRenderingContextCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSCDATASectionCustom.cpp"

 					>

 				</File>

@@ -28491,6 +29015,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSCSSRuleListCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSCSSStyleDeclarationCustom.cpp"

 					>

 				</File>

@@ -28575,6 +29103,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSDesktopNotificationsCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSDocumentCustom.cpp"

 					>

 				</File>

@@ -28643,6 +29175,18 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSEventSourceConstructor.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSEventSourceConstructor.h"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSEventSourceCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSEventTarget.cpp"

 					>

 				</File>

@@ -28671,6 +29215,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSHTMLCanvasElementCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSHTMLCollectionCustom.cpp"

 					>

 				</File>

@@ -28791,23 +29339,23 @@
 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSMessagePortCustom.cpp"

+					RelativePath="..\bindings\js\JSMessageEventCustom.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSMimeTypeArrayCustom.cpp"

+					RelativePath="..\bindings\js\JSMessagePortCustom.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSNamedNodeMapCustom.cpp"

+					RelativePath="..\bindings\js\JSMessagePortCustom.h"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSNamedNodesCollection.cpp"

+					RelativePath="..\bindings\js\JSMimeTypeArrayCustom.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSNamedNodesCollection.h"

+					RelativePath="..\bindings\js\JSNamedNodeMapCustom.cpp"

 					>

 				</File>

 				<File

@@ -28879,10 +29427,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSSharedWorkerContextCustom.cpp"

-					>

-				</File>

-				<File

 					RelativePath="..\bindings\js\JSSharedWorkerCustom.cpp"

 					>

 				</File>

@@ -28963,6 +29507,18 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSWebSocketConstructor.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSWebSocketConstructor.h"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSWebSocketCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSWorkerConstructor.cpp"

 					>

 				</File>

@@ -29131,6 +29687,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\SerializedScriptValue.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\SerializedScriptValue.h"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\StringSourceProvider.h"

 					>

 				</File>

@@ -29364,10 +29928,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGDefinitionSrcElement.h"

-				>

-			</File>

-			<File

 				RelativePath="..\svg\SVGDefsElement.h"

 				>

 			</File>

@@ -30596,6 +31156,22 @@
 				>

 			</File>

 			<File

+				RelativePath="..\storage\SQLTransactionClient.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\storage\SQLTransactionClient.h"

+				>

+			</File>

+			<File

+				RelativePath="..\storage\SQLTransactionCoordinator.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\storage\SQLTransactionCoordinator.h"

+				>

+			</File>

+			<File

 				RelativePath="..\storage\SQLTransactionErrorCallback.h"

 				>

 			</File>

@@ -30636,6 +31212,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\storage\StorageEventDispatcher.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\storage\StorageEventDispatcher.h"

+				>

+			</File>

+			<File

 				RelativePath="..\storage\StorageMap.cpp"

 				>

 			</File>

@@ -30800,6 +31384,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\DOMDispatchTimelineItem.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\DOMDispatchTimelineItem.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorBackend.cpp"

 				>

 			</File>

@@ -30860,6 +31452,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InspectorTimelineAgent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorTimelineAgent.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\JavaScriptCallFrame.cpp"

 				>

 			</File>

@@ -30895,6 +31495,14 @@
 				RelativePath="..\inspector\JavaScriptProfileNode.h"

 				>

 			</File>

+			<File

+				RelativePath="..\inspector\TimelineItem.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\TimelineItem.h"

+				>

+			</File>

 			<Filter

 				Name="front-end"

 				>

@@ -30939,10 +31547,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\DatabasesPanel.js"

-					>

-				</File>

-				<File

 					RelativePath="..\inspector\front-end\DatabaseTableView.js"

 					>

 				</File>

@@ -30975,6 +31579,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\ElementsTreeOutline.js"

+					>

+				</File>

+				<File

+					RelativePath="..\inspector\front-end\EventListenersSidebarPane.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\FontView.js"

 					>

 				</File>

@@ -30987,10 +31599,18 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\InjectedScriptAccess.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\inspector.css"

 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\inspectorSyntaxHighlight.css"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\inspector.html"

 					>

 				</File>

@@ -31027,6 +31647,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\Popup.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\ProfileDataGridTree.js"

 					>

 				</File>

@@ -31083,14 +31707,30 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\StatusBarButton.js"

+					>

+				</File>

+				<File

+					RelativePath="..\inspector\front-end\StoragePanel.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\StylesSidebarPane.js"

 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\SummaryBar.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\TextPrompt.js"

 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\TimelineAgent.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\TopDownProfileDataGridTree.js"

 					>

 				</File>

@@ -31106,6 +31746,10 @@
 					RelativePath="..\inspector\front-end\View.js"

 					>

 				</File>

+				<File

+					RelativePath="..\inspector\front-end\WatchExpressionsSidebarPane.js"

+					>

+				</File>

 			</Filter>

 		</Filter>

 		<Filter

@@ -31440,11 +32084,47 @@
 				>

 			</File>

 		</Filter>

+		<Filter

+			Name="websockets"

+			>

+			<File

+				RelativePath="..\websockets\WebSocket.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocket.h"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocketChannel.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocketChannel.h"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocketChannelClient.h"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocketHandshake.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocketHandshake.h"

+				>

+			</File>

+		</Filter>

 		<File

 			RelativePath="..\config.h"

 			>

 		</File>

 		<File

+			RelativePath="..\platform\graphics\TextRenderingMode.h"

+			>

+		</File>

+		<File

 			RelativePath="..\WebCorePrefix.cpp"

 			>

 			<FileConfiguration

diff --git a/WebCore/WebCore.vcproj/WebCoreCURL.vsprops b/WebCore/WebCore.vcproj/WebCoreCURL.vsprops
index aaadb97..4320e05 100644
--- a/WebCore/WebCore.vcproj/WebCoreCURL.vsprops
+++ b/WebCore/WebCore.vcproj/WebCoreCURL.vsprops
@@ -7,5 +7,6 @@
 	<Tool

 		Name="VCCLCompilerTool"

 		AdditionalIncludeDirectories="$(ProjectDir)..\platform\network\curl"

+		PreprocessorDefinitions="USE_WINDOWS_SSPI;USE_SSLEAY;HAVE_ZLIB"

 	/>

 </VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/WebCoreCairo.vsprops b/WebCore/WebCore.vcproj/WebCoreCairo.vsprops
index b1493d4..3531128 100644
--- a/WebCore/WebCore.vcproj/WebCoreCairo.vsprops
+++ b/WebCore/WebCore.vcproj/WebCoreCairo.vsprops
@@ -6,6 +6,6 @@
 	>

 	<Tool

 		Name="VCCLCompilerTool"

-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\platform\graphics\cairo&quot;;&quot;$(ProjectDir)..\svg\graphics\cairo&quot;;&quot;$(ProjectDir)..\platform\image-decoders&quot;;&quot;$(ProjectDir)..\platform\image-decoders\bmp&quot;;&quot;$(ProjectDir)..\platform\image-decoders\gif&quot;;&quot;$(ProjectDir)..\platform\image-decoders\ico&quot;;&quot;$(ProjectDir)..\platform\image-decoders\jpeg&quot;;&quot;$(ProjectDir)..\platform\image-decoders\png&quot;;&quot;$(ProjectDir)..\platform\image-decoders\xbm&quot;;&quot;$(ProjectDir)..\platform\image-decoders\zlib&quot;"

+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\platform\graphics\cairo&quot;;&quot;$(ProjectDir)..\svg\graphics\cairo&quot;;&quot;$(ProjectDir)..\platform\image-decoders&quot;;&quot;$(ProjectDir)..\platform\image-decoders\bmp&quot;;&quot;$(ProjectDir)..\platform\image-decoders\gif&quot;;&quot;$(ProjectDir)..\platform\image-decoders\ico&quot;;&quot;$(ProjectDir)..\platform\image-decoders\jpeg&quot;;&quot;$(ProjectDir)..\platform\image-decoders\png&quot;;&quot;$(ProjectDir)..\platform\image-decoders\xbm&quot;;&quot;$(ProjectDir)..\platform\image-decoders\zlib&quot;;&quot;$(WebKitLibrariesDir)\include\cairo&quot;"

 	/>

 </VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index 3dd37fc..6923c15 100644
--- a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -7,8 +7,8 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"
-		PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"
+		PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DATALIST;ENABLE_DOM_STORAGE;ENABLE_EVENTSOURCE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebCorePrefix.h"
 		ForcedIncludeFiles="WebCorePrefix.h"
@@ -19,6 +19,6 @@
 	/>
 	<Tool
 		Name="VCPreBuildEventTool"
-		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"
+		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"
 	/>
 </VisualStudioPropertySheet>
diff --git a/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj b/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
index a7e8f6f..73bde6c 100644
--- a/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
+++ b/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
@@ -1,48 +1,48 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="WebCoreGenerated"
-	ProjectGUID="{0A324352-B3B6-496C-9E5B-4C7E923E628B}"
-	Keyword="MakeFileProj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory="$(WebKitOutputDir)\lib"
-			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"
-			ConfigurationType="0"
-			>
-			<Tool
-				Name="VCNMakeTool"
-				BuildCommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot;&#x0D;&#x0A;bash migrate-idls.sh &quot;$(WebKitOutputDir)/obj/WebKit/DOMInterfaces&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DOMInterfaces&quot;&#x0D;&#x0A;set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot;&#x0D;&#x0A;bash migrate-idls.sh &quot;$(WebKitOutputDir)/obj/WebKit/DOMInterfaces&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-				CleanCommandLine="del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DOMInterfaces&quot;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-				Output=""
-				PreprocessorDefinitions=""
-				IncludeSearchPath=""
-				ForcedIncludes=""
-				AssemblySearchPath=""
-				ForcedUsingAssemblies=""
-				CompileAsManaged=""
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<File
-			RelativePath=".\build-generated-files.sh"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WebCoreGenerated"

+	ProjectGUID="{0A324352-B3B6-496C-9E5B-4C7E923E628B}"

+	Keyword="MakeFileProj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Release|Win32"

+			OutputDirectory="$(WebKitOutputDir)\lib"

+			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

+			ConfigurationType="0"

+			>

+			<Tool

+				Name="VCNMakeTool"

+				BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot;&#x0D;&#x0A;bash migrate-idls.sh &quot;$(WebKitOutputDir)/obj/WebKit/DOMInterfaces&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DOMInterfaces&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot;&#x0D;&#x0A;bash migrate-idls.sh &quot;$(WebKitOutputDir)/obj/WebKit/DOMInterfaces&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CleanCommandLine="del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DOMInterfaces&quot;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				Output=""

+				PreprocessorDefinitions=""

+				IncludeSearchPath=""

+				ForcedIncludes=""

+				AssemblySearchPath=""

+				ForcedUsingAssemblies=""

+				CompileAsManaged=""

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<File

+			RelativePath=".\build-generated-files.sh"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/WebCore/WebCore.vcproj/build-generated-files.sh b/WebCore/WebCore.vcproj/build-generated-files.sh
index e4cbd45..06b3c6d 100644
--- a/WebCore/WebCore.vcproj/build-generated-files.sh
+++ b/WebCore/WebCore.vcproj/build-generated-files.sh
@@ -55,21 +55,9 @@ export SDKROOT
 
 export BUILT_PRODUCTS_DIR="$XDSTROOT/obj/WebCore"
 
-if [ -e "$XDSTROOT/include/JavaScriptCore/create_hash_table" ]; then
-    export CREATE_HASH_TABLE="$XDSTROOT/include/JavaScriptCore/create_hash_table"
-elif [ -e "$XDSTROOT/include/private/JavaScriptCore/create_hash_table" ]; then
-    export CREATE_HASH_TABLE="$XDSTROOT/include/private/JavaScriptCore/create_hash_table"
-elif [ -e "$SDKROOT/include/JavaScriptCore/create_hash_table" ]; then
-    export CREATE_HASH_TABLE="$SDKROOT/include/JavaScriptCore/create_hash_table"
-elif [ -e "$SDKROOT/include/private/JavaScriptCore/create_hash_table" ]; then
-    export CREATE_HASH_TABLE="$SDKROOT/include/private/JavaScriptCore/create_hash_table"
-fi
-
-echo ${CREATE_HASH_TABLE}
-
 mkdir -p "${BUILT_PRODUCTS_DIR}/DerivedSources"
 cd "${BUILT_PRODUCTS_DIR}/DerivedSources"
 
 export WebCore="${XSRCROOT}"
-export FEATURE_DEFINES="ENABLE_CHANNEL_MESSAGING ENABLE_DATABASE ENABLE_DATAGRID ENABLE_DOM_STORAGE ENABLE_ICONDATABASE ENABLE_JAVASCRIPT_DEBUGGER ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_RUBY ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WEB_SOCKETS ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT"
+export FEATURE_DEFINES="ENABLE_CHANNEL_MESSAGING ENABLE_DATABASE ENABLE_DATAGRID ENABLE_DATALIST ENABLE_DOM_STORAGE ENABLE_EVENTSOURCE ENABLE_ICONDATABASE ENABLE_JAVASCRIPT_DEBUGGER ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_RUBY ENABLE_SHARED_WORKERS ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WEB_SOCKETS ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT"
 make -f "$WebCore/DerivedSources.make" -j ${NUMCPUS} || exit 1
diff --git a/WebCore/WebCore.xcodeproj/project.pbxproj b/WebCore/WebCore.xcodeproj/project.pbxproj
index 50e6a2a..01db8ea 100644
--- a/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -21,6 +21,8 @@
 /* End PBXAggregateTarget section */
 
 /* Begin PBXBuildFile section */
+		0014628A103CD1DE000B20DB /* OriginAccessEntry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */; };
+		0014628B103CD1DE000B20DB /* OriginAccessEntry.h in Headers */ = {isa = PBXBuildFile; fileRef = 00146289103CD1DE000B20DB /* OriginAccessEntry.h */; };
 		06027CAD0B1CBFC000884B2D /* ContextMenuItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 06027CAC0B1CBFC000884B2D /* ContextMenuItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		06027CB30B1CC03D00884B2D /* ContextMenuItemMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 06027CB20B1CC03D00884B2D /* ContextMenuItemMac.mm */; };
 		062287840B4DB322000C34DF /* FocusDirection.h in Headers */ = {isa = PBXBuildFile; fileRef = 062287830B4DB322000C34DF /* FocusDirection.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -38,6 +40,8 @@
 		0709FC4C1025DED80059CDBA /* AccessibilitySlider.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0709FC4B1025DED80059CDBA /* AccessibilitySlider.cpp */; };
 		0709FC4E1025DEE30059CDBA /* AccessibilitySlider.h in Headers */ = {isa = PBXBuildFile; fileRef = 0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */; };
 		0735EE6A0F40C5E4004A2604 /* MediaPlayerProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		07B0113D1032241900FBDC33 /* AccessibilityMediaControls.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 07B0113C1032241900FBDC33 /* AccessibilityMediaControls.cpp */; };
+		07B0113F1032242200FBDC33 /* AccessibilityMediaControls.h in Headers */ = {isa = PBXBuildFile; fileRef = 07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */; };
 		080081960ED3B2DD00C53BC0 /* WMLAnchorElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 080081940ED3B2DD00C53BC0 /* WMLAnchorElement.cpp */; };
 		080081970ED3B2DD00C53BC0 /* WMLAnchorElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 080081950ED3B2DD00C53BC0 /* WMLAnchorElement.h */; };
 		0804BF6E0EE09C3B0006C000 /* WMLDoElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0804BF6C0EE09C3B0006C000 /* WMLDoElement.cpp */; };
@@ -193,6 +197,8 @@
 		142011B70A003133008303F9 /* JSCSSStyleDeclaration.h in Headers */ = {isa = PBXBuildFile; fileRef = 142011B50A003133008303F9 /* JSCSSStyleDeclaration.h */; };
 		1432E8470C51493800B1500F /* GCController.h in Headers */ = {isa = PBXBuildFile; fileRef = 1432E8460C51493800B1500F /* GCController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1432E8490C51493F00B1500F /* GCController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1432E8480C51493F00B1500F /* GCController.cpp */; };
+		1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */ = {isa = PBXBuildFile; fileRef = 1449E24A107D4A8400B5793F /* JSCallbackData.h */; };
+		1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1449E286107D4DB400B5793F /* JSCallbackData.cpp */; };
 		1477E7760BF4134A00152872 /* PageCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1477E7740BF4134A00152872 /* PageCache.cpp */; };
 		1477E7770BF4134A00152872 /* PageCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1477E7750BF4134A00152872 /* PageCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		148AFDA50AF58360008CC700 /* ExceptionHandlers.h in Headers */ = {isa = PBXBuildFile; fileRef = 148AFDA30AF58360008CC700 /* ExceptionHandlers.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -200,6 +206,7 @@
 		14993BE50B2F2B1C0050497F /* FocusController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14993BE30B2F2B1C0050497F /* FocusController.cpp */; };
 		14993BE60B2F2B1C0050497F /* FocusController.h in Headers */ = {isa = PBXBuildFile; fileRef = 14993BE40B2F2B1C0050497F /* FocusController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14C9A5EA0B3D105F005A0232 /* Settings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14C9A5E90B3D105F005A0232 /* Settings.cpp */; };
+		14CD8D82106B529000A46D23 /* JSSharedWorkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */; };
 		14CF78A409F58CBF00EB3665 /* JSCSSValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14CF78A309F58CBF00EB3665 /* JSCSSValue.cpp */; };
 		14CF78A609F58CD800EB3665 /* JSCSSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 14CF78A509F58CD800EB3665 /* JSCSSValue.h */; };
 		14CF7B3309F6ECD700EB3665 /* JSCSSRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14CF7B3109F6ECD700EB3665 /* JSCSSRule.cpp */; };
@@ -364,7 +371,6 @@
 		1A8F6BC50DB55CDC001DB794 /* ManifestParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A8F6BBA0DB55CDC001DB794 /* ManifestParser.cpp */; };
 		1A8F6BC60DB55CDC001DB794 /* ManifestParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BBB0DB55CDC001DB794 /* ManifestParser.h */; };
 		1A98956B0AA78F80005EF5EF /* KURLCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A98956A0AA78F80005EF5EF /* KURLCFNet.cpp */; };
-		1A9EF4570A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A9EF4560A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp */; };
 		1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 1AB1AE780C051FDE00139F4F /* zoomInCursor.png */; };
 		1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 1AB1AE790C051FDE00139F4F /* zoomOutCursor.png */; };
 		1AB7FC680A8B92EC00D9D37B /* XPathEvaluator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AB7FC470A8B92EC00D9D37B /* XPathEvaluator.cpp */; };
@@ -463,7 +469,6 @@
 		1AE82F900CAAFA9D002237AE /* JSDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AE82F8E0CAAFA9D002237AE /* JSDatabase.h */; };
 		1AE82FEC0CAB07EE002237AE /* JSSQLResultSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AE82FEA0CAB07EE002237AE /* JSSQLResultSet.cpp */; };
 		1AE82FED0CAB07EE002237AE /* JSSQLResultSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AE82FEB0CAB07EE002237AE /* JSSQLResultSet.h */; };
-		1AE830440CAB0ED1002237AE /* JSDatabaseCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AE830420CAB0ED1002237AE /* JSDatabaseCustom.cpp */; };
 		1AF326790D78B9440068F0C4 /* EditorClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF326770D78B9440068F0C4 /* EditorClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AFE117D0CBFFB36003017FA /* SQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */; };
 		1AFE117E0CBFFB36003017FA /* SQLResultSetRowList.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */; };
@@ -548,7 +553,6 @@
 		29A812310FBB9C1D00510293 /* AccessibilityTableRow.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812130FBB9C1D00510293 /* AccessibilityTableRow.h */; };
 		29A812320FBB9C1D00510293 /* AccessibilityTableCell.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812140FBB9C1D00510293 /* AccessibilityTableCell.h */; };
 		29A812330FBB9C1D00510293 /* AccessibilityARIAGridRow.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812150FBB9C1D00510293 /* AccessibilityARIAGridRow.h */; };
-		29A812340FBB9C1D00510293 /* AccessibilityARIAGrid.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812160FBB9C1D00510293 /* AccessibilityARIAGrid.h */; };
 		29A812350FBB9C1D00510293 /* AccessibilityTableColumn.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812170FBB9C1D00510293 /* AccessibilityTableColumn.cpp */; };
 		29A812360FBB9C1D00510293 /* AccessibilityObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812180FBB9C1D00510293 /* AccessibilityObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		29A812370FBB9C1D00510293 /* AXObjectCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812190FBB9C1D00510293 /* AXObjectCache.cpp */; };
@@ -582,9 +586,9 @@
 		2E4346500F546A8200B0F1BA /* WorkerMessagingProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E43463E0F546A8200B0F1BA /* WorkerMessagingProxy.h */; };
 		2E4346510F546A8200B0F1BA /* WorkerObjectProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E43463F0F546A8200B0F1BA /* WorkerObjectProxy.h */; };
 		2E4346520F546A8200B0F1BA /* WorkerRunLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2E4346400F546A8200B0F1BA /* WorkerRunLoop.cpp */; };
-		2E4346530F546A8200B0F1BA /* WorkerRunLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346410F546A8200B0F1BA /* WorkerRunLoop.h */; };
+		2E4346530F546A8200B0F1BA /* WorkerRunLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346410F546A8200B0F1BA /* WorkerRunLoop.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		2E4346540F546A8200B0F1BA /* WorkerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2E4346420F546A8200B0F1BA /* WorkerThread.cpp */; };
-		2E4346550F546A8200B0F1BA /* WorkerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346430F546A8200B0F1BA /* WorkerThread.h */; };
+		2E4346550F546A8200B0F1BA /* WorkerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346430F546A8200B0F1BA /* WorkerThread.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		2E4346580F546A9900B0F1BA /* CrossThreadCopier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2E4346560F546A9900B0F1BA /* CrossThreadCopier.cpp */; };
 		2E4346590F546A9900B0F1BA /* CrossThreadCopier.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346570F546A9900B0F1BA /* CrossThreadCopier.h */; };
 		2EA768040FE7126400AB9C8A /* WorkerScriptLoaderClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 2EA768030FE7126400AB9C8A /* WorkerScriptLoaderClient.h */; };
@@ -635,6 +639,16 @@
 		31C0FF4C0E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 31C0FF460E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.h */; };
 		31C0FF4D0E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 31C0FF470E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm */; };
 		31C0FF4E0E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 31C0FF480E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h */; };
+		33503C9A10179A74003B47E1 /* NotificationPresenter.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503C9910179A74003B47E1 /* NotificationPresenter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		33503CA310179AD7003B47E1 /* JSNotification.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503C9F10179AD7003B47E1 /* JSNotification.cpp */; };
+		33503CA410179AD7003B47E1 /* JSNotification.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503CA010179AD7003B47E1 /* JSNotification.h */; };
+		33503CA510179AD7003B47E1 /* JSNotificationCenter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */; };
+		33503CA610179AD7003B47E1 /* JSNotificationCenter.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503CA210179AD7003B47E1 /* JSNotificationCenter.h */; };
+		33503CC010179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503CBF10179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp */; };
+		33503CC71017A1B1003B47E1 /* Notification.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503CC61017A1B1003B47E1 /* Notification.cpp */; };
+		3390CA550FFC157B00921962 /* NotificationCenter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3390CA510FFC157B00921962 /* NotificationCenter.cpp */; };
+		3390CA560FFC157B00921962 /* NotificationCenter.h in Headers */ = {isa = PBXBuildFile; fileRef = 3390CA520FFC157B00921962 /* NotificationCenter.h */; };
+		3390CA580FFC157B00921962 /* NotificationContents.h in Headers */ = {isa = PBXBuildFile; fileRef = 3390CA540FFC157B00921962 /* NotificationContents.h */; };
 		371F4F400D25B9AF00ECE0D5 /* FontData.h in Headers */ = {isa = PBXBuildFile; fileRef = 371F4F3E0D25B9AF00ECE0D5 /* FontData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		371F4F410D25B9AF00ECE0D5 /* FontData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 371F4F3F0D25B9AF00ECE0D5 /* FontData.cpp */; };
 		371F4FFC0D25E7F300ECE0D5 /* SegmentedFontData.h in Headers */ = {isa = PBXBuildFile; fileRef = 371F4FFA0D25E7F300ECE0D5 /* SegmentedFontData.h */; };
@@ -643,6 +657,7 @@
 		371F51A20D262FA000ECE0D5 /* CSSSegmentedFontFace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 371F51A00D262FA000ECE0D5 /* CSSSegmentedFontFace.cpp */; };
 		371F53E90D2704F900ECE0D5 /* CSSUnicodeRangeValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 371F53E70D2704F900ECE0D5 /* CSSUnicodeRangeValue.h */; };
 		371F53EA0D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 371F53E80D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp */; };
+		37202199106213C600F25C4B /* FontSmoothingMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 37202198106213C600F25C4B /* FontSmoothingMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3724CA570E68A7E400DB4384 /* CoreTextController.h in Headers */ = {isa = PBXBuildFile; fileRef = 3724CA540E68A7E400DB4384 /* CoreTextController.h */; };
 		3724CA580E68A7E400DB4384 /* CoreTextController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA550E68A7E400DB4384 /* CoreTextController.cpp */; };
 		3724CA590E68A7E400DB4384 /* FontMacATSUI.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */; };
@@ -660,13 +675,13 @@
 		37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */; };
 		41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */; };
 		41002CCE0F66EDEF009E660D /* ScriptFunctionCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */; };
+		410B7E721045FAB000D8224F /* JSMessageEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 410B7E711045FAB000D8224F /* JSMessageEventCustom.cpp */; };
 		411046410FA222A600BA436A /* ScriptEventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 4110463F0FA222A600BA436A /* ScriptEventListener.h */; };
 		411046420FA222A600BA436A /* ScriptEventListener.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 411046400FA222A600BA436A /* ScriptEventListener.cpp */; };
 		4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */; };
 		412A68470F6B03DD000EA66E /* ScriptObjectQuarantine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */; };
 		415B7C570FF598E6006770F7 /* JSAbstractWorkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */; };
 		415B7C580FF598E6006770F7 /* JSSharedWorkerConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */; };
-		415B7C590FF598E6006770F7 /* JSSharedWorkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 415B7C560FF598E6006770F7 /* JSSharedWorkerCustom.cpp */; };
 		415B7C630FF5A767006770F7 /* JSSharedWorkerConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */; };
 		4162A450101145AE00DFF3ED /* DedicatedWorkerContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4162A44D101145AE00DFF3ED /* DedicatedWorkerContext.cpp */; };
 		4162A451101145AE00DFF3ED /* DedicatedWorkerContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 4162A44E101145AE00DFF3ED /* DedicatedWorkerContext.h */; };
@@ -675,6 +690,7 @@
 		4162A4581011464700DFF3ED /* JSDedicatedWorkerContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 4162A4561011464700DFF3ED /* JSDedicatedWorkerContext.h */; };
 		4167EBF5102962BA003D252A /* DefaultSharedWorkerRepository.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4167EBF3102962BA003D252A /* DefaultSharedWorkerRepository.cpp */; };
 		4167EBF6102962BA003D252A /* DefaultSharedWorkerRepository.h in Headers */ = {isa = PBXBuildFile; fileRef = 4167EBF4102962BA003D252A /* DefaultSharedWorkerRepository.h */; };
+		416E29A6102FA962007FC14E /* WorkerReportingProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 416E29A5102FA962007FC14E /* WorkerReportingProxy.h */; };
 		416E75BE0EDF8FD700360E1D /* ScriptCallStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 416E75BC0EDF8FD700360E1D /* ScriptCallStack.h */; };
 		416E75BF0EDF8FD700360E1D /* ScriptCallStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416E75BD0EDF8FD700360E1D /* ScriptCallStack.cpp */; };
 		416E75CB0EDF90C700360E1D /* ScriptCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 416E75C90EDF90C700360E1D /* ScriptCallFrame.h */; };
@@ -686,7 +702,7 @@
 		41A3D58E101C152D00316D07 /* DedicatedWorkerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41A3D58C101C152D00316D07 /* DedicatedWorkerThread.cpp */; };
 		41A3D58F101C152D00316D07 /* DedicatedWorkerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 41A3D58D101C152D00316D07 /* DedicatedWorkerThread.h */; };
 		41BF700B0FE86F49005E8DEC /* MessagePortChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41BF70090FE86F49005E8DEC /* MessagePortChannel.cpp */; };
-		41BF700C0FE86F49005E8DEC /* MessagePortChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 41BF700A0FE86F49005E8DEC /* MessagePortChannel.h */; };
+		41BF700C0FE86F49005E8DEC /* MessagePortChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 41BF700A0FE86F49005E8DEC /* MessagePortChannel.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41BF700F0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41BF700D0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp */; };
 		41BF70100FE86F61005E8DEC /* PlatformMessagePortChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 41BF700E0FE86F61005E8DEC /* PlatformMessagePortChannel.h */; };
 		41C760B10EDE03D300C1655F /* ScriptState.h in Headers */ = {isa = PBXBuildFile; fileRef = 41C760B00EDE03D300C1655F /* ScriptState.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -699,7 +715,6 @@
 		41D168EA10226E89009BC827 /* SharedWorkerRepository.h in Headers */ = {isa = PBXBuildFile; fileRef = 41D168E210226E89009BC827 /* SharedWorkerRepository.h */; };
 		41D168ED10226E89009BC827 /* SharedWorkerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41D168E510226E89009BC827 /* SharedWorkerThread.cpp */; };
 		41D168EE10226E89009BC827 /* SharedWorkerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 41D168E610226E89009BC827 /* SharedWorkerThread.h */; };
-		41D168F010226EC4009BC827 /* JSSharedWorkerContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41D168EF10226EC4009BC827 /* JSSharedWorkerContextCustom.cpp */; };
 		41D1690510238B66009BC827 /* JSSharedWorkerContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41D1690310238B66009BC827 /* JSSharedWorkerContext.cpp */; };
 		41D1690610238B66009BC827 /* JSSharedWorkerContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 41D1690410238B66009BC827 /* JSSharedWorkerContext.h */; };
 		41E1B1D00FF5986900576B3B /* AbstractWorker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41E1B1CA0FF5986900576B3B /* AbstractWorker.cpp */; };
@@ -720,6 +735,7 @@
 		41F066E50F64BCF600A07EAC /* ScriptObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41F066E30F64BCF600A07EAC /* ScriptObject.cpp */; };
 		41F1D21F0EF35C2A00DA8753 /* ScriptCachedFrameData.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F1D21D0EF35C2A00DA8753 /* ScriptCachedFrameData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41F1D2200EF35C2A00DA8753 /* ScriptCachedFrameData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41F1D21E0EF35C2A00DA8753 /* ScriptCachedFrameData.cpp */; };
+		41F584C7104652CB009CAA64 /* JSMessagePortCustom.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F584C6104652CB009CAA64 /* JSMessagePortCustom.h */; };
 		4415292E0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4415292C0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h */; };
 		4415292F0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4415292D0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp */; };
 		441B055C0CD77A2D007C1F18 /* DOMHTMLEmbedElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 4429AAFB0CB84E88007647C5 /* DOMHTMLEmbedElementPrivate.h */; };
@@ -744,16 +760,12 @@
 		46F9D5DF0B0D60170028EE36 /* progressCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DC0B0D60170028EE36 /* progressCursor.png */; };
 		49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */; };
 		49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FB4102CF23C00187DD3 /* CanvasGradient.h */; };
-		49484FC3102CF23C00187DD3 /* CanvasGradient.idl in Resources */ = {isa = PBXBuildFile; fileRef = 49484FB5102CF23C00187DD3 /* CanvasGradient.idl */; };
 		49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */; };
 		49484FC5102CF23C00187DD3 /* CanvasPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FB7102CF23C00187DD3 /* CanvasPattern.h */; };
-		49484FC6102CF23C00187DD3 /* CanvasPattern.idl in Resources */ = {isa = PBXBuildFile; fileRef = 49484FB8102CF23C00187DD3 /* CanvasPattern.idl */; };
 		49484FC7102CF23C00187DD3 /* CanvasPixelArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB9102CF23C00187DD3 /* CanvasPixelArray.cpp */; };
 		49484FC8102CF23C00187DD3 /* CanvasPixelArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FBA102CF23C00187DD3 /* CanvasPixelArray.h */; };
-		49484FC9102CF23C00187DD3 /* CanvasPixelArray.idl in Resources */ = {isa = PBXBuildFile; fileRef = 49484FBB102CF23C00187DD3 /* CanvasPixelArray.idl */; };
 		49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FBC102CF23C00187DD3 /* CanvasRenderingContext2D.cpp */; };
 		49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FBD102CF23C00187DD3 /* CanvasRenderingContext2D.h */; };
-		49484FCC102CF23C00187DD3 /* CanvasRenderingContext2D.idl in Resources */ = {isa = PBXBuildFile; fileRef = 49484FBE102CF23C00187DD3 /* CanvasRenderingContext2D.idl */; };
 		49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FBF102CF23C00187DD3 /* CanvasStyle.cpp */; };
 		49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FC0102CF23C00187DD3 /* CanvasStyle.h */; };
 		494BD7950F55C8EE00747828 /* WebKitPoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 494BD7930F55C8EE00747828 /* WebKitPoint.h */; };
@@ -770,6 +782,46 @@
 		498391590F1E776900C23782 /* WebKitCSSMatrix.h in Headers */ = {isa = PBXBuildFile; fileRef = 498391560F1E776900C23782 /* WebKitCSSMatrix.h */; };
 		498391630F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */; };
 		498391640F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */; };
+		49C7B9931042D2D30009D447 /* JSCanvasBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */; };
+		49C7B9941042D2D30009D447 /* JSCanvasBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */; };
+		49C7B9951042D2D30009D447 /* JSCanvasByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */; };
+		49C7B9961042D2D30009D447 /* JSCanvasByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */; };
+		49C7B9971042D2D30009D447 /* JSCanvasFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */; };
+		49C7B9981042D2D30009D447 /* JSCanvasFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */; };
+		49C7B99B1042D2D30009D447 /* JSCanvasProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */; };
+		49C7B99C1042D2D30009D447 /* JSCanvasProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9891042D2D30009D447 /* JSCanvasProgram.h */; };
+		49C7B99D1042D2D30009D447 /* JSCanvasRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */; };
+		49C7B99E1042D2D30009D447 /* JSCanvasRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */; };
+		49C7B9A21042D2D30009D447 /* JSCanvasShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */; };
+		49C7B9A31042D2D30009D447 /* JSCanvasShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9901042D2D30009D447 /* JSCanvasShader.h */; };
+		49C7B9A41042D2D30009D447 /* JSCanvasTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */; };
+		49C7B9A51042D2D30009D447 /* JSCanvasTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9921042D2D30009D447 /* JSCanvasTexture.h */; };
+		49C7B9C81042D32F0009D447 /* CanvasBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */; };
+		49C7B9C91042D32F0009D447 /* CanvasBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9A91042D32E0009D447 /* CanvasBuffer.h */; };
+		49C7B9CB1042D32F0009D447 /* CanvasByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */; };
+		49C7B9CC1042D32F0009D447 /* CanvasByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */; };
+		49C7B9CE1042D32F0009D447 /* CanvasFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */; };
+		49C7B9CF1042D32F0009D447 /* CanvasFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */; };
+		49C7B9D41042D32F0009D447 /* CanvasObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B41042D32F0009D447 /* CanvasObject.cpp */; };
+		49C7B9D51042D32F0009D447 /* CanvasObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9B51042D32F0009D447 /* CanvasObject.h */; };
+		49C7B9D61042D32F0009D447 /* CanvasProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */; };
+		49C7B9D71042D32F0009D447 /* CanvasProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9B71042D32F0009D447 /* CanvasProgram.h */; };
+		49C7B9D91042D32F0009D447 /* CanvasRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */; };
+		49C7B9DA1042D32F0009D447 /* CanvasRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */; };
+		49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */; };
+		49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */; };
+		49C7B9DF1042D32F0009D447 /* CanvasRenderingContext3D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */; };
+		49C7B9E01042D32F0009D447 /* CanvasRenderingContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */; };
+		49C7B9E21042D32F0009D447 /* CanvasShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C21042D32F0009D447 /* CanvasShader.cpp */; };
+		49C7B9E31042D32F0009D447 /* CanvasShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C31042D32F0009D447 /* CanvasShader.h */; };
+		49C7B9E51042D32F0009D447 /* CanvasTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */; };
+		49C7B9E61042D32F0009D447 /* CanvasTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C61042D32F0009D447 /* CanvasTexture.h */; };
+		49C7B9FC1042D3650009D447 /* GraphicsContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		49C7BA001042D38C0009D447 /* Canvas3DLayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9FD1042D38C0009D447 /* Canvas3DLayer.h */; };
+		49C7BA011042D38C0009D447 /* Canvas3DLayer.mm in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */; };
+		49C7BA021042D38C0009D447 /* GraphicsContext3DMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9FF1042D38C0009D447 /* GraphicsContext3DMac.cpp */; };
+		49C7BA791042EFAE0009D447 /* OpenGL.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 49C7BA781042EFAE0009D447 /* OpenGL.framework */; };
+		49C7BA8D1042F5B10009D447 /* JSDocumentCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7BA8C1042F5B10009D447 /* JSDocumentCustom.cpp */; };
 		49D5DC2B0F423A73008F20FD /* Matrix3DTransformOperation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49D5DC270F423A73008F20FD /* Matrix3DTransformOperation.cpp */; };
 		49D5DC2C0F423A73008F20FD /* Matrix3DTransformOperation.h in Headers */ = {isa = PBXBuildFile; fileRef = 49D5DC280F423A73008F20FD /* Matrix3DTransformOperation.h */; };
 		49D5DC2D0F423A73008F20FD /* PerspectiveTransformOperation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49D5DC290F423A73008F20FD /* PerspectiveTransformOperation.cpp */; };
@@ -795,6 +847,70 @@
 		49E912AC0EFAC906009D0CAF /* AnimationList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49E912A70EFAC906009D0CAF /* AnimationList.cpp */; };
 		49E912AD0EFAC906009D0CAF /* AnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A80EFAC906009D0CAF /* AnimationList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49E912AE0EFAC906009D0CAF /* TimingFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A90EFAC906009D0CAF /* TimingFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		49EECDDF10503C2400099FAB /* CanvasArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDC710503C2300099FAB /* CanvasArray.cpp */; };
+		49EECDE010503C2400099FAB /* CanvasArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDC810503C2300099FAB /* CanvasArray.h */; };
+		49EECDE210503C2400099FAB /* CanvasArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */; };
+		49EECDE310503C2400099FAB /* CanvasArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */; };
+		49EECDE510503C2400099FAB /* CanvasFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */; };
+		49EECDE610503C2400099FAB /* CanvasFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCE10503C2300099FAB /* CanvasFloatArray.h */; };
+		49EECDE810503C2400099FAB /* CanvasIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD010503C2300099FAB /* CanvasIntArray.cpp */; };
+		49EECDE910503C2400099FAB /* CanvasIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD110503C2300099FAB /* CanvasIntArray.h */; };
+		49EECDEB10503C2400099FAB /* CanvasShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD310503C2300099FAB /* CanvasShortArray.cpp */; };
+		49EECDEC10503C2400099FAB /* CanvasShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD410503C2300099FAB /* CanvasShortArray.h */; };
+		49EECDEE10503C2400099FAB /* CanvasUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */; };
+		49EECDEF10503C2400099FAB /* CanvasUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */; };
+		49EECDF110503C2400099FAB /* CanvasUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */; };
+		49EECDF210503C2400099FAB /* CanvasUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */; };
+		49EECDF410503C2400099FAB /* CanvasUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */; };
+		49EECDF510503C2400099FAB /* CanvasUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */; };
+		49EECF00105070C400099FAB /* JSCanvasArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */; };
+		49EECF01105070C400099FAB /* JSCanvasArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */; };
+		49EECF02105070C400099FAB /* JSCanvasFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */; };
+		49EECF03105070C400099FAB /* JSCanvasFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */; };
+		49EECF04105070C400099FAB /* JSCanvasIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */; };
+		49EECF05105070C400099FAB /* JSCanvasIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF7105070C400099FAB /* JSCanvasIntArray.h */; };
+		49EECF06105070C400099FAB /* JSCanvasShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */; };
+		49EECF07105070C400099FAB /* JSCanvasShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF9105070C400099FAB /* JSCanvasShortArray.h */; };
+		49EECF08105070C400099FAB /* JSCanvasUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */; };
+		49EECF09105070C400099FAB /* JSCanvasUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */; };
+		49EECF0A105070C400099FAB /* JSCanvasUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */; };
+		49EECF0B105070C400099FAB /* JSCanvasUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */; };
+		49EECF0C105070C400099FAB /* JSCanvasUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */; };
+		49EECF0D105070C400099FAB /* JSCanvasUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */; };
+		49EECF1B105072F300099FAB /* JSCanvasArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF19105072F300099FAB /* JSCanvasArray.cpp */; };
+		49EECF1C105072F300099FAB /* JSCanvasArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF1A105072F300099FAB /* JSCanvasArray.h */; };
+		49EECF7810508D9C00099FAB /* JSCanvasByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */; };
+		49EECF7910508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */; };
+		49EECF7A10508D9C00099FAB /* JSCanvasIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */; };
+		49EECF7B10508D9C00099FAB /* JSCanvasShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */; };
+		49EECF7C10508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */; };
+		49EECF7D10508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */; };
+		49EECF7E10508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */; };
+		49EECFAB1050938200099FAB /* JSCanvasArrayBufferConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */; };
+		49EECFAC1050938200099FAB /* JSCanvasArrayBufferConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */; };
+		49EECFAD1050938200099FAB /* JSCanvasByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */; };
+		49EECFAE1050938200099FAB /* JSCanvasByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */; };
+		49EECFAF1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */; };
+		49EECFB01050938200099FAB /* JSCanvasFloatArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */; };
+		49EECFB11050938200099FAB /* JSCanvasIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */; };
+		49EECFB21050938200099FAB /* JSCanvasIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */; };
+		49EECFB51050938200099FAB /* JSCanvasShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */; };
+		49EECFB61050938200099FAB /* JSCanvasShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */; };
+		49EECFB71050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */; };
+		49EECFB81050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */; };
+		49EECFB91050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */; };
+		49EECFBA1050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */; };
+		49EECFBB1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */; };
+		49EECFBC1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */; };
+		49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */; };
+		49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */; };
+		49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */; };
+		49EED1451051969400099FAB /* JSCanvasRenderingContext2D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */; };
+		49EED1461051969400099FAB /* JSCanvasRenderingContext3D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */; };
+		49EED1471051969400099FAB /* JSCanvasRenderingContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */; };
+		49EED14E1051971A00099FAB /* JSCanvasRenderingContext2DCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */; };
+		49EED14F1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */; };
+		49EED1501051971A00099FAB /* JSCanvasRenderingContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */; };
 		4A8C96EB0BE69032004EEFF0 /* SelectionControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4A8C96EA0BE69032004EEFF0 /* SelectionControllerMac.mm */; };
 		4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B2708C50AF19EE40065127F /* Pasteboard.h */; };
 		4B2709830AF2E5E00065127F /* PasteboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4B2709810AF2E5E00065127F /* PasteboardMac.mm */; };
@@ -819,6 +935,14 @@
 		4E19592E0A39DACC00220FE5 /* MediaQueryExp.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959280A39DACC00220FE5 /* MediaQueryExp.h */; };
 		510184690B08602A004A825F /* CachedPage.h in Headers */ = {isa = PBXBuildFile; fileRef = 510184670B08602A004A825F /* CachedPage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5101846A0B08602A004A825F /* CachedPage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510184680B08602A004A825F /* CachedPage.cpp */; };
+		510D4A33103165EE0049EA54 /* SocketStreamErrorBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510D4A2D103165EE0049EA54 /* SocketStreamErrorBase.cpp */; };
+		510D4A34103165EE0049EA54 /* SocketStreamErrorBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A2E103165EE0049EA54 /* SocketStreamErrorBase.h */; };
+		510D4A36103165EE0049EA54 /* SocketStreamHandleBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510D4A30103165EE0049EA54 /* SocketStreamHandleBase.cpp */; };
+		510D4A37103165EE0049EA54 /* SocketStreamHandleBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A31103165EE0049EA54 /* SocketStreamHandleBase.h */; };
+		510D4A38103165EE0049EA54 /* SocketStreamHandleClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A32103165EE0049EA54 /* SocketStreamHandleClient.h */; };
+		510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510D4A47103177A20049EA54 /* WebSocketChannel.cpp */; };
+		510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A48103177A20049EA54 /* WebSocketChannel.h */; };
+		510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A49103177A20049EA54 /* WebSocketChannelClient.h */; };
 		5116D9770CF177BD00C2B84D /* DatabaseDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = 5116D9750CF177BD00C2B84D /* DatabaseDetails.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		511F23170DC160DA004F0032 /* LocalStorageTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23130DC160DA004F0032 /* LocalStorageTask.cpp */; };
 		511F23180DC160DA004F0032 /* LocalStorageTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23140DC160DA004F0032 /* LocalStorageTask.h */; };
@@ -895,6 +1019,9 @@
 		519611780CAC56A80010A80C /* DatabaseThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 519611620CAC56570010A80C /* DatabaseThread.h */; };
 		519611EA0CAC749C0010A80C /* DatabaseTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 519611E80CAC749C0010A80C /* DatabaseTask.h */; };
 		519611EB0CAC749C0010A80C /* DatabaseTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 519611E90CAC749C0010A80C /* DatabaseTask.cpp */; };
+		51A052331058774F00CC9E95 /* CredentialStorage.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A052311058774F00CC9E95 /* CredentialStorage.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		51A052341058774F00CC9E95 /* CredentialStorage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A052321058774F00CC9E95 /* CredentialStorage.cpp */; };
+		51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A052551058874000CC9E95 /* ProtectionSpaceHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51A45B560CAD7FD7000D2BE9 /* DatabaseAuthorizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A45B540CAD7FD7000D2BE9 /* DatabaseAuthorizer.h */; };
 		51A45B570CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A45B550CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp */; };
 		51A9267C0D53F0570063ECC2 /* OriginQuotaManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */; };
@@ -902,6 +1029,11 @@
 		51A9267E0D53F0570063ECC2 /* OriginUsageRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */; };
 		51A9267F0D53F0570063ECC2 /* OriginUsageRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */; };
 		51AA3F6F0BD5AA9E00892971 /* ResourceLoaderMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51AA3F6E0BD5AA9E00892971 /* ResourceLoaderMac.mm */; };
+		51ABAE1B103C18FF008C5260 /* SocketStreamError.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE1A103C18FF008C5260 /* SocketStreamError.h */; };
+		51ABAE1E103C1913008C5260 /* SocketStreamHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */; };
+		51ABAE1F103C1913008C5260 /* SocketStreamHandleCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */; };
+		51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */; };
+		51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */; };
 		51B2417B0D931F3F00E83F5C /* LegacyWebArchiveMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */; };
 		51BE37E00DAEE00E001085FC /* StorageArea.h in Headers */ = {isa = PBXBuildFile; fileRef = 51BE37DE0DAEE00E001085FC /* StorageArea.h */; };
 		51C0AA390F2AA10A001648C2 /* CachedFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 51C0AA380F2AA10A001648C2 /* CachedFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -952,6 +1084,8 @@
 		5D925B680F64D4DD00B847F0 /* ScrollBehavior.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D925B660F64D4DD00B847F0 /* ScrollBehavior.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5DA5E0FC102B953800088CF9 /* JSWebSocket.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5DA5E0FA102B953800088CF9 /* JSWebSocket.cpp */; };
 		5DA5E0FD102B953800088CF9 /* JSWebSocket.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DA5E0FB102B953800088CF9 /* JSWebSocket.h */; };
+		5DB1BC6A10715A6400EFAA49 /* TransformSource.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DB1BC6810715A6400EFAA49 /* TransformSource.h */; };
+		5DB1BC6B10715A6400EFAA49 /* TransformSourceLibxslt.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5DB1BC6910715A6400EFAA49 /* TransformSourceLibxslt.cpp */; };
 		5DCF836D0D59159800953BC6 /* PluginInfoStore.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DCF836C0D59159800953BC6 /* PluginInfoStore.h */; };
 		5DD0A3810D9AC6070056C122 /* DOMElementTimeControl.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = E415F1680D9A165D0033CE97 /* DOMElementTimeControl.h */; };
 		5DF7F5C20F01F92A00526B4B /* CSSPropertyNames.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 656580EF09D12B20000E61D7 /* CSSPropertyNames.h */; };
@@ -967,7 +1101,7 @@
 		6515EC910D9723FF0063D49A /* JSSVGAltGlyphElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6515EC8F0D9723FF0063D49A /* JSSVGAltGlyphElement.cpp */; };
 		6515EC920D9723FF0063D49A /* JSSVGAltGlyphElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 6515EC900D9723FF0063D49A /* JSSVGAltGlyphElement.h */; };
 		652FBBBC0DE27CB60001D386 /* JSDOMWindowCustom.h in Headers */ = {isa = PBXBuildFile; fileRef = 652FBBBB0DE27CB60001D386 /* JSDOMWindowCustom.h */; };
-		65488D6B0DD5A83D009D83B2 /* StringSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = 65488D6A0DD5A83D009D83B2 /* StringSourceProvider.h */; };
+		65488D6B0DD5A83D009D83B2 /* StringSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = 65488D6A0DD5A83D009D83B2 /* StringSourceProvider.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		6550B69D099DF0270090D781 /* CDATASection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6550B693099DF0270090D781 /* CDATASection.cpp */; };
 		6550B69E099DF0270090D781 /* CDATASection.h in Headers */ = {isa = PBXBuildFile; fileRef = 6550B694099DF0270090D781 /* CDATASection.h */; };
 		6550B69F099DF0270090D781 /* CharacterData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6550B695099DF0270090D781 /* CharacterData.cpp */; };
@@ -1047,13 +1181,13 @@
 		65DF323A09D1DE65000BE325 /* JSCanvasGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DF323409D1DE65000BE325 /* JSCanvasGradient.h */; };
 		65DF323B09D1DE65000BE325 /* JSCanvasPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65DF323509D1DE65000BE325 /* JSCanvasPattern.cpp */; };
 		65DF323C09D1DE65000BE325 /* JSCanvasPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DF323609D1DE65000BE325 /* JSCanvasPattern.h */; };
-		65DF323D09D1DE65000BE325 /* JSCanvasRenderingContext2D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65DF323709D1DE65000BE325 /* JSCanvasRenderingContext2D.cpp */; };
-		65DF323E09D1DE65000BE325 /* JSCanvasRenderingContext2D.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DF323809D1DE65000BE325 /* JSCanvasRenderingContext2D.h */; };
 		65DF326109D1E199000BE325 /* UserAgentStyleSheetsData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 656581AF09D14EE6000E61D7 /* UserAgentStyleSheetsData.cpp */; };
 		65FEA86909833ADE00BED4AB /* Page.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65FEA86809833ADE00BED4AB /* Page.cpp */; };
 		72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 72626E010EF022FE00A07E20 /* FontFastPath.cpp */; };
-		7284ADDD0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7284ADDB0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp */; };
-		7284ADDE0E6FEB31002EEFBD /* UserStyleSheetLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 7284ADDC0E6FEB31002EEFBD /* UserStyleSheetLoader.h */; };
+		75092BFE104B80F9003DD168 /* DOMDispatchTimelineItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75092BFC104B80F9003DD168 /* DOMDispatchTimelineItem.cpp */; };
+		75092BFF104B80F9003DD168 /* DOMDispatchTimelineItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 75092BFD104B80F9003DD168 /* DOMDispatchTimelineItem.h */; };
+		754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 754133A7102E00E800075D00 /* InspectorTimelineAgent.h */; };
+		754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */; };
 		75793E830D0CE0B3007FC0AC /* MessageEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75793E800D0CE0B3007FC0AC /* MessageEvent.cpp */; };
 		75793E840D0CE0B3007FC0AC /* MessageEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793E810D0CE0B3007FC0AC /* MessageEvent.h */; };
 		75793EC80D0CE72D007FC0AC /* JSMessageEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75793EC60D0CE72D007FC0AC /* JSMessageEvent.cpp */; };
@@ -1061,8 +1195,14 @@
 		75793ED30D0CE85B007FC0AC /* DOMMessageEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793ED00D0CE85B007FC0AC /* DOMMessageEvent.h */; };
 		75793ED40D0CE85B007FC0AC /* DOMMessageEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 75793ED10D0CE85B007FC0AC /* DOMMessageEvent.mm */; };
 		75793ED50D0CE85B007FC0AC /* DOMMessageEventInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793ED20D0CE85B007FC0AC /* DOMMessageEventInternal.h */; };
+		75A94A03104B74FB0006673C /* TimelineItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75A94A01104B74FB0006673C /* TimelineItem.cpp */; };
+		75A94A04104B74FB0006673C /* TimelineItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 75A94A02104B74FB0006673C /* TimelineItem.h */; };
+		7693BAD2106C2DCA007B0823 /* HaltablePlugin.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BACE106C2DCA007B0823 /* HaltablePlugin.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7693BAD3106C2DCA007B0823 /* PluginHalter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7693BACF106C2DCA007B0823 /* PluginHalter.cpp */; };
+		7693BAD4106C2DCA007B0823 /* PluginHalter.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BAD0106C2DCA007B0823 /* PluginHalter.h */; };
+		7693BAD5106C2DCA007B0823 /* PluginHalterClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7A1E88F5101CC384000C4DF5 /* ScriptArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A1E88F3101CC384000C4DF5 /* ScriptArray.cpp */; };
-		7A1E88F6101CC384000C4DF5 /* ScriptArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A1E88F4101CC384000C4DF5 /* ScriptArray.h */; };
+		7A1E88F6101CC384000C4DF5 /* ScriptArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A1E88F4101CC384000C4DF5 /* ScriptArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7A24587B1021EAF4000A00AA /* InspectorDOMAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */; };
 		7A24587C1021EAF4000A00AA /* InspectorDOMAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A24587A1021EAF4000A00AA /* InspectorDOMAgent.h */; };
 		7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */; };
@@ -1944,7 +2084,6 @@
 		85F74E0A0AA8DF8C000DC284 /* DOMCSSUnknownRule.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85032DD50AA8C9BE007D3B7D /* DOMCSSUnknownRule.h */; };
 		85FF315A0AAFBFCB00374F38 /* DOMKeyboardEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85FF31580AAFBFCB00374F38 /* DOMKeyboardEvent.h */; };
 		85FF315B0AAFBFCB00374F38 /* DOMKeyboardEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85FF31590AAFBFCB00374F38 /* DOMKeyboardEvent.mm */; };
-		929264770B61FC7200B41D34 /* JSDocumentCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 929264760B61FC7200B41D34 /* JSDocumentCustom.cpp */; };
 		9302B0BD0D79F82900C7EE83 /* PageGroup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */; };
 		9302B0BF0D79F82C00C7EE83 /* PageGroup.h in Headers */ = {isa = PBXBuildFile; fileRef = 9302B0BE0D79F82C00C7EE83 /* PageGroup.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9305B24D098F1B6B00C28855 /* Timer.h in Headers */ = {isa = PBXBuildFile; fileRef = 9305B24C098F1B6B00C28855 /* Timer.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1956,6 +2095,7 @@
 		9307F1D70AF2D59000DBA31A /* HitTestResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9307F1D50AF2D59000DBA31A /* HitTestResult.cpp */; };
 		9307F1D80AF2D59000DBA31A /* HitTestResult.h in Headers */ = {isa = PBXBuildFile; fileRef = 9307F1D60AF2D59000DBA31A /* HitTestResult.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		930908910AF7EDE40081DF01 /* HitTestRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 930908900AF7EDE40081DF01 /* HitTestRequest.h */; };
+		930FC68A1072B9280045293E /* TextRenderingMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 930FC6891072B9280045293E /* TextRenderingMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9326DC0C09DAD5D600AFC847 /* CharsetData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 656581AC09D14EE6000E61D7 /* CharsetData.cpp */; };
 		9327A94209968D1A0068A546 /* HTMLOptionsCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9327A94109968D1A0068A546 /* HTMLOptionsCollection.cpp */; };
 		932871C00B20DEB70049035A /* PlatformMenuDescription.h in Headers */ = {isa = PBXBuildFile; fileRef = 932871BF0B20DEB70049035A /* PlatformMenuDescription.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2089,6 +2229,8 @@
 		938E65F709F0985D008A48EC /* JSHTMLElementWrapperFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 938E65F609F0985D008A48EC /* JSHTMLElementWrapperFactory.cpp */; };
 		938E666009F09B81008A48EC /* JSHTMLCanvasElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 938E665F09F09B81008A48EC /* JSHTMLCanvasElement.cpp */; };
 		938E666209F09B87008A48EC /* JSHTMLCanvasElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 938E666109F09B87008A48EC /* JSHTMLCanvasElement.h */; };
+		9392262D1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9392262C1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp */; };
+		9392262F10321084006E7D5D /* JSCSSRuleListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */; };
 		9392F1420AD185F400691BD4 /* RenderCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 9392F1410AD185F400691BD4 /* RenderCounter.h */; };
 		9392F1440AD185FE00691BD4 /* RenderCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9392F1430AD185FE00691BD4 /* RenderCounter.cpp */; };
 		9392F14C0AD1861B00691BD4 /* CounterNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 9392F14B0AD1861B00691BD4 /* CounterNode.h */; };
@@ -2138,7 +2280,6 @@
 		93EB169509F880B00091F8FF /* WebCoreSystemInterface.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93EB169409F880B00091F8FF /* WebCoreSystemInterface.mm */; };
 		93EB169709F880C00091F8FF /* WebCoreSystemInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 93EB169609F880C00091F8FF /* WebCoreSystemInterface.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93EB355F09E37FD600F43799 /* MouseEventWithHitTestResults.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93EB355E09E37FD600F43799 /* MouseEventWithHitTestResults.cpp */; };
-		93EEC1FA09C2877700C515D1 /* DocPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 93EEC1E709C2877700C515D1 /* DocPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F198E508245E59001E9ABC /* HTMLDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = F523D23C02DE4396018635CA /* HTMLDocument.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F198E608245E59001E9ABC /* HTMLElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F523D23F02DE4396018635CA /* HTMLElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F198EF08245E59001E9ABC /* HTMLParser.h in Headers */ = {isa = PBXBuildFile; fileRef = F523D25102DE4396018635CA /* HTMLParser.h */; };
@@ -2183,8 +2324,9 @@
 		93F19AF808245E59001E9ABC /* Position.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BE91FC8C06133666005E3790 /* Position.cpp */; };
 		93F19AFD08245E59001E9ABC /* HTMLCanvasElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51F6A3D50663BF04004D2919 /* HTMLCanvasElement.cpp */; };
 		93F19AFF08245E59001E9ABC /* ClipboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 2D90660C0665D937006B6F1A /* ClipboardMac.mm */; };
-		93F19B0308245E59001E9ABC /* XSLStyleSheet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC06F24906D18A7E004A6FA3 /* XSLStyleSheet.cpp */; };
+		93F19B0308245E59001E9ABC /* XSLStyleSheetLibxslt.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC06F24906D18A7E004A6FA3 /* XSLStyleSheetLibxslt.cpp */; };
 		93F19B0408245E59001E9ABC /* XSLTProcessor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC06F24B06D18A7E004A6FA3 /* XSLTProcessor.cpp */; };
+		93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC06F24D06D18A7E004A6FA3 /* XSLTProcessorLibxslt.cpp */; };
 		93F19B0708245E59001E9ABC /* WebCoreView.m in Sources */ = {isa = PBXBuildFile; fileRef = BE8560510701F91100239769 /* WebCoreView.m */; };
 		93F19B0808245E59001E9ABC /* WebDashboardRegion.m in Sources */ = {isa = PBXBuildFile; fileRef = 5150C2A50702629800AF642C /* WebDashboardRegion.m */; settings = {COMPILER_FLAGS = "-Wno-cast-qual"; }; };
 		93F19B1308245E59001E9ABC /* ApplicationServices.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = F5C2869302846DCD018635CA /* ApplicationServices.framework */; };
@@ -2203,6 +2345,12 @@
 		93F9B7A00BA6032600854064 /* JSCDATASection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F9B79E0BA6032600854064 /* JSCDATASection.cpp */; };
 		93F9B7A10BA6032600854064 /* JSCDATASection.h in Headers */ = {isa = PBXBuildFile; fileRef = 93F9B79F0BA6032600854064 /* JSCDATASection.h */; };
 		93FDAFCA0B11307400E2746F /* EditorInsertAction.h in Headers */ = {isa = PBXBuildFile; fileRef = 93FDAFC90B11307400E2746F /* EditorInsertAction.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97059977107D975200A50A7C /* PolicyCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97059973107D975200A50A7C /* PolicyCallback.cpp */; };
+		97059978107D975200A50A7C /* PolicyCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97059974107D975200A50A7C /* PolicyCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97059979107D975200A50A7C /* PolicyChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97059975107D975200A50A7C /* PolicyChecker.cpp */; };
+		9705997A107D975200A50A7C /* PolicyChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 97059976107D975200A50A7C /* PolicyChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		979F43D31075E44A0000F83B /* RedirectScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 979F43D11075E44A0000F83B /* RedirectScheduler.cpp */; };
+		979F43D41075E44A0000F83B /* RedirectScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 979F43D21075E44A0000F83B /* RedirectScheduler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */; };
 		97DD4D870FDF4D6E00ECF9A4 /* XSSAuditor.h in Headers */ = {isa = PBXBuildFile; fileRef = 97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */; };
 		A17C81220F2A5CF7005DAAEB /* HTMLElementFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */; };
@@ -2211,6 +2359,8 @@
 		A71878900B2D04AC00A16ECE /* DragControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */; };
 		A7352C190B1BB89D00A986D0 /* RenderSVGBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7352C170B1BB89D00A986D0 /* RenderSVGBlock.cpp */; };
 		A7352C1A0B1BB89D00A986D0 /* RenderSVGBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = A7352C180B1BB89D00A986D0 /* RenderSVGBlock.h */; };
+		A75E497610752ACB00C9B896 /* SerializedScriptValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A75E497410752ACB00C9B896 /* SerializedScriptValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A75E497710752ACB00C9B896 /* SerializedScriptValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75E497510752ACB00C9B896 /* SerializedScriptValue.cpp */; };
 		A75E8B880E1DE2D6007F2481 /* FEBlend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75E8B800E1DE2D6007F2481 /* FEBlend.cpp */; };
 		A75E8B890E1DE2D6007F2481 /* FEBlend.h in Headers */ = {isa = PBXBuildFile; fileRef = A75E8B810E1DE2D6007F2481 /* FEBlend.h */; };
 		A75E8B8A0E1DE2D6007F2481 /* FEColorMatrix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75E8B820E1DE2D6007F2481 /* FEColorMatrix.cpp */; };
@@ -2319,12 +2469,6 @@
 		A80E7E9E0A1A83E3007FB8C5 /* JSHTMLTextAreaElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E7E940A1A83E3007FB8C5 /* JSHTMLTextAreaElement.cpp */; };
 		A80E7E9F0A1A83E3007FB8C5 /* JSHTMLButtonElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E7E950A1A83E3007FB8C5 /* JSHTMLButtonElement.h */; };
 		A80E7EA00A1A83E3007FB8C5 /* JSHTMLButtonElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E7E960A1A83E3007FB8C5 /* JSHTMLButtonElement.cpp */; };
-		A80F393D0CCD971A002DD990 /* JSSVGDefinitionSrcElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A80F393B0CCD971A002DD990 /* JSSVGDefinitionSrcElement.h */; };
-		A80F393E0CCD971A002DD990 /* JSSVGDefinitionSrcElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80F393C0CCD971A002DD990 /* JSSVGDefinitionSrcElement.cpp */; };
-		A80F39580CCD9796002DD990 /* DOMSVGDefinitionSrcElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = A80F39550CCD9796002DD990 /* DOMSVGDefinitionSrcElementInternal.h */; };
-		A80F39590CCD9796002DD990 /* DOMSVGDefinitionSrcElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = A80F39560CCD9796002DD990 /* DOMSVGDefinitionSrcElement.mm */; };
-		A80F395A0CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A80F39570CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h */; };
-		A80F3A2E0CCD9D5A002DD990 /* DOMSVGDefinitionSrcElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = A80F39570CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h */; };
 		A80F3A500CCDA2A2002DD990 /* DOMSVGFETurbulenceElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 8502AB3E0AD438C000378540 /* DOMSVGFETurbulenceElement.h */; };
 		A80F3A5A0CCDA2ED002DD990 /* DOMSVGAnimatedPoints.h in Headers */ = {isa = PBXBuildFile; fileRef = 85ACEF070ACDCCCF001214FF /* DOMSVGAnimatedPoints.h */; };
 		A80F3A640CCDA2FC002DD990 /* DOMSVGLineElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85C9A2FD0AD7E94200FBFF1E /* DOMSVGLineElement.h */; };
@@ -3147,8 +3291,6 @@
 		B22279A50D00BF220071B782 /* SVGComponentTransferFunctionElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B222780F0D00BF1F0071B782 /* SVGComponentTransferFunctionElement.h */; };
 		B22279A70D00BF220071B782 /* SVGCursorElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278110D00BF1F0071B782 /* SVGCursorElement.cpp */; };
 		B22279A80D00BF220071B782 /* SVGCursorElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278120D00BF1F0071B782 /* SVGCursorElement.h */; };
-		B22279AA0D00BF220071B782 /* SVGDefinitionSrcElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278140D00BF1F0071B782 /* SVGDefinitionSrcElement.cpp */; };
-		B22279AB0D00BF220071B782 /* SVGDefinitionSrcElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278150D00BF1F0071B782 /* SVGDefinitionSrcElement.h */; };
 		B22279AD0D00BF220071B782 /* SVGDefsElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278170D00BF1F0071B782 /* SVGDefsElement.cpp */; };
 		B22279AE0D00BF220071B782 /* SVGDefsElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278180D00BF1F0071B782 /* SVGDefsElement.h */; };
 		B22279B00D00BF220071B782 /* SVGDescElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B222781A0D00BF1F0071B782 /* SVGDescElement.cpp */; };
@@ -3849,8 +3991,12 @@
 		B2FA3E180AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2FA3D300AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp */; };
 		B2FA3E190AB75A6F000E5AC4 /* JSSVGZoomEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = B2FA3D310AB75A6F000E5AC4 /* JSSVGZoomEvent.h */; };
 		B50F5B810E96CD9900AD71A6 /* WebCoreObjCExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */; settings = {COMPILER_FLAGS = "-Wno-deprecated-declarations"; }; };
+		B51BF6F0102C9E590002C15A /* SQLTransactionClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */; };
+		B51BF6F1102C9E590002C15A /* SQLTransactionClient.h in Headers */ = {isa = PBXBuildFile; fileRef = B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */; };
 		B5A684220FFABE9800D24689 /* SQLiteFileSystem.h in Headers */ = {isa = PBXBuildFile; fileRef = B5A684210FFABE9800D24689 /* SQLiteFileSystem.h */; };
 		B5A684240FFABEAA00D24689 /* SQLiteFileSystem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5A684230FFABEAA00D24689 /* SQLiteFileSystem.cpp */; };
+		B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */; };
+		B5C1123C102B6C4600096578 /* SQLTransactionCoordinator.h in Headers */ = {isa = PBXBuildFile; fileRef = B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */; };
 		BC00F0040E0A185500FD04E3 /* DOMFile.h in Headers */ = {isa = PBXBuildFile; fileRef = BC00EFFE0E0A185500FD04E3 /* DOMFile.h */; };
 		BC00F0050E0A185500FD04E3 /* DOMFile.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC00EFFF0E0A185500FD04E3 /* DOMFile.mm */; };
 		BC00F0060E0A185500FD04E3 /* DOMFileInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = BC00F0000E0A185500FD04E3 /* DOMFileInternal.h */; };
@@ -3906,7 +4052,6 @@
 		BC1A37BE097C715F0019F3D8 /* DOMTraversal.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1A37A8097C715F0019F3D8 /* DOMTraversal.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC1A37BF097C715F0019F3D8 /* DOMUtility.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC1A37A9097C715F0019F3D8 /* DOMUtility.mm */; };
 		BC1A37C0097C715F0019F3D8 /* DOMViews.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1A37AA097C715F0019F3D8 /* DOMViews.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC1DEA4F0E268EB60083A73F /* JSDocumentFragmentCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC1DEA4E0E268EB60083A73F /* JSDocumentFragmentCustom.cpp */; };
 		BC20FB7F0C0E8E6C00D1447F /* JSCSSValueCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */; };
 		BC212A1F0FE8333200EC3708 /* HTMLDataGridElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC212A1E0FE8333200EC3708 /* HTMLDataGridElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC212A410FE83A1800EC3708 /* JSHTMLDataGridElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC212A3F0FE83A1800EC3708 /* JSHTMLDataGridElement.cpp */; };
@@ -4135,18 +4280,22 @@
 		BC80C9880CD294EE00A0B7B3 /* CSSTimingFunctionValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC80C9860CD294EE00A0B7B3 /* CSSTimingFunctionValue.h */; };
 		BC8243290D0CE8A200460C8F /* JSSQLError.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8243250D0CE8A200460C8F /* JSSQLError.h */; };
 		BC82432A0D0CE8A200460C8F /* JSSQLTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8243260D0CE8A200460C8F /* JSSQLTransaction.h */; };
-		BC82432B0D0CE8A200460C8F /* JSVoidCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8243270D0CE8A200460C8F /* JSVoidCallback.cpp */; };
-		BC82432C0D0CE8A200460C8F /* JSVoidCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8243280D0CE8A200460C8F /* JSVoidCallback.h */; };
 		BC8243E80D0CFD7500460C8F /* WindowFeatures.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */; };
 		BC8243E90D0CFD7500460C8F /* WindowFeatures.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8243E70D0CFD7500460C8F /* WindowFeatures.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC8B853E0E7C7F1100AB6984 /* ScrollbarThemeMac.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8B853C0E7C7F1100AB6984 /* ScrollbarThemeMac.h */; };
 		BC8B854B0E7C7F5600AB6984 /* ScrollbarTheme.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8B854A0E7C7F5600AB6984 /* ScrollbarTheme.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC8BF151105813BF00A40A07 /* UserStyleSheet.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8BF150105813BF00A40A07 /* UserStyleSheet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC8BF15A1058141800A40A07 /* UserStyleSheetTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8BF1591058141800A40A07 /* UserStyleSheetTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC8C8FAD0DDCD31B00B592F4 /* RenderStyle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8C8FAB0DDCD31B00B592F4 /* RenderStyle.cpp */; };
 		BC8C8FAE0DDCD31B00B592F4 /* RenderStyle.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8C8FAC0DDCD31B00B592F4 /* RenderStyle.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC904B760D10998F00680D32 /* ClassNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC904B720D10998F00680D32 /* ClassNodeList.cpp */; };
 		BC904B770D10998F00680D32 /* ClassNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = BC904B730D10998F00680D32 /* ClassNodeList.h */; };
 		BC926F800C0552470082776B /* JSHTMLFrameSetElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC926F7E0C0552470082776B /* JSHTMLFrameSetElement.cpp */; };
 		BC926F810C0552470082776B /* JSHTMLFrameSetElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC926F7F0C0552470082776B /* JSHTMLFrameSetElement.h */; };
+		BC9462CC107A7A3900857193 /* BeforeLoadEvent.idl in Resources */ = {isa = PBXBuildFile; fileRef = BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */; };
+		BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */; };
+		BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */; };
+		BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC946347107A936600857193 /* JSBeforeLoadEvent.h */; };
 		BC94D1080C274F88006BC617 /* PlatformScreenMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC94D1070C274F88006BC617 /* PlatformScreenMac.mm */; };
 		BC94D14E0C275C68006BC617 /* JSHistory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC94D14C0C275C68006BC617 /* JSHistory.cpp */; };
 		BC94D14F0C275C68006BC617 /* JSHistory.h in Headers */ = {isa = PBXBuildFile; fileRef = BC94D14D0C275C68006BC617 /* JSHistory.h */; };
@@ -4163,6 +4312,8 @@
 		BC9BC64E0E7C4889008B9849 /* ScrollbarClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9BC64D0E7C4889008B9849 /* ScrollbarClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCA169A20BFD55B40019CA76 /* JSHTMLTableCaptionElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA169A00BFD55B40019CA76 /* JSHTMLTableCaptionElement.cpp */; };
 		BCA169A30BFD55B40019CA76 /* JSHTMLTableCaptionElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA169A10BFD55B40019CA76 /* JSHTMLTableCaptionElement.h */; };
+		BCA2B061105047600043BD1C /* UserScript.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA2B0601050475F0043BD1C /* UserScript.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BCA2B08B10505BCD0043BD1C /* UserScriptTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA2B08A10505BCD0043BD1C /* UserScriptTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCA83E4F0D7CE1E9003421A8 /* JSClipboard.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA83E4D0D7CE1E9003421A8 /* JSClipboard.cpp */; };
 		BCA83E500D7CE1E9003421A8 /* JSClipboard.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA83E4E0D7CE1E9003421A8 /* JSClipboard.h */; };
 		BCA83E520D7CE205003421A8 /* JSClipboardCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */; };
@@ -4170,6 +4321,8 @@
 		BCA846D70DC67A350026C309 /* RenderReplica.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA846D50DC67A350026C309 /* RenderReplica.h */; };
 		BCA85A100C3AEAF4006F8308 /* DOMSVGNumberInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA85A0F0C3AEAF4006F8308 /* DOMSVGNumberInternal.h */; };
 		BCAA90C30A7EBA60008B1229 /* Scrollbar.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCAA90C20A7EBA60008B1229 /* Scrollbar.cpp */; };
+		BCACF3BC1072921A00C0C8A3 /* UserContentURLPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCACF3BA1072921A00C0C8A3 /* UserContentURLPattern.cpp */; };
+		BCACF3BD1072921A00C0C8A3 /* UserContentURLPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = BCACF3BB1072921A00C0C8A3 /* UserContentURLPattern.h */; };
 		BCAEFCAE1016CE4A0040D34E /* DOMRGBColor.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCAEFCAD1016CE4A0040D34E /* DOMRGBColor.mm */; };
 		BCB16C170979C3BD00467741 /* Cache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCB16BFE0979C3BD00467741 /* Cache.cpp */; };
 		BCB16C180979C3BD00467741 /* Cache.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB16BFF0979C3BD00467741 /* Cache.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4232,6 +4385,8 @@
 		BCCBE7B50E07166900EAFA8E /* CSSVariableDependentValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCBE7B40E07166900EAFA8E /* CSSVariableDependentValue.cpp */; };
 		BCCD74DC0A4C8D35005FDA6D /* HTMLViewSourceDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = BCCD74DB0A4C8D35005FDA6D /* HTMLViewSourceDocument.h */; };
 		BCCD74E50A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCD74E40A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp */; };
+		BCCE58AC1061E8CF008FB35A /* JSDatabaseCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCE58AB1061E8CF008FB35A /* JSDatabaseCustom.cpp */; };
+		BCCE58AF1061E90C008FB35A /* JSDocumentFragmentCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCE58AE1061E90C008FB35A /* JSDocumentFragmentCustom.cpp */; };
 		BCCFBAE80B5152ED0001F1D7 /* Tokenizer.h in Headers */ = {isa = PBXBuildFile; fileRef = BCCFBAE70B5152ED0001F1D7 /* Tokenizer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCD0E0FA0E972C3500265DEA /* SecurityOrigin.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD0E0F70E972C3500265DEA /* SecurityOrigin.cpp */; };
 		BCD0E0FB0E972C3500265DEA /* SecurityOrigin.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD0E0F80E972C3500265DEA /* SecurityOrigin.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4244,8 +4399,6 @@
 		BCD9C2630C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C25F0C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp */; };
 		BCD9C2640C17AA67005C90A2 /* JSNodeCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C2600C17AA67005C90A2 /* JSNodeCustom.cpp */; };
 		BCD9C2650C17AA67005C90A2 /* JSNodeListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C2610C17AA67005C90A2 /* JSNodeListCustom.cpp */; };
-		BCD9C2720C17AA81005C90A2 /* JSNamedNodesCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C26C0C17AA81005C90A2 /* JSNamedNodesCollection.cpp */; };
-		BCD9C2730C17AA81005C90A2 /* JSNamedNodesCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD9C26D0C17AA81005C90A2 /* JSNamedNodesCollection.h */; };
 		BCD9C2C00C17B69E005C90A2 /* JSNamedNodeMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C2BC0C17B69E005C90A2 /* JSNamedNodeMap.cpp */; };
 		BCD9C2C10C17B69E005C90A2 /* JSNamedNodeMap.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD9C2BD0C17B69E005C90A2 /* JSNamedNodeMap.h */; };
 		BCD9C2C20C17B69E005C90A2 /* JSNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C2BE0C17B69E005C90A2 /* JSNodeList.cpp */; };
@@ -4344,6 +4497,7 @@
 		BCEFE1EA0DCA5F6400739219 /* JSXSLTProcessor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCEFE1E80DCA5F6400739219 /* JSXSLTProcessor.cpp */; };
 		BCEFE1EB0DCA5F6400739219 /* JSXSLTProcessor.h in Headers */ = {isa = PBXBuildFile; fileRef = BCEFE1E90DCA5F6400739219 /* JSXSLTProcessor.h */; };
 		BCF524600FEBEE5D0095BF26 /* HTMLDataGridElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCF5245F0FEBEE5D0095BF26 /* HTMLDataGridElement.cpp */; };
+		BCFA930810333193007B25D1 /* RenderOverflow.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFA930710333193007B25D1 /* RenderOverflow.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCFB2E5E0979E46400BA703D /* CachedResourceClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFB2E5D0979E46400BA703D /* CachedResourceClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCFB2F76097A2E1A00BA703D /* Arena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFB2F74097A2E1A00BA703D /* Arena.cpp */; };
 		BCFB2F77097A2E1A00BA703D /* Arena.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFB2F75097A2E1A00BA703D /* Arena.h */; };
@@ -4370,9 +4524,11 @@
 		C5160EEB1004543A00A7CEE2 /* StorageAreaImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C5160EE91004543A00A7CEE2 /* StorageAreaImpl.h */; };
 		C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */; };
 		C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C55E38BC10040D5D00A56BDB /* StorageNamespaceImpl.cpp */; };
+		C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */; };
+		C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */; };
 		C6D74AD509AA282E000B0A52 /* ModifySelectionListLevel.h in Headers */ = {isa = PBXBuildFile; fileRef = C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */; };
 		C6D74AE409AA290A000B0A52 /* ModifySelectionListLevel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */; };
-		CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */; };
+		CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		D05CED290A40BB2C00C5AF38 /* FormatBlockCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D05CED270A40BB2C00C5AF38 /* FormatBlockCommand.cpp */; };
 		D05CED2A0A40BB2C00C5AF38 /* FormatBlockCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = D05CED280A40BB2C00C5AF38 /* FormatBlockCommand.h */; };
 		D06C0D8F0CFD11460065F43F /* RemoveFormatCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = D06C0D8D0CFD11460065F43F /* RemoveFormatCommand.h */; };
@@ -4386,12 +4542,20 @@
 		D23CA55D0AB0EAAE005108A5 /* JSRangeException.h in Headers */ = {isa = PBXBuildFile; fileRef = D23CA55C0AB0EAAE005108A5 /* JSRangeException.h */; };
 		D23CA55F0AB0EAB6005108A5 /* JSRangeException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D23CA55E0AB0EAB6005108A5 /* JSRangeException.cpp */; };
 		D23CA56C0AB0EB8D005108A5 /* RangeException.h in Headers */ = {isa = PBXBuildFile; fileRef = D23CA56B0AB0EB8D005108A5 /* RangeException.h */; };
+		D8B6152F1032495100C8554A /* Cookie.h in Headers */ = {isa = PBXBuildFile; fileRef = D8B6152E1032495100C8554A /* Cookie.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DB23C2CB0A508D29002489EB /* IndentOutdentCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DB23C2C90A508D29002489EB /* IndentOutdentCommand.cpp */; };
 		DB23C2CC0A508D29002489EB /* IndentOutdentCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = DB23C2CA0A508D29002489EB /* IndentOutdentCommand.h */; };
 		DD05FE0D0B8BA3C6009ACDFE /* WebCoreObjCExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = DD05FE0B0B8BA3C6009ACDFE /* WebCoreObjCExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DD763BB20992C2C900740B8E /* libxml2.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = DD763BB10992C2C900740B8E /* libxml2.dylib */; };
 		DD7CDF250A23CF9800069928 /* CSSUnknownRule.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CCE0A1989CA007FB8C5 /* CSSUnknownRule.h */; };
 		DDE63ED50B7D45A800226998 /* DOMTextEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 933A14750B7D1BAF00A53FFD /* DOMTextEvent.h */; };
+		E0FEF372B17C53EAC1C1FBEE /* EventSource.h in Headers */ = {isa = PBXBuildFile; fileRef = E0FEF371B17C53EAC1C1FBEE /* EventSource.h */; };
+		E0FEF372B27C53EAC1C1FBEE /* EventSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E0FEF371B27C53EAC1C1FBEE /* EventSource.cpp */; };
+		E0FEF372B37C53EAC1C1FBEE /* JSEventSource.h in Headers */ = {isa = PBXBuildFile; fileRef = E0FEF371B37C53EAC1C1FBEE /* JSEventSource.h */; };
+		E0FEF372B47C53EAC1C1FBEE /* JSEventSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E0FEF371B47C53EAC1C1FBEE /* JSEventSource.cpp */; };
+		E0FEF372B57C53EAC1C1FBEE /* JSEventSourceCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E0FEF371B57C53EAC1C1FBEE /* JSEventSourceCustom.cpp */; };
+		E0FEF372B67C53EAC1C1FBEE /* JSEventSourceConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = E0FEF371B67C53EAC1C1FBEE /* JSEventSourceConstructor.h */; };
+		E0FEF372B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E0FEF371B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp */; };
 		E107400D0E77BDC00033AF24 /* JSMessageChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E107400B0E77BDC00033AF24 /* JSMessageChannel.cpp */; };
 		E107400E0E77BDC00033AF24 /* JSMessageChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = E107400C0E77BDC00033AF24 /* JSMessageChannel.h */; };
 		E10743240E7835830033AF24 /* JSMessageChannelConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E10743230E7835830033AF24 /* JSMessageChannelConstructor.cpp */; };
@@ -4410,6 +4574,12 @@
 		E1271A140EEEC80400F61213 /* WorkerNavigator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1271A130EEEC80400F61213 /* WorkerNavigator.cpp */; };
 		E1271A580EEECDE400F61213 /* JSWorkerNavigator.h in Headers */ = {isa = PBXBuildFile; fileRef = E1271A560EEECDE400F61213 /* JSWorkerNavigator.h */; };
 		E1271A590EEECDE400F61213 /* JSWorkerNavigator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1271A570EEECDE400F61213 /* JSWorkerNavigator.cpp */; };
+		E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = E1284AE010447D4500EAEB52 /* PageTransitionEvent.h */; };
+		E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1284AE910447DEE00EAEB52 /* PageTransitionEvent.cpp */; };
+		E1284BB110449FFA00EAEB52 /* JSPageTransitionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = E1284BAF10449FFA00EAEB52 /* JSPageTransitionEvent.h */; };
+		E1284BB210449FFA00EAEB52 /* JSPageTransitionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */; };
+		E1284BD51044A01E00EAEB52 /* DOMPageTransitionEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1284BD31044A01E00EAEB52 /* DOMPageTransitionEvent.mm */; };
+		E1284BD61044A01E00EAEB52 /* DOMPageTransitionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = E1284BD41044A01E00EAEB52 /* DOMPageTransitionEvent.h */; };
 		E12EDB7B0B308A78002704B6 /* EventTarget.h in Headers */ = {isa = PBXBuildFile; fileRef = E12EDB7A0B308A78002704B6 /* EventTarget.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E12EDBEA0B308E0B002704B6 /* EventTarget.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E12EDBE90B308E0B002704B6 /* EventTarget.cpp */; };
 		E17A4A1B0D97991D00FC10C6 /* DOMSVGAltGlyphElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 65AA6BAC0D974A00000541AE /* DOMSVGAltGlyphElement.h */; };
@@ -4424,7 +4594,7 @@
 		E1A643FD0EC097A000779668 /* WorkerScriptController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */; };
 		E1ACAF4C0E791AAF0087D12B /* DOMMessagePort.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1ACAF4A0E791AAF0087D12B /* DOMMessagePort.mm */; };
 		E1ACAF4D0E791AAF0087D12B /* DOMMessagePort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ACAF4B0E791AAF0087D12B /* DOMMessagePort.h */; };
-		E1ADECBF0E76ACF1004A1A5E /* MessagePort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ADECBD0E76ACF1004A1A5E /* MessagePort.h */; };
+		E1ADECBF0E76ACF1004A1A5E /* MessagePort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ADECBD0E76ACF1004A1A5E /* MessagePort.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E1ADECC00E76ACF1004A1A5E /* MessagePort.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1ADECBE0E76ACF1004A1A5E /* MessagePort.cpp */; };
 		E1ADECCE0E76AD8B004A1A5E /* MessageChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ADECCC0E76AD8B004A1A5E /* MessageChannel.h */; };
 		E1ADECCF0E76AD8B004A1A5E /* MessageChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1ADECCD0E76AD8B004A1A5E /* MessageChannel.cpp */; };
@@ -4521,10 +4691,29 @@
 		ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED501DC50B249F2900AE18D9 /* EditorMac.mm */; };
 		EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE3A4FF0C7A430600956A37 /* ColorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		EDEC98030AED7E170059137F /* WebCorePrefix.h in Headers */ = {isa = PBXBuildFile; fileRef = EDEC98020AED7E170059137F /* WebCorePrefix.h */; };
+		F5C041DA0FFCA7CE00839D4A /* HTMLDataListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5C041D70FFCA7CE00839D4A /* HTMLDataListElement.cpp */; };
+		F5C041DB0FFCA7CE00839D4A /* HTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041D80FFCA7CE00839D4A /* HTMLDataListElement.h */; };
+		F5C041E30FFCA96D00839D4A /* DOMHTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041DE0FFCA96D00839D4A /* DOMHTMLDataListElement.h */; };
+		F5C041E40FFCA96D00839D4A /* DOMHTMLDataListElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = F5C041DF0FFCA96D00839D4A /* DOMHTMLDataListElement.mm */; };
+		F5C041E50FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041E00FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h */; };
+		F5C041E60FFCA96D00839D4A /* JSHTMLDataListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5C041E10FFCA96D00839D4A /* JSHTMLDataListElement.cpp */; };
+		F5C041E70FFCA96D00839D4A /* JSHTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041E20FFCA96D00839D4A /* JSHTMLDataListElement.h */; };
 		F916C48D0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F916C48B0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp */; };
 		F916C48E0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = F916C48C0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h */; };
 		F9F0ED7A0DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = F9F0ED770DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.h */; };
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
 		FE6FD4880F676E5700092873 /* Coordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD4850F676E5700092873 /* Coordinates.h */; };
+=======
+		FABE72F41059C1EB00D999DD /* MathMLElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72ED1059C1EB00D999DD /* MathMLElement.cpp */; };
+		FABE72F51059C1EB00D999DD /* MathMLElement.h in Headers */ = {isa = PBXBuildFile; fileRef = FABE72EE1059C1EB00D999DD /* MathMLElement.h */; };
+		FABE72F61059C1EB00D999DD /* MathMLInlineContainerElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72EF1059C1EB00D999DD /* MathMLInlineContainerElement.cpp */; };
+		FABE72F71059C1EB00D999DD /* MathMLInlineContainerElement.h in Headers */ = {isa = PBXBuildFile; fileRef = FABE72F01059C1EB00D999DD /* MathMLInlineContainerElement.h */; };
+		FABE72F81059C1EB00D999DD /* MathMLMathElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72F11059C1EB00D999DD /* MathMLMathElement.cpp */; };
+		FABE72F91059C1EB00D999DD /* MathMLMathElement.h in Headers */ = {isa = PBXBuildFile; fileRef = FABE72F21059C1EB00D999DD /* MathMLMathElement.h */; };
+		FABE72FD1059C21100D999DD /* MathMLElementFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72FB1059C21100D999DD /* MathMLElementFactory.cpp */; };
+		FABE72FE1059C21100D999DD /* MathMLNames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72FC1059C21100D999DD /* MathMLNames.cpp */; };
+		FE6FD4880F676E5700092873 /* Coordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD4850F676E5700092873 /* Coordinates.h */; settings = {ATTRIBUTES = (Private, ); }; };
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 		FE6FD48D0F676E9300092873 /* JSCoordinates.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE6FD48B0F676E9300092873 /* JSCoordinates.cpp */; };
 		FE6FD48E0F676E9300092873 /* JSCoordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD48C0F676E9300092873 /* JSCoordinates.h */; };
 		FE700DD10F92D81A008E2BFE /* JSCoordinatesCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */; };
@@ -4535,7 +4724,11 @@
 		FE80D7AB0E9C1ED2000D6F75 /* JSGeolocationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80D7A60E9C1ED2000D6F75 /* JSGeolocationCustom.cpp */; };
 		FE80D7C50E9C1F25000D6F75 /* Geolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80D7B70E9C1F25000D6F75 /* Geolocation.cpp */; };
 		FE80D7C60E9C1F25000D6F75 /* Geolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7B80E9C1F25000D6F75 /* Geolocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
 		FE80D7C90E9C1F25000D6F75 /* Geoposition.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */; };
+=======
+		FE80D7C90E9C1F25000D6F75 /* Geoposition.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */; settings = {ATTRIBUTES = (Private, ); }; };
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 		FE80D7CB0E9C1F25000D6F75 /* PositionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE80D7CD0E9C1F25000D6F75 /* PositionError.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BF0E9C1F25000D6F75 /* PositionError.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE80D7CF0E9C1F25000D6F75 /* PositionErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7C10E9C1F25000D6F75 /* PositionErrorCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4745,7 +4938,6 @@
 				A80F3B870CCDCE24002DD990 /* DOMSVGComponentTransferFunctionElementInternal.h in Copy Generated Headers */,
 				A8F46AC40CB20A9D003A9670 /* DOMSVGCursorElement.h in Copy Generated Headers */,
 				A80F3B9C0CCDCE24002DD990 /* DOMSVGCursorElementInternal.h in Copy Generated Headers */,
-				A80F3A2E0CCD9D5A002DD990 /* DOMSVGDefinitionSrcElement.h in Copy Generated Headers */,
 				A8F46B2D0CB20A9D003A9670 /* DOMSVGDefsElement.h in Copy Generated Headers */,
 				A80F3B550CCDCE24002DD990 /* DOMSVGDefsElementInternal.h in Copy Generated Headers */,
 				A8F46ABB0CB20A9D003A9670 /* DOMSVGDescElement.h in Copy Generated Headers */,
@@ -4976,6 +5168,8 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
+		00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginAccessEntry.cpp; sourceTree = "<group>"; };
+		00146289103CD1DE000B20DB /* OriginAccessEntry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OriginAccessEntry.h; sourceTree = "<group>"; };
 		06027CAC0B1CBFC000884B2D /* ContextMenuItem.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ContextMenuItem.h; sourceTree = "<group>"; };
 		06027CB20B1CC03D00884B2D /* ContextMenuItemMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = ContextMenuItemMac.mm; sourceTree = "<group>"; };
 		062287830B4DB322000C34DF /* FocusDirection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FocusDirection.h; sourceTree = "<group>"; };
@@ -4995,7 +5189,9 @@
 		070DD8F50F01868000727DEB /* mediaControls.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mediaControls.css; sourceTree = "<group>"; };
 		0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerProxy.h; sourceTree = "<group>"; };
 		079F5E4B0F3BEBEA005E0782 /* MediaPlayerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivate.h; sourceTree = "<group>"; };
-		07AFE5900F1446BD00841617 /* mediaControlsQT.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mediaControlsQT.css; sourceTree = "<group>"; };
+		07AFE5900F1446BD00841617 /* mediaControlsQuickTime.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = mediaControlsQuickTime.css; sourceTree = "<group>"; };
+		07B0113C1032241900FBDC33 /* AccessibilityMediaControls.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityMediaControls.cpp; sourceTree = "<group>"; };
+		07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityMediaControls.h; sourceTree = "<group>"; };
 		080081940ED3B2DD00C53BC0 /* WMLAnchorElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLAnchorElement.cpp; sourceTree = "<group>"; };
 		080081950ED3B2DD00C53BC0 /* WMLAnchorElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLAnchorElement.h; sourceTree = "<group>"; };
 		0804BF6C0EE09C3B0006C000 /* WMLDoElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLDoElement.cpp; sourceTree = "<group>"; };
@@ -5111,6 +5307,7 @@
 		0F580CFC0F12DE9B0051D689 /* RenderLayerBacking.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderLayerBacking.cpp; sourceTree = "<group>"; };
 		0F6ECD430F252F3700BDE271 /* CSSPropertyLonghand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSPropertyLonghand.h; sourceTree = "<group>"; };
 		0F6ECD440F252F3700BDE271 /* CSSPropertyLonghand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSPropertyLonghand.cpp; sourceTree = "<group>"; };
+		0F9C6F4B1073EF0400DED9BF /* WebCore.3DRendering.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.3DRendering.exp; sourceTree = "<group>"; };
 		0FC705200EB1815600B90AD8 /* AtomicStringHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AtomicStringHash.h; sourceTree = "<group>"; };
 		0FCF33230F2B9715004B6795 /* ColorCG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ColorCG.cpp; sourceTree = "<group>"; };
 		0FCF33280F2B9A25004B6795 /* WebTiledLayer.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebTiledLayer.mm; sourceTree = "<group>"; };
@@ -5145,6 +5342,8 @@
 		142011B50A003133008303F9 /* JSCSSStyleDeclaration.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCSSStyleDeclaration.h; sourceTree = "<group>"; };
 		1432E8460C51493800B1500F /* GCController.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = GCController.h; sourceTree = "<group>"; };
 		1432E8480C51493F00B1500F /* GCController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = GCController.cpp; sourceTree = "<group>"; };
+		1449E24A107D4A8400B5793F /* JSCallbackData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackData.h; sourceTree = "<group>"; };
+		1449E286107D4DB400B5793F /* JSCallbackData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackData.cpp; sourceTree = "<group>"; };
 		1477E7740BF4134A00152872 /* PageCache.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PageCache.cpp; sourceTree = "<group>"; };
 		1477E7750BF4134A00152872 /* PageCache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PageCache.h; sourceTree = "<group>"; };
 		14813BF309EDF88E00F757E1 /* IDLParser.pm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text.script.perl; name = IDLParser.pm; path = scripts/IDLParser.pm; sourceTree = "<group>"; };
@@ -5153,6 +5352,7 @@
 		14993BE30B2F2B1C0050497F /* FocusController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FocusController.cpp; sourceTree = "<group>"; };
 		14993BE40B2F2B1C0050497F /* FocusController.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FocusController.h; sourceTree = "<group>"; };
 		14C9A5E90B3D105F005A0232 /* Settings.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Settings.cpp; sourceTree = "<group>"; };
+		14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerCustom.cpp; sourceTree = "<group>"; };
 		14CF787109F587CA00EB3665 /* CSSValue.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = CSSValue.idl; sourceTree = "<group>"; };
 		14CF78A309F58CBF00EB3665 /* JSCSSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSValue.cpp; sourceTree = "<group>"; };
 		14CF78A509F58CD800EB3665 /* JSCSSValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCSSValue.h; sourceTree = "<group>"; };
@@ -5339,7 +5539,6 @@
 		1A8F6BBA0DB55CDC001DB794 /* ManifestParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ManifestParser.cpp; sourceTree = "<group>"; };
 		1A8F6BBB0DB55CDC001DB794 /* ManifestParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ManifestParser.h; sourceTree = "<group>"; };
 		1A98956A0AA78F80005EF5EF /* KURLCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = KURLCFNet.cpp; sourceTree = "<group>"; };
-		1A9EF4560A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2DCustom.cpp; sourceTree = "<group>"; };
 		1AB1AE780C051FDE00139F4F /* zoomInCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = zoomInCursor.png; sourceTree = "<group>"; };
 		1AB1AE790C051FDE00139F4F /* zoomOutCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = zoomOutCursor.png; sourceTree = "<group>"; };
 		1AB7FC470A8B92EC00D9D37B /* XPathEvaluator.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = XPathEvaluator.cpp; sourceTree = "<group>"; };
@@ -5466,7 +5665,6 @@
 		1AE82F8E0CAAFA9D002237AE /* JSDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDatabase.h; sourceTree = "<group>"; };
 		1AE82FEA0CAB07EE002237AE /* JSSQLResultSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLResultSet.cpp; sourceTree = "<group>"; };
 		1AE82FEB0CAB07EE002237AE /* JSSQLResultSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLResultSet.h; sourceTree = "<group>"; };
-		1AE830420CAB0ED1002237AE /* JSDatabaseCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDatabaseCustom.cpp; sourceTree = "<group>"; };
 		1AF326770D78B9440068F0C4 /* EditorClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditorClient.h; sourceTree = "<group>"; };
 		1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLResultSetRowList.cpp; sourceTree = "<group>"; };
 		1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLResultSetRowList.h; sourceTree = "<group>"; };
@@ -5632,6 +5830,19 @@
 		31C0FF460E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitTransitionEvent.h; sourceTree = "<group>"; };
 		31C0FF470E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMWebKitTransitionEvent.mm; sourceTree = "<group>"; };
 		31C0FF480E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitTransitionEventInternal.h; sourceTree = "<group>"; };
+		333F704E0FB49CA2008E12A6 /* Notification.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Notification.idl; path = notifications/Notification.idl; sourceTree = "<group>"; };
+		333F704F0FB49CA2008E12A6 /* Notification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Notification.h; path = notifications/Notification.h; sourceTree = "<group>"; };
+		33503C9910179A74003B47E1 /* NotificationPresenter.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; name = NotificationPresenter.h; path = notifications/NotificationPresenter.h; sourceTree = "<group>"; };
+		33503C9F10179AD7003B47E1 /* JSNotification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotification.cpp; sourceTree = "<group>"; };
+		33503CA010179AD7003B47E1 /* JSNotification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotification.h; sourceTree = "<group>"; };
+		33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotificationCenter.cpp; sourceTree = "<group>"; };
+		33503CA210179AD7003B47E1 /* JSNotificationCenter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotificationCenter.h; sourceTree = "<group>"; };
+		33503CBF10179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDesktopNotificationsCustom.cpp; sourceTree = "<group>"; };
+		33503CC61017A1B1003B47E1 /* Notification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Notification.cpp; path = notifications/Notification.cpp; sourceTree = "<group>"; };
+		3390CA510FFC157B00921962 /* NotificationCenter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NotificationCenter.cpp; path = notifications/NotificationCenter.cpp; sourceTree = "<group>"; };
+		3390CA520FFC157B00921962 /* NotificationCenter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NotificationCenter.h; path = notifications/NotificationCenter.h; sourceTree = "<group>"; };
+		3390CA530FFC157B00921962 /* NotificationCenter.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = NotificationCenter.idl; path = notifications/NotificationCenter.idl; sourceTree = "<group>"; };
+		3390CA540FFC157B00921962 /* NotificationContents.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NotificationContents.h; path = notifications/NotificationContents.h; sourceTree = "<group>"; };
 		371F4F3E0D25B9AF00ECE0D5 /* FontData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontData.h; sourceTree = "<group>"; };
 		371F4F3F0D25B9AF00ECE0D5 /* FontData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontData.cpp; sourceTree = "<group>"; };
 		371F4FFA0D25E7F300ECE0D5 /* SegmentedFontData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SegmentedFontData.h; sourceTree = "<group>"; };
@@ -5640,6 +5851,7 @@
 		371F51A00D262FA000ECE0D5 /* CSSSegmentedFontFace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSSegmentedFontFace.cpp; sourceTree = "<group>"; };
 		371F53E70D2704F900ECE0D5 /* CSSUnicodeRangeValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSUnicodeRangeValue.h; sourceTree = "<group>"; };
 		371F53E80D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSUnicodeRangeValue.cpp; sourceTree = "<group>"; };
+		37202198106213C600F25C4B /* FontSmoothingMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontSmoothingMode.h; sourceTree = "<group>"; };
 		3724CA540E68A7E400DB4384 /* CoreTextController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CoreTextController.h; sourceTree = "<group>"; };
 		3724CA550E68A7E400DB4384 /* CoreTextController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CoreTextController.cpp; sourceTree = "<group>"; };
 		3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FontMacATSUI.mm; sourceTree = "<group>"; };
@@ -5657,13 +5869,13 @@
 		37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreURLResponse.mm; sourceTree = "<group>"; };
 		41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFunctionCall.h; sourceTree = "<group>"; };
 		41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptFunctionCall.cpp; sourceTree = "<group>"; };
+		410B7E711045FAB000D8224F /* JSMessageEventCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageEventCustom.cpp; sourceTree = "<group>"; };
 		4110463F0FA222A600BA436A /* ScriptEventListener.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptEventListener.h; sourceTree = "<group>"; };
 		411046400FA222A600BA436A /* ScriptEventListener.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptEventListener.cpp; sourceTree = "<group>"; };
 		4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptState.cpp; sourceTree = "<group>"; };
 		412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptObjectQuarantine.cpp; sourceTree = "<group>"; };
 		415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAbstractWorkerCustom.cpp; sourceTree = "<group>"; };
 		415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerConstructor.cpp; sourceTree = "<group>"; };
-		415B7C560FF598E6006770F7 /* JSSharedWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerCustom.cpp; sourceTree = "<group>"; };
 		415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSharedWorkerConstructor.h; sourceTree = "<group>"; };
 		4162A44D101145AE00DFF3ED /* DedicatedWorkerContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DedicatedWorkerContext.cpp; path = workers/DedicatedWorkerContext.cpp; sourceTree = "<group>"; };
 		4162A44E101145AE00DFF3ED /* DedicatedWorkerContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DedicatedWorkerContext.h; path = workers/DedicatedWorkerContext.h; sourceTree = "<group>"; };
@@ -5673,6 +5885,7 @@
 		4162A4561011464700DFF3ED /* JSDedicatedWorkerContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDedicatedWorkerContext.h; sourceTree = "<group>"; };
 		4167EBF3102962BA003D252A /* DefaultSharedWorkerRepository.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DefaultSharedWorkerRepository.cpp; path = workers/DefaultSharedWorkerRepository.cpp; sourceTree = "<group>"; };
 		4167EBF4102962BA003D252A /* DefaultSharedWorkerRepository.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DefaultSharedWorkerRepository.h; path = workers/DefaultSharedWorkerRepository.h; sourceTree = "<group>"; };
+		416E29A5102FA962007FC14E /* WorkerReportingProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerReportingProxy.h; path = workers/WorkerReportingProxy.h; sourceTree = "<group>"; };
 		416E75BC0EDF8FD700360E1D /* ScriptCallStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallStack.h; sourceTree = "<group>"; };
 		416E75BD0EDF8FD700360E1D /* ScriptCallStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallStack.cpp; sourceTree = "<group>"; };
 		416E75C90EDF90C700360E1D /* ScriptCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallFrame.h; sourceTree = "<group>"; };
@@ -5698,7 +5911,6 @@
 		41D168E210226E89009BC827 /* SharedWorkerRepository.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SharedWorkerRepository.h; path = workers/SharedWorkerRepository.h; sourceTree = "<group>"; };
 		41D168E510226E89009BC827 /* SharedWorkerThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SharedWorkerThread.cpp; path = workers/SharedWorkerThread.cpp; sourceTree = "<group>"; };
 		41D168E610226E89009BC827 /* SharedWorkerThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SharedWorkerThread.h; path = workers/SharedWorkerThread.h; sourceTree = "<group>"; };
-		41D168EF10226EC4009BC827 /* JSSharedWorkerContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerContextCustom.cpp; sourceTree = "<group>"; };
 		41D1690310238B66009BC827 /* JSSharedWorkerContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerContext.cpp; sourceTree = "<group>"; };
 		41D1690410238B66009BC827 /* JSSharedWorkerContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSharedWorkerContext.h; sourceTree = "<group>"; };
 		41E1B1CA0FF5986900576B3B /* AbstractWorker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AbstractWorker.cpp; path = workers/AbstractWorker.cpp; sourceTree = "<group>"; };
@@ -5721,6 +5933,7 @@
 		41F066E30F64BCF600A07EAC /* ScriptObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptObject.cpp; sourceTree = "<group>"; };
 		41F1D21D0EF35C2A00DA8753 /* ScriptCachedFrameData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCachedFrameData.h; sourceTree = "<group>"; };
 		41F1D21E0EF35C2A00DA8753 /* ScriptCachedFrameData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCachedFrameData.cpp; sourceTree = "<group>"; };
+		41F584C6104652CB009CAA64 /* JSMessagePortCustom.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMessagePortCustom.h; sourceTree = "<group>"; };
 		4415292C0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLPlugInImageElement.h; sourceTree = "<group>"; };
 		4415292D0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLPlugInImageElement.cpp; sourceTree = "<group>"; };
 		4429AAFB0CB84E88007647C5 /* DOMHTMLEmbedElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLEmbedElementPrivate.h; sourceTree = "<group>"; };
@@ -5741,7 +5954,7 @@
 		449195980FBE17D700D9F824 /* WebCore.SVG.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.SVG.exp; sourceTree = "<group>"; };
 		449195990FBE17D700D9F824 /* WebCore.SVG.Animation.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.SVG.Animation.exp; sourceTree = "<group>"; };
 		4491959A0FBE17D700D9F824 /* WebCore.NPAPI.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.NPAPI.exp; sourceTree = "<group>"; };
-		4491959B0FBE17D700D9F824 /* WebCore.LP64.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.LP64.exp; sourceTree = "<group>"; };
+		4491959B0FBE17D700D9F824 /* WebCore.PluginHostProcess.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.PluginHostProcess.exp; sourceTree = "<group>"; };
 		4491959C0FBE17D700D9F824 /* WebCore.JNI.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.JNI.exp; sourceTree = "<group>"; };
 		4491959D0FBE17D700D9F824 /* WebCore.DashboardSupport.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.DashboardSupport.exp; sourceTree = "<group>"; };
 		449B19F30FA72ECE0015CA4A /* HTMLParserQuirks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLParserQuirks.h; sourceTree = "<group>"; };
@@ -5785,6 +5998,55 @@
 		498391570F1E776900C23782 /* WebKitCSSMatrix.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitCSSMatrix.idl; sourceTree = "<group>"; };
 		498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitCSSMatrixConstructor.cpp; sourceTree = "<group>"; };
 		498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitCSSMatrixConstructor.h; sourceTree = "<group>"; };
+		49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasBuffer.cpp; sourceTree = "<group>"; };
+		49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasBuffer.h; sourceTree = "<group>"; };
+		49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArray.cpp; sourceTree = "<group>"; };
+		49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasByteArray.h; sourceTree = "<group>"; };
+		49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFramebuffer.cpp; sourceTree = "<group>"; };
+		49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFramebuffer.h; sourceTree = "<group>"; };
+		49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasProgram.cpp; sourceTree = "<group>"; };
+		49C7B9891042D2D30009D447 /* JSCanvasProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasProgram.h; sourceTree = "<group>"; };
+		49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderbuffer.cpp; sourceTree = "<group>"; };
+		49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderbuffer.h; sourceTree = "<group>"; };
+		49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShader.cpp; sourceTree = "<group>"; };
+		49C7B9901042D2D30009D447 /* JSCanvasShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShader.h; sourceTree = "<group>"; };
+		49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasTexture.cpp; sourceTree = "<group>"; };
+		49C7B9921042D2D30009D447 /* JSCanvasTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasTexture.h; sourceTree = "<group>"; };
+		49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasBuffer.cpp; path = canvas/CanvasBuffer.cpp; sourceTree = "<group>"; };
+		49C7B9A91042D32E0009D447 /* CanvasBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasBuffer.h; path = canvas/CanvasBuffer.h; sourceTree = "<group>"; };
+		49C7B9AA1042D32E0009D447 /* CanvasBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasBuffer.idl; path = canvas/CanvasBuffer.idl; sourceTree = "<group>"; };
+		49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasByteArray.cpp; path = canvas/CanvasByteArray.cpp; sourceTree = "<group>"; };
+		49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasByteArray.h; path = canvas/CanvasByteArray.h; sourceTree = "<group>"; };
+		49C7B9AD1042D32E0009D447 /* CanvasByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasByteArray.idl; path = canvas/CanvasByteArray.idl; sourceTree = "<group>"; };
+		49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasFramebuffer.cpp; path = canvas/CanvasFramebuffer.cpp; sourceTree = "<group>"; };
+		49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasFramebuffer.h; path = canvas/CanvasFramebuffer.h; sourceTree = "<group>"; };
+		49C7B9B01042D32E0009D447 /* CanvasFramebuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasFramebuffer.idl; path = canvas/CanvasFramebuffer.idl; sourceTree = "<group>"; };
+		49C7B9B41042D32F0009D447 /* CanvasObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasObject.cpp; path = canvas/CanvasObject.cpp; sourceTree = "<group>"; };
+		49C7B9B51042D32F0009D447 /* CanvasObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasObject.h; path = canvas/CanvasObject.h; sourceTree = "<group>"; };
+		49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasProgram.cpp; path = canvas/CanvasProgram.cpp; sourceTree = "<group>"; };
+		49C7B9B71042D32F0009D447 /* CanvasProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasProgram.h; path = canvas/CanvasProgram.h; sourceTree = "<group>"; };
+		49C7B9B81042D32F0009D447 /* CanvasProgram.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasProgram.idl; path = canvas/CanvasProgram.idl; sourceTree = "<group>"; };
+		49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderbuffer.cpp; path = canvas/CanvasRenderbuffer.cpp; sourceTree = "<group>"; };
+		49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderbuffer.h; path = canvas/CanvasRenderbuffer.h; sourceTree = "<group>"; };
+		49C7B9BB1042D32F0009D447 /* CanvasRenderbuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderbuffer.idl; path = canvas/CanvasRenderbuffer.idl; sourceTree = "<group>"; };
+		49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderingContext.cpp; path = canvas/CanvasRenderingContext.cpp; sourceTree = "<group>"; };
+		49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderingContext.h; path = canvas/CanvasRenderingContext.h; sourceTree = "<group>"; };
+		49C7B9BE1042D32F0009D447 /* CanvasRenderingContext.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderingContext.idl; path = canvas/CanvasRenderingContext.idl; sourceTree = "<group>"; };
+		49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderingContext3D.cpp; path = canvas/CanvasRenderingContext3D.cpp; sourceTree = "<group>"; };
+		49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderingContext3D.h; path = canvas/CanvasRenderingContext3D.h; sourceTree = "<group>"; };
+		49C7B9C11042D32F0009D447 /* CanvasRenderingContext3D.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderingContext3D.idl; path = canvas/CanvasRenderingContext3D.idl; sourceTree = "<group>"; };
+		49C7B9C21042D32F0009D447 /* CanvasShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasShader.cpp; path = canvas/CanvasShader.cpp; sourceTree = "<group>"; };
+		49C7B9C31042D32F0009D447 /* CanvasShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasShader.h; path = canvas/CanvasShader.h; sourceTree = "<group>"; };
+		49C7B9C41042D32F0009D447 /* CanvasShader.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasShader.idl; path = canvas/CanvasShader.idl; sourceTree = "<group>"; };
+		49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasTexture.cpp; path = canvas/CanvasTexture.cpp; sourceTree = "<group>"; };
+		49C7B9C61042D32F0009D447 /* CanvasTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasTexture.h; path = canvas/CanvasTexture.h; sourceTree = "<group>"; };
+		49C7B9C71042D32F0009D447 /* CanvasTexture.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasTexture.idl; path = canvas/CanvasTexture.idl; sourceTree = "<group>"; };
+		49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GraphicsContext3D.h; sourceTree = "<group>"; };
+		49C7B9FD1042D38C0009D447 /* Canvas3DLayer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Canvas3DLayer.h; sourceTree = "<group>"; };
+		49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = Canvas3DLayer.mm; sourceTree = "<group>"; };
+		49C7B9FF1042D38C0009D447 /* GraphicsContext3DMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GraphicsContext3DMac.cpp; sourceTree = "<group>"; };
+		49C7BA781042EFAE0009D447 /* OpenGL.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = OpenGL.framework; path = /System/Library/Frameworks/OpenGL.framework; sourceTree = "<absolute>"; };
+		49C7BA8C1042F5B10009D447 /* JSDocumentCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDocumentCustom.cpp; sourceTree = "<group>"; };
 		49D5DC270F423A73008F20FD /* Matrix3DTransformOperation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Matrix3DTransformOperation.cpp; path = transforms/Matrix3DTransformOperation.cpp; sourceTree = "<group>"; };
 		49D5DC280F423A73008F20FD /* Matrix3DTransformOperation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Matrix3DTransformOperation.h; path = transforms/Matrix3DTransformOperation.h; sourceTree = "<group>"; };
 		49D5DC290F423A73008F20FD /* PerspectiveTransformOperation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = PerspectiveTransformOperation.cpp; path = transforms/PerspectiveTransformOperation.cpp; sourceTree = "<group>"; };
@@ -5810,6 +6072,78 @@
 		49E912A70EFAC906009D0CAF /* AnimationList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AnimationList.cpp; path = animation/AnimationList.cpp; sourceTree = "<group>"; };
 		49E912A80EFAC906009D0CAF /* AnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationList.h; path = animation/AnimationList.h; sourceTree = "<group>"; };
 		49E912A90EFAC906009D0CAF /* TimingFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TimingFunction.h; path = animation/TimingFunction.h; sourceTree = "<group>"; };
+		49EECDC710503C2300099FAB /* CanvasArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasArray.cpp; path = canvas/CanvasArray.cpp; sourceTree = "<group>"; };
+		49EECDC810503C2300099FAB /* CanvasArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasArray.h; path = canvas/CanvasArray.h; sourceTree = "<group>"; };
+		49EECDC910503C2300099FAB /* CanvasArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasArray.idl; path = canvas/CanvasArray.idl; sourceTree = "<group>"; };
+		49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasArrayBuffer.cpp; path = canvas/CanvasArrayBuffer.cpp; sourceTree = "<group>"; };
+		49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasArrayBuffer.h; path = canvas/CanvasArrayBuffer.h; sourceTree = "<group>"; };
+		49EECDCC10503C2300099FAB /* CanvasArrayBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasArrayBuffer.idl; path = canvas/CanvasArrayBuffer.idl; sourceTree = "<group>"; };
+		49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasFloatArray.cpp; path = canvas/CanvasFloatArray.cpp; sourceTree = "<group>"; };
+		49EECDCE10503C2300099FAB /* CanvasFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasFloatArray.h; path = canvas/CanvasFloatArray.h; sourceTree = "<group>"; };
+		49EECDCF10503C2300099FAB /* CanvasFloatArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasFloatArray.idl; path = canvas/CanvasFloatArray.idl; sourceTree = "<group>"; };
+		49EECDD010503C2300099FAB /* CanvasIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasIntArray.cpp; path = canvas/CanvasIntArray.cpp; sourceTree = "<group>"; };
+		49EECDD110503C2300099FAB /* CanvasIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasIntArray.h; path = canvas/CanvasIntArray.h; sourceTree = "<group>"; };
+		49EECDD210503C2300099FAB /* CanvasIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasIntArray.idl; path = canvas/CanvasIntArray.idl; sourceTree = "<group>"; };
+		49EECDD310503C2300099FAB /* CanvasShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasShortArray.cpp; path = canvas/CanvasShortArray.cpp; sourceTree = "<group>"; };
+		49EECDD410503C2300099FAB /* CanvasShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasShortArray.h; path = canvas/CanvasShortArray.h; sourceTree = "<group>"; };
+		49EECDD510503C2300099FAB /* CanvasShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasShortArray.idl; path = canvas/CanvasShortArray.idl; sourceTree = "<group>"; };
+		49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedByteArray.cpp; path = canvas/CanvasUnsignedByteArray.cpp; sourceTree = "<group>"; };
+		49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedByteArray.h; path = canvas/CanvasUnsignedByteArray.h; sourceTree = "<group>"; };
+		49EECDD810503C2300099FAB /* CanvasUnsignedByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedByteArray.idl; path = canvas/CanvasUnsignedByteArray.idl; sourceTree = "<group>"; };
+		49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedIntArray.cpp; path = canvas/CanvasUnsignedIntArray.cpp; sourceTree = "<group>"; };
+		49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedIntArray.h; path = canvas/CanvasUnsignedIntArray.h; sourceTree = "<group>"; };
+		49EECDDB10503C2300099FAB /* CanvasUnsignedIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedIntArray.idl; path = canvas/CanvasUnsignedIntArray.idl; sourceTree = "<group>"; };
+		49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedShortArray.cpp; path = canvas/CanvasUnsignedShortArray.cpp; sourceTree = "<group>"; };
+		49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedShortArray.h; path = canvas/CanvasUnsignedShortArray.h; sourceTree = "<group>"; };
+		49EECDDE10503C2400099FAB /* CanvasUnsignedShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedShortArray.idl; path = canvas/CanvasUnsignedShortArray.idl; sourceTree = "<group>"; };
+		49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayBuffer.cpp; sourceTree = "<group>"; };
+		49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArrayBuffer.h; sourceTree = "<group>"; };
+		49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArray.cpp; sourceTree = "<group>"; };
+		49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFloatArray.h; sourceTree = "<group>"; };
+		49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArray.cpp; sourceTree = "<group>"; };
+		49EECEF7105070C400099FAB /* JSCanvasIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasIntArray.h; sourceTree = "<group>"; };
+		49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArray.cpp; sourceTree = "<group>"; };
+		49EECEF9105070C400099FAB /* JSCanvasShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShortArray.h; sourceTree = "<group>"; };
+		49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArray.cpp; sourceTree = "<group>"; };
+		49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedByteArray.h; sourceTree = "<group>"; };
+		49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArray.cpp; sourceTree = "<group>"; };
+		49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedIntArray.h; sourceTree = "<group>"; };
+		49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArray.cpp; sourceTree = "<group>"; };
+		49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedShortArray.h; sourceTree = "<group>"; };
+		49EECF19105072F300099FAB /* JSCanvasArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArray.cpp; sourceTree = "<group>"; };
+		49EECF1A105072F300099FAB /* JSCanvasArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArray.h; sourceTree = "<group>"; };
+		49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayBufferConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArrayBufferConstructor.h; sourceTree = "<group>"; };
+		49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasByteArrayConstructor.h; sourceTree = "<group>"; };
+		49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFloatArrayConstructor.h; sourceTree = "<group>"; };
+		49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasIntArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShortArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedByteArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedIntArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedShortArrayConstructor.h; sourceTree = "<group>"; };
+		49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext.cpp; sourceTree = "<group>"; };
+		49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext.h; sourceTree = "<group>"; };
+		49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2D.cpp; sourceTree = "<group>"; };
+		49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext2D.h; sourceTree = "<group>"; };
+		49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext3D.cpp; sourceTree = "<group>"; };
+		49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext3D.h; sourceTree = "<group>"; };
+		49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2DCustom.cpp; sourceTree = "<group>"; };
+		49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext3DCustom.cpp; sourceTree = "<group>"; };
+		49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContextCustom.cpp; sourceTree = "<group>"; };
 		4A8C96EA0BE69032004EEFF0 /* SelectionControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = SelectionControllerMac.mm; path = mac/SelectionControllerMac.mm; sourceTree = "<group>"; };
 		4B2708C50AF19EE40065127F /* Pasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pasteboard.h; sourceTree = "<group>"; };
 		4B2709810AF2E5E00065127F /* PasteboardMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PasteboardMac.mm; sourceTree = "<group>"; };
@@ -5849,6 +6183,14 @@
 		4E1959280A39DACC00220FE5 /* MediaQueryExp.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryExp.h; sourceTree = "<group>"; };
 		510184670B08602A004A825F /* CachedPage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedPage.h; sourceTree = "<group>"; };
 		510184680B08602A004A825F /* CachedPage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedPage.cpp; sourceTree = "<group>"; };
+		510D4A2D103165EE0049EA54 /* SocketStreamErrorBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamErrorBase.cpp; sourceTree = "<group>"; };
+		510D4A2E103165EE0049EA54 /* SocketStreamErrorBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamErrorBase.h; sourceTree = "<group>"; };
+		510D4A30103165EE0049EA54 /* SocketStreamHandleBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamHandleBase.cpp; sourceTree = "<group>"; };
+		510D4A31103165EE0049EA54 /* SocketStreamHandleBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandleBase.h; sourceTree = "<group>"; };
+		510D4A32103165EE0049EA54 /* SocketStreamHandleClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandleClient.h; sourceTree = "<group>"; };
+		510D4A47103177A20049EA54 /* WebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketChannel.cpp; sourceTree = "<group>"; };
+		510D4A48103177A20049EA54 /* WebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketChannel.h; sourceTree = "<group>"; };
+		510D4A49103177A20049EA54 /* WebSocketChannelClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketChannelClient.h; sourceTree = "<group>"; };
 		5116D9750CF177BD00C2B84D /* DatabaseDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseDetails.h; sourceTree = "<group>"; };
 		511F23130DC160DA004F0032 /* LocalStorageTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalStorageTask.cpp; sourceTree = "<group>"; };
 		511F23140DC160DA004F0032 /* LocalStorageTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalStorageTask.h; sourceTree = "<group>"; };
@@ -5932,6 +6274,9 @@
 		519611E90CAC749C0010A80C /* DatabaseTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseTask.cpp; sourceTree = "<group>"; };
 		519FE0A10DAD446E00A08F21 /* HTMLAttributeNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLAttributeNames.in; sourceTree = "<group>"; };
 		519FE0A20DAD446E00A08F21 /* HTMLTagNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLTagNames.in; sourceTree = "<group>"; };
+		51A052311058774F00CC9E95 /* CredentialStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CredentialStorage.h; sourceTree = "<group>"; };
+		51A052321058774F00CC9E95 /* CredentialStorage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CredentialStorage.cpp; sourceTree = "<group>"; };
+		51A052551058874000CC9E95 /* ProtectionSpaceHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProtectionSpaceHash.h; sourceTree = "<group>"; };
 		51A45B540CAD7FD7000D2BE9 /* DatabaseAuthorizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseAuthorizer.h; sourceTree = "<group>"; };
 		51A45B550CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseAuthorizer.cpp; sourceTree = "<group>"; };
 		51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginQuotaManager.cpp; sourceTree = "<group>"; };
@@ -5939,6 +6284,11 @@
 		51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginUsageRecord.cpp; sourceTree = "<group>"; };
 		51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OriginUsageRecord.h; sourceTree = "<group>"; };
 		51AA3F6E0BD5AA9E00892971 /* ResourceLoaderMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ResourceLoaderMac.mm; sourceTree = "<group>"; };
+		51ABAE1A103C18FF008C5260 /* SocketStreamError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SocketStreamError.h; path = cf/SocketStreamError.h; sourceTree = "<group>"; };
+		51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SocketStreamHandle.h; path = cf/SocketStreamHandle.h; sourceTree = "<group>"; };
+		51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SocketStreamHandleCFNet.cpp; path = cf/SocketStreamHandleCFNet.cpp; sourceTree = "<group>"; };
+		51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketHandshake.cpp; sourceTree = "<group>"; };
+		51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketHandshake.h; sourceTree = "<group>"; };
 		51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LegacyWebArchiveMac.mm; sourceTree = "<group>"; };
 		51BE37DE0DAEE00E001085FC /* StorageArea.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageArea.h; sourceTree = "<group>"; };
 		51C0AA380F2AA10A001648C2 /* CachedFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedFrame.h; sourceTree = "<group>"; };
@@ -5995,10 +6345,13 @@
 		5D925B660F64D4DD00B847F0 /* ScrollBehavior.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollBehavior.h; sourceTree = "<group>"; };
 		5DA5E0FA102B953800088CF9 /* JSWebSocket.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebSocket.cpp; sourceTree = "<group>"; };
 		5DA5E0FB102B953800088CF9 /* JSWebSocket.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebSocket.h; sourceTree = "<group>"; };
+		5DB1BC6810715A6400EFAA49 /* TransformSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TransformSource.h; sourceTree = "<group>"; };
+		5DB1BC6910715A6400EFAA49 /* TransformSourceLibxslt.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TransformSourceLibxslt.cpp; sourceTree = "<group>"; };
 		5DCF836C0D59159800953BC6 /* PluginInfoStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginInfoStore.h; sourceTree = "<group>"; };
 		63189AE20E83A33300012E41 /* NodeRareData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeRareData.h; sourceTree = "<group>"; };
 		637B7ADE0E8767B800E32194 /* ElementRareData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ElementRareData.h; sourceTree = "<group>"; };
 		63D7B32C0E78CD3F00F7617C /* NodeRenderStyle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeRenderStyle.h; sourceTree = "<group>"; };
+		63F371CD100E790000BBA87A /* WebCore.Video.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.Video.exp; sourceTree = "<group>"; };
 		650F53DB09D15DDA00C9B0C8 /* CSSGrammar.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSGrammar.h; sourceTree = "<group>"; };
 		650FBF270D9AF046008FC292 /* SVGHKernElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGHKernElement.cpp; sourceTree = "<group>"; };
 		650FBF280D9AF047008FC292 /* SVGHKernElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGHKernElement.h; sourceTree = "<group>"; };
@@ -6101,13 +6454,13 @@
 		65DF323409D1DE65000BE325 /* JSCanvasGradient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCanvasGradient.h; sourceTree = "<group>"; };
 		65DF323509D1DE65000BE325 /* JSCanvasPattern.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasPattern.cpp; sourceTree = "<group>"; };
 		65DF323609D1DE65000BE325 /* JSCanvasPattern.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCanvasPattern.h; sourceTree = "<group>"; };
-		65DF323709D1DE65000BE325 /* JSCanvasRenderingContext2D.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2D.cpp; sourceTree = "<group>"; };
-		65DF323809D1DE65000BE325 /* JSCanvasRenderingContext2D.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext2D.h; sourceTree = "<group>"; };
 		65F80697054D9F86008BF776 /* BlockExceptions.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = BlockExceptions.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		65FEA86809833ADE00BED4AB /* Page.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Page.cpp; sourceTree = "<group>"; };
 		72626E010EF022FE00A07E20 /* FontFastPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFastPath.cpp; sourceTree = "<group>"; };
-		7284ADDB0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UserStyleSheetLoader.cpp; sourceTree = "<group>"; };
-		7284ADDC0E6FEB31002EEFBD /* UserStyleSheetLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserStyleSheetLoader.h; sourceTree = "<group>"; };
+		75092BFC104B80F9003DD168 /* DOMDispatchTimelineItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMDispatchTimelineItem.cpp; sourceTree = "<group>"; };
+		75092BFD104B80F9003DD168 /* DOMDispatchTimelineItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDispatchTimelineItem.h; sourceTree = "<group>"; };
+		754133A7102E00E800075D00 /* InspectorTimelineAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTimelineAgent.h; sourceTree = "<group>"; };
+		754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTimelineAgent.cpp; sourceTree = "<group>"; };
 		75793E800D0CE0B3007FC0AC /* MessageEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; name = MessageEvent.cpp; path = dom/MessageEvent.cpp; sourceTree = SOURCE_ROOT; };
 		75793E810D0CE0B3007FC0AC /* MessageEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; name = MessageEvent.h; path = dom/MessageEvent.h; sourceTree = SOURCE_ROOT; };
 		75793E820D0CE0B3007FC0AC /* MessageEvent.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; name = MessageEvent.idl; path = dom/MessageEvent.idl; sourceTree = SOURCE_ROOT; };
@@ -6116,6 +6469,12 @@
 		75793ED00D0CE85B007FC0AC /* DOMMessageEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMessageEvent.h; sourceTree = "<group>"; };
 		75793ED10D0CE85B007FC0AC /* DOMMessageEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMMessageEvent.mm; sourceTree = "<group>"; };
 		75793ED20D0CE85B007FC0AC /* DOMMessageEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMessageEventInternal.h; sourceTree = "<group>"; };
+		75A94A01104B74FB0006673C /* TimelineItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TimelineItem.cpp; sourceTree = "<group>"; };
+		75A94A02104B74FB0006673C /* TimelineItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TimelineItem.h; sourceTree = "<group>"; };
+		7693BACE106C2DCA007B0823 /* HaltablePlugin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HaltablePlugin.h; sourceTree = "<group>"; };
+		7693BACF106C2DCA007B0823 /* PluginHalter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginHalter.cpp; sourceTree = "<group>"; };
+		7693BAD0106C2DCA007B0823 /* PluginHalter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginHalter.h; sourceTree = "<group>"; };
+		7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginHalterClient.h; sourceTree = "<group>"; };
 		7A1E88F3101CC384000C4DF5 /* ScriptArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptArray.cpp; sourceTree = "<group>"; };
 		7A1E88F4101CC384000C4DF5 /* ScriptArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptArray.h; sourceTree = "<group>"; };
 		7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorDOMAgent.cpp; sourceTree = "<group>"; };
@@ -6948,7 +7307,6 @@
 		85F56A790A98CE3700ADB60A /* DOMProcessingInstruction.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMProcessingInstruction.mm; sourceTree = "<group>"; };
 		85FF31580AAFBFCB00374F38 /* DOMKeyboardEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMKeyboardEvent.h; sourceTree = "<group>"; };
 		85FF31590AAFBFCB00374F38 /* DOMKeyboardEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMKeyboardEvent.mm; sourceTree = "<group>"; };
-		929264760B61FC7200B41D34 /* JSDocumentCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSDocumentCustom.cpp; sourceTree = "<group>"; };
 		9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageGroup.cpp; sourceTree = "<group>"; };
 		9302B0BE0D79F82C00C7EE83 /* PageGroup.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageGroup.h; sourceTree = "<group>"; };
 		9305B24C098F1B6B00C28855 /* Timer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Timer.h; sourceTree = "<group>"; };
@@ -6962,6 +7320,7 @@
 		9307F1D50AF2D59000DBA31A /* HitTestResult.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HitTestResult.cpp; sourceTree = "<group>"; };
 		9307F1D60AF2D59000DBA31A /* HitTestResult.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HitTestResult.h; sourceTree = "<group>"; };
 		930908900AF7EDE40081DF01 /* HitTestRequest.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HitTestRequest.h; sourceTree = "<group>"; };
+		930FC6891072B9280045293E /* TextRenderingMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextRenderingMode.h; sourceTree = "<group>"; };
 		9327A94109968D1A0068A546 /* HTMLOptionsCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLOptionsCollection.cpp; sourceTree = "<group>"; };
 		932871BF0B20DEB70049035A /* PlatformMenuDescription.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PlatformMenuDescription.h; sourceTree = "<group>"; };
 		932E16080AF578340025F408 /* FrameLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FrameLoader.cpp; sourceTree = "<group>"; };
@@ -7097,6 +7456,8 @@
 		938E662509F09956008A48EC /* HTMLCanvasElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLCanvasElement.idl; sourceTree = "<group>"; };
 		938E665F09F09B81008A48EC /* JSHTMLCanvasElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLCanvasElement.cpp; sourceTree = "<group>"; };
 		938E666109F09B87008A48EC /* JSHTMLCanvasElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLCanvasElement.h; sourceTree = "<group>"; };
+		9392262C1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLCanvasElementCustom.cpp; sourceTree = "<group>"; };
+		9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSRuleListCustom.cpp; sourceTree = "<group>"; };
 		9392F1410AD185F400691BD4 /* RenderCounter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderCounter.h; sourceTree = "<group>"; };
 		9392F1430AD185FE00691BD4 /* RenderCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderCounter.cpp; sourceTree = "<group>"; };
 		9392F14B0AD1861B00691BD4 /* CounterNode.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CounterNode.h; sourceTree = "<group>"; };
@@ -7158,7 +7519,6 @@
 		93EB355E09E37FD600F43799 /* MouseEventWithHitTestResults.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MouseEventWithHitTestResults.cpp; sourceTree = "<group>"; };
 		93EEC1E509C2877700C515D1 /* Attr.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Attr.idl; sourceTree = "<group>"; };
 		93EEC1E609C2877700C515D1 /* CharacterData.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = CharacterData.idl; sourceTree = "<group>"; };
-		93EEC1E709C2877700C515D1 /* DocPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocPtr.h; sourceTree = "<group>"; };
 		93EEC1E809C2877700C515D1 /* DocumentType.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DocumentType.idl; sourceTree = "<group>"; };
 		93EEC1E909C2877700C515D1 /* DOMImplementation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMImplementation.idl; sourceTree = "<group>"; };
 		93EEC1EA09C2877700C515D1 /* Element.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Element.idl; sourceTree = "<group>"; };
@@ -7186,6 +7546,12 @@
 		93F9B79E0BA6032600854064 /* JSCDATASection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCDATASection.cpp; sourceTree = "<group>"; };
 		93F9B79F0BA6032600854064 /* JSCDATASection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCDATASection.h; sourceTree = "<group>"; };
 		93FDAFC90B11307400E2746F /* EditorInsertAction.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = EditorInsertAction.h; sourceTree = "<group>"; };
+		97059973107D975200A50A7C /* PolicyCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PolicyCallback.cpp; sourceTree = "<group>"; };
+		97059974107D975200A50A7C /* PolicyCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolicyCallback.h; sourceTree = "<group>"; };
+		97059975107D975200A50A7C /* PolicyChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PolicyChecker.cpp; sourceTree = "<group>"; };
+		97059976107D975200A50A7C /* PolicyChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolicyChecker.h; sourceTree = "<group>"; };
+		979F43D11075E44A0000F83B /* RedirectScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RedirectScheduler.cpp; sourceTree = "<group>"; };
+		979F43D21075E44A0000F83B /* RedirectScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RedirectScheduler.h; sourceTree = "<group>"; };
 		97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSSAuditor.cpp; sourceTree = "<group>"; };
 		97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XSSAuditor.h; sourceTree = "<group>"; };
 		A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLElementFactory.cpp; sourceTree = "<group>"; };
@@ -7194,6 +7560,8 @@
 		A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DragControllerMac.mm; sourceTree = "<group>"; };
 		A7352C170B1BB89D00A986D0 /* RenderSVGBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGBlock.cpp; sourceTree = "<group>"; };
 		A7352C180B1BB89D00A986D0 /* RenderSVGBlock.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSVGBlock.h; sourceTree = "<group>"; };
+		A75E497410752ACB00C9B896 /* SerializedScriptValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SerializedScriptValue.h; sourceTree = "<group>"; };
+		A75E497510752ACB00C9B896 /* SerializedScriptValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SerializedScriptValue.cpp; sourceTree = "<group>"; };
 		A75E8B800E1DE2D6007F2481 /* FEBlend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FEBlend.cpp; path = filters/FEBlend.cpp; sourceTree = "<group>"; };
 		A75E8B810E1DE2D6007F2481 /* FEBlend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FEBlend.h; path = filters/FEBlend.h; sourceTree = "<group>"; };
 		A75E8B820E1DE2D6007F2481 /* FEColorMatrix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FEColorMatrix.cpp; path = filters/FEColorMatrix.cpp; sourceTree = "<group>"; };
@@ -7316,11 +7684,6 @@
 		A80E7E940A1A83E3007FB8C5 /* JSHTMLTextAreaElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLTextAreaElement.cpp; sourceTree = "<group>"; };
 		A80E7E950A1A83E3007FB8C5 /* JSHTMLButtonElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLButtonElement.h; sourceTree = "<group>"; };
 		A80E7E960A1A83E3007FB8C5 /* JSHTMLButtonElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLButtonElement.cpp; sourceTree = "<group>"; };
-		A80F393B0CCD971A002DD990 /* JSSVGDefinitionSrcElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSSVGDefinitionSrcElement.h; sourceTree = "<group>"; };
-		A80F393C0CCD971A002DD990 /* JSSVGDefinitionSrcElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGDefinitionSrcElement.cpp; sourceTree = "<group>"; };
-		A80F39550CCD9796002DD990 /* DOMSVGDefinitionSrcElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGDefinitionSrcElementInternal.h; sourceTree = "<group>"; };
-		A80F39560CCD9796002DD990 /* DOMSVGDefinitionSrcElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMSVGDefinitionSrcElement.mm; sourceTree = "<group>"; };
-		A80F39570CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGDefinitionSrcElement.h; sourceTree = "<group>"; };
 		A81369AE097374F500D74463 /* HTMLIsIndexElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HTMLIsIndexElement.h; sourceTree = "<group>"; };
 		A81369AF097374F500D74463 /* HTMLIsIndexElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLIsIndexElement.cpp; sourceTree = "<group>"; };
 		A81369B0097374F500D74463 /* HTMLInputElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HTMLInputElement.h; sourceTree = "<group>"; };
@@ -7900,9 +8263,6 @@
 		B22278110D00BF1F0071B782 /* SVGCursorElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGCursorElement.cpp; sourceTree = "<group>"; };
 		B22278120D00BF1F0071B782 /* SVGCursorElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGCursorElement.h; sourceTree = "<group>"; };
 		B22278130D00BF1F0071B782 /* SVGCursorElement.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = SVGCursorElement.idl; sourceTree = "<group>"; };
-		B22278140D00BF1F0071B782 /* SVGDefinitionSrcElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGDefinitionSrcElement.cpp; sourceTree = "<group>"; };
-		B22278150D00BF1F0071B782 /* SVGDefinitionSrcElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGDefinitionSrcElement.h; sourceTree = "<group>"; };
-		B22278160D00BF1F0071B782 /* SVGDefinitionSrcElement.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = SVGDefinitionSrcElement.idl; sourceTree = "<group>"; };
 		B22278170D00BF1F0071B782 /* SVGDefsElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGDefsElement.cpp; sourceTree = "<group>"; };
 		B22278180D00BF1F0071B782 /* SVGDefsElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGDefsElement.h; sourceTree = "<group>"; };
 		B22278190D00BF1F0071B782 /* SVGDefsElement.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = SVGDefsElement.idl; sourceTree = "<group>"; };
@@ -8725,8 +9085,12 @@
 		B2FA3D300AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGZoomEvent.cpp; sourceTree = "<group>"; };
 		B2FA3D310AB75A6F000E5AC4 /* JSSVGZoomEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSSVGZoomEvent.h; sourceTree = "<group>"; };
 		B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreObjCExtras.mm; sourceTree = "<group>"; };
+		B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransactionClient.cpp; sourceTree = "<group>"; };
+		B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionClient.h; sourceTree = "<group>"; };
 		B5A684210FFABE9800D24689 /* SQLiteFileSystem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLiteFileSystem.h; path = sql/SQLiteFileSystem.h; sourceTree = "<group>"; };
 		B5A684230FFABEAA00D24689 /* SQLiteFileSystem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLiteFileSystem.cpp; path = sql/SQLiteFileSystem.cpp; sourceTree = "<group>"; };
+		B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransactionCoordinator.cpp; sourceTree = "<group>"; };
+		B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionCoordinator.h; sourceTree = "<group>"; };
 		BC00EFFE0E0A185500FD04E3 /* DOMFile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMFile.h; sourceTree = "<group>"; };
 		BC00EFFF0E0A185500FD04E3 /* DOMFile.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMFile.mm; sourceTree = "<group>"; };
 		BC00F0000E0A185500FD04E3 /* DOMFileInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMFileInternal.h; sourceTree = "<group>"; };
@@ -8751,10 +9115,11 @@
 		BC06EDE20BFD6D0D00856E9D /* JSHTMLTableCellElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLTableCellElement.h; sourceTree = "<group>"; };
 		BC06EE020BFD71AA00856E9D /* JSHTMLTableElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLTableElement.cpp; sourceTree = "<group>"; };
 		BC06EE030BFD71AA00856E9D /* JSHTMLTableElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLTableElement.h; sourceTree = "<group>"; };
-		BC06F24906D18A7E004A6FA3 /* XSLStyleSheet.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLStyleSheet.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		BC06F24906D18A7E004A6FA3 /* XSLStyleSheetLibxslt.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLStyleSheetLibxslt.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		BC06F24A06D18A7E004A6FA3 /* XSLStyleSheet.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = XSLStyleSheet.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		BC06F24B06D18A7E004A6FA3 /* XSLTProcessor.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLTProcessor.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		BC06F24C06D18A7E004A6FA3 /* XSLTProcessor.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = XSLTProcessor.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		BC06F24D06D18A7E004A6FA3 /* XSLTProcessorLibxslt.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLTProcessorLibxslt.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		BC073BA90C399B1F000F5979 /* FloatConversion.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FloatConversion.h; sourceTree = "<group>"; };
 		BC0B36A10CD3C67C00AC7EB5 /* Console.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Console.cpp; sourceTree = "<group>"; };
 		BC0B36A20CD3C67C00AC7EB5 /* Console.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Console.h; sourceTree = "<group>"; };
@@ -8786,7 +9151,6 @@
 		BC1A37A8097C715F0019F3D8 /* DOMTraversal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMTraversal.h; sourceTree = "<group>"; };
 		BC1A37A9097C715F0019F3D8 /* DOMUtility.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMUtility.mm; sourceTree = "<group>"; };
 		BC1A37AA097C715F0019F3D8 /* DOMViews.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMViews.h; sourceTree = "<group>"; };
-		BC1DEA4E0E268EB60083A73F /* JSDocumentFragmentCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDocumentFragmentCustom.cpp; sourceTree = "<group>"; };
 		BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSValueCustom.cpp; sourceTree = "<group>"; };
 		BC212A1E0FE8333200EC3708 /* HTMLDataGridElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDataGridElement.h; sourceTree = "<group>"; };
 		BC212A230FE8345D00EC3708 /* HTMLDataGridElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLDataGridElement.idl; sourceTree = "<group>"; };
@@ -9028,18 +9392,22 @@
 		BC80C9860CD294EE00A0B7B3 /* CSSTimingFunctionValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSTimingFunctionValue.h; sourceTree = "<group>"; };
 		BC8243250D0CE8A200460C8F /* JSSQLError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLError.h; sourceTree = "<group>"; };
 		BC8243260D0CE8A200460C8F /* JSSQLTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransaction.h; sourceTree = "<group>"; };
-		BC8243270D0CE8A200460C8F /* JSVoidCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSVoidCallback.cpp; sourceTree = "<group>"; };
-		BC8243280D0CE8A200460C8F /* JSVoidCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSVoidCallback.h; sourceTree = "<group>"; };
 		BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WindowFeatures.cpp; sourceTree = "<group>"; };
 		BC8243E70D0CFD7500460C8F /* WindowFeatures.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WindowFeatures.h; sourceTree = "<group>"; };
 		BC8B853C0E7C7F1100AB6984 /* ScrollbarThemeMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollbarThemeMac.h; sourceTree = "<group>"; };
 		BC8B854A0E7C7F5600AB6984 /* ScrollbarTheme.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollbarTheme.h; sourceTree = "<group>"; };
+		BC8BF150105813BF00A40A07 /* UserStyleSheet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserStyleSheet.h; sourceTree = "<group>"; };
+		BC8BF1591058141800A40A07 /* UserStyleSheetTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserStyleSheetTypes.h; sourceTree = "<group>"; };
 		BC8C8FAB0DDCD31B00B592F4 /* RenderStyle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderStyle.cpp; path = style/RenderStyle.cpp; sourceTree = "<group>"; };
 		BC8C8FAC0DDCD31B00B592F4 /* RenderStyle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderStyle.h; path = style/RenderStyle.h; sourceTree = "<group>"; };
 		BC904B720D10998F00680D32 /* ClassNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ClassNodeList.cpp; sourceTree = "<group>"; };
 		BC904B730D10998F00680D32 /* ClassNodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassNodeList.h; sourceTree = "<group>"; };
 		BC926F7E0C0552470082776B /* JSHTMLFrameSetElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLFrameSetElement.cpp; sourceTree = "<group>"; };
 		BC926F7F0C0552470082776B /* JSHTMLFrameSetElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLFrameSetElement.h; sourceTree = "<group>"; };
+		BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = BeforeLoadEvent.idl; sourceTree = "<group>"; };
+		BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BeforeLoadEvent.h; sourceTree = "<group>"; };
+		BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBeforeLoadEvent.cpp; sourceTree = "<group>"; };
+		BC946347107A936600857193 /* JSBeforeLoadEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBeforeLoadEvent.h; sourceTree = "<group>"; };
 		BC94D1070C274F88006BC617 /* PlatformScreenMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformScreenMac.mm; sourceTree = "<group>"; };
 		BC94D14C0C275C68006BC617 /* JSHistory.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHistory.cpp; sourceTree = "<group>"; };
 		BC94D14D0C275C68006BC617 /* JSHistory.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHistory.h; sourceTree = "<group>"; };
@@ -9057,6 +9425,8 @@
 		BC9BC64D0E7C4889008B9849 /* ScrollbarClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollbarClient.h; sourceTree = "<group>"; };
 		BCA169A00BFD55B40019CA76 /* JSHTMLTableCaptionElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLTableCaptionElement.cpp; sourceTree = "<group>"; };
 		BCA169A10BFD55B40019CA76 /* JSHTMLTableCaptionElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLTableCaptionElement.h; sourceTree = "<group>"; };
+		BCA2B0601050475F0043BD1C /* UserScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserScript.h; sourceTree = "<group>"; };
+		BCA2B08A10505BCD0043BD1C /* UserScriptTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserScriptTypes.h; sourceTree = "<group>"; };
 		BCA378BA0D15F64200B793D6 /* ScheduledAction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScheduledAction.cpp; sourceTree = "<group>"; };
 		BCA378BB0D15F64200B793D6 /* ScheduledAction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScheduledAction.h; sourceTree = "<group>"; };
 		BCA83E360D7CDC4E003421A8 /* Clipboard.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Clipboard.idl; sourceTree = "<group>"; };
@@ -9067,6 +9437,8 @@
 		BCA846D50DC67A350026C309 /* RenderReplica.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderReplica.h; sourceTree = "<group>"; };
 		BCA85A0F0C3AEAF4006F8308 /* DOMSVGNumberInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGNumberInternal.h; sourceTree = "<group>"; };
 		BCAA90C20A7EBA60008B1229 /* Scrollbar.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; name = Scrollbar.cpp; path = platform/Scrollbar.cpp; sourceTree = SOURCE_ROOT; };
+		BCACF3BA1072921A00C0C8A3 /* UserContentURLPattern.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UserContentURLPattern.cpp; sourceTree = "<group>"; };
+		BCACF3BB1072921A00C0C8A3 /* UserContentURLPattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserContentURLPattern.h; sourceTree = "<group>"; };
 		BCAEFCAD1016CE4A0040D34E /* DOMRGBColor.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMRGBColor.mm; sourceTree = "<group>"; };
 		BCB16BFE0979C3BD00467741 /* Cache.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Cache.cpp; sourceTree = "<group>"; };
 		BCB16BFF0979C3BD00467741 /* Cache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Cache.h; sourceTree = "<group>"; };
@@ -9131,6 +9503,8 @@
 		BCCBE7B40E07166900EAFA8E /* CSSVariableDependentValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSVariableDependentValue.cpp; sourceTree = "<group>"; };
 		BCCD74DB0A4C8D35005FDA6D /* HTMLViewSourceDocument.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HTMLViewSourceDocument.h; sourceTree = "<group>"; };
 		BCCD74E40A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLViewSourceDocument.cpp; sourceTree = "<group>"; };
+		BCCE58AB1061E8CF008FB35A /* JSDatabaseCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDatabaseCustom.cpp; sourceTree = "<group>"; };
+		BCCE58AE1061E90C008FB35A /* JSDocumentFragmentCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDocumentFragmentCustom.cpp; sourceTree = "<group>"; };
 		BCCFBAE70B5152ED0001F1D7 /* Tokenizer.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Tokenizer.h; sourceTree = "<group>"; };
 		BCD0E0F70E972C3500265DEA /* SecurityOrigin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SecurityOrigin.cpp; sourceTree = "<group>"; };
 		BCD0E0F80E972C3500265DEA /* SecurityOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecurityOrigin.h; sourceTree = "<group>"; };
@@ -9143,8 +9517,6 @@
 		BCD9C25F0C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNamedNodeMapCustom.cpp; sourceTree = "<group>"; };
 		BCD9C2600C17AA67005C90A2 /* JSNodeCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNodeCustom.cpp; sourceTree = "<group>"; };
 		BCD9C2610C17AA67005C90A2 /* JSNodeListCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNodeListCustom.cpp; sourceTree = "<group>"; };
-		BCD9C26C0C17AA81005C90A2 /* JSNamedNodesCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNamedNodesCollection.cpp; sourceTree = "<group>"; };
-		BCD9C26D0C17AA81005C90A2 /* JSNamedNodesCollection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSNamedNodesCollection.h; sourceTree = "<group>"; };
 		BCD9C2BC0C17B69E005C90A2 /* JSNamedNodeMap.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNamedNodeMap.cpp; sourceTree = "<group>"; };
 		BCD9C2BD0C17B69E005C90A2 /* JSNamedNodeMap.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSNamedNodeMap.h; sourceTree = "<group>"; };
 		BCD9C2BE0C17B69E005C90A2 /* JSNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNodeList.cpp; sourceTree = "<group>"; };
@@ -9251,6 +9623,7 @@
 		BCEFE1E80DCA5F6400739219 /* JSXSLTProcessor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSXSLTProcessor.cpp; sourceTree = "<group>"; };
 		BCEFE1E90DCA5F6400739219 /* JSXSLTProcessor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSXSLTProcessor.h; sourceTree = "<group>"; };
 		BCF5245F0FEBEE5D0095BF26 /* HTMLDataGridElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDataGridElement.cpp; sourceTree = "<group>"; };
+		BCFA930710333193007B25D1 /* RenderOverflow.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderOverflow.h; sourceTree = "<group>"; };
 		BCFB2E5D0979E46400BA703D /* CachedResourceClient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CachedResourceClient.h; sourceTree = "<group>"; };
 		BCFB2F74097A2E1A00BA703D /* Arena.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Arena.cpp; sourceTree = "<group>"; };
 		BCFB2F75097A2E1A00BA703D /* Arena.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Arena.h; sourceTree = "<group>"; };
@@ -9282,6 +9655,8 @@
 		C5160EE91004543A00A7CEE2 /* StorageAreaImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageAreaImpl.h; sourceTree = "<group>"; };
 		C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageNamespaceImpl.h; sourceTree = "<group>"; };
 		C55E38BC10040D5D00A56BDB /* StorageNamespaceImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageNamespaceImpl.cpp; sourceTree = "<group>"; };
+		C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageEventDispatcher.cpp; sourceTree = "<group>"; };
+		C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageEventDispatcher.h; sourceTree = "<group>"; };
 		C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModifySelectionListLevel.h; sourceTree = "<group>"; };
 		C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModifySelectionListLevel.cpp; sourceTree = "<group>"; };
 		CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptSourceProvider.h; sourceTree = "<group>"; };
@@ -9299,10 +9674,19 @@
 		D23CA55C0AB0EAAE005108A5 /* JSRangeException.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSRangeException.h; sourceTree = "<group>"; };
 		D23CA55E0AB0EAB6005108A5 /* JSRangeException.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSRangeException.cpp; sourceTree = "<group>"; };
 		D23CA56B0AB0EB8D005108A5 /* RangeException.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RangeException.h; sourceTree = "<group>"; };
+		D8B6152E1032495100C8554A /* Cookie.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Cookie.h; sourceTree = "<group>"; };
 		DB23C2C90A508D29002489EB /* IndentOutdentCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = IndentOutdentCommand.cpp; sourceTree = "<group>"; };
 		DB23C2CA0A508D29002489EB /* IndentOutdentCommand.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = IndentOutdentCommand.h; sourceTree = "<group>"; };
 		DD05FE0B0B8BA3C6009ACDFE /* WebCoreObjCExtras.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebCoreObjCExtras.h; sourceTree = "<group>"; };
 		DD763BB10992C2C900740B8E /* libxml2.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libxml2.dylib; path = /usr/lib/libxml2.dylib; sourceTree = "<absolute>"; };
+		E0FEF371B07C53EAC1C1FBEE /* EventSource.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = EventSource.idl; sourceTree = "<group>"; };
+		E0FEF371B17C53EAC1C1FBEE /* EventSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventSource.h; sourceTree = "<group>"; };
+		E0FEF371B27C53EAC1C1FBEE /* EventSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventSource.cpp; sourceTree = "<group>"; };
+		E0FEF371B37C53EAC1C1FBEE /* JSEventSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSEventSource.h; sourceTree = "<group>"; };
+		E0FEF371B47C53EAC1C1FBEE /* JSEventSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEventSource.cpp; sourceTree = "<group>"; };
+		E0FEF371B57C53EAC1C1FBEE /* JSEventSourceCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEventSourceCustom.cpp; sourceTree = "<group>"; };
+		E0FEF371B67C53EAC1C1FBEE /* JSEventSourceConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSEventSourceConstructor.h; sourceTree = "<group>"; };
+		E0FEF371B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEventSourceConstructor.cpp; sourceTree = "<group>"; };
 		E107400B0E77BDC00033AF24 /* JSMessageChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageChannel.cpp; sourceTree = "<group>"; };
 		E107400C0E77BDC00033AF24 /* JSMessageChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMessageChannel.h; sourceTree = "<group>"; };
 		E10743230E7835830033AF24 /* JSMessageChannelConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageChannelConstructor.cpp; sourceTree = "<group>"; };
@@ -9322,6 +9706,13 @@
 		E1271A510EEECD1C00F61213 /* WorkerNavigator.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WorkerNavigator.idl; sourceTree = "<group>"; };
 		E1271A560EEECDE400F61213 /* JSWorkerNavigator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWorkerNavigator.h; sourceTree = "<group>"; };
 		E1271A570EEECDE400F61213 /* JSWorkerNavigator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerNavigator.cpp; sourceTree = "<group>"; };
+		E1284AD910447AEB00EAEB52 /* PageTransitionEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PageTransitionEvent.idl; sourceTree = "<group>"; };
+		E1284AE010447D4500EAEB52 /* PageTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageTransitionEvent.h; sourceTree = "<group>"; };
+		E1284AE910447DEE00EAEB52 /* PageTransitionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageTransitionEvent.cpp; sourceTree = "<group>"; };
+		E1284BAF10449FFA00EAEB52 /* JSPageTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPageTransitionEvent.h; sourceTree = "<group>"; };
+		E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPageTransitionEvent.cpp; sourceTree = "<group>"; };
+		E1284BD31044A01E00EAEB52 /* DOMPageTransitionEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMPageTransitionEvent.mm; sourceTree = "<group>"; };
+		E1284BD41044A01E00EAEB52 /* DOMPageTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMPageTransitionEvent.h; sourceTree = "<group>"; };
 		E12EDB7A0B308A78002704B6 /* EventTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTarget.h; sourceTree = "<group>"; };
 		E12EDBE90B308E0B002704B6 /* EventTarget.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventTarget.cpp; sourceTree = "<group>"; };
 		E182568D0EF2B02D00933242 /* JSWorkerContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerContext.cpp; sourceTree = "<group>"; };
@@ -9469,6 +9860,14 @@
 		F587868402DE3B8601EA4122 /* Cursor.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Cursor.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F587869902DE3B8601EA4122 /* DeprecatedPtrList.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = DeprecatedPtrList.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F58EF58E02DFDFB7018635CA /* WebCore.base.exp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.exports; path = WebCore.base.exp; sourceTree = "<group>"; tabWidth = 4; usesTabs = 0; };
+		F5C041D70FFCA7CE00839D4A /* HTMLDataListElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDataListElement.cpp; sourceTree = "<group>"; };
+		F5C041D80FFCA7CE00839D4A /* HTMLDataListElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDataListElement.h; sourceTree = "<group>"; };
+		F5C041D90FFCA7CE00839D4A /* HTMLDataListElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLDataListElement.idl; sourceTree = "<group>"; };
+		F5C041DE0FFCA96D00839D4A /* DOMHTMLDataListElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLDataListElement.h; sourceTree = "<group>"; };
+		F5C041DF0FFCA96D00839D4A /* DOMHTMLDataListElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLDataListElement.mm; sourceTree = "<group>"; };
+		F5C041E00FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLDataListElementInternal.h; sourceTree = "<group>"; };
+		F5C041E10FFCA96D00839D4A /* JSHTMLDataListElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLDataListElement.cpp; sourceTree = "<group>"; };
+		F5C041E20FFCA96D00839D4A /* JSHTMLDataListElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLDataListElement.h; sourceTree = "<group>"; };
 		F5C2869302846DCD018635CA /* ApplicationServices.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = ApplicationServices.framework; path = /System/Library/Frameworks/ApplicationServices.framework; sourceTree = "<absolute>"; };
 		F5C2869402846DCD018635CA /* Carbon.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Carbon.framework; path = /System/Library/Frameworks/Carbon.framework; sourceTree = "<absolute>"; };
 		F5C2869502846DCD018635CA /* Cocoa.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Cocoa.framework; path = /System/Library/Frameworks/Cocoa.framework; sourceTree = "<absolute>"; };
@@ -9477,6 +9876,17 @@
 		F916C48C0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSXMLHttpRequestProgressEvent.h; sourceTree = "<group>"; };
 		F9F0ED770DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XMLHttpRequestProgressEvent.h; sourceTree = "<group>"; };
 		F9F0ED780DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = XMLHttpRequestProgressEvent.idl; sourceTree = "<group>"; };
+		FABE72ED1059C1EB00D999DD /* MathMLElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLElement.cpp; sourceTree = "<group>"; };
+		FABE72EE1059C1EB00D999DD /* MathMLElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MathMLElement.h; sourceTree = "<group>"; };
+		FABE72EF1059C1EB00D999DD /* MathMLInlineContainerElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLInlineContainerElement.cpp; sourceTree = "<group>"; };
+		FABE72F01059C1EB00D999DD /* MathMLInlineContainerElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MathMLInlineContainerElement.h; sourceTree = "<group>"; };
+		FABE72F11059C1EB00D999DD /* MathMLMathElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLMathElement.cpp; sourceTree = "<group>"; };
+		FABE72F21059C1EB00D999DD /* MathMLMathElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MathMLMathElement.h; sourceTree = "<group>"; };
+		FABE72F31059C1EB00D999DD /* mathtags.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mathtags.in; sourceTree = "<group>"; };
+		FABE72FB1059C21100D999DD /* MathMLElementFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLElementFactory.cpp; sourceTree = "<group>"; };
+		FABE72FC1059C21100D999DD /* MathMLNames.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLNames.cpp; sourceTree = "<group>"; };
+		FE136AE710643BE50078CF6D /* WebCore.OrientationEvents.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.OrientationEvents.exp; sourceTree = "<group>"; };
+		FE49BD301061719100D0E1AE /* WebCore.Inspector.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.Inspector.exp; sourceTree = "<group>"; };
 		FE49EF970DC51462004266E1 /* DashboardSupportCSSPropertyNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DashboardSupportCSSPropertyNames.in; sourceTree = "<group>"; };
 		FE6FD4850F676E5700092873 /* Coordinates.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Coordinates.h; sourceTree = "<group>"; };
 		FE6FD4860F676E5700092873 /* Coordinates.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Coordinates.idl; sourceTree = "<group>"; };
@@ -9504,8 +9914,10 @@
 		FE80DA620E9C4703000D6F75 /* JSGeoposition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGeoposition.h; sourceTree = "<group>"; };
 		FE80DA6D0E9C472F000D6F75 /* JSPositionError.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPositionError.cpp; sourceTree = "<group>"; };
 		FE80DA6E0E9C472F000D6F75 /* JSPositionError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPositionError.h; sourceTree = "<group>"; };
+		FEA4133F105D67AE0007236F /* WebCore.DragSupport.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.DragSupport.exp; sourceTree = "<group>"; };
 		FEAB90100EA51B9C006348C3 /* GeolocationService.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeolocationService.cpp; sourceTree = "<group>"; };
 		FEAB90110EA51B9C006348C3 /* GeolocationService.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationService.h; sourceTree = "<group>"; };
+		FEFD102C105C41470002855E /* WebCore.ContextMenus.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.ContextMenus.exp; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -9522,6 +9934,7 @@
 				DD763BB20992C2C900740B8E /* libxml2.dylib in Frameworks */,
 				A88AD52F09524B92001DD196 /* QuartzCore.framework in Frameworks */,
 				1A7FA7CC0DDA4B770028F8A5 /* SystemConfiguration.framework in Frameworks */,
+				49C7BA791042EFAE0009D447 /* OpenGL.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -9555,6 +9968,8 @@
 				93EEC1EC09C2877700C515D1 /* html */,
 				1C81B94D0E9732D900266E07 /* inspector */,
 				BCB16BFB0979C38700467741 /* loader */,
+				FABE72EC1059C1EB00D999DD /* mathml */,
+				333F703D0FB49C16008E12A6 /* notifications */,
 				65BF02180974806300C43196 /* page */,
 				BCF1A5BA097832090061A123 /* platform */,
 				5DCF83690D59157800953BC6 /* plugins */,
@@ -9578,6 +9993,7 @@
 		0867D69AFE84028FC02AAC07 /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
+				49C7BA781042EFAE0009D447 /* OpenGL.framework */,
 				F5C2869302846DCD018635CA /* ApplicationServices.framework */,
 				F5C2869402846DCD018635CA /* Carbon.framework */,
 				F5C2869502846DCD018635CA /* Cocoa.framework */,
@@ -9642,6 +10058,7 @@
 				A83B79120CCB003F000B0825 /* Events */,
 				A83B79080CCAFF2B000B0825 /* HTML */,
 				1C5FAECA0DCFD8C900D58F78 /* Inspector */,
+				33503C9C10179A9A003B47E1 /* Notifications */,
 				1AC226020DB69EA70089B669 /* Offline */,
 				A9D247F90D757E4100FDF959 /* Plugins */,
 				BC9854460CD3DA5F00069BC1 /* Ranges */,
@@ -9808,6 +10225,10 @@
 		1AE82EC90CAAE177002237AE /* storage */ = {
 			isa = PBXGroup;
 			children = (
+				B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */,
+				B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */,
+				B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */,
+				B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */,
 				514185ED0CD65F0400763C99 /* ChangeVersionWrapper.cpp */,
 				514185EC0CD65F0400763C99 /* ChangeVersionWrapper.h */,
 				5196115E0CAC56570010A80C /* Database.cpp */,
@@ -9859,6 +10280,8 @@
 				51E0BABA0DA5547100A9E417 /* StorageEvent.cpp */,
 				51E0BAB90DA5547100A9E417 /* StorageEvent.h */,
 				51E0BABD0DA5548400A9E417 /* StorageEvent.idl */,
+				C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */,
+				C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */,
 				51E0BB370DA5ACB600A9E417 /* StorageMap.cpp */,
 				51E0BB360DA5ACB600A9E417 /* StorageMap.h */,
 				C50D0E800FF4272900AC2644 /* StorageNamespace.cpp */,
@@ -9888,6 +10311,12 @@
 		1C81B94D0E9732D900266E07 /* inspector */ = {
 			isa = PBXGroup;
 			children = (
+				75092BFC104B80F9003DD168 /* DOMDispatchTimelineItem.cpp */,
+				75092BFD104B80F9003DD168 /* DOMDispatchTimelineItem.h */,
+				75A94A01104B74FB0006673C /* TimelineItem.cpp */,
+				75A94A02104B74FB0006673C /* TimelineItem.h */,
+				754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */,
+				754133A7102E00E800075D00 /* InspectorTimelineAgent.h */,
 				1C81B9590E97330800266E07 /* front-end */,
 				41F0618D0F5F069800A07EAC /* ConsoleMessage.cpp */,
 				41F0618C0F5F069800A07EAC /* ConsoleMessage.h */,
@@ -9956,6 +10385,8 @@
 				29A812250FBB9C1D00510293 /* AccessibilityListBox.h */,
 				29A8121F0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp */,
 				29A812240FBB9C1D00510293 /* AccessibilityListBoxOption.h */,
+				07B0113C1032241900FBDC33 /* AccessibilityMediaControls.cpp */,
+				07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */,
 				29A8121E0FBB9C1D00510293 /* AccessibilityObject.cpp */,
 				29A812180FBB9C1D00510293 /* AccessibilityObject.h */,
 				29A812080FBB9C1D00510293 /* AccessibilityRenderObject.cpp */,
@@ -10026,6 +10457,7 @@
 				2E43463D0F546A8200B0F1BA /* WorkerMessagingProxy.cpp */,
 				2E43463E0F546A8200B0F1BA /* WorkerMessagingProxy.h */,
 				2E43463F0F546A8200B0F1BA /* WorkerObjectProxy.h */,
+				416E29A5102FA962007FC14E /* WorkerReportingProxy.h */,
 				2E4346400F546A8200B0F1BA /* WorkerRunLoop.cpp */,
 				2E4346410F546A8200B0F1BA /* WorkerRunLoop.h */,
 				A7D6B3480F61104500B79FD1 /* WorkerScriptLoader.cpp */,
@@ -10055,19 +10487,51 @@
 			name = animation;
 			sourceTree = "<group>";
 		};
+		333F703D0FB49C16008E12A6 /* notifications */ = {
+			isa = PBXGroup;
+			children = (
+				33503CC61017A1B1003B47E1 /* Notification.cpp */,
+				33503C9910179A74003B47E1 /* NotificationPresenter.h */,
+				3390CA510FFC157B00921962 /* NotificationCenter.cpp */,
+				3390CA520FFC157B00921962 /* NotificationCenter.h */,
+				3390CA530FFC157B00921962 /* NotificationCenter.idl */,
+				3390CA540FFC157B00921962 /* NotificationContents.h */,
+				333F704E0FB49CA2008E12A6 /* Notification.idl */,
+				333F704F0FB49CA2008E12A6 /* Notification.h */,
+			);
+			name = notifications;
+			sourceTree = "<group>";
+		};
+		33503C9C10179A9A003B47E1 /* Notifications */ = {
+			isa = PBXGroup;
+			children = (
+				33503C9F10179AD7003B47E1 /* JSNotification.cpp */,
+				33503CA010179AD7003B47E1 /* JSNotification.h */,
+				33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */,
+				33503CA210179AD7003B47E1 /* JSNotificationCenter.h */,
+			);
+			name = Notifications;
+			sourceTree = "<group>";
+		};
 		449195900FBE175B00D9F824 /* Exports */ = {
 			isa = PBXGroup;
 			children = (
 				F58EF58E02DFDFB7018635CA /* WebCore.base.exp */,
+				0F9C6F4B1073EF0400DED9BF /* WebCore.3DRendering.exp */,
+				FEFD102C105C41470002855E /* WebCore.ContextMenus.exp */,
 				4491959D0FBE17D700D9F824 /* WebCore.DashboardSupport.exp */,
+				FEA4133F105D67AE0007236F /* WebCore.DragSupport.exp */,
+				FE49BD301061719100D0E1AE /* WebCore.Inspector.exp */,
 				4491959C0FBE17D700D9F824 /* WebCore.JNI.exp */,
-				4491959B0FBE17D700D9F824 /* WebCore.LP64.exp */,
+				4491959B0FBE17D700D9F824 /* WebCore.PluginHostProcess.exp */,
 				4491959A0FBE17D700D9F824 /* WebCore.NPAPI.exp */,
+				FE136AE710643BE50078CF6D /* WebCore.OrientationEvents.exp */,
 				449195990FBE17D700D9F824 /* WebCore.SVG.Animation.exp */,
 				449195980FBE17D700D9F824 /* WebCore.SVG.exp */,
 				449195970FBE17D700D9F824 /* WebCore.SVG.Filters.exp */,
 				449195960FBE17D700D9F824 /* WebCore.SVG.ForeignObject.exp */,
 				449195950FBE17D700D9F824 /* WebCore.Tiger.exp */,
+				63F371CD100E790000BBA87A /* WebCore.Video.exp */,
 				449195940FBE17D700D9F824 /* WebCore.VideoProxy.exp */,
 			);
 			name = Exports;
@@ -10076,20 +10540,73 @@
 		49484FAE102CF01E00187DD3 /* canvas */ = {
 			isa = PBXGroup;
 			children = (
+				49EECDC710503C2300099FAB /* CanvasArray.cpp */,
+				49EECDC810503C2300099FAB /* CanvasArray.h */,
+				49EECDC910503C2300099FAB /* CanvasArray.idl */,
+				49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */,
+				49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */,
+				49EECDCC10503C2300099FAB /* CanvasArrayBuffer.idl */,
+				49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */,
+				49C7B9A91042D32E0009D447 /* CanvasBuffer.h */,
+				49C7B9AA1042D32E0009D447 /* CanvasBuffer.idl */,
+				49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */,
+				49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */,
+				49C7B9AD1042D32E0009D447 /* CanvasByteArray.idl */,
+				49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */,
+				49EECDCE10503C2300099FAB /* CanvasFloatArray.h */,
+				49EECDCF10503C2300099FAB /* CanvasFloatArray.idl */,
+				49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */,
+				49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */,
+				49C7B9B01042D32E0009D447 /* CanvasFramebuffer.idl */,
 				49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */,
 				49484FB4102CF23C00187DD3 /* CanvasGradient.h */,
 				49484FB5102CF23C00187DD3 /* CanvasGradient.idl */,
+				49EECDD010503C2300099FAB /* CanvasIntArray.cpp */,
+				49EECDD110503C2300099FAB /* CanvasIntArray.h */,
+				49EECDD210503C2300099FAB /* CanvasIntArray.idl */,
+				49C7B9B41042D32F0009D447 /* CanvasObject.cpp */,
+				49C7B9B51042D32F0009D447 /* CanvasObject.h */,
 				49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */,
 				49484FB7102CF23C00187DD3 /* CanvasPattern.h */,
 				49484FB8102CF23C00187DD3 /* CanvasPattern.idl */,
 				49484FB9102CF23C00187DD3 /* CanvasPixelArray.cpp */,
 				49484FBA102CF23C00187DD3 /* CanvasPixelArray.h */,
 				49484FBB102CF23C00187DD3 /* CanvasPixelArray.idl */,
+				49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */,
+				49C7B9B71042D32F0009D447 /* CanvasProgram.h */,
+				49C7B9B81042D32F0009D447 /* CanvasProgram.idl */,
+				49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */,
+				49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */,
+				49C7B9BB1042D32F0009D447 /* CanvasRenderbuffer.idl */,
+				49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */,
+				49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */,
+				49C7B9BE1042D32F0009D447 /* CanvasRenderingContext.idl */,
 				49484FBC102CF23C00187DD3 /* CanvasRenderingContext2D.cpp */,
 				49484FBD102CF23C00187DD3 /* CanvasRenderingContext2D.h */,
 				49484FBE102CF23C00187DD3 /* CanvasRenderingContext2D.idl */,
+				49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */,
+				49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */,
+				49C7B9C11042D32F0009D447 /* CanvasRenderingContext3D.idl */,
+				49C7B9C21042D32F0009D447 /* CanvasShader.cpp */,
+				49C7B9C31042D32F0009D447 /* CanvasShader.h */,
+				49C7B9C41042D32F0009D447 /* CanvasShader.idl */,
+				49EECDD310503C2300099FAB /* CanvasShortArray.cpp */,
+				49EECDD410503C2300099FAB /* CanvasShortArray.h */,
+				49EECDD510503C2300099FAB /* CanvasShortArray.idl */,
 				49484FBF102CF23C00187DD3 /* CanvasStyle.cpp */,
 				49484FC0102CF23C00187DD3 /* CanvasStyle.h */,
+				49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */,
+				49C7B9C61042D32F0009D447 /* CanvasTexture.h */,
+				49C7B9C71042D32F0009D447 /* CanvasTexture.idl */,
+				49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */,
+				49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */,
+				49EECDD810503C2300099FAB /* CanvasUnsignedByteArray.idl */,
+				49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */,
+				49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */,
+				49EECDDB10503C2300099FAB /* CanvasUnsignedIntArray.idl */,
+				49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */,
+				49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */,
+				49EECDDE10503C2400099FAB /* CanvasUnsignedShortArray.idl */,
 			);
 			name = canvas;
 			sourceTree = "<group>";
@@ -10300,6 +10817,11 @@
 		518A34BD1026C831001B6896 /* websockets */ = {
 			isa = PBXGroup;
 			children = (
+				51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */,
+				51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */,
+				510D4A47103177A20049EA54 /* WebSocketChannel.cpp */,
+				510D4A48103177A20049EA54 /* WebSocketChannel.h */,
+				510D4A49103177A20049EA54 /* WebSocketChannelClient.h */,
 				518A34BE1026C831001B6896 /* WebSocket.cpp */,
 				518A34BF1026C831001B6896 /* WebSocket.h */,
 				518A34C01026C831001B6896 /* WebSocket.idl */,
@@ -10374,6 +10896,8 @@
 				938E65F009F09840008A48EC /* JSHTMLElementWrapperFactory.h */,
 				8574D1F10ADE6122004CBA11 /* JSSVGElementWrapperFactory.cpp */,
 				8574D1F20ADE6122004CBA11 /* JSSVGElementWrapperFactory.h */,
+				FABE72FB1059C21100D999DD /* MathMLElementFactory.cpp */,
+				FABE72FC1059C21100D999DD /* MathMLNames.cpp */,
 				656581E609D1508D000E61D7 /* SVGElementFactory.cpp */,
 				656581E709D1508D000E61D7 /* SVGElementFactory.h */,
 				656581E809D1508D000E61D7 /* SVGNames.cpp */,
@@ -10407,6 +10931,8 @@
 				934F71390D5A6F1000018D69 /* AuthenticationChallengeBase.h */,
 				514C76580CE923A1007EF3CD /* Credential.cpp */,
 				514C76590CE923A1007EF3CD /* Credential.h */,
+				51A052321058774F00CC9E95 /* CredentialStorage.cpp */,
+				51A052311058774F00CC9E95 /* CredentialStorage.h */,
 				B2F34FE50E82F81400F627CD /* DNS.h */,
 				514C765A0CE923A1007EF3CD /* FormData.cpp */,
 				514C765B0CE923A1007EF3CD /* FormData.h */,
@@ -10420,6 +10946,7 @@
 				1A7FA6180DDA3B3A0028F8A5 /* NetworkStateNotifier.h */,
 				514C765F0CE923A1007EF3CD /* ProtectionSpace.cpp */,
 				514C76600CE923A1007EF3CD /* ProtectionSpace.h */,
+				51A052551058874000CC9E95 /* ProtectionSpaceHash.h */,
 				934F713D0D5A6F2800018D69 /* ResourceErrorBase.cpp */,
 				934F713B0D5A6F1900018D69 /* ResourceErrorBase.h */,
 				514C76630CE923A1007EF3CD /* ResourceHandle.cpp */,
@@ -10430,6 +10957,11 @@
 				514C76680CE923A1007EF3CD /* ResourceRequestBase.h */,
 				514C76690CE923A1007EF3CD /* ResourceResponseBase.cpp */,
 				514C766A0CE923A1007EF3CD /* ResourceResponseBase.h */,
+				510D4A2D103165EE0049EA54 /* SocketStreamErrorBase.cpp */,
+				510D4A2E103165EE0049EA54 /* SocketStreamErrorBase.h */,
+				510D4A30103165EE0049EA54 /* SocketStreamHandleBase.cpp */,
+				510D4A31103165EE0049EA54 /* SocketStreamHandleBase.h */,
+				510D4A32103165EE0049EA54 /* SocketStreamHandleClient.h */,
 			);
 			path = network;
 			sourceTree = "<group>";
@@ -10561,6 +11093,9 @@
 				1AF326770D78B9440068F0C4 /* EditorClient.h */,
 				93C09A800B064F00005ABD4D /* EventHandler.cpp */,
 				93C09A520B064DB3005ABD4D /* EventHandler.h */,
+				E0FEF371B27C53EAC1C1FBEE /* EventSource.cpp */,
+				E0FEF371B17C53EAC1C1FBEE /* EventSource.h */,
+				E0FEF371B07C53EAC1C1FBEE /* EventSource.idl */,
 				14993BE30B2F2B1C0050497F /* FocusController.cpp */,
 				14993BE40B2F2B1C0050497F /* FocusController.h */,
 				062287830B4DB322000C34DF /* FocusDirection.h */,
@@ -10576,6 +11111,7 @@
 				FE80D7B90E9C1F25000D6F75 /* Geolocation.idl */,
 				FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */,
 				FE80D7BC0E9C1F25000D6F75 /* Geoposition.idl */,
+				7693BACE106C2DCA007B0823 /* HaltablePlugin.h */,
 				BC94D1500C275C8B006BC617 /* History.cpp */,
 				BC94D1510C275C8B006BC617 /* History.h */,
 				BC94D1520C275C8B006BC617 /* History.idl */,
@@ -10589,12 +11125,17 @@
 				A9C6E65D0D746694006442E9 /* Navigator.idl */,
 				E12719C90EEEC21300F61213 /* NavigatorBase.cpp */,
 				E12719C60EEEC16800F61213 /* NavigatorBase.h */,
+				00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */,
+				00146289103CD1DE000B20DB /* OriginAccessEntry.h */,
 				65FEA86809833ADE00BED4AB /* Page.cpp */,
 				65A21467097A329100B9050A /* Page.h */,
 				9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */,
 				9302B0BE0D79F82C00C7EE83 /* PageGroup.h */,
 				7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */,
 				7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */,
+				7693BACF106C2DCA007B0823 /* PluginHalter.cpp */,
+				7693BAD0106C2DCA007B0823 /* PluginHalter.h */,
+				7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */,
 				FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */,
 				FE80D7BF0E9C1F25000D6F75 /* PositionError.h */,
 				FE80D7C00E9C1F25000D6F75 /* PositionError.idl */,
@@ -10608,6 +11149,12 @@
 				BCD0E0F90E972C3500265DEA /* SecurityOriginHash.h */,
 				14C9A5E90B3D105F005A0232 /* Settings.cpp */,
 				F587863A02DE3A1401EA4122 /* Settings.h */,
+				BCACF3BA1072921A00C0C8A3 /* UserContentURLPattern.cpp */,
+				BCACF3BB1072921A00C0C8A3 /* UserContentURLPattern.h */,
+				BCA2B0601050475F0043BD1C /* UserScript.h */,
+				BCA2B08A10505BCD0043BD1C /* UserScriptTypes.h */,
+				BC8BF150105813BF00A40A07 /* UserStyleSheet.h */,
+				BC8BF1591058141800A40A07 /* UserStyleSheetTypes.h */,
 				494BD7930F55C8EE00747828 /* WebKitPoint.h */,
 				494BD7940F55C8EE00747828 /* WebKitPoint.idl */,
 				BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */,
@@ -10878,9 +11425,6 @@
 				850361300ACE007C001F3D9E /* DOMSVGCursorElement.h */,
 				850361310ACE007C001F3D9E /* DOMSVGCursorElement.mm */,
 				A8E544970CA9D1C20097D09B /* DOMSVGCursorElementInternal.h */,
-				A80F39570CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h */,
-				A80F39560CCD9796002DD990 /* DOMSVGDefinitionSrcElement.mm */,
-				A80F39550CCD9796002DD990 /* DOMSVGDefinitionSrcElementInternal.h */,
 				85004D880ACEEAEF00C438F6 /* DOMSVGDefsElement.h */,
 				85004D890ACEEAEF00C438F6 /* DOMSVGDefsElement.mm */,
 				A8E544950CA9D1C20097D09B /* DOMSVGDefsElementInternal.h */,
@@ -11264,6 +11808,8 @@
 				85C7F5BD0AAFB7CC004014DD /* DOMMutationEvent.mm */,
 				85C7F5CE0AAFB8D9004014DD /* DOMOverflowEvent.h */,
 				85C7F5CF0AAFB8D9004014DD /* DOMOverflowEvent.mm */,
+				E1284BD41044A01E00EAEB52 /* DOMPageTransitionEvent.h */,
+				E1284BD31044A01E00EAEB52 /* DOMPageTransitionEvent.mm */,
 				BCC573330D695BBE006EF517 /* DOMProgressEvent.h */,
 				BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */,
 				933A14750B7D1BAF00A53FFD /* DOMTextEvent.h */,
@@ -11328,6 +11874,8 @@
 				93F9B6540BA0F35E00854064 /* DOMHTMLCanvasElement.mm */,
 				85DF2F8C0AA3C88100AD64C5 /* DOMHTMLCollection.h */,
 				85DF2F8D0AA3C88100AD64C5 /* DOMHTMLCollection.mm */,
+				F5C041DE0FFCA96D00839D4A /* DOMHTMLDataListElement.h */,
+				F5C041DF0FFCA96D00839D4A /* DOMHTMLDataListElement.mm */,
 				85BA4CFD0AA688680088052D /* DOMHTMLDirectoryElement.h */,
 				85BA4CFE0AA688680088052D /* DOMHTMLDirectoryElement.mm */,
 				85BA4CFF0AA688680088052D /* DOMHTMLDivElement.h */,
@@ -11482,6 +12030,7 @@
 				85E711520AC5D5340053270F /* DOMHTMLButtonElementInternal.h */,
 				93F9B6550BA0F35E00854064 /* DOMHTMLCanvasElementInternal.h */,
 				85E711530AC5D5340053270F /* DOMHTMLCollectionInternal.h */,
+				F5C041E00FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h */,
 				85E711540AC5D5340053270F /* DOMHTMLDirectoryElementInternal.h */,
 				85E711550AC5D5340053270F /* DOMHTMLDivElementInternal.h */,
 				85E711560AC5D5340053270F /* DOMHTMLDListElementInternal.h */,
@@ -11909,6 +12458,9 @@
 				BC77CD410FEFE0C40070887B /* HTMLDataGridRowElement.cpp */,
 				BC77CCED0FEFDE6C0070887B /* HTMLDataGridRowElement.h */,
 				BC77CC6B0FEC3D5F0070887B /* HTMLDataGridRowElement.idl */,
+				F5C041D70FFCA7CE00839D4A /* HTMLDataListElement.cpp */,
+				F5C041D80FFCA7CE00839D4A /* HTMLDataListElement.h */,
+				F5C041D90FFCA7CE00839D4A /* HTMLDataListElement.idl */,
 				A8EA79ED0A1916DF00A8EF5F /* HTMLDirectoryElement.cpp */,
 				A8EA79EE0A1916DF00A8EF5F /* HTMLDirectoryElement.h */,
 				1A85B1D90A1B23A400D8C87C /* HTMLDirectoryElement.idl */,
@@ -12145,12 +12697,46 @@
 		A83B79080CCAFF2B000B0825 /* HTML */ = {
 			isa = PBXGroup;
 			children = (
+				49EECF19105072F300099FAB /* JSCanvasArray.cpp */,
+				49EECF1A105072F300099FAB /* JSCanvasArray.h */,
+				49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */,
+				49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */,
+				49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */,
+				49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */,
+				49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */,
+				49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */,
+				49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */,
+				49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */,
+				49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */,
+				49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */,
 				65DF323309D1DE65000BE325 /* JSCanvasGradient.cpp */,
 				65DF323409D1DE65000BE325 /* JSCanvasGradient.h */,
+				49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */,
+				49EECEF7105070C400099FAB /* JSCanvasIntArray.h */,
 				65DF323509D1DE65000BE325 /* JSCanvasPattern.cpp */,
 				65DF323609D1DE65000BE325 /* JSCanvasPattern.h */,
-				65DF323709D1DE65000BE325 /* JSCanvasRenderingContext2D.cpp */,
-				65DF323809D1DE65000BE325 /* JSCanvasRenderingContext2D.h */,
+				49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */,
+				49C7B9891042D2D30009D447 /* JSCanvasProgram.h */,
+				49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */,
+				49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */,
+				49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */,
+				49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */,
+				49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */,
+				49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */,
+				49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */,
+				49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */,
+				49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */,
+				49C7B9901042D2D30009D447 /* JSCanvasShader.h */,
+				49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */,
+				49EECEF9105070C400099FAB /* JSCanvasShortArray.h */,
+				49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */,
+				49C7B9921042D2D30009D447 /* JSCanvasTexture.h */,
+				49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */,
+				49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */,
+				49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */,
+				49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */,
+				49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */,
+				49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */,
 				BC77D1650FF19F550070887B /* JSDataGridColumn.cpp */,
 				BC77D1660FF19F550070887B /* JSDataGridColumn.h */,
 				BC77D1670FF19F550070887B /* JSDataGridColumnList.cpp */,
@@ -12191,6 +12777,8 @@
 				BC212A400FE83A1800EC3708 /* JSHTMLDataGridElement.h */,
 				BC77CD4C0FEFE1610070887B /* JSHTMLDataGridRowElement.cpp */,
 				BC77CD4D0FEFE1610070887B /* JSHTMLDataGridRowElement.h */,
+				F5C041E10FFCA96D00839D4A /* JSHTMLDataListElement.cpp */,
+				F5C041E20FFCA96D00839D4A /* JSHTMLDataListElement.h */,
 				1A85B1E00A1B240500D8C87C /* JSHTMLDirectoryElement.cpp */,
 				1A85B1E10A1B240500D8C87C /* JSHTMLDirectoryElement.h */,
 				1A85B2B40A1B2AC700D8C87C /* JSHTMLDivElement.cpp */,
@@ -12305,8 +12893,6 @@
 				E44614130CD6826900FADA75 /* JSTimeRanges.h */,
 				15C77092100D3CA8005BA267 /* JSValidityState.cpp */,
 				15C77091100D3CA8005BA267 /* JSValidityState.h */,
-				BC8243270D0CE8A200460C8F /* JSVoidCallback.cpp */,
-				BC8243280D0CE8A200460C8F /* JSVoidCallback.h */,
 			);
 			name = HTML;
 			sourceTree = "<group>";
@@ -12362,8 +12948,6 @@
 				B2FA3C770AB75A6E000E5AC4 /* JSSVGComponentTransferFunctionElement.h */,
 				B2FA3C780AB75A6E000E5AC4 /* JSSVGCursorElement.cpp */,
 				B2FA3C790AB75A6E000E5AC4 /* JSSVGCursorElement.h */,
-				A80F393C0CCD971A002DD990 /* JSSVGDefinitionSrcElement.cpp */,
-				A80F393B0CCD971A002DD990 /* JSSVGDefinitionSrcElement.h */,
 				B2FA3C7A0AB75A6E000E5AC4 /* JSSVGDefsElement.cpp */,
 				B2FA3C7B0AB75A6E000E5AC4 /* JSSVGDefsElement.h */,
 				B2FA3C7C0AB75A6E000E5AC4 /* JSSVGDescElement.cpp */,
@@ -12720,6 +13304,8 @@
 		A83B79120CCB003F000B0825 /* Events */ = {
 			isa = PBXGroup;
 			children = (
+				BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */,
+				BC946347107A936600857193 /* JSBeforeLoadEvent.h */,
 				2ECF7ADA10162B3800427DE7 /* JSErrorEvent.cpp */,
 				2ECF7ADB10162B3800427DE7 /* JSErrorEvent.h */,
 				14E8378309F85D1C00B85AE4 /* JSEvent.cpp */,
@@ -12740,6 +13326,8 @@
 				65DF31E809D1CC60000BE325 /* JSMutationEvent.h */,
 				1A0D573E0A5C7867007EDD4C /* JSOverflowEvent.cpp */,
 				1A0D573F0A5C7867007EDD4C /* JSOverflowEvent.h */,
+				E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */,
+				E1284BAF10449FFA00EAEB52 /* JSPageTransitionEvent.h */,
 				933A14B60B7D1D5200A53FFD /* JSTextEvent.cpp */,
 				933A14B70B7D1D5200A53FFD /* JSTextEvent.h */,
 				A86629CA09DA2B47009633A5 /* JSUIEvent.cpp */,
@@ -12882,9 +13470,6 @@
 				B22278110D00BF1F0071B782 /* SVGCursorElement.cpp */,
 				B22278120D00BF1F0071B782 /* SVGCursorElement.h */,
 				B22278130D00BF1F0071B782 /* SVGCursorElement.idl */,
-				B22278140D00BF1F0071B782 /* SVGDefinitionSrcElement.cpp */,
-				B22278150D00BF1F0071B782 /* SVGDefinitionSrcElement.h */,
-				B22278160D00BF1F0071B782 /* SVGDefinitionSrcElement.idl */,
 				B22278170D00BF1F0071B782 /* SVGDefsElement.cpp */,
 				B22278180D00BF1F0071B782 /* SVGDefsElement.h */,
 				B22278190D00BF1F0071B782 /* SVGDefsElement.idl */,
@@ -13347,6 +13932,8 @@
 		B27535490B053814002CE64F /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				49C7B9FD1042D38C0009D447 /* Canvas3DLayer.h */,
+				49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */,
 				EDE3A4FF0C7A430600956A37 /* ColorMac.h */,
 				B275354A0B053814002CE64F /* ColorMac.mm */,
 				3724CA550E68A7E400DB4384 /* CoreTextController.cpp */,
@@ -13364,6 +13951,7 @@
 				B2AFFC7A0D00A5C10030074D /* FontPlatformDataMac.mm */,
 				B2AFFC7B0D00A5C10030074D /* GlyphPageTreeNodeMac.cpp */,
 				B277B4030B22F37C0004BEC6 /* GraphicsContextMac.mm */,
+				49C7B9FF1042D38C0009D447 /* GraphicsContext3DMac.cpp */,
 				0F580B040F12A2550051D689 /* GraphicsLayerCA.h */,
 				0F580B030F12A2540051D689 /* GraphicsLayerCA.mm */,
 				B275358D0B053A66002CE64F /* IconMac.mm */,
@@ -13420,6 +14008,7 @@
 				72626E010EF022FE00A07E20 /* FontFastPath.cpp */,
 				37ACCE410DA2980F0089E602 /* FontRenderingMode.h */,
 				B2C3DA5A0D006CD600EF6F26 /* FontSelector.h */,
+				37202198106213C600F25C4B /* FontSmoothingMode.h */,
 				3784C34A0E11AA34007D8D48 /* FontTraitsMask.h */,
 				BCE04C930DAFF902007A0F41 /* GeneratedImage.cpp */,
 				BC23F0DA0DAFF4A4009FDC91 /* GeneratedImage.h */,
@@ -13434,6 +14023,7 @@
 				B2A015920AF6CD53006BCE0E /* GraphicsContext.cpp */,
 				B2A015930AF6CD53006BCE0E /* GraphicsContext.h */,
 				A88FE3330E5EEE87008D8C0F /* GraphicsContextPrivate.h */,
+				49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */,
 				0F580B090F12A2690051D689 /* GraphicsLayer.cpp */,
 				0F580B0A0F12A2690051D689 /* GraphicsLayer.h */,
 				0F580B0B0F12A2690051D689 /* GraphicsLayerClient.h */,
@@ -13467,6 +14057,7 @@
 				B2C3DA540D006CD600EF6F26 /* SimpleFontData.h */,
 				B23540F00D00782E002382FA /* StringTruncator.cpp */,
 				B23540F10D00782E002382FA /* StringTruncator.h */,
+				930FC6891072B9280045293E /* TextRenderingMode.h */,
 				A824B4640E2EF2EA0081A7B7 /* TextRun.h */,
 				E4AFCFA40DAF29A300F5F55C /* UnitBezier.h */,
 				939B02EC0EA2DBC400C54570 /* WidthIterator.cpp */,
@@ -13565,6 +14156,9 @@
 		B2F34FE70E82F81700F627CD /* cf */ = {
 			isa = PBXGroup;
 			children = (
+				51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */,
+				51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */,
+				51ABAE1A103C18FF008C5260 /* SocketStreamError.h */,
 				B2F34FE80E82F82700F627CD /* DNSCFNet.cpp */,
 			);
 			name = cf;
@@ -13588,6 +14182,8 @@
 		BC1A3793097C6FB10019F3D8 /* js */ = {
 			isa = PBXGroup;
 			children = (
+				BCCE58A71061E82F008FB35A /* Callback Objects */,
+				BCCE58B41061E925008FB35A /* Constructors */,
 				BC4EDEF70C08F414007EDD49 /* Custom */,
 				14DFB33F0A7DF7630018F769 /* Derived Sources */,
 				BCD533630ED6848900887468 /* CachedScriptSourceProvider.h */,
@@ -13595,12 +14191,6 @@
 				A8EDB03C1016849400FE8113 /* DOMObjectWithSVGContext.h */,
 				1432E8480C51493F00B1500F /* GCController.cpp */,
 				1432E8460C51493800B1500F /* GCController.h */,
-				E4EEFFC60D34550C00469A58 /* JSAudioConstructor.cpp */,
-				E4EEFFC70D34550C00469A58 /* JSAudioConstructor.h */,
-				E10B93C20B73C291003ED890 /* JSCustomXPathNSResolver.cpp */,
-				E10B937B0B73C00A003ED890 /* JSCustomXPathNSResolver.h */,
-				BCBCAE3A0FF19399000762AE /* JSDataGridDataSource.cpp */,
-				BCBCAE3B0FF19399000762AE /* JSDataGridDataSource.h */,
 				93B70D4709EB0C7C009D8468 /* JSDOMBinding.cpp */,
 				93B70D4809EB0C7C009D8468 /* JSDOMBinding.h */,
 				E1C36CBC0EB08062007410BC /* JSDOMGlobalObject.cpp */,
@@ -13609,50 +14199,22 @@
 				BC6932720D7E293900AE44D1 /* JSDOMWindowBase.h */,
 				BCBFB53A0DCD29CF0019B3E5 /* JSDOMWindowShell.cpp */,
 				BCBFB53B0DCD29CF0019B3E5 /* JSDOMWindowShell.h */,
-				93B70D4D09EB0C7C009D8468 /* JSEventListener.cpp */,
-				93B70D4E09EB0C7C009D8468 /* JSEventListener.h */,
 				BC60901E0E91B8EC000C68B5 /* JSEventTarget.cpp */,
 				BC60901D0E91B8EC000C68B5 /* JSEventTarget.h */,
-				9350E70C0E87500B00189FFF /* JSHTMLAllCollection.cpp */,
-				BC6DC7A00C1A4BFA004E2017 /* JSHTMLAllCollection.h */,
-				BC6C49F10D7DBA0500FFA558 /* JSImageConstructor.cpp */,
-				BC6C49F20D7DBA0500FFA558 /* JSImageConstructor.h */,
 				C09158840DB4209200E55AF4 /* JSInspectedObjectWrapper.cpp */,
 				C09158850DB4209200E55AF4 /* JSInspectedObjectWrapper.h */,
 				C09158860DB4209200E55AF4 /* JSInspectorCallbackWrapper.cpp */,
 				C09158870DB4209200E55AF4 /* JSInspectorCallbackWrapper.h */,
-				935F45400F7C3B5F00D7C1FB /* JSLazyEventListener.cpp */,
-				935F45410F7C3B5F00D7C1FB /* JSLazyEventListener.h */,
-				E10743230E7835830033AF24 /* JSMessageChannelConstructor.cpp */,
-				E10743260E7835A50033AF24 /* JSMessageChannelConstructor.h */,
-				BCD9C26C0C17AA81005C90A2 /* JSNamedNodesCollection.cpp */,
-				BCD9C26D0C17AA81005C90A2 /* JSNamedNodesCollection.h */,
-				BCB7735E0C17853D00132BA4 /* JSNodeFilterCondition.cpp */,
-				BCB7735F0C17853D00132BA4 /* JSNodeFilterCondition.h */,
-				A826E8AD0A1A8F2300CD1BB6 /* JSOptionConstructor.cpp */,
-				A826E8AC0A1A8F2300CD1BB6 /* JSOptionConstructor.h */,
 				93B70D4F09EB0C7C009D8468 /* JSPluginElementFunctions.cpp */,
 				93B70D5009EB0C7C009D8468 /* JSPluginElementFunctions.h */,
 				C09158880DB4209200E55AF4 /* JSQuarantinedObjectWrapper.cpp */,
 				C09158890DB4209200E55AF4 /* JSQuarantinedObjectWrapper.h */,
 				415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */,
 				415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */,
-				415B7C560FF598E6006770F7 /* JSSharedWorkerCustom.cpp */,
+				14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */,
 				B21127A50B3186770009BE53 /* JSSVGPODTypeWrapper.h */,
-				498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */,
-				498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */,
-				494BD7970F55C90E00747828 /* JSWebKitPointConstructor.cpp */,
-				494BD7980F55C90E00747828 /* JSWebKitPointConstructor.h */,
-				518A34C41026C8C9001B6896 /* JSWebSocketConstructor.cpp */,
-				518A34C51026C8C9001B6896 /* JSWebSocketConstructor.h */,
-				E1CA5CD50E8CDEE900E8EF90 /* JSWorkerConstructor.cpp */,
-				E1CA5CD20E8CDE8000E8EF90 /* JSWorkerConstructor.h */,
 				E1C36D320EB0A094007410BC /* JSWorkerContextBase.cpp */,
 				E1C36D330EB0A094007410BC /* JSWorkerContextBase.h */,
-				BC348BE70DB80354004ABAB9 /* JSXMLHttpRequestConstructor.cpp */,
-				BC348BE80DB80354004ABAB9 /* JSXMLHttpRequestConstructor.h */,
-				BCE99EC10DCA624100182683 /* JSXSLTProcessorConstructor.cpp */,
-				BCE99EC20DCA624100182683 /* JSXSLTProcessorConstructor.h */,
 				BCA378BA0D15F64200B793D6 /* ScheduledAction.cpp */,
 				BCA378BB0D15F64200B793D6 /* ScheduledAction.h */,
 				7A1E88F3101CC384000C4DF5 /* ScriptArray.cpp */,
@@ -13685,6 +14247,8 @@
 				65488D6A0DD5A83D009D83B2 /* StringSourceProvider.h */,
 				E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */,
 				E1A643F10EC0972500779668 /* WorkerScriptController.h */,
+				A75E497410752ACB00C9B896 /* SerializedScriptValue.h */,
+				A75E497510752ACB00C9B896 /* SerializedScriptValue.cpp */,
 			);
 			path = js;
 			sourceTree = "<group>";
@@ -13740,12 +14304,22 @@
 			children = (
 				415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */,
 				BC2ED6BB0C6BD2F000920BFF /* JSAttrCustom.cpp */,
-				1A9EF4560A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp */,
+				49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */,
+				49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */,
+				49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */,
+				49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */,
+				49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */,
+				49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */,
+				49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */,
+				49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */,
+				49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */,
+				49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */,
 				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
 				BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */,
 				C0DFC86F0DB6841A003EAE7C /* JSConsoleCustom.cpp */,
 				FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */,
 				BC46C1ED0C0DDBDF0020CFC3 /* JSCSSRuleCustom.cpp */,
+				9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */,
 				BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */,
 				BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */,
 				FE80D7A20E9C1ED2000D6F75 /* JSCustomPositionCallback.cpp */,
@@ -13762,22 +14336,30 @@
 				51EC92620CE90DD400F90308 /* JSCustomSQLTransactionErrorCallback.h */,
 				1A3417C80CECFF250049CBDE /* JSCustomVoidCallback.cpp */,
 				1A3417C70CECFF250049CBDE /* JSCustomVoidCallback.h */,
-				1AE830420CAB0ED1002237AE /* JSDatabaseCustom.cpp */,
-				1AE830420CAB0ED1002237AE /* JSDatabaseCustom.cpp */,
+				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
+				BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */,
+				C0DFC86F0DB6841A003EAE7C /* JSConsoleCustom.cpp */,
+				FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */,
+				BC46C1ED0C0DDBDF0020CFC3 /* JSCSSRuleCustom.cpp */,
+				9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */,
+				BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */,
+				BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */,
+				BCCE58AB1061E8CF008FB35A /* JSDatabaseCustom.cpp */,
 				BC77D1510FF19C730070887B /* JSDataGridColumnListCustom.cpp */,
 				4162A453101145E300DFF3ED /* JSDedicatedWorkerContextCustom.cpp */,
-				929264760B61FC7200B41D34 /* JSDocumentCustom.cpp */,
-				929264760B61FC7200B41D34 /* JSDocumentCustom.cpp */,
-				BC1DEA4E0E268EB60083A73F /* JSDocumentFragmentCustom.cpp */,
-				BC1DEA4E0E268EB60083A73F /* JSDocumentFragmentCustom.cpp */,
+				33503CBF10179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp */,
+				49C7BA8C1042F5B10009D447 /* JSDocumentCustom.cpp */,
+				BCCE58AE1061E90C008FB35A /* JSDocumentFragmentCustom.cpp */,
 				1AC226160DB69F740089B669 /* JSDOMApplicationCacheCustom.cpp */,
 				BCD9C25E0C17AA67005C90A2 /* JSDOMWindowCustom.cpp */,
 				652FBBBB0DE27CB60001D386 /* JSDOMWindowCustom.h */,
 				BC2ED5540C6B9BD300920BFF /* JSElementCustom.cpp */,
 				BCEFAF4D0C317E6900FA81F6 /* JSEventCustom.cpp */,
+				E0FEF371B57C53EAC1C1FBEE /* JSEventSourceCustom.cpp */,
 				FE80D7A60E9C1ED2000D6F75 /* JSGeolocationCustom.cpp */,
 				BCE7B1920D4E86960075A539 /* JSHistoryCustom.cpp */,
 				BC4EDEF30C08F3FB007EDD49 /* JSHTMLAppletElementCustom.cpp */,
+				9392262C1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp */,
 				BCCBAD3A0C18BFF800CE890F /* JSHTMLCollectionCustom.cpp */,
 				BCBCAE530FF1A29E000762AE /* JSHTMLDataGridElementCustom.cpp */,
 				BC51580A0C03D404008BB0EE /* JSHTMLDocumentCustom.cpp */,
@@ -13797,7 +14379,9 @@
 				1C5FAEE60DCFDA6800D58F78 /* JSJavaScriptCallFrameCustom.cpp */,
 				BCE1C43F0D9830F4003B02F2 /* JSLocationCustom.cpp */,
 				E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */,
+				410B7E711045FAB000D8224F /* JSMessageEventCustom.cpp */,
 				E1ADED460E76B8DD004A1A5E /* JSMessagePortCustom.cpp */,
+				41F584C6104652CB009CAA64 /* JSMessagePortCustom.h */,
 				A9C6E6460D7465CA006442E9 /* JSMimeTypeArrayCustom.cpp */,
 				BCD9C25F0C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp */,
 				A9C6E6480D7465D8006442E9 /* JSNavigatorCustom.cpp */,
@@ -13807,7 +14391,6 @@
 				BCD9C2610C17AA67005C90A2 /* JSNodeListCustom.cpp */,
 				A9C6E64A0D7465E7006442E9 /* JSPluginArrayCustom.cpp */,
 				A9C6E64B0D7465E7006442E9 /* JSPluginCustom.cpp */,
-				41D168EF10226EC4009BC827 /* JSSharedWorkerContextCustom.cpp */,
 				51DCE8010CAC9F1C00488358 /* JSSQLResultSetRowListCustom.cpp */,
 				1AD2316D0CD269E700C1F194 /* JSSQLTransactionCustom.cpp */,
 				51D0C5150DAA90B7003B3831 /* JSStorageCustom.cpp */,
@@ -13908,6 +14491,8 @@
 				BC5A86B40C3367E800EEA649 /* JSDOMSelection.h */,
 				1403BA0B09EB18C700797C7F /* JSDOMWindow.cpp */,
 				1403BA0E09EB18F800797C7F /* JSDOMWindow.h */,
+				E0FEF371B37C53EAC1C1FBEE /* JSEventSource.h */,
+				E0FEF371B47C53EAC1C1FBEE /* JSEventSource.cpp */,
 				BC94D14C0C275C68006BC617 /* JSHistory.cpp */,
 				BC94D14D0C275C68006BC617 /* JSHistory.h */,
 				BCE1C4390D9830D3003B02F2 /* JSLocation.cpp */,
@@ -14015,8 +14600,14 @@
 				377C4CDD1014E9F600B9AE42 /* PlaceholderDocument.h */,
 				1AC694C50A3B1676003F5049 /* PluginDocument.cpp */,
 				1AC694C60A3B1676003F5049 /* PluginDocument.h */,
+				97059973107D975200A50A7C /* PolicyCallback.cpp */,
+				97059974107D975200A50A7C /* PolicyCallback.h */,
+				97059975107D975200A50A7C /* PolicyChecker.cpp */,
+				97059976107D975200A50A7C /* PolicyChecker.h */,
 				1A2A68210B5BEDE70002A480 /* ProgressTracker.cpp */,
 				1A2A68220B5BEDE70002A480 /* ProgressTracker.h */,
+				979F43D11075E44A0000F83B /* RedirectScheduler.cpp */,
+				979F43D21075E44A0000F83B /* RedirectScheduler.h */,
 				BCB16C150979C3BD00467741 /* Request.cpp */,
 				BCB16C160979C3BD00467741 /* Request.h */,
 				93E227DE0AF589AD00D48324 /* ResourceLoader.cpp */,
@@ -14033,8 +14624,6 @@
 				0B90561D0F257E930095FF6A /* ThreadableLoader.cpp */,
 				0B9056170F2578BE0095FF6A /* ThreadableLoader.h */,
 				0B9056180F2578BE0095FF6A /* ThreadableLoaderClient.h */,
-				7284ADDB0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp */,
-				7284ADDC0E6FEB31002EEFBD /* UserStyleSheetLoader.h */,
 				0B9056F60F2685F30095FF6A /* WorkerThreadableLoader.cpp */,
 				0B9056F70F2685F30095FF6A /* WorkerThreadableLoader.h */,
 			);
@@ -14043,6 +14632,88 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		BCCE58A71061E82F008FB35A /* Callback Objects */ = {
+			isa = PBXGroup;
+			children = (
+				1449E286107D4DB400B5793F /* JSCallbackData.cpp */,
+				1449E24A107D4A8400B5793F /* JSCallbackData.h */,
+				FE80D7A20E9C1ED2000D6F75 /* JSCustomPositionCallback.cpp */,
+				FE80D7A30E9C1ED2000D6F75 /* JSCustomPositionCallback.h */,
+				FE80D7A40E9C1ED2000D6F75 /* JSCustomPositionErrorCallback.cpp */,
+				FE80D7A50E9C1ED2000D6F75 /* JSCustomPositionErrorCallback.h */,
+				51EC925B0CE90DD400F90308 /* JSCustomSQLStatementCallback.cpp */,
+				51EC925C0CE90DD400F90308 /* JSCustomSQLStatementCallback.h */,
+				51EC925D0CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp */,
+				51EC925E0CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.h */,
+				51EC925F0CE90DD400F90308 /* JSCustomSQLTransactionCallback.cpp */,
+				51EC92600CE90DD400F90308 /* JSCustomSQLTransactionCallback.h */,
+				51EC92610CE90DD400F90308 /* JSCustomSQLTransactionErrorCallback.cpp */,
+				51EC92620CE90DD400F90308 /* JSCustomSQLTransactionErrorCallback.h */,
+				1A3417C80CECFF250049CBDE /* JSCustomVoidCallback.cpp */,
+				1A3417C70CECFF250049CBDE /* JSCustomVoidCallback.h */,
+				E10B93C20B73C291003ED890 /* JSCustomXPathNSResolver.cpp */,
+				E10B937B0B73C00A003ED890 /* JSCustomXPathNSResolver.h */,
+				BCBCAE3A0FF19399000762AE /* JSDataGridDataSource.cpp */,
+				BCBCAE3B0FF19399000762AE /* JSDataGridDataSource.h */,
+				93B70D4D09EB0C7C009D8468 /* JSEventListener.cpp */,
+				93B70D4E09EB0C7C009D8468 /* JSEventListener.h */,
+				935F45400F7C3B5F00D7C1FB /* JSLazyEventListener.cpp */,
+				935F45410F7C3B5F00D7C1FB /* JSLazyEventListener.h */,
+				BCB7735E0C17853D00132BA4 /* JSNodeFilterCondition.cpp */,
+				BCB7735F0C17853D00132BA4 /* JSNodeFilterCondition.h */,
+			);
+			name = "Callback Objects";
+			sourceTree = "<group>";
+		};
+		BCCE58B41061E925008FB35A /* Constructors */ = {
+			isa = PBXGroup;
+			children = (
+				E4EEFFC60D34550C00469A58 /* JSAudioConstructor.cpp */,
+				E4EEFFC70D34550C00469A58 /* JSAudioConstructor.h */,
+				49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */,
+				49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */,
+				49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */,
+				49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */,
+				49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */,
+				49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */,
+				49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */,
+				49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */,
+				49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */,
+				49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */,
+				49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */,
+				49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */,
+				49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */,
+				49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */,
+				49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */,
+				49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */,
+				E0FEF371B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp */,
+				E0FEF371B67C53EAC1C1FBEE /* JSEventSourceConstructor.h */,
+				9350E70C0E87500B00189FFF /* JSHTMLAllCollection.cpp */,
+				BC6DC7A00C1A4BFA004E2017 /* JSHTMLAllCollection.h */,
+				BC6C49F10D7DBA0500FFA558 /* JSImageConstructor.cpp */,
+				BC6C49F20D7DBA0500FFA558 /* JSImageConstructor.h */,
+				E10743230E7835830033AF24 /* JSMessageChannelConstructor.cpp */,
+				E10743260E7835A50033AF24 /* JSMessageChannelConstructor.h */,
+				A826E8AD0A1A8F2300CD1BB6 /* JSOptionConstructor.cpp */,
+				A826E8AC0A1A8F2300CD1BB6 /* JSOptionConstructor.h */,
+				415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */,
+				415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */,
+				498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */,
+				498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */,
+				494BD7970F55C90E00747828 /* JSWebKitPointConstructor.cpp */,
+				494BD7980F55C90E00747828 /* JSWebKitPointConstructor.h */,
+				518A34C41026C8C9001B6896 /* JSWebSocketConstructor.cpp */,
+				518A34C51026C8C9001B6896 /* JSWebSocketConstructor.h */,
+				E1CA5CD50E8CDEE900E8EF90 /* JSWorkerConstructor.cpp */,
+				E1CA5CD20E8CDE8000E8EF90 /* JSWorkerConstructor.h */,
+				BC348BE70DB80354004ABAB9 /* JSXMLHttpRequestConstructor.cpp */,
+				BC348BE80DB80354004ABAB9 /* JSXMLHttpRequestConstructor.h */,
+				BCE99EC10DCA624100182683 /* JSXSLTProcessorConstructor.cpp */,
+				BCE99EC20DCA624100182683 /* JSXSLTProcessorConstructor.h */,
+			);
+			name = Constructors;
+			sourceTree = "<group>";
+		};
 		BCD0FBCE0DBD624100B2F630 /* Views */ = {
 			isa = PBXGroup;
 			children = (
@@ -14073,6 +14744,7 @@
 				93B6A0E70B0BCA6700F5027A /* ContextMenu.cpp */,
 				93B6A0E50B0BCA5C00F5027A /* ContextMenu.h */,
 				06027CAC0B1CBFC000884B2D /* ContextMenuItem.h */,
+				D8B6152E1032495100C8554A /* Cookie.h */,
 				9352088109BD45E900F2038D /* CookieJar.h */,
 				2E4346560F546A9900B0F1BA /* CrossThreadCopier.cpp */,
 				2E4346570F546A9900B0F1BA /* CrossThreadCopier.h */,
@@ -14238,12 +14910,13 @@
 				1AB7FC670A8B92EC00D9D37B /* XPathVariableReference.h */,
 				85217E000A5ECD4700DB8D00 /* XSLImportRule.cpp */,
 				85217E010A5ECD4700DB8D00 /* XSLImportRule.h */,
-				BC06F24906D18A7E004A6FA3 /* XSLStyleSheet.cpp */,
+				BC06F24906D18A7E004A6FA3 /* XSLStyleSheetLibxslt.cpp */,
 				BC06F24A06D18A7E004A6FA3 /* XSLStyleSheet.h */,
 				E1F1E82D0C3C2BB9006DB391 /* XSLTExtensions.cpp */,
 				E1F1E82E0C3C2BB9006DB391 /* XSLTExtensions.h */,
 				BC06F24B06D18A7E004A6FA3 /* XSLTProcessor.cpp */,
 				BC06F24C06D18A7E004A6FA3 /* XSLTProcessor.h */,
+				BC06F24D06D18A7E004A6FA3 /* XSLTProcessorLibxslt.cpp */,
 				BCEFE1DC0DCA5CFD00739219 /* XSLTProcessor.idl */,
 				E1BE512B0CF6C512002EA959 /* XSLTUnicodeSort.cpp */,
 				E1BE512C0CF6C512002EA959 /* XSLTUnicodeSort.h */,
@@ -14399,7 +15072,7 @@
 				93CA4C9B09DF93FA00DF8677 /* makeprop.pl */,
 				93CA4C9D09DF93FA00DF8677 /* makevalues.pl */,
 				070DD8F50F01868000727DEB /* mediaControls.css */,
-				07AFE5900F1446BD00841617 /* mediaControlsQT.css */,
+				07AFE5900F1446BD00841617 /* mediaControlsQuickTime.css */,
 				4E19591F0A39DABA00220FE5 /* MediaFeatureNames.cpp */,
 				4E1959200A39DABA00220FE5 /* MediaFeatureNames.h */,
 				0FF5026E102BA9660066F39A /* Media.cpp */,
@@ -14555,6 +15228,7 @@
 				BCEA4841097D93020094C9E4 /* RenderObject.h */,
 				BC60EFB60F33A0E700812A93 /* RenderObjectChildList.cpp */,
 				BC2CC8DE0F32881000A9DF26 /* RenderObjectChildList.h */,
+				BCFA930710333193007B25D1 /* RenderOverflow.h */,
 				A871DEC80A1530C700B12A68 /* RenderPart.cpp */,
 				A871DECF0A1530C700B12A68 /* RenderPart.h */,
 				A871DECE0A1530C700B12A68 /* RenderPartObject.cpp */,
@@ -14675,8 +15349,10 @@
 				A8C4A7F909D563270003AC8D /* Attribute.h */,
 				AB23A32509BBA7D00067CC53 /* BeforeTextInsertedEvent.cpp */,
 				AB23A32609BBA7D00067CC53 /* BeforeTextInsertedEvent.h */,
+				BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */,
 				85031B260A44EFC700F992E0 /* BeforeUnloadEvent.cpp */,
 				85031B270A44EFC700F992E0 /* BeforeUnloadEvent.h */,
+				BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */,
 				6550B693099DF0270090D781 /* CDATASection.cpp */,
 				6550B694099DF0270090D781 /* CDATASection.h */,
 				85089CC90A98C2AB00A275AA /* CDATASection.idl */,
@@ -14710,7 +15386,6 @@
 				A81872110977D3C0005826D9 /* ContainerNode.h */,
 				A8C4A7F809D563270003AC8D /* CSSMappedAttributeDeclaration.cpp */,
 				A8C4A7F709D563270003AC8D /* CSSMappedAttributeDeclaration.h */,
-				93EEC1E709C2877700C515D1 /* DocPtr.h */,
 				A8185F3409765765005826D9 /* Document.cpp */,
 				A8185F3809765765005826D9 /* Document.h */,
 				6548E24809E1E04D00AF8020 /* Document.idl */,
@@ -14820,6 +15495,9 @@
 				1A0D57340A5C77FE007EDD4C /* OverflowEvent.cpp */,
 				1A0D57350A5C77FE007EDD4C /* OverflowEvent.h */,
 				1A0D57380A5C7812007EDD4C /* OverflowEvent.idl */,
+				E1284AE910447DEE00EAEB52 /* PageTransitionEvent.cpp */,
+				E1284AE010447D4500EAEB52 /* PageTransitionEvent.h */,
+				E1284AD910447AEB00EAEB52 /* PageTransitionEvent.idl */,
 				41BF700D0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp */,
 				41BF700E0FE86F61005E8DEC /* PlatformMessagePortChannel.h */,
 				BE91FC8C06133666005E3790 /* Position.cpp */,
@@ -14865,6 +15543,8 @@
 				933A142D0B7D188600A53FFD /* TextEvent.h */,
 				933A142C0B7D188600A53FFD /* TextEvent.idl */,
 				BCCFBAE70B5152ED0001F1D7 /* Tokenizer.h */,
+				5DB1BC6810715A6400EFAA49 /* TransformSource.h */,
+				5DB1BC6910715A6400EFAA49 /* TransformSourceLibxslt.cpp */,
 				854FE72C0A2297BE0058D7AD /* Traversal.cpp */,
 				854FE72D0A2297BE0058D7AD /* Traversal.h */,
 				854FE72E0A2297BE0058D7AD /* TreeWalker.cpp */,
@@ -14895,6 +15575,20 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		FABE72EC1059C1EB00D999DD /* mathml */ = {
+			isa = PBXGroup;
+			children = (
+				FABE72ED1059C1EB00D999DD /* MathMLElement.cpp */,
+				FABE72EE1059C1EB00D999DD /* MathMLElement.h */,
+				FABE72EF1059C1EB00D999DD /* MathMLInlineContainerElement.cpp */,
+				FABE72F01059C1EB00D999DD /* MathMLInlineContainerElement.h */,
+				FABE72F11059C1EB00D999DD /* MathMLMathElement.cpp */,
+				FABE72F21059C1EB00D999DD /* MathMLMathElement.h */,
+				FABE72F31059C1EB00D999DD /* mathtags.in */,
+			);
+			path = mathml;
+			sourceTree = "<group>";
+		};
 /* End PBXGroup section */
 
 /* Begin PBXHeadersBuildPhase section */
@@ -14903,13 +15597,13 @@
 			buildActionMask = 2147483647;
 			files = (
 				41E1B1D10FF5986900576B3B /* AbstractWorker.h in Headers */,
-				29A812340FBB9C1D00510293 /* AccessibilityARIAGrid.h in Headers */,
 				29A8122E0FBB9C1D00510293 /* AccessibilityARIAGridCell.h in Headers */,
 				29A812330FBB9C1D00510293 /* AccessibilityARIAGridRow.h in Headers */,
 				29A8123B0FBB9C1D00510293 /* AccessibilityImageMapLink.h in Headers */,
 				29A8122C0FBB9C1D00510293 /* AccessibilityList.h in Headers */,
 				29A812430FBB9C1D00510293 /* AccessibilityListBox.h in Headers */,
 				29A812420FBB9C1D00510293 /* AccessibilityListBoxOption.h in Headers */,
+				07B0113F1032242200FBDC33 /* AccessibilityMediaControls.h in Headers */,
 				29A812360FBB9C1D00510293 /* AccessibilityObject.h in Headers */,
 				29A812490FBB9CA900510293 /* AccessibilityObjectWrapper.h in Headers */,
 				29A812390FBB9C1D00510293 /* AccessibilityRenderObject.h in Headers */,
@@ -15111,7 +15805,6 @@
 				93F1996D08245E59001E9ABC /* DeprecatedPtrListImpl.h in Headers */,
 				B2F34FE60E82F81400F627CD /* DNS.h in Headers */,
 				BCB16C2A0979C3BD00467741 /* DocLoader.h in Headers */,
-				93EEC1FA09C2877700C515D1 /* DocPtr.h in Headers */,
 				A8185F4009765766005826D9 /* Document.h in Headers */,
 				A8185F3D09765766005826D9 /* DocumentFragment.h in Headers */,
 				656D37360ADBA5DE00A4554D /* DocumentLoader.h in Headers */,
@@ -15217,6 +15910,8 @@
 				93F9B6580BA0F35E00854064 /* DOMHTMLCanvasElementInternal.h in Headers */,
 				85DF2F8E0AA3C88100AD64C5 /* DOMHTMLCollection.h in Headers */,
 				85E711A20AC5D5350053270F /* DOMHTMLCollectionInternal.h in Headers */,
+				F5C041E30FFCA96D00839D4A /* DOMHTMLDataListElement.h in Headers */,
+				F5C041E50FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h in Headers */,
 				85BA4D0B0AA688680088052D /* DOMHTMLDirectoryElement.h in Headers */,
 				85E711A30AC5D5350053270F /* DOMHTMLDirectoryElementInternal.h in Headers */,
 				85BA4D0D0AA688680088052D /* DOMHTMLDivElement.h in Headers */,
@@ -15447,8 +16142,6 @@
 				8503613A0ACE007C001F3D9E /* DOMSVGCursorElement.h in Headers */,
 				850361450ACE00BB001F3D9E /* DOMSVGCursorElementInternal.h in Headers */,
 				A8E545950CA9D1C20097D09B /* DOMSVGCursorElementInternal.h in Headers */,
-				A80F395A0CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h in Headers */,
-				A80F39580CCD9796002DD990 /* DOMSVGDefinitionSrcElementInternal.h in Headers */,
 				85004D940ACEEAEF00C438F6 /* DOMSVGDefsElement.h in Headers */,
 				85004DA40ACEEB5A00C438F6 /* DOMSVGDefsElementInternal.h in Headers */,
 				A8E545930CA9D1C20097D09B /* DOMSVGDefsElementInternal.h in Headers */,
@@ -15874,6 +16567,7 @@
 				935FBC4509BA00B900E230B1 /* EventListener.h in Headers */,
 				1CA19E160DC255CA0065A994 /* EventLoop.h in Headers */,
 				939885C408B7E3D100E707C4 /* EventNames.h in Headers */,
+				E0FEF372B17C53EAC1C1FBEE /* EventSource.h in Headers */,
 				E12EDB7B0B308A78002704B6 /* EventTarget.h in Headers */,
 				BC60D8F30D2A11E000B9918F /* ExceptionBase.h in Headers */,
 				935FBCF209BA143B00E230B1 /* ExceptionCode.h in Headers */,
@@ -15944,6 +16638,7 @@
 				B2A015A90AF6CD53006BCE0E /* GraphicsContext.h in Headers */,
 				A80D67080E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h in Headers */,
 				A88FE3340E5EEE87008D8C0F /* GraphicsContextPrivate.h in Headers */,
+				49C7B9FC1042D3650009D447 /* GraphicsContext3D.h in Headers */,
 				0F580B0D0F12A2690051D689 /* GraphicsLayer.h in Headers */,
 				0F580B060F12A2550051D689 /* GraphicsLayerCA.h in Headers */,
 				0F580B0E0F12A2690051D689 /* GraphicsLayerClient.h in Headers */,
@@ -15970,6 +16665,7 @@
 				BC77CB870FEBF5AF0070887B /* HTMLDataGridColElement.h in Headers */,
 				BC212A1F0FE8333200EC3708 /* HTMLDataGridElement.h in Headers */,
 				BC77CCEE0FEFDE6C0070887B /* HTMLDataGridRowElement.h in Headers */,
+				F5C041DB0FFCA7CE00839D4A /* HTMLDataListElement.h in Headers */,
 				A8EA79FA0A1916DF00A8EF5F /* HTMLDirectoryElement.h in Headers */,
 				A8EA7CB70A192B9C00A8EF5F /* HTMLDivElement.h in Headers */,
 				A8EA79F70A1916DF00A8EF5F /* HTMLDListElement.h in Headers */,
@@ -16101,7 +16797,6 @@
 				BC124F000C26447A009E2349 /* JSBarInfo.h in Headers */,
 				65DF323A09D1DE65000BE325 /* JSCanvasGradient.h in Headers */,
 				65DF323C09D1DE65000BE325 /* JSCanvasPattern.h in Headers */,
-				65DF323E09D1DE65000BE325 /* JSCanvasRenderingContext2D.h in Headers */,
 				93F9B7A10BA6032600854064 /* JSCDATASection.h in Headers */,
 				65DF31F409D1CC60000BE325 /* JSCharacterData.h in Headers */,
 				BCC065880F3CE2A700CD2D87 /* JSClientRect.h in Headers */,
@@ -16159,6 +16854,8 @@
 				14E8378E09F85D4F00B85AE4 /* JSEvent.h in Headers */,
 				BC60D9C00D2A269A00B9918F /* JSEventException.h in Headers */,
 				93B70D6A09EB0C7C009D8468 /* JSEventListener.h in Headers */,
+				E0FEF372B37C53EAC1C1FBEE /* JSEventSource.h in Headers */,
+				E0FEF372B67C53EAC1C1FBEE /* JSEventSourceConstructor.h in Headers */,
 				BC60901F0E91B8EC000C68B5 /* JSEventTarget.h in Headers */,
 				BC00F0150E0A189500FD04E3 /* JSFile.h in Headers */,
 				BC00F0170E0A189500FD04E3 /* JSFileList.h in Headers */,
@@ -16182,6 +16879,7 @@
 				BC77CBD40FEBF8310070887B /* JSHTMLDataGridColElement.h in Headers */,
 				BC212A420FE83A1800EC3708 /* JSHTMLDataGridElement.h in Headers */,
 				BC77CD4F0FEFE1610070887B /* JSHTMLDataGridRowElement.h in Headers */,
+				F5C041E70FFCA96D00839D4A /* JSHTMLDataListElement.h in Headers */,
 				1A85B1E70A1B240500D8C87C /* JSHTMLDirectoryElement.h in Headers */,
 				1A85B2B70A1B2AC700D8C87C /* JSHTMLDivElement.h in Headers */,
 				1A85B1E90A1B240500D8C87C /* JSHTMLDListElement.h in Headers */,
@@ -16256,13 +16954,14 @@
 				A86629D109DA2B48009633A5 /* JSMouseEvent.h in Headers */,
 				65DF31FC09D1CC60000BE325 /* JSMutationEvent.h in Headers */,
 				BCD9C2C10C17B69E005C90A2 /* JSNamedNodeMap.h in Headers */,
-				BCD9C2730C17AA81005C90A2 /* JSNamedNodesCollection.h in Headers */,
 				A9D247F80D757E3400FDF959 /* JSNavigator.h in Headers */,
 				14115B7309F84CD600CA4FC1 /* JSNodeFilter.h in Headers */,
 				BCB773620C17853D00132BA4 /* JSNodeFilterCondition.h in Headers */,
 				1A750D8E0A90E521000FF215 /* JSNodeIterator.h in Headers */,
 				BCD9C2C30C17B69E005C90A2 /* JSNodeList.h in Headers */,
 				65DF31FE09D1CC60000BE325 /* JSNotation.h in Headers */,
+				33503CA410179AD7003B47E1 /* JSNotification.h in Headers */,
+				33503CA610179AD7003B47E1 /* JSNotificationCenter.h in Headers */,
 				A826E8AE0A1A8F2300CD1BB6 /* JSOptionConstructor.h in Headers */,
 				1A0D57410A5C7867007EDD4C /* JSOverflowEvent.h in Headers */,
 				A9D247FF0D757E6900FDF959 /* JSPlugin.h in Headers */,
@@ -16311,7 +17010,6 @@
 				B2FA3D5D0AB75A6F000E5AC4 /* JSSVGColor.h in Headers */,
 				B2FA3D5F0AB75A6F000E5AC4 /* JSSVGComponentTransferFunctionElement.h in Headers */,
 				B2FA3D610AB75A6F000E5AC4 /* JSSVGCursorElement.h in Headers */,
-				A80F393D0CCD971A002DD990 /* JSSVGDefinitionSrcElement.h in Headers */,
 				B2FA3D630AB75A6F000E5AC4 /* JSSVGDefsElement.h in Headers */,
 				B2FA3D650AB75A6F000E5AC4 /* JSSVGDescElement.h in Headers */,
 				B2FA3D670AB75A6F000E5AC4 /* JSSVGDocument.h in Headers */,
@@ -16428,7 +17126,6 @@
 				1A750D5D0A90DEE1000FF215 /* JSTreeWalker.h in Headers */,
 				A86629CF09DA2B47009633A5 /* JSUIEvent.h in Headers */,
 				15C77093100D3CA8005BA267 /* JSValidityState.h in Headers */,
-				BC82432C0D0CE8A200460C8F /* JSVoidCallback.h in Headers */,
 				31C0FF3E0E4CEFAC007D6FE5 /* JSWebKitAnimationEvent.h in Headers */,
 				316FE0720E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.h in Headers */,
 				316FE0740E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.h in Headers */,
@@ -16535,6 +17232,9 @@
 				63D7B32D0E78CD3F00F7617C /* NodeRenderStyle.h in Headers */,
 				9382AAB40D8C386100F357A6 /* NodeWithIndex.h in Headers */,
 				A8EA7EBE0A1945D000A8EF5F /* Notation.h in Headers */,
+				3390CA560FFC157B00921962 /* NotificationCenter.h in Headers */,
+				3390CA580FFC157B00921962 /* NotificationContents.h in Headers */,
+				33503C9A10179A74003B47E1 /* NotificationPresenter.h in Headers */,
 				1A569D0B0D7E2B82007C3983 /* NP_jsobject.h in Headers */,
 				1A569D0C0D7E2B82007C3983 /* npapi.h in Headers */,
 				1A219B3B0DCA87AB0040E3A0 /* npfunctions.h in Headers */,
@@ -16847,7 +17547,6 @@
 				B22279A20D00BF220071B782 /* SVGColor.h in Headers */,
 				B22279A50D00BF220071B782 /* SVGComponentTransferFunctionElement.h in Headers */,
 				B22279A80D00BF220071B782 /* SVGCursorElement.h in Headers */,
-				B22279AB0D00BF220071B782 /* SVGDefinitionSrcElement.h in Headers */,
 				B22279AE0D00BF220071B782 /* SVGDefsElement.h in Headers */,
 				B22279B10D00BF220071B782 /* SVGDescElement.h in Headers */,
 				B25599710D00D8BA00BB825C /* SVGDistantLightSource.h in Headers */,
@@ -17063,7 +17762,6 @@
 				E4AFCFA50DAF29A300F5F55C /* UnitBezier.h in Headers */,
 				D086FE9809D53AAB005BC74D /* UnlinkCommand.h in Headers */,
 				656581B209D14EE6000E61D7 /* UserAgentStyleSheets.h in Headers */,
-				7284ADDE0E6FEB31002EEFBD /* UserStyleSheetLoader.h in Headers */,
 				15C7708D100D3C6B005BA267 /* ValidityState.h in Headers */,
 				93309E1E099E64920056E581 /* visible_units.h in Headers */,
 				93309E20099E64920056E581 /* VisiblePosition.h in Headers */,
@@ -17188,12 +17886,108 @@
 				0FF50263102BA92C0066F39A /* DOMMediaInternal.h in Headers */,
 				0FF5026A102BA9430066F39A /* JSMedia.h in Headers */,
 				0FF50272102BA96A0066F39A /* Media.h in Headers */,
+				754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */,
 				49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */,
 				49484FC5102CF23C00187DD3 /* CanvasPattern.h in Headers */,
 				49484FC8102CF23C00187DD3 /* CanvasPixelArray.h in Headers */,
 				49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */,
 				49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */,
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
+=======
+				416E29A6102FA962007FC14E /* WorkerReportingProxy.h in Headers */,
+				B5C1123C102B6C4600096578 /* SQLTransactionCoordinator.h in Headers */,
+				D8B6152F1032495100C8554A /* Cookie.h in Headers */,
+				41F584C7104652CB009CAA64 /* JSMessagePortCustom.h in Headers */,
+				BCFA930810333193007B25D1 /* RenderOverflow.h in Headers */,
+				0014628B103CD1DE000B20DB /* OriginAccessEntry.h in Headers */,
+				B51BF6F1102C9E590002C15A /* SQLTransactionClient.h in Headers */,
+				E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */,
+				49C7B9941042D2D30009D447 /* JSCanvasBuffer.h in Headers */,
+				49C7B9961042D2D30009D447 /* JSCanvasByteArray.h in Headers */,
+				49C7B9981042D2D30009D447 /* JSCanvasFramebuffer.h in Headers */,
+				49C7B99C1042D2D30009D447 /* JSCanvasProgram.h in Headers */,
+				49C7B99E1042D2D30009D447 /* JSCanvasRenderbuffer.h in Headers */,
+				49C7B9A31042D2D30009D447 /* JSCanvasShader.h in Headers */,
+				49C7B9A51042D2D30009D447 /* JSCanvasTexture.h in Headers */,
+				49C7B9C91042D32F0009D447 /* CanvasBuffer.h in Headers */,
+				49C7B9CC1042D32F0009D447 /* CanvasByteArray.h in Headers */,
+				49C7B9CF1042D32F0009D447 /* CanvasFramebuffer.h in Headers */,
+				49C7B9D51042D32F0009D447 /* CanvasObject.h in Headers */,
+				49C7B9D71042D32F0009D447 /* CanvasProgram.h in Headers */,
+				49C7B9DA1042D32F0009D447 /* CanvasRenderbuffer.h in Headers */,
+				49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */,
+				49C7B9E01042D32F0009D447 /* CanvasRenderingContext3D.h in Headers */,
+				49C7B9E31042D32F0009D447 /* CanvasShader.h in Headers */,
+				49C7B9E61042D32F0009D447 /* CanvasTexture.h in Headers */,
+				49C7BA001042D38C0009D447 /* Canvas3DLayer.h in Headers */,
+				BCA2B061105047600043BD1C /* UserScript.h in Headers */,
+				BCA2B08B10505BCD0043BD1C /* UserScriptTypes.h in Headers */,
+				E1284BB110449FFA00EAEB52 /* JSPageTransitionEvent.h in Headers */,
+				E1284BD61044A01E00EAEB52 /* DOMPageTransitionEvent.h in Headers */,
+				510D4A34103165EE0049EA54 /* SocketStreamErrorBase.h in Headers */,
+				510D4A37103165EE0049EA54 /* SocketStreamHandleBase.h in Headers */,
+				510D4A38103165EE0049EA54 /* SocketStreamHandleClient.h in Headers */,
+				51ABAE1B103C18FF008C5260 /* SocketStreamError.h in Headers */,
+				51ABAE1E103C1913008C5260 /* SocketStreamHandle.h in Headers */,
+				75A94A04104B74FB0006673C /* TimelineItem.h in Headers */,
+				75092BFF104B80F9003DD168 /* DOMDispatchTimelineItem.h in Headers */,
+				49EECDE010503C2400099FAB /* CanvasArray.h in Headers */,
+				49EECDE310503C2400099FAB /* CanvasArrayBuffer.h in Headers */,
+				49EECDE610503C2400099FAB /* CanvasFloatArray.h in Headers */,
+				49EECDE910503C2400099FAB /* CanvasIntArray.h in Headers */,
+				49EECDEC10503C2400099FAB /* CanvasShortArray.h in Headers */,
+				49EECDEF10503C2400099FAB /* CanvasUnsignedByteArray.h in Headers */,
+				49EECDF210503C2400099FAB /* CanvasUnsignedIntArray.h in Headers */,
+				49EECDF510503C2400099FAB /* CanvasUnsignedShortArray.h in Headers */,
+				49EECF01105070C400099FAB /* JSCanvasArrayBuffer.h in Headers */,
+				49EECF03105070C400099FAB /* JSCanvasFloatArray.h in Headers */,
+				49EECF05105070C400099FAB /* JSCanvasIntArray.h in Headers */,
+				49EECF07105070C400099FAB /* JSCanvasShortArray.h in Headers */,
+				49EECF09105070C400099FAB /* JSCanvasUnsignedByteArray.h in Headers */,
+				49EECF0B105070C400099FAB /* JSCanvasUnsignedIntArray.h in Headers */,
+				49EECF0D105070C400099FAB /* JSCanvasUnsignedShortArray.h in Headers */,
+				49EECF1C105072F300099FAB /* JSCanvasArray.h in Headers */,
+				49EECFAC1050938200099FAB /* JSCanvasArrayBufferConstructor.h in Headers */,
+				49EECFAE1050938200099FAB /* JSCanvasByteArrayConstructor.h in Headers */,
+				49EECFB01050938200099FAB /* JSCanvasFloatArrayConstructor.h in Headers */,
+				49EECFB21050938200099FAB /* JSCanvasIntArrayConstructor.h in Headers */,
+				49EECFB61050938200099FAB /* JSCanvasShortArrayConstructor.h in Headers */,
+				49EECFB81050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h in Headers */,
+				49EECFBA1050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h in Headers */,
+				49EECFBC1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h in Headers */,
+				49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */,
+				49EED1451051969400099FAB /* JSCanvasRenderingContext2D.h in Headers */,
+				49EED1471051969400099FAB /* JSCanvasRenderingContext3D.h in Headers */,
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 				59C77F2B10545B3B00506104 /* GeolocationServiceMock.h in Headers */,
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
+=======
+				51A052331058774F00CC9E95 /* CredentialStorage.h in Headers */,
+				51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */,
+				BC8BF151105813BF00A40A07 /* UserStyleSheet.h in Headers */,
+				BC8BF15A1058141800A40A07 /* UserStyleSheetTypes.h in Headers */,
+				510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */,
+				510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */,
+				51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */,
+				C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */,
+				FABE72F51059C1EB00D999DD /* MathMLElement.h in Headers */,
+				FABE72F71059C1EB00D999DD /* MathMLInlineContainerElement.h in Headers */,
+				FABE72F91059C1EB00D999DD /* MathMLMathElement.h in Headers */,
+				37202199106213C600F25C4B /* FontSmoothingMode.h in Headers */,
+				7693BAD2106C2DCA007B0823 /* HaltablePlugin.h in Headers */,
+				7693BAD4106C2DCA007B0823 /* PluginHalter.h in Headers */,
+				7693BAD5106C2DCA007B0823 /* PluginHalterClient.h in Headers */,
+				BCACF3BD1072921A00C0C8A3 /* UserContentURLPattern.h in Headers */,
+				5DB1BC6A10715A6400EFAA49 /* TransformSource.h in Headers */,
+				930FC68A1072B9280045293E /* TextRenderingMode.h in Headers */,
+				979F43D41075E44A0000F83B /* RedirectScheduler.h in Headers */,
+				BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */,
+				BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */,
+				1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */,
+				A75E497610752ACB00C9B896 /* SerializedScriptValue.h in Headers */,
+				97059978107D975200A50A7C /* PolicyCallback.h in Headers */,
+				9705997A107D975200A50A7C /* PolicyChecker.h in Headers */,
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -17212,7 +18006,6 @@
 				1C81BA330E97357C00266E07 /* Copy Inspector Resources */,
 				1C5F9D760E09A1B400E91D0A /* Streamline Inspector Source */,
 				93F19A0C08245E59001E9ABC /* Sources */,
-				1CB71D4A0B02658D0061EA45 /* Generate 64-bit Export File */,
 				93F19B1208245E59001E9ABC /* Frameworks */,
 				939D050109D9FF6B00984996 /* Check For Global Initializers */,
 				933457E60EBFDF6B00B80894 /* Check For Exit Time Destructors */,
@@ -17295,10 +18088,7 @@
 				85136CA80AED665900F90A3D /* westResizeCursor.png in Resources */,
 				1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */,
 				1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */,
-				49484FC3102CF23C00187DD3 /* CanvasGradient.idl in Resources */,
-				49484FC6102CF23C00187DD3 /* CanvasPattern.idl in Resources */,
-				49484FC9102CF23C00187DD3 /* CanvasPixelArray.idl in Resources */,
-				49484FCC102CF23C00187DD3 /* CanvasRenderingContext2D.idl in Resources */,
+				BC9462CC107A7A3900857193 /* BeforeLoadEvent.idl in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -17339,23 +18129,6 @@
 			shellPath = /bin/sh;
 			shellScript = "# Copy all the Inspector front-end resources.\nditto \"${SRCROOT}/inspector/front-end\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector\"\n\n# Remove the WebKit.qrc file since it is not used on the Mac (this file is for Qt)\nrm -f \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector/WebKit.qrc\"\n";
 		};
-		1CB71D4A0B02658D0061EA45 /* Generate 64-bit Export File */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp",
-				"$(SRCROOT)/WebCore.LP64.exp",
-			);
-			name = "Generate 64-bit Export File";
-			outputPaths = (
-				"$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "# Corrections for 64-bit\n# 1) Switch NSRect, NSSize and NSPoint with their CG counterparts\n# 2) Append any 64-bit only symbols from WebCore.LP64.exp\ncat \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore/WebCore.exp\" | sed -e s/7_NSRect/6CGRect/ -e s/7_NSSize/6CGSize/ -e s/8_NSPoint/7CGPoint/ > \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore/WebCore.LP64.exp\"\ncat \"${SRCROOT}/WebCore.LP64.exp\" >> \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore/WebCore.LP64.exp\"\n";
-		};
 		1CC93C640DAE929600E4BC3A /* Copy Forwarding and ICU Headers */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
@@ -17460,6 +18233,7 @@
 				29A8122F0FBB9C1D00510293 /* AccessibilityList.cpp in Sources */,
 				29A8123E0FBB9C1D00510293 /* AccessibilityListBox.cpp in Sources */,
 				29A8123D0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp in Sources */,
+				07B0113D1032241900FBDC33 /* AccessibilityMediaControls.cpp in Sources */,
 				29A8123C0FBB9C1D00510293 /* AccessibilityObject.cpp in Sources */,
 				29A812480FBB9CA900510293 /* AccessibilityObjectMac.mm in Sources */,
 				29A8124A0FBB9CA900510293 /* AccessibilityObjectWrapper.mm in Sources */,
@@ -17682,6 +18456,7 @@
 				85BA4CDE0AA6861B0088052D /* DOMHTMLButtonElement.mm in Sources */,
 				93F9B6570BA0F35E00854064 /* DOMHTMLCanvasElement.mm in Sources */,
 				85DF2F8F0AA3C88100AD64C5 /* DOMHTMLCollection.mm in Sources */,
+				F5C041E40FFCA96D00839D4A /* DOMHTMLDataListElement.mm in Sources */,
 				85BA4D0C0AA688680088052D /* DOMHTMLDirectoryElement.mm in Sources */,
 				85BA4D0E0AA688680088052D /* DOMHTMLDivElement.mm in Sources */,
 				85BA4D100AA688680088052D /* DOMHTMLDListElement.mm in Sources */,
@@ -17780,7 +18555,6 @@
 				850361390ACE007C001F3D9E /* DOMSVGColor.mm in Sources */,
 				8502AB770AD438E600378540 /* DOMSVGComponentTransferFunctionElement.mm in Sources */,
 				8503613B0ACE007C001F3D9E /* DOMSVGCursorElement.mm in Sources */,
-				A80F39590CCD9796002DD990 /* DOMSVGDefinitionSrcElement.mm in Sources */,
 				85004D950ACEEAEF00C438F6 /* DOMSVGDefsElement.mm in Sources */,
 				85004D970ACEEAEF00C438F6 /* DOMSVGDescElement.mm in Sources */,
 				85004D990ACEEAEF00C438F6 /* DOMSVGDocument.mm in Sources */,
@@ -17928,6 +18702,7 @@
 				93C09A7F0B064EEF005ABD4D /* EventHandlerMac.mm in Sources */,
 				1CA19E050DC255950065A994 /* EventLoopMac.mm in Sources */,
 				939885C308B7E3D100E707C4 /* EventNames.cpp in Sources */,
+				E0FEF372B27C53EAC1C1FBEE /* EventSource.cpp in Sources */,
 				E12EDBEA0B308E0B002704B6 /* EventTarget.cpp in Sources */,
 				BC60D8F20D2A11E000B9918F /* ExceptionBase.cpp in Sources */,
 				93831B570D087D6000E5C984 /* ExceptionCode.cpp in Sources */,
@@ -18023,6 +18798,7 @@
 				BC77CBAA0FEBF6C90070887B /* HTMLDataGridColElement.cpp in Sources */,
 				BCF524600FEBEE5D0095BF26 /* HTMLDataGridElement.cpp in Sources */,
 				BC77CD420FEFE0C40070887B /* HTMLDataGridRowElement.cpp in Sources */,
+				F5C041DA0FFCA7CE00839D4A /* HTMLDataListElement.cpp in Sources */,
 				A8EA79F90A1916DF00A8EF5F /* HTMLDirectoryElement.cpp in Sources */,
 				A8EA7CB10A192B9C00A8EF5F /* HTMLDivElement.cpp in Sources */,
 				A8EA79F50A1916DF00A8EF5F /* HTMLDListElement.cpp in Sources */,
@@ -18157,8 +18933,6 @@
 				BC124EFF0C26447A009E2349 /* JSBarInfo.cpp in Sources */,
 				65DF323909D1DE65000BE325 /* JSCanvasGradient.cpp in Sources */,
 				65DF323B09D1DE65000BE325 /* JSCanvasPattern.cpp in Sources */,
-				65DF323D09D1DE65000BE325 /* JSCanvasRenderingContext2D.cpp in Sources */,
-				1A9EF4570A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp in Sources */,
 				93F9B7A00BA6032600854064 /* JSCDATASection.cpp in Sources */,
 				93BA59B20F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp in Sources */,
 				65DF31F309D1CC60000BE325 /* JSCharacterData.cpp in Sources */,
@@ -18199,17 +18973,15 @@
 				1A3417CA0CECFF250049CBDE /* JSCustomVoidCallback.cpp in Sources */,
 				E10B93C30B73C291003ED890 /* JSCustomXPathNSResolver.cpp in Sources */,
 				1AE82F8F0CAAFA9D002237AE /* JSDatabase.cpp in Sources */,
-				1AE830440CAB0ED1002237AE /* JSDatabaseCustom.cpp in Sources */,
 				BC77D1690FF19F560070887B /* JSDataGridColumn.cpp in Sources */,
 				BC77D16B0FF19F560070887B /* JSDataGridColumnList.cpp in Sources */,
 				BC77D1520FF19C730070887B /* JSDataGridColumnListCustom.cpp in Sources */,
 				BCBCAE3C0FF19399000762AE /* JSDataGridDataSource.cpp in Sources */,
 				4162A4571011464700DFF3ED /* JSDedicatedWorkerContext.cpp in Sources */,
 				4162A454101145E300DFF3ED /* JSDedicatedWorkerContextCustom.cpp in Sources */,
+				33503CC010179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp in Sources */,
 				659DDC8209E198BA001BF3C6 /* JSDocument.cpp in Sources */,
-				929264770B61FC7200B41D34 /* JSDocumentCustom.cpp in Sources */,
 				1A494EDE0A123F4C00FDAFC1 /* JSDocumentFragment.cpp in Sources */,
-				BC1DEA4F0E268EB60083A73F /* JSDocumentFragmentCustom.cpp in Sources */,
 				65DF31F509D1CC60000BE325 /* JSDocumentType.cpp in Sources */,
 				1AC2260C0DB69F190089B669 /* JSDOMApplicationCache.cpp in Sources */,
 				1AC226170DB69F740089B669 /* JSDOMApplicationCacheCustom.cpp in Sources */,
@@ -18232,6 +19004,9 @@
 				BCEFAF4E0C317E6900FA81F6 /* JSEventCustom.cpp in Sources */,
 				BC60D9BF0D2A269A00B9918F /* JSEventException.cpp in Sources */,
 				93B70D6909EB0C7C009D8468 /* JSEventListener.cpp in Sources */,
+				E0FEF372B47C53EAC1C1FBEE /* JSEventSource.cpp in Sources */,
+				E0FEF372B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp in Sources */,
+				E0FEF372B57C53EAC1C1FBEE /* JSEventSourceCustom.cpp in Sources */,
 				BC6090200E91B8EC000C68B5 /* JSEventTarget.cpp in Sources */,
 				BC00F0140E0A189500FD04E3 /* JSFile.cpp in Sources */,
 				BC00F0160E0A189500FD04E3 /* JSFileList.cpp in Sources */,
@@ -18260,6 +19035,7 @@
 				BC212A410FE83A1800EC3708 /* JSHTMLDataGridElement.cpp in Sources */,
 				BCBCAE540FF1A29E000762AE /* JSHTMLDataGridElementCustom.cpp in Sources */,
 				BC77CD4E0FEFE1610070887B /* JSHTMLDataGridRowElement.cpp in Sources */,
+				F5C041E60FFCA96D00839D4A /* JSHTMLDataListElement.cpp in Sources */,
 				1A85B1E60A1B240500D8C87C /* JSHTMLDirectoryElement.cpp in Sources */,
 				1A85B2B60A1B2AC700D8C87C /* JSHTMLDivElement.cpp in Sources */,
 				1A85B1E80A1B240500D8C87C /* JSHTMLDListElement.cpp in Sources */,
@@ -18352,7 +19128,6 @@
 				65DF31FB09D1CC60000BE325 /* JSMutationEvent.cpp in Sources */,
 				BCD9C2C00C17B69E005C90A2 /* JSNamedNodeMap.cpp in Sources */,
 				BCD9C2630C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp in Sources */,
-				BCD9C2720C17AA81005C90A2 /* JSNamedNodesCollection.cpp in Sources */,
 				A9D247F70D757E3400FDF959 /* JSNavigator.cpp in Sources */,
 				A9C6E6490D7465D8006442E9 /* JSNavigatorCustom.cpp in Sources */,
 				14DC0D3709FED073007B0235 /* JSNode.cpp in Sources */,
@@ -18365,6 +19140,8 @@
 				BCD9C2C20C17B69E005C90A2 /* JSNodeList.cpp in Sources */,
 				BCD9C2650C17AA67005C90A2 /* JSNodeListCustom.cpp in Sources */,
 				65DF31FD09D1CC60000BE325 /* JSNotation.cpp in Sources */,
+				33503CA310179AD7003B47E1 /* JSNotification.cpp in Sources */,
+				33503CA510179AD7003B47E1 /* JSNotificationCenter.cpp in Sources */,
 				A826EC480A1B0CBE00CD1BB6 /* JSOptionConstructor.cpp in Sources */,
 				1A0D57400A5C7867007EDD4C /* JSOverflowEvent.cpp in Sources */,
 				A9D247FE0D757E6900FDF959 /* JSPlugin.cpp in Sources */,
@@ -18384,8 +19161,6 @@
 				41D07A7E0FF935CA0095EDCE /* JSSharedWorker.cpp in Sources */,
 				415B7C580FF598E6006770F7 /* JSSharedWorkerConstructor.cpp in Sources */,
 				41D1690510238B66009BC827 /* JSSharedWorkerContext.cpp in Sources */,
-				41D168F010226EC4009BC827 /* JSSharedWorkerContextCustom.cpp in Sources */,
-				415B7C590FF598E6006770F7 /* JSSharedWorkerCustom.cpp in Sources */,
 				514C76370CE9225E007EF3CD /* JSSQLError.cpp in Sources */,
 				1AE82FEC0CAB07EE002237AE /* JSSQLResultSet.cpp in Sources */,
 				1AFE11990CBFFCC4003017FA /* JSSQLResultSetRowList.cpp in Sources */,
@@ -18423,7 +19198,6 @@
 				B2FA3D5C0AB75A6F000E5AC4 /* JSSVGColor.cpp in Sources */,
 				B2FA3D5E0AB75A6F000E5AC4 /* JSSVGComponentTransferFunctionElement.cpp in Sources */,
 				B2FA3D600AB75A6F000E5AC4 /* JSSVGCursorElement.cpp in Sources */,
-				A80F393E0CCD971A002DD990 /* JSSVGDefinitionSrcElement.cpp in Sources */,
 				B2FA3D620AB75A6F000E5AC4 /* JSSVGDefsElement.cpp in Sources */,
 				B2FA3D640AB75A6F000E5AC4 /* JSSVGDescElement.cpp in Sources */,
 				B2FA3D660AB75A6F000E5AC4 /* JSSVGDocument.cpp in Sources */,
@@ -18548,7 +19322,6 @@
 				516BB7940CE91E6800512F79 /* JSTreeWalkerCustom.cpp in Sources */,
 				A86629D009DA2B48009633A5 /* JSUIEvent.cpp in Sources */,
 				15C77094100D3CA8005BA267 /* JSValidityState.cpp in Sources */,
-				BC82432B0D0CE8A200460C8F /* JSVoidCallback.cpp in Sources */,
 				31C0FF3D0E4CEFAC007D6FE5 /* JSWebKitAnimationEvent.cpp in Sources */,
 				316FE0710E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.cpp in Sources */,
 				316FE0730E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.cpp in Sources */,
@@ -18654,6 +19427,8 @@
 				854FE7320A2297BE0058D7AD /* NodeFilterCondition.cpp in Sources */,
 				854FE7340A2297BE0058D7AD /* NodeIterator.cpp in Sources */,
 				A8EA7EBF0A1945D000A8EF5F /* Notation.cpp in Sources */,
+				33503CC71017A1B1003B47E1 /* Notification.cpp in Sources */,
+				3390CA550FFC157B00921962 /* NotificationCenter.cpp in Sources */,
 				1A569D0A0D7E2B82007C3983 /* NP_jsobject.cpp in Sources */,
 				1A569D0D0D7E2B82007C3983 /* npruntime.cpp in Sources */,
 				1A569D130D7E2B82007C3983 /* objc_class.mm in Sources */,
@@ -18932,7 +19707,6 @@
 				B2227B060D00BFF10071B782 /* SVGCSSParser.cpp in Sources */,
 				B2227B080D00BFF10071B782 /* SVGCSSStyleSelector.cpp in Sources */,
 				B22279A70D00BF220071B782 /* SVGCursorElement.cpp in Sources */,
-				B22279AA0D00BF220071B782 /* SVGDefinitionSrcElement.cpp in Sources */,
 				B22279AD0D00BF220071B782 /* SVGDefsElement.cpp in Sources */,
 				B22279B00D00BF220071B782 /* SVGDescElement.cpp in Sources */,
 				B22279B30D00BF220071B782 /* SVGDocument.cpp in Sources */,
@@ -19126,7 +19900,6 @@
 				B2C3DA4C0D006C1D00EF6F26 /* UnicodeRange.cpp in Sources */,
 				D086FE9909D53AAB005BC74D /* UnlinkCommand.cpp in Sources */,
 				65DF326109D1E199000BE325 /* UserAgentStyleSheetsData.cpp in Sources */,
-				7284ADDD0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp in Sources */,
 				15C7708E100D3C6B005BA267 /* ValidityState.cpp in Sources */,
 				93309E1D099E64920056E581 /* visible_units.cpp in Sources */,
 				93309E1F099E64920056E581 /* VisiblePosition.cpp in Sources */,
@@ -19230,20 +20003,120 @@
 				1AB7FC850A8B92EC00D9D37B /* XPathValue.cpp in Sources */,
 				1AB7FC870A8B92EC00D9D37B /* XPathVariableReference.cpp in Sources */,
 				85217E020A5ECD4700DB8D00 /* XSLImportRule.cpp in Sources */,
-				93F19B0308245E59001E9ABC /* XSLStyleSheet.cpp in Sources */,
+				93F19B0308245E59001E9ABC /* XSLStyleSheetLibxslt.cpp in Sources */,
 				E1F1E82F0C3C2BB9006DB391 /* XSLTExtensions.cpp in Sources */,
 				93F19B0408245E59001E9ABC /* XSLTProcessor.cpp in Sources */,
+				93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */,
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */,
 				0FF5025C102BA9010066F39A /* DOMMedia.mm in Sources */,
 				0FF50269102BA9430066F39A /* JSMedia.cpp in Sources */,
 				0FF50271102BA96A0066F39A /* Media.cpp in Sources */,
+				754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */,
 				49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */,
 				49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */,
 				49484FC7102CF23C00187DD3 /* CanvasPixelArray.cpp in Sources */,
 				49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */,
 				49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */,
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
+=======
+				9392262D1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp in Sources */,
+				9392262F10321084006E7D5D /* JSCSSRuleListCustom.cpp in Sources */,
+				B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */,
+				410B7E721045FAB000D8224F /* JSMessageEventCustom.cpp in Sources */,
+				0014628A103CD1DE000B20DB /* OriginAccessEntry.cpp in Sources */,
+				B51BF6F0102C9E590002C15A /* SQLTransactionClient.cpp in Sources */,
+				E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */,
+				49C7B9931042D2D30009D447 /* JSCanvasBuffer.cpp in Sources */,
+				49C7B9951042D2D30009D447 /* JSCanvasByteArray.cpp in Sources */,
+				49C7B9971042D2D30009D447 /* JSCanvasFramebuffer.cpp in Sources */,
+				49C7B99B1042D2D30009D447 /* JSCanvasProgram.cpp in Sources */,
+				49C7B99D1042D2D30009D447 /* JSCanvasRenderbuffer.cpp in Sources */,
+				49C7B9A21042D2D30009D447 /* JSCanvasShader.cpp in Sources */,
+				49C7B9A41042D2D30009D447 /* JSCanvasTexture.cpp in Sources */,
+				49C7B9C81042D32F0009D447 /* CanvasBuffer.cpp in Sources */,
+				49C7B9CB1042D32F0009D447 /* CanvasByteArray.cpp in Sources */,
+				49C7B9CE1042D32F0009D447 /* CanvasFramebuffer.cpp in Sources */,
+				49C7B9D41042D32F0009D447 /* CanvasObject.cpp in Sources */,
+				49C7B9D61042D32F0009D447 /* CanvasProgram.cpp in Sources */,
+				49C7B9D91042D32F0009D447 /* CanvasRenderbuffer.cpp in Sources */,
+				49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */,
+				49C7B9DF1042D32F0009D447 /* CanvasRenderingContext3D.cpp in Sources */,
+				49C7B9E21042D32F0009D447 /* CanvasShader.cpp in Sources */,
+				49C7B9E51042D32F0009D447 /* CanvasTexture.cpp in Sources */,
+				49C7BA011042D38C0009D447 /* Canvas3DLayer.mm in Sources */,
+				49C7BA021042D38C0009D447 /* GraphicsContext3DMac.cpp in Sources */,
+				49C7BA8D1042F5B10009D447 /* JSDocumentCustom.cpp in Sources */,
+				E1284BB210449FFA00EAEB52 /* JSPageTransitionEvent.cpp in Sources */,
+				E1284BD51044A01E00EAEB52 /* DOMPageTransitionEvent.mm in Sources */,
+				510D4A33103165EE0049EA54 /* SocketStreamErrorBase.cpp in Sources */,
+				510D4A36103165EE0049EA54 /* SocketStreamHandleBase.cpp in Sources */,
+				51ABAE1F103C1913008C5260 /* SocketStreamHandleCFNet.cpp in Sources */,
+				75A94A03104B74FB0006673C /* TimelineItem.cpp in Sources */,
+				75092BFE104B80F9003DD168 /* DOMDispatchTimelineItem.cpp in Sources */,
+				49EECDDF10503C2400099FAB /* CanvasArray.cpp in Sources */,
+				49EECDE210503C2400099FAB /* CanvasArrayBuffer.cpp in Sources */,
+				49EECDE510503C2400099FAB /* CanvasFloatArray.cpp in Sources */,
+				49EECDE810503C2400099FAB /* CanvasIntArray.cpp in Sources */,
+				49EECDEB10503C2400099FAB /* CanvasShortArray.cpp in Sources */,
+				49EECDEE10503C2400099FAB /* CanvasUnsignedByteArray.cpp in Sources */,
+				49EECDF110503C2400099FAB /* CanvasUnsignedIntArray.cpp in Sources */,
+				49EECDF410503C2400099FAB /* CanvasUnsignedShortArray.cpp in Sources */,
+				49EECF00105070C400099FAB /* JSCanvasArrayBuffer.cpp in Sources */,
+				49EECF02105070C400099FAB /* JSCanvasFloatArray.cpp in Sources */,
+				49EECF04105070C400099FAB /* JSCanvasIntArray.cpp in Sources */,
+				49EECF06105070C400099FAB /* JSCanvasShortArray.cpp in Sources */,
+				49EECF08105070C400099FAB /* JSCanvasUnsignedByteArray.cpp in Sources */,
+				49EECF0A105070C400099FAB /* JSCanvasUnsignedIntArray.cpp in Sources */,
+				49EECF0C105070C400099FAB /* JSCanvasUnsignedShortArray.cpp in Sources */,
+				49EECF1B105072F300099FAB /* JSCanvasArray.cpp in Sources */,
+				49EECF7810508D9C00099FAB /* JSCanvasByteArrayCustom.cpp in Sources */,
+				49EECF7910508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp in Sources */,
+				49EECF7A10508D9C00099FAB /* JSCanvasIntArrayCustom.cpp in Sources */,
+				49EECF7B10508D9C00099FAB /* JSCanvasShortArrayCustom.cpp in Sources */,
+				49EECF7C10508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp in Sources */,
+				49EECF7D10508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp in Sources */,
+				49EECF7E10508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp in Sources */,
+				49EECFAB1050938200099FAB /* JSCanvasArrayBufferConstructor.cpp in Sources */,
+				49EECFAD1050938200099FAB /* JSCanvasByteArrayConstructor.cpp in Sources */,
+				49EECFAF1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp in Sources */,
+				49EECFB11050938200099FAB /* JSCanvasIntArrayConstructor.cpp in Sources */,
+				49EECFB51050938200099FAB /* JSCanvasShortArrayConstructor.cpp in Sources */,
+				49EECFB71050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp in Sources */,
+				49EECFB91050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp in Sources */,
+				49EECFBB1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp in Sources */,
+				49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */,
+				49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */,
+				49EED1461051969400099FAB /* JSCanvasRenderingContext3D.cpp in Sources */,
+				49EED14E1051971A00099FAB /* JSCanvasRenderingContext2DCustom.cpp in Sources */,
+				49EED14F1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp in Sources */,
+				49EED1501051971A00099FAB /* JSCanvasRenderingContextCustom.cpp in Sources */,
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 				59C77F2A10545B3B00506104 /* GeolocationServiceMock.cpp in Sources */,
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
+=======
+				51A052341058774F00CC9E95 /* CredentialStorage.cpp in Sources */,
+				510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */,
+				51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */,
+				FABE72F41059C1EB00D999DD /* MathMLElement.cpp in Sources */,
+				FABE72F61059C1EB00D999DD /* MathMLInlineContainerElement.cpp in Sources */,
+				FABE72F81059C1EB00D999DD /* MathMLMathElement.cpp in Sources */,
+				FABE72FD1059C21100D999DD /* MathMLElementFactory.cpp in Sources */,
+				FABE72FE1059C21100D999DD /* MathMLNames.cpp in Sources */,
+				BCCE58AC1061E8CF008FB35A /* JSDatabaseCustom.cpp in Sources */,
+				BCCE58AF1061E90C008FB35A /* JSDocumentFragmentCustom.cpp in Sources */,
+				C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */,
+				14CD8D82106B529000A46D23 /* JSSharedWorkerCustom.cpp in Sources */,
+				7693BAD3106C2DCA007B0823 /* PluginHalter.cpp in Sources */,
+				BCACF3BC1072921A00C0C8A3 /* UserContentURLPattern.cpp in Sources */,
+				5DB1BC6B10715A6400EFAA49 /* TransformSourceLibxslt.cpp in Sources */,
+				979F43D31075E44A0000F83B /* RedirectScheduler.cpp in Sources */,
+				BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */,
+				1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */,
+				A75E497710752ACB00C9B896 /* SerializedScriptValue.cpp in Sources */,
+				97059977107D975200A50A7C /* PolicyCallback.cpp in Sources */,
+				97059979107D975200A50A7C /* PolicyChecker.cpp in Sources */,
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebCore/WebCorePrefix.h b/WebCore/WebCorePrefix.h
index c0d1e70..6c8e200 100644
--- a/WebCore/WebCorePrefix.h
+++ b/WebCore/WebCorePrefix.h
@@ -113,6 +113,13 @@
 #include <stdio.h>
 #else
 #include <CoreServices/CoreServices.h>
+
+#if defined(WIN32) || defined(_WIN32)
+/* Including CoreServices.h on Windows doesn't include CFNetwork.h, so we do
+   it explicitly here to make Windows more consistent with Mac. */
+#include <CFNetwork/CFNetwork.h>
+#endif
+
 #endif
 #endif
 
@@ -125,8 +132,11 @@
 #define delete ("if you use new/delete make sure to include config.h at the top of the file"()) 
 #endif
 
-/* Work around a bug with C++ library that screws up Objective-C++ when exception support is disabled. */
-#if defined(__APPLE__)
+/* When C++ exceptions are disabled, the C++ library defines |try| and |catch|
+ * to allow C++ code that expects exceptions to build. These definitions
+ * interfere with Objective-C++ uses of Objective-C exception handlers, which
+ * use |@try| and |@catch|. As a workaround, undefine these macros. */
+#ifdef __OBJC__
 #undef try
 #undef catch
 #endif
diff --git a/WebCore/WebCoreSources.bkl b/WebCore/WebCoreSources.bkl
index a9a1b42..013b4d6 100644
--- a/WebCore/WebCoreSources.bkl
+++ b/WebCore/WebCoreSources.bkl
@@ -1,5 +1,5 @@
 <?xml version="1.0" ?>
-<!-- 
+<!--
 
 Copyright (C) 2007 Kevin Ollivier.  All rights reserved.
 
@@ -8,13 +8,13 @@ modification, are permitted provided that the following conditions
 are met:
 
 1.  Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer. 
+    notice, this list of conditions and the following disclaimer.
 2.  Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
-    documentation and/or other materials provided with the distribution. 
+    documentation and/or other materials provided with the distribution.
 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
     its contributors may be used to endorse or promote products derived
-    from this software without specific prior written permission. 
+    from this software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
 EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -37,6 +37,7 @@ This file contains the list of files needed to build WebCore.
         accessibility/AccessibilityARIAGridCell.cpp
         accessibility/AccessibilityARIAGridRow.cpp
         accessibility/AccessibilityImageMapLink.cpp
+        accessibility/AccessibilityMediaControls.cpp
         accessibility/AccessibilityObject.cpp
         accessibility/AccessibilityList.cpp
         accessibility/AccessibilityListBox.cpp
@@ -50,16 +51,18 @@ This file contains the list of files needed to build WebCore.
         accessibility/AccessibilityTableRow.cpp
         accessibility/AXObjectCache.cpp
     </set>
-    
+
     <set append="1" var="WEBCORE_SOURCES_JS">
         bindings/js/GCController.cpp
         bindings/js/JSAttrCustom.cpp
         bindings/js/JSAudioConstructor.cpp
         bindings/js/JSCDATASectionCustom.cpp
+        bindings/js/JSCanvasRenderingContextCustom.cpp
         bindings/js/JSCanvasRenderingContext2DCustom.cpp
         bindings/js/JSClipboardCustom.cpp
         bindings/js/JSConsoleCustom.cpp
         bindings/js/JSCSSRuleCustom.cpp
+        bindings/js/JSCSSRuleListCustom.cpp
         bindings/js/JSCSSStyleDeclarationCustom.cpp
         bindings/js/JSCSSValueCustom.cpp
         bindings/js/JSCoordinatesCustom.cpp
@@ -85,11 +88,14 @@ This file contains the list of files needed to build WebCore.
         bindings/js/JSDocumentFragmentCustom.cpp
         bindings/js/JSElementCustom.cpp
         bindings/js/JSEventCustom.cpp
+        bindings/js/JSEventSourceConstructor.cpp
+        bindings/js/JSEventSourceCustom.cpp
         bindings/js/JSEventTarget.cpp
         bindings/js/JSGeolocationCustom.cpp
         bindings/js/JSHTMLAllCollection.cpp
         bindings/js/JSHistoryCustom.cpp
         bindings/js/JSHTMLAppletElementCustom.cpp
+        bindings/js/JSHTMLCanvasElementCustom.cpp
         bindings/js/JSHTMLCollectionCustom.cpp
         bindings/js/JSHTMLDataGridElementCustom.cpp
         bindings/js/JSHTMLDocumentCustom.cpp
@@ -112,10 +118,10 @@ This file contains the list of files needed to build WebCore.
         bindings/js/JSLocationCustom.cpp
         bindings/js/JSMessageChannelConstructor.cpp
         bindings/js/JSMessageChannelCustom.cpp
+        bindings/js/JSMessageEventCustom.cpp
         bindings/js/JSMessagePortCustom.cpp
         bindings/js/JSMimeTypeArrayCustom.cpp
         bindings/js/JSNamedNodeMapCustom.cpp
-        bindings/js/JSNamedNodesCollection.cpp
         bindings/js/JSNavigatorCustom.cpp
         bindings/js/JSNodeCustom.cpp
         bindings/js/JSNodeFilterCondition.cpp
@@ -260,6 +266,7 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSCSSVariablesRule.cpp
         DerivedSources/WebCore/JSCanvasGradient.cpp
         DerivedSources/WebCore/JSCanvasPattern.cpp
+        DerivedSources/WebCore/JSCanvasRenderingContext.cpp
         DerivedSources/WebCore/JSCanvasRenderingContext2D.cpp
         DerivedSources/WebCore/JSCharacterData.cpp
         DerivedSources/WebCore/JSClientRect.cpp
@@ -283,6 +290,7 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSEntityReference.cpp
         DerivedSources/WebCore/JSErrorEvent.cpp
         DerivedSources/WebCore/JSEvent.cpp
+        DerivedSources/WebCore/JSEventSource.cpp
         DerivedSources/WebCore/JSEventException.cpp
         DerivedSources/WebCore/JSFile.cpp
         DerivedSources/WebCore/JSFileList.cpp
@@ -303,6 +311,7 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSHTMLDataGridCellElement.cpp
         DerivedSources/WebCore/JSHTMLDataGridColElement.cpp
         DerivedSources/WebCore/JSHTMLDataGridRowElement.cpp
+        DerivedSources/WebCore/JSHTMLDataListElement.cpp
         DerivedSources/WebCore/JSHTMLDListElement.cpp
         DerivedSources/WebCore/JSHTMLDirectoryElement.cpp
         DerivedSources/WebCore/JSHTMLDivElement.cpp
@@ -376,6 +385,7 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSNodeList.cpp
         DerivedSources/WebCore/JSNotation.cpp
         DerivedSources/WebCore/JSOverflowEvent.cpp
+        DerivedSources/WebCore/JSPageTransitionEvent.cpp
         DerivedSources/WebCore/JSPlugin.cpp
         DerivedSources/WebCore/JSPluginArray.cpp
         DerivedSources/WebCore/JSPositionError.cpp
@@ -479,6 +489,7 @@ This file contains the list of files needed to build WebCore.
         dom/OptionGroupElement.cpp
         dom/OptionElement.cpp
         dom/OverflowEvent.cpp
+        dom/PageTransitionEvent.cpp
         dom/Position.cpp
         dom/PositionIterator.cpp
         dom/ProcessingInstruction.cpp
@@ -488,7 +499,7 @@ This file contains the list of files needed to build WebCore.
         dom/RegisteredEventListener.cpp
         dom/ScriptElement.cpp
         dom/ScriptExecutionContext.cpp
-        dom/SelectElement.cpp 
+        dom/SelectElement.cpp
         dom/SelectorNodeList.cpp
         dom/StaticNodeList.cpp
         dom/StyleElement.cpp
@@ -496,6 +507,7 @@ This file contains the list of files needed to build WebCore.
         dom/TagNodeList.cpp
         dom/Text.cpp
         dom/TextEvent.cpp
+        dom/TransformSourceLibxslt.cpp
         dom/Traversal.cpp
         dom/TreeWalker.cpp
         dom/UIEvent.cpp
@@ -557,7 +569,7 @@ This file contains the list of files needed to build WebCore.
         editing/markup.cpp
         editing/visible_units.cpp
     </set>
-    
+
     <set append="1" var="WEBCORE_SOURCES_HISTORY">
         history/BackForwardList.cpp
         history/CachedFrame.cpp
@@ -565,11 +577,12 @@ This file contains the list of files needed to build WebCore.
         history/PageCache.cpp
         history/HistoryItem.cpp
     </set>
-    
+
     <set append="1" var="WEBCORE_SOURCES_HTML">
         html/canvas/CanvasGradient.cpp
         html/canvas/CanvasPattern.cpp
         html/canvas/CanvasPixelArray.cpp
+        html/canvas/CanvasRenderingContext.cpp
         html/canvas/CanvasRenderingContext2D.cpp
         html/canvas/CanvasStyle.cpp
         html/CollectionCache.cpp
@@ -592,6 +605,7 @@ This file contains the list of files needed to build WebCore.
         html/HTMLDataGridCellElement.cpp
         html/HTMLDataGridColElement.cpp
         html/HTMLDataGridRowElement.cpp
+        html/HTMLDataListElement.cpp
         html/HTMLDListElement.cpp
         html/HTMLDirectoryElement.cpp
         html/HTMLDivElement.cpp
@@ -714,6 +728,7 @@ This file contains the list of files needed to build WebCore.
         loader/PlaceholderDocument.cpp
         loader/PluginDocument.cpp
         loader/ProgressTracker.cpp
+        loader/RedirectScheduler.cpp
         loader/Request.cpp
         loader/ResourceLoader.cpp
         loader/SubresourceLoader.cpp
@@ -723,7 +738,7 @@ This file contains the list of files needed to build WebCore.
         loader/WorkerThreadableLoader.cpp
         loader/loader.cpp
     </set>
-    
+
     <set append="1" var="WEBCORE_SOURCES_ICON">
         loader/icon/IconDatabase.cpp
         loader/icon/IconLoader.cpp
@@ -741,23 +756,23 @@ This file contains the list of files needed to build WebCore.
         page/Chrome.cpp
         page/Console.cpp
         page/ContextMenuController.cpp
-        page/Coordinates.cpp
         page/DOMSelection.cpp
         page/DOMTimer.cpp
         page/DOMWindow.cpp
         page/DragController.cpp
         page/EventHandler.cpp
+        page/EventSource.cpp
         page/FocusController.cpp
         page/Frame.cpp
         page/FrameTree.cpp
         page/FrameView.cpp
         page/Geolocation.cpp
-        page/Geoposition.cpp
         page/History.cpp
         page/Location.cpp
         page/MouseEventWithHitTestResults.cpp
         page/Navigator.cpp
         page/NavigatorBase.cpp
+        page/OriginAccessEntry.cpp
         page/Page.cpp
         page/PageGroup.cpp
         page/PageGroupLoadDeferrer.cpp
@@ -801,6 +816,7 @@ This file contains the list of files needed to build WebCore.
         platform/LinkHash.cpp
         platform/Logging.cpp
         platform/MIMETypeRegistry.cpp
+        platform/mock/GeolocationServiceMock.cpp
         platform/text/RegularExpression.cpp
         platform/Scrollbar.cpp
         platform/ScrollbarThemeComposite.cpp
@@ -835,6 +851,7 @@ This file contains the list of files needed to build WebCore.
         platform/graphics/GraphicsContext.cpp
         platform/graphics/GraphicsTypes.cpp
         platform/graphics/Image.cpp
+        platform/graphics/ImageSource.cpp
         platform/graphics/IntRect.cpp
         platform/graphics/Path.cpp
         platform/graphics/PathTraversalState.cpp
@@ -884,6 +901,10 @@ This file contains the list of files needed to build WebCore.
         plugins/npapi.cpp
     </set>
 
+    <set append="1" var="WEBCORE_SOURCES_IMAGE_DECODERS">
+        platform/image-decoders/ImageDecoder.cpp
+    </set>
+
     <set append="1" var="WEBCORE_SOURCES_GIF">
         platform/image-decoders/gif/GIFImageDecoder.cpp
         platform/image-decoders/gif/GIFImageReader.cpp
@@ -913,8 +934,8 @@ This file contains the list of files needed to build WebCore.
     </set>
 
     <set append="1" var="WEBCORE_SOURCES_BMP">
-      platform/image-decoders/bmp/BMPImageDecoder.cpp
-      platform/image-decoders/bmp/BMPImageReader.cpp
+        platform/image-decoders/bmp/BMPImageDecoder.cpp
+        platform/image-decoders/bmp/BMPImageReader.cpp
     </set>
 
     <set append="1" var="WEBCORE_SOURCES_ICO">
@@ -1030,10 +1051,13 @@ This file contains the list of files needed to build WebCore.
         storage/SQLResultSetRowList.cpp
         storage/SQLStatement.cpp
         storage/SQLTransaction.cpp
+        storage/SQLTransactionClient.cpp
+        storage/SQLTransactionCoordinator.cpp
         storage/Storage.cpp
         storage/StorageAreaImpl.cpp
         storage/StorageAreaSync.cpp
         storage/StorageEvent.cpp
+        storage/StorageEventDispatcher.cpp
         storage/StorageNamespace.cpp
         storage/StorageNamespaceImpl.cpp
         storage/StorageMap.cpp
@@ -1062,10 +1086,11 @@ This file contains the list of files needed to build WebCore.
         xml/XPathValue.cpp
         xml/XPathVariableReference.cpp
         xml/XSLImportRule.cpp
-        xml/XSLStyleSheet.cpp
+        xml/XSLStyleSheetLibxslt.cpp
         xml/XSLTExtensions.cpp
         xml/XSLTUnicodeSort.cpp
         xml/XSLTProcessor.cpp
+        xml/XSLTProcessorLibxslt.cpp
     </set>
 
 </makefile>
diff --git a/WebCore/accessibility/AXObjectCache.cpp b/WebCore/accessibility/AXObjectCache.cpp
index 0b758e6..55199a3 100644
--- a/WebCore/accessibility/AXObjectCache.cpp
+++ b/WebCore/accessibility/AXObjectCache.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,6 +36,7 @@
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
 #include "AccessibilityImageMapLink.h"
+#include "AccessibilityMediaControls.h"
 #include "AccessibilityRenderObject.h"
 #include "AccessibilitySlider.h"
 #include "AccessibilityTable.h"
@@ -43,8 +44,14 @@
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "InputElement.h"
+#include "FocusController.h"
+#include "Frame.h"
 #include "HTMLNames.h"
+#if ENABLE(VIDEO)
+#include "MediaControlElements.h"
+#endif
+#include "InputElement.h"
+#include "Page.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 
@@ -73,6 +80,32 @@ AXObjectCache::~AXObjectCache()
     }
 }
 
+AccessibilityObject* AXObjectCache::focusedUIElementForPage(const Page* page)
+{
+    // get the focused node in the page
+    Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
+    Node* focusedNode = focusedDocument->focusedNode();
+    if (!focusedNode)
+        focusedNode = focusedDocument;
+
+    RenderObject* focusedNodeRenderer = focusedNode->renderer();
+    if (!focusedNodeRenderer)
+        return 0;
+
+    AccessibilityObject* obj = focusedNodeRenderer->document()->axObjectCache()->getOrCreate(focusedNodeRenderer);
+
+    if (obj->shouldFocusActiveDescendant()) {
+        if (AccessibilityObject* descendant = obj->activeDescendant())
+            obj = descendant;
+    }
+
+    // the HTML element, for example, is focusable but has an AX object that is ignored
+    if (obj->accessibilityIsIgnored())
+        obj = obj->parentObjectUnignored();
+
+    return obj;
+}
+
 AccessibilityObject* AXObjectCache::get(RenderObject* renderer)
 {
     if (!renderer)
@@ -108,7 +141,7 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         RefPtr<AccessibilityObject> newObj = 0;
         if (renderer->isListBox())
             newObj = AccessibilityListBox::create(renderer);
-        else if (node && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
+        else if (node && (nodeIsAriaType(node, "list") || node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
             newObj = AccessibilityList::create(renderer);
         
         // aria tables
@@ -127,6 +160,12 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         else if (renderer->isTableCell())
             newObj = AccessibilityTableCell::create(renderer);
 
+#if ENABLE(VIDEO)
+        // media controls
+        else if (renderer->node() && renderer->node()->isMediaControlElement())
+            newObj = AccessibilityMediaControl::create(renderer);
+#endif
+
         // input type=range
         else if (renderer->isSlider())
             newObj = AccessibilitySlider::create(renderer);
@@ -213,6 +252,23 @@ void AXObjectCache::remove(RenderObject* renderer)
     m_renderObjectMapping.remove(renderer);
 }
 
+#if !PLATFORM(WIN)
+AXID AXObjectCache::platformGenerateAXID() const
+{
+    static AXID lastUsedID = 0;
+
+    // Generate a new ID.
+    AXID objID = lastUsedID;
+    do {
+        ++objID;
+    } while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+
+    lastUsedID = objID;
+
+    return objID;
+}
+#endif
+
 AXID AXObjectCache::getAXID(AccessibilityObject* obj)
 {
     // check for already-assigned ID
@@ -221,15 +277,10 @@ AXID AXObjectCache::getAXID(AccessibilityObject* obj)
         ASSERT(m_idsInUse.contains(objID));
         return objID;
     }
-    
-    // generate a new ID
-    static AXID lastUsedID = 0;
-    objID = lastUsedID;
-    do
-        ++objID;
-    while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+
+    objID = platformGenerateAXID();
+
     m_idsInUse.add(objID);
-    lastUsedID = objID;
     obj->setAXObjectID(objID);
     
     return objID;
@@ -288,7 +339,7 @@ void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
 }
     
 #if HAVE(ACCESSIBILITY)
-void AXObjectCache::postNotification(RenderObject* renderer, const String& message, bool postToElement)
+void AXObjectCache::postNotification(RenderObject* renderer, AXNotification notification, bool postToElement)
 {
     // Notifications for text input objects are sent to that object.
     // All others are sent to the top WebArea.
@@ -316,14 +367,14 @@ void AXObjectCache::postNotification(RenderObject* renderer, const String& messa
     if (!obj)
         return;
 
-    m_notificationsToPost.append(make_pair(obj, message));
+    m_notificationsToPost.append(make_pair(obj, notification));
     if (!m_notificationPostTimer.isActive())
         m_notificationPostTimer.startOneShot(0);
 }
 
 void AXObjectCache::selectedChildrenChanged(RenderObject* renderer)
 {
-    postNotification(renderer, "AXSelectedChildrenChanged", true);
+    postNotification(renderer, AXSelectedChildrenChanged, true);
 }
 #endif
 
diff --git a/WebCore/accessibility/AXObjectCache.h b/WebCore/accessibility/AXObjectCache.h
index 7a808dd..5a75f84 100644
--- a/WebCore/accessibility/AXObjectCache.h
+++ b/WebCore/accessibility/AXObjectCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,13 +42,11 @@ class WebCoreTextMarker;
 
 namespace WebCore {
 
+    class Node;
+    class Page;
     class RenderObject;
     class String;
     class VisiblePosition;
-    class AccessibilityObject;
-    class Node;
-    
-    typedef unsigned AXID;
 
     struct TextMarkerData  {
         AXID axID;
@@ -61,7 +59,9 @@ namespace WebCore {
     public:
         AXObjectCache();
         ~AXObjectCache();
-        
+
+        static AccessibilityObject* focusedUIElementForPage(const Page*);
+
         // to be used with render objects
         AccessibilityObject* getOrCreate(RenderObject*);
         
@@ -76,16 +76,13 @@ namespace WebCore {
 
         void detachWrapper(AccessibilityObject*);
         void attachWrapper(AccessibilityObject*);
-        void postNotification(RenderObject*, const String&, bool postToElement);
-        void postPlatformNotification(AccessibilityObject*, const String&);
         void childrenChanged(RenderObject*);
         void selectedChildrenChanged(RenderObject*);
         void handleActiveDescendantChanged(RenderObject*);
         void handleAriaRoleChanged(RenderObject*);
-        void handleFocusedUIElementChanged();
-#if PLATFORM(GTK)
-        void handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*);
-#endif
+        void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
+        void handleScrolledToAnchor(const Node* anchorNode);
+
         static void enableAccessibility() { gAccessibilityEnabled = true; }
         static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
         
@@ -94,11 +91,29 @@ namespace WebCore {
 
         void removeAXID(AccessibilityObject*);
         bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
+        AXID platformGenerateAXID() const;
+        AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
 
         // Text marker utilities.
         static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
         static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
-                
+
+        enum AXNotification {
+            AXCheckedStateChanged,
+            AXFocusedUIElementChanged,
+            AXLayoutComplete,
+            AXLoadComplete,
+            AXSelectedChildrenChanged,
+            AXSelectedTextChanged,
+            AXValueChanged,
+            AXScrolledToAnchor,
+        };
+        
+        void postNotification(RenderObject*, AXNotification, bool postToElement);
+
+    protected:
+        void postPlatformNotification(AccessibilityObject*, AXNotification);
+
     private:
         HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
         HashMap<RenderObject*, AXID> m_renderObjectMapping;
@@ -108,7 +123,7 @@ namespace WebCore {
         HashSet<AXID> m_idsInUse;
         
         Timer<AXObjectCache> m_notificationPostTimer;
-        Vector<pair<RefPtr<AccessibilityObject>, const String> > m_notificationsToPost;
+        Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
         void notificationPostTimerFired(Timer<AXObjectCache>*);
         
         AXID getAXID(AccessibilityObject*);
@@ -118,15 +133,13 @@ namespace WebCore {
 #if !HAVE(ACCESSIBILITY)
     inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
     inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
-    inline void AXObjectCache::handleFocusedUIElementChanged() { }
     inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, const String&, bool postToElement) { }
-    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&) { }
-#if PLATFORM(GTK)
-    inline void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*) { }
-#endif
+    inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement) { }
+    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
+    inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
+    inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
 #endif
 
 }
diff --git a/WebCore/accessibility/AccessibilityList.cpp b/WebCore/accessibility/AccessibilityList.cpp
index 3b7c7a4..95239b0 100644
--- a/WebCore/accessibility/AccessibilityList.cpp
+++ b/WebCore/accessibility/AccessibilityList.cpp
@@ -69,6 +69,13 @@ bool AccessibilityList::isUnorderedList() const
         return false;
     
     Node* node = m_renderer->node();
+
+    // The ARIA spec says the "list" role is supposed to mimic a UL or OL tag.
+    // Since it can't be both, it's probably OK to say that it's an un-ordered list.
+    // On the Mac, there's no distinction to the client.
+    if (ariaRoleAttribute() == ListRole)
+        return true;
+    
     return node && node->hasTagName(ulTag);
 }
 
diff --git a/WebCore/accessibility/AccessibilityMediaControls.cpp b/WebCore/accessibility/AccessibilityMediaControls.cpp
new file mode 100644
index 0000000..7200de9
--- /dev/null
+++ b/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -0,0 +1,323 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+
+#if ENABLE(VIDEO)
+
+#include "AccessibilityMediaControls.h"
+
+#include "AXObjectCache.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "LocalizedStrings.h"
+#include "MediaControlElements.h"
+#include "RenderObject.h"
+#include "RenderSlider.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+
+AccessibilityMediaControl::AccessibilityMediaControl(RenderObject* renderer)
+    : AccessibilityRenderObject(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaControl::create(RenderObject* renderer)
+{
+    ASSERT(renderer->node() && renderer->node()->isMediaControlElement());
+
+    Node* node = renderer->node();
+    MediaControlElementType controlType;
+
+    if (node->hasTagName(inputTag))
+        controlType = static_cast<MediaControlInputElement*>(node)->displayType();
+    else
+        controlType = static_cast<MediaControlElement*>(node)->displayType();
+
+    PassRefPtr<AccessibilityObject> obj;
+    switch (controlType) {
+    case MediaSlider:
+        obj = AccessibilityMediaTimeline::create(renderer);
+        break;
+
+    case MediaCurrentTimeDisplay:
+    case MediaTimeRemainingDisplay:
+        obj = AccessibilityMediaTimeDisplay::create(renderer);
+        break;
+
+    case MediaControlsPanel:
+        obj = AccessibilityMediaControlsContainer::create(renderer);
+        break;
+
+    default:
+        obj = adoptRef(new AccessibilityMediaControl(renderer));
+        break;
+    }
+
+    return obj;
+}
+
+MediaControlElementType AccessibilityMediaControl::controlType() const
+{
+    if (!renderer() || !renderer()->node())
+        return MediaTimelineContainer;  // Timeline container is not accessible.
+
+    Node* node = renderer()->node();
+
+    if (node->hasTagName(inputTag))
+        return static_cast<MediaControlInputElement*>(node)->displayType();
+
+    return static_cast<MediaControlElement*>(node)->displayType();
+}
+
+String AccessibilityMediaControl::controlTypeName() const
+{
+    DEFINE_STATIC_LOCAL(const String, mediaFullscreenButtonName, ("FullscreenButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaMuteButtonName, ("MuteButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaPlayButtonName, ("PlayButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaSeekBackButtonName, ("SeekBackButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaSeekForwardButtonName, ("SeekForwardButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaRewindButtonName, ("RewindButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaReturnToRealtimeButtonName, ("ReturnToRealtimeButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaUnMuteButtonName, ("UnMuteButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaPauseButtonName, ("PauseButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaStatusDisplayName, ("StatusDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaCurrentTimeDisplay, ("CurrentTimeDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaTimeRemainingDisplay, ("TimeRemainingDisplay"));
+
+    switch (controlType()) {
+    case MediaFullscreenButton:
+        return mediaFullscreenButtonName;
+    case MediaMuteButton:
+        return mediaMuteButtonName;
+    case MediaPlayButton:
+        return mediaPlayButtonName;
+    case MediaSeekBackButton:
+        return mediaSeekBackButtonName;
+    case MediaSeekForwardButton:
+        return mediaSeekForwardButtonName;
+    case MediaRewindButton:
+        return mediaRewindButtonName;
+    case MediaReturnToRealtimeButton:
+        return mediaReturnToRealtimeButtonName;
+    case MediaUnMuteButton:
+        return mediaUnMuteButtonName;
+    case MediaPauseButton:
+        return mediaPauseButtonName;
+    case MediaStatusDisplay:
+        return mediaStatusDisplayName;
+    case MediaCurrentTimeDisplay:
+        return mediaCurrentTimeDisplay;
+    case MediaTimeRemainingDisplay:
+        return mediaTimeRemainingDisplay;
+
+    default:
+        break;
+    }
+
+    return String();
+}
+
+String AccessibilityMediaControl::title() const
+{
+    DEFINE_STATIC_LOCAL(const String, controlsPanel, ("ControlsPanel"));
+
+    if (controlType() == MediaControlsPanel)
+        return localizedMediaControlElementString(controlsPanel);
+
+    return AccessibilityRenderObject::title();
+}
+
+String AccessibilityMediaControl::accessibilityDescription() const
+{
+    return localizedMediaControlElementString(controlTypeName());
+}
+
+String AccessibilityMediaControl::helpText() const
+{
+    return localizedMediaControlElementHelpText(controlTypeName());
+}
+
+bool AccessibilityMediaControl::accessibilityIsIgnored() const
+{
+    if (!m_renderer || !m_renderer->style() || m_renderer->style()->visibility() != VISIBLE || controlType() == MediaTimelineContainer)
+        return true;
+
+    return false;
+}
+
+AccessibilityRole AccessibilityMediaControl::roleValue() const
+{
+    switch (controlType()) {
+    case MediaFullscreenButton:
+    case MediaMuteButton:
+    case MediaPlayButton:
+    case MediaSeekBackButton:
+    case MediaSeekForwardButton:
+    case MediaRewindButton:
+    case MediaReturnToRealtimeButton:
+    case MediaUnMuteButton:
+    case MediaPauseButton:
+        return ButtonRole;
+
+    case MediaStatusDisplay:
+        return StaticTextRole;
+
+    case MediaTimelineContainer:
+        return GroupRole;
+
+    default:
+        break;
+    }
+
+    return UnknownRole;
+}
+
+
+
+//
+// AccessibilityMediaControlsContainer
+
+AccessibilityMediaControlsContainer::AccessibilityMediaControlsContainer(RenderObject* renderer)
+    : AccessibilityMediaControl(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaControlsContainer::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityMediaControlsContainer(renderer));
+}
+
+String AccessibilityMediaControlsContainer::accessibilityDescription() const
+{
+    return localizedMediaControlElementString(elementTypeName());
+}
+
+String AccessibilityMediaControlsContainer::helpText() const
+{
+    return localizedMediaControlElementHelpText(elementTypeName());
+}
+
+bool AccessibilityMediaControlsContainer::controllingVideoElement() const
+{
+    if (!m_renderer->node())
+        return true;
+
+    MediaControlTimeDisplayElement* element = static_cast<MediaControlTimeDisplayElement*>(m_renderer->node());
+
+    return element->mediaElement()->isVideo();
+}
+
+const String AccessibilityMediaControlsContainer::elementTypeName() const
+{
+    DEFINE_STATIC_LOCAL(const String, videoElement, ("VideoElement"));
+    DEFINE_STATIC_LOCAL(const String, audioElement, ("AudioElement"));
+
+    if (controllingVideoElement())
+        return videoElement;
+    return audioElement;
+}
+
+
+//
+// AccessibilityMediaTimeline
+
+AccessibilityMediaTimeline::AccessibilityMediaTimeline(RenderObject* renderer)
+    : AccessibilitySlider(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaTimeline::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityMediaTimeline(renderer));
+}
+
+String AccessibilityMediaTimeline::valueDescription() const
+{
+    ASSERT(m_renderer->node()->hasTagName(inputTag));
+
+    float time = static_cast<HTMLInputElement*>(m_renderer->node())->value().toFloat();
+    return localizedMediaTimeDescription(time);
+}
+
+String AccessibilityMediaTimeline::helpText() const
+{
+    DEFINE_STATIC_LOCAL(const String, slider, ("Slider"));
+    return localizedMediaControlElementHelpText(slider);
+}
+
+
+//
+// AccessibilityMediaTimeDisplay
+
+AccessibilityMediaTimeDisplay::AccessibilityMediaTimeDisplay(RenderObject* renderer)
+    : AccessibilityMediaControl(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaTimeDisplay::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityMediaTimeDisplay(renderer));
+}
+
+bool AccessibilityMediaTimeDisplay::accessibilityIsIgnored() const
+{
+    if (!m_renderer || !m_renderer->style() || m_renderer->style()->visibility() != VISIBLE)
+        return true;
+
+    return !m_renderer->style()->width().value();
+}
+
+String AccessibilityMediaTimeDisplay::accessibilityDescription() const
+{
+    DEFINE_STATIC_LOCAL(const String, currentTimeDisplay, ("CurrentTimeDisplay"));
+    DEFINE_STATIC_LOCAL(const String, timeRemainingDisplay, ("TimeRemainingDisplay"));
+
+    if (controlType() == MediaCurrentTimeDisplay)
+        return localizedMediaControlElementString(currentTimeDisplay);
+
+    return localizedMediaControlElementString(timeRemainingDisplay);
+}
+
+String AccessibilityMediaTimeDisplay::stringValue() const
+{
+    if (!m_renderer || !m_renderer->node())
+        return String();
+
+    MediaControlTimeDisplayElement* element = static_cast<MediaControlTimeDisplayElement*>(m_renderer->node());
+    float time = element->currentValue();
+    return localizedMediaTimeDescription(fabsf(time));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
diff --git a/WebCore/accessibility/AccessibilityMediaControls.h b/WebCore/accessibility/AccessibilityMediaControls.h
new file mode 100644
index 0000000..9b306fd
--- /dev/null
+++ b/WebCore/accessibility/AccessibilityMediaControls.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef AccessibilityMediaControls_h
+#define AccessibilityMediaControls_h
+
+#if ENABLE(VIDEO)
+
+#include "AccessibilitySlider.h"
+#include "MediaControlElements.h"
+
+namespace WebCore {
+
+    class AccessibilityMediaControl : public AccessibilityRenderObject {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaControl() { }
+
+        virtual AccessibilityRole roleValue() const;
+        virtual bool accessibilityIsIgnored() const;
+
+        virtual String title() const;
+        virtual String accessibilityDescription() const;
+        virtual String helpText() const;
+
+    protected:
+        AccessibilityMediaControl(RenderObject*);
+        MediaControlElementType controlType() const;
+        String controlTypeName() const;
+    };
+
+
+    class AccessibilityMediaTimeline : public AccessibilitySlider {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaTimeline() { }
+
+        virtual bool isMediaTimeline() const { return true; }
+
+        virtual String helpText() const;
+        virtual String valueDescription() const;
+        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+
+    private:
+        AccessibilityMediaTimeline(RenderObject*);
+    };
+
+
+    class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaControlsContainer() { }
+
+        virtual AccessibilityRole roleValue() const { return ToolbarRole; }
+        virtual bool accessibilityIsIgnored() const { return false; }
+
+        virtual String helpText() const;
+        virtual String accessibilityDescription() const;
+
+    private:
+        AccessibilityMediaControlsContainer(RenderObject*);
+        bool controllingVideoElement() const;
+        const String elementTypeName() const;
+    };
+
+
+    class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaTimeDisplay() { }
+
+        virtual AccessibilityRole roleValue() const { return StaticTextRole; }
+        virtual bool accessibilityIsIgnored() const;
+
+        virtual String stringValue() const;
+        virtual String accessibilityDescription() const;
+
+    private:
+        AccessibilityMediaTimeDisplay(RenderObject*);
+    };
+
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
+
+#endif // AccessibilityMediaControls_h
diff --git a/WebCore/accessibility/AccessibilityObject.cpp b/WebCore/accessibility/AccessibilityObject.cpp
index d6fd969..d7093e4 100644
--- a/WebCore/accessibility/AccessibilityObject.cpp
+++ b/WebCore/accessibility/AccessibilityObject.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,6 +41,7 @@
 #include "NotImplemented.h"
 #include "Page.h"
 #include "RenderImage.h"
+#include "RenderListItem.h"
 #include "RenderListMarker.h"
 #include "RenderMenuList.h"
 #include "RenderTextControl.h"
@@ -89,6 +90,35 @@ AccessibilityObject* AccessibilityObject::parentObjectUnignored() const
     return parent;
 }
 
+AccessibilityObject* AccessibilityObject::firstAccessibleObjectFromNode(const Node* node)
+{
+    ASSERT(AXObjectCache::accessibilityEnabled());
+
+    if (!node)
+        return 0;
+
+    Document* document = node->document();
+    if (!document)
+        return 0;
+
+    AXObjectCache* cache = document->axObjectCache();
+
+    AccessibilityObject* accessibleObject = cache->getOrCreate(node->renderer());
+    while (accessibleObject && accessibleObject->accessibilityIsIgnored()) {
+        node = node->traverseNextNode();
+
+        while (node && !node->renderer())
+            node = node->traverseNextSibling();
+
+        if (!node)
+            return 0;
+
+        accessibleObject = cache->getOrCreate(node->renderer());
+    }
+
+    return accessibleObject;
+}
+
 bool AccessibilityObject::isARIAInput(AccessibilityRole ariaRole)
 {
     return ariaRole == RadioButtonRole || ariaRole == CheckBoxRole || ariaRole == TextFieldRole;
@@ -363,6 +393,49 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
     return true;
 }
 
+// Finds a RenderListItem parent give a node.
+RenderListItem* AccessibilityObject::renderListItemContainerForNode(Node* node) const
+{
+    for (Node* stringNode = node; stringNode; stringNode = stringNode->parent()) {
+        RenderObject* renderObject = stringNode->renderer();
+        if (!renderObject || !renderObject->isListItem())
+            continue;
+        
+        return toRenderListItem(renderObject);
+    }
+    
+    return 0;
+}
+    
+// Returns the text associated with a list marker if this node is contained within a list item.
+String AccessibilityObject::listMarkerTextForNodeAndPosition(Node* node, const VisiblePosition& visiblePositionStart) const
+{
+    // If the range does not contain the start of the line, the list marker text should not be included.
+    if (!isStartOfLine(visiblePositionStart))
+        return String();
+
+    RenderListItem* listItem = renderListItemContainerForNode(node);
+    if (!listItem)
+        return String();
+        
+    // If this is in a list item, we need to manually add the text for the list marker 
+    // because a RenderListMarker does not have a Node equivalent and thus does not appear
+    // when iterating text.
+    const String& markerText = listItem->markerText();
+    if (markerText.isEmpty())
+        return String();
+                
+    // Append text, plus the period that follows the text.
+    // FIXME: Not all list marker styles are followed by a period, but this
+    // sounds much better when there is a synthesized pause because of a period.
+    Vector<UChar> resultVector;
+    resultVector.append(markerText.characters(), markerText.length());
+    resultVector.append('.');
+    resultVector.append(' ');
+    
+    return String::adopt(resultVector);
+}
+    
 String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionRange& visiblePositionRange) const
 {
     if (visiblePositionRange.isNull())
@@ -373,6 +446,11 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
         if (it.length() != 0) {
+            // Add a textual representation for list marker text
+            String listMarkerText = listMarkerTextForNodeAndPosition(it.node(), visiblePositionRange.start);
+            if (!listMarkerText.isEmpty())
+                resultVector.append(listMarkerText.characters(), listMarkerText.length());
+                
             resultVector.append(it.characters(), it.length());
         } else {
             // locate the node and starting offset for this replaced range
diff --git a/WebCore/accessibility/AccessibilityObject.h b/WebCore/accessibility/AccessibilityObject.h
index 3f6c395..c5ba1ed 100644
--- a/WebCore/accessibility/AccessibilityObject.h
+++ b/WebCore/accessibility/AccessibilityObject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nuanti Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -86,10 +86,13 @@ class IntPoint;
 class IntSize;
 class Node;
 class RenderObject;
+class RenderListItem;
 class VisibleSelection;
 class String;
 class Widget;
 
+typedef unsigned AXID;
+
 enum AccessibilityRole {
     UnknownRole = 1,
     ButtonRole,
@@ -156,7 +159,28 @@ enum AccessibilityRole {
     DefinitionListTermRole,
     DefinitionListDefinitionRole,
     AnnotationRole,
-    SliderThumbRole
+    SliderThumbRole,
+    
+    // ARIA Grouping roles
+    LandmarkApplicationRole,
+    LandmarkBannerRole,
+    LandmarkComplementaryRole,
+    LandmarkContentInfoRole,
+    LandmarkMainRole,
+    LandmarkNavigationRole,
+    LandmarkSearchRole,
+    
+    ApplicationLogRole,
+    ApplicationMarqueeRole,
+    ApplicationStatusRole,
+    ApplicationTimerRole,
+    
+    DocumentRole,
+    DocumentArticleRole,
+    DocumentNoteRole,
+    DocumentRegionRole,
+    
+    UserInterfaceTooltipRole
 };
 
 enum AccessibilityOrientation {
@@ -220,6 +244,7 @@ public:
     virtual bool isWebArea() const { return false; };
     virtual bool isCheckboxOrRadio() const { return false; };
     virtual bool isListBox() const { return roleValue() == ListBoxRole; };
+    virtual bool isMediaTimeline() const { return false; }
     virtual bool isMenuRelated() const { return false; }
     virtual bool isMenu() const { return false; }
     virtual bool isMenuBar() const { return false; }
@@ -285,11 +310,13 @@ public:
     virtual AccessibilityObject* parentObject() const = 0;
     virtual AccessibilityObject* parentObjectUnignored() const;
     virtual AccessibilityObject* parentObjectIfExists() const { return 0; }
+    static AccessibilityObject* firstAccessibleObjectFromNode(const Node*);
 
     virtual AccessibilityObject* observableObject() const { return 0; }
     virtual void linkedUIElements(AccessibilityChildrenVector&) const { }
     virtual AccessibilityObject* titleUIElement() const { return 0; }
     virtual bool exposesTitleUIElement() const { return true; }
+    virtual AccessibilityObject* correspondingControlForLabelElement() const { return 0; }
 
     virtual AccessibilityRole ariaRoleAttribute() const { return UnknownRole; }
     virtual bool isPresentationalChildOfAriaRole() const { return false; }
@@ -304,8 +331,8 @@ public:
     virtual PassRefPtr<Range> ariaSelectedTextDOMRange() const { return 0; }
 
     virtual AXObjectCache* axObjectCache() const { return 0; }
-    unsigned axObjectID() const { return m_id; }
-    void setAXObjectID(unsigned axObjectID) { m_id = axObjectID; }
+    AXID axObjectID() const { return m_id; }
+    void setAXObjectID(AXID axObjectID) { m_id = axObjectID; }
     
     static AccessibilityObject* anchorElementForNode(Node*);
     virtual Element* anchorElement() const { return 0; }
@@ -408,6 +435,7 @@ public:
 
     virtual String doAXStringForRange(const PlainTextRange&) const { return String(); }
     virtual IntRect doAXBoundsForRange(const PlainTextRange&) const { return IntRect(); }
+    String listMarkerTextForNodeAndPosition(Node*, const VisiblePosition&) const;
 
     unsigned doAXLineForIndex(unsigned);
 
@@ -436,14 +464,15 @@ public:
     virtual void updateBackingStore() { }
     
 protected:
-    unsigned m_id;
+    AXID m_id;
     AccessibilityChildrenVector m_children;
     mutable bool m_haveChildren;
     AccessibilityRole m_role;
     
     virtual void clearChildren();
     virtual bool isDetached() const { return true; }
-
+    RenderListItem* renderListItemContainerForNode(Node* node) const;
+    
 #if PLATFORM(MAC)
     RetainPtr<AccessibilityObjectWrapper> m_wrapper;
 #elif PLATFORM(WIN) && !PLATFORM(WINCE)
diff --git a/WebCore/accessibility/AccessibilityRenderObject.cpp b/WebCore/accessibility/AccessibilityRenderObject.cpp
index e0f9a91..834e931 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -35,7 +35,6 @@
 #include "CharacterNames.h"
 #include "EventNames.h"
 #include "FloatRect.h"
-#include "FocusController.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLAreaElement.h"
@@ -54,7 +53,6 @@
 #include "HitTestResult.h"
 #include "LocalizedStrings.h"
 #include "NodeList.h"
-#include "Page.h"
 #include "RenderButton.h"
 #include "RenderFieldset.h"
 #include "RenderFileUploadControl.h"
@@ -404,6 +402,11 @@ bool AccessibilityRenderObject::isReadOnly() const
         return !frame->isContentEditable();
     }
 
+    if (m_renderer->isTextField())
+        return static_cast<HTMLInputElement*>(m_renderer->node())->readOnly();
+    if (m_renderer->isTextArea())
+        return static_cast<HTMLTextAreaElement*>(m_renderer->node())->readOnly();
+    
     return !m_renderer->node() || !m_renderer->node()->isContentEditable();
 }
 
@@ -603,6 +606,22 @@ Element* AccessibilityRenderObject::mouseButtonListener() const
     return 0;
 }
 
+void AccessibilityRenderObject::increment()
+{
+    if (roleValue() != SliderRole)
+        return;
+    
+    changeValueByPercent(5);
+}
+
+void AccessibilityRenderObject::decrement()
+{
+    if (roleValue() != SliderRole)
+        return;
+    
+    changeValueByPercent(-5);
+}
+
 static Element* siblingWithAriaRole(String role, Node* node)
 {
     Node* sibling = node->parent()->firstChild();
@@ -1020,7 +1039,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
                 const AtomicString& title = static_cast<HTMLFrameElementBase*>(owner)->getAttribute(titleAttr);
                 if (!title.isEmpty())
                     return title;
-                return static_cast<HTMLFrameElementBase*>(owner)->name();
+                return static_cast<HTMLFrameElementBase*>(owner)->getAttribute(nameAttr);
             }
             if (owner->isHTMLElement())
                 return static_cast<HTMLElement*>(owner)->getAttribute(nameAttr);
@@ -1135,22 +1154,10 @@ AccessibilityObject* AccessibilityRenderObject::internalLinkElement() const
     if (!linkedNode)
         return 0;
     
-    // the element we find may not be accessible, keep searching until we find a good one
-    AccessibilityObject* linkedAXElement = m_renderer->document()->axObjectCache()->getOrCreate(linkedNode->renderer());
-    while (linkedAXElement && linkedAXElement->accessibilityIsIgnored()) {
-        linkedNode = linkedNode->traverseNextNode();
-        
-        while (linkedNode && !linkedNode->renderer())
-            linkedNode = linkedNode->traverseNextSibling();
-        
-        if (!linkedNode)
-            return 0;
-        linkedAXElement = m_renderer->document()->axObjectCache()->getOrCreate(linkedNode->renderer());
-    }
-    
-    return linkedAXElement;
+    // The element we find may not be accessible, so find the first accessible object.
+    return firstAccessibleObjectFromNode(linkedNode);
 }
-    
+
 void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const
 {
     if (!m_renderer || roleValue() != RadioButtonRole)
@@ -1269,15 +1276,9 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
-    HTMLLabelElement* labelElement = labelElementContainer();
-    if (labelElement) {
-        HTMLElement* correspondingControl = labelElement->correspondingControl();
-        if (correspondingControl && correspondingControl->renderer()) {
-            AccessibilityObject* controlObject = axObjectCache()->getOrCreate(correspondingControl->renderer());
-            if (!controlObject->exposesTitleUIElement())
-                return true;
-        }
-    }
+    AccessibilityObject* controlObject = correspondingControlForLabelElement();
+    if (controlObject && !controlObject->exposesTitleUIElement())
+        return true;
         
     AccessibilityRole ariaRole = ariaRoleAttribute();
     if (ariaRole == TextAreaRole || ariaRole == StaticTextRole) {
@@ -1590,8 +1591,22 @@ void AccessibilityRenderObject::setFocused(bool on)
     }
 }
 
+void AccessibilityRenderObject::changeValueByPercent(float percentChange)
+{
+    float range = maxValueForRange() - minValueForRange();
+    float value = valueForRange();
+    
+    value += range * (percentChange / 100);
+    setValue(String::number(value));
+    
+    axObjectCache()->postNotification(m_renderer, AXObjectCache::AXValueChanged, true);
+}
+    
 void AccessibilityRenderObject::setValue(const String& string)
 {
+    if (!m_renderer)
+        return;
+    
     // FIXME: Do we want to do anything here for ARIA textboxes?
     if (m_renderer->isTextField()) {
         HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->node());
@@ -1599,6 +1614,10 @@ void AccessibilityRenderObject::setValue(const String& string)
     } else if (m_renderer->isTextArea()) {
         HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(m_renderer->node());
         textArea->setValue(string);
+    } else if (roleValue() == SliderRole) {
+        Node* element = m_renderer->node();
+        if (element && element->isElementNode())
+            static_cast<Element*>(element)->setAttribute(aria_valuenowAttr, string);
     }
 }
 
@@ -1658,7 +1677,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(H
         
         // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
         // which has to be stripped off
-        String useMapName = static_cast<HTMLImageElement*>(curr)->useMap().substring(1).lower();
+        String useMapName = static_cast<HTMLImageElement*>(curr)->getAttribute(usemapAttr).string().substring(1).lower();
         if (useMapName == mapName)
             return axObjectCache()->getOrCreate(obj);
     }
@@ -2094,40 +2113,25 @@ AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const Int
     if (obj->isListBox())
         return static_cast<AccessibilityListBox*>(result)->doAccessibilityHitTest(point);
         
-    if (result->accessibilityIsIgnored())
+    if (result->accessibilityIsIgnored()) {
+        // If this element is the label of a control, a hit test should return the control.
+        AccessibilityObject* controlObject = result->correspondingControlForLabelElement();
+        if (controlObject && !controlObject->exposesTitleUIElement())
+            return controlObject;
+
         result = result->parentObjectUnignored();
+    }
 
     return result;
 }
 
 AccessibilityObject* AccessibilityRenderObject::focusedUIElement() const
 {
-    // get the focused node in the page
     Page* page = m_renderer->document()->page();
     if (!page)
         return 0;
-    
-    Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
-    Node* focusedNode = focusedDocument->focusedNode();
-    if (!focusedNode)
-        focusedNode = focusedDocument;
-    
-    RenderObject* focusedNodeRenderer = focusedNode->renderer();
-    if (!focusedNodeRenderer)
-        return 0;
-    
-    AccessibilityObject* obj = focusedNodeRenderer->document()->axObjectCache()->getOrCreate(focusedNodeRenderer);
-    
-    if (obj->shouldFocusActiveDescendant()) {
-        if (AccessibilityObject* descendant = obj->activeDescendant())
-            obj = descendant;
-    }
-    
-    // the HTML element, for example, is focusable but has an AX object that is ignored
-    if (obj->accessibilityIsIgnored())
-        obj = obj->parentObjectUnignored();
-    
-    return obj;
+
+    return AXObjectCache::focusedUIElementForPage(page);
 }
 
 bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
@@ -2174,7 +2178,7 @@ AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
         return 0;
     
     AccessibilityObject* obj = renderer()->document()->axObjectCache()->getOrCreate(target->renderer());
-    if (obj->isAccessibilityRenderObject())
+    if (obj && obj->isAccessibilityRenderObject())
     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
         return obj;
     return 0;
@@ -2192,9 +2196,21 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotification(activedescendant->renderer(), "AXFocusedUIElementChanged", true);
+        doc->axObjectCache()->postNotification(activedescendant->renderer(), AXObjectCache::AXFocusedUIElementChanged, true);
 }
 
+AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElement() const
+{
+    HTMLLabelElement* labelElement = labelElementContainer();
+    if (!labelElement)
+        return 0;
+    
+    HTMLElement* correspondingControl = labelElement->correspondingControl();
+    if (!correspondingControl)
+        return 0;
+    
+    return axObjectCache()->getOrCreate(correspondingControl->renderer());     
+}
 
 AccessibilityObject* AccessibilityRenderObject::observableObject() const
 {
@@ -2216,32 +2232,52 @@ static const ARIARoleMap& createARIARoleMap()
     };
 
     const RoleEntry roles[] = {
+        { "application", LandmarkApplicationRole },
+        { "article", DocumentArticleRole },
+        { "banner", LandmarkBannerRole },
         { "button", ButtonRole },
         { "checkbox", CheckBoxRole },
+        { "complementary", LandmarkComplementaryRole },
+        { "contentinfo", LandmarkContentInfoRole },
         { "grid", TableRole },
         { "gridcell", CellRole },
         { "columnheader", ColumnHeaderRole },
+        { "definition", DefinitionListDefinitionRole },
+        { "document", DocumentRole },
         { "rowheader", RowHeaderRole },
         { "group", GroupRole },
         { "heading", HeadingRole },
         { "img", ImageRole },
         { "link", WebCoreLinkRole },
+        { "list", ListRole },        
+        { "listitem", GroupRole },        
         { "listbox", ListBoxRole },
+        { "log", ApplicationLogRole },
         // "option" isn't here because it may map to different roles depending on the parent element's role
+        { "main", LandmarkMainRole },
+        { "marquee", ApplicationMarqueeRole },
         { "menu", MenuRole },
         { "menubar", GroupRole },
         // "menuitem" isn't here because it may map to different roles depending on the parent element's role
         { "menuitemcheckbox", MenuItemRole },
         { "menuitemradio", MenuItemRole },
+        { "note", DocumentNoteRole },
+        { "navigation", LandmarkNavigationRole },
         { "progressbar", ProgressIndicatorRole },
         { "radio", RadioButtonRole },
         { "radiogroup", RadioGroupRole },
+        { "region", DocumentRegionRole },
         { "row", RowRole },
         { "range", SliderRole },
+        { "search", LandmarkSearchRole },
+        { "separator", SplitterRole },
         { "slider", SliderRole },
         { "spinbutton", ProgressIndicatorRole },
+        { "status", ApplicationStatusRole },
         { "textbox", TextAreaRole },
-        { "toolbar", ToolbarRole }
+        { "timer", ApplicationTimerRole },
+        { "toolbar", ToolbarRole },
+        { "tooltip", UserInterfaceTooltipRole }
     };
     ARIARoleMap& roleMap = *new ARIARoleMap;
         
@@ -2418,6 +2454,7 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
         case PopUpButtonRole:
         case CheckBoxRole:
         case RadioButtonRole:
+        case SliderRole:
             return true;
         default:
             return false;
@@ -2429,10 +2466,10 @@ bool AccessibilityRenderObject::canSetValueAttribute() const
     if (equalIgnoringCase(getAttribute(aria_readonlyAttr).string(), "true"))
         return false;
 
-    if (isWebArea()) 
+    if (isWebArea() || isTextControl()) 
         return !isReadOnly();
 
-    return isTextControl() || isProgressIndicator() || isSlider();
+    return isProgressIndicator() || isSlider();
 }
 
 bool AccessibilityRenderObject::canSetTextRangeAttributes() const
@@ -2639,7 +2676,9 @@ void AccessibilityRenderObject::updateBackingStore()
 {
     if (!m_renderer)
         return;
-    m_renderer->view()->layoutIfNeeded();
-}    
-    
+
+    // Updating layout may delete m_renderer and this object.
+    m_renderer->document()->updateLayoutIgnorePendingStylesheets();
+}
+
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityRenderObject.h b/WebCore/accessibility/AccessibilityRenderObject.h
index 2b29f4a..d82ca71 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/WebCore/accessibility/AccessibilityRenderObject.h
@@ -133,6 +133,8 @@ public:
     virtual void linkedUIElements(AccessibilityChildrenVector&) const;
     virtual bool exposesTitleUIElement() const;
     virtual AccessibilityObject* titleUIElement() const;
+    virtual AccessibilityObject* correspondingControlForLabelElement() const;
+
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
@@ -188,6 +190,9 @@ public:
     virtual void setFocused(bool);
     virtual void setSelectedTextRange(const PlainTextRange&);
     virtual void setValue(const String&);
+    virtual void changeValueByPercent(float percentChange);
+    virtual void increment();
+    virtual void decrement();
     
     virtual void detach();
     virtual void childrenChanged();
diff --git a/WebCore/accessibility/AccessibilitySlider.cpp b/WebCore/accessibility/AccessibilitySlider.cpp
index e3a654b..5aca672 100644
--- a/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/WebCore/accessibility/AccessibilitySlider.cpp
@@ -75,6 +75,7 @@ AccessibilityOrientation AccessibilitySlider::orientation() const
         
         case SliderThumbVerticalPart: 
         case SliderVerticalPart:
+        case MediaVolumeSliderPart:
             return AccessibilityOrientationVertical;
             
         default:
@@ -113,15 +114,6 @@ float AccessibilitySlider::minValueForRange() const
     return getAttribute(minAttr).toFloat();
 }
 
-void AccessibilitySlider::changeValue(float percentChange)
-{
-    float range = maxValueForRange() - minValueForRange();
-    float value = valueForRange();
-    
-    value += range * (percentChange / 100);
-    setValue(String::number(value));
-}
-
 void AccessibilitySlider::setValue(const String& value)
 {
     HTMLInputElement* input = element();
@@ -135,16 +127,6 @@ void AccessibilitySlider::setValue(const String& value)
     input->dispatchFormControlChangeEvent();
 }
 
-void AccessibilitySlider::increment()
-{
-    return changeValue(5);
-}
-
-void AccessibilitySlider::decrement()
-{
-    return changeValue(-5);
-}
-
 HTMLInputElement* AccessibilitySlider::element() const
 {
     return static_cast<HTMLInputElement*>(m_renderer->node());
diff --git a/WebCore/accessibility/AccessibilitySlider.h b/WebCore/accessibility/AccessibilitySlider.h
index eadab08..254ebdd 100644
--- a/WebCore/accessibility/AccessibilitySlider.h
+++ b/WebCore/accessibility/AccessibilitySlider.h
@@ -58,12 +58,10 @@ namespace WebCore {
         virtual float minValueForRange() const;
         virtual AccessibilityOrientation orientation() const;
 
-        virtual void increment();
-        virtual void decrement();
+    protected:
+        AccessibilitySlider(RenderObject*);
 
     private:
-        AccessibilitySlider(RenderObject*);
-        void changeValue(float /*percentChange*/);
         HTMLInputElement* element() const;
     };
 
diff --git a/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp b/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
index d0f1882..a97dfe2 100644
--- a/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
+++ b/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
@@ -43,11 +43,15 @@ void AXObjectCache::attachWrapper(AccessibilityObject*)
     // In Chromium, AccessibilityObjects are wrapped lazily.
 }
 
-void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&)
+void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification)
 {
 }
 
-void AXObjectCache::handleFocusedUIElementChanged()
+void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*)
+{
+}
+
+void AXObjectCache::handleScrolledToAnchor(const Node*)
 {
 }
 
diff --git a/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp b/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
index a04367f..cc515ad 100644
--- a/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
+++ b/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
@@ -37,20 +37,16 @@ void AXObjectCache::attachWrapper(AccessibilityObject* obj)
     g_object_unref(atkObj);
 }
 
-void AXObjectCache::postPlatformNotification(AccessibilityObject* coreObject, const String& message)
+void AXObjectCache::postPlatformNotification(AccessibilityObject* coreObject, AXNotification notification)
 {
-    if (message == "AXCheckedStateChanged") {
+    if (notification == AXCheckedStateChanged) {
         if (!coreObject->isCheckboxOrRadio())
             return;
         g_signal_emit_by_name(coreObject->wrapper(), "state-change", "checked", coreObject->isChecked());
     }
 }
-    
-void AXObjectCache::handleFocusedUIElementChanged()
-{
-}
 
-void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject* oldFocusedRender, RenderObject* newFocusedRender)
+void AXObjectCache::handleFocusedUIElementChanged(RenderObject* oldFocusedRender, RenderObject* newFocusedRender)
 {
     RefPtr<AccessibilityObject> oldObject = getOrCreate(oldFocusedRender);
     if (oldObject) {
@@ -64,4 +60,8 @@ void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject* old
     }
 }
 
+void AXObjectCache::handleScrolledToAnchor(const Node*)
+{
+}
+
 } // namespace WebCore
diff --git a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index 6d3729b..811903d 100644
--- a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -60,7 +60,7 @@ using namespace WebCore;
 
 static AccessibilityObject* fallbackObject()
 {
-    static AXObjectCache* fallbackCache = new AXObjectCache();
+    static AXObjectCache* fallbackCache = new AXObjectCache;
     static AccessibilityObject* object = 0;
     if (!object) {
         // FIXME: using fallbackCache->getOrCreate(ListBoxOptionRole) is a hack
@@ -556,7 +556,7 @@ static PangoLayout* getPangoLayoutForAtk(AtkText* textObject)
     HostWindow* hostWindow = coreObject->document()->view()->hostWindow();
     if (!hostWindow)
         return 0;
-    PlatformWidget webView = hostWindow->platformWindow();
+    PlatformPageClient webView = hostWindow->platformPageClient();
     if (!webView)
         return 0;
 
diff --git a/WebCore/accessibility/mac/AXObjectCacheMac.mm b/WebCore/accessibility/mac/AXObjectCacheMac.mm
index be7968b..2f18cf3 100644
--- a/WebCore/accessibility/mac/AXObjectCacheMac.mm
+++ b/WebCore/accessibility/mac/AXObjectCacheMac.mm
@@ -51,19 +51,51 @@ void AXObjectCache::attachWrapper(AccessibilityObject* obj)
     obj->setWrapper([[AccessibilityObjectWrapper alloc] initWithAccessibilityObject:obj]);
 }
 
-void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, const String& message)
+void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotification notification)
 {
     if (!obj)
         return;
     
-    NSAccessibilityPostNotification(obj->wrapper(), message);
+    // Some notifications are unique to Safari and do not have NSAccessibility equivalents.
+    String macNotification;
+    switch (notification) {
+        case AXCheckedStateChanged:
+            macNotification = "AXCheckedStateChanged";
+            break;
+        case AXFocusedUIElementChanged:
+            macNotification = NSAccessibilityFocusedUIElementChangedNotification;
+            break;
+        case AXLayoutComplete:
+            macNotification = "AXLayoutComplete";
+            break;
+        case AXLoadComplete:
+            macNotification = "AXLoadComplete";
+            break;
+        case AXSelectedChildrenChanged:
+            macNotification = NSAccessibilitySelectedChildrenChangedNotification;
+            break;
+        case AXSelectedTextChanged:
+            macNotification = NSAccessibilitySelectedTextChangedNotification;
+            break;
+        case AXValueChanged:
+            macNotification = NSAccessibilityValueChangedNotification;
+            break;
+        default:
+            return;
+    }
+    
+    NSAccessibilityPostNotification(obj->wrapper(), macNotification);
 }
 
-void AXObjectCache::handleFocusedUIElementChanged()
+void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*)
 {
     [[WebCoreViewFactory sharedFactory] accessibilityHandleFocusChanged];
 }
 
+void AXObjectCache::handleScrolledToAnchor(const Node*)
+{
+}
+
 }
 
 #endif // HAVE(ACCESSIBILITY)
diff --git a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index d1e0599..e56e77c 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -122,6 +122,7 @@ using namespace std;
 #ifdef BUILDING_ON_TIGER
 typedef unsigned NSUInteger;
 #define NSAccessibilityValueDescriptionAttribute @"AXValueDescription"
+#define NSAccessibilityTimelineSubrole @"AXTimeline"
 #endif
 
 @interface NSObject (WebKitAccessibilityArrayCategory)
@@ -378,7 +379,7 @@ static void AXAttributeStringSetSpelling(NSMutableAttributedString* attrString,
         
         // add misspelling attribute for the intersection of the marker and the range
         int rStart = range.location + (marker.startOffset - offset);
-        int rLength = MIN(marker.endOffset, endOffset) - marker.startOffset;
+        int rLength = min(marker.endOffset, endOffset) - marker.startOffset;
         NSRange spellRange = NSMakeRange(rStart, rLength);
         AXAttributeStringSetNumber(attrString, NSAccessibilityMisspelledTextAttribute, [NSNumber numberWithBool:YES], spellRange);
         
@@ -478,6 +479,9 @@ static NSString* nsStringForReplacedNode(Node* replacedNode)
 
 - (NSAttributedString*)doAXAttributedStringForTextMarkerRange:(WebCoreTextMarkerRange*)textMarkerRange
 {
+    if (!m_object)
+        return nil;
+    
     // extract the start and end VisiblePosition
     VisiblePosition startVisiblePosition = visiblePositionForStartOfTextMarkerRange(textMarkerRange);
     if (startVisiblePosition.isNull())
@@ -487,6 +491,7 @@ static NSString* nsStringForReplacedNode(Node* replacedNode)
     if (endVisiblePosition.isNull())
         return nil;
 
+    VisiblePositionRange visiblePositionRange(startVisiblePosition, endVisiblePosition);
     // iterate over the range to build the AX attributed string
     NSMutableAttributedString* attrString = [[NSMutableAttributedString alloc] init];
     TextIterator it(makeRange(startVisiblePosition, endVisiblePosition).get());
@@ -499,6 +504,11 @@ static NSString* nsStringForReplacedNode(Node* replacedNode)
 
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
         if (it.length() != 0) {
+            // Add the text of the list marker item if necessary.
+            String listMarkerText = m_object->listMarkerTextForNodeAndPosition(node, VisiblePosition(it.range()->startPosition()));
+            if (!listMarkerText.isEmpty())
+                AXAttributedStringAppendText(attrString, node, offset, listMarkerText.characters(), listMarkerText.length());
+            
             AXAttributedStringAppendText(attrString, node, offset, it.characters(), it.length());
         } else {
             Node* replacedNode = node->childNode(offset);
@@ -536,6 +546,8 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     static NSArray* actionElementActions = [[NSArray alloc] initWithObjects: NSAccessibilityPressAction, NSAccessibilityShowMenuAction, nil];
     static NSArray* defaultElementActions = [[NSArray alloc] initWithObjects: NSAccessibilityShowMenuAction, nil];
@@ -563,6 +575,8 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         return nil;
     
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
     
     if (m_object->isAttachment())
         return [[self attachmentView] accessibilityAttributeNames];
@@ -669,6 +683,7 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         [tempArray addObject:NSAccessibilityMinValueAttribute];
         [tempArray addObject:NSAccessibilityMaxValueAttribute];
         [tempArray addObject:NSAccessibilityOrientationAttribute];
+        [tempArray addObject:NSAccessibilityValueDescriptionAttribute];
         rangeAttrs = [[NSArray alloc] initWithArray:tempArray];
         [tempArray release];
     }
@@ -969,8 +984,23 @@ static const AccessibilityRoleMap& createAccessibilityRoleMap()
         { TableHeaderContainerRole, NSAccessibilityGroupRole },
         { DefinitionListDefinitionRole, NSAccessibilityGroupRole },
         { DefinitionListTermRole, NSAccessibilityGroupRole },
-        
         { SliderThumbRole, NSAccessibilityValueIndicatorRole },
+        { LandmarkApplicationRole, NSAccessibilityGroupRole },
+        { LandmarkBannerRole, NSAccessibilityGroupRole },
+        { LandmarkComplementaryRole, NSAccessibilityGroupRole },
+        { LandmarkContentInfoRole, NSAccessibilityGroupRole },
+        { LandmarkMainRole, NSAccessibilityGroupRole },
+        { LandmarkNavigationRole, NSAccessibilityGroupRole },
+        { LandmarkSearchRole, NSAccessibilityGroupRole },
+        { ApplicationLogRole, NSAccessibilityGroupRole },
+        { ApplicationMarqueeRole, NSAccessibilityGroupRole },
+        { ApplicationStatusRole, NSAccessibilityGroupRole },
+        { ApplicationTimerRole, NSAccessibilityGroupRole },
+        { DocumentRole, NSAccessibilityGroupRole },
+        { DocumentArticleRole, NSAccessibilityGroupRole },
+        { DocumentNoteRole, NSAccessibilityGroupRole },
+        { DocumentRegionRole, NSAccessibilityGroupRole },
+        { UserInterfaceTooltipRole, NSAccessibilityGroupRole },
         
 
     };
@@ -1019,6 +1049,47 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             return NSAccessibilityDefinitionListSubrole;
     }
     
+    // ARIA content subroles.
+    switch (m_object->roleValue()) {
+        case LandmarkApplicationRole:
+            return @"AXLandmarkApplication";
+        case LandmarkBannerRole:
+            return @"AXLandmarkBanner";
+        case LandmarkComplementaryRole:
+            return @"AXLandmarkComplementary";
+        case LandmarkContentInfoRole:
+            return @"AXLandmarkContentInfo";
+        case LandmarkMainRole:
+            return @"AXLandmarkMain";
+        case LandmarkNavigationRole:
+            return @"AXLandmarkNavigation";
+        case LandmarkSearchRole:
+            return @"AXLandmarkSearch";
+        case ApplicationLogRole:
+            return @"AXApplicationLog";
+        case ApplicationMarqueeRole:
+            return @"AXApplicationMarquee";
+        case ApplicationStatusRole:
+            return @"AXApplicationStatus";
+        case ApplicationTimerRole:
+            return @"AXApplicationTimer";
+        case DocumentRole:
+            return @"AXDocument";
+        case DocumentArticleRole:
+            return @"AXDocumentArticle";
+        case DocumentNoteRole:
+            return @"AXDocumentNote";
+        case DocumentRegionRole:
+            return @"AXDocumentRegion";
+        case UserInterfaceTooltipRole:
+            return @"AXUserInterfaceTooltip";
+        default:
+            return nil;
+    }
+    
+    if (m_object->isMediaTimeline())
+        return NSAccessibilityTimelineSubrole;
+
     return nil;
 }
 
@@ -1047,8 +1118,44 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([axRole isEqualToString:NSAccessibilityImageRole])
         return NSAccessibilityRoleDescription(NSAccessibilityImageRole, [self subrole]);
     
-    if ([axRole isEqualToString:NSAccessibilityGroupRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityGroupRole, [self subrole]);
+    if ([axRole isEqualToString:NSAccessibilityGroupRole]) {
+        switch (m_object->roleValue()) {
+            default:
+                return NSAccessibilityRoleDescription(NSAccessibilityGroupRole, [self subrole]);
+            case LandmarkApplicationRole:
+                return AXARIAContentGroupText(@"ARIALandmarkApplication");
+            case LandmarkBannerRole:
+                return AXARIAContentGroupText(@"ARIALandmarkBanner");
+            case LandmarkComplementaryRole:
+                return AXARIAContentGroupText(@"ARIALandmarkComplementary");
+            case LandmarkContentInfoRole:
+                return AXARIAContentGroupText(@"ARIALandmarkContentInfo");
+            case LandmarkMainRole:
+                return AXARIAContentGroupText(@"ARIALandmarkMain");
+            case LandmarkNavigationRole:
+                return AXARIAContentGroupText(@"ARIALandmarkNavigation");
+            case LandmarkSearchRole:
+                return AXARIAContentGroupText(@"ARIALandmarkSearch");
+            case ApplicationLogRole:
+                return AXARIAContentGroupText(@"ARIAApplicationLog");
+            case ApplicationMarqueeRole:
+                return AXARIAContentGroupText(@"ARIAApplicationMarquee");
+            case ApplicationStatusRole:
+                return AXARIAContentGroupText(@"ARIAApplicationStatus");
+            case ApplicationTimerRole:
+                return AXARIAContentGroupText(@"ARIAApplicationTimer");
+            case DocumentRole:
+                return AXARIAContentGroupText(@"ARIADocument");
+            case DocumentArticleRole:
+                return AXARIAContentGroupText(@"ARIADocumentArticle");
+            case DocumentNoteRole:
+                return AXARIAContentGroupText(@"ARIADocumentNote");
+            case DocumentRegionRole:
+                return AXARIAContentGroupText(@"ARIADocumentRegion");
+            case UserInterfaceTooltipRole:
+                return AXARIAContentGroupText(@"ARIAUserInterfaceTooltip");
+        }
+    }        
     
     if ([axRole isEqualToString:NSAccessibilityCheckBoxRole])
         return NSAccessibilityRoleDescription(NSAccessibilityCheckBoxRole, [self subrole]);
@@ -1111,6 +1218,9 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([axRole isEqualToString:NSAccessibilityToolbarRole])
         return NSAccessibilityRoleDescription(NSAccessibilityToolbarRole, [self subrole]);
 
+    if ([axRole isEqualToString:NSAccessibilitySplitterRole])
+        return NSAccessibilityRoleDescription(NSAccessibilitySplitterRole, [self subrole]);
+    
     return NSAccessibilityRoleDescription(NSAccessibilityUnknownRole, nil);
 }
 
@@ -1123,6 +1233,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
     
     if ([attributeName isEqualToString: NSAccessibilityRoleAttribute])
         return [self role];
@@ -1244,7 +1356,7 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         }
         return m_object->accessibilityDescription();
     }
-    
+
     if ([attributeName isEqualToString: NSAccessibilityValueAttribute]) {
         if (m_object->isAttachment()) {
             if ([[[self attachmentView] accessibilityAttributeNames] containsObject:NSAccessibilityValueAttribute]) 
@@ -1465,6 +1577,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     RefPtr<AccessibilityObject> focusedObj = m_object->focusedUIElement();
 
@@ -1480,6 +1594,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     RefPtr<AccessibilityObject> axObject = m_object->doAccessibilityHitTest(IntPoint(point));
     if (axObject)
@@ -1493,6 +1609,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     if ([attributeName isEqualToString: @"AXSelectedTextMarkerRange"])
         return YES;
@@ -1532,6 +1650,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     if (m_object->isAttachment())
         return [[self attachmentView] accessibilityIsIgnored];
@@ -1544,6 +1664,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     if (m_object->isAttachment()) 
         return nil;
@@ -1581,6 +1703,7 @@ static NSString* roleValueToNSString(AccessibilityRole value)
                       @"AXStyleTextMarkerRangeForTextMarker",
                       @"AXLengthForTextMarkerRange",
                       NSAccessibilityBoundsForRangeParameterizedAttribute,
+                      NSAccessibilityStringForRangeParameterizedAttribute,
                       nil];
     }
 
@@ -1629,6 +1752,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return;
 
     if (m_object->isAttachment())
         [[self attachmentView] accessibilityPerformAction:NSAccessibilityPressAction];
@@ -1642,6 +1767,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return;
 
     if (m_object->isAttachment())
         [[self attachmentView] accessibilityPerformAction:NSAccessibilityIncrementAction];
@@ -1655,6 +1782,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return;
 
     if (m_object->isAttachment())
         [[self attachmentView] accessibilityPerformAction:NSAccessibilityDecrementAction];
@@ -1704,6 +1833,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return;
 
     if ([action isEqualToString:NSAccessibilityPressAction])
         [self accessibilityPerformPressAction];
@@ -1724,6 +1855,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return;
 
     WebCoreTextMarkerRange* textMarkerRange = nil;
     NSNumber*               number = nil;
@@ -1848,6 +1981,8 @@ static RenderObject* rendererForView(NSView* view)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
     
     // common parameter type check/casting.  Nil checks in handlers catch wrong type case.
     // NOTE: This assumes nil is not a valid parameter, because it is indistinguishable from
@@ -1932,6 +2067,14 @@ static RenderObject* rendererForView(NSView* view)
         NSRect rect = m_object->boundsForVisiblePositionRange(VisiblePositionRange(start, end));
         return [NSValue valueWithRect:rect];
     }
+    
+    if ([attribute isEqualToString:NSAccessibilityStringForRangeParameterizedAttribute]) {
+        VisiblePosition start = m_object->visiblePositionForIndex(range.location);
+        VisiblePosition end = m_object->visiblePositionForIndex(range.location+range.length);
+        if (start.isNull() || end.isNull())
+            return nil;
+        return m_object->stringForVisiblePositionRange(VisiblePositionRange(start, end));
+    }
 
     if ([attribute isEqualToString: @"AXAttributedStringForTextMarkerRange"])
         return [self doAXAttributedStringForTextMarkerRange:textMarkerRange];
@@ -2098,7 +2241,9 @@ static RenderObject* rendererForView(NSView* view)
         return NSNotFound;
 
     m_object->updateBackingStore();
-    
+    if (!m_object)
+        return NSNotFound;
+
     const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
        
     if (children.isEmpty())
@@ -2120,6 +2265,8 @@ static RenderObject* rendererForView(NSView* view)
         return 0;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return 0;
     
     if ([attribute isEqualToString:NSAccessibilityChildrenAttribute]) {
         const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
@@ -2138,6 +2285,8 @@ static RenderObject* rendererForView(NSView* view)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
     
     if ([attribute isEqualToString:NSAccessibilityChildrenAttribute]) {
         if (m_object->children().isEmpty()) {
diff --git a/WebCore/accessibility/win/AXObjectCacheWin.cpp b/WebCore/accessibility/win/AXObjectCacheWin.cpp
index e39d5a5..a1bdcc0 100644
--- a/WebCore/accessibility/win/AXObjectCacheWin.cpp
+++ b/WebCore/accessibility/win/AXObjectCacheWin.cpp
@@ -28,6 +28,11 @@
 #include "AXObjectCache.h"
 
 #include "AccessibilityObject.h"
+#include "Document.h"
+#include "Page.h"
+#include "RenderObject.h"
+
+using namespace std;
 
 namespace WebCore {
 
@@ -46,12 +51,86 @@ void AXObjectCache::attachWrapper(AccessibilityObject*)
     // software requests them via get_accChild.
 }
 
-void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&)
+void AXObjectCache::handleScrolledToAnchor(const Node* anchorNode)
+{
+    // The anchor node may not be accessible. Post the notification for the
+    // first accessible object.
+    postPlatformNotification(AccessibilityObject::firstAccessibleObjectFromNode(anchorNode), AXScrolledToAnchor);
+}
+
+void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotification notification)
 {
+    if (!obj)
+        return;
+
+    Document* document = obj->document();
+    if (!document)
+        return;
+
+    Page* page = document->page();
+    if (!page || !page->chrome()->platformPageClient())
+        return;
+
+    DWORD msaaEvent;
+    switch (notification) {
+        case AXFocusedUIElementChanged:
+            msaaEvent = EVENT_OBJECT_FOCUS;
+            break;
+
+        case AXScrolledToAnchor:
+            msaaEvent = EVENT_SYSTEM_SCROLLINGSTART;
+            break;
+
+        default:
+            return;
+    }
+
+    // Windows will end up calling get_accChild() on the root accessible
+    // object for the WebView, passing the child ID that we specify below. We
+    // negate the AXID so we know that the caller is passing the ID of an
+    // element, not the index of a child element.
+
+    ASSERT(obj->axObjectID() >= 1);
+    ASSERT(obj->axObjectID() <= numeric_limits<LONG>::max());
+
+    NotifyWinEvent(msaaEvent, page->chrome()->platformPageClient(), OBJID_CLIENT, -static_cast<LONG>(obj->axObjectID()));
 }
 
-void AXObjectCache::handleFocusedUIElementChanged()
+AXID AXObjectCache::platformGenerateAXID() const
 {
+    static AXID lastUsedID = 0;
+
+    // Generate a new ID. Windows accessibility relies on a positive AXID,
+    // ranging from 1 to LONG_MAX.
+    AXID objID = lastUsedID;
+    do {
+        ++objID;
+        objID %= std::numeric_limits<LONG>::max();
+    } while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+
+    ASSERT(objID >= 1 && objID <= std::numeric_limits<LONG>::max());
+
+    lastUsedID = objID;
+
+    return objID;
+}
+
+void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject* newFocusedRenderer)
+{
+    if (!newFocusedRenderer)
+        return;
+
+    Page* page = newFocusedRenderer->document()->page();
+    if (!page || !page->chrome()->platformPageClient())
+        return;
+
+    AccessibilityObject* focusedObject = focusedUIElementForPage(page);
+    if (!focusedObject)
+        return;
+
+    ASSERT(!focusedObject->accessibilityIsIgnored());
+
+    postPlatformNotification(focusedObject, AXFocusedUIElementChanged);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/DOMObjectWithSVGContext.h b/WebCore/bindings/js/DOMObjectWithSVGContext.h
index 570548d..3d435cb 100644
--- a/WebCore/bindings/js/DOMObjectWithSVGContext.h
+++ b/WebCore/bindings/js/DOMObjectWithSVGContext.h
@@ -40,7 +40,7 @@ namespace WebCore {
         SVGElement* context() const { return m_context.get(); }
 
     protected:
-        DOMObjectWithSVGContext(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject*, SVGElement* context)
+        DOMObjectWithSVGContext(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject*, SVGElement* context)
             : DOMObject(structure)
             , m_context(context)
         {
diff --git a/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 003f544..9411ad8 100644
--- a/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -44,30 +44,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSAbstractWorker::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, m_impl->onerror());
-
-    typedef AbstractWorker::EventListenersMap EventListenersMap;
-    typedef AbstractWorker::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
-}
-
 JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -76,10 +63,12 @@ JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& ar
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSAttrCustom.cpp b/WebCore/bindings/js/JSAttrCustom.cpp
index abd5ad5..14457c4 100644
--- a/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/WebCore/bindings/js/JSAttrCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -48,7 +48,8 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     Element* ownerElement = imp->ownerElement();
     if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
         if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(deprecatedParseURL(attrValue))) {
-            if (!checkNodeSecurity(exec, static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument()))
+            Document* contentDocument = static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument();
+            if (contentDocument && !checkNodeSecurity(exec, contentDocument))
                 return;
         }
     }
@@ -58,4 +59,16 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     setDOMException(exec, ec);
 }
 
+void JSAttr::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    // Mark the element so that this will work to access the attribute even if the last
+    // other reference goes away.
+    if (Element* element = impl()->ownerElement()) {
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
+            markStack.append(wrapper);
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSAudioConstructor.cpp b/WebCore/bindings/js/JSAudioConstructor.cpp
index 87a3880..174cc11 100644
--- a/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -34,6 +34,7 @@
 #include "JSHTMLAudioElement.h"
 #include "ScriptExecutionContext.h"
 #include "Text.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSCSSRuleListCustom.cpp b/WebCore/bindings/js/JSCSSRuleListCustom.cpp
new file mode 100644
index 0000000..be3a9a2
--- /dev/null
+++ b/WebCore/bindings/js/JSCSSRuleListCustom.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCSSRuleList.h"
+
+#include "CSSRuleList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCSSRuleList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    CSSRuleList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
+}
diff --git a/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 280ec93..4a137d3 100644
--- a/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,8 +27,8 @@
 #include "JSCSSStyleDeclarationCustom.h"
 
 #include "AtomicString.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
-#include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
 #include "PlatformString.h"
 #include <runtime/StringObjectThatMasqueradesAsUndefined.h>
@@ -40,6 +40,21 @@ using namespace WTF;
 
 namespace WebCore {
 
+void JSCSSStyleDeclaration::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    CSSStyleDeclaration* declaration = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    if (declaration->isMutableStyleDeclaration()) {
+        CSSMutableStyleDeclaration* mutableDeclaration = static_cast<CSSMutableStyleDeclaration*>(declaration);
+        CSSMutableStyleDeclaration::const_iterator end = mutableDeclaration->end();
+        for (CSSMutableStyleDeclaration::const_iterator it = mutableDeclaration->begin(); it != end; ++it)
+            markDOMObjectWrapper(markStack, globalData, it->value());
+    }
+}
+
 // Check for a CSS prefix.
 // Passed prefix is all lowercase.
 // First character of the prefix within the property name may be upper or lowercase.
diff --git a/WebCore/bindings/js/JSCallbackData.cpp b/WebCore/bindings/js/JSCallbackData.cpp
new file mode 100644
index 0000000..d08f760
--- /dev/null
+++ b/WebCore/bindings/js/JSCallbackData.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCallbackData.h"
+
+#include "Document.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+    
+namespace WebCore {
+
+void JSCallbackData::deleteData(void* context)
+{
+    delete static_cast<JSCallbackData*>(context);
+}
+
+JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedException)
+{
+    ASSERT(callback());
+    ASSERT(globalObject());
+
+    ExecState* exec = globalObject()->globalExec();
+    
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = callback()->getCallData(callData);
+        if (callType == CallTypeNone)
+            return JSValue();
+        function = callback();
+    }
+    
+    globalObject()->globalData()->timeoutChecker.start();
+    JSValue result = call(exec, function, callType, callData, callback(), args);
+    globalObject()->globalData()->timeoutChecker.stop();
+
+    Document::updateStyleForAllDocuments();
+
+    if (exec->hadException()) {
+        reportCurrentException(exec);
+        if (raisedException)
+            *raisedException = true;
+        return result;
+    }
+    
+    return result;
+}
+    
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCallbackData.h b/WebCore/bindings/js/JSCallbackData.h
new file mode 100644
index 0000000..4fc9f84
--- /dev/null
+++ b/WebCore/bindings/js/JSCallbackData.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSCallbackData_h
+#define JSCallbackData_h
+
+#include "JSDOMGlobalObject.h"
+#include <runtime/JSObject.h>
+#include <runtime/Protect.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+// We have to clean up this data on the main thread because unprotecting a
+// JSObject on a non-main thread without synchronization would corrupt the heap
+// (and synchronization would be slow).
+
+class JSCallbackData {
+public:
+    static void deleteData(void*);
+
+    JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+        : m_callback(callback)
+        , m_globalObject(globalObject)
+    {
+    }
+    
+    ~JSCallbackData()
+    {
+        ASSERT(isMainThread());
+    }
+
+    JSC::JSObject* callback() { return m_callback.get(); }
+    JSDOMGlobalObject* globalObject() { return m_globalObject.get(); }
+    
+    JSC::JSValue invokeCallback(JSC::MarkedArgumentBuffer&, bool* raisedException = 0);
+
+private:
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+};
+
+} // namespace WebCore
+
+#endif // JSCallbackData_h
diff --git a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
new file mode 100644
index 0000000..93d53ca
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasArrayBufferConstructor.h"
+
+#include "Document.h"
+#include "CanvasArrayBuffer.h"
+#include "JSCanvasArrayBuffer.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
+
+JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
+
+    unsigned int size = 0;
+    if (args.size() == 1) {
+        size = (unsigned int)args.at(0).toInt32(exec);
+        if (isnan(size))
+            size = 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
+}
+
+JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasArrayBuffer;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
new file mode 100644
index 0000000..5f1254e
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasArrayBufferConstructor_h
+#define JSCanvasArrayBufferConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+#include "JSCanvasArrayBuffer.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+    class CanvasArray;
+
+    // Template function used by CanvasXXXArrayConstructors
+    template<class C, typename T>
+    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
+    {
+        // There are 3 constructors:
+        //
+        //  1) (in int size)
+        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
+        //  3) (in sequence<T>) - This ends up being a JS "array-like" object
+        //
+        RefPtr<C> arrayObject;
+        
+        // For the 0 args case, just create an object without a buffer 
+        if (args.size() < 1)
+            return C::create(0, 0, 0);
+        
+        if (args.at(0).isObject()) {
+            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
+            if (buffer) {
+                int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
+                unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
+                return C::create(buffer, offset, length);
+            }
+            
+            JSC::JSObject* array = asObject(args.at(0));
+            int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+            void* tempValues;
+            if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues)) {
+                throwError(exec, JSC::GeneralError);
+                return 0;
+            }
+            
+            OwnFastMallocPtr<T> values(static_cast<T*>(tempValues));
+            for (int i = 0; i < length; ++i) {
+                JSC::JSValue v = array->get(exec, i);
+                if (exec->hadException())
+                    return 0;
+                values.get()[i] = static_cast<T>(v.toNumber(exec));
+            }
+            
+            return C::create(values.get(), length);
+        }
+        
+        unsigned size = static_cast<unsigned>(args.at(0).toInt32(exec));
+        return C::create(size);
+    }
+
+    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasArrayBufferConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/WebCore/bindings/js/JSCanvasArrayCustom.cpp
new file mode 100644
index 0000000..4aa1547
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasArrayCustom.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "config.h"
+#include "JSCanvasArray.h"
+
+#include "CanvasArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
+{
+    if (!object)
+        return jsUndefined();
+        
+    
+
+#if ENABLE(3D_CANVAS)
+    if (object->is3d())
+        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+#endif
+    ASSERT(object->is2d());
+    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
new file mode 100644
index 0000000..ec1d66d
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasByteArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
+    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.h b/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
index cd6c2cb..4d5dc11 100644
--- a/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,44 +23,24 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSNamedNodesCollection_h
-#define JSNamedNodesCollection_h
+#ifndef JSCanvasByteArrayConstructor_h
+#define JSCanvasByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
-#include <wtf/Vector.h>
+#include "JSDocument.h"
 
 namespace WebCore {
 
-    class Node;
-
-    // Internal class, used for the collection return by e.g. document.forms.myinput
-    // when multiple nodes have the same name.
-    class JSNamedNodesCollection : public DOMObjectWithGlobalPointer {
+    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSNamedNodesCollection(JSC::ExecState*, JSDOMGlobalObject*, const Vector<RefPtr<Node> >&);
-
-        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
-        {
-            return globalObject->objectPrototype();
-        }
-
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-        {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-        }
-
     private:
-        static JSC::JSValue lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        OwnPtr<Vector<RefPtr<Node> > > m_nodes;
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     };
 
-} // namespace WebCore
+}
 
-#endif // JSNamedNodesCollection_h
+#endif // JSCanvasByteArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
new file mode 100644
index 0000000..04697ce
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArray.h"
+
+#include "CanvasByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
new file mode 100644
index 0000000..15e39c2
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasFloatArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasFloatArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
+    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasFloatArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
new file mode 100644
index 0000000..efea250
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasFloatArrayConstructor_h
+#define JSCanvasFloatArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasFloatArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
new file mode 100644
index 0000000..20cd805
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArray.h"
+
+#include "CanvasFloatArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<float>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
new file mode 100644
index 0000000..6d57912
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasIntArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
+    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
new file mode 100644
index 0000000..5e19652
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasIntArrayConstructor_h
+#define JSCanvasIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasIntArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp b/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
new file mode 100644
index 0000000..8442b87
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArray.h"
+
+#include "CanvasIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasIntArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp b/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp
new file mode 100644
index 0000000..be10ac0
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasNumberArray.h"
+
+#include "CanvasNumberArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSCanvasNumberArray::getByIndex(JSC::ExecState* exec, unsigned int index)
+{
+    JSC::JSValue result = jsNumber(exec, impl()->item(index));
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 398a6799..bb3500b 100644
--- a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -67,27 +67,31 @@ static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
 
 JSValue JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
 {
-    return toJS(exec, impl()->strokeStyle());        
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    return toJS(exec, context->strokeStyle());        
 }
 
 void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValue value)
 {
-    impl()->setStrokeStyle(toHTMLCanvasStyle(exec, value));
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    context->setStrokeStyle(toHTMLCanvasStyle(exec, value));
 }
 
 JSValue JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
 {
-    return toJS(exec, impl()->fillStyle());
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    return toJS(exec, context->fillStyle());
 }
 
 void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValue value)
 {
-    impl()->setFillStyle(toHTMLCanvasStyle(exec, value));
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    context->setFillStyle(toHTMLCanvasStyle(exec, value));
 }
 
 JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
 {
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = named color
     // number arg = gray color
@@ -124,7 +128,7 @@ JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList&
 
 JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = named color
     // number arg = gray color
@@ -162,7 +166,7 @@ JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgLis
 
 JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
     
     if (args.size() <= 4)
         context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
@@ -176,7 +180,7 @@ JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& a
 
 JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // DrawImage has three variants:
     //     drawImage(img, dx, dy)
@@ -264,7 +268,7 @@ JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& ar
 
 JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
     
     JSValue value = args.at(0);
     if (!value.isObject())
@@ -284,7 +288,7 @@ JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const Arg
 
 JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     switch (args.size()) {
         case 3:
@@ -330,7 +334,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
 
 JSValue JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     JSValue value = args.at(0);
     if (!value.isObject())
@@ -362,7 +366,7 @@ JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList&
     // putImageData has two variants
     // putImageData(ImageData, x, y)
     // putImageData(ImageData, x, y, dirtyX, dirtyY, dirtyWidth, dirtyHeight)
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     ExceptionCode ec = 0;
     if (args.size() >= 7)
@@ -377,7 +381,7 @@ JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList&
 
 JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = text to draw
     // number arg = x
@@ -395,7 +399,7 @@ JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& arg
 
 JSValue JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = text to draw
     // number arg = x
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
new file mode 100644
index 0000000..3938ba1
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
@@ -0,0 +1,443 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasRenderingContext3D.h"
+
+#include "CanvasRenderingContext3D.h"
+#include "ExceptionCode.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "JSCanvasFloatArray.h"
+#include "JSCanvasIntArray.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSWebKitCSSMatrix.h"
+#include <runtime/Error.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/OwnFastMallocPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSCanvasRenderingContext3D::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned usage = args.at(2).toInt32(exec);
+
+    // If argument 1 is a number, we are initializing this buffer to that size
+    if (!args.at(1).isObject()) {
+        unsigned int count = args.at(1).toInt32(exec);
+        static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, count, usage);
+        return jsUndefined();
+    }
+
+    CanvasArray* array = toCanvasArray(args.at(1));
+    
+    static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, array, usage);
+    return jsUndefined();
+}
+
+JSValue JSCanvasRenderingContext3D::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned offset = args.at(1).toInt32(exec);
+    
+    CanvasArray* array = toCanvasArray(args.at(2));
+    
+    static_cast<CanvasRenderingContext3D*>(impl())->bufferSubData(target, offset, array);
+    return jsUndefined();
+}
+
+// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
+JSValue JSCanvasRenderingContext3D::texImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    if (args.size() > 5) {
+        // This must be the bare array case.
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+            
+        unsigned internalformat = args.at(2).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned width = args.at(3).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned height = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned border = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        CanvasArray* array = toCanvasArray(args.at(8));
+        if (exec->hadException())    
+            return jsUndefined();
+            
+        if (!array)
+            return throwError(exec, TypeError);
+        
+        // FIXME: Need to check to make sure CanvasArray is a CanvasByteArray or CanvasShortArray,
+        // depending on the passed type parameter.
+        
+        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
+        return jsUndefined();
+    }
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(2);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
+JSValue JSCanvasRenderingContext3D::texSubImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 7 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned level = args.at(1).toInt32(exec);
+    unsigned xoff = args.at(2).toInt32(exec);
+    unsigned yoff = args.at(3).toInt32(exec);
+    unsigned width = args.at(4).toInt32(exec);
+    unsigned height = args.at(5).toInt32(exec);
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(6);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    ExceptionCode ec = 0;
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+template<typename T>
+void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
+{
+    array = 0;
+    
+    if (!value.isObject())
+        return;
+        
+    JSC::JSObject* object = asObject(value);
+    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    void* tempValues;
+    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
+        return;
+    
+    T* values = static_cast<T*>(tempValues);
+    for (int i = 0; i < length; ++i) {
+        JSC::JSValue v = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        values[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    array = values;
+    size = length;
+}
+
+enum DataFunctionToCall {
+    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
+    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
+};
+
+enum DataFunctionMatrixToCall {
+    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
+};
+
+static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1fv(location, canvasArray.get()); break;
+            case f_uniform2v: context->uniform2fv(location, canvasArray.get()); break;
+            case f_uniform3v: context->uniform3fv(location, canvasArray.get()); break;
+            case f_uniform4v: context->uniform4fv(location, canvasArray.get()); break;
+            case f_vertexAttrib1v: context->vertexAttrib1fv(location, canvasArray.get()); break;
+            case f_vertexAttrib2v: context->vertexAttrib2fv(location, canvasArray.get()); break;
+            case f_vertexAttrib3v: context->vertexAttrib3fv(location, canvasArray.get()); break;
+            case f_vertexAttrib4v: context->vertexAttrib4fv(location, canvasArray.get()); break;
+        }
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1fv(location, array, size); break;
+        case f_uniform2v: context->uniform2fv(location, array, size); break;
+        case f_uniform3v: context->uniform3fv(location, array, size); break;
+        case f_uniform4v: context->uniform4fv(location, array, size); break;
+        case f_vertexAttrib1v: context->vertexAttrib1fv(location, array, size); break;
+        case f_vertexAttrib2v: context->vertexAttrib2fv(location, array, size); break;
+        case f_vertexAttrib3v: context->vertexAttrib3fv(location, array, size); break;
+        case f_vertexAttrib4v: context->vertexAttrib4fv(location, array, size); break;
+    }
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasIntArray> canvasArray = toCanvasIntArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1iv(location, canvasArray.get()); break;
+            case f_uniform2v: context->uniform2iv(location, canvasArray.get()); break;
+            case f_uniform3v: context->uniform3iv(location, canvasArray.get()); break;
+            case f_uniform4v: context->uniform4iv(location, canvasArray.get()); break;
+            default: break;
+        }
+        return jsUndefined();
+    }
+    
+    int* array;
+    int size;
+    toArray<int>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1iv(location, array, size); break;
+        case f_uniform2v: context->uniform2iv(location, array, size); break;
+        case f_uniform3v: context->uniform3iv(location, array, size); break;
+        case f_uniform4v: context->uniform4iv(location, array, size); break;
+        default: break;
+    }
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    bool transpose = args.at(1).toBoolean(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(2));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, canvasArray.get()); break;
+            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, canvasArray.get()); break;
+            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, canvasArray.get()); break;
+        }
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(2), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size); break;
+        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size); break;
+        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size); break;
+    }
+    return jsUndefined();
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
new file mode 100644
index 0000000..0cd2aa3
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCanvasRenderingContext.h"
+
+#include "CanvasRenderingContext2D.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "CanvasRenderingContext3D.h"
+#include "JSCanvasRenderingContext3D.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasRenderingContext* object)
+{
+    if (!object)
+        return jsUndefined();
+
+#if ENABLE(3D_CANVAS)
+    if (object->is3d())
+        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+#endif
+    ASSERT(object->is2d());
+    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
new file mode 100644
index 0000000..a885b7b
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasShortArray.h"
+#include "JSCanvasArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasShortArrayConstructor::s_info = { "CanvasShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasShortArrayConstructor::JSCanvasShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasShortArrayConstructor* jsConstructor = static_cast<JSCanvasShortArrayConstructor*>(constructor);
+    RefPtr<CanvasShortArray> array = static_cast<CanvasShortArray*>(construct<CanvasShortArray, short>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasShortArrayConstructor.h b/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
new file mode 100644
index 0000000..df21825
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasShortArrayConstructor_h
+#define JSCanvasShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp b/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
new file mode 100644
index 0000000..21af0a6
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArray.h"
+
+#include "CanvasShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasShortArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
new file mode 100644
index 0000000..5d0800e
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedByteArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedByteArrayConstructor::s_info = { "CanvasUnsignedByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedByteArrayConstructor::JSCanvasUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedByteArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedByteArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedByteArray> array = static_cast<CanvasUnsignedByteArray*>(construct<CanvasUnsignedByteArray, unsigned char>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
new file mode 100644
index 0000000..9cfb721
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedByteArrayConstructor_h
+#define JSCanvasUnsignedByteArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedByteArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedByteArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp b/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
new file mode 100644
index 0000000..f2b0c74
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArray.h"
+
+#include "CanvasUnsignedByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedByteArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
new file mode 100644
index 0000000..5f145a7
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedIntArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedIntArrayConstructor::s_info = { "CanvasUnsignedIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedIntArrayConstructor::JSCanvasUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedIntArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedIntArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedIntArray> array = static_cast<CanvasUnsignedIntArray*>(construct<CanvasUnsignedIntArray, unsigned int>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
new file mode 100644
index 0000000..6016159
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedIntArrayConstructor_h
+#define JSCanvasUnsignedIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedIntArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp b/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
new file mode 100644
index 0000000..95a80a7
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArray.h"
+
+#include "CanvasUnsignedIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedIntArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
new file mode 100644
index 0000000..9735693
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedShortArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedShortArrayConstructor::s_info = { "CanvasUnsignedShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedShortArrayConstructor::JSCanvasUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedShortArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedShortArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedShortArray> array = static_cast<CanvasUnsignedShortArray*>(construct<CanvasUnsignedShortArray, unsigned short>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
new file mode 100644
index 0000000..23c197f
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedShortArrayConstructor_h
+#define JSCanvasUnsignedShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp b/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
new file mode 100644
index 0000000..290cd4b
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArray.h"
+
+#include "CanvasUnsignedShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedShortArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCustomPositionCallback.cpp b/WebCore/bindings/js/JSCustomPositionCallback.cpp
index ec2d8e3..07788a8 100644
--- a/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -35,42 +35,20 @@ namespace WebCore {
 
 using namespace JSC;
 
-JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(callback, globalObject)
 {
 }
 
 void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-    
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-    
-    JSC::JSLock lock(SilenceAssertionsOnly);
-    
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-    
     RefPtr<JSCustomPositionCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data.globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), geoposition));
+<<<<<<< HEAD:WebCore/bindings/js/JSCustomPositionCallback.cpp
 
     globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
@@ -81,6 +59,9 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
     }
     
     Document::updateStyleForAllDocuments();
+=======
+    m_data.invokeCallback(args);
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSCustomPositionCallback.cpp
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionCallback.h b/WebCore/bindings/js/JSCustomPositionCallback.h
index 9c8fe86..dff34fe 100644
--- a/WebCore/bindings/js/JSCustomPositionCallback.h
+++ b/WebCore/bindings/js/JSCustomPositionCallback.h
@@ -26,31 +26,33 @@
 #ifndef JSCustomPositionCallback_h
 #define JSCustomPositionCallback_h
 
+#include "JSCallbackData.h"
 #include "PositionCallback.h"
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class Geoposition;
+class JSDOMGlobalObject;
 
 class JSCustomPositionCallback : public PositionCallback {
 public:
-    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionCallback(callback, frame)); }
+    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomPositionCallback(callback, globalObject));
+    }
     
+<<<<<<< HEAD:WebCore/bindings/js/JSCustomPositionCallback.h
     virtual void handleEvent(Geoposition*);
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSCustomPositionCallback.h
 private:
-    JSCustomPositionCallback(JSC::JSObject* callback, Frame*);
+    JSCustomPositionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    virtual void handleEvent(Geoposition*);
+    
+    JSCallbackData m_data;
 };
     
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index cda5738..bd64deb 100644
--- a/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -35,51 +35,21 @@ namespace WebCore {
     
 using namespace JSC;
 
-JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(callback, globalObject)
 {
 }
 
 void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-    
-    if (!m_frame->script()->isEnabled())
-        return;
+    RefPtr<JSCustomPositionErrorCallback> protect(this);
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-    
     JSC::JSLock lock(SilenceAssertionsOnly);
-    
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-    
-    RefPtr<JSCustomPositionErrorCallback> protect(this);
-    
+    ExecState* exec = m_data.globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), positionError));
     
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-    
-    if (exec->hadException())
-        reportCurrentException(exec);
-    
-    Document::updateStyleForAllDocuments();
+    m_data.invokeCallback(args);
 }
     
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionErrorCallback.h b/WebCore/bindings/js/JSCustomPositionErrorCallback.h
index 9f143a2..59328ca 100644
--- a/WebCore/bindings/js/JSCustomPositionErrorCallback.h
+++ b/WebCore/bindings/js/JSCustomPositionErrorCallback.h
@@ -26,31 +26,26 @@
 #ifndef JSCustomPositionErrorCallback_h
 #define JSCustomPositionErrorCallback_h
 
+#include "JSCallbackData.h"
 #include "PositionErrorCallback.h"
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
     
-class Frame;
 class PositionError;
 
 class JSCustomPositionErrorCallback : public PositionErrorCallback {
 public:
-    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomPositionErrorCallback(callback, globalObject));
+    }
     
-    virtual void handleEvent(PositionError*);
-
 private:
-    JSCustomPositionErrorCallback(JSC::JSObject* callback, Frame*);
-
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCustomPositionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
+    virtual void handleEvent(PositionError*);
+    
+    JSCallbackData m_data;
 };
     
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index d0943de..1f6bd95 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -28,6 +28,7 @@
 
 #include "config.h"
 #include "JSCustomSQLStatementCallback.h"
+
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
@@ -35,60 +36,38 @@
 #include "JSSQLResultSet.h"
 #include "JSSQLTransaction.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
     
-void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback()
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-        
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
+void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+{
+    ASSERT(m_data);
 
     RefPtr<JSCustomSQLStatementCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), resultSet));
-        
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-
-        raisedException = true;
-    }
 
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args, &raisedException);
 }
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/WebCore/bindings/js/JSCustomSQLStatementCallback.h
index c380670..259aecf 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -31,32 +31,29 @@
 
 #if ENABLE(DATABASE)
 
+#include "JSCallbackData.h"
 #include "SQLStatementCallback.h"
-
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class SQLResultSet;
 
 class JSCustomSQLStatementCallback : public SQLStatementCallback {
 public:
-    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLStatementCallback(callback, globalObject));
+    }
+    
+    virtual ~JSCustomSQLStatementCallback();
 
     virtual void handleEvent(SQLTransaction*, SQLResultSet*, bool& raisedException);
 
 private:
-    JSCustomSQLStatementCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLStatementCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 6c831ac..6178509 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -32,75 +32,51 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
 #include "JSSQLError.h"
 #include "JSSQLTransaction.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
-    
-bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
-{
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-        
-    if (!m_frame->script()->isEnabled())
-        return true;
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
-    CallData callbackCallData;
-    CallType callbackCallType = CallTypeNone;
+JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    if (handleEventCallType == CallTypeNone) {
-        callbackCallType = m_callback->getCallData(callbackCallData);
-        if (callbackCallType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return true;
-        }
-    }
+bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
+{
+    ASSERT(m_data);
         
     RefPtr<JSCustomSQLStatementErrorCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
-        
-    JSValue result;
-    globalObject->globalData()->timeoutChecker.start();
-    if (handleEventCallType != CallTypeNone)
-        result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
-    else
-        result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-            
+    
+    bool raisedException = false;
+    JSValue result = m_data->invokeCallback(args, &raisedException);
+    if (raisedException) {
         // The spec says:
         // "If the error callback returns false, then move on to the next statement..."
         // "Otherwise, the error callback did not return false, or there was no error callback"
         // Therefore an exception and returning true are the same thing - so, return true on an exception
         return true;
     }
-        
-    Document::updateStyleForAllDocuments();
-
     return result.toBoolean(exec);
 }
 
diff --git a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
index e563393..ac4e45f 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -31,32 +31,31 @@
 
 #if ENABLE(DATABASE)
 
+#include "JSDOMGlobalObject.h"
 #include "SQLStatementErrorCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
-    
-class Frame;
+
+class JSCallbackData;    
 class SQLError;
     
 class JSCustomSQLStatementErrorCallback : public SQLStatementErrorCallback {
 public:
-    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementErrorCallback(callback, frame)); }
-        
+    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLStatementErrorCallback(callback, globalObject));
+    }
+
+    virtual ~JSCustomSQLStatementErrorCallback();
+
     virtual bool handleEvent(SQLTransaction*, SQLError*);
 
 private:
-    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCallbackData* m_data;
 };
     
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index 3d42f81..456022f 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -32,9 +32,11 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
+#include "JSDOMGlobalObject.h"
 #include "JSSQLTransaction.h"
 #include "Page.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
 #include <wtf/MainThread.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -47,39 +49,17 @@ using namespace JSC;
 static WTF::RefCountedLeakCounter counter("JSCustomSQLTransactionCallback");
 #endif
 
-// We have to clean up the data on the main thread for two reasons:
-//
-//     1) Can't deref a Frame on a non-main thread.
-//     2) Unprotecting the JSObject on a non-main thread would register that thread
-//        for JavaScript garbage collection, which could unnecessarily slow things down.
-
-class JSCustomSQLTransactionCallback::Data {
-public:
-    Data(JSObject* callback, Frame* frame) : m_callback(callback), m_frame(frame) { }
-    JSObject* callback() { return m_callback; }
-    Frame* frame() { return m_frame.get(); }
-
-private:
-    ProtectedPtr<JSObject> m_callback;
-    RefPtr<Frame> m_frame;
-};
-
-JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, Frame* frame)
-    : m_data(new Data(callback, frame))
+JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 #ifndef NDEBUG
     counter.increment();
 #endif
 }
 
-void JSCustomSQLTransactionCallback::deleteData(void* context)
-{
-    delete static_cast<Data*>(context);
-}
-
 JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
 {
-    callOnMainThread(deleteData, m_data);
+    callOnMainThread(JSCallbackData::deleteData, m_data);
 #ifndef NDEBUG
     m_data = 0;
     counter.decrement();
@@ -89,51 +69,14 @@ JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
 void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bool& raisedException)
 {
     ASSERT(m_data);
-    ASSERT(m_data->callback());
-    ASSERT(m_data->frame());
 
-    if (!m_data->frame()->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_data->frame()->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
-    CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
-    CallData callbackCallData;
-    CallType callbackCallType = CallTypeNone;
-
-    if (handleEventCallType == CallTypeNone) {
-        callbackCallType = m_data->callback()->getCallData(callbackCallData);
-        if (callbackCallType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-    }
-        
     RefPtr<JSCustomSQLTransactionCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
-
-    globalObject->globalData()->timeoutChecker.start();
-    if (handleEventCallType != CallTypeNone)
-        call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
-    else
-        call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-        
-        raisedException = true;
-    }
-        
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args, &raisedException);
 }
     
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
index 22c367c..f142e59 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -32,7 +32,6 @@
 #if ENABLE(DATABASE)
 
 #include "SQLTransactionCallback.h"
-
 #include <wtf/PassRefPtr.h>
 
 namespace JSC {
@@ -42,22 +41,24 @@ namespace JSC {
 namespace WebCore {
 
 class Frame;
+class JSCallbackData;
+class JSDOMGlobalObject;
 
 class JSCustomSQLTransactionCallback : public SQLTransactionCallback {
 public:
-    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLTransactionCallback(callback, globalObject));
+    }
 
     virtual ~JSCustomSQLTransactionCallback();
     
     virtual void handleEvent(SQLTransaction*, bool& raisedException);
 
 private:
-    JSCustomSQLTransactionCallback(JSC::JSObject* callback, Frame*);
-
-    static void deleteData(void*);
+    JSCustomSQLTransactionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    class Data;
-    Data* m_data;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index 2d41bb8..331e014 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -32,59 +32,40 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
 #include "JSSQLError.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
-    
-void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
-{
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-
-    if (!m_frame->script()->isEnabled())
-        return;
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-
-    JSC::JSLock lock(SilenceAssertionsOnly);
+JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
+void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+{
+    ASSERT(m_data);
 
     RefPtr<JSCustomSQLTransactionErrorCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
-
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException())
-        reportCurrentException(exec);
-
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args);
 }
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index be3df29..54bf33b 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -32,31 +32,30 @@
 #if ENABLE(DATABASE)
 
 #include "SQLTransactionErrorCallback.h"
-
-#include <runtime/JSObject.h>
+#include "JSDOMGlobalObject.h"
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
+class JSCallbackData;
 class SQLError;
 
 class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
-    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, globalObject));
+    }
+    
+    virtual ~JSCustomSQLTransactionErrorCallback();
     
     virtual void handleEvent(SQLError*);
 
 private:
-    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.cpp b/WebCore/bindings/js/JSCustomVoidCallback.cpp
index b4e525b..0edd66f 100644
--- a/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -30,70 +30,38 @@
 #include "JSCustomVoidCallback.h"
 
 #include "Frame.h"
+#include "JSCallbackData.h"
 #include "JSDOMWindowCustom.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
+
+JSCustomVoidCallback::~JSCustomVoidCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
     
 void JSCustomVoidCallback::handleEvent()
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-       
-    if (!m_frame->script()->isEnabled())
-        return;
-        
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-        
+    ASSERT(m_data);
+
     RefPtr<JSCustomVoidCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
     MarkedArgumentBuffer args;
-    
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException())
-        reportCurrentException(exec);
-        
-    Document::updateStyleForAllDocuments();
-}
- 
-PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValue value)
-{
-    JSObject* object = value.getObject();
-    if (!object)
-        return 0;
-    
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return 0;
-    
-    return JSCustomVoidCallback::create(object, frame);
+    m_data->invokeCallback(args);
 }
 
-}
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.h b/WebCore/bindings/js/JSCustomVoidCallback.h
index 9cd7c34..4b8d7ea 100644
--- a/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -29,33 +29,31 @@
 #ifndef JSCustomVoidCallback_h
 #define JSCustomVoidCallback_h
 
+#include "JSDOMGlobalObject.h"
 #include "VoidCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
+
+class JSCallbackData;
+
+class JSCustomVoidCallback : public VoidCallback {
+public: 
+    static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomVoidCallback(callback, globalObject));
+    }
     
-    class Frame;
+    virtual ~JSCustomVoidCallback();
     
-    class JSCustomVoidCallback : public VoidCallback {
-    public: 
-        static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, Frame* frame)
-        {
-            return adoptRef(new JSCustomVoidCallback(callback, frame));
-        }
-        
-        virtual void handleEvent();
-        
-    private:
-        JSCustomVoidCallback(JSC::JSObject* callback, Frame*);
-
-        JSC::ProtectedPtr<JSC::JSObject> m_callback;
-        RefPtr<Frame> m_frame;
-    };
-
-    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValue);
+    virtual void handleEvent();
+    
+private:
+    JSCustomVoidCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
+
+    JSCallbackData* m_data;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 4476be5..da4a53a 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -49,13 +49,13 @@ PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecSta
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
     }
-    
-    return adoptRef(new JSCustomXPathNSResolver(resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame()));
+
+    return adoptRef(new JSCustomXPathNSResolver(resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())));
 }
 
-JSCustomXPathNSResolver::JSCustomXPathNSResolver(JSObject* customResolver, Frame* frame)
+JSCustomXPathNSResolver::JSCustomXPathNSResolver(JSObject* customResolver, JSDOMWindow* globalObject)
     : m_customResolver(customResolver)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
 
@@ -67,15 +67,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 {
     ASSERT(m_customResolver);
 
-    if (!m_frame)
-        return String();
-    if (!m_frame->script()->isEnabled())
-        return String();
-
     JSLock lock(SilenceAssertionsOnly);
 
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
         
     JSValue function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
     CallData callData;
@@ -84,7 +78,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
         callType = m_customResolver->getCallData(callData);
         if (callType == CallTypeNone) {
             // FIXME: Pass actual line number and source URL.
-            m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
+            m_globalObject->impl()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
             return String();
         }
         function = m_customResolver;
@@ -95,9 +89,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     MarkedArgumentBuffer args;
     args.append(jsString(exec, prefix));
 
-    globalObject->globalData()->timeoutChecker.start();
+    m_globalObject->globalData()->timeoutChecker.start();
     JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
-    globalObject->globalData()->timeoutChecker.stop();
+    m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
     if (exec->hadException())
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.h b/WebCore/bindings/js/JSCustomXPathNSResolver.h
index 44c44f9..7d66494 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.h
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -41,6 +41,7 @@ namespace JSC {
 namespace WebCore {
 
     class Frame;
+    class JSDOMWindow;
 
     class JSCustomXPathNSResolver : public XPathNSResolver {
     public:
@@ -51,10 +52,11 @@ namespace WebCore {
         virtual String lookupNamespaceURI(const String& prefix);
 
     private:
-        JSCustomXPathNSResolver(JSC::JSObject*, Frame*);
+        JSCustomXPathNSResolver(JSC::JSObject*, JSDOMWindow*);
 
-        JSC::JSObject* m_customResolver; // JSCustomXPathNSResolvers are always temporary, thus no need to GC protect the object.
-        RefPtr<Frame> m_frame;
+        // JSCustomXPathNSResolvers are always temporary, thus no need to GC protect the objects.
+        JSC::JSObject* m_customResolver;
+        JSDOMWindow* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 109308c..49ef5e3 100644
--- a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -42,28 +42,6 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSDOMApplicationCache::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, m_impl->onchecking());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onnoupdate());
-    markIfNotNull(markStack, m_impl->ondownloading());
-    markIfNotNull(markStack, m_impl->onprogress());
-    markIfNotNull(markStack, m_impl->onupdateready());
-    markIfNotNull(markStack, m_impl->oncached());
-    markIfNotNull(markStack, m_impl->onobsolete());
-
-    typedef DOMApplicationCache::EventListenersMap EventListenersMap;
-    typedef DOMApplicationCache::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
-}
-
 #if ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
 
 JSValue JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
@@ -112,10 +90,12 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -124,10 +104,12 @@ JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgLis
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSDOMBinding.cpp b/WebCore/bindings/js/JSDOMBinding.cpp
index 566b986..515c088 100644
--- a/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/WebCore/bindings/js/JSDOMBinding.cpp
@@ -28,6 +28,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLAudioElement.h"
+#include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
 #include "HTMLScriptElement.h"
 #include "HTMLNames.h"
@@ -42,6 +43,8 @@
 #include "RangeException.h"
 #include "ScriptController.h"
 #include "XMLHttpRequestException.h"
+#include <runtime/Error.h>
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 #include <wtf/StdLibExtras.h>
 
@@ -264,18 +267,48 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
     Node* node = jsNode->impl();
 
     if (node->inDocument()) {
-        // 1. If a node is in the document, and its wrapper has custom properties,
+        // If a node is in the document, and its wrapper has custom properties,
         // the wrapper is observable because future access to the node through the
         // DOM must reflect those properties.
         if (jsNode->hasCustomProperties())
             return true;
 
-        // 2. If a node is in the document, and has event listeners, its wrapper is
+        // If a node is in the document, and has event listeners, its wrapper is
         // observable because its wrapper is responsible for marking those event listeners.
-        if (node->eventListeners().size())
+        if (node->hasEventListeners())
             return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
+
+        // If a node owns another object with a wrapper with custom properties,
+        // the wrapper must be treated as observable, because future access to
+        // those objects through the DOM must reflect those properties.
+        // FIXME: It would be better if this logic could be in the node next to
+        // the custom markChildren functions rather than here.
+        if (node->isElementNode()) {
+            if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
+                if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), attributes)) {
+                    if (wrapper->hasCustomProperties())
+                        return true;
+                }
+            }
+            if (node->isStyledElement()) {
+                if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
+                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), style)) {
+                        if (wrapper->hasCustomProperties())
+                            return true;
+                    }
+                }
+            }
+            if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
+                if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
+                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), context)) {
+                        if (wrapper->hasCustomProperties())
+                            return true;
+                    }
+                }
+            }
+        }
     } else {
-        // 3. If a wrapper is the last reference to an image or script element
+        // If a wrapper is the last reference to an image or script element
         // that is loading but not in the document, the wrapper is observable
         // because it is the only thing keeping the image element alive, and if
         // the image element is destroyed, its load event will not fire.
@@ -290,6 +323,11 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
 #endif
     }
 
+    // If a node is firing event listeners, its wrapper is observable because
+    // its wrapper is responsible for marking those event listeners.
+    if (node->isFiringEventListeners())
+        return true;
+
     return false;
 }
 
@@ -348,6 +386,9 @@ void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocum
 
 void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void* object)
 {
+    // FIXME: This could be changed to only mark wrappers that are "observable"
+    // as markDOMNodesForDocument does, allowing us to collect more wrappers,
+    // but doing this correctly would be challenging.
     if (!object)
         return;
     DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, object);
@@ -559,7 +600,7 @@ Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInf
     return structures.get(classInfo).get();
 }
 
-Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
     JSDOMStructureMap& structures = globalObject->structures();
     ASSERT(!structures.contains(classInfo));
@@ -571,7 +612,7 @@ Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
     return getCachedDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), classInfo);
 }
 
-Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(ExecState* exec, NonNullPassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
     return cacheDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), structure, classInfo);
 }
@@ -589,4 +630,33 @@ void cacheDOMConstructor(ExecState* exec, const ClassInfo* classInfo, JSObject*
     constructors.set(classInfo, constructor);
 }
 
+JSC::JSObject* toJSSequence(ExecState* exec, JSValue value, unsigned& length)
+{
+    JSObject* object = value.getObject();
+    if (!object) {
+        throwError(exec, TypeError);
+        return 0;
+    }
+    JSValue lengthValue = object->get(exec, exec->propertyNames().length);
+    if (exec->hadException())
+        return 0;
+
+    if (lengthValue.isUndefinedOrNull()) {
+        throwError(exec, TypeError);
+        return 0;
+    }
+
+    length = lengthValue.toUInt32(exec);
+    if (exec->hadException())
+        return 0;
+
+    return object;
+}
+
+bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
+{
+    throwError(exec, TypeError, "defineProperty is not supported on DOM Objects");
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMBinding.h b/WebCore/bindings/js/JSDOMBinding.h
index 64cfc3a..9c0ad7e 100644
--- a/WebCore/bindings/js/JSDOMBinding.h
+++ b/WebCore/bindings/js/JSDOMBinding.h
@@ -26,7 +26,6 @@
 #include "Document.h" // For DOMConstructorWithDocument
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
-#include <runtime/JSFunction.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -51,17 +50,19 @@ namespace WebCore {
     // Base class for all objects in this binding except Window.
     class DOMObject : public JSC::JSObject {
     protected:
-        explicit DOMObject(PassRefPtr<JSC::Structure> structure) 
+        explicit DOMObject(NonNullPassRefPtr<JSC::Structure> structure) 
             : JSObject(structure)
         {
         }
 
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
+
 #ifndef NDEBUG
         virtual ~DOMObject();
 #endif
     };
 
-    // FIXME: This class should colapse into DOMObject once all DOMObjects are
+    // FIXME: This class should collapse into DOMObject once all DOMObjects are
     // updated to store a globalObject pointer.
     class DOMObjectWithGlobalPointer : public DOMObject {
     public:
@@ -73,8 +74,13 @@ namespace WebCore {
             return m_globalObject->scriptExecutionContext();
         }
 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        {
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot));
+        }
+
     protected:
-        DOMObjectWithGlobalPointer(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
+        DOMObjectWithGlobalPointer(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
             , m_globalObject(globalObject)
         {
@@ -83,7 +89,7 @@ namespace WebCore {
             // needing to reach through the frame to get to the Document*.  See bug 27640.
             // ASSERT(globalObject->scriptExecutionContext());
         }
-        virtual ~DOMObjectWithGlobalPointer() {}
+        virtual ~DOMObjectWithGlobalPointer() { }
 
         void markChildren(JSC::MarkStack& markStack)
         {
@@ -104,7 +110,7 @@ namespace WebCore {
         }
 
     protected:
-        DOMConstructorObject(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
+        DOMConstructorObject(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObjectWithGlobalPointer(structure, globalObject)
         {
         }
@@ -120,7 +126,7 @@ namespace WebCore {
         }
 
     protected:
-        DOMConstructorWithDocument(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
+        DOMConstructorWithDocument(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMConstructorObject(structure, globalObject)
         {
             ASSERT(globalObject->scriptExecutionContext()->isDocument());
@@ -141,9 +147,9 @@ namespace WebCore {
     void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
-    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
-    JSC::Structure* cacheDOMStructure(JSC::ExecState*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSC::ExecState*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
@@ -277,6 +283,9 @@ namespace WebCore {
         return toJS(exec, globalObject, ptr.get());
     }
 
+    // Validates that the passed object is a sequence type per section 4.1.13 of the WebIDL spec.
+    JSC::JSObject* toJSSequence(JSC::ExecState*, JSC::JSValue, unsigned&);
+
     bool checkNodeSecurity(JSC::ExecState*, Node*);
 
     // Helpers for Window, History, and Location classes to implement cross-domain policy.
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.cpp b/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 68a1db9..372684c 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -40,24 +40,11 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData()
-    : evt(0)
-{
-}
-
-JSDOMGlobalObject::JSDOMGlobalObject(PassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
+JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
     : JSGlobalObject(structure, data, thisValue)
 {
 }
 
-JSDOMGlobalObject::~JSDOMGlobalObject()
-{
-    JSListenersMap::iterator it = d()->jsEventListeners.begin();
-    JSListenersMap::iterator end = d()->jsEventListeners.end();
-    for (; it != end; ++it)
-        it->second->clearGlobalObject();
-}
-
 void JSDOMGlobalObject::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
@@ -71,37 +58,12 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
         markStack.append(it2->second);
 }
 
-JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValue val)
-{
-    if (!val.isObject())
-        return 0;
-
-    return d()->jsEventListeners.get(asObject(val));
-}
-
-PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(JSValue val)
-{
-    if (JSEventListener* listener = findJSEventListener(val))
-        return listener;
-
-    if (!val.isObject())
-        return 0;
-
-    // The JSEventListener constructor adds it to our jsEventListeners map.
-    return JSEventListener::create(asObject(val), this, false).get();
-}
-
 PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
 {
     if (!val.isObject())
         return 0;
 
-    return JSEventListener::create(asObject(val), this, true).get();
-}
-
-JSDOMGlobalObject::JSListenersMap& JSDOMGlobalObject::jsEventListeners()
-{
-    return d()->jsEventListeners;
+    return JSEventListener::create(asObject(val), true).get();
 }
 
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
@@ -114,6 +76,11 @@ Event* JSDOMGlobalObject::currentEvent() const
     return d()->evt;
 }
 
+void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData)
+{
+    delete static_cast<JSDOMGlobalObjectData*>(jsDOMGlobalObjectData);
+}
+
 JSDOMGlobalObject* toJSDOMGlobalObject(Document* document)
 {
     return toJSDOMWindow(document->frame());
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.h b/WebCore/bindings/js/JSDOMGlobalObject.h
index 855691c..ce26857 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -45,8 +45,7 @@ namespace WebCore {
     protected:
         struct JSDOMGlobalObjectData;
 
-        JSDOMGlobalObject(PassRefPtr<JSC::Structure>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
-        virtual ~JSDOMGlobalObject();
+        JSDOMGlobalObject(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
 
     public:
         JSDOMStructureMap& structures() { return d()->structures; }
@@ -54,20 +53,10 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Finds a wrapper of a GC-unprotected JS EventListener, returns 0 if no existing one.
-        JSEventListener* findJSEventListener(JSC::JSValue);
-
-        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is *NOT* GC-protected.
-        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::JSValue);
-
-        // Creates a GC-protected JS EventListener for an "onXXX" event attribute.
-        // These listeners cannot be removed through the removeEventListener API.
+        // Creates a JS EventListener for an "onXXX" event attribute. These
+        // listeners cannot be removed through the removeEventListener API.
         PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
 
-        typedef HashMap<JSC::JSObject*, JSEventListener*> JSListenersMap;
-
-        JSListenersMap& jsEventListeners();
-
         // Make binding code generation easier.
         JSDOMGlobalObject* globalObject() { return this; }
 
@@ -78,17 +67,27 @@ namespace WebCore {
 
     protected:
         struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
-            JSDOMGlobalObjectData();
+            JSDOMGlobalObjectData()
+                : JSGlobalObjectData(destroyJSDOMGlobalObjectData)
+                , evt(0)
+            {
+            }
+
+            JSDOMGlobalObjectData(Destructor destructor)
+                : JSGlobalObjectData(destructor)
+                , evt(0)
+            {
+            }
 
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
-            JSDOMGlobalObject::JSListenersMap jsEventListeners;
-
             Event* evt;
         };
 
     private:
+        static void destroyJSDOMGlobalObjectData(void*);
+
         JSDOMGlobalObjectData* d() const { return static_cast<JSDOMGlobalObjectData*>(JSC::JSVariableObject::d); }
     };
 
diff --git a/WebCore/bindings/js/JSDOMWindowBase.cpp b/WebCore/bindings/js/JSDOMWindowBase.cpp
index df6068a..a04ef89 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -42,13 +42,7 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
-JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-    : impl(window)
-    , shell(shell)
-{
-}
-
-JSDOMWindowBase::JSDOMWindowBase(PassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
 {
     GlobalPropertyInfo staticGlobals[] = {
@@ -113,7 +107,7 @@ ExecState* JSDOMWindowBase::globalExec()
 
 bool JSDOMWindowBase::supportsProfiling() const
 {
-#if !ENABLE(JAVASCRIPT_DEBUGGER)
+#if !ENABLE(JAVASCRIPT_DEBUGGER) || !ENABLE(INSPECTOR)
     return false;
 #else
     Frame* frame = impl()->frame();
@@ -167,11 +161,19 @@ JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
     if (!globalData) {
         globalData = JSGlobalData::createLeaked().releaseRef();
         globalData->timeoutChecker.setTimeoutInterval(10000); // 10 seconds
+#ifndef NDEBUG
+        globalData->mainThreadOnly = true;
+#endif
     }
 
     return globalData;
 }
 
+void JSDOMWindowBase::destroyJSDOMWindowBaseData(void* jsDOMWindowBaseData)
+{
+    delete static_cast<JSDOMWindowBaseData*>(jsDOMWindowBaseData);
+}
+
 // JSDOMGlobalObject* is ignored, accesing a window in any context will
 // use that DOMWindow's prototype chain.
 JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
diff --git a/WebCore/bindings/js/JSDOMWindowBase.h b/WebCore/bindings/js/JSDOMWindowBase.h
index 84cc81f..52c3c1d 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/WebCore/bindings/js/JSDOMWindowBase.h
@@ -43,7 +43,7 @@ namespace WebCore {
     class JSDOMWindowBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
     protected:
-        JSDOMWindowBase(PassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+        JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
         void updateDocument();
@@ -76,7 +76,12 @@ namespace WebCore {
 
     private:
         struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+                : JSDOMGlobalObjectData(destroyJSDOMWindowBaseData)
+                , impl(window)
+                , shell(shell)
+            {
+            }
 
             RefPtr<DOMWindow> impl;
             JSDOMWindowShell* shell;
@@ -85,6 +90,8 @@ namespace WebCore {
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
         
+        static void destroyJSDOMWindowBaseData(void*);
+
         JSDOMWindowBaseData* d() const { return static_cast<JSDOMWindowBaseData*>(JSC::JSVariableObject::d); }
     };
 
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.cpp b/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 9798972..47339d4 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -38,29 +38,53 @@
 #include "JSDOMWindowShell.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSEventSourceConstructor.h"
 #include "JSHTMLCollection.h"
 #include "JSHistory.h"
 #include "JSImageConstructor.h"
 #include "JSLocation.h"
 #include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSMessagePortCustom.h"
 #include "JSOptionConstructor.h"
+
+#if ENABLE(SHARED_WORKERS)
 #include "JSSharedWorkerConstructor.h"
+#endif
+
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasByteArrayConstructor.h"
+#include "JSCanvasUnsignedByteArrayConstructor.h"
+#include "JSCanvasIntArrayConstructor.h"
+#include "JSCanvasUnsignedIntArrayConstructor.h"
+#include "JSCanvasShortArrayConstructor.h"
+#include "JSCanvasUnsignedShortArrayConstructor.h"
+#include "JSCanvasFloatArrayConstructor.h"
+#endif
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
+#if ENABLE(WEB_SOCKETS)
+#include "JSWebSocketConstructor.h"
+#endif
 #include "JSWorkerConstructor.h"
 #include "JSXMLHttpRequestConstructor.h"
 #include "JSXSLTProcessorConstructor.h"
 #include "Location.h"
 #include "MediaPlayer.h"
 #include "MessagePort.h"
+#include "NotificationCenter.h"
 #include "Page.h"
 #include "PlatformScreen.h"
 #include "RegisteredEventListener.h"
 #include "ScheduledAction.h"
 #include "ScriptController.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
+#include "SharedWorkerRepository.h"
 #include "WindowFeatures.h"
+#include <runtime/Error.h>
+#include <runtime/JSFunction.h>
 #include <runtime/JSObject.h>
 #include <runtime/PrototypeFunction.h>
 
@@ -72,7 +96,7 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    markEventListeners(markStack, impl()->eventListeners());
+    impl()->markEventListeners(markStack);
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
@@ -271,6 +295,150 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
+    // are not affected by properties changed on the Window or anything in its prototype chain.
+    // This is consistent with the behavior of Firefox.
+    
+    const HashEntry* entry;
+    
+    // We don't want any properties other than "close" and "closed" on a closed window.
+    if (!impl()->frame()) {
+        // The following code is safe for cross-domain and same domain use.
+        // It ignores any custom properties that might be set on the DOMWindow (including a custom prototype).
+        entry = s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && !(entry->attributes() & Function) && entry->propertyGetter() == jsDOMWindowClosed) {
+            descriptor.setDescriptor(jsBoolean(true), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+        entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && (entry->attributes() & Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
+            PropertySlot slot;
+            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+        descriptor.setUndefined();
+        return true;
+    }
+
+    String errorMessage;
+    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
+    if (allowsAccess && JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+
+    // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
+    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
+    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
+    // what prototype is actually set on this object.
+    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
+                    descriptor.setUndefined();
+                    return true;
+                }
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.prototype.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            if (!allowsAccess) {
+                PropertySlot slot;
+                slot.setCustom(this, objectToStringFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                return true;
+            }
+        }
+    }
+    
+    entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    
+    // Check for child frames by name before built-in properties to
+    // match Mozilla. This does not match IE, but some sites end up
+    // naming frames things that conflict with window properties that
+    // are in Moz but not IE. Since we have some of these, we have to do
+    // it the Moz way.
+    if (impl()->frame()->tree()->child(propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, childFrameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    // Do prototype lookup early so that functions and attributes in the prototype can have
+    // precedence over the index and name getters.  
+    JSValue proto = prototype();
+    if (proto.isObject()) {
+        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor)) {
+            if (!allowsAccess) {
+                printErrorMessage(errorMessage);
+                descriptor.setUndefined();
+            }
+            return true;
+        }
+    }
+
+    bool ok;
+    unsigned i = propertyName.toArrayIndex(&ok);
+    if (ok && i < impl()->frame()->tree()->childCount()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, i, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+
+    // Allow shortcuts like 'Image1' instead of document.images.Image1
+    Document* document = impl()->frame()->document();
+    if (document->isHTMLDocument()) {
+        AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
+        if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
+            PropertySlot slot;
+            slot.setCustom(this, namedItemGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+    }
+    
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!impl()->frame())
@@ -306,6 +474,14 @@ void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyN
     Base::getPropertyNames(exec, propertyNames);
 }
 
+void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    // Only allow the window to enumerated by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return;
+    Base::getOwnPropertyNames(exec, propertyNames);
+}
+
 bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
     // Only allow getting property attributes properties by frames in the same origin.
@@ -314,7 +490,7 @@ bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& prope
     return Base::getPropertyAttributes(exec, propertyName, attributes);
 }
 
-void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     // Only allow defining getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -324,15 +500,23 @@ void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName,
     if (propertyName == "location")
         return;
 
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
-void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
     // Only allow defining setters by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::defineSetter(exec, propertyName, setterFunction);
+    Base::defineSetter(exec, propertyName, setterFunction, attributes);
+}
+
+bool JSDOMWindow::defineOwnProperty(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    // Only allow defining properties in this way by frames in the same origin, as it allows setters to be introduced.
+    if (!allowsAccessFrom(exec))
+        return false;
+    return Base::defineOwnProperty(exec, propertyName, descriptor, shouldThrow);
 }
 
 JSValue JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
@@ -398,16 +582,16 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    if (!shouldAllowNavigation(exec, frame))
-        return;
-
     KURL url = completeURL(exec, value.toString(exec));
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(exec, frame))
+        return;
+
     if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
-        frame->loader()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
     }
 }
 
@@ -424,6 +608,13 @@ JSValue JSDOMWindow::event(ExecState* exec) const
     return toJS(exec, event);
 }
 
+#if ENABLE(EVENTSOURCE)
+JSValue JSDOMWindow::eventSource(ExecState* exec) const
+{
+    return getDOMConstructor<JSEventSourceConstructor>(exec, this);
+}
+#endif
+
 JSValue JSDOMWindow::image(ExecState* exec) const
 {
     return getDOMConstructor<JSImageConstructor>(exec, this);
@@ -453,6 +644,48 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
     return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec, this);
 }
  
+#if ENABLE(3D_CANVAS)
+JSValue JSDOMWindow::canvasArrayBuffer(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasArrayBufferConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasByteArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasByteArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedByteArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedByteArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasIntArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasIntArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedIntArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedIntArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasShortArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasShortArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedShortArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedShortArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasFloatArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasFloatArrayConstructor>(exec, this);
+}
+#endif
+ 
 JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -482,7 +715,24 @@ JSValue JSDOMWindow::worker(ExecState* exec) const
 #if ENABLE(SHARED_WORKERS)
 JSValue JSDOMWindow::sharedWorker(ExecState* exec) const
 {
-    return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+    if (SharedWorkerRepository::isAvailable())
+        return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+JSValue JSDOMWindow::webSocket(ExecState* exec) const
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    Settings* settings = frame->settings();
+    if (!settings)
+        return jsUndefined();
+    if (!settings->experimentalWebSocketsEnabled())
+        return jsUndefined();
+    return getDOMConstructor<JSWebSocketConstructor>(exec, this);
 }
 #endif
 
@@ -521,7 +771,7 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         return 0;
 
     newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
+    newFrame->page()->setOpenedByDOM();
 
     JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
 
@@ -529,13 +779,13 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
 
     if (!protocolIsJavaScript(url) || newWindow->allowsAccessFrom(exec)) {
-        KURL completedURL = url.isEmpty() ? KURL("") : completeURL(exec, url);
+        KURL completedURL = url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(exec, url);
         bool userGesture = processingUserGesture(exec);
 
         if (created)
             newFrame->loader()->changeLocation(completedURL, referrer, false, false, userGesture);
         else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            newFrame->redirectScheduler()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
     }
 
     return newFrame;
@@ -543,6 +793,10 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
 
 JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 {
+    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
+    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
+
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
@@ -555,9 +809,6 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
     Page* page = frame->page();
 
-    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
-    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
-
     // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
     // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
     if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
@@ -575,13 +826,13 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
         topOrParent = true;
     }
     if (topOrParent) {
-        if (!shouldAllowNavigation(exec, frame))
-            return jsUndefined();
-
         String completedURL;
         if (!urlString.isEmpty())
             completedURL = completeURL(exec, urlString).string();
 
+        if (!shouldAllowNavigation(exec, frame))
+            return jsUndefined();
+
         const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
         if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
             bool userGesture = processingUserGesture(exec);
@@ -591,13 +842,12 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
             // here.
             String referrer = dynamicFrame->loader()->outgoingReferrer();
 
-            frame->loader()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            frame->redirectScheduler()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
         }
         return toJS(exec, frame->domWindow());
     }
 
     // In the case of a named frame or a new window, we'll use the createWindow() helper
-    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
     FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
                          windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
     DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
@@ -617,6 +867,10 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
 {
+    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    JSValue dialogArgs = args.at(1);
+    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
@@ -630,10 +884,6 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
         return jsUndefined();
 
-    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
-    JSValue dialogArgs = args.at(1);
-    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
-
     HashMap<String, String> features;
     DOMWindow::parseModalDialogFeatures(featureArgs, features);
 
@@ -687,7 +937,15 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
     dialogFrame->page()->chrome()->runModal();
 
-    return dialogWindow->getDirect(Identifier(exec, "returnValue"));
+    Identifier returnValue(exec, "returnValue");
+    if (dialogWindow->allowsAccessFromNoErrorMessage(exec)) {
+        PropertySlot slot;
+        // This is safe, we have already performed the origin security check and we are
+        // not interested in any of the DOM properties of the window.
+        if (dialogWindow->JSGlobalObject::getOwnPropertySlot(exec, returnValue, slot))
+            return slot.getValue(exec, returnValue);
+    }
+    return jsUndefined();
 }
 
 JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
@@ -695,19 +953,23 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
     DOMWindow* window = impl();
 
     DOMWindow* source = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
-    String message = args.at(0).toString(exec);
+    PassRefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, args.at(0));
 
     if (exec->hadException())
         return jsUndefined();
 
-    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(1));
+    MessagePortArray messagePorts;
+    if (args.size() > 2)
+        fillMessagePortArray(exec, args.at(1), messagePorts);
+    if (exec->hadException())
+        return jsUndefined();
 
     String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at((args.size() == 2) ? 1 : 2));
     if (exec->hadException())
         return jsUndefined();
 
     ExceptionCode ec = 0;
-    window->postMessage(message, messagePort, targetOrigin, source, ec);
+    window->postMessage(message, &messagePorts, targetOrigin, source, ec);
     setDOMException(exec, ec);
 
     return jsUndefined();
@@ -788,9 +1050,11 @@ JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(AtomicString(args.at(0).toString(exec)), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -800,9 +1064,11 @@ JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (JSEventListener* listener = findJSEventListener(args.at(1)))
-        impl()->removeEventListener(AtomicString(args.at(0).toString(exec)), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSDOMWindowShell.cpp b/WebCore/bindings/js/JSDOMWindowShell.cpp
index efffd42..3c3ff4c 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -88,6 +88,11 @@ bool JSDOMWindowShell::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return m_window->getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSDOMWindowShell::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return m_window->getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     m_window->put(exec, propertyName, value, slot);
@@ -98,6 +103,11 @@ void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& prop
     m_window->putWithAttributes(exec, propertyName, value, attributes);
 }
 
+bool JSDOMWindowShell::defineOwnProperty(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    return m_window->defineOwnProperty(exec, propertyName, descriptor, shouldThrow);
+}
+
 bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->deleteProperty(exec, propertyName);
@@ -108,19 +118,24 @@ void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& prop
     m_window->getPropertyNames(exec, propertyNames);
 }
 
+void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    m_window->getOwnPropertyNames(exec, propertyNames);
+}
+
 bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
     return m_window->getPropertyAttributes(exec, propertyName, attributes);
 }
 
-void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
-    m_window->defineGetter(exec, propertyName, getterFunction);
+    m_window->defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
-void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
-    m_window->defineSetter(exec, propertyName, setterFunction);
+    m_window->defineSetter(exec, propertyName, setterFunction, attributes);
 }
 
 JSValue JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
diff --git a/WebCore/bindings/js/JSDOMWindowShell.h b/WebCore/bindings/js/JSDOMWindowShell.h
index 0506283..23af340 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/WebCore/bindings/js/JSDOMWindowShell.h
@@ -67,13 +67,16 @@ namespace WebCore {
         virtual void markChildren(JSC::MarkStack&);
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
-        virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
-        virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
+        virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
+        virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
         virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSObject* unwrappedObject();
diff --git a/WebCore/bindings/js/JSDatabaseCustom.cpp b/WebCore/bindings/js/JSDatabaseCustom.cpp
index af3b066..0932cca 100644
--- a/WebCore/bindings/js/JSDatabaseCustom.cpp
+++ b/WebCore/bindings/js/JSDatabaseCustom.cpp
@@ -52,17 +52,13 @@ JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     String oldVersion = args.at(0).toString(exec);
     String newVersion = args.at(1).toString(exec);
 
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    
     JSObject* object;
     if (!(object = args.at(2).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }
     
-    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject())));
     
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     if (!args.at(3).isNull()) {
@@ -71,24 +67,25 @@ JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     RefPtr<VoidCallback> successCallback;
     if (!args.at(4).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(4));
-        if (!successCallback) {
+        if (!(object = args.at(4).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
+
+        successCallback = JSCustomVoidCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
-    
+
     m_impl->changeVersion(oldVersion, newVersion, callback.release(), errorCallback.release(), successCallback.release());
     
     return jsUndefined();
 }
 
-JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
+static JSValue createTransaction(ExecState* exec, const ArgList& args, Database* database, JSDOMGlobalObject* globalObject, bool readOnly)
 {
     JSObject* object;
     
@@ -96,12 +93,8 @@ JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }        
- 
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    
-    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+     
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, globalObject));
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     
     if (args.size() > 1 && !args.at(1).isNull()) {
@@ -110,22 +103,33 @@ JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
 
-        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, globalObject);
     }
 
     RefPtr<VoidCallback> successCallback;
     if (args.size() > 2 && !args.at(2).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(2));
-        if (!successCallback) {
+        if (!(object = args.at(2).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
+
+        successCallback = JSCustomVoidCallback::create(object, globalObject);
     }
     
-    m_impl->transaction(callback.release(), errorCallback.release(), successCallback.release());
-
+    database->transaction(callback.release(), errorCallback.release(), successCallback.release(), readOnly);
     return jsUndefined();
 }
+
+JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
+{
+    return createTransaction(exec, args, m_impl.get(), static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()), false);
+}
     
+JSValue JSDatabase::readTransaction(ExecState* exec, const ArgList& args)
+{
+    return createTransaction(exec, args, m_impl.get(), static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()), true);
+}
+
 }
+
 #endif // ENABLE(DATABASE)
diff --git a/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp b/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
index 657f9b3..fbee5ef 100644
--- a/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
+++ b/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
@@ -35,15 +35,16 @@
 
 #include "JSDedicatedWorkerContext.h"
 
+#include "JSDOMBinding.h"
+#include "JSMessagePortCustom.h"
+
 using namespace JSC;
 
 namespace WebCore {
 
-void JSDedicatedWorkerContext::markChildren(MarkStack& markStack)
+JSC::JSValue JSDedicatedWorkerContext::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
 {
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, impl()->onmessage());
+    return handlePostMessage(exec, args, impl());
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp b/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
new file mode 100644
index 0000000..493d7bd
--- /dev/null
+++ b/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "Document.h"
+#include "JSCustomVoidCallback.h"
+#include "JSEventListener.h"
+#include "JSNotification.h"
+#include "JSNotificationCenter.h"
+#include "Notification.h"
+#include "NotificationCenter.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSNotificationCenter::requestPermission(ExecState* exec, const ArgList& args)
+{
+    // Permission request is only valid from page context.
+    ScriptExecutionContext* context = impl()->context();
+    if (context->isWorkerContext())
+        return throwError(exec, SyntaxError);
+
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError);
+
+    PassRefPtr<JSCustomVoidCallback> callback = JSCustomVoidCallback::create(args.at(0).getObject(), static_cast<Document*>(context)->frame());
+
+    impl()->requestPermission(callback);
+    return jsUndefined();
+}
+
+JSValue JSNotification::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), globalObject, false), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSNotification::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+
+} // namespace
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/WebCore/bindings/js/JSDocumentCustom.cpp b/WebCore/bindings/js/JSDocumentCustom.cpp
index 39a1fc5..d7f8725 100644
--- a/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -24,6 +24,10 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasRenderingContext3D.h"
+#endif
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
 #include "JSLocation.h"
@@ -35,6 +39,8 @@
 #include "SVGDocument.h"
 #endif
 
+#include <wtf/GetPtr.h>
+
 using namespace JSC;
 
 namespace WebCore {
@@ -42,8 +48,14 @@ namespace WebCore {
 void JSDocument::markChildren(MarkStack& markStack)
 {
     JSNode::markChildren(markStack);
-    markDOMNodesForDocument(markStack, impl());
-    markActiveObjectsForContext(markStack, *Heap::heap(this)->globalData(), impl());
+
+    Document* document = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMNodesForDocument(markStack, document);
+    markActiveObjectsForContext(markStack, globalData, document);
+    markDOMObjectWrapper(markStack, globalData, document->implementation());
+    markDOMObjectWrapper(markStack, globalData, document->styleSheets());
 }
 
 JSValue JSDocument::location(ExecState* exec) const
@@ -76,7 +88,7 @@ void JSDocument::setLocation(ExecState* exec, JSValue value)
         str = activeFrame->document()->completeURL(str).string();
 
     bool userGesture = activeFrame->script()->processingUserGesture();
-    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+    frame->redirectScheduler()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
 JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* document)
diff --git a/WebCore/bindings/js/JSElementCustom.cpp b/WebCore/bindings/js/JSElementCustom.cpp
index 47793d0..fb64ff2 100644
--- a/WebCore/bindings/js/JSElementCustom.cpp
+++ b/WebCore/bindings/js/JSElementCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,15 +51,27 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+void JSElement::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    Element* element = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(markStack, globalData, element->attributeMap());
+    if (element->isStyledElement())
+        markDOMObjectWrapper(markStack, globalData, static_cast<StyledElement*>(element)->inlineStyleDecl());
+}
+
 static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
 {
     if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(deprecatedParseURL(value))) {
-        HTMLFrameElementBase* frame = static_cast<HTMLFrameElementBase*>(element);
-        if (!checkNodeSecurity(exec, frame->contentDocument()))
+        Document* contentDocument = static_cast<HTMLFrameElementBase*>(element)->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
     }
     return true;
-} 
+}
 
 JSValue JSElement::setAttribute(ExecState* exec, const ArgList& args)
 {
diff --git a/WebCore/bindings/js/JSEventCustom.cpp b/WebCore/bindings/js/JSEventCustom.cpp
index 804c529..c64ddc9 100644
--- a/WebCore/bindings/js/JSEventCustom.cpp
+++ b/WebCore/bindings/js/JSEventCustom.cpp
@@ -38,6 +38,7 @@
 #include "JSMouseEvent.h"
 #include "JSMutationEvent.h"
 #include "JSOverflowEvent.h"
+#include "JSPageTransitionEvent.h"
 #include "JSProgressEvent.h"
 #include "JSTextEvent.h"
 #include "JSUIEvent.h"
@@ -51,6 +52,7 @@
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "OverflowEvent.h"
+#include "PageTransitionEvent.h"
 #include "ProgressEvent.h"
 #include "TextEvent.h"
 #include "UIEvent.h"
@@ -120,6 +122,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, OverflowEvent, event);
     else if (event->isMessageEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, MessageEvent, event);
+    else if (event->isPageTransitionEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PageTransitionEvent, event);
     else if (event->isProgressEvent()) {
         if (event->isXMLHttpRequestProgressEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, XMLHttpRequestProgressEvent, event);
diff --git a/WebCore/bindings/js/JSEventListener.cpp b/WebCore/bindings/js/JSEventListener.cpp
index 42e0281..4f273fe 100644
--- a/WebCore/bindings/js/JSEventListener.cpp
+++ b/WebCore/bindings/js/JSEventListener.cpp
@@ -31,22 +31,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSEventListener::JSEventListener(JSObject* function, JSDOMGlobalObject* globalObject, bool isAttribute)
-    : m_jsFunction(function)
-    , m_globalObject(globalObject)
+JSEventListener::JSEventListener(JSObject* function, bool isAttribute)
+    : EventListener(JSEventListenerType)
+    , m_jsFunction(function)
     , m_isAttribute(isAttribute)
 {
-    if (!m_isAttribute && m_jsFunction)
-        globalObject->jsEventListeners().set(m_jsFunction, this);
 }
 
 JSEventListener::~JSEventListener()
 {
-    if (!m_isAttribute && m_jsFunction && m_globalObject)
-        m_globalObject->jsEventListeners().remove(m_jsFunction);
 }
 
-JSObject* JSEventListener::jsFunction() const
+JSObject* JSEventListener::jsFunction(ScriptExecutionContext*) const
 {
     return m_jsFunction;
 }
@@ -55,30 +51,24 @@ void JSEventListener::markJSFunction(MarkStack& markStack)
 {
     if (m_jsFunction)
         markStack.append(m_jsFunction);
-    if (m_globalObject)
-        markStack.append(m_globalObject);
 }
 
-void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
+void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext, Event* event)
 {
+    ASSERT(scriptExecutionContext);
+    if (!scriptExecutionContext)
+        return;
+
     JSLock lock(SilenceAssertionsOnly);
 
-    JSObject* jsFunction = this->jsFunction();
+    JSObject* jsFunction = this->jsFunction(scriptExecutionContext);
     if (!jsFunction)
         return;
 
-    JSDOMGlobalObject* globalObject = m_globalObject;
-    // Null check as clearGlobalObject() can clear this and we still get called back by
-    // xmlhttprequest objects. See http://bugs.webkit.org/show_bug.cgi?id=13275
-    // FIXME: Is this check still necessary? Requests are supposed to be stopped before clearGlobalObject() is called.
-    ASSERT(globalObject);
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(scriptExecutionContext);
     if (!globalObject)
         return;
 
-    ScriptExecutionContext* scriptExecutionContext = globalObject->scriptExecutionContext();
-    if (!scriptExecutionContext)
-        return;
-
     if (scriptExecutionContext->isDocument()) {
         JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
         Frame* frame = window->impl()->frame();
@@ -113,26 +103,14 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
         Event* savedEvent = globalObject->currentEvent();
         globalObject->setCurrentEvent(event);
 
-        // If this event handler is the first JavaScript to execute, then the
-        // dynamic global object should be set to the global object of the
-        // window in which the event occurred.
         JSGlobalData* globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);
 
-        JSValue retval;
-        if (handleEventFunction) {
-            globalObject->globalData()->timeoutChecker.start();
-            retval = call(exec, handleEventFunction, callType, callData, jsFunction, args);
-        } else {
-            JSValue thisValue;
-            if (isWindowEvent)
-                thisValue = globalObject->toThisObject(exec);
-            else
-                thisValue = toJS(exec, globalObject, event->currentTarget());
-            globalObject->globalData()->timeoutChecker.start();
-            retval = call(exec, jsFunction, callType, callData, thisValue, args);
-        }
-        globalObject->globalData()->timeoutChecker.stop();
+        globalData->timeoutChecker.start();
+        JSValue retval = handleEventFunction
+            ? call(exec, handleEventFunction, callType, callData, jsFunction, args)
+            : call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
+        globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
 
@@ -154,18 +132,15 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
     }
 }
 
-bool JSEventListener::reportError(const String& message, const String& url, int lineNumber)
+bool JSEventListener::reportError(ScriptExecutionContext* context, const String& message, const String& url, int lineNumber)
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    JSObject* jsFunction = this->jsFunction();
+    JSObject* jsFunction = this->jsFunction(context);
     if (!jsFunction)
         return false;
 
-    JSDOMGlobalObject* globalObject = m_globalObject;
-    if (!globalObject)
-        return false;
-
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(context);
     ExecState* exec = globalObject->globalExec();
 
     CallData callData;
@@ -179,17 +154,14 @@ bool JSEventListener::reportError(const String& message, const String& url, int
     args.append(jsString(exec, url));
     args.append(jsNumber(exec, lineNumber));
 
-    // If this event handler is the first JavaScript to execute, then the
-    // dynamic global object should be set to the global object of the
-    // window in which the event occurred.
     JSGlobalData* globalData = globalObject->globalData();
     DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);    
 
     JSValue thisValue = globalObject->toThisObject(exec);
 
-    globalObject->globalData()->timeoutChecker.start();
+    globalData->timeoutChecker.start();
     JSValue returnValue = call(exec, jsFunction, callType, callData, thisValue, args);
-    globalObject->globalData()->timeoutChecker.stop();
+    globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
     if (exec->hadException()) {
@@ -206,4 +178,11 @@ bool JSEventListener::virtualisAttribute() const
     return m_isAttribute;
 }
 
+bool JSEventListener::operator==(const EventListener& listener)
+{
+    if (const JSEventListener* jsEventListener = JSEventListener::cast(&listener))
+        return m_jsFunction == jsEventListener->m_jsFunction && m_isAttribute == jsEventListener->m_isAttribute;
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSEventListener.h b/WebCore/bindings/js/JSEventListener.h
index 7929169..285a9c4 100644
--- a/WebCore/bindings/js/JSEventListener.h
+++ b/WebCore/bindings/js/JSEventListener.h
@@ -30,30 +30,38 @@ namespace WebCore {
 
     class JSEventListener : public EventListener {
     public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isAttribute)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, bool isAttribute)
         {
-            return adoptRef(new JSEventListener(listener, globalObject, isAttribute));
+            return adoptRef(new JSEventListener(listener, isAttribute));
         }
+
+        static const JSEventListener* cast(const EventListener* listener)
+        {
+            return listener->type() == JSEventListenerType
+                ? static_cast<const JSEventListener*>(listener)
+                : 0;
+        }
+
         virtual ~JSEventListener();
-        void clearGlobalObject() { m_globalObject = 0; }
+
+        virtual bool operator==(const EventListener& other);
 
         // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
         bool isAttribute() const { return m_isAttribute; }
 
-        virtual JSC::JSObject* jsFunction() const;
+        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
 
     private:
         virtual void markJSFunction(JSC::MarkStack&);
-        virtual void handleEvent(Event*, bool isWindowEvent);
-        virtual bool reportError(const String& message, const String& url, int lineNumber);
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
+        virtual bool reportError(ScriptExecutionContext*, const String& message, const String& url, int lineNumber);
         virtual bool virtualisAttribute() const;
         void clearJSFunctionInline();
 
     protected:
-        JSEventListener(JSC::JSObject* function, JSDOMGlobalObject*, bool isAttribute);
+        JSEventListener(JSC::JSObject* function, bool isAttribute);
 
         mutable JSC::JSObject* m_jsFunction;
-        JSDOMGlobalObject* m_globalObject;
         bool m_isAttribute;
     };
 
diff --git a/WebCore/bindings/js/JSEventSourceConstructor.cpp b/WebCore/bindings/js/JSEventSourceConstructor.cpp
new file mode 100644
index 0000000..c6e4825
--- /dev/null
+++ b/WebCore/bindings/js/JSEventSourceConstructor.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSourceConstructor.h"
+
+#include "EventSource.h"
+#include "ExceptionCode.h"
+#include "JSEventSource.h"
+#include "ScriptExecutionContext.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSEventSourceConstructor);
+
+const ClassInfo JSEventSourceConstructor::s_info = { "EventSourceContructor", 0, 0, 0 };
+
+JSEventSourceConstructor::JSEventSourceConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSEventSourceConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSEventSourcePrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructEventSource(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    UString url = args.at(0).toString(exec);
+    if (exec->hadException())
+        return 0;
+
+    JSEventSourceConstructor* jsConstructor =  static_cast<JSEventSourceConstructor*>(constructor);
+    ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "EventSource constructor associated document is unavailable");
+
+    ExceptionCode ec = 0;
+    RefPtr<EventSource> eventSource = EventSource::create(url, context, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return 0;
+    }
+
+    return asObject(toJS(exec, jsConstructor->globalObject(), eventSource.release()));
+}
+
+ConstructType JSEventSourceConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructEventSource;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/WebCore/bindings/js/JSEventSourceConstructor.h b/WebCore/bindings/js/JSEventSourceConstructor.h
new file mode 100644
index 0000000..b2f3cb5
--- /dev/null
+++ b/WebCore/bindings/js/JSEventSourceConstructor.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSEventSourceConstructor_h
+#define JSEventSourceConstructor_h
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class JSEventSourceConstructor : public DOMConstructorObject {
+    public:
+        JSEventSourceConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
+
+#endif // JSEventSourceConstructor_h
diff --git a/WebCore/bindings/js/JSEventSourceCustom.cpp b/WebCore/bindings/js/JSEventSourceCustom.cpp
new file mode 100644
index 0000000..404bf11
--- /dev/null
+++ b/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSource.h"
+
+#include "EventSource.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEventListener.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/WebCore/bindings/js/JSEventTarget.cpp b/WebCore/bindings/js/JSEventTarget.cpp
index c34e10e..0421d10 100644
--- a/WebCore/bindings/js/JSEventTarget.cpp
+++ b/WebCore/bindings/js/JSEventTarget.cpp
@@ -33,16 +33,29 @@
 #include "JSEventListener.h"
 #include "JSMessagePort.h"
 #include "JSNode.h"
+#if ENABLE(SHARED_WORKERS)
+
 #include "JSSharedWorker.h"
 #include "JSSharedWorkerContext.h"
+#endif
+
 #include "JSXMLHttpRequest.h"
 #include "JSXMLHttpRequestUpload.h"
 #include "MessagePort.h"
+
+#if ENABLE(SHARED_WORKERS)
 #include "SharedWorker.h"
 #include "SharedWorkerContext.h"
+#endif
+
 #include "XMLHttpRequest.h"
 #include "XMLHttpRequestUpload.h"
 
+#if ENABLE(EVENTSOURCE)
+#include "EventSource.h"
+#include "JSEventSource.h"
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 #include "DOMApplicationCache.h"
 #include "JSDOMApplicationCache.h"
@@ -60,6 +73,16 @@
 #include "Worker.h"
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+#include "JSNotification.h"
+#include "Notification.h"
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+#include "JSWebSocket.h"
+#include "WebSocket.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -69,6 +92,11 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
     if (!target)
         return jsNull();
     
+#if ENABLE(EVENTSOURCE)
+    if (EventSource* eventSource = target->toEventSource())
+        return toJS(exec, globalObject, eventSource);
+#endif
+
 #if ENABLE(SVG)
     // SVGElementInstance supports both toSVGElementInstance and toNode since so much mouse handling code depends on toNode returning a valid node.
     if (SVGElementInstance* instance = target->toSVGElementInstance())
@@ -111,6 +139,16 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
         return toJSDOMGlobalObject(workerContext);
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    if (Notification* notification = target->toNotification())
+        return toJS(exec, notification);
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    if (WebSocket* webSocket = target->toWebSocket())
+        return toJS(exec, webSocket);
+#endif
+
     ASSERT_NOT_REACHED();
     return jsNull();
 }
@@ -118,7 +156,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
 EventTarget* toEventTarget(JSC::JSValue value)
 {
     #define CONVERT_TO_EVENT_TARGET(type) \
-        if (value.isObject(&JS##type::s_info)) \
+        if (value.inherits(&JS##type::s_info)) \
             return static_cast<JS##type*>(asObject(value))->impl();
 
     CONVERT_TO_EVENT_TARGET(Node)
@@ -126,9 +164,13 @@ EventTarget* toEventTarget(JSC::JSValue value)
     CONVERT_TO_EVENT_TARGET(XMLHttpRequestUpload)
     CONVERT_TO_EVENT_TARGET(MessagePort)
 
-    if (value.isObject(&JSDOMWindowShell::s_info))
+    if (value.inherits(&JSDOMWindowShell::s_info))
         return static_cast<JSDOMWindowShell*>(asObject(value))->impl();
 
+#if ENABLE(EVENTSOURCE)
+    CONVERT_TO_EVENT_TARGET(EventSource)
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     CONVERT_TO_EVENT_TARGET(DOMApplicationCache)
 #endif
@@ -147,6 +189,14 @@ EventTarget* toEventTarget(JSC::JSValue value)
     CONVERT_TO_EVENT_TARGET(SharedWorkerContext)
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    CONVERT_TO_EVENT_TARGET(Notification)
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    CONVERT_TO_EVENT_TARGET(WebSocket)
+#endif
+
     return 0;
 }
 
diff --git a/WebCore/bindings/js/JSGeolocationCustom.cpp b/WebCore/bindings/js/JSGeolocationCustom.cpp
index 280fd2f..23a4c00 100644
--- a/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -41,34 +41,58 @@ using namespace std;
 
 namespace WebCore {
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
 static PassRefPtr<PositionCallback> createPositionCallback(ExecState* exec, JSValue value)
+=======
+static PassRefPtr<PositionCallback> createPositionCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 {
     // The spec specifies 'FunctionOnly' for this object.
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (!value.isObject(&InternalFunction::info)) {
+=======
+    if (!value.inherits(&InternalFunction::info)) {
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
     }
 
     JSObject* object = asObject(value);
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame();
     return JSCustomPositionCallback::create(object, frame);
+=======
+    return JSCustomPositionCallback::create(object, globalObject);
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 }
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
 static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(ExecState* exec, JSValue value)
+=======
+static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 {
     // Argument is optional (hence undefined is allowed), and null is allowed.
     if (value.isUndefinedOrNull())
         return 0;
 
     // The spec specifies 'FunctionOnly' for this object.
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (!value.isObject(&InternalFunction::info)) {
+=======
+    if (!value.inherits(&InternalFunction::info)) {
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
     }
 
     JSObject* object = asObject(value);
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame();
     return JSCustomPositionErrorCallback::create(object, frame);
+=======
+    return JSCustomPositionErrorCallback::create(object, globalObject);
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 }
 
 static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
@@ -139,12 +163,20 @@ JSValue JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, args.at(0));
+=======
+    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(0));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
     ASSERT(positionCallback);
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, args.at(1));
+=======
+    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(1));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
 
@@ -161,12 +193,20 @@ JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, args.at(0));
+=======
+    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(0));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
     ASSERT(positionCallback);
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, args.at(1));
+=======
+    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(1));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
 
diff --git a/WebCore/bindings/js/JSHTMLAllCollection.h b/WebCore/bindings/js/JSHTMLAllCollection.h
index 7363e5c..e6fe7f5 100644
--- a/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/WebCore/bindings/js/JSHTMLAllCollection.h
@@ -35,7 +35,7 @@ namespace WebCore {
 
     class JSHTMLAllCollection : public JSHTMLCollection {
     public:
-        JSHTMLAllCollection(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLCollection> collection)
+        JSHTMLAllCollection(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLCollection> collection)
             : JSHTMLCollection(structure, globalObject, collection)
         {
         }
diff --git a/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index 37561af..30892e0 100644
--- a/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLAppletElement::getOwnPropertySlotDelegate(ExecState* exec, const Iden
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLAppletElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLAppletElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
new file mode 100644
index 0000000..8ecd287
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLCanvasElement.h"
+
+#include "HTMLCanvasElement.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasRenderingContext3D.h"
+#endif
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSHTMLCanvasElement::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(impl());
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(markStack, globalData, canvas->renderingContext());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index dd9af74..8ffddf7 100644
--- a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -23,12 +23,13 @@
 #include "AtomicString.h"
 #include "HTMLCollection.h"
 #include "HTMLOptionsCollection.h"
+#include "JSDOMBinding.h"
 #include "JSHTMLAllCollection.h"
 #include "JSHTMLOptionsCollection.h"
-#include "JSNamedNodesCollection.h"
 #include "JSNode.h"
+#include "JSNodeList.h"
 #include "Node.h"
-#include "JSDOMBinding.h"
+#include "StaticNodeList.h"
 #include <wtf/Vector.h>
 
 using namespace JSC;
@@ -42,11 +43,13 @@ static JSValue getNamedItems(ExecState* exec, JSHTMLCollection* collection, cons
 
     if (namedItems.isEmpty())
         return jsUndefined();
-
     if (namedItems.size() == 1)
         return toJS(exec, collection->globalObject(), namedItems[0].get());
 
-    return new (exec) JSNamedNodesCollection(exec, collection->globalObject(), namedItems);
+    // FIXME: HTML5 specifies that this should be a DynamicNodeList.
+    // FIXME: HTML5 specifies that non-HTMLOptionsCollection collections should return
+    // the first matching item instead of a NodeList.
+    return toJS(exec, collection->globalObject(), StaticNodeList::adopt(namedItems).get());
 }
 
 // HTMLCollections are strange objects, they support both get and call,
diff --git a/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 2570bc6..bce3ffb 100644
--- a/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLEmbedElement::getOwnPropertySlotDelegate(ExecState* exec, const Ident
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLEmbedElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index ffa2d57..de9ec4a 100644
--- a/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -30,7 +30,8 @@
 #include "HTMLCollection.h"
 #include "HTMLFormElement.h"
 #include "JSDOMWindowCustom.h"
-#include "JSNamedNodesCollection.h"
+#include "JSNodeList.h"
+#include "StaticNodeList.h"
 
 using namespace JSC;
 
@@ -47,15 +48,17 @@ JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propert
 {
     JSHTMLElement* jsForm = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
     HTMLFormElement* form = static_cast<HTMLFormElement*>(jsForm->impl());
-    
+
     Vector<RefPtr<Node> > namedItems;
     form->getNamedElements(propertyName, namedItems);
     
+    if (namedItems.isEmpty())
+        return jsUndefined();
     if (namedItems.size() == 1)
         return toJS(exec, namedItems[0].get());
-    if (namedItems.size() > 1) 
-        return new (exec) JSNamedNodesCollection(exec, jsForm->globalObject(), namedItems);
-    return jsUndefined();
+
+    // FIXME: HTML5 specifies that this should be a RadioNodeList.
+    return toJS(exec, jsForm->globalObject(), StaticNodeList::adopt(namedItems).get());
 }
 
 JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
diff --git a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index c8aea9f..6e01513 100644
--- a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -32,16 +32,20 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
 {
     if (protocolIsJavaScript(deprecatedParseURL(value))) {
-        if (!checkNodeSecurity(exec, imp->contentDocument()))
+        Document* contentDocument = imp->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
     }
     return true;
@@ -55,8 +59,7 @@ void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue value)
     if (!allowSettingJavascriptURL(exec, imp, srcValue))
         return;
 
-    imp->setSrc(srcValue);
-    return;
+    imp->setAttribute(srcAttr, srcValue);
 }
 
 void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
@@ -68,7 +71,6 @@ void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
         return;
 
     imp->setLocation(locationValue);
-    return;
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
index 8e32381..60ea45e 100644
--- a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
@@ -32,12 +32,15 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLIFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
@@ -45,11 +48,12 @@ void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
     String srcValue = valueToStringWithNullCheck(exec, value);
 
     if (protocolIsJavaScript(deprecatedParseURL(srcValue))) {
-        if (!checkNodeSecurity(exec, imp->contentDocument()))
+        Document* contentDocument = imp->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return;
     }
 
-    imp->setSrc(srcValue);
+    imp->setAttribute(srcAttr, srcValue);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
index 6b47622..e5166ee 100644
--- a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -29,6 +29,7 @@
 #include "Document.h"
 #include "HTMLInputElement.h"
 #include "Settings.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index a99e46c..1bfb51f 100644
--- a/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLObjectElement::getOwnPropertySlotDelegate(ExecState* exec, const Iden
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLObjectElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLObjectElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/WebCore/bindings/js/JSHistoryCustom.cpp b/WebCore/bindings/js/JSHistoryCustom.cpp
index a3b15e1..b24b1ff 100644
--- a/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -31,6 +31,7 @@
 
 #include "Frame.h"
 #include "History.h"
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
@@ -92,6 +93,52 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
     return true;
 }
 
+bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // When accessing History cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
+    
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, impl()->frame(), message))
+        return false;
+    
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        // Allow access to back(), forward() and go() from any frame.
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsHistoryPrototypeFunctionBack) {
+                slot.setCustom(this, nonCachingStaticBackFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionForward) {
+                slot.setCustom(this, nonCachingStaticForwardFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionGo) {
+                slot.setCustom(this, nonCachingStaticGoFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            PropertySlot slot;
+            slot.setCustom(this, objectToStringFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        }
+    }
+    
+    printErrorMessageForFrame(impl()->frame(), message);
+    descriptor.setUndefined();
+    return true;
+}
+
 bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
@@ -108,12 +155,12 @@ bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSHistory::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the history object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSImageConstructor.cpp b/WebCore/bindings/js/JSImageConstructor.cpp
index faaaf41..0f4a991 100644
--- a/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/WebCore/bindings/js/JSImageConstructor.cpp
@@ -25,6 +25,7 @@
 #include "JSHTMLImageElement.h"
 #include "JSNode.h"
 #include "ScriptExecutionContext.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index fff7aee..ed79427 100644
--- a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSInspectedObjectWrapper.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectorCallbackWrapper.h"
 #include <runtime/JSGlobalObject.h>
 #include <wtf/StdLibExtras.h>
@@ -69,7 +71,7 @@ JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrapp
     return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
 }
 
-JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
+JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
     : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
 {
     WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
@@ -125,3 +127,5 @@ JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.h b/WebCore/bindings/js/JSInspectedObjectWrapper.h
index 201feb6..ad97035 100644
--- a/WebCore/bindings/js/JSInspectedObjectWrapper.h
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.h
@@ -38,7 +38,7 @@ namespace WebCore {
         static const JSC::ClassInfo s_info;
 
     private:
-        JSInspectedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
+        JSInspectedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual bool allowsGetProperty() const { return true; }
         virtual bool allowsSetProperty() const { return true; }
diff --git a/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/WebCore/bindings/js/JSInspectorBackendCustom.cpp
index b2eb2d1..73fa268 100644
--- a/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/WebCore/bindings/js/JSInspectorBackendCustom.cpp
@@ -33,6 +33,8 @@
 #include "config.h"
 #include "JSInspectorBackend.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "Console.h"
 #if ENABLE(DATABASE)
 #include "Database.h"
@@ -51,6 +53,10 @@
 #include "JSRange.h"
 #include "Node.h"
 #include "Page.h"
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#include "JSStorage.h"
+#endif
 #include "TextIterator.h"
 #include "VisiblePosition.h"
 #include <runtime/JSArray.h>
@@ -70,21 +76,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState*, const JSC::ArgList& args)
+JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Node* node = toNode(wrapper->unwrappedObject());
-    if (!node)
-        return jsUndefined();
-
-    impl()->highlight(node);
-
+    impl()->highlight(args.at(0).toInt32(exec));
     return jsUndefined();
 }
 
@@ -125,27 +122,20 @@ JSValue JSInspectorBackend::search(ExecState* exec, const ArgList& args)
 }
 
 #if ENABLE(DATABASE)
-JSValue JSInspectorBackend::databaseTableNames(ExecState* exec, const ArgList& args)
+JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
         return jsUndefined();
 
-    Database* database = toDatabase(wrapper->unwrappedObject());
+    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
     if (!database)
         return jsUndefined();
-
-    MarkedArgumentBuffer result;
-
-    Vector<String> tableNames = database->tableNames();
-    unsigned length = tableNames.size();
-    for (unsigned i = 0; i < length; ++i)
-        result.append(jsString(exec, tableNames[i]));
-
-    return constructArray(exec, result);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, database));
 }
 #endif
 
@@ -257,7 +247,7 @@ JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
         return jsUndefined();
 
     // FIXME: I am not sure if this is actually needed. Can we just use exec?
-    ExecState* globalExec = callFrame->scopeChain()->globalObject()->globalExec();
+    ExecState* globalExec = callFrame->scopeChain()->globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
     return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
@@ -280,4 +270,94 @@ JSValue JSInspectorBackend::profiles(JSC::ExecState* exec, const JSC::ArgList&)
 
 #endif
 
+JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
+    if (!node)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
+}
+
+JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    return impl()->wrapObject(ScriptValue(args.at(0)), args.at(1).toString(exec)).jsValue();
+}
+
+JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    return impl()->unwrapObject(args.at(0).toString(exec)).jsValue();
+}
+
+JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Node* node = toNode(wrapper->unwrappedObject());
+    if (!node)
+        return jsUndefined();
+
+    bool selectInUI = args.at(1).toBoolean(exec);
+    return jsNumber(exec, impl()->pushNodePathToFrontend(node, selectInUI));
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Database* database = toDatabase(wrapper->unwrappedObject());
+    if (database)
+        impl()->selectDatabase(database);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+JSValue JSInspectorBackend::selectDOMStorage(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Storage* storage = toStorage(wrapper->unwrappedObject());
+    if (storage)
+        impl()->selectDOMStorage(storage);
+    return jsUndefined();
+}
+#endif
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 0e14109..9c4330d 100644
--- a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSInspectorCallbackWrapper.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectedObjectWrapper.h"
 #include <wtf/StdLibExtras.h>
 
@@ -73,10 +75,10 @@ JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwra
         static Structure* structure = leakInspectorCallbackWrapperStructure();
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, asObject(wrap(unwrappedExec, prototype))->inheritorID());
+    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
 }
 
-JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
+JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
     : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
 {
     ASSERT(!wrappers().contains(unwrappedObject));
@@ -105,3 +107,5 @@ JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExe
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/WebCore/bindings/js/JSInspectorCallbackWrapper.h
index cfc2fb6..be28063 100644
--- a/WebCore/bindings/js/JSInspectorCallbackWrapper.h
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.h
@@ -40,7 +40,7 @@ namespace WebCore {
         static const JSC::ClassInfo s_info;
 
     protected:
-        JSInspectorCallbackWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
+        JSInspectorCallbackWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual bool allowsCallAsFunction() const { return true; }
 
diff --git a/WebCore/bindings/js/JSLazyEventListener.cpp b/WebCore/bindings/js/JSLazyEventListener.cpp
index 7caff2b..0d6cb57 100644
--- a/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -23,6 +23,7 @@
 #include "Frame.h"
 #include "JSNode.h"
 #include <runtime/FunctionConstructor.h>
+#include <runtime/JSFunction.h>
 #include <runtime/JSLock.h>
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -34,12 +35,13 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
 #endif
 
-JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
-    : JSEventListener(0, globalObject, true)
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber)
+    : JSEventListener(0, true)
     , m_functionName(functionName)
     , m_eventParameterName(eventParameterName)
     , m_code(code)
     , m_parsed(false)
+    , m_sourceURL(sourceURL)
     , m_lineNumber(lineNumber)
     , m_originalNode(node)
 {
@@ -66,23 +68,43 @@ JSLazyEventListener::~JSLazyEventListener()
 #endif
 }
 
-JSObject* JSLazyEventListener::jsFunction() const
+JSObject* JSLazyEventListener::jsFunction(ScriptExecutionContext* executionContext) const
 {
-    parseCode();
+    parseCode(executionContext);
     return m_jsFunction;
 }
 
-void JSLazyEventListener::parseCode() const
+void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) const
 {
+    ASSERT(executionContext);
+    ASSERT(executionContext->isDocument());
+    if (!executionContext)
+        return;
+
     if (m_parsed)
         return;
 
-    ScriptExecutionContext* executionContext = m_globalObject->scriptExecutionContext();
-    ASSERT(executionContext);
-    if (!executionContext)
+    Frame* frame = static_cast<Document*>(executionContext)->frame();
+    if (!frame)
         return;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return;
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext);
+    if (!globalObject)
+        return;
+
+    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
+    if (m_originalNode) {
+        JSLock lock(SilenceAssertionsOnly);
+        // FIXME: Should pass the global object associated with the node
+        toJS(globalObject->globalExec(), globalObject, m_originalNode);
+    }
+
     if (executionContext->isDocument()) {
-        JSDOMWindow* window = static_cast<JSDOMWindow*>(m_globalObject);
+        JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
         Frame* frame = window->impl()->frame();
         if (!frame)
             return;
@@ -94,16 +116,13 @@ void JSLazyEventListener::parseCode() const
 
     m_parsed = true;
 
-    ExecState* exec = m_globalObject->globalExec();
+    ExecState* exec = globalObject->globalExec();
 
     MarkedArgumentBuffer args;
-    UString sourceURL(executionContext->url().string());
     args.append(jsNontrivialString(exec, m_eventParameterName));
     args.append(jsString(exec, m_code));
 
-    // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
-    // have been added with setAttribute from a script, and we should pass String() in that case.
-    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
+    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), m_sourceURL, m_lineNumber); // FIXME: is globalExec ok?
 
     JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_jsFunction);
 
@@ -117,7 +136,7 @@ void JSLazyEventListener::parseCode() const
         // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
         ScopeChain scope = listenerAsFunction->scope();
 
-        JSValue thisObj = toJS(exec, m_globalObject, m_originalNode);
+        JSValue thisObj = toJS(exec, globalObject, m_originalNode);
         if (thisObj.isObject()) {
             static_cast<JSNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
             listenerAsFunction->setScope(scope);
@@ -128,6 +147,7 @@ void JSLazyEventListener::parseCode() const
     m_functionName = String();
     m_code = String();
     m_eventParameterName = String();
+    m_sourceURL = String();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSLazyEventListener.h b/WebCore/bindings/js/JSLazyEventListener.h
index a5304cf..e3137b8 100644
--- a/WebCore/bindings/js/JSLazyEventListener.h
+++ b/WebCore/bindings/js/JSLazyEventListener.h
@@ -29,24 +29,25 @@ namespace WebCore {
 
     class JSLazyEventListener : public JSEventListener {
     public:
-        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber)
         {
-            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, globalObject, node, lineNumber));
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber));
         }
         virtual ~JSLazyEventListener();
 
     private:
-        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber);
 
-        virtual JSC::JSObject* jsFunction() const;
+        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
         virtual bool wasCreatedFromMarkup() const { return true; }
 
-        void parseCode() const;
+        void parseCode(ScriptExecutionContext*) const;
 
         mutable String m_functionName;
         mutable String m_eventParameterName;
         mutable String m_code;
         mutable bool m_parsed;
+        mutable String m_sourceURL;
         int m_lineNumber;
         Node* m_originalNode;
     };
diff --git a/WebCore/bindings/js/JSLocationCustom.cpp b/WebCore/bindings/js/JSLocationCustom.cpp
index d7d32f4..c76a2b1 100644
--- a/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/WebCore/bindings/js/JSLocationCustom.cpp
@@ -31,6 +31,7 @@
 #include "KURL.h"
 #include "Location.h"
 #include "ScriptController.h"
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
@@ -93,6 +94,51 @@ bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& p
     return true;
 }
 
+bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    Frame* frame = impl()->frame();
+    if (!frame) {
+        descriptor.setUndefined();
+        return true;
+    }
+    
+    // When accessing Location cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
+    
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, frame, message))
+        return false;
+    
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    PropertySlot slot;
+    if (entry && (entry->attributes() & Function)) {
+        if (entry->function() == jsLocationPrototypeFunctionReplace) {
+            slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionReload) {
+            slot.setCustom(this, nonCachingStaticReloadFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionAssign) {
+            slot.setCustom(this, nonCachingStaticAssignFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        }
+    }
+    
+    // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
+    // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
+    // such cases when normally the string form of Location would be the URL.
+    
+    printErrorMessageForFrame(frame, message);
+    descriptor.setUndefined();
+    return true;
+}
+
 bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
@@ -128,19 +174,19 @@ bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSLocation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the location object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
-void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
         return;
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
 static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
@@ -150,7 +196,7 @@ static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bo
         return;
 
     if (!protocolIsJavaScript(url) || allowsAccessFromFrame(exec, frame))
-        frame->loader()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
 }
 
 void JSLocation::setHref(ExecState* exec, JSValue value)
@@ -158,13 +204,13 @@ void JSLocation::setHref(ExecState* exec, JSValue value)
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    if (!shouldAllowNavigation(exec, frame))
-        return;
-
     KURL url = completeURL(exec, value.toString(exec));
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(exec, frame))
+        return;
+
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
@@ -262,13 +308,13 @@ JSValue JSLocation::replace(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (!shouldAllowNavigation(exec, frame))
-        return jsUndefined();
-
     KURL url = completeURL(exec, args.at(0).toString(exec));
     if (url.isNull())
         return jsUndefined();
 
+    if (!shouldAllowNavigation(exec, frame))
+        return jsUndefined();
+
     navigateIfAllowed(exec, frame, url, true, true);
     return jsUndefined();
 }
@@ -280,7 +326,7 @@ JSValue JSLocation::reload(ExecState* exec, const ArgList&)
         return jsUndefined();
 
     if (!protocolIsJavaScript(frame->loader()->url()))
-        frame->loader()->scheduleRefresh(processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleRefresh(processingUserGesture(exec));
     return jsUndefined();
 }
 
@@ -290,13 +336,13 @@ JSValue JSLocation::assign(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (!shouldAllowNavigation(exec, frame))
-        return jsUndefined();
-
     KURL url = completeURL(exec, args.at(0).toString(exec));
     if (url.isNull())
         return jsUndefined();
 
+    if (!shouldAllowNavigation(exec, frame))
+        return jsUndefined();
+
     // We want a new history item if this JS was called via a user gesture
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
     return jsUndefined();
@@ -316,11 +362,11 @@ bool JSLocationPrototype::putDelegate(ExecState* exec, const Identifier& propert
     return (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf);
 }
 
-void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
         return;
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index 25a5cb2..9721ba3 100644
--- a/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -30,6 +30,7 @@
 #include "JSDocument.h"
 #include "JSMessageChannel.h"
 #include "MessageChannel.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSMessageEventCustom.cpp b/WebCore/bindings/js/JSMessageEventCustom.cpp
new file mode 100644
index 0000000..2e7b2d0
--- /dev/null
+++ b/WebCore/bindings/js/JSMessageEventCustom.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSMessageEvent.h"
+
+#include "JSDOMBinding.h"
+#include "JSDOMWindow.h"
+#include "JSEventTarget.h"
+#include "JSMessagePortCustom.h"
+#include "MessageEvent.h"
+#include <runtime/JSArray.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSMessageEvent::ports(ExecState* exec) const
+{
+    MessagePortArray* ports = static_cast<MessageEvent*>(impl())->ports();
+    if (!ports || ports->isEmpty())
+        return jsNull();
+
+    MarkedArgumentBuffer list;
+    for (size_t i = 0; i < ports->size(); i++)
+        list.append(toJS(exec, globalObject(), (*ports)[i].get()));
+    return constructArray(exec, list);
+}
+
+JSC::JSValue JSMessageEvent::initMessageEvent(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    PassRefPtr<SerializedScriptValue> dataArg = SerializedScriptValue::create(exec, args.at(3));
+    const UString& originArg = args.at(4).toString(exec);
+    const UString& lastEventIdArg = args.at(5).toString(exec);
+    DOMWindow* sourceArg = toDOMWindow(args.at(6));
+    OwnPtr<MessagePortArray> messagePorts;
+    if (!args.at(7).isUndefinedOrNull()) {
+        messagePorts = new MessagePortArray();
+        fillMessagePortArray(exec, args.at(7), *messagePorts);
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    MessageEvent* event = static_cast<MessageEvent*>(this->impl());
+    event->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg, originArg, lastEventIdArg, sourceArg, messagePorts.release());
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessagePortCustom.cpp b/WebCore/bindings/js/JSMessagePortCustom.cpp
index c3316c5..210c93e 100644
--- a/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -28,11 +28,14 @@
 
 #include "AtomicString.h"
 #include "Event.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSMessagePortCustom.h"
 #include "MessagePort.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
@@ -42,8 +45,6 @@ void JSMessagePort::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    markIfNotNull(markStack, m_impl->onmessage());
-
     // If we have a locally entangled port, we can directly mark it as reachable. Ports that are remotely entangled are marked in-use by markActiveObjectsForContext().
     if (MessagePort* entangledPort = m_impl->locallyEntangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
@@ -51,13 +52,7 @@ void JSMessagePort::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    typedef MessagePort::EventListenersMap EventListenersMap;
-    typedef MessagePort::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) 
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
@@ -65,10 +60,12 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -77,11 +74,54 @@ JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+JSC::JSValue JSMessagePort::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
+}
+
+void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortArray& portArray)
+{
+    // Convert from the passed-in JS array-like object to a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
+    if (value.isUndefinedOrNull()) {
+        portArray.resize(0);
+        return;
+    }
+
+    // Validation of sequence types, per WebIDL spec 4.1.13.
+    unsigned length;
+    JSObject* object = toJSSequence(exec, value, length);
+    if (exec->hadException())
+        return;
+
+    portArray.resize(length);
+    for (unsigned i = 0 ; i < length; ++i) {
+        JSValue value = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        // Validation of non-null objects, per HTML5 spec 8.3.3.
+        if (value.isUndefinedOrNull()) {
+            setDOMException(exec, INVALID_STATE_ERR);
+            return;
+        }
+
+        // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
+        RefPtr<MessagePort> port = toMessagePort(value);
+        if (!port) {
+            throwError(exec, TypeError);
+            return;
+        }
+        portArray[i] = port.release();
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessagePortCustom.h b/WebCore/bindings/js/JSMessagePortCustom.h
new file mode 100644
index 0000000..17b1eae
--- /dev/null
+++ b/WebCore/bindings/js/JSMessagePortCustom.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSMessagePortCustom_h
+#define JSMessagePortCustom_h
+
+#include "MessagePort.h"
+#include <runtime/JSValue.h>
+
+namespace WebCore {
+
+    typedef int ExceptionCode;
+
+    class String;
+
+    // Helper function which pulls the values out of a JS sequence and into a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
+    // May generate an exception via the passed ExecState.
+    void fillMessagePortArray(JSC::ExecState*, JSC::JSValue, MessagePortArray&);
+
+    // Helper function to convert from JS postMessage arguments to WebCore postMessage arguments.
+    template <typename T>
+    inline JSC::JSValue handlePostMessage(JSC::ExecState* exec, const JSC::ArgList& args, T* impl)
+    {
+        PassRefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, args.at(0));
+        MessagePortArray portArray;
+        fillMessagePortArray(exec, args.at(1), portArray);
+        if (exec->hadException())
+            return JSC::jsUndefined();
+
+        ExceptionCode ec = 0;
+        impl->postMessage(message, &portArray, ec);
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+
+}
+#endif // JSMessagePortCustom_h
diff --git a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 7bd95b4..1974ab0 100644
--- a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,10 +27,9 @@
 #include "JSNamedNodeMap.h"
 
 #include "JSNode.h"
+
+#include "Element.h"
 #include "NamedNodeMap.h"
-#include "Node.h"
-#include "PlatformString.h"
-#include "JSDOMBinding.h"
 
 using namespace JSC;
 
@@ -47,4 +46,16 @@ JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyNa
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
 }
 
+void JSNamedNodeMap::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    // Mark the element so that this will work to access the attribute even if the last
+    // other reference goes away.
+    if (Element* element = impl()->element()) {
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
+            markStack.append(wrapper);
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.cpp b/WebCore/bindings/js/JSNamedNodesCollection.cpp
deleted file mode 100644
index f36a7d6..0000000
--- a/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSNamedNodesCollection.h"
-
-#include "AtomicString.h"
-#include "Element.h"
-#include "JSNode.h"
-#include "NamedNodeMap.h"
-
-namespace WebCore {
-
-using namespace JSC;
-
-ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection);
-
-const ClassInfo JSNamedNodesCollection::s_info = { "Collection", 0, 0, 0 };
-
-// Such a collection is usually very short-lived, it only exists
-// for constructs like document.forms.<name>[1],
-// so it shouldn't be a problem that it's storing all the nodes (with the same name). (David)
-JSNamedNodesCollection::JSNamedNodesCollection(ExecState* exec, JSDOMGlobalObject* globalObject, const Vector<RefPtr<Node> >& nodes)
-    : DOMObjectWithGlobalPointer(getDOMStructure<JSNamedNodesCollection>(exec, globalObject), globalObject)
-    , m_nodes(new Vector<RefPtr<Node> >(nodes))
-{
-}
-
-JSValue JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSNamedNodesCollection* thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
-    return jsNumber(exec, thisObj->m_nodes->size());
-}
-
-JSValue JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSNamedNodesCollection *thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
-    return toJS(exec, (*thisObj->m_nodes)[slot.index()].get());
-}
-
-bool JSNamedNodesCollection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
-        return true;
-    }
-
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok);
-    if (ok && index < m_nodes->size()) {
-        slot.setCustomIndex(this, index, indexGetter);
-        return true;
-    }
-
-    // For IE compatibility, we need to be able to look up elements in a
-    // document.formName.name result by id as well as be index.
-
-    AtomicString atomicPropertyName = propertyName;
-    for (unsigned i = 0; i < m_nodes->size(); i++) {
-        Node* node = (*m_nodes)[i].get();
-        if (node->hasAttributes() && node->attributes()->id() == atomicPropertyName) {
-            slot.setCustomIndex(this, i, indexGetter);
-            return true;
-        }
-    }
-
-    return DOMObjectWithGlobalPointer::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-} // namespace WebCore
diff --git a/WebCore/bindings/js/JSNodeCustom.cpp b/WebCore/bindings/js/JSNodeCustom.cpp
index cf884b9..52f21e7 100644
--- a/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/WebCore/bindings/js/JSNodeCustom.cpp
@@ -110,25 +110,37 @@ JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->document());
+    Document* document = impl()->document();
+    if (!document)
+        return jsUndefined();
+        
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->document());
+    Document* document = impl()->document();
+    if (!document)
+        return jsUndefined();
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
-        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -138,10 +150,10 @@ void JSNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
 
 void JSNode::markChildren(MarkStack& markStack)
 {
-    Node* node = m_impl.get();
-
     Base::markChildren(markStack);
-    markEventListeners(markStack, node->eventListeners());
+
+    Node* node = m_impl.get();
+    node->markEventListeners(markStack);
 
     // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
     // the document, we need to mark the document, but we don't need to explicitly
diff --git a/WebCore/bindings/js/JSNodeFilterCustom.cpp b/WebCore/bindings/js/JSNodeFilterCustom.cpp
index 09fd110..2a99a93 100644
--- a/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -48,7 +48,7 @@ JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
 
 PassRefPtr<NodeFilter> toNodeFilter(JSValue value)
 {
-    if (value.isObject(&JSNodeFilter::s_info))
+    if (value.inherits(&JSNodeFilter::s_info))
         return static_cast<JSNodeFilter*>(asObject(value))->impl();
 
     return NodeFilter::create(JSNodeFilterCondition::create(value));
diff --git a/WebCore/bindings/js/JSOptionConstructor.cpp b/WebCore/bindings/js/JSOptionConstructor.cpp
index 2b8bd5d..7da0666 100644
--- a/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -25,6 +25,7 @@
 #include "JSHTMLOptionElement.h"
 #include "ScriptExecutionContext.h"
 #include "Text.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.cpp b/WebCore/bindings/js/JSPluginElementFunctions.cpp
index 56b0eca..ada2a77 100644
--- a/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -86,6 +86,22 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
     return true;
 }
 
+bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, JSHTMLElement* element)
+{
+    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    if (!runtimeObject)
+        return false;
+    if (!runtimeObject->hasProperty(exec, propertyName))
+        return false;
+    PropertySlot slot;
+    slot.setCustom(element, runtimeObjectPropertyGetter);
+    // While we don't know what the plugin allows, we do know that we prevent
+    // enumeration or deletion of properties, so we mark plugin properties
+    // as DontEnum | DontDelete
+    descriptor.setDescriptor(slot.getValue(exec, propertyName), DontEnum | DontDelete);
+    return true;
+}
+
 bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
     RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.h b/WebCore/bindings/js/JSPluginElementFunctions.h
index 8c9dfa7..a5a323a 100644
--- a/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -33,6 +33,7 @@ namespace WebCore {
     JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
+    bool runtimeObjectCustomGetOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, JSHTMLElement*);
     bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
     JSC::CallType runtimeObjectGetCallData(HTMLElement*, JSC::CallData&);
 
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index 5f4dfd4..a0551a1 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -56,7 +56,7 @@ JSValue JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifi
     return v;
 }
 
-JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
+JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
     : JSObject(structure)
     , m_unwrappedGlobalObject(unwrappedExec->lexicalGlobalObject())
     , m_unwrappedObject(unwrappedObject)
@@ -138,6 +138,26 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     return result;
 }
 
+bool JSQuarantinedObjectWrapper::getOwnPropertyDescriptor(ExecState* exec, const Identifier& identifier, PropertyDescriptor& descriptor)
+{
+    if (!allowsGetProperty()) {
+        descriptor.setUndefined();
+        return true;
+    }
+
+    PropertyDescriptor unwrappedDescriptor;
+    bool result = m_unwrappedObject->getOwnPropertyDescriptor(unwrappedExecState(), identifier, unwrappedDescriptor);
+
+    if (unwrappedDescriptor.isAccessorDescriptor()) {
+        descriptor.setAccessorDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.getter()),
+                                         wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.setter()),
+                                         unwrappedDescriptor.attributes());
+    } else
+        descriptor.setDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.value()), unwrappedDescriptor.attributes());
+    transferExceptionToExecState(exec);
+    return result;
+}
+
 void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     if (!allowsSetProperty())
@@ -158,6 +178,33 @@ void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSVal
     transferExceptionToExecState(exec);
 }
 
+bool JSQuarantinedObjectWrapper::defineOwnProperty(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    if (!allowsSetProperty())
+        return false;
+
+    PropertyDescriptor wrappedDescriptor;
+    if (descriptor.isDataDescriptor()) {
+        wrappedDescriptor.setValue(prepareIncomingValue(exec, descriptor.value()));
+        if (wrappedDescriptor.writablePresent())
+            wrappedDescriptor.setWritable(descriptor.writable());
+    } else if (descriptor.isAccessorDescriptor()) {
+        if (descriptor.getter())
+            wrappedDescriptor.setGetter(prepareIncomingValue(exec, descriptor.getter()));
+        if (descriptor.setter())
+            wrappedDescriptor.setSetter(prepareIncomingValue(exec, descriptor.setter()));
+    }
+    if (wrappedDescriptor.enumerablePresent())
+        wrappedDescriptor.setEnumerable(descriptor.enumerable());
+    if (wrappedDescriptor.configurablePresent())
+        wrappedDescriptor.setConfigurable(descriptor.configurable());
+    
+    bool result = m_unwrappedObject->defineOwnProperty(unwrappedExecState(), propertyName, wrappedDescriptor, shouldThrow);
+    
+    transferExceptionToExecState(exec);
+    return result;
+}
+
 bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier)
 {
     if (!allowsDeleteProperty())
@@ -270,8 +317,16 @@ void JSQuarantinedObjectWrapper::getPropertyNames(ExecState*, PropertyNameArray&
 {
     if (!allowsGetPropertyNames())
         return;
-
+    
     m_unwrappedObject->getPropertyNames(unwrappedExecState(), array);
 }
 
+void JSQuarantinedObjectWrapper::getOwnPropertyNames(ExecState*, PropertyNameArray& array)
+{
+    if (!allowsGetPropertyNames())
+        return;
+
+    m_unwrappedObject->getOwnPropertyNames(unwrappedExecState(), array);
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index 08935e7..94a92bd 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -51,16 +51,18 @@ namespace WebCore {
         }
 
     protected:
-        JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
+        JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual void markChildren(JSC::MarkStack&);
 
     private:
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
 
         virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
 
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
         virtual bool deleteProperty(JSC::ExecState*, unsigned);
@@ -69,8 +71,9 @@ namespace WebCore {
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
 
         virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
-
+        
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
         virtual JSC::UString className() const { return m_unwrappedObject->className(); }
 
diff --git a/WebCore/bindings/js/JSSQLTransactionCustom.cpp b/WebCore/bindings/js/JSSQLTransactionCustom.cpp
index dbe8e3c..e022401 100644
--- a/WebCore/bindings/js/JSSQLTransactionCustom.cpp
+++ b/WebCore/bindings/js/JSSQLTransactionCustom.cpp
@@ -95,8 +95,7 @@ JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
-            callback = JSCustomSQLStatementCallback::create(object, frame);
+        callback = JSCustomSQLStatementCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     RefPtr<SQLStatementErrorCallback> errorCallback;
@@ -107,8 +106,7 @@ JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
-            errorCallback = JSCustomSQLStatementErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLStatementErrorCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     ExceptionCode ec = 0;
diff --git a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index 6e77f9b..571e302 100644
--- a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -54,9 +54,11 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -66,9 +68,11 @@ JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
-        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSSharedWorkerConstructor.cpp b/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
index e2f1136..c05b3d2 100644
--- a/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
+++ b/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
@@ -37,6 +37,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSSharedWorker.h"
 #include "SharedWorker.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
@@ -56,11 +57,14 @@ static JSObject* constructSharedWorker(ExecState* exec, JSObject* constructor, c
 {
     JSSharedWorkerConstructor* jsConstructor = static_cast<JSSharedWorkerConstructor*>(constructor);
 
-    if (args.size() < 2)
+    if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     UString scriptURL = args.at(0).toString(exec);
-    UString name = args.at(1).toString(exec);
+    UString name;
+    if (args.size() > 1)
+        name = args.at(1).toString(exec);
+
     if (exec->hadException())
         return 0;
 
diff --git a/WebCore/bindings/js/JSStorageCustom.cpp b/WebCore/bindings/js/JSStorageCustom.cpp
index 07cf2f8..e416d35 100644
--- a/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/WebCore/bindings/js/JSStorageCustom.cpp
@@ -64,13 +64,13 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return true;
 }
 
-void JSStorage::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     unsigned length = m_impl->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier(exec, m_impl->key(i)));
         
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
diff --git a/WebCore/bindings/js/JSStyleSheetCustom.cpp b/WebCore/bindings/js/JSStyleSheetCustom.cpp
index 43249dc..d711b6f 100644
--- a/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -56,12 +56,19 @@ void JSStyleSheet::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
+    StyleSheet* sheet = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = sheet->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, sheet->item(i));
+
     // This prevents us from having a style sheet with a dangling ownerNode pointer.
     // A better solution would be to handle this on the DOM side -- if the style sheet
     // is kept around, then we want the node to stay around too. One possibility would
     // be to make ref/deref on the style sheet ref/deref the node instead, but there's
     // a lot of disentangling of the CSS DOM objects that would need to happen first.
-    if (Node* ownerNode = impl()->ownerNode()) {
+    if (Node* ownerNode = sheet->ownerNode()) {
         if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode))
             markStack.append(ownerNodeWrapper);
     }
diff --git a/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index 1da6418..7bf9389 100644
--- a/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +35,18 @@ using namespace JSC;
 
 namespace WebCore {
 
+void JSStyleSheetList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    StyleSheetList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
 bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheetList, const Identifier& propertyName)
 {
     return styleSheetList->getNamedItem(propertyName);
diff --git a/WebCore/bindings/js/JSWebSocketConstructor.cpp b/WebCore/bindings/js/JSWebSocketConstructor.cpp
index ca2e104..5b34765 100644
--- a/WebCore/bindings/js/JSWebSocketConstructor.cpp
+++ b/WebCore/bindings/js/JSWebSocketConstructor.cpp
@@ -37,6 +37,7 @@
 #include "JSWebSocket.h"
 #include "ScriptExecutionContext.h"
 #include "WebSocket.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSWebSocketCustom.cpp b/WebCore/bindings/js/JSWebSocketCustom.cpp
index 3aa4b8b..d305502 100644
--- a/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -38,19 +38,12 @@
 #include "KURL.h"
 #include "WebSocket.h"
 #include "NotImplemented.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSWebSocket::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-    if (m_impl->readyState() != WebSocket::CLOSED)
-        markIfNotNull(markStack, m_impl->onmessage());
-    // FIXME: mark if EventListeners is registered.
-}
-
 // Custom functions
 JSValue JSWebSocket::send(ExecState* exec, const ArgList& args)
 {
diff --git a/WebCore/bindings/js/JSWorkerConstructor.cpp b/WebCore/bindings/js/JSWorkerConstructor.cpp
index 9943cfb..69c05e7 100644
--- a/WebCore/bindings/js/JSWorkerConstructor.cpp
+++ b/WebCore/bindings/js/JSWorkerConstructor.cpp
@@ -34,6 +34,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSWorker.h"
 #include "Worker.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSWorkerContextBase.cpp b/WebCore/bindings/js/JSWorkerContextBase.cpp
index 1e4df42..741a269 100644
--- a/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -44,7 +44,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 
 const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
 
-JSWorkerContextBase::JSWorkerContextBase(PassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
+JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
     : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
     , m_impl(impl)
 {
diff --git a/WebCore/bindings/js/JSWorkerContextBase.h b/WebCore/bindings/js/JSWorkerContextBase.h
index a9a6e63..45238f1 100644
--- a/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/WebCore/bindings/js/JSWorkerContextBase.h
@@ -41,7 +41,7 @@ namespace WebCore {
     class JSWorkerContextBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
     public:
-        JSWorkerContextBase(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
+        JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
         virtual ~JSWorkerContextBase();
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
diff --git a/WebCore/bindings/js/JSWorkerContextCustom.cpp b/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 919c81f..e1c8a8c 100644
--- a/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -43,6 +43,10 @@
 #include "WorkerNavigator.h"
 #include <interpreter/Interpreter.h>
 
+#if ENABLE(EVENTSOURCE)
+#include "JSEventSourceConstructor.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -58,15 +62,7 @@ void JSWorkerContext::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
 
-    markIfNotNull(markStack, impl()->onerror());
-
-    typedef WorkerContext::EventListenersMap EventListenersMap;
-    typedef WorkerContext::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = impl()->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    impl()->markEventListeners(markStack);
 }
 
 bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -77,6 +73,21 @@ bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifi
     return false;
 }
 
+bool JSWorkerContext::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // Look for overrides before looking at any of our own properties.
+    if (JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+    return false;
+}
+
+#if ENABLE(EVENTSOURCE)
+JSValue JSWorkerContext::eventSource(ExecState* exec) const
+{
+    return getDOMConstructor<JSEventSourceConstructor>(exec, this);
+}
+#endif
+
 JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -107,19 +118,21 @@ JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 
 JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
 {
-    RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSEventListener* listener = findJSEventListener(args.at(1));
-    if (!listener)
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSWorkerCustom.cpp b/WebCore/bindings/js/JSWorkerCustom.cpp
index f5c394b..09b881a 100644
--- a/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -30,17 +30,16 @@
 #include "JSWorker.h"
 
 #include "JSDOMGlobalObject.h"
+#include "JSMessagePortCustom.h"
 #include "Worker.h"
 
 using namespace JSC;
 
 namespace WebCore {
-    
-void JSWorker::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
 
-    markIfNotNull(markStack, static_cast<Worker*>(impl())->onmessage());
+JSC::JSValue JSWorker::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index a644c9e..91fff9a 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -23,6 +23,7 @@
 #include "JSXMLHttpRequest.h"
 #include "ScriptExecutionContext.h"
 #include "XMLHttpRequest.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index a591fae..4b44db2 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -59,20 +59,7 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    markIfNotNull(markStack, m_impl->onreadystatechange());
-    markIfNotNull(markStack, m_impl->onabort());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onload());
-    markIfNotNull(markStack, m_impl->onloadstart());
-    markIfNotNull(markStack, m_impl->onprogress());
-    
-    typedef XMLHttpRequest::EventListenersMap EventListenersMap;
-    typedef XMLHttpRequest::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 // Custom functions
@@ -123,9 +110,9 @@ JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
         JSValue val = args.at(0);
         if (val.isUndefinedOrNull())
             impl()->send(ec);
-        else if (val.isObject(&JSDocument::s_info))
+        else if (val.inherits(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val.isObject(&JSFile::s_info))
+        else if (val.inherits(&JSFile::s_info))
             impl()->send(toFile(val), ec);
         else
             impl()->send(val.toString(exec), ec);
@@ -168,10 +155,12 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -180,10 +169,12 @@ JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& ar
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index cb6d5f2..dab0a3e 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -51,19 +51,7 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    markIfNotNull(markStack, m_impl->onabort());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onload());
-    markIfNotNull(markStack, m_impl->onloadstart());
-    markIfNotNull(markStack, m_impl->onprogress());
-    
-    typedef XMLHttpRequestUpload::EventListenersMap EventListenersMap;
-    typedef XMLHttpRequestUpload::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
@@ -71,10 +59,12 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -83,10 +73,12 @@ JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgLi
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSXSLTProcessorCustom.cpp b/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
index 01e53a6..441bbc9 100644
--- a/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
+++ b/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
@@ -49,7 +49,7 @@ namespace WebCore {
 JSValue JSXSLTProcessor::importStylesheet(ExecState*, const ArgList& args)
 {
     JSValue nodeVal = args.at(0);
-    if (nodeVal.isObject(&JSNode::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         impl()->importStylesheet(node->impl());
         return jsUndefined();
@@ -62,7 +62,7 @@ JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& arg
 {
     JSValue nodeVal = args.at(0);
     JSValue docVal = args.at(1);
-    if (nodeVal.isObject(&JSNode::s_info) && docVal.isObject(&JSDocument::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info) && docVal.inherits(&JSDocument::s_info)) {
         WebCore::Node* node = static_cast<JSNode*>(asObject(nodeVal))->impl();
         Document* doc = static_cast<Document*>(static_cast<JSDocument*>(asObject(docVal))->impl());
         return toJS(exec, impl()->transformToFragment(node, doc).get());
@@ -74,7 +74,7 @@ JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& arg
 JSValue JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
 {
     JSValue nodeVal = args.at(0);
-    if (nodeVal.isObject(&JSNode::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         RefPtr<Document> resultDocument = impl()->transformToDocument(node->impl());
         if (resultDocument)
diff --git a/WebCore/bindings/js/ScriptCachedFrameData.cpp b/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 8852611..77b8ca4 100644
--- a/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -86,7 +86,7 @@ void ScriptCachedFrameData::clear()
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    if (!m_window) {
+    if (m_window) {
         m_window = 0;
         gcController().garbageCollectSoon();
     }
diff --git a/WebCore/bindings/js/ScriptCallFrame.cpp b/WebCore/bindings/js/ScriptCallFrame.cpp
index 58168d0..09752d1 100644
--- a/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/WebCore/bindings/js/ScriptCallFrame.cpp
@@ -40,7 +40,7 @@ namespace WebCore {
 
 ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, const ArgList& args, unsigned skipArgumentCount)
     : m_functionName(functionName)
-    , m_sourceURL(urlString)
+    , m_sourceURL(ParsedURLString, urlString)
     , m_lineNumber(lineNumber)
 {
     size_t argumentCount = args.size();
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index 8908155..6de9b75 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -33,6 +33,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
+#include "StorageNamespace.h"
 #include "XSSAuditor.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
@@ -84,12 +85,7 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
     String sourceURL = jsSourceCode.provider()->url();
     
-    if (sourceURL.isNull() && !m_XSSAuditor->canEvaluateJavaScriptURL(sourceCode.source())) {
-        // This JavaScript URL is not safe to be evaluated.
-        return JSValue();
-    }
-    
-    if (!sourceURL.isNull() && !m_XSSAuditor->canEvaluate(sourceCode.source())) {
+    if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
         // This script is not safe to be evaluated.
         return JSValue();
     }
@@ -130,6 +126,14 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     return JSValue();
 }
 
+void ScriptController::evaluateInIsolatedWorld(unsigned /* worldID */, const Vector<ScriptSourceCode>& sourceCode) 
+{
+    // FIXME: Actually support isolated worlds!
+    unsigned size = sourceCode.size();
+    for (unsigned i = 0; i < size; ++i)
+        evaluate(sourceCode[i]);
+}
+
 void ScriptController::clearWindowShell()
 {
     if (!m_windowShell)
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
index 4528495..56e8f0c 100644
--- a/WebCore/bindings/js/ScriptController.h
+++ b/WebCore/bindings/js/ScriptController.h
@@ -81,6 +81,7 @@ public:
     }
 
     ScriptValue evaluate(const ScriptSourceCode&);
+    void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
diff --git a/WebCore/bindings/js/ScriptControllerHaiku.cpp b/WebCore/bindings/js/ScriptControllerHaiku.cpp
index b573b97..3fe471d 100644
--- a/WebCore/bindings/js/ScriptControllerHaiku.cpp
+++ b/WebCore/bindings/js/ScriptControllerHaiku.cpp
@@ -28,8 +28,8 @@
 #include "ScriptController.h"
 
 #include "PluginView.h"
-#include "runtime_root.h"
 #include "runtime.h"
+#include "runtime_root.h"
 
 
 namespace WebCore {
diff --git a/WebCore/bindings/js/ScriptEventListener.cpp b/WebCore/bindings/js/ScriptEventListener.cpp
index 878c535..0b0047b 100644
--- a/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/WebCore/bindings/js/ScriptEventListener.cpp
@@ -33,12 +33,11 @@
 
 #include "Attribute.h"
 #include "Document.h"
+#include "EventListener.h"
 #include "JSNode.h"
 #include "Frame.h"
 #include "XSSAuditor.h"
 
-#include <runtime/JSLock.h>
-
 using namespace JSC;
 
 namespace WebCore {
@@ -54,29 +53,25 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
 {
     ASSERT(node);
 
-    Frame* frame = node->document()->frame();
-    if (!frame)
-        return 0;
-
-    ScriptController* scriptController = frame->script();
-    if (!scriptController->isEnabled())
-        return 0;
-
-    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
-        // This script is not safe to execute.
-        return 0;
-    }
+    int lineNumber = 1;
+    String sourceURL;
     
-    JSDOMWindow* globalObject = scriptController->globalObject();
-
-    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
-    {
-        JSLock lock(SilenceAssertionsOnly);
-        // FIXME: Should pass the global object associated with the node
-        toJS(globalObject->globalExec(), globalObject, node);
+    // FIXME: We should be able to provide accurate source information for frameless documents, too (e.g. for importing nodes from XMLHttpRequest.responseXML).
+    if (Frame* frame = node->document()->frame()) {
+        ScriptController* scriptController = frame->script();
+        if (!scriptController->isEnabled())
+            return 0;
+
+        if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
+            // This script is not safe to execute.
+            return 0;
+        }
+
+        lineNumber = scriptController->eventHandlerLineNumber();
+        sourceURL = node->document()->url().string();
     }
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), globalObject, node, scriptController->eventHandlerLineNumber());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber);
 }
 
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -84,19 +79,29 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!frame)
         return 0;
 
+    int lineNumber = 1;
+    String sourceURL;
+    
     ScriptController* scriptController = frame->script();
     if (!scriptController->isEnabled())
         return 0;
-    
+
     if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
         // This script is not safe to execute.
         return 0;
     }
 
-    // 'globalObject' is the JavaScript wrapper that will mark the event listener we're creating.
-    JSDOMWindow* globalObject = scriptController->globalObject();
+    lineNumber = scriptController->eventHandlerLineNumber();
+    sourceURL = frame->document()->url().string();
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber);
+}
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), globalObject, 0, scriptController->eventHandlerLineNumber());
+String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* eventListener)
+{
+    JSC::JSObject* functionObject = eventListener->jsFunction(context);
+    if (!functionObject)
+        return "";
+    return functionObject->toString(scriptState);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptEventListener.h b/WebCore/bindings/js/ScriptEventListener.h
index 8299d29..3396541 100644
--- a/WebCore/bindings/js/ScriptEventListener.h
+++ b/WebCore/bindings/js/ScriptEventListener.h
@@ -32,17 +32,20 @@
 #define ScriptEventListener_h
 
 #include "JSLazyEventListener.h"
+#include "ScriptState.h"
 
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
     class Attribute;
+    class EventListener;
     class Frame;
     class Node;
 
     PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node*, Attribute*);
     PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+    String getEventListenerHandlerBody(ScriptExecutionContext*, ScriptState*, EventListener*);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/ScriptObject.cpp b/WebCore/bindings/js/ScriptObject.cpp
index beadc4a..aaf4163 100644
--- a/WebCore/bindings/js/ScriptObject.cpp
+++ b/WebCore/bindings/js/ScriptObject.cpp
@@ -106,6 +106,14 @@ bool ScriptObject::set(const char* name, int value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, unsigned value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -127,7 +135,11 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const S
     return handleException(scriptState);
 }
 
+<<<<<<< HEAD:WebCore/bindings/js/ScriptObject.cpp
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+=======
+#if ENABLE(INSPECTOR)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/ScriptObject.cpp
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorBackend* value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -135,7 +147,11 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
+<<<<<<< HEAD:WebCore/bindings/js/ScriptObject.cpp
 #endif
+=======
+#endif // ENABLE(INSPECTOR)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/ScriptObject.cpp
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
 {
diff --git a/WebCore/bindings/js/ScriptObject.h b/WebCore/bindings/js/ScriptObject.h
index 50b63ad..31381f3 100644
--- a/WebCore/bindings/js/ScriptObject.h
+++ b/WebCore/bindings/js/ScriptObject.h
@@ -52,6 +52,7 @@ namespace WebCore {
         bool set(const char* name, double);
         bool set(const char* name, long long);
         bool set(const char* name, int);
+        bool set(const char* name, unsigned);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
@@ -63,7 +64,9 @@ namespace WebCore {
     class ScriptGlobalObject {
     public:
         static bool set(ScriptState*, const char* name, const ScriptObject&);
+#if ENABLE(INSPECTOR)
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+#endif
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
     private:
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
index 89553ef..b48556e 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "ScriptObjectQuarantine.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "Document.h"
 #include "Frame.h"
 #include "JSDOMBinding.h"
@@ -38,6 +40,7 @@
 #include "JSNode.h"
 #include "ScriptObject.h"
 #include "ScriptValue.h"
+#include "Storage.h"
 
 #include <runtime/JSLock.h>
 
@@ -80,10 +83,11 @@ bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObj
 #endif
 
 #if ENABLE(DOM_STORAGE)
-bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
 {
-    ASSERT(frame);
     ASSERT(storage);
+    Frame* frame = storage->frame();
+    ASSERT(frame);
 
     JSDOMGlobalObject* globalObject = toJSDOMWindow(frame);
     ExecState* exec = globalObject->globalExec();
@@ -123,3 +127,5 @@ bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedO
 
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.h b/WebCore/bindings/js/ScriptObjectQuarantine.h
index d70acd7..df52379 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ b/WebCore/bindings/js/ScriptObjectQuarantine.h
@@ -37,7 +37,6 @@ namespace WebCore {
 
     class Database;
     class DOMWindow;
-    class Frame;
     class Node;
     class ScriptObject;
     class ScriptValue;
@@ -49,7 +48,7 @@ namespace WebCore {
     bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
 #endif
 #if ENABLE(DOM_STORAGE)
-    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
 #endif
     bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
     bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
diff --git a/WebCore/bindings/js/ScriptValue.cpp b/WebCore/bindings/js/ScriptValue.cpp
index d427cee..6eac102 100644
--- a/WebCore/bindings/js/ScriptValue.cpp
+++ b/WebCore/bindings/js/ScriptValue.cpp
@@ -74,4 +74,11 @@ bool ScriptValue::isUndefined() const
     return m_value.get().isUndefined();
 }
 
+bool ScriptValue::isObject() const
+{
+    if (!m_value)
+        return false;
+    return m_value.get().isObject();
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptValue.h b/WebCore/bindings/js/ScriptValue.h
index 209ce06..19bb693 100644
--- a/WebCore/bindings/js/ScriptValue.h
+++ b/WebCore/bindings/js/ScriptValue.h
@@ -50,6 +50,7 @@ public:
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
     bool isUndefined() const;
+    bool isObject() const;
     bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
 private:
diff --git a/WebCore/bindings/js/SerializedScriptValue.cpp b/WebCore/bindings/js/SerializedScriptValue.cpp
new file mode 100644
index 0000000..48cd92d
--- /dev/null
+++ b/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -0,0 +1,839 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "SerializedScriptValue.h"
+
+#include <runtime/DateInstance.h>
+#include <runtime/ExceptionHelpers.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/HashTraits.h>
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+class SerializedObject : public SharedSerializedData
+{
+public:
+    typedef Vector<RefPtr<StringImpl> > PropertyNameList;
+    typedef Vector<SerializedScriptValueData> ValueList;
+
+    void set(const Identifier& propertyName, const SerializedScriptValueData& value)
+    {
+        ASSERT(m_names.size() == m_values.size());
+        m_names.append(String(propertyName.ustring()).crossThreadString().impl());
+        m_values.append(value);
+    }
+
+    PropertyNameList& names() { return m_names; }
+
+    ValueList& values() { return m_values; }
+
+    static PassRefPtr<SerializedObject> create()
+    {
+        return adoptRef(new SerializedObject);
+    }
+
+    void clear()
+    {
+        m_names.clear();
+        m_values.clear();
+    }
+
+private:
+    SerializedObject() { }
+    PropertyNameList m_names;
+    ValueList m_values;
+};
+
+class SerializedArray : public SharedSerializedData
+{
+    typedef HashMap<unsigned, SerializedScriptValueData, DefaultHash<unsigned>::Hash, WTF::UnsignedWithZeroKeyHashTraits<unsigned> > SparseMap;
+public:
+    void setIndex(unsigned index, const SerializedScriptValueData& value)
+    {
+        ASSERT(index < m_length);
+        if (index == m_compactStorage.size())
+            m_compactStorage.append(value);
+        else
+            m_sparseStorage.set(index, value);
+    }
+
+    bool canDoFastRead(unsigned index) const
+    {
+        ASSERT(index < m_length);
+        return index < m_compactStorage.size();
+    }
+
+    const SerializedScriptValueData& getIndex(unsigned index)
+    {
+        ASSERT(index < m_compactStorage.size());
+        return m_compactStorage[index];
+    }
+
+    SerializedScriptValueData getSparseIndex(unsigned index, bool& hasIndex)
+    {
+        ASSERT(index >= m_compactStorage.size());
+        ASSERT(index < m_length);
+        SparseMap::iterator iter = m_sparseStorage.find(index);
+        if (iter == m_sparseStorage.end()) {
+            hasIndex = false;
+            return SerializedScriptValueData();
+        }
+        hasIndex = true;
+        return iter->second;
+    }
+
+    unsigned length() const
+    {
+        return m_length;
+    }
+
+    static PassRefPtr<SerializedArray> create(unsigned length)
+    {
+        return adoptRef(new SerializedArray(length));
+    }
+
+    void clear()
+    {
+        m_compactStorage.clear();
+        m_sparseStorage.clear();
+        m_length = 0;
+    }
+private:
+    SerializedArray(unsigned length)
+        : m_length(length)
+    {
+    }
+
+    Vector<SerializedScriptValueData> m_compactStorage;
+    SparseMap m_sparseStorage;
+    unsigned m_length;
+};
+
+SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedObject> data)
+    : m_type(ObjectType)
+    , m_sharedData(data)
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedArray> data)
+    : m_type(ArrayType)
+    , m_sharedData(data)
+{
+}
+
+SerializedArray* SharedSerializedData::asArray()
+{
+    return static_cast<SerializedArray*>(this);
+}
+
+SerializedObject* SharedSerializedData::asObject()
+{
+    return static_cast<SerializedObject*>(this);
+}
+
+static const unsigned maximumFilterRecursion = 40000;
+enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember,
+    ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
+template <typename TreeWalker> typename TreeWalker::OutputType walk(TreeWalker& context, typename TreeWalker::InputType in)
+{
+    typedef typename TreeWalker::InputObject InputObject;
+    typedef typename TreeWalker::InputArray InputArray;
+    typedef typename TreeWalker::OutputObject OutputObject;
+    typedef typename TreeWalker::OutputArray OutputArray;
+    typedef typename TreeWalker::InputType InputType;
+    typedef typename TreeWalker::OutputType OutputType;
+    typedef typename TreeWalker::PropertyList PropertyList;
+
+    Vector<uint32_t, 16> indexStack;
+    Vector<uint32_t, 16> lengthStack;
+    Vector<PropertyList, 16> propertyStack;
+    Vector<InputObject, 16> inputObjectStack;
+    Vector<InputArray, 16> inputArrayStack;
+    Vector<OutputObject, 16> outputObjectStack;
+    Vector<OutputArray, 16> outputArrayStack;
+    Vector<WalkerState, 16> stateStack;
+    WalkerState state = StateUnknown;
+    InputType inValue = in;
+    OutputType outValue = context.null();
+
+    unsigned tickCount = context.ticksUntilNextCheck();
+    while (1) {
+        switch (state) {
+            arrayStartState:
+            case ArrayStartState: {
+                ASSERT(context.isArray(inValue));
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
+                    context.throwStackOverflow();
+                    return context.null();
+                }
+
+                InputArray inArray = context.asInputArray(inValue);
+                unsigned length = context.length(inArray);
+                OutputArray outArray = context.createOutputArray(length);
+                if (!context.startArray(inArray, outArray))
+                    return context.null();
+                inputArrayStack.append(inArray);
+                outputArrayStack.append(outArray);
+                indexStack.append(0);
+                lengthStack.append(length);
+                // fallthrough
+            }
+            arrayStartVisitMember:
+            case ArrayStartVisitMember: {
+                if (!--tickCount) {
+                    if (context.didTimeOut()) {
+                        context.throwInterruptedException();
+                        return context.null();
+                    }
+                    tickCount = context.ticksUntilNextCheck();
+                }
+
+                InputArray array = inputArrayStack.last();
+                uint32_t index = indexStack.last();
+                if (index == lengthStack.last()) {
+                    InputArray inArray = inputArrayStack.last();
+                    OutputArray outArray = outputArrayStack.last();
+                    context.endArray(inArray, outArray);
+                    outValue = outArray;
+                    inputArrayStack.removeLast();
+                    outputArrayStack.removeLast();
+                    indexStack.removeLast();
+                    lengthStack.removeLast();
+                    break;
+                }
+                if (context.canDoFastRead(array, index))
+                    inValue = context.getIndex(array, index);
+                else {
+                    bool hasIndex = false;
+                    inValue = context.getSparseIndex(array, index, hasIndex);
+                    if (!hasIndex) {
+                        indexStack.last()++;
+                        goto arrayStartVisitMember;
+                    }
+                }
+
+                if (OutputType transformed = context.convertIfTerminal(inValue))
+                    outValue = transformed;
+                else {
+                    stateStack.append(ArrayEndVisitMember);
+                    goto stateUnknown;
+                }
+                // fallthrough
+            }
+            case ArrayEndVisitMember: {
+                OutputArray outArray = outputArrayStack.last();
+                context.putProperty(outArray, indexStack.last(), outValue);
+                indexStack.last()++;
+                goto arrayStartVisitMember;
+            }
+            objectStartState:
+            case ObjectStartState: {
+                ASSERT(context.isObject(inValue));
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
+                    context.throwStackOverflow();
+                    return context.null();
+                }
+                InputObject inObject = context.asInputObject(inValue);
+                OutputObject outObject = context.createOutputObject();
+                if (!context.startObject(inObject, outObject))
+                    return context.null();
+                inputObjectStack.append(inObject);
+                outputObjectStack.append(outObject);
+                indexStack.append(0);
+                context.getPropertyNames(inObject, propertyStack);
+                // fallthrough
+            }
+            objectStartVisitMember:
+            case ObjectStartVisitMember: {
+                if (!--tickCount) {
+                    if (context.didTimeOut()) {
+                        context.throwInterruptedException();
+                        return context.null();
+                    }
+                    tickCount = context.ticksUntilNextCheck();
+                }
+
+                InputObject object = inputObjectStack.last();
+                uint32_t index = indexStack.last();
+                PropertyList& properties = propertyStack.last();
+                if (index == properties.size()) {
+                    InputObject inObject = inputObjectStack.last();
+                    OutputObject outObject = outputObjectStack.last();
+                    context.endObject(inObject, outObject);
+                    outValue = outObject;
+                    inputObjectStack.removeLast();
+                    outputObjectStack.removeLast();
+                    indexStack.removeLast();
+                    propertyStack.removeLast();
+                    break;
+                }
+                inValue = context.getProperty(object, properties[index], index);
+
+                if (context.shouldTerminate())
+                    return context.null();
+
+                if (OutputType transformed = context.convertIfTerminal(inValue))
+                    outValue = transformed;
+                else {
+                    stateStack.append(ObjectEndVisitMember);
+                    goto stateUnknown;
+                }
+                // fallthrough
+            }
+            case ObjectEndVisitMember: {
+                context.putProperty(outputObjectStack.last(), propertyStack.last()[indexStack.last()], outValue);
+                if (context.shouldTerminate())
+                    return context.null();
+
+                indexStack.last()++;
+                goto objectStartVisitMember;
+            }
+            stateUnknown:
+            case StateUnknown:
+                if (OutputType transformed = context.convertIfTerminal(inValue)) {
+                    outValue = transformed;
+                    break;
+                }
+                if (context.isArray(inValue))
+                    goto arrayStartState;
+                goto objectStartState;
+        }
+        if (stateStack.isEmpty())
+            break;
+
+        state = stateStack.last();
+        stateStack.removeLast();
+
+        if (!--tickCount) {
+            if (context.didTimeOut()) {
+                context.throwInterruptedException();
+                return context.null();
+            }
+            tickCount = context.ticksUntilNextCheck();
+        }
+    }
+    return outValue;
+}
+
+struct BaseWalker {
+    BaseWalker(ExecState* exec)
+        : m_exec(exec)
+        , m_timeoutChecker(exec->globalData().timeoutChecker)
+    {
+        m_timeoutChecker.reset();
+    }
+    ExecState* m_exec;
+    TimeoutChecker m_timeoutChecker;
+    MarkedArgumentBuffer m_gcBuffer;
+
+    bool shouldTerminate()
+    {
+        return m_exec->hadException();
+    }
+
+    unsigned ticksUntilNextCheck()
+    {
+        return m_timeoutChecker.ticksUntilNextCheck();
+    }
+
+    bool didTimeOut()
+    {
+        return m_timeoutChecker.didTimeOut(m_exec);
+    }
+
+    void throwStackOverflow()
+    {
+        m_exec->setException(createStackOverflowError(m_exec));
+    }
+
+    void throwInterruptedException()
+    {
+        m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+    }
+};
+
+struct SerializingTreeWalker : public BaseWalker {
+    typedef JSValue InputType;
+    typedef JSArray* InputArray;
+    typedef JSObject* InputObject;
+    typedef SerializedScriptValueData OutputType;
+    typedef RefPtr<SerializedArray> OutputArray;
+    typedef RefPtr<SerializedObject> OutputObject;
+    typedef PropertyNameArray PropertyList;
+
+    SerializingTreeWalker(ExecState* exec)
+        : BaseWalker(exec)
+    {
+    }
+
+    OutputType null() { return SerializedScriptValueData(); }
+
+    bool isArray(JSValue value)
+    {
+        if (!value.isObject())
+            return false;
+        JSObject* object = asObject(value);
+        return isJSArray(&m_exec->globalData(), object) || object->inherits(&JSArray::info);
+    }
+
+    bool isObject(JSValue value)
+    {
+        return value.isObject();
+    }
+
+    JSArray* asInputArray(JSValue value)
+    {
+        return asArray(value);
+    }
+
+    JSObject* asInputObject(JSValue value)
+    {
+        return asObject(value);
+    }
+
+    PassRefPtr<SerializedArray> createOutputArray(unsigned length)
+    {
+        return SerializedArray::create(length);
+    }
+
+    PassRefPtr<SerializedObject> createOutputObject()
+    {
+        return SerializedObject::create();
+    }
+
+    uint32_t length(JSValue array)
+    {
+        ASSERT(array.isObject());
+        JSObject* object = asObject(array);
+        return object->get(m_exec, m_exec->propertyNames().length).toUInt32(m_exec);
+    }
+
+    bool canDoFastRead(JSArray* array, unsigned index)
+    {
+        return isJSArray(&m_exec->globalData(), array) && array->canGetIndex(index);
+    }
+
+    JSValue getIndex(JSArray* array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    JSValue getSparseIndex(JSObject* object, unsigned propertyName, bool& hasIndex)
+    {
+        PropertySlot slot(object);
+        if (object->getOwnPropertySlot(m_exec, propertyName, slot)) {
+            hasIndex = true;
+            return slot.getValue(m_exec, propertyName);
+        }
+        hasIndex = false;
+        return jsNull();
+    }
+
+    JSValue getProperty(JSObject* object, const Identifier& propertyName, unsigned)
+    {
+        PropertySlot slot(object);
+        if (object->getOwnPropertySlot(m_exec, propertyName, slot))
+            return slot.getValue(m_exec, propertyName);
+        return jsNull();
+    }
+
+    SerializedScriptValueData convertIfTerminal(JSValue value)
+    {
+        if (!value.isCell())
+            return SerializedScriptValueData(value);
+
+        if (value.isString())
+            return SerializedScriptValueData(asString(value)->value());
+
+        if (value.isNumber())
+            return SerializedScriptValueData(SerializedScriptValueData::NumberType, value.uncheckedGetNumber());
+
+        if (value.isObject() && asObject(value)->inherits(&DateInstance::info))
+            return SerializedScriptValueData(SerializedScriptValueData::DateType, asDateInstance(value)->internalNumber());
+
+        if (isArray(value))
+            return SerializedScriptValueData();
+
+        CallData unusedData;
+        if (value.isObject() && value.getCallData(unusedData) == CallTypeNone)
+            return SerializedScriptValueData();
+
+        // Any other types are expected to serialize as null.
+        return SerializedScriptValueData(jsNull());
+    }
+
+    void getPropertyNames(JSObject* object, Vector<PropertyNameArray, 16>& propertyStack)
+    {
+        propertyStack.append(PropertyNameArray(m_exec));
+        object->getOwnPropertyNames(m_exec, propertyStack.last());
+    }
+
+    void putProperty(RefPtr<SerializedArray> array, unsigned propertyName, const SerializedScriptValueData& value)
+    {
+        array->setIndex(propertyName, value);
+    }
+
+    void putProperty(RefPtr<SerializedObject> object, const Identifier& propertyName, const SerializedScriptValueData& value)
+    {
+        object->set(propertyName, value);
+    }
+
+    bool startArray(JSArray* inArray, RefPtr<SerializedArray>)
+    {
+        // Cycle detection
+        if (!m_cycleDetector.add(inArray).second) {
+            m_exec->setException(createTypeError(m_exec, "Cannot post cyclic structures."));
+            return false;
+        }
+        m_gcBuffer.append(inArray);
+        return true;
+    }
+
+    void endArray(JSArray* inArray, RefPtr<SerializedArray>)
+    {
+        m_cycleDetector.remove(inArray);
+        m_gcBuffer.removeLast();
+    }
+
+    bool startObject(JSObject* inObject, RefPtr<SerializedObject>)
+    {
+        // Cycle detection
+        if (!m_cycleDetector.add(inObject).second) {
+            m_exec->setException(createTypeError(m_exec, "Cannot post cyclic structures."));
+            return false;
+        }
+        m_gcBuffer.append(inObject);
+        return true;
+    }
+
+    void endObject(JSObject* inObject, RefPtr<SerializedObject>)
+    {
+        m_cycleDetector.remove(inObject);
+        m_gcBuffer.removeLast();
+    }
+
+private:
+    HashSet<JSObject*> m_cycleDetector;
+};
+
+SerializedScriptValueData SerializedScriptValueData::serialize(ExecState* exec, JSValue inValue)
+{
+    SerializingTreeWalker context(exec);
+    return walk<SerializingTreeWalker>(context, inValue);
+}
+
+
+struct DeserializingTreeWalker : public BaseWalker {
+    typedef SerializedScriptValueData InputType;
+    typedef RefPtr<SerializedArray> InputArray;
+    typedef RefPtr<SerializedObject> InputObject;
+    typedef JSValue OutputType;
+    typedef JSArray* OutputArray;
+    typedef JSObject* OutputObject;
+    typedef SerializedObject::PropertyNameList PropertyList;
+
+    DeserializingTreeWalker(ExecState* exec, bool mustCopy)
+        : BaseWalker(exec)
+        , m_mustCopy(mustCopy)
+    {
+    }
+
+    OutputType null() { return jsNull(); }
+
+    bool isArray(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ArrayType;
+    }
+
+    bool isObject(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ObjectType;
+    }
+
+    SerializedArray* asInputArray(const SerializedScriptValueData& value)
+    {
+        return value.asArray();
+    }
+
+    SerializedObject* asInputObject(const SerializedScriptValueData& value)
+    {
+        return value.asObject();
+    }
+
+    JSArray* createOutputArray(unsigned length)
+    {
+        JSArray* array = constructEmptyArray(m_exec);
+        array->setLength(length);
+        return array;
+    }
+
+    JSObject* createOutputObject()
+    {
+        return constructEmptyObject(m_exec);
+    }
+
+    uint32_t length(RefPtr<SerializedArray> array)
+    {
+        return array->length();
+    }
+
+    bool canDoFastRead(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->canDoFastRead(index);
+    }
+
+    SerializedScriptValueData getIndex(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    SerializedScriptValueData getSparseIndex(RefPtr<SerializedArray> array, unsigned propertyName, bool& hasIndex)
+    {
+        return array->getSparseIndex(propertyName, hasIndex);
+    }
+
+    SerializedScriptValueData getProperty(RefPtr<SerializedObject> object, const RefPtr<StringImpl>& propertyName, unsigned propertyIndex)
+    {
+        ASSERT(object->names()[propertyIndex] == propertyName);
+        UNUSED_PARAM(propertyName);
+        return object->values()[propertyIndex];
+    }
+
+    JSValue convertIfTerminal(SerializedScriptValueData& value)
+    {
+        switch (value.type()) {
+            case SerializedScriptValueData::ArrayType:
+            case SerializedScriptValueData::ObjectType:
+                return JSValue();
+            case SerializedScriptValueData::StringType:
+                return jsString(m_exec, value.asString().crossThreadString());
+            case SerializedScriptValueData::ImmediateType:
+                return value.asImmediate();
+            case SerializedScriptValueData::NumberType:
+                return jsNumber(m_exec, value.asDouble());
+            case SerializedScriptValueData::DateType:
+                return new (m_exec) DateInstance(m_exec, value.asDouble());
+            default:
+                ASSERT_NOT_REACHED();
+                return JSValue();
+        }
+    }
+
+    void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
+    {
+        properties.append(object->names());
+    }
+
+    void putProperty(JSArray* array, unsigned propertyName, JSValue value)
+    {
+        array->put(m_exec, propertyName, value);
+    }
+
+    void putProperty(JSObject* object, const RefPtr<StringImpl> propertyName, JSValue value)
+    {
+        object->putDirect(Identifier(m_exec, String(propertyName)), value);
+    }
+
+    bool startArray(RefPtr<SerializedArray>, JSArray* outArray)
+    {
+        m_gcBuffer.append(outArray);
+        return true;
+    }
+    void endArray(RefPtr<SerializedArray>, JSArray*)
+    {
+        m_gcBuffer.removeLast();
+    }
+    bool startObject(RefPtr<SerializedObject>, JSObject* outObject)
+    {
+        m_gcBuffer.append(outObject);
+        return true;
+    }
+    void endObject(RefPtr<SerializedObject>, JSObject*)
+    {
+        m_gcBuffer.removeLast();
+    }
+
+private:
+    bool m_mustCopy;
+};
+
+JSValue SerializedScriptValueData::deserialize(ExecState* exec, bool mustCopy) const
+{
+    DeserializingTreeWalker context(exec, mustCopy);
+    return walk<DeserializingTreeWalker>(context, *this);
+}
+
+struct TeardownTreeWalker {
+    typedef SerializedScriptValueData InputType;
+    typedef RefPtr<SerializedArray> InputArray;
+    typedef RefPtr<SerializedObject> InputObject;
+    typedef bool OutputType;
+    typedef bool OutputArray;
+    typedef bool OutputObject;
+    typedef SerializedObject::PropertyNameList PropertyList;
+
+    bool shouldTerminate()
+    {
+        return false;
+    }
+
+    unsigned ticksUntilNextCheck()
+    {
+        return 0xFFFFFFFF;
+    }
+
+    bool didTimeOut()
+    {
+        return false;
+    }
+
+    void throwStackOverflow()
+    {
+    }
+
+    void throwInterruptedException()
+    {
+    }
+
+    bool null() { return false; }
+
+    bool isArray(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ArrayType;
+    }
+
+    bool isObject(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ObjectType;
+    }
+
+    SerializedArray* asInputArray(const SerializedScriptValueData& value)
+    {
+        return value.asArray();
+    }
+
+    SerializedObject* asInputObject(const SerializedScriptValueData& value)
+    {
+        return value.asObject();
+    }
+
+    bool createOutputArray(unsigned)
+    {
+        return false;
+    }
+
+    bool createOutputObject()
+    {
+        return false;
+    }
+
+    uint32_t length(RefPtr<SerializedArray> array)
+    {
+        return array->length();
+    }
+
+    bool canDoFastRead(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->canDoFastRead(index);
+    }
+
+    SerializedScriptValueData getIndex(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    SerializedScriptValueData getSparseIndex(RefPtr<SerializedArray> array, unsigned propertyName, bool& hasIndex)
+    {
+        return array->getSparseIndex(propertyName, hasIndex);
+    }
+
+    SerializedScriptValueData getProperty(RefPtr<SerializedObject> object, const RefPtr<StringImpl>& propertyName, unsigned propertyIndex)
+    {
+        ASSERT(object->names()[propertyIndex] == propertyName);
+        UNUSED_PARAM(propertyName);
+        return object->values()[propertyIndex];
+    }
+
+    bool convertIfTerminal(SerializedScriptValueData& value)
+    {
+        switch (value.type()) {
+            case SerializedScriptValueData::ArrayType:
+            case SerializedScriptValueData::ObjectType:
+                return false;
+            case SerializedScriptValueData::StringType:
+            case SerializedScriptValueData::ImmediateType:
+            case SerializedScriptValueData::NumberType:
+                return true;
+            default:
+                ASSERT_NOT_REACHED();
+                return JSValue();
+        }
+    }
+
+    void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
+    {
+        properties.append(object->names());
+    }
+
+    void putProperty(bool, unsigned, bool)
+    {
+    }
+
+    void putProperty(bool, const RefPtr<StringImpl>&, bool)
+    {
+    }
+
+    bool startArray(RefPtr<SerializedArray>, bool)
+    {
+        return true;
+    }
+    void endArray(RefPtr<SerializedArray> array, bool)
+    {
+        array->clear();
+    }
+    bool startObject(RefPtr<SerializedObject>, bool)
+    {
+        return true;
+    }
+    void endObject(RefPtr<SerializedObject> object, bool)
+    {
+        object->clear();
+    }
+};
+
+void SerializedScriptValueData::tearDownSerializedData()
+{
+    if (m_sharedData && m_sharedData->refCount() > 1)
+        return;
+    TeardownTreeWalker context;
+    walk<TeardownTreeWalker>(context, *this);
+}
+
+}
diff --git a/WebCore/bindings/js/SerializedScriptValue.h b/WebCore/bindings/js/SerializedScriptValue.h
new file mode 100644
index 0000000..f8a126f
--- /dev/null
+++ b/WebCore/bindings/js/SerializedScriptValue.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef SerializedScriptValue_h
+#define SerializedScriptValue_h
+
+#include "ScriptValue.h"
+
+namespace WebCore {
+    class SerializedObject;
+    class SerializedArray;
+
+    class SharedSerializedData : public RefCounted<SharedSerializedData> {
+    public:
+        virtual ~SharedSerializedData() { }
+        SerializedArray* asArray();
+        SerializedObject* asObject();
+    };
+
+    class SerializedScriptValue;
+
+    class SerializedScriptValueData {
+    public:
+        enum SerializedType {
+            EmptyType,
+            DateType,
+            NumberType,
+            ImmediateType,
+            ObjectType,
+            ArrayType,
+            StringType
+        };
+
+        SerializedType type() const { return m_type; }
+        static SerializedScriptValueData serialize(JSC::ExecState*, JSC::JSValue);
+        JSC::JSValue deserialize(JSC::ExecState*, bool mustCopy) const;
+
+        ~SerializedScriptValueData()
+        {
+            if (m_sharedData)
+                tearDownSerializedData();
+        }
+
+        SerializedScriptValueData()
+            : m_type(EmptyType)
+        {
+        }
+
+        explicit SerializedScriptValueData(const String& string)
+            : m_type(StringType)
+            , m_string(string.crossThreadString()) // FIXME: Should be able to just share the Rep
+        {
+        }
+
+        explicit SerializedScriptValueData(JSC::JSValue value)
+            : m_type(ImmediateType)
+        {
+            ASSERT(!value.isCell());
+            m_data.m_immediate = JSC::JSValue::encode(value);
+        }
+
+        SerializedScriptValueData(SerializedType type, double value)
+            : m_type(type)
+        {
+            m_data.m_double = value;
+        }
+
+        SerializedScriptValueData(RefPtr<SerializedObject>);
+        SerializedScriptValueData(RefPtr<SerializedArray>);
+
+        JSC::JSValue asImmediate() const
+        {
+            ASSERT(m_type == ImmediateType);
+            return JSC::JSValue::decode(m_data.m_immediate);
+        }
+
+        double asDouble() const
+        {
+            ASSERT(m_type == NumberType || m_type == DateType);
+            return m_data.m_double;
+        }
+
+        String asString() const
+        {
+            ASSERT(m_type == StringType);
+            return m_string;
+        }
+
+        SerializedObject* asObject() const
+        {
+            ASSERT(m_type == ObjectType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asObject();
+        }
+
+        SerializedArray* asArray() const
+        {
+            ASSERT(m_type == ArrayType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asArray();
+        }
+
+        operator bool() const { return m_type != EmptyType; }
+
+        SerializedScriptValueData release()
+        {
+            SerializedScriptValueData result = *this;
+            *this = SerializedScriptValueData();
+            return result;
+        }
+
+    private:
+        void tearDownSerializedData();
+        SerializedType m_type;
+        RefPtr<SharedSerializedData> m_sharedData;
+        String m_string;
+        union {
+            double m_double;
+            JSC::EncodedJSValue m_immediate;
+        } m_data;
+    };
+
+    class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
+    public:
+        static PassRefPtr<SerializedScriptValue> create(JSC::ExecState* exec, JSC::JSValue value)
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData::serialize(exec, value)));
+        }
+
+        static PassRefPtr<SerializedScriptValue> create(String string)
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData(string)));
+        }
+
+        static PassRefPtr<SerializedScriptValue> create()
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData()));
+        }
+
+        PassRefPtr<SerializedScriptValue> release()
+        {
+            PassRefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_value));
+            m_value = SerializedScriptValueData();
+            result->m_mustCopy = true;
+            return result;
+        }
+
+        String toString()
+        {
+            if (m_value.type() != SerializedScriptValueData::StringType)
+                return "";
+            return m_value.asString();
+        }
+
+        JSC::JSValue deserialize(JSC::ExecState* exec)
+        {
+            if (!m_value)
+                return JSC::jsNull();
+            return m_value.deserialize(exec, m_mustCopy);
+        }
+
+        ~SerializedScriptValue() {}
+
+    private:
+        SerializedScriptValue(SerializedScriptValueData value)
+            : m_value(value)
+            , m_mustCopy(false)
+        {
+        }
+
+        SerializedScriptValueData m_value;
+        bool m_mustCopy;
+    };
+}
+
+#endif // SerializedScriptValue_h
diff --git a/WebCore/bindings/objc/DOM.mm b/WebCore/bindings/objc/DOM.mm
index 62bf1de..63a3b2a 100644
--- a/WebCore/bindings/objc/DOM.mm
+++ b/WebCore/bindings/objc/DOM.mm
@@ -29,21 +29,23 @@
 #import "DOMInternal.h" // import first to make the private/public trick work
 #import "DOM.h"
 
-#import "DOMRangeInternal.h"
 #import "DOMElementInternal.h"
-#import "DOMNodeInternal.h"
 #import "DOMHTMLCanvasElement.h"
+#import "DOMNodeInternal.h"
+#import "DOMPrivate.h"
+#import "DOMRangeInternal.h"
 #import "Frame.h"
-#import "HTMLNames.h"
 #import "HTMLElement.h"
-#import "RenderImage.h"
+#import "HTMLNames.h"
 #import "NodeFilter.h"
+#import "RenderImage.h"
 #import "WebScriptObjectPrivate.h"
 #import <wtf/HashMap.h>
 
 #if ENABLE(SVG_DOM_OBJC_BINDINGS)
 #import "DOMSVG.h"
 #import "SVGElementInstance.h"
+#import "SVGNames.h"
 #endif
 
 using namespace JSC;
@@ -154,9 +156,6 @@ static void createElementClassMap()
     addElementClass(SVGNames::circleTag, [DOMSVGCircleElement class]);
     addElementClass(SVGNames::clipPathTag, [DOMSVGClipPathElement class]);
     addElementClass(SVGNames::cursorTag, [DOMSVGCursorElement class]);
-#if ENABLE(SVG_FONTS)
-    addElementClass(SVGNames::definition_srcTag, [DOMSVGDefinitionSrcElement class]);
-#endif
     addElementClass(SVGNames::defsTag, [DOMSVGDefsElement class]);
     addElementClass(SVGNames::descTag, [DOMSVGDescElement class]);
     addElementClass(SVGNames::ellipseTag, [DOMSVGEllipseElement class]);
@@ -359,20 +358,6 @@ id <DOMEventTarget> kit(WebCore::EventTarget* eventTarget)
     return renderer->absoluteBoundingBoxRect();
 }
 
-- (NSArray *)textRects
-{
-    // FIXME: Could we move this function to WebCore::Node and autogenerate?
-    core(self)->document()->updateLayoutIgnorePendingStylesheets();
-    if (!core(self)->renderer())
-        return nil;
-    RefPtr<Range> range = Range::create(core(self)->document());
-    WebCore::ExceptionCode ec = 0;
-    range->selectNodeContents(core(self), ec);
-    Vector<WebCore::IntRect> rects;
-    range->textRects(rects);
-    return kit(rects);
-}
-
 - (NSArray *)lineBoxRects
 {
     return [self textRects];
@@ -392,6 +377,19 @@ id <DOMEventTarget> kit(WebCore::EventTarget* eventTarget)
     return frame->nodeImage(node);
 }
 
+- (NSArray *)textRects
+{
+    // FIXME: Could we move this function to WebCore::Node and autogenerate?
+    core(self)->document()->updateLayoutIgnorePendingStylesheets();
+    if (!core(self)->renderer())
+        return nil;
+    RefPtr<Range> range = Range::create(core(self)->document());
+    WebCore::ExceptionCode ec = 0;
+    range->selectNodeContents(core(self), ec);
+    Vector<WebCore::IntRect> rects;
+    range->textRects(rects);
+    return kit(rects);
+}
 @end
 
 @implementation DOMRange (DOMRangeExtensions)
diff --git a/WebCore/bindings/objc/DOMCSS.mm b/WebCore/bindings/objc/DOMCSS.mm
index 0149273..22a9cb2 100644
--- a/WebCore/bindings/objc/DOMCSS.mm
+++ b/WebCore/bindings/objc/DOMCSS.mm
@@ -47,6 +47,7 @@
 #import "DOMStyleSheetInternal.h"
 #import "DOMWebKitCSSKeyframeRule.h"
 #import "DOMWebKitCSSKeyframesRule.h"
+#import "DOMWebKitCSSTransformValue.h"
 
 #if ENABLE(SVG_DOM_OBJC_BINDINGS)
 #import "DOMSVGPaint.h"
@@ -102,6 +103,8 @@ Class kitClass(WebCore::CSSValue* impl)
         case WebCore::CSSValue::CSS_PRIMITIVE_VALUE:
             return [DOMCSSPrimitiveValue class];
         case WebCore::CSSValue::CSS_VALUE_LIST:
+            if (impl->isWebKitCSSTransformValue())
+                return [DOMWebKitCSSTransformValue class];
             return [DOMCSSValueList class];
         case WebCore::CSSValue::CSS_INHERIT:
         case WebCore::CSSValue::CSS_INITIAL:
diff --git a/WebCore/bindings/objc/DOMInternal.h b/WebCore/bindings/objc/DOMInternal.h
index 48f5d2f..72f63d2 100644
--- a/WebCore/bindings/objc/DOMInternal.h
+++ b/WebCore/bindings/objc/DOMInternal.h
@@ -61,7 +61,6 @@ namespace WebCore {
 
 // Create an NSMapTable mapping from pointers to ObjC objects held with zeroing weak references.
 NSMapTable* createWrapperCache();
-NSMapTable* createWrapperCacheWithIntegerKeys(); // Same, but from integers to ObjC objects.
 
 id createDOMWrapper(JSC::JSObject*, PassRefPtr<JSC::Bindings::RootObject> origin, PassRefPtr<JSC::Bindings::RootObject> current);
 
diff --git a/WebCore/bindings/objc/DOMInternal.mm b/WebCore/bindings/objc/DOMInternal.mm
index 9b26e59..993a3ad 100644
--- a/WebCore/bindings/objc/DOMInternal.mm
+++ b/WebCore/bindings/objc/DOMInternal.mm
@@ -49,18 +49,6 @@ NSMapTable* createWrapperCache()
 #endif
 }
 
-NSMapTable* createWrapperCacheWithIntegerKeys()
-{
-#ifdef BUILDING_ON_TIGER
-    return NSCreateMapTable(NSIntMapKeyCallBacks, NSNonRetainedObjectMapValueCallBacks, 0);
-#else
-    // NSMapTable with zeroing weak pointers is the recommended way to build caches like this under garbage collection.
-    NSPointerFunctionsOptions keyOptions = NSPointerFunctionsOpaqueMemory | NSPointerFunctionsIntegerPersonality;
-    NSPointerFunctionsOptions valueOptions = NSPointerFunctionsZeroingWeakMemory | NSPointerFunctionsObjectPersonality;
-    return [[NSMapTable alloc] initWithKeyOptions:keyOptions valueOptions:valueOptions capacity:0];
-#endif
-}
-
 NSObject* getDOMWrapper(DOMObjectInternal* impl)
 {
     if (!DOMWrapperCache)
diff --git a/WebCore/bindings/objc/DOMSVG.h b/WebCore/bindings/objc/DOMSVG.h
index f1321d8..cb74544 100644
--- a/WebCore/bindings/objc/DOMSVG.h
+++ b/WebCore/bindings/objc/DOMSVG.h
@@ -50,7 +50,6 @@
 #import <WebCore/DOMSVGColor.h>
 #import <WebCore/DOMSVGComponentTransferFunctionElement.h>
 #import <WebCore/DOMSVGCursorElement.h>
-#import <WebCore/DOMSVGDefinitionSrcElement.h>
 #import <WebCore/DOMSVGDefsElement.h>
 #import <WebCore/DOMSVGDescElement.h>
 #import <WebCore/DOMSVGDocument.h>
diff --git a/WebCore/bindings/objc/ObjCEventListener.h b/WebCore/bindings/objc/ObjCEventListener.h
index 6056b01..434ef45 100644
--- a/WebCore/bindings/objc/ObjCEventListener.h
+++ b/WebCore/bindings/objc/ObjCEventListener.h
@@ -39,13 +39,22 @@ namespace WebCore {
     public:
         static PassRefPtr<ObjCEventListener> wrap(id <DOMEventListener>);
 
+        static const ObjCEventListener* cast(const EventListener* listener)
+        {
+            return listener->type() == ObjCEventListenerType
+                ? static_cast<const ObjCEventListener*>(listener)
+                : 0;
+        }
+
+        virtual bool operator==(const EventListener& other);
+
     private:
         static ObjCEventListener* find(id <DOMEventListener>);
 
         ObjCEventListener(id <DOMEventListener>);
         virtual ~ObjCEventListener();
 
-        virtual void handleEvent(Event*, bool isWindowEvent);
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
 
         id <DOMEventListener> m_listener;
     };
diff --git a/WebCore/bindings/objc/ObjCEventListener.mm b/WebCore/bindings/objc/ObjCEventListener.mm
index 77c6ad2..d73ac30 100644
--- a/WebCore/bindings/objc/ObjCEventListener.mm
+++ b/WebCore/bindings/objc/ObjCEventListener.mm
@@ -56,7 +56,8 @@ PassRefPtr<ObjCEventListener> ObjCEventListener::wrap(id <DOMEventListener> list
 }
 
 ObjCEventListener::ObjCEventListener(id <DOMEventListener> listener)
-    : m_listener([listener retain])
+    : EventListener(ObjCEventListenerType)
+    , m_listener([listener retain])
 {
     ListenerMap* map = listenerMap;
     if (!map) {
@@ -72,9 +73,16 @@ ObjCEventListener::~ObjCEventListener()
     [m_listener release];
 }
 
-void ObjCEventListener::handleEvent(Event* event, bool)
+void ObjCEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
     [m_listener handleEvent:kit(event)];
 }
 
+bool ObjCEventListener::operator==(const EventListener& listener)
+{
+    if (const ObjCEventListener* objCEventListener = ObjCEventListener::cast(&listener))
+        return m_listener == objCEventListener->m_listener;
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/scripts/CodeGenerator.pm b/WebCore/bindings/scripts/CodeGenerator.pm
index 341c607..92bd390 100644
--- a/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/WebCore/bindings/scripts/CodeGenerator.pm
@@ -4,6 +4,7 @@
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 # Copyright (C) 2007 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 # 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -23,12 +24,16 @@
 
 package CodeGenerator;
 
+use File::Find;
+
 my $useDocument = "";
 my $useGenerator = "";
 my $useOutputDir = "";
 my $useDirectories = "";
 my $useLayerOnTop = 0;
 my $preprocessor;
+my $writeDependencies = 0;
+my $defines = "";
 
 my $codeGenerator = 0;
 
@@ -54,12 +59,8 @@ my %svgAnimatedTypeHash = ("SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1,
                            "SVGAnimatedRect" => 1, "SVGAnimatedString" => 1,
                            "SVGAnimatedTransformList" => 1);
 
-# Helpers for 'ScanDirectory'
-my $endCondition = 0;
-my $foundFilename = "";
-my @foundFilenames = ();
-my $ignoreParent = 1;
-my $defines = "";
+# Cache of IDL file pathnames.
+my $idlFiles;
 
 # Default constructor
 sub new
@@ -72,6 +73,7 @@ sub new
     $useOutputDir = shift;
     $useLayerOnTop = shift;
     $preprocessor = shift;
+    $writeDependencies = shift;
 
     bless($reference, $object);
     return $reference;
@@ -95,7 +97,7 @@ sub ProcessDocument
 
     # Dynamically load external code generation perl module
     require $ifaceName . ".pm";
-    $codeGenerator = $ifaceName->new($object, $useOutputDir, $useLayerOnTop, $preprocessor);
+    $codeGenerator = $ifaceName->new($object, $useOutputDir, $useLayerOnTop, $preprocessor, $writeDependencies);
     unless (defined($codeGenerator)) {
         my $classes = $useDocument->classes;
         foreach my $class (@$classes) {
@@ -116,100 +118,83 @@ sub ProcessDocument
     $codeGenerator->finish();
 }
 
-# Necessary for V8 bindings to determine whether an interface is descendant from Node.
-# Node descendants are treated differently by DOMMap and this allows inferring the
-# type statically. See more at the original change: http://codereview.chromium.org/3195.
-# FIXME: Figure out a way to eliminate this JS bindings dichotomy.
-sub FindParentsRecursively
+sub ForAllParents
 {
     my $object = shift;
     my $dataNode = shift;
-    my @parents = ($dataNode->name);
-    foreach (@{$dataNode->parents}) {
-        my $interface = $object->StripModule($_);
-
-        $endCondition = 0;
-        $foundFilename = "";
-        foreach (@{$useDirectories}) {
-            $object->ScanDirectory("$interface.idl", $_, $_, 0) if ($foundFilename eq "");
-        }
+    my $beforeRecursion = shift;
+    my $afterRecursion = shift;
+    my $parentsOnly = shift;
 
-        if ($foundFilename ne "") {
-            print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interface\"\n" if $verbose;
+    my $recurse;
+    $recurse = sub {
+        my $interface = shift;
 
-           # Step #2: Parse the found IDL file (in quiet mode).
-            my $parser = IDLParser->new(1);
-            my $document = $parser->Parse($foundFilename, $defines, $preprocessor, 1);
+        for (@{$interface->parents}) {
+            my $interfaceName = $object->StripModule($_);
+            my $parentInterface = $object->ParseInterface($interfaceName, $parentsOnly);
 
-            foreach my $class (@{$document->classes}) {
-                @parents = (@parents, FindParentsRecursively($object, $class));
+            if ($beforeRecursion) {
+                &$beforeRecursion($parentInterface) eq 'prune' and next;
             }
-        } else {
-            die("Could NOT find specified parent interface \"$interface\"!\n")
+            &$recurse($parentInterface);
+            &$afterRecursion($parentInterface) if $afterRecursion;
         }
-    }
-    return @parents;
+    };
+
+    &$recurse($dataNode);
 }
 
 sub AddMethodsConstantsAndAttributesFromParentClasses
 {
-    # For the passed interface, recursively parse all parent
-    # IDLs in order to find out all inherited properties/methods.
+    # Add to $dataNode all of its inherited interface members, except for those
+    # inherited through $dataNode's first listed parent.  If an array reference
+    # is passed in as $parents, the names of all ancestor interfaces visited
+    # will be appended to the array.  If $collectDirectParents is true, then
+    # even the names of $dataNode's first listed parent and its ancestors will
+    # be appended to $parents.
 
     my $object = shift;
     my $dataNode = shift;
+    my $parents = shift;
+    my $collectDirectParents = shift;
 
-    my @parents = @{$dataNode->parents};
-    my $parentsMax = @{$dataNode->parents};
+    my $first = 1;
 
-    my $constantsRef = $dataNode->constants;
-    my $functionsRef = $dataNode->functions;
-    my $attributesRef = $dataNode->attributes;
+    $object->ForAllParents($dataNode, sub {
+        my $interface = shift;
 
-    foreach (@{$dataNode->parents}) {
-        if ($ignoreParent) {
+        if ($first) {
             # Ignore first parent class, already handled by the generation itself.
-            $ignoreParent = 0;
-            next;
-        }
-
-        my $interface = $object->StripModule($_);
-
-        # Step #1: Find the IDL file associated with 'interface'
-        $endCondition = 0;
-        $foundFilename = "";
+            $first = 0;
+
+            if ($collectDirectParents) {
+                # Just collect the names of the direct ancestor interfaces,
+                # if necessary.
+                push(@$parents, $interface->name);
+                $object->ForAllParents($interface, sub {
+                    my $interface = shift;
+                    push(@$parents, $interface->name);
+                }, undef, 1);
+            }
 
-        foreach (@{$useDirectories}) {
-            $object->ScanDirectory("$interface.idl", $_, $_, 0) if ($foundFilename eq "");
+            # Prune the recursion here.
+            return 'prune';
         }
 
-        if ($foundFilename ne "") {
-            print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interface\"\n" if $verbose;
-
-            # Step #2: Parse the found IDL file (in quiet mode).
-            my $parser = IDLParser->new(1);
-            my $document = $parser->Parse($foundFilename, $defines, $preprocessor);
+        # Collect the name of this additional parent.
+        push(@$parents, $interface->name) if $parents;
 
-            foreach my $class (@{$document->classes}) {
-                # Step #3: Enter recursive parent search
-                AddMethodsConstantsAndAttributesFromParentClasses($object, $class);
+        print "  |  |>  -> Inheriting "
+            . @{$interface->constants} . " constants, "
+            . @{$interface->functions} . " functions, "
+            . @{$interface->attributes} . " attributes...\n  |  |>\n" if $verbose;
 
-                # Step #4: Collect constants & functions & attributes of this parent-class
-                my $constantsMax = @{$class->constants};
-                my $functionsMax = @{$class->functions};
-                my $attributesMax = @{$class->attributes};
-
-                print "  |  |>  -> Inheriting $constantsMax constants, $functionsMax functions, $attributesMax attributes...\n  |  |>\n" if $verbose;
-
-                # Step #5: Concatenate data
-                push(@$constantsRef, $_) foreach (@{$class->constants});
-                push(@$functionsRef, $_) foreach (@{$class->functions});
-                push(@$attributesRef, $_) foreach (@{$class->attributes});
-            }
-        } else {
-            die("Could NOT find specified parent interface \"$interface\"!\n");
-        }
-    }
+        # Add this parent's members to $dataNode.
+        push(@{$dataNode->constants}, @{$interface->constants});
+        push(@{$dataNode->functions}, @{$interface->functions});
+        push(@{$dataNode->attributes}, @{$interface->attributes});
+    });
 }
 
 sub GetMethodsAndAttributesFromParentClasses
@@ -220,76 +205,67 @@ sub GetMethodsAndAttributesFromParentClasses
     my $object = shift;
     my $dataNode = shift;
 
-    my @parents = @{$dataNode->parents};
-
-    return if @{$dataNode->parents} == 0;
-
     my @parentList = ();
 
-    foreach (@{$dataNode->parents}) {
-        my $interface = $object->StripModule($_);
+    $object->ForAllParents($dataNode, undef, sub {
+        my $interface = shift;
 
-        # Step #1: Find the IDL file associated with 'interface'
-        $endCondition = 0;
-        $foundFilename = "";
+        my $hash = {
+            "name" => $interface->name,
+            "functions" => $interface->functions,
+            "attributes" => $interface->attributes
+        };
 
-        foreach (@{$useDirectories}) {
-            $object->ScanDirectory("${interface}.idl", $_, $_, 0) if $foundFilename eq "";
-        }
-
-        die("Could NOT find specified parent interface \"$interface\"!\n") if $foundFilename eq "";
-
-        print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interface\"\n" if $verbose;
+        unshift(@parentList, $hash);
+    });
 
-        # Step #2: Parse the found IDL file (in quiet mode).
-        my $parser = IDLParser->new(1);
-        my $document = $parser->Parse($foundFilename, $defines);
+    return @parentList;
+}
 
-        foreach my $class (@{$document->classes}) {
-            # Step #3: Enter recursive parent search
-            push(@parentList, GetMethodsAndAttributesFromParentClasses($object, $class));
+sub IDLFileForInterface
+{
+    my $object = shift;
+    my $interfaceName = shift;
 
-            # Step #4: Collect constants & functions & attributes of this parent-class
+    unless ($idlFiles) {
+        my $sourceRoot = $ENV{SOURCE_ROOT};
+        my @directories = map { $_ = "$sourceRoot/$_" if $sourceRoot && -d "$sourceRoot/$_"; $_ } @$useDirectories;
 
-            # print "  |  |>  -> Inheriting $functionsMax functions amd $attributesMax attributes...\n  |  |>\n" if $verbose;
-            my $hash = {
-                "name" => $class->name,
-                "functions" => $class->functions,
-                "attributes" => $class->attributes
-            };
+        $idlFiles = { };
 
-            # Step #5: Concatenate data
-            unshift(@parentList, $hash);
-        }
+        my $wanted = sub {
+            $idlFiles->{$1} = $File::Find::name if /^([A-Z].*)\.idl$/;
+            $File::Find::prune = 1 if /^\../;
+        };
+        find($wanted, @directories);
     }
 
-    return @parentList;
+    return $idlFiles->{$interfaceName};
 }
 
 sub ParseInterface
 {
-    my ($object, $interfaceName) = @_;
+    my $object = shift;
+    my $interfaceName = shift;
+    my $parentsOnly = shift;
 
-    # Step #1: Find the IDL file associated with 'interface'
-    $endCondition = 0;
-    $foundFilename = "";
+    return undef if $interfaceName eq 'Object';
 
-    foreach (@{$useDirectories}) {
-        $object->ScanDirectory("${interfaceName}.idl", $_, $_, 0) if $foundFilename eq "";
-    }
-    die "Could NOT find specified parent interface \"$interfaceName\"!\n" if $foundFilename eq "";
+    # Step #1: Find the IDL file associated with 'interface'
+    my $filename = $object->IDLFileForInterface($interfaceName)
+        or die("Could NOT find IDL file for interface \"$interfaceName\"!\n");
 
-    print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interfaceName\"\n" if $verbose;
+    print "  |  |>  Parsing parent IDL \"$filename\" for interface \"$interfaceName\"\n" if $verbose;
 
     # Step #2: Parse the found IDL file (in quiet mode).
     my $parser = IDLParser->new(1);
-    my $document = $parser->Parse($foundFilename, $defines);
+    my $document = $parser->Parse($filename, $defines, $preprocessor, $parentsOnly);
 
     foreach my $interface (@{$document->classes}) {
         return $interface if $interface->name eq $interfaceName;
     }
 
-    die "Interface definition not found";
+    die("Could NOT find interface definition for $interface in $filename");
 }
 
 # Helpers for all CodeGenerator***.pm modules
@@ -348,56 +324,6 @@ sub IsSVGAnimatedType
     return 0; 
 }
 
-# Internal Helper
-sub ScanDirectory
-{
-    my $object = shift;
-
-    my $interface = shift;
-    my $directory = shift;
-    my $useDirectory = shift;
-    my $reportAllFiles = shift;
-
-    return if ($endCondition eq 1) and ($reportAllFiles eq 0);
-
-    my $sourceRoot = $ENV{SOURCE_ROOT};
-    my $thisDir = $sourceRoot ? "$sourceRoot/$directory" : $directory;
-
-    if (!opendir(DIR, $thisDir)) {
-        opendir(DIR, $directory) or die "[ERROR] Can't open directory $thisDir or $directory: \"$!\"\n";
-        $thisDir = $directory;
-    }
-
-    my @names = readdir(DIR) or die "[ERROR] Cant't read directory $thisDir \"$!\"\n";
-    closedir(DIR);
-
-    foreach my $name (@names) {
-        # Skip if we already found the right file or
-        # if we encounter 'exotic' stuff (ie. '.', '..', '.svn')
-        next if ($endCondition eq 1) or ($name =~ /^\./);
-
-        # Recurisvely enter directory
-        if (-d "$thisDir/$name") {
-            $object->ScanDirectory($interface, "$directory/$name", $useDirectory, $reportAllFiles);
-            next;
-        }
-
-        # Check wheter we found the desired file
-        my $condition = ($name eq $interface);
-        $condition = 1 if ($interface eq "allidls") and ($name =~ /\.idl$/);
-
-        if ($condition) {
-            $foundFilename = "$thisDir/$name";
-
-            if ($reportAllFiles eq 0) {
-                $endCondition = 1;
-            } else {
-                push(@foundFilenames, $foundFilename);
-            }
-        }
-    }
-}
-
 # Uppercase the first letter while respecting WebKit style guidelines. 
 # E.g., xmlEncoding becomes XMLEncoding, but xmlllang becomes Xmllang.
 sub WK_ucfirst
diff --git a/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
index 6641305..4d5cb96 100644
--- a/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
@@ -326,9 +326,8 @@ sub AddIncludesForTypeInCPPImplementation
 
 sub GetAdditionalInterfaces
 {
+    # This function does nothing, but it stays here for future multiple inheritance support.
     my $type = $codeGenerator->StripModule(shift);
-
-    return ("EventTarget") if $type eq "Node";
     return ();
 }
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 1918aef..095c75f 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -4,6 +4,7 @@
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 # 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -26,6 +27,7 @@ use File::stat;
 
 my $module = "";
 my $outputDir = "";
+my $writeDependencies = 0;
 
 my @headerContentHeader = ();
 my @headerContent = ();
@@ -34,6 +36,7 @@ my %headerIncludes = ();
 my @implContentHeader = ();
 my @implContent = ();
 my %implIncludes = ();
+my @depsContent = ();
 
 # Default .h template
 my $headerTemplate = << "EOF";
@@ -66,6 +69,9 @@ sub new
 
     $codeGenerator = shift;
     $outputDir = shift;
+    shift; # $useLayerOnTop
+    shift; # $preprocessor
+    $writeDependencies = shift;
 
     bless($reference, $object);
     return $reference;
@@ -100,9 +106,16 @@ sub GenerateInterface
     # Open files for writing
     my $headerFileName = "$outputDir/JS$name.h";
     my $implFileName = "$outputDir/JS$name.cpp";
+    my $depsFileName = "$outputDir/JS$name.dep";
+
+    # Remove old dependency file.
+    unlink($depsFileName);
 
     open($IMPL, ">$implFileName") || die "Couldn't open file $implFileName";
     open($HEADER, ">$headerFileName") || die "Couldn't open file $headerFileName";
+    if (@depsContent) {
+        open($DEPS, ">$depsFileName") || die "Couldn't open file $depsFileName";
+    }
 }
 
 # Params: 'idlDocument' struct
@@ -300,11 +313,11 @@ sub GenerateGetOwnPropertySlotBody
         &$manualLookupGetterGeneration();
     }
 
-    if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+    if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@getOwnPropertySlotImpl, "    bool ok;\n");
         push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
         push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
-        if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+        if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@getOwnPropertySlotImpl, "        slot.setValue(getByIndex(exec, index));\n");
         } else {
             push(@getOwnPropertySlotImpl, "        slot.setCustomIndex(this, index, indexGetter);\n");
@@ -348,6 +361,99 @@ sub GenerateGetOwnPropertySlotBody
     return @getOwnPropertySlotImpl;
 }
 
+sub GenerateGetOwnPropertyDescriptorBody
+{
+    my ($dataNode, $interfaceName, $className, $implClassName, $hasAttributes, $inlined) = @_;
+    
+    my $namespaceMaybe = ($inlined ? "JSC::" : "");
+    
+    my @getOwnPropertyDescriptorImpl = ();
+    
+    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection") {
+        push(@getOwnPropertyDescriptorImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
+        push(@getOwnPropertyDescriptorImpl, "    if (proto.isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
+        push(@getOwnPropertyDescriptorImpl, "        return false;\n\n");
+    }
+    
+    my $manualLookupGetterGeneration = sub {
+        my $requiresManualLookup = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasNameGetter"};
+        if ($requiresManualLookup) {
+            push(@getOwnPropertyDescriptorImpl, "    const ${namespaceMaybe}HashEntry* entry = ${className}Table.entry(exec, propertyName);\n");
+            push(@getOwnPropertyDescriptorImpl, "    if (entry) {\n");
+            push(@getOwnPropertyDescriptorImpl, "        PropertySlot slot;\n");
+            push(@getOwnPropertyDescriptorImpl, "        slot.setCustom(this, entry->propertyGetter());\n");
+            push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());\n");
+            push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+            push(@getOwnPropertyDescriptorImpl, "    }\n");
+        }
+    };
+    
+    if (!$dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        &$manualLookupGetterGeneration();
+    }
+    
+    if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+        push(@getOwnPropertyDescriptorImpl, "    bool ok;\n");
+        push(@getOwnPropertyDescriptorImpl, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
+        push(@getOwnPropertyDescriptorImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+        if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+            # Assume that if there's a setter, the index will be writable
+            if ($dataNode->extendedAttributes->{"HasIndexSetter"} || $dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(getByIndex(exec, index), ${namespaceMaybe}DontDelete);\n");
+            } else {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(getByIndex(exec, index), ${namespaceMaybe}DontDelete | ${namespaceMaybe}ReadOnly);\n");
+            }
+        } else {
+            push(@getOwnPropertyDescriptorImpl, "        ${namespaceMaybe}PropertySlot slot;\n");
+            push(@getOwnPropertyDescriptorImpl, "        slot.setCustomIndex(this, index, indexGetter);\n");
+            # Assume that if there's a setter, the index will be writable
+            if ($dataNode->extendedAttributes->{"HasIndexSetter"} || $dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), ${namespaceMaybe}DontDelete);\n");
+            } else {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), ${namespaceMaybe}DontDelete | ${namespaceMaybe}ReadOnly);\n");
+            }
+        }
+        push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+        push(@getOwnPropertyDescriptorImpl, "    }\n");
+    }
+    
+    if ($dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        push(@getOwnPropertyDescriptorImpl, "    if (canGetItemsForName(exec, static_cast<$implClassName*>(impl()), propertyName)) {\n");
+        push(@getOwnPropertyDescriptorImpl, "        ${namespaceMaybe}PropertySlot slot;\n");
+        push(@getOwnPropertyDescriptorImpl, "        slot.setCustom(this, nameGetter);\n");
+        push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);\n");
+        push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+        push(@getOwnPropertyDescriptorImpl, "    }\n");
+        if ($inlined) {
+            $headerIncludes{"AtomicString.h"} = 1;
+        } else {
+            $implIncludes{"AtomicString.h"} = 1;
+        }
+    }
+    
+    if ($dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        &$manualLookupGetterGeneration();
+    }
+    
+    if ($dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}) {
+        push(@getOwnPropertyDescriptorImpl, "    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))\n");
+        push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+    }
+    
+    if ($hasAttributes) {
+        if ($inlined) {
+            die "Cannot inline if NoStaticTables is set." if ($dataNode->extendedAttributes->{"NoStaticTables"});
+            push(@getOwnPropertyDescriptorImpl, "    return ${namespaceMaybe}getStaticValueDescriptor<$className, Base>(exec, s_info.staticPropHashTable, this, propertyName, descriptor);\n");
+        } else {
+            push(@getOwnPropertyDescriptorImpl, "    return ${namespaceMaybe}getStaticValueDescriptor<$className, Base>(exec, " . hashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        }
+    } else {
+        push(@getOwnPropertyDescriptorImpl, "    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);\n");
+    }
+    
+    return @getOwnPropertyDescriptorImpl;
+}
+
 sub GenerateHeader
 {
     my $object = shift;
@@ -356,11 +462,12 @@ sub GenerateHeader
     my $interfaceName = $dataNode->name;
     my $className = "JS$interfaceName";
     my $implClassName = $interfaceName;
+    my @ancestorInterfaceNames = ();
 
     # We only support multiple parents with SVG (for now).
     if (@{$dataNode->parents} > 1) {
         die "A class can't have more than one parent" unless $interfaceName =~ /SVG/;
-        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode);
+        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@ancestorInterfaceNames);
     }
 
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
@@ -369,7 +476,9 @@ sub GenerateHeader
     my $parentClassName = GetParentClassName($dataNode);
     my $conditional = $dataNode->extendedAttributes->{"Conditional"};
     my $needsSVGContext = IsSVGTypeNeedingContextParameter($interfaceName);
-
+    my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
+    my $needsMarkChildren = $dataNode->extendedAttributes->{"CustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
+    
     # - Add default header template
     @headerContentHeader = split("\r", $headerTemplate);
 
@@ -431,17 +540,17 @@ sub GenerateHeader
 
     # Constructor
     if ($interfaceName eq "DOMWindow") {
-        push(@headerContent, "    $className(PassRefPtr<JSC::Structure>, PassRefPtr<$implType>, JSDOMWindowShell*);\n");
+        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<$implType>, JSDOMWindowShell*);\n");
     } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
-        push(@headerContent, "    $className(PassRefPtr<JSC::Structure>, PassRefPtr<$implType>);\n");
+        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<$implType>);\n");
     } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-        push(@headerContent, "    $className(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>, SVGElement* context);\n");
+        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>, SVGElement* context);\n");
     } else {
-        push(@headerContent, "    $className(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>);\n");
+        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>);\n");
     }
 
     # Destructor
-    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
+    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $eventTarget or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
 
     # Prototype
     push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
@@ -452,6 +561,7 @@ sub GenerateHeader
                  || $dataNode->extendedAttributes->{"GenerateConstructor"} 
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
+                 || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"HasNameGetter"}
@@ -460,8 +570,10 @@ sub GenerateHeader
     # Getters
     if ($hasGetter) {
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);\n");
-        push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"};
+        push(@headerContent, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);\n");
+        push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"};
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
+        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
     }
 
     # Check if we have any writable properties
@@ -503,8 +615,8 @@ sub GenerateHeader
             "    }\n\n");
     }
 
-    # Custom mark function
-    push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n") if $dataNode->extendedAttributes->{"CustomMarkFunction"};
+    # markChildren function
+    push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n") if $needsMarkChildren;
 
     # Custom pushEventHandlerScope function
     push(@headerContent, "    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;\n\n") if $dataNode->extendedAttributes->{"CustomPushEventHandlerScope"};
@@ -515,17 +627,23 @@ sub GenerateHeader
     # Custom deleteProperty function
     push(@headerContent, "    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);\n") if $dataNode->extendedAttributes->{"CustomDeleteProperty"};
 
-    # Custom getPropertyNames function
-    push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"});
+    # Custom getPropertyNames function exists on DOMWindow
+    push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if $interfaceName eq "DOMWindow";
+
+    # Custom defineProperty function exists on DOMWindow
+    push(@headerContent, "    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $interfaceName eq "DOMWindow";
+
+    # Custom getOwnPropertyNames function
+    push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"});    
 
     # Custom getPropertyAttributes function
     push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
 
     # Custom defineGetter function
-    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);\n") if $dataNode->extendedAttributes->{"CustomDefineGetter"};
+    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomDefineGetter"};
 
     # Custom defineSetter function
-    push(@headerContent, "    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);\n") if $dataNode->extendedAttributes->{"CustomDefineSetter"};
+    push(@headerContent, "    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomDefineSetter"};
 
     # Custom lookupGetter function
     push(@headerContent, "    virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupGetter"};
@@ -599,7 +717,7 @@ sub GenerateHeader
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
         push(@headerContent, "    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
     }
-    if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+    if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
     }
     
@@ -621,6 +739,10 @@ sub GenerateHeader
         push(@headerContent, "{\n");
         push(@headerContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 1));
         push(@headerContent, "}\n\n");
+        push(@headerContent, "ALWAYS_INLINE bool ${className}::getOwnPropertyDescriptor(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor)\n");
+        push(@headerContent, "{\n");
+        push(@headerContent, GenerateGetOwnPropertyDescriptorBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 1));
+        push(@headerContent, "}\n\n");
     }
 
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateToJS"} || $dataNode->extendedAttributes->{"CustomToJS"}) {
@@ -662,11 +784,19 @@ sub GenerateHeader
     push(@headerContent, "    static const JSC::ClassInfo s_info;\n");
     if ($numFunctions > 0 || $numConstants > 0 || $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"}) {
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n");
+        push(@headerContent, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
+        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
 
         push(@headerContent,
             "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
+            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType" . ($needsMarkChildren ? "" : ", JSC::HasDefaultMark") . "));\n" .
+            "    }\n");
+    } elsif ($dataNode->extendedAttributes->{"CustomMarkFunction"}) {
+        push(@headerContent,
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+            "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
             "    }\n");
     }
@@ -676,9 +806,9 @@ sub GenerateHeader
     }
 
     # Custom defineGetter function
-    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);\n") if $dataNode->extendedAttributes->{"CustomPrototypeDefineGetter"};
+    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomPrototypeDefineGetter"};
 
-    push(@headerContent, "    ${className}Prototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
+    push(@headerContent, "    ${className}Prototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
 
     push(@headerContent, "};\n\n");
 
@@ -718,6 +848,12 @@ sub GenerateHeader
     push(@headerContent, "\n} // namespace WebCore\n\n");
     push(@headerContent, "#endif // ${conditionalString}\n\n") if $conditional;
     push(@headerContent, "#endif\n");
+
+    # - Generate dependencies.
+    if ($writeDependencies && @ancestorInterfaceNames) {
+        push(@depsContent, "$className.h : ", join(" ", map { "$_.idl" } @ancestorInterfaceNames), "\n");
+        push(@depsContent, map { "$_.idl :\n" } @ancestorInterfaceNames); 
+    }
 }
 
 sub GenerateImplementation
@@ -734,6 +870,8 @@ sub GenerateImplementation
     my $parentClassName = GetParentClassName($dataNode);
     my $conditional = $dataNode->extendedAttributes->{"Conditional"};
     my $visibleClassName = GetVisibleClassName($interfaceName);
+    my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
+    my $needsMarkChildren = $dataNode->extendedAttributes->{"CustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
 
     # - Add default header template
     @implContentHeader = split("\r", $headerTemplate);
@@ -749,7 +887,7 @@ sub GenerateImplementation
     AddIncludesForSVGAnimatedType($interfaceName) if $className =~ /^JSSVGAnimated/;
 
     $implIncludes{"<wtf/GetPtr.h>"} = 1;
-    $implIncludes{"<runtime/PropertyNameArray.h>"} = 1 if $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"};
+    $implIncludes{"<runtime/PropertyNameArray.h>"} = 1 if $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"};
 
     AddIncludesForType($interfaceName);
 
@@ -933,6 +1071,25 @@ sub GenerateImplementation
             push(@implContent, "    return getStaticPropertySlot<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, slot);\n");
         }
         push(@implContent, "}\n\n");
+
+        push(@implContent, "bool ${className}Prototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
+        push(@implContent, "{\n");
+        
+        if ($dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"}) {
+            push(@implContent, "    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))\n");
+            push(@implContent, "        return true;\n");
+        }
+        
+        if ($numConstants eq 0 && $numFunctions eq 0) {
+            push(@implContent, "    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);\n");        
+        } elsif ($numConstants eq 0) {
+            push(@implContent, "    return getStaticFunctionDescriptor<JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        } elsif ($numFunctions eq 0) {
+            push(@implContent, "    return getStaticValueDescriptor<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        } else {
+            push(@implContent, "    return getStaticPropertyDescriptor<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        }
+        push(@implContent, "}\n\n");
     }
 
     if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
@@ -980,15 +1137,15 @@ sub GenerateImplementation
     # Constructor
     if ($interfaceName eq "DOMWindow") {
         AddIncludesForType("JSDOMWindowShell");
-        push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, PassRefPtr<$implType> impl, JSDOMWindowShell* shell)\n");
+        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, PassRefPtr<$implType> impl, JSDOMWindowShell* shell)\n");
         push(@implContent, "    : $parentClassName(structure, impl, shell)\n");
     } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
         AddIncludesForType($interfaceName);
-        push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, PassRefPtr<$implType> impl)\n");
+        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, PassRefPtr<$implType> impl)\n");
         push(@implContent, "    : $parentClassName(structure, impl)\n");
     } else {
         my $contextArg = $needsSVGContext ? ", SVGElement* context" : "";
-        push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<$implType> impl$contextArg)\n");
+        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<$implType> impl$contextArg)\n");
         if ($hasParent) {
             push(@implContent, "    : $parentClassName(structure, globalObject, impl" . ($parentNeedsSVGContext ? ", context" : "") . ")\n");
         } else {
@@ -1000,17 +1157,17 @@ sub GenerateImplementation
     push(@implContent, "}\n\n");
 
     # Destructor
-    if (!$hasParent || $interfaceName eq "DOMWindow") {
+    if (!$hasParent || $eventTarget) {
         push(@implContent, "${className}::~$className()\n");
         push(@implContent, "{\n");
 
+        if ($eventTarget) {
+            $implIncludes{"RegisteredEventListener.h"} = 1;
+            push(@implContent, "    impl()->invalidateEventListeners();\n");
+        }
+
         if ($interfaceName eq "Node") {
-             $implIncludes{"RegisteredEventListener.h"} = 1;
-             push(@implContent, "    invalidateEventListeners(m_impl->eventListeners());\n");
-             push(@implContent, "    forgetDOMNode(m_impl->document(), m_impl.get());\n");
-        } elsif ($interfaceName eq "DOMWindow") {
-             $implIncludes{"RegisteredEventListener.h"} = 1;
-             push(@implContent, "    invalidateEventListeners(impl()->eventListeners());\n");
+             push(@implContent, "    forgetDOMNode(impl()->document(), impl());\n");
         } else {
             if ($podType) {
                 my $animatedType = $implClassName;
@@ -1021,7 +1178,7 @@ sub GenerateImplementation
                     push(@implContent, "    JSSVGDynamicPODTypeWrapperCache<$podType, $animatedType>::forgetWrapper(m_impl.get());\n");
                 }
             }
-            push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());\n");
+            push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), impl());\n");
         }
 
         push(@implContent, "}\n\n");
@@ -1034,6 +1191,14 @@ sub GenerateImplementation
         push(@implContent, "{\n    forgetDOMObject(*Heap::heap(this)->globalData(), static_cast<${implClassName}*>(impl()));\n}\n\n");
     }
 
+    if ($needsMarkChildren && !$dataNode->extendedAttributes->{"CustomMarkFunction"}) {
+        push(@implContent, "void ${className}::markChildren(MarkStack& markStack)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    Base::markChildren(markStack);\n");
+        push(@implContent, "    impl()->markEventListeners(markStack);\n");
+        push(@implContent, "}\n\n");
+    }
+
     if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
         push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
@@ -1049,6 +1214,7 @@ sub GenerateImplementation
                  || $dataNode->extendedAttributes->{"GenerateConstructor"} 
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
+                 || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}
                  || $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"HasNameGetter"}
@@ -1061,14 +1227,18 @@ sub GenerateImplementation
             push(@implContent, "{\n");
             push(@implContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 0));
             push(@implContent, "}\n\n");
+            push(@implContent, "bool ${className}::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
+            push(@implContent, "{\n");
+            push(@implContent, GenerateGetOwnPropertyDescriptorBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 0));
+            push(@implContent, "}\n\n");
         }
 
-        if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) 
+        if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) 
                 && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
             push(@implContent, "bool ${className}::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)\n");
             push(@implContent, "{\n");
             push(@implContent, "    if (propertyName < static_cast<$implClassName*>(impl())->length()) {\n");
-            if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+            if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
                 push(@implContent, "        slot.setValue(getByIndex(exec, propertyName));\n");
             } else {
                 push(@implContent, "        slot.setCustomIndex(this, propertyName, indexGetter);\n");
@@ -1124,7 +1294,11 @@ sub GenerateImplementation
                     push(@implContent, "    UNUSED_PARAM(exec);\n");
                     push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(castedThis->impl());\n");
                     push(@implContent, "    if (EventListener* listener = imp->$implGetterFunctionName()) {\n");
-                    push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction())\n");
+                    if ($implClassName eq "Document" || $implClassName eq "WorkerContext" || $implClassName eq "SharedWorkerContext" || $implClassName eq "DedicatedWorkerContext") {
+                        push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction(imp))\n");
+                    } else {
+                        push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))\n");
+                    }
                     push(@implContent, "            return jsFunction;\n");
                     push(@implContent, "    }\n");
                     push(@implContent, "    return jsNull();\n");
@@ -1333,14 +1507,14 @@ sub GenerateImplementation
         }
     }
 
-    if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
-        push(@implContent, "void ${className}::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)\n");
+    if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
+        push(@implContent, "void ${className}::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)\n");
         push(@implContent, "{\n");
-        if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+        if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@implContent, "    for (unsigned i = 0; i < static_cast<${implClassName}*>(impl())->length(); ++i)\n");
             push(@implContent, "        propertyNames.add(Identifier::from(exec, i));\n");
         }
-        push(@implContent, "     Base::getPropertyNames(exec, propertyNames);\n");
+        push(@implContent, "     Base::getOwnPropertyNames(exec, propertyNames);\n");
         push(@implContent, "}\n\n");
     }
 
@@ -1373,7 +1547,7 @@ sub GenerateImplementation
                 push(@implContent, "    if (!castedThisObj)\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
             } else {
-                push(@implContent, "    if (!thisValue.isObject(&${className}::s_info))\n");
+                push(@implContent, "    if (!thisValue.inherits(&${className}::s_info))\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
                 push(@implContent, "    $className* castedThisObj = static_cast<$className*>(asObject(thisValue));\n");
             }
@@ -1507,6 +1681,17 @@ sub GenerateImplementation
             $implIncludes{"Node.h"} = 1;
         }
     }
+    
+    if ($dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+        push(@implContent, "\nJSValue ${className}::getByIndex(ExecState* exec, unsigned index)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    return jsNumber(exec, static_cast<$implClassName*>(impl())->item(index));\n");
+        push(@implContent, "}\n");
+        if ($interfaceName eq "HTMLCollection") {
+            $implIncludes{"JSNode.h"} = 1;
+            $implIncludes{"Node.h"} = 1;
+        }
+    }
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateToJS"}) and !$dataNode->extendedAttributes->{"CustomToJS"}) {
         if ($podType) {
@@ -1537,7 +1722,7 @@ sub GenerateImplementation
 
         push(@implContent, "{\n");
 
-        push(@implContent, "    return value.isObject(&${className}::s_info) ? " . ($podType ? "($podType) *" : "") . "static_cast<$className*>(asObject(value))->impl() : ");
+        push(@implContent, "    return value.inherits(&${className}::s_info) ? " . ($podType ? "($podType) *" : "") . "static_cast<$className*>(asObject(value))->impl() : ");
         if ($podType and $podType ne "float") {
             push(@implContent, "$podType();\n}\n");
         } else {
@@ -1657,6 +1842,11 @@ sub JSValueToNative
         return "$value.toString(exec)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "SerializedScriptValue::create(exec, $value)";
+    }
+
     $implIncludes{"FloatPoint.h"} = 1 if $type eq "SVGPoint";
     $implIncludes{"FloatRect.h"} = 1 if $type eq "SVGRect";
     $implIncludes{"HTMLOptionElement.h"} = 1 if $type eq "HTMLOptionElement";
@@ -1762,6 +1952,9 @@ sub NativeToJSValue
         $joinedName = $type;
         $joinedName =~ s/Abs|Rel//;
         $implIncludes{"$joinedName.h"} = 1;
+    } elsif ($type eq "SerializedScriptValue") {
+        $implIncludes{"$type.h"} = 1;
+        return "$value->deserialize(exec)";
     } else {
         # Default, include header with same name.
         $implIncludes{"JS$type.h"} = 1;
@@ -2021,6 +2214,15 @@ sub WriteData
         @headerContent = ();
         %headerIncludes = ();
     }
+
+    if (defined($DEPS)) {
+        # Write dependency file.
+        print $DEPS @depsContent;
+        close($DEPS);
+        undef($DEPS);
+
+        @depsContent = ();
+    }
 }
 
 sub constructorFor
@@ -2041,6 +2243,7 @@ public:
         putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -2074,6 +2277,11 @@ bool ${constructorClassName}::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<${constructorClassName}, DOMObject>(exec, &${constructorClassName}Table, this, propertyName, slot);
 }
 
+bool ${constructorClassName}::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<${constructorClassName}, DOMObject>(exec, &${constructorClassName}Table, this, propertyName, descriptor);
+}
+
 EOF
 
     $implJSCInclude{"JSNumberCell.h"} = 1; # FIXME: What is this for?
diff --git a/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index f449e19..317086b 100644
--- a/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -4,6 +4,7 @@
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -28,6 +29,7 @@ use File::stat;
 # Global Variables
 my $module = "";
 my $outputDir = "";
+my $writeDependencies = 0;
 my %publicInterfaces = ();
 my $newPublicClass = 0;
 my $interfaceAvailabilityVersion = "";
@@ -49,6 +51,7 @@ my @internalHeaderContent = ();
 my @implContentHeader = ();
 my @implContent = ();
 my %implIncludes = ();
+my @depsContent = ();
 
 # Hashes
 my %protocolTypeHash = ("XPathNSResolver" => 1, "EventListener" => 1, "EventTarget" => 1, "NodeFilter" => 1,
@@ -194,6 +197,9 @@ sub new
 
     $codeGenerator = shift;
     $outputDir = shift;
+    shift; # $useLayerOnTop
+    shift; # $preprocessor
+    $writeDependencies = shift;
 
     bless($reference, $object);
     return $reference;
@@ -305,7 +311,7 @@ sub GetClassName
     my $name = $codeGenerator->StripModule(shift);
 
     # special cases
-    return "NSString" if $codeGenerator->IsStringType($name);
+    return "NSString" if $codeGenerator->IsStringType($name) or $name eq "SerializedScriptValue";
     return "NS$name" if IsNativeObjCType($name);
     return "BOOL" if $name eq "boolean";
     return "unsigned" if $name eq "unsigned long";
@@ -486,6 +492,11 @@ sub GetObjCTypeGetter
     return "WTF::getPtr(nativeEventListener)" if $type eq "EventListener";
     return "WTF::getPtr(nativeNodeFilter)" if $type eq "NodeFilter";
     return "WTF::getPtr(nativeResolver)" if $type eq "XPathNSResolver";
+    
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "WebCore::SerializedScriptValue::create(WebCore::String($argName))";
+    }
     return "core($argName)";
 }
 
@@ -601,6 +612,11 @@ sub AddIncludesForType
         return;
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return;
+    }
+
     # FIXME: won't compile without these
     $implIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
     $implIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
@@ -976,8 +992,10 @@ sub GenerateImplementation
     my $object = shift;
     my $dataNode = shift;
 
+    my @ancestorInterfaceNames = ();
+
     if (@{$dataNode->parents} > 1) {
-        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode);
+        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@ancestorInterfaceNames);
     }
 
     my $interfaceName = $dataNode->name;
@@ -1204,6 +1222,9 @@ sub GenerateImplementation
             } elsif ($idlType eq "Color") {
                 $getterContentHead = "WebCore::nsColor($getterContentHead";
                 $getterContentTail .= ")";
+            } elsif ($attribute->signature->type eq "SerializedScriptValue") {
+                $getterContentHead = "$getterContentHead";
+                $getterContentTail .= "->toString()";                
             } elsif (ConversionNeeded($attribute->signature->type)) {
                 $getterContentHead = "kit(WTF::getPtr($getterContentHead";
                 $getterContentTail .= "))";
@@ -1438,6 +1459,8 @@ sub GenerateImplementation
                     push(@functionContent, "        return $toReturn;\n");
                     push(@functionContent, "    return nil;\n");
                 }
+            } elsif ($returnType eq "SerializedScriptValue") {
+                $content = "foo";
             } else {
                 if (ConversionNeeded($function->signature->type)) {
                     if ($codeGenerator->IsPodType($function->signature->type)) {
@@ -1543,6 +1566,12 @@ sub GenerateImplementation
 
     # - End the ifdef conditional if necessary
     push(@implContent, "\n#endif // ${conditionalString}\n") if $conditional;
+
+    # - Generate dependencies.
+    if ($writeDependencies && @ancestorInterfaceNames) {
+        push(@depsContent, "$className.h : ", join(" ", map { "$_.idl" } @ancestorInterfaceNames), "\n");
+        push(@depsContent, map { "$_.idl :\n" } @ancestorInterfaceNames); 
+    }
 }
 
 # Internal helper
@@ -1556,12 +1585,14 @@ sub WriteData
     my $privateHeaderFileName = "$outputDir/" . $name . "Private.h";
     my $implFileName = "$outputDir/" . $name . ".mm";
     my $internalHeaderFileName = "$outputDir/" . $name . "Internal.h";
+    my $depsFileName = "$outputDir/" . $name . ".dep";
 
     # Remove old files.
     unlink($headerFileName);
     unlink($privateHeaderFileName);
     unlink($implFileName);
     unlink($internalHeaderFileName);
+    unlink($depsFileName);
 
     # Write public header.
     open(HEADER, ">$headerFileName") or die "Couldn't open file $headerFileName";
@@ -1624,6 +1655,14 @@ sub WriteData
 
        @internalHeaderContent = ();
     }
+
+    # Write dependency file.
+    if (@depsContent) {
+        open(DEPS, ">$depsFileName") or die "Couldn't open file $depsFileName";
+        print DEPS @depsContent;
+        close(DEPS);
+        @depsContent = ();
+    }
 }
 
 1;
diff --git a/WebCore/bindings/scripts/CodeGeneratorV8.pm b/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 439f368..b65da53 100644
--- a/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -5,6 +5,7 @@
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006 Apple Computer, Inc.
 # Copyright (C) 2007, 2008, 2009 Google Inc.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 # This file is part of the KDE project
 #
@@ -90,26 +91,6 @@ sub leftShift($$) {
     return (($value << $distance) & 0xFFFFFFFF);
 }
 
-# Uppercase the first letter, while respecting WebKit style guidelines.
-# E.g., xmlEncoding becomes XMLEncoding, but xmlllang becomes Xmllang.
-sub WK_ucfirst
-{
-    my $param = shift;
-    my $ret = ucfirst($param);
-    $ret =~ s/Xml/XML/ if $ret =~ /^Xml[^a-z]/;
-    return $ret;
-}
-
-# Lowercase the first letter while respecting WebKit style guidelines.
-# URL becomes url, but SetURL becomes setURL.
-sub WK_lcfirst
-{
-    my $param = shift;
-    my $ret = lcfirst($param);
-    $ret =~ s/uRL/url/;
-    return $ret;
-}
-
 # Workaround for V8 bindings difference where RGBColor is not a POD type.
 sub IsPodType
 {
@@ -266,7 +247,7 @@ sub GenerateHeader
 
     # Copy contents of parent classes except the first parent or if it is
     # EventTarget.
-    $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode);
+    $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@allParents, 1);
 
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
     my $conditionalString = GenerateConditionalString($dataNode);
@@ -345,6 +326,28 @@ sub IsNodeSubType
     return 0;
 }
 
+sub GetHiddenDependencyIndex
+{
+    my $dataNode = shift;
+    my $attribute = shift;
+    my $name = $dataNode->name;
+    return "V8Custom::kNodeEventListenerCacheIndex" if IsNodeSubType($dataNode);
+    return "V8Custom::kSVGElementInstanceEventListenerCacheIndex" if $name eq "SVGElementInstance";
+    return "V8Custom::kAbstractWorkerRequestCacheIndex" if $name eq "AbstractWorker";
+    return "V8Custom::kWorkerRequestCacheIndex" if $name eq "Worker";
+    return "V8Custom::kDedicatedWorkerContextRequestCacheIndex" if $name eq "DedicatedWorkerContext";
+    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "WorkerContext";
+    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "SharedWorkerContext";
+    return "V8Custom::kMessagePortRequestCacheIndex" if $name eq "MessagePort";
+    return "V8Custom::kWebSocketCacheIndex" if $name eq "WebSocket";
+    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequest";
+    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequestUpload";
+    return "V8Custom::kDOMApplicationCacheCacheIndex" if $name eq "DOMApplicationCache";
+    return "V8Custom::kNotificationRequestCacheIndex" if $name eq "Notification";
+    return "V8Custom::kDOMWindowEventListenerCacheIndex" if $name eq "DOMWindow";
+    die "Unexpected name " . $name . " when generating " . $attribute;
+}
+
 sub HolderToNative
 {
     my $dataNode = shift;
@@ -513,11 +516,17 @@ END
         }
 
     } elsif ($attrExt->{"v8OnProto"} || $attrExt->{"V8DisallowShadowing"}) {
+      if ($classIndex eq "DOMWINDOW") {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = info.Holder();
+END
+      } else {
         # perform lookup first
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
     if (holder.IsEmpty()) return v8::Undefined();
 END
+      }
         HolderToNative($dataNode, $implClassName, $classIndex);
     } else {
         push(@implContentDecls, <<END);
@@ -543,7 +552,7 @@ END
         $attrName = $attribute->signature->extendedAttributes->{"v8referenceattr"};
     }
 
-    my $getterFunc = WK_lcfirst($attrName);
+    my $getterFunc = $codeGenerator->WK_lcfirst($attrName);
     $getterFunc .= "Animated" if $codeGenerator->IsSVGAnimatedType($attribute->signature->type);
 
     my $returnType = GetTypeFromSignature($attribute->signature);
@@ -582,7 +591,7 @@ END
         my $getter = $getterString;
         $getter =~ s/imp->//;
         $getter =~ s/\(\)//;
-        my $setter = "set" . WK_ucfirst($getter);
+        my $setter = "set" . $codeGenerator->WK_ucfirst($getter);
 
         my $implClassIsAnimatedType = $codeGenerator->IsSVGAnimatedType($implClassName);
         if (not $implClassIsAnimatedType and $codeGenerator->IsPodTypeWithWriteableProperties($attrType) and not defined $attribute->signature->extendedAttributes->{"Immutable"}) {
@@ -607,6 +616,10 @@ END
         }
 
     } else {
+        if ($attribute->signature->type eq "EventListener" && $dataNode->name eq "DOMWindow") {
+            push(@implContentDecls, "    if (!imp->document())\n");
+            push(@implContentDecls, "      return v8::Undefined();\n");
+        }
         push(@implContentDecls, "    $nativeType v = ");
 
         push(@implContentDecls, "$getterString;\n");
@@ -685,11 +698,17 @@ sub GenerateNormalAttrSetter
         push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
 
     } elsif ($attrExt->{"v8OnProto"}) {
+      if ($classIndex eq "DOMWINDOW") {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = info.Holder();
+END
+      } else {
         # perform lookup first
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
-    if (holder.IsEmpty()) return v8::Undefined();
+    if (holder.IsEmpty()) return;
 END
+      }
         HolderToNative($dataNode, $implClassName, $classIndex);
     } else {
         push(@implContentDecls, <<END);
@@ -699,7 +718,15 @@ END
     }
 
     my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
-    push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
+    if ($attribute->signature->type eq "EventListener") {
+        if ($dataNode->name eq "DOMWindow") {
+            push(@implContentDecls, "    if (!imp->document())\n");
+            push(@implContentDecls, "      return;\n");
+        }
+        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, ListenerFindOrCreate);\n");
+    } else {
+        push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
+    }
 
     my $result = "";
     if ($nativeType eq "int" and $attribute->signature->extendedAttributes->{"ConvertFromString"}) {
@@ -724,13 +751,27 @@ END
     if ($implClassName eq "double") {
         push(@implContentDecls, "    *imp = $result;\n");
     } else {
-        my $implSetterFunctionName = WK_ucfirst($attrName);
+        my $implSetterFunctionName = $codeGenerator->WK_ucfirst($attrName);
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
             $implIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
             push(@implContentDecls, "    imp->setAttribute(HTMLNames::${contentAttributeName}Attr, $result");
+        } elsif ($attribute->signature->type eq "EventListener") {
+            $implIncludes{"V8AbstractEventListener.h"} = 1;
+            $implIncludes{"V8CustomBinding.h"} = 1;
+            $cacheIndex = GetHiddenDependencyIndex($dataNode, $attrName);
+            push(@implContentDecls, "    $nativeType old = imp->$attrName();\n");
+            push(@implContentDecls, "    V8AbstractEventListener* oldListener = old ? V8AbstractEventListener::cast(old.get()) : 0;\n");
+            push(@implContentDecls, "    if (oldListener) {\n");
+            push(@implContentDecls, "      v8::Local<v8::Object> oldListenerObject = oldListener->getExistingListenerObject();\n");
+            push(@implContentDecls, "      if (!oldListenerObject.IsEmpty())\n");
+            push(@implContentDecls, "        removeHiddenDependency(holder, oldListenerObject, $cacheIndex);\n");
+            push(@implContentDecls, "    }\n");
+            push(@implContentDecls, "    imp->set$implSetterFunctionName($result);\n");
+            push(@implContentDecls, "    if ($result)\n");
+            push(@implContentDecls, "      createHiddenDependency(holder, value, $cacheIndex");
         } else {
             push(@implContentDecls, "    imp->set$implSetterFunctionName(" . $result);
         }
@@ -779,7 +820,7 @@ sub GenerateNewFunctionTemplate
         my $customFunc = $function->signature->extendedAttributes->{"Custom"} ||
                          $function->signature->extendedAttributes->{"V8Custom"};
         if ($customFunc eq 1) {
-            $customFunc = $interfaceName . WK_ucfirst($name);
+            $customFunc = $interfaceName . $codeGenerator->WK_ucfirst($name);
         }
         return "v8::FunctionTemplate::New(V8Custom::v8${customFunc}Callback, v8::Handle<v8::Value>(), $signature)";
     } else {
@@ -841,6 +882,11 @@ END
         push(@implContentDecls, "    ScriptCallStack callStack(args, $numParameters);\n");
         $implIncludes{"ScriptCallStack.h"} = 1;
     }
+    if ($function->signature->extendedAttributes->{"SVGCheckSecurityDocument"}) {
+        push(@implContentDecls,
+"    if (!V8Proxy::checkNodeSecurity(imp->getSVGDocument(ec)))\n" .
+"      return v8::Undefined();\n");
+    }
 
     my $paramIndex = 0;
     foreach my $parameter (@{$function->parameters}) {
@@ -893,7 +939,8 @@ END
 
 sub GenerateBatchedAttributeData
 {
-    my $interfaceName = shift;
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->name;
     my $attributes = shift;
 
     foreach my $attribute (@$attributes) {
@@ -926,7 +973,7 @@ sub GenerateBatchedAttributeData
             "";
         if ($customAccessor eq 1) {
             # use the naming convension, interface + (capitalize) attr name
-            $customAccessor = $interfaceName . WK_ucfirst($attrName);
+            $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
         }
 
         my $getter;
@@ -950,79 +997,41 @@ sub GenerateBatchedAttributeData
             my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
             $constructorType =~ s/Constructor$//;
             my $constructorIndex = uc($constructorType);
-            $data = "V8ClassIndex::${constructorIndex}";
-            $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
-            $setter = "0";
-            $propAttr = "v8::ReadOnly";
-
-        # EventListeners
-        } elsif ($attribute->signature->type eq "EventListener") {
-            if ($interfaceName eq "DOMWindow") {
-                $getter = "V8Custom::v8DOMWindowEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8DOMWindowEventHandlerAccessorSetter";
-            } elsif ($interfaceName eq "Element" || $interfaceName eq "Document" || $interfaceName eq "HTMLBodyElement" || $interfaceName eq "SVGElementInstance" || $interfaceName eq "HTMLFrameSetElement") {
-                $getter = "V8Custom::v8NodeEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8NodeEventHandlerAccessorSetter";
-            } elsif ($interfaceName eq "DOMApplicationCache") {
-                $getter = "V8Custom::v8DOMApplicationCacheEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8DOMApplicationCacheEventHandlerAccessorSetter";
-            } else {
+            if ($customAccessor) {
                 $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-                if ($interfaceName eq "WorkerContext" and $attrName eq "self") {
-                    $setter = "0";
-                    $propAttr = "v8::ReadOnly";
-                } else {
-                    $setter = "V8Custom::v8${customAccessor}AccessorSetter";
-                }
-            }
-
-        # Custom Getter and Setter
-        } elsif ($attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-            if ($interfaceName eq "WorkerContext" and $attrName eq "self") {
-                $setter = "0";
-                $propAttr = "v8::ReadOnly";
             } else {
-                $hasCustomSetter = 1;
-                $setter = "V8Custom::v8${customAccessor}AccessorSetter";
+                $data = "V8ClassIndex::${constructorIndex}";
+                $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
             }
+            $setter = "0";
+            $propAttr = "v8::ReadOnly";
 
-        # Custom Setter
-        } elsif ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"}) {
-            $hasCustomSetter = 1;
+        } else {
+            # Default Getter and Setter
             $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "V8Custom::v8${customAccessor}AccessorSetter";
-
-        # Custom Getter
-        } elsif ($attrExt->{"CustomGetter"}) {
-            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
             $setter = "${interfaceName}Internal::${attrName}AttrSetter";
 
-        # Replaceable
-        } elsif ($attrExt->{"Replaceable"}) {
-            # Replaceable accessor is put on instance template with ReadOnly attribute.
-            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "0";
-
-            # Mark to avoid duplicate v8::ReadOnly flags in output.
-            $hasCustomSetter = 1;
-
-            # Handle the special case of window.top being marked upstream as Replaceable.
-            # FIXME: Investigate why [Replaceable] is not marked as ReadOnly
-            # upstream and reach parity.
-            if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) {
-                $propAttr .= "|v8::ReadOnly";
+            # Custom Setter
+            if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+                $hasCustomSetter = 1;
+                $setter = "V8Custom::v8${customAccessor}AccessorSetter";
             }
 
-        # Normal
-        } else {
-            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "${interfaceName}Internal::${attrName}AttrSetter";
+            # Custom Getter
+            if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+                $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+            }
         }
 
+        # Replaceable
         if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
             $setter = "0";
-            $propAttr .= "|v8::ReadOnly";
+            # Handle the special case of window.top being marked as Replaceable.
+            # FIXME: Investigate whether we could treat window.top as replaceable 
+            # and allow shadowing without it being a security hole.
+            if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) { 
+                $propAttr .= "|v8::ReadOnly";
+            }
         }
 
         # Read only attributes
@@ -1068,8 +1077,6 @@ sub GenerateImplementation
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
     my $conditionalString = GenerateConditionalString($dataNode);
 
-    @allParents = $codeGenerator->FindParentsRecursively($dataNode);
-
     # - Add default header template
     @implContentHeader = split("\r", $headerTemplate);
 
@@ -1104,20 +1111,16 @@ sub GenerateImplementation
 
         # Generate special code for the constructor attributes.
         if ($attrType =~ /Constructor$/) {
-            $hasConstructors = 1;
+            if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
+                $implIncludes{"V8CustomBinding.h"} = 1;
+            } else {
+                $hasConstructors = 1;
+            }
             next;
         }
 
-        # Make EventListeners always custom.
-        # FIXME: make the perl code capable of generating the
-        #   event setters/getters.  For now, WebKit has started removing the
-        #   [Custom] attribute, so just automatically insert it to avoid forking
-        #   other files.  This should be okay because we can't generate stubs
-        #   for any event getter/setters anyway.
-        if ($attrType eq "EventListener") {
-            $attribute->signature->extendedAttributes->{"Custom"} = 1;
-            $implIncludes{"V8CustomBinding.h"} = 1;
-            next;
+        if ($attrType eq "EventListener" && $interfaceName eq "DOMWindow") {
+            $attribute->signature->extendedAttributes->{"v8OnProto"} = 1;
         }
 
         # Do not generate accessor if this is a custom attribute.  The
@@ -1186,7 +1189,7 @@ sub GenerateImplementation
         # Put the attributes that disallow shadowing on the shadow object.
         $attributes = \@normal;
         push(@implContent, "static const BatchedAttribute shadow_attrs[] = {\n");
-        GenerateBatchedAttributeData($interfaceName, \@disallows_shadowing);
+        GenerateBatchedAttributeData($dataNode, \@disallows_shadowing);
         push(@implContent, "};\n");
     }
 
@@ -1194,7 +1197,7 @@ sub GenerateImplementation
     if (@$attributes) {
         $has_attributes = 1;
         push(@implContent, "static const BatchedAttribute ${interfaceName}_attrs[] = {\n");
-        GenerateBatchedAttributeData($interfaceName, $attributes);
+        GenerateBatchedAttributeData($dataNode, $attributes);
         push(@implContent, "};\n");
     }
 
@@ -1472,7 +1475,7 @@ sub GenerateFunctionCallString()
             $paramName = "SVGPODListItem<" . GetNativeType($paramType, 1) . ">::copy($paramName)";
         }
 
-        if ($parameter->type eq "NodeFilter") {
+        if ($parameter->type eq "NodeFilter" || $parameter->type eq "XPathNSResolver") {
             $functionString .= "$paramName.get()";
         } else {
             $functionString .= $paramName;
@@ -1590,7 +1593,7 @@ sub GetTypeFromSignature
     my $signature = shift;
 
     my $type = $codeGenerator->StripModule($signature->type);
-    if (($type eq "DOMString") && $signature->extendedAttributes->{"V8Custom"}) {
+    if (($type eq "DOMString") && $signature->extendedAttributes->{"HintAtomic"}) {
         $type = "AtomicString";
     }
 
@@ -1605,6 +1608,11 @@ sub GetNativeTypeFromSignature
 
     my $type = GetTypeFromSignature($signature);
 
+    if ($type eq "unsigned long" and $signature->extendedAttributes->{"IsIndex"}) {
+        # Special-case index arguments because we need to check that they aren't < 0.
+        return "int";
+    }
+
     return GetNativeType($type, $isParameter);
 }
 
@@ -1612,7 +1620,24 @@ sub IsRefPtrType
 {
     my $type = shift;
     return 1 if $type eq "Attr";
+    return 1 if $type eq "CanvasArray";
+    return 1 if $type eq "CanvasArrayBuffer";
+    return 1 if $type eq "CanvasBooleanArray";
+    return 1 if $type eq "CanvasByteArray";
+    return 1 if $type eq "CanvasBuffer";
+    return 1 if $type eq "CanvasFloatArray";
+    return 1 if $type eq "CanvasFramebuffer";
     return 1 if $type eq "CanvasGradient";
+    return 1 if $type eq "CanvasIntArray";
+    return 1 if $type eq "CanvasObject";
+    return 1 if $type eq "CanvasProgram";
+    return 1 if $type eq "CanvasRenderbuffer";
+    return 1 if $type eq "CanvasShader";
+    return 1 if $type eq "CanvasShortArray";
+    return 1 if $type eq "CanvasTexture";
+    return 1 if $type eq "CanvasUnsignedByteArray";
+    return 1 if $type eq "CanvasUnsignedIntArray";
+    return 1 if $type eq "CanvasUnsignedShortArray";
     return 1 if $type eq "ClientRect";
     return 1 if $type eq "ClientRectList";
     return 1 if $type eq "CDATASection";
@@ -1636,6 +1661,7 @@ sub IsRefPtrType
     return 1 if $type eq "Element";
     return 1 if $type eq "EntityReference";
     return 1 if $type eq "Event";
+    return 1 if $type eq "EventListener";
     return 1 if $type eq "FileList";
     return 1 if $type eq "HTMLCollection";
     return 1 if $type eq "HTMLDocument";
@@ -1653,6 +1679,7 @@ sub IsRefPtrType
     return 1 if $type eq "Plugin";
     return 1 if $type eq "ProcessingInstruction";
     return 1 if $type eq "Range";
+    return 1 if $type eq "RGBColor";
     return 1 if $type eq "Text";
     return 1 if $type eq "TextMetrics";
     return 1 if $type eq "TimeRanges";
@@ -1708,7 +1735,8 @@ sub GetNativeType
 
     return "int" if $type eq "int";
     return "int" if $type eq "short" or $type eq "unsigned short";
-    return "int" if $type eq "long" or $type eq "unsigned long";
+    return "unsigned" if $type eq "unsigned long";
+    return "int" if $type eq "long";
     return "unsigned long long" if $type eq "unsigned long long";
     return "bool" if $type eq "boolean";
     return "String" if $type eq "DOMString";
@@ -1729,6 +1757,9 @@ sub GetNativeType
     # temporary hack
     return "RefPtr<NodeFilter>" if $type eq "NodeFilter";
 
+    # necessary as resolvers could be constructed on fly.
+    return "RefPtr<XPathNSResolver>" if $type eq "XPathNSResolver";
+
     return "RefPtr<${type}>" if IsRefPtrType($type) and not $isParameter;
 
     # Default, assume native type is a pointer with same type name as idl type
@@ -1739,6 +1770,19 @@ sub GetNativeType
 my %typeCanFailConversion = (
     "AtomicString" => 0,
     "Attr" => 1,
+    "CanvasArray" => 0,
+    "CanvasBuffer" => 0,
+    "CanvasByteArray" => 0,
+    "CanvasFloatArray" => 0,
+    "CanvasFramebuffer" => 0,
+    "CanvasGradient" => 0,
+    "CanvasIntArray" => 0,
+    "CanvasPixelArray" => 0,
+    "CanvasProgram" => 0,
+    "CanvasRenderbuffer" => 0,
+    "CanvasShader" => 0,
+    "CanvasShortArray" => 0,
+    "CanvasTexture" => 0,
     "CompareHow" => 0,
     "DataGridColumn" => 0,
     "DOMString" => 0,
@@ -1748,8 +1792,11 @@ my %typeCanFailConversion = (
     "Event" => 0,
     "EventListener" => 0,
     "EventTarget" => 0,
+    "HTMLCanvasElement" => 0,
     "HTMLElement" => 0,
+    "HTMLImageElement" => 0,
     "HTMLOptionElement" => 0,
+    "HTMLVideoElement" => 0,
     "Node" => 0,
     "NodeFilter" => 0,
     "MessagePort" => 0,
@@ -1837,7 +1884,11 @@ sub JSValueToNative
     return "static_cast<Range::CompareHow>($value->Int32Value())" if $type eq "CompareHow";
     return "static_cast<SVGPaint::SVGPaintType>($value->ToInt32()->Int32Value())" if $type eq "SVGPaintType";
 
-    return "v8ValueToAtomicWebCoreString($value)" if $type eq "AtomicString";
+    if ($type eq "AtomicString") {
+        return "v8ValueToAtomicWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
+        return "v8ValueToAtomicWebCoreString($value)";
+    }
+
     return "toWebCoreString($value)" if $type eq "DOMUserData";
     if ($type eq "DOMString") {
         return "toWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
@@ -1845,6 +1896,11 @@ sub JSValueToNative
         return "toWebCoreString($value)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "SerializedScriptValue::create($value)";
+    }
+
     if ($type eq "NodeFilter") {
         return "V8DOMWrapper::wrapNativeNodeFilter($value)";
     }
@@ -1866,6 +1922,10 @@ sub JSValueToNative
         return "V8Node::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 
+    if ($type eq "XPathNSResolver") {
+        return "V8DOMWrapper::getXPathNSResolver($value)";
+    }
+
     AddIncludesForType($type);
     # $implIncludes{"$type.h"} = 1 unless AvoidInclusionOfType($type);
 
@@ -1917,10 +1977,16 @@ sub CreateCustomSignature
         if ($first) { $first = 0; }
         else { $result .= ", "; }
         if (IsWrapperType($parameter->type)) {
-            my $type = $parameter->type;
-            my $header = GetV8HeaderName($type);
-            $implIncludes{$header} = 1;
-            $result .= "V8${type}::GetRawTemplate()";
+            if ($parameter->type eq "XPathNSResolver") {
+                # Special case for XPathNSResolver.  All other browsers accepts a callable,
+                # so, even though it's against IDL, accept objects here.
+                $result .= "v8::Handle<v8::FunctionTemplate>()";
+            } else {
+                my $type = $parameter->type;
+                my $header = GetV8HeaderName($type);
+                $implIncludes{$header} = 1;
+                $result .= "V8${type}::GetRawTemplate()";
+            }
         } else {
             $result .= "v8::Handle<v8::FunctionTemplate>()";
         }
@@ -2063,12 +2129,17 @@ sub ReturnNativeToJSValue
         return "return V8DOMWrapper::convertEventListenerToV8Object($value)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"$type.h"} = 1;
+        return "return v8String($value->toString())";
+    }
+
     if ($type eq "DedicatedWorkerContext" or $type eq "WorkerContext" or $type eq "SharedWorkerContext") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
         return "return WorkerContextExecutionProxy::convertWorkerContextToV8Object($value)";
     }
 
-    if ($type eq "WorkerLocation" or $type eq "WorkerNavigator") {
+    if ($type eq "WorkerLocation" or $type eq "WorkerNavigator" or $type eq "NotificationCenter") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
         my $classIndex = uc($type);
 
diff --git a/WebCore/bindings/scripts/IDLParser.pm b/WebCore/bindings/scripts/IDLParser.pm
index c4cb041..4abdb45 100644
--- a/WebCore/bindings/scripts/IDLParser.pm
+++ b/WebCore/bindings/scripts/IDLParser.pm
@@ -309,7 +309,11 @@ sub ParseInterface
                 $methodException =~ s/\s+//g;
                 @{$newDataNode->raisesExceptions} = split(/,/, $methodException);
 
-                my @params = split(/,/, $methodSignature);
+                # Split arguments at commas but only if the comma
+                # is not within attribute brackets, expressed here
+                # as being followed by a ']' without a preceding '['.
+                # Note that this assumes that attributes don't nest.
+                my @params = split(/,(?![^[]*\])/, $methodSignature);
                 foreach(@params) {
                     my $line = $_;
 
diff --git a/WebCore/bindings/scripts/generate-bindings.pl b/WebCore/bindings/scripts/generate-bindings.pl
index 9c374bf..c7adeb3 100755
--- a/WebCore/bindings/scripts/generate-bindings.pl
+++ b/WebCore/bindings/scripts/generate-bindings.pl
@@ -42,12 +42,14 @@ my $outputDirectory;
 my $generator;
 my $defines;
 my $preprocessor;
+my $writeDependencies;
 
 GetOptions('include=s@' => \@idlDirectories,
            'outputDir=s' => \$outputDirectory,
            'generator=s' => \$generator,
            'defines=s' => \$defines,
-           'preprocessor=s' => \$preprocessor);
+           'preprocessor=s' => \$preprocessor,
+           'write-dependencies' => \$writeDependencies);
 
 my $idlFile = $ARGV[0];
 
@@ -65,5 +67,5 @@ my $parser = IDLParser->new(1);
 my $document = $parser->Parse($idlFile, $defines, $preprocessor);
 
 # Generate desired output for given IDL file.
-my $codeGen = CodeGenerator->new(\@idlDirectories, $generator, $outputDirectory, 0, $preprocessor);
+my $codeGen = CodeGenerator->new(\@idlDirectories, $generator, $outputDirectory, 0, $preprocessor, $writeDependencies);
 $codeGen->ProcessDocument($document, $defines);
diff --git a/WebCore/bindings/v8/DOMObjectsInclude.h b/WebCore/bindings/v8/DOMObjectsInclude.h
index 6f36f3b..682ce79 100644
--- a/WebCore/bindings/v8/DOMObjectsInclude.h
+++ b/WebCore/bindings/v8/DOMObjectsInclude.h
@@ -33,11 +33,30 @@
 
 #include "AbstractWorker.h"
 #include "BarInfo.h"
+#include "BeforeLoadEvent.h"
+#include "CanvasArray.h"
+#include "CanvasArrayBuffer.h"
+#include "CanvasBuffer.h"
+#include "CanvasByteArray.h"
+#include "CanvasFloatArray.h"
+#include "CanvasFramebuffer.h"
 #include "CanvasGradient.h"
+#include "CanvasIntArray.h"
+#include "CanvasObject.h"
 #include "CanvasPattern.h"
 #include "CanvasPixelArray.h"
+#include "CanvasProgram.h"
+#include "CanvasRenderbuffer.h"
+#include "CanvasRenderingContext.h"
 #include "CanvasRenderingContext2D.h"
+#include "CanvasRenderingContext3D.h"
+#include "CanvasShader.h"
+#include "CanvasShortArray.h"
+#include "CanvasUnsignedByteArray.h"
+#include "CanvasUnsignedIntArray.h"
+#include "CanvasUnsignedShortArray.h"
 #include "CanvasStyle.h"
+#include "CanvasTexture.h"
 #include "CharacterData.h"
 #include "ClientRect.h"
 #include "ClientRectList.h"
@@ -106,6 +125,7 @@
 #include "NodeIterator.h"
 #include "OverflowEvent.h"
 #include "Page.h"
+#include "PageTransitionEvent.h"
 #include "Plugin.h"
 #include "PluginArray.h"
 #include "ProcessingInstruction.h"
@@ -135,7 +155,6 @@
 #include "V8HTMLElement.h"
 #include "V8LazyEventListener.h"
 #include "V8NodeFilterCondition.h"
-#include "V8ObjectEventListener.h"
 #include "ValidityState.h"
 #include "VoidCallback.h"
 #include "WebKitAnimationEvent.h"
@@ -215,10 +234,15 @@
 #include "V8SVGPODTypeWrapper.h"
 #endif // SVG
 
+<<<<<<< HEAD:WebCore/bindings/v8/DOMObjectsInclude.h
 #if ENABLE(TOUCH_EVENTS)
 #include "Touch.h"
 #include "TouchList.h"
 #include "TouchEvent.h"
+=======
+#if ENABLE(WEB_SOCKETS)
+#include "WebSocket.h"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/DOMObjectsInclude.h
 #endif
 
 #if ENABLE(WORKERS)
@@ -229,6 +253,11 @@
 #include "WorkerNavigator.h"
 #endif // WORKERS
 
+#if ENABLE(NOTIFICATIONS)
+#include "Notification.h"
+#include "NotificationCenter.h"
+#endif // NOTIFICATIONS
+
 #if ENABLE(XPATH)
 #include "XPathEvaluator.h"
 #endif // XPATH
diff --git a/WebCore/bindings/v8/DateExtension.cpp b/WebCore/bindings/v8/DateExtension.cpp
new file mode 100644
index 0000000..778a15a
--- /dev/null
+++ b/WebCore/bindings/v8/DateExtension.cpp
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DateExtension.h"
+
+#include "V8Proxy.h"
+#include "V8HiddenPropertyName.h"
+
+namespace WebCore {
+
+DateExtension* DateExtension::extension;
+
+static const char* dateExtensionName = "v8/DateExtension";
+static const char* dateExtensionScript =
+    "(function () {"
+    "  var counter;"
+    "  var orig_getTime;"
+    "  function getTimeOverride() {"
+    "    if (++counter > 1000)"
+    "      OnSleepDetected();"
+    "    return orig_getTime.call(this);"
+    "  };"
+    "  function enableSleepDetection(enable) {"
+    "    if (enable) {"
+    "      counter = 0;"
+    "      orig_getTime = Date.prototype.getTime;"
+    "      Date.prototype.getTime = getTimeOverride;"
+    "    } else {"
+    "      Date.prototype.getTime = orig_getTime;"
+    "    }"
+    "  };"
+    "  native function Setup();"
+    "  native function OnSleepDetected();"
+    "  Setup(Date, enableSleepDetection);"
+    "})()";
+
+DateExtension::DateExtension() : v8::Extension(dateExtensionName, dateExtensionScript)
+{
+}
+
+DateExtension* DateExtension::get()
+{
+    if (!extension)
+        extension = new DateExtension();
+    return extension;
+}
+
+void DateExtension::setAllowSleep(bool allow)
+{
+    v8::Local<v8::Value> result = V8Proxy::retrieve()->context()->Global()->Get(v8::String::New("Date"));
+    if (result.IsEmpty())
+        return;
+
+    v8::Handle<v8::Object> dateObject = v8::Handle<v8::Object>::Cast(result);
+    if (dateObject.IsEmpty())
+        return;
+
+    v8::Local<v8::Value> sleepFunctionHandle = dateObject->GetHiddenValue(V8HiddenPropertyName::sleepFunction());
+    if (sleepFunctionHandle.IsEmpty() || !sleepFunctionHandle->IsFunction())
+        return;
+
+    v8::Handle<v8::Value> argv[1];
+    argv[0] = v8::String::New(allow ? "false" : "true");
+    v8::Handle<v8::Function>::Cast(sleepFunctionHandle)->Call(v8::Object::New(), 1, argv);
+}
+
+v8::Handle<v8::FunctionTemplate> DateExtension::GetNativeFunction(v8::Handle<v8::String> name)
+{
+    if (name->Equals(v8::String::New("Setup")))
+        return v8::FunctionTemplate::New(Setup);
+    if (name->Equals(v8::String::New("OnSleepDetected")))
+        return v8::FunctionTemplate::New(OnSleepDetected);
+
+    return v8::Handle<v8::FunctionTemplate>();
+}
+
+v8::Handle<v8::Value> DateExtension::Setup(const v8::Arguments& args)
+{
+    if (args.Length() != 2 || !args[0]->IsObject() || !args[1]->IsFunction())
+        return v8::Undefined();
+
+    v8::Handle<v8::Object> dateObject = v8::Handle<v8::Object>::Cast(args[0]);
+    v8::Handle<v8::Function> enableSleepDetectionFunction = v8::Handle<v8::Function>::Cast(args[1]);
+
+    dateObject->SetHiddenValue(V8HiddenPropertyName::sleepFunction(), enableSleepDetectionFunction);
+    return v8::Undefined();
+}
+
+v8::Handle<v8::Value> DateExtension::OnSleepDetected(const v8::Arguments&)
+{
+    v8::V8::TerminateExecution();
+    return v8::Undefined();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/bindings/v8/DateExtension.h b/WebCore/bindings/v8/DateExtension.h
new file mode 100644
index 0000000..2bccac4
--- /dev/null
+++ b/WebCore/bindings/v8/DateExtension.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DateExtension_h
+#define DateExtension_h
+
+#include <v8.h>
+
+namespace WebCore {
+
+// Prevent "sleep" calls in unload handlers.
+class DateExtension : public v8::Extension {
+public:
+    static DateExtension* get();
+    void setAllowSleep(bool allow);
+
+private:
+    DateExtension();
+    virtual v8::Handle<v8::FunctionTemplate> GetNativeFunction(v8::Handle<v8::String>);
+    static v8::Handle<v8::Value> Setup(const v8::Arguments&);
+    static v8::Handle<v8::Value> OnSleepDetected(const v8::Arguments&);
+
+    static DateExtension* extension;
+};
+
+} // namespace WebCore
+
+#endif  // DateExtension_h
diff --git a/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp b/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
index e52a505..1dec0b1 100644
--- a/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
+++ b/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
@@ -33,10 +33,28 @@
 
 #include "bindings/V8Attr.cpp"
 #include "bindings/V8BarInfo.cpp"
+#include "bindings/V8BeforeLoadEvent.cpp"
+#include "bindings/V8CanvasArray.cpp"
+#include "bindings/V8CanvasArrayBuffer.cpp"
+#include "bindings/V8CanvasBuffer.cpp"
+#include "bindings/V8CanvasByteArray.cpp"
+#include "bindings/V8CanvasFloatArray.cpp"
+#include "bindings/V8CanvasFramebuffer.cpp"
 #include "bindings/V8CanvasGradient.cpp"
+#include "bindings/V8CanvasIntArray.cpp"
 #include "bindings/V8CanvasPattern.cpp"
 #include "bindings/V8CanvasPixelArray.cpp"
+#include "bindings/V8CanvasProgram.cpp"
+#include "bindings/V8CanvasRenderbuffer.cpp"
+#include "bindings/V8CanvasRenderingContext.cpp"
 #include "bindings/V8CanvasRenderingContext2D.cpp"
+#include "bindings/V8CanvasRenderingContext3D.cpp"
+#include "bindings/V8CanvasShader.cpp"
+#include "bindings/V8CanvasShortArray.cpp"
+#include "bindings/V8CanvasTexture.cpp"
+#include "bindings/V8CanvasUnsignedByteArray.cpp"
+#include "bindings/V8CanvasUnsignedIntArray.cpp"
+#include "bindings/V8CanvasUnsignedShortArray.cpp"
 #include "bindings/V8CDATASection.cpp"
 #include "bindings/V8CharacterData.cpp"
 #include "bindings/V8ClientRect.cpp"
@@ -174,7 +192,10 @@
 #include "bindings/V8NodeIterator.cpp"
 #include "bindings/V8NodeList.cpp"
 #include "bindings/V8Notation.cpp"
+#include "bindings/V8Notification.cpp"
+#include "bindings/V8NotificationCenter.cpp"
 #include "bindings/V8OverflowEvent.cpp"
+#include "bindings/V8PageTransitionEvent.cpp"
 #include "bindings/V8Plugin.cpp"
 #include "bindings/V8PluginArray.cpp"
 #include "bindings/V8ProcessingInstruction.cpp"
@@ -251,7 +272,6 @@
 #include "bindings/V8SVGClipPathElement.cpp"
 #include "bindings/V8SVGColor.cpp"
 #include "bindings/V8SVGCursorElement.cpp"
-#include "bindings/V8SVGDefinitionSrcElement.cpp"
 #include "bindings/V8SVGDefsElement.cpp"
 #include "bindings/V8SVGDescElement.cpp"
 #include "bindings/V8SVGDocument.cpp"
@@ -337,12 +357,35 @@
 #include "bindings/V8SVGUseElement.cpp"
 #include "bindings/V8SVGViewElement.cpp"
 #include "bindings/V8SVGZoomEvent.cpp"
+<<<<<<< HEAD:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
+=======
+#include "bindings/V8Text.cpp"
+#include "bindings/V8TextEvent.cpp"
+#include "bindings/V8TextMetrics.cpp"
+#include "bindings/V8TimeRanges.cpp"
+#include "bindings/V8TreeWalker.cpp"
+#include "bindings/V8UIEvent.cpp"
+#include "bindings/V8ValidityState.cpp"
+#include "bindings/V8WebKitAnimationEvent.cpp"
+#include "bindings/V8WebKitCSSKeyframeRule.cpp"
+#include "bindings/V8WebKitCSSKeyframesRule.cpp"
+#include "bindings/V8WebKitCSSMatrix.cpp"
+#include "bindings/V8WebKitCSSTransformValue.cpp"
+#include "bindings/V8WebKitPoint.cpp"
+#include "bindings/V8WebKitTransitionEvent.cpp"
+#if ENABLE(WEB_SOCKETS)
+#include "bindings/V8WebSocket.cpp"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
 #endif
+<<<<<<< HEAD:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
 
 #if ENABLE(WORKERS)
 #include "bindings/V8AbstractWorker.cpp"
 #include "bindings/V8DedicatedWorkerContext.cpp"
 #include "bindings/V8SharedWorker.cpp"
+=======
+#include "bindings/V8WheelEvent.cpp"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
 #include "bindings/V8Worker.cpp"
 #include "bindings/V8WorkerContext.cpp"
 #include "bindings/V8WorkerLocation.cpp"
diff --git a/WebCore/bindings/v8/NPV8Object.cpp b/WebCore/bindings/v8/NPV8Object.cpp
index cb2a6c1..13403ec 100644
--- a/WebCore/bindings/v8/NPV8Object.cpp
+++ b/WebCore/bindings/v8/NPV8Object.cpp
@@ -276,7 +276,7 @@ bool _NPN_EvaluateHelper(NPP npp, bool popupsAllowed, NPObject* npObject, NPStri
         filename = "npscript";
 
     WebCore::String script = WebCore::String::fromUTF8(npScript->UTF8Characters, npScript->UTF8Length);
-    v8::Local<v8::Value> v8result = proxy->evaluate(WebCore::ScriptSourceCode(script, WebCore::KURL(filename)), 0);
+    v8::Local<v8::Value> v8result = proxy->evaluate(WebCore::ScriptSourceCode(script, WebCore::KURL(WebCore::ParsedURLString, filename)), 0);
 
     if (v8result.IsEmpty())
         return false;
@@ -413,8 +413,12 @@ bool _NPN_HasMethod(NPP npp, NPObject* npObject, NPIdentifier methodName)
 
 void _NPN_SetException(NPObject* npObject, const NPUTF8 *message)
 {
-    if (npObject->_class != npScriptObjectClass)
+    if (npObject->_class != npScriptObjectClass) {
+        // We won't be able to find a proper scope for this exception, so just throw it.
+        // This is consistent with JSC, which throws a global exception all the time.
+        V8Proxy::throwError(V8Proxy::GeneralError, message);
         return;
+    }
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> context = toV8Context(0, npObject);
     if (context.IsEmpty())
diff --git a/WebCore/bindings/v8/OwnHandle.h b/WebCore/bindings/v8/OwnHandle.h
index 6580674..17c551c 100644
--- a/WebCore/bindings/v8/OwnHandle.h
+++ b/WebCore/bindings/v8/OwnHandle.h
@@ -45,15 +45,13 @@ namespace WebCore {
         v8::Handle<T> get() const { return m_handle; }
         void set(v8::Handle<T> handle) { clear(); m_handle = v8::Persistent<T>::New(handle); }
 
-        // FIXME: What if we release a weak handle?  Won't the callback do the wrong thing?
-        v8::Persistent<T> release() { v8::Persistent<T> result = m_handle; m_handle.Clear(); return result; }
-        void adopt(v8::Persistent<T> handle) { clear(); m_handle = handle; }
-
         // Note: This is clear in the OwnPtr sense, not the v8::Handle sense.
         void clear()
         {
             if (m_handle.IsEmpty())
                 return;
+            if (m_handle.IsWeak())
+                m_handle.ClearWeak();
             m_handle.Dispose();
             m_handle.Clear();
         }
diff --git a/WebCore/bindings/v8/ScheduledAction.cpp b/WebCore/bindings/v8/ScheduledAction.cpp
index 44e8a37..268e177 100644
--- a/WebCore/bindings/v8/ScheduledAction.cpp
+++ b/WebCore/bindings/v8/ScheduledAction.cpp
@@ -44,8 +44,9 @@
 
 namespace WebCore {
 
-ScheduledAction::ScheduledAction(v8::Handle<v8::Function> func, int argc, v8::Handle<v8::Value> argv[])
-    : m_code(String(), KURL(), 0)
+ScheduledAction::ScheduledAction(v8::Handle<v8::Context> context, v8::Handle<v8::Function> func, int argc, v8::Handle<v8::Value> argv[])
+    : m_context(context)
+    , m_code(String(), KURL(), 0)
 {
     m_function = v8::Persistent<v8::Function>::New(func);
 
@@ -107,7 +108,7 @@ void ScheduledAction::execute(V8Proxy* proxy)
 
     LOCK_V8;
     v8::HandleScope handleScope;
-    v8::Local<v8::Context> v8Context = proxy->context();
+    v8::Handle<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context.get());
     if (v8Context.IsEmpty())
         return; // JS may not be enabled.
 
@@ -136,7 +137,7 @@ void ScheduledAction::execute(WorkerContext* workerContext)
     if (!m_function.IsEmpty() && m_function->IsFunction()) {
         LOCK_V8;
         v8::HandleScope handleScope;
-        v8::Local<v8::Context> v8Context = scriptController->proxy()->context();
+        v8::Handle<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context.get());
         ASSERT(!v8Context.IsEmpty());
         v8::Context::Scope scope(v8Context);
         m_function->Call(v8Context->Global(), m_argc, m_argv);
diff --git a/WebCore/bindings/v8/ScheduledAction.h b/WebCore/bindings/v8/ScheduledAction.h
index 53694c7..003885f 100644
--- a/WebCore/bindings/v8/ScheduledAction.h
+++ b/WebCore/bindings/v8/ScheduledAction.h
@@ -31,7 +31,9 @@
 #ifndef ScheduledAction_h
 #define ScheduledAction_h
 
+#include "OwnHandle.h"
 #include "ScriptSourceCode.h"
+#include "V8GCController.h"
 
 #include <v8.h>
 
@@ -44,9 +46,10 @@ namespace WebCore {
 
     class ScheduledAction {
     public:
-        ScheduledAction(v8::Handle<v8::Function>, int argc, v8::Handle<v8::Value> argv[]);
-        explicit ScheduledAction(const WebCore::String& code, const KURL& url = KURL())
-            : m_argc(0)
+        ScheduledAction(v8::Handle<v8::Context>, v8::Handle<v8::Function>, int argc, v8::Handle<v8::Value> argv[]);
+        explicit ScheduledAction(v8::Handle<v8::Context> context, const WebCore::String& code, const KURL& url = KURL())
+            : m_context(context)
+            , m_argc(0)
             , m_argv(0)
             , m_code(code, url)
         {
@@ -61,6 +64,7 @@ namespace WebCore {
         void execute(WorkerContext*);
 #endif
 
+        OwnHandle<v8::Context> m_context;
         v8::Persistent<v8::Function> m_function;
         int m_argc;
         v8::Persistent<v8::Value>* m_argv;
diff --git a/WebCore/bindings/v8/ScriptCallFrame.cpp b/WebCore/bindings/v8/ScriptCallFrame.cpp
index ab30862..4c29814 100644
--- a/WebCore/bindings/v8/ScriptCallFrame.cpp
+++ b/WebCore/bindings/v8/ScriptCallFrame.cpp
@@ -42,7 +42,7 @@ namespace WebCore {
 
 ScriptCallFrame::ScriptCallFrame(const String& functionName, const String& urlString, int lineNumber, const v8::Arguments& arguments, unsigned skipArgumentCount)
     : m_functionName(functionName)
-    , m_sourceURL(urlString)
+    , m_sourceURL(ParsedURLString, urlString)
     , m_lineNumber(lineNumber)
 {
     for (int i = 0; i < arguments.Length(); ++i)
diff --git a/WebCore/bindings/v8/ScriptController.cpp b/WebCore/bindings/v8/ScriptController.cpp
index 48c5115..d2c1db2 100644
--- a/WebCore/bindings/v8/ScriptController.cpp
+++ b/WebCore/bindings/v8/ScriptController.cpp
@@ -51,7 +51,6 @@
 #include "npruntime_priv.h"
 #include "NPV8Object.h"
 #include "ScriptSourceCode.h"
-#include "ScriptState.h"
 #include "Widget.h"
 #include "XSSAuditor.h"
 
@@ -96,7 +95,6 @@ ScriptController::ScriptController(Frame* frame)
     , m_sourceURL(0)
     , m_processingTimerCallback(false)
     , m_paused(false)
-    , m_scriptState(new ScriptState(frame))
     , m_proxy(new V8Proxy(frame))
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_windowScriptNPObject(0)
@@ -186,9 +184,14 @@ bool ScriptController::processingUserGesture() const
     return false;
 }
 
-void ScriptController::evaluateInNewWorld(const Vector<ScriptSourceCode>& sources, int extensionGroup)
+void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sources)
 {
-    m_proxy->evaluateInNewWorld(sources, extensionGroup);
+    m_proxy->evaluateInIsolatedWorld(worldID, sources, 0);
+}
+
+void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sources, int extensionGroup)
+{
+    m_proxy->evaluateInIsolatedWorld(worldID, sources, extensionGroup);
 }
 
 void ScriptController::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int extensionGroup)
@@ -202,12 +205,7 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     LOCK_V8;
     String sourceURL = sourceCode.url();
     
-    if (sourceURL.isNull() && !m_XSSAuditor->canEvaluateJavaScriptURL(sourceCode.source())) {
-        // This JavaScript URL is not safe to be evaluated.
-        return ScriptValue();
-    }
-    
-    if (!sourceURL.isNull() && !m_XSSAuditor->canEvaluate(sourceCode.source())) {
+    if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
         // This script is not safe to be evaluated.
         return ScriptValue();
     }
@@ -343,7 +341,7 @@ PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widge
     return V8ScriptInstance::create(wrapper);
 }
 
-void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)
+void ScriptController::cleanupScriptObjectsForPlugin(Widget* nativeHandle)
 {
     PluginObjectMap::iterator it = m_pluginObjects.find(nativeHandle);
     if (it == m_pluginObjects.end())
diff --git a/WebCore/bindings/v8/ScriptController.h b/WebCore/bindings/v8/ScriptController.h
index d614619..9658b05 100644
--- a/WebCore/bindings/v8/ScriptController.h
+++ b/WebCore/bindings/v8/ScriptController.h
@@ -46,7 +46,6 @@ namespace WebCore {
     class Frame;
     class HTMLPlugInElement;
     class ScriptSourceCode;
-    class ScriptState;
     class String;
     class Widget;
     class XSSAuditor;
@@ -65,11 +64,19 @@ namespace WebCore {
         // as a string.
         ScriptValue evaluate(const ScriptSourceCode&);
 
-        // Executes JavaScript in a new world associated with the web frame. The
-        // script gets its own global scope, its own prototypes for intrinsic
-        // JavaScript objects (String, Array, and so-on), and its own wrappers for
-        // all DOM nodes and DOM constructors.
-        void evaluateInNewWorld(const Vector<ScriptSourceCode>&, int extensionGroup);
+        void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
+
+        // Executes JavaScript in an isolated world. The script gets its own global scope,
+        // its own prototypes for intrinsic JavaScript objects (String, Array, and so-on),
+        // and its own wrappers for all DOM nodes and DOM constructors.
+        //
+        // If an isolated world with the specified ID already exists, it is reused.
+        // Otherwise, a new world is created.
+        //
+        // If the worldID is 0, a new world is always created.
+        //
+        // FIXME: Get rid of extensionGroup here.
+        void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&, int extensionGroup);
 
         // Executes JavaScript in a new context associated with the web frame. The
         // script gets its own global scope and its own prototypes for intrinsic
@@ -86,8 +93,6 @@ namespace WebCore {
         // with what JSC does as well.
         ScriptController* windowShell() { return this; }
 
-        ScriptState* state() const { return m_scriptState.get(); }
-
         XSSAuditor* xssAuditor() { return m_XSSAuditor.get(); }
 
         void collectGarbage();
@@ -146,7 +151,7 @@ namespace WebCore {
         void updateSecurityOrigin();
         void clearScriptObjects();
         void updatePlatformScriptObjects();
-        void cleanupScriptObjectsForPlugin(void*);
+        void cleanupScriptObjectsForPlugin(Widget*);
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
         NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
@@ -160,9 +165,8 @@ namespace WebCore {
         bool m_processingTimerCallback;
         bool m_paused;
 
-        OwnPtr<ScriptState> m_scriptState;
         OwnPtr<V8Proxy> m_proxy;
-        typedef HashMap<void*, NPObject*> PluginObjectMap;
+        typedef HashMap<Widget*, NPObject*> PluginObjectMap;
 
         // A mapping between Widgets and their corresponding script object.
         // This list is used so that when the plugin dies, we can immediately
diff --git a/WebCore/bindings/v8/ScriptEventListener.cpp b/WebCore/bindings/v8/ScriptEventListener.cpp
index 7a8aa64..16ca70f 100644
--- a/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -33,7 +33,11 @@
 
 #include "Attribute.h"
 #include "Document.h"
+#include "EventListener.h"
 #include "Frame.h"
+#include "ScriptScope.h"
+#include "V8AbstractEventListener.h"
+#include "V8Binding.h"
 #include "XSSAuditor.h"
 
 namespace WebCore {
@@ -68,4 +72,18 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
     return V8LazyEventListener::create(frame, attr->value(), attr->localName().string(), frame->document()->isSVGDocument());
 }
 
+String getEventListenerHandlerBody(ScriptExecutionContext*, ScriptState* scriptState, EventListener* listener)
+{
+    if (listener->type() != EventListener::JSEventListenerType)
+        return "";
+
+    ScriptScope scope(scriptState);
+    V8AbstractEventListener* v8Listener = static_cast<V8AbstractEventListener*>(listener);
+    v8::Handle<v8::Object> function = v8Listener->getListenerObject();
+    if (function.IsEmpty())
+        return "";
+
+    return toWebCoreStringWithNullCheck(function);
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptEventListener.h b/WebCore/bindings/v8/ScriptEventListener.h
index 0171120..ce12a53 100644
--- a/WebCore/bindings/v8/ScriptEventListener.h
+++ b/WebCore/bindings/v8/ScriptEventListener.h
@@ -38,11 +38,14 @@
 namespace WebCore {
 
     class Attribute;
+    class EventListener;
     class Frame;
     class Node;
+    class ScriptState;
 
     PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node*, Attribute*);
     PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+    String getEventListenerHandlerBody(ScriptExecutionContext*, ScriptState*, EventListener*);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/v8/ScriptFunctionCall.cpp b/WebCore/bindings/v8/ScriptFunctionCall.cpp
index 2fa43d5..9ff6b8c 100644
--- a/WebCore/bindings/v8/ScriptFunctionCall.cpp
+++ b/WebCore/bindings/v8/ScriptFunctionCall.cpp
@@ -31,8 +31,6 @@
 #include "config.h"
 #include "ScriptFunctionCall.h"
 
-#include "Document.h"
-#include "Frame.h"
 #include "ScriptScope.h"
 #include "ScriptState.h"
 #include "ScriptString.h"
@@ -40,19 +38,13 @@
 
 #include "V8Binding.h"
 #include "V8Proxy.h"
+#include "V8Utilities.h"
 
 #include <v8.h>
 #include <wtf/OwnArrayPtr.h>
 
 namespace WebCore {
 
-static void reportException(ScriptState* scriptState, v8::TryCatch &exceptionCatcher)
-{
-    v8::Local<v8::Message> message = exceptionCatcher.Message();
-    scriptState->frame()->document()->reportException(toWebCoreString(message->Get()), message->GetLineNumber(), toWebCoreString(message->GetScriptResourceName()));
-    exceptionCatcher.Reset();
-}
-
 ScriptFunctionCall::ScriptFunctionCall(ScriptState* scriptState, const ScriptObject& thisObject, const String& name)
     : m_scriptState(scriptState)
     , m_thisObject(thisObject)
diff --git a/WebCore/bindings/v8/ScriptObject.cpp b/WebCore/bindings/v8/ScriptObject.cpp
index b6943bd..ac8051d 100644
--- a/WebCore/bindings/v8/ScriptObject.cpp
+++ b/WebCore/bindings/v8/ScriptObject.cpp
@@ -97,6 +97,13 @@ bool ScriptObject::set(const char* name, int value)
     return scope.success();
 }
 
+bool ScriptObject::set(const char* name, unsigned value)
+{
+    ScriptScope scope(m_scriptState);
+    v8Object()->Set(v8::String::New(name), v8::Number::New(value));
+    return scope.success();
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     ScriptScope scope(m_scriptState);
diff --git a/WebCore/bindings/v8/ScriptObject.h b/WebCore/bindings/v8/ScriptObject.h
index dcee3a5..f741f89 100644
--- a/WebCore/bindings/v8/ScriptObject.h
+++ b/WebCore/bindings/v8/ScriptObject.h
@@ -53,6 +53,7 @@ namespace WebCore {
         bool set(const char* name, double);
         bool set(const char* name, long long);
         bool set(const char* name, int);
+        bool set(const char* name, unsigned);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
diff --git a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp b/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
index 053cf68..5dd0dc5 100644
--- a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
+++ b/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
@@ -35,9 +35,11 @@
 #include "Document.h"
 #include "DOMWindow.h"
 #include "Frame.h"
+#include "InspectorController.h"
 #include "Page.h"
 #include "ScriptObject.h"
 #include "ScriptValue.h"
+#include "Storage.h"
 
 #include "V8Binding.h"
 #include "V8Proxy.h"
@@ -61,10 +63,11 @@ bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObj
     return false;
 }
 
-bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
 {
-    ASSERT(frame);
     ASSERT(storage);
+    Frame* frame = storage->frame();
+    ASSERT(frame);
 
 #if ENABLE(DOM_STORAGE)
     v8::HandleScope handleScope;
@@ -73,7 +76,8 @@ bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& qu
     v8::Context::Scope scope(context);
 
     v8::Handle<v8::Value> v8Storage = V8DOMWrapper::convertToV8Object(V8ClassIndex::STORAGE, storage);
-    quarantinedObject = ScriptObject(frame->script()->state(), v8::Local<v8::Object>(v8::Object::Cast(*v8Storage)));
+    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
+    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Storage)));
 #else
     ASSERT_NOT_REACHED();
     quarantinedObject = ScriptObject();
@@ -94,7 +98,8 @@ bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
     v8::Context::Scope scope(context);
 
     v8::Handle<v8::Value> v8Node = V8DOMWrapper::convertNodeToV8Object(node);
-    quarantinedObject = ScriptObject(frame->script()->state(), v8::Local<v8::Object>(v8::Object::Cast(*v8Node)));
+    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
+    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Node)));
 
     return true;
 }
@@ -111,7 +116,8 @@ bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedO
     v8::Context::Scope scope(context);
 
     v8::Handle<v8::Value> v8DomWindow = V8DOMWrapper::convertToV8Object(V8ClassIndex::DOMWINDOW, domWindow);
-    quarantinedObject = ScriptObject(frame->script()->state(), v8::Local<v8::Object>(v8::Object::Cast(*v8DomWindow)));
+    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
+    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8DomWindow)));
 
     return true;
 }
diff --git a/WebCore/bindings/v8/ScriptObjectQuarantine.h b/WebCore/bindings/v8/ScriptObjectQuarantine.h
index 3b7ccff..712dd9b 100644
--- a/WebCore/bindings/v8/ScriptObjectQuarantine.h
+++ b/WebCore/bindings/v8/ScriptObjectQuarantine.h
@@ -42,7 +42,6 @@ namespace WebCore {
 
     class Database;
     class DOMWindow;
-    class Frame;
     class Node;
     class ScriptObject;
     class ScriptValue;
@@ -51,7 +50,7 @@ namespace WebCore {
     ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
 
     bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
     bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
     bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
 
diff --git a/WebCore/bindings/v8/ScriptScope.cpp b/WebCore/bindings/v8/ScriptScope.cpp
index 52cab10..727ab25 100644
--- a/WebCore/bindings/v8/ScriptScope.cpp
+++ b/WebCore/bindings/v8/ScriptScope.cpp
@@ -36,14 +36,13 @@
 #include "Document.h"
 #include "Frame.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 #include <v8.h>
 
 namespace WebCore {
 
 ScriptScope::ScriptScope(ScriptState* scriptState, bool reportExceptions)
-    : m_context(V8Proxy::context(scriptState->frame()))
+    : m_context(scriptState->context())
     , m_scope(m_context)
     , m_scriptState(scriptState)
     , m_reportExceptions(reportExceptions)
diff --git a/WebCore/bindings/v8/ScriptSourceCode.h b/WebCore/bindings/v8/ScriptSourceCode.h
index fea387a..5c16168 100644
--- a/WebCore/bindings/v8/ScriptSourceCode.h
+++ b/WebCore/bindings/v8/ScriptSourceCode.h
@@ -50,7 +50,7 @@ public:
     // Not sure if that matters.
     ScriptSourceCode(CachedScript* cs)
         : m_source(cs->script())
-        , m_url(cs->url())
+        , m_url(ParsedURLString, cs->url())
         , m_startLine(1)
     {
     }
diff --git a/WebCore/bindings/v8/ScriptState.cpp b/WebCore/bindings/v8/ScriptState.cpp
index b9e240c..99557b5 100644
--- a/WebCore/bindings/v8/ScriptState.cpp
+++ b/WebCore/bindings/v8/ScriptState.cpp
@@ -42,9 +42,22 @@ namespace WebCore {
 
 ScriptState::ScriptState(Frame* frame)
     : m_frame(frame)
+    , m_context(v8::Persistent<v8::Context>::New(V8Proxy::mainWorldContext(frame)))
 {
 }
 
+ScriptState::ScriptState(Frame* frame, v8::Handle<v8::Context> context)
+    : m_frame(frame)
+    , m_context(v8::Persistent<v8::Context>::New(context))
+{
+}
+
+ScriptState::~ScriptState()
+{
+    m_context.Dispose();
+    m_context.Clear();
+}
+
 ScriptState* scriptStateFromNode(Node* node)
 {
     // This should be never reached with V8 bindings (WebKit only uses it
@@ -55,7 +68,9 @@ ScriptState* scriptStateFromNode(Node* node)
 
 ScriptState* scriptStateFromPage(Page* page)
 {
-    return page->mainFrame()->script()->state();
+    // This should be never reached with V8 bindings.
+    ASSERT_NOT_REACHED();
+    return 0;
 }
 
 }
diff --git a/WebCore/bindings/v8/ScriptState.h b/WebCore/bindings/v8/ScriptState.h
index 8fbcfa3..e44e914 100644
--- a/WebCore/bindings/v8/ScriptState.h
+++ b/WebCore/bindings/v8/ScriptState.h
@@ -32,16 +32,19 @@
 #define ScriptState_h
 
 #include <v8.h>
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
     class Node;
     class Page;
     class Frame;
 
-    class ScriptState {
+    class ScriptState : public Noncopyable {
     public:
         ScriptState() { }
         ScriptState(Frame* frame);
+        ScriptState(Frame* frame, v8::Handle<v8::Context> context);
+        ~ScriptState();
 
         bool hadException() { return !m_exception.IsEmpty(); }
         void setException(v8::Local<v8::Value> exception)
@@ -51,10 +54,15 @@ namespace WebCore {
         v8::Local<v8::Value> exception() { return m_exception; }
 
         Frame* frame() const { return m_frame; }
+        v8::Local<v8::Context> context() const
+        {
+            return v8::Local<v8::Context>::New(m_context);
+        }
 
     private:
         v8::Local<v8::Value> m_exception;
         Frame* m_frame;
+        v8::Persistent<v8::Context> m_context;
     };
 
     ScriptState* scriptStateFromNode(Node*);
diff --git a/WebCore/bindings/v8/ScriptValue.h b/WebCore/bindings/v8/ScriptValue.h
index 004851b..a429593 100644
--- a/WebCore/bindings/v8/ScriptValue.h
+++ b/WebCore/bindings/v8/ScriptValue.h
@@ -110,7 +110,12 @@ public:
     {
         return m_value->IsUndefined();
     }
-    
+
+    bool isObject() const
+    {
+        return m_value->IsObject();
+    }
+
     bool hasNoValue() const
     {
         return m_value.IsEmpty();
@@ -128,7 +133,7 @@ public:
         m_value.Clear();
     }
 
-    ~ScriptValue() 
+    virtual ~ScriptValue() 
     {
         clear();
     }
diff --git a/WebCore/bindings/v8/SerializedScriptValue.h b/WebCore/bindings/v8/SerializedScriptValue.h
new file mode 100644
index 0000000..26a4199
--- /dev/null
+++ b/WebCore/bindings/v8/SerializedScriptValue.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SerializedScriptValue_h
+#define SerializedScriptValue_h
+
+#include "ScriptValue.h"
+#include "V8Binding.h"
+#include <v8.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
+public:
+    static PassRefPtr<SerializedScriptValue> create(String string)
+    {
+        return adoptRef(new SerializedScriptValue(string));
+    }
+
+    static PassRefPtr<SerializedScriptValue> create()
+    {
+        return adoptRef(new SerializedScriptValue());
+    }
+
+    PassRefPtr<SerializedScriptValue> release()
+    {
+        RefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_data));
+        m_data = String();
+        return result.release();
+    }
+
+    String toString()
+    {
+        return m_data;
+    }
+
+private:
+    SerializedScriptValue(String string)
+        : m_data(string)
+    {
+    }
+
+    SerializedScriptValue() { }
+    String m_data;
+};
+
+} // namespace WebCore
+
+#endif // SerializedScriptValue_h
diff --git a/WebCore/bindings/v8/SharedPersistent.h b/WebCore/bindings/v8/SharedPersistent.h
new file mode 100644
index 0000000..c1232ae
--- /dev/null
+++ b/WebCore/bindings/v8/SharedPersistent.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SharedPersistent_h
+#define SharedPersistent_h
+
+#include <v8.h>
+
+namespace WebCore {
+
+    // A shareable reference to a v8 persistent handle.  Using a shared
+    // persistent any number of objects can share a reference to a v8
+    // object and when it should no longer be accessible the object's
+    // owner can clear it.
+    template <typename T>
+    class SharedPersistent : public WTF::RefCounted<SharedPersistent<T> > {
+    public:
+        void set(v8::Persistent<T> value)
+        {
+            m_value = value;
+        }
+        v8::Persistent<T> get()
+        {
+            return m_value;
+        }
+        void disposeHandle()
+        {
+            if (!m_value.IsEmpty()) {
+              m_value.Dispose();
+              m_value.Clear();
+            }
+        }
+        static PassRefPtr<SharedPersistent<T> > create(v8::Persistent<T> value)
+        {
+            return adoptRef(new SharedPersistent<T>(value));
+        }
+        static PassRefPtr<SharedPersistent<T> > create()
+        {
+            return create(v8::Persistent<T>());
+        }
+    private:
+        explicit SharedPersistent(v8::Persistent<T> value) : m_value(value) { }
+        v8::Persistent<T> m_value;
+    };
+
+} // namespace WebCore
+
+#endif // SharedPersistent_h
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.cpp b/WebCore/bindings/v8/V8AbstractEventListener.cpp
index 0c81846..032b6b9 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -31,17 +31,30 @@
 #include "config.h"
 #include "V8AbstractEventListener.h"
 
+#include "DateExtension.h"
 #include "Document.h"
 #include "Event.h"
 #include "Frame.h"
 #include "Tokenizer.h"
 #include "V8Binding.h"
+#include "V8EventListenerList.h"
+#include "V8Proxy.h"
+#include "V8Utilities.h"
 
 namespace WebCore {
 
-V8AbstractEventListener::V8AbstractEventListener(Frame* frame, bool isAttribute)
-    : m_isAttribute(isAttribute)
+static void weakEventListenerCallback(v8::Persistent<v8::Value>, void* parameter)
+{
+    V8AbstractEventListener* listener = static_cast<V8AbstractEventListener*>(parameter);
+    listener->disposeListenerObject();
+}
+
+V8AbstractEventListener::V8AbstractEventListener(Frame* frame, PassRefPtr<V8ListenerGuard> guard, bool isAttribute)
+    : EventListener(JSEventListenerType)
+    , m_isWeak(true)
+    , m_isAttribute(isAttribute)
     , m_frame(frame)
+    , m_guard(guard)
     , m_lineNumber(0)
     , m_columnNumber(0)
 {
@@ -51,8 +64,7 @@ V8AbstractEventListener::V8AbstractEventListener(Frame* frame, bool isAttribute)
     // We might be called directly from the parser.
     v8::HandleScope handleScope;
 
-    m_context.set(V8Proxy::context(m_frame));
-    m_context.makeWeak();
+    m_context = V8Proxy::shared_context(m_frame);
 
     // Get the position in the source if any.
     if (m_isAttribute && m_frame->document()->tokenizer()) {
@@ -61,52 +73,17 @@ V8AbstractEventListener::V8AbstractEventListener(Frame* frame, bool isAttribute)
     }
 }
 
-void V8AbstractEventListener::invokeEventHandler(v8::Handle<v8::Context> v8Context, Event* event, v8::Handle<v8::Value> jsEvent, bool isWindowEvent)
+V8AbstractEventListener::~V8AbstractEventListener()
 {
-    // We push the event being processed into the global object, so that it can be exposed by DOMWindow's bindings.
-    v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
-    v8::Local<v8::Value> returnValue;
-
-    {
-        // Catch exceptions thrown in the event handler so they do not propagate to javascript code that caused the event to fire.
-        v8::TryCatch tryCatch;
-        tryCatch.SetVerbose(true);
-
-        // Save the old 'event' property so we can restore it later.
-        v8::Local<v8::Value> savedEvent = v8Context->Global()->GetHiddenValue(eventSymbol);
-        tryCatch.Reset();
-
-        // Make the event available in the global object, so DOMWindow can expose it.
-        v8Context->Global()->SetHiddenValue(eventSymbol, jsEvent);
-        tryCatch.Reset();
-
-        // Call the event handler.
-        returnValue = callListenerFunction(jsEvent, event, isWindowEvent);
-        tryCatch.Reset();
-
-        // Restore the old event. This must be done for all exit paths through this method.
-        if (savedEvent.IsEmpty())
-            v8Context->Global()->SetHiddenValue(eventSymbol, v8::Undefined());
-        else
-            v8Context->Global()->SetHiddenValue(eventSymbol, savedEvent);
-        tryCatch.Reset();
+    if (!m_listener.IsEmpty()) {
+        v8::HandleScope scope;
+        v8::Local<v8::Object> listener = v8::Local<v8::Object>::New(m_listener);
+        V8EventListenerList::clearWrapper(listener, m_isAttribute);
     }
-
-    ASSERT(!V8Proxy::handleOutOfMemory() || returnValue.IsEmpty());
-
-    if (returnValue.IsEmpty())
-        return;
-
-    if (!returnValue->IsNull() && !returnValue->IsUndefined() && event->storesResultAsString())
-        event->storeResult(toWebCoreString(returnValue));
-
-    // Prevent default action if the return value is false;
-    // FIXME: Add example, and reference to bug entry.
-    if (m_isAttribute && returnValue->IsBoolean() && !returnValue->BooleanValue())
-        event->preventDefault();
+    disposeListenerObject();
 }
 
-void V8AbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
+void V8AbstractEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext, Event* event)
 {
     // EventListener could be disconnected from the frame.
     if (disconnected())
@@ -119,7 +96,12 @@ void V8AbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
     LOCK_V8;
     v8::HandleScope handleScope;
 
-    v8::Handle<v8::Context> v8Context = m_context.get();
+    if (!m_context)
+        return;
+
+    // Create a new local handle since the persistent handle stored in
+    // m_context may be disposed before we're done.
+    v8::Handle<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context->get());
     if (v8Context.IsEmpty())
         return;
 
@@ -132,7 +114,7 @@ void V8AbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
     // Get the V8 wrapper for the event object.
     v8::Handle<v8::Value> jsEvent = V8DOMWrapper::convertEventToV8Object(event);
 
-    invokeEventHandler(v8Context, event, jsEvent, isWindowEvent);
+    invokeEventHandler(v8Context, event, jsEvent);
 
     Document::updateStyleForAllDocuments();
 }
@@ -148,14 +130,83 @@ void V8AbstractEventListener::disposeListenerObject()
     }
 }
 
-v8::Local<v8::Object> V8AbstractEventListener::getReceiverObject(Event* event, bool isWindowEvent)
+void V8AbstractEventListener::setListenerObject(v8::Handle<v8::Object> listener)
+{
+    disposeListenerObject();
+    m_listener = v8::Persistent<v8::Object>::New(listener);
+#ifndef NDEBUG
+    V8GCController::registerGlobalHandle(EVENT_LISTENER, this, m_listener);
+#endif
+    if (m_isWeak)
+        m_listener.MakeWeak(this, &weakEventListenerCallback);
+}
+
+void V8AbstractEventListener::invokeEventHandler(v8::Handle<v8::Context> v8Context, Event* event, v8::Handle<v8::Value> jsEvent)
+{
+    // We push the event being processed into the global object, so that it can be exposed by DOMWindow's bindings.
+    v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
+    v8::Local<v8::Value> returnValue;
+
+    // In beforeunload/unload handlers, we want to avoid sleeps which do tight loops of calling Date.getTime().
+    if (event->type() == "beforeunload" || event->type() == "unload")
+        DateExtension::get()->setAllowSleep(false);
+
+    {
+        // Catch exceptions thrown in the event handler so they do not propagate to javascript code that caused the event to fire.
+        v8::TryCatch tryCatch;
+        tryCatch.SetVerbose(true);
+
+        // Save the old 'event' property so we can restore it later.
+        v8::Local<v8::Value> savedEvent = v8Context->Global()->GetHiddenValue(eventSymbol);
+        tryCatch.Reset();
+
+        // Make the event available in the global object, so DOMWindow can expose it.
+        v8Context->Global()->SetHiddenValue(eventSymbol, jsEvent);
+        tryCatch.Reset();
+
+        // Call the event handler.
+        tryCatch.SetVerbose(false); // We do not want to report the exception to the inspector console.
+        returnValue = callListenerFunction(jsEvent, event);
+        if (!tryCatch.CanContinue())
+            return;
+
+        // If an error occurs while handling the event, it should be reported.
+        if (tryCatch.HasCaught()) {
+            reportException(0, tryCatch);
+            tryCatch.Reset();
+        }
+
+        // Restore the old event. This must be done for all exit paths through this method.
+        tryCatch.SetVerbose(true);
+        if (savedEvent.IsEmpty())
+            v8Context->Global()->SetHiddenValue(eventSymbol, v8::Undefined());
+        else
+            v8Context->Global()->SetHiddenValue(eventSymbol, savedEvent);
+        tryCatch.Reset();
+    }
+
+    if (event->type() == "beforeunload" || event->type() == "unload")
+        DateExtension::get()->setAllowSleep(true);
+
+    ASSERT(!V8Proxy::handleOutOfMemory() || returnValue.IsEmpty());
+
+    if (returnValue.IsEmpty())
+        return;
+
+    if (!returnValue->IsNull() && !returnValue->IsUndefined() && event->storesResultAsString())
+        event->storeResult(toWebCoreString(returnValue));
+
+    // Prevent default action if the return value is false;
+    // FIXME: Add example, and reference to bug entry.
+    if (m_isAttribute && returnValue->IsBoolean() && !returnValue->BooleanValue())
+        event->preventDefault();
+}
+
+v8::Local<v8::Object> V8AbstractEventListener::getReceiverObject(Event* event)
 {
     if (!m_listener.IsEmpty() && !m_listener->IsFunction())
         return v8::Local<v8::Object>::New(m_listener);
 
-    if (isWindowEvent)
-        return v8::Context::GetCurrent()->Global();
-
     EventTarget* target = event->currentTarget();
     v8::Handle<v8::Value> value = V8DOMWrapper::convertEventTargetToV8Object(target);
     if (value.IsEmpty())
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.h b/WebCore/bindings/v8/V8AbstractEventListener.h
index 1521941..c7736be 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.h
+++ b/WebCore/bindings/v8/V8AbstractEventListener.h
@@ -33,12 +33,39 @@
 
 #include "EventListener.h"
 #include "OwnHandle.h"
+#include "SharedPersistent.h"
 #include <v8.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
     class Event;
     class Frame;
+    class V8Proxy;
+
+    // Shared by listener objects and V8Proxy so that V8Proxy can
+    // silence listeners when needed.
+    class V8ListenerGuard : public RefCounted<V8ListenerGuard> {
+      public:
+        static PassRefPtr<V8ListenerGuard> create()
+        {
+            return adoptRef(new V8ListenerGuard);
+        }
+
+        bool isDisconnected() const { return m_disconnected; }
+
+        void disconnectListeners()
+        {
+            m_disconnected = true;
+        }
+
+      private:
+        V8ListenerGuard()
+            : m_disconnected(false) { }
+
+        bool m_disconnected;
+    };
 
     // There are two kinds of event listeners: HTML or non-HMTL. onload,
     // onfocus, etc (attributes) are always HTML event handler type; Event
@@ -50,54 +77,94 @@ namespace WebCore {
     // but ALLOWs duplicated non-HTML event handlers.
     class V8AbstractEventListener : public EventListener {
     public:
-        virtual ~V8AbstractEventListener() { }
+        virtual ~V8AbstractEventListener();
+
+        static const V8AbstractEventListener* cast(const EventListener* listener)
+        {
+            return listener->type() == JSEventListenerType
+                ? static_cast<const V8AbstractEventListener*>(listener)
+                : 0;
+        }
+
+        static V8AbstractEventListener* cast(EventListener* listener)
+        {
+            return const_cast<V8AbstractEventListener*>(cast(const_cast<const EventListener*>(listener)));
+        }
+
+        // Implementation of EventListener interface.
+
+        virtual bool operator==(const EventListener& other) { return this == &other; }
+
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
 
         // Returns the owner frame of the listener.
         Frame* frame() { return m_frame; }
 
-        virtual void handleEvent(Event*, bool isWindowEvent);
-        void invokeEventHandler(v8::Handle<v8::Context>, Event*, v8::Handle<v8::Value> jsEvent, bool isWindowEvent);
+        virtual bool isLazy() const { return false; }
 
         // Returns the listener object, either a function or an object.
-        virtual v8::Local<v8::Object> getListenerObject()
+        v8::Local<v8::Object> getListenerObject()
         {
+            prepareListenerObject();
             return v8::Local<v8::Object>::New(m_listener);
         }
 
+        v8::Local<v8::Object> getExistingListenerObject()
+        {
+            return v8::Local<v8::Object>::New(m_listener);
+        }
+
+        bool hasExistingListenerObject()
+        {
+            return !m_listener.IsEmpty();
+        }
+
         // Dispose listener object and clear the handle.
         void disposeListenerObject();
 
-        virtual bool disconnected() const { return !m_frame; }
+        // Detach the listener from its owner frame.
+        void disconnectFrame() { m_frame = 0; }
 
-        virtual bool isObjectListener() const { return false; }
+        virtual bool disconnected() const { return m_guard && m_guard->isDisconnected(); }
 
     protected:
-        v8::Persistent<v8::Object> m_listener;
+        V8AbstractEventListener(Frame*, PassRefPtr<V8ListenerGuard>, bool isAttribute);
 
-        // Indicates if this is an HTML type listener.
-        bool m_isAttribute;
+        virtual void prepareListenerObject() { }
 
-    private:
-        V8AbstractEventListener(Frame*, bool isInline);
+        void setListenerObject(v8::Handle<v8::Object> listener);
 
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsevent, Event*, bool isWindowEvent) = 0;
+        void invokeEventHandler(v8::Handle<v8::Context>, Event*, v8::Handle<v8::Value> jsEvent);
 
         // Get the receiver object to use for event listener call.
-        v8::Local<v8::Object> getReceiverObject(Event*, bool isWindowEvent);
+        v8::Local<v8::Object> getReceiverObject(Event*);
+
+        int lineNumber() const { return m_lineNumber; }
+
+    private:
+        // Implementation of EventListener function.
+        virtual bool virtualisAttribute() const { return m_isAttribute; }
+
+        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsevent, Event*) = 0;
+
+        v8::Persistent<v8::Object> m_listener;
+
+        // Indicates if the above handle is weak.
+        bool m_isWeak;
+
+        // Indicates if this is an HTML type listener.
+        bool m_isAttribute;
 
         // Frame to which the event listener is attached to. An event listener must be destroyed before its owner frame is
         // deleted. See fast/dom/replaceChild.html
         // FIXME: this could hold m_frame live until the event listener is deleted.
         Frame* m_frame;
-        OwnHandle<v8::Context> m_context;
+        RefPtr<SharedPersistent<v8::Context> > m_context;
+        RefPtr<V8ListenerGuard> m_guard;
 
         // Position in the HTML source for HTML event listeners.
         int m_lineNumber;
         int m_columnNumber;
-
-        friend class V8EventListener;
-        friend class V8ObjectEventListener;
-        friend class V8LazyEventListener;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Binding.cpp b/WebCore/bindings/v8/V8Binding.cpp
index 0da910b..7d84243 100644
--- a/WebCore/bindings/v8/V8Binding.cpp
+++ b/WebCore/bindings/v8/V8Binding.cpp
@@ -55,7 +55,8 @@ public:
 #ifndef NDEBUG
         m_threadId = WTF::currentThread();
 #endif
-        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * length());
+        ASSERT(!string.isNull());
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * string.length());
     }
 
     explicit WebCoreStringResource(const AtomicString& string)
@@ -65,7 +66,8 @@ public:
 #ifndef NDEBUG
         m_threadId = WTF::currentThread();
 #endif
-        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * length());
+        ASSERT(!string.isNull());
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * string.length());
     }
 
     virtual ~WebCoreStringResource()
@@ -73,18 +75,18 @@ public:
 #ifndef NDEBUG
         ASSERT(m_threadId == WTF::currentThread());
 #endif
-        int reducedExternalMemory = -2 * length();
-        if (!m_plainString.impl()->inTable())
+        int reducedExternalMemory = -2 * m_plainString.length();
+        if (m_plainString.impl() != m_atomicString.impl() && !m_atomicString.isNull())
             reducedExternalMemory *= 2;
         v8::V8::AdjustAmountOfExternalAllocatedMemory(reducedExternalMemory);
     }
 
-    const uint16_t* data() const
+    virtual const uint16_t* data() const
     {
-        return reinterpret_cast<const uint16_t*>(m_plainString.characters());
+        return reinterpret_cast<const uint16_t*>(m_plainString.impl()->characters());
     }
 
-    size_t length() const { return m_plainString.length(); }
+    virtual size_t length() const { return m_plainString.impl()->length(); }
 
     String webcoreString() { return m_plainString; }
 
@@ -95,12 +97,17 @@ public:
 #endif
         if (m_atomicString.isNull()) {
             m_atomicString = AtomicString(m_plainString);
-            if (!m_plainString.impl()->inTable())
-                v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * length());
+            ASSERT(!m_atomicString.isNull());
+            if (m_plainString.impl() != m_atomicString.impl())
+                v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * m_atomicString.length());
         }
         return m_atomicString;
     }
 
+    // Returns right string type based on a dummy parameter.
+    String string(String) { return webcoreString(); }
+    AtomicString string(AtomicString) { return atomicString(); }
+
     static WebCoreStringResource* toStringResource(v8::Handle<v8::String> v8String)
     {
         return static_cast<WebCoreStringResource*>(v8String->GetExternalStringResource());
@@ -121,12 +128,17 @@ private:
 #endif
 };
 
-String v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external,
-        StringType type)
+enum ExternalMode {
+    Externalize,
+    DoNotExternalize
+};
+
+template <typename StringType>
+static StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external)
 {
     WebCoreStringResource* stringResource = WebCoreStringResource::toStringResource(v8String);
     if (stringResource)
-        return stringResource->webcoreString();
+        return stringResource->string(StringType());
 
     int length = v8String->Length();
     if (!length) {
@@ -134,44 +146,42 @@ String v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode ext
         return StringImpl::empty();
     }
 
-    UChar* buffer;
-    String result = String::createUninitialized(length, buffer);
-    v8String->Write(reinterpret_cast<uint16_t*>(buffer), 0, length);
-
-    if (type == AtomicStringType)
-        result = AtomicString(result);
+    StringType result;
+    static const int inlineBufferSize = 16;
+    if (length <= inlineBufferSize) {
+        UChar inlineBuffer[inlineBufferSize];
+        v8String->Write(reinterpret_cast<uint16_t*>(inlineBuffer), 0, length);
+        result = StringType(inlineBuffer, length);
+    } else {
+        UChar* buffer;
+        String tmp = String::createUninitialized(length, buffer);
+        v8String->Write(reinterpret_cast<uint16_t*>(buffer), 0, length);
+        result = StringType(tmp);
+    }
 
-    if (external == Externalize) {
-        WebCoreStringResource* resource = new WebCoreStringResource(result);
-        if (!v8String->MakeExternal(resource)) {
+    if (external == Externalize && v8String->CanMakeExternal()) {
+        stringResource = new WebCoreStringResource(result);
+        if (!v8String->MakeExternal(stringResource)) {
             // In case of a failure delete the external resource as it was not used.
-            delete resource;
+            delete stringResource;
         }
     }
     return result;
 }
 
-AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String> v8String)
+String v8StringToWebCoreString(v8::Handle<v8::String> v8String)
 {
-    WebCoreStringResource* stringResource = WebCoreStringResource::toStringResource(v8String);
-    if (!stringResource) {
-        // If this string hasn't been externalized, we force it now.
-        String plain = v8StringToWebCoreString(v8String, Externalize, AtomicStringType);
-        // If the string is empty there's no room to cache an atomic
-        // string so we bail out.
-        if (plain.isEmpty())
-            return plain;
-        stringResource = WebCoreStringResource::toStringResource(v8String);
-        ASSERT(stringResource != NULL);
-    }
-    return stringResource->atomicString();
+    return v8StringToWebCoreString<String>(v8String, Externalize);
 }
 
-String v8ValueToWebCoreString(v8::Handle<v8::Value> object)
+AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String> v8String)
 {
-    if (object->IsString())
-        return v8StringToWebCoreString(v8::Handle<v8::String>::Cast(object), Externalize, PlainStringType);
+    return v8StringToWebCoreString<AtomicString>(v8String, Externalize);
+}
 
+String v8NonStringValueToWebCoreString(v8::Handle<v8::Value> object)
+{
+    ASSERT(!object->IsString());
     if (object->IsInt32()) {
         int value = object->Int32Value();
         // Most numbers used are <= 100. Even if they aren't used there's very little in using the space.
@@ -197,6 +207,7 @@ String v8ValueToWebCoreString(v8::Handle<v8::Value> object)
         throwError(block.Exception());
         return StringImpl::empty();
     }
+<<<<<<< HEAD:WebCore/bindings/v8/V8Binding.cpp
     return v8StringToWebCoreString(v8String, DoNotExternalize, PlainStringType);
 }
 
@@ -206,11 +217,15 @@ AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> v8Value)
         return v8StringToAtomicWebCoreString(v8::Handle<v8::String>::Cast(v8Value));
     String string = v8ValueToWebCoreString(v8Value);
     return AtomicString(string);
+=======
+    return v8StringToWebCoreString<String>(v8String, DoNotExternalize);
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Binding.cpp
 }
 
-v8::Handle<v8::String> v8String(const String& string)
+AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value> object)
 {
-    return v8ExternalString(string);
+    ASSERT(!object->IsString());
+    return AtomicString(v8NonStringValueToWebCoreString(object));
 }
 
 static bool stringImplCacheEnabled = false;
@@ -261,7 +276,7 @@ v8::Local<v8::String> v8ExternalString(const String& string)
     StringCache& stringCache = getStringCache();
     v8::String* cachedV8String = stringCache.get(stringImpl);
     if (cachedV8String)
-        return v8::Local<v8::String>(cachedV8String);
+        return v8::Local<v8::String>::New(v8::Handle<v8::String>(cachedV8String));
 
     v8::Local<v8::String> newString = makeExternalString(string);
     if (newString.IsEmpty())
diff --git a/WebCore/bindings/v8/V8Binding.h b/WebCore/bindings/v8/V8Binding.h
index 4f36f00..a09102d 100644
--- a/WebCore/bindings/v8/V8Binding.h
+++ b/WebCore/bindings/v8/V8Binding.h
@@ -31,6 +31,7 @@
 #ifndef V8Binding_h
 #define V8Binding_h
 
+#include "AtomicString.h"
 #include "MathExtras.h"
 #include "PlatformString.h"
 
@@ -38,32 +39,31 @@
 
 namespace WebCore {
 
-    enum ExternalMode {
-        Externalize,
-        DoNotExternalize
-    };
-
-    enum StringType {
-        PlainStringType,
-        AtomicStringType
-    };
-
     // Convert v8 types to a WebCore::String. If the V8 string is not already
     // an external string then it is transformed into an external string at this
     // point to avoid repeated conversions.
-    String v8StringToWebCoreString(v8::Handle<v8::String>, ExternalMode mode, StringType type);
-    String v8ValueToWebCoreString(v8::Handle<v8::Value>);
+    String v8StringToWebCoreString(v8::Handle<v8::String>);
+    String v8NonStringValueToWebCoreString(v8::Handle<v8::Value>);
+    inline String v8ValueToWebCoreString(v8::Handle<v8::Value> value)
+    {
+        if (value->IsString())
+            return v8StringToWebCoreString(v8::Handle<v8::String>::Cast(value));
+        return v8NonStringValueToWebCoreString(value);
+    }
 
     // Convert v8 types to a WebCore::AtomicString.
     AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String>);
-    AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value>);
-
-    // Convert a string to a V8 string.
-    v8::Handle<v8::String> v8String(const String&);
+    AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value>);
+    inline AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> value)
+    {
+        if (value->IsString())
+            return v8StringToAtomicWebCoreString(v8::Handle<v8::String>::Cast(value));
+        return v8NonStringValueToAtomicWebCoreString(value);
+    }
 
-    inline String toString(const String& string)

-    {

-        return string;

+    inline String toString(const String& string)
+    {
+        return string;
     }
 
     // Return a V8 external string that shares the underlying buffer with the given
@@ -71,6 +71,12 @@ namespace WebCore {
     // underlying buffer alive while the string is still live in the V8 engine.
     v8::Local<v8::String> v8ExternalString(const String&);
 
+    // Convert a string to a V8 string.
+    inline v8::Handle<v8::String> v8String(const String& string)
+    {
+        return v8ExternalString(string);
+    }
+
     // Enables caching v8 wrappers created for WebCore::StringImpl.  Currently this cache requires
     // all the calls (both to convert WebCore::String to v8::String and to GC the handle)
     // to be performed on the main thread.
@@ -145,7 +151,7 @@ namespace WebCore {
     {
         return value ? v8::True() : v8::False();
     }
-   
+
     inline String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
     {
         if (value->IsNull()) 
@@ -153,6 +159,13 @@ namespace WebCore {
         return v8ValueToWebCoreString(value);
     }
 
+    inline AtomicString v8ValueToAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
+    {
+        if (value->IsNull())
+            return AtomicString();
+        return v8ValueToAtomicWebCoreString(value);
+    }
+
     inline String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value)
     {
         if (value->IsNull() || value->IsUndefined())
diff --git a/WebCore/bindings/v8/V8DOMWrapper.cpp b/WebCore/bindings/v8/V8DOMWrapper.cpp
index 8a9741a..df8e833 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -31,21 +31,31 @@
 #include "config.h"
 #include "V8DOMWrapper.h"
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8DOMWrapper.cpp
 #if PLATFORM(CHROMIUM)
 #include "ChromiumBridge.h"
 #endif
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8DOMWrapper.cpp
 #include "CSSMutableStyleDeclaration.h"
+#include "ChromiumBridge.h"
 #include "DOMObjectsInclude.h"
 #include "DocumentLoader.h"
 #include "FrameLoaderClient.h"
+#include "Notification.h"
+#include "SVGElementInstance.h"
 #include "ScriptController.h"
+#include "V8AbstractEventListener.h"
 #include "V8Binding.h"
 #include "V8Collection.h"
 #include "V8CustomBinding.h"
+#include "V8CustomEventListener.h"
 #include "V8DOMMap.h"
 #include "V8DOMWindow.h"
+#include "V8EventListenerList.h"
 #include "V8Index.h"
 #include "V8IsolatedWorld.h"
+#include "V8Proxy.h"
 #include "WorkerContextExecutionProxy.h"
 
 #include <algorithm>
@@ -337,6 +347,7 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
 
         descriptor->PrototypeTemplate()->SetNamedPropertyHandler(USE_NAMED_PROPERTY_GETTER(DOMWindow));
         descriptor->PrototypeTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(DOMWindow));
+        descriptor->PrototypeTemplate()->SetInternalFieldCount(V8Custom::kDOMWindowInternalFieldCount);
 
         descriptor->SetHiddenPrototype(true);
 
@@ -381,6 +392,24 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
         break;
     }
 
+#if ENABLE(NOTIFICATIONS)
+    case V8ClassIndex::NOTIFICATION: {
+        // Reserve one more internal field for keeping event listeners.
+        v8::Local<v8::ObjectTemplate> instanceTemplate = descriptor->InstanceTemplate();
+        instanceTemplate->SetInternalFieldCount(V8Custom::kNotificationInternalFieldCount);
+        break;
+    }
+#endif // NOTIFICATIONS
+
+#if ENABLE(SVG)
+    case V8ClassIndex::SVGELEMENTINSTANCE: {
+        // Reserve one more internal field for keeping event listeners.
+        v8::Local<v8::ObjectTemplate> instanceTemplate = descriptor->InstanceTemplate();
+        instanceTemplate->SetInternalFieldCount(V8Custom::kSVGElementInstanceInternalFieldCount);
+        break;
+    }
+#endif
+
 #if ENABLE(WORKERS)
     case V8ClassIndex::ABSTRACTWORKER: {
         // Reserve one more internal field for keeping event listeners.
@@ -424,20 +453,42 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
     }
 #endif
 
+#if ENABLE(3D_CANVAS)
     // The following objects are created from JavaScript.
-    case V8ClassIndex::DOMPARSER:
-        descriptor->SetCallHandler(USE_CALLBACK(DOMParserConstructor));
+    case V8ClassIndex::CANVASARRAYBUFFER:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasArrayBufferConstructor));
         break;
-#if ENABLE(VIDEO)
-    case V8ClassIndex::HTMLAUDIOELEMENT:
-        descriptor->SetCallHandler(USE_CALLBACK(HTMLAudioElementConstructor));
+    case V8ClassIndex::CANVASBYTEARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasByteArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasByteArray), USE_INDEXED_PROPERTY_SETTER(CanvasByteArray));
         break;
-#endif
-    case V8ClassIndex::HTMLIMAGEELEMENT:
-        descriptor->SetCallHandler(USE_CALLBACK(HTMLImageElementConstructor));
+    case V8ClassIndex::CANVASFLOATARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasFloatArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasFloatArray), USE_INDEXED_PROPERTY_SETTER(CanvasFloatArray));
+        break;
+    case V8ClassIndex::CANVASINTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasIntArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasIntArray), USE_INDEXED_PROPERTY_SETTER(CanvasIntArray));
+        break;
+    case V8ClassIndex::CANVASSHORTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasShortArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasShortArray), USE_INDEXED_PROPERTY_SETTER(CanvasShortArray));
         break;
-    case V8ClassIndex::HTMLOPTIONELEMENT:
-        descriptor->SetCallHandler(USE_CALLBACK(HTMLOptionElementConstructor));
+    case V8ClassIndex::CANVASUNSIGNEDBYTEARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedByteArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray));
+        break;
+    case V8ClassIndex::CANVASUNSIGNEDINTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedIntArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray));
+        break;
+    case V8ClassIndex::CANVASUNSIGNEDSHORTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedShortArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray));
+        break;
+#endif
+    case V8ClassIndex::DOMPARSER:
+        descriptor->SetCallHandler(USE_CALLBACK(DOMParserConstructor));
         break;
     case V8ClassIndex::WEBKITCSSMATRIX:
         descriptor->SetCallHandler(USE_CALLBACK(WebKitCSSMatrixConstructor));
@@ -445,6 +496,15 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
     case V8ClassIndex::WEBKITPOINT:
         descriptor->SetCallHandler(USE_CALLBACK(WebKitPointConstructor));
         break;
+#if ENABLE(WEB_SOCKETS)
+    case V8ClassIndex::WEBSOCKET: {
+        // Reserve one more internal field for keeping event listeners.
+        v8::Local<v8::ObjectTemplate> instanceTemplate = descriptor->InstanceTemplate();
+        instanceTemplate->SetInternalFieldCount(V8Custom::kWebSocketInternalFieldCount);
+        descriptor->SetCallHandler(USE_CALLBACK(WebSocketConstructor));
+        break;
+    }
+#endif
     case V8ClassIndex::XMLSERIALIZER:
         descriptor->SetCallHandler(USE_CALLBACK(XMLSerializerConstructor));
         break;
@@ -482,6 +542,9 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
     case V8ClassIndex::CLIENTRECTLIST:
         descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(ClientRectList));
         break;
+    case V8ClassIndex::FILELIST:
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(FileList));
+        break;
 #if ENABLE(DATAGRID)
     case V8ClassIndex::DATAGRIDCOLUMNLIST:
         descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(DataGridColumnList));
@@ -534,6 +597,16 @@ v8::Local<v8::Function> V8DOMWrapper::getConstructor(V8ClassIndex::V8WrapperType
     if (!frame)
         return v8::Local<v8::Function>();
 
+#if ENABLE(WEB_SOCKETS)
+    // Make typeof(window.WebSocket) == 'undefined' when
+    // experimentalWebSocketEnabled is false.
+    if (type == V8ClassIndex::WEBSOCKET) {
+        Settings* settings = frame->settings();
+        if (!settings || !settings->experimentalWebSocketsEnabled())
+            return v8::Local<v8::Function>();
+    }
+#endif
+
     v8::Handle<v8::Context> context = V8Proxy::context(frame);
     if (context.IsEmpty())
         return v8::Local<v8::Function>();
@@ -562,6 +635,7 @@ v8::Handle<v8::Value> V8DOMWrapper::convertToV8Object(V8ClassIndex::V8WrapperTyp
 
     // These objects can be constructed under WorkerContextExecutionProxy.  They need special
     // handling, since if we proceed below V8Proxy::retrieve() will get called and will crash.
+    // TODO(ukai): websocket?
     if ((type == V8ClassIndex::DOMCOREEXCEPTION
          || type == V8ClassIndex::RANGEEXCEPTION
          || type == V8ClassIndex::EVENTEXCEPTION
@@ -982,7 +1056,6 @@ V8ClassIndex::V8WrapperType V8DOMWrapper::htmlElementType(HTMLElement* element)
 
 #if ENABLE(SVG_FONTS)
 #define FOR_EACH_FONTS_TAG(macro) \
-    macro(definition-src, DEFINITIONSRC) \
     macro(font-face, FONTFACE) \
     macro(font-face-format, FONTFACEFORMAT) \
     macro(font-face-name, FONTFACENAME) \
@@ -1105,6 +1178,8 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventToV8Object(Event* event)
         type = V8ClassIndex::OVERFLOWEVENT;
     else if (event->isMessageEvent())
         type = V8ClassIndex::MESSAGEEVENT;
+    else if (event->isPageTransitionEvent())
+        type = V8ClassIndex::PAGETRANSITIONEVENT;
     else if (event->isProgressEvent()) {
         if (event->isXMLHttpRequestProgressEvent())
             type = V8ClassIndex::XMLHTTPREQUESTPROGRESSEVENT;
@@ -1155,30 +1230,30 @@ static const V8ClassIndex::V8WrapperType mapping[] = {
     V8ClassIndex::NODE,                   // XPATH_NAMESPACE_NODE
 };
 
-// Caller checks node is not null.
-v8::Handle<v8::Value> V8DOMWrapper::convertNodeToV8Object(Node* node)
+v8::Handle<v8::Value> V8DOMWrapper::convertDocumentToV8Object(Document* document)
 {
-    if (!node)
-        return v8::Null();
-
     // Find a proxy for this node.
     //
     // Note that if proxy is found, we might initialize the context which can
     // instantiate a document wrapper.  Therefore, we get the proxy before
     // checking if the node already has a wrapper.
-    V8Proxy* proxy = 0;
-    Document* document = node->document();
-    if (document) {
-        Frame* frame = document->frame();
-        proxy = V8Proxy::retrieve(frame);
-        if (proxy)
-            proxy->initContextIfNeeded();
-    }
+    V8Proxy* proxy = V8Proxy::retrieve(document->frame());
+    if (proxy)
+        proxy->initContextIfNeeded();
 
     DOMWrapperMap<Node>& domNodeMap = getDOMNodeMap();
-    v8::Handle<v8::Object> wrapper = domNodeMap.get(node);
-    if (!wrapper.IsEmpty())
-        return wrapper;
+    v8::Handle<v8::Object> wrapper = domNodeMap.get(document);
+    if (wrapper.IsEmpty())
+        return convertNewNodeToV8Object(document, proxy, domNodeMap);
+
+    return wrapper;
+}
+
+// Caller checks node is not null.
+v8::Handle<v8::Value> V8DOMWrapper::convertNewNodeToV8Object(Node* node, V8Proxy* proxy, DOMWrapperMap<Node>& domNodeMap)
+{
+    if (!proxy && node->document())
+        proxy = V8Proxy::retrieve(node->document()->frame());
 
     bool isDocument = false; // document type node has special handling
     V8ClassIndex::V8WrapperType type;
@@ -1272,6 +1347,18 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* ta
         return convertToV8Object(V8ClassIndex::WORKER, worker);
 #endif // WORKERS
 
+#if ENABLE(NOTIFICATIONS)
+    Notification* notification = target->toNotification();
+    if (notification)
+        return convertToV8Object(V8ClassIndex::NOTIFICATION, notification);
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    WebSocket* webSocket = target->toWebSocket();
+    if (webSocket)
+        return convertToV8Object(V8ClassIndex::WEBSOCKET, webSocket);
+#endif
+
     Node* node = target->toNode();
     if (node)
         return convertNodeToV8Object(node);
@@ -1322,6 +1409,98 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventListenerToV8Object(EventListener
     return v8listener->getListenerObject();
 }
 
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    ScriptExecutionContext* context = node->scriptExecutionContext();
+    if (!context)
+        return 0;
+
+    V8Proxy* proxy = V8Proxy::retrieve(context);
+    // The document might be created using createDocument, which does
+    // not have a frame, use the active frame.
+    if (!proxy)
+        proxy = V8Proxy::retrieve(V8Proxy::retrieveFrameForEnteredContext());
+
+    if (proxy)
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+
+    return 0;
+}
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(SVGElementInstance* element, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    return getEventListener(element->correspondingElement(), value, isAttribute, lookup);
+}
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(AbstractWorker* worker, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    if (worker->scriptExecutionContext()->isWorkerContext()) {
+        WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
+        ASSERT(workerContextProxy);
+        return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
+    }
+
+    V8Proxy* proxy = V8Proxy::retrieve(worker->scriptExecutionContext());
+    if (proxy)
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+
+    return 0;
+}
+
+#if ENABLE(NOTIFICATIONS)
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Notification* notification, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    if (notification->scriptExecutionContext()->isWorkerContext()) {
+        WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
+        ASSERT(workerContextProxy);
+        return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
+    }
+
+    V8Proxy* proxy = V8Proxy::retrieve(notification->scriptExecutionContext());
+    if (proxy)
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+
+    return 0;
+}
+#endif
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(WorkerContext* workerContext, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    WorkerContextExecutionProxy* workerContextProxy = workerContext->script()->proxy();
+    if (workerContextProxy)
+        return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
+
+    return 0;
+}
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(XMLHttpRequestUpload* upload, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    return getEventListener(upload->associatedXMLHttpRequest(), value, isAttribute, lookup);
+}
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(EventTarget* eventTarget, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    V8Proxy* proxy = V8Proxy::retrieve(eventTarget->scriptExecutionContext());
+    if (proxy)
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+
+#if ENABLE(WORKERS)
+    WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
+    if (workerContextProxy)
+        return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
+#endif
+
+    return 0;
+}
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(V8Proxy* proxy, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    if (proxy)
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+
+    return 0;
+}
+
 v8::Handle<v8::Value> V8DOMWrapper::convertDOMImplementationToV8Object(DOMImplementation* impl)
 {
     v8::Handle<v8::Object> result = instantiateV8Object(V8ClassIndex::DOMIMPLEMENTATION, V8ClassIndex::DOMIMPLEMENTATION, impl);
diff --git a/WebCore/bindings/v8/V8DOMWrapper.h b/WebCore/bindings/v8/V8DOMWrapper.h
index 57b3a69..2257688 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/WebCore/bindings/v8/V8DOMWrapper.h
@@ -31,13 +31,18 @@
 #ifndef V8DOMWrapper_h
 #define V8DOMWrapper_h
 
+#include "Document.h"
 #include "Event.h"
 #include "Node.h"
 #include "NodeFilter.h"
 #include "PlatformString.h" // for WebCore::String
 #include "V8CustomBinding.h"
+#include "V8CustomXPathNSResolver.h"
+#include "V8DOMMap.h"
 #include "V8Index.h"
 #include "V8Utilities.h"
+#include "V8XPathNSResolver.h"
+#include "XPathNSResolver.h"
 #include <v8.h>
 
 namespace WebCore {
@@ -86,8 +91,16 @@ namespace WebCore {
     class StyleSheetList;
     class V8EventListener;
     class V8ObjectEventListener;
+#if ENABLE(WEB_SOCKETS)
+    class WebSocket;
+#endif
     class WorkerContext;
 
+    enum ListenerLookupType {
+        ListenerFindOnly,
+        ListenerFindOrCreate,
+    };
+
     class V8DOMWrapper {
     public:
 #ifndef NDEBUG
@@ -134,7 +147,26 @@ namespace WebCore {
             return convertNodeToV8Object(node.get());
         }
 
-        static v8::Handle<v8::Value> convertNodeToV8Object(Node*);
+        static v8::Handle<v8::Value> convertNodeToV8Object(Node* node)
+        {
+            if (!node)
+                return v8::Null();
+
+            Document* document = node->document();
+            if (node == document)
+                return convertDocumentToV8Object(document);
+
+            DOMWrapperMap<Node>& domNodeMap = getDOMNodeMap();
+            v8::Handle<v8::Object> wrapper = domNodeMap.get(node);
+            if (wrapper.IsEmpty())
+                return convertNewNodeToV8Object(node, 0, domNodeMap);
+
+            return wrapper;
+        }
+
+        static v8::Handle<v8::Value> convertDocumentToV8Object(Document*);
+
+        static v8::Handle<v8::Value> convertNewNodeToV8Object(Node*, V8Proxy*, DOMWrapperMap<Node>&);
 
         template <class C>
         static C* convertToNativeObject(V8ClassIndex::V8WrapperType type, v8::Handle<v8::Object> object)
@@ -184,13 +216,43 @@ namespace WebCore {
         static v8::Handle<v8::Value> convertEventTargetToV8Object(EventTarget*);
 
         // Wrap and unwrap JS event listeners.
-        static v8::Handle<v8::Value> convertEventListenerToV8Object(PassRefPtr<Event> eventListener)
+        static v8::Handle<v8::Value> convertEventListenerToV8Object(PassRefPtr<EventListener> eventListener)
         {
             return convertEventListenerToV8Object(eventListener.get());
         }
 
         static v8::Handle<v8::Value> convertEventListenerToV8Object(EventListener*);
 
+        static PassRefPtr<EventListener> getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+        static PassRefPtr<EventListener> getEventListener(SVGElementInstance* element, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+        static PassRefPtr<EventListener> getEventListener(AbstractWorker* worker, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+#if ENABLE(NOTIFICATIONS)
+        static PassRefPtr<EventListener> getEventListener(Notification* notification, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+#endif
+
+        static PassRefPtr<EventListener> getEventListener(WorkerContext* workerContext, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+        static PassRefPtr<EventListener> getEventListener(XMLHttpRequestUpload* upload, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+        static PassRefPtr<EventListener> getEventListener(EventTarget* eventTarget, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+        static PassRefPtr<EventListener> getEventListener(V8Proxy* proxy, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+
+        // XPath-related utilities
+        static RefPtr<XPathNSResolver> getXPathNSResolver(v8::Handle<v8::Value> value)
+        {
+            RefPtr<XPathNSResolver> resolver;
+            if (V8XPathNSResolver::HasInstance(value))
+                resolver = convertToNativeObject<XPathNSResolver>(V8ClassIndex::XPATHNSRESOLVER, v8::Handle<v8::Object>::Cast(value));
+            else if (value->IsObject())
+                resolver = V8CustomXPathNSResolver::create(value->ToObject());
+            return resolver;
+        }
+
         // DOMImplementation is a singleton and it is handled in a special
         // way. A wrapper is generated per document and stored in an
         // internal field of the document.
diff --git a/WebCore/bindings/v8/V8EventListenerList.cpp b/WebCore/bindings/v8/V8EventListenerList.cpp
index c9aaa12..e37d630 100644
--- a/WebCore/bindings/v8/V8EventListenerList.cpp
+++ b/WebCore/bindings/v8/V8EventListenerList.cpp
@@ -31,165 +31,6 @@
 #include "config.h"
 #include "V8EventListenerList.h"
 
-#include "V8CustomEventListener.h"
-
 namespace WebCore {
 
-V8EventListenerListIterator::V8EventListenerListIterator(V8EventListenerList* list)
-    : m_list(list)
-    , m_vectorIndex(0)
-    , m_iter(list->m_table.begin())
-{
-}
-
-V8EventListenerListIterator::V8EventListenerListIterator(V8EventListenerList* list, bool shouldSeekToEnd)
-    : m_list(list)
-    , m_vectorIndex(0)
-    , m_iter(list->m_table.begin())
-{
-    if (shouldSeekToEnd)
-        seekToEnd();
-}
-
-V8EventListenerListIterator::~V8EventListenerListIterator() { }
-
-void V8EventListenerListIterator::operator++()
-{
-    if (m_iter != m_list->m_table.end()) {
-        Vector<V8EventListener*>* vector = m_iter->second;
-        if (m_vectorIndex + 1 < vector->size()) {
-            m_vectorIndex++;
-            return;
-        }
-        m_vectorIndex = 0;
-        ++m_iter;
-    }
-}
-
-bool V8EventListenerListIterator::operator==(const V8EventListenerListIterator& other)
-{
-    return other.m_iter == m_iter && other.m_vectorIndex == m_vectorIndex && other.m_list == m_list;
-}
-
-bool V8EventListenerListIterator::operator!=(const V8EventListenerListIterator& other)
-{
-    return !operator==(other);
-}
-
-V8EventListener* V8EventListenerListIterator::operator*()
-{
-    if (m_iter != m_list->m_table.end()) {
-        Vector<V8EventListener*>* vector = m_iter->second;
-        if (m_vectorIndex < vector->size())
-            return vector->at(m_vectorIndex);
-    }
-    return 0;
-}
-
-void V8EventListenerListIterator::seekToEnd()
-{
-    m_iter = m_list->m_table.end();
-    m_vectorIndex = 0;
-}
-
-
-V8EventListenerList::V8EventListenerList()
-{
-}
-
-V8EventListenerList::~V8EventListenerList()
-{
-}
-
-V8EventListenerListIterator V8EventListenerList::begin()
-{
-    return iterator(this);
-}
-
-V8EventListenerListIterator V8EventListenerList::end()
-{
-    return iterator(this, true);
-}
-
-
-static int getKey(v8::Local<v8::Object> object)
-{
-    // 0 is a sentinel value for the HashMap key, so we map it to 1.
-    int hash = object->GetIdentityHash();
-    if (!hash)
-        return 1;
-    return hash;
-}
-
-void V8EventListenerList::add(V8EventListener* listener)
-{
-    ASSERT(v8::Context::InContext());
-    v8::HandleScope handleScope;
-
-    v8::Local<v8::Object> object = listener->getListenerObject();
-    int key = getKey(object);
-    Vector<V8EventListener*>* vector = m_table.get(key);
-    if (!vector) {
-        vector = new Vector<V8EventListener*>();
-        m_table.set(key, vector);
-    }
-    vector->append(listener);
-    m_reverseTable.set(listener, key);
-}
-
-void V8EventListenerList::remove(V8EventListener* listener)
-{
-    if (m_reverseTable.contains(listener)) {
-        int key = m_reverseTable.get(listener);
-        Vector<V8EventListener*>* vector = m_table.get(key);
-        if (!vector)
-            return;
-        for (size_t j = 0; j < vector->size(); j++) {
-            if (vector->at(j) == listener) {
-                vector->remove(j);
-                if (!vector->size()) {
-                    m_table.remove(key);
-                    delete vector;
-                    vector = 0;
-                }
-                m_reverseTable.remove(listener);
-                return;
-            }
-        }
-    }
-}
-
-void V8EventListenerList::clear()
-{
-    m_table.clear();
-    m_reverseTable.clear();
-}
-
-V8EventListener* V8EventListenerList::find(v8::Local<v8::Object> object, bool isAttribute)
-{
-    ASSERT(v8::Context::InContext());
-    int key = getKey(object);
-
-    Vector<V8EventListener*>* vector = m_table.get(key);
-    if (!vector)
-        return 0;
-
-    for (size_t i = 0; i < vector->size(); i++) {
-        V8EventListener* element = vector->at(i);
-        if (isAttribute == element->isAttribute() && object == element->getListenerObject())
-            return element;
-    }
-    return 0;
-}
-
-PassRefPtr<V8EventListener> V8EventListenerList::findWrapper(v8::Local<v8::Value> object, bool isAttribute)
-{
-    ASSERT(v8::Context::InContext());
-    if (!object->IsObject())
-        return 0;
-
-    // FIXME: Should this be v8::Local<v8::Object>::Cast instead?
-    return find(object->ToObject(), isAttribute);
-}
-
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8EventListenerList.h b/WebCore/bindings/v8/V8EventListenerList.h
index 4255050..506e5dc 100644
--- a/WebCore/bindings/v8/V8EventListenerList.h
+++ b/WebCore/bindings/v8/V8EventListenerList.h
@@ -32,92 +32,74 @@
 #define V8EventListenerList_h
 
 #include <v8.h>
-#include <wtf/Vector.h>
-#include <wtf/HashMap.h>
 
 #include "PassRefPtr.h"
+#include "V8CustomEventListener.h"
+#include "V8HiddenPropertyName.h"
 
 namespace WebCore {
     class Frame;
     class V8EventListener;
-    class V8EventListenerListIterator;
 
-    // This is a container for V8EventListener objects that uses the identity hash of the v8::Object to
-    // speed up lookups
+    // This is a container for V8EventListener objects that uses hidden properties of v8::Object to speed up lookups.
     class V8EventListenerList {
     public:
-        // Because v8::Object identity hashes are not guaranteed to be unique, we unfortunately can't just map
-        // an int to V8EventListener. Instead we define a HashMap of int to Vector of V8EventListener
-        // called a ListenerMultiMap.
-        typedef Vector<V8EventListener*>* Values;
-        struct ValuesTraits : HashTraits<Values> {
-            static const bool needsDestruction = true;
-        };
-        typedef HashMap<int, Values, DefaultHash<int>::Hash, HashTraits<int>, ValuesTraits> ListenerMultiMap;
-
-        V8EventListenerList();
-        ~V8EventListenerList();
-
-        friend class V8EventListenerListIterator;
-        typedef V8EventListenerListIterator iterator;        
-
-        iterator begin();
-        iterator end();
-
-        void add(V8EventListener*);
-        void remove(V8EventListener*);
-        V8EventListener* find(v8::Local<v8::Object>, bool isAttribute);
-        void clear();
-        size_t size() { return m_table.size(); }
-
-        PassRefPtr<V8EventListener> findWrapper(v8::Local<v8::Value>, bool isAttribute);
-        template<typename WrapperType>
-        PassRefPtr<V8EventListener> findOrCreateWrapper(Frame*, v8::Local<v8::Value>, bool isAttribute);
+        static PassRefPtr<V8EventListener> findWrapper(v8::Local<v8::Value> value, bool isAttribute)
+        {
+            ASSERT(v8::Context::InContext());
+            if (!value->IsObject())
+                return 0;
 
-    private:
-        ListenerMultiMap m_table;
+            v8::Handle<v8::String> wrapperProperty = getHiddenProperty(isAttribute);
+            return doFindWrapper(v8::Local<v8::Object>::Cast(value), wrapperProperty);
+        }
 
-        // we also keep a reverse mapping of V8EventListener to v8::Object identity hash,
-        // in order to speed up removal by V8EventListener
-        HashMap<V8EventListener*, int> m_reverseTable;
-    };
+        template<typename WrapperType, typename ContextType>
+        static PassRefPtr<V8EventListener> findOrCreateWrapper(ContextType*, PassRefPtr<V8ListenerGuard>, v8::Local<v8::Value>, bool isAttribute);
+
+        static void clearWrapper(v8::Handle<v8::Object> listenerObject, bool isAttribute)
+        {
+            v8::Handle<v8::String> wrapperProperty = getHiddenProperty(isAttribute);
+            listenerObject->DeleteHiddenValue(wrapperProperty);
+        }
 
-    class V8EventListenerListIterator {
-    public:
-        ~V8EventListenerListIterator();
-        void operator++();
-        bool operator==(const V8EventListenerListIterator&);
-        bool operator!=(const V8EventListenerListIterator&);
-        V8EventListener* operator*();
     private:
-        friend class V8EventListenerList;
-        explicit V8EventListenerListIterator(V8EventListenerList*);
-        V8EventListenerListIterator(V8EventListenerList*, bool shouldSeekToEnd);
-        void seekToEnd();
-
-        V8EventListenerList* m_list;
-        V8EventListenerList::ListenerMultiMap::iterator m_iter;
-        size_t m_vectorIndex;
+        static V8EventListener* doFindWrapper(v8::Local<v8::Object> object, v8::Handle<v8::String> wrapperProperty)
+        {
+            ASSERT(v8::Context::InContext());
+            v8::HandleScope scope;
+            v8::Local<v8::Value> listener = object->GetHiddenValue(wrapperProperty);
+            if (listener.IsEmpty())
+                return 0;
+            return static_cast<V8EventListener*>(v8::External::Unwrap(listener));
+        }
+
+        static inline v8::Handle<v8::String> getHiddenProperty(bool isAttribute)
+        {
+            return isAttribute ? V8HiddenPropertyName::attributeListener() : V8HiddenPropertyName::listener();
+        }
     };
 
-    template<typename WrapperType>
-    PassRefPtr<V8EventListener> V8EventListenerList::findOrCreateWrapper(Frame* frame, v8::Local<v8::Value> object, bool isAttribute)
+    template<typename WrapperType, typename ContextType>
+    PassRefPtr<V8EventListener> V8EventListenerList::findOrCreateWrapper(ContextType* context, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Value> value, bool isAttribute)
     {
         ASSERT(v8::Context::InContext());
-        if (!object->IsObject())
+        if (!value->IsObject())
             return 0;
 
-        // FIXME: Should this be v8::Local<v8::Object>::Cast instead?
-        V8EventListener* wrapper = find(object->ToObject(), isAttribute);
+        v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(value);
+        v8::Handle<v8::String> wrapperProperty = getHiddenProperty(isAttribute);
+
+        V8EventListener* wrapper = doFindWrapper(object, wrapperProperty);
         if (wrapper)
             return wrapper;
 
-        // Create a new one, and add to cache.
-        RefPtr<WrapperType> newListener = WrapperType::create(frame, v8::Local<v8::Object>::Cast(object), isAttribute);
-        add(newListener.get());
+        PassRefPtr<V8EventListener> wrapperPtr = WrapperType::create(context, guard, object, isAttribute);
+        if (wrapperPtr)
+            object->SetHiddenValue(wrapperProperty, v8::External::Wrap(wrapperPtr.get()));
 
-        return newListener;
-    };
+        return wrapperPtr;
+    }
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/v8/V8HiddenPropertyName.cpp b/WebCore/bindings/v8/V8HiddenPropertyName.cpp
index 16ac232..d83573f 100644
--- a/WebCore/bindings/v8/V8HiddenPropertyName.cpp
+++ b/WebCore/bindings/v8/V8HiddenPropertyName.cpp
@@ -33,22 +33,21 @@
 
 namespace WebCore {
 
-v8::Handle<v8::String> V8HiddenPropertyName::objectPrototype()
-{
-    static v8::Persistent<v8::String>* string = createString("WebCore::V8HiddenPropertyName::objectPrototype");
-
-    return *string;
+#define V8_AS_STRING(x) V8_AS_STRING_IMPL(x)
+#define V8_AS_STRING_IMPL(x) #x
+
+#define V8_DEFINE_PROPERTY(name) \
+v8::Handle<v8::String> V8HiddenPropertyName::name() \
+{ \
+    static v8::Persistent<v8::String>* string = createString("WebCore::V8HiddenPropertyName::" V8_AS_STRING(name)); \
+    return *string; \
 }
 
-v8::Handle<v8::String> V8HiddenPropertyName::isolatedWorld()
-{
-    static v8::Persistent<v8::String>* string = createString("WebCore::V8HiddenPropertyName::isolatedWorld");
-
-    return *string;
-}
+V8_HIDDEN_PROPERTIES(V8_DEFINE_PROPERTY);
 
 v8::Persistent<v8::String>* V8HiddenPropertyName::createString(const char* key)
 {
+    v8::HandleScope scope;
     return new v8::Persistent<v8::String>(v8::Persistent<v8::String>::New(v8::String::NewSymbol(key)));
 }
 
diff --git a/WebCore/bindings/v8/V8HiddenPropertyName.h b/WebCore/bindings/v8/V8HiddenPropertyName.h
index 874b525..5ef89cb 100644
--- a/WebCore/bindings/v8/V8HiddenPropertyName.h
+++ b/WebCore/bindings/v8/V8HiddenPropertyName.h
@@ -35,10 +35,19 @@
 
 namespace WebCore {
 
+#define V8_HIDDEN_PROPERTIES(V) \
+    V(objectPrototype) \
+    V(isolatedWorld) \
+    V(listener) \
+    V(attributeListener) \
+    V(sleepFunction) \
+    V(toStringString)
+
     class V8HiddenPropertyName {
     public:
-        static v8::Handle<v8::String> objectPrototype();
-        static v8::Handle<v8::String> isolatedWorld();
+#define V8_DECLARE_PROPERTY(name) static v8::Handle<v8::String> name();
+        V8_HIDDEN_PROPERTIES(V8_DECLARE_PROPERTY);
+#undef V8_DECLARE_PROPERTY
 
     private:
         static v8::Persistent<v8::String>* createString(const char* key);
diff --git a/WebCore/bindings/v8/V8Index.cpp b/WebCore/bindings/v8/V8Index.cpp
index 9efbc3d..1d2b9c0 100644
--- a/WebCore/bindings/v8/V8Index.cpp
+++ b/WebCore/bindings/v8/V8Index.cpp
@@ -33,6 +33,8 @@
 
 #include "V8Attr.h"
 #include "V8BarInfo.h"
+#include "V8BeforeLoadEvent.h"
+#include "V8CanvasRenderingContext.h"
 #include "V8CanvasRenderingContext2D.h"
 #include "V8CanvasGradient.h"
 #include "V8CanvasPattern.h"
@@ -107,6 +109,7 @@
 #include "V8HTMLHtmlElement.h"
 #include "V8HTMLIFrameElement.h"
 #include "V8HTMLImageElement.h"
+#include "V8HTMLImageElementConstructor.h"
 #include "V8HTMLInputElement.h"
 #include "V8HTMLIsIndexElement.h"
 #include "V8HTMLLabelElement.h"
@@ -121,6 +124,7 @@
 #include "V8HTMLOListElement.h"
 #include "V8HTMLOptGroupElement.h"
 #include "V8HTMLOptionElement.h"
+#include "V8HTMLOptionElementConstructor.h"
 #include "V8HTMLParagraphElement.h"
 #include "V8HTMLParamElement.h"
 #include "V8HTMLPreElement.h"
@@ -179,6 +183,7 @@
 #include "V8Navigator.h"
 #include "V8MimeType.h"
 #include "V8MimeTypeArray.h"
+#include "V8PageTransitionEvent.h"
 #include "V8Plugin.h"
 #include "V8PluginArray.h"
 #include "V8Range.h"
@@ -254,7 +259,6 @@
 #endif
 
 #if ENABLE(SVG_FONTS)
-#include "V8SVGDefinitionSrcElement.h"
 #include "V8SVGFontFaceElement.h"
 #include "V8SVGFontFaceFormatElement.h"
 #include "V8SVGFontFaceNameElement.h"
@@ -370,6 +374,7 @@
 
 #if ENABLE(VIDEO)
 #include "V8HTMLAudioElement.h"
+#include "V8HTMLAudioElementConstructor.h"
 #include "V8HTMLMediaElement.h"
 #include "V8HTMLSourceElement.h"
 #include "V8HTMLVideoElement.h"
@@ -377,6 +382,10 @@
 #include "V8TimeRanges.h"
 #endif
 
+#if ENABLE(WEB_SOCKETS)
+#include "V8WebSocket.h"
+#endif
+
 #if ENABLE(WORKERS)
 #include "V8AbstractWorker.h"
 #include "V8DedicatedWorkerContext.h"
@@ -386,10 +395,16 @@
 #include "V8WorkerNavigator.h"
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+#include "V8Notification.h"
+#include "V8NotificationCenter.h"
+#endif
+
 #if ENABLE(SHARED_WORKERS)
 #include "V8SharedWorker.h"
 #endif
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.cpp
 #if ENABLE(GEOLOCATION)
 #include "V8Coordinates.h"
 #include "V8Geolocation.h"
@@ -413,6 +428,25 @@
 
 #if ENABLE(XSLT)
 #include "V8XSLTProcessor.h"
+=======
+#if ENABLE(3D_CANVAS)
+#include "V8CanvasRenderingContext3D.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArray.h"
+#include "V8CanvasByteArray.h"
+#include "V8CanvasBuffer.h"
+#include "V8CanvasFloatArray.h"
+#include "V8CanvasFramebuffer.h"
+#include "V8CanvasIntArray.h"
+#include "V8CanvasProgram.h"
+#include "V8CanvasRenderbuffer.h"
+#include "V8CanvasShader.h"
+#include "V8CanvasShortArray.h"
+#include "V8CanvasTexture.h"
+#include "V8CanvasUnsignedByteArray.h"
+#include "V8CanvasUnsignedIntArray.h"
+#include "V8CanvasUnsignedShortArray.h"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Index.cpp
 #endif
 
 namespace WebCore {
diff --git a/WebCore/bindings/v8/V8Index.h b/WebCore/bindings/v8/V8Index.h
index d6db4c6..b73100c 100644
--- a/WebCore/bindings/v8/V8Index.h
+++ b/WebCore/bindings/v8/V8Index.h
@@ -54,6 +54,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if ENABLE(VIDEO)
 #define VIDEO_HTMLELEMENT_TYPES(V)                                      \
+    V(AUDIO, HTMLAudioElementConstructor)                               \
     V(HTMLAUDIOELEMENT, HTMLAudioElement)                               \
     V(HTMLMEDIAELEMENT, HTMLMediaElement)                               \
     V(HTMLSOURCEELEMENT, HTMLSourceElement)                             \
@@ -88,6 +89,14 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #define APPLICATIONCACHE_NONNODE_WRAPPER_TYPES(V)
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+#define NOTIFICATIONS_NONNODE_WRAPPER_TYPES(V)                          \
+    V(NOTIFICATION, Notification)                                       \
+    V(NOTIFICATIONCENTER, NotificationCenter)
+#else
+#define NOTIFICATIONS_NONNODE_WRAPPER_TYPES(V)
+#endif
+
 #if ENABLE(SHARED_WORKERS)
 #define SHARED_WORKER_ACTIVE_OBJECT_WRAPPER_TYPES(V)                    \
     V(SHAREDWORKER, SharedWorker)
@@ -109,7 +118,9 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     V(ENTITY, Entity)                                                   \
     V(ENTITYREFERENCE, EntityReference)                                 \
     V(HTMLDOCUMENT, HTMLDocument)                                       \
+    V(IMAGE, HTMLImageElementConstructor)                               \
     V(NODE, Node)                                                       \
+    V(OPTION, HTMLOptionElementConstructor)                             \
     V(NOTATION, Notation)                                               \
     V(PROCESSINGINSTRUCTION, ProcessingInstruction)                     \
     V(TEXT, Text)                                                       \
@@ -216,7 +227,6 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if ENABLE(SVG_FONTS)
 #define SVG_FONTS_ELEMENT_TYPES(V)                                      \
-    V(SVGDEFINITIONSRCELEMENT, SVGDefinitionSrcElement)                 \
     V(SVGFONTFACEELEMENT, SVGFontFaceElement)                           \
     V(SVGFONTFACEFORMATELEMENT, SVGFontFaceFormatElement)               \
     V(SVGFONTFACENAMEELEMENT, SVGFontFaceNameElement)                   \
@@ -289,13 +299,21 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #endif  // SVG
 
 
+#if ENABLE(WEB_SOCKETS)
+#define WEBSOCKET_ACTIVE_OBJECT_WRAPPER_TYPES(V)                        \
+    V(WEBSOCKET, WebSocket)
+#else
+#define WEBSOCKET_ACTIVE_OBJECT_WRAPPER_TYPES(V)
+#endif
+
 // ACTIVE_DOM_OBJECT_TYPES are DOM_OBJECT_TYPES that need special treatement
 // during GC.
 #define ACTIVE_DOM_OBJECT_TYPES(V)                                      \
     V(MESSAGEPORT, MessagePort)                                         \
     V(XMLHTTPREQUEST, XMLHttpRequest)                                   \
     WORKER_ACTIVE_OBJECT_WRAPPER_TYPES(V)                               \
-    SHARED_WORKER_ACTIVE_OBJECT_WRAPPER_TYPES(V)
+    SHARED_WORKER_ACTIVE_OBJECT_WRAPPER_TYPES(V)                        \
+    WEBSOCKET_ACTIVE_OBJECT_WRAPPER_TYPES(V)
 
 // NOTE: DOM_OBJECT_TYPES is split into two halves because
 //       Visual Studio's Intellinonsense crashes when macros get
@@ -303,8 +321,10 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 // DOM_OBJECT_TYPES are non-node DOM types.
 #define DOM_OBJECT_TYPES_1(V)                                           \
     V(BARINFO, BarInfo)                                                 \
+    V(BEFORELOADEVENT, BeforeLoadEvent)                                 \
     V(CANVASGRADIENT, CanvasGradient)                                   \
     V(CANVASPATTERN, CanvasPattern)                                     \
+    V(CANVASRENDERINGCONTEXT, CanvasRenderingContext)                   \
     V(CANVASRENDERINGCONTEXT2D, CanvasRenderingContext2D)               \
     V(CLIENTRECT, ClientRect)                                           \
     V(CLIENTRECTLIST, ClientRectList)                                   \
@@ -359,6 +379,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     V(NODEITERATOR, NodeIterator)                                       \
     V(NODELIST, NodeList)                                               \
     V(OVERFLOWEVENT, OverflowEvent)                                     \
+    V(PAGETRANSITIONEVENT, PageTransitionEvent)                         \
     V(PLUGIN, Plugin)                                                   \
     V(PLUGINARRAY, PluginArray)                                         \
     V(PROGRESSEVENT, ProgressEvent)                                     \
@@ -391,6 +412,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     APPLICATIONCACHE_NONNODE_WRAPPER_TYPES(V)                           \
     DATAGRID_NONNODE_TYPES(V)                                           \
     VIDEO_NONNODE_TYPES(V)                                              \
+    NOTIFICATIONS_NONNODE_WRAPPER_TYPES(V)                              \
     SHARED_WORKER_NONNODE_WRAPPER_TYPES(V)                              \
     WORKER_NONNODE_WRAPPER_TYPES(V)
 
@@ -438,16 +460,42 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #define DOM_OBJECT_WORKERS_TYPES(V)
 #endif
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
 #if ENABLE(GEOLOCATION)
 #define DOM_OBJECT_GEOLOCATION_TYPES(V)                                 \
     V(COORDINATES, Coordinates)                                         \
     V(GEOLOCATION, Geolocation)                                         \
     V(GEOPOSITION, Geoposition)                                         \
     V(POSITIONERROR, PositionError)
+=======
+#if ENABLE(3D_CANVAS)
+#define DOM_OBJECT_3D_CANVAS_TYPES(V)                                   \
+    V(CANVASARRAY, CanvasArray)                                         \
+    V(CANVASARRAYBUFFER, CanvasArrayBuffer)                             \
+    V(CANVASBUFFER, CanvasBuffer)                                       \
+    V(CANVASBYTEARRAY, CanvasByteArray)                                 \
+    V(CANVASFLOATARRAY, CanvasFloatArray)                               \
+    V(CANVASFRAMEBUFFER, CanvasFramebuffer)                             \
+    V(CANVASINTARRAY, CanvasIntArray)                                   \
+    V(CANVASPROGRAM, CanvasProgram)                                     \
+    V(CANVASRENDERBUFFER, CanvasRenderbuffer)                           \
+    V(CANVASRENDERINGCONTEXT3D, CanvasRenderingContext3D)               \
+    V(CANVASSHADER, CanvasShader)                                       \
+    V(CANVASSHORTARRAY, CanvasShortArray)                               \
+    V(CANVASTEXTURE, CanvasTexture)                                     \
+    V(CANVASUNSIGNEDBYTEARRAY, CanvasUnsignedByteArray)                 \
+    V(CANVASUNSIGNEDINTARRAY, CanvasUnsignedIntArray)                   \
+    V(CANVASUNSIGNEDSHORTARRAY, CanvasUnsignedShortArray)
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Index.h
 #else
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
 #define DOM_OBJECT_GEOLOCATION_TYPES(V)
+=======
+#define DOM_OBJECT_3D_CANVAS_TYPES(V)
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Index.h
 #endif
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
 #if ENABLE(TOUCH_EVENTS)
 #define DOM_OBJECT_TOUCH_EVENT_TYPES(V)                                 \
     V(TOUCHLIST, TouchList)                                             \
@@ -458,12 +506,15 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #endif
 
 #if PLATFORM(CHROMIUM)
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Index.h
 #define DOM_OBJECT_TYPES(V)                                             \
     DOM_OBJECT_TYPES_1(V)                                               \
     DOM_OBJECT_TYPES_2(V)                                               \
     DOM_OBJECT_DATABASE_TYPES(V)                                        \
     DOM_OBJECT_STORAGE_TYPES(V)                                         \
     DOM_OBJECT_WORKERS_TYPES(V)                                         \
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
     DOM_OBJECT_XPATH_TYPES(V)                                           \
     DOM_OBJECT_XSLT_TYPES(V)                                            \
     V(INSPECTORBACKEND, InspectorBackend)
@@ -477,6 +528,9 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     DOM_OBJECT_TOUCH_EVENT_TYPES(V)                                     \
     DOM_OBJECT_WORKERS_TYPES(V)
 #endif
+=======
+    DOM_OBJECT_3D_CANVAS_TYPES(V)
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Index.h
 
 #if ENABLE(SVG)
 // SVG_OBJECT_TYPES are svg non-node, non-pod types.
diff --git a/WebCore/bindings/v8/V8IsolatedWorld.cpp b/WebCore/bindings/v8/V8IsolatedWorld.cpp
index 1457545..d4e4f52 100644
--- a/WebCore/bindings/v8/V8IsolatedWorld.cpp
+++ b/WebCore/bindings/v8/V8IsolatedWorld.cpp
@@ -43,34 +43,29 @@
 
 namespace WebCore {
 
-static int isolatedWorldCount = 0;
+int V8IsolatedWorld::isolatedWorldCount = 0;
 
-static void contextWeakReferenceCallback(v8::Persistent<v8::Value> object, void* isolated_world)
+void V8IsolatedWorld::contextWeakReferenceCallback(v8::Persistent<v8::Value> object, void* isolated_world)
 {
     // Our context is going away.  Time to clean up the world.
     V8IsolatedWorld* world = static_cast<V8IsolatedWorld*>(isolated_world);
     delete world;
 }
 
-void V8IsolatedWorld::evaluate(const Vector<ScriptSourceCode>& sources, V8Proxy* proxy, int extensionGroup)
+V8IsolatedWorld::V8IsolatedWorld(V8Proxy* proxy, int extensionGroup)
 {
+    ++isolatedWorldCount;
+
     v8::HandleScope scope;
-    v8::Persistent<v8::Context> context = proxy->createNewContext(v8::Handle<v8::Object>(), extensionGroup);
+    m_context = SharedPersistent<v8::Context>::create(proxy->createNewContext(v8::Handle<v8::Object>(), extensionGroup));
 
     // Run code in the new context.
-    v8::Context::Scope context_scope(context);
-
-    // The lifetime of this object is controlled by the V8 GC.
-    // We need to create the world before touching DOM wrappers.
-    V8IsolatedWorld* world = new V8IsolatedWorld(context);
+    v8::Context::Scope context_scope(m_context->get());
 
-    V8Proxy::installHiddenObjectPrototype(context);
-    proxy->installDOMWindow(context, proxy->frame()->domWindow());
-
-    proxy->frame()->loader()->client()->didCreateIsolatedScriptContext();
+    m_context->get()->Global()->SetHiddenValue(V8HiddenPropertyName::isolatedWorld(), v8::External::Wrap(this));
 
-    for (size_t i = 0; i < sources.size(); ++i)
-        proxy->evaluate(sources[i], 0);
+    V8Proxy::installHiddenObjectPrototype(m_context->get());
+    proxy->installDOMWindow(m_context->get(), proxy->frame()->domWindow());
 
     // Using the default security token means that the canAccess is always
     // called, which is slow.
@@ -78,40 +73,24 @@ void V8IsolatedWorld::evaluate(const Vector<ScriptSourceCode>& sources, V8Proxy*
     //        created contexts so that they can all be updated when the
     //        document domain
     //        changes.
-    // FIXME: Move this statement above proxy->evaluate?  It seems like we
-    //        should set up the token before running the script.
-    context->UseDefaultSecurityToken();
+    m_context->get()->UseDefaultSecurityToken();
 
-    context.Dispose();
-    // WARNING!  This might well delete |world|.
+    proxy->frame()->loader()->client()->didCreateIsolatedScriptContext();
 }
 
-V8IsolatedWorld::V8IsolatedWorld(v8::Handle<v8::Context> context)
-    : m_context(v8::Persistent<v8::Context>::New(context))
+void V8IsolatedWorld::destroy()
 {
-    ++isolatedWorldCount;
-    m_context.MakeWeak(this, &contextWeakReferenceCallback);
-    m_context->Global()->SetHiddenValue(V8HiddenPropertyName::isolatedWorld(), v8::External::Wrap(this));
+    m_context->get().MakeWeak(this, &contextWeakReferenceCallback);
 }
 
 V8IsolatedWorld::~V8IsolatedWorld()
 {
     --isolatedWorldCount;
-    m_context.Dispose();
-    m_context.Clear();
+    m_context->disposeHandle();
 }
 
-V8IsolatedWorld* V8IsolatedWorld::getEntered()
+V8IsolatedWorld* V8IsolatedWorld::getEnteredImpl()
 {
-    if (isolatedWorldCount == 0) {
-        // This is a temporary performance optimization.   Essentially,
-        // GetHiddenValue is too slow for this code path.  We need to get the
-        // V8 team to add a real property to v8::Context for isolated worlds.
-        // Until then, we optimize the common case of not having any isolated
-        // worlds at all.
-        return 0;
-    }
-
     if (!v8::Context::InContext())
         return 0;
     v8::HandleScope scope;
diff --git a/WebCore/bindings/v8/V8IsolatedWorld.h b/WebCore/bindings/v8/V8IsolatedWorld.h
index 2036e65..15d8711 100644
--- a/WebCore/bindings/v8/V8IsolatedWorld.h
+++ b/WebCore/bindings/v8/V8IsolatedWorld.h
@@ -35,6 +35,7 @@
 
 #include "V8DOMMap.h"
 #include "V8Index.h"
+#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "ScriptSourceCode.h"  // for WebCore::ScriptSourceCode
 
@@ -57,11 +58,14 @@ namespace WebCore {
     //
     class V8IsolatedWorld {
     public:
-        ~V8IsolatedWorld();
+        // Creates an isolated world. To destroy it, call destroy().
+        // This will delete the isolated world when the context it owns is GC'd.
+        V8IsolatedWorld(V8Proxy* proxy, int extensionGroup);
 
-        // Evaluate JavaScript in a new isolated world.  The script has access
-        // to the DOM of the document associated with |proxy|.
-        static void evaluate(const Vector<ScriptSourceCode>& sources, V8Proxy* proxy, int extensionGroup);
+        // Call this to destroy the isolated world. It will be deleted sometime
+        // after this call, once all script references to the world's context
+        // have been dropped.
+        void destroy();
 
         // Returns the isolated world associated with
         // v8::Context::GetEntered().  Because worlds are isolated, the entire
@@ -71,26 +75,42 @@ namespace WebCore {
         // FIXME: Consider edge cases with DOM mutation events that might
         // violate this invariant.
         //
-        static V8IsolatedWorld* getEntered();
+        static V8IsolatedWorld* getEntered()
+        {
+            // This is a temporary performance optimization.   Essentially,
+            // GetHiddenValue is too slow for this code path.  We need to get the
+            // V8 team to add a real property to v8::Context for isolated worlds.
+            // Until then, we optimize the common case of not having any isolated
+            // worlds at all.
+            if (!isolatedWorldCount)
+                return 0;
+            return getEnteredImpl();
+        }
 
-        v8::Handle<v8::Context> context() { return m_context; }
+        v8::Handle<v8::Context> context() { return m_context->get(); }
+        PassRefPtr<SharedPersistent<v8::Context> > shared_context() { return m_context; }
 
         DOMDataStore* getDOMDataStore() const { return m_domDataStore.getStore(); }
 
     private:
-        // The lifetime of an isolated world is managed by the V8 garbage
-        // collector.  In particular, the object created by this constructor is
-        // freed when |context| is garbage collected.
-        explicit V8IsolatedWorld(v8::Handle<v8::Context> context);
+        ~V8IsolatedWorld();
+
+        static V8IsolatedWorld* getEnteredImpl();
+
+        // Called by the garbage collector when our JavaScript context is about
+        // to be destroyed.
+        static void contextWeakReferenceCallback(v8::Persistent<v8::Value> object, void* isolated_world);
 
         // The v8::Context for the isolated world.  This object is keep on the
         // heap as long as |m_context| has not been garbage collected.
-        v8::Persistent<v8::Context> m_context;
+        RefPtr<SharedPersistent<v8::Context> > m_context;
 
         // The backing store for the isolated world's DOM wrappers.  This class
         // doesn't have visibility into the wrappers.  This handle simply helps
         // manage their lifetime.
         DOMDataStoreHandle m_domDataStore;
+
+        static int isolatedWorldCount;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8LazyEventListener.cpp b/WebCore/bindings/v8/V8LazyEventListener.cpp
index 59fa7be..9b58571 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -33,199 +33,115 @@
 
 #include "Frame.h"
 #include "V8Binding.h"
+#include "V8HiddenPropertyName.h"
 #include "V8Proxy.h"
 
+#include <wtf/StdLibExtras.h>
+
 namespace WebCore {
 
-V8LazyEventListener::V8LazyEventListener(Frame *frame, const String& code, const String& functionName, bool isSVGEvent)
-    : V8AbstractEventListener(frame, true)
+V8LazyEventListener::V8LazyEventListener(Frame* frame, const String& code, const String& functionName, bool isSVGEvent)
+    : V8AbstractEventListener(frame, 0, true)
     , m_code(code)
     , m_functionName(functionName)
     , m_isSVGEvent(isSVGEvent)
-    , m_compiled(false)
-    , m_wrappedFunctionCompiled(false)
-{
-}
-
-V8LazyEventListener::~V8LazyEventListener()
 {
-    disposeListenerObject();
-
-    // Dispose wrapped function
-    if (!m_wrappedFunction.IsEmpty()) {
-#ifndef NDEBUG
-        V8GCController::unregisterGlobalHandle(this, m_wrappedFunction);
-#endif
-        m_wrappedFunction.Dispose();
-        m_wrappedFunction.Clear();
-    }
 }
 
-v8::Local<v8::Function> V8LazyEventListener::getListenerFunction()
+v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event)
 {
-    if (m_compiled) {
-        ASSERT(m_listener.IsEmpty() || m_listener->IsFunction());
-        return m_listener.IsEmpty() ? v8::Local<v8::Function>() : v8::Local<v8::Function>::New(v8::Persistent<v8::Function>::Cast(m_listener));
-    }
-
-    m_compiled = true;
-
-    ASSERT(m_frame);
-
-    {
-        // Switch to the context of m_frame.
-        v8::HandleScope handleScope;
-
-        // Use the outer scope to hold context.
-        v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(m_frame);
-        // Bail out if we could not get the context.
-        if (v8Context.IsEmpty())
-            return v8::Local<v8::Function>();
-
-        v8::Context::Scope scope(v8Context);
-
-        // Wrap function around the event code.  The parenthesis around the function are needed so that evaluating the code yields
-        // the function value.  Without the parenthesis the function value is thrown away.
-
-        // Make it an anonymous function to avoid name conflict for cases like
-        // <body onload='onload()'>
-        // <script> function onload() { alert('hi'); } </script>.
-        // Set function name to function object instead.
-        // See issue 944690.
-        //
-        // The ECMAScript spec says (very obliquely) that the parameter to an event handler is named "evt".
-        //
-        // Don't use new lines so that lines in the modified handler
-        // have the same numbers as in the original code.
-        String code = "(function (evt) {";
-        code.append(m_code);
-        code.append("\n})");
-
-        v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
-        v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_frame->document()->url(), m_lineNumber - 1);
-        if (!script.IsEmpty()) {
-            V8Proxy* proxy = V8Proxy::retrieve(m_frame);
-            ASSERT(proxy);
-            v8::Local<v8::Value> value = proxy->runScript(script, false);
-            if (!value.IsEmpty()) {
-                ASSERT(value->IsFunction());
-                v8::Local<v8::Function> listenerFunction = v8::Local<v8::Function>::Cast(value);
-                listenerFunction->SetName(v8::String::New(fromWebCoreString(m_functionName), m_functionName.length()));
-
-                m_listener = v8::Persistent<v8::Function>::New(listenerFunction);
-#ifndef NDEBUG
-                V8GCController::registerGlobalHandle(EVENT_LISTENER, this, m_listener);
-#endif
-            }
-        }
-    }
-
-    ASSERT(m_listener.IsEmpty() || m_listener->IsFunction());
-    return m_listener.IsEmpty() ? v8::Local<v8::Function>() : v8::Local<v8::Function>::New(v8::Persistent<v8::Function>::Cast(m_listener));
-}
-
-v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event, bool isWindowEvent)
-{
-    v8::Local<v8::Function> handlerFunction = getWrappedListenerFunction();
-    v8::Local<v8::Object> receiver = getReceiverObject(event, isWindowEvent);
+    v8::Local<v8::Function> handlerFunction = v8::Local<v8::Function>::Cast(getListenerObject());
+    v8::Local<v8::Object> receiver = getReceiverObject(event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
 
-    V8Proxy* proxy = V8Proxy::retrieve(m_frame);
+    V8Proxy* proxy = V8Proxy::retrieve(frame());
     return proxy->callFunction(handlerFunction, receiver, 1, parameters);
 }
 
-
 static v8::Handle<v8::Value> V8LazyEventListenerToString(const v8::Arguments& args)
 {
-    return args.Callee()->GetHiddenValue(v8::String::New("toStringString"));
+    return args.Holder()->GetHiddenValue(V8HiddenPropertyName::toStringString());
 }
 
-
-v8::Local<v8::Function> V8LazyEventListener::getWrappedListenerFunction()
+void V8LazyEventListener::prepareListenerObject()
 {
-    if (m_wrappedFunctionCompiled) {
-        ASSERT(m_wrappedFunction.IsEmpty() || m_wrappedFunction->IsFunction());
-        return m_wrappedFunction.IsEmpty() ? v8::Local<v8::Function>() : v8::Local<v8::Function>::New(m_wrappedFunction);
-    }
-
-    m_wrappedFunctionCompiled = true;
-
-    {
-        // Switch to the context of m_frame.
-        v8::HandleScope handleScope;
-
-        // Use the outer scope to hold context.
-        v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(m_frame);
-        // Bail out if we cannot get the context.
-        if (v8Context.IsEmpty())
-            return v8::Local<v8::Function>();
-
-        v8::Context::Scope scope(v8Context);
-
-        // FIXME: cache the wrapper function.
-
-        // Nodes other than the document object, when executing inline event handlers push document, form, and the target node on the scope chain.
-        // We do this by using 'with' statement.
-        // See chrome/fast/forms/form-action.html
-        //     chrome/fast/forms/selected-index-value.html
-        //     base/fast/overflow/onscroll-layer-self-destruct.html
-        //
-        // Don't use new lines so that lines in the modified handler
-        // have the same numbers as in the original code.
-        String code = "(function (evt) {" \
-                      "with (this.ownerDocument ? this.ownerDocument : {}) {" \
-                      "with (this.form ? this.form : {}) {" \
-                      "with (this) {" \
-                      "return (function(evt){";
-        code.append(m_code);
-        // Insert '\n' otherwise //-style comments could break the handler.
-        code.append(  "\n}).call(this, evt);}}}})");
-        v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
-        v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_frame->document()->url(), m_lineNumber);
-        if (!script.IsEmpty()) {
-            V8Proxy* proxy = V8Proxy::retrieve(m_frame);
-            ASSERT(proxy);
-            v8::Local<v8::Value> value = proxy->runScript(script, false);
-            if (!value.IsEmpty()) {
-                ASSERT(value->IsFunction());
-
-                m_wrappedFunction = v8::Persistent<v8::Function>::New(v8::Local<v8::Function>::Cast(value));
-
-                // Change the toString function on the wrapper function to avoid it returning the source for the actual wrapper function. Instead
-                // it returns source for a clean wrapper function with the event argument wrapping the event source code. The reason for this
-                // is that some web sites uses toString on event functions and the evals the source returned (some times a RegExp is applied as
-                // well) for some other use. That fails miserably if the actual wrapper source is returned.
-                v8::Local<v8::FunctionTemplate> toStringTemplate = v8::FunctionTemplate::New(V8LazyEventListenerToString);
-                v8::Local<v8::Function> toStringFunction;
-                if (!toStringTemplate.IsEmpty())
-                    toStringFunction = toStringTemplate->GetFunction();
-                if (!toStringFunction.IsEmpty()) {
-                    String toStringResult = "function ";
-                    toStringResult.append(m_functionName);
-                    toStringResult.append("(");
-                    if (m_isSVGEvent)
-                        toStringResult.append("evt");
-                    else
-                        toStringResult.append("event");
-                    toStringResult.append(") {\n  ");
-                    toStringResult.append(m_code);
-                    toStringResult.append("\n}");
-                    toStringFunction->SetHiddenValue(v8::String::New("toStringString"), v8ExternalString(toStringResult));
-                    m_wrappedFunction->Set(v8::String::New("toString"), toStringFunction);
-                }
-
-#ifndef NDEBUG
-                V8GCController::registerGlobalHandle(EVENT_LISTENER, this, m_wrappedFunction);
-#endif
-                m_wrappedFunction->SetName(v8::String::New(fromWebCoreString(m_functionName), m_functionName.length()));
+    if (hasExistingListenerObject())
+        return;
+
+    // Switch to the context of m_frame.
+    v8::HandleScope handleScope;
+
+    // Use the outer scope to hold context.
+    v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(frame());
+    // Bail out if we cannot get the context.
+    if (v8Context.IsEmpty())
+        return;
+
+    v8::Context::Scope scope(v8Context);
+
+    // FIXME: cache the wrapper function.
+
+    // Nodes other than the document object, when executing inline event handlers push document, form, and the target node on the scope chain.
+    // We do this by using 'with' statement.
+    // See chrome/fast/forms/form-action.html
+    //     chrome/fast/forms/selected-index-value.html
+    //     base/fast/overflow/onscroll-layer-self-destruct.html
+    //
+    // Don't use new lines so that lines in the modified handler
+    // have the same numbers as in the original code.
+    String code = "(function (evt) {" \
+            "with (this.ownerDocument ? this.ownerDocument : {}) {" \
+            "with (this.form ? this.form : {}) {" \
+            "with (this) {" \
+            "return (function(evt){";
+    code.append(m_code);
+    // Insert '\n' otherwise //-style comments could break the handler.
+    code.append(  "\n}).call(this, evt);}}}})");
+    v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
+    v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, frame()->document()->url(), lineNumber());
+    if (!script.IsEmpty()) {
+        V8Proxy* proxy = V8Proxy::retrieve(frame());
+        ASSERT(proxy);
+        v8::Local<v8::Value> value = proxy->runScript(script, false);
+        if (!value.IsEmpty()) {
+            ASSERT(value->IsFunction());
+
+            v8::Local<v8::Function> wrappedFunction = v8::Local<v8::Function>::Cast(value);
+
+            // Change the toString function on the wrapper function to avoid it
+            // returning the source for the actual wrapper function. Instead it
+            // returns source for a clean wrapper function with the event
+            // argument wrapping the event source code. The reason for this is
+            // that some web sites use toString on event functions and eval the
+            // source returned (sometimes a RegExp is applied as well) for some
+            // other use. That fails miserably if the actual wrapper source is
+            // returned.
+            DEFINE_STATIC_LOCAL(v8::Persistent<v8::FunctionTemplate>, toStringTemplate, ());
+            if (toStringTemplate.IsEmpty())
+                toStringTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8LazyEventListenerToString));
+            v8::Local<v8::Function> toStringFunction;
+            if (!toStringTemplate.IsEmpty())
+                toStringFunction = toStringTemplate->GetFunction();
+            if (!toStringFunction.IsEmpty()) {
+                String toStringResult = "function ";
+                toStringResult.append(m_functionName);
+                toStringResult.append("(");
+                toStringResult.append(m_isSVGEvent ? "evt" : "event");
+                toStringResult.append(") {\n  ");
+                toStringResult.append(m_code);
+                toStringResult.append("\n}");
+                wrappedFunction->SetHiddenValue(V8HiddenPropertyName::toStringString(), v8ExternalString(toStringResult));
+                wrappedFunction->Set(v8::String::New("toString"), toStringFunction);
             }
+
+            wrappedFunction->SetName(v8::String::New(fromWebCoreString(m_functionName), m_functionName.length()));
+
+            setListenerObject(wrappedFunction);
         }
     }
-
-    return v8::Local<v8::Function>::New(m_wrappedFunction);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8LazyEventListener.h b/WebCore/bindings/v8/V8LazyEventListener.h
index 62d9342..ba460e6 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.h
+++ b/WebCore/bindings/v8/V8LazyEventListener.h
@@ -50,30 +50,19 @@ namespace WebCore {
             return adoptRef(new V8LazyEventListener(frame, code, functionName, isSVGEvent));
         }
 
-        // For lazy event listener, the listener object is the same as its listener
-        // function without additional scope chains.
-        virtual v8::Local<v8::Object> getListenerObject() { return getWrappedListenerFunction(); }
+        virtual bool isLazy() const { return true; }
+
+    protected:
+        virtual void prepareListenerObject();
 
     private:
         V8LazyEventListener(Frame*, const String& code, const String& functionName, bool isSVGEvent);
-        virtual ~V8LazyEventListener();
 
-        virtual bool virtualisAttribute() const { return true; }
+        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*);
 
         String m_code;
         String m_functionName;
         bool m_isSVGEvent;
-        bool m_compiled;
-
-        // If the event listener is on a non-document dom node, we compile the function with some implicit scope chains before it.
-        bool m_wrappedFunctionCompiled;
-        v8::Persistent<v8::Function> m_wrappedFunction;
-
-        v8::Local<v8::Function> getWrappedListenerFunction();
-
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*, bool isWindowEvent);
-
-        v8::Local<v8::Function> getListenerFunction();
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8ObjectEventListener.cpp b/WebCore/bindings/v8/V8ObjectEventListener.cpp
deleted file mode 100644
index f10766c..0000000
--- a/WebCore/bindings/v8/V8ObjectEventListener.cpp
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "V8ObjectEventListener.h"
-
-#include "Frame.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-static void weakObjectEventListenerCallback(v8::Persistent<v8::Value>, void* parameter)
-{
-    V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(parameter);
-
-    // Remove the wrapper
-    Frame* frame = listener->frame();
-    if (frame) {
-        V8Proxy* proxy = V8Proxy::retrieve(frame);
-        if (proxy)
-            proxy->objectListeners()->remove(listener);
-
-        // Because the listener is no longer in the list, it must be disconnected from the frame to avoid dangling frame pointer
-        // in the destructor.
-        listener->disconnectFrame();
-    }
-    listener->disposeListenerObject();
-}
-
-// An object event listener wrapper only holds a weak reference to the
-// JS function. A strong reference can create a cycle.
-//
-// The lifetime of these objects is bounded by the life time of the JS
-// wrapper of XHR or Node. So we can create a hidden reference from
-// the JS wrapper to to its JS function.
-//
-//                          (map)
-//          XHR or Node  <----------  JS_wrapper
-//               |             (hidden) :  ^
-//               V                      V  : (may be reachable by closure)
-//           V8_listener  --------> JS_function
-//                         (weak)  <-- may create a cycle if it is strong
-//
-// The persistent reference is made weak in the constructor of
-// V8ObjectEventListener.
-
-V8ObjectEventListener::V8ObjectEventListener(Frame* frame, v8::Local<v8::Object> listener, bool isInline)
-    : V8EventListener(frame, listener, isInline)
-{
-    m_listener.MakeWeak(this, weakObjectEventListenerCallback);
-}
-
-V8ObjectEventListener::~V8ObjectEventListener()
-{
-    if (m_frame) {
-        ASSERT(!m_listener.IsEmpty());
-        V8Proxy* proxy = V8Proxy::retrieve(m_frame);
-        if (proxy)
-            proxy->objectListeners()->remove(this);
-    }
-
-    disposeListenerObject();
-}
-
-} // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Proxy.cpp b/WebCore/bindings/v8/V8Proxy.cpp
index 1cfafb8..5e0c8b6 100644
--- a/WebCore/bindings/v8/V8Proxy.cpp
+++ b/WebCore/bindings/v8/V8Proxy.cpp
@@ -32,11 +32,18 @@
 #include "V8Proxy.h"
 
 #include "CSSMutableStyleDeclaration.h"
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
 #include "CString.h"
+=======
+#include "DateExtension.h"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.cpp
 #include "DOMObjectsInclude.h"
 #include "DocumentLoader.h"
 #include "FrameLoaderClient.h"
+#include "Page.h"
+#include "PageGroup.h"
 #include "ScriptController.h"
+#include "StorageNamespace.h"
 #include "V8Binding.h"
 #include "V8Collection.h"
 #include "V8ConsoleMessage.h"
@@ -67,7 +74,7 @@ namespace WebCore {
 v8::Persistent<v8::Context> V8Proxy::m_utilityContext;
 
 // Static list of registered extensions
-V8ExtensionList V8Proxy::m_extensions;
+V8Extensions V8Proxy::m_extensions;
 
 const char* V8Proxy::kContextDebugDataType = "type";
 const char* V8Proxy::kContextDebugDataValue = "value";
@@ -213,6 +220,14 @@ static void reportFatalErrorInV8(const char* location, const char* message)
     handleFatalErrorInV8();
 }
 
+V8Proxy::V8Proxy(Frame* frame)
+    : m_frame(frame),
+      m_context(SharedPersistent<v8::Context>::create()),
+      m_listenerGuard(V8ListenerGuard::create()),
+      m_inlineCode(false),
+      m_timerCallback(false),
+      m_recursion(0) { }
+
 V8Proxy::~V8Proxy()
 {
     clearForClose();
@@ -230,22 +245,6 @@ void V8Proxy::destroyGlobal()
     }
 }
 
-static void disconnectEventListenersInList(V8EventListenerList& list)
-{
-    V8EventListenerList::iterator it = list.begin();
-    while (it != list.end()) {
-        (*it)->disconnectFrame();
-        ++it;
-    }
-    list.clear();
-}
-
-void V8Proxy::disconnectEventListeners()
-{
-    disconnectEventListenersInList(m_eventListeners);
-    disconnectEventListenersInList(m_objectListeners);
-}
-
 v8::Handle<v8::Script> V8Proxy::compileScript(v8::Handle<v8::String> code, const String& fileName, int baseLine)
 #ifdef ANDROID_INSTRUMENT
 {
@@ -296,10 +295,32 @@ bool V8Proxy::handleOutOfMemory()
     return true;
 }
 
-void V8Proxy::evaluateInNewWorld(const Vector<ScriptSourceCode>& sources, int extensionGroup)
+void V8Proxy::evaluateInIsolatedWorld(int worldID, const Vector<ScriptSourceCode>& sources, int extensionGroup)
 {
     initContextIfNeeded();
-    V8IsolatedWorld::evaluate(sources, this, extensionGroup);
+
+    v8::HandleScope handleScope;
+    V8IsolatedWorld* world = 0;
+
+    if (worldID > 0) {
+        IsolatedWorldMap::iterator iter = m_isolatedWorlds.find(worldID);
+        if (iter != m_isolatedWorlds.end()) {
+            world = iter->second;
+        } else {
+            world = new V8IsolatedWorld(this, extensionGroup);
+            m_isolatedWorlds.set(worldID, world);
+        }
+    } else {
+        world = new V8IsolatedWorld(this, extensionGroup);
+    }
+
+    v8::Local<v8::Context> context = v8::Local<v8::Context>::New(world->context());
+    v8::Context::Scope context_scope(context);
+    for (size_t i = 0; i < sources.size(); ++i)
+      evaluate(sources[i], 0);
+
+    if (worldID == 0)
+      world->destroy();
 }
 
 void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int extensionGroup)
@@ -309,7 +330,7 @@ void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int
     v8::HandleScope handleScope;
 
     // Set up the DOM window as the prototype of the new global object.
-    v8::Handle<v8::Context> windowContext = m_context;
+    v8::Handle<v8::Context> windowContext = context();
     v8::Handle<v8::Object> windowGlobal = windowContext->Global();
     v8::Handle<v8::Object> windowWrapper = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, windowGlobal);
 
@@ -357,6 +378,7 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
     ASSERT(v8::Context::InContext());
     LOCK_V8;
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     // Compile the script.
     v8::Local<v8::String> code = v8ExternalString(source.source());
 #if PLATFORM(CHROMIUM)
@@ -372,14 +394,27 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
     ChromiumBridge::traceEventEnd("v8.compile", node, "");
     ChromiumBridge::traceEventBegin("v8.run", node, "");
 #endif
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.cpp
     v8::Local<v8::Value> result;
     {
-        // Isolate exceptions that occur when executing the code. These
-        // exceptions should not interfere with javascript code we might
-        // evaluate from C++ when returning from here.
+        // Isolate exceptions that occur when compiling and executing
+        // the code. These exceptions should not interfere with
+        // javascript code we might evaluate from C++ when returning
+        // from here.
         v8::TryCatch tryCatch;
         tryCatch.SetVerbose(true);
 
+        // Compile the script.
+        v8::Local<v8::String> code = v8ExternalString(source.source());
+        ChromiumBridge::traceEventBegin("v8.compile", node, "");
+
+        // NOTE: For compatibility with WebCore, ScriptSourceCode's line starts at
+        // 1, whereas v8 starts at 0.
+        v8::Handle<v8::Script> script = compileScript(code, source.url(), source.startLine() - 1);
+        ChromiumBridge::traceEventEnd("v8.compile", node, "");
+
+        ChromiumBridge::traceEventBegin("v8.run", node, "");
         // Set inlineCode to true for <a href="javascript:doSomething()">
         // and false for <script>doSomething</script>. We make a rough guess at
         // this based on whether the script source has a URL.
@@ -431,15 +466,18 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
     v8::Local<v8::Value> result;
     {
         V8ConsoleMessage::Scope scope;
-        m_recursion++;
 
         // See comment in V8Proxy::callFunction.
         m_frame->keepAlive();
 
+        m_recursion++;
         result = script->Run();
         m_recursion--;
     }
 
+    // Release the storage mutex if applicable.
+    releaseStorageMutex();
+
     if (handleOutOfMemory())
         ASSERT(result.IsEmpty());
 
@@ -458,6 +496,7 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
 
 v8::Local<v8::Value> V8Proxy::callFunction(v8::Handle<v8::Function> function, v8::Handle<v8::Object> receiver, int argc, v8::Handle<v8::Value> args[])
 {
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::JavaScriptExecuteTimeCounter);
 #endif
@@ -465,10 +504,23 @@ v8::Local<v8::Value> V8Proxy::callFunction(v8::Handle<v8::Function> function, v8
     // For now, we don't put any artificial limitations on the depth
     // of recursion that stems from calling functions. This is in
     // contrast to the script evaluations.
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.cpp
     v8::Local<v8::Value> result;
     {
         V8ConsoleMessage::Scope scope;
 
+        if (m_recursion >= kMaxRecursionDepth) {
+            v8::Local<v8::String> code = v8::String::New("throw new RangeError('Maximum call stack size exceeded.')");
+            if (code.IsEmpty())
+                return result;
+            v8::Local<v8::Script> script = v8::Script::Compile(code);
+            if (script.IsEmpty())
+                return result;
+            script->Run();
+            return result;
+        }
+
         // Evaluating the JavaScript could cause the frame to be deallocated,
         // so we start the keep alive timer here.
         // Frame::keepAlive method adds the ref count of the frame and sets a
@@ -476,9 +528,14 @@ v8::Local<v8::Value> V8Proxy::callFunction(v8::Handle<v8::Function> function, v8
         // execution finishs before firing the timer.
         m_frame->keepAlive();
 
+        m_recursion++;
         result = function->Call(receiver, argc, args);
+        m_recursion--;
     }
 
+    // Release the storage mutex if applicable.
+    releaseStorageMutex();
+
     if (v8::V8::IsDead())
         handleFatalErrorInV8();
 
@@ -508,17 +565,13 @@ v8::Local<v8::Value> V8Proxy::newInstance(v8::Handle<v8::Function> constructor,
     return result;
 }
 
-v8::Local<v8::Object> V8Proxy::createWrapperFromCache(V8ClassIndex::V8WrapperType type)
+v8::Local<v8::Object> V8Proxy::createWrapperFromCacheSlowCase(V8ClassIndex::V8WrapperType type)
 {
-    int classIndex = V8ClassIndex::ToInt(type);
-    v8::Local<v8::Object> clone(m_wrapperBoilerplates->CloneElementAt(classIndex));
-    if (!clone.IsEmpty())
-        return clone;
-
     // Not in cache.
+    int classIndex = V8ClassIndex::ToInt(type);
     initContextIfNeeded();
-    v8::Context::Scope scope(m_context);
-    v8::Local<v8::Function> function = V8DOMWrapper::getConstructor(type, getHiddenObjectPrototype(m_context));
+    v8::Context::Scope scope(context());
+    v8::Local<v8::Function> function = V8DOMWrapper::getConstructor(type, getHiddenObjectPrototype(context()));
     v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
     if (!instance.IsEmpty()) {
         m_wrapperBoilerplates->Set(v8::Integer::New(classIndex), instance);
@@ -531,9 +584,9 @@ bool V8Proxy::isContextInitialized()
 {
     // m_context, m_global, and m_wrapperBoilerplates should
     // all be non-empty if if m_context is non-empty.
-    ASSERT(m_context.IsEmpty() || !m_global.IsEmpty());
-    ASSERT(m_context.IsEmpty() || !m_wrapperBoilerplates.IsEmpty());
-    return !m_context.IsEmpty();
+    ASSERT(context().IsEmpty() || !m_global.IsEmpty());
+    ASSERT(context().IsEmpty() || !m_wrapperBoilerplates.IsEmpty());
+    return !context().IsEmpty();
 }
 
 DOMWindow* V8Proxy::retrieveWindow(v8::Handle<v8::Context> context)
@@ -547,7 +600,14 @@ DOMWindow* V8Proxy::retrieveWindow(v8::Handle<v8::Context> context)
 
 Frame* V8Proxy::retrieveFrame(v8::Handle<v8::Context> context)
 {
-    return retrieveWindow(context)->frame();
+    DOMWindow* window = retrieveWindow(context);
+    Frame* frame = window->frame();
+    if (frame && frame->domWindow() == window)
+        return frame;
+    // We return 0 here because |context| is detached from the Frame.  If we
+    // did return |frame| we could get in trouble because the frame could be
+    // navigated to another security origin.
+    return 0;
 }
 
 Frame* V8Proxy::retrieveFrameForEnteredContext()
@@ -701,21 +761,20 @@ void V8Proxy::updateDocumentWrapperCache()
         clearDocumentWrapperCache();
         return;
     }
-    m_context->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete));
+    context()->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete));
 }
 
 void V8Proxy::clearDocumentWrapperCache()
 {
-    ASSERT(!m_context.IsEmpty());
-    m_context->Global()->ForceDelete(v8::String::New("document"));
+    ASSERT(!context().IsEmpty());
+    context()->Global()->ForceDelete(v8::String::New("document"));
 }
 
 void V8Proxy::disposeContextHandles()
 {
-    if (!m_context.IsEmpty()) {
+    if (!context().IsEmpty()) {
         m_frame->loader()->client()->didDestroyScriptContextForFrame();
-        m_context.Dispose();
-        m_context.Clear();
+        shared_context()->disposeHandle();
     }
 
     if (!m_wrapperBoilerplates.IsEmpty()) {
@@ -727,10 +786,45 @@ void V8Proxy::disposeContextHandles()
     }
 }
 
+void V8Proxy::releaseStorageMutex()
+{
+    // If we've just left a top level script context and local storage has been
+    // instantiated, we must ensure that any storage locks have been freed.
+    // Per http://dev.w3.org/html5/spec/Overview.html#storage-mutex
+    if (m_recursion != 0)
+        return;
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+    if (page->group().hasLocalStorage())
+        page->group().localStorage()->unlock();
+}
+
+void V8Proxy::disconnectEventListeners()
+{
+    m_listenerGuard->disconnectListeners();
+    m_listenerGuard = V8ListenerGuard::create();
+}
+    
+void V8Proxy::resetIsolatedWorlds()
+{
+    for (IsolatedWorldMap::iterator iter = m_isolatedWorlds.begin();
+         iter != m_isolatedWorlds.end(); ++iter) {
+        iter->second->destroy();
+    }
+    m_isolatedWorlds.clear();
+}
+
 void V8Proxy::clearForClose()
 {
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     if (!m_context.IsEmpty()) {
         LOCK_V8;
+=======
+    resetIsolatedWorlds();
+
+    if (!context().IsEmpty()) {
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.cpp
         v8::HandleScope handleScope;
 
         clearDocumentWrapper();
@@ -741,13 +835,18 @@ void V8Proxy::clearForClose()
 void V8Proxy::clearForNavigation()
 {
     disconnectEventListeners();
+    resetIsolatedWorlds();
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     if (!m_context.IsEmpty()) {
         LOCK_V8;
+=======
+    if (!context().IsEmpty()) {
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.cpp
         v8::HandleScope handle;
         clearDocumentWrapper();
 
-        v8::Context::Scope contextScope(m_context);
+        v8::Context::Scope contextScope(context());
 
         // Clear the document wrapper cache before turning on access checks on
         // the old DOMWindow wrapper. This way, access to the document wrapper
@@ -760,7 +859,7 @@ void V8Proxy::clearForNavigation()
         wrapper->TurnOnAccessCheck();
 
         // Separate the context from its global object.
-        m_context->DetachGlobal();
+        context()->DetachGlobal();
 
         disposeContextHandles();
     }
@@ -771,7 +870,7 @@ void V8Proxy::setSecurityToken()
     Document* document = m_frame->document();
     // Setup security origin and security token.
     if (!document) {
-        m_context->UseDefaultSecurityToken();
+        context()->UseDefaultSecurityToken();
         return;
     }
 
@@ -791,14 +890,14 @@ void V8Proxy::setSecurityToken()
     // case, we use the global object as the security token to avoid
     // calling canAccess when a script accesses its own objects.
     if (token.isEmpty() || token == "null") {
-        m_context->UseDefaultSecurityToken();
+        context()->UseDefaultSecurityToken();
         return;
     }
 
     CString utf8Token = token.utf8();
     // NOTE: V8 does identity comparison in fast path, must use a symbol
     // as the security token.
-    m_context->SetSecurityToken(v8::String::NewSymbol(utf8Token.data(), utf8Token.length()));
+    context()->SetSecurityToken(v8::String::NewSymbol(utf8Token.data(), utf8Token.length()));
 }
 
 void V8Proxy::updateDocument()
@@ -816,6 +915,10 @@ void V8Proxy::updateDocument()
     // global object wrapper succeed.
     initContextIfNeeded();
 
+    // Bail out if context initialization failed.
+    if (context().IsEmpty())
+        return;
+
     // We have a new document and we need to update the cache.
     updateDocumentWrapperCache();
 
@@ -930,21 +1033,26 @@ v8::Persistent<v8::Context> V8Proxy::createNewContext(v8::Handle<v8::Object> glo
 
     // Install a security handler with V8.
     globalTemplate->SetAccessCheckCallbacks(V8Custom::v8DOMWindowNamedSecurityCheck, V8Custom::v8DOMWindowIndexedSecurityCheck, v8::Integer::New(V8ClassIndex::DOMWINDOW));
+    globalTemplate->SetInternalFieldCount(V8Custom::kDOMWindowInternalFieldCount);
+
+    // Used to avoid sleep calls in unload handlers.
+    if (!registeredExtensionWithV8(DateExtension::get()))
+        registerExtension(DateExtension::get(), String());
 
     // Dynamically tell v8 about our extensions now.
     OwnArrayPtr<const char*> extensionNames(new const char*[m_extensions.size()]);
     int index = 0;
-    for (V8ExtensionList::iterator it = m_extensions.begin(); it != m_extensions.end(); ++it) {
-        if (it->group && it->group != extensionGroup)
+    for (size_t i = 0; i < m_extensions.size(); ++i) {
+        if (m_extensions[i].group && m_extensions[i].group != extensionGroup)
             continue;
 
         // Note: we check the loader URL here instead of the document URL
         // because we might be currently loading an URL into a blank page.
         // See http://code.google.com/p/chromium/issues/detail?id=10924
-        if (it->scheme.length() > 0 && (it->scheme != m_frame->loader()->activeDocumentLoader()->url().protocol() || it->scheme != m_frame->page()->mainFrame()->loader()->activeDocumentLoader()->url().protocol()))
+        if (m_extensions[i].scheme.length() > 0 && (m_extensions[i].scheme != m_frame->loader()->activeDocumentLoader()->url().protocol() || m_extensions[i].scheme != m_frame->page()->mainFrame()->loader()->activeDocumentLoader()->url().protocol()))
             continue;
 
-        extensionNames[index++] = it->extension->name();
+        extensionNames[index++] = m_extensions[i].extension->name();
     }
     v8::ExtensionConfiguration extensions(index, extensionNames.get());
     result = v8::Context::New(&extensions, globalTemplate, global);
@@ -967,12 +1075,14 @@ bool V8Proxy::installDOMWindow(v8::Handle<v8::Context> context, DOMWindow* windo
 
     // Wrap the window.
     V8DOMWrapper::setDOMWrapper(jsWindow, V8ClassIndex::ToInt(V8ClassIndex::DOMWINDOW), window);
+    V8DOMWrapper::setDOMWrapper(v8::Handle<v8::Object>::Cast(jsWindow->GetPrototype()), V8ClassIndex::ToInt(V8ClassIndex::DOMWINDOW), window);
 
     window->ref();
     V8DOMWrapper::setJSWrapperForDOMObject(window, v8::Persistent<v8::Object>::New(jsWindow));
 
     // Insert the window instance as the prototype of the shadow object.
     v8::Handle<v8::Object> v8Global = context->Global();
+    V8DOMWrapper::setDOMWrapper(v8::Handle<v8::Object>::Cast(v8Global->GetPrototype()), V8ClassIndex::ToInt(V8ClassIndex::DOMWINDOW), window);
     v8Global->Set(implicitProtoString, jsWindow);
     return true;
 }
@@ -1015,7 +1125,7 @@ bool V8Proxy::installDOMWindow(v8::Handle<v8::Context> context, DOMWindow* windo
 void V8Proxy::initContextIfNeeded()
 {
     // Bail out if the context has already been initialized.
-    if (!m_context.IsEmpty())
+    if (!context().IsEmpty())
         return;
 
 #ifdef ANDROID_INSTRUMENT
@@ -1044,17 +1154,18 @@ void V8Proxy::initContextIfNeeded()
         isV8Initialized = true;
     }
 
-    m_context = createNewContext(m_global, 0);
-    if (m_context.IsEmpty())
+
+    v8::Persistent<v8::Context> context = createNewContext(m_global, 0);
+    if (context.IsEmpty())
         return;
+    m_context->set(context);
+
 
-    // Starting from now, use local context only.
-    v8::Local<v8::Context> v8Context = context();
-    v8::Context::Scope contextScope(v8Context);
+    v8::Context::Scope contextScope(context);
 
     // Store the first global object created so we can reuse it.
     if (m_global.IsEmpty()) {
-        m_global = v8::Persistent<v8::Object>::New(v8Context->Global());
+        m_global = v8::Persistent<v8::Object>::New(context->Global());
         // Bail out if allocation of the first global objects fails.
         if (m_global.IsEmpty()) {
             disposeContextHandles();
@@ -1065,7 +1176,7 @@ void V8Proxy::initContextIfNeeded()
 #endif
     }
 
-    installHiddenObjectPrototype(m_context);
+    installHiddenObjectPrototype(context);
     m_wrapperBoilerplates = v8::Persistent<v8::Array>::New(v8::Array::New(V8ClassIndex::WRAPPER_TYPE_COUNT));
     // Bail out if allocation failed.
     if (m_wrapperBoilerplates.IsEmpty()) {
@@ -1076,7 +1187,7 @@ void V8Proxy::initContextIfNeeded()
     V8GCController::registerGlobalHandle(PROXY, this, m_wrapperBoilerplates);
 #endif
 
-    if (!installDOMWindow(v8Context, m_frame->domWindow()))
+    if (!installDOMWindow(context, m_frame->domWindow()))
         disposeContextHandles();
 
     updateDocument();
@@ -1162,6 +1273,23 @@ v8::Local<v8::Context> V8Proxy::context(Frame* frame)
     return context;
 }
 
+PassRefPtr<SharedPersistent<v8::Context> > V8Proxy::shared_context(Frame* frame)
+{
+    V8Proxy *proxy = V8Proxy::retrieve(frame);
+    if (!proxy)
+        return 0;
+
+    proxy->initContextIfNeeded();
+    RefPtr<SharedPersistent<v8::Context> > context = proxy->shared_context();
+    if (V8IsolatedWorld* world = V8IsolatedWorld::getEntered()) {
+        context = world->shared_context();
+        if (frame != V8Proxy::retrieveFrame(context->get()))
+            return 0;
+    }
+
+    return context;
+}
+
 v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
 {
     V8Proxy* proxy = retrieve(frame);
@@ -1169,7 +1297,7 @@ v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
         return v8::Local<v8::Context>();
 
     proxy->initContextIfNeeded();
-    return proxy->context();
+    return v8::Local<v8::Context>::New(proxy->context());
 }
 
 v8::Local<v8::Context> V8Proxy::currentContext()
@@ -1279,14 +1407,21 @@ String V8Proxy::sourceName()
 #endif
 }
 
-void V8Proxy::registerExtensionWithV8(v8::Extension* extension) {
+void V8Proxy::registerExtensionWithV8(v8::Extension* extension)
+{
     // If the extension exists in our list, it was already registered with V8.
-    for (V8ExtensionList::iterator it = m_extensions.begin(); it != m_extensions.end(); ++it) {
-        if (it->extension == extension)
-            return;
+    if (!registeredExtensionWithV8(extension))
+        v8::RegisterExtension(extension);
+}
+
+bool V8Proxy::registeredExtensionWithV8(v8::Extension* extension)
+{
+    for (size_t i = 0; i < m_extensions.size(); ++i) {
+        if (m_extensions[i].extension == extension)
+            return true;
     }
 
-    v8::RegisterExtension(extension);
+    return false;
 }
 
 void V8Proxy::registerExtension(v8::Extension* extension, const String& schemeRestriction)
@@ -1306,17 +1441,17 @@ void V8Proxy::registerExtension(v8::Extension* extension, int extensionGroup)
 bool V8Proxy::setContextDebugId(int debugId)
 {
     ASSERT(debugId > 0);
-    if (m_context.IsEmpty())
+    if (context().IsEmpty())
         return false;
     v8::HandleScope scope;
-    if (!m_context->GetData()->IsUndefined())
+    if (!context()->GetData()->IsUndefined())
         return false;
 
-    v8::Context::Scope contextScope(m_context);
+    v8::Context::Scope contextScope(context());
     v8::Handle<v8::Object> contextData = v8::Object::New();
     contextData->Set(v8::String::New(kContextDebugDataType), v8::String::New("page"));
     contextData->Set(v8::String::New(kContextDebugDataValue), v8::Integer::New(debugId));
-    m_context->SetData(contextData);
+    context()->SetData(contextData);
     return true;
 }
 
diff --git a/WebCore/bindings/v8/V8Proxy.h b/WebCore/bindings/v8/V8Proxy.h
index d8f546c..c68f6b7 100644
--- a/WebCore/bindings/v8/V8Proxy.h
+++ b/WebCore/bindings/v8/V8Proxy.h
@@ -31,25 +31,30 @@
 #ifndef V8Proxy_h
 #define V8Proxy_h
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.h
 #include "Node.h"
 #include "NodeFilter.h"
 #include "PlatformString.h" // for WebCore::String
+=======
+#include "ChromiumBridge.h"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.h
 #include "ScriptSourceCode.h" // for WebCore::ScriptSourceCode
 #include "SecurityOrigin.h" // for WebCore::SecurityOrigin
-#include "V8CustomBinding.h"
-#include "V8DOMMap.h"
+#include "SharedPersistent.h"
+#include "V8AbstractEventListener.h"
 #include "V8DOMWrapper.h"
-#include "V8EventListenerList.h"
 #include "V8GCController.h"
 #include "V8Index.h"
-#include "V8Utilities.h"
 #include <v8.h>
-#include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h> // so generated bindings don't have to
 #include <wtf/Vector.h>
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.h
 #if defined(ENABLE_DOM_STATS_COUNTERS) && PLATFORM(CHROMIUM)
 #include "ChromiumBridge.h"
+=======
+#ifdef ENABLE_DOM_STATS_COUNTERS
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.h
 #define INC_STATS(name) ChromiumBridge::incrementStatsCounter(name)
 #else
 #define INC_STATS(name)
@@ -57,49 +62,14 @@
 
 namespace WebCore {
 
-    class CSSRule;
-    class CSSRuleList;
-    class CSSStyleDeclaration;
-    class CSSValue;
-    class CSSValueList;
-    class ClientRectList;
-    class DOMImplementation;
     class DOMWindow;
-    class Document;
-    class Element;
-    class Event;
-    class EventListener;
-    class EventTarget;
     class Frame;
-    class HTMLCollection;
-    class HTMLDocument;
-    class HTMLElement;
-    class HTMLOptionsCollection;
-    class MediaList;
-    class MimeType;
-    class MimeTypeArray;
-    class NamedNodeMap;
-    class Navigator;
     class Node;
-    class NodeFilter;
-    class NodeList;
-    class Plugin;
-    class PluginArray;
     class SVGElement;
-#if ENABLE(SVG)
-    class SVGElementInstance;
-#endif
-    class Screen;
     class ScriptExecutionContext;
-#if ENABLE(DOM_STORAGE)
-    class Storage;
-    class StorageEvent;
-#endif
     class String;
-    class StyleSheet;
-    class StyleSheetList;
     class V8EventListener;
-    class V8ObjectEventListener;
+    class V8IsolatedWorld;
 
     // FIXME: use standard logging facilities in WebCore.
     void logInfo(Frame*, const String& message, const String& url);
@@ -145,7 +115,11 @@ namespace WebCore {
         int group;
         v8::Extension* extension;
     };
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.h
     typedef WTF::Vector<V8ExtensionInfo> V8ExtensionList;
+=======
+    typedef WTF::Vector<V8ExtensionInfo> V8Extensions;
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.h
 
     class V8Proxy {
     public:
@@ -158,7 +132,7 @@ namespace WebCore {
             GeneralError
         };
 
-        explicit V8Proxy(Frame* frame) : m_frame(frame), m_inlineCode(false), m_timerCallback(false), m_recursion(0) { }
+        explicit V8Proxy(Frame*);
 
         ~V8Proxy();
 
@@ -196,9 +170,6 @@ namespace WebCore {
 
         bool isEnabled();
 
-        V8EventListenerList* eventListeners() { return &m_eventListeners; }
-        V8EventListenerList* objectListeners() { return &m_objectListeners; }
-
 #if ENABLE(SVG)
         static void setSVGContext(void*, SVGElement*);
         static SVGElement* svgContext(void*);
@@ -211,7 +182,7 @@ namespace WebCore {
         // global scope, its own prototypes for intrinsic JavaScript objects (String,
         // Array, and so-on), and its own wrappers for all DOM nodes and DOM
         // constructors.
-        void evaluateInNewWorld(const Vector<ScriptSourceCode>& sources, int extensionGroup);
+        void evaluateInIsolatedWorld(int worldId, const Vector<ScriptSourceCode>& sources, int extensionGroup);
 
         // Evaluate JavaScript in a new context. The script gets its own global scope
         // and its own prototypes for intrinsic JavaScript objects (String, Array,
@@ -239,7 +210,12 @@ namespace WebCore {
         // To create JS Wrapper objects, we create a cache of a 'boiler plate'
         // object, and then simply Clone that object each time we need a new one.
         // This is faster than going through the full object creation process.
-        v8::Local<v8::Object> createWrapperFromCache(V8ClassIndex::V8WrapperType);
+        v8::Local<v8::Object> createWrapperFromCache(V8ClassIndex::V8WrapperType type)
+        {
+            int classIndex = V8ClassIndex::ToInt(type);
+            v8::Local<v8::Object> clone(m_wrapperBoilerplates->CloneElementAt(classIndex));
+            return clone.IsEmpty() ? createWrapperFromCacheSlowCase(type) : clone;
+        }
 
         // Returns the window object associated with a context.
         static DOMWindow* retrieveWindow(v8::Handle<v8::Context>);
@@ -290,6 +266,7 @@ namespace WebCore {
         // Returns V8 Context of a frame. If none exists, creates
         // a new context. It is potentially slow and consumes memory.
         static v8::Local<v8::Context> context(Frame*);
+        static PassRefPtr<SharedPersistent<v8::Context> > shared_context(Frame*);
         static v8::Local<v8::Context> mainWorldContext(Frame*);
         static v8::Local<v8::Context> currentContext();
 
@@ -334,10 +311,19 @@ namespace WebCore {
         static int sourceLineNumber();
         static String sourceName();
 
-        // Returns a local handle of the context.
-        v8::Local<v8::Context> context()
+        v8::Handle<v8::Context> context()
+        {
+            return m_context->get();
+        }
+
+        PassRefPtr<SharedPersistent<v8::Context> > shared_context()
+        {
+            return m_context;
+        }
+
+        PassRefPtr<V8ListenerGuard> listenerGuard()
         {
-            return v8::Local<v8::Context>::New(m_context);
+            return m_listenerGuard;
         }
 
         bool setContextDebugId(int id);
@@ -368,7 +354,6 @@ namespace WebCore {
         static const char* kContextDebugDataType;
         static const char* kContextDebugDataValue;
 
-        void disconnectEventListeners();
         void setSecurityToken();
         void clearDocumentWrapper();
 
@@ -382,6 +367,14 @@ namespace WebCore {
         // Dispose global handles of m_contexts and friends.
         void disposeContextHandles();
 
+        // If m_recursionCount is 0, let LocalStorage know so we can release
+        // the storage mutex.
+        void releaseStorageMutex();
+
+        void disconnectEventListeners();
+        
+        void resetIsolatedWorlds();
+
         static bool canAccessPrivate(DOMWindow*);
 
         static const char* rangeExceptionName(int exceptionCode);
@@ -407,11 +400,17 @@ namespace WebCore {
             return v8::Local<v8::Context>::New(m_utilityContext);
         }
 
+        v8::Local<v8::Object> createWrapperFromCacheSlowCase(V8ClassIndex::V8WrapperType);
+
         static void registerExtensionWithV8(v8::Extension*);
+        static bool registeredExtensionWithV8(v8::Extension*);
 
         Frame* m_frame;
 
-        v8::Persistent<v8::Context> m_context;
+        RefPtr<SharedPersistent<v8::Context> > m_context;
+
+        RefPtr<V8ListenerGuard> m_listenerGuard;
+
         // For each possible type of wrapper, we keep a boilerplate object.
         // The boilerplate is used to create additional wrappers of the same
         // type.  We keep a single persistent handle to an array of the
@@ -426,14 +425,6 @@ namespace WebCore {
 
         int m_handlerLineNumber;
 
-        // A list of event listeners created for this frame,
-        // the list gets cleared when removing all timeouts.
-        V8EventListenerList m_eventListeners;
-
-        // A list of event listeners create for XMLHttpRequest object for this frame,
-        // the list gets cleared when removing all timeouts.
-        V8EventListenerList m_objectListeners;
-
         // True for <a href="javascript:foo()"> and false for <script>foo()</script>.
         // Only valid during execution.
         bool m_inlineCode;
@@ -447,8 +438,18 @@ namespace WebCore {
         // excessive recursion in the binding layer.
         int m_recursion;
 
-        // List of extensions registered with the context.
-        static V8ExtensionList m_extensions;
+        // All of the extensions registered with the context.
+        static V8Extensions m_extensions;
+
+        // The isolated worlds we are tracking for this frame. We hold them alive
+        // here so that they can be used again by future calls to
+        // evaluateInIsolatedWorld().
+        //
+        // Note: although the pointer is raw, the instance is kept alive by a strong
+        // reference to the v8 context it contains, which is not made weak until we
+        // call world->destroy().
+        typedef HashMap<int, V8IsolatedWorld*> IsolatedWorldMap;
+        IsolatedWorldMap m_isolatedWorlds;
     };
 
     template <int tag, typename T>
diff --git a/WebCore/bindings/v8/V8Utilities.cpp b/WebCore/bindings/v8/V8Utilities.cpp
index c1ac6d4..a66f435 100644
--- a/WebCore/bindings/v8/V8Utilities.cpp
+++ b/WebCore/bindings/v8/V8Utilities.cpp
@@ -33,8 +33,15 @@
 
 #include <v8.h>
 
+#include "Document.h"
+#include "Frame.h"
+#include "ScriptExecutionContext.h"
+#include "ScriptState.h"
 #include "V8CustomBinding.h"
+#include "V8Binding.h"
 #include "V8Proxy.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
 
 #include <wtf/Assertions.h>
 #include "Frame.h"
@@ -43,7 +50,7 @@ namespace WebCore {
 
 // Use an array to hold dependents. It works like a ref-counted scheme.
 // A value can be added more than once to the DOM object.
-void createHiddenDependency(v8::Local<v8::Object> object, v8::Local<v8::Value> value, int cacheIndex)
+void createHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value> value, int cacheIndex)
 {
     v8::Local<v8::Value> cache = object->GetInternalField(cacheIndex);
     if (cache->IsNull() || cache->IsUndefined()) {
@@ -55,7 +62,7 @@ void createHiddenDependency(v8::Local<v8::Object> object, v8::Local<v8::Value> v
     cacheArray->Set(v8::Integer::New(cacheArray->Length()), value);
 }
 
-void removeHiddenDependency(v8::Local<v8::Object> object, v8::Local<v8::Value> value, int cacheIndex)
+void removeHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value> value, int cacheIndex)
 {
     v8::Local<v8::Value> cache = object->GetInternalField(cacheIndex);
     if (!cache->IsArray())
@@ -98,7 +105,46 @@ void navigateIfAllowed(Frame* frame, const KURL& url, bool lockHistory, bool loc
         return;
 
     if (!protocolIsJavaScript(url) || ScriptController::isSafeScript(frame))
-        frame->loader()->scheduleLocationChange(url.string(), callingFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture());
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), callingFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture());
+}
+
+ScriptExecutionContext* getScriptExecutionContext(ScriptState* scriptState)
+{
+#if ENABLE(WORKERS)
+    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
+    if (proxy)
+        return proxy->workerContext()->scriptExecutionContext();
+#endif
+
+    if (scriptState)
+        return scriptState->frame()->document()->scriptExecutionContext();
+    else {
+        Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
+        if (frame)
+            return frame->document()->scriptExecutionContext();
+    }
+
+    return 0;
+}
+
+void reportException(ScriptState* scriptState, v8::TryCatch& exceptionCatcher)
+{
+    String errorMessage;
+    int lineNumber = 0;
+    String sourceURL;
+
+    // There can be a situation that an exception is thrown without setting a message.
+    v8::Local<v8::Message> message = exceptionCatcher.Message();
+    if (message.IsEmpty())
+        errorMessage = toWebCoreString(exceptionCatcher.Exception()->ToString());
+    else {
+        errorMessage = toWebCoreString(message->Get());
+        lineNumber = message->GetLineNumber();
+        sourceURL = toWebCoreString(message->GetScriptResourceName());
+    }
+
+    getScriptExecutionContext(scriptState)->reportException(errorMessage, lineNumber, sourceURL);
+    exceptionCatcher.Reset();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Utilities.h b/WebCore/bindings/v8/V8Utilities.h
index 3e59d34..1a713c9 100644
--- a/WebCore/bindings/v8/V8Utilities.h
+++ b/WebCore/bindings/v8/V8Utilities.h
@@ -44,17 +44,26 @@ namespace WebCore {
 
     class Frame;
     class KURL;
+    class ScriptExecutionContext;
+    class ScriptState;
     class String;
 
     // Use an array to hold dependents. It works like a ref-counted scheme. A value can be added more than once to the DOM object.
-    void createHiddenDependency(v8::Local<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
-    void removeHiddenDependency(v8::Local<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
+    void createHiddenDependency(v8::Handle<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
+    void removeHiddenDependency(v8::Handle<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
 
     bool processingUserGesture();
     bool shouldAllowNavigation(Frame*);
     KURL completeURL(const String& relativeURL);
     void navigateIfAllowed(Frame*, const KURL&, bool lockHistory, bool lockBackForwardList);
 
+    ScriptExecutionContext* getScriptExecutionContext(ScriptState*);
+    inline ScriptExecutionContext* getScriptExecutionContext() {
+        return getScriptExecutionContext(0);
+    }
+
+    void reportException(ScriptState*, v8::TryCatch&);
+
     class AllowAllocation {
     public:
         inline AllowAllocation()
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
index 862cd2d..24e493c 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
@@ -41,20 +41,13 @@
 
 namespace WebCore {
 
-V8WorkerContextEventListener::V8WorkerContextEventListener(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
-    : V8EventListener(0, listener, isInline)
+V8WorkerContextEventListener::V8WorkerContextEventListener(WorkerContextExecutionProxy* proxy, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
+    : V8EventListener(0, guard, listener, isInline)
     , m_proxy(proxy)
 {
 }
 
-V8WorkerContextEventListener::~V8WorkerContextEventListener()
-{
-    if (m_proxy)
-        m_proxy->removeEventListener(this);
-    disposeListenerObject();
-}
-
-void V8WorkerContextEventListener::handleEvent(Event* event, bool isWindowEvent)
+void V8WorkerContextEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
     // Is the EventListener disconnected?
     if (disconnected())
@@ -77,7 +70,7 @@ void V8WorkerContextEventListener::handleEvent(Event* event, bool isWindowEvent)
     // Get the V8 wrapper for the event object.
     v8::Handle<v8::Value> jsEvent = WorkerContextExecutionProxy::convertEventToV8Object(event);
 
-    invokeEventHandler(context, event, jsEvent, isWindowEvent);
+    invokeEventHandler(context, event, jsEvent);
 }
 
 bool V8WorkerContextEventListener::reportError(const String& message, const String& url, int lineNumber)
@@ -98,6 +91,7 @@ bool V8WorkerContextEventListener::reportError(const String& message, const Stri
     // Enter the V8 context in which to perform the event handling.
     v8::Context::Scope scope(context);
 
+    v8::Local<v8::Object> listener = getListenerObject();
     v8::Local<v8::Value> returnValue;
     {
         // Catch exceptions thrown in calling the function so they do not propagate to javascript code that caused the event to fire.
@@ -105,8 +99,8 @@ bool V8WorkerContextEventListener::reportError(const String& message, const Stri
         tryCatch.SetVerbose(true);
 
         // Call the function.
-        if (!m_listener.IsEmpty() && m_listener->IsFunction()) {
-            v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::New(v8::Persistent<v8::Function>::Cast(m_listener));
+        if (!listener.IsEmpty() && listener->IsFunction()) {
+            v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::Cast(listener);
             v8::Local<v8::Object> thisValue = v8::Context::GetCurrent()->Global();
 
             v8::Handle<v8::Value> parameters[3] = { v8String(message), v8String(url), v8::Integer::New(lineNumber) };
@@ -126,10 +120,10 @@ bool V8WorkerContextEventListener::reportError(const String& message, const Stri
     return errorHandled;
 }
 
-v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event, bool isWindowEvent)
+v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event)
 {
     v8::Local<v8::Function> handlerFunction = getListenerFunction();
-    v8::Local<v8::Object> receiver = getReceiverObject(event, isWindowEvent);
+    v8::Local<v8::Object> receiver = getReceiverObject(event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
@@ -141,13 +135,12 @@ v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(v8::Hand
     return result;
 }
 
-v8::Local<v8::Object> V8WorkerContextEventListener::getReceiverObject(Event* event, bool isWindowEvent)
+v8::Local<v8::Object> V8WorkerContextEventListener::getReceiverObject(Event* event)
 {
-    if (!m_listener.IsEmpty() && !m_listener->IsFunction())
-        return v8::Local<v8::Object>::New(m_listener);
+    v8::Local<v8::Object> listener = getListenerObject();
 
-    if (isWindowEvent)
-        return v8::Context::GetCurrent()->Global();
+    if (!listener.IsEmpty() && !listener->IsFunction())
+        return listener;
 
     EventTarget* target = event->currentTarget();
     v8::Handle<v8::Value> value = WorkerContextExecutionProxy::convertEventTargetToV8Object(target);
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.h b/WebCore/bindings/v8/V8WorkerContextEventListener.h
index c901c51..3752533 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.h
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.h
@@ -44,23 +44,21 @@ namespace WebCore {
 
     class V8WorkerContextEventListener : public V8EventListener {
     public:
-        static PassRefPtr<V8WorkerContextEventListener> create(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
+        static PassRefPtr<V8WorkerContextEventListener> create(WorkerContextExecutionProxy* proxy, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
         {
-            return adoptRef(new V8WorkerContextEventListener(proxy, listener, isInline));
+            return adoptRef(new V8WorkerContextEventListener(proxy, guard, listener, isInline));
         }
-        V8WorkerContextEventListener(WorkerContextExecutionProxy*, v8::Local<v8::Object> listener, bool isInline);
 
-        virtual ~V8WorkerContextEventListener();
-        virtual void handleEvent(Event*, bool isWindowEvent);
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
         virtual bool reportError(const String& message, const String& url, int lineNumber);
-        virtual bool disconnected() const { return !m_proxy; }
 
         WorkerContextExecutionProxy* proxy() const { return m_proxy; }
-        void disconnect() { m_proxy = 0; }
 
     private:
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*, bool isWindowEvent);
-        v8::Local<v8::Object> getReceiverObject(Event*, bool isWindowEvent);
+        V8WorkerContextEventListener(WorkerContextExecutionProxy*, PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isInline);
+
+        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*);
+        v8::Local<v8::Object> getReceiverObject(Event*);
         WorkerContextExecutionProxy* m_proxy;
     };
 
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index ba858cf..8ef65b3 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -38,6 +38,8 @@
 #include "DOMCoreException.h"
 #include "DedicatedWorkerContext.h"
 #include "Event.h"
+#include "Notification.h"
+#include "NotificationCenter.h"
 #include "EventException.h"
 #include "MessagePort.h"
 #include "RangeException.h"
@@ -46,7 +48,9 @@
 #include "V8Index.h"
 #include "V8Proxy.h"
 #include "V8WorkerContextEventListener.h"
-#include "V8WorkerContextObjectEventListener.h"
+#if ENABLE(WEB_SOCKETS)
+#include "WebSocket.h"
+#endif
 #include "Worker.h"
 #include "WorkerContext.h"
 #include "WorkerLocation.h"
@@ -66,6 +70,7 @@ static void reportFatalErrorInV8(const char* location, const char* message)
 WorkerContextExecutionProxy::WorkerContextExecutionProxy(WorkerContext* workerContext)
     : m_workerContext(workerContext)
     , m_recursion(0)
+    , m_listenerGuard(V8ListenerGuard::create())
 {
     initV8IfNeeded();
 }
@@ -77,13 +82,7 @@ WorkerContextExecutionProxy::~WorkerContextExecutionProxy()
 
 void WorkerContextExecutionProxy::dispose()
 {
-    // Disconnect all event listeners.
-    if (m_listeners.get()) {
-        for (V8EventListenerList::iterator iterator(m_listeners->begin()); iterator != m_listeners->end(); ++iterator)
-           static_cast<V8WorkerContextEventListener*>(*iterator)->disconnect();
-
-        m_listeners->clear();
-    }
+    m_listenerGuard->disconnectListeners();
 
     // Detach all events from their JS wrappers.
     for (size_t eventIndex = 0; eventIndex < m_events.size(); ++eventIndex) {
@@ -169,8 +168,6 @@ void WorkerContextExecutionProxy::initContextIfNeeded()
     // Insert the object instance as the prototype of the shadow object.
     v8::Handle<v8::Object> globalObject = m_context->Global();
     globalObject->Set(implicitProtoString, jsWorkerContext);
-
-    m_listeners.set(new V8EventListenerList());
 }
 
 v8::Handle<v8::Value> WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::V8WrapperType type, void* impl)
@@ -224,6 +221,14 @@ v8::Handle<v8::Value> WorkerContextExecutionProxy::convertToV8Object(V8ClassInde
             case V8ClassIndex::WORKERNAVIGATOR:
                 static_cast<WorkerNavigator*>(impl)->ref();
                 break;
+#if ENABLE(NOTIFICATIONS)
+            case V8ClassIndex::NOTIFICATIONCENTER:
+                static_cast<NotificationCenter*>(impl)->ref();
+                break;
+            case V8ClassIndex::NOTIFICATION:
+                static_cast<Notification*>(impl)->ref();
+                break;
+#endif
             case V8ClassIndex::DOMCOREEXCEPTION:
                 static_cast<DOMCoreException*>(impl)->ref();
                 break;
@@ -398,6 +403,7 @@ v8::Local<v8::Value> WorkerContextExecutionProxy::runScript(v8::Handle<v8::Scrip
     return result;
 }
 
+<<<<<<< HEAD:WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
 PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListenerHelper(v8::Local<v8::Value> object, bool isInline, bool findOnly, bool createObjectEventListener)
 {
     if (!object->IsObject())
@@ -419,19 +425,11 @@ PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListen
     return newListener.release();
 }
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
 PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly)
 {
-    return findOrCreateEventListenerHelper(object, isInline, findOnly, false);
-}
-
-PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateObjectEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly)
-{
-    return findOrCreateEventListenerHelper(object, isInline, findOnly, true);
-}
-
-void WorkerContextExecutionProxy::removeEventListener(V8EventListener* listener)
-{
-    m_listeners->remove(listener);
+    return findOnly ? V8EventListenerList::findWrapper(object, isInline) : V8EventListenerList::findOrCreateWrapper<V8WorkerContextEventListener>(this, m_listenerGuard, object, isInline);
 }
 
 void WorkerContextExecutionProxy::trackEvent(Event* event)
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.h b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
index 75024df..a08395c 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.h
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
@@ -64,12 +64,8 @@ namespace WebCore {
         WorkerContextExecutionProxy(WorkerContext*);
         ~WorkerContextExecutionProxy();
 
-        void removeEventListener(V8EventListener*);
-
         // Finds/creates event listener wrappers.
         PassRefPtr<V8EventListener> findOrCreateEventListener(v8::Local<v8::Value> listener, bool isInline, bool findOnly);
-        PassRefPtr<V8EventListener> findOrCreateObjectEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly);
-        PassRefPtr<V8EventListener> findOrCreateEventListenerHelper(v8::Local<v8::Value> object, bool isInline, bool findOnly, bool createObjectEventListener);
 
         // Track the event so that we can detach it from the JS wrapper when a worker
         // terminates. This is needed because we need to be able to dispose these
@@ -114,8 +110,8 @@ namespace WebCore {
         WorkerContext* m_workerContext;
         v8::Persistent<v8::Context> m_context;
         int m_recursion;
+        RefPtr<V8ListenerGuard> m_listenerGuard;
 
-        OwnPtr<V8EventListenerList> m_listeners;
         Vector<Event*> m_events;
     };
 
diff --git a/WebCore/bindings/v8/custom/V8AbstractWorkerCustom.cpp b/WebCore/bindings/v8/custom/V8AbstractWorkerCustom.cpp
index ce759eb..0240895 100644
--- a/WebCore/bindings/v8/custom/V8AbstractWorkerCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8AbstractWorkerCustom.cpp
@@ -38,75 +38,18 @@
 #include "ScriptExecutionContext.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContextExecutionProxy.h"
 
 namespace WebCore {
 
-PassRefPtr<EventListener> getEventListener(AbstractWorker* worker, v8::Local<v8::Value> value, bool isAttribute, bool findOnly)
-{
-    if (worker->scriptExecutionContext()->isWorkerContext()) {
-        WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
-        ASSERT(workerContextProxy);
-        return workerContextProxy->findOrCreateObjectEventListener(value, isAttribute, findOnly);
-    }
-
-    V8Proxy* proxy = V8Proxy::retrieve(worker->scriptExecutionContext());
-    if (proxy) {
-        V8EventListenerList* list = proxy->objectListeners();
-        return findOnly ? list->findWrapper(value, isAttribute) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, isAttribute);
-    }
-
-    return 0;
-}
-
-ACCESSOR_GETTER(AbstractWorkerOnerror)
-{
-    INC_STATS(L"DOM.AbstractWorker.onerror._get");
-    AbstractWorker* worker = V8DOMWrapper::convertToNativeObject<AbstractWorker>(V8ClassIndex::ABSTRACTWORKER, info.Holder());
-    if (worker->onerror()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(worker->onerror());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Undefined();
-}
-
-ACCESSOR_SETTER(AbstractWorkerOnerror)
-{
-    INC_STATS(L"DOM.AbstractWorker.onerror._set");
-    AbstractWorker* worker = V8DOMWrapper::convertToNativeObject<AbstractWorker>(V8ClassIndex::ABSTRACTWORKER, info.Holder());
-    V8ObjectEventListener* oldListener = static_cast<V8ObjectEventListener*>(worker->onerror());
-    if (value->IsNull()) {
-        if (oldListener) {
-            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kAbstractWorkerRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        worker->setOnerror(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(worker, value, true, false);
-        if (listener) {
-            if (oldListener) {
-                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kAbstractWorkerRequestCacheIndex);
-            }
-
-            worker->setOnerror(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kAbstractWorkerRequestCacheIndex);
-        }
-    }
-}
-
 CALLBACK_FUNC_DECL(AbstractWorkerAddEventListener)
 {
     INC_STATS(L"DOM.AbstractWorker.addEventListener()");
     AbstractWorker* worker = V8DOMWrapper::convertToNativeObject<AbstractWorker>(V8ClassIndex::ABSTRACTWORKER, args.Holder());
 
-    RefPtr<EventListener> listener = getEventListener(worker, args[1], false, false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(worker, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -122,7 +65,7 @@ CALLBACK_FUNC_DECL(AbstractWorkerRemoveEventListener)
     INC_STATS(L"DOM.AbstractWorker.removeEventListener()");
     AbstractWorker* worker = V8DOMWrapper::convertToNativeObject<AbstractWorker>(V8ClassIndex::ABSTRACTWORKER, args.Holder());
 
-    RefPtr<EventListener> listener = getEventListener(worker, args[1], false, true);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(worker, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
diff --git a/WebCore/bindings/v8/custom/V8CanvasArrayBufferCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasArrayBufferCustom.cpp
new file mode 100644
index 0000000..4a85e82
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasArrayBufferCustom.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasArrayBufferConstructor)
+{
+    INC_STATS("DOM.CanvasArrayBuffer.Contructor");
+
+    if (!args.IsConstructCall())
+        return throwError("DOM object constructor cannot be called as a function.");
+
+    int argLen = args.Length();
+    // Supported constructors:
+    // CanvasArrayBuffer(n) where n is an integer:
+    //   -- create an empty buffer of n bytes
+
+    if (argLen != 1)
+        return throwError("Wrong number of arguments specified to constructor (requires 1)");
+
+    int len = 0;
+    if (!args[0]->IsInt32())
+        return throwError("Argument to CanvasArrayBuffer constructor was not an integer");
+    len = toInt32(args[0]);
+    RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(len);
+    // Transform the holder into a wrapper object for the array.
+    V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::CANVASARRAYBUFFER), buffer.get());
+    return toV8(buffer.release(), args.Holder());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h b/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h
new file mode 100644
index 0000000..311b838
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+    // Template function used by the CanvasArray*Constructor callbacks.
+    template<class ArrayClass>
+    v8::Handle<v8::Value> constructCanvasArray(const v8::Arguments& args,
+                                               int classIndex)
+    {
+        if (!args.IsConstructCall())
+            return throwError("DOM object constructor cannot be called as a function.");
+
+        int argLen = args.Length();
+        // Supported constructors:
+        // Canvas<T>Array(n) where n is an integer:
+        //   -- create an empty array of n elements
+        // Canvas<T>Array(arr) where arr is an array:
+        //   -- create a Canvas<T>Array containing the contents of "arr"
+        // Canvas<T>Array(buf, offset, length)
+        //   -- create a Canvas<T>Array pointing to the CanvasArrayBuffer
+        //      "buf", starting at the specified offset, for the given
+        //      length
+
+        if (argLen == 0)
+            return throwError("No arguments specified to constructor");
+
+        // See whether the first argument is a CanvasArrayBuffer.
+        if (V8CanvasArrayBuffer::HasInstance(args[0])) {
+            if (argLen > 3)
+                return throwError("Wrong number of arguments to new Canvas<T>Array(CanvasArrayBuffer, int, int)");
+
+            CanvasArrayBuffer* buf =
+                V8DOMWrapper::convertToNativeObject<CanvasArrayBuffer>(V8ClassIndex::CANVASARRAYBUFFER,
+                                                                       args[0]->ToObject());
+            if (buf == NULL)
+                return throwError("Could not convert argument 0 to a CanvasArrayBuffer");
+            bool ok;
+            int offset = 0;
+            if (argLen > 1) {
+                offset = toInt32(args[1], ok);
+                if (!ok)
+                    return throwError("Could not convert argument 1 to an integer");
+            }
+            int length = buf->byteLength() - offset;
+            if (argLen > 2) {
+                length = toInt32(args[2], ok);
+                if (!ok)
+                    return throwError("Could not convert argument 2 to an integer");
+            }
+            if (length < 0)
+                return throwError("Length / offset out of range");
+
+            RefPtr<ArrayClass> array = ArrayClass::create(buf, offset, length);
+            if (array == NULL)
+                return throwError("Invalid arguments to new Canvas<T>Array(CanvasArrayBuffer, int, int)");
+            // Transform the holder into a wrapper object for the array.
+            V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
+            return toV8(array.release(), args.Holder());
+        }
+
+        int len = 0;
+        v8::Handle<v8::Array> srcArray;
+        if (argLen != 1)
+            return throwError("Wrong number of arguments to new Canvas<T>Array(int / array)");
+
+        if (args[0]->IsInt32()) {
+            len = toInt32(args[0]);
+        } else if (args[0]->IsArray()) {
+            srcArray = v8::Local<v8::Array>::Cast(args[0]);
+            if (srcArray.IsEmpty())
+                return throwError("Could not convert argument 0 to an array");
+            len = srcArray->Length();
+        } else
+            return throwError("Could not convert argument 0 to either an int32 or an array");
+
+        RefPtr<ArrayClass> array = ArrayClass::create(len);
+        if (!srcArray.IsEmpty()) {
+            // Need to copy the incoming array into the newly created CanvasArray.
+            for (int i = 0; i < len; i++) {
+                v8::Local<v8::Value> val = srcArray->Get(v8::Integer::New(i));
+                if (!val->IsNumber()) {
+                    char buf[256];
+                    sprintf(buf, "Could not convert array element %d to a number", i);
+                    return throwError(buf);
+                }
+                array->set(i, val->NumberValue());
+            }
+        }
+
+        // Transform the holder into a wrapper object for the array.
+        V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
+        return toV8(array.release(), args.Holder());
+    }
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasByteArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasByteArrayCustom.cpp
new file mode 100644
index 0000000..503e5e8
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasByteArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasByteArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasByteArrayConstructor)
+{
+    INC_STATS("DOM.CanvasByteArray.Contructor");
+
+    return constructCanvasArray<CanvasByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASBYTEARRAY));
+}
+
+// Get the specified value from the byte buffer and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid byte buffer range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasByteArray)
+{
+    INC_STATS("DOM.CanvasByteArray.IndexedPropertyGetter");
+    CanvasByteArray* byteBuffer = V8DOMWrapper::convertToNativeObject<CanvasByteArray>(V8ClassIndex::CANVASBYTEARRAY, info.Holder());
+
+    if ((index < 0) || (index >= byteBuffer->length()))
+        return v8::Undefined();
+    signed char result;
+    if (!byteBuffer->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the byte buffer. Accesses outside the valid byte buffer range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasByteArray)
+{
+    INC_STATS("DOM.CanvasByteArray.IndexedPropertySetter");
+    CanvasByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasByteArray>(V8ClassIndex::CANVASBYTEARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasFloatArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasFloatArrayCustom.cpp
new file mode 100644
index 0000000..b3c1d62
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasFloatArrayCustom.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasFloatArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasFloatArrayConstructor)
+{
+    INC_STATS("DOM.CanvasFloatArray.Contructor");
+
+    return constructCanvasArray<CanvasFloatArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASFLOATARRAY));
+}
+
+// Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasFloatArray)
+{
+    INC_STATS("DOM.CanvasFloatArray.IndexedPropertyGetter");
+    CanvasFloatArray* array = V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    float result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the array. Accesses outside the valid array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasFloatArray)
+{
+    INC_STATS("DOM.CanvasFloatArray.IndexedPropertySetter");
+    CanvasFloatArray* array = V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length()))
+        array->set(index, value->NumberValue());
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasIntArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasIntArrayCustom.cpp
new file mode 100644
index 0000000..6f35db8
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasIntArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasIntArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasIntArrayConstructor)
+{
+    INC_STATS("DOM.CanvasIntArray.Contructor");
+
+    return constructCanvasArray<CanvasIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASINTARRAY));
+}
+
+// Get the specified value from the integer array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasIntArray)
+{
+    INC_STATS("DOM.CanvasIntArray.IndexedPropertyGetter");
+    CanvasIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    int result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the integer array. Accesses outside the valid integer array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasIntArray)
+{
+    INC_STATS("DOM.CanvasIntArray.IndexedPropertySetter");
+    CanvasIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp
new file mode 100644
index 0000000..c109bb8
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp
@@ -0,0 +1,597 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasRenderingContext3D.h"
+
+#include "ExceptionCode.h"
+
+#include "NotImplemented.h"
+
+#include <wtf/FastMalloc.h>
+
+#include "V8Binding.h"
+#include "V8CanvasArray.h"
+#include "V8CanvasByteArray.h"
+#include "V8CanvasFloatArray.h"
+#include "V8CanvasIntArray.h"
+#include "V8CanvasShortArray.h"
+#include "V8CanvasUnsignedByteArray.h"
+#include "V8CanvasUnsignedIntArray.h"
+#include "V8CanvasUnsignedShortArray.h"
+#include "V8HTMLImageElement.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+// Allocates new storage via tryFastMalloc.
+// Returns NULL if array failed to convert for any reason.
+static float* jsArrayToFloatArray(v8::Handle<v8::Array> array, uint32_t len)
+{
+    // Convert the data element-by-element.
+    float* data;
+    if (!tryFastMalloc(len * sizeof(float)).getValue(data))
+        return 0;
+    for (uint32_t i = 0; i < len; i++) {
+        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
+        if (!val->IsNumber()) {
+            fastFree(data);
+            return 0;
+        }
+        data[i] = toFloat(val);
+    }
+    return data;
+}
+
+// Allocates new storage via tryFastMalloc.
+// Returns NULL if array failed to convert for any reason.
+static int* jsArrayToIntArray(v8::Handle<v8::Array> array, uint32_t len)
+{
+    // Convert the data element-by-element.
+    int* data;
+    if (!tryFastMalloc(len * sizeof(int)).getValue(data))
+        return 0;
+    for (uint32_t i = 0; i < len; i++) {
+        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
+        bool ok;
+        int ival = toInt32(val, ok);
+        if (!ok) {
+            fastFree(data);
+            return 0;
+        }
+        data[i] = ival;
+    }
+    return data;
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DBufferData)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.bufferData()");
+
+    // Forms:
+    // * bufferData(GLenum target, CanvasArray data, GLenum usage);
+    //   - Sets the buffer's data from the given CanvasArray
+    // * bufferData(GLenum target, GLsizeiptr size, GLenum usage);
+    //   - Sets the size of the buffer to the given size in bytes
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int usage = toInt32(args[2], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (args[1]->IsInt32()) {
+        int size = toInt32(args[1]);
+        context->bufferData(target, size, usage);
+    } else if (V8CanvasArray::HasInstance(args[1])) {
+        CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, args[1]->ToObject());
+        context->bufferData(target, array, usage);
+    } else {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DBufferSubData)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.bufferSubData()");
+
+    // Forms:
+    // * bufferSubData(GLenum target, GLintptr offset, CanvasArray data);
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int offset = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (!V8CanvasArray::HasInstance(args[2])) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, args[2]->ToObject());
+    context->bufferSubData(target, offset, array);
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DTexImage2D)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.texImage2D()");
+
+    // Currently supported forms:
+    // * void texImage2D(in GLenum target, in GLint level,
+    //                   in GLint internalformat,
+    //                   in GLsizei width, in GLsizei height, in GLint border,
+    //                   in GLenum format, in GLenum type, in CanvasArray pixels);
+    // * void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
+    //                   [Optional] in GLboolean flipY, [Optional] in GLboolean premultiplyAlpha);
+    if (args.Length() != 3 &&
+        args.Length() != 4 &&
+        args.Length() != 5 &&
+        args.Length() != 9) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int level = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    if (args.Length() == 3 ||
+        args.Length() == 4 ||
+        args.Length() == 5) {
+        v8::Handle<v8::Value> arg = args[2];
+        if (V8HTMLImageElement::HasInstance(arg)) {
+            HTMLImageElement* image_element = V8DOMWrapper::convertDOMWrapperToNode<HTMLImageElement>(v8::Handle<v8::Object>::Cast(arg));
+            bool flipY = false;
+            bool premultiplyAlpha = false;
+            if (args.Length() >= 4)
+                flipY = args[3]->BooleanValue();
+            if (args.Length() >= 5)
+                premultiplyAlpha = args[4]->BooleanValue();
+            context->texImage2D(target, level, image_element, flipY, premultiplyAlpha, ec);
+        } else {
+            // FIXME: consider different / better exception type.
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        // Fall through
+    } else if (args.Length() == 9) {
+        int internalformat = toInt32(args[2], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int width = toInt32(args[3], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int height = toInt32(args[4], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int border = toInt32(args[5], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int format = toInt32(args[6], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int type = toInt32(args[7], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        v8::Handle<v8::Value> arg = args[8];
+        if (V8CanvasArray::HasInstance(arg)) {
+            CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, arg->ToObject());
+            // FIXME: must do validation similar to JOGL's to ensure that
+            // the incoming array is of the appropriate length and type
+            context->texImage2D(target,
+                                level,
+                                internalformat,
+                                width,
+                                height,
+                                border,
+                                format,
+                                type,
+                                array,
+                                ec);
+            // Fall through
+        } else {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+    } else {
+        ASSERT_NOT_REACHED();
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DTexSubImage2D)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.texSubImage2D()");
+
+    // FIXME: implement
+    notImplemented();
+
+    return v8::Undefined();
+}
+
+enum FunctionToCall {
+    kUniform1v, kUniform2v, kUniform3v, kUniform4v,
+    kVertexAttrib1v, kVertexAttrib2v, kVertexAttrib3v, kVertexAttrib4v
+};
+
+static v8::Handle<v8::Value> vertexAttribAndUniformHelperf(const v8::Arguments& args,
+                                                           FunctionToCall functionToCall) {
+    // Forms:
+    // * glUniform1fv(GLint location, Array data);
+    // * glUniform1fv(GLint location, CanvasFloatArray data);
+    // * glUniform2fv(GLint location, Array data);
+    // * glUniform2fv(GLint location, CanvasFloatArray data);
+    // * glUniform3fv(GLint location, Array data);
+    // * glUniform3fv(GLint location, CanvasFloatArray data);
+    // * glUniform4fv(GLint location, Array data);
+    // * glUniform4fv(GLint location, CanvasFloatArray data);
+    // * glVertexAttrib1fv(GLint location, Array data);
+    // * glVertexAttrib1fv(GLint location, CanvasFloatArray data);
+    // * glVertexAttrib2fv(GLint location, Array data);
+    // * glVertexAttrib2fv(GLint location, CanvasFloatArray data);
+    // * glVertexAttrib3fv(GLint location, Array data);
+    // * glVertexAttrib3fv(GLint location, CanvasFloatArray data);
+    // * glVertexAttrib4fv(GLint location, Array data);
+    // * glVertexAttrib4fv(GLint location, CanvasFloatArray data);
+
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int location = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (V8CanvasFloatArray::HasInstance(args[1])) {
+        CanvasFloatArray* array = 
+            V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, args[1]->ToObject());
+        ASSERT(array != NULL);
+        switch (functionToCall) {
+            case kUniform1v: context->uniform1fv(location, array); break;
+            case kUniform2v: context->uniform2fv(location, array); break;
+            case kUniform3v: context->uniform3fv(location, array); break;
+            case kUniform4v: context->uniform4fv(location, array); break;
+            case kVertexAttrib1v: context->vertexAttrib1fv(location, array); break;
+            case kVertexAttrib2v: context->vertexAttrib2fv(location, array); break;
+            case kVertexAttrib3v: context->vertexAttrib3fv(location, array); break;
+            case kVertexAttrib4v: context->vertexAttrib4fv(location, array); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[1]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    float* data = jsArrayToFloatArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    switch (functionToCall) {
+        case kUniform1v: context->uniform1fv(location, data, len); break;
+        case kUniform2v: context->uniform2fv(location, data, len); break;
+        case kUniform3v: context->uniform3fv(location, data, len); break;
+        case kUniform4v: context->uniform4fv(location, data, len); break;
+        case kVertexAttrib1v: context->vertexAttrib1fv(location, data, len); break;
+        case kVertexAttrib2v: context->vertexAttrib2fv(location, data, len); break;
+        case kVertexAttrib3v: context->vertexAttrib3fv(location, data, len); break;
+        case kVertexAttrib4v: context->vertexAttrib4fv(location, data, len); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    return v8::Undefined();
+}
+
+static v8::Handle<v8::Value> uniformHelperi(const v8::Arguments& args,
+                                            FunctionToCall functionToCall) {
+    // Forms:
+    // * glUniform1iv(GLint location, Array data);
+    // * glUniform1iv(GLint location, CanvasIntArray data);
+    // * glUniform2iv(GLint location, Array data);
+    // * glUniform2iv(GLint location, CanvasIntArray data);
+    // * glUniform3iv(GLint location, Array data);
+    // * glUniform3iv(GLint location, CanvasIntArray data);
+    // * glUniform4iv(GLint location, Array data);
+    // * glUniform4iv(GLint location, CanvasIntArray data);
+
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int location = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (V8CanvasIntArray::HasInstance(args[1])) {
+        CanvasIntArray* array = 
+            V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, args[1]->ToObject());
+        ASSERT(array != NULL);
+        switch (functionToCall) {
+            case kUniform1v: context->uniform1iv(location, array); break;
+            case kUniform2v: context->uniform2iv(location, array); break;
+            case kUniform3v: context->uniform3iv(location, array); break;
+            case kUniform4v: context->uniform4iv(location, array); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[1]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    int* data = jsArrayToIntArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    switch (functionToCall) {
+        case kUniform1v: context->uniform1iv(location, data, len); break;
+        case kUniform2v: context->uniform2iv(location, data, len); break;
+        case kUniform3v: context->uniform3iv(location, data, len); break;
+        case kUniform4v: context->uniform4iv(location, data, len); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform1fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform1fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform1v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform1iv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform1iv()");
+    return uniformHelperi(args, kUniform1v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform2fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform2fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform2v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform2iv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform2iv()");
+    return uniformHelperi(args, kUniform2v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform3fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform3fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform3v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform3iv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform3iv()");
+    return uniformHelperi(args, kUniform3v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform4fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform4fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform4v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform4iv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform4iv()");
+    return uniformHelperi(args, kUniform4v);
+}
+
+static v8::Handle<v8::Value> uniformMatrixHelper(const v8::Arguments& args,
+                                                 int matrixSize)
+{
+    // Forms:
+    // * glUniformMatrix2fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix2fv(GLint location, GLboolean transpose, CanvasFloatArray data);
+    // * glUniformMatrix3fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix3fv(GLint location, GLboolean transpose, CanvasFloatArray data);
+    // * glUniformMatrix4fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix4fv(GLint location, GLboolean transpose, CanvasFloatArray data);
+    //
+    // FIXME: need to change to accept CanvasFloatArray as well.
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int location = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    bool transpose = args[1]->BooleanValue();
+    if (V8CanvasFloatArray::HasInstance(args[2])) {
+        CanvasFloatArray* array = 
+            V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, args[2]->ToObject());
+        ASSERT(array != NULL);
+        switch (matrixSize) {
+            case 2: context->uniformMatrix2fv(location, transpose, array); break;
+            case 3: context->uniformMatrix3fv(location, transpose, array); break;
+            case 4: context->uniformMatrix4fv(location, transpose, array); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[2]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    float* data = jsArrayToFloatArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    switch (matrixSize) {
+        case 2: context->uniformMatrix2fv(location, transpose, data, len); break;
+        case 3: context->uniformMatrix3fv(location, transpose, data, len); break;
+        case 4: context->uniformMatrix4fv(location, transpose, data, len); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix2fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix2fv()");
+    return uniformMatrixHelper(args, 2);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix3fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix3fv()");
+    return uniformMatrixHelper(args, 3);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix4fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix4fv()");
+    return uniformMatrixHelper(args, 4);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib1fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib1fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib1v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib2fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib2fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib2v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib3fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib3fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib3v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib4fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib4fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib4v);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasShortArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasShortArrayCustom.cpp
new file mode 100644
index 0000000..8b83022
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasShortArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasShortArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasShortArrayConstructor)
+{
+    INC_STATS("DOM.CanvasShortArray.Contructor");
+
+    return constructCanvasArray<CanvasShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASSHORTARRAY));
+}
+
+// Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasShortArray)
+{
+    INC_STATS("DOM.CanvasShortArray.IndexedPropertyGetter");
+    CanvasShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasShortArray>(V8ClassIndex::CANVASSHORTARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    short result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the array. Accesses outside the valid array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasShortArray)
+{
+    INC_STATS("DOM.CanvasShortArray.IndexedPropertySetter");
+    CanvasShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasShortArray>(V8ClassIndex::CANVASSHORTARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp
new file mode 100644
index 0000000..62ab880
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedByteArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasUnsignedByteArrayConstructor)
+{
+    INC_STATS("DOM.CanvasUnsignedByteArray.Contructor");
+
+    return constructCanvasArray<CanvasUnsignedByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY));
+}
+
+// Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray)
+{
+    INC_STATS("DOM.CanvasUnsignedByteArray.IndexedPropertyGetter");
+    CanvasUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedByteArray>(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    unsigned char result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the array. Accesses outside the valid array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray)
+{
+    INC_STATS("DOM.CanvasUnsignedByteArray.IndexedPropertySetter");
+    CanvasUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedByteArray>(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp
new file mode 100644
index 0000000..94ec7d0
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedIntArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasUnsignedIntArrayConstructor)
+{
+    INC_STATS("DOM.CanvasUnsignedIntArray.Contructor");
+
+    return constructCanvasArray<CanvasUnsignedIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDINTARRAY));
+}
+
+// Get the specified value from the integer array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray)
+{
+    INC_STATS("DOM.CanvasUnsignedIntArray.IndexedPropertyGetter");
+    CanvasUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedIntArray>(V8ClassIndex::CANVASUNSIGNEDINTARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    unsigned int result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the integer array. Accesses outside the valid integer array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray)
+{
+    INC_STATS("DOM.CanvasUnsignedIntArray.IndexedPropertySetter");
+    CanvasUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedIntArray>(V8ClassIndex::CANVASUNSIGNEDINTARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp
new file mode 100644
index 0000000..eeef82c
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedShortArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasUnsignedShortArrayConstructor)
+{
+    INC_STATS("DOM.CanvasUnsignedShortArray.Contructor");
+
+    return constructCanvasArray<CanvasUnsignedShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY));
+}
+
+// Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray)
+{
+    INC_STATS("DOM.CanvasUnsignedShortArray.IndexedPropertyGetter");
+    CanvasUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedShortArray>(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    unsigned short result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the array. Accesses outside the valid array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray)
+{
+    INC_STATS("DOM.CanvasUnsignedShortArray.IndexedPropertySetter");
+    CanvasUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedShortArray>(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CustomBinding.h b/WebCore/bindings/v8/custom/V8CustomBinding.h
index 22b4a94..3f381be 100644
--- a/WebCore/bindings/v8/custom/V8CustomBinding.h
+++ b/WebCore/bindings/v8/custom/V8CustomBinding.h
@@ -135,6 +135,16 @@ namespace WebCore {
         static const int kAbstractWorkerInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+        static const int kNotificationRequestCacheIndex = kDefaultWrapperInternalFieldCount + 0;
+        static const int kNotificationInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+#endif
+
+#if ENABLE(SVG)
+        static const int kSVGElementInstanceEventListenerCacheIndex = kDefaultWrapperInternalFieldCount + 0;
+        static const int kSVGElementInstanceInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+#endif
+
         static const int kDOMWindowConsoleIndex = kDefaultWrapperInternalFieldCount + 0;
         static const int kDOMWindowHistoryIndex = kDefaultWrapperInternalFieldCount + 1;
         static const int kDOMWindowLocationbarIndex = kDefaultWrapperInternalFieldCount + 2;
@@ -148,7 +158,8 @@ namespace WebCore {
         static const int kDOMWindowToolbarIndex = kDefaultWrapperInternalFieldCount + 10;
         static const int kDOMWindowLocationIndex = kDefaultWrapperInternalFieldCount + 11;
         static const int kDOMWindowDOMSelectionIndex = kDefaultWrapperInternalFieldCount + 12;
-        static const int kDOMWindowInternalFieldCount = kDefaultWrapperInternalFieldCount + 13;
+        static const int kDOMWindowEventListenerCacheIndex = kDefaultWrapperInternalFieldCount + 13;
+        static const int kDOMWindowInternalFieldCount = kDefaultWrapperInternalFieldCount + 14;
 
         static const int kStyleSheetOwnerNodeIndex = kDefaultWrapperInternalFieldCount + 0;
         static const int kStyleSheetInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
@@ -158,6 +169,11 @@ namespace WebCore {
         static const int kDOMApplicationCacheFieldCount = kDefaultWrapperInternalFieldCount + 1;
 #endif
 
+#if ENABLE(WEB_SOCKETS)
+        static const int kWebSocketCacheIndex = kDefaultWrapperInternalFieldCount + 0;
+        static const int kWebSocketInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+#endif
+
 #define DECLARE_PROPERTY_ACCESSOR_GETTER(NAME) \
     static v8::Handle<v8::Value> v8##NAME##AccessorGetter( \
         v8::Local<v8::String> name, const v8::AccessorInfo& info)
@@ -218,11 +234,18 @@ namespace WebCore {
 
         DECLARE_PROPERTY_ACCESSOR(CanvasRenderingContext2DStrokeStyle);
         DECLARE_PROPERTY_ACCESSOR(CanvasRenderingContext2DFillStyle);
-        DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowEvent);
+        DECLARE_PROPERTY_ACCESSOR(DOMWindowEvent);
         DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowCrypto);
         DECLARE_PROPERTY_ACCESSOR_SETTER(DOMWindowLocation);
         DECLARE_PROPERTY_ACCESSOR_SETTER(DOMWindowOpener);
 
+#if ENABLE(VIDEO)
+        DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowAudio);
+#endif
+
+        DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowImage);
+        DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowOption);
+
         DECLARE_PROPERTY_ACCESSOR(DocumentLocation);
         DECLARE_PROPERTY_ACCESSOR(DocumentImplementation);
         DECLARE_PROPERTY_ACCESSOR_GETTER(EventSrcElement);
@@ -231,7 +254,6 @@ namespace WebCore {
         DECLARE_PROPERTY_ACCESSOR_GETTER(EventClipboardData);
 
         DECLARE_PROPERTY_ACCESSOR(DOMWindowEventHandler);
-        DECLARE_PROPERTY_ACCESSOR(NodeEventHandler);
 
         DECLARE_CALLBACK(HTMLCanvasElementGetContext);
 
@@ -319,6 +341,38 @@ namespace WebCore {
         DECLARE_CALLBACK(CanvasRenderingContext2DStrokeText);
         DECLARE_CALLBACK(CanvasRenderingContext2DPutImageData);
 
+#if ENABLE(3D_CANVAS)
+        DECLARE_CALLBACK(CanvasRenderingContext3DBufferData);
+        DECLARE_CALLBACK(CanvasRenderingContext3DBufferSubData);
+        DECLARE_CALLBACK(CanvasRenderingContext3DSizeof);
+        DECLARE_CALLBACK(CanvasRenderingContext3DTexImage2D);
+        DECLARE_CALLBACK(CanvasRenderingContext3DTexSubImage2D);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform1fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform1iv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform2fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform2iv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform3fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform3iv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform4fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform4iv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix2fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix3fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix4fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib1fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib2fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib3fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib4fv);
+
+        DECLARE_CALLBACK(CanvasArrayBufferConstructor);
+        DECLARE_CALLBACK(CanvasByteArrayConstructor);
+        DECLARE_CALLBACK(CanvasFloatArrayConstructor);
+        DECLARE_CALLBACK(CanvasIntArrayConstructor);
+        DECLARE_CALLBACK(CanvasShortArrayConstructor);
+        DECLARE_CALLBACK(CanvasUnsignedByteArrayConstructor);
+        DECLARE_CALLBACK(CanvasUnsignedIntArrayConstructor);
+        DECLARE_CALLBACK(CanvasUnsignedShortArrayConstructor);
+#endif
+
         DECLARE_PROPERTY_ACCESSOR_GETTER(ClipboardTypes);
         DECLARE_CALLBACK(ClipboardClearData);
         DECLARE_CALLBACK(ClipboardGetData);
@@ -400,14 +454,22 @@ namespace WebCore {
         DECLARE_CALLBACK(InspectorBackendAddSourceToFrame);
         DECLARE_CALLBACK(InspectorBackendSearch);
         DECLARE_CALLBACK(InspectorBackendSetting);
+        DECLARE_CALLBACK(InspectorBackendDatabaseForId);
         DECLARE_CALLBACK(InspectorBackendInspectedWindow);
         DECLARE_CALLBACK(InspectorBackendSetSetting);
         DECLARE_CALLBACK(InspectorBackendCurrentCallFrame);
         DECLARE_CALLBACK(InspectorBackendDebuggerEnabled);
         DECLARE_CALLBACK(InspectorBackendPauseOnExceptions);
         DECLARE_CALLBACK(InspectorBackendProfilerEnabled);
+        DECLARE_CALLBACK(InspectorBackendNodeForId);
+        DECLARE_CALLBACK(InspectorBackendWrapObject);
+        DECLARE_CALLBACK(InspectorBackendUnwrapObject);
+        DECLARE_CALLBACK(InspectorBackendPushNodePathToFrontend);
 #if ENABLE(DATABASE)
-        DECLARE_CALLBACK(InspectorBackendDatabaseTableNames);
+        DECLARE_CALLBACK(InspectorBackendSelectDatabase);
+#endif
+#if ENABLE(DOM_STORAGE)
+        DECLARE_CALLBACK(InspectorBackendSelectDOMStorage);
 #endif
         DECLARE_CALLBACK(InspectorBackendWrapCallback);
 
@@ -445,21 +507,52 @@ namespace WebCore {
         DECLARE_INDEXED_PROPERTY_SETTER(HTMLSelectElementCollection);
         DECLARE_NAMED_PROPERTY_GETTER(HTMLCollection);
 
+#if ENABLE(3D_CANVAS)
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasByteArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasByteArray);
+
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasFloatArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasFloatArray);
+
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasIntArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasIntArray);
+#endif
+
         DECLARE_INDEXED_PROPERTY_GETTER(CanvasPixelArray);
         DECLARE_INDEXED_PROPERTY_SETTER(CanvasPixelArray);
 
+#if ENABLE(3D_CANVAS)
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasShortArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasShortArray);
+
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray);
+
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray);
+
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray);
+#endif
+
+        DECLARE_PROPERTY_ACCESSOR_GETTER(MessageEventPorts);
+        DECLARE_CALLBACK(MessageEventInitMessageEvent);
+
         DECLARE_PROPERTY_ACCESSOR(MessagePortOnmessage);
         DECLARE_PROPERTY_ACCESSOR(MessagePortOnclose);
-        DECLARE_CALLBACK(MessagePortStartConversation);
         DECLARE_CALLBACK(MessagePortAddEventListener);
+        DECLARE_CALLBACK(MessagePortPostMessage);
         DECLARE_CALLBACK(MessagePortRemoveEventListener);
+        DECLARE_CALLBACK(MessagePortStartConversation);
 
         DECLARE_CALLBACK(DatabaseChangeVersion);
         DECLARE_CALLBACK(DatabaseTransaction);
+        DECLARE_CALLBACK(DatabaseReadTransaction);
         DECLARE_CALLBACK(SQLTransactionExecuteSql);
         DECLARE_CALLBACK(SQLResultSetRowListItem);
 
         DECLARE_INDEXED_PROPERTY_GETTER(ClientRectList);
+        DECLARE_INDEXED_PROPERTY_GETTER(FileList);
   
 #if ENABLE(DATAGRID)
         DECLARE_PROPERTY_ACCESSOR(HTMLDataGridElementDataSource);
@@ -496,8 +589,10 @@ namespace WebCore {
         DECLARE_CALLBACK(AbstractWorkerRemoveEventListener);
 
         DECLARE_PROPERTY_ACCESSOR(DedicatedWorkerContextOnmessage);
+        DECLARE_CALLBACK(DedicatedWorkerContextPostMessage);
 
         DECLARE_PROPERTY_ACCESSOR(WorkerOnmessage);
+        DECLARE_CALLBACK(WorkerPostMessage);
         DECLARE_CALLBACK(WorkerConstructor);
 
         DECLARE_PROPERTY_ACCESSOR_GETTER(WorkerContextSelf);
@@ -509,7 +604,17 @@ namespace WebCore {
         DECLARE_CALLBACK(WorkerContextClearInterval);
         DECLARE_CALLBACK(WorkerContextAddEventListener);
         DECLARE_CALLBACK(WorkerContextRemoveEventListener);
-#endif
+#endif // ENABLE(WORKERS)
+
+#if ENABLE(NOTIFICATIONS)
+        DECLARE_CALLBACK(NotificationCenterRequestPermission);
+        DECLARE_CALLBACK(NotificationCenterCreateNotification);
+        DECLARE_CALLBACK(NotificationCenterCreateHTMLNotification);
+
+        DECLARE_CALLBACK(NotificationAddEventListener);
+        DECLARE_CALLBACK(NotificationRemoveEventListener);
+        DECLARE_PROPERTY_ACCESSOR(NotificationEventHandler);
+#endif // ENABLE(NOTIFICATIONS)
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         DECLARE_PROPERTY_ACCESSOR(DOMApplicationCacheEventHandler);
@@ -521,12 +626,23 @@ namespace WebCore {
         DECLARE_CALLBACK(SharedWorkerConstructor);
 #endif
 
+<<<<<<< HEAD:WebCore/bindings/v8/custom/V8CustomBinding.h
         DECLARE_CALLBACK(GeolocationGetCurrentPosition);
         DECLARE_CALLBACK(GeolocationWatchPosition);
         DECLARE_PROPERTY_ACCESSOR_GETTER(CoordinatesAltitude);
         DECLARE_PROPERTY_ACCESSOR_GETTER(CoordinatesAltitudeAccuracy);
         DECLARE_PROPERTY_ACCESSOR_GETTER(CoordinatesHeading);
         DECLARE_PROPERTY_ACCESSOR_GETTER(CoordinatesSpeed);
+=======
+#if ENABLE(WEB_SOCKETS)
+        DECLARE_PROPERTY_ACCESSOR(WebSocketOnopen);
+        DECLARE_PROPERTY_ACCESSOR(WebSocketOnmessage);
+        DECLARE_PROPERTY_ACCESSOR(WebSocketOnclose);
+        DECLARE_CALLBACK(WebSocketConstructor);
+        DECLARE_CALLBACK(WebSocketSend);
+        DECLARE_CALLBACK(WebSocketClose);
+#endif
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/custom/V8CustomBinding.h
 
 #undef DECLARE_INDEXED_ACCESS_CHECK
 #undef DECLARE_NAMED_ACCESS_CHECK
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
index 305da8d..91abecd 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
@@ -35,37 +35,25 @@
 
 namespace WebCore {
 
-V8EventListener::V8EventListener(Frame* frame, v8::Local<v8::Object> listener, bool isAttribute)
-    : V8AbstractEventListener(frame, isAttribute)
+V8EventListener::V8EventListener(Frame* frame, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
+    : V8AbstractEventListener(frame, guard, isAttribute)
 {
-    m_listener = v8::Persistent<v8::Object>::New(listener);
-#ifndef NDEBUG
-    V8GCController::registerGlobalHandle(EVENT_LISTENER, this, m_listener);
-#endif
-}
-
-V8EventListener::~V8EventListener()
-{
-    if (m_frame) {
-        V8Proxy* proxy = V8Proxy::retrieve(m_frame);
-        if (proxy)
-            proxy->eventListeners()->remove(this);
-    }
-
-    disposeListenerObject();
+    setListenerObject(listener);
 }
 
 v8::Local<v8::Function> V8EventListener::getListenerFunction()
 {
+    v8::Local<v8::Object> listener = getListenerObject();
+
     // Has the listener been disposed?
-    if (m_listener.IsEmpty())
+    if (listener.IsEmpty())
         return v8::Local<v8::Function>();
 
-    if (m_listener->IsFunction())
-        return v8::Local<v8::Function>::New(v8::Persistent<v8::Function>::Cast(m_listener));
+    if (listener->IsFunction())
+        return v8::Local<v8::Function>::Cast(listener);
 
-    if (m_listener->IsObject()) {
-        v8::Local<v8::Value> property = m_listener->Get(v8::String::NewSymbol("handleEvent"));
+    if (listener->IsObject()) {
+        v8::Local<v8::Value> property = listener->Get(v8::String::NewSymbol("handleEvent"));
         if (property->IsFunction())
             return v8::Local<v8::Function>::Cast(property);
     }
@@ -73,16 +61,16 @@ v8::Local<v8::Function> V8EventListener::getListenerFunction()
     return v8::Local<v8::Function>();
 }
 
-v8::Local<v8::Value> V8EventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event, bool isWindowEvent)
+v8::Local<v8::Value> V8EventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event)
 {
     v8::Local<v8::Function> handlerFunction = getListenerFunction();
-    v8::Local<v8::Object> receiver = getReceiverObject(event, isWindowEvent);
+    v8::Local<v8::Object> receiver = getReceiverObject(event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
 
-    V8Proxy* proxy = V8Proxy::retrieve(m_frame);
+    V8Proxy* proxy = V8Proxy::retrieve(frame());
     if (!proxy)
         return v8::Local<v8::Value>();
     return proxy->callFunction(handlerFunction, receiver, 1, parameters);
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.h b/WebCore/bindings/v8/custom/V8CustomEventListener.h
index 20adf99..e34f24f 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.h
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.h
@@ -44,23 +44,19 @@ namespace WebCore {
     // that can handle the event.
     class V8EventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8EventListener> create(Frame* frame, v8::Local<v8::Object> listener, bool isAttribute)
+        static PassRefPtr<V8EventListener> create(Frame* frame, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
         {
-            return adoptRef(new V8EventListener(frame, listener, isAttribute));
+            return adoptRef(new V8EventListener(frame, guard, listener, isAttribute));
         }
 
-        // Detach the listener from its owner frame.
-        void disconnectFrame() { m_frame = 0; }
-
     protected:
-        V8EventListener(Frame*, v8::Local<v8::Object> listener, bool isAttribute);
-        virtual ~V8EventListener();
+        V8EventListener(Frame*, PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isAttribute);
+
         v8::Local<v8::Function> getListenerFunction();
 
     private:
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*, bool isWindowEvent);
-        virtual bool virtualisAttribute() const { return m_isAttribute; }
-    };
+        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*);
+     };
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp b/WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp
index 7a3bfe6..1b81257 100644
--- a/WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp
@@ -37,13 +37,13 @@
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8Document.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContextExecutionProxy.h"
 
 namespace WebCore {
 
+<<<<<<< HEAD:WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp
 static const bool kFindOnly = true;
 static const bool kFindOrCreate = false;
 
@@ -101,13 +101,15 @@ ACCESSOR_SETTER(DOMApplicationCacheEventHandler)
     }
 }
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp
 // Handles appcache.addEventListner(name, func, capture) method calls
 CALLBACK_FUNC_DECL(DOMApplicationCacheAddEventListener)
 {
     INC_STATS("DOMApplicationCache.addEventListener()");
     DOMApplicationCache* appcache = V8DOMWrapper::convertToNativeObject<DOMApplicationCache>(V8ClassIndex::DOMAPPLICATIONCACHE, args.Holder());
 
-    RefPtr<EventListener> listener = argumentToEventListener(appcache, args[1], kFindOrCreate);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(appcache, args[1], false, ListenerFindOrCreate);
     if (listener) {
         createHiddenDependency(args.Holder(), args[1], V8Custom::kDOMApplicationCacheCacheIndex);
         String eventType = toWebCoreString(args[0]);
@@ -123,7 +125,7 @@ CALLBACK_FUNC_DECL(DOMApplicationCacheRemoveEventListener)
     INC_STATS("DOMApplicationCache.removeEventListener()");
     DOMApplicationCache* appcache = V8DOMWrapper::convertToNativeObject<DOMApplicationCache>(V8ClassIndex::DOMAPPLICATIONCACHE, args.Holder());
 
-    RefPtr<EventListener> listener = argumentToEventListener(appcache, args[1], kFindOnly);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(appcache, args[1], false, ListenerFindOnly);
     if (listener) {
         removeHiddenDependency(args.Holder(), args[1], V8Custom::kDOMApplicationCacheCacheIndex);
         String eventType = toWebCoreString(args[0]);
diff --git a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 7d0b9e6..0dc5a96 100644
--- a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -34,6 +34,7 @@
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8CustomEventListener.h"
+#include "V8MessagePortCustom.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 
@@ -48,6 +49,7 @@
 #include "PlatformScreen.h"
 #include "ScheduledAction.h"
 #include "ScriptSourceCode.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
 #include "WindowFeatures.h"
 
@@ -64,32 +66,44 @@ v8::Handle<v8::Value> V8Custom::WindowSetTimeoutImpl(const v8::Arguments& args,
     if (argumentCount < 1)
         return v8::Undefined();
 
-    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
-
-    if (!imp->frame())
-        return v8::Undefined();
-
-    if (!V8Proxy::canAccessFrame(imp->frame(), true))
-        return v8::Undefined();
+    v8::Handle<v8::Value> function = args[0];
 
-    ScriptExecutionContext* scriptContext = static_cast<ScriptExecutionContext*>(imp->frame()->document());
+    WebCore::String functionString;
+    if (!function->IsFunction()) {
+        if (function->IsString())
+            functionString = toWebCoreString(function);
+        else {
+            v8::Handle<v8::Value> v8String = function->ToString();
 
-    v8::Handle<v8::Value> function = args[0];
+            // Bail out if string conversion failed. 
+            if (v8String.IsEmpty()) 
+                return v8::Undefined(); 
 
-    int32_t timeout = 0;
-    if (argumentCount >= 2) 
-        timeout = args[1]->Int32Value();
+            functionString = toWebCoreString(v8String);
+        }
 
-    int id;
-    if (function->IsString()) {
         // Don't allow setting timeouts to run empty functions!
         // (Bug 1009597)
-        WebCore::String functionString = toWebCoreString(function);
         if (functionString.length() == 0)
             return v8::Undefined();
+    }
+
+    int32_t timeout = 0;
+    if (argumentCount >= 2)
+        timeout = args[1]->Int32Value();
+
+    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
+
+    if (!V8Proxy::canAccessFrame(imp->frame(), true))
+        return v8::Undefined();
 
-        id = DOMTimer::install(scriptContext, new ScheduledAction(functionString), timeout, singleShot);
-    } else if (function->IsFunction()) {
+    ScriptExecutionContext* scriptContext = static_cast<ScriptExecutionContext*>(imp->document());
+
+    if (!scriptContext)
+        return v8::Undefined();
+
+    int id;
+    if (function->IsFunction()) {
         int paramCount = argumentCount >= 2 ? argumentCount - 2 : 0;
         v8::Local<v8::Value>* params = 0;
         if (paramCount > 0) {
@@ -100,14 +114,14 @@ v8::Handle<v8::Value> V8Custom::WindowSetTimeoutImpl(const v8::Arguments& args,
         }
 
         // params is passed to action, and released in action's destructor
-        ScheduledAction* action = new ScheduledAction(v8::Handle<v8::Function>::Cast(function), paramCount, params);
+        ScheduledAction* action = new ScheduledAction(V8Proxy::context(imp->frame()), v8::Handle<v8::Function>::Cast(function), paramCount, params);
 
         delete[] params;
 
         id = DOMTimer::install(scriptContext, action, timeout, singleShot);
-    } else
-        // FIXME(fqian): what's the right return value if failed.
-        return v8::Undefined();
+    } else {
+        id = DOMTimer::install(scriptContext, new ScheduledAction(V8Proxy::context(imp->frame()), functionString), timeout, singleShot);
+    }
 
     return v8::Integer::New(id);
 }
@@ -145,14 +159,37 @@ static v8::Handle<v8::Value> convertBase64(const String& str, bool encode)
 
 ACCESSOR_GETTER(DOMWindowEvent)
 {
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
+    if (holder.IsEmpty())
+        return v8::Undefined();
+
+    Frame* frame = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder)->frame();
+    if (!V8Proxy::canAccessFrame(frame, true))
+        return v8::Undefined();
+
+    v8::Local<v8::Context> context = V8Proxy::context(frame);
     v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
-    v8::Local<v8::Context> context = v8::Context::GetCurrent();
     v8::Handle<v8::Value> jsEvent = context->Global()->GetHiddenValue(eventSymbol);
     if (jsEvent.IsEmpty())
         return v8::Undefined();
     return jsEvent;
 }
 
+ACCESSOR_SETTER(DOMWindowEvent)
+{
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
+    if (holder.IsEmpty())
+        return;
+
+    Frame* frame = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder)->frame();
+    if (!V8Proxy::canAccessFrame(frame, true))
+        return;
+
+    v8::Local<v8::Context> context = V8Proxy::context(frame);
+    v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
+    context->Global()->SetHiddenValue(eventSymbol, value);
+}
+
 ACCESSOR_GETTER(DOMWindowCrypto)
 {
     // FIXME: Implement me.
@@ -161,11 +198,7 @@ ACCESSOR_GETTER(DOMWindowCrypto)
 
 ACCESSOR_SETTER(DOMWindowLocation)
 {
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
-    if (holder.IsEmpty())
-        return;
-
-    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
+    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     WindowSetLocation(imp, toWebCoreString(value));
 }
 
@@ -194,18 +227,42 @@ ACCESSOR_SETTER(DOMWindowOpener)
     info.This()->Set(name, value);
 }
 
+#if ENABLE(VIDEO)
+
+ACCESSOR_GETTER(DOMWindowAudio)
+{
+    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    return V8DOMWrapper::getConstructor(V8ClassIndex::AUDIO, window);
+}
+
+#endif
+
+ACCESSOR_GETTER(DOMWindowImage)
+{
+    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    return V8DOMWrapper::getConstructor(V8ClassIndex::IMAGE, window);
+}
+
+ACCESSOR_GETTER(DOMWindowOption)
+{
+    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    return V8DOMWrapper::getConstructor(V8ClassIndex::OPTION, window);
+}
+
 CALLBACK_FUNC_DECL(DOMWindowAddEventListener)
 {
     INC_STATS("DOM.DOMWindow.addEventListener()");
+
+    String eventType = toWebCoreString(args[0]);
+    bool useCapture = args[2]->BooleanValue();
+
     DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
 
     if (!V8Proxy::canAccessFrame(imp->frame(), true))
         return v8::Undefined();
 
-    if (!imp->frame())
-        return v8::Undefined();  // DOMWindow could be disconnected from the frame
-  
-    Document* doc = imp->frame()->document();
+    Document* doc = imp->document();
+
     if (!doc)
         return v8::Undefined();
 
@@ -214,12 +271,11 @@ CALLBACK_FUNC_DECL(DOMWindowAddEventListener)
     if (!proxy)
         return v8::Undefined();
 
-    RefPtr<EventListener> listener = proxy->eventListeners()->findOrCreateWrapper<V8EventListener>(proxy->frame(), args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(proxy, args[1], false, ListenerFindOrCreate);
 
     if (listener) {
-        String eventType = toWebCoreString(args[0]);
-        bool useCapture = args[2]->BooleanValue();
         imp->addEventListener(eventType, listener, useCapture);
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kDOMWindowEventListenerCacheIndex);
     }
 
     return v8::Undefined();
@@ -229,15 +285,17 @@ CALLBACK_FUNC_DECL(DOMWindowAddEventListener)
 CALLBACK_FUNC_DECL(DOMWindowRemoveEventListener)
 {
     INC_STATS("DOM.DOMWindow.removeEventListener()");
+
+    String eventType = toWebCoreString(args[0]);
+    bool useCapture = args[2]->BooleanValue();
+
     DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
 
     if (!V8Proxy::canAccessFrame(imp->frame(), true))
         return v8::Undefined();
 
-    if (!imp->frame())
-        return v8::Undefined();
+    Document* doc = imp->document();
 
-    Document* doc = imp->frame()->document();
     if (!doc)
         return v8::Undefined();
 
@@ -245,12 +303,11 @@ CALLBACK_FUNC_DECL(DOMWindowRemoveEventListener)
     if (!proxy)
         return v8::Undefined();
 
-    RefPtr<EventListener> listener = proxy->eventListeners()->findWrapper(args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(proxy, args[1], false, ListenerFindOnly);
 
     if (listener) {
-        String eventType = toWebCoreString(args[0]);
-        bool useCapture = args[2]->BooleanValue();
         imp->removeEventListener(eventType, listener.get(), useCapture);
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kDOMWindowEventListenerCacheIndex);
     }
 
     return v8::Undefined();
@@ -265,8 +322,8 @@ CALLBACK_FUNC_DECL(DOMWindowPostMessage)
     ASSERT(source->frame());
 
     v8::TryCatch tryCatch;
-    String message = toWebCoreString(args[0]);
-    MessagePort* port = 0;
+    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(toWebCoreString(args[0]));
+    MessagePortArray portArray;
     String targetOrigin;
 
     // This function has variable arguments and can either be:
@@ -274,8 +331,8 @@ CALLBACK_FUNC_DECL(DOMWindowPostMessage)
     // or
     //   postMessage(message, targetOrigin);
     if (args.Length() > 2) {
-        if (V8DOMWrapper::isWrapperOfType(args[1], V8ClassIndex::MESSAGEPORT))
-            port = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, v8::Handle<v8::Object>::Cast(args[1]));
+        if (!getMessagePortArray(args[1], portArray))
+            return v8::Undefined();
         targetOrigin = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
     } else {
         targetOrigin = toWebCoreStringWithNullOrUndefinedCheck(args[1]);
@@ -285,16 +342,18 @@ CALLBACK_FUNC_DECL(DOMWindowPostMessage)
         return v8::Undefined();
 
     ExceptionCode ec = 0;
-    window->postMessage(message, port, targetOrigin, source, ec);
-    if (ec)
-        V8Proxy::setDOMException(ec);
-
-    return v8::Undefined();
+    window->postMessage(message.release(), &portArray, targetOrigin, source, ec);
+    return throwError(ec);
 }
 
 CALLBACK_FUNC_DECL(DOMWindowAtob)
 {
     INC_STATS("DOM.DOMWindow.atob()");
+
+    if (args[0]->IsNull())
+        return v8String("");
+    String str = toWebCoreString(args[0]);
+
     DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
 
     if (!V8Proxy::canAccessFrame(imp->frame(), true))
@@ -303,16 +362,17 @@ CALLBACK_FUNC_DECL(DOMWindowAtob)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::SyntaxError);
 
-    if (args[0]->IsNull())
-        return v8String("");
-
-    String str = toWebCoreString(args[0]);
     return convertBase64(str, false);
 }
 
 CALLBACK_FUNC_DECL(DOMWindowBtoa)
 {
     INC_STATS("DOM.DOMWindow.btoa()");
+
+    if (args[0]->IsNull())
+        return v8String("");
+    String str = toWebCoreString(args[0]);
+
     DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
 
     if (!V8Proxy::canAccessFrame(imp->frame(), true))
@@ -321,10 +381,6 @@ CALLBACK_FUNC_DECL(DOMWindowBtoa)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::SyntaxError);
 
-    if (args[0]->IsNull())
-        return v8String("");
-
-    String str = toWebCoreString(args[0]);
     return convertBase64(str, true);
 }
 
@@ -335,7 +391,10 @@ CALLBACK_FUNC_DECL(DOMWindowBtoa)
 CALLBACK_FUNC_DECL(DOMWindowToString)
 {
     INC_STATS("DOM.DOMWindow.toString()");
-    return args.This()->ObjectProtoToString();
+    v8::Handle<v8::Object> domWrapper = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, args.This());
+    if (domWrapper.IsEmpty())
+        return args.This()->ObjectProtoToString();
+    return domWrapper->ObjectProtoToString();
 }
 
 CALLBACK_FUNC_DECL(DOMWindowNOP)
@@ -344,84 +403,6 @@ CALLBACK_FUNC_DECL(DOMWindowNOP)
     return v8::Undefined();
 }
 
-static String eventNameFromAttributeName(const String& name)
-{
-    ASSERT(name.startsWith("on"));
-    String eventType = name.substring(2);
-
-    if (eventType.startsWith("w")) {
-        switch(eventType[eventType.length() - 1]) {
-        case 't':
-            eventType = "webkitAnimationStart";
-            break;
-        case 'n':
-            eventType = "webkitAnimationIteration";
-            break;
-        case 'd':
-            ASSERT(eventType.length() > 7);
-            if (eventType[7] == 'a')
-                eventType = "webkitAnimationEnd";
-            else
-                eventType = "webkitTransitionEnd";
-            break;
-        }
-    }
-
-    return eventType;
-}
-
-ACCESSOR_SETTER(DOMWindowEventHandler)
-{
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
-    if (holder.IsEmpty())
-        return;
-
-    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
-    if (!imp->frame())
-        return;
-
-    Document* doc = imp->frame()->document();
-    if (!doc)
-        return;
-
-    String key = toWebCoreString(name);
-    String eventType = eventNameFromAttributeName(key);
-
-    if (value->IsNull()) {
-        // Clear the event listener
-        imp->clearAttributeEventListener(eventType);
-    } else {
-        V8Proxy* proxy = V8Proxy::retrieve(imp->frame());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->eventListeners()->findOrCreateWrapper<V8EventListener>(proxy->frame(), value, true);
-        if (listener)
-            imp->setAttributeEventListener(eventType, listener);
-    }
-}
-
-ACCESSOR_GETTER(DOMWindowEventHandler)
-{
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
-    if (holder.IsEmpty())
-        return v8::Undefined();
-
-    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
-    if (!imp->frame())
-        return v8::Undefined();
-
-    Document* doc = imp->frame()->document();
-    if (!doc)
-        return v8::Undefined();
-
-    String key = toWebCoreString(name);
-    String eventType = eventNameFromAttributeName(key);
-
-    EventListener* listener = imp->getAttributeEventListener(eventType);
-    return V8DOMWrapper::convertEventListenerToV8Object(listener);
-}
-
 static bool canShowModalDialogNow(const Frame* frame)
 {
     // A frame can out live its page. See bug 1219613.
@@ -512,7 +493,7 @@ static Frame* createWindow(Frame* callingFrame,
         return 0;
 
     newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
+    newFrame->page()->setOpenedByDOM();
 
     // Set dialog arguments on the global object of the new frame.
     if (!dialogArgs.IsEmpty()) {
@@ -525,13 +506,13 @@ static Frame* createWindow(Frame* callingFrame,
 
     if (protocolIsJavaScript(url) || ScriptController::isSafeScript(newFrame)) {
         KURL completedUrl =
-            url.isEmpty() ? KURL("") : completeURL(url);
+            url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(url);
         bool userGesture = processingUserGesture();
 
         if (created)
             newFrame->loader()->changeLocation(completedUrl, referrer, false, false, userGesture);
         else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedUrl.string(), referrer, false, userGesture);
+            newFrame->redirectScheduler()->scheduleLocationChange(completedUrl.string(), referrer, false, userGesture);
     }
 
     return newFrame;
@@ -542,11 +523,16 @@ static Frame* createWindow(Frame* callingFrame,
 CALLBACK_FUNC_DECL(DOMWindowShowModalDialog)
 {
     INC_STATS("DOM.DOMWindow.showModalDialog()");
+
+    String url = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
+    v8::Local<v8::Value> dialogArgs = args[1];
+    String featureArgs = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
+
     DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(
         V8ClassIndex::DOMWINDOW, args.Holder());
     Frame* frame = window->frame();
 
-    if (!frame || !V8Proxy::canAccessFrame(frame, true)) 
+    if (!V8Proxy::canAccessFrame(frame, true))
         return v8::Undefined();
 
     Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
@@ -560,10 +546,6 @@ CALLBACK_FUNC_DECL(DOMWindowShowModalDialog)
     if (!canShowModalDialogNow(frame) || !allowPopUp())
         return v8::Undefined();
 
-    String url = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
-    v8::Local<v8::Value> dialogArgs = args[1];
-    String featureArgs = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
-
     const HashMap<String, String> features = parseModalDialogFeatures(featureArgs);
 
     const bool trusted = false;
@@ -631,10 +613,14 @@ CALLBACK_FUNC_DECL(DOMWindowShowModalDialog)
 CALLBACK_FUNC_DECL(DOMWindowOpen)
 {
     INC_STATS("DOM.DOMWindow.open()");
+
+    String urlString = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
+    AtomicString frameName = (args[1]->IsUndefined() || args[1]->IsNull()) ? "_blank" : AtomicString(toWebCoreString(args[1]));
+
     DOMWindow* parent = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
     Frame* frame = parent->frame();
 
-    if (!frame || !V8Proxy::canAccessFrame(frame, true))
+    if (!V8Proxy::canAccessFrame(frame, true))
         return v8::Undefined();
 
     Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
@@ -649,9 +635,6 @@ CALLBACK_FUNC_DECL(DOMWindowOpen)
     if (!page)
         return v8::Undefined();
 
-    String urlString = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
-    AtomicString frameName = (args[1]->IsUndefined() || args[1]->IsNull()) ? "_blank" : AtomicString(toWebCoreString(args[1]));
-
     // Because FrameTree::find() returns true for empty strings, we must check
     // for empty framenames. Otherwise, illegitimate window.open() calls with
     // no name will pass right through the popup blocker.
@@ -687,7 +670,7 @@ CALLBACK_FUNC_DECL(DOMWindowOpen)
             // the outgoingReferrer.  We replicate that behavior here.
             String referrer = enteredFrame->loader()->outgoingReferrer();
 
-            frame->loader()->scheduleLocationChange(completedUrl, referrer, false, userGesture);
+            frame->redirectScheduler()->scheduleLocationChange(completedUrl, referrer, false, userGesture);
         }
         return V8DOMWrapper::convertToV8Object(V8ClassIndex::DOMWINDOW, frame->domWindow());
     }
@@ -756,11 +739,8 @@ CALLBACK_FUNC_DECL(DOMWindowOpen)
 INDEXED_PROPERTY_GETTER(DOMWindow)
 {
     INC_STATS("DOM.DOMWindow.IndexedPropertyGetter");
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
-    if (holder.IsEmpty())
-        return notHandledByInterceptor();
 
-    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
+    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     if (!window)
         return notHandledByInterceptor();
 
@@ -780,11 +760,8 @@ NAMED_PROPERTY_GETTER(DOMWindow)
 {
     INC_STATS("DOM.DOMWindow.NamedPropertyGetter");
 
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
-    if (holder.IsEmpty())
-        return notHandledByInterceptor();
-
-    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
+    // TODO(antonm): investigate what convertToNativeObject does for the case of DOMWINDOW.
+    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     if (!window)
         return notHandledByInterceptor();
 
@@ -800,12 +777,13 @@ NAMED_PROPERTY_GETTER(DOMWindow)
         return V8DOMWrapper::convertToV8Object(V8ClassIndex::DOMWINDOW, child->domWindow());
 
     // Search IDL functions defined in the prototype
-    v8::Handle<v8::Value> result = holder->GetRealNamedPropertyInPrototypeChain(name);
+    v8::Handle<v8::Value> result = info.Holder()->GetRealNamedProperty(name);
     if (!result.IsEmpty())
         return result;
 
     // Search named items in the document.
     Document* doc = frame->document();
+
     if (doc) {
         RefPtr<HTMLCollection> items = doc->windowNamedItems(propName);
         if (items->length() >= 1) {
@@ -826,13 +804,13 @@ void V8Custom::WindowSetLocation(DOMWindow* window, const String& relativeURL)
     if (!frame)
         return;
 
-    if (!shouldAllowNavigation(frame))
-        return;
-
     KURL url = completeURL(relativeURL);
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(frame))
+        return;
+
     navigateIfAllowed(frame, url, false, false);
 }
 
@@ -853,12 +831,15 @@ CALLBACK_FUNC_DECL(DOMWindowSetInterval)
 
 void V8Custom::ClearTimeoutImpl(const v8::Arguments& args)
 {
+    int handle = toInt32(args[0]);
+
     v8::Handle<v8::Object> holder = args.Holder();
     DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
     if (!V8Proxy::canAccessFrame(imp->frame(), true))
         return;
-    ScriptExecutionContext* context = static_cast<ScriptExecutionContext*>(imp->frame()->document());
-    int handle = toInt32(args[0]);
+    ScriptExecutionContext* context = static_cast<ScriptExecutionContext*>(imp->document());
+    if (!context)
+        return;
     DOMTimer::removeById(context, handle);
 }
 
diff --git a/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp b/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp
index cdcef31..9ddd620 100644
--- a/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp
@@ -87,10 +87,8 @@ CALLBACK_FUNC_DECL(DatabaseChangeVersion)
     return v8::Undefined();
 }
 
-CALLBACK_FUNC_DECL(DatabaseTransaction)
+static v8::Handle<v8::Value> createTransaction(const v8::Arguments& args, bool readOnly)
 {
-    INC_STATS("DOM.Database.transaction()");
-
     if (!args.Length())
         return throwError("Transaction callback is required.", V8Proxy::SyntaxError);
 
@@ -121,12 +119,22 @@ CALLBACK_FUNC_DECL(DatabaseTransaction)
         successCallback = V8CustomVoidCallback::create(args[2], frame);
     }
 
-    database->transaction(callback.release(), errorCallback.release(), successCallback.release());
-
+    database->transaction(callback.release(), errorCallback.release(), successCallback.release(), readOnly);
     return v8::Undefined();
 }
 
+CALLBACK_FUNC_DECL(DatabaseTransaction)
+{
+    INC_STATS("DOM.Database.transaction()");
+    return createTransaction(args, false);
+}
+
+CALLBACK_FUNC_DECL(DatabaseReadTransaction)
+{
+    INC_STATS("DOM.Database.readTransaction()");
+    return createTransaction(args, true);
+}
+
 } // namespace WebCore
 
 #endif
-
diff --git a/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
index f13e45e..263c005 100644
--- a/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
@@ -35,48 +35,26 @@
 #include "WorkerContextExecutionProxy.h"
 
 #include "DedicatedWorkerContext.h"
+#include "V8Binding.h"
+#include "V8MessagePortCustom.h"
 #include "V8Proxy.h"
 #include "V8WorkerContextEventListener.h"
 
 namespace WebCore {
 
-ACCESSOR_GETTER(DedicatedWorkerContextOnmessage)
+CALLBACK_FUNC_DECL(DedicatedWorkerContextPostMessage)
 {
-    INC_STATS(L"DOM.DedicatedWorkerContext.onmessage._get");
-    DedicatedWorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<DedicatedWorkerContext>(V8ClassIndex::DEDICATEDWORKERCONTEXT, info.Holder());
-    if (workerContext->onmessage()) {
-        V8WorkerContextEventListener* listener = static_cast<V8WorkerContextEventListener*>(workerContext->onmessage());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Undefined();
-}
-
-ACCESSOR_SETTER(DedicatedWorkerContextOnmessage)
-{
-    INC_STATS(L"DOM.DedicatedWorkerContext.onmessage._set");
-    DedicatedWorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<DedicatedWorkerContext>(V8ClassIndex::DEDICATEDWORKERCONTEXT, info.Holder());
-    V8WorkerContextEventListener* oldListener = static_cast<V8WorkerContextEventListener*>(workerContext->onmessage());
-    if (value->IsNull()) {
-        if (workerContext->onmessage()) {
-            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kDedicatedWorkerContextRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        workerContext->setOnmessage(0);
-    } else {
-        RefPtr<V8EventListener> listener = workerContext->script()->proxy()->findOrCreateEventListener(v8::Local<v8::Object>::Cast(value), false, false);
-        if (listener) {
-            if (oldListener) {
-                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kDedicatedWorkerContextRequestCacheIndex);
-            }
-
-            workerContext->setOnmessage(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kDedicatedWorkerContextRequestCacheIndex);
-        }
+    INC_STATS(L"DOM.DedicatedWorkerContext.postMessage");
+    DedicatedWorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<DedicatedWorkerContext>(V8ClassIndex::DEDICATEDWORKERCONTEXT, args.Holder());
+    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(v8ValueToWebCoreString(args[0]));
+    MessagePortArray portArray;
+    if (args.Length() > 1) {
+        if (!getMessagePortArray(args[1], portArray))
+            return v8::Undefined();
     }
+    ExceptionCode ec = 0;
+    workerContext->postMessage(message.release(), &portArray, ec);
+    return throwError(ec);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
index 80d204b..8b77a3a 100644
--- a/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
@@ -31,10 +31,12 @@
 #include "config.h"
 #include "Document.h"
 
+#include "CanvasRenderingContext.h"
 #include "ExceptionCode.h"
 #include "Node.h"
 #include "XPathNSResolver.h"
 #include "XPathResult.h"
+#include "CanvasRenderingContext.h"
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
@@ -62,12 +64,8 @@ CALLBACK_FUNC_DECL(DocumentEvaluate)
     if (V8Node::HasInstance(args[1]))
         contextNode = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[1]));
 
-    RefPtr<XPathNSResolver> resolver;
-    if (V8XPathNSResolver::HasInstance(args[2]))
-        resolver = V8DOMWrapper::convertToNativeObject<XPathNSResolver>(V8ClassIndex::XPATHNSRESOLVER, v8::Handle<v8::Object>::Cast(args[2]));
-    else if (args[2]->IsObject())
-        resolver = V8CustomXPathNSResolver::create(args[2]->ToObject());
-    else if (!args[2]->IsNull() && !args[2]->IsUndefined())
+    RefPtr<XPathNSResolver> resolver = V8DOMWrapper::getXPathNSResolver(args[2]);
+    if (!resolver && !args[2]->IsNull() && !args[2]->IsUndefined())
         return throwError(TYPE_MISMATCH_ERR);
 
     int type = toInt32(args[3]);
@@ -99,8 +97,17 @@ CALLBACK_FUNC_DECL(DocumentGetCSSCanvasContext)
     String name = toWebCoreString(args[1]);
     int width = toInt32(args[2]);
     int height = toInt32(args[3]);
-    CanvasRenderingContext2D* result = imp->getCSSCanvasContext(contextId, name, width, height);
-    return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
+    CanvasRenderingContext* result = imp->getCSSCanvasContext(contextId, name, width, height);
+    if (!result)
+        return v8::Undefined();
+    if (result->is2d())
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
+#if ENABLE(3D_CANVAS)
+    else if (result->is3d())
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT3D, result);
+#endif // ENABLE(3D_CANVAS)
+    ASSERT_NOT_REACHED();
+    return v8::Undefined();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8FileListCustom.cpp b/WebCore/bindings/v8/custom/V8FileListCustom.cpp
new file mode 100644
index 0000000..bc533cf
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8FileListCustom.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FileList.h"
+
+#include "File.h"
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+INDEXED_PROPERTY_GETTER(FileList)
+{
+    INC_STATS("DOM.FileList.IndexedPropertyGetter");
+    FileList* fileList = V8DOMWrapper::convertToNativeObject<FileList>(V8ClassIndex::FILELIST, info.Holder());
+    RefPtr<File> file = fileList->item(index);
+    if (!file)
+        return notHandledByInterceptor();
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::FILE, file.release());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp b/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp
index 6f9b761..c735c49 100644
--- a/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp
@@ -29,8 +29,9 @@
  */
 
 #include "config.h"
-#include "HTMLAudioElement.h"
+#include "V8HTMLAudioElementConstructor.h"
 
+#include "HTMLAudioElement.h"
 #include "Document.h"
 #include "Frame.h"
 #include "HTMLNames.h"
@@ -42,6 +43,24 @@
 
 namespace WebCore {
 
+v8::Persistent<v8::FunctionTemplate> V8HTMLAudioElementConstructor::GetTemplate()
+{
+    static v8::Persistent<v8::FunctionTemplate> cachedTemplate;
+    if (!cachedTemplate.IsEmpty())
+        return cachedTemplate;
+
+    v8::HandleScope scope;
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(USE_CALLBACK(HTMLAudioElementConstructor));
+
+    v8::Local<v8::ObjectTemplate> instance = result->InstanceTemplate();
+    instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+    result->SetClassName(v8::String::New("HTMLAudioElement"));
+    result->Inherit(V8DOMWrapper::getTemplate(V8ClassIndex::HTMLAUDIOELEMENT));
+
+    cachedTemplate = v8::Persistent<v8::FunctionTemplate>::New(result);
+    return cachedTemplate;
+}
+
 CALLBACK_FUNC_DECL(HTMLAudioElementConstructor)
 {
     INC_STATS("DOM.HTMLAudioElement.Contructor");
diff --git a/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.h
index dca3536..ac4b46d 100644..100755
--- a/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.h
@@ -28,23 +28,20 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
+#ifndef V8HTMLAudioElementConstructor_h
+#define V8HTMLAudioElementConstructor_h
 
-#if ENABLE(SHARED_WORKERS)
-
-#include "JSSharedWorkerContext.h"
-
-using namespace JSC;
+#include <v8.h>
 
 namespace WebCore {
 
-void JSSharedWorkerContext::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
+class V8HTMLAudioElementConstructor {
+private:
+    static v8::Persistent<v8::FunctionTemplate> GetTemplate();
 
-    markIfNotNull(markStack, impl()->onconnect());
-}
+    friend class V8ClassIndex;
+};
 
-} // namespace WebCore
+}
 
-#endif // ENABLE(SHARED_WORKERS)
+#endif // V8HTMLAudioElementConstructor_h
diff --git a/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index 6ba9367..4116673 100644
--- a/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -30,7 +30,9 @@
 
 #include "config.h"
 #include "HTMLCanvasElement.h"
+#include "CanvasRenderingContext.h"
 
+#include "CanvasRenderingContext.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8Node.h"
@@ -44,8 +46,17 @@ CALLBACK_FUNC_DECL(HTMLCanvasElementGetContext)
     v8::Handle<v8::Object> holder = args.Holder();
     HTMLCanvasElement* imp = V8DOMWrapper::convertDOMWrapperToNode<HTMLCanvasElement>(holder);
     String contextId = toWebCoreString(args[0]);
-    CanvasRenderingContext2D* result = imp->getContext(contextId);
-    return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
+    CanvasRenderingContext* result = imp->getContext(contextId);
+    if (!result)
+        return v8::Undefined();
+    if (result->is2d())
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
+#if ENABLE(3D_CANVAS)
+    else if (result->is3d())
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT3D, result);
+#endif
+    ASSERT_NOT_REACHED();
+    return v8::Undefined();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
index 4f865dd..2f55758 100644
--- a/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
@@ -30,6 +30,7 @@
 
 #include "config.h"
 #include "HTMLFrameElement.h"
+#include "HTMLNames.h"
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
@@ -37,6 +38,8 @@
 
 namespace WebCore {
 
+using namespace HTMLNames; 
+
 ACCESSOR_SETTER(HTMLFrameElementSrc)
 {
     HTMLFrameElement* frame = V8DOMWrapper::convertDOMWrapperToNode<HTMLFrameElement>(info.Holder());
@@ -45,7 +48,7 @@ ACCESSOR_SETTER(HTMLFrameElementSrc)
     if (!allowSettingFrameSrcToJavascriptUrl(frame, srcValue))
         return;
 
-    frame->setSrc(srcValue);
+    frame->setAttribute(srcAttr, srcValue); 
 }
 
 ACCESSOR_SETTER(HTMLFrameElementLocation)
diff --git a/WebCore/bindings/v8/custom/V8HTMLIFrameElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLIFrameElementCustom.cpp
index ce2c29a..a4863e8 100644
--- a/WebCore/bindings/v8/custom/V8HTMLIFrameElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLIFrameElementCustom.cpp
@@ -30,6 +30,7 @@
 
 #include "config.h"
 #include "HTMLIFrameElement.h"
+#include "HTMLNames.h" 
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
@@ -37,6 +38,8 @@
 
 namespace WebCore {
 
+using namespace HTMLNames; 
+
 ACCESSOR_SETTER(HTMLIFrameElementSrc)
 {
     HTMLIFrameElement* iframe = V8DOMWrapper::convertDOMWrapperToNode<HTMLIFrameElement>(info.Holder());
@@ -45,7 +48,7 @@ ACCESSOR_SETTER(HTMLIFrameElementSrc)
     if (!allowSettingFrameSrcToJavascriptUrl(iframe, v))
         return;
 
-    iframe->setSrc(v);
+    iframe->setAttribute(srcAttr, v); 
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp b/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
index 91ebd5f..71c99cf 100644
--- a/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
@@ -29,8 +29,9 @@
  */
 
 #include "config.h"
-#include "HTMLImageElement.h"
+#include "V8HTMLImageElementConstructor.h"
 
+#include "HTMLImageElement.h"
 #include "Document.h"
 #include "Frame.h"
 #include "HTMLNames.h"
@@ -42,6 +43,24 @@
 
 namespace WebCore {
 
+v8::Persistent<v8::FunctionTemplate> V8HTMLImageElementConstructor::GetTemplate()
+{
+    static v8::Persistent<v8::FunctionTemplate> cachedTemplate;
+    if (!cachedTemplate.IsEmpty())
+        return cachedTemplate;
+
+    v8::HandleScope scope;
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(USE_CALLBACK(HTMLImageElementConstructor));
+
+    v8::Local<v8::ObjectTemplate> instance = result->InstanceTemplate();
+    instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+    result->SetClassName(v8::String::New("HTMLImageElement"));
+    result->Inherit(V8DOMWrapper::getTemplate(V8ClassIndex::HTMLIMAGEELEMENT));
+
+    cachedTemplate = v8::Persistent<v8::FunctionTemplate>::New(result);
+    return cachedTemplate;
+}
+
 CALLBACK_FUNC_DECL(HTMLImageElementConstructor)
 {
     INC_STATS("DOM.HTMLImageElement.Contructor");
diff --git a/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.h b/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.h
new file mode 100755
index 0000000..cdce0e0
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8HTMLImageElementConstructor_h
+#define V8HTMLImageElementConstructor_h
+
+#include <v8.h>
+
+namespace WebCore {
+
+    class V8HTMLImageElementConstructor {
+    private:
+        static v8::Persistent<v8::FunctionTemplate> GetTemplate();
+
+        friend class V8ClassIndex;
+    };
+
+}
+
+#endif // V8HTMLImageElementConstructor_h
diff --git a/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp b/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp
index c22d127..f9c9cb4 100644
--- a/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp
@@ -29,8 +29,9 @@
  */
 
 #include "config.h"
-#include "HTMLOptionElement.h"
+#include "V8HTMLOptionElementConstructor.h"
 
+#include "HTMLOptionElement.h"
 #include "Document.h"
 #include "Frame.h"
 #include "HTMLNames.h"
@@ -43,6 +44,24 @@
 
 namespace WebCore {
 
+v8::Persistent<v8::FunctionTemplate> V8HTMLOptionElementConstructor::GetTemplate()
+{
+    static v8::Persistent<v8::FunctionTemplate> cachedTemplate;
+    if (!cachedTemplate.IsEmpty())
+        return cachedTemplate;
+
+    v8::HandleScope scope;
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(USE_CALLBACK(HTMLOptionElementConstructor));
+
+    v8::Local<v8::ObjectTemplate> instance = result->InstanceTemplate();
+    instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+    result->SetClassName(v8::String::New("HTMLOptionElement"));
+    result->Inherit(V8DOMWrapper::getTemplate(V8ClassIndex::HTMLOPTIONELEMENT));
+
+    cachedTemplate = v8::Persistent<v8::FunctionTemplate>::New(result);
+    return cachedTemplate;
+}
+
 CALLBACK_FUNC_DECL(HTMLOptionElementConstructor)
 {
     INC_STATS("DOM.HTMLOptionElement.Contructor");
diff --git a/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.h b/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.h
new file mode 100755
index 0000000..70076a5
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8HTMLOptionElementConstructor_h
+#define V8HTMLOptionElementConstructor_h
+
+#include <v8.h>
+
+namespace WebCore {
+
+    class V8HTMLOptionElementConstructor {
+    private:
+        static v8::Persistent<v8::FunctionTemplate> GetTemplate();
+
+        friend class V8ClassIndex;
+    };
+
+}
+
+#endif // V8HTMLOptionElementConstructor_h
diff --git a/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp b/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp
index 2571df4..ec9b034 100644
--- a/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "InspectorBackend.h"
 
+#include "Database.h"
 #include "DOMWindow.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -57,13 +58,8 @@ CALLBACK_FUNC_DECL(InspectorBackendHighlightDOMNode)
     if (args.Length() < 1)
         return v8::Undefined();
 
-    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
-    if (!node)
-        return v8::Undefined();
-
     InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    inspectorBackend->highlight(node);
-
+    inspectorBackend->highlight(args[0]->ToInt32()->Value());
     return v8::Undefined();
 }
 
@@ -107,11 +103,17 @@ CALLBACK_FUNC_DECL(InspectorBackendSearch)
 }
 
 #if ENABLE(DATABASE)
-CALLBACK_FUNC_DECL(InspectorBackendDatabaseTableNames)
+CALLBACK_FUNC_DECL(InspectorBackendDatabaseForId)
 {
-    INC_STATS("InspectorBackend.databaseTableNames()");
-    v8::Local<v8::Array> result = v8::Array::New(0);
-    return result;
+    INC_STATS("InspectorBackend.databaseForId()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    Database* database = inspectorBackend->databaseForId(args[0]->ToInt32()->Value());
+    if (!database)
+        return v8::Undefined();
+    return V8DOMWrapper::convertToV8Object<Database>(V8ClassIndex::DATABASE, database);
 }
 #endif
 
@@ -215,4 +217,90 @@ CALLBACK_FUNC_DECL(InspectorBackendWrapCallback)
     return args[0];
 }
 
+CALLBACK_FUNC_DECL(InspectorBackendNodeForId)
+{
+    INC_STATS("InspectorBackend.nodeForId()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    
+    Node* node = inspectorBackend->nodeForId(args[0]->ToInt32()->Value());
+    if (!node)
+        return v8::Undefined();
+
+    InspectorController* ic = inspectorBackend->inspectorController();
+    if (!ic)
+        return v8::Undefined();
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NODE, node);
+}
+
+CALLBACK_FUNC_DECL(InspectorBackendWrapObject)
+{
+    INC_STATS("InspectorBackend.wrapObject()");
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    return inspectorBackend->wrapObject(ScriptValue(args[0]), toWebCoreStringWithNullCheck(args[1])).v8Value();
+}
+
+CALLBACK_FUNC_DECL(InspectorBackendUnwrapObject)
+{
+    INC_STATS("InspectorBackend.unwrapObject()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    return inspectorBackend->unwrapObject(toWebCoreStringWithNullCheck(args[0])).v8Value();
+}
+
+CALLBACK_FUNC_DECL(InspectorBackendPushNodePathToFrontend)
+{
+    INC_STATS("InspectorBackend.pushNodePathToFrontend()");
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
+    bool selectInUI = args[1]->ToBoolean()->Value();
+    if (node)
+        return v8::Number::New(inspectorBackend->pushNodePathToFrontend(node, selectInUI));
+
+    return v8::Undefined();
+}
+
+#if ENABLE(DATABASE)
+CALLBACK_FUNC_DECL(InspectorBackendSelectDatabase)
+{
+    INC_STATS("InspectorBackend.selectDatabase()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    Database* database = V8DOMWrapper::convertToNativeObject<Database>(V8ClassIndex::DATABASE, v8::Handle<v8::Object>::Cast(args[0]));
+    if (database)
+        inspectorBackend->selectDatabase(database);
+
+    return v8::Undefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+CALLBACK_FUNC_DECL(InspectorBackendSelectDOMStorage)
+{
+    INC_STATS("InspectorBackend.selectDOMStorage()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    Storage* storage = V8DOMWrapper::convertToNativeObject<Storage>(V8ClassIndex::STORAGE, v8::Handle<v8::Object>::Cast(args[0]));
+    if (storage)
+        inspectorBackend->selectDOMStorage(storage);
+
+    return v8::Undefined();
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8LocationCustom.cpp b/WebCore/bindings/v8/custom/V8LocationCustom.cpp
index 3f3ff6b..1ed4c51 100644
--- a/WebCore/bindings/v8/custom/V8LocationCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8LocationCustom.cpp
@@ -128,13 +128,13 @@ ACCESSOR_SETTER(LocationHref)
     if (!frame)
         return;
 
-    if (!shouldAllowNavigation(frame))
-        return;
-
     KURL url = completeURL(toWebCoreString(value));
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(frame))
+        return;
+
     navigateIfAllowed(frame, url, false, false);
 }
 
@@ -274,7 +274,7 @@ CALLBACK_FUNC_DECL(LocationReload)
         return v8::Undefined();
 
     if (!protocolIsJavaScript(frame->loader()->url()))
-        frame->loader()->scheduleRefresh(processingUserGesture());
+        frame->redirectScheduler()->scheduleRefresh(processingUserGesture());
     return v8::Undefined();
 }
 
@@ -288,13 +288,13 @@ CALLBACK_FUNC_DECL(LocationReplace)
     if (!frame)
         return v8::Undefined();
 
-    if (!shouldAllowNavigation(frame))
-        return v8::Undefined();
-
     KURL url = completeURL(toWebCoreString(args[0]));
     if (url.isNull())
         return v8::Undefined();
 
+    if (!shouldAllowNavigation(frame))
+        return v8::Undefined();
+
     navigateIfAllowed(frame, url, true, true);
     return v8::Undefined();
 }
@@ -309,13 +309,13 @@ CALLBACK_FUNC_DECL(LocationAssign)
     if (!frame)
         return v8::Undefined();
 
-    if (!shouldAllowNavigation(frame))
-        return v8::Undefined();
-
     KURL url = completeURL(toWebCoreString(args[0]));
     if (url.isNull())
         return v8::Undefined();
 
+    if (!shouldAllowNavigation(frame))
+        return v8::Undefined();
+
     navigateIfAllowed(frame, url, false, false);
     return v8::Undefined();
 }
diff --git a/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp b/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
index f45aecf..ca02b16 100644
--- a/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
@@ -36,6 +36,7 @@
 
 #include "Document.h"
 #include "Frame.h"
+#include "V8Utilities.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 
@@ -52,16 +53,9 @@ CALLBACK_FUNC_DECL(MessageChannelConstructor)
         return throwError("DOM object constructor cannot be called as a function.");
 
     // Get the ScriptExecutionContext (WorkerContext or Document)
-    ScriptExecutionContext* context = 0;
-    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
-    if (proxy)
-        context = proxy->workerContext();
-    else {
-        Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
-        if (!frame)
-            return v8::Undefined();
-        context = frame->document();
-    }
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return v8::Undefined();
 
     // Note: it's OK to let this RefPtr go out of scope because we also call
     // SetDOMWrapper(), which effectively holds a reference to obj.
diff --git a/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp b/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
new file mode 100644
index 0000000..c5af635
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MessageEvent.h"
+#include "SerializedScriptValue.h"
+
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8DOMWindow.h"
+#include "V8MessagePortCustom.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+ACCESSOR_GETTER(MessageEventPorts)
+{
+    INC_STATS("DOM.MessageEvent.ports");
+    MessageEvent* event = V8DOMWrapper::convertToNativeObject<MessageEvent>(V8ClassIndex::MESSAGEEVENT, info.Holder());
+
+    MessagePortArray* ports = event->ports();
+    if (!ports || ports->isEmpty())
+        return v8::Null();
+
+    v8::Local<v8::Array> portArray = v8::Array::New(ports->size());
+    for (size_t i = 0; i < ports->size(); ++i)
+        portArray->Set(v8::Integer::New(i), V8DOMWrapper::convertToV8Object(V8ClassIndex::MESSAGEPORT, (*ports)[i].get()));
+
+    return portArray;
+}
+
+CALLBACK_FUNC_DECL(MessageEventInitMessageEvent)
+{
+    INC_STATS("DOM.MessageEvent.initMessageEvent");
+    MessageEvent* event = V8DOMWrapper::convertToNativeObject<MessageEvent>(V8ClassIndex::MESSAGEEVENT, args.Holder());
+    String typeArg = v8ValueToWebCoreString(args[0]);
+    bool canBubbleArg = args[1]->BooleanValue();
+    bool cancelableArg = args[2]->BooleanValue();
+    RefPtr<SerializedScriptValue> dataArg = SerializedScriptValue::create(v8ValueToWebCoreString(args[3]));
+    String originArg = v8ValueToWebCoreString(args[4]);
+    String lastEventIdArg = v8ValueToWebCoreString(args[5]);
+    DOMWindow* sourceArg = V8DOMWindow::HasInstance(args[6]) ? V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, v8::Handle<v8::Object>::Cast(args[6])) : 0;
+    OwnPtr<MessagePortArray> portArray;
+
+    if (!isUndefinedOrNull(args[7])) {
+        portArray = new MessagePortArray();
+        if (!getMessagePortArray(args[7], *portArray))
+            return v8::Undefined();
+    }
+    event->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg.release(), originArg, lastEventIdArg, sourceArg, portArray.release());
+    return v8::Undefined();
+  }
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp b/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
index 95d248c..0d8631f 100644
--- a/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
@@ -32,66 +32,22 @@
 
 #include "ExceptionCode.h"
 #include "MessagePort.h"
+#include "SerializedScriptValue.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
+#include "V8MessagePortCustom.h"
+#include "V8MessagePort.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContextExecutionProxy.h"
 
 namespace WebCore {
 
-PassRefPtr<EventListener> getEventListener(MessagePort* messagePort, v8::Local<v8::Value> value, bool findOnly, bool createObjectEventListener)
-{
-    V8Proxy* proxy = V8Proxy::retrieve(messagePort->scriptExecutionContext());
-    if (proxy) {
-        V8EventListenerList* list = proxy->objectListeners();
-        return findOnly ? list->findWrapper(value, false) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-    }
-
-#if ENABLE(WORKERS)
-    WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
-    if (workerContextProxy)
-        return workerContextProxy->findOrCreateEventListenerHelper(value, false, findOnly, createObjectEventListener);
-#endif
-
-    return PassRefPtr<EventListener>();
-}
-
-ACCESSOR_GETTER(MessagePortOnmessage)
-{
-    INC_STATS("DOM.MessagePort.onmessage._get");
-    MessagePort* messagePort = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, info.Holder());
-    return V8DOMWrapper::convertEventListenerToV8Object(messagePort->onmessage());
-}
-
-ACCESSOR_SETTER(MessagePortOnmessage)
-{
-    INC_STATS("DOM.MessagePort.onmessage._set");
-    MessagePort* messagePort = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, info.Holder());
-    if (value->IsNull()) {
-        if (messagePort->onmessage()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(messagePort->onmessage());
-            removeHiddenDependency(info.Holder(), listener->getListenerObject(), V8Custom::kMessagePortRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        messagePort->setOnmessage(0);
-
-    } else {
-        RefPtr<EventListener> listener = getEventListener(messagePort, value, false, false);
-        if (listener) {
-            messagePort->setOnmessage(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kMessagePortRequestCacheIndex);
-        }
-    }
-}
-
 CALLBACK_FUNC_DECL(MessagePortAddEventListener)
 {
     INC_STATS("DOM.MessagePort.addEventListener()");
     MessagePort* messagePort = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, args.Holder());
-    RefPtr<EventListener> listener = getEventListener(messagePort, args[1], false, true);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(messagePort, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -106,7 +62,7 @@ CALLBACK_FUNC_DECL(MessagePortRemoveEventListener)
 {
     INC_STATS("DOM.MessagePort.removeEventListener()");
     MessagePort* messagePort = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, args.Holder());
-    RefPtr<EventListener> listener = getEventListener(messagePort, args[1], true, true);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(messagePort, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -118,4 +74,64 @@ CALLBACK_FUNC_DECL(MessagePortRemoveEventListener)
     return v8::Undefined();
 }
 
+CALLBACK_FUNC_DECL(MessagePortPostMessage)
+{
+    INC_STATS("DOM.MessagePort.postMessage");
+    MessagePort* messagePort = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, args.Holder());
+    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(toWebCoreString(args[0]));
+    MessagePortArray portArray;
+    if (args.Length() > 1) {
+        if (!getMessagePortArray(args[1], portArray))
+            return v8::Undefined();
+    }
+    ExceptionCode ec = 0;
+    messagePort->postMessage(message.release(), &portArray, ec);
+    return throwError(ec);
+}
+
+bool getMessagePortArray(v8::Local<v8::Value> value, MessagePortArray& portArray)
+{
+    if (isUndefinedOrNull(value)) {
+        portArray.resize(0);
+        return true;
+    }
+
+    if (!value->IsObject()) {
+        throwError("MessagePortArray argument must be an object");
+        return false;
+    }
+    uint32_t length = 0;
+    v8::Local<v8::Object> ports = v8::Local<v8::Object>::Cast(value);
+
+    if (value->IsArray()) {
+        v8::Local<v8::Array> array = v8::Local<v8::Array>::Cast(value);
+        length = array->Length();
+    } else {
+        // Sequence-type object - get the length attribute
+        v8::Local<v8::Value> sequenceLength = ports->Get(v8::String::New("length"));
+        if (!sequenceLength->IsNumber()) {
+            throwError("MessagePortArray argument has no length attribute");
+            return false;
+        }
+        length = sequenceLength->Uint32Value();
+    }
+    portArray.resize(length);
+
+    for (unsigned int i = 0; i < length; ++i) {
+        v8::Local<v8::Value> port = ports->Get(v8::Integer::New(i));
+        // Validation of non-null objects, per HTML5 spec 8.3.3.
+        if (isUndefinedOrNull(port)) {
+            throwError(INVALID_STATE_ERR);
+            return false;
+        }
+        // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
+        if (!V8MessagePort::HasInstance(port)) {
+            throwError("MessagePortArray argument must contain only MessagePorts");
+            return false;
+        }
+        portArray[i] = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, v8::Handle<v8::Object>::Cast(port));
+    }
+    return true;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8MessagePortCustom.h b/WebCore/bindings/v8/custom/V8MessagePortCustom.h
new file mode 100644
index 0000000..7ab502b
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8MessagePortCustom.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2008, 2009 Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8MessagePortCustom_h
+#define V8MessagePortCustom_h
+
+#include <v8.h>
+
+#include "MessagePort.h"
+
+namespace WebCore {
+
+    // Helper function which pulls the values out of a JS sequence and into a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec and generates exceptions as appropriate.
+    // Returns true if the array was filled, or false if the passed value was not of an appropriate type.
+    bool getMessagePortArray(v8::Local<v8::Value>, MessagePortArray&);
+
+} // namespace WebCore
+
+#endif // V8MessagePortCustom_h
diff --git a/WebCore/bindings/v8/custom/V8NodeCustom.cpp b/WebCore/bindings/v8/custom/V8NodeCustom.cpp
index 6b0d740..9b4b9aa 100644
--- a/WebCore/bindings/v8/custom/V8NodeCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8NodeCustom.cpp
@@ -39,76 +39,18 @@
 #include "V8CustomBinding.h"
 #include "V8CustomEventListener.h"
 #include "V8Node.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-static inline String toEventType(v8::Local<v8::String> value)
-{
-    String key = toWebCoreString(value);
-    ASSERT(key.startsWith("on"));
-    return key.substring(2);
-}
-
-static PassRefPtr<EventListener> getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, bool findOnly)
-{
-    V8Proxy* proxy = V8Proxy::retrieve(node->scriptExecutionContext());
-    // The document might be created using createDocument, which does
-    // not have a frame, use the active frame.
-    if (!proxy)
-        proxy = V8Proxy::retrieve(V8Proxy::retrieveFrameForEnteredContext());
-
-    if (proxy) {
-        V8EventListenerList* list = proxy->objectListeners();
-        return findOnly ? list->findWrapper(value, isAttribute) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, isAttribute);
-    }
-
-    return 0;
-}
-
-ACCESSOR_SETTER(NodeEventHandler)
-{
-    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(info.Holder());
-    String eventType = toEventType(name);
-
-    // Remove hidden dependency on the old event handler.
-    if (EventListener* listener = node->getAttributeEventListener(eventType)) {
-        if (static_cast<V8AbstractEventListener*>(listener)->isObjectListener()) {
-            v8::Local<v8::Object> v8Listener = static_cast<V8ObjectEventListener*>(listener)->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kNodeEventListenerCacheIndex);
-        }
-    }
-
-    // Set handler if the value is a function.
-    if (value->IsFunction()) {
-        RefPtr<EventListener> listener = getEventListener(node, value, true, false);
-        if (listener) {
-            node->setAttributeEventListener(eventType, listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kNodeEventListenerCacheIndex);
-        }
-    } else {
-        // Otherwise, clear the handler.
-        node->clearAttributeEventListener(eventType);
-    }
-}
-
-ACCESSOR_GETTER(NodeEventHandler)
-{
-    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(info.Holder());
-
-    EventListener* listener = node->getAttributeEventListener(toEventType(name));
-    return V8DOMWrapper::convertEventListenerToV8Object(listener);
-}
-
 CALLBACK_FUNC_DECL(NodeAddEventListener)
 {
     INC_STATS("DOM.Node.addEventListener()");
     Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(args.Holder());
 
-    RefPtr<EventListener> listener = getEventListener(node, args[1], false, false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(node, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -126,9 +68,9 @@ CALLBACK_FUNC_DECL(NodeRemoveEventListener)
     // It is possbile that the owner document of the node is detached
     // from the frame.
     // See issue http://b/878909
-    RefPtr<EventListener> listener = getEventListener(node, args[1], false, true);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(node, args[1], false, ListenerFindOnly);
     if (listener) {
-        String type = toWebCoreString(args[0]);
+        AtomicString type = v8ValueToAtomicWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
         node->removeEventListener(type, listener.get(), useCapture);
         removeHiddenDependency(args.Holder(), args[1], V8Custom::kNodeEventListenerCacheIndex);
diff --git a/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp b/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
new file mode 100644
index 0000000..bd5fb4a
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "NotImplemented.h"
+#include "Notification.h"
+#include "NotificationCenter.h"
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8CustomEventListener.h"
+#include "V8CustomVoidCallback.h"
+#include "V8Proxy.h"
+#include "V8Utilities.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(NotificationAddEventListener)
+{
+    INC_STATS("DOM.Notification.addEventListener()");
+    Notification* notification = V8DOMWrapper::convertToNativeObject<Notification>(V8ClassIndex::NOTIFICATION, args.Holder());
+
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(notification, args[1], false, ListenerFindOrCreate);
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        notification->addEventListener(type, listener, useCapture);
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kNotificationRequestCacheIndex);
+    }
+
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(NotificationRemoveEventListener)
+{
+    INC_STATS("DOM.Notification.removeEventListener()");
+    Notification* notification = V8DOMWrapper::convertToNativeObject<Notification>(V8ClassIndex::NOTIFICATION, args.Holder());
+
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(notification, args[1], false, ListenerFindOnly);
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        notification->removeEventListener(type, listener.get(), useCapture);
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kNotificationRequestCacheIndex);
+    }
+
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(NotificationCenterCreateHTMLNotification)
+{
+    INC_STATS(L"DOM.NotificationCenter.CreateHTMLNotification()");
+    NotificationCenter* notificationCenter = V8DOMWrapper::convertToNativeObject<NotificationCenter>(V8ClassIndex::NOTIFICATIONCENTER, args.Holder());
+    ScriptExecutionContext* context = notificationCenter->context();
+    ExceptionCode ec = 0;
+    String url = toWebCoreString(args[0]);
+    RefPtr<Notification> notification = Notification::create(url, context, ec, notificationCenter->presenter());
+
+    if (ec)
+        return throwError(ec);
+
+    if (context->isWorkerContext())
+        return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
+}
+
+CALLBACK_FUNC_DECL(NotificationCenterCreateNotification)
+{
+    INC_STATS(L"DOM.NotificationCenter.CreateNotification()");
+    NotificationCenter* notificationCenter = V8DOMWrapper::convertToNativeObject<NotificationCenter>(V8ClassIndex::NOTIFICATIONCENTER, args.Holder());
+    NotificationContents contents(toWebCoreString(args[0]), toWebCoreString(args[1]), toWebCoreString(args[2]));
+
+    ScriptExecutionContext* context = notificationCenter->context();
+    ExceptionCode ec = 0;
+    RefPtr<Notification> notification = Notification::create(contents, context, ec, notificationCenter->presenter());
+
+    if (ec)
+        return throwError(ec);
+
+    if (context->isWorkerContext())
+        return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
+}
+
+CALLBACK_FUNC_DECL(NotificationCenterRequestPermission)
+{
+    INC_STATS(L"DOM.NotificationCenter.RequestPermission()");
+    NotificationCenter* notificationCenter = V8DOMWrapper::convertToNativeObject<NotificationCenter>(V8ClassIndex::NOTIFICATIONCENTER, args.Holder());
+    ScriptExecutionContext* context = notificationCenter->context();
+
+    // Requesting permission is only valid from a page context.
+    if (context->isWorkerContext())
+        return throwError(NOT_SUPPORTED_ERR);
+
+    RefPtr<V8CustomVoidCallback> callback;
+    if (args.Length() > 0) {
+        if (!args[0]->IsObject())
+            return throwError("Callback must be of valid type.", V8Proxy::TypeError);
+ 
+        callback = V8CustomVoidCallback::create(args[0], V8Proxy::retrieveFrameForCurrentContext());
+    }
+
+    notificationCenter->requestPermission(callback.release());
+    return v8::Undefined();
+}
+
+
+}  // namespace WebCore
+
+#endif  // ENABLE(NOTIFICATIONS)
diff --git a/WebCore/bindings/v8/custom/V8SVGElementInstanceCustom.cpp b/WebCore/bindings/v8/custom/V8SVGElementInstanceCustom.cpp
index ce9c345..dff4ff4 100644
--- a/WebCore/bindings/v8/custom/V8SVGElementInstanceCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8SVGElementInstanceCustom.cpp
@@ -49,15 +49,12 @@ CALLBACK_FUNC_DECL(SVGElementInstanceAddEventListener)
     INC_STATS("DOM.SVGElementInstance.AddEventListener()");
     SVGElementInstance* instance = V8DOMWrapper::convertDOMWrapperToNative<SVGElementInstance>(args.Holder());
 
-    V8Proxy* proxy = V8Proxy::retrieve(instance->scriptExecutionContext());
-    if (!proxy)
-        return v8::Undefined();
-
-    RefPtr<EventListener> listener = proxy->eventListeners()->findOrCreateWrapper<V8EventListener>(proxy->frame(), args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(instance, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
         instance->addEventListener(type, listener, useCapture);
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kNodeEventListenerCacheIndex);
     }
 
     return v8::Undefined();
@@ -68,15 +65,12 @@ CALLBACK_FUNC_DECL(SVGElementInstanceRemoveEventListener)
     INC_STATS("DOM.SVGElementInstance.RemoveEventListener()");
     SVGElementInstance* instance = V8DOMWrapper::convertDOMWrapperToNative<SVGElementInstance>(args.Holder());
 
-    V8Proxy* proxy = V8Proxy::retrieve(instance->scriptExecutionContext());
-    if (!proxy)
-        return v8::Undefined();
-
-    RefPtr<EventListener> listener = proxy->eventListeners()->findWrapper(args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(instance, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
         instance->removeEventListener(type, listener.get(), useCapture);
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kNodeEventListenerCacheIndex);
     }
 
     return v8::Undefined();
diff --git a/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp b/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp
index 3ab2f8e..e470bc8 100644
--- a/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp
@@ -53,12 +53,15 @@ CALLBACK_FUNC_DECL(SharedWorkerConstructor)
     if (!args.IsConstructCall())
         return throwError("DOM object constructor cannot be called as a function.");
 
-    if (args.Length() < 2)
+    if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::SyntaxError);
 
     v8::TryCatch tryCatch;
     v8::Handle<v8::String> scriptUrl = args[0]->ToString();
-    v8::Handle<v8::String> name = args[1]->ToString();
+    String name;
+    if (args.Length() > 1)
+        name = toWebCoreString(args[1]->ToString());
+
     if (tryCatch.HasCaught())
         return throwError(tryCatch.Exception());
 
@@ -66,21 +69,14 @@ CALLBACK_FUNC_DECL(SharedWorkerConstructor)
         return v8::Undefined();
 
     // Get the script execution context.
-    ScriptExecutionContext* context = 0;
-    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
-    if (proxy)
-        context = proxy->workerContext();
-    else {
-        Frame* frame = V8Proxy::retrieveFrame();
-        if (!frame)
-            return v8::Undefined();
-        context = frame->document();
-    }
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return v8::Undefined();
 
     // Create the worker object.
     // Note: it's OK to let this RefPtr go out of scope because we also call SetDOMWrapper(), which effectively holds a reference to obj.
     ExceptionCode ec = 0;
-    RefPtr<SharedWorker> obj = SharedWorker::create(toWebCoreString(scriptUrl), toWebCoreString(name), context, ec);
+    RefPtr<SharedWorker> obj = SharedWorker::create(toWebCoreString(scriptUrl), name, context, ec);
 
     // Setup the standard wrapper object internal fields.
     v8::Handle<v8::Object> wrapperObject = args.Holder();
diff --git a/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp b/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
index dd19a88..b2a807d 100755
--- a/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
@@ -30,17 +30,38 @@
 
 #include "config.h"
 
+#include "V8Binding.h"
 #include "V8CustomBinding.h"
+#include "V8DOMWrapper.h"
 #include "V8Index.h"
 #include "V8Proxy.h"
 #include "WebKitPoint.h"
 
+#include <wtf/MathExtras.h>
+
 namespace WebCore {
 
 CALLBACK_FUNC_DECL(WebKitPointConstructor)
 {
     INC_STATS("DOM.WebKitPoint.Constructor");
-    return V8Proxy::constructDOMObject<V8ClassIndex::WEBKITPOINT, WebKitPoint>(args);
+    float x = 0;
+    float y = 0;
+    if (args.Length() > 1) {
+        if (!args[0]->IsUndefined()) {
+            x = toFloat(args[0]);
+            if (isnan(x))
+                x = 0;
+        }
+        if (!args[1]->IsUndefined()) {
+            y = toFloat(args[1]);
+            if (isnan(y))
+                y = 0;
+        }
+    }
+    PassRefPtr<WebKitPoint> point = WebKitPoint::create(x, y);
+    point->ref();
+    V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::WEBKITPOINT, point.get());
+    return args.Holder();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp b/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
new file mode 100644
index 0000000..f498e4f
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocket.h"
+
+#include "Frame.h"
+#include "Settings.h"
+#include "V8Binding.h"
+#include "V8Proxy.h"
+#include "V8Utilities.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
+
+namespace WebCore {
+
+// ??? AddEventListener, RemoveEventListener
+
+CALLBACK_FUNC_DECL(WebSocketConstructor)
+{
+    INC_STATS("DOM.WebSocket.Constructor");
+
+    if (!args.IsConstructCall())
+        return throwError("DOM object custructor cannot be called as a function.");
+    if (args.Length() == 0)
+        return throwError("Not enough arguments", V8Proxy::SyntaxError);
+
+    v8::TryCatch tryCatch;
+    v8::Handle<v8::String> urlstring = args[0]->ToString();
+    if (tryCatch.HasCaught())
+        return throwError(tryCatch.Exception());
+    if (urlstring.IsEmpty())
+        return throwError("Empty URL", V8Proxy::SyntaxError);
+
+    // Get the script execution context.
+    ScriptExecutionContext* context = 0;
+    // TODO: Workers
+    if (!context) {
+        Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
+        if (!frame)
+            return throwError("WebSocket constructor's associated frame is not available", V8Proxy::ReferenceError);
+        context = frame->document();
+    }
+
+    const KURL& url = context->completeURL(toWebCoreString(urlstring));
+
+    RefPtr<WebSocket> webSocket = WebSocket::create(context);
+    ExceptionCode ec = 0;
+
+    if (args.Length() < 2)
+        webSocket->connect(url, ec);
+    else {
+        v8::TryCatch tryCatchProtocol;
+        v8::Handle<v8::String> protocol = args[1]->ToString();
+        if (tryCatchProtocol.HasCaught())
+            return throwError(tryCatchProtocol.Exception());
+        webSocket->connect(url, toWebCoreString(protocol), ec);
+    }
+    if (ec)
+        return throwError(ec);
+
+    // Setup the standard wrapper object internal fields.
+    V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::WEBSOCKET), webSocket.get());
+
+    // Add object to the wrapper map.
+    webSocket->ref();
+    V8DOMWrapper::setJSWrapperForActiveDOMObject(webSocket.get(), v8::Persistent<v8::Object>::New(args.Holder()));
+
+    return args.Holder();
+}
+
+CALLBACK_FUNC_DECL(WebSocketSend)
+{
+    INC_STATS("DOM.WebSocket.send()");
+    WebSocket* webSocket = V8DOMWrapper::convertToNativeObject<WebSocket>(V8ClassIndex::WEBSOCKET, args.Holder());
+
+    ExceptionCode ec = 0;
+    bool ret = false;
+    if (args.Length() < 1)
+        return throwError("Not enough arguments", V8Proxy::SyntaxError);
+    else {
+        String msg = toWebCoreString(args[0]);
+        ret = webSocket->send(msg, ec);
+    }
+    if (ec)
+        return throwError(ec);
+    return v8Boolean(ret);
+}
+
+CALLBACK_FUNC_DECL(WebSocketClose)
+{
+    INC_STATS("DOM.WebSocket.close()");
+    WebSocket* webSocket = V8DOMWrapper::convertToNativeObject<WebSocket>(V8ClassIndex::WEBSOCKET, args.Holder());
+
+    webSocket->close();
+    return v8::Undefined();
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
diff --git a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
index b526040..21b3c30 100755
--- a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -52,45 +52,6 @@ ACCESSOR_GETTER(WorkerContextSelf)
     return WorkerContextExecutionProxy::convertWorkerContextToV8Object(workerContext);
 }
 
-ACCESSOR_GETTER(WorkerContextOnerror)
-{
-    INC_STATS(L"DOM.WorkerContext.onerror._get");
-    WorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
-    if (workerContext->onerror()) {
-        V8WorkerContextEventListener* listener = static_cast<V8WorkerContextEventListener*>(workerContext->onerror());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Undefined();
-}
-
-ACCESSOR_SETTER(WorkerContextOnerror)
-{
-    INC_STATS(L"DOM.WorkerContext.onerror._set");
-    WorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
-    V8WorkerContextEventListener* oldListener = static_cast<V8WorkerContextEventListener*>(workerContext->onerror());
-    if (value->IsNull()) {
-        if (workerContext->onerror()) {
-            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerContextRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        workerContext->setOnerror(0);
-    } else {
-        RefPtr<V8EventListener> listener = workerContext->script()->proxy()->findOrCreateEventListener(v8::Local<v8::Object>::Cast(value), true, false);
-        if (listener) {
-            if (oldListener) {
-                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerContextRequestCacheIndex);
-            }
-
-            workerContext->setOnerror(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kWorkerContextRequestCacheIndex);
-        }
-    }
-}
-
 v8::Handle<v8::Value> SetTimeoutOrInterval(const v8::Arguments& args, bool singleShot)
 {
     WorkerContext* workerContext = V8DOMWrapper::convertDOMWrapperToNative<WorkerContext>(args.Holder());
@@ -103,9 +64,10 @@ v8::Handle<v8::Value> SetTimeoutOrInterval(const v8::Arguments& args, bool singl
     int32_t timeout = argumentCount >= 2 ? args[1]->Int32Value() : 0;
     int timerId;
 
+    v8::Handle<v8::Context> v8Context = workerContext->script()->proxy()->context();
     if (function->IsString()) {
         WebCore::String stringFunction = toWebCoreString(function);
-        timerId = DOMTimer::install(workerContext, new ScheduledAction(stringFunction, workerContext->url()), timeout, singleShot);
+        timerId = DOMTimer::install(workerContext, new ScheduledAction(v8Context, stringFunction, workerContext->url()), timeout, singleShot);
     } else if (function->IsFunction()) {
         size_t paramCount = argumentCount >= 2 ? argumentCount - 2 : 0;
         v8::Local<v8::Value>* params = 0;
@@ -115,7 +77,7 @@ v8::Handle<v8::Value> SetTimeoutOrInterval(const v8::Arguments& args, bool singl
                 params[i] = args[i+2];
         }
         // ScheduledAction takes ownership of actual params and releases them in its destructor.
-        ScheduledAction* action = new ScheduledAction(v8::Handle<v8::Function>::Cast(function), paramCount, params);
+        ScheduledAction* action = new ScheduledAction(v8Context, v8::Handle<v8::Function>::Cast(function), paramCount, params);
         delete [] params;
         timerId = DOMTimer::install(workerContext, action, timeout, singleShot);
     } else
@@ -170,8 +132,7 @@ CALLBACK_FUNC_DECL(WorkerContextAddEventListener)
     INC_STATS(L"DOM.WorkerContext.addEventListener()");
     WorkerContext* workerContext = V8DOMWrapper::convertDOMWrapperToNative<WorkerContext>(args.Holder());
 
-    RefPtr<V8EventListener> listener = workerContext->script()->proxy()->findOrCreateEventListener(v8::Local<v8::Object>::Cast(args[1]), false, false);
-
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(workerContext, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -186,10 +147,8 @@ CALLBACK_FUNC_DECL(WorkerContextRemoveEventListener)
 {
     INC_STATS(L"DOM.WorkerContext.removeEventListener()");
     WorkerContext* workerContext = V8DOMWrapper::convertDOMWrapperToNative<WorkerContext>(args.Holder());
-    WorkerContextExecutionProxy* proxy = workerContext->script()->proxy();
-
-    RefPtr<V8EventListener> listener = proxy->findOrCreateEventListener(v8::Local<v8::Object>::Cast(args[1]), false, true);
 
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(workerContext, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -197,7 +156,6 @@ CALLBACK_FUNC_DECL(WorkerContextRemoveEventListener)
 
         removeHiddenDependency(args.Holder(), args[1], V8Custom::kWorkerContextRequestCacheIndex);
     }
-
     return v8::Undefined();
 }
 
diff --git a/WebCore/bindings/v8/custom/V8WorkerCustom.cpp b/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
index 32450b8..454e41f 100755
--- a/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
@@ -36,9 +36,10 @@
 
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "SerializedScriptValue.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
+#include "V8MessagePortCustom.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
@@ -65,16 +66,9 @@ CALLBACK_FUNC_DECL(WorkerConstructor)
         return v8::Undefined();
 
     // Get the script execution context.
-    ScriptExecutionContext* context = 0;
-    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
-    if (proxy)
-        context = proxy->workerContext();
-    else {
-        Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
-        if (!frame)
-            return v8::Undefined();
-        context = frame->document();
-    }
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return v8::Undefined();
 
     // Create the worker object.
     // Note: it's OK to let this RefPtr go out of scope because we also call setDOMWrapper(), which effectively holds a reference to obj.
@@ -93,60 +87,19 @@ CALLBACK_FUNC_DECL(WorkerConstructor)
     return wrapperObject;
 }
 
-PassRefPtr<EventListener> getEventListener(Worker* worker, v8::Local<v8::Value> value, bool isAttribute, bool findOnly)
-{
-    if (worker->scriptExecutionContext()->isWorkerContext()) {
-        WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
-        ASSERT(workerContextProxy);
-        return workerContextProxy->findOrCreateObjectEventListener(value, isAttribute, findOnly);
-    }
-
-    V8Proxy* proxy = V8Proxy::retrieve(worker->scriptExecutionContext());
-    if (proxy) {
-        V8EventListenerList* list = proxy->objectListeners();
-        return findOnly ? list->findWrapper(value, isAttribute) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, isAttribute);
-    }
-
-    return 0;
-}
-
-ACCESSOR_GETTER(WorkerOnmessage)
-{
-    INC_STATS(L"DOM.Worker.onmessage._get");
-    Worker* worker = V8DOMWrapper::convertToNativeObject<Worker>(V8ClassIndex::WORKER, info.Holder());
-    if (worker->onmessage()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(worker->onmessage());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Undefined();
-}
-
-ACCESSOR_SETTER(WorkerOnmessage)
+CALLBACK_FUNC_DECL(WorkerPostMessage)
 {
-    INC_STATS(L"DOM.Worker.onmessage._set");
-    Worker* worker = V8DOMWrapper::convertToNativeObject<Worker>(V8ClassIndex::WORKER, info.Holder());
-    V8ObjectEventListener* oldListener = static_cast<V8ObjectEventListener*>(worker->onmessage());
-    if (value->IsNull()) {
-        if (oldListener) {
-            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        worker->setOnmessage(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(worker, value, true, false);
-        if (listener) {
-            if (oldListener) {
-                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerRequestCacheIndex);
-            }
-
-            worker->setOnmessage(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kWorkerRequestCacheIndex);
-        }
+    INC_STATS("DOM.Worker.postMessage");
+    Worker* worker = V8DOMWrapper::convertToNativeObject<Worker>(V8ClassIndex::WORKER, args.Holder());
+    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(toWebCoreString(args[0]));
+    MessagePortArray portArray;
+    if (args.Length() > 1) {
+        if (!getMessagePortArray(args[1], portArray))
+            return v8::Undefined();
     }
+    ExceptionCode ec = 0;
+    worker->postMessage(message.release(), &portArray, ec);
+    return throwError(ec);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
index 02ce8e2..af647cd 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
@@ -33,8 +33,8 @@
 #include "Frame.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
+#include "V8Utilities.h"
 #include "XMLHttpRequest.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
@@ -50,20 +50,9 @@ CALLBACK_FUNC_DECL(XMLHttpRequestConstructor)
 
     // Expect no parameters.
     // Allocate a XMLHttpRequest object as its internal field.
-    ScriptExecutionContext* context = 0;
-#if ENABLE(WORKERS)
-    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
-    if (proxy)
-        context = proxy->workerContext();
-    else {
-#endif
-        Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
-        if (!frame)
-            return throwError("XMLHttpRequest constructor's associated frame is not available", V8Proxy::ReferenceError);
-        context = frame->document();
-#if ENABLE(WORKERS)
-    }
-#endif
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return throwError("XMLHttpRequest constructor's associated context is not available", V8Proxy::ReferenceError);
     RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(context);
     V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::XMLHTTPREQUEST), xmlHttpRequest.get());
 
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index 7204a61..39105de 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -33,10 +33,10 @@
 
 #include "Frame.h"
 #include "V8Binding.h"
-#include "V8Document.h"
 #include "V8CustomBinding.h"
+#include "V8Document.h"
+#include "V8File.h"
 #include "V8HTMLDocument.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
@@ -44,227 +44,6 @@
 
 namespace WebCore {
 
-static PassRefPtr<EventListener> getEventListener(XMLHttpRequest* xmlHttpRequest, v8::Local<v8::Value> value, bool findOnly)
-{
-#if ENABLE(WORKERS)
-    WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
-    if (workerContextProxy)
-        return workerContextProxy->findOrCreateObjectEventListener(value, false, findOnly);
-#endif
-
-    V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-    if (proxy) {
-        V8EventListenerList* list = proxy->objectListeners();
-        return findOnly ? list->findWrapper(value, false) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-    }
-
-    return PassRefPtr<EventListener>();
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnabort)
-{
-    INC_STATS("DOM.XMLHttpRequest.onabort._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onabort()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onabort());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnabort)
-{
-    INC_STATS("DOM.XMLHttpRequest.onabort._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onabort()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onabort());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequest->setOnabort(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnabort(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnerror)
-{
-    INC_STATS("DOM.XMLHttpRequest.onerror._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onerror()) {
-        RefPtr<V8ObjectEventListener> listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onerror());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnerror)
-{
-    INC_STATS("DOM.XMLHttpRequest.onerror._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onerror()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onerror());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequest->setOnerror(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnerror(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnload)
-{
-    INC_STATS("DOM.XMLHttpRequest.onload._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onload()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onload());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnload)
-{
-    INC_STATS("DOM.XMLHttpRequest.onload._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onload()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onload());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        xmlHttpRequest->setOnload(0);
-
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnload(listener.get());
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnloadstart)
-{
-    INC_STATS("DOM.XMLHttpRequest.onloadstart._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onloadstart()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onloadstart());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnloadstart)
-{
-    INC_STATS("DOM.XMLHttpRequest.onloadstart._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onloadstart()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onloadstart());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequest->setOnloadstart(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnloadstart(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnprogress)
-{
-    INC_STATS("DOM.XMLHttpRequest.onprogress._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onprogress()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onprogress());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnprogress)
-{
-    INC_STATS("DOM.XMLHttpRequest.onprogress._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onprogress()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onprogress());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequest->setOnprogress(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnprogress(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnreadystatechange)
-{
-    INC_STATS("DOM.XMLHttpRequest.onreadystatechange._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onreadystatechange()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onreadystatechange());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnreadystatechange)
-{
-    INC_STATS("DOM.XMLHttpRequest.onreadystatechange._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onreadystatechange()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onreadystatechange());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequest->setOnreadystatechange(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnreadystatechange(listener.get());
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
 ACCESSOR_GETTER(XMLHttpRequestResponseText)
 {
     // FIXME: This is only needed because webkit set this getter as custom.
@@ -279,7 +58,7 @@ CALLBACK_FUNC_DECL(XMLHttpRequestAddEventListener)
     INC_STATS("DOM.XMLHttpRequest.addEventListener()");
     XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, args.Holder());
 
-    RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(xmlHttpRequest, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -295,7 +74,7 @@ CALLBACK_FUNC_DECL(XMLHttpRequestRemoveEventListener)
     INC_STATS("DOM.XMLHttpRequest.removeEventListener()");
     XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, args.Holder());
 
-    RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, args[1], true);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(xmlHttpRequest, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -323,22 +102,9 @@ CALLBACK_FUNC_DECL(XMLHttpRequestOpen)
 
     String method = toWebCoreString(args[0]);
     String urlstring = toWebCoreString(args[1]);
-    ScriptExecutionContext* context = 0;
-#if ENABLE(WORKERS)
-    WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
-    if (workerContextProxy) {
-        context = workerContextProxy->workerContext();
-        ASSERT(context);
-    }
-#endif
-
-    if (!context) {
-        V8Proxy* proxy = V8Proxy::retrieve();
-        if (!proxy)
-            return v8::Undefined();
-        context = proxy->frame()->document();
-        ASSERT(context);
-    }
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return v8::Undefined();
 
     KURL url = context->completeURL(urlstring);
 
@@ -379,12 +145,16 @@ CALLBACK_FUNC_DECL(XMLHttpRequestSend)
         xmlHttpRequest->send(ec);
     else {
         v8::Handle<v8::Value> arg = args[0];
-        // FIXME: upstream handles "File" objects too.
         if (IsDocumentType(arg)) {
             v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
             Document* document = V8DOMWrapper::convertDOMWrapperToNode<Document>(object);
             ASSERT(document);
             xmlHttpRequest->send(document, ec);
+        } else if (V8File::HasInstance(arg)) {
+            v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
+            File* file = V8DOMWrapper::convertDOMWrapperToNative<File>(object);
+            ASSERT(file);
+            xmlHttpRequest->send(file, ec);
         } else
             xmlHttpRequest->send(toWebCoreStringWithNullCheck(arg), ec);
     }
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp
index bbc69dd..9323f71 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp
@@ -34,7 +34,6 @@
 #include "ExceptionCode.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "XMLHttpRequest.h"
@@ -43,212 +42,14 @@
 
 namespace WebCore {
 
-ACCESSOR_GETTER(XMLHttpRequestUploadOnabort)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onabort._get");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (xmlHttpRequestUpload->onabort()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onabort());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestUploadOnabort)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onabort._set");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequestUpload->onabort()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onabort());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequestUpload->setOnabort(0);
-    } else {
-        XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-        if (listener) {
-            xmlHttpRequestUpload->setOnabort(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestUploadOnerror)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onerror._get");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (xmlHttpRequestUpload->onerror()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onerror());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestUploadOnerror)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onerror._set");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequestUpload->onerror()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onerror());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequestUpload->setOnerror(0);
-    } else {
-        XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-        if (listener) {
-            xmlHttpRequestUpload->setOnerror(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestUploadOnload)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onload._get");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (xmlHttpRequestUpload->onload()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onload());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestUploadOnload)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onload._set");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequestUpload->onload()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onload());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequestUpload->setOnload(0);
-    } else {
-        XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-        if (listener) {
-            xmlHttpRequestUpload->setOnload(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestUploadOnloadstart)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onloadstart._get");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (xmlHttpRequestUpload->onloadstart()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onloadstart());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestUploadOnloadstart)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onloadstart._set");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequestUpload->onloadstart()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onloadstart());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequestUpload->setOnloadstart(0);
-    } else {
-        XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-        if (listener) {
-            xmlHttpRequestUpload->setOnloadstart(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestUploadOnprogress)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onprogress._get");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (xmlHttpRequestUpload->onprogress()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onprogress());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestUploadOnprogress)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onprogress._set");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequestUpload->onprogress()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onprogress());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequestUpload->setOnprogress(0);
-    } else {
-        XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-        if (listener) {
-            xmlHttpRequestUpload->setOnprogress(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
 CALLBACK_FUNC_DECL(XMLHttpRequestUploadAddEventListener)
 {
     INC_STATS("DOM.XMLHttpRequestUpload.addEventListener()");
     XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, args.Holder());
 
     XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-    V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-    if (!proxy)
-        return v8::Undefined();
 
-    RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(xmlHttpRequest, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -265,12 +66,8 @@ CALLBACK_FUNC_DECL(XMLHttpRequestUploadRemoveEventListener)
     XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, args.Holder());
 
     XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-    V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-    if (!proxy)
-        return v8::Undefined(); // Probably leaked.
-
-    RefPtr<EventListener> listener = proxy->objectListeners()->findWrapper(args[1], false);
 
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(xmlHttpRequest, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
diff --git a/WebCore/bindings/v8/npruntime.cpp b/WebCore/bindings/v8/npruntime.cpp
index 64a1927..3ae2e70 100644
--- a/WebCore/bindings/v8/npruntime.cpp
+++ b/WebCore/bindings/v8/npruntime.cpp
@@ -39,7 +39,7 @@
 // The static initializer here should work okay, but we want to avoid
 // static initialization in general.
 
-namespace {
+namespace npruntime {
 
 // We use StringKey here as the key-type to avoid a string copy to
 // construct the map key and for faster comparisons than strcmp.
@@ -112,7 +112,10 @@ struct StringKeyHash {
     static const bool safeToCompareToEmptyOrDeleted = true;
 };
 
-}  // namespace
+}  // namespace npruntime
+
+using npruntime::StringKey;
+using npruntime::StringKeyHash;
 
 // Implement HashTraits<StringKey>
 struct StringKeyHashTraits : WTF::GenericHashTraits<StringKey> {
diff --git a/WebCore/bridge/IdentifierRep.h b/WebCore/bridge/IdentifierRep.h
index 8e0e0d9..8128bf8 100644
--- a/WebCore/bridge/IdentifierRep.h
+++ b/WebCore/bridge/IdentifierRep.h
@@ -27,11 +27,12 @@
 #define IdentifierRep_h
 
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <string.h>
 
 namespace WebCore {
     
-class IdentifierRep {
+class IdentifierRep : public FastAllocBase {
 public:
     static IdentifierRep* get(int);
     static IdentifierRep* get(const char*);
diff --git a/WebCore/bridge/jni/jni_jsobject.mm b/WebCore/bridge/jni/jni_jsobject.mm
index c9af8b0..eb4a6bd 100644
--- a/WebCore/bridge/jni/jni_jsobject.mm
+++ b/WebCore/bridge/jni/jni_jsobject.mm
@@ -29,19 +29,18 @@
 #if ENABLE(MAC_JAVA_BRIDGE)
 
 #include "Frame.h"
+#include "ScriptController.h"
+#include "StringSourceProvider.h"
 #include "WebCoreFrameView.h"
 #include "jni_runtime.h"
 #include "jni_utility.h"
-#include "ScriptController.h"
 #include "runtime_object.h"
 #include "runtime_root.h"
 #include <interpreter/CallFrame.h>
+#include <runtime/Completion.h>
 #include <runtime/JSGlobalObject.h>
 #include <runtime/JSLock.h>
-#include <runtime/Completion.h>
-#include <runtime/Completion.h>
 #include <wtf/Assertions.h>
-#include <parser/SourceProvider.h>
 
 using WebCore::Frame;
 
diff --git a/WebCore/bridge/npapi.h b/WebCore/bridge/npapi.h
index 126d513..ca70dcf 100644
--- a/WebCore/bridge/npapi.h
+++ b/WebCore/bridge/npapi.h
@@ -71,6 +71,13 @@
 #    endif /* XP_PC */
 #endif /* __MWERKS__ */
 
+#ifdef __SYMBIAN32__
+#   ifndef XP_SYMBIAN
+#       define XP_SYMBIAN 1
+#       undef XP_WIN
+#   endif
+#endif  /* __SYMBIAN32__ */
+
 #if defined(__APPLE_CC__) && !defined(__MACOS_CLASSIC__) && !defined(XP_UNIX)
 #   define XP_MACOSX
 #endif
@@ -114,6 +121,14 @@
 /*             Definition of Basic Types                                */
 /*----------------------------------------------------------------------*/
 
+/* QNX sets the _INT16 and friends defines, but does not typedef the types */
+#ifdef __QNXNTO__
+#undef _UINT16
+#undef _INT16
+#undef _UINT32
+#undef _INT32
+#endif
+
 #ifndef _UINT16
 #define _UINT16
 typedef unsigned short uint16;
diff --git a/WebCore/bridge/objc/objc_instance.h b/WebCore/bridge/objc/objc_instance.h
index 6f1eb0d..64cd491 100644
--- a/WebCore/bridge/objc/objc_instance.h
+++ b/WebCore/bridge/objc/objc_instance.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,16 +37,12 @@ class ObjcClass;
 
 class ObjcInstance : public Instance {
 public:
-    static PassRefPtr<ObjcInstance> create(ObjectStructPtr instance, PassRefPtr<RootObject> rootObject)
-    {
-        return adoptRef(new ObjcInstance(instance, rootObject));
-    }
-
+    static PassRefPtr<ObjcInstance> create(ObjectStructPtr, PassRefPtr<RootObject>);
+    virtual ~ObjcInstance();
+    
     static void setGlobalException(NSString*, JSGlobalObject* exceptionEnvironment = 0); // A null exceptionEnvironment means the exception should propogate to any execution environment.
 
-    ~ObjcInstance();
-    
-    virtual Class *getClass() const;
+    virtual Class* getClass() const;
         
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
@@ -71,7 +67,7 @@ protected:
 private:
     static void moveGlobalExceptionToExecState(ExecState*);
 
-    ObjcInstance(ObjectStructPtr instance, PassRefPtr<RootObject>);
+    ObjcInstance(ObjectStructPtr, PassRefPtr<RootObject>);
     
     RetainPtr<ObjectStructPtr> _instance;
     mutable ObjcClass *_class;
diff --git a/WebCore/bridge/objc/objc_instance.mm b/WebCore/bridge/objc/objc_instance.mm
index b84f7bb..f7550e4 100644
--- a/WebCore/bridge/objc/objc_instance.mm
+++ b/WebCore/bridge/objc/objc_instance.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2008 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,8 +44,21 @@
 using namespace JSC::Bindings;
 using namespace JSC;
 
-static NSString* s_exception;
+static NSString *s_exception;
 static JSGlobalObject* s_exceptionEnvironment; // No need to protect this value, since we just use it for a pointer comparison.
+static NSMapTable *s_instanceWrapperCache;
+
+static NSMapTable *createInstanceWrapperCache()
+{
+#ifdef BUILDING_ON_TIGER
+    return NSCreateMapTable(NSNonRetainedObjectMapKeyCallBacks, NSNonOwnedPointerMapValueCallBacks, 0);
+#else
+    // NSMapTable with zeroing weak pointers is the recommended way to build caches like this under garbage collection.
+    NSPointerFunctionsOptions keyOptions = NSPointerFunctionsZeroingWeakMemory | NSPointerFunctionsObjectPersonality;
+    NSPointerFunctionsOptions valueOptions = NSPointerFunctionsOpaqueMemory | NSPointerFunctionsOpaquePersonality;
+    return [[NSMapTable alloc] initWithKeyOptions:keyOptions valueOptions:valueOptions capacity:0];
+#endif
+}
 
 void ObjcInstance::setGlobalException(NSString* exception, JSGlobalObject* exceptionEnvironment)
 {
@@ -74,7 +87,7 @@ void ObjcInstance::moveGlobalExceptionToExecState(ExecState* exec)
     s_exceptionEnvironment = 0;
 }
 
-ObjcInstance::ObjcInstance(ObjectStructPtr instance, PassRefPtr<RootObject> rootObject) 
+ObjcInstance::ObjcInstance(id instance, PassRefPtr<RootObject> rootObject) 
     : Instance(rootObject)
     , _instance(instance)
     , _class(0)
@@ -83,13 +96,30 @@ ObjcInstance::ObjcInstance(ObjectStructPtr instance, PassRefPtr<RootObject> root
 {
 }
 
+PassRefPtr<ObjcInstance> ObjcInstance::create(id instance, PassRefPtr<RootObject> rootObject)
+{
+    if (!s_instanceWrapperCache)
+        s_instanceWrapperCache = createInstanceWrapperCache();
+    if (void* existingWrapper = NSMapGet(s_instanceWrapperCache, instance))
+        return static_cast<ObjcInstance*>(existingWrapper);
+    RefPtr<ObjcInstance> wrapper = adoptRef(new ObjcInstance(instance, rootObject));
+    NSMapInsert(s_instanceWrapperCache, instance, wrapper.get());
+    return wrapper.release();
+}
+
 ObjcInstance::~ObjcInstance() 
 {
-    // -finalizeForWebScript and -dealloc/-finalize may require autorelease pools.
+    // Both -finalizeForWebScript and -dealloc/-finalize of _instance may require autorelease pools.
     NSAutoreleasePool* pool = [[NSAutoreleasePool alloc] init];
+
+    ASSERT(s_instanceWrapperCache);
+    ASSERT(_instance);
+    NSMapRemove(s_instanceWrapperCache, _instance.get());
+
     if ([_instance.get() respondsToSelector:@selector(finalizeForWebScript)])
         [_instance.get() performSelector:@selector(finalizeForWebScript)];
     _instance = 0;
+
     [pool drain];
 }
 
diff --git a/WebCore/bridge/objc/objc_runtime.h b/WebCore/bridge/objc/objc_runtime.h
index 82d563b..7c772a6 100644
--- a/WebCore/bridge/objc/objc_runtime.h
+++ b/WebCore/bridge/objc/objc_runtime.h
@@ -109,6 +109,7 @@ public:
 
 private:
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual CallType getCallData(CallData&);
     virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
diff --git a/WebCore/bridge/objc/objc_runtime.mm b/WebCore/bridge/objc/objc_runtime.mm
index 2d69c1c..5efc865 100644
--- a/WebCore/bridge/objc/objc_runtime.mm
+++ b/WebCore/bridge/objc/objc_runtime.mm
@@ -203,13 +203,20 @@ bool ObjcFallbackObjectImp::getOwnPropertySlot(ExecState*, const Identifier&, Pr
     return true;
 }
 
+bool ObjcFallbackObjectImp::getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor& descriptor)
+{
+    // keep the prototype from getting called instead of just returning false
+    descriptor.setUndefined();
+    return true;
+}
+
 void ObjcFallbackObjectImp::put(ExecState*, const Identifier&, JSValue, PutPropertySlot&)
 {
 }
 
 static JSValue JSC_HOST_CALL callObjCFallbackObject(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&RuntimeObjectImp::s_info))
+    if (!thisValue.inherits(&RuntimeObjectImp::s_info))
         return throwError(exec, TypeError);
 
     JSValue result = jsUndefined();
diff --git a/WebCore/bridge/qt/qt_class.h b/WebCore/bridge/qt/qt_class.h
index 19d4207..dc6b130 100644
--- a/WebCore/bridge/qt/qt_class.h
+++ b/WebCore/bridge/qt/qt_class.h
@@ -26,7 +26,7 @@
 
 QT_BEGIN_NAMESPACE
 class QObject;
-class QMetaObject;
+struct QMetaObject;
 QT_END_NAMESPACE
 
 namespace JSC {
diff --git a/WebCore/bridge/qt/qt_instance.cpp b/WebCore/bridge/qt/qt_instance.cpp
index 506697a..0546014 100644
--- a/WebCore/bridge/qt/qt_instance.cpp
+++ b/WebCore/bridge/qt/qt_instance.cpp
@@ -43,30 +43,21 @@ namespace Bindings {
 typedef QMultiHash<void*, QtInstance*> QObjectInstanceMap;
 static QObjectInstanceMap cachedInstances;
 
-// Cache JSObjects
-typedef QHash<QtInstance*, JSObject*> InstanceJSObjectMap;
-static InstanceJSObjectMap cachedObjects;
-
 // Derived RuntimeObject
 class QtRuntimeObjectImp : public RuntimeObjectImp {
 public:
     QtRuntimeObjectImp(ExecState*, PassRefPtr<Instance>);
-    ~QtRuntimeObjectImp();
-    virtual void invalidate();
 
     static const ClassInfo s_info;
 
-    virtual void mark()
+    virtual void markChildren(MarkStack& markStack)
     {
+        RuntimeObjectImp::markChildren(markStack);
         QtInstance* instance = static_cast<QtInstance*>(getInternalInstance());
         if (instance)
-            instance->mark();
-        RuntimeObjectImp::mark();
+            instance->markAggregate(markStack);
     }
 
-protected:
-    void removeFromCache();
-        
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
 };
@@ -78,25 +69,6 @@ QtRuntimeObjectImp::QtRuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> ins
 {
 }
 
-QtRuntimeObjectImp::~QtRuntimeObjectImp()
-{
-    removeFromCache();
-}
-
-void QtRuntimeObjectImp::invalidate()
-{
-    removeFromCache();
-    RuntimeObjectImp::invalidate();
-}
-
-void QtRuntimeObjectImp::removeFromCache()
-{
-    JSLock lock(SilenceAssertionsOnly);
-    QtInstance* key = cachedObjects.key(this);
-    if (key)
-        cachedObjects.remove(key);
-}
-
 // QtInstance
 QtInstance::QtInstance(QObject* o, PassRefPtr<RootObject> rootObject, QScriptEngine::ValueOwnership ownership)
     : Instance(rootObject)
@@ -112,7 +84,6 @@ QtInstance::~QtInstance()
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    cachedObjects.remove(this);
     cachedInstances.remove(m_hashkey);
 
     // clean up (unprotect from gc) the JSValues we've created
@@ -190,25 +161,19 @@ Class* QtInstance::getClass() const
     return m_class;
 }
 
-RuntimeObjectImp* QtInstance::createRuntimeObject(ExecState* exec)
+RuntimeObjectImp* QtInstance::newRuntimeObject(ExecState* exec)
 {
     JSLock lock(SilenceAssertionsOnly);
-    RuntimeObjectImp* ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(this));
-    if (!ret) {
-        ret = new (exec) QtRuntimeObjectImp(exec, this);
-        cachedObjects.insert(this, ret);
-        ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(this));
-    }
-    return ret;
+    return new (exec) QtRuntimeObjectImp(exec, this);
 }
 
-void QtInstance::mark()
+void QtInstance::markAggregate(MarkStack& markStack)
 {
-    if (m_defaultMethod && !m_defaultMethod->marked())
-        m_defaultMethod->mark();
+    if (m_defaultMethod)
+        markStack.append(m_defaultMethod);
     foreach(JSObject* val, m_methods.values()) {
-        if (val && !val->marked())
-            val->mark();
+        if (val)
+            markStack.append(val);
     }
 }
 
diff --git a/WebCore/bridge/qt/qt_instance.h b/WebCore/bridge/qt/qt_instance.h
index 23766b1..00aaa5b 100644
--- a/WebCore/bridge/qt/qt_instance.h
+++ b/WebCore/bridge/qt/qt_instance.h
@@ -40,7 +40,7 @@ public:
     ~QtInstance();
 
     virtual Class* getClass() const;
-    virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
+    virtual RuntimeObjectImp* newRuntimeObject(ExecState*);
 
     virtual void begin();
     virtual void end();
@@ -48,7 +48,7 @@ public:
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual void mark(); // This isn't inherited
+    void markAggregate(MarkStack&);
 
     virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
 
diff --git a/WebCore/bridge/qt/qt_runtime.cpp b/WebCore/bridge/qt/qt_runtime.cpp
index 6be119c..3cb2156 100644
--- a/WebCore/bridge/qt/qt_runtime.cpp
+++ b/WebCore/bridge/qt/qt_runtime.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "qt_runtime.h"
 
+#include "BooleanObject.h"
 #include "DateInstance.h"
 #include "DateMath.h"
 #include "DatePrototype.h"
@@ -46,9 +47,9 @@
 #include <JSFunction.h>
 #include <limits.h>
 #include <runtime.h>
+#include <runtime/Error.h>
 #include <runtime_array.h>
 #include <runtime_object.h>
-#include "BooleanObject.h"
 
 // QtScript has these
 Q_DECLARE_METATYPE(QObjectList);
@@ -1162,7 +1163,7 @@ static int findMethodIndex(ExecState* exec,
         }
 
         // If the native method requires more arguments than what was passed from JavaScript
-        if (jsArgs.size() < (types.count() - 1)) {
+        if (jsArgs.size() + 1 < static_cast<unsigned>(types.count())) {
             qMatchDebug() << "Match:too few args for" << method.signature();
             tooFewArgs.append(index);
             continue;
@@ -1185,7 +1186,7 @@ static int findMethodIndex(ExecState* exec,
 
         bool converted = true;
         int matchDistance = 0;
-        for (int i = 0; converted && i < types.count() - 1; ++i) {
+        for (unsigned i = 0; converted && i + 1 < static_cast<unsigned>(types.count()); ++i) {
             JSValue arg = i < jsArgs.size() ? jsArgs.at(i) : jsUndefined();
 
             int argdistance = -1;
@@ -1202,7 +1203,7 @@ static int findMethodIndex(ExecState* exec,
         qMatchDebug() << "Match: " << method.signature() << (converted ? "converted":"failed to convert") << "distance " << matchDistance;
 
         if (converted) {
-            if ((jsArgs.size() == types.count() - 1)
+            if ((jsArgs.size() + 1 == static_cast<unsigned>(types.count()))
                 && (matchDistance == 0)) {
                 // perfect match, use this one
                 chosenIndex = index;
@@ -1328,17 +1329,17 @@ QtRuntimeMetaMethod::QtRuntimeMetaMethod(ExecState* exec, const Identifier& iden
     d->m_allowPrivate = allowPrivate;
 }
 
-void QtRuntimeMetaMethod::mark()
+void QtRuntimeMetaMethod::markChildren(MarkStack& markStack)
 {
-    QtRuntimeMethod::mark();
+    QtRuntimeMethod::markChildren(markStack);
     QW_D(QtRuntimeMetaMethod);
     if (d->m_connect)
-        d->m_connect->mark();
+        markStack.append(d->m_connect);
     if (d->m_disconnect)
-        d->m_disconnect->mark();
+        markStack.append(d->m_disconnect);
 }
 
-JSValue QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
+JSValue QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValue, const ArgList& args)
 {
     QtRuntimeMetaMethodData* d = static_cast<QtRuntimeMetaMethod *>(functionObject)->d_func();
 
@@ -1436,7 +1437,7 @@ QtRuntimeConnectionMethod::QtRuntimeConnectionMethod(ExecState* exec, const Iden
     d->m_isConnect = isConnect;
 }
 
-JSValue QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
+JSValue QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValue, const ArgList& args)
 {
     QtRuntimeConnectionMethodData* d = static_cast<QtRuntimeConnectionMethod *>(functionObject)->d_func();
 
diff --git a/WebCore/bridge/qt/qt_runtime.h b/WebCore/bridge/qt/qt_runtime.h
index 72d93eb..edb577c 100644
--- a/WebCore/bridge/qt/qt_runtime.h
+++ b/WebCore/bridge/qt/qt_runtime.h
@@ -167,7 +167,7 @@ public:
 
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
 
-    virtual void mark();
+    virtual void markChildren(MarkStack& markStack);
 
 protected:
     QtRuntimeMetaMethodData* d_func() const {return reinterpret_cast<QtRuntimeMetaMethodData*>(d_ptr);}
diff --git a/WebCore/bridge/runtime.cpp b/WebCore/bridge/runtime.cpp
index 6934406..eac8586 100644
--- a/WebCore/bridge/runtime.cpp
+++ b/WebCore/bridge/runtime.cpp
@@ -48,12 +48,14 @@ Array::~Array()
 
 Instance::Instance(PassRefPtr<RootObject> rootObject)
     : _rootObject(rootObject)
+    , m_runtimeObject(0)
 {
     ASSERT(_rootObject);
 }
 
 Instance::~Instance()
 {
+    ASSERT(!m_runtimeObject);
 }
 
 static KJSDidExecuteFunctionPtr s_didExecuteFunction;
@@ -80,11 +82,37 @@ void Instance::end()
 
 RuntimeObjectImp* Instance::createRuntimeObject(ExecState* exec)
 {
+    ASSERT(_rootObject);
+    ASSERT(_rootObject->isValid());
+    if (m_runtimeObject)
+        return m_runtimeObject;
+    JSLock lock(SilenceAssertionsOnly);
+    m_runtimeObject = newRuntimeObject(exec);
+    _rootObject->addRuntimeObject(m_runtimeObject);
+    return m_runtimeObject;
+}
+
+RuntimeObjectImp* Instance::newRuntimeObject(ExecState* exec)
+{
     JSLock lock(SilenceAssertionsOnly);
-    
     return new (exec) RuntimeObjectImp(exec, this);
 }
 
+void Instance::willDestroyRuntimeObject()
+{
+    ASSERT(_rootObject);
+    ASSERT(_rootObject->isValid());
+    ASSERT(m_runtimeObject);
+    _rootObject->removeRuntimeObject(m_runtimeObject);
+    m_runtimeObject = 0;
+}
+
+void Instance::willInvalidateRuntimeObject()
+{
+    ASSERT(m_runtimeObject);
+    m_runtimeObject = 0;
+}
+
 RootObject* Instance::rootObject() const 
 { 
     return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
diff --git a/WebCore/bridge/runtime.h b/WebCore/bridge/runtime.h
index 2f74a4e..6682a97 100644
--- a/WebCore/bridge/runtime.h
+++ b/WebCore/bridge/runtime.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -86,8 +86,10 @@ public:
     void begin();
     void end();
     
-    virtual Class *getClass() const = 0;
-    virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
+    virtual Class* getClass() const = 0;
+    RuntimeObjectImp* createRuntimeObject(ExecState*);
+    void willInvalidateRuntimeObject();
+    void willDestroyRuntimeObject();
     
     // Returns false if the value was not set successfully.
     virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue) { return false; }
@@ -111,13 +113,18 @@ public:
     virtual ~Instance();
 
     virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&) { return false; }
+    virtual bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&) { return false; }
     virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&) { }
 
 protected:
     virtual void virtualBegin() { }
     virtual void virtualEnd() { }
+    virtual RuntimeObjectImp* newRuntimeObject(ExecState*);
 
     RefPtr<RootObject> _rootObject;
+
+private:
+    RuntimeObjectImp* m_runtimeObject;
 };
 
 class Array : public Noncopyable {
diff --git a/WebCore/bridge/runtime_array.cpp b/WebCore/bridge/runtime_array.cpp
index 2849822..feadb07 100644
--- a/WebCore/bridge/runtime_array.cpp
+++ b/WebCore/bridge/runtime_array.cpp
@@ -75,6 +75,29 @@ bool RuntimeArray::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool RuntimeArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        PropertySlot slot;
+        slot.setCustom(this, lengthGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    bool ok;
+    unsigned index = propertyName.toArrayIndex(&ok);
+    if (ok) {
+        if (index < getLength()) {
+            PropertySlot slot;
+            slot.setCustomIndex(this, index, indexGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | DontEnum);
+            return true;
+        }
+    }
+    
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 bool RuntimeArray::getOwnPropertySlot(ExecState *exec, unsigned index, PropertySlot& slot)
 {
     if (index < getLength()) {
diff --git a/WebCore/bridge/runtime_array.h b/WebCore/bridge/runtime_array.h
index 5a86e9d..f614f7f 100644
--- a/WebCore/bridge/runtime_array.h
+++ b/WebCore/bridge/runtime_array.h
@@ -37,6 +37,7 @@ public:
     
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState *, unsigned, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState *, const Identifier&, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual void put(ExecState*, unsigned propertyName, JSValue);
     
diff --git a/WebCore/bridge/runtime_method.cpp b/WebCore/bridge/runtime_method.cpp
index 0af0af5..ffe4c0a 100644
--- a/WebCore/bridge/runtime_method.cpp
+++ b/WebCore/bridge/runtime_method.cpp
@@ -73,6 +73,18 @@ bool RuntimeMethod::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return InternalFunction::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool RuntimeMethod::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor &descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        PropertySlot slot;
+        slot.setCustom(this, lengthGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    return InternalFunction::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     RuntimeMethod* method = static_cast<RuntimeMethod*>(function);
@@ -82,13 +94,13 @@ static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* functi
     
     RuntimeObjectImp* imp;
 
-    if (thisValue.isObject(&RuntimeObjectImp::s_info)) {
+    if (thisValue.inherits(&RuntimeObjectImp::s_info)) {
         imp = static_cast<RuntimeObjectImp*>(asObject(thisValue));
     } else {
         // If thisObj is the DOM object for a plugin, get the corresponding
         // runtime object from the DOM object.
         JSValue value = thisValue.get(exec, Identifier(exec, "__apple_runtime_object"));
-        if (value.isObject(&RuntimeObjectImp::s_info))    
+        if (value.inherits(&RuntimeObjectImp::s_info))    
             imp = static_cast<RuntimeObjectImp*>(asObject(value));
         else
             return throwError(exec, TypeError);
diff --git a/WebCore/bridge/runtime_method.h b/WebCore/bridge/runtime_method.h
index 5333c14..3233ffa 100644
--- a/WebCore/bridge/runtime_method.h
+++ b/WebCore/bridge/runtime_method.h
@@ -53,6 +53,7 @@ public:
 private:
     static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual CallType getCallData(CallData&);
 
     OwnPtr<Bindings::MethodList> _methodList;
diff --git a/WebCore/bridge/runtime_object.cpp b/WebCore/bridge/runtime_object.cpp
index 385f914..9583fb2 100644
--- a/WebCore/bridge/runtime_object.cpp
+++ b/WebCore/bridge/runtime_object.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,7 +28,6 @@
 
 #include "JSDOMBinding.h"
 #include "runtime_method.h"
-#include "runtime_root.h"
 #include <runtime/Error.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -40,38 +39,38 @@ using namespace Bindings;
 
 const ClassInfo RuntimeObjectImp::s_info = { "RuntimeObject", 0, 0, 0 };
 
-RuntimeObjectImp::RuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> i)
+RuntimeObjectImp::RuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> instance)
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
     // We need to pass in the right global object for "i".
     : JSObject(deprecatedGetDOMStructure<RuntimeObjectImp>(exec))
-    , instance(i)
+    , m_instance(instance)
 {
-    instance->rootObject()->addRuntimeObject(this);
 }
-    
-RuntimeObjectImp::RuntimeObjectImp(ExecState*, PassRefPtr<Structure> structure, PassRefPtr<Instance> i)
+
+RuntimeObjectImp::RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure> structure, PassRefPtr<Instance> instance)
     : JSObject(structure)
-    , instance(i)
+    , m_instance(instance)
 {
-    instance->rootObject()->addRuntimeObject(this);
 }
 
 RuntimeObjectImp::~RuntimeObjectImp()
 {
-    if (instance)
-        instance->rootObject()->removeRuntimeObject(this);
+    if (m_instance)
+        m_instance->willDestroyRuntimeObject();
 }
 
 void RuntimeObjectImp::invalidate()
 {
-    ASSERT(instance);
-    instance = 0;
+    ASSERT(m_instance);
+    if (m_instance)
+        m_instance->willInvalidateRuntimeObject();
+    m_instance = 0;
 }
 
 JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
-    RefPtr<Instance> instance = thisObj->instance;
+    RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -89,7 +88,7 @@ JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier
 JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {    
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
-    RefPtr<Instance> instance = thisObj->instance;
+    RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -108,7 +107,7 @@ JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propert
 JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
-    RefPtr<Instance> instance = thisObj->instance;
+    RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -126,11 +125,13 @@ JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& proper
 
 bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (!instance) {
+    if (!m_instance) {
         throwInvalidAccessError(exec);
         return false;
     }
     
+    RefPtr<Instance> instance = m_instance;
+
     instance->begin();
     
     Class *aClass = instance->getClass();
@@ -167,14 +168,63 @@ bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& pro
     return instance->getOwnPropertySlot(this, exec, propertyName, slot);
 }
 
+bool RuntimeObjectImp::getOwnPropertyDescriptor(ExecState *exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (!m_instance) {
+        throwInvalidAccessError(exec);
+        return false;
+    }
+    
+    RefPtr<Instance> instance = m_instance;
+    instance->begin();
+    
+    Class *aClass = instance->getClass();
+    
+    if (aClass) {
+        // See if the instance has a field with the specified name.
+        Field *aField = aClass->fieldNamed(propertyName, instance.get());
+        if (aField) {
+            PropertySlot slot;
+            slot.setCustom(this, fieldGetter);
+            instance->end();
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete);
+            return true;
+        } else {
+            // Now check if a method with specified name exists, if so return a function object for
+            // that method.
+            MethodList methodList = aClass->methodsNamed(propertyName, instance.get());
+            if (methodList.size() > 0) {
+                PropertySlot slot;
+                slot.setCustom(this, methodGetter);
+                instance->end();
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+                return true;
+            }
+        }
+        
+        // Try a fallback object.
+        if (!aClass->fallbackObject(exec, instance.get(), propertyName).isUndefined()) {
+            PropertySlot slot;
+            slot.setCustom(this, fallbackObjectGetter);
+            instance->end();
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+            return true;
+        }
+    }
+    
+    instance->end();
+    
+    return instance->getOwnPropertyDescriptor(this, exec, propertyName, descriptor);
+}
+
 void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (!instance) {
+    if (!m_instance) {
         throwInvalidAccessError(exec);
         return;
     }
     
-    RefPtr<Instance> protector(instance);
+    RefPtr<Instance> instance = m_instance;
     instance->begin();
 
     // Set the value of the property.
@@ -195,10 +245,11 @@ bool RuntimeObjectImp::deleteProperty(ExecState*, const Identifier&)
 
 JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
-    if (!instance)
+    if (!m_instance)
         return throwInvalidAccessError(exec);
     
-    RefPtr<Instance> protector(instance);
+    RefPtr<Instance> instance = m_instance;
+
     instance->begin();
     JSValue result = instance->defaultValue(exec, hint);
     instance->end();
@@ -216,8 +267,13 @@ static JSValue JSC_HOST_CALL callRuntimeObject(ExecState* exec, JSObject* functi
 
 CallType RuntimeObjectImp::getCallData(CallData& callData)
 {
-    if (!instance || !instance->supportsInvokeDefaultMethod())
+    if (!m_instance)
         return CallTypeNone;
+    
+    RefPtr<Instance> instance = m_instance;
+    if (!instance->supportsInvokeDefaultMethod())
+        return CallTypeNone;
+    
     callData.native.function = callRuntimeObject;
     return CallTypeHost;
 }
@@ -235,24 +291,36 @@ static JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor,
 
 ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
 {
-    if (!instance || !instance->supportsConstruct())
+    if (!m_instance)
         return ConstructTypeNone;
+    
+    RefPtr<Instance> instance = m_instance;
+    if (!instance->supportsConstruct())
+        return ConstructTypeNone;
+    
     constructData.native.function = callRuntimeConstructor;
     return ConstructTypeHost;
 }
 
 void RuntimeObjectImp::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    if (!instance) {
+    if (!m_instance) {
         throwInvalidAccessError(exec);
         return;
     }
+
+    RefPtr<Instance> instance = m_instance;
     
     instance->begin();
     instance->getPropertyNames(exec, propertyNames);
     instance->end();
 }
 
+void RuntimeObjectImp::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    getOwnPropertyNames(exec, propertyNames);
+}
+
 JSObject* RuntimeObjectImp::throwInvalidAccessError(ExecState* exec)
 {
     return throwError(exec, ReferenceError, "Trying to access object from destroyed plug-in.");
diff --git a/WebCore/bridge/runtime_object.h b/WebCore/bridge/runtime_object.h
index f01fe1e..f16778e 100644
--- a/WebCore/bridge/runtime_object.h
+++ b/WebCore/bridge/runtime_object.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,20 +34,22 @@ namespace JSC {
 class RuntimeObjectImp : public JSObject {
 public:
     RuntimeObjectImp(ExecState*, PassRefPtr<Bindings::Instance>);
-
     virtual ~RuntimeObjectImp();
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-    virtual bool deleteProperty(ExecState* , const Identifier& propertyName);
+    virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
     virtual CallType getCallData(CallData&);
     virtual ConstructType getConstructData(ConstructData&);
-    
+
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+
+    void invalidate();
 
-    virtual void invalidate();
-    Bindings::Instance* getInternalInstance() const { return instance.get(); }
+    Bindings::Instance* getInternalInstance() const { return m_instance.get(); }
 
     static JSObject* throwInvalidAccessError(ExecState*);
 
@@ -64,7 +66,7 @@ public:
     }
 
 protected:
-    RuntimeObjectImp(ExecState*, PassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
+    RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
 
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
@@ -73,7 +75,7 @@ private:
     static JSValue fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
     static JSValue methodGetter(ExecState*, const Identifier&, const PropertySlot&);
 
-    RefPtr<Bindings::Instance> instance;
+    RefPtr<Bindings::Instance> m_instance;
 };
     
 } // namespace
diff --git a/WebCore/config.h b/WebCore/config.h
index 21442bf..7460946 100644
--- a/WebCore/config.h
+++ b/WebCore/config.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2004, 2005, 2006 Apple Inc.
- * 
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ -74,6 +75,7 @@
 
 #endif /* PLATFORM(WIN_OS) */
 
+<<<<<<< HEAD:WebCore/config.h
 // On MSW, wx headers need to be included before windows.h is.
 // The only way we can always ensure this is if we include wx here.
 #if PLATFORM(WX)
@@ -138,6 +140,8 @@
 #define ENABLE_GEOLOCATION 1
 #endif  // PLATFORM(ANDROID)
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/config.h
 #ifdef __cplusplus
 
 // These undefs match up with defines in WebCorePrefix.h for Mac OS X.
@@ -148,10 +152,19 @@
 
 #endif
 
+// On MSW, wx headers need to be included before windows.h is.
+// The only way we can always ensure this is if we include wx here.
+#if PLATFORM(WX)
+// The defines in KeyboardCodes.h conflict with Windows as well, and the only way I've found
+// to address the problem is include KeyboarddCodes.h before windows.h, so do it here.
+#include "KeyboardCodes.h"
+#include <wx/defs.h>
+#endif
+
 // this breaks compilation of <QFontDatabase>, at least, so turn it off for now
 // Also generates errors on wx on Windows, presumably because these functions
 // are used from wx headers.
-#if !PLATFORM(QT) && !PLATFORM(WX)
+#if !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM)
 #include <wtf/DisallowCType.h>
 #endif
 
@@ -211,13 +224,30 @@
 #include <wtf/MathExtras.h>
 #endif
 
-#if !defined(WTF_USE_V8)
-/* Currently Chromium is the only platform which uses V8 by default */
 #if PLATFORM(CHROMIUM)
+
+#if !PLATFORM(DARWIN)
+// Define SKIA on non-Mac.
+#define WTF_PLATFORM_SKIA 1
+#endif /* !PLATFORM(DARWIN) */
+
+// Chromium uses this file instead of JavaScriptCore/config.h to compile
+// JavaScriptCore/wtf (chromium doesn't compile the rest of JSC). Therefore,
+// this define is required.
+#define WTF_CHANGES 1
+
+#define WTF_USE_GOOGLEURL 1
+
+#if !defined(WTF_USE_V8)
 #define WTF_USE_V8 1
-#else
-#define WTF_USE_V8 0
+#endif
+
+#undef WTF_USE_CFNETWORK
+
 #endif /* PLATFORM(CHROMIUM) */
+
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 0
 #endif /* !defined(WTF_USE_V8) */
 
 /* Using V8 implies not using JSC and vice versa */
diff --git a/WebCore/css/CSSCanvasValue.cpp b/WebCore/css/CSSCanvasValue.cpp
index cf8cb42..0c1c3f9 100644
--- a/WebCore/css/CSSCanvasValue.cpp
+++ b/WebCore/css/CSSCanvasValue.cpp
@@ -47,15 +47,15 @@ String CSSCanvasValue::cssText() const
 void CSSCanvasValue::canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect)
 {
     IntRect imageChangeRect = enclosingIntRect(changedRect);
-    HashMap<RenderObject*, IntSize>::const_iterator end = m_clients.end();
-    for (HashMap<RenderObject*, IntSize>::const_iterator curr = m_clients.begin(); curr != end; ++curr)
+    RenderObjectSizeCountMap::const_iterator end = m_clients.end();
+    for (RenderObjectSizeCountMap::const_iterator curr = m_clients.begin(); curr != end; ++curr)
         curr->first->imageChanged(static_cast<WrappedImagePtr>(this), &imageChangeRect);
 }
 
 void CSSCanvasValue::canvasResized(HTMLCanvasElement*)
 {
-    HashMap<RenderObject*, IntSize>::const_iterator end = m_clients.end();
-    for (HashMap<RenderObject*, IntSize>::const_iterator curr = m_clients.begin(); curr != end; ++curr)
+    RenderObjectSizeCountMap::const_iterator end = m_clients.end();
+    for (RenderObjectSizeCountMap::const_iterator curr = m_clients.begin(); curr != end; ++curr)
         curr->first->imageChanged(static_cast<WrappedImagePtr>(this));
 }
 
diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp
index 8a91140..34b93c1 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -62,6 +62,7 @@ static const int computedProperties[] = {
     CSSPropertyBackgroundOrigin,
     CSSPropertyBackgroundPosition, // more-specific background-position-x/y are non-standard
     CSSPropertyBackgroundRepeat,
+    CSSPropertyBackgroundSize,
     CSSPropertyBorderBottomColor,
     CSSPropertyBorderBottomLeftRadius,
     CSSPropertyBorderBottomRightRadius,
@@ -80,7 +81,6 @@ static const int computedProperties[] = {
     CSSPropertyBorderTopStyle,
     CSSPropertyBorderTopWidth,
     CSSPropertyBottom,
-    CSSPropertyBoxShadow,
     CSSPropertyCaptionSide,
     CSSPropertyClear,
     CSSPropertyClip,
@@ -132,6 +132,7 @@ static const int computedProperties[] = {
     CSSPropertyTextAlign,
     CSSPropertyTextDecoration,
     CSSPropertyTextIndent,
+    CSSPropertyTextRendering,
     CSSPropertyTextShadow,
     CSSPropertyTextOverflow,
     CSSPropertyTextTransform,
@@ -160,7 +161,6 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBackgroundClip,
     CSSPropertyWebkitBackgroundComposite,
     CSSPropertyWebkitBackgroundOrigin,
-    CSSPropertyWebkitBackgroundSize,
     CSSPropertyWebkitBorderFit,
     CSSPropertyWebkitBorderHorizontalSpacing,
     CSSPropertyWebkitBorderImage,
@@ -174,6 +174,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBoxOrient,
     CSSPropertyWebkitBoxPack,
     CSSPropertyWebkitBoxReflect,
+    CSSPropertyWebkitBoxShadow,
     CSSPropertyWebkitBoxSizing,
     CSSPropertyWebkitColumnBreakAfter,
     CSSPropertyWebkitColumnBreakBefore,
@@ -187,6 +188,7 @@ static const int computedProperties[] = {
 #if ENABLE(DASHBOARD_SUPPORT)
     CSSPropertyWebkitDashboardRegion,
 #endif
+    CSSPropertyWebkitFontSmoothing,
     CSSPropertyWebkitHighlight,
     CSSPropertyWebkitLineBreak,
     CSSPropertyWebkitLineClamp,
@@ -255,7 +257,6 @@ static const int computedProperties[] = {
     CSSPropertyStrokeMiterlimit,
     CSSPropertyStrokeOpacity,
     CSSPropertyStrokeWidth,
-    CSSPropertyTextRendering,
     CSSPropertyAlignmentBaseline,
     CSSPropertyBaselineShift,
     CSSPropertyDominantBaseline,
@@ -627,6 +628,32 @@ static PassRefPtr<CSSValue> renderTextDecorationFlagsToCSSValue(int textDecorati
     return list;
 }
 
+static PassRefPtr<CSSValue> fillRepeatToCSSValue(EFillRepeat xRepeat, EFillRepeat yRepeat)
+{
+    // For backwards compatibility, if both values are equal, just return one of them. And
+    // if the two values are equivalent to repeat-x or repeat-y, just return the shorthand.
+    if (xRepeat == yRepeat)
+        return CSSPrimitiveValue::create(xRepeat);
+    if (xRepeat == CSSValueRepeat && yRepeat == CSSValueNoRepeat)
+        return CSSPrimitiveValue::createIdentifier(CSSValueRepeatX);
+    if (xRepeat == CSSValueNoRepeat && yRepeat == CSSValueRepeat)
+        return CSSPrimitiveValue::createIdentifier(CSSValueRepeatY);
+
+    RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+    list->append(CSSPrimitiveValue::create(xRepeat));
+    list->append(CSSPrimitiveValue::create(yRepeat));
+    return list.release();
+}
+
+static void logUnimplementedPropertyID(int propertyID)
+{
+    DEFINE_STATIC_LOCAL(HashSet<int>, propertyIDSet, ());
+    if (!propertyIDSet.add(propertyID).second)
+        return;
+
+    LOG_ERROR("WebKit does not yet implement getComputedStyle for '%s'.", getPropertyName(static_cast<CSSPropertyID>(propertyID)));
+} 
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID, EUpdateLayout updateLayout) const
 {
     Node* node = m_node.get();
@@ -661,14 +688,19 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             if (style->backgroundImage())
                 return style->backgroundImage()->cssValue();
             return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-        case CSSPropertyWebkitBackgroundSize: {
+        case CSSPropertyBackgroundSize: {
+            EFillSizeType size = style->backgroundSizeType();
+            if (size == Contain)
+                return CSSPrimitiveValue::createIdentifier(CSSValueContain);
+            if (size == Cover)
+                return CSSPrimitiveValue::createIdentifier(CSSValueCover);
             RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-            list->append(CSSPrimitiveValue::create(style->backgroundSize().width()));
-            list->append(CSSPrimitiveValue::create(style->backgroundSize().height()));
+            list->append(CSSPrimitiveValue::create(style->backgroundSizeLength().width()));
+            list->append(CSSPrimitiveValue::create(style->backgroundSizeLength().height()));
             return list.release();
         }  
         case CSSPropertyBackgroundRepeat:
-            return CSSPrimitiveValue::create(style->backgroundRepeat());
+            return fillRepeatToCSSValue(style->backgroundRepeatX(), style->backgroundRepeatY());
         case CSSPropertyWebkitBackgroundComposite:
             return CSSPrimitiveValue::create(style->backgroundComposite());
         case CSSPropertyBackgroundAttachment:
@@ -756,7 +788,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         }
         case CSSPropertyWebkitBoxReflect:
             return valueForReflection(style->boxReflect());
-        case CSSPropertyBoxShadow:
+        case CSSPropertyWebkitBoxShadow:
             return valueForShadow(style->boxShadow(), static_cast<CSSPropertyID>(propertyID));
         case CSSPropertyCaptionSide:
             return CSSPrimitiveValue::create(style->captionSide());
@@ -942,7 +974,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return list.release();
         }  
         case CSSPropertyWebkitMaskRepeat:
-            return CSSPrimitiveValue::create(style->maskRepeat());
+            return fillRepeatToCSSValue(style->maskRepeatX(), style->maskRepeatY());
         case CSSPropertyWebkitMaskAttachment:
             return CSSPrimitiveValue::create(style->maskAttachment());
         case CSSPropertyWebkitMaskComposite:
@@ -1053,6 +1085,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->textIndent());
         case CSSPropertyTextShadow:
             return valueForShadow(style->textShadow(), static_cast<CSSPropertyID>(propertyID));
+        case CSSPropertyTextRendering:
+            return CSSPrimitiveValue::create(style->fontDescription().textRenderingMode());
         case CSSPropertyTextOverflow:
             if (style->textOverflow())
                 return CSSPrimitiveValue::createIdentifier(CSSValueEllipsis);
@@ -1141,6 +1175,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->matchNearestMailBlockquoteColor());
         case CSSPropertyResize:
             return CSSPrimitiveValue::create(style->resize());
+        case CSSPropertyWebkitFontSmoothing:
+            return CSSPrimitiveValue::create(style->fontDescription().fontSmoothing());
         case CSSPropertyZIndex:
             if (style->hasAutoZIndex())
                 return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
@@ -1435,7 +1471,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
 #endif
     }
 
-    LOG_ERROR("unimplemented propertyID: %d", propertyID);
+    logUnimplementedPropertyID(propertyID);
     return 0;
 }
 
diff --git a/WebCore/css/CSSCursorImageValue.cpp b/WebCore/css/CSSCursorImageValue.cpp
index 13c55a8..c1a517c 100644
--- a/WebCore/css/CSSCursorImageValue.cpp
+++ b/WebCore/css/CSSCursorImageValue.cpp
@@ -39,7 +39,7 @@ namespace WebCore {
 #if ENABLE(SVG)
 static inline bool isSVGCursorIdentifier(const String& url)
 {
-    KURL kurl(url);
+    KURL kurl(ParsedURLString, url);
     return kurl.hasFragmentIdentifier();
 }
 
diff --git a/WebCore/css/CSSImageGeneratorValue.cpp b/WebCore/css/CSSImageGeneratorValue.cpp
index 6e23d95..4cf0873 100644
--- a/WebCore/css/CSSImageGeneratorValue.cpp
+++ b/WebCore/css/CSSImageGeneratorValue.cpp
@@ -49,24 +49,42 @@ void CSSImageGeneratorValue::addClient(RenderObject* renderer, const IntSize& si
     ref();
     if (!size.isEmpty())
         m_sizes.add(size);
-    m_clients.add(renderer, size);
+    
+    RenderObjectSizeCountMap::iterator it = m_clients.find(renderer);
+    if (it == m_clients.end())
+        m_clients.add(renderer, SizeCountPair(size, 1));
+    else {
+        SizeCountPair& sizeCount = it->second;
+        ++sizeCount.second;
+    }
 }
 
 void CSSImageGeneratorValue::removeClient(RenderObject* renderer)
 {
-    IntSize size = m_clients.get(renderer);
+    RenderObjectSizeCountMap::iterator it = m_clients.find(renderer);
+    ASSERT(it != m_clients.end());
+
+    SizeCountPair& sizeCount = it->second;
+    IntSize size = sizeCount.first;
     if (!size.isEmpty()) {
         m_sizes.remove(size);
         if (!m_sizes.contains(size))
             m_images.remove(size);
     }
-    m_clients.remove(renderer);
+    
+    if (!--sizeCount.second)
+        m_clients.remove(renderer);
+
     deref();
 }
 
 Image* CSSImageGeneratorValue::getImage(RenderObject* renderer, const IntSize& size)
 {
-    IntSize oldSize = m_clients.get(renderer);
+    RenderObjectSizeCountMap::iterator it = m_clients.find(renderer);
+    ASSERT(it != m_clients.end());
+
+    SizeCountPair& sizeCount = it->second;
+    IntSize oldSize = sizeCount.first;
     if (oldSize != size) {
         removeClient(renderer);
         addClient(renderer, size);
diff --git a/WebCore/css/CSSImageGeneratorValue.h b/WebCore/css/CSSImageGeneratorValue.h
index 661fd37..c053bfe 100644
--- a/WebCore/css/CSSImageGeneratorValue.h
+++ b/WebCore/css/CSSImageGeneratorValue.h
@@ -57,8 +57,11 @@ protected:
     Image* getImage(RenderObject*, const IntSize&);
     void putImage(const IntSize&, PassRefPtr<Image>);
 
+    typedef pair<IntSize, int> SizeCountPair;
+    typedef HashMap<RenderObject*, SizeCountPair> RenderObjectSizeCountMap;
+
     HashCountedSet<IntSize> m_sizes; // A count of how many times a given image size is in use.
-    HashMap<RenderObject*, IntSize> m_clients; // A map from RenderObjects to image sizes.
+    RenderObjectSizeCountMap m_clients; // A map from RenderObjects (with entry count) to image sizes.
     HashMap<IntSize, RefPtr<Image> > m_images; // A cache of Image objects by image size.
     
     RefPtr<StyleGeneratedImage> m_image;
diff --git a/WebCore/css/CSSImageValue.cpp b/WebCore/css/CSSImageValue.cpp
index 7fc99bb..3432a4e 100644
--- a/WebCore/css/CSSImageValue.cpp
+++ b/WebCore/css/CSSImageValue.cpp
@@ -63,7 +63,7 @@ StyleCachedImage* CSSImageValue::cachedImage(DocLoader* loader, const String& ur
             cachedImage = loader->requestImage(url);
         else {
             // FIXME: Should find a way to make these images sit in their own memory partition, since they are user agent images.
-            cachedImage = static_cast<CachedImage*>(cache()->requestResource(0, CachedResource::ImageResource, KURL(url), String()));
+            cachedImage = static_cast<CachedImage*>(cache()->requestResource(0, CachedResource::ImageResource, KURL(ParsedURLString, url), String()));
         }
 
         if (cachedImage) {
diff --git a/WebCore/css/CSSImportRule.cpp b/WebCore/css/CSSImportRule.cpp
index 50e60f4..6e62f6d 100644
--- a/WebCore/css/CSSImportRule.cpp
+++ b/WebCore/css/CSSImportRule.cpp
@@ -1,7 +1,7 @@
 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2002, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2002, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,6 +26,8 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "MediaList.h"
+#include "Settings.h"
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -60,7 +62,20 @@ void CSSImportRule::setCSSStyleSheet(const String& url, const String& charset, c
 
     CSSStyleSheet* parent = parentStyleSheet();
     bool strict = !parent || parent->useStrictParsing();
-    m_styleSheet->parseString(sheet->sheetText(strict), strict);
+    String sheetText = sheet->sheetText(strict);
+    m_styleSheet->parseString(sheetText, strict);
+
+    if (strict && parent && parent->doc() && parent->doc()->settings() && parent->doc()->settings()->needsSiteSpecificQuirks()) {
+        // Work around <https://bugs.webkit.org/show_bug.cgi?id=28350>.
+        DEFINE_STATIC_LOCAL(const String, slashKHTMLFixesDotCss, ("/KHTMLFixes.css"));
+        DEFINE_STATIC_LOCAL(const String, mediaWikiKHTMLFixesStyleSheet, ("/* KHTML fix stylesheet */\n/* work around the horizontal scrollbars */\n#column-content { margin-left: 0; }\n\n"));
+        if (url.endsWith(slashKHTMLFixesDotCss) && sheetText == mediaWikiKHTMLFixesStyleSheet) {
+            ASSERT(m_styleSheet->length() == 1);
+            ExceptionCode ec;
+            m_styleSheet->deleteRule(0, ec);
+        }
+    }
+
     m_loading = false;
 
     if (parent)
@@ -85,7 +100,7 @@ void CSSImportRule::insertedIntoParent()
     String absHref = m_strHref;
     if (!parentSheet->href().isNull())
         // use parent styleheet's URL as the base URL
-        absHref = KURL(KURL(parentSheet->href()), m_strHref).string();
+        absHref = KURL(KURL(ParsedURLString, parentSheet->href()), m_strHref).string();
 
     // Check for a cycle in our import chain.  If we encounter a stylesheet
     // in our parent chain with the same URL, then just bail.
@@ -96,7 +111,10 @@ void CSSImportRule::insertedIntoParent()
         root = curr;
     }
 
-    m_cachedSheet = docLoader->requestCSSStyleSheet(absHref, parentSheet->charset());
+    if (parentSheet->isUserStyleSheet())
+        m_cachedSheet = docLoader->requestUserCSSStyleSheet(absHref, parentSheet->charset());
+    else
+        m_cachedSheet = docLoader->requestCSSStyleSheet(absHref, parentSheet->charset());
     if (m_cachedSheet) {
         // if the import rule is issued dynamically, the sheet may be
         // removed from the pending sheet count, so let the doc know
diff --git a/WebCore/css/CSSMutableStyleDeclaration.cpp b/WebCore/css/CSSMutableStyleDeclaration.cpp
index 8ff5300..2dd2f5d 100644
--- a/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -28,6 +28,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
 #include "CSSStyleSheet.h"
+#include "CSSValueKeywords.h"
 #include "CSSValueList.h"
 #include "Document.h"
 #include "ExceptionCode.h"
@@ -110,15 +111,24 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
     switch (propertyID) {
         case CSSPropertyBackgroundPosition: {
             // FIXME: Is this correct? The code in cssparser.cpp is confusing
-            const int properties[2] = { CSSPropertyBackgroundPositionX,
-                                        CSSPropertyBackgroundPositionY };
+            const int properties[2] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
+            return getLayeredShorthandValue(properties, 2);
+        }
+        case CSSPropertyBackgroundRepeat: {
+            const int properties[2] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
             return getLayeredShorthandValue(properties, 2);
         }
         case CSSPropertyBackground: {
-            const int properties[7] = { CSSPropertyBackgroundImage, CSSPropertyBackgroundRepeat, 
-                                        CSSPropertyBackgroundAttachment, CSSPropertyBackgroundPosition, CSSPropertyBackgroundClip,
-                                        CSSPropertyBackgroundOrigin, CSSPropertyBackgroundColor };
-            return getLayeredShorthandValue(properties, 7);
+            const int properties[9] = { CSSPropertyBackgroundColor,
+                                        CSSPropertyBackgroundImage, 
+                                        CSSPropertyBackgroundRepeatX, 
+                                        CSSPropertyBackgroundRepeatY, 
+                                        CSSPropertyBackgroundAttachment, 
+                                        CSSPropertyBackgroundPositionX, 
+                                        CSSPropertyBackgroundPositionY, 
+                                        CSSPropertyBackgroundClip,
+                                        CSSPropertyBackgroundOrigin }; 
+            return getLayeredShorthandValue(properties, 9);
         }
         case CSSPropertyBorder: {
             const int properties[3][4] = {{ CSSPropertyBorderTopWidth,
@@ -206,8 +216,11 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         }
         case CSSPropertyWebkitMaskPosition: {
             // FIXME: Is this correct? The code in cssparser.cpp is confusing
-            const int properties[2] = { CSSPropertyWebkitMaskPositionX,
-                                        CSSPropertyWebkitMaskPositionY };
+            const int properties[2] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
+            return getLayeredShorthandValue(properties, 2);
+        }
+        case CSSPropertyWebkitMaskRepeat: {
+            const int properties[2] = { CSSPropertyWebkitMaskRepeatX, CSSPropertyWebkitMaskRepeatY };
             return getLayeredShorthandValue(properties, 2);
         }
         case CSSPropertyWebkitMask: {
@@ -286,6 +299,9 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
     // can safely be omitted.
     for (size_t i = 0; i < numLayers; i++) {
         String layerRes;
+        bool useRepeatXShorthand = false;
+        bool useRepeatYShorthand = false;
+        bool useSingleWordShorthand = false;
         for (size_t j = 0; j < number; j++) {
             RefPtr<CSSValue> value;
             if (values[j]) {
@@ -302,11 +318,50 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
                         value = 0;
                 }
             }
+
+            // We need to report background-repeat as it was written in the CSS. If the property is implicit,
+            // then it was written with only one value. Here we figure out which value that was so we can
+            // report back correctly. 
+            if (properties[j] == CSSPropertyBackgroundRepeatX && isPropertyImplicit(properties[j])) {
+                if (j < number - 1 && properties[j + 1] == CSSPropertyBackgroundRepeatY) {
+                    RefPtr<CSSValue> yValue;
+                    RefPtr<CSSValue> nextValue = values[j + 1];
+                    if (nextValue->isValueList())
+                        yValue = static_cast<CSSValueList*>(nextValue.get())->itemWithoutBoundsCheck(i);
+                    else
+                        yValue = nextValue;
+                        
+                    int xId = static_cast<CSSPrimitiveValue*>(value.get())->getIdent();
+                    int yId = static_cast<CSSPrimitiveValue*>(yValue.get())->getIdent();
+                    if (xId != yId) {
+                        if (xId == CSSValueRepeat && yId == CSSValueNoRepeat) {
+                            useRepeatXShorthand = true;
+                            ++j;
+                        } else if (xId == CSSValueNoRepeat && yId == CSSValueRepeat) {
+                            useRepeatYShorthand = true;
+                            continue;
+                        }
+                    } else {
+                        useSingleWordShorthand = true;
+                        ++j;
+                    }
+                }
+            }
             
             if (value && !value->isImplicitInitialValue()) {
                 if (!layerRes.isNull())
                     layerRes += " ";
-                layerRes += value->cssText();
+                if (useRepeatXShorthand) {
+                    useRepeatXShorthand = false;
+                    layerRes += getValueName(CSSValueRepeatX);
+                } else if (useRepeatYShorthand) {
+                    useRepeatYShorthand = false;
+                    layerRes += getValueName(CSSValueRepeatY);
+                } else if (useSingleWordShorthand) {
+                    useSingleWordShorthand = false;
+                    layerRes += value->cssText();
+                } else
+                    layerRes += value->cssText();
             }
         }
         
@@ -583,6 +638,8 @@ String CSSMutableStyleDeclaration::cssText() const
     
     const CSSProperty* positionXProp = 0;
     const CSSProperty* positionYProp = 0;
+    const CSSProperty* repeatXProp = 0;
+    const CSSProperty* repeatYProp = 0;
     
     unsigned size = m_properties.size();
     for (unsigned n = 0; n < size; ++n) {
@@ -591,6 +648,10 @@ String CSSMutableStyleDeclaration::cssText() const
             positionXProp = &prop;
         else if (prop.id() == CSSPropertyBackgroundPositionY)
             positionYProp = &prop;
+        else if (prop.id() == CSSPropertyBackgroundRepeatX)
+            repeatXProp = &prop;
+        else if (prop.id() == CSSPropertyBackgroundRepeatY)
+            repeatYProp = &prop;
         else
             result += prop.cssText();
     }
@@ -614,6 +675,22 @@ String CSSMutableStyleDeclaration::cssText() const
             result += positionYProp->cssText();
     }
 
+    // FIXME: We need to do the same for background-repeat.
+    if (repeatXProp && repeatYProp && repeatXProp->isImportant() == repeatYProp->isImportant()) {
+        String repeatValue;
+        const int repeatProperties[2] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
+        if (repeatXProp->value()->isValueList() || repeatYProp->value()->isValueList()) 
+            repeatValue = getLayeredShorthandValue(repeatProperties, 2);
+        else
+            repeatValue = repeatXProp->value()->cssText() + " " + repeatYProp->value()->cssText();
+        result += "background-repeat: " + repeatValue + (repeatXProp->isImportant() ? " !important" : "") + "; ";
+    } else {
+        if (repeatXProp) 
+            result += repeatXProp->cssText();
+        if (repeatYProp)
+            result += repeatYProp->cssText();
+    }
+
     return result;
 }
 
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index b79992f..b7155b3 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -4,6 +4,7 @@
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -171,7 +172,7 @@ CSSParser::~CSSParser()
     }
     delete m_floatingMediaQueryExp;
     delete m_floatingMediaQuery;
-    deleteAllValues(m_floatingSelectors);
+    fastDeleteAllValues(m_floatingSelectors);
     deleteAllValues(m_floatingValueLists);
     deleteAllValues(m_floatingFunctions);
     deleteAllValues(m_reusableSelectorVector);
@@ -747,7 +748,11 @@ bool CSSParser::parseValue(int propId, bool important)
         // inline | block | list-item | run-in | inline-block | table |
         // inline-table | table-row-group | table-header-group | table-footer-group | table-row |
         // table-column-group | table-column | table-cell | table-caption | box | inline-box | none | inherit
+#if ENABLE(WCSS)
+        if ((id >= CSSValueInline && id <= CSSValueWapMarquee) || id == CSSValueNone)
+#else
         if ((id >= CSSValueInline && id <= CSSValueWebkitInlineBox) || id == CSSValueNone)
+#endif
             valid_primitive = true;
         break;
 
@@ -920,8 +925,10 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBackgroundPosition:
     case CSSPropertyBackgroundPositionX:
     case CSSPropertyBackgroundPositionY:
-    case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyBackgroundSize:
     case CSSPropertyBackgroundRepeat:
+    case CSSPropertyBackgroundRepeatX:
+    case CSSPropertyBackgroundRepeatY:
     case CSSPropertyWebkitMaskAttachment:
     case CSSPropertyWebkitMaskClip:
     case CSSPropertyWebkitMaskComposite:
@@ -931,17 +938,21 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitMaskPositionX:
     case CSSPropertyWebkitMaskPositionY:
     case CSSPropertyWebkitMaskSize:
-    case CSSPropertyWebkitMaskRepeat: {
+    case CSSPropertyWebkitMaskRepeat:
+    case CSSPropertyWebkitMaskRepeatX:
+    case CSSPropertyWebkitMaskRepeatY: {
         RefPtr<CSSValue> val1;
         RefPtr<CSSValue> val2;
         int propId1, propId2;
+        bool result = false;
         if (parseFillProperty(propId, propId1, propId2, val1, val2)) {
             addProperty(propId1, val1.release(), important);
             if (val2)
                 addProperty(propId2, val2.release(), important);
-            return true;
+            result = true;
         }
-        return false;
+        m_implicitShorthand = false;
+        return result;
     }
     case CSSPropertyListStyleImage:     // <uri> | none | inherit
         if (id == CSSValueNone) {
@@ -1231,7 +1242,7 @@ bool CSSParser::parseValue(int propId, bool important)
         valid_primitive = validUnit(value, FLength, m_strict);
         break;
     case CSSPropertyTextShadow: // CSS2 property, dropped in CSS2.1, back in CSS3, so treat as CSS3
-    case CSSPropertyBoxShadow:
+    case CSSPropertyWebkitBoxShadow:
         if (id == CSSValueNone)
             valid_primitive = true;
         else
@@ -1313,6 +1324,28 @@ bool CSSParser::parseValue(int propId, bool important)
         else
             valid_primitive = validUnit(value, FTime|FInteger|FNonNeg, m_strict);
         break;
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeDir:
+        if (id == CSSValueLtr || id == CSSValueRtl)
+            valid_primitive = true;
+        break;
+    case CSSPropertyWapMarqueeStyle:
+        if (id == CSSValueNone || id == CSSValueSlide || id == CSSValueScroll || id == CSSValueAlternate)
+            valid_primitive = true;
+        break;
+    case CSSPropertyWapMarqueeLoop:
+        if (id == CSSValueInfinite)
+            valid_primitive = true;
+        else
+            valid_primitive = validUnit(value, FInteger | FNonNeg, m_strict);
+        break;
+    case CSSPropertyWapMarqueeSpeed:
+        if (id == CSSValueNormal || id == CSSValueSlow || id == CSSValueFast)
+            valid_primitive = true;
+        else
+            valid_primitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
+        break;
+#endif
     case CSSPropertyWebkitUserDrag: // auto | none | element
         if (id == CSSValueAuto || id == CSSValueNone || id == CSSValueElement)
             valid_primitive = true;
@@ -1452,6 +1485,11 @@ bool CSSParser::parseValue(int propId, bool important)
             id == CSSValueWave)
             valid_primitive = true;
         break;
+    case CSSPropertyTextRendering: // auto | optimizeSpeed | optimizeLegibility | geometricPrecision
+        if (id == CSSValueAuto || id == CSSValueOptimizespeed || id == CSSValueOptimizelegibility
+            || id == CSSValueGeometricprecision)
+            valid_primitive = true;
+        break;
     case CSSPropertyTextLineThroughWidth:
     case CSSPropertyTextOverlineWidth:
     case CSSPropertyTextUnderlineWidth:
@@ -1542,6 +1580,12 @@ bool CSSParser::parseValue(int propId, bool important)
             valid_primitive = true;
         break;
 
+    case CSSPropertyWebkitFontSmoothing:
+        if (id == CSSValueAuto || id == CSSValueNone 
+            || id == CSSValueAntialiased || id == CSSValueSubpixelAntialiased)
+            valid_primitive = true;
+        break;
+
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPropertyWebkitDashboardRegion:                 // <dashboard-region> | <dashboard-region> 
         if (value->unit == CSSParserValue::Function || id == CSSValueNone)
@@ -1554,7 +1598,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBackground: {
         // Position must come before color in this array because a plain old "0" is a legal color
         // in quirks mode but it's usually the X coordinate of a position.
-        // FIXME: Add CSSPropertyWebkitBackgroundSize to the shorthand.
+        // FIXME: Add CSSPropertyBackgroundSize to the shorthand.
         const int properties[] = { CSSPropertyBackgroundImage, CSSPropertyBackgroundRepeat, 
                                    CSSPropertyBackgroundAttachment, CSSPropertyBackgroundPosition, CSSPropertyBackgroundOrigin, 
                                    CSSPropertyBackgroundColor };
@@ -1736,7 +1780,7 @@ void CSSParser::addFillValue(RefPtr<CSSValue>& lval, PassRefPtr<CSSValue> rval)
         lval = rval;
 }
 
-const int cMaxFillProperties = 7;
+const int cMaxFillProperties = 9;
 
 bool CSSParser::parseFillShorthand(int propId, const int* properties, int numProperties, bool important)
 {
@@ -1750,6 +1794,7 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
     RefPtr<CSSValue> values[cMaxFillProperties];
     RefPtr<CSSValue> clipValue;
     RefPtr<CSSValue> positionYValue;
+    RefPtr<CSSValue> repeatYValue;
     int i;
 
     while (m_valueList->current()) {
@@ -1767,6 +1812,8 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                     addFillValue(values[i], CSSInitialValue::createImplicit());
                     if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                         addFillValue(positionYValue, CSSInitialValue::createImplicit());
+                    if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
+                        addFillValue(repeatYValue, CSSInitialValue::createImplicit());
                     if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) && !parsedProperty[i]) {
                         // If background-origin wasn't present, then reset background-clip also.
                         addFillValue(clipValue, CSSInitialValue::createImplicit());
@@ -1789,6 +1836,8 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                     addFillValue(values[i], val1.release());
                     if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                         addFillValue(positionYValue, val2.release());
+                    if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
+                        addFillValue(repeatYValue, val2.release());
                     if (properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) {
                         // Reparse the value as a clip, and see if we succeed.
                         if (parseFillProperty(CSSPropertyBackgroundClip, propId1, propId2, val1, val2))
@@ -1812,6 +1861,8 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
             addFillValue(values[i], CSSInitialValue::createImplicit());
             if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                 addFillValue(positionYValue, CSSInitialValue::createImplicit());
+            if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
+                addFillValue(repeatYValue, CSSInitialValue::createImplicit());
             if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) && !parsedProperty[i]) {
                 // If background-origin wasn't present, then reset background-clip also.
                 addFillValue(clipValue, CSSInitialValue::createImplicit());
@@ -1829,6 +1880,14 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
             addProperty(CSSPropertyWebkitMaskPositionX, values[i].release(), important);
             // it's OK to call positionYValue.release() since we only see CSSPropertyWebkitMaskPosition once
             addProperty(CSSPropertyWebkitMaskPositionY, positionYValue.release(), important);
+        } else if (properties[i] == CSSPropertyBackgroundRepeat) {
+            addProperty(CSSPropertyBackgroundRepeatX, values[i].release(), important);
+            // it's OK to call repeatYValue.release() since we only see CSSPropertyBackgroundPosition once
+            addProperty(CSSPropertyBackgroundRepeatY, repeatYValue.release(), important);
+        } else if (properties[i] == CSSPropertyWebkitMaskRepeat) {
+            addProperty(CSSPropertyWebkitMaskRepeatX, values[i].release(), important);
+            // it's OK to call repeatYValue.release() since we only see CSSPropertyBackgroundPosition once
+            addProperty(CSSPropertyWebkitMaskRepeatY, repeatYValue.release(), important);
         } else
             addProperty(properties[i], values[i].release(), important);
             
@@ -2156,7 +2215,7 @@ PassRefPtr<CSSValue> CSSParser::parseAttr(CSSParserValueList* args)
     if (attrName[0] == '-')
         return 0;
 
-    if (document()->isHTMLDocument())
+    if (document() && document()->isHTMLDocument())
         attrName = attrName.lower();
     
     return CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR);
@@ -2269,9 +2328,59 @@ void CSSParser::parseFillPosition(RefPtr<CSSValue>& value1, RefPtr<CSSValue>& va
         value1.swap(value2);
 }
 
-PassRefPtr<CSSValue> CSSParser::parseFillSize()
+void CSSParser::parseFillRepeat(RefPtr<CSSValue>& value1, RefPtr<CSSValue>& value2)
+{
+    CSSParserValue* value = m_valueList->current();
+
+    int id = m_valueList->current()->id;
+    if (id == CSSValueRepeatX) {
+        m_implicitShorthand = true;
+        value1 = CSSPrimitiveValue::createIdentifier(CSSValueRepeat);
+        value2 = CSSPrimitiveValue::createIdentifier(CSSValueNoRepeat);
+        m_valueList->next();
+        return;
+    } 
+    if (id == CSSValueRepeatY) {
+        m_implicitShorthand = true;
+        value1 = CSSPrimitiveValue::createIdentifier(CSSValueNoRepeat);
+        value2 = CSSPrimitiveValue::createIdentifier(CSSValueRepeat);
+        m_valueList->next();
+        return;    
+    }
+    if (id == CSSValueRepeat || id == CSSValueNoRepeat || id == CSSValueRound || id == CSSValueSpace)
+        value1 = CSSPrimitiveValue::createIdentifier(id);
+    else {
+        value1 = 0;
+        return;
+    }
+
+    value = m_valueList->next();
+
+    // First check for the comma.  If so, we are finished parsing this value or value pair.
+    if (value && value->unit == CSSParserValue::Operator && value->iValue == ',')
+        value = 0;
+
+    if (value)
+        id = m_valueList->current()->id;
+    
+    if (value && (id == CSSValueRepeat || id == CSSValueNoRepeat || id == CSSValueRound || id == CSSValueSpace)) {
+        value2 = CSSPrimitiveValue::createIdentifier(id);
+        m_valueList->next();
+    } else { 
+        // If only one value was specified, value2 is the same as value1.
+        m_implicitShorthand = true;
+        value2 = CSSPrimitiveValue::createIdentifier(static_cast<CSSPrimitiveValue*>(value1.get())->getIdent());
+    }
+}
+
+PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
 {
+    allowComma = true;
     CSSParserValue* value = m_valueList->current();
+
+    if (value->id == CSSValueContain || value->id == CSSValueCover)
+        return CSSPrimitiveValue::createIdentifier(value->id);
+
     RefPtr<CSSPrimitiveValue> parsedValue1;
     
     if (value->id == CSSValueAuto)
@@ -2286,6 +2395,8 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize()
     if ((value = m_valueList->next())) {
         if (value->id == CSSValueAuto)
             parsedValue2 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
+        else if (value->unit == CSSParserValue::Operator && value->iValue == ',')
+            allowComma = false;
         else {
             if (!validUnit(value, FLength|FPercent, m_strict))
                 return 0;
@@ -2316,6 +2427,12 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
     } else if (propId == CSSPropertyWebkitMaskPosition) {
         propId1 = CSSPropertyWebkitMaskPositionX;
         propId2 = CSSPropertyWebkitMaskPositionY;
+    } else if (propId == CSSPropertyBackgroundRepeat) {
+        propId1 = CSSPropertyBackgroundRepeatX;
+        propId2 = CSSPropertyBackgroundRepeatY;
+    } else if (propId == CSSPropertyWebkitMaskRepeat) {
+        propId1 = CSSPropertyWebkitMaskRepeatX;
+        propId2 = CSSPropertyWebkitMaskRepeatY;
     }
 
     while ((val = m_valueList->current())) {
@@ -2328,6 +2445,7 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
             m_valueList->next();
             allowComma = false;
         } else {
+            allowComma = true;
             switch (propId) {
                 case CSSPropertyBackgroundColor:
                     currValue = parseBackgroundColor();
@@ -2402,17 +2520,16 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                     break;
                 case CSSPropertyBackgroundRepeat:
                 case CSSPropertyWebkitMaskRepeat:
-                    if (val->id >= CSSValueRepeat && val->id <= CSSValueNoRepeat) {
-                        currValue = CSSPrimitiveValue::createIdentifier(val->id);
-                        m_valueList->next();
-                    }
+                    parseFillRepeat(currValue, currValue2);
+                    // parseFillRepeat advances the m_valueList pointer
                     break;
-                case CSSPropertyWebkitBackgroundSize:
-                case CSSPropertyWebkitMaskSize:
-                    currValue = parseFillSize();
+                case CSSPropertyBackgroundSize:
+                case CSSPropertyWebkitMaskSize: {
+                    currValue = parseFillSize(allowComma);
                     if (currValue)
                         m_valueList->next();
                     break;
+                }
             }
             if (!currValue)
                 return false;
@@ -2437,7 +2554,6 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                 else
                     value2 = currValue2.release();
             }
-            allowComma = true;
         }
         
         // When parsing any fill shorthand property, we let it handle building up the lists for all
@@ -3554,7 +3670,7 @@ struct ShadowParseContext {
         , allowBlur(false)
         , allowSpread(false)
         , allowColor(true)
-        , allowStyle(prop == CSSPropertyBoxShadow)
+        , allowStyle(prop == CSSPropertyWebkitBoxShadow)
         , allowBreak(true)
     {
     }
@@ -3586,7 +3702,7 @@ struct ShadowParseContext {
         allowY = false;
         allowBlur = false;
         allowSpread = false;
-        allowStyle = property == CSSPropertyBoxShadow;
+        allowStyle = property == CSSPropertyWebkitBoxShadow;
     }
 
     void commitLength(CSSParserValue* v)
@@ -3605,12 +3721,12 @@ struct ShadowParseContext {
             allowY = false;
             allowBlur = true;
             allowColor = true;
-            allowStyle = property == CSSPropertyBoxShadow;
+            allowStyle = property == CSSPropertyWebkitBoxShadow;
             allowBreak = true;
         } else if (allowBlur) {
             blur = val.release();
             allowBlur = false;
-            allowSpread = property == CSSPropertyBoxShadow;
+            allowSpread = property == CSSPropertyWebkitBoxShadow;
         } else if (allowSpread) {
             spread = val.release();
             allowSpread = false;
@@ -3627,7 +3743,7 @@ struct ShadowParseContext {
         } else {
             allowBlur = false;
             allowSpread = false;
-            allowStyle = property == CSSPropertyBoxShadow;
+            allowStyle = property == CSSPropertyWebkitBoxShadow;
         }
     }
 
@@ -4730,7 +4846,7 @@ UChar* CSSParser::text(int *length)
 
 CSSSelector* CSSParser::createFloatingSelector()
 {
-    CSSSelector* selector = new CSSSelector;
+    CSSSelector* selector = fastNew<CSSSelector>();
     m_floatingSelectors.add(selector);
     return selector;
 }
@@ -5126,11 +5242,11 @@ static int cssPropertyID(const UChar* propertyName, unsigned length)
                 const char* const opacity = "opacity";
                 name = opacity;
                 length = strlen(opacity);
-            } else if (strcmp(buffer, "-webkit-box-shadow") == 0) {
-                // CSS Backgrounds/Borders.  -webkit-box-shadow worked in Safari 4 and earlier.
-                const char* const boxShadow = "box-shadow";
-                name = boxShadow;
-                length = strlen(boxShadow);
+            } else if (strcmp(buffer, "-webkit-background-size") == 0) {
+                // CSS Backgrounds/Borders.  -webkit-background-size worked in Safari 4 and earlier.
+                const char* const backgroundSize = "background-size";
+                name = backgroundSize;
+                length = strlen(backgroundSize);
             } else if (hasPrefix(buffer + 7, length - 7, "-border-")) {
                 // -webkit-border-*-*-radius worked in Safari 4 and earlier. -webkit-border-radius syntax
                 // differs from border-radius, so it is remains as a distinct property.
diff --git a/WebCore/css/CSSParser.h b/WebCore/css/CSSParser.h
index 5a2b283..1a156da 100644
--- a/WebCore/css/CSSParser.h
+++ b/WebCore/css/CSSParser.h
@@ -82,7 +82,8 @@ namespace WebCore {
         bool parseFillImage(RefPtr<CSSValue>&);
         PassRefPtr<CSSValue> parseFillPositionXY(bool& xFound, bool& yFound);
         void parseFillPosition(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
-        PassRefPtr<CSSValue> parseFillSize();
+        void parseFillRepeat(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
+        PassRefPtr<CSSValue> parseFillSize(bool &allowComma);
         
         bool parseFillProperty(int propId, int& propId1, int& propId2, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         bool parseFillShorthand(int propId, const int* properties, int numProperties, bool important);
diff --git a/WebCore/css/CSSPrimitiveValue.cpp b/WebCore/css/CSSPrimitiveValue.cpp
index 6343dac..1f2c9ca 100644
--- a/WebCore/css/CSSPrimitiveValue.cpp
+++ b/WebCore/css/CSSPrimitiveValue.cpp
@@ -643,7 +643,7 @@ Rect* CSSPrimitiveValue::getRectValue(ExceptionCode& ec) const
     return m_value.rect;
 }
 
-RGBColor* CSSPrimitiveValue::getRGBColorValue(ExceptionCode& ec) const
+PassRefPtr<RGBColor> CSSPrimitiveValue::getRGBColorValue(ExceptionCode& ec) const
 {
     ec = 0;
     if (m_type != CSS_RGBCOLOR) {
@@ -652,7 +652,7 @@ RGBColor* CSSPrimitiveValue::getRGBColorValue(ExceptionCode& ec) const
     }
 
     // FIMXE: This should not return a new object for each invocation.
-    return RGBColor::create(m_value.rgbcolor).releaseRef();
+    return RGBColor::create(m_value.rgbcolor);
 }
 
 Pair* CSSPrimitiveValue::getPairValue(ExceptionCode& ec) const
diff --git a/WebCore/css/CSSPrimitiveValue.h b/WebCore/css/CSSPrimitiveValue.h
index 85a0ba3..d417619 100644
--- a/WebCore/css/CSSPrimitiveValue.h
+++ b/WebCore/css/CSSPrimitiveValue.h
@@ -152,7 +152,7 @@ public:
     Rect* getRectValue(ExceptionCode&) const;
     Rect* getRectValue() const { return m_type != CSS_RECT ? 0 : m_value.rect; }
 
-    RGBColor* getRGBColorValue(ExceptionCode&) const;
+    PassRefPtr<RGBColor> getRGBColorValue(ExceptionCode&) const;
     RGBA32 getRGBA32Value() const { return m_type != CSS_RGBCOLOR ? 0 : m_value.rgbcolor; }
 
     Pair* getPairValue(ExceptionCode&) const;
diff --git a/WebCore/css/CSSPrimitiveValueMappings.h b/WebCore/css/CSSPrimitiveValueMappings.h
index 69cfbb1..3616aa5 100644
--- a/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2007 Alexey Proskuryakov <ap@nypop.com>.
  * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,11 +30,13 @@
 
 #include "CSSPrimitiveValue.h"
 #include "CSSValueKeywords.h"
+#include "FontSmoothingMode.h"
 #include "GraphicsTypes.h"
 #include "Path.h"
 #include "RenderStyleConstants.h"
 #include "SVGRenderStyleDefs.h"
 #include "TextDirection.h"
+#include "TextRenderingMode.h"
 #include "ThemeTypes.h"
 
 namespace WebCore {
@@ -197,6 +200,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case ListboxPart:
             m_value.ident = CSSValueListbox;
             break;
+#if ENABLE(DATALIST)
+        case ListButtonPart:
+            m_value.ident = CSSValueListButton;
+            break;
+#endif
         case ListItemPart:
             m_value.ident = CSSValueListitem;
             break;
@@ -227,6 +235,15 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaSliderThumbPart:
             m_value.ident = CSSValueMediaSliderthumb;
             break;
+        case MediaVolumeSliderContainerPart:
+            m_value.ident = CSSValueMediaVolumeSliderContainer;
+            break;
+        case MediaVolumeSliderPart:
+            m_value.ident = CSSValueMediaVolumeSlider;
+            break;
+        case MediaVolumeSliderThumbPart:
+            m_value.ident = CSSValueMediaVolumeSliderthumb;
+            break;
         case MediaControlsBackgroundPart:
             m_value.ident = CSSValueMediaControlsBackground;
             break;
@@ -375,15 +392,15 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EFillRepeat e)
         case RepeatFill:
             m_value.ident = CSSValueRepeat;
             break;
-        case RepeatXFill:
-            m_value.ident = CSSValueRepeatX;
-            break;
-        case RepeatYFill:
-            m_value.ident = CSSValueRepeatY;
-            break;
         case NoRepeatFill:
             m_value.ident = CSSValueNoRepeat;
             break;
+        case RoundFill:
+            m_value.ident = CSSValueRound;
+            break;
+        case SpaceFill:
+            m_value.ident = CSSValueSpace;
+            break;
     }
 }
 
@@ -392,12 +409,12 @@ template<> inline CSSPrimitiveValue::operator EFillRepeat() const
     switch (m_value.ident) {
         case CSSValueRepeat:
             return RepeatFill;
-        case CSSValueRepeatX:
-            return RepeatXFill;
-        case CSSValueRepeatY:
-            return RepeatYFill;
         case CSSValueNoRepeat:
             return NoRepeatFill;
+        case CSSValueRound:
+            return RoundFill;
+        case CSSValueSpace:
+            return SpaceFill;
         default:
             ASSERT_NOT_REACHED();
             return RepeatFill;
@@ -522,6 +539,7 @@ template<> inline CSSPrimitiveValue::operator EBoxOrient() const
         case CSSValueInlineAxis:
             return HORIZONTAL;
         case CSSValueVertical:
+        case CSSValueBlockAxis:
             return VERTICAL;
         default:
             ASSERT_NOT_REACHED();
@@ -777,6 +795,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EDisplay e)
         case TABLE_CAPTION:
             m_value.ident = CSSValueTableCaption;
             break;
+#if ENABLE(WCSS)
+        case WAP_MARQUEE:
+            m_value.ident = CSSValueWapMarquee;
+            break;
+#endif
         case BOX:
             m_value.ident = CSSValueWebkitBox;
             break;
@@ -1782,6 +1805,81 @@ template<> inline CSSPrimitiveValue::operator EPointerEvents() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(FontSmoothingMode smoothing)
+    : m_type(CSS_IDENT)
+{
+    switch (smoothing) {
+    case AutoSmoothing:
+        m_value.ident = CSSValueAuto;
+        return;
+    case NoSmoothing:
+        m_value.ident = CSSValueNone;
+        return;
+    case Antialiased:
+        m_value.ident = CSSValueAntialiased;
+        return;
+    case SubpixelAntialiased:
+        m_value.ident = CSSValueSubpixelAntialiased;
+        return;
+    }
+    
+    ASSERT_NOT_REACHED();
+    m_value.ident = CSSValueAuto;
+}
+
+template<> inline CSSPrimitiveValue::operator FontSmoothingMode() const
+{
+    switch (m_value.ident) {
+    case CSSValueAuto:
+        return AutoSmoothing;
+    case CSSValueNone:
+        return NoSmoothing;
+    case CSSValueAntialiased:
+        return Antialiased;
+    case CSSValueSubpixelAntialiased:
+        return SubpixelAntialiased;
+    }
+    
+    ASSERT_NOT_REACHED();
+    return AutoSmoothing;
+}
+
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(TextRenderingMode e)
+    : m_type(CSS_IDENT)
+{
+    switch (e) {
+        case AutoTextRendering:
+            m_value.ident = CSSValueAuto;
+            break;
+        case OptimizeSpeed:
+            m_value.ident = CSSValueOptimizespeed;
+            break;
+        case OptimizeLegibility:
+            m_value.ident = CSSValueOptimizelegibility;
+            break;
+        case GeometricPrecision:
+            m_value.ident = CSSValueGeometricprecision;
+            break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator TextRenderingMode() const
+{
+    switch (m_value.ident) {
+        case CSSValueAuto:
+            return AutoTextRendering;
+        case CSSValueOptimizespeed:
+            return OptimizeSpeed;
+        case CSSValueOptimizelegibility:
+            return OptimizeLegibility;
+        case CSSValueGeometricprecision:
+            return GeometricPrecision;
+        default:
+            ASSERT_NOT_REACHED();
+            return AutoTextRendering;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
@@ -2185,42 +2283,6 @@ template<> inline CSSPrimitiveValue::operator ETextAnchor() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ETextRendering e)
-    : m_type(CSS_IDENT)
-{
-    switch (e) {
-        case TR_AUTO:
-            m_value.ident = CSSValueAuto;
-            break;
-        case TR_OPTIMIZESPEED:
-            m_value.ident = CSSValueOptimizespeed;
-            break;
-        case TR_OPTIMIZELEGIBILITY:
-            m_value.ident = CSSValueOptimizelegibility;
-            break;
-        case TR_GEOMETRICPRECISION:
-            m_value.ident = CSSValueGeometricprecision;
-            break;
-    }
-}
-
-template<> inline CSSPrimitiveValue::operator ETextRendering() const
-{
-    switch (m_value.ident) {
-        case CSSValueAuto:
-            return TR_AUTO;
-        case CSSValueOptimizespeed:
-            return TR_OPTIMIZESPEED;
-        case CSSValueOptimizelegibility:
-            return TR_OPTIMIZELEGIBILITY;
-        case CSSValueGeometricprecision:
-            return TR_GEOMETRICPRECISION;
-        default:
-            ASSERT_NOT_REACHED();
-            return TR_AUTO;
-    }
-}
-
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EWritingMode e)
     : m_type(CSS_IDENT)
 {
diff --git a/WebCore/css/CSSPropertyLonghand.cpp b/WebCore/css/CSSPropertyLonghand.cpp
index b15f31e..b45fa0d 100644
--- a/WebCore/css/CSSPropertyLonghand.cpp
+++ b/WebCore/css/CSSPropertyLonghand.cpp
@@ -77,6 +77,9 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
     static const int backgroundPositionProperties[] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackgroundPosition, backgroundPositionProperties);
 
+    static const int backgroundRepeatProperties[] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackgroundRepeat, backgroundRepeatProperties);
+
     static const int borderSpacingProperties[] = { CSSPropertyWebkitBorderHorizontalSpacing, CSSPropertyWebkitBorderVerticalSpacing };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderSpacing, borderSpacingProperties);
 
@@ -134,7 +137,8 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
         CSSPropertyBackgroundOrigin,
         CSSPropertyBackgroundPositionX,
         CSSPropertyBackgroundPositionY,
-        CSSPropertyBackgroundRepeat,
+        CSSPropertyBackgroundRepeatX,
+        CSSPropertyBackgroundRepeatY
     };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackground, backgroundProperties);
 
@@ -163,6 +167,9 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
     static const int maskPositionProperties[] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMaskPosition, maskPositionProperties);
 
+    static const int maskRepeatProperties[] = { CSSPropertyWebkitMaskRepeatX, CSSPropertyWebkitMaskRepeatY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMaskRepeat, maskRepeatProperties);
+
     static const int maskProperties[] = {
         CSSPropertyWebkitMaskAttachment,
         CSSPropertyWebkitMaskClip,
@@ -170,7 +177,8 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
         CSSPropertyWebkitMaskOrigin,
         CSSPropertyWebkitMaskPositionX,
         CSSPropertyWebkitMaskPositionY,
-        CSSPropertyWebkitMaskRepeat,
+        CSSPropertyWebkitMaskRepeatX,
+        CSSPropertyWebkitMaskRepeatY
     };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMask, maskProperties);
 
diff --git a/WebCore/css/CSSPropertyNames.in b/WebCore/css/CSSPropertyNames.in
index 40e456f..7bed755 100644
--- a/WebCore/css/CSSPropertyNames.in
+++ b/WebCore/css/CSSPropertyNames.in
@@ -18,6 +18,9 @@ background-position
 background-position-x
 background-position-y
 background-repeat
+background-repeat-x
+background-repeat-y
+background-size
 border
 border-bottom
 border-bottom-color
@@ -46,7 +49,6 @@ border-top-style
 border-top-width
 border-width
 bottom
-box-shadow
 caption-side
 clear
 clip
@@ -124,6 +126,7 @@ text-overline-color
 text-overline-mode
 text-overline-style
 text-overline-width
+text-rendering
 text-shadow
 text-transform
 text-underline
@@ -157,7 +160,6 @@ zoom
 -webkit-background-clip
 -webkit-background-composite
 -webkit-background-origin
--webkit-background-size
 -webkit-binding
 -webkit-border-fit
 -webkit-border-horizontal-spacing
@@ -177,6 +179,7 @@ zoom
 -webkit-box-orient
 -webkit-box-pack
 -webkit-box-reflect
+-webkit-box-shadow
 -webkit-box-sizing
 -webkit-column-break-after
 -webkit-column-break-before
@@ -190,6 +193,7 @@ zoom
 -webkit-column-width
 -webkit-columns
 -webkit-font-size-delta
+-webkit-font-smoothing
 -webkit-highlight
 -webkit-line-break
 -webkit-line-clamp
@@ -214,6 +218,8 @@ zoom
 -webkit-mask-position-x
 -webkit-mask-position-y
 -webkit-mask-repeat
+-webkit-mask-repeat-x
+-webkit-mask-repeat-y
 -webkit-mask-size
 -webkit-match-nearest-mail-blockquote-color
 -webkit-nbsp-mode
diff --git a/WebCore/css/CSSRuleList.idl b/WebCore/css/CSSRuleList.idl
index 224d6a1..9add078 100644
--- a/WebCore/css/CSSRuleList.idl
+++ b/WebCore/css/CSSRuleList.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         InterfaceUUID=64c346a0-1e34-49d3-9472-57ec8e0fdccb,
diff --git a/WebCore/css/CSSSelector.cpp b/WebCore/css/CSSSelector.cpp
index 80910a7..313528f 100644
--- a/WebCore/css/CSSSelector.cpp
+++ b/WebCore/css/CSSSelector.cpp
@@ -77,9 +77,12 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, before, ("before"));
     DEFINE_STATIC_LOCAL(AtomicString, checked, ("checked"));
     DEFINE_STATIC_LOCAL(AtomicString, fileUploadButton, ("-webkit-file-upload-button"));
+    DEFINE_STATIC_LOCAL(AtomicString, defaultString, ("default"));
     DEFINE_STATIC_LOCAL(AtomicString, disabled, ("disabled"));
     DEFINE_STATIC_LOCAL(AtomicString, readOnly, ("read-only"));
     DEFINE_STATIC_LOCAL(AtomicString, readWrite, ("read-write"));
+    DEFINE_STATIC_LOCAL(AtomicString, valid, ("valid"));
+    DEFINE_STATIC_LOCAL(AtomicString, invalid, ("invalid"));
     DEFINE_STATIC_LOCAL(AtomicString, drag, ("-webkit-drag"));
     DEFINE_STATIC_LOCAL(AtomicString, dragAlias, ("-khtml-drag")); // was documented with this name in Apple documentation, so keep an alia
     DEFINE_STATIC_LOCAL(AtomicString, empty, ("empty"));
@@ -96,6 +99,9 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, focus, ("focus"));
     DEFINE_STATIC_LOCAL(AtomicString, hover, ("hover"));
     DEFINE_STATIC_LOCAL(AtomicString, indeterminate, ("indeterminate"));
+#if ENABLE(DATALIST)
+    DEFINE_STATIC_LOCAL(AtomicString, inputListButton, ("-webkit-input-list-button"));
+#endif
     DEFINE_STATIC_LOCAL(AtomicString, inputPlaceholder, ("-webkit-input-placeholder"));
     DEFINE_STATIC_LOCAL(AtomicString, lastChild, ("last-child"));
     DEFINE_STATIC_LOCAL(AtomicString, lastOfType, ("last-of-type"));
@@ -105,6 +111,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsMuteButton, ("-webkit-media-controls-mute-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsPlayButton, ("-webkit-media-controls-play-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeline, ("-webkit-media-controls-timeline"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsVolumeSlider, ("-webkit-media-controls-volume-slider"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekBackButton, ("-webkit-media-controls-seek-back-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekForwardButton, ("-webkit-media-controls-seek-forward-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsRewindButton, ("-webkit-media-controls-rewind-button"));
@@ -112,6 +119,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsStatusDisplay, ("-webkit-media-controls-status-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsFullscreenButton, ("-webkit-media-controls-fullscreen-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimelineContainer, ("-webkit-media-controls-timeline-container"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsVolumeSliderContainer, ("-webkit-media-controls-volume-slider-container"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsCurrentTimeDisplay, ("-webkit-media-controls-current-time-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeRemainingDisplay, ("-webkit-media-controls-time-remaining-display"));
     DEFINE_STATIC_LOCAL(AtomicString, notStr, ("not("));
@@ -170,12 +178,18 @@ void CSSSelector::extractPseudoType() const
     else if (m_value == fileUploadButton) {
         m_pseudoType = PseudoFileUploadButton;
         element = true;
-    } else if (m_value == disabled)
+    } else if (m_value == defaultString)
+        m_pseudoType = PseudoDefault;
+    else if (m_value == disabled)
         m_pseudoType = PseudoDisabled;
     else if (m_value == readOnly)
         m_pseudoType = PseudoReadOnly;
     else if (m_value == readWrite)
         m_pseudoType = PseudoReadWrite;
+    else if (m_value == valid)
+        m_pseudoType = PseudoValid;
+    else if (m_value == invalid)
+        m_pseudoType = PseudoInvalid;
     else if (m_value == drag || m_value == dragAlias)
         m_pseudoType = PseudoDrag;
     else if (m_value == enabled)
@@ -186,7 +200,14 @@ void CSSSelector::extractPseudoType() const
         m_pseudoType = PseudoFirstChild;
     else if (m_value == fullPageMedia)
         m_pseudoType = PseudoFullPageMedia;
-    else if (m_value == inputPlaceholder) {
+    else
+#if ENABLE(DATALIST)
+    if (m_value == inputListButton) {
+        m_pseudoType = PseudoInputListButton;
+        element = true;
+    } else
+#endif
+    if (m_value == inputPlaceholder) {
         m_pseudoType = PseudoInputPlaceholder;
         element = true;
     } else if (m_value == lastChild)
@@ -235,6 +256,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsTimeline) {
         m_pseudoType = PseudoMediaControlsTimeline;
         element = true;
+    } else if (m_value == mediaControlsVolumeSlider) {
+        m_pseudoType = PseudoMediaControlsVolumeSlider;
+        element = true;
     } else if (m_value == mediaControlsSeekBackButton) {
         m_pseudoType = PseudoMediaControlsSeekBackButton;
         element = true;
@@ -256,6 +280,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsTimelineContainer) {
         m_pseudoType = PseudoMediaControlsTimelineContainer;
         element = true;
+    } else if (m_value == mediaControlsVolumeSliderContainer) {
+        m_pseudoType = PseudoMediaControlsVolumeSliderContainer;
+        element = true;
     } else if (m_value == notStr)
         m_pseudoType = PseudoNot;
     else if (m_value == nthChild)
diff --git a/WebCore/css/CSSSelector.h b/WebCore/css/CSSSelector.h
index 18251fd..0c3b677 100644
--- a/WebCore/css/CSSSelector.h
+++ b/WebCore/css/CSSSelector.h
@@ -126,12 +126,15 @@ namespace WebCore {
             PseudoChecked,
             PseudoEnabled,
             PseudoFullPageMedia,
+            PseudoDefault,
             PseudoDisabled,
             PseudoInputPlaceholder,
             PseudoOptional,
             PseudoRequired,
             PseudoReadOnly,
             PseudoReadWrite,
+            PseudoValid,
+            PseudoInvalid,
             PseudoIndeterminate,
             PseudoTarget,
             PseudoBefore,
@@ -170,15 +173,18 @@ namespace WebCore {
             PseudoMediaControlsMuteButton,
             PseudoMediaControlsPlayButton,
             PseudoMediaControlsTimelineContainer,
+            PseudoMediaControlsVolumeSliderContainer,
             PseudoMediaControlsCurrentTimeDisplay,
             PseudoMediaControlsTimeRemainingDisplay,
             PseudoMediaControlsTimeline,
+            PseudoMediaControlsVolumeSlider,
             PseudoMediaControlsSeekBackButton,
             PseudoMediaControlsSeekForwardButton,
             PseudoMediaControlsRewindButton,
             PseudoMediaControlsReturnToRealtimeButton,
             PseudoMediaControlsStatusDisplay,
-            PseudoMediaControlsFullscreenButton
+            PseudoMediaControlsFullscreenButton,
+            PseudoInputListButton
         };
 
         PseudoType pseudoType() const
diff --git a/WebCore/css/CSSSelectorList.cpp b/WebCore/css/CSSSelectorList.cpp
index 5ad3809..7f82ca4 100644
--- a/WebCore/css/CSSSelectorList.cpp
+++ b/WebCore/css/CSSSelectorList.cpp
@@ -55,11 +55,9 @@ void CSSSelectorList::adoptSelectorVector(Vector<CSSSelector*>& selectorVector)
     m_selectorArray = reinterpret_cast<CSSSelector*>(fastMalloc(sizeof(CSSSelector) * selectorVector.size()));
     for (size_t i = 0; i < size; ++i) {
         memcpy(&m_selectorArray[i], selectorVector[i], sizeof(CSSSelector));
-        // We want to free the memory (which was allocated with new), but we
-        // don't want the destructor to run since it will affect the copy
-        // we've just made. In theory this is undefined, but operator delete
-        // is only defined taking a void*, so in practice it should be ok.
-        delete reinterpret_cast<char*>(selectorVector[i]);
+        // We want to free the memory (which was allocated with fastNew), but we
+        // don't want the destructor to run since it will affect the copy we've just made.
+        fastDeleteSkippingDestructor(selectorVector[i]);
         ASSERT(!m_selectorArray[i].isLastInSelectorList());
     }
     m_selectorArray[size - 1].setLastInSelectorList();
@@ -91,4 +89,51 @@ void CSSSelectorList::deleteSelectors()
     }
 }
 
+
+template <typename Functor>
+static bool forEachTagSelector(Functor& functor, CSSSelector* selector)
+{
+    ASSERT(selector);
+
+    do {
+        if (functor(selector))
+            return true;
+        if (CSSSelector* simpleSelector = selector->simpleSelector()) {
+            if (forEachTagSelector(functor, simpleSelector))
+                return true;
+        }
+    } while ((selector = selector->tagHistory()));
+
+    return false;
+}
+
+template <typename Functor>
+static bool forEachSelector(Functor& functor, const CSSSelectorList* selectorList)
+{
+    for (CSSSelector* selector = selectorList->first(); selector; selector = CSSSelectorList::next(selector)) {
+        if (forEachTagSelector(functor, selector))
+            return true;
+    }
+
+    return false;
+}
+
+class SelectorNeedsNamespaceResolutionFunctor {
+public:
+    bool operator()(CSSSelector* selector)
+    {
+        if (selector->hasTag() && selector->m_tag.prefix() != nullAtom && selector->m_tag.prefix() != starAtom)
+            return true;
+        if (selector->hasAttribute() && selector->attribute().prefix() != nullAtom && selector->attribute().prefix() != starAtom)
+            return true;
+        return false;
+    }
+};
+
+bool CSSSelectorList::selectorsNeedNamespaceResolution()
+{
+    SelectorNeedsNamespaceResolutionFunctor functor;
+    return forEachSelector(functor, this);
 }
+
+} // namespace WebCore
diff --git a/WebCore/css/CSSSelectorList.h b/WebCore/css/CSSSelectorList.h
index 3518139..9e40ef8 100644
--- a/WebCore/css/CSSSelectorList.h
+++ b/WebCore/css/CSSSelectorList.h
@@ -31,25 +31,27 @@
 
 namespace WebCore {
     
-    class CSSSelectorList : public Noncopyable {
-    public:
-        CSSSelectorList() : m_selectorArray(0) { }
-        ~CSSSelectorList();
-
-        void adopt(CSSSelectorList& list);
-        void adoptSelectorVector(Vector<CSSSelector*>& selectorVector);
-        
-        CSSSelector* first() const { return m_selectorArray ? m_selectorArray : 0; }
-        static CSSSelector* next(CSSSelector* previous) { return previous->isLastInSelectorList() ? 0 : previous + 1; }
-        bool hasOneSelector() const { return m_selectorArray ? m_selectorArray->isLastInSelectorList() : false; }
-        
-    private:
-        void deleteSelectors();
-
-        // End of the array is indicated by m_isLastInSelectorList bit in the last item.
-        CSSSelector* m_selectorArray;
-    };
-
-}
-
-#endif
+class CSSSelectorList : public Noncopyable {
+public:
+    CSSSelectorList() : m_selectorArray(0) { }
+    ~CSSSelectorList();
+
+    void adopt(CSSSelectorList& list);
+    void adoptSelectorVector(Vector<CSSSelector*>& selectorVector);
+    
+    CSSSelector* first() const { return m_selectorArray ? m_selectorArray : 0; }
+    static CSSSelector* next(CSSSelector* previous) { return previous->isLastInSelectorList() ? 0 : previous + 1; }
+    bool hasOneSelector() const { return m_selectorArray ? m_selectorArray->isLastInSelectorList() : false; }
+
+    bool selectorsNeedNamespaceResolution();
+
+private:
+    void deleteSelectors();
+
+    // End of the array is indicated by m_isLastInSelectorList bit in the last item.
+    CSSSelector* m_selectorArray;
+};
+
+} // namespace WebCore
+
+#endif // CSSSelectorList_h
diff --git a/WebCore/css/CSSStyleDeclaration.idl b/WebCore/css/CSSStyleDeclaration.idl
index f7ce37f..3e37418 100644
--- a/WebCore/css/CSSStyleDeclaration.idl
+++ b/WebCore/css/CSSStyleDeclaration.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,6 +22,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         DelegatingPutFunction,
         HasNameGetter,
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index 9074476..69c5598 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -408,7 +408,9 @@ static const MediaQueryEvaluator& printEval()
     return staticPrintEval;
 }
 
-CSSStyleSelector::CSSStyleSelector(Document* doc, const String& userStyleSheet, StyleSheetList* styleSheets, CSSStyleSheet* mappedElementSheet, bool strictParsing, bool matchAuthorAndUserStyles)
+CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, CSSStyleSheet* mappedElementSheet,
+                                   CSSStyleSheet* pageUserSheet, const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets,
+                                   bool strictParsing, bool matchAuthorAndUserStyles)
     : m_backgroundData(BackgroundFillLayer)
     , m_checker(doc, strictParsing)
     , m_fontSelector(CSSFontSelector::create(doc))
@@ -449,12 +451,15 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, const String& userStyleSheet,
     }
 
     // FIXME: This sucks! The user sheet is reparsed every time!
-    if (!userStyleSheet.isEmpty()) {
-        m_userSheet = CSSStyleSheet::create(doc);
-        m_userSheet->parseString(userStyleSheet, strictParsing);
-
+    if (pageUserSheet || pageGroupUserSheets) {
         m_userStyle = new CSSRuleSet();
-        m_userStyle->addRulesFromSheet(m_userSheet.get(), *m_medium, this);
+        if (pageUserSheet)
+            m_userStyle->addRulesFromSheet(pageUserSheet, *m_medium, this);
+        if (pageGroupUserSheets) {
+            unsigned length = pageGroupUserSheets->size();
+            for (unsigned i = 0; i < length; i++)
+                m_userStyle->addRulesFromSheet(pageGroupUserSheets->at(i).get(), *m_medium, this);
+        }
     }
 
     // add stylesheets from document
@@ -995,6 +1000,13 @@ bool CSSStyleSelector::canShareStyleWithElement(Node* n)
 
                 if (s->isEnabledFormControl() != m_element->isEnabledFormControl())
                     return false;
+
+                if (s->isDefaultButtonForForm() != m_element->isDefaultButtonForForm())
+                    return false;
+
+                if ((s->willValidate() && s->isValidFormControlElement()) !=
+                    (m_element->willValidate() && m_element->isValidFormControlElement()))
+                    return false;
             }
 
             if (style->transitions() || style->animations())
@@ -1127,6 +1139,17 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
     }
 #endif
 
+#if ENABLE(MATHML)
+    static bool loadedMathMLUserAgentSheet;
+    if (e->isMathMLElement() && !loadedMathMLUserAgentSheet) {
+        // MathML rules.
+        loadedMathMLUserAgentSheet = true;
+        CSSStyleSheet* mathMLSheet = parseUASheet(mathmlUserAgentStyleSheet, sizeof(mathmlUserAgentStyleSheet));
+        defaultStyle->addRulesFromSheet(mathMLSheet, screenEval());
+        defaultPrintStyle->addRulesFromSheet(mathMLSheet, printEval());
+    }
+#endif
+
 #if ENABLE(WML)
     static bool loadedWMLUserAgentSheet;
     if (e->isWMLElement() && !loadedWMLUserAgentSheet) {
@@ -2358,6 +2381,8 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoFullPageMedia:
                 return e && e->document() && e->document()->isMediaDocument();
                 break;
+            case CSSSelector::PseudoDefault:
+                return e && e->isDefaultButtonForForm();
             case CSSSelector::PseudoDisabled:
                 if (e && e->isFormControlElement()) {
                     InputElement* inputElement = toInputElement(e);
@@ -2384,6 +2409,10 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 return e && e->isOptionalFormControl();
             case CSSSelector::PseudoRequired:
                 return e && e->isRequiredFormControl();
+            case CSSSelector::PseudoValid:
+                return e && e->willValidate() && e->isValidFormControlElement();
+            case CSSSelector::PseudoInvalid:
+                return e && e->willValidate() && !e->isValidFormControlElement();
             case CSSSelector::PseudoChecked: {
                 if (!e || !e->isFormControlElement())
                     break;
@@ -2465,6 +2494,11 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoFileUploadButton:
                 dynamicPseudo = FILE_UPLOAD_BUTTON;
                 return true;
+#if ENABLE(DATALIST)
+            case CSSSelector::PseudoInputListButton:
+                dynamicPseudo = INPUT_LIST_BUTTON;
+                return true;
+#endif
             case CSSSelector::PseudoInputPlaceholder:
                 dynamicPseudo = INPUT_PLACEHOLDER;
                 return true;
@@ -2494,7 +2528,10 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 return true;
             case CSSSelector::PseudoMediaControlsTimelineContainer:
                 dynamicPseudo = MEDIA_CONTROLS_TIMELINE_CONTAINER;
-                 return true;
+                return true;
+            case CSSSelector::PseudoMediaControlsVolumeSliderContainer:
+                dynamicPseudo = MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER;
+                return true;
             case CSSSelector::PseudoMediaControlsCurrentTimeDisplay:
                 dynamicPseudo = MEDIA_CONTROLS_CURRENT_TIME_DISPLAY;
                 return true;
@@ -2504,6 +2541,9 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoMediaControlsTimeline:
                 dynamicPseudo = MEDIA_CONTROLS_TIMELINE;
                 return true;
+            case CSSSelector::PseudoMediaControlsVolumeSlider:
+                dynamicPseudo = MEDIA_CONTROLS_VOLUME_SLIDER;
+                return true;
             case CSSSelector::PseudoMediaControlsSeekBackButton:
                 dynamicPseudo = MEDIA_CONTROLS_SEEK_BACK_BUTTON;
                 return true;
@@ -2920,10 +2960,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitBackgroundOrigin:
         HANDLE_BACKGROUND_VALUE(origin, Origin, value)
         return;
-    case CSSPropertyBackgroundRepeat:
-        HANDLE_BACKGROUND_VALUE(repeat, Repeat, value)
-        return;
-    case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyBackgroundSize:
         HANDLE_BACKGROUND_VALUE(size, Size, value)
         return;
     case CSSPropertyWebkitMaskAttachment:
@@ -2938,9 +2975,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitMaskOrigin:
         HANDLE_MASK_VALUE(origin, Origin, value)
         return;
-    case CSSPropertyWebkitMaskRepeat:
-        HANDLE_MASK_VALUE(repeat, Repeat, value)
-        return;
     case CSSPropertyWebkitMaskSize:
         HANDLE_MASK_VALUE(size, Size, value)
         return;
@@ -2991,6 +3025,26 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyDisplay:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(display, Display)
+#if ENABLE(WCSS)
+        if (primitiveValue) {
+            if (primitiveValue->getIdent() == CSSValueWapMarquee) {
+                // Initialize Wap Marquee style
+                m_style->setOverflowX(OMARQUEE);
+                m_style->setOverflowY(OMARQUEE);
+                m_style->setWhiteSpace(NOWRAP);
+                m_style->setMarqueeDirection(MLEFT);
+                m_style->setMarqueeSpeed(85); // Normal speed
+                m_style->setMarqueeLoopCount(1);
+                m_style->setMarqueeBehavior(MSCROLL);
+
+                if (m_parentStyle)
+                    m_style->setDisplay(m_parentStyle->display());
+                else
+                    m_style->setDisplay(*primitiveValue);
+            } else
+                m_style->setDisplay(*primitiveValue);
+        }
+#endif
         return;
     case CSSPropertyEmptyCells:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(emptyCells, EmptyCells)
@@ -3207,6 +3261,26 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_MASK_VALUE(yPosition, YPosition, value)
         return;
     }
+    case CSSPropertyBackgroundRepeat:
+        HANDLE_BACKGROUND_INHERIT_AND_INITIAL(repeatX, RepeatX);
+        HANDLE_BACKGROUND_INHERIT_AND_INITIAL(repeatY, RepeatY);
+        return;
+    case CSSPropertyBackgroundRepeatX:
+        HANDLE_BACKGROUND_VALUE(repeatX, RepeatX, value)
+        return;
+    case CSSPropertyBackgroundRepeatY:
+        HANDLE_BACKGROUND_VALUE(repeatY, RepeatY, value)
+        return;
+    case CSSPropertyWebkitMaskRepeat:
+        HANDLE_MASK_INHERIT_AND_INITIAL(repeatX, RepeatX);
+        HANDLE_MASK_INHERIT_AND_INITIAL(repeatY, RepeatY);
+        return;
+    case CSSPropertyWebkitMaskRepeatX:
+        HANDLE_MASK_VALUE(repeatX, RepeatX, value)
+        return;
+    case CSSPropertyWebkitMaskRepeatY:
+        HANDLE_MASK_VALUE(repeatY, RepeatY, value)
+        return;
     case CSSPropertyBorderSpacing: {
         if (isInherit) {
             m_style->setHorizontalBorderSpacing(m_parentStyle->horizontalBorderSpacing());
@@ -3437,6 +3511,41 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 
+    case CSSPropertyWebkitFontSmoothing: {
+        FontDescription fontDescription = m_style->fontDescription();
+        if (isInherit) 
+            fontDescription.setFontSmoothing(m_parentStyle->fontDescription().fontSmoothing());
+        else if (isInitial)
+            fontDescription.setFontSmoothing(AutoSmoothing);
+        else {
+            if (!primitiveValue)
+                return;
+            int id = primitiveValue->getIdent();
+            FontSmoothingMode smoothing;
+            switch (id) {
+                case CSSValueAuto:
+                    smoothing = AutoSmoothing;
+                    break;
+                case CSSValueNone:
+                    smoothing = NoSmoothing;
+                    break;
+                case CSSValueAntialiased:
+                    smoothing = Antialiased;
+                    break;
+                case CSSValueSubpixelAntialiased:
+                    smoothing = SubpixelAntialiased;
+                    break;
+                default:
+                    ASSERT_NOT_REACHED();
+                    smoothing = AutoSmoothing;
+            }
+            fontDescription.setFontSmoothing(smoothing);
+        }
+        if (m_style->setFontDescription(fontDescription))
+            m_fontDirty = true;
+        return;
+    }
+
     case CSSPropertyLetterSpacing:
     case CSSPropertyWordSpacing:
     {
@@ -3754,7 +3863,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     {
         FontDescription fontDescription = m_style->fontDescription();
         fontDescription.setKeywordSize(0);
-        bool familyIsFixed = fontDescription.genericFamily() == FontDescription::MonospaceFamily;
         float oldSize = 0;
         float size = 0;
         
@@ -3769,7 +3877,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (m_parentNode)
                 fontDescription.setKeywordSize(m_parentStyle->fontDescription().keywordSize());
         } else if (isInitial) {
-            size = fontSizeForKeyword(CSSValueMedium, m_style->htmlHacks(), familyIsFixed);
+            size = fontSizeForKeyword(CSSValueMedium, m_style->htmlHacks(), fontDescription.useFixedDefaultSize());
             fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
         } else if (primitiveValue->getIdent()) {
             // Keywords are being used.
@@ -3782,7 +3890,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 case CSSValueXLarge:
                 case CSSValueXxLarge:
                 case CSSValueWebkitXxxLarge:
-                    size = fontSizeForKeyword(primitiveValue->getIdent(), m_style->htmlHacks(), familyIsFixed);
+                    size = fontSizeForKeyword(primitiveValue->getIdent(), m_style->htmlHacks(), fontDescription.useFixedDefaultSize());
                     fontDescription.setKeywordSize(primitiveValue->getIdent() - CSSValueXxSmall + 1);
                     break;
                 case CSSValueLarger:
@@ -4025,13 +4133,12 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (m_style->setFontDescription(fontDescription))
                 m_fontDirty = true;
             return;
-        }
-        else if (isInitial) {
+        } else if (isInitial) {
             FontDescription initialDesc = FontDescription();
             FontDescription fontDescription = m_style->fontDescription();
             // We need to adjust the size to account for the generic family change from monospace
             // to non-monospace.
-            if (fontDescription.keywordSize() && fontDescription.genericFamily() == FontDescription::MonospaceFamily)
+            if (fontDescription.keywordSize() && fontDescription.useFixedDefaultSize())
                 setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), false));
             fontDescription.setGenericFamily(initialDesc.genericFamily());
             if (!initialDesc.firstFamily().familyIsEmpty())
@@ -4041,21 +4148,23 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             return;
         }
         
-        if (!value->isValueList()) return;
+        if (!value->isValueList())
+            return;
         FontDescription fontDescription = m_style->fontDescription();
-        CSSValueList *list = static_cast<CSSValueList*>(value);
+        CSSValueList* list = static_cast<CSSValueList*>(value);
         int len = list->length();
         FontFamily& firstFamily = fontDescription.firstFamily();
-        FontFamily *currFamily = 0;
+        FontFamily* currFamily = 0;
         
         // Before mapping in a new font-family property, we should reset the generic family.
-        bool oldFamilyIsMonospace = fontDescription.genericFamily() == FontDescription::MonospaceFamily;
+        bool oldFamilyUsedFixedDefaultSize = fontDescription.useFixedDefaultSize();
         fontDescription.setGenericFamily(FontDescription::NoFamily);
 
         for (int i = 0; i < len; i++) {
-            CSSValue *item = list->itemWithoutBoundsCheck(i);
-            if (!item->isPrimitiveValue()) continue;
-            CSSPrimitiveValue *val = static_cast<CSSPrimitiveValue*>(item);
+            CSSValue* item = list->itemWithoutBoundsCheck(i);
+            if (!item->isPrimitiveValue())
+                continue;
+            CSSPrimitiveValue* val = static_cast<CSSPrimitiveValue*>(item);
             AtomicString face;
             Settings* settings = m_checker.m_document->settings();
             if (val->primitiveType() == CSSPrimitiveValue::CSS_STRING)
@@ -4087,28 +4196,32 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                         break;
                 }
             }
-    
+
             if (!face.isEmpty()) {
                 if (!currFamily) {
                     // Filling in the first family.
                     firstFamily.setFamily(face);
+                    firstFamily.appendFamily(0); // Remove any inherited family-fallback list.
                     currFamily = &firstFamily;
-                }
-                else {
+                } else {
                     RefPtr<SharedFontFamily> newFamily = SharedFontFamily::create();
                     newFamily->setFamily(face);
                     currFamily->appendFamily(newFamily);
                     currFamily = newFamily.get();
                 }
-    
-                if (fontDescription.keywordSize() && (fontDescription.genericFamily() == FontDescription::MonospaceFamily) != oldFamilyIsMonospace)
-                    setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), !oldFamilyIsMonospace));
-            
-                if (m_style->setFontDescription(fontDescription))
-                    m_fontDirty = true;
             }
         }
-      return;
+
+        // We can't call useFixedDefaultSize() until all new font families have been added
+        // If currFamily is non-zero then we set at least one family on this description.
+        if (currFamily) {
+            if (fontDescription.keywordSize() && fontDescription.useFixedDefaultSize() != oldFamilyUsedFixedDefaultSize)
+                setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), !oldFamilyUsedFixedDefaultSize));
+
+            if (m_style->setFontDescription(fontDescription))
+                m_fontDirty = true;
+        }
+        return;
     }
     case CSSPropertyTextDecoration: {
         // list of ident
@@ -4526,9 +4639,23 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_INHERIT_AND_INITIAL(outlineOffset, OutlineOffset)
         m_style->setOutlineOffset(primitiveValue->computeLengthInt(style(), m_rootElementStyle, zoomFactor));
         return;
-
+    case CSSPropertyTextRendering: {
+        FontDescription fontDescription = m_style->fontDescription();
+        if (isInherit) 
+            fontDescription.setTextRenderingMode(m_parentStyle->fontDescription().textRenderingMode());
+        else if (isInitial)
+            fontDescription.setTextRenderingMode(AutoTextRendering);
+        else {
+            if (!primitiveValue)
+                return;
+            fontDescription.setTextRenderingMode(*primitiveValue);
+        }
+        if (m_style->setFontDescription(fontDescription))
+            m_fontDirty = true;
+        return;
+    }
     case CSSPropertyTextShadow:
-    case CSSPropertyBoxShadow: {
+    case CSSPropertyWebkitBoxShadow: {
         if (isInherit) {
             if (id == CSSPropertyTextShadow)
                 return m_style->setTextShadow(m_parentStyle->textShadow() ? new ShadowData(*m_parentStyle->textShadow()) : 0);
@@ -4742,6 +4869,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setMarqueeLoopCount(m_parentStyle->marqueeLoopCount());
         m_style->setMarqueeBehavior(m_parentStyle->marqueeBehavior());
         return;
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeLoop:
+#endif
     case CSSPropertyWebkitMarqueeRepetition: {
         HANDLE_INHERIT_AND_INITIAL(marqueeLoopCount, MarqueeLoopCount)
         if (!primitiveValue)
@@ -4752,6 +4882,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             m_style->setMarqueeLoopCount(primitiveValue->getIntValue());
         return;
     }
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeSpeed:
+#endif
     case CSSPropertyWebkitMarqueeSpeed: {
         HANDLE_INHERIT_AND_INITIAL(marqueeSpeed, MarqueeSpeed)      
         if (!primitiveValue)
@@ -4802,9 +4935,30 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         return;
     }
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeStyle:
+#endif
     case CSSPropertyWebkitMarqueeStyle:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeBehavior, MarqueeBehavior)      
         return;
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeDir:
+        HANDLE_INHERIT_AND_INITIAL(marqueeDirection, MarqueeDirection)
+        if (primitiveValue && primitiveValue->getIdent()) {
+            switch (primitiveValue->getIdent()) {
+            case CSSValueLtr:
+                m_style->setMarqueeDirection(MRIGHT);
+                break;
+            case CSSValueRtl:
+                m_style->setMarqueeDirection(MLEFT);
+                break;
+            default:
+                m_style->setMarqueeDirection(*primitiveValue);
+                break;
+            }
+        }
+        return;
+#endif
     case CSSPropertyWebkitMarqueeDirection:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeDirection, MarqueeDirection)
         return;
@@ -5246,10 +5400,10 @@ void CSSStyleSelector::mapFillImage(FillLayer* layer, CSSValue* value)
     layer->setImage(styleImage(value));
 }
 
-void CSSStyleSelector::mapFillRepeat(FillLayer* layer, CSSValue* value)
+void CSSStyleSelector::mapFillRepeatX(FillLayer* layer, CSSValue* value)
 {
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
-        layer->setRepeat(FillLayer::initialFillRepeat(layer->type()));
+        layer->setRepeatX(FillLayer::initialFillRepeatX(layer->type()));
         return;
     }
     
@@ -5257,22 +5411,46 @@ void CSSStyleSelector::mapFillRepeat(FillLayer* layer, CSSValue* value)
         return;
 
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-    layer->setRepeat(*primitiveValue);
+    layer->setRepeatX(*primitiveValue);
 }
 
-void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
+void CSSStyleSelector::mapFillRepeatY(FillLayer* layer, CSSValue* value)
 {
-    LengthSize b = FillLayer::initialFillSize(layer->type());
-    
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
-        layer->setSize(b);
+        layer->setRepeatY(FillLayer::initialFillRepeatY(layer->type()));
         return;
     }
     
     if (!value->isPrimitiveValue())
         return;
-        
+
+    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    layer->setRepeatY(*primitiveValue);
+}
+
+void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
+{
+    if (!value->isPrimitiveValue()) {
+        layer->setSizeType(SizeNone);
+        return;
+    }
+
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    if (primitiveValue->getIdent() == CSSValueContain)
+        layer->setSizeType(Contain);
+    else if (primitiveValue->getIdent() == CSSValueCover)
+        layer->setSizeType(Cover);
+    else
+        layer->setSizeType(SizeLength);
+    
+    LengthSize b = FillLayer::initialFillSizeLength(layer->type());
+    
+    if (value->cssValueType() == CSSValue::CSS_INITIAL || primitiveValue->getIdent() == CSSValueContain
+        || primitiveValue->getIdent() == CSSValueCover) {
+        layer->setSizeLength(b);
+        return;
+    }
+
     Pair* pair = primitiveValue->getPairValue();
     if (!pair)
         return;
@@ -5309,7 +5487,7 @@ void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
     
     b.setWidth(firstLength);
     b.setHeight(secondLength);
-    layer->setSize(b);
+    layer->setSizeLength(b);
 }
 
 void CSSStyleSelector::mapFillXPosition(FillLayer* layer, CSSValue* value)
@@ -5587,8 +5765,7 @@ void CSSStyleSelector::checkForGenericFamilyChange(RenderStyle* style, RenderSty
         return;
 
     const FontDescription& parentFont = parentStyle->fontDescription();
-
-    if (childFont.genericFamily() == parentFont.genericFamily())
+    if (childFont.useFixedDefaultSize() == parentFont.useFixedDefaultSize())
         return;
 
     // For now, lump all families but monospace together.
@@ -5601,17 +5778,16 @@ void CSSStyleSelector::checkForGenericFamilyChange(RenderStyle* style, RenderSty
     // If the font uses a keyword size, then we refetch from the table rather than
     // multiplying by our scale factor.
     float size;
-    if (childFont.keywordSize()) {
-        size = fontSizeForKeyword(CSSValueXxSmall + childFont.keywordSize() - 1, style->htmlHacks(),
-                                  childFont.genericFamily() == FontDescription::MonospaceFamily);
-    } else {
+    if (childFont.keywordSize())
+        size = fontSizeForKeyword(CSSValueXxSmall + childFont.keywordSize() - 1, style->htmlHacks(), childFont.useFixedDefaultSize());
+    else {
         Settings* settings = m_checker.m_document->settings();
         float fixedScaleFactor = settings
             ? static_cast<float>(settings->defaultFixedFontSize()) / settings->defaultFontSize()
             : 1;
-        size = (parentFont.genericFamily() == FontDescription::MonospaceFamily) ? 
-                childFont.specifiedSize()/fixedScaleFactor :
-                childFont.specifiedSize()*fixedScaleFactor;
+        size = parentFont.useFixedDefaultSize() ?
+                childFont.specifiedSize() / fixedScaleFactor :
+                childFont.specifiedSize() * fixedScaleFactor;
     }
 
     FontDescription newFontDescription(childFont);
diff --git a/WebCore/css/CSSStyleSelector.h b/WebCore/css/CSSStyleSelector.h
index 668c6c3..6e0663f 100644
--- a/WebCore/css/CSSStyleSelector.h
+++ b/WebCore/css/CSSStyleSelector.h
@@ -80,7 +80,9 @@ public:
     // This class selects a RenderStyle for a given element based on a collection of stylesheets.
     class CSSStyleSelector : public Noncopyable {
     public:
-        CSSStyleSelector(Document*, const String& userStyleSheet, StyleSheetList*, CSSStyleSheet*, bool strictParsing, bool matchAuthorAndUserStyles);
+        CSSStyleSelector(Document*, StyleSheetList* authorSheets, CSSStyleSheet* mappedElementSheet,
+                         CSSStyleSheet* pageUserSheet, const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets,
+                         bool strictParsing, bool matchAuthorAndUserStyles);
         ~CSSStyleSelector();
 
         void initElementAndPseudoState(Element*);
@@ -175,7 +177,6 @@ public:
         
         CSSRuleSet* m_authorStyle;
         CSSRuleSet* m_userStyle;
-        RefPtr<CSSStyleSheet> m_userSheet;
 
         bool m_hasUAAppearance;
         BorderData m_borderData;
@@ -223,7 +224,8 @@ public:
         void mapFillComposite(FillLayer*, CSSValue*);
         void mapFillOrigin(FillLayer*, CSSValue*);
         void mapFillImage(FillLayer*, CSSValue*);
-        void mapFillRepeat(FillLayer*, CSSValue*);
+        void mapFillRepeatX(FillLayer*, CSSValue*);
+        void mapFillRepeatY(FillLayer*, CSSValue*);
         void mapFillSize(FillLayer*, CSSValue*);
         void mapFillXPosition(FillLayer*, CSSValue*);
         void mapFillYPosition(FillLayer*, CSSValue*);
diff --git a/WebCore/css/CSSStyleSheet.cpp b/WebCore/css/CSSStyleSheet.cpp
index ce50af6..1579999 100644
--- a/WebCore/css/CSSStyleSheet.cpp
+++ b/WebCore/css/CSSStyleSheet.cpp
@@ -40,20 +40,22 @@ CSSStyleSheet::CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, con
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(!parentSheet || parentSheet->useStrictParsing())
+    , m_isUserStyleSheet(parentSheet ? parentSheet->isUserStyleSheet() : false)
 {
 }
 
-CSSStyleSheet::CSSStyleSheet(Node *parentNode, const String& href, const String& charset)
+CSSStyleSheet::CSSStyleSheet(Node* parentNode, const String& href, const String& charset)
     : StyleSheet(parentNode, href)
     , m_doc(parentNode->document())
     , m_namespaces(0)
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(false)
+    , m_isUserStyleSheet(false)
 {
 }
 
-CSSStyleSheet::CSSStyleSheet(CSSRule *ownerRule, const String& href, const String& charset)
+CSSStyleSheet::CSSStyleSheet(CSSRule* ownerRule, const String& href, const String& charset)
     : StyleSheet(ownerRule, href)
     , m_namespaces(0)
     , m_charset(charset)
@@ -62,6 +64,7 @@ CSSStyleSheet::CSSStyleSheet(CSSRule *ownerRule, const String& href, const Strin
 {
     CSSStyleSheet* parentSheet = ownerRule ? ownerRule->parentStyleSheet() : 0;
     m_doc = parentSheet ? parentSheet->doc() : 0;
+    m_isUserStyleSheet = parentSheet ? parentSheet->isUserStyleSheet() : false;
 }
 
 CSSStyleSheet::~CSSStyleSheet()
diff --git a/WebCore/css/CSSStyleSheet.h b/WebCore/css/CSSStyleSheet.h
index 8646ee9..f534104 100644
--- a/WebCore/css/CSSStyleSheet.h
+++ b/WebCore/css/CSSStyleSheet.h
@@ -93,6 +93,9 @@ public:
     void setStrictParsing(bool b) { m_strictParsing = b; }
     bool useStrictParsing() const { return m_strictParsing; }
 
+    void setIsUserStyleSheet(bool b) { m_isUserStyleSheet = b; }
+    bool isUserStyleSheet() const { return m_isUserStyleSheet; }
+
 private:
     CSSStyleSheet(Node* ownerNode, const String& href, const String& charset);
     CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const String& charset);
@@ -106,6 +109,7 @@ private:
     String m_charset;
     bool m_loadCompleted : 1;
     bool m_strictParsing : 1;
+    bool m_isUserStyleSheet : 1;
 };
 
 } // namespace
diff --git a/WebCore/css/CSSValueKeywords.in b/WebCore/css/CSSValueKeywords.in
index c0b52f2..1b7b1d8 100644
--- a/WebCore/css/CSSValueKeywords.in
+++ b/WebCore/css/CSSValueKeywords.in
@@ -169,6 +169,8 @@ repeat
 repeat-x
 repeat-y
 no-repeat
+# round
+# space
 #
 # CSS_PROP__WEBKIT_BACKGROUND_COMPOSITE:
 #
@@ -260,6 +262,7 @@ table-cell
 table-caption
 -webkit-box
 -webkit-inline-box
+-wap-marquee
 #none
 #
 # CSS_PROP_CURSOR:
@@ -498,6 +501,7 @@ square-button
 button
 button-bevel
 default-button
+list-button
 listbox
 listitem
 media-fullscreen-button
@@ -509,6 +513,9 @@ media-rewind-button
 media-return-to-realtime-button
 media-slider
 media-sliderthumb
+media-volume-slider-container
+media-volume-slider
+media-volume-sliderthumb
 media-controls-background
 media-current-time-display
 media-time-remaining-display
@@ -551,6 +558,12 @@ padding
 padding-box
 
 #
+# background-size
+#
+contain
+cover
+
+#
 # CSS_PROP__KHTML_RTL_ORDERING
 #
 logical
@@ -611,3 +624,17 @@ fill
 stroke
 #all
 #none
+
+#
+# -webkit-font-smoothing
+#
+# auto
+# none
+antialiased
+subpixel-antialiased
+
+# text-rendering
+#auto
+optimizeSpeed
+optimizeLegibility
+geometricPrecision
diff --git a/WebCore/css/CSSValueList.cpp b/WebCore/css/CSSValueList.cpp
index 4928026..9633f7c 100644
--- a/WebCore/css/CSSValueList.cpp
+++ b/WebCore/css/CSSValueList.cpp
@@ -96,6 +96,14 @@ bool CSSValueList::hasValue(CSSValue* val)
     return false;
 }
 
+PassRefPtr<CSSValueList> CSSValueList::copy()
+{
+    PassRefPtr<CSSValueList> newList = m_isSpaceSeparated ? createSpaceSeparated() : createCommaSeparated();
+    for (size_t index = 0; index < m_values.size(); index++)
+        newList->append(item(index));
+    return newList;
+}
+
 String CSSValueList::cssText() const
 {
     String result = "";
diff --git a/WebCore/css/CSSValueList.h b/WebCore/css/CSSValueList.h
index 0d531de..b835345 100644
--- a/WebCore/css/CSSValueList.h
+++ b/WebCore/css/CSSValueList.h
@@ -54,6 +54,7 @@ public:
     void prepend(PassRefPtr<CSSValue>);
     bool removeAll(CSSValue*);
     bool hasValue(CSSValue*);
+    PassRefPtr<CSSValueList> copy();
 
     virtual String cssText() const;
 
diff --git a/WebCore/css/SVGCSSComputedStyleDeclaration.cpp b/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
index 2cd90a9d..e8492d4 100644
--- a/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
@@ -93,8 +93,6 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getSVGPropertyCSSValue(int pro
             return CSSPrimitiveValue::create(svgStyle->strokeMiterLimit(), CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyStrokeOpacity:
             return CSSPrimitiveValue::create(svgStyle->strokeOpacity(), CSSPrimitiveValue::CSS_NUMBER);
-        case CSSPropertyTextRendering:
-            return CSSPrimitiveValue::create(svgStyle->textRendering());
         case CSSPropertyAlignmentBaseline:
             return CSSPrimitiveValue::create(svgStyle->alignmentBaseline());
         case CSSPropertyDominantBaseline:
diff --git a/WebCore/css/SVGCSSParser.cpp b/WebCore/css/SVGCSSParser.cpp
index 04ba185..0ae9fbc 100644
--- a/WebCore/css/SVGCSSParser.cpp
+++ b/WebCore/css/SVGCSSParser.cpp
@@ -132,12 +132,6 @@ bool CSSParser::parseSVGValue(int propId, bool important)
             valid_primitive = true;
         break;
 
-    case CSSPropertyTextRendering:   // auto | optimizeSpeed | optimizeLegibility | geometricPrecision | inherit
-        if (id == CSSValueAuto || id == CSSValueOptimizespeed || id == CSSValueOptimizelegibility ||
-       id == CSSValueGeometricprecision)
-            valid_primitive = true;
-        break;
-
     case CSSPropertyImageRendering:  // auto | optimizeSpeed |
     case CSSPropertyColorRendering:  // optimizeQuality | inherit
         if (id == CSSValueAuto || id == CSSValueOptimizespeed ||
diff --git a/WebCore/css/SVGCSSPropertyNames.in b/WebCore/css/SVGCSSPropertyNames.in
index 965fbbf..e400ffe 100644
--- a/WebCore/css/SVGCSSPropertyNames.in
+++ b/WebCore/css/SVGCSSPropertyNames.in
@@ -37,7 +37,7 @@ stroke-linejoin
 stroke-miterlimit
 stroke-opacity
 stroke-width
-text-rendering
+# text-rendering
 alignment-baseline
 baseline-shift
 dominant-baseline
diff --git a/WebCore/css/SVGCSSStyleSelector.cpp b/WebCore/css/SVGCSSStyleSelector.cpp
index d326dde..b81b4f2 100644
--- a/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/WebCore/css/SVGCSSStyleSelector.cpp
@@ -229,13 +229,6 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
                 svgstyle->setShapeRendering(*primitiveValue);
             break;
         }
-        case CSSPropertyTextRendering:
-        {
-            HANDLE_INHERIT_AND_INITIAL(textRendering, TextRendering)
-            if (primitiveValue)
-                svgstyle->setTextRendering(*primitiveValue);
-            break;
-        }
         // end of ident only properties
         case CSSPropertyFill:
         {
diff --git a/WebCore/css/SVGCSSValueKeywords.in b/WebCore/css/SVGCSSValueKeywords.in
index c866a17..152a68f 100644
--- a/WebCore/css/SVGCSSValueKeywords.in
+++ b/WebCore/css/SVGCSSValueKeywords.in
@@ -196,7 +196,7 @@ linearRGB
 
 # CSS_PROP_COLOR_RENDERING
 #auto
-optimizeSpeed
+#optimizeSpeed
 optimizeQuality
 
 ## CSS_PROP_FILL
@@ -220,7 +220,7 @@ optimizeQuality
 #auto
 #optimizeSpeed
 crispEdges
-geometricPrecision
+#geometricPrecision
 
 # CSS_PROP_STROKE
 # CSS_PROP_STROKE_DASHARRAY
@@ -238,11 +238,6 @@ bevel
 # CSS_PROP_STROKE_MITERLIMIT
 # CSS_PROP_STROKE_OPACITY
 # CSS_PROP_STROKE_WIDTH
-# CSS_PROP_TEXT_RENDERING
-#auto
-#optimizeSpeed
-optimizeLegibility
-#geometricPrecision
 
 # CSS_PROP_ALIGNMENT_BASELINE
 #auto
diff --git a/WebCore/css/StyleBase.cpp b/WebCore/css/StyleBase.cpp
index 4d5c9c8..aaa7626 100644
--- a/WebCore/css/StyleBase.cpp
+++ b/WebCore/css/StyleBase.cpp
@@ -57,7 +57,7 @@ KURL StyleBase::baseURL() const
     if (!sheet)
         return KURL();
     if (!sheet->href().isNull())
-        return KURL(sheet->href());
+        return KURL(ParsedURLString, sheet->href());
     if (sheet->parent()) 
         return sheet->parent()->baseURL();
     if (!sheet->ownerNode()) 
diff --git a/WebCore/css/StyleSheetList.idl b/WebCore/css/StyleSheetList.idl
index 2abd22f..574d749 100644
--- a/WebCore/css/StyleSheetList.idl
+++ b/WebCore/css/StyleSheetList.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,6 +22,7 @@ module stylesheets {
 
     // Introduced in DOM Level 2:
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
diff --git a/WebCore/css/WCSSPropertyNames.in b/WebCore/css/WCSSPropertyNames.in
new file mode 100644
index 0000000..704209f
--- /dev/null
+++ b/WebCore/css/WCSSPropertyNames.in
@@ -0,0 +1,4 @@
+-wap-marquee-dir
+-wap-marquee-loop
+-wap-marquee-speed
+-wap-marquee-style
diff --git a/WebCore/css/WCSSValueKeywords.in b/WebCore/css/WCSSValueKeywords.in
new file mode 100644
index 0000000..00657ba
--- /dev/null
+++ b/WebCore/css/WCSSValueKeywords.in
@@ -0,0 +1 @@
+# place holder for all WCSS specific CSS value keywords
diff --git a/WebCore/css/html.css b/WebCore/css/html.css
index 6b03390..095fab3 100644
--- a/WebCore/css/html.css
+++ b/WebCore/css/html.css
@@ -72,6 +72,10 @@ layer {
     display: block
 }
 
+nav {
+    display: block
+}
+
 marquee {
     display: inline-block;
     overflow: -webkit-marquee
@@ -350,6 +354,11 @@ input[type="search"]::-webkit-search-results-button {
     display: inline-block;
 }
 
+input::-webkit-input-list-button {
+    -webkit-appearance: list-button;
+    display: inline-block;
+}
+
 textarea {
     -webkit-appearance: textarea;
     background-color: white;
@@ -364,7 +373,7 @@ textarea {
     word-wrap: break-word;
 }
 
-input::-webkit-input-placeholder, isindex::-webkit-input-placeholder {
+input::-webkit-input-placeholder, isindex::-webkit-input-placeholder, textarea::-webkit-input-placeholder {
     color: darkGray;
 }
 
@@ -483,6 +492,10 @@ select[size="1"] {
     white-space: pre;
 }
 
+datalist {
+    display: none;
+}
+
 optgroup {
     font-weight: bolder;
 }
diff --git a/WebCore/css/mathml.css b/WebCore/css/mathml.css
new file mode 100644
index 0000000..e725d8c
--- /dev/null
+++ b/WebCore/css/mathml.css
@@ -0,0 +1,170 @@
+@namespace "http://www.w3.org/1998/Math/MathML";
+
+/* approved */
+math {
+    font-family: Symbol, STIXGeneral, "Times New Roman";
+    display: inline-block;
+    padding: 0px;
+    margin: 0px;
+    text-indent: 0;
+    font-size: 1.1em;
+    vertical-align: baseline;
+}
+math[display="block"] {
+    font-family: "New Times Roman"
+    display: block;
+    text-align: center;
+    page-break-inside: avoid;
+}
+
+mfrac {
+    vertical-align: middle;
+}
+
+msub, msup {
+   display: inline-block;
+}
+
+msub > * + * {
+   vertical-align: sub;
+   font-size: 0.75em;
+   line-height: 0.75em;
+}
+
+msup > * + * {
+   vertical-align: super;
+   font-size: 0.75em;
+   line-height: 0.75em;
+}
+
+msubsup > * {
+    margin: 0px;
+    padding: 0px;
+    vertical-align: middle;
+}
+
+msubsup > * + * {
+   font-size: 0.75em;
+   line-height: 0.75em;
+}
+
+munderover {
+    vertical-align: middle;
+}
+
+munderover > * + *, mover > * + *, munder > * + * {
+   font-size: 0.75em;
+   line-height: 0.5625em;
+}
+
+mrow {
+    line-height: 1em;
+    white-space: nowrap;
+    vertical-align: middle;
+}
+
+mfenced > * {
+    vertical-align: middle;
+}
+
+mo, mn, mi {
+   line-height: 0.75em;
+   padding: 0px;
+   margin: 0px;
+}
+
+mo[mathsize="small"], mn[mathsize="small"], mi[mathsize="small"] {
+   font-size: 0.75em;
+   line-height: 0.5625em;
+}
+
+mo[mathsize="normal"],mn[mathsize="normal"],mi[mathsize="normal"] {
+   font-size: 1em;
+   line-height: 0.75em;
+}
+
+mo[mathsize="big"], mn[mathsize="big"], mi[mathsize="big"] {
+   line-height: 1.2em;
+   font-size: 1.5em;
+}
+ 
+annotation, annotation-xml {
+    display:none;
+}
+
+mphantom {
+    visibility: hidden;
+}
+merror {
+    outline: solid thin red;
+}
+
+msqrt {
+    padding-top: 0.2em;
+    padding-left: 0.75em;
+}
+
+mroot {
+    padding-top: 0.2em;
+    padding-left: 0.2em;
+}
+
+mroot > * + * {
+    font-size: 0.75em;
+    line-height: 0.75em;
+    vertical-align: top;
+    padding-right: 0.3em;
+}
+
+mtable {
+    display: inline-table;
+    line-height: 1.5em;
+    text-align: center;
+    vertical-align: middle;
+}
+mtr {
+    display: table-row;
+}
+mtd {
+    display: table-cell;
+    padding: 0 0.5ex;
+}
+
+mtable[columnalign="left"], mtr[columnalign="left"], mtd[columnalign="left"] {
+    text-align: left;
+}
+
+mtable[columnalign="right"], mtr[columnalign="right"], mtd[columnalign="right"] {
+    text-align: right;
+}
+mtable[rowalign="top"] mtd, mtable mtr[rowalign="top"] mtd, mtable mtr mtd[rowalign="top"] {
+    vertical-align: top;
+}
+mtable[rowalign="bottom"] mtd, mtable mtr[rowalign="bottom"] mtd, mtable mtr mtd[rowalign="bottom"] {
+    vertical-align: bottom;
+}
+mtable[rowalign="center"] mtd, mtable mtr[rowalign="center"] mtd, mtable mtr mtd[rowalign="center"] {
+    vertical-align: middle;
+}
+mtable[frame="solid"] {
+    border: solid thin;
+}
+mtable[frame="dashed"] {
+    border: dashed thin;
+}
+mtable[rowlines="solid"], mtable[rowlines="dashed"], mtable[columnlines="solid"], mtable[columnlines="dashed"] {
+    border-collapse: collapse;
+}
+mtable[rowlines="solid"] > mtr + mtr {
+    border-top: solid thin;
+}
+mtable[rowlines="dashed"] > mtr + mtr {
+    border-top: dashed thin;
+}
+mtable[columnlines="solid"] > mtr > mtd + mtd {
+    border-left: solid thin;
+}
+mtable[columnlines="dashed"] > mtr > mtd + mtd {
+    border-left: dashed thin;
+}
+
diff --git a/WebCore/css/mediaControls.css b/WebCore/css/mediaControls.css
index f9694f8..d0ec90d 100644
--- a/WebCore/css/mediaControls.css
+++ b/WebCore/css/mediaControls.css
@@ -88,6 +88,14 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     padding: 0px 2px;
 }
 
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+}
+
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     -webkit-appearance: media-seek-back-button;
     display: -webkit-box;
diff --git a/WebCore/css/mediaControlsChromium.css b/WebCore/css/mediaControlsChromium.css
index 6fda61c..0f667bd 100644
--- a/WebCore/css/mediaControlsChromium.css
+++ b/WebCore/css/mediaControlsChromium.css
@@ -33,6 +33,7 @@ audio {
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
     -webkit-user-select: none;
     position: absolute;
+    overflow: visible;
     bottom: 0;
     width: 100%;
     height: 32px;
@@ -46,7 +47,6 @@ video:-webkit-full-page-media::-webkit-media-controls-panel {
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     -webkit-appearance: media-mute-button;
-
     position: absolute;
     top: auto;
     bottom: 0;
@@ -83,8 +83,8 @@ audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-
     width: auto;
     height: 32px;
 
-    border-left-color: rgba(255, 255, 255, 0.2);
-    border-right-color: rgba(255, 255, 255, 0.2);
+    border-left: 1px solid rgba(255, 255, 255, 0.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
 }
 
 audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
@@ -141,12 +141,13 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     -webkit-appearance: media-slider;
     position: absolute;
     top: auto;
-    bottom: 8px;
+    bottom: 7px;
     left: 6px;
     right: 65px;
     height: 16px;
 
     border-color: rgba(255, 255, 255, 0.2);
+    border-style: solid;
     border-width: 1px;
     border-radius: 2px;
     background-color: rgba(255, 255, 255, 0.08);
@@ -167,3 +168,25 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     -webkit-appearance: media-fullscreen-button;
     display: none;
 }
+
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    -webkit-appearance: media-volume-slider-container;
+    position: absolute;
+
+    width: 34px;
+    height: 100px;
+
+    background-color: rgba(0, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    -webkit-appearance: media-volume-slider;
+    display: inline;
+    position: absolute;
+
+    top: 10px;
+    left: 12px;
+
+    width: 10px;
+    height: 80px;
+}
diff --git a/WebCore/css/qt/mediaControls-extras.css b/WebCore/css/mediaControlsQt.css
index d85deae..a9c3609 100644
--- a/WebCore/css/qt/mediaControls-extras.css
+++ b/WebCore/css/mediaControlsQt.css
@@ -25,18 +25,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+ /* QtWebKit media controls. Extends mediaControls.css */
+
 audio {
     height: 34px;
     width: 400px;
 }
 
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: end;
+    -webkit-user-select: none;
+    position: absolute;
+    bottom: 0;
+    width: 100%;
+    z-index: 0;
+    overflow: hidden;
+    height: 100%;
+    text-align: right;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+	display: none;
+}
+
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     left: auto;
     right: 5px;
     width: 12px;
     height: 12px;
     padding: 6px;
-    margin: 5px 0px;
+    margin: 5px 5px 5px 3px;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
@@ -44,17 +64,18 @@ audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-bu
     width: 9px;
     height: 12px;
     padding: 6px 12px 6px 11px;
-    margin: 5px 0px;
+    margin: 5px 3px 5px 5px;
 }
 
-audio::-webkit-media-controls-time-display, video::-webkit-media-controls-time-display {
-    /* Since MediaControlElements are always created with a renderer we have to hide
-       the controls we don't use, so they don't mess up activation and event handling */
-    left: 0px;
-    top: 0px;
-    width: 0px;
-    height: 0px;
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    height: 34px;
+}
 
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    display: none;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
     display: none;
 }
 
@@ -66,6 +87,14 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     margin: 5px 0px;
 }
 
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+}
+
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     /* Since MediaControlElements are always created with a renderer we have to hide
        the controls we don't use, so they don't mess up activation and event handling */
@@ -99,3 +128,11 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     display: none;
 }
 
+audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
+    display: none;
+}
+
+audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
+    display: none;
+}
+
diff --git a/WebCore/css/mediaControlsQT.css b/WebCore/css/mediaControlsQuickTime.css
index 5cf48ae..5cf48ae 100644
--- a/WebCore/css/mediaControlsQT.css
+++ b/WebCore/css/mediaControlsQuickTime.css
diff --git a/WebCore/dom/ActiveDOMObject.h b/WebCore/dom/ActiveDOMObject.h
index e58d3f9..73b52d5 100644
--- a/WebCore/dom/ActiveDOMObject.h
+++ b/WebCore/dom/ActiveDOMObject.h
@@ -53,9 +53,6 @@ namespace WebCore {
         virtual void resume();
         virtual void stop();
 
-    protected:
-        virtual ~ActiveDOMObject();
-
         template<class T> void setPendingActivity(T* thisObject)
         {
             ASSERT(thisObject == this);
@@ -70,6 +67,9 @@ namespace WebCore {
             thisObject->deref();
         }
 
+    protected:
+        virtual ~ActiveDOMObject();
+
     private:
         ScriptExecutionContext* m_scriptExecutionContext;
         unsigned m_pendingActivityCount;
diff --git a/WebCore/dom/Attr.cpp b/WebCore/dom/Attr.cpp
index 435c1af..aa5916b 100644
--- a/WebCore/dom/Attr.cpp
+++ b/WebCore/dom/Attr.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,10 +30,10 @@
 
 namespace WebCore {
 
-Attr::Attr(Element* element, Document* docPtr, PassRefPtr<Attribute> a)
-    : ContainerNode(docPtr)
+inline Attr::Attr(Element* element, Document* document, PassRefPtr<Attribute> attribute)
+    : ContainerNode(document)
     , m_element(element)
-    , m_attribute(a)
+    , m_attribute(attribute)
     , m_ignoreChildrenChanged(0)
     , m_specified(true)  
 {
@@ -41,6 +41,13 @@ Attr::Attr(Element* element, Document* docPtr, PassRefPtr<Attribute> a)
     m_attribute->m_impl = this;
 }
 
+PassRefPtr<Attr> Attr::create(Element* element, Document* document, PassRefPtr<Attribute> attribute)
+{
+    RefPtr<Attr> attr = adoptRef(new Attr(element, document, attribute));
+    attr->createTextChild();
+    return attr.release();
+}
+
 Attr::~Attr()
 {
     ASSERT(m_attribute->attr() == this);
@@ -86,14 +93,14 @@ const AtomicString& Attr::prefix() const
     return m_attribute->prefix();
 }
 
-void Attr::setPrefix(const AtomicString &_prefix, ExceptionCode& ec)
+void Attr::setPrefix(const AtomicString& prefix, ExceptionCode& ec)
 {
     ec = 0;
-    checkSetPrefix(_prefix, ec);
+    checkSetPrefix(prefix, ec);
     if (ec)
         return;
 
-    m_attribute->setPrefix(_prefix);
+    m_attribute->setPrefix(prefix);
 }
 
 String Attr::nodeValue() const
@@ -101,11 +108,11 @@ String Attr::nodeValue() const
     return value();
 }
 
-void Attr::setValue(const String& v, ExceptionCode&)
+void Attr::setValue(const AtomicString& value, ExceptionCode&)
 {
     m_ignoreChildrenChanged++;
     removeChildren();
-    m_attribute->setValue(v.impl());
+    m_attribute->setValue(value);
     createTextChild();
     m_ignoreChildrenChanged--;
 
@@ -120,7 +127,7 @@ void Attr::setNodeValue(const String& v, ExceptionCode& ec)
 
 PassRefPtr<Node> Attr::cloneNode(bool /*deep*/)
 {
-    RefPtr<Attr> clone = new Attr(0, document(), m_attribute->clone());
+    RefPtr<Attr> clone = adoptRef(new Attr(0, document(), m_attribute->clone()));
     cloneChildNodes(clone.get());
     return clone.release();
 }
diff --git a/WebCore/dom/Attr.h b/WebCore/dom/Attr.h
index ed4dc07..e927a6e 100644
--- a/WebCore/dom/Attr.h
+++ b/WebCore/dom/Attr.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -39,48 +39,47 @@ namespace WebCore {
 class Attr : public ContainerNode {
     friend class NamedNodeMap;
 public:
-    Attr(Element*, Document*, PassRefPtr<Attribute>);
-    ~Attr();
+    static PassRefPtr<Attr> create(Element*, Document*, PassRefPtr<Attribute>);
+    virtual ~Attr();
 
-    // Call this after calling the constructor so the
-    // Attr node isn't floating when we append the text node.
-    void createTextChild();
-    
-    // DOM methods & attributes for Attr
     String name() const { return qualifiedName().toString(); }
     bool specified() const { return m_specified; }
     Element* ownerElement() const { return m_element; }
 
-    String value() const { return m_attribute->value(); }
-    void setValue(const String&, ExceptionCode&);
+    const AtomicString& value() const { return m_attribute->value(); }
+    void setValue(const AtomicString&, ExceptionCode&);
+
+    Attribute* attr() const { return m_attribute.get(); }
+    const QualifiedName& qualifiedName() const { return m_attribute->name(); }
+
+    // An extension to get presentational information for attributes.
+    CSSStyleDeclaration* style() { return m_attribute->style(); }
+
+    void setSpecified(bool specified) { m_specified = specified; }
+
+private:
+    Attr(Element*, Document*, PassRefPtr<Attribute>);
+
+    void createTextChild();
 
-    // DOM methods overridden from parent classes
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
+
     const AtomicString& localName() const;
     const AtomicString& namespaceURI() const;
     const AtomicString& prefix() const;
+
     virtual void setPrefix(const AtomicString&, ExceptionCode&);
 
     virtual String nodeValue() const;
     virtual void setNodeValue(const String&, ExceptionCode&);
     virtual PassRefPtr<Node> cloneNode(bool deep);
 
-    // Other methods (not part of DOM)
     virtual bool isAttributeNode() const { return true; }
     virtual bool childTypeAllowed(NodeType);
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    Attribute* attr() const { return m_attribute.get(); }
-    const QualifiedName& qualifiedName() const { return m_attribute->name(); }
-
-    // An extension to get presentational information for attributes.
-    CSSStyleDeclaration* style() { return m_attribute->style(); }
-
-    void setSpecified(bool specified) { m_specified = specified; }
-
-private:
     virtual const AtomicString& virtualPrefix() const { return prefix(); }
     virtual const AtomicString& virtualLocalName() const { return localName(); }
     virtual const AtomicString& virtualNamespaceURI() const { return namespaceURI(); }
diff --git a/WebCore/dom/Attr.idl b/WebCore/dom/Attr.idl
index 29f4be1..c01f34a 100644
--- a/WebCore/dom/Attr.idl
+++ b/WebCore/dom/Attr.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         GenerateNativeConverter,
         InterfaceUUID=EEE8E22B-22C3-4e50-95F4-5E0B8AAD8231,
diff --git a/WebCore/dom/Attribute.cpp b/WebCore/dom/Attribute.cpp
index 048ac6a..0ab0bb6 100644
--- a/WebCore/dom/Attribute.cpp
+++ b/WebCore/dom/Attribute.cpp
@@ -37,10 +37,8 @@ PassRefPtr<Attribute> Attribute::clone() const
 PassRefPtr<Attr> Attribute::createAttrIfNeeded(Element* e)
 {
     RefPtr<Attr> r = m_impl;
-    if (!r) {
-        r = new Attr(e, e->document(), this);
-        r->createTextChild();
-    }
+    if (!r)
+        r = Attr::create(e, e->document(), this);
     return r.release();
 }
 
diff --git a/WebCore/dom/BeforeLoadEvent.h b/WebCore/dom/BeforeLoadEvent.h
new file mode 100644
index 0000000..8c86773
--- /dev/null
+++ b/WebCore/dom/BeforeLoadEvent.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef BeforeLoadEvent_h
+#define BeforeLoadEvent_h
+
+#include "Event.h"
+#include "EventNames.h"
+
+namespace WebCore {
+
+class BeforeLoadEvent : public Event {
+public:
+    static PassRefPtr<BeforeLoadEvent> create(const String& url)
+    {
+        return adoptRef(new BeforeLoadEvent(url));
+    }
+
+    void initBeforeLoadEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& url)
+    {
+        if (dispatched())
+            return;
+        
+        initEvent(type, canBubble, cancelable);
+
+        m_url = url;
+    }
+
+    const String& url() const { return m_url; }
+
+private:
+    BeforeLoadEvent(const String& url)
+        : Event(eventNames().beforeloadEvent, false, true)
+        , m_url(url)
+    {}
+
+    String m_url;
+};
+
+} // namespace WebCore
+
+#endif // BeforeLoadEvent_h
diff --git a/WebCore/dom/BeforeLoadEvent.idl b/WebCore/dom/BeforeLoadEvent.idl
new file mode 100644
index 0000000..d06a39d
--- /dev/null
+++ b/WebCore/dom/BeforeLoadEvent.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module events {
+
+    interface [
+        GenerateConstructor
+    ] BeforeLoadEvent : Event {
+        void initBeforeLoadEvent(in DOMString type,
+                                 in boolean canBubble, 
+                                 in boolean cancelable,
+                                 in DOMString url);
+        readonly attribute DOMString url;
+    };
+
+}
diff --git a/WebCore/dom/CDATASection.cpp b/WebCore/dom/CDATASection.cpp
index 72faa70..d73054e 100644
--- a/WebCore/dom/CDATASection.cpp
+++ b/WebCore/dom/CDATASection.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,13 +26,14 @@
 
 namespace WebCore {
 
-CDATASection::CDATASection(Document* document, const String& text)
-    : Text(document, text)
+inline CDATASection::CDATASection(Document* document, const String& data)
+    : Text(document, data)
 {
 }
 
-CDATASection::~CDATASection()
+PassRefPtr<CDATASection> CDATASection::create(Document* document, const String& data)
 {
+    return adoptRef(new CDATASection(document, data));
 }
 
 String CDATASection::nodeName() const
@@ -47,19 +48,17 @@ Node::NodeType CDATASection::nodeType() const
 
 PassRefPtr<Node> CDATASection::cloneNode(bool /*deep*/)
 {
-    return new CDATASection(document(), m_data);
+    return create(document(), data());
 }
 
-// DOM Section 1.1.1
 bool CDATASection::childTypeAllowed(NodeType)
 {
     return false;
 }
 
-PassRefPtr<Text> CDATASection::createNew(PassRefPtr<StringImpl> string)
+PassRefPtr<Text> CDATASection::virtualCreate(const String& data)
 {
-    return new CDATASection(document(), string);
+    return create(document(), data);
 }
 
-
 } // namespace WebCore
diff --git a/WebCore/dom/CDATASection.h b/WebCore/dom/CDATASection.h
index 8b7df9d..5cf07e1 100644
--- a/WebCore/dom/CDATASection.h
+++ b/WebCore/dom/CDATASection.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,16 +29,16 @@ namespace WebCore {
 
 class CDATASection : public Text {
 public:
+    static PassRefPtr<CDATASection> create(Document*, const String&);
+
+private:
     CDATASection(Document*, const String&);
-    virtual ~CDATASection();
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType);
-
-protected:
-    virtual PassRefPtr<Text> createNew(PassRefPtr<StringImpl>);
+    virtual PassRefPtr<Text> virtualCreate(const String&);
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/CharacterData.cpp b/WebCore/dom/CharacterData.cpp
index 9a72de9..3c3dc37 100644
--- a/WebCore/dom/CharacterData.cpp
+++ b/WebCore/dom/CharacterData.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,20 +30,11 @@
 
 namespace WebCore {
 
-CharacterData::CharacterData(Document *doc, bool isText)
-    : Node(doc, false, false, isText)
-    , m_data(StringImpl::empty())
-{
-}
-
-CharacterData::CharacterData(Document* document, const String& text, bool isText)
-    : Node(document, false, false, isText)
-{
-    m_data = text.impl() ? text.impl() : StringImpl::empty();
-}
-
-CharacterData::~CharacterData()
+CharacterData::CharacterData(Document* document, const String& text, ConstructionType type)
+    : Node(document, type)
+    , m_data(text.impl() ? text.impl() : StringImpl::empty())
 {
+    ASSERT(type == CreateOther || type == CreateText);
 }
 
 void CharacterData::setData(const String& data, ExceptionCode&)
@@ -196,10 +187,8 @@ void CharacterData::dispatchModifiedEvent(StringImpl* prevValue)
 {
     if (parentNode())
         parentNode()->childrenChanged();
-    if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER)) {
-        ExceptionCode ec;
-        dispatchMutationEvent(eventNames().DOMCharacterDataModifiedEvent, true, 0, prevValue, m_data, ec); 
-    }
+    if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
+        dispatchEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, prevValue, m_data));
     dispatchSubtreeModifiedEvent();
 }
 
diff --git a/WebCore/dom/CharacterData.h b/WebCore/dom/CharacterData.h
index d9e55c0..6c31933 100644
--- a/WebCore/dom/CharacterData.h
+++ b/WebCore/dom/CharacterData.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,12 +29,6 @@ namespace WebCore {
 
 class CharacterData : public Node {
 public:
-    CharacterData(Document*, const String& text, bool isText = false);
-    CharacterData(Document*, bool isText = false);
-    virtual ~CharacterData();
-
-    // DOM methods & attributes for CharacterData
-
     String data() const { return m_data; }
     void setData(const String&, ExceptionCode&);
     unsigned length() const { return m_data->length(); }
@@ -42,31 +36,30 @@ public:
     void appendData(const String&, ExceptionCode&);
     void insertData(unsigned offset, const String&, ExceptionCode&);
     void deleteData(unsigned offset, unsigned count, ExceptionCode&);
-    void replaceData(unsigned offset, unsigned count, const String &arg, ExceptionCode&);
+    void replaceData(unsigned offset, unsigned count, const String&, ExceptionCode&);
 
     bool containsOnlyWhitespace() const;
 
-    // DOM methods overridden from parent classes
-
-    virtual String nodeValue() const;
-    virtual void setNodeValue(const String&, ExceptionCode&);
-    
-    // Other methods (not part of DOM)
+    StringImpl* dataImpl() { return m_data.get(); }
 
-    virtual bool isCharacterDataNode() const { return true; }
-    virtual int maxCharacterOffset() const;
-    StringImpl* string() { return m_data.get(); }
+protected:
+    CharacterData(Document*, const String&, ConstructionType);
 
-    virtual bool offsetInCharacters() const;
     virtual bool rendererIsNeeded(RenderStyle*);
 
-protected:
-    RefPtr<StringImpl> m_data;
-
+    void setDataImpl(PassRefPtr<StringImpl> impl) { m_data = impl; }
     void dispatchModifiedEvent(StringImpl* oldValue);
 
 private:
+    virtual String nodeValue() const;
+    virtual void setNodeValue(const String&, ExceptionCode&);
+    virtual bool isCharacterDataNode() const { return true; }
+    virtual int maxCharacterOffset() const;
+    virtual bool offsetInCharacters() const;
+
     void checkCharDataOperation(unsigned offset, ExceptionCode&);
+
+    RefPtr<StringImpl> m_data;
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/Clipboard.h b/WebCore/dom/Clipboard.h
index 0fea604..f6c09b2 100644
--- a/WebCore/dom/Clipboard.h
+++ b/WebCore/dom/Clipboard.h
@@ -64,7 +64,9 @@ namespace WebCore {
         virtual void setDragImageElement(Node*, const IntPoint&) = 0;
         
         virtual DragImageRef createDragImage(IntPoint& dragLocation) const = 0;
+#if ENABLE(DRAG_SUPPORT)
         virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*) = 0;
+#endif
         virtual void writeURL(const KURL&, const String&, Frame*) = 0;
         virtual void writeRange(Range*, Frame*) = 0;
 
diff --git a/WebCore/dom/Comment.cpp b/WebCore/dom/Comment.cpp
index a36a491..3dcde38 100644
--- a/WebCore/dom/Comment.cpp
+++ b/WebCore/dom/Comment.cpp
@@ -1,9 +1,7 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,22 +22,16 @@
 #include "config.h"
 #include "Comment.h"
 
-#include "Document.h"
-
 namespace WebCore {
 
-Comment::Comment(Document* doc, const String& text)
-    : CharacterData(doc, text)
-{
-}
-
-Comment::Comment(Document* doc)
-    : CharacterData(doc)
+inline Comment::Comment(Document* document, const String& text)
+    : CharacterData(document, text, CreateOther)
 {
 }
 
-Comment::~Comment()
+PassRefPtr<Comment> Comment::create(Document* document, const String& text)
 {
+    return adoptRef(new Comment(document, text));
 }
 
 String Comment::nodeName() const
@@ -54,10 +46,9 @@ Node::NodeType Comment::nodeType() const
 
 PassRefPtr<Node> Comment::cloneNode(bool /*deep*/)
 {
-    return document()->createComment(m_data);
+    return create(document(), data());
 }
 
-// DOM Section 1.1.1
 bool Comment::childTypeAllowed(NodeType)
 {
     return false;
diff --git a/WebCore/dom/Comment.h b/WebCore/dom/Comment.h
index d00ba62..680ffae 100644
--- a/WebCore/dom/Comment.h
+++ b/WebCore/dom/Comment.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,16 +29,14 @@ namespace WebCore {
 
 class Comment : public CharacterData {
 public:
-    Comment(Document*, const String &_text);
-    Comment(Document*);
-    virtual ~Comment();
+    static PassRefPtr<Comment> create(Document*, const String&);
+
+private:
+    Comment(Document*, const String&);
 
-    // DOM methods overridden from  parent classes
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
-
-    // Other methods (not part of DOM)
     virtual bool isCommentNode() const { return true; }
     virtual bool childTypeAllowed(NodeType);
 };
diff --git a/WebCore/dom/ContainerNode.cpp b/WebCore/dom/ContainerNode.cpp
index 2d79156..99b2c4f 100644
--- a/WebCore/dom/ContainerNode.cpp
+++ b/WebCore/dom/ContainerNode.cpp
@@ -23,6 +23,7 @@
 #include "config.h"
 #include "ContainerNode.h"
 
+#include "BeforeLoadEvent.h"
 #include "Cache.h"
 #include "ContainerNodeAlgorithms.h"
 #include "DeleteButtonController.h"
@@ -41,8 +42,8 @@
 
 namespace WebCore {
 
-static void dispatchChildInsertionEvents(Node*, ExceptionCode&);
-static void dispatchChildRemovalEvents(Node*, ExceptionCode&);
+static void dispatchChildInsertionEvents(Node*);
+static void dispatchChildRemovalEvents(Node*);
 
 typedef Vector<std::pair<NodeCallback, RefPtr<Node> > > NodeCallbackQueue;
 static NodeCallbackQueue* s_postAttachCallbackQueue;
@@ -144,7 +145,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
 
         // Dispatch the mutation events.
         childrenChanged(false, refChildPreviousSibling.get(), next.get(), 1);
-        dispatchChildInsertionEvents(child.get(), ec);
+        dispatchChildInsertionEvents(child.get());
                 
         // Add child to the rendering tree.
         if (attached() && !child->attached() && child->parent() == this) {
@@ -255,7 +256,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         allowEventDispatch();
 
         // Dispatch the mutation events
-        dispatchChildInsertionEvents(child.get(), ec);
+        dispatchChildInsertionEvents(child.get());
                 
         // Add child to the rendering tree
         if (attached() && !child->attached() && child->parent() == this) {
@@ -287,7 +288,7 @@ static ExceptionCode willRemoveChild(Node *child)
     ExceptionCode ec = 0;
 
     // fire removed from document mutation events.
-    dispatchChildRemovalEvents(child, ec);
+    dispatchChildRemovalEvents(child);
     if (ec)
         return ec;
 
@@ -480,7 +481,7 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
 
         // Dispatch the mutation events
         childrenChanged(false, prev.get(), 0, 1);
-        dispatchChildInsertionEvents(child.get(), ec);
+        dispatchChildInsertionEvents(child.get());
 
         // Add child to the rendering tree
         if (attached() && !child->attached() && child->parent() == this) {
@@ -690,7 +691,7 @@ bool ContainerNode::getUpperLeftCorner(FloatPoint& point) const
             point = o->container()->localToAbsolute();
             if (o->isText() && toRenderText(o)->firstTextBox()) {
                 point.move(toRenderText(o)->linesBoundingBox().x(),
-                           toRenderText(o)->firstTextBox()->root()->topOverflow());
+                           toRenderText(o)->firstTextBox()->root()->lineTop());
             } else if (o->isBox()) {
                 RenderBox* box = toRenderBox(o);
                 point.move(box->x(), box->y());
@@ -864,63 +865,57 @@ Node *ContainerNode::childNode(unsigned index) const
     return n;
 }
 
-static void dispatchChildInsertionEvents(Node* child, ExceptionCode& ec)
+static void dispatchChildInsertionEvents(Node* child)
 {
     ASSERT(!eventDispatchForbidden());
 
     RefPtr<Node> c = child;
-    DocPtr<Document> doc = child->document();
+    RefPtr<Document> document = child->document();
 
     if (c->parentNode() && c->parentNode()->inDocument())
         c->insertedIntoDocument();
     else
         c->insertedIntoTree(true);
 
-    doc->incDOMTreeVersion();
+    document->incDOMTreeVersion();
 
-    if (c->parentNode() && doc->hasListenerType(Document::DOMNODEINSERTED_LISTENER)) {
-        ec = 0;
-        c->dispatchMutationEvent(eventNames().DOMNodeInsertedEvent, true, c->parentNode(), String(), String(), ec); 
-        if (ec)
-            return;
-    }
+    if (c->parentNode() && document->hasListenerType(Document::DOMNODEINSERTED_LISTENER))
+        c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedEvent, true, c->parentNode()));
 
     // dispatch the DOMNodeInsertedIntoDocument event to all descendants
-    if (c->inDocument() && doc->hasListenerType(Document::DOMNODEINSERTEDINTODOCUMENT_LISTENER))
-        for (; c; c = c->traverseNextNode(child)) {
-            ec = 0;
-            c->dispatchMutationEvent(eventNames().DOMNodeInsertedIntoDocumentEvent, false, 0, String(), String(), ec); 
-            if (ec)
-                return;
-        }
+    if (c->inDocument() && document->hasListenerType(Document::DOMNODEINSERTEDINTODOCUMENT_LISTENER)) {
+        for (; c; c = c->traverseNextNode(child))
+            c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedIntoDocumentEvent, false));
+    }
 }
 
-static void dispatchChildRemovalEvents(Node* child, ExceptionCode& ec)
+static void dispatchChildRemovalEvents(Node* child)
 {
     RefPtr<Node> c = child;
-    DocPtr<Document> doc = child->document();
+    RefPtr<Document> document = child->document();
 
     // update auxiliary doc info (e.g. iterators) to note that node is being removed
-    doc->nodeWillBeRemoved(child);
+    document->nodeWillBeRemoved(child);
 
-    doc->incDOMTreeVersion();
+    document->incDOMTreeVersion();
 
     // dispatch pre-removal mutation events
-    if (c->parentNode() && doc->hasListenerType(Document::DOMNODEREMOVED_LISTENER)) {
-        ec = 0;
-        c->dispatchMutationEvent(eventNames().DOMNodeRemovedEvent, true, c->parentNode(), String(), String(), ec); 
-        if (ec)
-            return;
-    }
+    if (c->parentNode() && document->hasListenerType(Document::DOMNODEREMOVED_LISTENER))
+        c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedEvent, true, c->parentNode()));
 
     // dispatch the DOMNodeRemovedFromDocument event to all descendants
-    if (c->inDocument() && doc->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER))
-        for (; c; c = c->traverseNextNode(child)) {
-            ec = 0;
-            c->dispatchMutationEvent(eventNames().DOMNodeRemovedFromDocumentEvent, false, 0, String(), String(), ec); 
-            if (ec)
-                return;
-        }
+    if (c->inDocument() && document->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER)) {
+        for (; c; c = c->traverseNextNode(child))
+            c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedFromDocumentEvent, false));
+    }
 }
 
+bool ContainerNode::dispatchBeforeLoadEvent(const String& sourceURL)
+{
+    RefPtr<ContainerNode> protector(this);
+    RefPtr<BeforeLoadEvent> beforeLoadEvent = BeforeLoadEvent::create(sourceURL);
+    dispatchEvent(beforeLoadEvent.get());
+    return inDocument() && !beforeLoadEvent->defaultPrevented();
 }
+
+} // namespace WebCore
diff --git a/WebCore/dom/ContainerNode.h b/WebCore/dom/ContainerNode.h
index 3ad932c..9789f1f 100644
--- a/WebCore/dom/ContainerNode.h
+++ b/WebCore/dom/ContainerNode.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -38,7 +38,6 @@ namespace Private {
 
 class ContainerNode : public Node {
 public:
-    ContainerNode(Document*, bool isElement = false);
     virtual ~ContainerNode();
 
     Node* firstChild() const { return m_firstChild; }
@@ -72,8 +71,12 @@ public:
     void removeAllChildren();
 
     void cloneChildNodes(ContainerNode* clone);
+    
+    bool dispatchBeforeLoadEvent(const String& sourceURL);
 
 protected:
+    ContainerNode(Document*, ConstructionType = CreateContainer);
+
     static void queuePostAttachCallback(NodeCallback, Node*);
     void suspendPostAttachCallbacks();
     void resumePostAttachCallbacks();
@@ -97,8 +100,8 @@ private:
     Node* m_lastChild;
 };
 
-inline ContainerNode::ContainerNode(Document* document, bool isElement)
-    : Node(document, isElement, true)
+inline ContainerNode::ContainerNode(Document* document, ConstructionType type)
+    : Node(document, type)
     , m_firstChild(0)
     , m_lastChild(0)
 {
diff --git a/WebCore/dom/DOMImplementation.cpp b/WebCore/dom/DOMImplementation.cpp
index 065f708..59b9703 100644
--- a/WebCore/dom/DOMImplementation.cpp
+++ b/WebCore/dom/DOMImplementation.cpp
@@ -223,12 +223,6 @@ DOMImplementation* DOMImplementation::getInterface(const String& /*feature*/)
 PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceURI,
     const String& qualifiedName, DocumentType* doctype, ExceptionCode& ec)
 {
-    // WRONG_DOCUMENT_ERR: Raised if doctype has already been used with a different document or was
-    // created from a different implementation.
-    bool shouldThrowWrongDocErr = false;
-    if (doctype && doctype->document())
-        shouldThrowWrongDocErr = true;
-
     RefPtr<Document> doc;
 #if ENABLE(SVG)
     if (namespaceURI == SVGNames::svgNamespaceURI)
@@ -245,24 +239,27 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceUR
     else
         doc = Document::create(0);
 
-    // now get the interesting parts of the doctype
-    if (doctype)
-        doc->addChild(doctype);
-
+    RefPtr<Node> documentElement;
     if (!qualifiedName.isEmpty()) {
-        RefPtr<Node> documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
+        documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
         if (ec)
             return 0;
-        doc->addChild(documentElement.release());
     }
 
+    // WRONG_DOCUMENT_ERR: Raised if doctype has already been used with a different document or was
+    // created from a different implementation.
     // Hixie's interpretation of the DOM Core spec suggests we should prefer
-    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec)
-    if (shouldThrowWrongDocErr) {
+    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec).
+    if (doctype && doctype->document()) {
         ec = WRONG_DOCUMENT_ERR;
         return 0;
     }
 
+    if (doctype)
+        doc->addChild(doctype);
+    if (documentElement)
+        doc->addChild(documentElement.release());
+
     return doc.release();
 }
 
diff --git a/WebCore/dom/DocPtr.h b/WebCore/dom/DocPtr.h
deleted file mode 100644
index 8b50e8d..0000000
--- a/WebCore/dom/DocPtr.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * This file is part of the DOM implementation for KDE.
- * Copyright (C) 2005, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef DocPtr_h
-#define DocPtr_h
-
-namespace WebCore {
-
-template <class T> class DocPtr {
-public:
-    DocPtr() : m_ptr(0) {}
-    DocPtr(T *ptr) : m_ptr(ptr) { if (ptr) ptr->selfOnlyRef(); }
-    DocPtr(const DocPtr &o) : m_ptr(o.m_ptr) { if (T *ptr = m_ptr) ptr->selfOnlyRef(); }
-    ~DocPtr() { if (T *ptr = m_ptr) ptr->selfOnlyDeref(); }
-    
-    template <class U> DocPtr(const DocPtr<U> &o) : m_ptr(o.get()) { if (T *ptr = m_ptr) ptr->selfOnlyRef(); }
-    
-    void resetSkippingRef(T *o) { m_ptr = o; }
-    
-    T *get() const { return m_ptr; }
-    
-    T &operator*() const { return *m_ptr; }
-    T *operator->() const { return m_ptr; }
-    
-    bool operator!() const { return !m_ptr; }
-
-    // this type conversion operator allows implicit conversion to
-    // bool but not to other integer types
-    
-    typedef T * (DocPtr::*UnspecifiedBoolType)() const;
-    operator UnspecifiedBoolType() const
-    {
-        return m_ptr ? &DocPtr::get : 0;
-    }
-    
-    DocPtr &operator=(const DocPtr &);
-    DocPtr &operator=(T *);
-    
- private:
-    T *m_ptr;
-};
-
-template <class T> DocPtr<T> &DocPtr<T>::operator=(const DocPtr<T> &o) 
-{
-    T *optr = o.m_ptr;
-    if (optr)
-        optr->selfOnlyRef();
-    if (T *ptr = m_ptr)
-        ptr->selfOnlyDeref();
-    m_ptr = optr;
-        return *this;
-}
-
-template <class T> inline DocPtr<T> &DocPtr<T>::operator=(T *optr)
-{
-    if (optr)
-        optr->selfOnlyRef();
-    if (T *ptr = m_ptr)
-        ptr->selfOnlyDeref();
-    m_ptr = optr;
-    return *this;
-}
-
-template <class T> inline bool operator==(const DocPtr<T> &a, const DocPtr<T> &b) 
-{ 
-    return a.get() == b.get(); 
-}
-
-template <class T> inline bool operator==(const DocPtr<T> &a, const T *b) 
-{ 
-    return a.get() == b; 
-}
-
-template <class T> inline bool operator==(const T *a, const DocPtr<T> &b) 
-{
-    return a == b.get(); 
-}
-
-template <class T> inline bool operator!=(const DocPtr<T> &a, const DocPtr<T> &b) 
-{ 
-    return a.get() != b.get(); 
-}
-
-template <class T> inline bool operator!=(const DocPtr<T> &a, const T *b)
-{
-    return a.get() != b; 
-}
-
-template <class T> inline bool operator!=(const T *a, const DocPtr<T> &b) 
-{ 
-    return a != b.get(); 
-}
-
-} // namespace WebCore
-
-#endif // DocPtr_h
diff --git a/WebCore/dom/Document.cpp b/WebCore/dom/Document.cpp
index e4c5741..221473b 100644
--- a/WebCore/dom/Document.cpp
+++ b/WebCore/dom/Document.cpp
@@ -79,7 +79,7 @@
 #include "HitTestResult.h"
 #include "ImageLoader.h"
 #include "InspectorController.h"
-#include "ScriptEventListener.h"
+#include "InspectorTimelineAgent.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
 #include "MappedAttribute.h"
@@ -93,6 +93,8 @@
 #include "NodeWithIndex.h"
 #include "OverflowEvent.h"
 #include "Page.h"
+#include "PageGroup.h"
+#include "PageTransitionEvent.h"
 #include "PlatformKeyboardEvent.h"
 #include "ProcessingInstruction.h"
 #include "ProgressEvent.h"
@@ -103,6 +105,7 @@
 #include "RenderWidget.h"
 #include "ScriptController.h"
 #include "ScriptElement.h"
+#include "ScriptEventListener.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "SelectionController.h"
@@ -112,14 +115,17 @@
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
 #include "Timer.h"
+#include "TransformSource.h"
 #include "TreeWalker.h"
 #include "UIEvent.h"
+#include "UserContentURLPattern.h"
 #include "WebKitAnimationEvent.h"
 #include "WebKitTransitionEvent.h"
 #include "WheelEvent.h"
 #include "XMLHttpRequest.h"
 #include "XMLNames.h"
 #include "XMLTokenizer.h"
+#include "htmlediting.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/HashFunctions.h>
 #include <wtf/MainThread.h>
@@ -131,6 +137,10 @@
 #include "DatabaseThread.h"
 #endif
 
+#if ENABLE(SHARED_WORKERS)
+#include "SharedWorkerRepository.h"
+#endif
+
 #if ENABLE(DOM_STORAGE)
 #include "StorageEvent.h"
 #endif
@@ -153,6 +163,7 @@
 #if ENABLE(SVG)
 #include "SVGDocumentExtensions.h"
 #include "SVGElementFactory.h"
+#include "SVGNames.h"
 #include "SVGZoomEvent.h"
 #include "SVGStyleElement.h"
 #endif
@@ -184,6 +195,12 @@
 #include "WMLNames.h"
 #endif
 
+#if ENABLE(MATHML)
+#include "MathMLElement.h"
+#include "MathMLElementFactory.h"
+#include "MathMLNames.h"
+#endif
+
 #if ENABLE(XHTMLMP)
 #include "HTMLNoScriptElement.h"
 #endif
@@ -325,9 +342,6 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_titleSetExplicitly(false)
     , m_updateFocusAppearanceTimer(this, &Document::updateFocusAppearanceTimerFired)
     , m_executeScriptSoonTimer(this, &Document::executeScriptSoonTimerFired)
-#if ENABLE(XSLT)
-    , m_transformSource(0)
-#endif
     , m_xmlVersion("1.0")
     , m_xmlStandalone(false)
 #if ENABLE(XBL)
@@ -361,7 +375,9 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_containsWMLContent(false)
 #endif
 {
-    m_document.resetSkippingRef(this);
+    m_document = this;
+
+    m_pageGroupUserSheetCacheValid = false;
 
     m_printing = false;
     
@@ -431,8 +447,7 @@ void Document::removedLastRef()
         // want the document to be destructed until after
         // removeAllChildren returns, so we guard ourselves with an
         // extra self-only ref.
-
-        DocPtr<Document> guard(this);
+        selfOnlyRef();
 
         // We must make sure not to be retaining any of our children through
         // these extra pointers or we will create a reference cycle.
@@ -456,6 +471,8 @@ void Document::removedLastRef()
 #ifndef NDEBUG
         m_inRemovedLastRefFunction = false;
 #endif
+
+        selfOnlyDeref();
     } else {
 #ifndef NDEBUG
         m_deletionHasBegun = true;
@@ -482,7 +499,7 @@ Document::~Document()
 #endif
 
     delete m_tokenizer;
-    m_document.resetSkippingRef(0);
+    m_document = 0;
     delete m_styleSelector;
     delete m_docLoader;
     
@@ -491,10 +508,6 @@ Document::~Document()
         m_renderArena = 0;
     }
 
-#if ENABLE(XSLT)
-    xmlFreeDoc((xmlDocPtr)m_transformSource);
-#endif
-
 #if ENABLE(XBL)
     delete m_bindingManager;
 #endif
@@ -518,8 +531,6 @@ Document::~Document()
 
     if (m_styleSheets)
         m_styleSheets->documentDestroyed();
-
-    m_document = 0;
 }
 
 void Document::resetLinkColor()
@@ -599,17 +610,17 @@ PassRefPtr<Element> Document::createElement(const AtomicString& name, ExceptionC
 
 PassRefPtr<DocumentFragment> Document::createDocumentFragment()
 {
-    return new DocumentFragment(document());
+    return DocumentFragment::create(document());
 }
 
 PassRefPtr<Text> Document::createTextNode(const String& data)
 {
-    return new Text(this, data);
+    return Text::create(this, data);
 }
 
 PassRefPtr<Comment> Document::createComment(const String& data)
 {
-    return new Comment(this, data);
+    return Comment::create(this, data);
 }
 
 PassRefPtr<CDATASection> Document::createCDATASection(const String& data, ExceptionCode& ec)
@@ -618,7 +629,7 @@ PassRefPtr<CDATASection> Document::createCDATASection(const String& data, Except
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return new CDATASection(this, data);
+    return CDATASection::create(this, data);
 }
 
 PassRefPtr<ProcessingInstruction> Document::createProcessingInstruction(const String& target, const String& data, ExceptionCode& ec)
@@ -631,7 +642,7 @@ PassRefPtr<ProcessingInstruction> Document::createProcessingInstruction(const St
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return new ProcessingInstruction(this, target, data);
+    return ProcessingInstruction::create(this, target, data);
 }
 
 PassRefPtr<EntityReference> Document::createEntityReference(const String& name, ExceptionCode& ec)
@@ -644,12 +655,12 @@ PassRefPtr<EntityReference> Document::createEntityReference(const String& name,
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return new EntityReference(this, name);
+    return EntityReference::create(this, name);
 }
 
 PassRefPtr<EditingText> Document::createEditingTextNode(const String& text)
 {
-    return new EditingText(this, text);
+    return EditingText::create(this, text);
 }
 
 PassRefPtr<CSSStyleDeclaration> Document::createCSSStyleDeclaration()
@@ -714,11 +725,8 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
 
             return newElement.release();
         }
-        case ATTRIBUTE_NODE: {
-            RefPtr<Attr> newAttr = new Attr(0, this, static_cast<Attr*>(importedNode)->attr()->clone());
-            newAttr->createTextChild();
-            return newAttr.release();
-        }
+        case ATTRIBUTE_NODE:
+            return Attr::create(0, this, static_cast<Attr*>(importedNode)->attr()->clone());
         case DOCUMENT_FRAGMENT_NODE: {
             DocumentFragment* oldFragment = static_cast<DocumentFragment*>(importedNode);
             RefPtr<DocumentFragment> newFragment = createDocumentFragment();
@@ -828,9 +836,13 @@ PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool cre
     else if (isWMLDocument())
         e = WMLElementFactory::createWMLElement(QualifiedName(nullAtom, qName.localName(), WMLNames::wmlNamespaceURI), this, createdByParser);
 #endif
+#if ENABLE(MATHML)
+    else if (qName.namespaceURI() == MathMLNames::mathmlNamespaceURI)
+        e = MathMLElementFactory::createMathMLElement(qName, this, createdByParser);
+#endif
     
     if (!e)
-        e = new Element(qName, document());
+        e = Element::create(qName, document());
 
     // <image> uses imgTag so we need a special rule.
 #if ENABLE(WML)
@@ -952,16 +964,25 @@ KURL Document::baseURI() const
 
 Element* Document::elementFromPoint(int x, int y) const
 {
+    // FIXME: Share code between this and caretRangeFromPoint.
     if (!renderer())
         return 0;
+    Frame* frame = this->frame();
+    if (!frame)
+        return 0;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return 0;
 
-    HitTestRequest request(HitTestRequest::ReadOnly |
-                           HitTestRequest::Active);
+    float zoomFactor = frame->pageZoomFactor();
+    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
 
-    float zoomFactor = frame() ? frame()->pageZoomFactor() : 1.0f;
+    if (!frameView->visibleContentRect().contains(point))
+        return 0;
 
-    HitTestResult result(roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)));
-    renderView()->layer()->hitTest(request, result); 
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+    HitTestResult result(point);
+    renderView()->layer()->hitTest(request, result);
 
     Node* n = result.innerNode();
     while (n && !n->isElementNode())
@@ -971,6 +992,50 @@ Element* Document::elementFromPoint(int x, int y) const
     return static_cast<Element*>(n);
 }
 
+PassRefPtr<Range> Document::caretRangeFromPoint(int x, int y)
+{
+    // FIXME: Share code between this and elementFromPoint.
+    if (!renderer())
+        return 0;
+    Frame* frame = this->frame();
+    if (!frame)
+        return 0;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return 0;
+
+    float zoomFactor = frame->pageZoomFactor();
+    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
+
+    if (!frameView->visibleContentRect().contains(point))
+        return 0;
+
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+    HitTestResult result(point);
+    renderView()->layer()->hitTest(request, result);
+
+    Node* node = result.innerNode();
+    if (!node)
+        return 0;
+
+    Node* shadowAncestorNode = node->shadowAncestorNode();
+    if (shadowAncestorNode != node) {
+        unsigned offset = shadowAncestorNode->nodeIndex();
+        Node* container = shadowAncestorNode->parentNode();
+        return Range::create(this, container, offset, container, offset);
+    }
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return 0;
+    VisiblePosition visiblePosition = renderer->positionForPoint(result.localPoint());
+    if (visiblePosition.isNull())
+        return 0;
+
+    Position rangeCompliantPosition = rangeCompliantEquivalent(visiblePosition);
+    return Range::create(this, rangeCompliantPosition, rangeCompliantPosition);
+}
+
 void Document::addElementById(const AtomicString& elementId, Element* element)
 {
     typedef HashMap<AtomicStringImpl*, Element*>::iterator iterator;
@@ -1186,6 +1251,12 @@ void Document::recalcStyle(StyleChange change)
     if (m_inStyleRecalc)
         return; // Guard against re-entrancy. -dwh
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willRecalculateStyle();
+#endif
+
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
     if (view())
@@ -1266,6 +1337,11 @@ bail_out:
         m_closeAfterStyleRecalc = false;
         implicitClose();
     }
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didRecalculateStyle();
+#endif
 }
 
 void Document::updateStyleIfNeeded()
@@ -1363,7 +1439,8 @@ void Document::attach()
         bool matchAuthorAndUserStyles = true;
         if (Settings* docSettings = settings())
             matchAuthorAndUserStyles = docSettings->authorAndUserStylesEnabled();
-        m_styleSelector = new CSSStyleSelector(this, userStyleSheet(), m_styleSheets.get(), m_mappedElementSheet.get(), !inCompatMode(), matchAuthorAndUserStyles);
+        m_styleSelector = new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), pageUserSheet(), pageGroupUserSheets(), 
+                                               !inCompatMode(), matchAuthorAndUserStyles);
     }
 
     recalcStyle(Force);
@@ -1389,7 +1466,11 @@ void Document::detach()
     // Send out documentWillBecomeInactive() notifications to registered elements,
     // in order to stop media elements
     documentWillBecomeInactive();
-    
+
+#if ENABLE(SHARED_WORKERS)
+    SharedWorkerRepository::documentDetached(this);
+#endif
+
     if (m_frame) {
         FrameView* view = m_frame->view();
         if (view)
@@ -1436,31 +1517,14 @@ void Document::detach()
 
 void Document::removeAllEventListeners()
 {
+    EventTarget::removeAllEventListeners();
+
     if (DOMWindow* domWindow = this->domWindow())
         domWindow->removeAllEventListeners();
-    removeAllDisconnectedNodeEventListeners();
-    for (Node* node = this; node; node = node->traverseNextNode())
+    for (Node* node = firstChild(); node; node = node->traverseNextNode())
         node->removeAllEventListeners();
 }
 
-void Document::registerDisconnectedNodeWithEventListeners(Node* node)
-{
-    m_disconnectedNodesWithEventListeners.add(node);
-}
-
-void Document::unregisterDisconnectedNodeWithEventListeners(Node* node)
-{
-    m_disconnectedNodesWithEventListeners.remove(node);
-}
-
-void Document::removeAllDisconnectedNodeEventListeners()
-{
-    HashSet<Node*>::iterator end = m_disconnectedNodesWithEventListeners.end();
-    for (HashSet<Node*>::iterator i = m_disconnectedNodesWithEventListeners.begin(); i != end; ++i)
-        (*i)->removeAllEventListeners();
-    m_disconnectedNodesWithEventListeners.clear();
-}
-
 RenderView* Document::renderView() const
 {
     return toRenderView(renderer());
@@ -1660,7 +1724,7 @@ void Document::implicitClose()
         return;
     }
 
-    bool wasLocationChangePending = frame() && frame()->loader()->isScheduledLocationChangePending();
+    bool wasLocationChangePending = frame() && frame()->redirectScheduler()->locationChangePending();
     bool doload = !parsing() && m_tokenizer && !m_processingLoadEvent && !wasLocationChangePending;
     
     if (!doload)
@@ -1708,7 +1772,8 @@ void Document::implicitClose()
         f->animation()->resumeAnimations(this);
 
     ImageLoader::dispatchPendingLoadEvents();
-    dispatchLoadEvent();
+    dispatchWindowLoadEvent();
+    dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -1726,7 +1791,7 @@ void Document::implicitClose()
     // fires. This will improve onload scores, and other browsers do it.
     // If they wanna cheat, we can too. -dwh
 
-    if (frame()->loader()->isScheduledLocationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {
+    if (frame()->redirectScheduler()->locationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {
         // Just bail out. Before or during the onload we were shifted to another page.
         // The old i-Bench suite does this. When this happens don't bother painting or laying out.        
         view()->unscheduleRelayout();
@@ -1755,7 +1820,7 @@ void Document::implicitClose()
         // exists in the cache (we ignore the return value because we don't need it here). This is 
         // only safe to call when a layout is not in progress, so it can not be used in postNotification.    
         axObjectCache()->getOrCreate(renderObject);
-        axObjectCache()->postNotification(renderObject, "AXLoadComplete", true);
+        axObjectCache()->postNotification(renderObject, AXObjectCache::AXLoadComplete, true);
     }
 #endif
 
@@ -1917,34 +1982,72 @@ String Document::userAgent(const KURL& url) const
     return frame() ? frame()->loader()->userAgent(url) : String();
 }
 
-void Document::setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet* sheet)
+CSSStyleSheet* Document::pageUserSheet()
 {
-    m_sheet = CSSStyleSheet::create(this, url, charset);
-    m_sheet->parseString(sheet->sheetText());
+    if (m_pageUserSheet)
+        return m_pageUserSheet.get();
+    
+    Page* owningPage = page();
+    if (!owningPage)
+        return 0;
+    
+    String userSheetText = owningPage->userStyleSheet();
+    if (userSheetText.isEmpty())
+        return 0;
+    
+    // Parse the sheet and cache it.
+    m_pageUserSheet = CSSStyleSheet::create(this, settings()->userStyleSheetLocation());
+    m_pageUserSheet->setIsUserStyleSheet(true);
+    m_pageUserSheet->parseString(userSheetText, !inCompatMode());
+    return m_pageUserSheet.get();
+}
 
+void Document::clearPageUserSheet()
+{
+    m_pageUserSheet = 0;
     updateStyleSelector();
 }
 
-#if FRAME_LOADS_USER_STYLESHEET
-void Document::setUserStyleSheet(const String& sheet)
+const Vector<RefPtr<CSSStyleSheet> >* Document::pageGroupUserSheets() const
 {
-    if (m_usersheet != sheet) {
-        m_usersheet = sheet;
-        updateStyleSelector();
+    if (m_pageGroupUserSheetCacheValid)
+        return m_pageGroupUserSheets.get();
+    
+    m_pageGroupUserSheetCacheValid = true;
+    
+    Page* owningPage = page();
+    if (!owningPage)
+        return 0;
+        
+    const PageGroup& pageGroup = owningPage->group();
+    const UserStyleSheetMap* sheetsMap = pageGroup.userStyleSheets();
+    if (!sheetsMap)
+        return 0;
+
+    UserStyleSheetMap::const_iterator end = sheetsMap->end();
+    for (UserStyleSheetMap::const_iterator it = sheetsMap->begin(); it != end; ++it) {
+        const UserStyleSheetVector* sheets = it->second;
+        for (unsigned i = 0; i < sheets->size(); ++i) {
+            const UserStyleSheet* sheet = sheets->at(i).get();
+            if (!UserContentURLPattern::matchesPatterns(url(), sheet->whitelist(), sheet->blacklist()))
+                continue;
+            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this), sheet->url());
+            parsedSheet->setIsUserStyleSheet(true);
+            parsedSheet->parseString(sheet->source(), !inCompatMode());
+            if (!m_pageGroupUserSheets)
+                m_pageGroupUserSheets.set(new Vector<RefPtr<CSSStyleSheet> >);
+            m_pageGroupUserSheets->append(parsedSheet.release());
+        }
     }
+
+    return m_pageGroupUserSheets.get();
 }
-#endif
 
-String Document::userStyleSheet() const
+void Document::clearPageGroupUserSheets()
 {
-#if FRAME_LOADS_USER_STYLESHEET
-    return m_usersheet;
-#else
-    Page* page = this->page();
-    if (!page)
-        return String();
-    return page->userStyleSheet();
-#endif
+    m_pageGroupUserSheets.clear();
+    m_pageGroupUserSheetCacheValid = false;
+    updateStyleSelector();
 }
 
 CSSStyleSheet* Document::elementSheet()
@@ -2175,7 +2278,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
                 url = frame->loader()->url().string();
             else
                 url = completeURL(url).string();
-            frame->loader()->scheduleHTTPRedirection(delay, url);
+            frame->redirectScheduler()->scheduleRedirect(delay, url);
         }
     } else if (equalIgnoringCase(equiv, "set-cookie")) {
         // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
@@ -2189,7 +2292,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         FrameLoader* frameLoader = frame->loader();
         if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
             frameLoader->stopAllLoaders();
-            frameLoader->scheduleHTTPRedirection(0, blankURL());
+            frame->redirectScheduler()->scheduleLocationChange(blankURL(), String());
         }
     }
 }
@@ -2566,7 +2669,8 @@ void Document::recalcStyleSelector()
 
     // Create a new style selector
     delete m_styleSelector;
-    m_styleSelector = new CSSStyleSelector(this, userStyleSheet(), m_styleSheets.get(), m_mappedElementSheet.get(), !inCompatMode(), matchAuthorAndUserStyles);
+    m_styleSelector = new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), 
+                                           pageUserSheet(), pageGroupUserSheets(), !inCompatMode(), matchAuthorAndUserStyles);
     m_didCalculateStyleSelector = true;
 }
 
@@ -2661,7 +2765,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         // Dispatch a change event for text fields or textareas that have been edited
         RenderObject* r = oldFocusedNode->renderer();
         if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
-            oldFocusedNode->dispatchEvent(eventNames().changeEvent, true, false);
+            oldFocusedNode->dispatchEvent(Event::create(eventNames().changeEvent, true, false));
             r = oldFocusedNode->renderer();
             if (r && r->isTextControl())
                 toRenderTextControl(r)->setEdited(false);
@@ -2681,10 +2785,10 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             newFocusedNode = 0;
         }
-        if ((oldFocusedNode.get() == this) && oldFocusedNode->hasOneRef())
+        if (oldFocusedNode == this && oldFocusedNode->hasOneRef())
             return true;
             
-        if (oldFocusedNode.get() == oldFocusedNode->rootEditableElement())
+        if (oldFocusedNode == oldFocusedNode->rootEditableElement())
             frame()->editor()->didEndEditing();
     }
 
@@ -2713,7 +2817,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         }
         m_focusedNode->setFocus();
 
-        if (m_focusedNode.get() == m_focusedNode->rootEditableElement())
+        if (m_focusedNode == m_focusedNode->rootEditableElement())
             frame()->editor()->didBeginEditing();
 
         // eww, I suck. set the qt focus correctly
@@ -2735,20 +2839,17 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         }
     }
 
-#if PLATFORM(MAC) && !PLATFORM(CHROMIUM)
-    if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled())
-        axObjectCache()->handleFocusedUIElementChanged();
-#elif PLATFORM(GTK)
+#if ((PLATFORM(MAC) || PLATFORM(WIN)) && !PLATFORM(CHROMIUM)) || PLATFORM(GTK)
     if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled()) {
         RenderObject* oldFocusedRenderer = 0;
         RenderObject* newFocusedRenderer = 0;
 
         if (oldFocusedNode)
-            oldFocusedRenderer = oldFocusedNode.get()->renderer();
+            oldFocusedRenderer = oldFocusedNode->renderer();
         if (newFocusedNode)
-            newFocusedRenderer = newFocusedNode.get()->renderer();
+            newFocusedRenderer = newFocusedNode->renderer();
 
-        axObjectCache()->handleFocusedUIElementChangedWithRenderers(oldFocusedRenderer, newFocusedRenderer);
+        axObjectCache()->handleFocusedUIElementChanged(oldFocusedRenderer, newFocusedRenderer);
     }
 #endif
 
@@ -2891,26 +2992,16 @@ EventListener* Document::getWindowAttributeEventListener(const AtomicString& eve
     return domWindow->getAttributeEventListener(eventType);
 }
 
-void Document::dispatchWindowEvent(PassRefPtr<Event> event)
-{
-    ASSERT(!eventDispatchForbidden());
-    DOMWindow* domWindow = this->domWindow();
-    if (!domWindow)
-        return;
-    ExceptionCode ec;
-    domWindow->dispatchEvent(event, ec);
-}
-
-void Document::dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
+void Document::dispatchWindowEvent(PassRefPtr<Event> event,  PassRefPtr<EventTarget> target)
 {
     ASSERT(!eventDispatchForbidden());
     DOMWindow* domWindow = this->domWindow();
     if (!domWindow)
         return;
-    domWindow->dispatchEvent(eventType, canBubbleArg, cancelableArg);
+    domWindow->dispatchEvent(event, target);
 }
 
-void Document::dispatchLoadEvent()
+void Document::dispatchWindowLoadEvent()
 {
     ASSERT(!eventDispatchForbidden());
     DOMWindow* domWindow = this->domWindow();
@@ -2933,6 +3024,8 @@ PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode&
         return MutationEvent::create();
     if (eventType == "OverflowEvent")
         return OverflowEvent::create();
+    if (eventType == "PageTransitionEvent")
+        return PageTransitionEvent::create();
     if (eventType == "ProgressEvent")
         return ProgressEvent::create();
 #if ENABLE(DOM_STORAGE)
@@ -3039,7 +3132,7 @@ String Document::domain() const
     return securityOrigin()->domain();
 }
 
-void Document::setDomain(const String& newDomain)
+void Document::setDomain(const String& newDomain, ExceptionCode& ec)
 {
     // Both NS and IE specify that changing the domain is only allowed when
     // the new domain is a suffix of the old domain.
@@ -3062,19 +3155,25 @@ void Document::setDomain(const String& newDomain)
     int oldLength = domain().length();
     int newLength = newDomain.length();
     // e.g. newDomain = webkit.org (10) and domain() = www.webkit.org (14)
-    if (newLength >= oldLength)
+    if (newLength >= oldLength) {
+        ec = SECURITY_ERR;
         return;
+    }
 
     String test = domain();
     // Check that it's a subdomain, not e.g. "ebkit.org"
-    if (test[oldLength - newLength - 1] != '.')
+    if (test[oldLength - newLength - 1] != '.') {
+        ec = SECURITY_ERR;
         return;
+    }
 
     // Now test is "webkit.org" from domain()
     // and we check that it's the same thing as newDomain
     test.remove(0, oldLength - newLength);
-    if (test != newDomain)
+    if (test != newDomain) {
+        ec = SECURITY_ERR;
         return;
+    }
 
     securityOrigin()->setDomainFromDOM(newDomain);
     if (m_frame)
@@ -3870,13 +3969,11 @@ void Document::applyXSLTransform(ProcessingInstruction* pi)
     processor->createDocumentFromSource(newSource, resultEncoding, resultMIMEType, this, frame());
 }
 
-void Document::setTransformSource(void* doc)
+void Document::setTransformSource(PassOwnPtr<TransformSource> source)
 {
-    if (doc == m_transformSource)
+    if (m_transformSource == source)
         return;
-
-    xmlFreeDoc((xmlDocPtr)m_transformSource);
-    m_transformSource = doc;
+    m_transformSource = source;
 }
 
 #endif
@@ -3946,7 +4043,7 @@ PassRefPtr<Attr> Document::createAttributeNS(const String& namespaceURI, const S
 
     // FIXME: Assume this is a mapped attribute, since createAttribute isn't namespace-aware.  There's no harm to XML
     // documents if we're wrong.
-    return new Attr(0, this, MappedAttribute::create(qName, StringImpl::empty()));
+    return Attr::create(0, this, MappedAttribute::create(qName, StringImpl::empty()));
 }
 
 #if ENABLE(SVG)
@@ -4040,12 +4137,18 @@ CollectionCache* Document::nameCollectionInfo(CollectionType type, const AtomicS
 void Document::finishedParsing()
 {
     setParsing(false);
+    dispatchEvent(Event::create(eventNames().DOMContentLoadedEvent, true, false));
+    if (Frame* f = frame()) {
+        f->loader()->finishedParsing();
 
-    ExceptionCode ec = 0;
-    dispatchEvent(Event::create(eventNames().DOMContentLoadedEvent, true, false), ec);
+#if ENABLE(INSPECTOR)
+        if (!page())
+            return;
 
-    if (Frame* f = frame())
-        f->loader()->finishedParsing();
+        if (InspectorController* controller = page()->inspectorController())
+            controller->mainResourceFiredDOMContentEvent(f->loader()->documentLoader(), url());
+    }
+#endif
 }
 
 Vector<String> Document::formElementsState() const
@@ -4247,7 +4350,7 @@ void Document::initSecurityContext()
     if (!m_frame) {
         // No source for a security context.
         // This can occur via document.implementation.createDocument().
-        m_cookieURL = KURL("");
+        m_cookieURL = KURL(ParsedURLString, "");
         ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::createEmpty());
         return;
     }
@@ -4258,7 +4361,7 @@ void Document::initSecurityContext()
     m_cookieURL = url;
     ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(url));
 
-    if (FrameLoader::allowSubstituteDataAccessToLocal()) {
+    if (SecurityOrigin::allowSubstituteDataAccessToLocal()) {
         // If this document was loaded with substituteData, then the document can
         // load local resources.  See https://bugs.webkit.org/show_bug.cgi?id=16756
         // and https://bugs.webkit.org/show_bug.cgi?id=19760 for further
@@ -4448,7 +4551,7 @@ void Document::detachRange(Range* range)
     m_ranges.remove(range);
 }
 
-CanvasRenderingContext2D* Document::getCSSCanvasContext(const String& type, const String& name, int width, int height)
+CanvasRenderingContext* Document::getCSSCanvasContext(const String& type, const String& name, int width, int height)
 {
     HTMLCanvasElement* result = getCSSCanvasElement(name);
     if (!result)
@@ -4531,10 +4634,12 @@ void Document::reportException(const String& errorMessage, int lineNumber, const
 void Document::addMessage(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
 {
     switch (destination) {
+#if ENABLE(INSPECTOR)
     case InspectorControllerDestination:
         if (page())
             page()->inspectorController()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
         return;
+#endif
     case ConsoleDestination:
         if (DOMWindow* window = domWindow())
             window->console()->addMessage(source, type, level, message, lineNumber, sourceURL);
@@ -4545,8 +4650,10 @@ void Document::addMessage(MessageDestination destination, MessageSource source,
 
 void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
 {
+#if ENABLE(INSPECTOR)
     if (page())
         page()->inspectorController()->resourceRetrievedByXMLHttpRequest(identifier, sourceString);
+#endif
     Frame* frame = this->frame();
     if (frame) {
         FrameLoader* frameLoader = frame->loader();
@@ -4556,8 +4663,13 @@ void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const
 
 void Document::scriptImported(unsigned long identifier, const String& sourceString)
 {
+#if ENABLE(INSPECTOR)
     if (page())
         page()->inspectorController()->scriptImported(identifier, sourceString);
+#else
+    UNUSED_PARAM(identifier);
+    UNUSED_PARAM(sourceString);
+#endif
 }
 
 class ScriptExecutionContextTaskTimer : public TimerBase {
diff --git a/WebCore/dom/Document.h b/WebCore/dom/Document.h
index fc4dc7e..82a5b98 100644
--- a/WebCore/dom/Document.h
+++ b/WebCore/dom/Document.h
@@ -33,18 +33,12 @@
 #include "CollectionType.h"
 #include "Color.h"
 #include "DocumentMarker.h"
+#include "Page.h"
 #include "ScriptExecutionContext.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
-
-// FIXME: We should move Mac off of the old Frame-based user stylesheet loading
-// code and onto the new code in Page. We can't do that until the code in Page
-// supports non-file: URLs, however.
-#if PLATFORM(MAC) || PLATFORM(QT)
-#define FRAME_LOADS_USER_STYLESHEET 1
-#else
-#define FRAME_LOADS_USER_STYLESHEET 0
-#endif
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -53,7 +47,7 @@ namespace WebCore {
     class CDATASection;
     class CachedCSSStyleSheet;
     class CachedScript;
-    class CanvasRenderingContext2D;
+    class CanvasRenderingContext;
     class CharacterData;
     class CSSStyleDeclaration;
     class CSSStyleSelector;
@@ -83,12 +77,12 @@ namespace WebCore {
     class HTMLHeadElement;
     class HTMLInputElement;
     class HTMLMapElement;
+    class InspectorTimelineAgent;
     class IntPoint;
     class JSNode;
     class MouseEventWithHitTestResults;
     class NodeFilter;
     class NodeIterator;
-    class Page;
     class PlatformMouseEvent;
     class ProcessingInstruction;
     class Range;
@@ -111,6 +105,10 @@ namespace WebCore {
     class SVGDocumentExtensions;
 #endif
     
+#if ENABLE(XSLT)
+    class TransformSource;
+#endif
+
 #if ENABLE(XBL)
     class XBLBindingManager;
 #endif
@@ -172,19 +170,16 @@ class Document : public ContainerNode, public ScriptExecutionContext {
 public:
     static PassRefPtr<Document> create(Frame* frame)
     {
-        return new Document(frame, false);
+        return adoptRef(new Document(frame, false));
     }
     static PassRefPtr<Document> createXHTML(Frame* frame)
     {
-        return new Document(frame, true);
+        return adoptRef(new Document(frame, true));
     }
     virtual ~Document();
 
-    virtual bool isDocument() const { return true; }
-
     using ContainerNode::ref;
     using ContainerNode::deref;
-    virtual void removedLastRef();
 
     // Nodes belonging to this document hold "self-only" references -
     // these are enough to keep the document from being destroyed, but
@@ -211,10 +206,52 @@ public:
 
     // DOM methods & attributes for Document
 
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragenter);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragleave);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousewheel);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
+
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(blur);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+
+    // WebKit extensions
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(cut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecopy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(copy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforepaste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(paste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(selectstart);
+
     DocumentType* doctype() const { return m_docType.get(); }
 
     DOMImplementation* implementation() const;
-    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     
     Element* documentElement() const
     {
@@ -240,6 +277,8 @@ public:
     bool containsMultipleElementsWithId(const AtomicString& elementId) { return m_duplicateIds.contains(elementId.impl()); }
 
     Element* elementFromPoint(int x, int y) const;
+    PassRefPtr<Range> caretRangeFromPoint(int x, int y);
+
     String readyState() const;
 
     String defaultCharset() const;
@@ -299,11 +338,6 @@ public:
 
     CollectionCache* nameCollectionInfo(CollectionType, const AtomicString& name);
 
-    // DOM methods overridden from  parent classes
-
-    virtual String nodeName() const;
-    virtual NodeType nodeType() const;
-
     // Other methods (not part of DOM)
     virtual bool isHTMLDocument() const { return false; }
     virtual bool isImageDocument() const { return false; }
@@ -392,6 +426,9 @@ public:
     Frame* frame() const { return m_frame; } // can be NULL
     Page* page() const; // can be NULL
     Settings* settings() const; // can be NULL
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* inspectorTimelineAgent() const; // can be NULL
+#endif
 
     PassRefPtr<Range> createRange();
 
@@ -455,17 +492,15 @@ public:
 
     virtual String userAgent(const KURL&) const;
 
-    // from cachedObjectClient
-    virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
-
-#if FRAME_LOADS_USER_STYLESHEET
-    void setUserStyleSheet(const String& sheet);
-#endif
+    CSSStyleSheet* pageUserSheet();
+    void clearPageUserSheet();
 
-    String userStyleSheet() const;
+    const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets() const;
+    void clearPageGroupUserSheets();
 
     CSSStyleSheet* elementSheet();
     CSSStyleSheet* mappedElementSheet();
+    
     virtual Tokenizer* createTokenizer();
     Tokenizer* tokenizer() { return m_tokenizer; }
     
@@ -474,10 +509,6 @@ public:
 
     enum ParseMode { Compat, AlmostStrict, Strict };
 
-private:
-    virtual void determineParseMode() {}
-    
-public:
     void setParseMode(ParseMode m) { m_parseMode = m; }
     ParseMode parseMode() const { return m_parseMode; }
 
@@ -506,11 +537,6 @@ public:
     
     MouseEventWithHitTestResults prepareMouseEvent(const HitTestRequest&, const IntPoint&, const PlatformMouseEvent&);
 
-    virtual bool childTypeAllowed(NodeType);
-    virtual PassRefPtr<Node> cloneNode(bool deep);
-
-    virtual bool canReplaceChild(Node* newChild, Node* oldChild);
-    
     StyleSheetList* styleSheets();
 
     /* Newly proposed CSS3 mechanism for selecting alternate
@@ -570,9 +596,8 @@ public:
     // Helper functions for forwarding DOMWindow event related tasks to the DOMWindow if it exists.
     void setWindowAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
     EventListener* getWindowAttributeEventListener(const AtomicString& eventType);
-    void dispatchWindowEvent(PassRefPtr<Event>);
-    void dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg);
-    void dispatchLoadEvent();
+    void dispatchWindowEvent(PassRefPtr<Event>, PassRefPtr<EventTarget> = 0);
+    void dispatchWindowLoadEvent();
 
     PassRefPtr<Event> createEvent(const String& eventType, ExceptionCode&);
 
@@ -661,7 +686,7 @@ public:
     String referrer() const;
 
     String domain() const;
-    void setDomain(const String& newDomain);
+    void setDomain(const String& newDomain, ExceptionCode&);
 
     String lastModified() const;
 
@@ -735,10 +760,11 @@ public:
 
 #if ENABLE(XSLT)
     void applyXSLTransform(ProcessingInstruction* pi);
-    void setTransformSource(void* doc);
-    const void* transformSource() { return m_transformSource; }
     PassRefPtr<Document> transformSourceDocument() { return m_transformSourceDocument; }
     void setTransformSourceDocument(Document* doc) { m_transformSourceDocument = doc; }
+
+    void setTransformSource(PassOwnPtr<TransformSource>);
+    TransformSource* transformSource() const { return m_transformSource.get(); }
 #endif
 
 #if ENABLE(XBL)
@@ -751,8 +777,6 @@ public:
 
     void setDocType(PassRefPtr<DocumentType>);
 
-    virtual void finishedParsing();
-
 #if ENABLE(XPATH)
     // XPathEvaluator methods
     PassRefPtr<XPathExpression> createExpression(const String& expression,
@@ -795,11 +819,10 @@ public:
     DOMSelection* getSelection() const;
     
     // Extension for manipulating canvas drawing contexts for use in CSS
-    CanvasRenderingContext2D* getCSSCanvasContext(const String& type, const String& name, int width, int height);
+    CanvasRenderingContext* getCSSCanvasContext(const String& type, const String& name, int width, int height);
     HTMLCanvasElement* getCSSCanvasElement(const String& name);
 
     bool isDNSPrefetchEnabled() const { return m_isDNSPrefetchEnabled; }
-    void initDNSPrefetch();
     void parseDNSPrefetchControlHeader(const String&);
 
     virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL);
@@ -808,10 +831,92 @@ public:
     virtual void scriptImported(unsigned long, const String&);
     virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
 
+    typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
+    JSWrapperCache& wrapperCache() { return m_wrapperCache; }
+
+    virtual void finishedParsing();
+
+    bool inPageCache() const { return m_inPageCache; }
+    void setInPageCache(bool flag);
+    
+    // Elements can register themselves for the "documentWillBecomeInactive()" and  
+    // "documentDidBecomeActive()" callbacks
+    void registerForDocumentActivationCallbacks(Element*);
+    void unregisterForDocumentActivationCallbacks(Element*);
+    void documentWillBecomeInactive();
+    void documentDidBecomeActive();
+
+    void registerForMediaVolumeCallbacks(Element*);
+    void unregisterForMediaVolumeCallbacks(Element*);
+    void mediaVolumeDidChange();
+
+    void setShouldCreateRenderers(bool);
+    bool shouldCreateRenderers();
+
+    void setDecoder(PassRefPtr<TextResourceDecoder>);
+    TextResourceDecoder* decoder() const { return m_decoder.get(); }
+
+    String displayStringModifiedByEncoding(const String&) const;
+    PassRefPtr<StringImpl> displayStringModifiedByEncoding(PassRefPtr<StringImpl>) const;
+    void displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const;
+
+    // Quirk for the benefit of Apple's Dictionary application.
+    void setFrameElementsShouldIgnoreScrolling(bool ignore) { m_frameElementsShouldIgnoreScrolling = ignore; }
+    bool frameElementsShouldIgnoreScrolling() const { return m_frameElementsShouldIgnoreScrolling; }
+
+#if ENABLE(DASHBOARD_SUPPORT)
+    void setDashboardRegionsDirty(bool f) { m_dashboardRegionsDirty = f; }
+    bool dashboardRegionsDirty() const { return m_dashboardRegionsDirty; }
+    bool hasDashboardRegions () const { return m_hasDashboardRegions; }
+    void setHasDashboardRegions(bool f) { m_hasDashboardRegions = f; }
+    const Vector<DashboardRegionValue>& dashboardRegions() const;
+    void setDashboardRegions(const Vector<DashboardRegionValue>&);
+#endif
+
+    virtual void removeAllEventListeners();
+
+    CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
+    
+#if ENABLE(SVG)
+    const SVGDocumentExtensions* svgExtensions();
+    SVGDocumentExtensions* accessSVGExtensions();
+#endif
+
+    void initSecurityContext();
+
+    // Explicitly override the security origin for this document.
+    // Note: It is dangerous to change the security origin of a document
+    //       that already contains content.
+    void setSecurityOrigin(SecurityOrigin*);
+
+    bool processingLoadEvent() const { return m_processingLoadEvent; }
+
+#if ENABLE(DATABASE)
+    void addOpenDatabase(Database*);
+    void removeOpenDatabase(Database*);
+    DatabaseThread* databaseThread();   // Creates the thread as needed, but not if it has been already terminated.
+    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
+    bool hasOpenDatabases() { return m_hasOpenDatabases; }
+    void stopDatabases();
+#endif
+
+    void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
+    bool usingGeolocation() const { return m_usingGeolocation; };
+
+#if ENABLE(WML)
+    void setContainsWMLContent(bool value) { m_containsWMLContent = value; }
+    bool containsWMLContent() const { return m_containsWMLContent; }
+
+    void resetWMLPageState();
+    void initializeWMLPageState();
+#endif
+
 protected:
     Document(Frame*, bool isXHTML);
 
-    void setStyleSelector(CSSStyleSelector* styleSelector) {  m_styleSelector = styleSelector; }
+    void setStyleSelector(CSSStyleSelector* styleSelector) { m_styleSelector = styleSelector; }
+
+    void clearXMLVersion() { m_xmlVersion = String(); }
 
 #if ENABLE(TOUCH_EVENTS) // Android
 public:
@@ -826,16 +931,36 @@ private:
 #endif  // ENABLE(TOUCH_EVENTS)
 
 private:
+    virtual bool isDocument() const { return true; }
+    virtual void removedLastRef();
+    virtual void determineParseMode() { }
+
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+
+    virtual String nodeName() const;
+    virtual NodeType nodeType() const;
+    virtual bool childTypeAllowed(NodeType);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
+    virtual bool canReplaceChild(Node* newChild, Node* oldChild);
+
     virtual void refScriptExecutionContext() { ref(); }
     virtual void derefScriptExecutionContext() { deref(); }
 
     virtual const KURL& virtualURL() const; // Same as url(), but needed for ScriptExecutionContext to implement it without a performance loss for direct calls.
     virtual KURL virtualCompleteURL(const String&) const; // Same as completeURL() for the same reason as above.
 
+    void initDNSPrefetch();
+
     String encoding() const;
 
     void executeScriptSoonTimerFired(Timer<Document>*);
 
+    void updateTitle();
+    void updateFocusAppearanceTimerFired(Timer<Document>*);
+    void updateBaseURL();
+
+    void cacheDocumentElement() const;
+
     CSSStyleSelector* m_styleSelector;
     bool m_didCalculateStyleSelector;
 
@@ -863,11 +988,6 @@ private:
     RefPtr<DocumentType> m_docType;
     mutable RefPtr<DOMImplementation> m_implementation;
 
-    RefPtr<StyleSheet> m_sheet;
-#if FRAME_LOADS_USER_STYLESHEET
-    String m_usersheet;
-#endif
-
     // Track the number of currently loading top-level stylesheets.  Sheets
     // loaded using the @import directive are not included in this count.
     // We use this count of pending sheets to detect when we can begin attaching
@@ -887,6 +1007,9 @@ private:
 
     RefPtr<CSSStyleSheet> m_elemSheet;
     RefPtr<CSSStyleSheet> m_mappedElementSheet;
+    RefPtr<CSSStyleSheet> m_pageUserSheet;
+    mutable OwnPtr<Vector<RefPtr<CSSStyleSheet> > > m_pageGroupUserSheets;
+    mutable bool m_pageGroupUserSheetCacheValid;
 
     bool m_printing;
     
@@ -963,7 +1086,7 @@ private:
     Timer<Document> m_executeScriptSoonTimer;
     
 #if ENABLE(XSLT)
-    void* m_transformSource;
+    OwnPtr<TransformSource> m_transformSource;
     RefPtr<Document> m_transformSourceDocument;
 #endif
 
@@ -974,8 +1097,6 @@ private:
     typedef HashMap<AtomicStringImpl*, HTMLMapElement*> ImageMapsByName;
     ImageMapsByName m_imageMapsByName;
 
-    HashSet<Node*> m_disconnectedNodesWithEventListeners;
-
     int m_docID; // A unique document identifier used for things like document-specific mapped attributes.
 
     String m_xmlEncoding;
@@ -988,96 +1109,6 @@ private:
     bool m_shouldProcessNoScriptElement;
 #endif
 
-public:
-    bool inPageCache() const { return m_inPageCache; }
-    void setInPageCache(bool flag);
-    
-    // Elements can register themselves for the "documentWillBecomeInactive()" and  
-    // "documentDidBecomeActive()" callbacks
-    void registerForDocumentActivationCallbacks(Element*);
-    void unregisterForDocumentActivationCallbacks(Element*);
-    void documentWillBecomeInactive();
-    void documentDidBecomeActive();
-
-    void registerForMediaVolumeCallbacks(Element*);
-    void unregisterForMediaVolumeCallbacks(Element*);
-    void mediaVolumeDidChange();
-
-    void setShouldCreateRenderers(bool);
-    bool shouldCreateRenderers();
-    
-    void setDecoder(PassRefPtr<TextResourceDecoder>);
-    TextResourceDecoder* decoder() const { return m_decoder.get(); }
-
-    String displayStringModifiedByEncoding(const String&) const;
-    PassRefPtr<StringImpl> displayStringModifiedByEncoding(PassRefPtr<StringImpl>) const;
-    void displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const;
-
-    // Quirk for the benefit of Apple's Dictionary application.
-    void setFrameElementsShouldIgnoreScrolling(bool ignore) { m_frameElementsShouldIgnoreScrolling = ignore; }
-    bool frameElementsShouldIgnoreScrolling() const { return m_frameElementsShouldIgnoreScrolling; }
-
-#if ENABLE(DASHBOARD_SUPPORT)
-    void setDashboardRegionsDirty(bool f) { m_dashboardRegionsDirty = f; }
-    bool dashboardRegionsDirty() const { return m_dashboardRegionsDirty; }
-    bool hasDashboardRegions () const { return m_hasDashboardRegions; }
-    void setHasDashboardRegions(bool f) { m_hasDashboardRegions = f; }
-    const Vector<DashboardRegionValue>& dashboardRegions() const;
-    void setDashboardRegions(const Vector<DashboardRegionValue>&);
-#endif
-
-    void removeAllEventListeners();
-
-    void registerDisconnectedNodeWithEventListeners(Node*);
-    void unregisterDisconnectedNodeWithEventListeners(Node*);
-    
-    CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
-    
-#if ENABLE(SVG)
-    const SVGDocumentExtensions* svgExtensions();
-    SVGDocumentExtensions* accessSVGExtensions();
-#endif
-
-    void initSecurityContext();
-
-    // Explicitly override the security origin for this document.
-    // Note: It is dangerous to change the security origin of a document
-    //       that already contains content.
-    void setSecurityOrigin(SecurityOrigin*);
-
-    bool processingLoadEvent() const { return m_processingLoadEvent; }
-
-#if ENABLE(DATABASE)
-    void addOpenDatabase(Database*);
-    void removeOpenDatabase(Database*);
-    DatabaseThread* databaseThread();   // Creates the thread as needed, but not if it has been already terminated.
-    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
-    bool hasOpenDatabases() { return m_hasOpenDatabases; }
-    void stopDatabases();
-#endif
-    
-    void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
-    bool usingGeolocation() const { return m_usingGeolocation; };
-
-#if ENABLE(WML)
-    void setContainsWMLContent(bool value) { m_containsWMLContent = value; }
-    bool containsWMLContent() const { return m_containsWMLContent; }
-
-    void resetWMLPageState();
-    void initializeWMLPageState();
-#endif
-
-protected:
-    void clearXMLVersion() { m_xmlVersion = String(); }
-
-private:
-    void updateTitle();
-    void removeAllDisconnectedNodeEventListeners();
-    void updateFocusAppearanceTimerFired(Timer<Document>*);
-    void updateBaseURL();
-
-    void cacheDocumentElement() const;
-
     RenderObject* m_savedRenderer;
     int m_secureForms;
     
@@ -1131,10 +1162,6 @@ private:
 
     unsigned m_numNodeListCaches;
 
-public:
-    typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
-    JSWrapperCache& wrapperCache() { return m_wrapperCache; }
-private:
     JSWrapperCache m_wrapperCache;
 
 #if ENABLE(DATABASE)
@@ -1163,9 +1190,15 @@ inline bool Document::hasElementWithId(AtomicStringImpl* id) const
     
 inline bool Node::isDocumentNode() const
 {
-    return this == m_document.get();
+    return this == m_document;
 }
 
+#if ENABLE(INSPECTOR)
+inline InspectorTimelineAgent* Document::inspectorTimelineAgent() const {
+    return page() ? page()->inspectorTimelineAgent() : 0;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // Document_h
diff --git a/WebCore/dom/Document.idl b/WebCore/dom/Document.idl
index cd3ec77..e7a43c7 100644
--- a/WebCore/dom/Document.idl
+++ b/WebCore/dom/Document.idl
@@ -35,7 +35,7 @@ module core {
         readonly attribute [V8Custom] DOMImplementation implementation;
         readonly attribute Element documentElement;
 
-        [ReturnsNew] Element createElement(in [ConvertNullToNullString] DOMString tagName)
+        [ReturnsNew] Element createElement(in [ConvertNullToNullString, HintAtomic] DOMString tagName)
             raises (DOMException);
         DocumentFragment   createDocumentFragment();
         [ReturnsNew] Text createTextNode(in DOMString data);
@@ -64,7 +64,7 @@ module core {
             raises (DOMException);
         [OldStyleObjC] NodeList getElementsByTagNameNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                                        in DOMString localName);
-        Element            getElementById(in [V8Custom=HintAtomic] DOMString elementId);
+        Element            getElementById(in [HintAtomic] DOMString elementId);
 
         // DOM Level 3 Core
 
@@ -155,7 +155,8 @@ module core {
                  attribute [ConvertNullToNullString] DOMString title;
         readonly attribute DOMString referrer;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString domain;
+                 attribute [ConvertNullToNullString] DOMString domain
+                     setter raises (DOMException);
 #else
         readonly attribute DOMString domain;
 #endif
@@ -191,6 +192,9 @@ module core {
         readonly attribute [ConvertNullStringTo=Undefined] DOMString readyState;
 
         Element            elementFromPoint(in long x, in long y);
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        Range              caretRangeFromPoint(in long x, in long y);
+#endif
 
         // Mozilla extensions
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
@@ -264,6 +268,7 @@ module core {
         attribute [DontEnum] EventListener onerror;
         attribute [DontEnum] EventListener onfocus;
         attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener oninvalid;
         attribute [DontEnum] EventListener onkeydown;
         attribute [DontEnum] EventListener onkeypress;
         attribute [DontEnum] EventListener onkeyup;
@@ -291,7 +296,6 @@ module core {
         // attribute [DontEnum] EventListener onended;
         // attribute [DontEnum] EventListener onformchange;
         // attribute [DontEnum] EventListener onforminput;
-        // attribute [DontEnum] EventListener oninvalid;
         // attribute [DontEnum] EventListener onloadeddata;
         // attribute [DontEnum] EventListener onloadedmetadata;
         // attribute [DontEnum] EventListener onloadstart;
diff --git a/WebCore/dom/DocumentFragment.cpp b/WebCore/dom/DocumentFragment.cpp
index 7a6174f..3663e99 100644
--- a/WebCore/dom/DocumentFragment.cpp
+++ b/WebCore/dom/DocumentFragment.cpp
@@ -1,10 +1,8 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,13 +21,18 @@
  */
 
 #include "config.h"
-
 #include "DocumentFragment.h"
 
 namespace WebCore {
 
-DocumentFragment::DocumentFragment(Document *doc) : ContainerNode(doc)
+inline DocumentFragment::DocumentFragment(Document* document)
+    : ContainerNode(document)
+{
+}
+
+PassRefPtr<DocumentFragment> DocumentFragment::create(Document* document)
 {
+    return adoptRef(new DocumentFragment(document));
 }
 
 String DocumentFragment::nodeName() const
@@ -42,7 +45,6 @@ Node::NodeType DocumentFragment::nodeType() const
     return DOCUMENT_FRAGMENT_NODE;
 }
 
-// DOM Section 1.1.1
 bool DocumentFragment::childTypeAllowed(NodeType type)
 {
     switch (type) {
@@ -60,7 +62,7 @@ bool DocumentFragment::childTypeAllowed(NodeType type)
 
 PassRefPtr<Node> DocumentFragment::cloneNode(bool deep)
 {
-    RefPtr<DocumentFragment> clone = new DocumentFragment(document());
+    RefPtr<DocumentFragment> clone = create(document());
     if (deep)
         cloneChildNodes(clone.get());
     return clone.release();
diff --git a/WebCore/dom/DocumentFragment.h b/WebCore/dom/DocumentFragment.h
index 46d8ecd..e624ee4 100644
--- a/WebCore/dom/DocumentFragment.h
+++ b/WebCore/dom/DocumentFragment.h
@@ -1,10 +1,8 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,6 +30,9 @@ namespace WebCore {
 
 class DocumentFragment : public ContainerNode {
 public:
+    static PassRefPtr<DocumentFragment> create(Document*);
+
+private:
     DocumentFragment(Document*);
 
     virtual String nodeName() const;
diff --git a/WebCore/dom/DocumentType.cpp b/WebCore/dom/DocumentType.cpp
index 885a65b..b8185e7 100644
--- a/WebCore/dom/DocumentType.cpp
+++ b/WebCore/dom/DocumentType.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,11 +29,11 @@
 
 namespace WebCore {
 
-DocumentType::DocumentType(Document* document, const String& n, const String& p, const String& s)
-    : Node(document)
-    , m_name(n)
-    , m_publicId(p)
-    , m_systemId(s)
+DocumentType::DocumentType(Document* document, const String& name, const String& publicId, const String& systemId)
+    : Node(document, CreateOther)
+    , m_name(name)
+    , m_publicId(publicId)
+    , m_systemId(systemId)
 {
 }
 
@@ -54,7 +54,7 @@ Node::NodeType DocumentType::nodeType() const
 
 PassRefPtr<Node> DocumentType::cloneNode(bool /*deep*/)
 {
-    return new DocumentType(document(), m_name, m_publicId, m_systemId);
+    return create(document(), m_name, m_publicId, m_systemId);
 }
 
 void DocumentType::insertedIntoDocument()
diff --git a/WebCore/dom/DocumentType.h b/WebCore/dom/DocumentType.h
index 9fd3c6e..4f89d01 100644
--- a/WebCore/dom/DocumentType.h
+++ b/WebCore/dom/DocumentType.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,7 +34,7 @@ class DocumentType : public Node {
 public:
     static PassRefPtr<DocumentType> create(Document* document, const String& name, const String& publicId, const String& systemId)
     {
-        return new DocumentType(document, name, publicId, systemId);
+        return adoptRef(new DocumentType(document, name, publicId, systemId));
     }
 
     NamedNodeMap* entities() const { return m_entities.get(); }
diff --git a/WebCore/dom/EditingText.cpp b/WebCore/dom/EditingText.cpp
index 40cf97d..b36931a 100644
--- a/WebCore/dom/EditingText.cpp
+++ b/WebCore/dom/EditingText.cpp
@@ -1,9 +1,5 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+/*
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,24 +20,19 @@
 #include "config.h"
 #include "EditingText.h"
 
-// FIXME: does this really require a class? Perhaps any Text node
-// inside an editable element should have the "always create a renderer"
-// behavior.
+// FIXME: Does this really require a class? Perhaps instead any text node
+// inside an editable element could have the "always create a renderer" behavior.
 
 namespace WebCore {
 
-EditingText::EditingText(Document *impl, const String &text)
-    : Text(impl, text)
-{
-}
-
-EditingText::EditingText(Document *impl)
-    : Text(impl)
+inline EditingText::EditingText(Document* document, const String& data)
+    : Text(document, data)
 {
 }
 
-EditingText::~EditingText()
+PassRefPtr<EditingText> EditingText::create(Document* document, const String& data)
 {
+    return adoptRef(new EditingText(document, data));
 }
 
 bool EditingText::rendererIsNeeded(RenderStyle*)
diff --git a/WebCore/dom/EditingText.h b/WebCore/dom/EditingText.h
index e114786..08223c2 100644
--- a/WebCore/dom/EditingText.h
+++ b/WebCore/dom/EditingText.h
@@ -1,9 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,11 +27,12 @@ namespace WebCore {
 
 class EditingText : public Text {
 public:
-    EditingText(Document *impl, const String &text);
-    EditingText(Document *impl);
-    virtual ~EditingText();
+    static PassRefPtr<EditingText> create(Document*, const String&);
 
+private:
     virtual bool rendererIsNeeded(RenderStyle *);
+
+    EditingText(Document*, const String&);
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index 1956be4..50ff033 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -28,6 +28,8 @@
 
 #include "AXObjectCache.h"
 #include "Attr.h"
+#include "CSSParser.h"
+#include "CSSSelectorList.h"
 #include "CSSStyleSelector.h"
 #include "CString.h"
 #include "ClientRect.h"
@@ -57,12 +59,17 @@ namespace WebCore {
 using namespace HTMLNames;
 using namespace XMLNames;
     
-Element::Element(const QualifiedName& tagName, Document* doc)
-    : ContainerNode(doc, true)
+Element::Element(const QualifiedName& tagName, Document* document, ConstructionType type)
+    : ContainerNode(document, type)
     , m_tagName(tagName)
 {
 }
 
+PassRefPtr<Element> Element::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new Element(tagName, document, CreateElement));
+}
+
 Element::~Element()
 {
     if (namedAttrMap)
@@ -275,42 +282,6 @@ static int adjustForLocalZoom(int value, RenderObject* renderer)
     return static_cast<int>(value / zoomFactor);
 }
 
-static int adjustForAbsoluteZoom(int value, RenderObject* renderer)
-{
-    float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1)
-        return value;
-    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
-    if (zoomFactor > 1)
-        value++;
-    return static_cast<int>(value / zoomFactor);
-}
-
-static FloatPoint adjustFloatPointForAbsoluteZoom(const FloatPoint& point, RenderObject* renderer)
-{
-    // The result here is in floats, so we don't need the truncation hack from the integer version above.
-    float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1)
-        return point;
-    return FloatPoint(point.x() / zoomFactor, point.y() / zoomFactor);
-}
-
-static void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* renderer)
-{
-    quad.setP1(adjustFloatPointForAbsoluteZoom(quad.p1(), renderer));
-    quad.setP2(adjustFloatPointForAbsoluteZoom(quad.p2(), renderer));
-    quad.setP3(adjustFloatPointForAbsoluteZoom(quad.p3(), renderer));
-    quad.setP4(adjustFloatPointForAbsoluteZoom(quad.p4(), renderer));
-}
-
-static void adjustIntRectForAbsoluteZoom(IntRect& rect, RenderObject* renderer)
-{
-    rect.setX(adjustForAbsoluteZoom(rect.x(), renderer));
-    rect.setY(adjustForAbsoluteZoom(rect.y(), renderer));
-    rect.setWidth(adjustForAbsoluteZoom(rect.width(), renderer));
-    rect.setHeight(adjustForAbsoluteZoom(rect.height(), renderer));
-}
-
 int Element::offsetLeft()
 {
     document()->updateLayoutIgnorePendingStylesheets();
@@ -597,16 +568,20 @@ void Element::attributeChanged(Attribute* attr, bool)
 
 void Element::updateAfterAttributeChanged(Attribute* attr)
 {
-    if (!document()->axObjectCache()->accessibilityEnabled())
+    AXObjectCache* axObjectCache = document()->axObjectCache();
+    if (!axObjectCache->accessibilityEnabled())
         return;
 
     const QualifiedName& attrName = attr->name();
     if (attrName == aria_activedescendantAttr) {
         // any change to aria-activedescendant attribute triggers accessibility focus change, but document focus remains intact
-        document()->axObjectCache()->handleActiveDescendantChanged(renderer());
+        axObjectCache->handleActiveDescendantChanged(renderer());
     } else if (attrName == roleAttr) {
         // the role attribute can change at any time, and the AccessibilityObject must pick up these changes
-        document()->axObjectCache()->handleAriaRoleChanged(renderer());
+        axObjectCache->handleAriaRoleChanged(renderer());
+    } else if (attrName == aria_valuenowAttr) {
+        // If the valuenow attribute changes, AX clients need to be notified.
+        axObjectCache->postNotification(renderer(), AXObjectCache::AXValueChanged, true);
     }
 }
     
@@ -677,7 +652,7 @@ void Element::setPrefix(const AtomicString &_prefix, ExceptionCode& ec)
 
 KURL Element::baseURI() const
 {
-    KURL base(getAttribute(baseAttr));
+    KURL base(KURL(), getAttribute(baseAttr));
     if (!base.protocol().isEmpty())
         return base;
 
@@ -804,7 +779,8 @@ bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderS
 
 void Element::recalcStyle(StyleChange change)
 {
-    RenderStyle* currentStyle = renderStyle();
+    // Ref currentStyle in case it would otherwise be deleted when setRenderStyle() is called.
+    RefPtr<RenderStyle> currentStyle(renderStyle());
     bool hasParentStyle = parentNode() ? parentNode()->renderStyle() : false;
     bool hasPositionalRules = needsStyleRecalc() && currentStyle && currentStyle->childrenAffectedByPositionalRules();
     bool hasDirectAdjacentRules = currentStyle && currentStyle->childrenAffectedByDirectAdjacentRules();
@@ -820,7 +796,7 @@ void Element::recalcStyle(StyleChange change)
     }
     if (hasParentStyle && (change >= Inherit || needsStyleRecalc())) {
         RefPtr<RenderStyle> newStyle = document()->styleSelector()->styleForElement(this);
-        StyleChange ch = diff(currentStyle, newStyle.get());
+        StyleChange ch = diff(currentStyle.get(), newStyle.get());
         if (ch == Detach || !currentStyle) {
             if (attached())
                 detach();
@@ -852,9 +828,9 @@ void Element::recalcStyle(StyleChange change)
                 newStyle->setChildrenAffectedByDirectAdjacentRules();
         }
 
-        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle, newStyle.get())) {
+        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle.get(), newStyle.get())) {
             setRenderStyle(newStyle);
-        } else if (needsStyleRecalc() && (styleChangeType() != AnimationStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
+        } else if (needsStyleRecalc() && (styleChangeType() != SyntheticStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
             // Although no change occurred, we use the new style so that the cousin style sharing code won't get
             // fooled into believing this style is the same.  This is only necessary if the document actually uses
             // sibling/descendant rules, since otherwise it isn't possible for ancestor styles to affect sharing of
@@ -863,7 +839,7 @@ void Element::recalcStyle(StyleChange change)
                 renderer()->setStyleInternal(newStyle.get());
             else
                 setRenderStyle(newStyle);
-        } else if (styleChangeType() == AnimationStyleChange)
+        } else if (styleChangeType() == SyntheticStyleChange)
              setRenderStyle(newStyle);
 
         if (change != Force) {
@@ -1215,14 +1191,24 @@ void Element::focus(bool restorePreviousSelection)
     if (doc->focusedNode() == this)
         return;
 
-    doc->updateLayoutIgnorePendingStylesheets();
-    
     if (!supportsFocus())
         return;
-    
+
+    // If the stylesheets have already been loaded we can reliably check isFocusable.
+    // If not, we continue and set the focused node on the focus controller below so
+    // that it can be updated soon after attach. 
+    if (doc->haveStylesheetsLoaded()) {
+        doc->updateLayoutIgnorePendingStylesheets();
+        if (!isFocusable())
+            return;
+    }
+
     if (Page* page = doc->page())
         page->focusController()->setFocusedNode(this, doc->frame());
 
+    // Setting the focused node above might have invalidated the layout due to scripts.
+    doc->updateLayoutIgnorePendingStylesheets();
+
     if (!isFocusable()) {
         ensureRareData()->setNeedsFocusAppearanceUpdateSoonAfterAttach(true);
         return;
@@ -1386,6 +1372,39 @@ unsigned Element::childElementCount() const
     return count;
 }
 
+bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
+{
+    if (selector.isEmpty()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    bool strictParsing = !document()->inCompatMode();
+    CSSParser p(strictParsing);
+
+    CSSSelectorList selectorList;
+    p.parseSelector(selector, document(), selectorList);
+
+    if (!selectorList.first()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // Throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
+    if (selectorList.selectorsNeedNamespaceResolution()) {
+        ec = NAMESPACE_ERR;
+        return false;
+    }
+
+    CSSStyleSelector::SelectorChecker selectorChecker(document(), strictParsing);
+    for (CSSSelector* selector = selectorList.first(); selector; selector = CSSSelectorList::next(selector)) {
+        if (selectorChecker.checkSelector(selector, this))
+            return true;
+    }
+
+    return false;
+}
+
 KURL Element::getURLAttribute(const QualifiedName& name) const
 {
 #ifndef NDEBUG
diff --git a/WebCore/dom/Element.h b/WebCore/dom/Element.h
index 223c26a..8d12cc9 100644
--- a/WebCore/dom/Element.h
+++ b/WebCore/dom/Element.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -41,8 +41,53 @@ class IntSize;
 
 class Element : public ContainerNode {
 public:
-    Element(const QualifiedName&, Document*);
-    ~Element();
+    static PassRefPtr<Element> create(const QualifiedName&, Document*);
+    virtual ~Element();
+
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragenter);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragleave);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousewheel);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
+
+    // These 4 attribute event handler attributes are overrided by HTMLBodyElement
+    // and HTMLFrameSetElement to forward to the DOMWindow.
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(blur);
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(focus);
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(load);
+
+    // WebKit extensions
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(cut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecopy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(copy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforepaste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(paste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(selectstart);
 
     const AtomicString& getIDAttribute() const;
     bool hasAttribute(const QualifiedName&) const;
@@ -64,7 +109,6 @@ public:
     void scrollIntoView(bool alignToTop = true);
     void scrollIntoViewIfNeeded(bool centerIfNeeded = true);
 
-    void scrollByUnits(int units, ScrollGranularity);
     void scrollByLines(int lines);
     void scrollByPages(int pages);
 
@@ -108,17 +152,11 @@ public:
 
     const AtomicString& localName() const { return m_tagName.localName(); }
     const AtomicString& prefix() const { return m_tagName.prefix(); }
-    virtual void setPrefix(const AtomicString&, ExceptionCode&);
     const AtomicString& namespaceURI() const { return m_tagName.namespaceURI(); }
 
     virtual KURL baseURI() const;
 
-    // DOM methods overridden from parent classes
-    virtual NodeType nodeType() const;
     virtual String nodeName() const;
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
-    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     PassRefPtr<Element> cloneElementWithChildren();
     PassRefPtr<Element> cloneElementWithoutChildren();
@@ -136,13 +174,9 @@ public:
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
-    // The implementation of Element::attributeChanged() calls the following two functions.
-    // They are separated to allow a different flow of control in StyledElement::attributeChanged().
-    void recalcStyleIfNeededAfterAttributeChanged(Attribute*);
-    void updateAfterAttributeChanged(Attribute*);
-
     // not part of the DOM
     void setAttributeMap(PassRefPtr<NamedNodeMap>);
+    NamedNodeMap* attributeMap() const { return namedAttrMap.get(); }
 
     virtual void copyNonAttributeProperties(const Element* /*source*/) { }
 
@@ -153,10 +187,6 @@ public:
 
     virtual RenderStyle* computedStyle();
 
-    virtual bool childTypeAllowed(NodeType);
-
-    virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
-    
     void dispatchAttrRemovalEvent(Attribute*);
     void dispatchAttrAdditionEvent(Attribute*);
 
@@ -170,12 +200,6 @@ public:
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     void blur();
 
-#ifndef NDEBUG
-    virtual void formatForDebugger(char* buffer, unsigned length) const;
-#endif
-
-    bool pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle);
-
     String innerText() const;
     String outerText() const;
  
@@ -206,13 +230,17 @@ public:
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
-    // FormControlElement API
+    bool webkitMatchesSelector(const String& selectors, ExceptionCode&);
+
     virtual bool isFormControlElement() const { return false; }
     virtual bool isEnabledFormControl() const { return true; }
     virtual bool isReadOnlyFormControl() const { return false; }
     virtual bool isTextFormControl() const { return false; }
     virtual bool isOptionalFormControl() const { return false; }
     virtual bool isRequiredFormControl() const { return false; }
+    virtual bool isDefaultButtonForForm() const { return false; }
+    virtual bool willValidate() const { return false; }
+    virtual bool isValidFormControlElement() { return false; }
 
     virtual bool formControlValueMatchesRenderer() const { return false; }
     virtual void setFormControlValueMatchesRenderer(bool) { }
@@ -225,13 +253,39 @@ public:
 
     virtual void dispatchFormControlChangeEvent() { }
 
+protected:
+    Element(const QualifiedName&, Document*, ConstructionType);
+
+    virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+
+    // The implementation of Element::attributeChanged() calls the following two functions.
+    // They are separated to allow a different flow of control in StyledElement::attributeChanged().
+    void recalcStyleIfNeededAfterAttributeChanged(Attribute*);
+    void updateAfterAttributeChanged(Attribute*);
+
 private:
+    void scrollByUnits(int units, ScrollGranularity);
+
+    virtual void setPrefix(const AtomicString&, ExceptionCode&);
+    virtual NodeType nodeType() const;
+    virtual bool childTypeAllowed(NodeType);
+
+    virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
+    
+#ifndef NDEBUG
+    virtual void formatForDebugger(char* buffer, unsigned length) const;
+#endif
+
+    bool pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle);
+
     virtual void createAttributeMap() const;
 
-    virtual void updateStyleAttribute() const {}
+    virtual void updateStyleAttribute() const { }
 
 #if ENABLE(SVG)
-    virtual void updateAnimatedSVGAttribute(const String&) const {}
+    virtual void updateAnimatedSVGAttribute(const String&) const { }
 #endif
 
     void updateFocusAppearanceSoonAfterAttach();
@@ -248,10 +302,10 @@ private:
     QualifiedName m_tagName;
     virtual NodeRareData* createRareData();
 
-protected:
     ElementRareData* rareData() const;
     ElementRareData* ensureRareData();
     
+protected:
     mutable RefPtr<NamedNodeMap> namedAttrMap;
 };
     
diff --git a/WebCore/dom/Element.idl b/WebCore/dom/Element.idl
index e8988e1..c24ef65 100644
--- a/WebCore/dom/Element.idl
+++ b/WebCore/dom/Element.idl
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         GenerateNativeConverter,
         InlineGetOwnPropertySlot,
@@ -110,6 +111,10 @@ module core {
             raises(DOMException);
 
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        // WebKit extension, pending specification.
+        boolean webkitMatchesSelector(in DOMString selectors)
+            raises(DOMException);
+
         // ElementTraversal API
         readonly attribute Element firstElementChild;
         readonly attribute Element lastElementChild;
@@ -148,6 +153,7 @@ module core {
         attribute [DontEnum] EventListener onerror;
         attribute [DontEnum] EventListener onfocus;
         attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener oninvalid;
         attribute [DontEnum] EventListener onkeydown;
         attribute [DontEnum] EventListener onkeypress;
         attribute [DontEnum] EventListener onkeyup;
@@ -175,7 +181,6 @@ module core {
         // attribute [DontEnum] EventListener onended;
         // attribute [DontEnum] EventListener onformchange;
         // attribute [DontEnum] EventListener onforminput;
-        // attribute [DontEnum] EventListener oninvalid;
         // attribute [DontEnum] EventListener onloadeddata;
         // attribute [DontEnum] EventListener onloadedmetadata;
         // attribute [DontEnum] EventListener onloadstart;
diff --git a/WebCore/dom/EntityReference.cpp b/WebCore/dom/EntityReference.cpp
index 012605c..c4c292a 100644
--- a/WebCore/dom/EntityReference.cpp
+++ b/WebCore/dom/EntityReference.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,12 +23,17 @@
 
 namespace WebCore {
 
-EntityReference::EntityReference(Document* document, const String& entityName)
+inline EntityReference::EntityReference(Document* document, const String& entityName)
     : ContainerNode(document)
     , m_entityName(entityName)
 {
 }
 
+PassRefPtr<EntityReference> EntityReference::create(Document* document, const String& entityName)
+{
+    return adoptRef(new EntityReference(document, entityName));
+}
+
 String EntityReference::nodeName() const
 {
     return m_entityName;
@@ -41,7 +46,7 @@ Node::NodeType EntityReference::nodeType() const
 
 PassRefPtr<Node> EntityReference::cloneNode(bool)
 {
-    return new EntityReference(document(), m_entityName);
+    return create(document(), m_entityName);
 }
 
 } // namespace
diff --git a/WebCore/dom/EntityReference.h b/WebCore/dom/EntityReference.h
index 4767a5e..7a6f6c3 100644
--- a/WebCore/dom/EntityReference.h
+++ b/WebCore/dom/EntityReference.h
@@ -28,13 +28,15 @@ namespace WebCore {
 
 class EntityReference : public ContainerNode {
 public:
+    static PassRefPtr<EntityReference> create(Document*, const String& entityName);
+
+private:
     EntityReference(Document*, const String& entityName);
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
 
-private:
     String m_entityName;
 };
 
diff --git a/WebCore/dom/Event.cpp b/WebCore/dom/Event.cpp
index b711759..cae4122 100644
--- a/WebCore/dom/Event.cpp
+++ b/WebCore/dom/Event.cpp
@@ -124,6 +124,11 @@ bool Event::isOverflowEvent() const
     return false;
 }
 
+bool Event::isPageTransitionEvent() const
+{
+    return false;
+}
+
 bool Event::isProgressEvent() const
 {
     return false;
diff --git a/WebCore/dom/Event.h b/WebCore/dom/Event.h
index 0b9bcf0..30e5d27 100644
--- a/WebCore/dom/Event.h
+++ b/WebCore/dom/Event.h
@@ -109,6 +109,7 @@ namespace WebCore {
         virtual bool isWheelEvent() const;
         virtual bool isBeforeTextInsertedEvent() const;
         virtual bool isOverflowEvent() const;
+        virtual bool isPageTransitionEvent() const;
         virtual bool isProgressEvent() const;
         virtual bool isXMLHttpRequestProgressEvent() const;
         virtual bool isWebKitAnimationEvent() const;
diff --git a/WebCore/dom/EventListener.h b/WebCore/dom/EventListener.h
index 7c4812f..f834b31 100644
--- a/WebCore/dom/EventListener.h
+++ b/WebCore/dom/EventListener.h
@@ -31,31 +31,45 @@ namespace JSC {
 
 namespace WebCore {
 
+    class ScriptExecutionContext;
     class Event;
 
     class EventListener : public RefCounted<EventListener> {
     public:
+        enum Type { JSEventListenerType, 
+                    ImageEventListenerType, 
+                    InspectorDOMAgentType,
+                    InspectorDOMStorageResourceType,
+                    ObjCEventListenerType, 
+                    ConditionEventListenerType };
+                    
         virtual ~EventListener() { }
-        virtual void handleEvent(Event*, bool isWindowEvent = false) = 0;
+        virtual bool operator==(const EventListener&) = 0;
+        virtual void handleEvent(ScriptExecutionContext*, Event*) = 0;
         // Return true to indicate that the error is handled.
-        virtual bool reportError(const String& /*message*/, const String& /*url*/, int /*lineNumber*/) { return false; }
+        virtual bool reportError(ScriptExecutionContext*, const String& /*message*/, const String& /*url*/, int /*lineNumber*/) { return false; }
         virtual bool wasCreatedFromMarkup() const { return false; }
 
 #if USE(JSC)
-        virtual JSC::JSObject* jsFunction() const { return 0; }
+        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const { return 0; }
         virtual void markJSFunction(JSC::MarkStack&) { }
 #endif
 
         bool isAttribute() const { return virtualisAttribute(); }
+        Type type() const { return m_type; }
+
+    protected:
+        EventListener(Type type)
+            : m_type(type)
+        {
+        }
 
     private:
         virtual bool virtualisAttribute() const { return false; }
+        
+        Type m_type;
     };
 
-#if USE(JSC)
-    inline void markIfNotNull(JSC::MarkStack& markStack, EventListener* listener) { if (listener) listener->markJSFunction(markStack); }
-#endif
-
 }
 
 #endif
diff --git a/WebCore/dom/EventListener.idl b/WebCore/dom/EventListener.idl
index 9dc2e0a..1edf52f 100644
--- a/WebCore/dom/EventListener.idl
+++ b/WebCore/dom/EventListener.idl
@@ -24,8 +24,8 @@ module events {
     interface [
         NoStaticTables,
         ObjCProtocol,
+        PureInterface,
         InterfaceUUID=B04F2AE3-71E2-4ebe-ABFE-EF4938354082,
-        ImplementationUUID=DDFDD342-A78B-4f19-8F32-A5DF51B56E08
     ] EventListener {
         void               handleEvent(in Event evt);
     };
diff --git a/WebCore/dom/EventNames.h b/WebCore/dom/EventNames.h
index d28b154..31c29fb 100644
--- a/WebCore/dom/EventNames.h
+++ b/WebCore/dom/EventNames.h
@@ -32,6 +32,7 @@ namespace WebCore {
     macro(abort) \
     macro(beforecopy) \
     macro(beforecut) \
+    macro(beforeload) \
     macro(beforepaste) \
     macro(beforeunload) \
     macro(blur) \
@@ -45,6 +46,7 @@ namespace WebCore {
     macro(copy) \
     macro(cut) \
     macro(dblclick) \
+    macro(display) \
     macro(downloading) \
     macro(drag) \
     macro(dragend) \
@@ -57,10 +59,12 @@ namespace WebCore {
     macro(focus) \
     macro(hashchange) \
     macro(input) \
+    macro(invalid) \
     macro(keydown) \
     macro(keypress) \
     macro(keyup) \
     macro(load) \
+    macro(loadend) \
     macro(loadstart) \
     macro(message) \
     macro(mousedown) \
@@ -73,7 +77,10 @@ namespace WebCore {
     macro(obsolete) \
     macro(offline) \
     macro(online) \
+    macro(open) \
     macro(overflowchanged) \
+    macro(pagehide) \
+    macro(pageshow) \
     macro(paste) \
     macro(readystatechange) \
     macro(reset) \
@@ -137,6 +144,8 @@ namespace WebCore {
     \
     macro(webkitTransitionEnd) \
     \
+    macro(orientationchange) \
+    \
 // end of DOM_EVENT_NAMES_FOR_EACH
 
     class EventNames {
diff --git a/WebCore/dom/EventTarget.cpp b/WebCore/dom/EventTarget.cpp
index 7ba0584..ceb5221 100644
--- a/WebCore/dom/EventTarget.cpp
+++ b/WebCore/dom/EventTarget.cpp
@@ -34,16 +34,49 @@
 #include "config.h"
 #include "EventTarget.h"
 
+#include "Event.h"
+#include "EventException.h"
+#include <wtf/StdLibExtras.h>
+
+using namespace WTF;
+
 namespace WebCore {
 
 #ifndef NDEBUG
 static int gEventDispatchForbidden = 0;
-#endif
+
+void forbidEventDispatch()
+{
+    if (!isMainThread())
+        return;
+    ++gEventDispatchForbidden;
+}
+
+void allowEventDispatch()
+{
+    if (!isMainThread())
+        return;
+    if (gEventDispatchForbidden > 0)
+        --gEventDispatchForbidden;
+}
+
+bool eventDispatchForbidden()
+{
+    if (!isMainThread())
+        return false;
+    return gEventDispatchForbidden > 0;
+}
+#endif // NDEBUG
 
 EventTarget::~EventTarget()
 {
 }
 
+EventSource* EventTarget::toEventSource()
+{
+    return 0;
+}
+
 Node* EventTarget::toNode()
 {
     return 0;
@@ -78,6 +111,13 @@ SVGElementInstance* EventTarget::toSVGElementInstance()
 }
 #endif
 
+#if ENABLE(WEB_SOCKETS)
+WebSocket* EventTarget::toWebSocket()
+{
+    return 0;
+}
+#endif
+
 MessagePort* EventTarget::toMessagePort()
 {
     return 0;
@@ -106,22 +146,160 @@ SharedWorkerContext* EventTarget::toSharedWorkerContext()
 }
 #endif
 
-#ifndef NDEBUG
-void forbidEventDispatch()
+#if ENABLE(NOTIFICATIONS)
+Notification* EventTarget::toNotification()
 {
-    ++gEventDispatchForbidden;
+    return 0;
 }
+#endif
 
-void allowEventDispatch()
+bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    if (gEventDispatchForbidden > 0)
-        --gEventDispatchForbidden;
+    EventTargetData* d = ensureEventTargetData();
+
+    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, EventListenerVector());
+    EventListenerVector& entry = result.first->second;
+
+    RegisteredEventListener registeredListener(listener, useCapture);
+    if (!result.second) { // pre-existing entry
+        if (entry.find(registeredListener) != notFound) // duplicate listener
+            return false;
+    }
+
+    entry.append(registeredListener);
+    return true;
 }
 
-bool eventDispatchForbidden()
+bool EventTarget::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    return gEventDispatchForbidden > 0;
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return false;
+
+    EventListenerMap::iterator result = d->eventListenerMap.find(eventType);
+    if (result == d->eventListenerMap.end())
+        return false;
+    EventListenerVector& entry = result->second;
+
+    RegisteredEventListener registeredListener(listener, useCapture);
+    size_t index = entry.find(registeredListener);
+    if (index == notFound)
+        return false;
+
+    entry.remove(index);
+    if (!entry.size())
+        d->eventListenerMap.remove(result);
+
+    // Notify firing events planning to invoke the listener at 'index' that
+    // they have one less listener to invoke.
+    for (size_t i = 0; i < d->firingEventEndIterators.size(); ++i) {
+        if (eventType == *d->firingEventEndIterators[i].eventType && index < *d->firingEventEndIterators[i].value)
+            --*d->firingEventEndIterators[i].value;
+    }
+
+    return true;
+}
+
+bool EventTarget::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    clearAttributeEventListener(eventType);
+    if (!listener)
+        return false;
+    return addEventListener(eventType, listener, false);
+}
+
+EventListener* EventTarget::getAttributeEventListener(const AtomicString& eventType)
+{
+    const EventListenerVector& entry = getEventListeners(eventType);
+    for (size_t i = 0; i < entry.size(); ++i) {
+        if (entry[i].listener->isAttribute())
+            return entry[i].listener.get();
+    }
+    return 0;
+}
+
+bool EventTarget::clearAttributeEventListener(const AtomicString& eventType)
+{
+    EventListener* listener = getAttributeEventListener(eventType);
+    if (!listener)
+        return false;
+    return removeEventListener(eventType, listener, false);
+}
+
+bool EventTarget::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
+{
+    if (!event || event->type().isEmpty()) {
+        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
+        return false;
+    }
+    return dispatchEvent(event);
+}
+
+bool EventTarget::dispatchEvent(PassRefPtr<Event> event)
+{
+    event->setTarget(this);
+    event->setCurrentTarget(this);
+    event->setEventPhase(Event::AT_TARGET);
+    return fireEventListeners(event.get());
+}
+
+bool EventTarget::fireEventListeners(Event* event)
+{
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(event && !event->type().isEmpty());
+
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return true;
+
+    EventListenerMap::iterator result = d->eventListenerMap.find(event->type());
+    if (result == d->eventListenerMap.end())
+        return false;
+    EventListenerVector& entry = result->second;
+
+    RefPtr<EventTarget> protect = this;
+
+    size_t end = entry.size();
+    d->firingEventEndIterators.append(FiringEventEndIterator(&event->type(), &end));
+    for (size_t i = 0; i < end; ++i) {
+        RegisteredEventListener& registeredListener = entry[i];
+        if (event->eventPhase() == Event::CAPTURING_PHASE && !registeredListener.useCapture)
+            continue;
+        if (event->eventPhase() == Event::BUBBLING_PHASE && registeredListener.useCapture)
+            continue;
+        // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
+        // event listeners, even though that violates some versions of the DOM spec.
+        registeredListener.listener->handleEvent(scriptExecutionContext(), event);
+    }
+    d->firingEventEndIterators.removeLast();
+
+    return !event->defaultPrevented();
+}
+
+const EventListenerVector& EventTarget::getEventListeners(const AtomicString& eventType)
+{
+    DEFINE_STATIC_LOCAL(EventListenerVector, emptyVector, ());
+
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return emptyVector;
+    EventListenerMap::iterator it = d->eventListenerMap.find(eventType);
+    if (it == d->eventListenerMap.end())
+        return emptyVector;
+    return it->second;
+}
+
+void EventTarget::removeAllEventListeners()
+{
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return;
+    d->eventListenerMap.clear();
+
+    // Notify firing events planning to invoke the listener at 'index' that
+    // they have one less listener to invoke.
+    for (size_t i = 0; i < d->firingEventEndIterators.size(); ++i)
+        *d->firingEventEndIterators[i].value = 0;
 }
-#endif // NDEBUG
 
-} // end namespace
+} // namespace WebCore
diff --git a/WebCore/dom/EventTarget.h b/WebCore/dom/EventTarget.h
index 2ededda..2d612e1 100644
--- a/WebCore/dom/EventTarget.h
+++ b/WebCore/dom/EventTarget.h
@@ -32,6 +32,9 @@
 #ifndef EventTarget_h
 #define EventTarget_h
 
+#include "AtomicStringHash.h"
+#include "EventNames.h"
+#include "RegisteredEventListener.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -43,20 +46,47 @@ namespace WebCore {
     class DOMWindow;
     class Event;
     class EventListener;
+    class EventSource;
     class MessagePort;
     class Node;
+    class Notification;
     class SVGElementInstance;
     class ScriptExecutionContext;
     class SharedWorker;
     class SharedWorkerContext;
+    class WebSocket;
     class Worker;
     class XMLHttpRequest;
     class XMLHttpRequestUpload;
 
     typedef int ExceptionCode;
 
+    struct FiringEventEndIterator {
+        FiringEventEndIterator(const AtomicString* eventType, size_t* value)
+            : eventType(eventType)
+            , value(value)
+        {
+        }
+        
+        const AtomicString* eventType;
+        size_t* value;
+    };
+    typedef Vector<FiringEventEndIterator, 1> FiringEventEndIteratorVector;
+
+    typedef Vector<RegisteredEventListener, 1> EventListenerVector;
+    typedef HashMap<AtomicString, EventListenerVector> EventListenerMap;
+
+    struct EventTargetData {
+        EventListenerMap eventListenerMap;
+        FiringEventEndIteratorVector firingEventEndIterators;
+    };
+
     class EventTarget {
     public:
+        void ref() { refEventTarget(); }
+        void deref() { derefEventTarget(); }
+
+        virtual EventSource* toEventSource();
         virtual MessagePort* toMessagePort();
         virtual Node* toNode();
         virtual DOMWindow* toDOMWindow();
@@ -72,44 +102,132 @@ namespace WebCore {
         virtual Worker* toWorker();
         virtual DedicatedWorkerContext* toDedicatedWorkerContext();
 #endif
-
 #if ENABLE(SHARED_WORKERS)
         virtual SharedWorker* toSharedWorker();
         virtual SharedWorkerContext* toSharedWorkerContext();
 #endif
+#if ENABLE(WEB_SOCKETS)
+        virtual WebSocket* toWebSocket();
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+        virtual Notification* toNotification();
+#endif
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture) = 0;
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture) = 0;
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&) = 0;
+        virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual void removeAllEventListeners();
+        virtual bool dispatchEvent(PassRefPtr<Event>);
+        bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&); // DOM API
 
-        void ref() { refEventTarget(); }
-        void deref() { derefEventTarget(); }
+        // Used for legacy "onEvent" attribute APIs.
+        bool setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+        bool clearAttributeEventListener(const AtomicString& eventType);
+        EventListener* getAttributeEventListener(const AtomicString& eventType);
 
-        // Handlers to do/undo actions on the target node before an event is dispatched to it and after the event
-        // has been dispatched.  The data pointer is handed back by the preDispatch and passed to postDispatch.
-        virtual void* preDispatchEventHandler(Event*) { return 0; }
-        virtual void postDispatchEventHandler(Event*, void* /*dataFromPreDispatch*/) { }
+        bool hasEventListeners();
+        bool hasEventListeners(const AtomicString& eventType);
+        const EventListenerVector& getEventListeners(const AtomicString& eventType);
+
+        bool fireEventListeners(Event*);
+        bool isFiringEventListeners();
+
+#if USE(JSC)
+        void markEventListeners(JSC::MarkStack&);
+        void invalidateEventListeners();
+#endif
 
     protected:
         virtual ~EventTarget();
+        
+        virtual EventTargetData* eventTargetData() = 0;
+        virtual EventTargetData* ensureEventTargetData() = 0;
 
     private:
         virtual void refEventTarget() = 0;
         virtual void derefEventTarget() = 0;
     };
 
-    void forbidEventDispatch();
-    void allowEventDispatch();
+    #define DEFINE_ATTRIBUTE_EVENT_LISTENER(attribute) \
+        EventListener* on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+
+    #define DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(attribute) \
+        virtual EventListener* on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
+        virtual void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+
+    #define DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(attribute) \
+        EventListener* on##attribute() { return document()->getWindowAttributeEventListener(eventNames().attribute##Event); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { document()->setWindowAttributeEventListener(eventNames().attribute##Event, listener); } \
+
+    #define DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(attribute, eventName) \
+        EventListener* on##attribute() { return getAttributeEventListener(eventNames().eventName##Event); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().eventName##Event, listener); } \
+
+    #define DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(recipient, attribute) \
+        EventListener* on##attribute() { return recipient ? recipient->getAttributeEventListener(eventNames().attribute##Event) : 0; } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { if (recipient) recipient->setAttributeEventListener(eventNames().attribute##Event, listener); } \
 
 #ifndef NDEBUG
+    void forbidEventDispatch();
+    void allowEventDispatch();
     bool eventDispatchForbidden();
 #else
     inline void forbidEventDispatch() { }
     inline void allowEventDispatch() { }
 #endif
 
-}
-
+#if USE(JSC)
+    inline void EventTarget::markEventListeners(JSC::MarkStack& markStack)
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return;
+
+        EventListenerMap::iterator end = d->eventListenerMap.end();
+        for (EventListenerMap::iterator it = d->eventListenerMap.begin(); it != end; ++it) {
+            EventListenerVector& entry = it->second;
+            for (size_t i = 0; i < entry.size(); ++i)
+                entry[i].listener->markJSFunction(markStack);
+        }
+    }
+
+    inline void EventTarget::invalidateEventListeners()
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return;
+
+        d->eventListenerMap.clear();
+    }
 #endif
+
+    inline bool EventTarget::isFiringEventListeners()
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return false;
+        return d->firingEventEndIterators.size() != 0;
+    }
+
+    inline bool EventTarget::hasEventListeners()
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return false;
+        return !d->eventListenerMap.isEmpty();
+    }
+
+    inline bool EventTarget::hasEventListeners(const AtomicString& eventType)
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return false;
+        return d->eventListenerMap.contains(eventType);
+    }
+
+} // namespace WebCore
+
+#endif // EventTarget_h
diff --git a/WebCore/dom/InputElement.cpp b/WebCore/dom/InputElement.cpp
index 0e2456d..c29cb1c 100644
--- a/WebCore/dom/InputElement.cpp
+++ b/WebCore/dom/InputElement.cpp
@@ -34,7 +34,6 @@
 #include "RenderTextControlSingleLine.h"
 #include "SelectionController.h"
 #include "TextIterator.h"
-#include "TextBreakIterator.h"
 
 #if ENABLE(WML)
 #include "WMLInputElement.h"
@@ -46,25 +45,23 @@ namespace WebCore {
 using namespace HTMLNames;
 
 // FIXME: According to HTML4, the length attribute's value can be arbitrarily
-// large. However, due to http://bugs.webkit.org/show_bugs.cgi?id=14536 things
+// large. However, due to https://bugs.webkit.org/show_bug.cgi?id=14536 things
 // get rather sluggish when a text field has a larger number of characters than
 // this, even when just clicking in the text field.
 const int InputElement::s_maximumLength = 524288;
 const int InputElement::s_defaultSize = 20;
 
-void InputElement::dispatchFocusEvent(InputElementData& data, InputElement* inputElement, Element* element)
+void InputElement::dispatchFocusEvent(InputElement* inputElement, Element* element)
 {
     if (!inputElement->isTextField())
         return;
 
-    updatePlaceholderVisibility(data, inputElement, element);
-
     Document* document = element->document();
     if (inputElement->isPasswordField() && document->frame())
         document->setUseSecureKeyboardEntryWhenActive(true);
 }
 
-void InputElement::dispatchBlurEvent(InputElementData& data, InputElement* inputElement, Element* element)
+void InputElement::dispatchBlurEvent(InputElement* inputElement, Element* element)
 {
     if (!inputElement->isTextField())
         return;
@@ -74,28 +71,12 @@ void InputElement::dispatchBlurEvent(InputElementData& data, InputElement* input
     if (!frame)
         return;
 
-    updatePlaceholderVisibility(data, inputElement, element);
-
     if (inputElement->isPasswordField())
         document->setUseSecureKeyboardEntryWhenActive(false);
 
     frame->textFieldDidEndEditing(element);
 }
 
-void InputElement::updatePlaceholderVisibility(InputElementData& data, InputElement* inputElement, Element* element, bool placeholderValueChanged)
-{
-    ASSERT(inputElement->isTextField());
-    Document* document = element->document();
-
-    bool oldPlaceholderShouldBeVisible = data.placeholderShouldBeVisible();
-    data.setPlaceholderShouldBeVisible(inputElement->value().isEmpty() 
-                                       && document->focusedNode() != element
-                                       && !inputElement->placeholder().isEmpty());
-
-    if ((oldPlaceholderShouldBeVisible != data.placeholderShouldBeVisible() || placeholderValueChanged) && element->renderer())
-        toRenderTextControlSingleLine(element->renderer())->updatePlaceholderVisibility();
-}
-
 void InputElement::updateFocusAppearance(InputElementData& data, InputElement* inputElement, Element* element, bool restorePreviousSelection)
 {
     ASSERT(inputElement->isTextField());
@@ -137,11 +118,8 @@ void InputElement::aboutToUnload(InputElement* inputElement, Element* element)
 
 void InputElement::setValueFromRenderer(InputElementData& data, InputElement* inputElement, Element* element, const String& value)
 {
-    // Renderer and our event handler are responsible for constraining values.
-    ASSERT(value == inputElement->constrainValue(value) || inputElement->constrainValue(value).isEmpty());
-
-    if (inputElement->isTextField())
-        updatePlaceholderVisibility(data, inputElement, element);
+    // Renderer and our event handler are responsible for sanitizing values.
+    ASSERT_UNUSED(inputElement, value == inputElement->sanitizeValue(value) || inputElement->sanitizeValue(value).isEmpty());
 
     // Workaround for bug where trailing \n is included in the result of textContent.
     // The assert macro above may also be simplified to:  value == constrainValue(value)
@@ -153,84 +131,58 @@ void InputElement::setValueFromRenderer(InputElementData& data, InputElement* in
 
     element->setFormControlValueMatchesRenderer(true);
 
-    // Fire the "input" DOM event
-    element->dispatchEvent(eventNames().inputEvent, true, false);
+    element->dispatchEvent(Event::create(eventNames().inputEvent, true, false));
     notifyFormStateChanged(element);
 }
 
-static int numCharactersInGraphemeClusters(StringImpl* s, int numGraphemeClusters)
+String InputElement::sanitizeValue(const InputElement* inputElement, const String& proposedValue)
 {
-    if (!s)
-        return 0;
-
-    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
-    if (!it)
-        return 0;
-
-    for (int i = 0; i < numGraphemeClusters; ++i) {
-        if (textBreakNext(it) == TextBreakDone)
-            return s->length();
-    }
-
-    return textBreakCurrent(it);
+    return InputElement::sanitizeUserInputValue(inputElement, proposedValue, s_maximumLength);
 }
 
-String InputElement::constrainValue(const InputElement* inputElement, const String& proposedValue, int maxLength)
+String InputElement::sanitizeUserInputValue(const InputElement* inputElement, const String& proposedValue, int maxLength)
 {
-    String string = proposedValue;
     if (!inputElement->isTextField())
-        return string;
+        return proposedValue;
 
+    String string = proposedValue;
     string.replace("\r\n", " ");
     string.replace('\r', ' ');
     string.replace('\n', ' ');
-    
-    StringImpl* s = string.impl();
-    int newLength = numCharactersInGraphemeClusters(s, maxLength);
-    for (int i = 0; i < newLength; ++i) {
-        const UChar& current = (*s)[i];
+
+    unsigned newLength = string.numCharactersInGraphemeClusters(maxLength);
+    for (unsigned i = 0; i < newLength; ++i) {
+        const UChar current = string[i];
         if (current < ' ' && current != '\t') {
             newLength = i;
             break;
         }
     }
-
-    if (newLength < static_cast<int>(string.length()))
-        return string.left(newLength);
-
-    return string;
-}
-
-static int numGraphemeClusters(StringImpl* s)
-{
-    if (!s)
-        return 0;
-
-    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
-    if (!it)
-        return 0;
-
-    int num = 0;
-    while (textBreakNext(it) != TextBreakDone)
-        ++num;
-
-    return num;
+    return string.left(newLength);
 }
 
-void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputElement* inputElement, Document* document, Event* event)
+void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputElement* inputElement, Element* element, Event* event)
 {
     ASSERT(event->isBeforeTextInsertedEvent());
-
     // Make sure that the text to be inserted will not violate the maxLength.
-    int oldLength = numGraphemeClusters(inputElement->value().impl());
-    ASSERT(oldLength <= data.maxLength());
-    int selectionLength = numGraphemeClusters(plainText(document->frame()->selection()->selection().toNormalizedRange().get()).impl());
+
+    // We use RenderTextControlSingleLine::text() instead of InputElement::value()
+    // because they can be mismatched by sanitizeValue() in
+    // RenderTextControlSingleLine::subtreeHasChanged() in some cases.
+    unsigned oldLength = toRenderTextControlSingleLine(element->renderer())->text().numGraphemeClusters();
+
+    // selection() may be a pre-edit text.
+    unsigned selectionLength = plainText(element->document()->frame()->selection()->selection().toNormalizedRange().get()).numGraphemeClusters();
     ASSERT(oldLength >= selectionLength);
-    int maxNewLength = data.maxLength() - (oldLength - selectionLength);
+
+    // Selected characters will be removed by the next text event.
+    unsigned baseLength = oldLength - selectionLength;
+    unsigned maxLength = static_cast<unsigned>(data.maxLength()); // maxLength() can never be negative.
+    unsigned appendableLength = maxLength > baseLength ? maxLength - baseLength : 0;
 
     // Truncate the inserted text to avoid violating the maxLength and other constraints.
     BeforeTextInsertedEvent* textEvent = static_cast<BeforeTextInsertedEvent*>(event);
-    textEvent->setText(constrainValue(inputElement, textEvent->text(), maxNewLength));
+    textEvent->setText(sanitizeUserInputValue(inputElement, textEvent->text(), appendableLength));
 }
 
 void InputElement::parseSizeAttribute(InputElementData& data, Element* element, MappedAttribute* attribute)
@@ -259,7 +211,7 @@ void InputElement::parseMaxLengthAttribute(InputElementData& data, InputElement*
 void InputElement::updateValueIfNeeded(InputElementData& data, InputElement* inputElement)
 {
     String oldValue = data.value();
-    String newValue = inputElement->constrainValue(oldValue);
+    String newValue = sanitizeValue(inputElement, oldValue);
     if (newValue != oldValue)
         inputElement->setValue(newValue);
 }
@@ -277,8 +229,7 @@ void InputElement::notifyFormStateChanged(Element* element)
 
 // InputElementData
 InputElementData::InputElementData()
-    : m_placeholderShouldBeVisible(false)
-    , m_size(InputElement::s_defaultSize)
+    : m_size(InputElement::s_defaultSize)
     , m_maxLength(InputElement::s_maximumLength)
     , m_cachedSelectionStart(-1)
     , m_cachedSelectionEnd(-1)
diff --git a/WebCore/dom/InputElement.h b/WebCore/dom/InputElement.h
index 7ad3cbd..e0e7110 100644
--- a/WebCore/dom/InputElement.h
+++ b/WebCore/dom/InputElement.h
@@ -44,17 +44,13 @@ public:
     virtual bool isSearchField() const = 0;
     virtual bool isTextField() const = 0;
 
-    virtual bool placeholderShouldBeVisible() const = 0;
     virtual bool searchEventsShouldBeDispatched() const = 0;
 
     virtual int size() const = 0;
     virtual String value() const = 0;
     virtual void setValue(const String&) = 0;
 
-    virtual String placeholder() const = 0;
-    virtual void setPlaceholder(const String&) = 0;
-
-    virtual String constrainValue(const String&) const = 0;
+    virtual String sanitizeValue(const String&) const = 0;
     virtual void setValueFromRenderer(const String&) = 0;
 
     virtual void cacheSelection(int start, int end) = 0;
@@ -64,15 +60,19 @@ public:
     static const int s_defaultSize;
 
 protected:
-    static void dispatchFocusEvent(InputElementData&, InputElement*, Element*);
-    static void dispatchBlurEvent(InputElementData&, InputElement*, Element*);
-    static void updatePlaceholderVisibility(InputElementData&, InputElement*, Element*, bool placeholderValueChanged = false);
+    static void dispatchFocusEvent(InputElement*, Element*);
+    static void dispatchBlurEvent(InputElement*, Element*);
     static void updateFocusAppearance(InputElementData&, InputElement*, Element*, bool restorePreviousSelection);
     static void updateSelectionRange(InputElement*, Element*, int start, int end);
     static void aboutToUnload(InputElement*, Element*);
     static void setValueFromRenderer(InputElementData&, InputElement*, Element*, const String&);
-    static String constrainValue(const InputElement*, const String& proposedValue, int maxLength);
-    static void handleBeforeTextInsertedEvent(InputElementData&, InputElement*, Document*, Event*);
+    // Replaces CRs and LFs, shrinks the value for s_maximumLength.
+    // This should be applied to values from the HTML value attribute and the DOM value property.
+    static String sanitizeValue(const InputElement*, const String&);
+    // Replaces CRs and LFs, shrinks the value for the specified maximum length.
+    // This should be applied to values specified by users.
+    static String sanitizeUserInputValue(const InputElement*, const String&, int);
+    static void handleBeforeTextInsertedEvent(InputElementData&, InputElement*, Element*, Event*);
     static void parseSizeAttribute(InputElementData&, Element*, MappedAttribute*);
     static void parseMaxLengthAttribute(InputElementData&, InputElement*, Element*, MappedAttribute*);
     static void updateValueIfNeeded(InputElementData&, InputElement*);
@@ -85,9 +85,6 @@ class InputElementData {
 public:
     InputElementData();
 
-    bool placeholderShouldBeVisible() const { return m_placeholderShouldBeVisible; }
-    void setPlaceholderShouldBeVisible(bool visible) { m_placeholderShouldBeVisible = visible; }
-
     const AtomicString& name() const;
     void setName(const AtomicString& value) { m_name = value; }
 
@@ -107,7 +104,6 @@ public:
     void setCachedSelectionEnd(int value) { m_cachedSelectionEnd = value; }
 
 private:
-    bool m_placeholderShouldBeVisible;
     AtomicString m_name;
     String m_value;
     int m_size;
diff --git a/WebCore/dom/MessageEvent.cpp b/WebCore/dom/MessageEvent.cpp
index a0af32d..3c84642 100644
--- a/WebCore/dom/MessageEvent.cpp
+++ b/WebCore/dom/MessageEvent.cpp
@@ -34,16 +34,17 @@
 namespace WebCore {
 
 MessageEvent::MessageEvent()
+    : m_data(SerializedScriptValue::create())
 {
 }
 
-MessageEvent::MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassRefPtr<MessagePort> messagePort)
-    : Event(eventNames().messageEvent, false, true)
+MessageEvent::MessageEvent(PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray> ports)
+    : Event(eventNames().messageEvent, false, false)
     , m_data(data)
     , m_origin(origin)
     , m_lastEventId(lastEventId)
     , m_source(source)
-    , m_messagePort(messagePort)
+    , m_ports(ports)
 {
 }
 
@@ -51,7 +52,7 @@ MessageEvent::~MessageEvent()
 {
 }
 
-void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort* messagePort)
+void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray> ports)
 {
     if (dispatched())
         return;
@@ -62,7 +63,26 @@ void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bo
     m_origin = origin;
     m_lastEventId = lastEventId;
     m_source = source;
-    m_messagePort = messagePort;
+    m_ports = ports;
+}
+
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+MessagePort* MessageEvent::messagePort()
+{
+    if (!m_ports)
+        return 0;
+    ASSERT(m_ports->size() == 1);
+    return (*m_ports)[0].get();
+}
+
+void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort* port)
+{
+    MessagePortArray* ports = 0;
+    if (port) {
+        ports = new MessagePortArray();
+        ports->append(port);
+    }
+    initMessageEvent(type, canBubble, cancelable, data, origin, lastEventId, source, ports);
 }
 
 bool MessageEvent::isMessageEvent() const 
diff --git a/WebCore/dom/MessageEvent.h b/WebCore/dom/MessageEvent.h
index 87a6745..b7f9b02 100644
--- a/WebCore/dom/MessageEvent.h
+++ b/WebCore/dom/MessageEvent.h
@@ -28,8 +28,10 @@
 #ifndef MessageEvent_h
 #define MessageEvent_h
 
+#include "DOMWindow.h"
 #include "Event.h"
 #include "MessagePort.h"
+#include "SerializedScriptValue.h"
 
 namespace WebCore {
 
@@ -41,31 +43,36 @@ namespace WebCore {
         {
             return adoptRef(new MessageEvent);
         }
-        static PassRefPtr<MessageEvent> create(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassRefPtr<MessagePort> messagePort)
+        static PassRefPtr<MessageEvent> create(PassOwnPtr<MessagePortArray> ports, PassRefPtr<SerializedScriptValue> data = 0, const String& origin = "", const String& lastEventId = "", PassRefPtr<DOMWindow> source = 0)
         {
-            return adoptRef(new MessageEvent(data, origin, lastEventId, source, messagePort));
+            return adoptRef(new MessageEvent(data, origin, lastEventId, source, ports));
         }
         virtual ~MessageEvent();
 
-        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort*);
-        
-        const String& data() const { return m_data; }
+        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray>);
+
+        SerializedScriptValue* data() const { return m_data.get(); }
         const String& origin() const { return m_origin; }
         const String& lastEventId() const { return m_lastEventId; }
         DOMWindow* source() const { return m_source.get(); }
-        MessagePort* messagePort() const { return m_messagePort.get(); }
-        
+        MessagePortArray* ports() const { return m_ports.get(); }
+
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        MessagePort* messagePort();
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort*);
+
         virtual bool isMessageEvent() const;
 
-    private:    
+    private:
         MessageEvent();
-        MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassRefPtr<MessagePort> messagePort);
+        MessageEvent(PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray>);
 
-        String m_data;
+        RefPtr<SerializedScriptValue> m_data;
         String m_origin;
         String m_lastEventId;
         RefPtr<DOMWindow> m_source;
-        RefPtr<MessagePort> m_messagePort;
+        OwnPtr<MessagePortArray> m_ports;
     };
 
 } // namespace WebCore
diff --git a/WebCore/dom/MessageEvent.idl b/WebCore/dom/MessageEvent.idl
index 8e8f271..7e497fc 100644
--- a/WebCore/dom/MessageEvent.idl
+++ b/WebCore/dom/MessageEvent.idl
@@ -30,14 +30,21 @@ module events {
         GenerateConstructor,
         NoStaticTables
     ] MessageEvent : Event {
+        readonly attribute SerializedScriptValue data;
 
-        readonly attribute DOMString data;
         readonly attribute DOMString origin;
         readonly attribute DOMString lastEventId;
         readonly attribute DOMWindow source;
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        readonly attribute [CustomGetter] Array ports;
+
+        [Custom] void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in SerializedScriptValue dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in Array messagePorts);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just expose a single port.
         readonly attribute MessagePort messagePort;
-        
-        void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in MessagePort messagePort);
+
+        void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in SerializedScriptValue dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in MessagePort messagePort);
+#endif
 
     };
 
diff --git a/WebCore/dom/MessagePort.cpp b/WebCore/dom/MessagePort.cpp
index 9f3e4d2..9f6e649 100644
--- a/WebCore/dom/MessagePort.cpp
+++ b/WebCore/dom/MessagePort.cpp
@@ -55,28 +55,41 @@ MessagePort::~MessagePort()
         m_scriptExecutionContext->destroyedMessagePort(this);
 }
 
-void MessagePort::postMessage(const String& message, ExceptionCode& ec)
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
-    postMessage(message, 0, ec);
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, ec);
 }
 
-void MessagePort::postMessage(const String& message, MessagePort* dataPort, ExceptionCode& ec)
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
+{
+    postMessage(message, static_cast<MessagePortArray*>(0), ec);
+}
+
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     if (!m_entangledChannel)
         return;
     ASSERT(m_scriptExecutionContext);
 
-    OwnPtr<MessagePortChannel> channel;
-    if (dataPort) {
-        if (dataPort == this || m_entangledChannel->isConnectedTo(dataPort)) {
-            ec = INVALID_STATE_ERR;
-            return;
+    OwnPtr<MessagePortChannelArray> channels;
+    // Make sure we aren't connected to any of the passed-in ports.
+    if (ports) {
+        for (unsigned int i = 0; i < ports->size(); ++i) {
+            MessagePort* dataPort = (*ports)[i].get();
+            if (dataPort == this || m_entangledChannel->isConnectedTo(dataPort)) {
+                ec = INVALID_STATE_ERR;
+                return;
+            }
         }
-        channel = dataPort->disentangle(ec);
+        channels = MessagePort::disentanglePorts(ports, ec);
         if (ec)
             return;
     }
-    m_entangledChannel->postMessageToRemote(MessagePortChannel::EventData::create(message, channel.release()));
+    m_entangledChannel->postMessageToRemote(MessagePortChannel::EventData::create(message, channels.release()));
 }
 
 PassOwnPtr<MessagePortChannel> MessagePort::disentangle(ExceptionCode& ec)
@@ -155,20 +168,8 @@ void MessagePort::dispatchMessages()
 
     OwnPtr<MessagePortChannel::EventData> eventData;
     while (m_entangledChannel && m_entangledChannel->tryGetMessageFromRemote(eventData)) {
-        RefPtr<MessagePort> port;
-        OwnPtr<MessagePortChannel> channel = eventData->channel();
-        if (channel) {
-            // The remote side sent over a MessagePortChannel, so create a MessagePort to wrap it.
-            port = MessagePort::create(*m_scriptExecutionContext);
-            port->entangle(channel.release());
-        }
-        RefPtr<Event> evt = MessageEvent::create(eventData->message(), "", "", 0, port.release());
-
-        if (m_onMessageListener) {
-            evt->setTarget(this);
-            evt->setCurrentTarget(this);
-            m_onMessageListener->handleEvent(evt.get(), false);
-        }
+        OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*m_scriptExecutionContext, eventData->channels());
+        RefPtr<Event> evt = MessageEvent::create(ports.release(), eventData->message());
 
         ExceptionCode ec = 0;
         dispatchEvent(evt.release(), ec);
@@ -176,73 +177,68 @@ void MessagePort::dispatchMessages()
     }
 }
 
-void MessagePort::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
+bool MessagePort::hasPendingActivity()
 {
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
-                return;
-        }
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }    
+    // The spec says that entangled message ports should always be treated as if they have a strong reference.
+    // We'll also stipulate that the queue needs to be open (if the app drops its reference to the port before start()-ing it, then it's not really entangled as it's unreachable).
+    return m_started && m_entangledChannel && m_entangledChannel->hasPendingActivity();
 }
 
-void MessagePort::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
+MessagePort* MessagePort::locallyEntangledPort()
 {
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-    
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
+    return m_entangledChannel ? m_entangledChannel->locallyEntangledPort(m_scriptExecutionContext) : 0;
 }
 
-bool MessagePort::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
+PassOwnPtr<MessagePortChannelArray> MessagePort::disentanglePorts(const MessagePortArray* ports, ExceptionCode& ec)
 {
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
+    if (!ports || !ports->size())
+        return 0;
+
+    // HashSet used to efficiently check for duplicates in the passed-in array.
+    HashSet<MessagePort*> portSet;
+
+    // Walk the incoming array - if there are any duplicate ports, or null ports or cloned ports, throw an error (per section 8.3.3 of the HTML5 spec).
+    for (unsigned int i = 0; i < ports->size(); ++i) {
+        MessagePort* port = (*ports)[i].get();
+        if (!port || !port->isEntangled() || portSet.contains(port)) {
+            ec = INVALID_STATE_ERR;
+            return 0;
+        }
+        portSet.add(port);
     }
-    
-    ListenerVector listenersCopy = m_eventListeners.get(event->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(event.get(), false);
+
+    // Passed-in ports passed validity checks, so we can disentangle them.
+    MessagePortChannelArray* portArray = new MessagePortChannelArray(ports->size());
+    for (unsigned int i = 0 ; i < ports->size() ; ++i) {
+        OwnPtr<MessagePortChannel> channel = (*ports)[i]->disentangle(ec);
+        ASSERT(!ec); // Can't generate exception here if passed above checks.
+        (*portArray)[i] = channel.release();
     }
-    
-    return !event->defaultPrevented();
+    return portArray;
 }
 
-void MessagePort::setOnmessage(PassRefPtr<EventListener> eventListener)
+PassOwnPtr<MessagePortArray> MessagePort::entanglePorts(ScriptExecutionContext& context, PassOwnPtr<MessagePortChannelArray> channels)
 {
-    m_onMessageListener = eventListener;
-    start();
+    if (!channels || !channels->size())
+        return 0;
+
+    MessagePortArray* portArray = new MessagePortArray(channels->size());
+    for (unsigned int i = 0; i < channels->size(); ++i) {
+        RefPtr<MessagePort> port = MessagePort::create(context);
+        port->entangle((*channels)[i].release());
+        (*portArray)[i] = port.release();
+    }
+    return portArray;
 }
 
-bool MessagePort::hasPendingActivity()
+EventTargetData* MessagePort::eventTargetData()
 {
-    // The spec says that entangled message ports should always be treated as if they have a strong reference.
-    // We'll also stipulate that the queue needs to be open (if the app drops its reference to the port before start()-ing it, then it's not really entangled as it's unreachable).
-    return m_started && m_entangledChannel && m_entangledChannel->hasPendingActivity();
+    return &m_eventTargetData;
 }
 
-MessagePort* MessagePort::locallyEntangledPort()
+EventTargetData* MessagePort::ensureEventTargetData()
 {
-    return m_entangledChannel ? m_entangledChannel->locallyEntangledPort(m_scriptExecutionContext) : 0;
+    return &m_eventTargetData;
 }
 
 } // namespace WebCore
diff --git a/WebCore/dom/MessagePort.h b/WebCore/dom/MessagePort.h
index f416b9b..0ab0f50 100644
--- a/WebCore/dom/MessagePort.h
+++ b/WebCore/dom/MessagePort.h
@@ -29,9 +29,9 @@
 
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include "MessagePortChannel.h"
-
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -44,22 +44,38 @@ namespace WebCore {
     class AtomicStringImpl;
     class Event;
     class Frame;
+    class MessagePort;
     class ScriptExecutionContext;
     class String;
 
+    // The overwhelmingly common case is sending a single port, so handle that efficiently with an inline buffer of size 1.
+    typedef Vector<RefPtr<MessagePort>, 1> MessagePortArray;
+
     class MessagePort : public RefCounted<MessagePort>, public EventTarget {
     public:
         static PassRefPtr<MessagePort> create(ScriptExecutionContext& scriptExecutionContext) { return adoptRef(new MessagePort(scriptExecutionContext)); }
         ~MessagePort();
 
-        void postMessage(const String& message, ExceptionCode&);
-        void postMessage(const String& message, MessagePort*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, ExceptionCode&);
+
         void start();
         void close();
 
         void entangle(PassOwnPtr<MessagePortChannel>);
         PassOwnPtr<MessagePortChannel> disentangle(ExceptionCode&);
 
+        // Disentangle an array of ports, returning the entangled channels.
+        // Per section 8.3.3 of the HTML5 spec, generates an INVALID_STATE_ERR exception if any of the passed ports are null or not entangled.
+        // Returns 0 if there is an exception, or if the passed-in array is 0/empty.
+        static PassOwnPtr<MessagePortChannelArray> disentanglePorts(const MessagePortArray*, ExceptionCode&);
+
+        // Entangles an array of channels, returning an array of MessagePorts in matching order.
+        // Returns 0 if the passed array is 0/empty.
+        static PassOwnPtr<MessagePortArray> entanglePorts(ScriptExecutionContext&, PassOwnPtr<MessagePortChannelArray>);
+
         void messageAvailable();
         bool started() const { return m_started; }
 
@@ -71,21 +87,17 @@ namespace WebCore {
 
         void dispatchMessages();
 
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-
-        typedef Vector<RefPtr<EventListener> > ListenerVector;
-        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-        EventListenersMap& eventListeners() { return m_eventListeners; }
-
         using RefCounted<MessagePort>::ref;
         using RefCounted<MessagePort>::deref;
 
         bool hasPendingActivity();
 
-        void setOnmessage(PassRefPtr<EventListener>);
-        EventListener* onmessage() const { return m_onMessageListener.get(); }
+        void setOnmessage(PassRefPtr<EventListener> listener)
+        {
+            setAttributeEventListener(eventNames().messageEvent, listener);
+            start();
+        }
+        EventListener* onmessage() { return getAttributeEventListener(eventNames().messageEvent); }
 
         // Returns null if there is no entangled port, or if the entangled port is run by a different thread.
         // Returns null otherwise.
@@ -98,16 +110,15 @@ namespace WebCore {
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         OwnPtr<MessagePortChannel> m_entangledChannel;
 
         bool m_started;
 
         ScriptExecutionContext* m_scriptExecutionContext;
-
-        RefPtr<EventListener> m_onMessageListener;
-
-        EventListenersMap m_eventListeners;
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/WebCore/dom/MessagePort.idl b/WebCore/dom/MessagePort.idl
index e5f9ad1..a9149ec 100644
--- a/WebCore/dom/MessagePort.idl
+++ b/WebCore/dom/MessagePort.idl
@@ -28,13 +28,14 @@ module events {
 
     interface [
         CustomMarkFunction,
+        EventTarget,
         GenerateConstructor,
         NoStaticTables
     ] MessagePort {
 // We need to have something as an ObjC binding, because MessagePort is used in MessageEvent, which already has one,
 // but we don't want to actually expose the API while it is in flux.
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
+        [Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts)
             raises(DOMException);
         void start();
         void close();
diff --git a/WebCore/dom/MessagePortChannel.cpp b/WebCore/dom/MessagePortChannel.cpp
index 05134c0..e1a3ac6 100644
--- a/WebCore/dom/MessagePortChannel.cpp
+++ b/WebCore/dom/MessagePortChannel.cpp
@@ -33,14 +33,14 @@
 namespace WebCore {
 
 
-PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(const String& message, PassOwnPtr<MessagePortChannel> channel)
+PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
-    return new EventData(message, channel);
+    return new EventData(message, channels);
 }
 
-MessagePortChannel::EventData::EventData(const String& message, PassOwnPtr<MessagePortChannel> channel)
-    : m_message(message.copy())
-    , m_channel(channel)
+MessagePortChannel::EventData::EventData(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+    : m_message(message->release())
+    , m_channels(channels)
 {
 }
 
diff --git a/WebCore/dom/MessagePortChannel.h b/WebCore/dom/MessagePortChannel.h
index 93b224b..2321b1f 100644
--- a/WebCore/dom/MessagePortChannel.h
+++ b/WebCore/dom/MessagePortChannel.h
@@ -33,6 +33,8 @@
 
 #include "PlatformString.h"
 
+#include "SerializedScriptValue.h"
+
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -42,10 +44,15 @@
 namespace WebCore {
 
     class MessagePort;
+    class MessagePortChannel;
     class PlatformMessagePortChannel;
     class ScriptExecutionContext;
+    class SerializedScriptValue;
     class String;
 
+    // The overwhelmingly common case is sending a single port, so handle that efficiently with an inline buffer of size 1.
+    typedef Vector<OwnPtr<MessagePortChannel>, 1> MessagePortChannelArray;
+
     // MessagePortChannel is a platform-independent interface to the remote side of a message channel.
     // It acts as a wrapper around the platform-dependent PlatformMessagePortChannel implementation which ensures that the platform-dependent close() method is invoked before destruction.
     class MessagePortChannel : public Noncopyable {
@@ -73,15 +80,15 @@ namespace WebCore {
 
         class EventData {
         public:
-            static PassOwnPtr<EventData> create(const String&, PassOwnPtr<MessagePortChannel>);
+            static PassOwnPtr<EventData> create(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
 
-            const String& message() { return m_message; }
-            PassOwnPtr<MessagePortChannel> channel() { return m_channel.release(); }
+            SerializedScriptValue* message() { return m_message.get(); }
+            PassOwnPtr<MessagePortChannelArray> channels() { return m_channels.release(); }
 
         private:
-            EventData(const String& message, PassOwnPtr<MessagePortChannel>);
-            String m_message;
-            OwnPtr<MessagePortChannel> m_channel;
+            EventData(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray>);
+            RefPtr<SerializedScriptValue> m_message;
+            OwnPtr<MessagePortChannelArray> m_channels;
         };
 
         // Sends a message and optional cloned port to the remote port.
diff --git a/WebCore/dom/MutationEvent.h b/WebCore/dom/MutationEvent.h
index c5f2d1d..29b978c 100644
--- a/WebCore/dom/MutationEvent.h
+++ b/WebCore/dom/MutationEvent.h
@@ -41,10 +41,11 @@ namespace WebCore {
         {
             return adoptRef(new MutationEvent);
         }
-        static PassRefPtr<MutationEvent> create(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<Node> relatedNode,
-            const String& prevValue, const String& newValue, const String& attrName, unsigned short attrChange)
+
+        static PassRefPtr<MutationEvent> create(const AtomicString& type, bool canBubble, PassRefPtr<Node> relatedNode = 0,
+            const String& prevValue = String(), const String& newValue = String(), const String& attrName = String(), unsigned short attrChange = 0)
         {
-            return adoptRef(new MutationEvent(type, canBubble, cancelable, relatedNode, prevValue, newValue, attrName, attrChange));
+            return adoptRef(new MutationEvent(type, canBubble, false, relatedNode, prevValue, newValue, attrName, attrChange));
         }
 
         void initMutationEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<Node> relatedNode,
diff --git a/WebCore/dom/NamedAttrMap.cpp b/WebCore/dom/NamedAttrMap.cpp
index fe631c8..d4ec598 100644
--- a/WebCore/dom/NamedAttrMap.cpp
+++ b/WebCore/dom/NamedAttrMap.cpp
@@ -178,10 +178,8 @@ Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreA
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
-        if (!m_attributes[i]->name().hasPrefix() && 
-            m_attributes[i]->name().localName() == name)
-                return m_attributes[i].get();
-
+        if (!m_attributes[i]->name().hasPrefix() && m_attributes[i]->name().localName() == name)
+            return m_attributes[i].get();
         if (shouldIgnoreAttributeCase ? equalIgnoringCase(m_attributes[i]->name().toString(), name) : name == m_attributes[i]->name().toString())
             return m_attributes[i].get();
     }
@@ -206,10 +204,12 @@ void NamedNodeMap::clearAttributes()
 
 void NamedNodeMap::detachFromElement()
 {
-    // we allow a NamedNodeMap w/o an element in case someone still has a reference
-    // to if after the element gets deleted - but the map is now invalid
+    // This can't happen if the holder of the map is JavaScript, because we mark the
+    // element if the map is alive. So it has no impact on web page behavior. Because
+    // of that, we can simply clear all the attributes to avoid accessing stale
+    // pointers to do things like create Attr objects.
     m_element = 0;
-    detachAttributesFromElement();
+    clearAttributes();
 }
 
 void NamedNodeMap::setAttributes(const NamedNodeMap& other)
@@ -251,7 +251,7 @@ void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
         attr->m_element = m_element;
 
     // Notify the element that the attribute has been added, and dispatch appropriate mutation events
-    // Note that element may be null here if we are called from insertAttr() during parsing
+    // Note that element may be null here if we are called from insertAttribute() during parsing
     if (m_element) {
         m_element->attributeChanged(attribute.get());
         // Because of our updateStyleAttribute() style modification events are never sent at the right time, so don't bother sending them.
@@ -265,12 +265,13 @@ void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
 void NamedNodeMap::removeAttribute(const QualifiedName& name)
 {
     unsigned len = length();
-    unsigned index = len + 1;
-    for (unsigned i = 0; i < len; ++i)
+    unsigned index = len;
+    for (unsigned i = 0; i < len; ++i) {
         if (m_attributes[i]->name().matches(name)) {
             index = i;
             break;
         }
+    }
 
     if (index >= len)
         return;
diff --git a/WebCore/dom/NamedAttrMap.h b/WebCore/dom/NamedAttrMap.h
index 4fb96de..759900b 100644
--- a/WebCore/dom/NamedAttrMap.h
+++ b/WebCore/dom/NamedAttrMap.h
@@ -94,11 +94,11 @@ public:
     void addAttribute(PassRefPtr<Attribute>);
     void removeAttribute(const QualifiedName&);
 
+    Element* element() const { return m_element; }
+
 protected:
     virtual void clearAttributes();
 
-    Element* element() const { return m_element; }
-
 private:
     void detachAttributesFromElement();
     void detachFromElement();
diff --git a/WebCore/dom/NamedNodeMap.idl b/WebCore/dom/NamedNodeMap.idl
index 3310ded..8166853 100644
--- a/WebCore/dom/NamedNodeMap.idl
+++ b/WebCore/dom/NamedNodeMap.idl
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
diff --git a/WebCore/dom/Node.cpp b/WebCore/dom/Node.cpp
index 11d2bcf..bee07cd 100644
--- a/WebCore/dom/Node.cpp
+++ b/WebCore/dom/Node.cpp
@@ -55,6 +55,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
+#include "InspectorTimelineAgent.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
 #include "MouseEvent.h"
@@ -337,8 +338,69 @@ Node::StyleChange Node::diff(const RenderStyle* s1, const RenderStyle* s2)
     return ch;
 }
 
-Node::Node(Document* doc, bool isElement, bool isContainer, bool isText)
-    : m_document(doc)
+inline bool Node::initialRefCount(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateElement:
+        case CreateOther:
+        case CreateText:
+            return 1;
+        case CreateElementZeroRefCount:
+            return 0;
+    }
+    ASSERT_NOT_REACHED();
+    return 1;
+}
+
+inline bool Node::isContainer(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateElement:
+        case CreateElementZeroRefCount:
+            return true;
+        case CreateOther:
+        case CreateText:
+            return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+inline bool Node::isElement(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateOther:
+        case CreateText:
+            return false;
+        case CreateElement:
+        case CreateElementZeroRefCount:
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+inline bool Node::isText(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateElement:
+        case CreateElementZeroRefCount:
+        case CreateOther:
+            return false;
+        case CreateText:
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+Node::Node(Document* document, ConstructionType type)
+    : TreeShared<Node>(initialRefCount(type))
+    , m_document(document)
     , m_previous(0)
     , m_next(0)
     , m_renderer(0)
@@ -355,25 +417,27 @@ Node::Node(Document* doc, bool isElement, bool isContainer, bool isText)
     , m_inDetach(false)
     , m_inSubtreeMark(false)
     , m_hasRareData(false)
-    , m_isElement(isElement)
-    , m_isContainer(isContainer)
-    , m_isText(isText)
+    , m_isElement(isElement(type))
+    , m_isContainer(isContainer(type))
+    , m_isText(isText(type))
     , m_parsingChildrenFinished(true)
-#if ENABLE(SVG)
-    , m_areSVGAttributesValid(true)
-#endif
     , m_isStyleAttributeValid(true)
     , m_synchronizingStyleAttribute(false)
 #if ENABLE(SVG)
+    , m_areSVGAttributesValid(true)
     , m_synchronizingSVGAttributes(false)
 #endif
 {
+    if (m_document)
+        m_document->selfOnlyRef();
+
 #ifndef NDEBUG
     if (shouldIgnoreLeaks)
         ignoreSet.add(this);
     else
         nodeCounter.increment();
 #endif
+
 #if DUMP_NODE_STATISTICS
     liveNodeSet.add(this);
 #endif
@@ -393,9 +457,6 @@ Node::~Node()
     liveNodeSet.remove(this);
 #endif
 
-    if (!eventListeners().isEmpty() && !inDocument())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
     if (!hasRareData())
         ASSERT(!NodeRareData::rareDataMap().contains(this));
     else {
@@ -416,6 +477,9 @@ Node::~Node()
         m_previous->setNextSibling(0);
     if (m_next)
         m_next->setPreviousSibling(0);
+
+    if (m_document)
+        m_document->selfOnlyDeref();
 }
 
 #ifdef NDEBUG
@@ -450,14 +514,19 @@ void Node::setDocument(Document* document)
     if (inDocument() || m_document == document)
         return;
 
+    document->selfOnlyRef();
+
     setWillMoveToNewOwnerDocumentWasCalled(false);
     willMoveToNewOwnerDocument();
     ASSERT(willMoveToNewOwnerDocumentWasCalled);
 
 #if USE(JSC)
-    updateDOMNodeDocument(this, m_document.get(), document);
+    updateDOMNodeDocument(this, m_document, document);
 #endif
 
+    if (m_document)
+        m_document->selfOnlyDeref();
+
     m_document = document;
 
     setDidMoveToNewOwnerDocumentWasCalled(false);
@@ -519,7 +588,8 @@ PassRefPtr<NodeList> Node::childNodes()
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
         data->setNodeLists(NodeListsNodeData::create());
-        document()->addNodeListCache();
+        if (document())
+            document()->addNodeListCache();
     }
 
     return ChildNodeList::create(this, data->nodeLists()->m_childNodeListCaches.get());
@@ -699,7 +769,7 @@ void Node::setNeedsStyleRecalc(StyleChangeType changeType)
     if ((changeType != NoStyleChange) && !attached()) // changed compared to what?
         return;
 
-    if (!(changeType == InlineStyleChange && (m_styleChange == FullStyleChange || m_styleChange == AnimationStyleChange)))
+    if (!(changeType == InlineStyleChange && (m_styleChange == FullStyleChange || m_styleChange == SyntheticStyleChange)))
         m_styleChange = changeType;
 
     if (m_styleChange != NoStyleChange) {
@@ -762,10 +832,30 @@ bool Node::rareDataFocused() const
     ASSERT(hasRareData());
     return rareData()->isFocused();
 }
+
+bool Node::supportsFocus() const
+{
+    return hasRareData() && rareData()->tabIndexSetExplicitly();
+}
     
 bool Node::isFocusable() const
 {
-    return hasRareData() && rareData()->tabIndexSetExplicitly();
+    if (!inDocument() || !supportsFocus())
+        return false;
+    
+    if (renderer())
+        ASSERT(!renderer()->needsLayout());
+    else
+        // If the node is in a display:none tree it might say it needs style recalc but
+        // the whole document is atually up to date.
+        ASSERT(!document()->childNeedsStyleRecalc());
+    
+    // FIXME: Even if we are not visible, we might have a child that is visible.
+    // Hyatt wants to fix that some day with a "has visible content" flag or the like.
+    if (!renderer() || renderer()->style()->visibility() != VISIBLE)
+        return false;
+
+    return true;
 }
 
 bool Node::isKeyboardFocusable(KeyboardEvent*) const
@@ -793,7 +883,7 @@ void Node::registerDynamicNodeList(DynamicNodeList* list)
     if (!data->nodeLists()) {
         data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
-    } else if (!m_document->hasNodeListCaches()) {
+    } else if (!m_document || !m_document->hasNodeListCaches()) {
         // We haven't been receiving notifications while there were no registered lists, so the cache is invalid now.
         data->nodeLists()->invalidateCaches();
     }
@@ -811,7 +901,8 @@ void Node::unregisterDynamicNodeList(DynamicNodeList* list)
         data->nodeLists()->m_listsWithCaches.remove(list);
         if (data->nodeLists()->isEmpty()) {
             data->clearNodeLists();
-            document()->removeNodeListCache();
+            if (document())
+                document()->removeNodeListCache();
         }
     }
 }
@@ -1540,52 +1631,6 @@ PassRefPtr<NodeList> Node::getElementsByClassName(const String& classNames)
     return ClassNodeList::create(this, classNames, result.first->second.get());
 }
 
-template <typename Functor>
-static bool forEachTagSelector(Functor& functor, CSSSelector* selector)
-{
-    ASSERT(selector);
-
-    do {
-        if (functor(selector))
-            return true;
-        if (CSSSelector* simpleSelector = selector->simpleSelector()) {
-            if (forEachTagSelector(functor, simpleSelector))
-                return true;
-        }
-    } while ((selector = selector->tagHistory()));
-
-    return false;
-}
-
-template <typename Functor>
-static bool forEachSelector(Functor& functor, const CSSSelectorList& selectorList)
-{
-    for (CSSSelector* selector = selectorList.first(); selector; selector = CSSSelectorList::next(selector)) {
-        if (forEachTagSelector(functor, selector))
-            return true;
-    }
-
-    return false;
-}
-
-class SelectorNeedsNamespaceResolutionFunctor {
-public:
-    bool operator()(CSSSelector* selector)
-    {
-        if (selector->hasTag() && selector->m_tag.prefix() != nullAtom && selector->m_tag.prefix() != starAtom)
-            return true;
-        if (selector->hasAttribute() && selector->attribute().prefix() != nullAtom && selector->attribute().prefix() != starAtom)
-            return true;
-        return false;
-    }
-};
-
-static bool selectorNeedsNamespaceResolution(const CSSSelectorList& selectorList)
-{
-    SelectorNeedsNamespaceResolutionFunctor functor;
-    return forEachSelector(functor, selectorList);
-}
-
 PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode& ec)
 {
     if (selectors.isEmpty()) {
@@ -1604,7 +1649,7 @@ PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode&
     }
 
     // throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
-    if (selectorNeedsNamespaceResolution(querySelectorList)) {
+    if (querySelectorList.selectorsNeedNamespaceResolution()) {
         ec = NAMESPACE_ERR;
         return 0;
     }
@@ -1652,7 +1697,7 @@ PassRefPtr<NodeList> Node::querySelectorAll(const String& selectors, ExceptionCo
     }
 
     // Throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
-    if (selectorNeedsNamespaceResolution(querySelectorList)) {
+    if (querySelectorList.selectorsNeedNamespaceResolution()) {
         ec = NAMESPACE_ERR;
         return 0;
     }
@@ -1900,11 +1945,11 @@ void Node::appendTextContent(bool convertBRsToNewlines, StringBuilder& content)
         case TEXT_NODE:
         case CDATA_SECTION_NODE:
         case COMMENT_NODE:
-            content.append(static_cast<const CharacterData*>(this)->CharacterData::nodeValue());
+            content.append(static_cast<const CharacterData*>(this)->data());
             break;
 
         case PROCESSING_INSTRUCTION_NODE:
-            content.append(static_cast<const ProcessingInstruction*>(this)->ProcessingInstruction::nodeValue());
+            content.append(static_cast<const ProcessingInstruction*>(this)->data());
             break;
         
         case ELEMENT_NODE:
@@ -2313,46 +2358,24 @@ ScriptExecutionContext* Node::scriptExecutionContext() const
     return document();
 }
 
-const RegisteredEventListenerVector& Node::eventListeners() const
-{
-    if (hasRareData()) {
-        if (RegisteredEventListenerVector* listeners = rareData()->listeners())
-            return *listeners;
-    }
-    static const RegisteredEventListenerVector* emptyListenersVector = new RegisteredEventListenerVector;
-    return *emptyListenersVector;
-}
-
 void Node::insertedIntoDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
     setInDocument(true);
 }
 
 void Node::removedFromDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->registerDisconnectedNodeWithEventListeners(this);
-
     setInDocument(false);
 }
 
 void Node::willMoveToNewOwnerDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
     ASSERT(!willMoveToNewOwnerDocumentWasCalled);
     setWillMoveToNewOwnerDocumentWasCalled(true);
 }
 
 void Node::didMoveToNewOwnerDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->registerDisconnectedNodeWithEventListeners(this);
-
     ASSERT(!didMoveToNewOwnerDocumentWasCalled);
     setDidMoveToNewOwnerDocumentWasCalled(true);
 }
@@ -2382,26 +2405,15 @@ static inline void updateSVGElementInstancesAfterEventListenerChange(Node* refer
 #endif
 }
 
-void Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+bool Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    Document* document = this->document();
-    if (!document->attached())
-        return;
-
-    document->addListenerTypeIfNeeded(eventType);
-
-    RegisteredEventListenerVector& listeners = ensureRareData()->ensureListeners();
-
-    // Remove existing identical listener set with identical arguments.
-    // The DOM2 spec says that "duplicate instances are discarded" in this case.
-    removeEventListener(eventType, listener.get(), useCapture);
-
-    // adding the first one
-    if (listeners.isEmpty() && !inDocument())
-        document->registerDisconnectedNodeWithEventListeners(this);
+    if (!EventTarget::addEventListener(eventType, listener, useCapture))
+        return false;
 
-    listeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
+    if (Document* document = this->document())
+        document->addListenerTypeIfNeeded(eventType);
     updateSVGElementInstancesAfterEventListenerChange(this);
+<<<<<<< HEAD:WebCore/dom/Node.cpp
 
 #if ENABLE(TOUCH_EVENTS) // Android
     if (eventType == eventNames().touchstartEvent || 
@@ -2410,28 +2422,17 @@ void Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListe
             eventType == eventNames().touchcancelEvent)
         document->addTouchEventListener(this);
 #endif
+=======
+    return true;
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.cpp
 }
 
-void Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+bool Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
-            r.setRemoved(true);
-            listeners->remove(i);
-
-            // removed last
-            if (listeners->isEmpty() && !inDocument())
-                document()->unregisterDisconnectedNodeWithEventListeners(this);
+    if (!EventTarget::removeEventListener(eventType, listener, useCapture))
+        return false;
 
+<<<<<<< HEAD:WebCore/dom/Node.cpp
             updateSVGElementInstancesAfterEventListenerChange(this);
 #if ENABLE(TOUCH_EVENTS) // Android
             if (eventType == eventNames().touchstartEvent || 
@@ -2443,16 +2444,18 @@ void Node::removeEventListener(const AtomicString& eventType, EventListener* lis
             return;
         }
     }
+=======
+    updateSVGElementInstancesAfterEventListenerChange(this);
+    return true;
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.cpp
 }
 
-void Node::removeAllEventListenersSlowCase()
+EventTargetData* Node::eventTargetData()
 {
-    ASSERT(hasRareData());
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
+    return hasRareData() ? rareData()->eventTargetData() : 0;
+}
 
+<<<<<<< HEAD:WebCore/dom/Node.cpp
 #if ENABLE(TOUCH_EVENTS) // Android
     document()->removeTouchEventListener(this);
 #endif
@@ -2461,20 +2464,22 @@ void Node::removeAllEventListenersSlowCase()
     for (size_t i = 0; i < size; ++i)
         listeners->at(i)->setRemoved(true);
     listeners->clear();
+=======
+EventTargetData* Node::ensureEventTargetData()
+{
+    return ensureRareData()->ensureEventTargetData();
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.cpp
 }
 
-void Node::handleLocalEvents(Event* event, bool useCapture)
+void Node::handleLocalEvents(Event* event)
 {
+    if (!hasRareData() || !rareData()->eventTargetData())
+        return;
+
     if (disabled() && event->isMouseEvent())
         return;
 
-    RegisteredEventListenerVector listenersCopy = eventListeners();
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        const RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, false);
-    }
+    fireEventListeners(event);
 }
 
 #if ENABLE(SVG)
@@ -2515,19 +2520,29 @@ static inline EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNo
     return referenceNode;
 }
 
-bool Node::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
+void Node::eventAncestors(Vector<RefPtr<ContainerNode> > &ancestors)
 {
-    RefPtr<Event> evt(e);
-    ASSERT(!eventDispatchForbidden());
-    if (!evt || evt->type().isEmpty()) { 
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return false;
+    if (inDocument()) {
+        for (ContainerNode* ancestor = eventParentNode(); ancestor; ancestor = ancestor->eventParentNode()) {
+#if ENABLE(SVG)
+            // Skip <use> shadow tree elements.
+            if (ancestor->isSVGElement() && ancestor->isShadowNode())
+                continue;
+#endif
+            ancestors.append(ancestor);
+        }
     }
+}
 
-    evt->setTarget(eventTargetRespectingSVGTargetRules(this));
+bool Node::dispatchEvent(PassRefPtr<Event> prpEvent)
+{
+    RefPtr<EventTarget> protect = this;
+    RefPtr<Event> event = prpEvent;
+
+    event->setTarget(eventTargetRespectingSVGTargetRules(this));
 
     RefPtr<FrameView> view = document()->view();
-    return dispatchGenericEvent(evt.release());
+    return dispatchGenericEvent(event.release());
 }
 
 bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
@@ -2538,21 +2553,18 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
     ASSERT(event->target());
     ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willDispatchDOMEvent(*event);
+#endif
+
     // Make a vector of ancestors to send the event to.
     // If the node is not in a document just send the event to it.
     // Be sure to ref all of nodes since event handlers could result in the last reference going away.
     RefPtr<Node> thisNode(this);
     Vector<RefPtr<ContainerNode> > ancestors;
-    if (inDocument()) {
-        for (ContainerNode* ancestor = eventParentNode(); ancestor; ancestor = ancestor->eventParentNode()) {
-#if ENABLE(SVG)
-            // Skip <use> shadow tree elements.
-            if (ancestor->isSVGElement() && ancestor->isShadowNode())
-                continue;
-#endif
-            ancestors.append(ancestor);
-        }
-    }
+    eventAncestors(ancestors);
 
     // Set up a pointer to indicate whether / where to dispatch window events.
     // We don't dispatch load events to the window. That quirk was originally
@@ -2574,27 +2586,22 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
 
     if (targetForWindowEvents) {
         event->setCurrentTarget(targetForWindowEvents);
-        targetForWindowEvents->handleEvent(event.get(), true);
+        targetForWindowEvents->fireEventListeners(event.get());
         if (event->propagationStopped())
             goto doneDispatching;
     }
     for (size_t i = ancestors.size(); i; --i) {
         ContainerNode* ancestor = ancestors[i - 1].get();
         event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
-        ancestor->handleLocalEvents(event.get(), true);
+        ancestor->handleLocalEvents(event.get());
         if (event->propagationStopped())
             goto doneDispatching;
     }
 
     event->setEventPhase(Event::AT_TARGET);
 
-    // We do want capturing event listeners to be invoked here, even though
-    // that violates some versions of the DOM specification; Mozilla does it.
     event->setCurrentTarget(eventTargetRespectingSVGTargetRules(this));
-    handleLocalEvents(event.get(), true);
-    if (event->propagationStopped())
-        goto doneDispatching;
-    handleLocalEvents(event.get(), false);
+    handleLocalEvents(event.get());
     if (event->propagationStopped())
         goto doneDispatching;
 
@@ -2606,13 +2613,13 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
         for (size_t i = 0; i < size; ++i) {
             ContainerNode* ancestor = ancestors[i].get();
             event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
-            ancestor->handleLocalEvents(event.get(), false);
+            ancestor->handleLocalEvents(event.get());
             if (event->propagationStopped() || event->cancelBubble())
                 goto doneDispatching;
         }
         if (targetForWindowEvents) {
             event->setCurrentTarget(targetForWindowEvents);
-            targetForWindowEvents->handleEvent(event.get(), false);
+            targetForWindowEvents->fireEventListeners(event.get());
             if (event->propagationStopped() || event->cancelBubble())
                 goto doneDispatching;
         }
@@ -2649,6 +2656,11 @@ doneDispatching:
     }
 
 doneWithDefault:
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didDispatchDOMEvent();
+#endif
+
     Document::updateStyleForAllDocuments();
 
     return !event->defaultPrevented();
@@ -2665,8 +2677,7 @@ void Node::dispatchSubtreeModifiedEvent()
     if (!document()->hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
         return;
 
-    ExceptionCode ec = 0;
-    dispatchMutationEvent(eventNames().DOMSubtreeModifiedEvent, true, 0, String(), String(), ec); 
+    dispatchEvent(MutationEvent::create(eventNames().DOMSubtreeModifiedEvent, true));
 }
 
 void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
@@ -2676,18 +2687,15 @@ void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr
     
     bool cancelable = eventType == eventNames().DOMActivateEvent;
     
-    ExceptionCode ec = 0;
-    RefPtr<UIEvent> evt = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
-    evt->setUnderlyingEvent(underlyingEvent);
-    dispatchEvent(evt.release(), ec);
+    RefPtr<UIEvent> event = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
+    event->setUnderlyingEvent(underlyingEvent);
+    dispatchEvent(event.release());
 }
 
 bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& key)
 {
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
     RefPtr<KeyboardEvent> keyboardEvent = KeyboardEvent::create(key, document()->defaultView());
-    bool r = dispatchEvent(keyboardEvent, ec);
+    bool r = dispatchEvent(keyboardEvent);
     
     // we want to return false if default is prevented (already taken care of)
     // or if the element is default-handled by the DOM. Otherwise we let it just
@@ -2781,8 +2789,6 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
     
     bool cancelable = eventType != eventNames().mousemoveEvent;
     
-    ExceptionCode ec = 0;
-    
     bool swallowEvent = false;
     
     // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
@@ -2807,7 +2813,7 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
     mouseEvent->setUnderlyingEvent(underlyingEvent.get());
     mouseEvent->setAbsoluteLocation(IntPoint(pageX, pageY));
     
-    dispatchEvent(mouseEvent, ec);
+    dispatchEvent(mouseEvent);
     bool defaultHandled = mouseEvent->defaultHandled();
     bool defaultPrevented = mouseEvent->defaultPrevented();
     if (defaultHandled || defaultPrevented)
@@ -2825,7 +2831,7 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
         doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
         if (defaultHandled)
             doubleClickEvent->setDefaultHandled();
-        dispatchEvent(doubleClickEvent, ec);
+        dispatchEvent(doubleClickEvent);
         if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
             swallowEvent = true;
     }
@@ -2862,102 +2868,18 @@ void Node::dispatchWheelEvent(PlatformWheelEvent& e)
 
     we->setAbsoluteLocation(IntPoint(pos.x(), pos.y()));
 
-    ExceptionCode ec = 0;
-    if (!dispatchEvent(we.release(), ec))
+    if (!dispatchEvent(we.release()))
         e.accept();
 }
 
-void Node::dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    ExceptionCode ec = 0;
-    dispatchEvent(WebKitAnimationEvent::create(eventType, animationName, elapsedTime), ec);
-}
-
-void Node::dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    ExceptionCode ec = 0;
-    dispatchEvent(WebKitTransitionEvent::create(eventType, propertyName, elapsedTime), ec);
-}
-
-void Node::dispatchMutationEvent(const AtomicString& eventType, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode& ec)
-{
-    ASSERT(!eventDispatchForbidden());
-
-    dispatchEvent(MutationEvent::create(eventType, canBubble, false, relatedNode, prevValue, newValue, String(), 0), ec);
-}
-
 void Node::dispatchFocusEvent()
 {
-    dispatchEvent(eventNames().focusEvent, false, false);
+    dispatchEvent(Event::create(eventNames().focusEvent, false, false));
 }
 
 void Node::dispatchBlurEvent()
 {
-    dispatchEvent(eventNames().blurEvent, false, false);
-}
-
-bool Node::dispatchEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    return dispatchEvent(Event::create(eventType, canBubbleArg, cancelableArg), ec);
-}
-
-void Node::dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    dispatchEvent(ProgressEvent::create(eventType, lengthComputableArg, loadedArg, totalArg), ec);
-}
-
-void Node::clearAttributeEventListener(const AtomicString& eventType)
-{
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() != eventType || !r.listener()->isAttribute())
-            continue;
-
-        r.setRemoved(true);
-        listeners->remove(i);
-
-        // removed last
-        if (listeners->isEmpty() && !inDocument())
-            document()->unregisterDisconnectedNodeWithEventListeners(this);
-
-        updateSVGElementInstancesAfterEventListenerChange(this);
-        return;
-    }
-}
-
-void Node::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    clearAttributeEventListener(eventType);
-    if (listener)
-        addEventListener(eventType, listener, false);
-}
-
-EventListener* Node::getAttributeEventListener(const AtomicString& eventType) const
-{
-    const RegisteredEventListenerVector& listeners = eventListeners();
-    size_t size = listeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        const RegisteredEventListener& r = *listeners[i];
-        if (r.eventType() == eventType && r.listener()->isAttribute())
-            return r.listener();
-    }
-    return 0;
+    dispatchEvent(Event::create(eventNames().blurEvent, false, false));
 }
 
 bool Node::disabled() const
@@ -2977,10 +2899,12 @@ void Node::defaultEventHandler(Event* event)
     } else if (eventType == eventNames().clickEvent) {
         int detail = event->isUIEvent() ? static_cast<UIEvent*>(event)->detail() : 0;
         dispatchUIEvent(eventNames().DOMActivateEvent, detail, event);
+#if ENABLE(CONTEXT_MENUS)
     } else if (eventType == eventNames().contextmenuEvent) {
         if (Frame* frame = document()->frame())
             if (Page* page = frame->page())
                 page->contextMenuController()->handleContextMenuEvent(event);
+#endif
     } else if (eventType == eventNames().textInputEvent) {
         if (event->isTextEvent())
             if (Frame* frame = document()->frame())
@@ -2988,6 +2912,7 @@ void Node::defaultEventHandler(Event* event)
     }
 }
 
+<<<<<<< HEAD:WebCore/dom/Node.cpp
 EventListener* Node::onabort() const
 {
     return getAttributeEventListener(eventNames().abortEvent);
@@ -3410,6 +3335,8 @@ void Node::setOntouchcancel(PassRefPtr<EventListener> eventListener)
 }
 #endif // ENABLE(TOUCH_EVENT)
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.cpp
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/WebCore/dom/Node.h b/WebCore/dom/Node.h
index 753f20e..c57c49f 100644
--- a/WebCore/dom/Node.h
+++ b/WebCore/dom/Node.h
@@ -25,7 +25,6 @@
 #ifndef Node_h
 #define Node_h
 
-#include "DocPtr.h"
 #include "EventTarget.h"
 #include "KURLHash.h"
 #include "PlatformString.h"
@@ -68,7 +67,10 @@ class StringBuilder;
 
 typedef int ExceptionCode;
 
-enum StyleChangeType { NoStyleChange, InlineStyleChange, FullStyleChange, AnimationStyleChange };
+// SyntheticStyleChange means that we need to go through the entire style change logic even though
+// no style property has actually changed. It is used to restructure the tree when, for instance,
+// RenderLayers are created or destroyed due to animation changes.
+enum StyleChangeType { NoStyleChange, InlineStyleChange, FullStyleChange, SyntheticStyleChange };
 
 const unsigned short DOCUMENT_POSITION_EQUIVALENT = 0x00;
 const unsigned short DOCUMENT_POSITION_DISCONNECTED = 0x01;
@@ -108,7 +110,6 @@ public:
     enum StyleChange { NoChange, NoInherit, Inherit, Detach, Force };    
     static StyleChange diff(const RenderStyle*, const RenderStyle*);
 
-    Node(Document*, bool isElement = false, bool isContainer = false, bool isText = false);
     virtual ~Node();
 
     // DOM methods & attributes for Node
@@ -182,6 +183,14 @@ public:
     static bool isWMLElement() { return false; }
 #endif
 
+#if ENABLE(MATHML)
+    virtual bool isMathMLElement() const { return false; }
+#else
+    static bool isMathMLElement() { return false; }
+#endif
+
+
+    virtual bool isMediaControlElement() const { return false; }
     virtual bool isStyledElement() const { return false; }
     virtual bool isFrameOwnerElement() const { return false; }
     virtual bool isAttributeNode() const { return false; }
@@ -197,6 +206,9 @@ public:
     // The node's parent for the purpose of event capture and bubbling.
     virtual ContainerNode* eventParentNode();
 
+    // Node ancestors when concerned about event flow
+    void eventAncestors(Vector<RefPtr<ContainerNode> > &ancestors);
+
     bool isBlockFlow() const;
     bool isBlockFlowOrBlockTable() const;
     
@@ -289,10 +301,10 @@ public:
 
     virtual short tabIndex() const;
 
-    /**
-     * Whether this node can receive the keyboard focus.
-     */
-    virtual bool supportsFocus() const { return isFocusable(); }
+    // Whether this kind of node can receive focus by default. Most nodes are
+    // not focusable but some elements, such as form controls and links are.
+    virtual bool supportsFocus() const;
+    // Whether the node can actually be focused.
     virtual bool isFocusable() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
@@ -316,7 +328,7 @@ public:
     {
         ASSERT(this);
         ASSERT(m_document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
-        return m_document.get();
+        return m_document;
     }
     void setDocument(Document*);
 
@@ -499,6 +511,7 @@ public:
 
     unsigned short compareDocumentPosition(Node*);
 
+<<<<<<< HEAD:WebCore/dom/Node.h
 #ifdef ANDROID_INSTRUMENT
     // Overridden to prevent the normal new from being called.
     void* operator new(size_t) throw();
@@ -522,23 +535,25 @@ protected:
     NodeRareData* ensureRareData();
 
 public:
+=======
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.h
     virtual Node* toNode() { return this; }
 
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-    // Used for standard DOM addEventListener / removeEventListener APIs.
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+    virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+    virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
 
-    // Used for legacy "onEvent" property APIs.
-    void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
-    void clearAttributeEventListener(const AtomicString& eventType);
-    EventListener* getAttributeEventListener(const AtomicString& eventType) const;
+    // Handlers to do/undo actions on the target node before an event is dispatched to it and after the event
+    // has been dispatched.  The data pointer is handed back by the preDispatch and passed to postDispatch.
+    virtual void* preDispatchEventHandler(Event*) { return 0; }
+    virtual void postDispatchEventHandler(Event*, void* /*dataFromPreDispatch*/) { }
 
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-    bool dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+    using EventTarget::dispatchEvent;
+    virtual bool dispatchEvent(PassRefPtr<Event>);
 
-    void removeAllEventListeners() { if (hasRareData()) removeAllEventListenersSlowCase(); }
+    bool dispatchGenericEvent(PassRefPtr<Event>);
+    virtual void handleLocalEvents(Event*);
 
     void dispatchSubtreeModifiedEvent();
     void dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent);
@@ -552,14 +567,6 @@ public:
         bool isSimulated, Node* relatedTarget, PassRefPtr<Event> underlyingEvent);
     void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent);
     void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
-    void dispatchProgressEvent(const AtomicString& eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
-    void dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
-    void dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime);
-    void dispatchMutationEvent(const AtomicString& type, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode&);
-
-    bool dispatchGenericEvent(PassRefPtr<Event>);
-
-    virtual void handleLocalEvents(Event*, bool useCapture);
 
     virtual void dispatchFocusEvent();
     virtual void dispatchBlurEvent();
@@ -575,6 +582,7 @@ public:
      */
     virtual bool disabled() const;
 
+<<<<<<< HEAD:WebCore/dom/Node.h
     const RegisteredEventListenerVector& eventListeners() const;
 
     // These 4 attribute event handler attributes are overrided by HTMLBodyElement
@@ -670,16 +678,42 @@ public:
     void setOntouchcancel(PassRefPtr<EventListener>);
 #endif
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.h
     using TreeShared<Node>::ref;
     using TreeShared<Node>::deref;
- 
+
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
+
+protected:
+    // CreateElementZeroRefCount is deprecated and can be removed once we convert all element
+    // classes to start with a reference count of 1.
+    enum ConstructionType { CreateContainer, CreateElement, CreateOther, CreateText, CreateElementZeroRefCount };
+    Node(Document*, ConstructionType);
+
+    virtual void willMoveToNewOwnerDocument();
+    virtual void didMoveToNewOwnerDocument();
+    
+    virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const { }
+    void setTabIndexExplicitly(short);
+    
+    bool hasRareData() const { return m_hasRareData; }
+    
+    NodeRareData* rareData() const;
+    NodeRareData* ensureRareData();
+
 private:
+    static bool initialRefCount(ConstructionType);
+    static bool isContainer(ConstructionType);
+    static bool isElement(ConstructionType);
+    static bool isText(ConstructionType);
+
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
 
     void removeAllEventListenersSlowCase();
 
-private:
     virtual NodeRareData* createRareData();
     Node* containerChildNode(unsigned index) const;
     unsigned containerChildNodeCount() const;
@@ -697,7 +731,7 @@ private:
 
     void appendTextContent(bool convertBRsToNewlines, StringBuilder&) const;
 
-    DocPtr<Document> m_document;
+    Document* m_document;
     Node* m_previous;
     Node* m_next;
     RenderObject* m_renderer;
@@ -720,22 +754,16 @@ private:
     const bool m_isText : 1;
 
 protected:
-    // These bits are used by the Element derived class, pulled up here so they can
+    // These bits are used by derived classes, pulled up here so they can
     // be stored in the same memory word as the Node bits above.
-    bool m_parsingChildrenFinished : 1;
-#if ENABLE(SVG)
-    mutable bool m_areSVGAttributesValid : 1;
-#endif
 
-    // These bits are used by the StyledElement derived class, and live here for the
-    // same reason as above.
-    mutable bool m_isStyleAttributeValid : 1;
-    mutable bool m_synchronizingStyleAttribute : 1;
+    bool m_parsingChildrenFinished : 1; // Element
+    mutable bool m_isStyleAttributeValid : 1; // StyledElement
+    mutable bool m_synchronizingStyleAttribute : 1; // StyledElement
 
 #if ENABLE(SVG)
-    // This bit is used by the SVGElement derived class, and lives here for the same
-    // reason as above.
-    mutable bool m_synchronizingSVGAttributes : 1;
+    mutable bool m_areSVGAttributesValid : 1; // Element
+    mutable bool m_synchronizingSVGAttributes : 1; // SVGElement
 #endif
 
     // 11 bits remaining
diff --git a/WebCore/dom/Node.idl b/WebCore/dom/Node.idl
index 1e31aea..45ea132 100644
--- a/WebCore/dom/Node.idl
+++ b/WebCore/dom/Node.idl
@@ -24,6 +24,7 @@ module core {
         CustomMarkFunction,
         CustomPushEventHandlerScope,
         CustomToJS,
+        EventTarget,
         GenerateConstructor,
         GenerateNativeConverter,
         InlineGetOwnPropertySlot,
diff --git a/WebCore/dom/NodeRareData.h b/WebCore/dom/NodeRareData.h
index 7740344..8b9e1bf 100644
--- a/WebCore/dom/NodeRareData.h
+++ b/WebCore/dom/NodeRareData.h
@@ -93,12 +93,12 @@ public:
     void setTabIndexExplicitly(short index) { m_tabIndex = index; m_tabIndexWasSetExplicitly = true; }
     bool tabIndexSetExplicitly() const { return m_tabIndexWasSetExplicitly; }
 
-    RegisteredEventListenerVector* listeners() { return m_eventListeners.get(); }
-    RegisteredEventListenerVector& ensureListeners()
+    EventTargetData* eventTargetData() { return m_eventTargetData.get(); }
+    EventTargetData* ensureEventTargetData()
     {
-        if (!m_eventListeners)
-            m_eventListeners.set(new RegisteredEventListenerVector);
-        return *m_eventListeners;
+        if (!m_eventTargetData)
+            m_eventTargetData.set(new EventTargetData);
+        return m_eventTargetData.get();
     }
 
     bool isFocused() const { return m_isFocused; }
@@ -111,7 +111,7 @@ protected:
 
 private:
     OwnPtr<NodeListsNodeData> m_nodeLists;
-    OwnPtr<RegisteredEventListenerVector > m_eventListeners;
+    OwnPtr<EventTargetData> m_eventTargetData;
     short m_tabIndex;
     bool m_tabIndexWasSetExplicitly : 1;
     bool m_isFocused : 1;
diff --git a/WebCore/dom/Notation.cpp b/WebCore/dom/Notation.cpp
index 7081d98..cade384 100644
--- a/WebCore/dom/Notation.cpp
+++ b/WebCore/dom/Notation.cpp
@@ -1,8 +1,6 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
+/*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,17 +17,14 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "Notation.h"
 
 namespace WebCore {
 
-Notation::Notation(Document* doc) : ContainerNode(doc)
-{
-}
-
-Notation::Notation(Document* doc, const String& name, const String& publicId, const String& systemId)
-    : ContainerNode(doc)
+Notation::Notation(Document* document, const String& name, const String& publicId, const String& systemId)
+    : ContainerNode(document)
     , m_name(name)
     , m_publicId(publicId)
     , m_systemId(systemId)
@@ -52,7 +47,6 @@ PassRefPtr<Node> Notation::cloneNode(bool /*deep*/)
     return 0;
 }
 
-// DOM Section 1.1.1
 bool Notation::childTypeAllowed(NodeType)
 {
     return false;
diff --git a/WebCore/dom/Notation.h b/WebCore/dom/Notation.h
index 2bd5363..547c9e7 100644
--- a/WebCore/dom/Notation.h
+++ b/WebCore/dom/Notation.h
@@ -1,8 +1,6 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,26 +22,25 @@
 #ifndef Notation_h
 #define Notation_h
 
-#include "CachedResourceClient.h"
 #include "ContainerNode.h"
 
 namespace WebCore {
 
+// FIXME: This class is never instantiated. Maybe it should be removed.
+
 class Notation : public ContainerNode {
 public:
-    Notation(Document*);
-    Notation(Document*, const String& name, const String& publicId, const String& systemId);
+    const String& publicId() const { return m_publicId; }
+    const String& systemId() const { return m_systemId; }
 
-    // DOM methods & attributes for Notation
-    String publicId() const { return m_publicId; }
-    String systemId() const { return m_systemId; }
+private:
+    Notation(Document*, const String& name, const String& publicId, const String& systemId);
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType);
 
-private:
     String m_name;
     String m_publicId;
     String m_systemId;
diff --git a/WebCore/dom/PageTransitionEvent.cpp b/WebCore/dom/PageTransitionEvent.cpp
new file mode 100644
index 0000000..f9c487d
--- /dev/null
+++ b/WebCore/dom/PageTransitionEvent.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PageTransitionEvent.h"
+
+#include "EventNames.h"
+
+namespace WebCore {
+        
+PageTransitionEvent::PageTransitionEvent()
+    : m_persisted(false)
+{
+}
+
+PageTransitionEvent::PageTransitionEvent(const AtomicString& type, bool persisted)
+    : Event(type, true, true)
+    , m_persisted(persisted)
+{
+}
+
+PageTransitionEvent::~PageTransitionEvent()
+{
+}
+
+void PageTransitionEvent::initPageTransitionEvent(const AtomicString& type, 
+                                            bool canBubbleArg,
+                                            bool cancelableArg,
+                                            bool persisted)
+{
+    if (dispatched())
+        return;
+    
+    initEvent(type, canBubbleArg, cancelableArg);
+    
+    m_persisted = persisted;
+}
+
+} // namespace WebCore
diff --git a/WebCore/dom/PageTransitionEvent.h b/WebCore/dom/PageTransitionEvent.h
new file mode 100644
index 0000000..33c5a0c
--- /dev/null
+++ b/WebCore/dom/PageTransitionEvent.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PageTransitionEvent_h
+#define PageTransitionEvent_h
+
+#include "Event.h"
+
+namespace WebCore {
+
+    class PageTransitionEvent : public Event {
+    public:
+        static PassRefPtr<PageTransitionEvent> create()
+        {
+            return adoptRef(new PageTransitionEvent);
+        }
+        static PassRefPtr<PageTransitionEvent> create(const AtomicString& type, bool persisted)
+        {
+            return adoptRef(new PageTransitionEvent(type, persisted));
+        }
+
+        virtual ~PageTransitionEvent();
+
+        void initPageTransitionEvent(const AtomicString& type, 
+                                bool canBubbleArg,
+                                bool cancelableArg,
+                                bool persisted);
+
+        virtual bool isPageTransitionEvent() const { return true; }
+
+        bool persisted() const { return m_persisted; }
+
+    private:
+        PageTransitionEvent();
+        PageTransitionEvent(const AtomicString& type, bool persisted);
+
+        bool m_persisted;
+    };
+
+} // namespace WebCore
+
+#endif // PageTransitionEvent_h
diff --git a/WebCore/dom/PageTransitionEvent.idl b/WebCore/dom/PageTransitionEvent.idl
new file mode 100644
index 0000000..a09f94b
--- /dev/null
+++ b/WebCore/dom/PageTransitionEvent.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module events {
+
+    interface [
+        GenerateConstructor
+    ] PageTransitionEvent : Event {
+
+        readonly attribute boolean persisted;
+
+        void initPageTransitionEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in boolean persisted);
+    };
+
+}
diff --git a/WebCore/dom/Position.cpp b/WebCore/dom/Position.cpp
index 3b4c3e8..060b28c 100644
--- a/WebCore/dom/Position.cpp
+++ b/WebCore/dom/Position.cpp
@@ -138,10 +138,7 @@ int Position::computeOffsetInContainerNode() const
 
     switch (anchorType()) {
     case PositionIsOffsetInAnchor:
-    {
-        int maximumValidOffset = m_anchorNode->offsetInCharacters() ? m_anchorNode->maxCharacterOffset() : m_anchorNode->childNodeCount();
-        return std::min(maximumValidOffset, m_offset);
-    }
+        return std::min(lastOffsetInNode(m_anchorNode.get()), m_offset);
     case PositionIsBeforeAnchor:
         return m_anchorNode->nodeIndex();
     case PositionIsAfterAnchor:
@@ -1115,28 +1112,7 @@ void Position::showTreeForThis() const
 
 #endif
 
-Position startPosition(const Range* r)
-{
-    return r ? r->startPosition() : Position();
-}
-
-Position endPosition(const Range* r)
-{
-    return r ? r->endPosition() : Position();
-}
 
-// NOTE: first/lastDeepEditingPositionForNode can return "editing positions" (like [img, 0])
-// for elements which editing "ignores".  the rest of the editing code will treat [img, 0]
-// as "the last position before the img"
-Position firstDeepEditingPositionForNode(Node* node)
-{
-    return Position(node, 0);
-}
-
-Position lastDeepEditingPositionForNode(Node* node)
-{
-    return Position(node, lastOffsetForEditing(node));
-}
 
 } // namespace WebCore
 
diff --git a/WebCore/dom/Position.h b/WebCore/dom/Position.h
index b434ec9..c08872d 100644
--- a/WebCore/dom/Position.h
+++ b/WebCore/dom/Position.h
@@ -28,6 +28,7 @@
 
 #include "TextAffinity.h"
 #include "TextDirection.h"
+#include "Node.h" // for position creation functions
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -188,14 +189,53 @@ inline bool operator!=(const Position& a, const Position& b)
     return !(a == b);
 }
 
-Position startPosition(const Range*);
-Position endPosition(const Range*);
+// We define position creation functions to make callsites more readable.
+// These are inline to prevent ref-churn when returning a Position object.
+// If we ever add a PassPosition we can make these non-inline.
 
-// NOTE: first/lastDeepEditingPositionForNode can return "editing positions" (like [img, 0])
-// for elements which editing "ignores".  the rest of the editing code will treat [img, 0]
-// as "the last position before the img"
-Position firstDeepEditingPositionForNode(Node*);
-Position lastDeepEditingPositionForNode(Node*);
+inline Position positionInParentBeforeNode(const Node* node)
+{
+    // FIXME: This should ASSERT(node->parentNode())
+    // At least one caller currently hits this ASSERT though, which indicates
+    // that the caller is trying to make a position relative to a disconnected node (which is likely an error)
+    // Specifically, editing/deleting/delete-ligature-001.html crashes with ASSERT(node->parentNode())
+    return Position(node->parentNode(), node->nodeIndex(), Position::PositionIsOffsetInAnchor);
+}
+
+inline Position positionInParentAfterNode(const Node* node)
+{
+    ASSERT(node->parentNode());
+    return Position(node->parentNode(), node->nodeIndex() + 1, Position::PositionIsOffsetInAnchor);
+}
+
+// positionBeforeNode and positionAfterNode return neighbor-anchored positions, construction is O(1)
+inline Position positionBeforeNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, Position::PositionIsBeforeAnchor);
+}
+
+inline Position positionAfterNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, Position::PositionIsAfterAnchor);
+}
+
+inline int lastOffsetInNode(Node* node)
+{
+    return node->offsetInCharacters() ? node->maxCharacterOffset() : node->childNodeCount();
+}
+
+// firstPositionInNode and lastPositionInNode return parent-anchored positions, lastPositionInNode construction is O(n) due to childNodeCount()
+inline Position firstPositionInNode(Node* anchorNode)
+{
+    return Position(anchorNode, 0, Position::PositionIsOffsetInAnchor);
+}
+
+inline Position lastPositionInNode(Node* anchorNode)
+{
+    return Position(anchorNode, lastOffsetInNode(anchorNode), Position::PositionIsOffsetInAnchor);
+}
 
 } // namespace WebCore
 
diff --git a/WebCore/dom/PositionCreationFunctions.h b/WebCore/dom/PositionCreationFunctions.h
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/WebCore/dom/PositionCreationFunctions.h
diff --git a/WebCore/dom/PositionIterator.cpp b/WebCore/dom/PositionIterator.cpp
index a029b5e..8d881ba 100644
--- a/WebCore/dom/PositionIterator.cpp
+++ b/WebCore/dom/PositionIterator.cpp
@@ -38,7 +38,7 @@ PositionIterator::operator Position() const
 {
     if (m_nodeAfterPositionInAnchor) {
         ASSERT(m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode);
-        return positionBeforeNode(m_nodeAfterPositionInAnchor);
+        return positionInParentBeforeNode(m_nodeAfterPositionInAnchor);
     }
     if (m_anchorNode->hasChildNodes())
         return lastDeepEditingPositionForNode(m_anchorNode);
diff --git a/WebCore/dom/ProcessingInstruction.cpp b/WebCore/dom/ProcessingInstruction.cpp
index 806bf92..72993dd 100644
--- a/WebCore/dom/ProcessingInstruction.cpp
+++ b/WebCore/dom/ProcessingInstruction.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,8 +35,10 @@
 
 namespace WebCore {
 
-ProcessingInstruction::ProcessingInstruction(Document* doc)
-    : ContainerNode(doc)
+inline ProcessingInstruction::ProcessingInstruction(Document* document, const String& target, const String& data)
+    : ContainerNode(document)
+    , m_target(target)
+    , m_data(data)
     , m_cachedSheet(0)
     , m_loading(false)
     , m_alternate(false)
@@ -46,17 +48,9 @@ ProcessingInstruction::ProcessingInstruction(Document* doc)
 {
 }
 
-ProcessingInstruction::ProcessingInstruction(Document* doc, const String& target, const String& data)
-    : ContainerNode(doc)
-    , m_target(target)
-    , m_data(data)
-    , m_cachedSheet(0)
-    , m_loading(false)
-    , m_alternate(false)
-#if ENABLE(XSLT)
-    , m_isXSL(false)
-#endif
+PassRefPtr<ProcessingInstruction> ProcessingInstruction::create(Document* document, const String& target, const String& data)
 {
+    return adoptRef(new ProcessingInstruction(document, target, data));
 }
 
 ProcessingInstruction::~ProcessingInstruction()
@@ -70,6 +64,7 @@ void ProcessingInstruction::setData(const String& data, ExceptionCode&)
     int oldLength = m_data.length();
     m_data = data;
     document()->textRemoved(this, 0, oldLength);
+    checkStyleSheet();
 }
 
 String ProcessingInstruction::nodeName() const
@@ -95,8 +90,9 @@ void ProcessingInstruction::setNodeValue(const String& nodeValue, ExceptionCode&
 
 PassRefPtr<Node> ProcessingInstruction::cloneNode(bool /*deep*/)
 {
-    // ### copy m_localHref
-    return new ProcessingInstruction(document(), m_target, m_data);
+    // FIXME: Is it a problem that this does not copy m_localHref?
+    // What about other data members?
+    return create(document(), m_target, m_data);
 }
 
 // DOM Section 1.1.1
@@ -147,13 +143,21 @@ void ProcessingInstruction::checkStyleSheet()
             }
 #endif
         } else {
+            if (m_cachedSheet) {
+                m_cachedSheet->removeClient(this);
+                m_cachedSheet = 0;
+            }
+            
+            String url = document()->completeURL(href).string();
+            if (!dispatchBeforeLoadEvent(url))
+                return;
+            
             m_loading = true;
             document()->addPendingSheet();
-            if (m_cachedSheet)
-                m_cachedSheet->removeClient(this);
+            
 #if ENABLE(XSLT)
             if (m_isXSL)
-                m_cachedSheet = document()->docLoader()->requestXSLStyleSheet(document()->completeURL(href).string());
+                m_cachedSheet = document()->docLoader()->requestXSLStyleSheet(url);
             else
 #endif
             {
@@ -161,10 +165,15 @@ void ProcessingInstruction::checkStyleSheet()
                 if (charset.isEmpty())
                     charset = document()->frame()->loader()->encoding();
 
-                m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(document()->completeURL(href).string(), charset);
+                m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(url, charset);
             }
             if (m_cachedSheet)
                 m_cachedSheet->addClient(this);
+            else {
+                // The request may have been denied if (for example) the stylesheet is local and the document is remote.
+                m_loading = false;
+                document()->removePendingSheet();
+            }
         }
     }
 }
diff --git a/WebCore/dom/ProcessingInstruction.h b/WebCore/dom/ProcessingInstruction.h
index d133019..4b7dc86 100644
--- a/WebCore/dom/ProcessingInstruction.h
+++ b/WebCore/dom/ProcessingInstruction.h
@@ -1,8 +1,6 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,15 +33,28 @@ class CSSStyleSheet;
 
 class ProcessingInstruction : public ContainerNode, private CachedResourceClient {
 public:
-    ProcessingInstruction(Document*);
-    ProcessingInstruction(Document*, const String& target, const String& data);
+    static PassRefPtr<ProcessingInstruction> create(Document*, const String& target, const String& data);
     virtual ~ProcessingInstruction();
 
-    // DOM methods & attributes for Notation
-    String target() const { return m_target; }
-    String data() const { return m_data; }
+    const String& target() const { return m_target; }
+    const String& data() const { return m_data; }
     void setData(const String&, ExceptionCode&);
 
+    void setCreatedByParser(bool createdByParser) { m_createdByParser = createdByParser; }
+
+    virtual void finishParsingChildren();
+
+    const String& localHref() const { return m_localHref; }
+    StyleSheet* sheet() const { return m_sheet.get(); }
+    void setCSSStyleSheet(PassRefPtr<CSSStyleSheet>);
+
+#if ENABLE(XSLT)
+    bool isXSL() const { return m_isXSL; }
+#endif
+
+private:
+    ProcessingInstruction(Document*, const String& target, const String& data);
+
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual String nodeValue() const;
@@ -55,28 +66,18 @@ public:
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
-    void setCreatedByParser(bool createdByParser) { m_createdByParser = createdByParser; }
-    virtual void finishParsingChildren();
 
-    // Other methods (not part of DOM)
-    String localHref() const { return m_localHref; }
-    StyleSheet* sheet() const { return m_sheet.get(); }
     void checkStyleSheet();
     virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
 #if ENABLE(XSLT)
     virtual void setXSLStyleSheet(const String& url, const String& sheet);
 #endif
-    void setCSSStyleSheet(PassRefPtr<CSSStyleSheet>);
+
     bool isLoading() const;
     virtual bool sheetLoaded();
 
-#if ENABLE(XSLT)
-    bool isXSL() const { return m_isXSL; }
-#endif
-
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-private:
     void parseStyleSheet(const String& sheet);
 
     String m_target;
diff --git a/WebCore/dom/Range.cpp b/WebCore/dom/Range.cpp
index edee305..122130d 100644
--- a/WebCore/dom/Range.cpp
+++ b/WebCore/dom/Range.cpp
@@ -3,7 +3,7 @@
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,13 +26,17 @@
 #include "RangeException.h"
 
 #include "CString.h"
+#include "ClientRect.h"
+#include "ClientRectList.h"
 #include "DocumentFragment.h"
+#include "FrameView.h"
 #include "HTMLElement.h"
 #include "NodeWithIndex.h"
 #include "ProcessingInstruction.h"
 #include "Text.h"
 #include "TextIterator.h"
 #include "VisiblePosition.h"
+#include "htmlediting.h"
 #include "markup.h"
 #include "visible_units.h"
 #include <stdio.h>
@@ -586,7 +590,7 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
 
     RefPtr<DocumentFragment> fragment;
     if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
-        fragment = new DocumentFragment(m_ownerDocument.get());
+        fragment = DocumentFragment::create(m_ownerDocument.get());
     
     ec = 0;
     if (collapsed(ec))
@@ -1798,4 +1802,111 @@ void Range::textNodeSplit(Text* oldNode)
     boundaryTextNodesSplit(m_end, oldNode);
 }
 
+void Range::expand(const String& unit, ExceptionCode& ec)
+{
+    VisiblePosition start(startPosition());
+    VisiblePosition end(endPosition());
+    if (unit == "word") {
+        start = startOfWord(start);
+        end = endOfWord(end);
+    } else if (unit == "sentence") {
+        start = startOfSentence(start);
+        end = endOfSentence(end);
+    } else if (unit == "block") {
+        start = startOfParagraph(start);
+        end = endOfParagraph(end);
+    } else if (unit == "document") {
+        start = startOfDocument(start);
+        end = endOfDocument(end);
+    } else
+        return;
+    setStart(start.deepEquivalent().containerNode(), start.deepEquivalent().computeOffsetInContainerNode(), ec);
+    setEnd(end.deepEquivalent().containerNode(), end.deepEquivalent().computeOffsetInContainerNode(), ec);
+}
+
+PassRefPtr<ClientRectList> Range::getClientRects() const
+{
+    if (!m_start.container())
+        return 0;
+
+    m_ownerDocument->updateLayoutIgnorePendingStylesheets();
+
+    Vector<FloatQuad> quads;
+    getBorderAndTextQuads(quads);
+
+    return ClientRectList::create(quads);
+}
+
+PassRefPtr<ClientRect> Range::getBoundingClientRect() const
+{
+    if (!m_start.container())
+        return 0;
+
+    m_ownerDocument->updateLayoutIgnorePendingStylesheets();
+
+    Vector<FloatQuad> quads;
+    getBorderAndTextQuads(quads);
+
+    if (quads.isEmpty())
+        return ClientRect::create();
+
+    IntRect result;
+    for (size_t i = 0; i < quads.size(); ++i)
+        result.unite(quads[i].enclosingBoundingBox());
+
+    return ClientRect::create(result);
 }
+
+static void adjustFloatQuadsForScrollAndAbsoluteZoom(Vector<FloatQuad>& quads, Document* document, RenderObject* renderer)
+{
+    FrameView* view = document->view();
+    if (!view)
+        return;
+
+    IntRect visibleContentRect = view->visibleContentRect();
+    for (size_t i = 0; i < quads.size(); ++i) {
+        quads[i].move(-visibleContentRect.x(), -visibleContentRect.y());
+        adjustFloatQuadForAbsoluteZoom(quads[i], renderer);
+    }
+}
+
+void Range::getBorderAndTextQuads(Vector<FloatQuad>& quads) const
+{
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
+    Node* stopNode = pastLastNode();
+
+    HashSet<Node*> nodeSet;
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        if (node->isElementNode())
+            nodeSet.add(node);
+    }
+
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        if (node->isElementNode()) {
+            if (!nodeSet.contains(node->parentNode())) {
+                if (RenderBoxModelObject* renderBoxModelObject = static_cast<Element*>(node)->renderBoxModelObject()) {
+                    Vector<FloatQuad> elementQuads;
+                    renderBoxModelObject->absoluteQuads(elementQuads);
+                    adjustFloatQuadsForScrollAndAbsoluteZoom(elementQuads, m_ownerDocument.get(), renderBoxModelObject);
+
+                    quads.append(elementQuads);
+                }
+            }
+        } else if (node->isTextNode()) {
+            if (RenderObject* renderer = static_cast<Text*>(node)->renderer()) {
+                RenderText* renderText = toRenderText(renderer);
+                int startOffset = (node == startContainer) ? m_start.offset() : 0;
+                int endOffset = (node == endContainer) ? m_end.offset() : INT_MAX;
+                
+                Vector<FloatQuad> textQuads;
+                renderText->absoluteQuadsForRange(textQuads, startOffset, endOffset);
+                adjustFloatQuadsForScrollAndAbsoluteZoom(textQuads, m_ownerDocument.get(), renderText);
+
+                quads.append(textQuads);
+            }
+        }
+    }
+}
+
+} // namespace WebCore
diff --git a/WebCore/dom/Range.h b/WebCore/dom/Range.h
index 1487a7c..e2e282b 100644
--- a/WebCore/dom/Range.h
+++ b/WebCore/dom/Range.h
@@ -3,7 +3,7 @@
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,12 +25,15 @@
 #ifndef Range_h
 #define Range_h
 
+#include "FloatQuad.h"
 #include "RangeBoundaryPoint.h"
+#include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
 
 namespace WebCore {
 
+class ClientRect;
+class ClientRectList;
 class DocumentFragment;
 class NodeWithIndex;
 class Text;
@@ -112,6 +115,14 @@ public:
     void textNodesMerged(NodeWithIndex& oldNode, unsigned offset);
     void textNodeSplit(Text* oldNode);
 
+    // Expand range to a unit (word or sentence or block or document) boundary.
+    // Please refer to https://bugs.webkit.org/show_bug.cgi?id=27632 comment #5 
+    // for details.
+    void expand(const String&, ExceptionCode&);
+
+    PassRefPtr<ClientRectList> getClientRects() const;
+    PassRefPtr<ClientRect> getBoundingClientRect() const;
+
 #ifndef NDEBUG
     void formatForDebugger(char* buffer, unsigned length) const;
 #endif
@@ -130,6 +141,8 @@ private:
     enum ActionType { DELETE_CONTENTS, EXTRACT_CONTENTS, CLONE_CONTENTS };
     PassRefPtr<DocumentFragment> processContents(ActionType, ExceptionCode&);
 
+    void getBorderAndTextQuads(Vector<FloatQuad>&) const;
+
     RefPtr<Document> m_ownerDocument;
     RangeBoundaryPoint m_start;
     RangeBoundaryPoint m_end;
diff --git a/WebCore/dom/Range.idl b/WebCore/dom/Range.idl
index 0750c32..9024e09 100644
--- a/WebCore/dom/Range.idl
+++ b/WebCore/dom/Range.idl
@@ -85,6 +85,13 @@ module ranges {
         void detach()
             raises(DOMException);
 
+#if defined(LANGUAGE_JAVASCRIPT) || LANGUAGE_JAVASCRIPT
+        // CSSOM View Module API extensions
+
+        ClientRectList getClientRects();
+        ClientRect getBoundingClientRect();
+#endif
+
         // extensions
 
         DocumentFragment createContextualFragment(in DOMString html)
@@ -112,6 +119,9 @@ module ranges {
                                in long offset)
             raises(RangeException, DOMException);
 
+        void expand(in DOMString unit)
+            raises(RangeException, DOMException);
+
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute DOMString text;
 #endif
diff --git a/WebCore/dom/RegisteredEventListener.cpp b/WebCore/dom/RegisteredEventListener.cpp
index f257e56..e8bc594 100644
--- a/WebCore/dom/RegisteredEventListener.cpp
+++ b/WebCore/dom/RegisteredEventListener.cpp
@@ -27,12 +27,4 @@
 
 namespace WebCore {
 
-RegisteredEventListener::RegisteredEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-    : m_eventType(eventType)
-    , m_listener(listener)
-    , m_useCapture(useCapture)
-    , m_removed(false)
-{
-}
-
 } // namespace WebCore
diff --git a/WebCore/dom/RegisteredEventListener.h b/WebCore/dom/RegisteredEventListener.h
index 034f6c3..c34a341 100644
--- a/WebCore/dom/RegisteredEventListener.h
+++ b/WebCore/dom/RegisteredEventListener.h
@@ -29,47 +29,22 @@
 
 namespace WebCore {
 
-    class RegisteredEventListener : public RefCounted<RegisteredEventListener> {
+    class RegisteredEventListener {
     public:
-        static PassRefPtr<RegisteredEventListener> create(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+        RegisteredEventListener(PassRefPtr<EventListener> listener, bool useCapture)
+            : listener(listener)
+            , useCapture(useCapture)
         {
-            return adoptRef(new RegisteredEventListener(eventType, listener, useCapture));
         }
 
-        const AtomicString& eventType() const { return m_eventType; }
-        EventListener* listener() const { return m_listener.get(); }
-        bool useCapture() const { return m_useCapture; }
-        
-        bool removed() const { return m_removed; }
-        void setRemoved(bool removed) { m_removed = removed; }
-    
-    private:
-        RegisteredEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-
-        AtomicString m_eventType;
-        RefPtr<EventListener> m_listener;
-        bool m_useCapture;
-        bool m_removed;
+        RefPtr<EventListener> listener;
+        bool useCapture;
     };
-
-    typedef Vector<RefPtr<RegisteredEventListener> > RegisteredEventListenerVector;
-
-#if USE(JSC)
-    inline void markEventListeners(JSC::MarkStack& markStack, const RegisteredEventListenerVector& listeners)
-    {
-        for (size_t i = 0; i < listeners.size(); ++i)
-            listeners[i]->listener()->markJSFunction(markStack);
-    }
-
-    inline void invalidateEventListeners(const RegisteredEventListenerVector& listeners)
+    
+    inline bool operator==(const RegisteredEventListener& a, const RegisteredEventListener& b)
     {
-        // For efficiency's sake, we just set the "removed" bit, instead of
-        // actually removing the event listener. The node that owns these
-        // listeners is about to be deleted, anyway.
-        for (size_t i = 0; i < listeners.size(); ++i)
-            listeners[i]->setRemoved(true);
+        return *a.listener == *b.listener && a.useCapture == b.useCapture;
     }
-#endif
 
 } // namespace WebCore
 
diff --git a/WebCore/dom/ScriptElement.cpp b/WebCore/dom/ScriptElement.cpp
index fe38b46..827aff3 100644
--- a/WebCore/dom/ScriptElement.cpp
+++ b/WebCore/dom/ScriptElement.cpp
@@ -151,6 +151,9 @@ void ScriptElementData::requestScript(const String& sourceUrl)
     if (!document->frame())
         return;
 
+    if (!m_element->dispatchBeforeLoadEvent(sourceUrl))
+        return;
+
     ASSERT(!m_cachedScript);
     m_cachedScript = document->docLoader()->requestScript(sourceUrl, scriptCharset());
     m_requested = true;
diff --git a/WebCore/dom/ScriptExecutionContext.h b/WebCore/dom/ScriptExecutionContext.h
index 3f8febc..bb78b6f 100644
--- a/WebCore/dom/ScriptExecutionContext.h
+++ b/WebCore/dom/ScriptExecutionContext.h
@@ -44,7 +44,9 @@ namespace WebCore {
     class String;
 
     enum MessageDestination {
+#if ENABLE(INSPECTOR)
         InspectorControllerDestination,
+#endif
         ConsoleDestination,
     };
 
diff --git a/WebCore/dom/SelectElement.cpp b/WebCore/dom/SelectElement.cpp
index 1eb001e..49713ba 100644
--- a/WebCore/dom/SelectElement.cpp
+++ b/WebCore/dom/SelectElement.cpp
@@ -48,11 +48,11 @@
 #endif
 
 // Configure platform-specific behavior when focused pop-up receives arrow/space/return keystroke.
-// (PLATFORM(MAC) is always false in Chromium, hence the extra test.)
+// (PLATFORM(MAC) and PLATFORM(GTK) are always false in Chromium, hence the extra tests.)
 #if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #define ARROW_KEYS_POP_MENU 1
 #define SPACE_OR_RETURN_POP_MENU 0
-#elif PLATFORM(GTK)
+#elif PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(LINUX))
 #define ARROW_KEYS_POP_MENU 0
 #define SPACE_OR_RETURN_POP_MENU 1
 #else
@@ -644,14 +644,16 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
 
     if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
         element->focus();
-        if (RenderMenuList* menuList = toRenderMenuList(element->renderer())) {
-            if (menuList->popupIsVisible())
-                menuList->hidePopup();
-            else {
-                // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-                // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-                saveLastSelection(data, element);
-                menuList->showPopup();
+        if (element->renderer() && element->renderer()->isMenuList()) {
+            if (RenderMenuList* menuList = toRenderMenuList(element->renderer())) {
+                if (menuList->popupIsVisible())
+                    menuList->hidePopup();
+                else {
+                    // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
+                    // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+                    saveLastSelection(data, element);
+                    menuList->showPopup();
+                }
             }
         }
         event->setDefaultHandled();
@@ -676,7 +678,7 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
             data.setActiveSelectionState(true);
             
             bool multiSelectKeyPressed = false;
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
             multiSelectKeyPressed = mouseEvent->metaKey();
 #else
             multiSelectKeyPressed = mouseEvent->ctrlKey();
diff --git a/WebCore/dom/StyledElement.cpp b/WebCore/dom/StyledElement.cpp
index 456cc52..5212380 100644
--- a/WebCore/dom/StyledElement.cpp
+++ b/WebCore/dom/StyledElement.cpp
@@ -101,11 +101,6 @@ void StyledElement::removeMappedAttributeDecl(MappedAttributeEntry entryType, co
     mappedAttributeDecls->remove(MappedAttributeKey(entryType, attrName.localName().impl(), attrValue.impl()));
 }
 
-void StyledElement::invalidateStyleAttribute()
-{
-    m_isStyleAttributeValid = false;
-}
-
 void StyledElement::updateStyleAttribute() const
 {
     ASSERT(!m_isStyleAttributeValid);
@@ -116,8 +111,8 @@ void StyledElement::updateStyleAttribute() const
     m_synchronizingStyleAttribute = false;
 }
 
-StyledElement::StyledElement(const QualifiedName& name, Document *doc)
-    : Element(name, doc)
+StyledElement::StyledElement(const QualifiedName& name, Document* document, ConstructionType type)
+    : Element(name, document, type)
 {
 }
 
@@ -280,14 +275,6 @@ CSSStyleDeclaration* StyledElement::style()
     return getInlineStyleDecl();
 }
 
-static inline int toHex(UChar c)
-{
-    return ((c >= '0' && c <= '9') ? (c - '0')
-        : ((c >= 'a' && c <= 'f') ? (c - 'a' + 10)
-        : ((c >= 'A' && c <= 'F') ? (c - 'A' + 10)
-        : -1)));
-}
-
 void StyledElement::addCSSProperty(MappedAttribute* attr, int id, const String &value)
 {
     if (!attr->decl()) createMappedDecl(attr);
@@ -300,12 +287,6 @@ void StyledElement::addCSSProperty(MappedAttribute* attr, int id, int value)
     attr->decl()->setProperty(id, value, false);
 }
 
-void StyledElement::addCSSStringProperty(MappedAttribute* attr, int id, const String &value, CSSPrimitiveValue::UnitTypes type)
-{
-    if (!attr->decl()) createMappedDecl(attr);
-    attr->decl()->setStringProperty(id, value, type, false);
-}
-
 void StyledElement::addCSSImageProperty(MappedAttribute* attr, int id, const String& url)
 {
     if (!attr->decl()) createMappedDecl(attr);
@@ -393,10 +374,9 @@ void StyledElement::addCSSColor(MappedAttribute* attr, int id, const String& c)
                 // search forward for digits in the string
                 int numDigits = 0;
                 while (pos < (int)color.length() && numDigits < basicLength) {
-                    int hex = toHex(color[pos]);
-                    colors[component] = (colors[component] << 4);
-                    if (hex > 0) {
-                        colors[component] += hex;
+                    colors[component] <<= 4;
+                    if (isASCIIHexDigit(color[pos])) {
+                        colors[component] += toASCIIHexValue(color[pos]);
                         maxDigit = min(maxDigit, numDigits);
                     }
                     numDigits++;
@@ -410,10 +390,9 @@ void StyledElement::addCSSColor(MappedAttribute* attr, int id, const String& c)
             
             // normalize to 00-ff. The highest filled digit counts, minimum is 2 digits
             maxDigit -= 2;
-            colors[0] >>= 4*maxDigit;
-            colors[1] >>= 4*maxDigit;
-            colors[2] >>= 4*maxDigit;
-            // ASSERT(colors[0] < 0x100 && colors[1] < 0x100 && colors[2] < 0x100);
+            colors[0] >>= 4 * maxDigit;
+            colors[1] >>= 4 * maxDigit;
+            colors[2] >>= 4 * maxDigit;
             
             color = String::format("#%02x%02x%02x", colors[0], colors[1], colors[2]);
             if (attr->decl()->setProperty(id, color, false))
diff --git a/WebCore/dom/StyledElement.h b/WebCore/dom/StyledElement.h
index 158992e..85fa7a7 100644
--- a/WebCore/dom/StyledElement.h
+++ b/WebCore/dom/StyledElement.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -38,54 +38,49 @@ class MappedAttribute;
 
 class StyledElement : public Element {
 public:
-    StyledElement(const QualifiedName&, Document*);
     virtual ~StyledElement();
 
-    virtual bool isStyledElement() const { return true; }
-
     NamedMappedAttrMap* mappedAttributes() { return static_cast<NamedMappedAttrMap*>(namedAttrMap.get()); }
     const NamedMappedAttrMap* mappedAttributes() const { return static_cast<NamedMappedAttrMap*>(namedAttrMap.get()); }
+
     bool hasMappedAttributes() const { return namedAttrMap && mappedAttributes()->hasMappedAttributes(); }
     bool isMappedAttribute(const QualifiedName& name) const { MappedAttributeEntry res = eNone; mapToEntry(name, res); return res != eNone; }
 
-    void addCSSLength(MappedAttribute* attr, int id, const String &value);
-    void addCSSProperty(MappedAttribute* attr, int id, const String &value);
-    void addCSSProperty(MappedAttribute* attr, int id, int value);
-    void addCSSStringProperty(MappedAttribute* attr, int id, const String &value, CSSPrimitiveValue::UnitTypes = CSSPrimitiveValue::CSS_STRING);
+    void addCSSLength(MappedAttribute*, int id, const String& value);
+    void addCSSProperty(MappedAttribute*, int id, const String& value);
+    void addCSSProperty(MappedAttribute*, int id, int value);
     void addCSSImageProperty(MappedAttribute*, int propertyID, const String& url);
-    void addCSSColor(MappedAttribute* attr, int id, const String &c);
-    void createMappedDecl(MappedAttribute* attr);
-    
-    static CSSMappedAttributeDeclaration* getMappedAttributeDecl(MappedAttributeEntry type, const QualifiedName& name, const AtomicString& value);
+    void addCSSColor(MappedAttribute*, int id, const String& color);
+
+    static CSSMappedAttributeDeclaration* getMappedAttributeDecl(MappedAttributeEntry, const QualifiedName& name, const AtomicString& value);
     static void setMappedAttributeDecl(MappedAttributeEntry, const QualifiedName& name, const AtomicString& value, CSSMappedAttributeDeclaration*);
-    static void removeMappedAttributeDecl(MappedAttributeEntry type, const QualifiedName& name, const AtomicString& value);
+    static void removeMappedAttributeDecl(MappedAttributeEntry, const QualifiedName& name, const AtomicString& value);
 
     static CSSMappedAttributeDeclaration* getMappedAttributeDecl(MappedAttributeEntry, Attribute*);
     static void setMappedAttributeDecl(MappedAttributeEntry, Attribute*, CSSMappedAttributeDeclaration*);
-    
+
     CSSMutableStyleDeclaration* inlineStyleDecl() const { return m_inlineStyleDecl.get(); }
     virtual bool canHaveAdditionalAttributeStyleDecls() const { return false; }
     virtual void additionalAttributeStyleDecls(Vector<CSSMutableStyleDeclaration*>&) {};
     CSSMutableStyleDeclaration* getInlineStyleDecl();
     CSSStyleDeclaration* style();
-    void createInlineStyleDecl();
-    void destroyInlineStyleDecl();
     void invalidateStyleAttribute();
-    virtual void updateStyleAttribute() const;
-    
+
     const ClassNames& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
 
-    virtual void attributeChanged(Attribute*, bool preserveDecls = false);
-    virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
-    virtual void createAttributeMap() const;
+
     virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
 
+protected:
+    StyledElement(const QualifiedName&, Document*, ConstructionType);
+
+    virtual void attributeChanged(Attribute*, bool preserveDecls = false);
+    virtual void parseMappedAttribute(MappedAttribute*);
     virtual void copyNonAttributeProperties(const Element*);
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-protected:
     // classAttributeChanged() exists to share code between
     // parseMappedAttribute (called via setAttribute()) and
     // svgAttributeChanged (called when element.className.baseValue is set)
@@ -93,9 +88,25 @@ protected:
     
     virtual void didMoveToNewOwnerDocument();
 
+private:
+    virtual bool isStyledElement() const { return true; }
+
+    void createMappedDecl(MappedAttribute*);
+
+    void createInlineStyleDecl();
+    void destroyInlineStyleDecl();
+    virtual void updateStyleAttribute() const;
+
+    virtual void createAttributeMap() const;
+
     RefPtr<CSSMutableStyleDeclaration> m_inlineStyleDecl;
 };
 
+inline void StyledElement::invalidateStyleAttribute()
+{
+    m_isStyleAttributeValid = false;
+}
+
 } //namespace
 
 #endif
diff --git a/WebCore/dom/Text.cpp b/WebCore/dom/Text.cpp
index bbd926b..1ce074a 100644
--- a/WebCore/dom/Text.cpp
+++ b/WebCore/dom/Text.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -37,22 +37,18 @@
 #include "WMLVariables.h"
 #endif
 
-namespace WebCore {
-
-// DOM Section 1.1.1
+using namespace std;
 
-Text::Text(Document* document, const String& text)
-    : CharacterData(document, text, true)
-{
-}
+namespace WebCore {
 
-Text::Text(Document* document)
-    : CharacterData(document, true)
+Text::Text(Document* document, const String& data)
+    : CharacterData(document, data, CreateText)
 {
 }
 
-Text::~Text()
+PassRefPtr<Text> Text::create(Document* document, const String& data)
 {
+    return adoptRef(new Text(document, data));
 }
 
 PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
@@ -61,14 +57,14 @@ PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
 
     // INDEX_SIZE_ERR: Raised if the specified offset is negative or greater than
     // the number of 16-bit units in data.
-    if (offset > m_data->length()) {
+    if (offset > length()) {
         ec = INDEX_SIZE_ERR;
         return 0;
     }
 
-    RefPtr<StringImpl> oldStr = m_data;
-    RefPtr<Text> newText = createNew(oldStr->substring(offset));
-    m_data = oldStr->substring(0, offset);
+    RefPtr<StringImpl> oldStr = dataImpl();
+    RefPtr<Text> newText = virtualCreate(oldStr->substring(offset));
+    setDataImpl(oldStr->substring(0, offset));
 
     dispatchModifiedEvent(oldStr.get());
 
@@ -81,7 +77,7 @@ PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
         document()->textNodeSplit(this);
 
     if (renderer())
-        toRenderText(renderer())->setText(m_data);
+        toRenderText(renderer())->setText(dataImpl());
 
     return newText.release();
 }
@@ -199,7 +195,7 @@ Node::NodeType Text::nodeType() const
 
 PassRefPtr<Node> Text::cloneNode(bool /*deep*/)
 {
-    return document()->createTextNode(m_data);
+    return create(document(), data());
 }
 
 bool Text::rendererIsNeeded(RenderStyle *style)
@@ -244,7 +240,7 @@ bool Text::rendererIsNeeded(RenderStyle *style)
     return true;
 }
 
-RenderObject *Text::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* Text::createRenderer(RenderArena* arena, RenderStyle*)
 {
 #if ENABLE(SVG)
     if (parentNode()->isSVGElement()
@@ -252,17 +248,17 @@ RenderObject *Text::createRenderer(RenderArena* arena, RenderStyle*)
         && !parentNode()->hasTagName(SVGNames::foreignObjectTag)
 #endif
     )
-        return new (arena) RenderSVGInlineText(this, m_data);
+        return new (arena) RenderSVGInlineText(this, dataImpl());
 #endif
     
-    return new (arena) RenderText(this, m_data);
+    return new (arena) RenderText(this, dataImpl());
 }
 
 void Text::attach()
 {
 #if ENABLE(WML)
     if (document()->isWMLDocument() && !containsOnlyWhitespace()) {
-        String text = m_data;
+        String text = data();
         ASSERT(!text.isEmpty());
 
         text = substituteVariableReferences(text, document());
@@ -286,7 +282,7 @@ void Text::recalcStyle(StyleChange change)
     if (needsStyleRecalc()) {
         if (renderer()) {
             if (renderer()->isText())
-                toRenderText(renderer())->setText(m_data);
+                toRenderText(renderer())->setText(dataImpl());
         } else {
             if (attached())
                 detach();
@@ -296,40 +292,47 @@ void Text::recalcStyle(StyleChange change)
     setNeedsStyleRecalc(NoStyleChange);
 }
 
-// DOM Section 1.1.1
 bool Text::childTypeAllowed(NodeType)
 {
     return false;
 }
 
-PassRefPtr<Text> Text::createNew(PassRefPtr<StringImpl> string)
+PassRefPtr<Text> Text::virtualCreate(const String& data)
 {
-    return new Text(document(), string);
+    return create(document(), data);
 }
 
-PassRefPtr<Text> Text::createWithLengthLimit(Document* doc, const String& text, unsigned& charsLeft, unsigned maxChars)
+PassRefPtr<Text> Text::createWithLengthLimit(Document* document, const String& data, unsigned& charsLeft, unsigned maxChars)
 {
-    if (charsLeft == text.length() && charsLeft <= maxChars) {
+    unsigned dataLength = data.length();
+
+    if (charsLeft == dataLength && charsLeft <= maxChars) {
         charsLeft = 0;
-        return new Text(doc, text);
+        return create(document, data);
     }
+
+    unsigned start = dataLength - charsLeft;
+    unsigned end = start + min(charsLeft, maxChars);
     
-    unsigned start = text.length() - charsLeft;
-    unsigned end = start + std::min(charsLeft, maxChars);
+    // Check we are not on an unbreakable boundary.
+    // Some text break iterator implementations work best if the passed buffer is as small as possible, 
+    // see <https://bugs.webkit.org/show_bug.cgi?id=29092>. 
+    // We need at least two characters look-ahead to account for UTF-16 surrogates.
+    if (end < dataLength) {
+        TextBreakIterator* it = characterBreakIterator(data.characters() + start, (end + 2 > dataLength) ? dataLength - start : end - start + 2);
+        if (!isTextBreak(it, end - start))
+            end = textBreakPreceding(it, end - start) + start;
+    }
     
-    // check we are not on an unbreakable boundary
-    TextBreakIterator* it = characterBreakIterator(text.characters(), text.length());
-    if (end < text.length() && !isTextBreak(it, end))
-        end = textBreakPreceding(it, end);
-        
-    // maxChars of unbreakable characters could lead to infinite loop
+    // If we have maxChars of unbreakable characters the above could lead to
+    // an infinite loop.
+    // FIXME: It would be better to just have the old value of end before calling
+    // textBreakPreceding rather than this, because this exceeds the length limit.
     if (end <= start)
-        end = text.length();
+        end = dataLength;
     
-    String nodeText = text.substring(start, end - start);
-    charsLeft = text.length() - end;
-        
-    return new Text(doc, nodeText);
+    charsLeft = dataLength - end;
+    return create(document, data.substring(start, end - start));
 }
 
 #ifndef NDEBUG
@@ -343,7 +346,7 @@ void Text::formatForDebugger(char *buffer, unsigned length) const
         result += s;
     }
           
-    s = nodeValue();
+    s = data();
     if (s.length() > 0) {
         if (result.length() > 0)
             result += "; ";
diff --git a/WebCore/dom/Text.h b/WebCore/dom/Text.h
index e5a6e69..4722736 100644
--- a/WebCore/dom/Text.h
+++ b/WebCore/dom/Text.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,44 +27,39 @@
 
 namespace WebCore {
     
-const unsigned cTextNodeLengthLimit = 1 << 16;
-
 class Text : public CharacterData {
 public:
-    Text(Document *impl, const String &_text);
-    Text(Document *impl);
-    virtual ~Text();
+    static const unsigned defaultLengthLimit = 1 << 16;
 
-    // DOM methods & attributes for CharacterData
+    static PassRefPtr<Text> create(Document*, const String&);
+    static PassRefPtr<Text> createWithLengthLimit(Document*, const String&, unsigned& charsLeft, unsigned lengthLimit = defaultLengthLimit);
 
     PassRefPtr<Text> splitText(unsigned offset, ExceptionCode&);
 
     // DOM Level 3: http://www.w3.org/TR/DOM-Level-3-Core/core.html#ID-1312295772
+
     String wholeText() const;
     PassRefPtr<Text> replaceWholeText(const String&, ExceptionCode&);
 
-    // DOM methods overridden from parent classes
+    virtual void attach();
+
+protected:
+    Text(Document*, const String&);
 
+private:
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
-
-    // Other methods (not part of DOM)
-
-    virtual void attach();
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void recalcStyle(StyleChange = NoChange);
     virtual bool childTypeAllowed(NodeType);
 
-    static PassRefPtr<Text> createWithLengthLimit(Document*, const String&, unsigned& charsLeft, unsigned maxChars = cTextNodeLengthLimit);
+    virtual PassRefPtr<Text> virtualCreate(const String&);
 
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
 #endif
-
-protected:
-    virtual PassRefPtr<Text> createNew(PassRefPtr<StringImpl>);
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/TransformSource.h b/WebCore/dom/TransformSource.h
new file mode 100644
index 0000000..f97afcf
--- /dev/null
+++ b/WebCore/dom/TransformSource.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef TransformSource_h
+#define TransformSource_h
+
+#if ENABLE(XSLT)
+
+#include "PlatformString.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+#if USE(QXMLQUERY)
+    typedef String PlatformTransformSource;
+#else
+    typedef void* PlatformTransformSource;
+#endif
+
+    class TransformSource : public Noncopyable {
+    public:
+        TransformSource(const PlatformTransformSource& source);
+        ~TransformSource();
+
+        PlatformTransformSource platformSource() const { return m_source; }
+
+    private:
+        PlatformTransformSource m_source;
+    };
+
+} // namespace WebCore
+
+#endif
+
+#endif // TransformSource_h
diff --git a/WebCore/dom/TransformSourceLibxslt.cpp b/WebCore/dom/TransformSourceLibxslt.cpp
new file mode 100644
index 0000000..33a85e8
--- /dev/null
+++ b/WebCore/dom/TransformSourceLibxslt.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TransformSource.h"
+
+#include <libxml/tree.h>
+
+namespace WebCore {
+
+TransformSource::TransformSource(const PlatformTransformSource& source)
+    : m_source(source)
+{
+}
+
+TransformSource::~TransformSource()
+{
+    xmlFreeDoc((xmlDocPtr)m_source);
+}
+
+}
diff --git a/WebCore/dom/TransformSourceQt.cpp b/WebCore/dom/TransformSourceQt.cpp
new file mode 100644
index 0000000..074f2cb
--- /dev/null
+++ b/WebCore/dom/TransformSourceQt.cpp
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "TransformSource.h"
+
+namespace WebCore {
+
+TransformSource::TransformSource(const PlatformTransformSource& source)
+    : m_source(source)
+{
+}
+
+TransformSource::~TransformSource()
+{
+}
+
+}
diff --git a/WebCore/dom/XMLTokenizer.cpp b/WebCore/dom/XMLTokenizer.cpp
index 1747c3c..4d06343 100644
--- a/WebCore/dom/XMLTokenizer.cpp
+++ b/WebCore/dom/XMLTokenizer.cpp
@@ -136,7 +136,7 @@ bool XMLTokenizer::enterText()
 #if !USE(QXMLSTREAM)
     ASSERT(m_bufferedText.size() == 0);
 #endif
-    RefPtr<Node> newNode = new Text(m_doc, "");
+    RefPtr<Node> newNode = Text::create(m_doc, "");
     if (!m_currentNode->addChild(newNode.get()))
         return false;
     setCurrentNode(newNode.get());
diff --git a/WebCore/dom/XMLTokenizerLibxml2.cpp b/WebCore/dom/XMLTokenizerLibxml2.cpp
index 4387a66..e4a98d5 100644
--- a/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -50,6 +50,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
+#include "TransformSource.h"
 #include "XMLTokenizerScope.h"
 #include <libxml/parser.h>
 #include <libxml/parserInternals.h>
@@ -850,7 +851,8 @@ void XMLTokenizer::endElementNs()
         if (!scriptHref.isEmpty()) {
             // we have a src attribute 
             String scriptCharset = scriptElement->scriptCharset();
-            if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
+            if (element->dispatchBeforeLoadEvent(scriptHref) &&
+                (m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
                 m_scriptElement = element;
                 m_pendingScript->addClient(this);
 
@@ -951,7 +953,7 @@ void XMLTokenizer::cdataBlock(const xmlChar* s, int len)
     
     exitText();
 
-    RefPtr<Node> newNode = new CDATASection(m_doc, toString(s, len));
+    RefPtr<Node> newNode = CDATASection::create(m_doc, toString(s, len));
     if (!m_currentNode->addChild(newNode.get()))
         return;
     if (m_view && !newNode->attached())
@@ -970,7 +972,7 @@ void XMLTokenizer::comment(const xmlChar* s)
     
     exitText();
 
-    RefPtr<Node> newNode = new Comment(m_doc, toString(s));
+    RefPtr<Node> newNode = Comment::create(m_doc, toString(s));
     m_currentNode->addChild(newNode.get());
     if (m_view && !newNode->attached())
         newNode->attach();
@@ -1280,7 +1282,8 @@ void XMLTokenizer::doEnd()
 {
 #if ENABLE(XSLT)
     if (m_sawXSLTransform) {
-        m_doc->setTransformSource(xmlDocPtrForString(m_doc->docLoader(), m_originalSourceForTransform, m_doc->url().string()));
+        void* doc = xmlDocPtrForString(m_doc->docLoader(), m_originalSourceForTransform, m_doc->url().string());
+        m_doc->setTransformSource(new TransformSource(doc));
         
         m_doc->setParsing(false); // Make the doc think it's done, so it will apply xsl sheets.
         m_doc->updateStyleSelector();
diff --git a/WebCore/dom/XMLTokenizerQt.cpp b/WebCore/dom/XMLTokenizerQt.cpp
index 16c637f..04405d6 100644
--- a/WebCore/dom/XMLTokenizerQt.cpp
+++ b/WebCore/dom/XMLTokenizerQt.cpp
@@ -50,6 +50,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
+#include "TransformSource.h"
 #include <QDebug>
 #include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
@@ -237,7 +238,7 @@ void XMLTokenizer::doWrite(const String& parseString)
     return;
 }
 
-void XMLTokenizer::initializeParserContext(const char* chunk)
+void XMLTokenizer::initializeParserContext(const char*)
 {
     m_parserStopped = false;
     m_sawError = false;
@@ -248,45 +249,19 @@ void XMLTokenizer::initializeParserContext(const char* chunk)
 void XMLTokenizer::doEnd()
 {
 #if ENABLE(XSLT)
-    #warning Look at XMLTokenizerLibXml.cpp
-#endif
-
-    if (m_stream.error() == QXmlStreamReader::PrematureEndOfDocumentError || (m_wroteText && !m_sawFirstElement)) {
-        handleError(fatal, qPrintable(m_stream.errorString()), lineNumber(),
-                    columnNumber());
+    if (m_sawXSLTransform) {
+        m_doc->setTransformSource(new TransformSource(m_originalSourceForTransform));
+        m_doc->setParsing(false); // Make the doc think it's done, so it will apply xsl sheets.
+        m_doc->updateStyleSelector();
+        m_doc->setParsing(true);
+        m_parserStopped = true;
     }
-}
-
-#if ENABLE(XSLT)
-void* xmlDocPtrForString(DocLoader* docLoader, const String& source, const String& url)
-{
-    if (source.isEmpty())
-        return 0;
-
-    // Parse in a single chunk into an xmlDocPtr
-    // FIXME: Hook up error handlers so that a failure to parse the main document results in
-    // good error messages.
-    const UChar BOM = 0xFEFF;
-    const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
-
-    xmlGenericErrorFunc oldErrorFunc = xmlGenericError;
-    void* oldErrorContext = xmlGenericErrorContext;
-    
-    setLoaderForLibXMLCallbacks(docLoader);        
-    xmlSetGenericErrorFunc(0, errorFunc);
-    
-    xmlDocPtr sourceDoc = xmlReadMemory(reinterpret_cast<const char*>(source.characters()),
-                                        source.length() * sizeof(UChar),
-                                        url.latin1().data(),
-                                        BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE", 
-                                        XSLT_PARSE_OPTIONS);
-    
-    setLoaderForLibXMLCallbacks(0);
-    xmlSetGenericErrorFunc(oldErrorContext, oldErrorFunc);
+#endif
     
-    return sourceDoc;
+    if (m_stream.error() == QXmlStreamReader::PrematureEndOfDocumentError
+        || (m_wroteText && !m_sawFirstElement && !m_sawXSLTransform))
+        handleError(fatal, qPrintable(m_stream.errorString()), lineNumber(), columnNumber());
 }
-#endif
 
 int XMLTokenizer::lineNumber() const
 {
@@ -683,7 +658,7 @@ void XMLTokenizer::parseProcessingInstruction()
 
 #if ENABLE(XSLT)
     m_sawXSLTransform = !m_sawFirstElement && pi->isXSL();
-    if (m_sawXSLTransform && !m_doc->transformSourceDocument()))
+    if (m_sawXSLTransform && !m_doc->transformSourceDocument())
         stopParsing();
 #endif
 }
@@ -692,7 +667,7 @@ void XMLTokenizer::parseCdata()
 {
     exitText();
 
-    RefPtr<Node> newNode = new CDATASection(m_doc, m_stream.text());
+    RefPtr<Node> newNode = CDATASection::create(m_doc, m_stream.text());
     if (!m_currentNode->addChild(newNode.get()))
         return;
     if (m_view && !newNode->attached())
@@ -703,7 +678,7 @@ void XMLTokenizer::parseComment()
 {
     exitText();
 
-    RefPtr<Node> newNode = new Comment(m_doc, m_stream.text());
+    RefPtr<Node> newNode = Comment::create(m_doc, m_stream.text());
     m_currentNode->addChild(newNode.get());
     if (m_view && !newNode->attached())
         newNode->attach();
diff --git a/WebCore/dom/make_names.pl b/WebCore/dom/make_names.pl
index e6d59a0..6b5ddb4 100755
--- a/WebCore/dom/make_names.pl
+++ b/WebCore/dom/make_names.pl
@@ -48,28 +48,30 @@ my %parameters = ();
 my $extraDefines = 0;
 my $preprocessor = "/usr/bin/gcc -E -P -x c++";
 
-GetOptions('tags=s' => \$tagsFile, 
+GetOptions(
+    'tags=s' => \$tagsFile, 
     'attrs=s' => \$attrsFile,
     'factory' => \$printFactory,
     'outputDir=s' => \$outputDir,
     'extraDefines=s' => \$extraDefines,
     'preprocessor=s' => \$preprocessor,
-    'wrapperFactory' => \$printWrapperFactory);
+    'wrapperFactory' => \$printWrapperFactory
+);
 
 die "You must specify at least one of --tags <file> or --attrs <file>" unless (length($tagsFile) || length($attrsFile));
 
 readNames($tagsFile, "tags") if length($tagsFile);
 readNames($attrsFile, "attrs") if length($attrsFile);
 
-die "You must specify a namespace (e.g. SVG) for <namespace>Names.h" unless $parameters{'namespace'};
-die "You must specify a namespaceURI (e.g. http://www.w3.org/2000/svg)" unless $parameters{'namespaceURI'};
+die "You must specify a namespace (e.g. SVG) for <namespace>Names.h" unless $parameters{namespace};
+die "You must specify a namespaceURI (e.g. http://www.w3.org/2000/svg)" unless $parameters{namespaceURI};
 
-$parameters{'namespacePrefix'} = $parameters{'namespace'} unless $parameters{'namespacePrefix'};
+$parameters{namespacePrefix} = $parameters{namespace} unless $parameters{namespacePrefix};
 
 mkpath($outputDir);
-my $namesBasePath = "$outputDir/$parameters{'namespace'}Names";
-my $factoryBasePath = "$outputDir/$parameters{'namespace'}ElementFactory";
-my $wrapperFactoryBasePath = "$outputDir/JS$parameters{'namespace'}ElementWrapperFactory";
+my $namesBasePath = "$outputDir/$parameters{namespace}Names";
+my $factoryBasePath = "$outputDir/$parameters{namespace}ElementFactory";
+my $wrapperFactoryBasePath = "$outputDir/JS$parameters{namespace}ElementWrapperFactory";
 
 printNamesHeaderFile("$namesBasePath.h");
 printNamesCppFile("$namesBasePath.cpp");
@@ -86,39 +88,44 @@ if ($printWrapperFactory) {
 
 ### Hash initialization
 
-sub initializeTagPropertyHash
+sub defaultTagPropertyHash
 {
-    return ('constructorNeedsCreatedByParser' => 0,
-            'constructorNeedsFormElement' => 0,
-            'exportString' => 0,
-            'interfaceName' => defaultInterfaceName($_[0]),
-            # By default, the JSInterfaceName is the same as the interfaceName.
-            'JSInterfaceName' => defaultInterfaceName($_[0]),
-            'mapToTagName' => '',
-            'wrapperOnlyIfMediaIsAvailable' => 0,
-            'conditional' => 0);
+    return (
+        'constructorNeedsCreatedByParser' => 0,
+        'constructorNeedsFormElement' => 0,
+        'createWithNew' => 0,
+        'exportString' => 0,
+        'interfaceName' => defaultInterfaceName($_[0]),
+        # By default, the JSInterfaceName is the same as the interfaceName.
+        'JSInterfaceName' => defaultInterfaceName($_[0]),
+        'mapToTagName' => '',
+        'wrapperOnlyIfMediaIsAvailable' => 0,
+        'conditional' => 0
+    );
 }
 
-sub initializeAttrPropertyHash
+sub defaultAttrPropertyHash
 {
     return ('exportString' => 0);
 }
 
-sub initializeParametersHash
+sub defaultParametersHash
 {
-    return ('namespace' => '',
-            'namespacePrefix' => '',
-            'namespaceURI' => '',
-            'guardFactoryWith' => '',
-            'tagsNullNamespace' => 0,
-            'attrsNullNamespace' => 0,
-            'exportStrings' => 0);
+    return (
+        'namespace' => '',
+        'namespacePrefix' => '',
+        'namespaceURI' => '',
+        'guardFactoryWith' => '',
+        'tagsNullNamespace' => 0,
+        'attrsNullNamespace' => 0,
+        'exportStrings' => 0
+    );
 }
 
 sub defaultInterfaceName
 {
-    die "No namespace found" if !$parameters{'namespace'};
-    return $parameters{'namespace'} . upperCaseName($_[0]) . "Element"
+    die "No namespace found" if !$parameters{namespace};
+    return $parameters{namespace} . upperCaseName($_[0]) . "Element"
 }
 
 ### Parsing handlers
@@ -129,16 +136,16 @@ sub tagsHandler
 
     $tag =~ s/-/_/g;
 
-    # Initialize default properties' values.
-    $tags{$tag} = { initializeTagPropertyHash($tag) } if !defined($tags{$tag});
+    # Initialize default property values.
+    $tags{$tag} = { defaultTagPropertyHash($tag) } if !defined($tags{$tag});
 
     if ($property) {
         die "Unknown property $property for tag $tag\n" if !defined($tags{$tag}{$property});
-        # The code rely on JSInterfaceName deriving from interfaceName to check for custom JSInterfaceName.
-        # So just override JSInterfaceName if it was not already set.
-        if ($property eq "interfaceName" && $tags{$tag}{'JSInterfaceName'} eq $tags{$tag}{'interfaceName'}) {
-                $tags{$tag}{'JSInterfaceName'} = $value;
-        }
+
+        # The code relies on JSInterfaceName deriving from interfaceName to check for custom JSInterfaceName.
+        # So override JSInterfaceName if it was not already set.
+        $tags{$tag}{JSInterfaceName} = $value if $property eq "interfaceName" && $tags{$tag}{JSInterfaceName} eq $tags{$tag}{interfaceName};
+
         $tags{$tag}{$property} = $value;
     }
 }
@@ -150,7 +157,7 @@ sub attrsHandler
     $attr =~ s/-/_/g;
 
     # Initialize default properties' values.
-    $attrs{$attr} = { initializeAttrPropertyHash($attr) } if !defined($attrs{$attr});
+    $attrs{$attr} = { defaultAttrPropertyHash($attr) } if !defined($attrs{$attr});
 
     if ($property) {
         die "Unknown property $property for attribute $attr\n" if !defined($attrs{$attr}{$property});
@@ -163,7 +170,7 @@ sub parametersHandler
     my ($parameter, $value) = @_;
 
     # Initialize default properties' values.
-    %parameters = initializeParametersHash() if !(keys %parameters);
+    %parameters = defaultParametersHash() if !(keys %parameters);
 
     die "Unknown parameter $parameter for tags/attrs\n" if !defined($parameters{$parameter});
     $parameters{$parameter} = $value;
@@ -214,7 +221,7 @@ sub printMacros
     for my $name (sort keys %$namesRef) {
         print F "$macro $name","$suffix;\n";
 
-        if ($parameters{'exportStrings'} or $names{$name}{"exportString"}) { 
+        if ($parameters{exportStrings} or $names{$name}{exportString}) { 
             print F "extern char $name", "${suffix}String[];\n";
         }
     }
@@ -223,7 +230,7 @@ sub printMacros
 sub usesDefaultWrapper
 {
     my $tagName = shift;
-    return $tagName eq $parameters{'namespace'} . "Element";
+    return $tagName eq $parameters{namespace} . "Element";
 }
 
 # Build a direct mapping from the tags to the Element to create, excluding
@@ -232,16 +239,16 @@ sub buildConstructorMap
 {
     my %tagConstructorMap = ();
     for my $tagName (keys %tags) {
-        my $interfaceName = $tags{$tagName}{'interfaceName'};
+        my $interfaceName = $tags{$tagName}{interfaceName};
         next if (usesDefaultWrapper($interfaceName));
 
-        if ($tags{$tagName}{'mapToTagName'}) {
-            die "Cannot handle multiple mapToTagName for $tagName\n" if $tags{$tags{$tagName}{'mapToTagName'}}{'mapToTagName'};
-            $interfaceName = $tags{ $tags{$tagName}{'mapToTagName'} }{'interfaceName'};
+        if ($tags{$tagName}{mapToTagName}) {
+            die "Cannot handle multiple mapToTagName for $tagName\n" if $tags{$tags{$tagName}{mapToTagName}}{mapToTagName};
+            $interfaceName = $tags{ $tags{$tagName}{mapToTagName} }{interfaceName};
         }
 
         # Chop the string to keep the interesting part.
-        $interfaceName =~ s/$parameters{'namespace'}(.*)Element/$1/;
+        $interfaceName =~ s/$parameters{namespace}(.*)Element/$1/;
         $tagConstructorMap{$tagName} = lc($interfaceName);
     }
 
@@ -254,17 +261,13 @@ sub printConstructorSignature
 {
     my ($F, $tagName, $constructorName, $constructorTagName) = @_;
 
-    print F "static PassRefPtr<$parameters{'namespace'}Element> ${constructorName}Constructor(const QualifiedName& $constructorTagName, Document* doc";
-    if ($parameters{'namespace'} eq "HTML") {
+    print F "static PassRefPtr<$parameters{namespace}Element> ${constructorName}Constructor(const QualifiedName& $constructorTagName, Document* document";
+    if ($parameters{namespace} eq "HTML") {
         print F ", HTMLFormElement*";
-        if ($tags{$tagName}{'constructorNeedsFormElement'}) {
-            print F " formElement";
-        }
+        print F " formElement" if $tags{$tagName}{constructorNeedsFormElement};
     }
     print F ", bool";
-    if ($tags{$tagName}{'constructorNeedsCreatedByParser'}) {
-        print F " createdByParser"; 
-    }
+    print F " createdByParser" if $tags{$tagName}{constructorNeedsCreatedByParser};
     print F ")\n{\n";
 }
 
@@ -276,22 +279,26 @@ sub printConstructorInterior
     my ($F, $tagName, $interfaceName, $constructorTagName) = @_;
 
     # Handle media elements.
-    if ($tags{$tagName}{'wrapperOnlyIfMediaIsAvailable'}) {
+    if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
         print F <<END
     if (!MediaPlayer::isAvailable())
-        return new HTMLElement($constructorTagName, doc);
+        return HTMLElement::create($constructorTagName, document);
 END
 ;
     }
 
-    # Now call the constructor with the right parameters.
-    print F "    return new ${interfaceName}($constructorTagName, doc";
-    if ($tags{$tagName}{'constructorNeedsFormElement'}) {
-        print F ", formElement";
-    }
-    if ($tags{$tagName}{'constructorNeedsCreatedByParser'}) {
-        print F ", createdByParser";
+    my $newPrefix = "";
+    my $createSuffix = "::create";
+
+    if ($tags{$tagName}{createWithNew}) {
+        $newPrefix = "new ";
+        $createSuffix = "";
     }
+
+    # Call the constructor with the right parameters.
+    print F "    return $newPrefix$interfaceName${createSuffix}($constructorTagName, document";
+    print F ", formElement" if $tags{$tagName}{constructorNeedsFormElement};
+    print F ", createdByParser" if $tags{$tagName}{constructorNeedsCreatedByParser};
     print F ");\n}\n\n";
 }
 
@@ -300,20 +307,20 @@ sub printConstructors
     my ($F, $tagConstructorMapRef) = @_;
     my %tagConstructorMap = %$tagConstructorMapRef;
 
-    print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+    print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
     # This is to avoid generating the same constructor several times.
     my %uniqueTags = ();
     for my $tagName (sort keys %tagConstructorMap) {
-        my $interfaceName = $tags{$tagName}{'interfaceName'};
+        my $interfaceName = $tags{$tagName}{interfaceName};
 
         # Ignore the mapped tag
         # FIXME: It could be moved inside this loop but was split for readibility.
-        next if (defined($uniqueTags{$interfaceName}) || $tags{$tagName}{'mapToTagName'});
+        next if (defined($uniqueTags{$interfaceName}) || $tags{$tagName}{mapToTagName});
 
         $uniqueTags{$interfaceName} = '1';
 
-        my $conditional = $tags{$tagName}{"conditional"};
+        my $conditional = $tags{$tagName}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n\n";
@@ -323,20 +330,20 @@ sub printConstructors
         printConstructorInterior($F, $tagName, $interfaceName, "tagName");
 
         if ($conditional) {
-            print F "#endif\n\n";
+            print F "#endif\n";
         }
     }
 
     # Mapped tag name uses a special wrapper to keep their prefix and namespaceURI while using the mapped localname.
     for my $tagName (sort keys %tagConstructorMap) {
-        if ($tags{$tagName}{'mapToTagName'}) {
-            my $mappedName = $tags{$tagName}{'mapToTagName'};
+        if ($tags{$tagName}{mapToTagName}) {
+            my $mappedName = $tags{$tagName}{mapToTagName};
             printConstructorSignature($F, $mappedName, $mappedName . "To" . $tagName, "tagName");
-            printConstructorInterior($F, $mappedName, $tags{$mappedName}{'interfaceName'}, "QualifiedName(tagName.prefix(), ${mappedName}Tag.localName(), tagName.namespaceURI())");
+            printConstructorInterior($F, $mappedName, $tags{$mappedName}{interfaceName}, "QualifiedName(tagName.prefix(), ${mappedName}Tag.localName(), tagName.namespaceURI())");
         }
     }
 
-    print F "#endif\n" if $parameters{'guardFactoryWith'};
+    print F "#endif\n" if $parameters{guardFactoryWith};
 }
 
 sub printFunctionInits
@@ -346,14 +353,14 @@ sub printFunctionInits
 
     for my $tagName (sort keys %tagConstructorMap) {
 
-        my $conditional = $tags{$tagName}{"conditional"};
+        my $conditional = $tags{$tagName}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n";
         }
 
-        if ($tags{$tagName}{'mapToTagName'}) {
-            print F "    addTag(${tagName}Tag, $tags{$tagName}{'mapToTagName'}To${tagName}Constructor);\n";
+        if ($tags{$tagName}{mapToTagName}) {
+            print F "    addTag(${tagName}Tag, $tags{$tagName}{mapToTagName}To${tagName}Constructor);\n";
         } else {
             print F "    addTag(${tagName}Tag, $tagConstructorMap{$tagName}Constructor);\n";
         }
@@ -368,9 +375,7 @@ sub svgCapitalizationHacks
 {
     my $name = shift;
 
-    if ($name =~ /^fe(.+)$/) {
-        $name = "FE" . ucfirst $1;
-    }
+    $name = "FE" . ucfirst $1 if $name =~ /^fe(.+)$/;
 
     return $name;
 }
@@ -379,7 +384,7 @@ sub upperCaseName
 {
     my $name = shift;
     
-    $name = svgCapitalizationHacks($name) if ($parameters{'namespace'} eq "SVG");
+    $name = svgCapitalizationHacks($name) if ($parameters{namespace} eq "SVG");
 
     while ($name =~ /^(.*?)_(.*)/) {
         $name = $1 . ucfirst $2;
@@ -392,10 +397,11 @@ sub printLicenseHeader
 {
     my $F = shift;
     print F "/*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -416,10 +422,9 @@ sub printLicenseHeader
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 ";
 }
 
@@ -428,16 +433,16 @@ sub printNamesHeaderFile
     my ($headerPath) = shift;
     my $F;
     open F, ">$headerPath";
-    
+
     printLicenseHeader($F);
-    print F "#ifndef DOM_$parameters{'namespace'}NAMES_H\n";
-    print F "#define DOM_$parameters{'namespace'}NAMES_H\n\n";
+    print F "#ifndef DOM_$parameters{namespace}NAMES_H\n";
+    print F "#define DOM_$parameters{namespace}NAMES_H\n\n";
     print F "#include \"QualifiedName.h\"\n\n";
-    
-    print F "namespace WebCore {\n\n namespace $parameters{'namespace'}Names {\n\n";
-    
-    my $lowerNamespace = lc($parameters{'namespacePrefix'});
-    print F "#ifndef DOM_$parameters{'namespace'}NAMES_HIDE_GLOBALS\n";
+
+    print F "namespace WebCore {\n\n namespace $parameters{namespace}Names {\n\n";
+
+    my $lowerNamespace = lc($parameters{namespacePrefix});
+    print F "#ifndef DOM_$parameters{namespace}NAMES_HIDE_GLOBALS\n";
     print F "// Namespace\n";
     print F "extern const WebCore::AtomicString ${lowerNamespace}NamespaceURI;\n\n";
 
@@ -451,19 +456,19 @@ sub printNamesHeaderFile
         printMacros($F, "extern const WebCore::QualifiedName", "Attr", \%attrs);
     }
     print F "#endif\n\n";
-    
+
     if (keys %tags) {
-        print F "WebCore::QualifiedName** get$parameters{'namespace'}Tags(size_t* size);\n";
+        print F "WebCore::QualifiedName** get$parameters{namespace}Tags(size_t* size);\n";
     }
 
     if (keys %attrs) {
-        print F "WebCore::QualifiedName** get$parameters{'namespace'}Attrs(size_t* size);\n";
+        print F "WebCore::QualifiedName** get$parameters{namespace}Attrs(size_t* size);\n";
     }
-    
+
     print F "\nvoid init();\n\n";
     print F "} }\n\n";
     print F "#endif\n\n";
-    
+
     close F;
 }
 
@@ -475,25 +480,25 @@ sub printNamesCppFile
     
     printLicenseHeader($F);
     
-    my $lowerNamespace = lc($parameters{'namespacePrefix'});
+    my $lowerNamespace = lc($parameters{namespacePrefix});
 
 print F "#include \"config.h\"\n";
 
 print F "#ifdef SKIP_STATIC_CONSTRUCTORS_ON_GCC\n";
-print F "#define DOM_$parameters{'namespace'}NAMES_HIDE_GLOBALS 1\n";
+print F "#define DOM_$parameters{namespace}NAMES_HIDE_GLOBALS 1\n";
 print F "#else\n";
 print F "#define QNAME_DEFAULT_CONSTRUCTOR 1\n";
 print F "#endif\n\n";
 
 
-print F "#include \"$parameters{'namespace'}Names.h\"\n\n";
+print F "#include \"$parameters{namespace}Names.h\"\n\n";
 print F "#include \"StaticConstructors.h\"\n";
 
-print F "namespace WebCore {\n\n namespace $parameters{'namespace'}Names {
+print F "namespace WebCore {\n\n namespace $parameters{namespace}Names {
 
 using namespace WebCore;
 
-DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{'namespaceURI'}\")
+DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{namespaceURI}\")
 ";
 
     if (keys %tags) {
@@ -502,14 +507,14 @@ DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{'namesp
             print F "DEFINE_GLOBAL(QualifiedName, ", $name, "Tag, nullAtom, \"$name\", ${lowerNamespace}NamespaceURI);\n";
         }
         
-        print F "\n\nWebCore::QualifiedName** get$parameters{'namespace'}Tags(size_t* size)\n";
-        print F "{\n    static WebCore::QualifiedName* $parameters{'namespace'}Tags[] = {\n";
+        print F "\n\nWebCore::QualifiedName** get$parameters{namespace}Tags(size_t* size)\n";
+        print F "{\n    static WebCore::QualifiedName* $parameters{namespace}Tags[] = {\n";
         for my $name (sort keys %tags) {
             print F "        (WebCore::QualifiedName*)&${name}Tag,\n";
         }
         print F "    };\n";
         print F "    *size = ", scalar(keys %tags), ";\n";
-        print F "    return $parameters{'namespace'}Tags;\n";
+        print F "    return $parameters{namespace}Tags;\n";
         print F "}\n";
     }
 
@@ -518,14 +523,14 @@ DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{'namesp
         for my $name (sort keys %attrs) {
             print F "DEFINE_GLOBAL(QualifiedName, ", $name, "Attr, nullAtom, \"$name\", ${lowerNamespace}NamespaceURI);\n";
         }
-        print F "\n\nWebCore::QualifiedName** get$parameters{'namespace'}Attrs(size_t* size)\n";
-        print F "{\n    static WebCore::QualifiedName* $parameters{'namespace'}Attr[] = {\n";
+        print F "\n\nWebCore::QualifiedName** get$parameters{namespace}Attrs(size_t* size)\n";
+        print F "{\n    static WebCore::QualifiedName* $parameters{namespace}Attr[] = {\n";
         for my $name (sort keys %attrs) {
             print F "        (WebCore::QualifiedName*)&${name}Attr,\n";
         }
         print F "    };\n";
         print F "    *size = ", scalar(keys %attrs), ";\n";
-        print F "    return $parameters{'namespace'}Attr;\n";
+        print F "    return $parameters{namespace}Attr;\n";
         print F "}\n";
     }
 
@@ -549,16 +554,16 @@ print F "\nvoid init()
     AtomicString::init();
 ";
     
-    print(F "    AtomicString ${lowerNamespace}NS(\"$parameters{'namespaceURI'}\");\n\n");
+    print(F "    AtomicString ${lowerNamespace}NS(\"$parameters{namespaceURI}\");\n\n");
 
     print(F "    // Namespace\n");
     print(F "    new ((void*)&${lowerNamespace}NamespaceURI) AtomicString(${lowerNamespace}NS);\n\n");
     if (keys %tags) {
-        my $tagsNamespace = $parameters{'tagsNullNamespace'} ? "nullAtom" : "${lowerNamespace}NS";
+        my $tagsNamespace = $parameters{tagsNullNamespace} ? "nullAtom" : "${lowerNamespace}NS";
         printDefinitions($F, \%tags, "tags", $tagsNamespace);
     }
     if (keys %attrs) {
-        my $attrsNamespace = $parameters{'attrsNullNamespace'} ? "nullAtom" : "${lowerNamespace}NS";
+        my $attrsNamespace = $parameters{attrsNullNamespace} ? "nullAtom" : "${lowerNamespace}NS";
         printDefinitions($F, \%attrs, "attributes", $attrsNamespace);
     }
 
@@ -572,7 +577,7 @@ sub printJSElementIncludes
 
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
-        my $JSInterfaceName = $tags{$tagName}{"JSInterfaceName"};
+        my $JSInterfaceName = $tags{$tagName}{JSInterfaceName};
         next if defined($tagsSeen{$JSInterfaceName}) || usesDefaultJSWrapper($tagName);
         $tagsSeen{$JSInterfaceName} = 1;
 
@@ -586,7 +591,7 @@ sub printElementIncludes
 
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
-        my $interfaceName = $tags{$tagName}{"interfaceName"};
+        my $interfaceName = $tags{$tagName}{interfaceName};
         next if defined($tagsSeen{$interfaceName});
         $tagsSeen{$interfaceName} = 1;
 
@@ -604,7 +609,7 @@ sub printDefinitionStrings
 
     my %names = %$namesRef;
     for my $name (sort keys %$namesRef) {
-        next if (!$parameters{'exportStrings'} and !$names{$name}{"exportString"});
+        next if (!$parameters{exportStrings} and !$names{$name}{exportString});
 
         my $realName = $name;
         $realName =~ s/_/-/g;
@@ -625,7 +630,7 @@ sub printDefinitions
 
     my %names = %$namesRef;
     for my $name (sort keys %$namesRef) {
-        next if ($parameters{'exportStrings'} or $names{$name}{"exportString"});
+        next if ($parameters{exportStrings} or $names{$name}{exportString});
 
         my $realName = $name;
         $realName =~ s/_/-/g;
@@ -651,39 +656,31 @@ printLicenseHeader($F);
 
 print F <<END
 #include "config.h"
-#include "$parameters{'namespace'}ElementFactory.h"
-
-#include "$parameters{'namespace'}Names.h"
-#if ENABLE(DASHBOARD_SUPPORT)
-#include "Document.h"
-#include "Settings.h"
-#endif
+#include "$parameters{namespace}ElementFactory.h"
 
+#include "$parameters{namespace}Names.h"
 END
 ;
 
-if ($parameters{'namespace'} eq "HTML") {
-    print F "#include \"HTMLFormElement.h\"\n";
-}
-
 printElementIncludes($F);
 
 print F <<END
 #include <wtf/HashMap.h>
 
+#if ENABLE(DASHBOARD_SUPPORT)
+#include "Document.h"
+#include "Settings.h"
+#endif
+
 namespace WebCore {
 
-using namespace $parameters{'namespace'}Names;
+using namespace $parameters{namespace}Names;
 
 END
 ;
 
-print F "typedef PassRefPtr<$parameters{'namespace'}Element> (*ConstructorFunction)(const QualifiedName&, Document*";
-
-if ($parameters{'namespace'} eq "HTML") {
-    print F ", HTMLFormElement*";
-}
-
+print F "typedef PassRefPtr<$parameters{namespace}Element> (*ConstructorFunction)(const QualifiedName&, Document*";
+print F ", HTMLFormElement*" if $parameters{namespace} eq "HTML";
 print F ", bool createdByParser);\n";
 print F <<END
 typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
@@ -697,7 +694,7 @@ my %tagConstructorMap = buildConstructorMap();
 
 printConstructors($F, \%tagConstructorMap);
 
-print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
 print F <<END
 static void addTag(const QualifiedName& tag, ConstructorFunction func)
@@ -705,10 +702,10 @@ static void addTag(const QualifiedName& tag, ConstructorFunction func)
     gFunctionMap->set(tag.localName().impl(), func);
 }
 
-static inline void createFunctionMapIfNecessary()
+static void createFunctionMap()
 {
-    if (gFunctionMap)
-        return;
+    ASSERT(!gFunctionMap);
+
     // Create the table.
     gFunctionMap = new FunctionMap;
     
@@ -719,30 +716,25 @@ END
 printFunctionInits($F, \%tagConstructorMap);
 
 print F "}\n";
-print F "#endif\n" if $parameters{'guardFactoryWith'};
-
-print F "\nPassRefPtr<$parameters{'namespace'}Element> $parameters{'namespace'}ElementFactory::create$parameters{'namespace'}Element(const QualifiedName& qName, Document* doc";
-
-if ($parameters{"namespace"} eq "HTML") {
-    print F ", HTMLFormElement* formElement";
-}
+print F "#endif\n" if $parameters{guardFactoryWith};
 
+print F "\nPassRefPtr<$parameters{namespace}Element> $parameters{namespace}ElementFactory::create$parameters{namespace}Element(const QualifiedName& qName, Document* document";
+print F ", HTMLFormElement* formElement" if $parameters{namespace} eq "HTML";
 print F ", bool createdByParser)\n{\n";
 
-print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
 print F <<END
-    // Don't make elements without a document
-    if (!doc)
+    if (!document)
         return 0;
 
 END
 ;
 
-if ($parameters{'namespace'} ne "HTML") {
+if ($parameters{namespace} ne "HTML") {
 print F <<END
 #if ENABLE(DASHBOARD_SUPPORT)
-    Settings* settings = doc->settings();
+    Settings* settings = document->settings();
     if (settings && settings->usesDashboardBackwardCompatibilityMode())
         return 0;
 #endif
@@ -752,21 +744,21 @@ END
 }
 
 print F <<END
-    createFunctionMapIfNecessary();
-    ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
-    if (func)
+    if (!gFunctionMap)
+        createFunctionMap();
+    if (ConstructorFunction function = gFunctionMap->get(qName.localName().impl()))
 END
 ;
 
-if ($parameters{"namespace"} eq "HTML") {
-    print F "        return func(qName, doc, formElement, createdByParser);\n";
+if ($parameters{namespace} eq "HTML") {
+    print F "        return function(qName, document, formElement, createdByParser);\n";
 } else {
-    print F "        return func(qName, doc, createdByParser);\n";
+    print F "        return function(qName, document, createdByParser);\n";
 }
 
-print F "    return new $parameters{'namespace'}Element(qName, doc);\n";
+print F "    return $parameters{namespace}Element::create(qName, document);\n";
 
-if ($parameters{'guardFactoryWith'}) {
+if ($parameters{guardFactoryWith}) {
 
 print F <<END
 #else
@@ -797,8 +789,8 @@ sub printFactoryHeaderFile
     printLicenseHeader($F);
 
     print F<<END
-#ifndef $parameters{'namespace'}ElementFactory_h
-#define $parameters{'namespace'}ElementFactory_h
+#ifndef $parameters{namespace}ElementFactory_h
+#define $parameters{namespace}ElementFactory_h
 
 #include <wtf/PassRefPtr.h>
 
@@ -811,35 +803,29 @@ namespace WebCore {
 
 namespace WebCore {
 
-    class $parameters{'namespace'}Element;
+    class $parameters{namespace}Element;
 END
 ;
 
-if ($parameters{'namespace'} eq "HTML") {
-    print F "     class HTMLFormElement;\n";
-}
+print F "     class HTMLFormElement;\n" if $parameters{namespace} eq "HTML";
 
 print F<<END
     // The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense
     // elements. In a compound document world, the generic createElement function (will end up being virtual) will be called.
-    class $parameters{'namespace'}ElementFactory {
+    class $parameters{namespace}ElementFactory {
     public:
         PassRefPtr<Element> createElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
 END
 ;
-print F "        static PassRefPtr<$parameters{'namespace'}Element> create$parameters{'namespace'}Element(const WebCore::QualifiedName&, WebCore::Document*";
-
-if ($parameters{'namespace'} eq "HTML") {
-    print F ", HTMLFormElement* = 0";
-}
-
+print F "        static PassRefPtr<$parameters{namespace}Element> create$parameters{namespace}Element(const WebCore::QualifiedName&, WebCore::Document*";
+print F ", HTMLFormElement* = 0" if $parameters{namespace} eq "HTML";
 print F ", bool /*createdByParser*/ = true);\n";
 
 printf F<<END
     };
 }
 
-#endif // $parameters{'namespace'}ElementFactory_h
+#endif // $parameters{namespace}ElementFactory_h
 
 END
 ;
@@ -854,7 +840,7 @@ sub usesDefaultJSWrapper
     my $name = shift;
 
     # A tag reuses the default wrapper if its JSInterfaceName matches the default namespace Element.
-    return $tags{$name}{'JSInterfaceName'} eq $parameters{"namespace"} . "Element" || $tags{$name}{'JSInterfaceName'} eq "HTMLNoScriptElement";
+    return $tags{$name}{JSInterfaceName} eq $parameters{namespace} . "Element" || $tags{$name}{JSInterfaceName} eq "HTMLNoScriptElement";
 }
 
 sub printWrapperFunctions
@@ -864,11 +850,11 @@ sub printWrapperFunctions
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
         # Avoid defining the same wrapper method twice.
-        my $JSInterfaceName = $tags{$tagName}{"JSInterfaceName"};
+        my $JSInterfaceName = $tags{$tagName}{JSInterfaceName};
         next if defined($tagsSeen{$JSInterfaceName}) || usesDefaultJSWrapper($tagName);
         $tagsSeen{$JSInterfaceName} = 1;
 
-        my $conditional = $tags{$tagName}{"conditional"};
+        my $conditional = $tags{$tagName}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n\n";
@@ -876,12 +862,12 @@ sub printWrapperFunctions
 
         # Hack for the media tags
         # FIXME: This should have been done via a CustomWrapper attribute and a separate *Custom file.
-        if ($tags{$tagName}{"wrapperOnlyIfMediaIsAvailable"}) {
+        if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
             print F <<END
-static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
+static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {
     if (!MediaPlayer::isAvailable())
-        return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{'namespace'}Element, element.get());
+        return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{namespace}Element, element.get());
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
 }
 
@@ -889,7 +875,7 @@ END
 ;
         } else {
             print F <<END
-static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
+static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
 }
@@ -897,6 +883,7 @@ static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObjec
 END
 ;
         }
+
         if ($conditional) {
             print F "#endif\n\n";
         }
@@ -913,13 +900,13 @@ sub printWrapperFactoryCppFile
 
     print F "#include \"config.h\"\n\n";
 
-    print F "#if $parameters{'guardFactoryWith'}\n\n" if $parameters{'guardFactoryWith'};
+    print F "#if $parameters{guardFactoryWith}\n\n" if $parameters{guardFactoryWith};
 
-    print F "#include \"JS$parameters{'namespace'}ElementWrapperFactory.h\"\n";
+    print F "#include \"JS$parameters{namespace}ElementWrapperFactory.h\"\n";
 
     printJSElementIncludes($F);
 
-    print F "\n#include \"$parameters{'namespace'}Names.h\"\n\n";
+    print F "\n#include \"$parameters{namespace}Names.h\"\n\n";
 
     printElementIncludes($F);
 
@@ -930,9 +917,9 @@ using namespace JSC;
 
 namespace WebCore {
 
-using namespace $parameters{'namespace'}Names;
+using namespace $parameters{namespace}Names;
 
-typedef JSNode* (*Create$parameters{'namespace'}ElementWrapperFunction)(ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{'namespace'}Element>);
+typedef JSNode* (*Create$parameters{namespace}ElementWrapperFunction)(ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{namespace}Element>);
 
 END
 ;
@@ -940,9 +927,9 @@ END
     printWrapperFunctions($F);
 
     print F <<END
-JSNode* createJS$parameters{'namespace'}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
+JSNode* createJS$parameters{namespace}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {   
-    typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{'namespace'}ElementWrapperFunction> FunctionMap;
+    typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{namespace}ElementWrapperFunction> FunctionMap;
     DEFINE_STATIC_LOCAL(FunctionMap, map, ());
     if (map.isEmpty()) {
 END
@@ -952,13 +939,13 @@ END
         # Do not add the name to the map if it does not have a JS wrapper constructor or uses the default wrapper.
         next if usesDefaultJSWrapper($tag, \%tags);
 
-        my $conditional = $tags{$tag}{"conditional"};
+        my $conditional = $tags{$tag}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n";
         }
 
-        my $ucTag = $tags{$tag}{"JSInterfaceName"};
+        my $ucTag = $tags{$tag}{JSInterfaceName};
         print F "       map.set(${tag}Tag.localName().impl(), create${ucTag}Wrapper);\n";
 
         if ($conditional) {
@@ -968,10 +955,10 @@ END
 
     print F <<END
     }
-    Create$parameters{'namespace'}ElementWrapperFunction createWrapperFunction = map.get(element->localName().impl());
+    Create$parameters{namespace}ElementWrapperFunction createWrapperFunction = map.get(element->localName().impl());
     if (createWrapperFunction)
         return createWrapperFunction(exec, globalObject, element);
-    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{'namespace'}Element, element.get());
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{namespace}Element, element.get());
 }
 
 }
@@ -979,7 +966,7 @@ END
 END
 ;
 
-    print F "#endif\n" if $parameters{'guardFactoryWith'};
+    print F "#endif\n" if $parameters{guardFactoryWith};
 
     close F;
 }
@@ -992,10 +979,10 @@ sub printWrapperFactoryHeaderFile
 
     printLicenseHeader($F);
 
-    print F "#ifndef JS$parameters{'namespace'}ElementWrapperFactory_h\n";
-    print F "#define JS$parameters{'namespace'}ElementWrapperFactory_h\n\n";
+    print F "#ifndef JS$parameters{namespace}ElementWrapperFactory_h\n";
+    print F "#define JS$parameters{namespace}ElementWrapperFactory_h\n\n";
 
-    print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+    print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
     print F <<END
 #include <wtf/Forward.h>
@@ -1008,18 +995,18 @@ namespace WebCore {
 
     class JSNode;
     class JSDOMGlobalObject;
-    class $parameters{'namespace'}Element;
+    class $parameters{namespace}Element;
 
-    JSNode* createJS$parameters{'namespace'}Wrapper(JSC::ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{'namespace'}Element>);
+    JSNode* createJS$parameters{namespace}Wrapper(JSC::ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{namespace}Element>);
 
 }
  
 END
 ;
 
-    print F "#endif // $parameters{'guardFactoryWith'}\n\n" if $parameters{'guardFactoryWith'};
+    print F "#endif // $parameters{guardFactoryWith}\n\n" if $parameters{guardFactoryWith};
 
-    print F "#endif // JS$parameters{'namespace'}ElementWrapperFactory_h\n";
+    print F "#endif // JS$parameters{namespace}ElementWrapperFactory_h\n";
 
     close F;
 }
diff --git a/WebCore/editing/ApplyStyleCommand.cpp b/WebCore/editing/ApplyStyleCommand.cpp
index 86ef214..83d0bd3 100644
--- a/WebCore/editing/ApplyStyleCommand.cpp
+++ b/WebCore/editing/ApplyStyleCommand.cpp
@@ -58,6 +58,8 @@ public:
     String cssStyle() const { return m_cssStyle; }
     bool applyBold() const { return m_applyBold; }
     bool applyItalic() const { return m_applyItalic; }
+    bool applyUnderline() const { return m_applyUnderline; }
+    bool applyLineThrough() const { return m_applyLineThrough; }
     bool applySubscript() const { return m_applySubscript; }
     bool applySuperscript() const { return m_applySuperscript; }
     bool applyFontColor() const { return m_applyFontColor.length() > 0; }
@@ -70,12 +72,14 @@ public:
 
 private:
     void init(PassRefPtr<CSSStyleDeclaration>, const Position&);
-    bool checkForLegacyHTMLStyleChange(const CSSProperty*);
-    static bool currentlyHasStyle(const Position&, const CSSProperty*);
-    
+    void reconcileTextDecorationProperties(CSSMutableStyleDeclaration*);
+    void extractTextStyles(CSSMutableStyleDeclaration*);
+
     String m_cssStyle;
     bool m_applyBold;
     bool m_applyItalic;
+    bool m_applyUnderline;
+    bool m_applyLineThrough;
     bool m_applySubscript;
     bool m_applySuperscript;
     String m_applyFontColor;
@@ -87,6 +91,8 @@ private:
 StyleChange::StyleChange(CSSStyleDeclaration* style, const Position& position)
     : m_applyBold(false)
     , m_applyItalic(false)
+    , m_applyUnderline(false)
+    , m_applyLineThrough(false)
     , m_applySubscript(false)
     , m_applySuperscript(false)
 {
@@ -99,103 +105,135 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position& po
     if (!document || !document->frame())
         return;
 
-    bool useHTMLFormattingTags = !document->frame()->editor()->shouldStyleWithCSS();
-    RefPtr<CSSMutableStyleDeclaration> mutableStyle = style->makeMutable();
-    // We shouldn't have both text-decoration and -webkit-text-decorations-in-effect because that wouldn't make sense.
-    ASSERT(!mutableStyle->getPropertyCSSValue(CSSPropertyTextDecoration) || !mutableStyle->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect));
-    String styleText("");
-    bool addedDirection = false;
-    CSSMutableStyleDeclaration::const_iterator end = mutableStyle->end();
-    for (CSSMutableStyleDeclaration::const_iterator it = mutableStyle->begin(); it != end; ++it) {
-        const CSSProperty *property = &*it;
-
-        // If position is empty or the position passed in already has the 
-        // style, just move on.
-        if (position.isNotNull() && currentlyHasStyle(position, property))
-            continue;
-        
-        // Changing the whitespace style in a tab span would collapse the tab into a space.
-        if (property->id() == CSSPropertyWhiteSpace && (isTabSpanTextNode(position.node()) || isTabSpanNode((position.node()))))
-            continue;
-        
-        // If needed, figure out if this change is a legacy HTML style change.
-        if (useHTMLFormattingTags && checkForLegacyHTMLStyleChange(property))
-            continue;
+    RefPtr<CSSComputedStyleDeclaration> computedStyle = position.computedStyle();
+    RefPtr<CSSMutableStyleDeclaration> mutableStyle = getPropertiesNotInComputedStyle(style.get(), computedStyle.get());
 
-        if (property->id() == CSSPropertyDirection) {
-            if (addedDirection)
-                continue;
-            addedDirection = true;
-        }
+    reconcileTextDecorationProperties(mutableStyle.get());
+    if (!document->frame()->editor()->shouldStyleWithCSS())
+        extractTextStyles(mutableStyle.get());
 
-        // Add this property
-        if (property->id() == CSSPropertyTextDecoration || property->id() == CSSPropertyWebkitTextDecorationsInEffect) {
-            // Always use text-decoration because -webkit-text-decoration-in-effect is internal.
-            CSSProperty alteredProperty(CSSPropertyTextDecoration, property->value(), property->isImportant());
-            // We don't add "text-decoration: none" because it doesn't override the existing text decorations; i.e. redundant
-            if (!equalIgnoringCase(alteredProperty.value()->cssText(), "none"))
-                styleText += alteredProperty.cssText();
-        } else
-            styleText += property->cssText();
+    // Changing the whitespace style in a tab span would collapse the tab into a space.
+    if (isTabSpanTextNode(position.node()) || isTabSpanNode((position.node())))
+        mutableStyle->removeProperty(CSSPropertyWhiteSpace);
 
-        if (!addedDirection && property->id() == CSSPropertyUnicodeBidi) {
-            styleText += "direction: " + style->getPropertyValue(CSSPropertyDirection) + "; ";
-            addedDirection = true;
-        }
-    }
+    // If unicode-bidi is present in mutableStyle and direction is not, then add direction to mutableStyle.
+    // FIXME: Shouldn't this be done in getPropertiesNotInComputedStyle?
+    if (mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi) && !style->getPropertyCSSValue(CSSPropertyDirection))
+        mutableStyle->setProperty(CSSPropertyDirection, style->getPropertyValue(CSSPropertyDirection));
 
     // Save the result for later
-    m_cssStyle = styleText.stripWhiteSpace();
+    m_cssStyle = mutableStyle->cssText().stripWhiteSpace();
 }
 
-// This function is the mapping from CSS styles to styling tags (like font-weight: bold to <b>)
-bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty* property)
+void StyleChange::reconcileTextDecorationProperties(CSSMutableStyleDeclaration* style)
+{    
+    RefPtr<CSSValue> textDecorationsInEffect = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(CSSPropertyTextDecoration);
+    // We shouldn't have both text-decoration and -webkit-text-decorations-in-effect because that wouldn't make sense.
+    ASSERT(!textDecorationsInEffect || !textDecoration);
+    if (textDecorationsInEffect) {
+        style->setProperty(CSSPropertyTextDecoration, textDecorationsInEffect->cssText());
+        style->removeProperty(CSSPropertyWebkitTextDecorationsInEffect);
+        textDecoration = textDecorationsInEffect;
+    }
+
+    // If text-decration is set to "none", remove the property because we don't want to add redundant "text-decoration: none".
+    if (textDecoration && !textDecoration->isValueList())
+        style->removeProperty(CSSPropertyTextDecoration);
+}
+
+static int getIdentifierValue(CSSMutableStyleDeclaration* style, int propertyID)
 {
-    if (!property || !property->value())
-        return false;
-    
-    String valueText(property->value()->cssText());
-    switch (property->id()) {
-        case CSSPropertyFontWeight:
-            if (equalIgnoringCase(valueText, "bold")) {
-                m_applyBold = true;
-                return true;
-            }
-            break;
-        case CSSPropertyVerticalAlign:
-            if (equalIgnoringCase(valueText, "sub")) {
-                m_applySubscript = true;
-                return true;
-            }
-            if (equalIgnoringCase(valueText, "super")) {
-                m_applySuperscript = true;
-                return true;
-            }
-            break;
-        case CSSPropertyFontStyle:
-            if (equalIgnoringCase(valueText, "italic") || equalIgnoringCase(valueText, "oblique")) {
-                m_applyItalic = true;
-                return true;
-            }
-            break;
-        case CSSPropertyColor: {
-            RGBA32 rgba = 0;
-            CSSParser::parseColor(rgba, valueText);
-            Color color(rgba);
-            m_applyFontColor = color.name();
-            return true;
-        }
-        case CSSPropertyFontFamily:
-            m_applyFontFace = valueText;
-            return true;
-        case CSSPropertyFontSize:
-            if (property->value()->cssValueType() == CSSValue::CSS_PRIMITIVE_VALUE) {
-                CSSPrimitiveValue *value = static_cast<CSSPrimitiveValue *>(property->value());
+    if (!style)
+        return 0;
+
+    RefPtr<CSSValue> value = style->getPropertyCSSValue(propertyID);
+    if (!value || !value->isPrimitiveValue())
+        return 0;
+
+    return static_cast<CSSPrimitiveValue*>(value.get())->getIdent();
+}
 
-                if (value->primitiveType() < CSSPrimitiveValue::CSS_PX || value->primitiveType() > CSSPrimitiveValue::CSS_PC)
-                    // Size keyword or relative unit.
-                    return false;
+static void setTextDecorationProperty(CSSMutableStyleDeclaration* style, const CSSValueList* newTextDecoration, int propertyID)
+{
+    if (newTextDecoration->length())
+        style->setProperty(propertyID, newTextDecoration->cssText(), style->getPropertyPriority(propertyID));
+    else {
+        // text-decoration: none is redundant since it does not remove any text decorations.
+        ASSERT(!style->getPropertyPriority(propertyID));
+        style->removeProperty(propertyID);
+    }
+}
 
+void StyleChange::extractTextStyles(CSSMutableStyleDeclaration* style)
+{
+    ASSERT(style);
+
+    if (getIdentifierValue(style, CSSPropertyFontWeight) == CSSValueBold) {
+        style->removeProperty(CSSPropertyFontWeight);
+        m_applyBold = true;
+    }
+
+    int fontStyle = getIdentifierValue(style, CSSPropertyFontStyle);
+    if (fontStyle == CSSValueItalic || fontStyle == CSSValueOblique) {
+        style->removeProperty(CSSPropertyFontStyle);
+        m_applyItalic = true;
+    }
+
+    // Assuming reconcileTextDecorationProperties has been called, there should not be -webkit-text-decorations-in-effect
+    // Furthermore, text-decoration: none has been trimmed so that text-decoration property is always a CSSValueList.
+    if (RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(CSSPropertyTextDecoration)) {
+        ASSERT(textDecoration->isValueList());
+        DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, underline, (CSSPrimitiveValue::createIdentifier(CSSValueUnderline)));
+        DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, lineThrough, (CSSPrimitiveValue::createIdentifier(CSSValueLineThrough)));
+
+        RefPtr<CSSValueList> newTextDecoration = static_cast<CSSValueList*>(textDecoration.get())->copy();
+        if (newTextDecoration->removeAll(underline.get()))
+            m_applyUnderline = true;
+        if (newTextDecoration->removeAll(lineThrough.get()))
+            m_applyLineThrough = true;
+
+        // If trimTextDecorations, delete underline and line-through
+        setTextDecorationProperty(style, newTextDecoration.get(), CSSPropertyTextDecoration);
+    }
+
+    int verticalAlign = getIdentifierValue(style, CSSPropertyVerticalAlign);
+    switch (verticalAlign) {
+    case CSSValueSub:
+        style->removeProperty(CSSPropertyVerticalAlign);
+        m_applySubscript = true;
+        break;
+    case CSSValueSuper:
+        style->removeProperty(CSSPropertyVerticalAlign);
+        m_applySuperscript = true;
+        break;
+    }
+
+    if (RefPtr<CSSValue> colorValue = style->getPropertyCSSValue(CSSPropertyColor)) {
+        ASSERT(colorValue->isPrimitiveValue());
+        CSSPrimitiveValue* primitiveColor = static_cast<CSSPrimitiveValue*>(colorValue.get());
+        RGBA32 rgba;
+        if (primitiveColor->primitiveType() != CSSPrimitiveValue::CSS_RGBCOLOR) {
+            CSSParser::parseColor(rgba, colorValue->cssText());
+            // Need to take care of named color such as green and black
+            // This code should be removed after https://bugs.webkit.org/show_bug.cgi?id=28282 is fixed.
+        } else
+            rgba = primitiveColor->getRGBA32Value();
+        m_applyFontColor = Color(rgba).name();
+        style->removeProperty(CSSPropertyColor);
+    }
+
+    m_applyFontFace = style->getPropertyValue(CSSPropertyFontFamily);
+    style->removeProperty(CSSPropertyFontFamily);
+
+    if (RefPtr<CSSValue> fontSize = style->getPropertyCSSValue(CSSPropertyFontSize)) {
+        if (!fontSize->isPrimitiveValue())
+            style->removeProperty(CSSPropertyFontSize); // Can't make sense of the number. Put no font size.
+        else {
+            CSSPrimitiveValue* value = static_cast<CSSPrimitiveValue*>(fontSize.get());
+
+            // Only accept absolute scale
+            if (value->primitiveType() >= CSSPrimitiveValue::CSS_PX && value->primitiveType() <= CSSPrimitiveValue::CSS_PC) {
                 float number = value->getFloatValue(CSSPrimitiveValue::CSS_PX);
                 if (number <= 9)
                     m_applyFontSize = "1";
@@ -211,34 +249,12 @@ bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty* property)
                     m_applyFontSize = "6";
                 else
                     m_applyFontSize = "7";
-                // Huge quirk in Microsft Entourage is that they understand CSS font-size, but also write 
-                // out legacy 1-7 values in font tags (I guess for mailers that are not CSS-savvy at all, 
-                // like Eudora). Yes, they write out *both*. We need to write out both as well. Return false.
-                return false; 
-            }
-            else {
-                // Can't make sense of the number. Put no font size.
-                return true;
             }
+            // Huge quirk in Microsft Entourage is that they understand CSS font-size, but also write 
+            // out legacy 1-7 values in font tags (I guess for mailers that are not CSS-savvy at all, 
+            // like Eudora). Yes, they write out *both*. We need to write out both as well.
+        }
     }
-    return false;
-}
-
-bool StyleChange::currentlyHasStyle(const Position &pos, const CSSProperty *property)
-{
-    ASSERT(pos.isNotNull());
-    RefPtr<CSSComputedStyleDeclaration> style = pos.computedStyle();
-    RefPtr<CSSValue> value;
-    if (property->id() == CSSPropertyFontSize)
-        value = style->getFontSizeCSSValuePreferringKeyword();
-    // We need to use -webkit-text-decorations-in-effect to take care of text decorations set by u, s, and strike
-    else if (property->id() == CSSPropertyTextDecoration)
-        value = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
-    else
-        value = style->getPropertyCSSValue(property->id());
-    if (!value)
-        return false;
-    return equalIgnoringCase(value->cssText(), property->value()->cssText());
 }
 
 static String& styleSpanClassString()
@@ -302,7 +318,22 @@ PassRefPtr<HTMLElement> createStyleSpanElement(Document* document)
     styleElement->setAttribute(classAttr, styleSpanClassString());
     return styleElement.release();
 }
-    
+
+static void diffTextDecorations(CSSMutableStyleDeclaration* style, int propertID, CSSValue* refTextDecoration)
+{
+    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(propertID);
+    if (!textDecoration || !textDecoration->isValueList() || !refTextDecoration || !refTextDecoration->isValueList())
+        return;
+
+    RefPtr<CSSValueList> newTextDecoration = static_cast<CSSValueList*>(textDecoration.get())->copy();
+    CSSValueList* valuesInRefTextDecoration = static_cast<CSSValueList*>(refTextDecoration);
+
+    for (size_t i = 0; i < valuesInRefTextDecoration->length(); i++)
+        newTextDecoration->removeAll(valuesInRefTextDecoration->item(i));
+
+    setTextDecorationProperty(style, newTextDecoration.get(), propertID);
+}
+
 RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDeclaration* style, CSSComputedStyleDeclaration* computedStyle)
 {
     ASSERT(style);
@@ -310,27 +341,9 @@ RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDecla
     RefPtr<CSSMutableStyleDeclaration> result = style->copy();
     computedStyle->diff(result.get());
 
-    // If text decorations in effect is not present in the computed style, then there is nothing to remove from result
-    RefPtr<CSSValue> computedValue = computedStyle->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
-    if (!computedValue || !computedValue->isValueList())
-        return result;
-
-    // Take care of both text-decoration and -webkit-text-decorations-in-effect
-    static const int textDecorationProperties[]={CSSPropertyTextDecoration, CSSPropertyWebkitTextDecorationsInEffect};
-    for (size_t n = 0; n < sizeof(textDecorationProperties)/sizeof(textDecorationProperties[1]); n++) {
-        RefPtr<CSSValue> styleValue = style->getPropertyCSSValue(textDecorationProperties[n]);
-        if (!styleValue || !styleValue->isValueList())
-            continue;
-
-        CSSValueList* desiredValueList = static_cast<CSSValueList*>(styleValue.get());
-        CSSValueList* computedValueList = static_cast<CSSValueList*>(computedValue.get());
-        for (size_t i = 0; i < desiredValueList->length(); i++) {
-            if (!computedValueList->hasValue(desiredValueList->item(i))) {
-                result->removeProperty(textDecorationProperties[n]);
-                break;
-            }
-        }
-    }
+    RefPtr<CSSValue> computedTextDecorationsInEffect = computedStyle->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    diffTextDecorations(result.get(), CSSPropertyTextDecoration, computedTextDecorationsInEffect.get());
+    diffTextDecorations(result.get(), CSSPropertyWebkitTextDecorationsInEffect, computedTextDecorationsInEffect.get());
 
     return result;
 }
@@ -370,7 +383,11 @@ size_t numEditingStyleProperties = sizeof(editingStyleProperties)/sizeof(editing
 PassRefPtr<CSSMutableStyleDeclaration> editingStyleAtPosition(Position pos, ShouldIncludeTypingStyle shouldIncludeTypingStyle)
 {
     RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = pos.computedStyle();
-    RefPtr<CSSMutableStyleDeclaration> style = computedStyleAtPosition->copyPropertiesInSet(editingStyleProperties, numEditingStyleProperties);
+    RefPtr<CSSMutableStyleDeclaration> style;
+    if (!computedStyleAtPosition)
+        style = CSSMutableStyleDeclaration::create();
+    else
+        style = computedStyleAtPosition->copyPropertiesInSet(editingStyleProperties, numEditingStyleProperties);
 
     if (style && pos.node() && pos.node()->computedStyle()) {
         RenderStyle* renderStyle = pos.node()->computedStyle();
@@ -895,9 +912,9 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
     if (unicodeBidi) {
         // Avoid removing the dir attribute and the unicode-bidi and direction properties from the unsplit ancestors.
         if (startUnsplitAncestor && nodeFullySelected(startUnsplitAncestor, removeStart, end))
-            embeddingRemoveStart = positionAfterNode(startUnsplitAncestor);
+            embeddingRemoveStart = positionInParentAfterNode(startUnsplitAncestor);
         if (endUnsplitAncestor && nodeFullySelected(endUnsplitAncestor, removeStart, end))
-            embeddingRemoveEnd = positionBeforeNode(endUnsplitAncestor).downstream();
+            embeddingRemoveEnd = positionInParentBeforeNode(endUnsplitAncestor).downstream();
     }
 
     if (embeddingRemoveStart != removeStart || embeddingRemoveEnd != end) {
@@ -947,7 +964,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
                 if (ancestorUnicodeBidi) {
                     ASSERT(ancestorUnicodeBidi->isPrimitiveValue());
                     if (static_cast<CSSPrimitiveValue*>(ancestorUnicodeBidi.get())->getIdent() == CSSValueEmbed) {
-                        embeddingApplyStart = positionAfterNode(n);
+                        embeddingApplyStart = positionInParentAfterNode(n);
                         break;
                     }
                 }
@@ -961,7 +978,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
                 if (ancestorUnicodeBidi) {
                     ASSERT(ancestorUnicodeBidi->isPrimitiveValue());
                     if (static_cast<CSSPrimitiveValue*>(ancestorUnicodeBidi.get())->getIdent() == CSSValueEmbed) {
-                        embeddingApplyEnd = positionBeforeNode(n);
+                        embeddingApplyEnd = positionInParentBeforeNode(n);
                         break;
                     }
                 }
@@ -1300,7 +1317,7 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
         return;
 
     HTMLElement *element = static_cast<HTMLElement *>(node);
-        
+
     StyleChange styleChange(style, Position(element, 0));
     if (styleChange.cssStyle().length()) {
         String cssText = styleChange.cssStyle();
@@ -1309,6 +1326,12 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
             cssText += decl->cssText();
         setNodeAttribute(element, styleAttr, cssText);
     }
+
+    if (styleChange.applyUnderline())
+        surroundNodeRangeWithElement(node, node, createHTMLElement(document(), uTag));
+
+    if (styleChange.applyLineThrough())
+        surroundNodeRangeWithElement(node, node, createHTMLElement(document(), sTag));    
 }
 
 void ApplyStyleCommand::pushDownTextDecorationStyleAroundNode(Node* targetNode, bool forceNegate)
@@ -1360,6 +1383,7 @@ void ApplyStyleCommand::pushDownTextDecorationStyleAtBoundaries(const Position &
     pushDownTextDecorationStyleAroundNode(end.node(), true);
 }
 
+// FIXME: Why does this exist?  Callers should either use lastOffsetForEditing or lastOffsetInNode
 static int maxRangeOffset(Node *n)
 {
     if (n->offsetInCharacters())
@@ -1743,6 +1767,12 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
     if (styleChange.applyItalic())
         surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), iTag));
 
+    if (styleChange.applyUnderline())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), uTag));
+
+    if (styleChange.applyLineThrough())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), sTag));
+
     if (styleChange.applySubscript())
         surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), subTag));
     else if (styleChange.applySuperscript())
diff --git a/WebCore/editing/BreakBlockquoteCommand.cpp b/WebCore/editing/BreakBlockquoteCommand.cpp
index 1ca2d87..2da6047 100644
--- a/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -51,7 +51,16 @@ void BreakBlockquoteCommand::doApply()
     if (endingSelection().isRange())
         deleteSelection(false, false);
     
+    // This is a scenario that should never happen, but we want to
+    // make sure we don't dereference a null pointer below.    
+
+    ASSERT(!endingSelection().isNone());
+    
+    if (endingSelection().isNone())
+        return;
+        
     VisiblePosition visiblePos = endingSelection().visibleStart();
+    
     // pos is a position equivalent to the caret.  We use downstream() so that pos will 
     // be in the first node that we need to move (there are a few exceptions to this, see below).
     Position pos = endingSelection().start().downstream();
diff --git a/WebCore/editing/CompositeEditCommand.cpp b/WebCore/editing/CompositeEditCommand.cpp
index 25f167c..0496a8f 100644
--- a/WebCore/editing/CompositeEditCommand.cpp
+++ b/WebCore/editing/CompositeEditCommand.cpp
@@ -343,13 +343,13 @@ Position CompositeEditCommand::positionOutsideTabSpan(const Position& pos)
     Node* tabSpan = tabSpanNode(pos.node());
     
     if (pos.deprecatedEditingOffset() <= caretMinOffset(pos.node()))
-        return positionBeforeNode(tabSpan);
+        return positionInParentBeforeNode(tabSpan);
         
     if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()))
-        return positionAfterNode(tabSpan);
+        return positionInParentAfterNode(tabSpan);
 
     splitTextNodeContainingElement(static_cast<Text *>(pos.node()), pos.deprecatedEditingOffset());
-    return positionBeforeNode(tabSpan);
+    return positionInParentBeforeNode(tabSpan);
 }
 
 void CompositeEditCommand::insertNodeAtTabSpanPosition(PassRefPtr<Node> node, const Position& pos)
@@ -519,7 +519,7 @@ void CompositeEditCommand::deleteInsignificantText(PassRefPtr<Text> textNode, un
             gapStart = max(gapStart, start);
             gapEnd = min(gapEnd, end);
             if (str.isNull())
-                str = textNode->string()->substring(start, end - start);
+                str = textNode->data().substring(start, end - start);
             // remove text in the gap
             str.remove(gapStart - start - removed, gapLen);
             removed += gapLen;
@@ -890,31 +890,57 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
     Node* emptyListItem = enclosingEmptyListItem(endingSelection().visibleStart());
     if (!emptyListItem)
         return false;
-        
+
     RefPtr<CSSMutableStyleDeclaration> style = editingStyleAtPosition(endingSelection().start(), IncludeTypingStyle);
 
     Node* listNode = emptyListItem->parentNode();
-    
-    if (!listNode->isContentEditable())
+    // FIXME: Can't we do something better when the immediate parent wasn't a list node?
+    if (!listNode
+        || (!listNode->hasTagName(ulTag) && !listNode->hasTagName(olTag))
+        || !listNode->isContentEditable())
         return false;
-    
-    RefPtr<Element> newBlock = isListElement(listNode->parentNode()) ? createListItemElement(document()) : createDefaultParagraphElement(document());
-    
+
+    RefPtr<Element> newBlock = 0;
+    if (Node* blockEnclosingList = listNode->parentNode()) {
+        if (blockEnclosingList->hasTagName(liTag)) { // listNode is inside another list item
+            if (visiblePositionAfterNode(blockEnclosingList) == visiblePositionAfterNode(listNode)) {
+                // If listNode appears at the end of the outer list item, then move listNode outside of this list item
+                // e.g. <ul><li>hello <ul><li><br></li></ul> </li></ul> should become <ul><li>hello</li> <ul><li><br></li></ul> </ul> after this section
+                // If listNode does NOT appear at the end, then we should consider it as a regular paragraph.
+                // e.g. <ul><li> <ul><li><br></li></ul> hello</li></ul> should become <ul><li> <div><br></div> hello</li></ul> at the end
+                splitElement(static_cast<Element*>(blockEnclosingList), listNode);
+                removeNodePreservingChildren(listNode->parentNode());
+                newBlock = createListItemElement(document());
+            }
+            // If listNode does NOT appear at the end of the outer list item, then behave as if in a regular paragraph. 
+        } else if (blockEnclosingList->hasTagName(olTag) || blockEnclosingList->hasTagName(ulTag))
+            newBlock = createListItemElement(document());
+    }
+    if (!newBlock)
+        newBlock = createDefaultParagraphElement(document());
+
     if (emptyListItem->renderer()->nextSibling()) {
+        // If emptyListItem follows another list item, split the list node.
         if (emptyListItem->renderer()->previousSibling())
             splitElement(static_cast<Element*>(listNode), emptyListItem);
+
+        // If emptyListItem is followed by other list item, then insert newBlock before the list node.
+        // Because we have splitted the element, emptyListItem is the first element in the list node.
+        // i.e. insert newBlock before ul or ol whose first element is emptyListItem
         insertNodeBefore(newBlock, listNode);
         removeNode(emptyListItem);
     } else {
+        // When emptyListItem does not follow any list item, insert newBlock after the enclosing list node.
+        // Remove the enclosing node if emptyListItem is the only child; otherwise just remove emptyListItem.
         insertNodeAfter(newBlock, listNode);
         removeNode(emptyListItem->renderer()->previousSibling() ? emptyListItem : listNode);
     }
-    
+
     appendBlockPlaceholder(newBlock);
     setEndingSelection(VisibleSelection(Position(newBlock.get(), 0), DOWNSTREAM));
-    
-    computedStyle(endingSelection().start().node())->diff(style.get());
-    if (style->length() > 0)
+
+    prepareEditingStyleToApplyAt(style.get(), endingSelection().start());
+    if (style->length())
         applyStyle(style.get());
     
     return true;
@@ -960,7 +986,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     ASSERT(caretPos.node()->hasTagName(brTag) || caretPos.node()->isTextNode() && caretPos.node()->renderer()->style()->preserveNewline());
     
     if (caretPos.node()->hasTagName(brTag)) {
-        Position beforeBR(positionBeforeNode(caretPos.node()));
+        Position beforeBR(positionInParentBeforeNode(caretPos.node()));
         removeNode(caretPos.node());
         prune(beforeBR.node());
     } else {
@@ -1013,7 +1039,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
             if (lineBreakExistsAtVisiblePosition(visiblePos) && downstream.node()->isDescendantOf(enclosingAnchor))
                 return original;
             
-            result = positionAfterNode(enclosingAnchor);
+            result = positionInParentAfterNode(enclosingAnchor);
         }
         // If visually just before an anchor, insert *outside* the anchor unless it's the first
         // VisiblePosition in a paragraph, to match NSTextView.
@@ -1027,7 +1053,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
             if (!enclosingAnchor)
                 return original;
 
-            result = positionBeforeNode(enclosingAnchor);
+            result = positionInParentBeforeNode(enclosingAnchor);
         }
     }
         
diff --git a/WebCore/editing/CreateLinkCommand.cpp b/WebCore/editing/CreateLinkCommand.cpp
index 263feab..d7048fe 100644
--- a/WebCore/editing/CreateLinkCommand.cpp
+++ b/WebCore/editing/CreateLinkCommand.cpp
@@ -43,7 +43,7 @@ void CreateLinkCommand::doApply()
     if (endingSelection().isNone())
         return;
         
-    RefPtr<HTMLAnchorElement> anchorElement = new HTMLAnchorElement(document());
+    RefPtr<HTMLAnchorElement> anchorElement = HTMLAnchorElement::create(document());
     anchorElement->setHref(m_url);
     
     if (endingSelection().isRange()) {
@@ -51,9 +51,9 @@ void CreateLinkCommand::doApply()
         applyStyledElement(anchorElement.get());
     } else {
         insertNodeAt(anchorElement.get(), endingSelection().start());
-        RefPtr<Text> textNode = new Text(document(), m_url);
+        RefPtr<Text> textNode = Text::create(document(), m_url);
         appendNode(textNode.get(), anchorElement.get());
-        setEndingSelection(VisibleSelection(positionBeforeNode(anchorElement.get()), positionAfterNode(anchorElement.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionInParentBeforeNode(anchorElement.get()), positionInParentAfterNode(anchorElement.get()), DOWNSTREAM));
     }
 }
 
diff --git a/WebCore/editing/DeleteButtonController.cpp b/WebCore/editing/DeleteButtonController.cpp
index 725c01d..c154426 100644
--- a/WebCore/editing/DeleteButtonController.cpp
+++ b/WebCore/editing/DeleteButtonController.cpp
@@ -187,7 +187,7 @@ void DeleteButtonController::respondToChangedSelection(const VisibleSelection& o
 void DeleteButtonController::createDeletionUI()
 {
     RefPtr<HTMLDivElement> container = new HTMLDivElement(divTag, m_target->document());
-    container->setId(containerElementIdentifier);
+    container->setAttribute(idAttr, containerElementIdentifier);
 
     CSSMutableStyleDeclaration* style = container->getInlineStyleDecl();
     style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
@@ -202,7 +202,7 @@ void DeleteButtonController::createDeletionUI()
     style->setProperty(CSSPropertyLeft, "0");
 
     RefPtr<HTMLDivElement> outline = new HTMLDivElement(divTag, m_target->document());
-    outline->setId(outlineElementIdentifier);
+    outline->setAttribute(idAttr, outlineElementIdentifier);
 
     const int borderWidth = 4;
     const int borderRadius = 6;
@@ -225,7 +225,7 @@ void DeleteButtonController::createDeletionUI()
         return;
 
     RefPtr<DeleteButton> button = new DeleteButton(m_target->document());
-    button->setId(buttonElementIdentifier);
+    button->setAttribute(idAttr, buttonElementIdentifier);
 
     const int buttonWidth = 30;
     const int buttonHeight = 30;
@@ -350,7 +350,7 @@ void DeleteButtonController::deleteTarget()
     // Because the deletion UI only appears when the selection is entirely
     // within the target, we unconditionally update the selection to be
     // a caret where the target had been.
-    Position pos = positionBeforeNode(element.get());
+    Position pos = positionInParentBeforeNode(element.get());
     applyCommand(RemoveNodeCommand::create(element.release()));
     m_frame->selection()->setSelection(VisiblePosition(pos));
 }
diff --git a/WebCore/editing/DeleteSelectionCommand.cpp b/WebCore/editing/DeleteSelectionCommand.cpp
index d57c241..fbb5aea 100644
--- a/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/WebCore/editing/DeleteSelectionCommand.cpp
@@ -137,16 +137,15 @@ void DeleteSelectionCommand::initializeStartEnd(Position& start, Position& end)
             
         if (VisiblePosition(start) != m_selectionToDelete.visibleStart() || VisiblePosition(end) != m_selectionToDelete.visibleEnd())
             break;
-        
-        // If we're going to expand to include the startSpecialContainer, it must be fully selected.
 
-        if (startSpecialContainer && !endSpecialContainer && comparePositions(positionAfterNode(startSpecialContainer), end) > -1)
+        // If we're going to expand to include the startSpecialContainer, it must be fully selected.
+        if (startSpecialContainer && !endSpecialContainer && comparePositions(positionInParentAfterNode(startSpecialContainer), end) > -1)
             break;
 
         // If we're going to expand to include the endSpecialContainer, it must be fully selected.
-        if (endSpecialContainer && !startSpecialContainer && comparePositions(start, positionBeforeNode(endSpecialContainer)) > -1)
+        if (endSpecialContainer && !startSpecialContainer && comparePositions(start, positionInParentBeforeNode(endSpecialContainer)) > -1)
             break;
-        
+
         if (startSpecialContainer && startSpecialContainer->isDescendantOf(endSpecialContainer))
             // Don't adjust the end yet, it is the end of a special element that contains the start
             // special element (which may or may not be fully selected).
@@ -317,7 +316,7 @@ static void updatePositionForNodeRemoval(Node* node, Position& position)
     if (node->parent() == position.node() && node->nodeIndex() < (unsigned)position.deprecatedEditingOffset())
         position = Position(position.node(), position.deprecatedEditingOffset() - 1);
     if (position.node() == node || position.node()->isDescendantOf(node))
-        position = positionBeforeNode(node);
+        position = positionInParentBeforeNode(node);
 }
 
 void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
@@ -538,8 +537,6 @@ void DeleteSelectionCommand::mergeParagraphs()
 {
     if (!m_mergeBlocksAfterDelete) {
         if (m_pruneStartBlockIfNecessary) {
-            // Make sure that the ending position isn't inside the block we're about to prune.
-            m_endingPosition = m_downstreamEnd;
             // We aren't going to merge into the start block, so remove it if it's empty.
             prune(m_startBlock);
             // Removing the start block during a deletion is usually an indication that we need
diff --git a/WebCore/editing/Editor.cpp b/WebCore/editing/Editor.cpp
index b9dfc5d..3f3f736 100644
--- a/WebCore/editing/Editor.cpp
+++ b/WebCore/editing/Editor.cpp
@@ -393,7 +393,7 @@ void Editor::respondToChangedContents(const VisibleSelection& endingSelection)
     if (AXObjectCache::accessibilityEnabled()) {
         Node* node = endingSelection.start().node();
         if (node)
-            m_frame->document()->axObjectCache()->postNotification(node->renderer(), "AXValueChanged", false);
+            m_frame->document()->axObjectCache()->postNotification(node->renderer(), AXObjectCache::AXValueChanged, false);
     }
     
     if (client())
diff --git a/WebCore/editing/EditorCommand.cpp b/WebCore/editing/EditorCommand.cpp
index 55750ff..abd0174 100644
--- a/WebCore/editing/EditorCommand.cpp
+++ b/WebCore/editing/EditorCommand.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,6 +41,7 @@
 #include "FormatBlockCommand.h"
 #include "Frame.h"
 #include "HTMLFontElement.h"
+#include "HTMLHRElement.h"
 #include "HTMLImageElement.h"
 #include "IndentOutdentCommand.h"
 #include "InsertListCommand.h"
@@ -198,7 +200,7 @@ static bool executeInsertFragment(Frame* frame, PassRefPtr<DocumentFragment> fra
 
 static bool executeInsertNode(Frame* frame, PassRefPtr<Node> content)
 {
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(frame->document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(frame->document());
     ExceptionCode ec = 0;
     fragment->appendChild(content, ec);
     if (ec)
@@ -467,9 +469,9 @@ static bool executeInsertBacktab(Frame* frame, Event* event, EditorCommandSource
 
 static bool executeInsertHorizontalRule(Frame* frame, Event*, EditorCommandSource, const String& value)
 {
-    RefPtr<HTMLElement> hr = new HTMLElement(hrTag, frame->document());
+    RefPtr<HTMLHRElement> hr = new HTMLHRElement(hrTag, frame->document());
     if (!value.isEmpty())
-        hr->setId(value);
+        hr->setAttribute(idAttr, value);
     return executeInsertNode(frame, hr.release());
 }
 
@@ -1095,6 +1097,19 @@ static bool enabledVisibleSelection(Frame* frame, Event* event, EditorCommandSou
     return (selection.isCaret() && selection.isContentEditable()) || selection.isRange();
 }
 
+static bool caretBrowsingEnabled(Frame* frame)
+{
+    return frame->settings() && frame->settings()->caretBrowsingEnabled();
+}
+
+static EditorCommandSource dummyEditorCommandSource = static_cast<EditorCommandSource>(0);
+
+static bool enabledVisibleSelectionOrCaretBrowsing(Frame* frame, Event* event, EditorCommandSource)
+{
+    // The EditorCommandSource parameter is unused in enabledVisibleSelection, so just pass a dummy variable
+    return caretBrowsingEnabled(frame) || enabledVisibleSelection(frame, event, dummyEditorCommandSource);
+}
+
 static bool enabledVisibleSelectionAndMark(Frame* frame, Event* event, EditorCommandSource)
 {
     const VisibleSelection& selection = frame->editor()->selectionForCommand(event);
@@ -1139,6 +1154,12 @@ static bool enabledInEditableText(Frame* frame, Event* event, EditorCommandSourc
     return frame->editor()->selectionForCommand(event).isContentEditable();
 }
 
+static bool enabledInEditableTextOrCaretBrowsing(Frame* frame, Event* event, EditorCommandSource)
+{
+    // The EditorCommandSource parameter is unused in enabledInEditableText, so just pass a dummy variable
+    return caretBrowsingEnabled(frame) || enabledInEditableText(frame, event, dummyEditorCommandSource);
+}
+
 static bool enabledInRichlyEditableText(Frame* frame, Event*, EditorCommandSource)
 {
     return frame->selection()->isCaretOrRange() && frame->selection()->isContentRichlyEditable();
@@ -1193,7 +1214,7 @@ static TriState stateOrderedList(Frame* frame, Event*)
 
 static TriState stateStrikethrough(Frame* frame, Event*)
 {
-    return stateStyle(frame, CSSPropertyTextDecoration, "line-through");
+    return stateStyle(frame, CSSPropertyWebkitTextDecorationsInEffect, "line-through");
 }
 
 static TriState stateStyleWithCSS(Frame* frame, Event*)
@@ -1228,7 +1249,7 @@ static TriState stateTextWritingDirectionRightToLeft(Frame* frame, Event*)
 
 static TriState stateUnderline(Frame* frame, Event*)
 {
-    return stateStyle(frame, CSSPropertyTextDecoration, "underline");
+    return stateStyle(frame, CSSPropertyWebkitTextDecorationsInEffect, "underline");
 }
 
 static TriState stateUnorderedList(Frame* frame, Event*)
@@ -1329,20 +1350,20 @@ static const CommandMap& createCommandMap()
         { "MakeTextWritingDirectionRightToLeft", { executeMakeTextWritingDirectionRightToLeft, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateTextWritingDirectionRightToLeft, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveBackward", { executeMoveBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveBackwardAndModifySelection", { executeMoveBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveDown", { executeMoveDown, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveDownAndModifySelection", { executeMoveDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveDown", { executeMoveDown, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveDownAndModifySelection", { executeMoveDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveForward", { executeMoveForward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveForwardAndModifySelection", { executeMoveForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveLeft", { executeMoveLeft, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveLeftAndModifySelection", { executeMoveLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveLeft", { executeMoveLeft, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveLeftAndModifySelection", { executeMoveLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageDown", { executeMovePageDown, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageDownAndModifySelection", { executeMovePageDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageUp", { executeMovePageUp, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageUpAndModifySelection", { executeMovePageUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveParagraphBackwardAndModifySelection", { executeMoveParagraphBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveParagraphForwardAndModifySelection", { executeMoveParagraphForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveRight", { executeMoveRight, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveRightAndModifySelection", { executeMoveRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveParagraphBackwardAndModifySelection", { executeMoveParagraphBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveParagraphForwardAndModifySelection", { executeMoveParagraphForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveRight", { executeMoveRight, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveRightAndModifySelection", { executeMoveRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfDocument", { executeMoveToBeginningOfDocument, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfDocumentAndModifySelection", { executeMoveToBeginningOfDocumentAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfLine", { executeMoveToBeginningOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
@@ -1363,16 +1384,16 @@ static const CommandMap& createCommandMap()
         { "MoveToLeftEndOfLineAndModifySelection", { executeMoveToLeftEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToRightEndOfLine", { executeMoveToRightEndOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToRightEndOfLineAndModifySelection", { executeMoveToRightEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveUp", { executeMoveUp, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveUpAndModifySelection", { executeMoveUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveUp", { executeMoveUp, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveUpAndModifySelection", { executeMoveUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordBackward", { executeMoveWordBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordBackwardAndModifySelection", { executeMoveWordBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordForward", { executeMoveWordForward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordForwardAndModifySelection", { executeMoveWordForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordLeft", { executeMoveWordLeft, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordLeftAndModifySelection", { executeMoveWordLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordRight", { executeMoveWordRight, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordRightAndModifySelection", { executeMoveWordRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordLeft", { executeMoveWordLeft, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordLeftAndModifySelection", { executeMoveWordLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordRight", { executeMoveWordRight, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordRightAndModifySelection", { executeMoveWordRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Outdent", { executeOutdent, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Paste", { executePaste, supportedPaste, enabledPaste, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
         { "PasteAndMatchStyle", { executePasteAndMatchStyle, supportedPaste, enabledPaste, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
diff --git a/WebCore/editing/IndentOutdentCommand.cpp b/WebCore/editing/IndentOutdentCommand.cpp
index 8c4ba01..308ba74 100644
--- a/WebCore/editing/IndentOutdentCommand.cpp
+++ b/WebCore/editing/IndentOutdentCommand.cpp
@@ -121,12 +121,6 @@ void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& startOfCu
         targetBlockquote = 0;
 }
 
-bool IndentOutdentCommand::isAtUnsplittableElement(const Position& pos) const
-{
-    Node* node = pos.node();
-    return node == editableRootForPosition(pos) || node == enclosingNodeOfType(pos, &isTableCell);
-}
-
 // Enclose all nodes between start and end by newParent, which is a sibling node of nodes between start and end
 // FIXME: moveParagraph is overly complicated.  We need to clean up moveParagraph so that it uses appendParagraphIntoNode
 // or prepare more specialized functions and delete moveParagraph
@@ -173,7 +167,7 @@ void IndentOutdentCommand::removeUnnecessaryLineBreakAt(const Position& endOfPar
     Node* parentNode = br->parentNode();
 
     // If the node isn't br or the parent node is empty, then don't remove.
-    if (!br->hasTagName(brTag) || isVisiblyAdjacent(positionBeforeNode(parentNode), positionAfterNode(parentNode)))
+    if (!br->hasTagName(brTag) || isVisiblyAdjacent(positionInParentBeforeNode(parentNode), positionInParentAfterNode(parentNode)))
         return;
 
     removeNodeAndPruneAncestors(br);
@@ -211,7 +205,7 @@ void IndentOutdentCommand::indentRegion()
             blockquoteForNextIndent = 0;
         else {
             VisiblePosition startOfCurrentParagraph = startOfParagraph(endOfCurrentParagraph);
-            Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
+            Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
             // extend the region so that it contains all the ancestor blocks within the selection
             ExceptionCode ec;
             Element* unsplittableNode = unsplittableElementForPosition(endOfCurrentParagraph.deepEquivalent());
diff --git a/WebCore/editing/IndentOutdentCommand.h b/WebCore/editing/IndentOutdentCommand.h
index 104a0e7..d83128e 100644
--- a/WebCore/editing/IndentOutdentCommand.h
+++ b/WebCore/editing/IndentOutdentCommand.h
@@ -46,8 +46,6 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
-    // FIXME: Does this belong in htmlediting.cpp?
-    bool isAtUnsplittableElement(const Position&) const;
     void appendParagraphIntoNode(const VisiblePosition& start, const VisiblePosition& end, Node* newParent);
     void removeUnnecessaryLineBreakAt(const Position& endOfParagraph);
 
diff --git a/WebCore/editing/InsertLineBreakCommand.cpp b/WebCore/editing/InsertLineBreakCommand.cpp
index f020459..caaae0a 100644
--- a/WebCore/editing/InsertLineBreakCommand.cpp
+++ b/WebCore/editing/InsertLineBreakCommand.cpp
@@ -125,12 +125,12 @@ void InsertLineBreakCommand::doApply()
         if (!isStartOfParagraph(VisiblePosition(Position(nodeToInsert.get(), 0))))
             insertNodeBefore(nodeToInsert->cloneNode(false).get(), nodeToInsert.get());
         
-        setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionInParentAfterNode(nodeToInsert.get()), DOWNSTREAM));
     // If we're inserting after all of the rendered text in a text node, or into a non-text node,
     // a simple insertion is sufficient.
     } else if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()) || !pos.node()->isTextNode()) {
         insertNodeAt(nodeToInsert.get(), pos);
-        setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionInParentAfterNode(nodeToInsert.get()), DOWNSTREAM));
     } else {
         // Split a text node
         ASSERT(pos.node()->isTextNode());
@@ -144,7 +144,7 @@ void InsertLineBreakCommand::doApply()
         // Handle whitespace that occurs after the split
         updateLayout();
         if (!endingPosition.isRenderedCharacter()) {
-            Position positionBeforeTextNode(positionBeforeNode(textNode));
+            Position positionBeforeTextNode(positionInParentBeforeNode(textNode));
             // Clear out all whitespace and insert one non-breaking space
             deleteInsignificantTextDownstream(endingPosition);
             ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
diff --git a/WebCore/editing/InsertListCommand.cpp b/WebCore/editing/InsertListCommand.cpp
index ec707d2..beb5d08 100644
--- a/WebCore/editing/InsertListCommand.cpp
+++ b/WebCore/editing/InsertListCommand.cpp
@@ -251,7 +251,7 @@ void InsertListCommand::doApply()
             // Also avoid the containing list item.
             Node* listChild = enclosingListChild(insertionPos.node());
             if (listChild && listChild->hasTagName(liTag))
-                insertionPos = positionBeforeNode(listChild);
+                insertionPos = positionInParentBeforeNode(listChild);
 
             insertNodeAt(listElement, insertionPos);
 
diff --git a/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index c5fbf0a..695f46a 100644
--- a/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -103,6 +103,30 @@ bool InsertParagraphSeparatorCommand::shouldUseDefaultParagraphElement(Node* enc
            enclosingBlock->hasTagName(h5Tag);
 }
 
+void InsertParagraphSeparatorCommand::getAncestorsInsideBlock(const Node* insertionNode, Element* outerBlock, Vector<Element*>& ancestors)
+{
+    ancestors.clear();
+    
+    // Build up list of ancestors elements between the insertion node and the outer block.
+    if (insertionNode != outerBlock) {
+        for (Element* n = insertionNode->parentElement(); n && n != outerBlock; n = n->parentElement())
+            ancestors.append(n);
+    }
+}
+
+PassRefPtr<Element> InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock(const Vector<Element*>& ancestors, PassRefPtr<Element> blockToInsert)
+{
+    // Make clones of ancestors in between the start node and the start block.
+    RefPtr<Element> parent = blockToInsert;
+    for (size_t i = ancestors.size(); i != 0; --i) {
+        RefPtr<Element> child = ancestors[i - 1]->cloneElementWithoutChildren();
+        appendNode(child, parent);
+        parent = child.release();
+    }
+    
+    return parent.release();
+}
+
 void InsertParagraphSeparatorCommand::doApply()
 {
     bool splitText = false;
@@ -193,12 +217,18 @@ void InsertParagraphSeparatorCommand::doApply()
             insertNodeAfter(blockToInsert, startBlock);
         }
 
-        appendBlockPlaceholder(blockToInsert);
-        setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
-        if (shouldApplyStyleAfterInsertion)
-            applyStyleAfterInsertion(startBlock);
+        // Recreate the same structure in the new paragraph.
+        
+        Vector<Element*> ancestors;
+        getAncestorsInsideBlock(insertionPosition.node(), startBlock, ancestors);      
+        RefPtr<Element> parent = cloneHierarchyUnderNewBlock(ancestors, blockToInsert);
+        
+        appendBlockPlaceholder(parent);
+
+        setEndingSelection(VisibleSelection(Position(parent.get(), 0), DOWNSTREAM));
         return;
     }
+    
 
     //---------------------------------------------------------------------
     // Handle case when position is in the first visible position in its block, and
@@ -217,9 +247,15 @@ void InsertParagraphSeparatorCommand::doApply()
         insertionPosition = insertionPosition.downstream();
         
         insertNodeBefore(blockToInsert, refNode);
-        appendBlockPlaceholder(blockToInsert.get());
-        setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
-        applyStyleAfterInsertion(startBlock);
+
+        // Recreate the same structure in the new paragraph.
+
+        Vector<Element*> ancestors;
+        getAncestorsInsideBlock(positionAvoidingSpecialElementBoundary(insertionPosition).node(), startBlock, ancestors);
+        
+        appendBlockPlaceholder(cloneHierarchyUnderNewBlock(ancestors, blockToInsert));
+        
+        // In this case, we need to set the new ending selection.
         setEndingSelection(VisibleSelection(insertionPosition, DOWNSTREAM));
         return;
     }
@@ -234,7 +270,7 @@ void InsertParagraphSeparatorCommand::doApply()
     if (isStartOfParagraph(visiblePos)) {
         RefPtr<Element> br = createBreakElement(document());
         insertNodeAt(br.get(), insertionPosition);
-        insertionPosition = positionAfterNode(br.get());
+        insertionPosition = positionInParentAfterNode(br.get());
     }
     
     // Move downstream. Typing style code will take care of carrying along the 
@@ -248,10 +284,7 @@ void InsertParagraphSeparatorCommand::doApply()
 
     // Build up list of ancestors in between the start node and the start block.
     Vector<Element*> ancestors;
-    if (insertionPosition.node() != startBlock) {
-        for (Element* n = insertionPosition.node()->parentElement(); n && n != startBlock; n = n->parentElement())
-            ancestors.append(n);
-    }
+    getAncestorsInsideBlock(insertionPosition.node(), startBlock, ancestors);
 
     // Make sure we do not cause a rendered space to become unrendered.
     // FIXME: We need the affinity for pos, but pos.downstream() does not give it
@@ -284,13 +317,8 @@ void InsertParagraphSeparatorCommand::doApply()
 
     updateLayout();
     
-    // Make clones of ancestors in between the start node and the start block.
-    RefPtr<Element> parent = blockToInsert;
-    for (size_t i = ancestors.size(); i != 0; --i) {
-        RefPtr<Element> child = ancestors[i - 1]->cloneElementWithoutChildren();
-        appendNode(child, parent);
-        parent = child.release();
-    }
+    // Make clones of ancestors in between the start node and the outer block.
+    RefPtr<Element> parent = cloneHierarchyUnderNewBlock(ancestors, blockToInsert);
 
     // If the paragraph separator was inserted at the end of a paragraph, an empty line must be
     // created.  All of the nodes, starting at visiblePos, are about to be added to the new paragraph 
diff --git a/WebCore/editing/InsertParagraphSeparatorCommand.h b/WebCore/editing/InsertParagraphSeparatorCommand.h
index 01c08bf..23ee51c 100644
--- a/WebCore/editing/InsertParagraphSeparatorCommand.h
+++ b/WebCore/editing/InsertParagraphSeparatorCommand.h
@@ -44,6 +44,8 @@ private:
 
     void calculateStyleBeforeInsertion(const Position&);
     void applyStyleAfterInsertion(Node* originalEnclosingBlock);
+    void getAncestorsInsideBlock(const Node* insertionNode, Element* outerBlock, Vector<Element*>& ancestors);
+    PassRefPtr<Element> cloneHierarchyUnderNewBlock(const Vector<Element*>& ancestors, PassRefPtr<Element> blockToInsert);
     
     bool shouldUseDefaultParagraphElement(Node*) const;
 
diff --git a/WebCore/editing/InsertTextCommand.cpp b/WebCore/editing/InsertTextCommand.cpp
index 6b0af9b..f10d71b 100644
--- a/WebCore/editing/InsertTextCommand.cpp
+++ b/WebCore/editing/InsertTextCommand.cpp
@@ -145,7 +145,7 @@ void InsertTextCommand::input(const String& text, bool selectInsertedText)
     
     // It is possible for the node that contains startPosition to contain only unrendered whitespace,
     // and so deleteInsignificantText could remove it.  Save the position before the node in case that happens.
-    Position positionBeforeStartNode(positionBeforeNode(startPosition.node()));
+    Position positionBeforeStartNode(positionInParentBeforeNode(startPosition.node()));
     deleteInsignificantText(startPosition.upstream(), startPosition.downstream());
     if (!startPosition.node()->inDocument())
         startPosition = positionBeforeStartNode;
diff --git a/WebCore/editing/ReplaceSelectionCommand.cpp b/WebCore/editing/ReplaceSelectionCommand.cpp
index 8ae083c..b40dab2 100644
--- a/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -528,7 +528,7 @@ VisiblePosition ReplaceSelectionCommand::positionAtEndOfInsertedContent()
 VisiblePosition ReplaceSelectionCommand::positionAtStartOfInsertedContent()
 {
     // Return the inserted content's first VisiblePosition.
-    return VisiblePosition(nextCandidate(positionBeforeNode(m_firstNodeInserted.get())));
+    return VisiblePosition(nextCandidate(positionInParentBeforeNode(m_firstNodeInserted.get())));
 }
 
 // Remove style spans before insertion if they are unnecessary.  It's faster because we'll 
@@ -695,8 +695,17 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
     
     VisiblePosition destination = mergeForward ? endOfInsertedContent.next() : endOfInsertedContent;
     VisiblePosition startOfParagraphToMove = mergeForward ? startOfParagraph(endOfInsertedContent) : endOfInsertedContent.next();
+   
+    // Merging forward could result in deleting the destination anchor node.
+    // To avoid this, we add a placeholder node before the start of the paragraph.
+    if (endOfParagraph(startOfParagraphToMove) == destination) {
+        RefPtr<Node> placeholder = createBreakElement(document());
+        insertNodeBefore(placeholder, startOfParagraphToMove.deepEquivalent().node());
+        destination = VisiblePosition(Position(placeholder.get(), 0));
+    }
 
     moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
+    
     // Merging forward will remove m_lastLeafInserted from the document.
     // FIXME: Maintain positions for the start and end of inserted content instead of keeping nodes.  The nodes are
     // only ever used to create positions where inserted content starts/ends.  Also, we sometimes insert content
@@ -705,6 +714,10 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
         m_lastLeafInserted = destination.previous().deepEquivalent().node();
         if (!m_firstNodeInserted->inDocument())
             m_firstNodeInserted = endingSelection().visibleStart().deepEquivalent().node();
+        // If we merged text nodes, m_lastLeafInserted could be null. If this is the case,
+        // we use m_firstNodeInserted.
+        if (!m_lastLeafInserted)
+            m_lastLeafInserted = m_firstNodeInserted;
     }
 }
 
@@ -794,7 +807,7 @@ void ReplaceSelectionCommand::doApply()
         Node* br = endingSelection().start().node(); 
         ASSERT(br->hasTagName(brTag)); 
         // Insert content between the two blockquotes, but remove the br (since it was just a placeholder). 
-        insertionPos = positionBeforeNode(br); 
+        insertionPos = positionInParentBeforeNode(br);
         removeNode(br);
     }
     
@@ -817,9 +830,9 @@ void ReplaceSelectionCommand::doApply()
         ASSERT(startBlock != currentRoot);
         VisiblePosition visibleInsertionPos(insertionPos);
         if (isEndOfBlock(visibleInsertionPos) && !(isStartOfBlock(visibleInsertionPos) && fragment.hasInterchangeNewlineAtEnd()))
-            insertionPos = positionAfterNode(startBlock);
+            insertionPos = positionInParentAfterNode(startBlock);
         else if (isStartOfBlock(visibleInsertionPos))
-            insertionPos = positionBeforeNode(startBlock);
+            insertionPos = positionInParentBeforeNode(startBlock);
     }
 
     // Paste into run of tabs splits the tab span.
diff --git a/WebCore/editing/SelectionController.cpp b/WebCore/editing/SelectionController.cpp
index b6874d6..7d99916 100644
--- a/WebCore/editing/SelectionController.cpp
+++ b/WebCore/editing/SelectionController.cpp
@@ -90,7 +90,8 @@ void SelectionController::moveTo(const Position &pos, EAffinity affinity, bool u
 
 void SelectionController::moveTo(const Range *r, EAffinity affinity, bool userTriggered)
 {
-    setSelection(VisibleSelection(startPosition(r), endPosition(r), affinity), true, true, userTriggered);
+    VisibleSelection selection = r ? VisibleSelection(r->startPosition(), r->endPosition(), affinity) : VisibleSelection(Position(), Position(), affinity);
+    setSelection(selection, true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const Position &base, const Position &extent, EAffinity affinity, bool userTriggered)
diff --git a/WebCore/editing/SplitTextNodeCommand.cpp b/WebCore/editing/SplitTextNodeCommand.cpp
index 07a54e3..3b04e01 100644
--- a/WebCore/editing/SplitTextNodeCommand.cpp
+++ b/WebCore/editing/SplitTextNodeCommand.cpp
@@ -55,7 +55,7 @@ void SplitTextNodeCommand::doApply()
     if (prefixText.isEmpty())
         return;
 
-    RefPtr<Text> prefixTextNode = new Text(document(), prefixText);
+    RefPtr<Text> prefixTextNode = Text::create(document(), prefixText);
     ASSERT(prefixTextNode);
     document()->copyMarkers(m_text2.get(), 0, m_offset, prefixTextNode.get(), 0);
 
diff --git a/WebCore/editing/TextIterator.cpp b/WebCore/editing/TextIterator.cpp
index 08fda16..d36849c 100644
--- a/WebCore/editing/TextIterator.cpp
+++ b/WebCore/editing/TextIterator.cpp
@@ -33,7 +33,6 @@
 #include "HTMLNames.h"
 #include "htmlediting.h"
 #include "InlineTextBox.h"
-#include "Position.h"
 #include "Range.h"
 #include "RenderTableCell.h"
 #include "RenderTableRow.h"
@@ -941,7 +940,7 @@ SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator(const Range* r)
     if (!endNode->offsetInCharacters()) {
         if (endOffset > 0 && endOffset <= static_cast<int>(endNode->childNodeCount())) {
             endNode = endNode->childNode(endOffset - 1);
-            endOffset = endNode->offsetInCharacters() ? endNode->maxCharacterOffset() : endNode->childNodeCount();
+            endOffset = lastOffsetInNode(endNode);
         }
     }
 
diff --git a/WebCore/editing/UnlinkCommand.cpp b/WebCore/editing/UnlinkCommand.cpp
index 0ba9a06..7234a3b 100644
--- a/WebCore/editing/UnlinkCommand.cpp
+++ b/WebCore/editing/UnlinkCommand.cpp
@@ -37,14 +37,13 @@ UnlinkCommand::UnlinkCommand(Document* document)
 
 void UnlinkCommand::doApply()
 {
-    // FIXME: If a caret is inside a link, remove it.
+    // FIXME: If a caret is inside a link, we should remove it, but currently we don't.
     if (!endingSelection().isRange())
         return;
         
     pushPartiallySelectedAnchorElementsDown();
 
-    HTMLAnchorElement* anchorElement = new HTMLAnchorElement(document());
-    removeStyledElement(anchorElement);
+    removeStyledElement(HTMLAnchorElement::create(document()));
 }
 
 }
diff --git a/WebCore/editing/VisibleSelection.cpp b/WebCore/editing/VisibleSelection.cpp
index 56ad6b3..8adfd71 100644
--- a/WebCore/editing/VisibleSelection.cpp
+++ b/WebCore/editing/VisibleSelection.cpp
@@ -511,7 +511,7 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
             while (p.isNotNull() && !(lowestEditableAncestor(p.node()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
-                p = isAtomicNode(p.node()) ? positionBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
+                p = isAtomicNode(p.node()) ? positionInParentBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
                     p = lastDeepEditingPositionForNode(shadowAncestor);
             }
@@ -540,7 +540,7 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
             while (p.isNotNull() && !(lowestEditableAncestor(p.node()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
-                p = isAtomicNode(p.node()) ? positionAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
+                p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
                     p = Position(shadowAncestor, 0);
             }
diff --git a/WebCore/editing/haiku/EditorHaiku.cpp b/WebCore/editing/haiku/EditorHaiku.cpp
index 17fde1f..723d4ff 100644
--- a/WebCore/editing/haiku/EditorHaiku.cpp
+++ b/WebCore/editing/haiku/EditorHaiku.cpp
@@ -28,9 +28,8 @@
 #include "config.h"
 #include "Editor.h"
 
-#include "ClipboardAccessPolicy.h"
 #include "Clipboard.h"
-
+#include "ClipboardAccessPolicy.h"
 #include "ClipboardHaiku.h"
 
 
@@ -38,7 +37,7 @@ namespace WebCore {
 
 PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
 {
-    return new ClipboardHaiku(policy, false);
+    return ClipboardHaiku::create(policy, false);
 }
 
 } // namespace WebCore
diff --git a/WebCore/editing/htmlediting.cpp b/WebCore/editing/htmlediting.cpp
index 4124c48..d19ef6b 100644
--- a/WebCore/editing/htmlediting.cpp
+++ b/WebCore/editing/htmlediting.cpp
@@ -183,6 +183,13 @@ bool isEditablePosition(const Position& p)
     return node->isContentEditable();
 }
 
+bool isAtUnsplittableElement(const Position& pos)
+{
+    Node* node = pos.node();
+    return (node == editableRootForPosition(pos) || node == enclosingNodeOfType(pos, &isTableCell));
+}
+    
+    
 bool isRichlyEditablePosition(const Position& p)
 {
     Node* node = p.node();
@@ -280,7 +287,7 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
             p = lastDeepEditingPositionForNode(shadowAncestor);
     
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
-        p = isAtomicNode(p.node()) ? positionAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
+        p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
     
     if (p.node() && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
@@ -301,7 +308,7 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
             p = firstDeepEditingPositionForNode(shadowAncestor);
     
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
-        p = isAtomicNode(p.node()) ? positionBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
+        p = isAtomicNode(p.node()) ? positionInParentBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
     
     if (p.node() && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
@@ -339,7 +346,7 @@ Position rangeCompliantEquivalent(const Position& pos)
 
     if (pos.deprecatedEditingOffset() <= 0) {
         if (node->parentNode() && (editingIgnoresContent(node) || isTableElement(node)))
-            return positionBeforeNode(node);
+            return positionInParentBeforeNode(node);
         return Position(node, 0);
     }
 
@@ -349,7 +356,7 @@ Position rangeCompliantEquivalent(const Position& pos)
     int maxCompliantOffset = node->childNodeCount();
     if (pos.deprecatedEditingOffset() > maxCompliantOffset) {
         if (node->parentNode())
-            return positionAfterNode(node);
+            return positionInParentAfterNode(node);
 
         // there is no other option at this point than to
         // use the highest allowed position in the node
@@ -359,11 +366,11 @@ Position rangeCompliantEquivalent(const Position& pos)
     // Editing should never generate positions like this.
     if ((pos.deprecatedEditingOffset() < maxCompliantOffset) && editingIgnoresContent(node)) {
         ASSERT_NOT_REACHED();
-        return node->parentNode() ? positionBeforeNode(node) : Position(node, 0);
+        return node->parentNode() ? positionInParentBeforeNode(node) : Position(node, 0);
     }
     
     if (pos.deprecatedEditingOffset() == maxCompliantOffset && (editingIgnoresContent(node) || isTableElement(node)))
-        return positionAfterNode(node);
+        return positionInParentAfterNode(node);
     
     return Position(pos);
 }
@@ -384,10 +391,10 @@ int lastOffsetForEditing(const Node* node)
         return 0;
     if (node->offsetInCharacters())
         return node->maxCharacterOffset();
-        
+
     if (node->hasChildNodes())
         return node->childNodeCount();
-    
+
     // NOTE: This should preempt the childNodeCount for, e.g., select nodes
     if (editingIgnoresContent(node))
         return 1;
@@ -459,24 +466,30 @@ bool isSpecialElement(const Node *n)
 }
 
 // Checks if a string is a valid tag for the FormatBlockCommand function of execCommand. Expects lower case strings.
-bool validBlockTag(const String& blockTag)
-{
-    if (blockTag == "address" ||
-        blockTag == "blockquote" ||
-        blockTag == "dd" ||
-        blockTag == "div" ||
-        blockTag == "dl" ||
-        blockTag == "dt" ||
-        blockTag == "h1" ||
-        blockTag == "h2" ||
-        blockTag == "h3" ||
-        blockTag == "h4" ||
-        blockTag == "h5" ||
-        blockTag == "h6" ||
-        blockTag == "p" ||
-        blockTag == "pre")
-        return true;
-    return false;
+bool validBlockTag(const AtomicString& blockTag)
+{
+    if (blockTag.isEmpty())
+        return false;
+
+    DEFINE_STATIC_LOCAL(HashSet<AtomicString>, blockTags, ());
+    if (blockTags.isEmpty()) {
+        blockTags.add(addressTag.localName());
+        blockTags.add(blockquoteTag.localName());
+        blockTags.add(ddTag.localName());
+        blockTags.add(divTag.localName());
+        blockTags.add(dlTag.localName());
+        blockTags.add(dtTag.localName());
+        blockTags.add(h1Tag.localName());
+        blockTags.add(h2Tag.localName());
+        blockTags.add(h3Tag.localName());
+        blockTags.add(h4Tag.localName());
+        blockTags.add(h5Tag.localName());
+        blockTags.add(h6Tag.localName());
+        blockTags.add(navTag.localName());
+        blockTags.add(pTag.localName());
+        blockTags.add(preTag.localName());
+    }
+    return blockTags.contains(blockTag);
 }
 
 static Node* firstInSpecialElement(const Position& pos)
@@ -519,7 +532,7 @@ Position positionBeforeContainingSpecialElement(const Position& pos, Node** cont
     Node* n = firstInSpecialElement(pos);
     if (!n)
         return pos;
-    Position result = positionBeforeNode(n);
+    Position result = positionInParentBeforeNode(n);
     if (result.isNull() || result.node()->rootEditableElement() != pos.node()->rootEditableElement())
         return pos;
     if (containingSpecialElement)
@@ -537,7 +550,7 @@ Position positionAfterContainingSpecialElement(const Position& pos, Node **conta
     Node* n = lastInSpecialElement(pos);
     if (!n)
         return pos;
-    Position result = positionAfterNode(n);
+    Position result = positionInParentAfterNode(n);
     if (result.isNull() || result.node()->rootEditableElement() != pos.node()->rootEditableElement())
         return pos;
     if (containingSpecialElement)
@@ -572,20 +585,6 @@ Node* isLastPositionBeforeTable(const VisiblePosition& visiblePosition)
     return 0;
 }
 
-Position positionBeforeNode(const Node* node)
-{
-    ASSERT(node);
-    // FIXME: Should ASSERT(node->parentNode()) but doing so results in editing/deleting/delete-ligature-001.html crashing
-    return Position(node->parentNode(), node->nodeIndex());
-}
-
-Position positionAfterNode(const Node* node)
-{
-    ASSERT(node);
-    // FIXME: Should ASSERT(node->parentNode()) but doing so results in editing/deleting/delete-ligature-001.html crashing
-    return Position(node->parentNode(), node->nodeIndex() + 1);
-}
-
 // Returns the visible position at the beginning of a node
 VisiblePosition visiblePositionBeforeNode(Node* node)
 {
@@ -593,7 +592,7 @@ VisiblePosition visiblePositionBeforeNode(Node* node)
     if (node->childNodeCount())
         return VisiblePosition(node, 0, DOWNSTREAM);
     ASSERT(node->parentNode());
-    return positionBeforeNode(node);
+    return positionInParentBeforeNode(node);
 }
 
 // Returns the visible position at the ending of a node
@@ -603,7 +602,7 @@ VisiblePosition visiblePositionAfterNode(Node* node)
     if (node->childNodeCount())
         return VisiblePosition(node, node->childNodeCount(), DOWNSTREAM);
     ASSERT(node->parentNode());
-    return positionAfterNode(node);
+    return positionInParentAfterNode(node);
 }
 
 // Create a range object with two visible positions, start and end.
@@ -818,7 +817,7 @@ bool canMergeLists(Element* firstList, Element* secondList)
     return firstList->hasTagName(secondList->tagQName())// make sure the list types match (ol vs. ul)
     && firstList->isContentEditable() && secondList->isContentEditable()// both lists are editable
     && firstList->rootEditableElement() == secondList->rootEditableElement()// don't cross editing boundaries
-    && isVisiblyAdjacent(positionAfterNode(firstList), positionBeforeNode(secondList));
+    && isVisiblyAdjacent(positionInParentAfterNode(firstList), positionInParentBeforeNode(secondList));
     // Make sure there is no visible content between this li and the previous list
 }
 
@@ -908,7 +907,7 @@ Position positionBeforeTabSpan(const Position& pos)
     else if (!isTabSpanNode(node))
         return pos;
     
-    return positionBeforeNode(node);
+    return positionInParentBeforeNode(node);
 }
 
 PassRefPtr<Element> createTabSpanElement(Document* document, PassRefPtr<Node> tabTextNode)
diff --git a/WebCore/editing/htmlediting.h b/WebCore/editing/htmlediting.h
index f98b149..f44181c 100644
--- a/WebCore/editing/htmlediting.h
+++ b/WebCore/editing/htmlediting.h
@@ -29,6 +29,7 @@
 #include <wtf/Forward.h>
 #include "HTMLNames.h"
 #include "ExceptionCode.h"
+#include "Position.h"
 
 namespace WebCore {
 
@@ -42,47 +43,146 @@ class String;
 class VisiblePosition;
 class VisibleSelection;
 
-Position rangeCompliantEquivalent(const Position&);
-Position rangeCompliantEquivalent(const VisiblePosition&);
+
+// This file contains a set of helper functions used by the editing commands
+
+// -------------------------------------------------------------------------
+// Node
+// -------------------------------------------------------------------------
+
+// Functions returning Node
+
+Node* highestAncestor(Node*);
+Node* highestEditableRoot(const Position&);
+Node* highestEnclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*));
+Node* lowestEditableAncestor(Node*);   
+
+Node* enclosingBlock(Node*);
+Node* enclosingTableCell(const Position&);
+Node* enclosingEmptyListItem(const VisiblePosition&);
+Node* enclosingAnchorElement(const Position&);
+Node* enclosingNodeWithTag(const Position&, const QualifiedName&);
+Node* enclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), bool onlyReturnEditableNodes = true);
+
+Node* tabSpanNode(const Node*);
+Node* nearestMailBlockquote(const Node*);
+Node* isLastPositionBeforeTable(const VisiblePosition&);
+Node* isFirstPositionAfterTable(const VisiblePosition&);
+
+// offset functions on Node
+
 int lastOffsetForEditing(const Node*);
-bool isAtomicNode(const Node*);
+int caretMinOffset(const Node*);
+int caretMaxOffset(const Node*);
+
+// boolean functions on Node
+
 bool editingIgnoresContent(const Node*);
 bool canHaveChildrenForEditing(const Node*);
-Node* highestEditableRoot(const Position&);
-VisiblePosition firstEditablePositionAfterPositionInRoot(const Position&, Node*);
-VisiblePosition lastEditablePositionBeforePositionInRoot(const Position&, Node*);
-int comparePositions(const Position&, const Position&);
-int comparePositions(const VisiblePosition&, const VisiblePosition&);
-Node* lowestEditableAncestor(Node*);
+bool isAtomicNode(const Node*);
+bool isBlock(const Node*);
+bool isSpecialElement(const Node*);
+bool isTabSpanNode(const Node*);
+bool isTabSpanTextNode(const Node*);
+bool isMailBlockquote(const Node*);
+bool isTableElement(Node*);
+bool isTableCell(const Node*);
+bool isTableStructureNode(const Node*);
+bool isListElement(Node*);
+bool isNodeRendered(const Node*);
+bool isNodeVisiblyContainedWithin(Node*, const Range*);
+    
+    
+// -------------------------------------------------------------------------
+// Position
+// -------------------------------------------------------------------------
+    
+// Functions returning Position
+    
+Position rangeCompliantEquivalent(const Position&);
+Position rangeCompliantEquivalent(const VisiblePosition&);
+    
 Position nextCandidate(const Position&);
-Position nextVisuallyDistinctCandidate(const Position&);
 Position previousCandidate(const Position&);
+    
+Position nextVisuallyDistinctCandidate(const Position&);
 Position previousVisuallyDistinctCandidate(const Position&);
+
+Position positionBeforeTabSpan(const Position&);
+Position positionBeforeContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
+Position positionAfterContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
+Position positionOutsideContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
+    
+// Position creation functions are inline to prevent ref-churn.
+// Other Position creation functions are in Position.h
+// but these depend on lastOffsetForEditing which is defined in htmlediting.h.
+
+// NOTE: first/lastDeepEditingPositionForNode return legacy editing positions (like [img, 0])
+// for elements which editing ignores.  The rest of the editing code will treat [img, 0]
+// as "the last position before the img".
+// New code should use the creation functions in Position.h instead.
+inline Position firstDeepEditingPositionForNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, 0);
+}
+
+inline Position lastDeepEditingPositionForNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, lastOffsetForEditing(anchorNode));
+}
+       
+// comparision functions on Position
+    
+int comparePositions(const Position&, const Position&);
+
+// boolean functions on Position
+    
 bool isEditablePosition(const Position&);
 bool isRichlyEditablePosition(const Position&);
-Element* editableRootForPosition(const Position&);
-Element* unsplittableElementForPosition(const Position&);
-bool isBlock(const Node*);
-Node* enclosingBlock(Node*);
+bool isFirstVisiblePositionInSpecialElement(const Position&);
+bool isLastVisiblePositionInSpecialElement(const Position&);
+bool lineBreakExistsAtPosition(const Position&);
+bool isVisiblyAdjacent(const Position& first, const Position& second);
+bool isAtUnsplittableElement(const Position&);
 
-String stringWithRebalancedWhitespace(const String&, bool, bool);
-const String& nonBreakingSpaceString();
+// miscellaneous functions on Position
 
-//------------------------------------------------------------------------------------------
+unsigned numEnclosingMailBlockquotes(const Position&);
 
-Position positionBeforeNode(const Node*);
-Position positionAfterNode(const Node*);
+// -------------------------------------------------------------------------
+// VisiblePosition
+// -------------------------------------------------------------------------
+    
+// Functions returning VisiblePosition
+    
+VisiblePosition firstEditablePositionAfterPositionInRoot(const Position&, Node*);
+VisiblePosition lastEditablePositionBeforePositionInRoot(const Position&, Node*);
 VisiblePosition visiblePositionBeforeNode(Node*);
 VisiblePosition visiblePositionAfterNode(Node*);
+
+bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
+    
+int comparePositions(const VisiblePosition&, const VisiblePosition&);
+int indexForVisiblePosition(const VisiblePosition&);
+
+// -------------------------------------------------------------------------
+// Range
+// -------------------------------------------------------------------------
+
+// Functions returning Range
+
 PassRefPtr<Range> createRange(PassRefPtr<Document>, const VisiblePosition& start, const VisiblePosition& end, ExceptionCode&);
 PassRefPtr<Range> extendRangeToWrappingNodes(PassRefPtr<Range> rangeToExtend, const Range* maximumRange, const Node* rootNode);
-
 PassRefPtr<Range> avoidIntersectionWithNode(const Range*, Node*);
-VisibleSelection avoidIntersectionWithNode(const VisibleSelection&, Node*);
-
-bool isSpecialElement(const Node*);
-bool validBlockTag(const String&);
 
+// -------------------------------------------------------------------------
+// HTMLElement
+// -------------------------------------------------------------------------
+    
+// Functions returning HTMLElement
+    
 PassRefPtr<HTMLElement> createDefaultParagraphElement(Document*);
 PassRefPtr<HTMLElement> createBreakElement(Document*);
 PassRefPtr<HTMLElement> createOrderedListElement(Document*);
@@ -91,57 +191,45 @@ PassRefPtr<HTMLElement> createListItemElement(Document*);
 PassRefPtr<HTMLElement> createHTMLElement(Document*, const QualifiedName&);
 PassRefPtr<HTMLElement> createHTMLElement(Document*, const AtomicString&);
 
-bool isTabSpanNode(const Node*);
-bool isTabSpanTextNode(const Node*);
-Node* tabSpanNode(const Node*);
-Position positionBeforeTabSpan(const Position&);
+HTMLElement* enclosingList(Node*);
+HTMLElement* outermostEnclosingList(Node*);
+HTMLElement* enclosingListChild(Node*);
+
+// -------------------------------------------------------------------------
+// Element
+// -------------------------------------------------------------------------
+    
+// Functions returning Element
+    
 PassRefPtr<Element> createTabSpanElement(Document*);
 PassRefPtr<Element> createTabSpanElement(Document*, PassRefPtr<Node> tabTextNode);
 PassRefPtr<Element> createTabSpanElement(Document*, const String& tabText);
-
-bool isNodeRendered(const Node*);
-bool isMailBlockquote(const Node*);
-Node* nearestMailBlockquote(const Node*);
-unsigned numEnclosingMailBlockquotes(const Position&);
-int caretMinOffset(const Node*);
-int caretMaxOffset(const Node*);
-
-//------------------------------------------------------------------------------------------
-
-bool isTableStructureNode(const Node*);
 PassRefPtr<Element> createBlockPlaceholderElement(Document*);
 
-bool isFirstVisiblePositionInSpecialElement(const Position&);
-Position positionBeforeContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
-bool isLastVisiblePositionInSpecialElement(const Position&);
-Position positionAfterContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
-Position positionOutsideContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
-Node* isLastPositionBeforeTable(const VisiblePosition&);
-Node* isFirstPositionAfterTable(const VisiblePosition&);
+Element* editableRootForPosition(const Position&);
+Element* unsplittableElementForPosition(const Position&);
 
-Node* enclosingNodeWithTag(const Position&, const QualifiedName&);
-Node* enclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), bool onlyReturnEditableNodes = true);
-Node* highestEnclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*));
-Node* enclosingTableCell(const Position&);
-Node* enclosingEmptyListItem(const VisiblePosition&);
-Node* enclosingAnchorElement(const Position&);
-bool isListElement(Node*);
-HTMLElement* enclosingList(Node*);
-HTMLElement* outermostEnclosingList(Node*);
-HTMLElement* enclosingListChild(Node*);
+// Boolean functions on Element
+    
 bool canMergeLists(Element* firstList, Element* secondList);
-Node* highestAncestor(Node*);
-bool isTableElement(Node*);
-bool isTableCell(const Node*);
-
-bool lineBreakExistsAtPosition(const Position&);
-bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
+    
+// -------------------------------------------------------------------------
+// VisibleSelection
+// -------------------------------------------------------------------------
+    
+// Functions returning VisibleSelection
 
+VisibleSelection avoidIntersectionWithNode(const VisibleSelection&, Node*);
 VisibleSelection selectionForParagraphIteration(const VisibleSelection&);
+    
+
+// Miscellaneous functions on String
+    
+String stringWithRebalancedWhitespace(const String&, bool, bool);
+const String& nonBreakingSpaceString();
+bool validBlockTag(const AtomicString&);
+    
 
-int indexForVisiblePosition(const VisiblePosition&);
-bool isVisiblyAdjacent(const Position& first, const Position& second);
-bool isNodeVisiblyContainedWithin(Node*, const Range*);
 }
 
 #endif
diff --git a/WebCore/editing/mac/SelectionControllerMac.mm b/WebCore/editing/mac/SelectionControllerMac.mm
index 5970f99..47fb434 100644
--- a/WebCore/editing/mac/SelectionControllerMac.mm
+++ b/WebCore/editing/mac/SelectionControllerMac.mm
@@ -38,7 +38,7 @@ void SelectionController::notifyAccessibilityForSelectionChange()
     Document* document = m_frame->document();
 
     if (AXObjectCache::accessibilityEnabled() && m_sel.start().isNotNull() && m_sel.end().isNotNull())
-        document->axObjectCache()->postNotification(m_sel.start().node()->renderer(), "AXSelectedTextChanged", false);
+        document->axObjectCache()->postNotification(m_sel.start().node()->renderer(), AXObjectCache::AXSelectedTextChanged, false);
 
     // if zoom feature is enabled, insertion point changes should update the zoom
     if (!UAZoomEnabled() || !m_sel.isCaret())
diff --git a/WebCore/editing/markup.cpp b/WebCore/editing/markup.cpp
index 14ce7f6..47714e7 100644
--- a/WebCore/editing/markup.cpp
+++ b/WebCore/editing/markup.cpp
@@ -420,7 +420,7 @@ static void appendStartMarkup(Vector<UChar>& result, const Node* node, const Ran
         case Node::COMMENT_NODE:
             // FIXME: Comment content is not escaped, but XMLSerializer (and possibly other callers) should raise an exception if it includes "-->".
             append(result, "<!--");
-            append(result, static_cast<const Comment*>(node)->nodeValue());
+            append(result, static_cast<const Comment*>(node)->data());
             append(result, "-->");
             break;
         case Node::DOCUMENT_NODE:
@@ -645,7 +645,7 @@ static void completeURLs(Node* node, const String& baseURL)
 {
     Vector<AttributeChange> changes;
 
-    KURL parsedBaseURL(baseURL);
+    KURL parsedBaseURL(ParsedURLString, baseURL);
 
     Node* end = node->traverseNextSibling();
     for (Node* n = node; n != end; n = n->traverseNextNode()) {
@@ -983,8 +983,16 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
                 if (!fullySelectedRootStyle->getPropertyCSSValue(CSSPropertyBackgroundImage) && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
                     fullySelectedRootStyle->setProperty(CSSPropertyBackgroundImage, "url('" + static_cast<Element*>(fullySelectedRoot)->getAttribute(backgroundAttr) + "')");
                 
-                if (fullySelectedRootStyle->length())
+                if (fullySelectedRootStyle->length()) {
+                    // Reset the CSS properties to avoid an assertion error in addStyleMarkup().
+                    // This assertion is caused at least when we select all text of a <body> element whose
+                    // 'text-decoration' property is "inherit", and copy it.
+                    if (!propertyMissingOrEqualToNone(fullySelectedRootStyle.get(), CSSPropertyTextDecoration))
+                        fullySelectedRootStyle->setProperty(CSSPropertyTextDecoration, CSSValueNone);
+                    if (!propertyMissingOrEqualToNone(fullySelectedRootStyle.get(), CSSPropertyWebkitTextDecorationsInEffect))
+                        fullySelectedRootStyle->setProperty(CSSPropertyWebkitTextDecorationsInEffect, CSSValueNone);
                     addStyleMarkup(preMarkups, markups, fullySelectedRootStyle.get(), document, true);
+                }
             } else {
                 // Since this node and all the other ancestors are not in the selection we want to set RangeFullySelectsNode to DoesNotFullySelectNode
                 // so that styles that affect the exterior of the node are not included.
diff --git a/WebCore/editing/visible_units.cpp b/WebCore/editing/visible_units.cpp
index 869c893..c96fdfd 100644
--- a/WebCore/editing/visible_units.cpp
+++ b/WebCore/editing/visible_units.cpp
@@ -611,7 +611,7 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
         Node* node = renderer->node();
         if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->lineTop()));
     }
     
     // Could not find a previous line. This means we must already be on the first line.
@@ -712,7 +712,7 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
         Node* node = renderer->node();
         if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->lineTop()));
     }    
 
     // Could not find a next line. This means we must already be on the last line.
diff --git a/WebCore/editing/wx/EditorWx.cpp b/WebCore/editing/wx/EditorWx.cpp
index 0a63215..cb9e836 100644
--- a/WebCore/editing/wx/EditorWx.cpp
+++ b/WebCore/editing/wx/EditorWx.cpp
@@ -27,6 +27,7 @@
 #include "Editor.h"
 
 #include "ClipboardWx.h"
+#include "NotImplemented.h"
 
 namespace WebCore {
 
@@ -35,4 +36,19 @@ PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
     return ClipboardWx::create(policy, true);
 }
 
+void Editor::showColorPanel()
+{
+    notImplemented();
+}
+
+void Editor::showFontPanel()
+{
+    notImplemented();
+}
+
+void Editor::showStylesPanel()
+{
+    notImplemented();
+}
+
 }
diff --git a/WebCore/history/CachedFrame.cpp b/WebCore/history/CachedFrame.cpp
index 5f4e746..16c7087 100644
--- a/WebCore/history/CachedFrame.cpp
+++ b/WebCore/history/CachedFrame.cpp
@@ -29,10 +29,13 @@
 #include "CachedFramePlatformData.h"
 #include "CString.h"
 #include "DocumentLoader.h"
+#include "ExceptionCode.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "FrameView.h"
 #include "Logging.h"
+#include "PageTransitionEvent.h"
 #include <wtf/RefCountedLeakCounter.h>
 
 #if ENABLE(SVG)
@@ -49,12 +52,58 @@ static WTF::RefCountedLeakCounter& cachedFrameCounter()
 }
 #endif
 
-CachedFrame::CachedFrame(Frame* frame)
+CachedFrameBase::CachedFrameBase(Frame* frame)
     : m_document(frame->document())
     , m_documentLoader(frame->loader()->documentLoader())
     , m_view(frame->view())
     , m_mousePressNode(frame->eventHandler()->mousePressNode())
     , m_url(frame->loader()->url())
+    , m_isMainFrame(!frame->tree()->parent())
+{
+}
+
+CachedFrameBase::~CachedFrameBase()
+{
+#ifndef NDEBUG
+    cachedFrameCounter().decrement();
+#endif
+    // CachedFrames should always have had destroy() called by their parent CachedPage
+    ASSERT(!m_document);
+}
+
+void CachedFrameBase::restore()
+{
+    ASSERT(m_document->view() == m_view);
+    
+    Frame* frame = m_view->frame();
+    m_cachedFrameScriptData->restore(frame);
+
+#if ENABLE(SVG)
+    if (m_document->svgExtensions())
+        m_document->accessSVGExtensions()->unpauseAnimations();
+#endif
+
+    frame->animation()->resumeAnimations(m_document.get());
+    frame->eventHandler()->setMousePressNode(m_mousePressNode.get());
+    m_document->resumeActiveDOMObjects();
+
+    // It is necessary to update any platform script objects after restoring the
+    // cached page.
+    frame->script()->updatePlatformScriptObjects();
+
+    // Reconstruct the FrameTree
+    for (unsigned i = 0; i < m_childFrames.size(); ++i)
+        frame->tree()->appendChild(m_childFrames[i]->view()->frame());
+
+    // Open the child CachedFrames in their respective FrameLoaders.
+    for (unsigned i = 0; i < m_childFrames.size(); ++i)
+        m_childFrames[i]->open();
+
+    m_document->dispatchWindowEvent(PageTransitionEvent::create(EventNames().pageshowEvent, true), m_document);
+}
+
+CachedFrame::CachedFrame(Frame* frame)
+    : CachedFrameBase(frame)
 {
 #ifndef NDEBUG
     cachedFrameCounter().increment();
@@ -67,46 +116,38 @@ CachedFrame::CachedFrame(Frame* frame)
     m_document->suspendActiveDOMObjects();
     m_cachedFrameScriptData.set(new ScriptCachedFrameData(frame));
     
+    // Custom scrollbar renderers will get reattached when the document comes out of the page cache
+    m_view->detachCustomScrollbars();
+
     m_document->documentWillBecomeInactive(); 
     frame->clearTimers();
     m_document->setInPageCache(true);
     
     frame->loader()->client()->savePlatformDataToCachedFrame(this);
 
+    // Create the CachedFrames for all Frames in the FrameTree.
     for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
         m_childFrames.append(CachedFrame::create(child));
 
-    LOG(PageCache, "Finished creating CachedFrame with url %s and documentloader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
-}
+    // Deconstruct the FrameTree, to restore it later.
+    // We do this for two reasons:
+    // 1 - We reuse the main frame, so when it navigates to a new page load it needs to start with a blank FrameTree.
+    // 2 - It's much easier to destroy a CachedFrame while it resides in the PageCache if it is disconnected from its parent.
+    for (unsigned i = 0; i < m_childFrames.size(); ++i)
+        frame->tree()->removeChild(m_childFrames[i]->view()->frame());
 
-CachedFrame::~CachedFrame()
-{
 #ifndef NDEBUG
-    cachedFrameCounter().decrement();
+    if (m_isMainFrame)
+        LOG(PageCache, "Finished creating CachedFrame for main frame url '%s' and DocumentLoader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
+    else
+        LOG(PageCache, "Finished creating CachedFrame for child frame with url '%s' and DocumentLoader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
 #endif
-
-    clear();
 }
 
-void CachedFrame::restore()
+void CachedFrame::open()
 {
-    ASSERT(m_document->view() == m_view);
-    
-    Frame* frame = m_view->frame();
-    m_cachedFrameScriptData->restore(frame);
-
-#if ENABLE(SVG)
-    if (m_document->svgExtensions())
-        m_document->accessSVGExtensions()->unpauseAnimations();
-#endif
-
-    frame->animation()->resumeAnimations(m_document.get());
-    frame->eventHandler()->setMousePressNode(mousePressNode());
-    m_document->resumeActiveDOMObjects();
-
-    // It is necessary to update any platform script objects after restoring the
-    // cached page.
-    frame->script()->updatePlatformScriptObjects();
+    ASSERT(m_view);
+    m_view->frame()->loader()->open(*this);
 }
 
 void CachedFrame::clear()
@@ -114,26 +155,16 @@ void CachedFrame::clear()
     if (!m_document)
         return;
 
-    if (m_cachedFramePlatformData)
-        m_cachedFramePlatformData->clear();
-        
+    // clear() should only be called for Frames representing documents that are no longer in the page cache.
+    // This means the CachedFrame has been:
+    // 1 - Successfully restore()'d by going back/forward.
+    // 2 - destroy()'ed because the PageCache is pruning or the WebView was closed.
+    ASSERT(!m_document->inPageCache());
     ASSERT(m_view);
     ASSERT(m_document->frame() == m_view->frame());
 
-    if (m_document->inPageCache()) {
-        Frame::clearTimers(m_view.get(), m_document.get());
-
-        // FIXME: Why do we need to call removeAllEventListeners here? When the document is in page cache, this method won't work
-        // fully anyway, because the document won't be able to access its DOMWindow object (due to being frameless).
-        m_document->removeAllEventListeners();
-
-        m_document->setInPageCache(false);
-        // FIXME: We don't call willRemove here. Why is that OK?
-        m_document->detach();
-        m_view->clearFrame();
-    }
-
-    ASSERT(!m_document->inPageCache());
+    for (int i = m_childFrames.size() - 1; i >= 0; --i)
+        m_childFrames[i]->clear();
 
     m_document = 0;
     m_view = 0;
@@ -141,10 +172,44 @@ void CachedFrame::clear()
     m_url = KURL();
 
     m_cachedFramePlatformData.clear();
-
     m_cachedFrameScriptData.clear();
 }
 
+void CachedFrame::destroy()
+{
+    if (!m_document)
+        return;
+    
+    // Only CachedFrames that are still in the PageCache should be destroyed in this manner
+    ASSERT(m_document->inPageCache());
+    ASSERT(m_view);
+    ASSERT(m_document->frame() == m_view->frame());
+
+    if (!m_isMainFrame) {
+        m_view->frame()->detachFromPage();
+        m_view->frame()->loader()->detachViewsAndDocumentLoader();
+    }
+    
+    for (int i = m_childFrames.size() - 1; i >= 0; --i)
+        m_childFrames[i]->destroy();
+
+    if (m_cachedFramePlatformData)
+        m_cachedFramePlatformData->clear();
+
+    Frame::clearTimers(m_view.get(), m_document.get());
+
+    // FIXME: Why do we need to call removeAllEventListeners here? When the document is in page cache, this method won't work
+    // fully anyway, because the document won't be able to access its DOMWindow object (due to being frameless).
+    m_document->removeAllEventListeners();
+
+    m_document->setInPageCache(false);
+    // FIXME: We don't call willRemove here. Why is that OK?
+    m_document->detach();
+    m_view->clearFrame();
+
+    clear();
+}
+
 void CachedFrame::setCachedFramePlatformData(CachedFramePlatformData* data)
 {
     m_cachedFramePlatformData.set(data);
diff --git a/WebCore/history/CachedFrame.h b/WebCore/history/CachedFrame.h
index 0302444..883c12a 100644
--- a/WebCore/history/CachedFrame.h
+++ b/WebCore/history/CachedFrame.h
@@ -43,29 +43,20 @@ namespace WebCore {
 
 typedef Vector<RefPtr<CachedFrame> > CachedFrameVector;
 
-class CachedFrame : public RefCounted<CachedFrame> {
+class CachedFrameBase {
 public:
-    static PassRefPtr<CachedFrame> create(Frame* frame) { return adoptRef(new CachedFrame(frame)); }
-    ~CachedFrame();
-
     void restore();
-    void clear();
 
     Document* document() const { return m_document.get(); }
-    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
     FrameView* view() const { return m_view.get(); }
-    Node* mousePressNode() const { return m_mousePressNode.get(); }
     const KURL& url() const { return m_url; }
     DOMWindow* domWindow() const { return m_cachedFrameScriptData->domWindow(); }
+    bool isMainFrame() { return m_isMainFrame; }
 
-    void setCachedFramePlatformData(CachedFramePlatformData*);
-    CachedFramePlatformData* cachedFramePlatformData();
+protected:
+    CachedFrameBase(Frame*);
+    ~CachedFrameBase();
     
-    int descendantFrameCount() const;
-
-private:
-    CachedFrame(Frame*);
-
     RefPtr<Document> m_document;
     RefPtr<DocumentLoader> m_documentLoader;
     RefPtr<FrameView> m_view;
@@ -73,10 +64,33 @@ private:
     KURL m_url;
     OwnPtr<ScriptCachedFrameData> m_cachedFrameScriptData;
     OwnPtr<CachedFramePlatformData> m_cachedFramePlatformData;
+    bool m_isMainFrame;
     
     CachedFrameVector m_childFrames;
 };
 
+class CachedFrame : public RefCounted<CachedFrame>, private CachedFrameBase {
+public:
+    static PassRefPtr<CachedFrame> create(Frame* frame) { return adoptRef(new CachedFrame(frame)); }
+
+    void open();
+    void clear();
+    void destroy();
+
+    void setCachedFramePlatformData(CachedFramePlatformData* data);
+    CachedFramePlatformData* cachedFramePlatformData();
+
+    using CachedFrameBase::document;
+    using CachedFrameBase::view;
+    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
+    Node* mousePressNode() const { return m_mousePressNode.get(); }
+
+    int descendantFrameCount() const;
+
+private:
+    CachedFrame(Frame*);
+};
+
 } // namespace WebCore
 
 #endif // CachedFrame_h
diff --git a/WebCore/history/CachedPage.cpp b/WebCore/history/CachedPage.cpp
index 8898ce2..20c5fd7 100644
--- a/WebCore/history/CachedPage.cpp
+++ b/WebCore/history/CachedPage.cpp
@@ -61,14 +61,17 @@ CachedPage::~CachedPage()
     cachedPageCounter.decrement();
 #endif
 
-    clear();
+    destroy();
+    ASSERT(!m_cachedMainFrame);
 }
 
 void CachedPage::restore(Page* page)
 {
+    ASSERT(m_cachedMainFrame);
     ASSERT(page && page->mainFrame() && page->mainFrame() == m_cachedMainFrame->view()->frame());
-    m_cachedMainFrame->restore();
 
+    m_cachedMainFrame->open();
+    
     // Restore the focus appearance for the focused element.
     // FIXME: Right now we don't support pages w/ frames in the b/f cache.  This may need to be tweaked when we add support for that.
     Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
@@ -76,11 +79,23 @@ void CachedPage::restore(Page* page)
         if (node->isElementNode())
             static_cast<Element*>(node)->updateFocusAppearance(true);
     }
+    
+    clear();
 }
 
 void CachedPage::clear()
 {
-    m_cachedMainFrame.clear();
+    ASSERT(m_cachedMainFrame);
+    m_cachedMainFrame->clear();
+    m_cachedMainFrame = 0;
+}
+
+void CachedPage::destroy()
+{
+    if (m_cachedMainFrame)
+        m_cachedMainFrame->destroy();
+
+    m_cachedMainFrame = 0;
 }
 
 } // namespace WebCore
diff --git a/WebCore/history/CachedPage.h b/WebCore/history/CachedPage.h
index 430cf3a..c68c753 100644
--- a/WebCore/history/CachedPage.h
+++ b/WebCore/history/CachedPage.h
@@ -46,12 +46,10 @@ public:
 
     void restore(Page*);
     void clear();
+    void destroy();
 
     Document* document() const { return m_cachedMainFrame->document(); }
     DocumentLoader* documentLoader() const { return m_cachedMainFrame->documentLoader(); }
-    FrameView* mainFrameView() const { return m_cachedMainFrame->view(); }
-    const KURL& url() const { return m_cachedMainFrame->url(); }
-    DOMWindow* domWindow() const { return m_cachedMainFrame->domWindow(); }
 
     double timeStamp() const { return m_timeStamp; }
     
diff --git a/WebCore/history/HistoryItem.cpp b/WebCore/history/HistoryItem.cpp
index 08143e8..efd7078 100644
--- a/WebCore/history/HistoryItem.cpp
+++ b/WebCore/history/HistoryItem.cpp
@@ -176,12 +176,12 @@ double HistoryItem::lastVisitedTime() const
 
 KURL HistoryItem::url() const
 {
-    return KURL(m_urlString);
+    return KURL(ParsedURLString, m_urlString);
 }
 
 KURL HistoryItem::originalURL() const
 {
-    return KURL(m_originalURLString);
+    return KURL(ParsedURLString, m_originalURLString);
 }
 
 const String& HistoryItem::referrer() const
diff --git a/WebCore/history/PageCache.cpp b/WebCore/history/PageCache.cpp
index 8d04f6f..9a3ecd7 100644
--- a/WebCore/history/PageCache.cpp
+++ b/WebCore/history/PageCache.cpp
@@ -182,7 +182,7 @@ void PageCache::releaseAutoreleasedPagesNow()
 
     CachedPageSet::iterator end = tmp.end();
     for (CachedPageSet::iterator it = tmp.begin(); it != end; ++it)
-        (*it)->clear();
+        (*it)->destroy();
 
     // Now do the prune.
     cache()->setPruneEnabled(true);
diff --git a/WebCore/history/qt/HistoryItemQt.cpp b/WebCore/history/qt/HistoryItemQt.cpp
index 68fee87..098a786 100644
--- a/WebCore/history/qt/HistoryItemQt.cpp
+++ b/WebCore/history/qt/HistoryItemQt.cpp
@@ -45,7 +45,7 @@ bool WebCore::HistoryItem::restoreState(QDataStream& in, int /*version*/)
     WebCore::IntPoint scrollPoint;
     WTF::Vector<int> weeklyVisitCounts;
     WTF::Vector<int> dailyVisitCounts;
-    bool loadFormdata;
+    // bool loadFormdata;
     // WebCore::String formContentType;
     // WTF::Vector<char> formData;
 
diff --git a/WebCore/html/CollectionType.h b/WebCore/html/CollectionType.h
index e5973a3..9d7bb54 100644
--- a/WebCore/html/CollectionType.h
+++ b/WebCore/html/CollectionType.h
@@ -51,6 +51,7 @@ enum CollectionType {
     TSectionRows, // all row elements in this table section
     TRCells,      // all cells in this row
     SelectOptions,
+    DataListOptions,
     MapAreas,
 
     OtherCollection
diff --git a/WebCore/html/HTMLAnchorElement.cpp b/WebCore/html/HTMLAnchorElement.cpp
index 1515460..daa7919 100644
--- a/WebCore/html/HTMLAnchorElement.cpp
+++ b/WebCore/html/HTMLAnchorElement.cpp
@@ -40,51 +40,46 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAnchorElement::HTMLAnchorElement(Document* document)
-    : HTMLElement(aTag, document)
-    , m_rootEditableElementForSelectionOnMouseDown(0)
+HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document, CreateElement)
     , m_wasShiftKeyDownOnMouseDown(false)
 {
 }
 
-HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document* document)
-    : HTMLElement(tagName, document)
-    , m_rootEditableElementForSelectionOnMouseDown(0)
-    , m_wasShiftKeyDownOnMouseDown(false)
+PassRefPtr<HTMLAnchorElement> HTMLAnchorElement::create(Document* document)
 {
+    return adoptRef(new HTMLAnchorElement(aTag, document));
 }
 
-bool HTMLAnchorElement::supportsFocus() const
+PassRefPtr<HTMLAnchorElement> HTMLAnchorElement::create(const QualifiedName& tagName, Document* document)
 {
-    if (isContentEditable())
-        return HTMLElement::supportsFocus();
-    return isFocusable() || (isLink() && document() && !document()->haveStylesheetsLoaded());
+    return adoptRef(new HTMLAnchorElement(tagName, document));
 }
 
-bool HTMLAnchorElement::isFocusable() const
+bool HTMLAnchorElement::supportsFocus() const
 {
     if (isContentEditable())
-        return HTMLElement::isFocusable();
-
-    // FIXME: Even if we are not visible, we might have a child that is visible.
-    // Dave wants to fix that some day with a "has visible content" flag or the like.
-    if (!(isLink() && renderer() && renderer()->style()->visibility() == VISIBLE))
-        return false;
-
-    return true;
+        return HTMLElement::supportsFocus();
+    // If not a link we should still be able to focus the element if it has tabIndex.
+    return isLink() || HTMLElement::supportsFocus();
 }
 
 bool HTMLAnchorElement::isMouseFocusable() const
 {
-#if PLATFORM(GTK)
-    return HTMLElement::isMouseFocusable();
-#else
-    return false;
+    // Anchor elements should be mouse focusable, https://bugs.webkit.org/show_bug.cgi?id=26856
+#if !PLATFORM(GTK)
+    if (isLink())
+        return false;
 #endif
+    // Allow tab index etc to control focus.
+    return HTMLElement::isMouseFocusable();
 }
 
 bool HTMLAnchorElement::isKeyboardFocusable(KeyboardEvent* event) const
 {
+    if (!isLink())
+        return HTMLElement::isKeyboardFocusable(event);
+
     if (!isFocusable())
         return false;
     
@@ -350,15 +345,17 @@ String HTMLAnchorElement::hash() const
 
 String HTMLAnchorElement::host() const
 {
-    return href().host();
+    const KURL& url = href();
+    if (url.hostEnd() == url.pathStart())
+        return url.host();
+    if (SecurityOrigin::isDefaultPortForProtocol(url.port(), url.protocol()))
+        return url.host();
+    return url.host() + ":" + String::number(url.port());
 }
 
 String HTMLAnchorElement::hostname() const
 {
-    const KURL& url = href();
-    if (url.port() == 0)
-        return url.host();
-    return url.host() + ":" + String::number(url.port());
+    return href().host();
 }
 
 String HTMLAnchorElement::pathname() const
diff --git a/WebCore/html/HTMLAnchorElement.h b/WebCore/html/HTMLAnchorElement.h
index 7779bed..8274af4 100644
--- a/WebCore/html/HTMLAnchorElement.h
+++ b/WebCore/html/HTMLAnchorElement.h
@@ -30,8 +30,8 @@ namespace WebCore {
 
 class HTMLAnchorElement : public HTMLElement {
 public:
-    HTMLAnchorElement(Document*);
-    HTMLAnchorElement(const QualifiedName&, Document*);
+    static PassRefPtr<HTMLAnchorElement> create(Document*);
+    static PassRefPtr<HTMLAnchorElement> create(const QualifiedName&, Document*);
 
     KURL href() const;
     void setHref(const AtomicString&);
@@ -53,6 +53,8 @@ public:
     bool isLiveLink() const;
 
 protected:
+    HTMLAnchorElement(const QualifiedName&, Document*);
+
     virtual void parseMappedAttribute(MappedAttribute*);
 
 private:
@@ -70,7 +72,7 @@ private:
     virtual short tabIndex() const;
     virtual bool draggable() const;
 
-    Element* m_rootEditableElementForSelectionOnMouseDown;
+    RefPtr<Element> m_rootEditableElementForSelectionOnMouseDown;
     bool m_wasShiftKeyDownOnMouseDown;
 };
 
diff --git a/WebCore/html/HTMLAppletElement.cpp b/WebCore/html/HTMLAppletElement.cpp
index dfa2597..46045d6 100644
--- a/WebCore/html/HTMLAppletElement.cpp
+++ b/WebCore/html/HTMLAppletElement.cpp
@@ -34,12 +34,17 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAppletElement::HTMLAppletElement(const QualifiedName& tagName, Document* doc)
-    : HTMLPlugInElement(tagName, doc)
+inline HTMLAppletElement::HTMLAppletElement(const QualifiedName& tagName, Document* document)
+    : HTMLPlugInElement(tagName, document)
 {
     ASSERT(hasTagName(appletTag));
 }
 
+PassRefPtr<HTMLAppletElement> HTMLAppletElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLAppletElement(tagName, document));
+}
+
 void HTMLAppletElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == altAttr ||
diff --git a/WebCore/html/HTMLAppletElement.h b/WebCore/html/HTMLAppletElement.h
index c616bb4..baaab38 100644
--- a/WebCore/html/HTMLAppletElement.h
+++ b/WebCore/html/HTMLAppletElement.h
@@ -27,12 +27,9 @@
 
 namespace WebCore {
 
-class HTMLFormElement;
-class HTMLImageLoader;
-
 class HTMLAppletElement : public HTMLPlugInElement {
 public:
-    HTMLAppletElement(const QualifiedName&, Document*);
+    static PassRefPtr<HTMLAppletElement> create(const QualifiedName&, Document*);
 
     String hspace() const;
     void setHspace(const String&);
@@ -41,6 +38,8 @@ public:
     void setVspace(const String&);
 
 private:
+    HTMLAppletElement(const QualifiedName&, Document*);
+
     virtual int tagPriority() const { return 1; }
 
     virtual void parseMappedAttribute(MappedAttribute*);
diff --git a/WebCore/html/HTMLAreaElement.cpp b/WebCore/html/HTMLAreaElement.cpp
index b878a1a..b202cae 100644
--- a/WebCore/html/HTMLAreaElement.cpp
+++ b/WebCore/html/HTMLAreaElement.cpp
@@ -34,9 +34,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* document)
+inline HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* document)
     : HTMLAnchorElement(tagName, document)
-    , m_coords(0)
     , m_coordsLen(0)
     , m_lastSize(-1, -1)
     , m_shape(Unknown)
@@ -44,9 +43,9 @@ HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* documen
     ASSERT(hasTagName(areaTag));
 }
 
-HTMLAreaElement::~HTMLAreaElement()
+PassRefPtr<HTMLAreaElement> HTMLAreaElement::create(const QualifiedName& tagName, Document* document)
 {
-    delete [] m_coords;
+    return adoptRef(new HTMLAreaElement(tagName, document));
 }
 
 void HTMLAreaElement::parseMappedAttribute(MappedAttribute* attr)
@@ -61,8 +60,7 @@ void HTMLAreaElement::parseMappedAttribute(MappedAttribute* attr)
         else if (equalIgnoringCase(attr->value(), "rect"))
             m_shape = Rect;
     } else if (attr->name() == coordsAttr) {
-        delete [] m_coords;
-        m_coords = newCoordsArray(attr->value().string(), m_coordsLen);
+        m_coords.set(newCoordsArray(attr->value().string(), m_coordsLen));
     } else if (attr->name() == altAttr || attr->name() == accesskeyAttr) {
         // Do nothing.
     } else
@@ -164,9 +162,10 @@ void HTMLAreaElement::setNoHref(bool noHref)
     setAttribute(nohrefAttr, noHref ? "" : 0);
 }
 
-bool HTMLAreaElement::isFocusable() const
+bool HTMLAreaElement::supportsFocus() const
 {
-    return HTMLElement::isFocusable();
+    // Skip HTMLAnchorElements isLink() check.
+    return HTMLElement::supportsFocus();
 }
 
 String HTMLAreaElement::target() const
diff --git a/WebCore/html/HTMLAreaElement.h b/WebCore/html/HTMLAreaElement.h
index fffd45e..7b2497c 100644
--- a/WebCore/html/HTMLAreaElement.h
+++ b/WebCore/html/HTMLAreaElement.h
@@ -25,6 +25,7 @@
 
 #include "HTMLAnchorElement.h"
 #include "IntSize.h"
+#include <wtf/OwnArrayPtr.h>
 
 namespace WebCore {
 
@@ -33,8 +34,7 @@ class Path;
 
 class HTMLAreaElement : public HTMLAnchorElement {
 public:
-    HTMLAreaElement(const QualifiedName&, Document*);
-    virtual ~HTMLAreaElement();
+    static PassRefPtr<HTMLAreaElement> create(const QualifiedName&, Document*);
 
     bool isDefault() const { return m_shape == Default; }
 
@@ -48,17 +48,19 @@ public:
     void setNoHref(bool);
 
 private:
+    HTMLAreaElement(const QualifiedName&, Document*);
+
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
     virtual int tagPriority() const { return 0; }
     virtual void parseMappedAttribute(MappedAttribute*);
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
     virtual String target() const;
 
     enum Shape { Default, Poly, Rect, Circle, Unknown };
     Path getRegion(const IntSize&) const;
 
     OwnPtr<Path> m_region;
-    Length* m_coords;
+    OwnArrayPtr<Length> m_coords;
     int m_coordsLen;
     IntSize m_lastSize;
     Shape m_shape;
diff --git a/WebCore/html/HTMLAttributeNames.in b/WebCore/html/HTMLAttributeNames.in
index 05c0cb7..3e16015 100644
--- a/WebCore/html/HTMLAttributeNames.in
+++ b/WebCore/html/HTMLAttributeNames.in
@@ -78,6 +78,7 @@ expanded
 face
 focused
 for
+formnovalidate
 frame
 frameborder
 headers
@@ -97,6 +98,7 @@ lang
 language
 leftmargin
 link
+list
 longdesc
 loop
 playcount
@@ -117,11 +119,13 @@ name
 nohref
 noresize
 noshade
+novalidate
 nowrap
 object
 onabort
 onbeforecopy
 onbeforecut
+onbeforeload
 onbeforepaste
 onbeforeunload
 onblur
@@ -147,12 +151,14 @@ onerror
 onfocus
 onhashchange
 oninput
+oninvalid
 onkeydown
 onkeypress
 onkeyup
 onload
 onloadeddata
 onloadedmetadata
+onloadend
 onloadstart
 onmousedown
 onmousemove
@@ -162,6 +168,9 @@ onmouseup
 onmousewheel
 ononline
 onoffline
+onorientationchange
+onpagehide
+onpageshow
 onpaste
 onpause
 onplay
diff --git a/WebCore/html/HTMLBodyElement.cpp b/WebCore/html/HTMLBodyElement.cpp
index 4667381..b203cc0 100644
--- a/WebCore/html/HTMLBodyElement.cpp
+++ b/WebCore/html/HTMLBodyElement.cpp
@@ -140,10 +140,18 @@ void HTMLBodyElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onunloadAttr)
         document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpagehideAttr)
+        document()->setWindowAttributeEventListener(eventNames().pagehideEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpageshowAttr)
+        document()->setWindowAttributeEventListener(eventNames().pageshowEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onblurAttr)
         document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
         document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
+#if ENABLE(ORIENTATION_EVENTS)
+    else if (attr->name() == onorientationchangeAttr)
+        document()->setWindowAttributeEventListener(eventNames().orientationchangeEvent, createAttributeEventListener(document()->frame(), attr));
+#endif
     else if (attr->name() == onhashchangeAttr)
         document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onresizeAttr)
@@ -341,114 +349,4 @@ void HTMLBodyElement::didMoveToNewOwnerDocument()
     HTMLElement::didMoveToNewOwnerDocument();
 }
 
-EventListener* HTMLBodyElement::onblur() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().blurEvent);
-}
-
-void HTMLBodyElement::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().blurEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onerror() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().errorEvent);
-}
-
-void HTMLBodyElement::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().errorEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onfocus() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().focusEvent);
-}
-
-void HTMLBodyElement::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().focusEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().loadEvent);
-}
-
-void HTMLBodyElement::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().loadEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onbeforeunload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().beforeunloadEvent);
-}
-
-void HTMLBodyElement::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onmessage() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().messageEvent);
-}
-
-void HTMLBodyElement::setOnmessage(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().messageEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onoffline() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().offlineEvent);
-}
-
-void HTMLBodyElement::setOnoffline(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().offlineEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::ononline() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().onlineEvent);
-}
-
-void HTMLBodyElement::setOnonline(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().onlineEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onresize() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().resizeEvent);
-}
-
-void HTMLBodyElement::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onstorage() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().storageEvent);
-}
-
-void HTMLBodyElement::setOnstorage(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().storageEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onunload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().unloadEvent);
-}
-
-void HTMLBodyElement::setOnunload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
-}
-
 } // namespace WebCore
diff --git a/WebCore/html/HTMLBodyElement.h b/WebCore/html/HTMLBodyElement.h
index 575d562..e898c88 100644
--- a/WebCore/html/HTMLBodyElement.h
+++ b/WebCore/html/HTMLBodyElement.h
@@ -25,6 +25,7 @@
 #define HTMLBodyElement_h
 
 #include "HTMLElement.h"
+#include "Document.h"
 
 namespace WebCore {
 
@@ -44,29 +45,23 @@ public:
     String vLink() const;
     void setVLink(const String&);
 
-    virtual EventListener* onblur() const;
-    virtual void setOnblur(PassRefPtr<EventListener>);
-    virtual EventListener* onerror() const;
-    virtual void setOnerror(PassRefPtr<EventListener>);
-    virtual EventListener* onfocus() const;
-    virtual void setOnfocus(PassRefPtr<EventListener>);
-    virtual EventListener* onload() const;
-    virtual void setOnload(PassRefPtr<EventListener>);
+    // Declared virtual in Element
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(blur);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(focus);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(load);
 
-    EventListener* onbeforeunload() const;
-    void setOnbeforeunload(PassRefPtr<EventListener>);
-    EventListener* onmessage() const;
-    void setOnmessage(PassRefPtr<EventListener>);
-    EventListener* onoffline() const;
-    void setOnoffline(PassRefPtr<EventListener>);
-    EventListener* ononline() const;
-    void setOnonline(PassRefPtr<EventListener>);
-    EventListener* onresize() const;
-    void setOnresize(PassRefPtr<EventListener>);
-    EventListener* onstorage() const;
-    void setOnstorage(PassRefPtr<EventListener>);
-    EventListener* onunload() const;
-    void setOnunload(PassRefPtr<EventListener>);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(beforeunload);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(hashchange);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
+#if ENABLE(ORIENTATION_EVENTS)
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(orientationchange);
+#endif
 
 private:
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
diff --git a/WebCore/html/HTMLBodyElement.idl b/WebCore/html/HTMLBodyElement.idl
index 097b4ac..2e93e2e 100644
--- a/WebCore/html/HTMLBodyElement.idl
+++ b/WebCore/html/HTMLBodyElement.idl
@@ -36,6 +36,7 @@ module html {
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler attributes
         attribute [DontEnum] EventListener onbeforeunload;
+        attribute [DontEnum] EventListener onhashchange;
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
@@ -43,10 +44,19 @@ module html {
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
 
+#if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
+        attribute [DontEnum] EventListener onorientationchange;
+#endif
+
+        // Overrides of Element attributes (left in for completeness).
+        // attribute [DontEnum] EventListener onblur;
+        // attribute [DontEnum] EventListener onerror;
+        // attribute [DontEnum] EventListener onfocus;
+        // attribute [DontEnum] EventListener onload;
+
         // Not implemented yet.
         // attribute [DontEnum] EventListener onafterprint;
         // attribute [DontEnum] EventListener onbeforeprint;
-        // attribute [DontEnum] EventListener onhashchange;
         // attribute [DontEnum] EventListener onpopstate;
         // attribute [DontEnum] EventListener onredo;
         // attribute [DontEnum] EventListener onundo;
diff --git a/WebCore/html/HTMLButtonElement.idl b/WebCore/html/HTMLButtonElement.idl
index 5fd0075..55803df 100644
--- a/WebCore/html/HTMLButtonElement.idl
+++ b/WebCore/html/HTMLButtonElement.idl
@@ -26,6 +26,7 @@ module html {
         ImplementationUUID=1be13b5f-40df-4550-b70e-8c805e546cad
     ] HTMLButtonElement : HTMLElement {
         readonly attribute  HTMLFormElement      form;
+                 attribute  boolean              formNoValidate;
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute  ValidityState        validity;
 #endif
@@ -36,6 +37,7 @@ module html {
         readonly attribute  DOMString            type;
                  attribute  [ConvertNullToNullString] DOMString            value;
         readonly attribute boolean               willValidate;
+        boolean  checkValidity();
         void setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void click();
     };
diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index 203579b..e3fe329 100644
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -30,6 +30,9 @@
 #include "CanvasGradient.h"
 #include "CanvasPattern.h"
 #include "CanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)    
+#include "CanvasRenderingContext3D.h"
+#endif
 #include "CanvasStyle.h"
 #include "Chrome.h"
 #include "Document.h"
@@ -146,17 +149,45 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, ExceptionCode& ec)
 
 CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
 {
+    // A Canvas can either be "2D" or "3D" never both. If you request a 2D canvas and the existing
+    // context is already 2D, just return that. If the existing context is 3D, then destroy it
+    // before creating a new 2D context. Vice versa when requesting a 3D canvas. Requesting a
+    // context with any other type string will destroy any existing context.
+    
+    // FIXME - The code depends on the context not going away once created, to prevent JS from
+    // seeing a dangling pointer. So for now we will disallow the context from being changed
+    // once it is created.
     if (type == "2d") {
-        if (!m_2DContext)
-            m_2DContext.set(new CanvasRenderingContext2D(this));
-        return m_2DContext.get();
+        if (m_context && !m_context->is2d())
+            return 0;
+        if (!m_context)
+            m_context = new CanvasRenderingContext2D(this);
+        return m_context.get();
+    }
+#if ENABLE(3D_CANVAS)    
+    Settings* settings = document()->settings();
+    if (settings && settings->webGLEnabled()) {
+        if ((type == "webkit-3d") ||
+            (type == "GL")) {
+            if (m_context && !m_context->is3d())
+                return 0;
+            if (!m_context) {
+                m_context = new CanvasRenderingContext3D(this);
+
+                // Need to make sure a RenderLayer and compositing layer get created for the Canvas
+                setNeedsStyleRecalc(SyntheticStyleChange);
+            }
+            return m_context.get();
+        }
     }
+#endif
     return 0;
 }
 
 void HTMLCanvasElement::willDraw(const FloatRect& rect)
 {
-    m_imageBuffer->clearImage();
+    if (m_imageBuffer)
+        m_imageBuffer->clearImage();
     
     if (RenderBox* ro = renderBox()) {
         FloatRect destRect = ro->contentBoxRect();
@@ -192,8 +223,8 @@ void HTMLCanvasElement::reset()
     bool hadImageBuffer = m_createdImageBuffer;
     m_createdImageBuffer = false;
     m_imageBuffer.clear();
-    if (m_2DContext)
-        m_2DContext->reset();
+    if (m_context && m_context->is2d())
+        static_cast<CanvasRenderingContext2D*>(m_context.get())->reset();
 
     if (RenderObject* renderer = this->renderer()) {
         if (m_rendererIsCanvas) {
@@ -216,11 +247,26 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
     if (context->paintingDisabled())
         return;
     
+#if ENABLE(3D_CANVAS)
+    CanvasRenderingContext3D* context3D = NULL;
+    if (m_context && m_context->is3d()) {
+        context3D = static_cast<CanvasRenderingContext3D*>(m_context.get());
+        context3D->beginPaint();
+    }
+#endif
+
     if (m_imageBuffer) {
         Image* image = m_imageBuffer->image();
         if (image)
             context->drawImage(image, r);
     }
+
+#if ENABLE(3D_CANVAS)
+    if (context3D != NULL) {
+        context3D->reshape(r.width(), r.height());
+        context3D->endPaint();
+    }
+#endif
 }
 
 IntRect HTMLCanvasElement::convertLogicalToDevice(const FloatRect& logicalRect) const
@@ -293,4 +339,11 @@ TransformationMatrix HTMLCanvasElement::baseTransform() const
     return transform;
 }
 
+#if ENABLE(3D_CANVAS)    
+bool HTMLCanvasElement::is3D() const
+{
+    return m_context && m_context->is3d();
+}
+#endif
+
 }
diff --git a/WebCore/html/HTMLCanvasElement.h b/WebCore/html/HTMLCanvasElement.h
index bba1f2d..edae9e5 100644
--- a/WebCore/html/HTMLCanvasElement.h
+++ b/WebCore/html/HTMLCanvasElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,12 +30,14 @@
 #include "TransformationMatrix.h"
 #include "FloatRect.h"
 #include "HTMLElement.h"
+#if ENABLE(3D_CANVAS)    
+#include "GraphicsContext3D.h"
+#endif
 #include "IntSize.h"
 
 namespace WebCore {
 
-class CanvasRenderingContext2D;
-typedef CanvasRenderingContext2D CanvasRenderingContext;
+class CanvasRenderingContext;
 class FloatPoint;
 class FloatRect;
 class FloatSize;
@@ -47,7 +49,7 @@ class IntSize;
 
 class CanvasObserver {
 public:
-    virtual ~CanvasObserver() {};
+    virtual ~CanvasObserver() { }
 
     virtual void canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect) = 0;
     virtual void canvasResized(HTMLCanvasElement*) = 0;
@@ -59,11 +61,6 @@ public:
     HTMLCanvasElement(const QualifiedName&, Document*);
     virtual ~HTMLCanvasElement();
 
-#if ENABLE(DASHBOARD_SUPPORT)
-    virtual HTMLTagStatus endTagRequirement() const;
-    virtual int tagPriority() const;
-#endif
-
     int width() const { return m_size.width(); }
     int height() const { return m_size.height(); }
     void setWidth(int);
@@ -73,10 +70,7 @@ public:
 
     CanvasRenderingContext* getContext(const String&);
 
-    virtual void parseMappedAttribute(MappedAttribute*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
-    IntSize size() const { return m_size; }
+    const IntSize& size() const { return m_size; }
     void setSize(const IntSize& size)
     { 
         if (size == m_size)
@@ -103,18 +97,33 @@ public:
     void setOriginTainted() { m_originClean = false; } 
     bool originClean() const { return m_originClean; }
 
-    static const float MaxCanvasArea;
-
-    void setObserver(CanvasObserver* o) { m_observer = o; }
+    void setObserver(CanvasObserver* observer) { m_observer = observer; }
 
     TransformationMatrix baseTransform() const;
+
+    CanvasRenderingContext* renderingContext() const { return m_context.get(); }
+
+#if ENABLE(3D_CANVAS)    
+    bool is3D() const;
+#endif
+
 private:
+#if ENABLE(DASHBOARD_SUPPORT)
+    virtual HTMLTagStatus endTagRequirement() const;
+    virtual int tagPriority() const;
+#endif
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
     void createImageBuffer() const;
     void reset();
 
+    static const float MaxCanvasArea;
+
     bool m_rendererIsCanvas;
 
-    OwnPtr<CanvasRenderingContext2D> m_2DContext;
+    OwnPtr<CanvasRenderingContext> m_context;
     IntSize m_size;    
     CanvasObserver* m_observer;
 
diff --git a/WebCore/html/HTMLCanvasElement.idl b/WebCore/html/HTMLCanvasElement.idl
index 13fc623..4b1b057 100644
--- a/WebCore/html/HTMLCanvasElement.idl
+++ b/WebCore/html/HTMLCanvasElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
 module html {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         InterfaceUUID=a14d88c8-c6af-4e34-ad17-659700c77a10,
         ImplementationUUID=7ae731bc-c264-4ee3-a4b4-5d4540af26c3
diff --git a/WebCore/html/HTMLCollection.cpp b/WebCore/html/HTMLCollection.cpp
index de4c424..76de60a 100644
--- a/WebCore/html/HTMLCollection.cpp
+++ b/WebCore/html/HTMLCollection.cpp
@@ -27,6 +27,7 @@
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
+#include "HTMLOptionElement.h"
 #include "NodeList.h"
 
 #include <utility>
@@ -104,6 +105,7 @@ Element* HTMLCollection::itemAfter(Element* previous) const
         case MapAreas:
         case OtherCollection:
         case SelectOptions:
+        case DataListOptions:
         case WindowNamedItems:
             break;
         case NodeChildren:
@@ -153,6 +155,13 @@ Element* HTMLCollection::itemAfter(Element* previous) const
                 if (e->hasLocalName(optionTag))
                     return e;
                 break;
+            case DataListOptions:
+                if (e->hasLocalName(optionTag)) {
+                    HTMLOptionElement* option = static_cast<HTMLOptionElement*>(e);
+                    if (!option->disabled() && !option->value().isEmpty())
+                        return e;
+                }
+                break;
             case MapAreas:
                 if (e->hasLocalName(areaTag))
                     return e;
diff --git a/WebCore/html/HTMLDataListElement.cpp b/WebCore/html/HTMLDataListElement.cpp
new file mode 100644
index 0000000..a6ca525
--- /dev/null
+++ b/WebCore/html/HTMLDataListElement.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(DATALIST)
+#include "HTMLDataListElement.h"
+
+#include "HTMLNames.h"
+
+namespace WebCore {
+
+HTMLDataListElement::HTMLDataListElement(const QualifiedName& tagName, Document *doc)
+    : HTMLElement(tagName, doc)
+{
+}
+
+HTMLDataListElement::~HTMLDataListElement()
+{
+}
+
+bool HTMLDataListElement::checkDTD(const Node* newChild)
+{
+    return newChild->hasTagName(HTMLNames::optionTag) || HTMLElement::inInlineTagList(newChild);
+}
+
+PassRefPtr<HTMLCollection> HTMLDataListElement::options()
+{
+    return HTMLCollection::create(this, DataListOptions);
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(DATALIST)
diff --git a/WebCore/html/HTMLDataListElement.h b/WebCore/html/HTMLDataListElement.h
new file mode 100644
index 0000000..8c4cfbc
--- /dev/null
+++ b/WebCore/html/HTMLDataListElement.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLDataListElement_h
+#define HTMLDataListElement_h
+
+#if ENABLE(DATALIST)
+
+#include "HTMLCollection.h"
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+    class HTMLDataListElement : public HTMLElement {
+    public:
+        HTMLDataListElement(const QualifiedName&, Document*);
+        virtual ~HTMLDataListElement();
+        PassRefPtr<HTMLCollection> options();
+
+    private:
+        virtual bool checkDTD(const Node*);
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(DATALIST)
+
+#endif  // HTMLDataListElement_h
diff --git a/WebCore/html/HTMLDataListElement.idl b/WebCore/html/HTMLDataListElement.idl
new file mode 100644
index 0000000..916c0a1
--- /dev/null
+++ b/WebCore/html/HTMLDataListElement.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        GenerateConstructor,
+        Conditional=DATALIST
+    ] HTMLDataListElement : HTMLElement {
+        readonly attribute HTMLCollection options;
+    };
+}
diff --git a/WebCore/html/HTMLDocument.cpp b/WebCore/html/HTMLDocument.cpp
index 96ae9e4..fd939c8 100644
--- a/WebCore/html/HTMLDocument.cpp
+++ b/WebCore/html/HTMLDocument.cpp
@@ -109,14 +109,14 @@ String HTMLDocument::dir()
     HTMLElement* b = body();
     if (!b)
         return String();
-    return b->dir();
+    return b->getAttribute(dirAttr);
 }
 
 void HTMLDocument::setDir(const String& value)
 {
     HTMLElement* b = body();
     if (b)
-        b->setDir(value);
+        b->setAttribute(dirAttr, value);
 }
 
 String HTMLDocument::designMode() const
@@ -284,8 +284,10 @@ void HTMLDocument::releaseEvents()
 Tokenizer *HTMLDocument::createTokenizer()
 {
     bool reportErrors = false;
+#if ENABLE(INSPECTOR)
     if (Page* page = this->page())
         reportErrors = page->inspectorController()->windowVisible();
+#endif
 
     return new HTMLTokenizer(this, reportErrors);
 }
diff --git a/WebCore/html/HTMLDocument.h b/WebCore/html/HTMLDocument.h
index eda7593..4b14d0c 100644
--- a/WebCore/html/HTMLDocument.h
+++ b/WebCore/html/HTMLDocument.h
@@ -37,7 +37,7 @@ class HTMLDocument : public Document, public CachedResourceClient {
 public:
     static PassRefPtr<HTMLDocument> create(Frame* frame)
     {
-        return new HTMLDocument(frame);
+        return adoptRef(new HTMLDocument(frame));
     }
     virtual ~HTMLDocument();
 
@@ -71,10 +71,6 @@ public:
     void captureEvents();
     void releaseEvents();
 
-    virtual bool childAllowed(Node*);
-
-    virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
-
     void addNamedItem(const AtomicString& name);
     void removeNamedItem(const AtomicString& name);
     bool hasNamedItem(AtomicStringImpl* name);
@@ -87,6 +83,10 @@ protected:
     HTMLDocument(Frame*);
 
 private:
+    virtual bool childAllowed(Node*);
+
+    virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
+
     virtual bool isHTMLDocument() const { return true; }
     virtual bool isFrameSet() const;
     virtual Tokenizer* createTokenizer();
diff --git a/WebCore/html/HTMLElement.cpp b/WebCore/html/HTMLElement.cpp
index b310cad..a4807ba 100644
--- a/WebCore/html/HTMLElement.cpp
+++ b/WebCore/html/HTMLElement.cpp
@@ -56,13 +56,9 @@ using namespace HTMLNames;
 using std::min;
 using std::max;
 
-HTMLElement::HTMLElement(const QualifiedName& tagName, Document *doc)
-    : StyledElement(tagName, doc)
-{
-}
-
-HTMLElement::~HTMLElement()
+PassRefPtr<HTMLElement> HTMLElement::create(const QualifiedName& tagName, Document* document)
 {
+    return adoptRef(new HTMLElement(tagName, document, CreateElement));
 }
 
 String HTMLElement::nodeName() const
@@ -92,7 +88,7 @@ int HTMLElement::tagPriority() const
         return 0;
     if (hasLocalName(addressTag) || hasLocalName(ddTag) || hasLocalName(dtTag) || hasLocalName(noscriptTag) || hasLocalName(rpTag) || hasLocalName(rtTag))
         return 3;
-    if (hasLocalName(centerTag) || hasLocalName(nobrTag) || hasLocalName(rubyTag))
+    if (hasLocalName(centerTag) || hasLocalName(nobrTag) || hasLocalName(rubyTag) || hasLocalName(navTag))
         return 5;
     if (hasLocalName(noembedTag) || hasLocalName(noframesTag))
         return 10;
@@ -234,6 +230,8 @@ void HTMLElement::parseMappedAttribute(MappedAttribute *attr)
 #endif
     } else if (attr->name() == oninputAttr) {
         setAttributeEventListener(eventNames().inputEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == oninvalidAttr) {
+        setAttributeEventListener(eventNames().invalidEvent, createAttributeEventListener(this, attr));
     }
 }
 
@@ -257,7 +255,7 @@ PassRefPtr<DocumentFragment> HTMLElement::createContextualFragment(const String
         hasLocalName(headTag) || hasLocalName(styleTag) || hasLocalName(titleTag))
         return 0;
 
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
     
     if (document()->isHTMLDocument())
          parseHTMLDocumentFragment(html, fragment.get());
@@ -319,7 +317,7 @@ static void replaceChildrenWithFragment(HTMLElement* element, PassRefPtr<Documen
     }
 
     if (hasOneTextChild(element) && hasOneTextChild(fragment.get())) {
-        static_cast<Text*>(element->firstChild())->setData(static_cast<Text*>(fragment->firstChild())->string(), ec);
+        static_cast<Text*>(element->firstChild())->setData(static_cast<Text*>(fragment->firstChild())->data(), ec);
         return;
     }
 
@@ -339,7 +337,7 @@ static void replaceChildrenWithText(HTMLElement* element, const String& text, Ex
         return;
     }
 
-    RefPtr<Text> textNode = new Text(element->document(), text);
+    RefPtr<Text> textNode = Text::create(element->document(), text);
 
     if (hasOneChild(element)) {
         element->replaceChild(textNode.release(), element->firstChild(), ec);
@@ -425,7 +423,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
 
     // Add text nodes and <br> elements.
     ec = 0;
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
     int lineStart = 0;
     UChar prev = 0;
     int length = text.length();
@@ -433,7 +431,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
         UChar c = text[i];
         if (c == '\n' || c == '\r') {
             if (i > lineStart) {
-                fragment->appendChild(new Text(document(), text.substring(lineStart, i - lineStart)), ec);
+                fragment->appendChild(Text::create(document(), text.substring(lineStart, i - lineStart)), ec);
                 if (ec)
                     return;
             }
@@ -447,7 +445,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
         prev = c;
     }
     if (length > lineStart)
-        fragment->appendChild(new Text(document(), text.substring(lineStart, length - lineStart)), ec);
+        fragment->appendChild(Text::create(document(), text.substring(lineStart, length - lineStart)), ec);
     replaceChildrenWithFragment(this, fragment.release(), ec);
 }
 
@@ -475,7 +473,7 @@ void HTMLElement::setOuterText(const String &text, ExceptionCode& ec)
     // FIXME: This creates a new text node even when the text is empty.
     // FIXME: This creates a single text node even when the text has CR and LF
     // characters in it. Instead it should create <br> elements.
-    RefPtr<Text> t = new Text(document(), text);
+    RefPtr<Text> t = Text::create(document(), text);
     ec = 0;
     parent->replaceChild(t, this, ec);
     if (ec)
@@ -613,9 +611,9 @@ void HTMLElement::addHTMLAlignmentToStyledElement(StyledElement* element, Mapped
         element->addCSSProperty(attr, CSSPropertyVerticalAlign, verticalAlignValue);
 }
 
-bool HTMLElement::isFocusable() const
+bool HTMLElement::supportsFocus() const
 {
-    return Element::isFocusable() || (isContentEditable() && parent() && !parent()->isContentEditable());
+    return Element::supportsFocus() || (isContentEditable() && parent() && !parent()->isContentEditable());
 }
 
 bool HTMLElement::isContentEditable() const 
@@ -737,56 +735,11 @@ void HTMLElement::accessKeyAction(bool sendToAnyElement)
         dispatchSimulatedClick(0, true);
 }
 
-String HTMLElement::id() const
-{
-    return getAttribute(idAttr);
-}
-
-void HTMLElement::setId(const String& value)
-{
-    setAttribute(idAttr, value);
-}
-
 String HTMLElement::title() const
 {
     return getAttribute(titleAttr);
 }
 
-void HTMLElement::setTitle(const String& value)
-{
-    setAttribute(titleAttr, value);
-}
-
-String HTMLElement::lang() const
-{
-    return getAttribute(langAttr);
-}
-
-void HTMLElement::setLang(const String& value)
-{
-    setAttribute(langAttr, value);
-}
-
-String HTMLElement::dir() const
-{
-    return getAttribute(dirAttr);
-}
-
-void HTMLElement::setDir(const String &value)
-{
-    setAttribute(dirAttr, value);
-}
-
-String HTMLElement::className() const
-{
-    return getAttribute(classAttr);
-}
-
-void HTMLElement::setClassName(const String &value)
-{
-    setAttribute(classAttr, value);
-}
-
 short HTMLElement::tabIndex() const
 {
     if (supportsFocus())
@@ -894,6 +847,7 @@ static HashSet<AtomicStringImpl*>* inlineTagList()
         tagList.add(textareaTag.localName().impl());
         tagList.add(labelTag.localName().impl());
         tagList.add(buttonTag.localName().impl());
+        tagList.add(datalistTag.localName().impl());
         tagList.add(insTag.localName().impl());
         tagList.add(delTag.localName().impl());
         tagList.add(nobrTag.localName().impl());
@@ -936,6 +890,7 @@ static HashSet<AtomicStringImpl*>* blockTagList()
         tagList.add(listingTag.localName().impl());
         tagList.add(marqueeTag.localName().impl());
         tagList.add(menuTag.localName().impl());
+        tagList.add(navTag.localName().impl());
         tagList.add(noembedTag.localName().impl());
         tagList.add(noframesTag.localName().impl());
         tagList.add(nolayerTag.localName().impl());
diff --git a/WebCore/html/HTMLElement.h b/WebCore/html/HTMLElement.h
index 21b3bb5..c6a384b 100644
--- a/WebCore/html/HTMLElement.h
+++ b/WebCore/html/HTMLElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,28 +35,12 @@ enum HTMLTagStatus { TagStatusOptional, TagStatusRequired, TagStatusForbidden };
                        
 class HTMLElement : public StyledElement {
 public:
-    HTMLElement(const QualifiedName& tagName, Document*);
-    virtual ~HTMLElement();
-
-    virtual bool isHTMLElement() const { return true; }
-
-    virtual String nodeName() const;
-
-    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
-    virtual void parseMappedAttribute(MappedAttribute*);
+    static PassRefPtr<HTMLElement> create(const QualifiedName& tagName, Document*);
 
     PassRefPtr<HTMLCollection> children();
     
-    String id() const;
-    void setId(const String&);
     virtual String title() const;
-    void setTitle(const String&);
-    String lang() const;
-    void setLang(const String&);
-    String dir() const;
-    void setDir(const String&);
-    String className() const;
-    void setClassName(const String&);
+
     virtual short tabIndex() const;
     void setTabIndex(int);
 
@@ -72,12 +56,13 @@ public:
     void insertAdjacentHTML(const String& where, const String& html, ExceptionCode&);
     void insertAdjacentText(const String& where, const String& text, ExceptionCode&);
 
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
+    
     virtual bool isContentEditable() const;
     virtual bool isContentRichlyEditable() const;
-    virtual String contentEditable() const;
-    virtual void setContentEditable(MappedAttribute*);
-    virtual void setContentEditable(const String&);
+
+    String contentEditable() const;
+    void setContentEditable(const String&);
 
     virtual bool draggable() const;
     void setDraggable(bool);
@@ -88,31 +73,51 @@ public:
 
     virtual HTMLTagStatus endTagRequirement() const;
     virtual int tagPriority() const;
+
+    virtual bool rendererIsNeeded(RenderStyle*);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
+    HTMLFormElement* form() const { return virtualForm(); }
+
+    static void addHTMLAlignmentToStyledElement(StyledElement*, MappedAttribute*);
+
+protected:
+    HTMLElement(const QualifiedName& tagName, Document*, ConstructionType = CreateElementZeroRefCount);
+
+    void addHTMLAlignment(MappedAttribute*);
+
+    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
+    virtual void parseMappedAttribute(MappedAttribute*);
+
     virtual bool childAllowed(Node* newChild); // Error-checking during parsing that checks the DTD
 
     // Helper function to check the DTD for a given child node.
     virtual bool checkDTD(const Node*);
+
     static bool inEitherTagList(const Node*);
     static bool inInlineTagList(const Node*);
     static bool inBlockTagList(const Node*);
     static bool isRecognizedTagName(const QualifiedName&);
 
-    virtual bool rendererIsNeeded(RenderStyle*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
-    HTMLFormElement* form() const { return virtualForm(); }
     HTMLFormElement* findFormAncestor() const;
 
-    static void addHTMLAlignmentToStyledElement(StyledElement*, MappedAttribute*);
+private:
+    virtual bool isHTMLElement() const { return true; }
 
-protected:
-    void addHTMLAlignment(MappedAttribute*);
+    virtual String nodeName() const;
+
+    void setContentEditable(MappedAttribute*);
 
-private:
     virtual HTMLFormElement* virtualForm() const;
+
     Node* insertAdjacent(const String& where, Node* newChild, ExceptionCode&);
 };
 
+inline HTMLElement::HTMLElement(const QualifiedName& tagName, Document* document, ConstructionType type)
+    : StyledElement(tagName, document, type)
+{
+}
+
 } // namespace WebCore
 
 #endif // HTMLElement_h
diff --git a/WebCore/html/HTMLEmbedElement.cpp b/WebCore/html/HTMLEmbedElement.cpp
index 3f6db9a..81b88a4 100644
--- a/WebCore/html/HTMLEmbedElement.cpp
+++ b/WebCore/html/HTMLEmbedElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -42,15 +42,16 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLEmbedElement::HTMLEmbedElement(const QualifiedName& tagName, Document* doc)
-    : HTMLPlugInImageElement(tagName, doc)
+inline HTMLEmbedElement::HTMLEmbedElement(const QualifiedName& tagName, Document* document)
+    : HTMLPlugInImageElement(tagName, document)
     , m_needWidgetUpdate(false)
 {
     ASSERT(hasTagName(embedTag));
 }
 
-HTMLEmbedElement::~HTMLEmbedElement()
+PassRefPtr<HTMLEmbedElement> HTMLEmbedElement::create(const QualifiedName& tagName, Document* document)
 {
+    return adoptRef(new HTMLEmbedElement(tagName, document));
 }
 
 static inline RenderWidget* findWidgetRenderer(const Node* n) 
@@ -238,31 +239,11 @@ const QualifiedName& HTMLEmbedElement::imageSourceAttributeName() const
     return srcAttr;
 }
 
-String HTMLEmbedElement::src() const
-{
-    return getAttribute(srcAttr);
-}
-
-void HTMLEmbedElement::setSrc(const String& value)
-{
-    setAttribute(srcAttr, value);
-}
-
-String HTMLEmbedElement::type() const
-{
-    return getAttribute(typeAttr);
-}
-
-void HTMLEmbedElement::setType(const String& value)
-{
-    setAttribute(typeAttr, value);
-}
-
 void HTMLEmbedElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLPlugInImageElement::addSubresourceAttributeURLs(urls);
 
-    addSubresourceURL(urls, document()->completeURL(src()));
+    addSubresourceURL(urls, document()->completeURL(getAttribute(srcAttr)));
 }
 
 }
diff --git a/WebCore/html/HTMLEmbedElement.h b/WebCore/html/HTMLEmbedElement.h
index 2ce182a..16f0893 100644
--- a/WebCore/html/HTMLEmbedElement.h
+++ b/WebCore/html/HTMLEmbedElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,8 +29,12 @@ namespace WebCore {
 
 class HTMLEmbedElement : public HTMLPlugInImageElement {
 public:
+    static PassRefPtr<HTMLEmbedElement> create(const QualifiedName&, Document*);
+
+    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
+
+private:
     HTMLEmbedElement(const QualifiedName&, Document*);
-    ~HTMLEmbedElement();
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
     virtual int tagPriority() const { return 0; }
@@ -50,19 +54,11 @@ public:
     virtual const QualifiedName& imageSourceAttributeName() const;
 
     virtual void updateWidget();
-    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
 
     virtual RenderWidget* renderWidgetForJSBindings() const;
 
-    String src() const;
-    void setSrc(const String&);
-
-    String type() const;
-    void setType(const String&);
-
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-private:
     bool m_needWidgetUpdate;
 };
 
diff --git a/WebCore/html/HTMLEmbedElement.idl b/WebCore/html/HTMLEmbedElement.idl
index a38402c..05c10db 100644
--- a/WebCore/html/HTMLEmbedElement.idl
+++ b/WebCore/html/HTMLEmbedElement.idl
@@ -29,17 +29,17 @@ module html {
         InterfaceUUID=18f9bd58-6bb3-4b5c-aa30-6da13adfc91e,
         ImplementationUUID=93e0407a-8380-4ff0-978d-f773f2dee6a3
     ] HTMLEmbedElement : HTMLElement {
-                 attribute [ConvertNullToNullString] DOMString align;
+                 attribute [ConvertNullToNullString, Reflect] DOMString align;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString height;
+                 attribute [ConvertNullToNullString, Reflect] DOMString height;
 #else
                  attribute [ConvertFromString] long height;
 #endif
-                 attribute [ConvertNullToNullString] DOMString name;
-                 attribute [ConvertNullToNullString] DOMString src;
-                 attribute [ConvertNullToNullString] DOMString type;
+                 attribute [ConvertNullToNullString, Reflect] DOMString name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString type;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString width;
 #else
                  attribute [ConvertFromString] long width;
 #endif
diff --git a/WebCore/html/HTMLFieldSetElement.cpp b/WebCore/html/HTMLFieldSetElement.cpp
index eb83173..b792075 100644
--- a/WebCore/html/HTMLFieldSetElement.cpp
+++ b/WebCore/html/HTMLFieldSetElement.cpp
@@ -48,9 +48,9 @@ bool HTMLFieldSetElement::checkDTD(const Node* newChild)
     return newChild->hasTagName(legendTag) || HTMLElement::checkDTD(newChild);
 }
 
-bool HTMLFieldSetElement::isFocusable() const
+bool HTMLFieldSetElement::supportsFocus() const
 {
-    return HTMLElement::isFocusable();
+    return HTMLElement::supportsFocus();
 }
 
 const AtomicString& HTMLFieldSetElement::formControlType() const
diff --git a/WebCore/html/HTMLFieldSetElement.h b/WebCore/html/HTMLFieldSetElement.h
index e79f2c5..0900317 100644
--- a/WebCore/html/HTMLFieldSetElement.h
+++ b/WebCore/html/HTMLFieldSetElement.h
@@ -44,7 +44,7 @@ public:
     virtual int tagPriority() const { return 3; }
     virtual bool checkDTD(const Node* newChild);
 
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual const AtomicString& formControlType() const;
 
diff --git a/WebCore/html/HTMLFieldSetElement.idl b/WebCore/html/HTMLFieldSetElement.idl
index 4d11304..ca8563b 100644
--- a/WebCore/html/HTMLFieldSetElement.idl
+++ b/WebCore/html/HTMLFieldSetElement.idl
@@ -29,6 +29,7 @@ module html {
         readonly attribute ValidityState   validity;
 #endif
         readonly attribute boolean         willValidate;
+        boolean  checkValidity();
         void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
     };
 
diff --git a/WebCore/html/HTMLFormControlElement.cpp b/WebCore/html/HTMLFormControlElement.cpp
index 09d91df..ea46980 100644
--- a/WebCore/html/HTMLFormControlElement.cpp
+++ b/WebCore/html/HTMLFormControlElement.cpp
@@ -27,6 +27,7 @@
 
 #include "ChromeClient.h"
 #include "Document.h"
+#include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
 #include "Frame.h"
@@ -38,7 +39,9 @@
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderBox.h"
+#include "RenderTextControl.h"
 #include "RenderTheme.h"
+#include "ScriptEventListener.h"
 #include "ValidityState.h"
 
 namespace WebCore {
@@ -50,6 +53,7 @@ HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tagName, Doc
     , m_form(f)
     , m_disabled(false)
     , m_readOnly(false)
+    , m_required(false)
     , m_valueMatchesRenderer(false)
 {
     if (!m_form)
@@ -64,6 +68,16 @@ HTMLFormControlElement::~HTMLFormControlElement()
         m_form->removeFormElement(this);
 }
 
+bool HTMLFormControlElement::formNoValidate() const
+{
+    return !getAttribute(formnovalidateAttr).isNull();
+}
+
+void HTMLFormControlElement::setFormNoValidate(bool formnovalidate)
+{
+    setAttribute(formnovalidateAttr, formnovalidate ? "" : 0);
+}
+
 ValidityState* HTMLFormControlElement::validity()
 {
     if (!m_validityState)
@@ -74,9 +88,9 @@ ValidityState* HTMLFormControlElement::validity()
 
 void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
 {
-    if (attr->name() == nameAttr) {
-        // Do nothing.
-    } else if (attr->name() == disabledAttr) {
+    if (attr->name() == nameAttr)
+        setNeedsStyleRecalc();
+    else if (attr->name() == disabledAttr) {
         bool oldDisabled = m_disabled;
         m_disabled = !attr->isNull();
         if (oldDisabled != m_disabled) {
@@ -92,6 +106,11 @@ void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
             if (renderer() && renderer()->style()->hasAppearance())
                 renderer()->theme()->stateChanged(renderer(), ReadOnlyState);
         }
+    } else if (attr->name() == requiredAttr) {
+        bool oldRequired = m_required;
+        m_required = !attr->isNull();
+        if (oldRequired != m_required)
+            setNeedsStyleRecalc();
     } else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -176,7 +195,7 @@ void HTMLFormControlElement::setName(const AtomicString &value)
 
 void HTMLFormControlElement::dispatchFormControlChangeEvent()
 {
-    dispatchEvent(eventNames().changeEvent, true, false);
+    dispatchEvent(Event::create(eventNames().changeEvent, true, false));
 }
 
 bool HTMLFormControlElement::disabled() const
@@ -206,7 +225,7 @@ void HTMLFormControlElement::setAutofocus(bool b)
 
 bool HTMLFormControlElement::required() const
 {
-    return hasAttribute(requiredAttr);
+    return m_required;
 }
 
 void HTMLFormControlElement::setRequired(bool b)
@@ -222,13 +241,19 @@ void HTMLFormControlElement::recalcStyle(StyleChange change)
         renderer()->updateFromElement();
 }
 
+bool HTMLFormControlElement::supportsFocus() const
+{
+    return !disabled();
+}
+
 bool HTMLFormControlElement::isFocusable() const
 {
-    if (disabled() || !renderer() || 
-        (renderer()->style() && renderer()->style()->visibility() != VISIBLE) || 
+    if (!renderer() || 
         !renderer()->isBox() || toRenderBox(renderer())->size().isEmpty())
         return false;
-    return true;
+    // HTMLElement::isFocusable handles visibility and calls suportsFocus which
+    // will cover the disabled case.
+    return HTMLElement::isFocusable();
 }
 
 bool HTMLFormControlElement::isKeyboardFocusable(KeyboardEvent* event) const
@@ -260,7 +285,25 @@ bool HTMLFormControlElement::willValidate() const
     //      The control does not have a repetition template as an ancestor.
     //      The control does not have a datalist element as an ancestor.
     //      The control is not an output element.
-    return form() && name().length() && !disabled() && !isReadOnlyFormControl();
+    return form() && !name().isEmpty() && !disabled() && !isReadOnlyFormControl();
+}
+
+bool HTMLFormControlElement::checkValidity()
+{
+    if (willValidate() && !isValidFormControlElement()) {
+        dispatchEvent(Event::create(EventNames().invalidEvent, false, true));
+        return false;
+    }
+
+    return true;
+}
+
+void HTMLFormControlElement::updateValidity()
+{
+    if (willValidate()) {
+        // Update style for pseudo classes such as :valid :invalid.
+        setNeedsStyleRecalc();
+    }
 }
 
 void HTMLFormControlElement::setCustomValidity(const String& error)
@@ -284,14 +327,19 @@ void HTMLFormControlElement::dispatchBlurEvent()
     HTMLElement::dispatchBlurEvent();
 }
 
-bool HTMLFormControlElement::supportsFocus() const
+HTMLFormElement* HTMLFormControlElement::virtualForm() const
 {
-    return isFocusable() || (!disabled() && !document()->haveStylesheetsLoaded());
+    return m_form;
 }
 
-HTMLFormElement* HTMLFormControlElement::virtualForm() const
+bool HTMLFormControlElement::isDefaultButtonForForm() const
 {
-    return m_form;
+    return isSuccessfulSubmitButton() && m_form && m_form->defaultButton() == this;
+}
+
+bool HTMLFormControlElement::isValidFormControlElement()
+{
+    return validity()->valid();
 }
 
 void HTMLFormControlElement::removeFromForm()
@@ -336,4 +384,120 @@ void HTMLFormControlElementWithState::finishParsingChildren()
     }
 }
 
+HTMLTextFormControlElement::HTMLTextFormControlElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* form)
+    : HTMLFormControlElementWithState(tagName, doc, form)
+{
+}
+
+HTMLTextFormControlElement::~HTMLTextFormControlElement()
+{
+}
+
+void HTMLTextFormControlElement::dispatchFocusEvent()
+{
+    if (supportsPlaceholder())
+        updatePlaceholderVisibility(false);
+    handleFocusEvent();
+    HTMLFormControlElementWithState::dispatchFocusEvent();
+}
+
+void HTMLTextFormControlElement::dispatchBlurEvent()
+{
+    if (supportsPlaceholder())
+        updatePlaceholderVisibility(false);
+    handleBlurEvent();
+    HTMLFormControlElementWithState::dispatchBlurEvent();
+}
+
+bool HTMLTextFormControlElement::placeholderShouldBeVisible() const
+{
+    return supportsPlaceholder()
+        && isEmptyValue()
+        && document()->focusedNode() != this
+        && !getAttribute(placeholderAttr).isEmpty();
+}
+
+void HTMLTextFormControlElement::updatePlaceholderVisibility(bool placeholderValueChanged)
+{
+    if (supportsPlaceholder() && renderer())
+        toRenderTextControl(renderer())->updatePlaceholderVisibility(placeholderShouldBeVisible(), placeholderValueChanged);
+}
+
+RenderTextControl* HTMLTextFormControlElement::textRendererAfterUpdateLayout()
+{
+    if (!isTextFormControl())
+        return 0;
+    document()->updateLayoutIgnorePendingStylesheets();
+    return toRenderTextControl(renderer());
+}
+
+void HTMLTextFormControlElement::setSelectionStart(int start)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionStart(start);
+}
+
+void HTMLTextFormControlElement::setSelectionEnd(int end)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionEnd(end);
+}
+
+void HTMLTextFormControlElement::select()
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->select();
+}
+
+void HTMLTextFormControlElement::setSelectionRange(int start, int end)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionRange(start, end);
+}
+
+int HTMLTextFormControlElement::selectionStart()
+{
+    if (!isTextFormControl())
+        return 0;
+    if (document()->focusedNode() != this && cachedSelectionStart() >= 0)
+        return cachedSelectionStart();
+    if (!renderer())
+        return 0;
+    return toRenderTextControl(renderer())->selectionStart();
+}
+
+int HTMLTextFormControlElement::selectionEnd()
+{
+    if (!isTextFormControl())
+        return 0;
+    if (document()->focusedNode() != this && cachedSelectionEnd() >= 0)
+        return cachedSelectionEnd();
+    if (!renderer())
+        return 0;
+    return toRenderTextControl(renderer())->selectionEnd();
+}
+
+VisibleSelection HTMLTextFormControlElement::selection() const
+{
+    if (!renderer() || !isTextFormControl() || cachedSelectionStart() < 0 || cachedSelectionEnd() < 0)
+        return VisibleSelection();
+    return toRenderTextControl(renderer())->selection(cachedSelectionStart(), cachedSelectionEnd());
+}
+
+void HTMLTextFormControlElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    if (attr->name() == placeholderAttr)
+        updatePlaceholderVisibility(true);
+    else if (attr->name() == onfocusAttr)
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onblurAttr)
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onselectAttr)
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onchangeAttr)
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
+    else
+        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+}
+
 } // namespace Webcore
diff --git a/WebCore/html/HTMLFormControlElement.h b/WebCore/html/HTMLFormControlElement.h
index a30f46c..b5dc7ce 100644
--- a/WebCore/html/HTMLFormControlElement.h
+++ b/WebCore/html/HTMLFormControlElement.h
@@ -30,7 +30,9 @@ namespace WebCore {
 
 class FormDataList;
 class HTMLFormElement;
+class RenderTextControl;
 class ValidityState;
+class VisibleSelection;
 
 class HTMLFormControlElement : public HTMLElement {
 public:
@@ -43,6 +45,9 @@ public:
     HTMLFormElement* form() const { return m_form; }
     virtual ValidityState* validity();
 
+    bool formNoValidate() const;
+    void setFormNoValidate(bool);
+
     virtual bool isTextFormControl() const { return false; }
     virtual bool isEnabledFormControl() const { return !disabled(); }
 
@@ -102,10 +107,12 @@ public:
     virtual short tabIndex() const;
 
     virtual bool willValidate() const;
+    bool checkValidity();
+    void updateValidity();
     void setCustomValidity(const String&);
-
     virtual bool valueMissing() const { return false; }
     virtual bool patternMismatch() const { return false; }
+    virtual bool tooLong() const { return false; }
 
     void formDestroyed() { m_form = 0; }
 
@@ -117,12 +124,15 @@ protected:
 
 private:
     virtual HTMLFormElement* virtualForm() const;
+    virtual bool isDefaultButtonForForm() const;
+    virtual bool isValidFormControlElement();
 
     HTMLFormElement* m_form;
     RefPtr<ValidityState> m_validityState;
-    bool m_disabled;
-    bool m_readOnly;
-    bool m_valueMatchesRenderer;
+    bool m_disabled : 1;
+    bool m_readOnly : 1;
+    bool m_required : 1;
+    bool m_valueMatchesRenderer : 1;
 };
 
 class HTMLFormControlElementWithState : public HTMLFormControlElement {
@@ -137,6 +147,40 @@ protected:
     virtual void didMoveToNewOwnerDocument();
 };
 
+class HTMLTextFormControlElement : public HTMLFormControlElementWithState {
+public:
+    HTMLTextFormControlElement(const QualifiedName&, Document*, HTMLFormElement*);
+    virtual ~HTMLTextFormControlElement();
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+
+    int selectionStart();
+    int selectionEnd();
+    void setSelectionStart(int);
+    void setSelectionEnd(int);
+    void select();
+    void setSelectionRange(int start, int end);
+    VisibleSelection selection() const;
+
+protected:
+    bool placeholderShouldBeVisible() const;
+    void updatePlaceholderVisibility(bool);
+    virtual int cachedSelectionStart() const = 0;
+    virtual int cachedSelectionEnd() const = 0;
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+private:
+    // A subclass should return true if placeholder processing is needed.
+    virtual bool supportsPlaceholder() const = 0;
+    // Returns true if user-editable value is empty.  This is used to check placeholder visibility.
+    virtual bool isEmptyValue() const = 0;
+    // Called in dispatchFocusEvent(), after placeholder process, before calling parent's dispatchFocusEvent().
+    virtual void handleFocusEvent() { }
+    // Called in dispatchBlurEvent(), after placeholder process, before calling parent's dispatchBlurEvent().
+    virtual void handleBlurEvent() { }
+    RenderTextControl* textRendererAfterUpdateLayout();
+};
+
 } //namespace
 
 #endif
diff --git a/WebCore/html/HTMLFormElement.cpp b/WebCore/html/HTMLFormElement.cpp
index 54986b0..ace0f2f 100644
--- a/WebCore/html/HTMLFormElement.cpp
+++ b/WebCore/html/HTMLFormElement.cpp
@@ -47,6 +47,7 @@
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderTextControl.h"
+#include "ValidityState.h"
 #include <limits>
 #include <wtf/CurrentTime.h>
 #include <wtf/RandomNumber.h>
@@ -149,14 +150,14 @@ void HTMLFormElement::removedFromDocument()
     HTMLElement::removedFromDocument();
 }
 
-void HTMLFormElement::handleLocalEvents(Event* event, bool useCapture)
+void HTMLFormElement::handleLocalEvents(Event* event)
 {
     Node* targetNode = event->target()->toNode();
-    if (!useCapture && targetNode && targetNode != this && (event->type() == eventNames().submitEvent || event->type() == eventNames().resetEvent)) {
+    if (event->eventPhase() != Event::CAPTURING_PHASE && targetNode && targetNode != this && (event->type() == eventNames().submitEvent || event->type() == eventNames().resetEvent)) {
         event->stopPropagation();
         return;
     }
-    HTMLElement::handleLocalEvents(event, useCapture);
+    HTMLElement::handleLocalEvents(event);
 }
 
 unsigned HTMLFormElement::length() const
@@ -295,7 +296,7 @@ bool HTMLFormElement::prepareSubmit(Event* event)
     m_insubmit = true;
     m_doingsubmit = false;
 
-    if (dispatchEvent(eventNames().submitEvent, true, true) && !m_doingsubmit)
+    if (dispatchEvent(Event::create(eventNames().submitEvent, true, true)) && !m_doingsubmit)
         m_doingsubmit = true;
 
     m_insubmit = false;
@@ -415,7 +416,7 @@ void HTMLFormElement::reset()
 
     // ### DOM2 labels this event as not cancelable, however
     // common browsers( sick! ) allow it be cancelled.
-    if ( !dispatchEvent(eventNames().resetEvent, true, true) ) {
+    if (!dispatchEvent(Event::create(eventNames().resetEvent, true, true))) {
         m_inreset = false;
         return;
     }
@@ -537,6 +538,16 @@ void HTMLFormElement::setName(const String &value)
     setAttribute(nameAttr, value);
 }
 
+bool HTMLFormElement::noValidate() const
+{
+    return !getAttribute(novalidateAttr).isNull();
+}
+
+void HTMLFormElement::setNoValidate(bool novalidate)
+{
+    setAttribute(novalidateAttr, novalidate ? "" : 0);
+}
+
 void HTMLFormElement::setAcceptCharset(const String &value)
 {
     setAttribute(accept_charsetAttr, value);
@@ -577,6 +588,31 @@ void HTMLFormElement::setTarget(const String &value)
     setAttribute(targetAttr, value);
 }
 
+HTMLFormControlElement* HTMLFormElement::defaultButton() const
+{
+    for (unsigned i = 0; i < formElements.size(); ++i) {
+        HTMLFormControlElement* control = formElements[i];
+        if (control->isSuccessfulSubmitButton())
+            return control;
+    }
+
+    return 0;
+}
+
+bool HTMLFormElement::checkValidity()
+{
+    // TODO: Check for unhandled invalid controls, see #27452 for tips.
+
+    bool hasOnlyValidControls = true;
+    for (unsigned i = 0; i < formElements.size(); ++i) {
+        HTMLFormControlElement* control = formElements[i];
+        if (!control->checkValidity())
+            hasOnlyValidControls = false;
+    }
+
+    return hasOnlyValidControls;
+}
+
 PassRefPtr<HTMLFormControlElement> HTMLFormElement::elementForAlias(const AtomicString& alias)
 {
     if (alias.isEmpty() || !m_elementAliases)
diff --git a/WebCore/html/HTMLFormElement.h b/WebCore/html/HTMLFormElement.h
index 6b7812a..a2e9585 100644
--- a/WebCore/html/HTMLFormElement.h
+++ b/WebCore/html/HTMLFormElement.h
@@ -54,7 +54,7 @@ public:
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
  
-    virtual void handleLocalEvents(Event*, bool useCapture);
+    virtual void handleLocalEvents(Event*);
      
     PassRefPtr<HTMLCollection> elements();
     void getNamedElements(const AtomicString&, Vector<RefPtr<Node> >&);
@@ -96,6 +96,9 @@ public:
     String name() const;
     void setName(const String&);
 
+    bool noValidate() const;
+    void setNoValidate(bool);
+
     String acceptCharset() const { return m_formDataBuilder.acceptCharset(); }
     void setAcceptCharset(const String&);
 
@@ -107,7 +110,11 @@ public:
 
     virtual String target() const;
     void setTarget(const String&);
-    
+
+    HTMLFormControlElement* defaultButton() const;
+
+    bool checkValidity();
+
     PassRefPtr<HTMLFormControlElement> elementForAlias(const AtomicString&);
     void addElementAlias(HTMLFormControlElement*, const AtomicString& alias);
 
diff --git a/WebCore/html/HTMLFormElement.idl b/WebCore/html/HTMLFormElement.idl
index f3aca87..3e846d6 100644
--- a/WebCore/html/HTMLFormElement.idl
+++ b/WebCore/html/HTMLFormElement.idl
@@ -30,6 +30,7 @@ module html {
         readonly attribute HTMLCollection  elements;
         readonly attribute long            length;
                  attribute [ConvertNullToNullString] DOMString       name;
+                 attribute boolean         noValidate;
                  attribute [ConvertNullToNullString] DOMString       acceptCharset;
                  attribute [ConvertNullToNullString] DOMString       action;
                  attribute [ConvertNullToNullString] DOMString       encoding;  /* Netscape/Firefox legacy attribute. Same as enctype. */
@@ -39,5 +40,6 @@ module html {
         
         [Custom] void submit();
         void reset();
+        boolean  checkValidity();
     };
 }
diff --git a/WebCore/html/HTMLFrameElement.cpp b/WebCore/html/HTMLFrameElement.cpp
index adc3ff1..b456ac3 100644
--- a/WebCore/html/HTMLFrameElement.cpp
+++ b/WebCore/html/HTMLFrameElement.cpp
@@ -1,9 +1,9 @@
-/**
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,18 +34,24 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* document)
+inline HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* document)
     : HTMLFrameElementBase(tagName, document)
     , m_frameBorder(true)
     , m_frameBorderSet(false)
+    , m_noResize(false)
 {
     ASSERT(hasTagName(frameTag));
 }
 
+PassRefPtr<HTMLFrameElement> HTMLFrameElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLFrameElement(tagName, document));
+}
+
 bool HTMLFrameElement::rendererIsNeeded(RenderStyle*)
 {
     // For compatibility, frames render even when display: none is set.
-    return isURLAllowed(m_URL);
+    return isURLAllowed();
 }
 
 RenderObject* HTMLFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -55,9 +61,10 @@ RenderObject* HTMLFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
 
 static inline HTMLFrameSetElement* containingFrameSetElement(Node* node)
 {
-    while ((node = node->parentNode()))
+    while ((node = node->parentNode())) {
         if (node->hasTagName(framesetTag))
             return static_cast<HTMLFrameSetElement*>(node);
+    }
     return 0;
 }
 
@@ -73,14 +80,26 @@ void HTMLFrameElement::attach()
     }
 }
 
-void HTMLFrameElement::parseMappedAttribute(MappedAttribute *attr)
+void HTMLFrameElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == frameborderAttr) {
         m_frameBorder = attr->value().toInt();
         m_frameBorderSet = !attr->isNull();
         // FIXME: If we are already attached, this has no effect.
+    } else if (attr->name() == noresizeAttr) {
+        m_noResize = true;
+        // FIXME: If we are already attached, this has no effect.
+        // FIXME: Since this does not check attr->isNull(), it can
+        // never reset m_noResize to false if the attribute is removed.
+        // FIXME: There seems to be no code that looks at this
+        // value and prevents resizing.
     } else
         HTMLFrameElementBase::parseMappedAttribute(attr);
 }
 
+void HTMLFrameElement::setNoResize(bool noResize)
+{
+    setAttribute(noresizeAttr, noResize ? "" : 0);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameElement.h b/WebCore/html/HTMLFrameElement.h
index ab602ee..4a8e16c 100644
--- a/WebCore/html/HTMLFrameElement.h
+++ b/WebCore/html/HTMLFrameElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,13 +28,16 @@
 
 namespace WebCore {
 
-class Document;
-class RenderObject;
-class RenderArena;
-class RenderStyle;
-
 class HTMLFrameElement : public HTMLFrameElementBase {
 public:
+    static PassRefPtr<HTMLFrameElement> create(const QualifiedName&, Document*);
+
+    bool hasFrameBorder() const { return m_frameBorder; }
+
+    bool noResize() const { return m_noResize; }
+    void setNoResize(bool);
+
+private:
     HTMLFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
@@ -47,11 +50,10 @@ public:
     
     virtual void parseMappedAttribute(MappedAttribute*);
 
-    bool hasFrameBorder() const { return m_frameBorder; }
-
-private:
     bool m_frameBorder;
     bool m_frameBorderSet;
+
+    bool m_noResize;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameElement.idl b/WebCore/html/HTMLFrameElement.idl
index 106e57e..d0076eb 100644
--- a/WebCore/html/HTMLFrameElement.idl
+++ b/WebCore/html/HTMLFrameElement.idl
@@ -26,14 +26,14 @@ module html {
         ImplementationUUID=38c9e3c8-3384-40b6-a484-cb845c48b67d
     ] HTMLFrameElement : HTMLElement {
 
-                 attribute [ConvertNullToNullString] DOMString       frameBorder;
-                 attribute [ConvertNullToNullString] DOMString       longDesc;
-                 attribute [ConvertNullToNullString] DOMString       marginHeight;
-                 attribute [ConvertNullToNullString] DOMString       marginWidth;
-                 attribute [ConvertNullToNullString] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect=frameborder] DOMString       frameBorder;
+                 attribute [ConvertNullToNullString, Reflect=longdesc] DOMString       longDesc;
+                 attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
+                 attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
                  attribute boolean         noResize;
-                 attribute [ConvertNullToNullString] DOMString       scrolling;
-                 attribute [ConvertNullToNullString, CustomSetter] DOMString       src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
+                 attribute [ConvertNullToNullString, CustomSetter, ReflectURL] DOMString       src;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/WebCore/html/HTMLFrameElementBase.cpp b/WebCore/html/HTMLFrameElementBase.cpp
index a4f0a5e..1bc4995 100644
--- a/WebCore/html/HTMLFrameElementBase.cpp
+++ b/WebCore/html/HTMLFrameElementBase.cpp
@@ -50,18 +50,17 @@ HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Documen
     , m_scrolling(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
-    , m_noResize(false)
     , m_viewSource(false)
     , m_shouldOpenURLAfterAttach(false)
 {
 }
 
-bool HTMLFrameElementBase::isURLAllowed(const AtomicString& URLString) const
+bool HTMLFrameElementBase::isURLAllowed() const
 {
-    if (URLString.isEmpty())
+    if (m_URL.isEmpty())
         return true;
 
-    const KURL& completeURL = document()->completeURL(URLString);
+    const KURL& completeURL = document()->completeURL(m_URL);
 
     // Don't allow more than 200 total frames in a set. This seems
     // like a reasonable upper bound, and otherwise mutually recursive
@@ -93,7 +92,7 @@ void HTMLFrameElementBase::openURL()
 {
     ASSERT(!m_frameName.isEmpty());
 
-    if (!isURLAllowed(m_URL))
+    if (!isURLAllowed())
         return;
 
     if (m_URL.isEmpty())
@@ -127,9 +126,6 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
     } else if (attr->name() == marginheightAttr) {
         m_marginHeight = attr->value().toInt();
         // FIXME: If we are already attached, this has no effect.
-    } else if (attr->name() == noresizeAttr) {
-        m_noResize = true;
-        // FIXME: If we are already attached, this has no effect.
     } else if (attr->name() == scrollingAttr) {
         // Auto and yes both simply mean "allow scrolling." No means "don't allow scrolling."
         if (equalIgnoringCase(attr->value(), "auto") || equalIgnoringCase(attr->value(), "yes"))
@@ -201,7 +197,7 @@ void HTMLFrameElementBase::attach()
 
 KURL HTMLFrameElementBase::location() const
 {
-    return src();
+    return document()->completeURL(getAttribute(srcAttr));
 }
 
 void HTMLFrameElementBase::setLocation(const String& str)
@@ -216,9 +212,9 @@ void HTMLFrameElementBase::setLocation(const String& str)
         openURL();
 }
 
-bool HTMLFrameElementBase::isFocusable() const
+bool HTMLFrameElementBase::supportsFocus() const
 {
-    return renderer();
+    return true;
 }
 
 void HTMLFrameElementBase::setFocus(bool received)
@@ -233,81 +229,6 @@ bool HTMLFrameElementBase::isURLAttribute(Attribute *attr) const
     return attr->name() == srcAttr;
 }
 
-String HTMLFrameElementBase::frameBorder() const
-{
-    return getAttribute(frameborderAttr);
-}
-
-void HTMLFrameElementBase::setFrameBorder(const String &value)
-{
-    setAttribute(frameborderAttr, value);
-}
-
-String HTMLFrameElementBase::longDesc() const
-{
-    return getAttribute(longdescAttr);
-}
-
-void HTMLFrameElementBase::setLongDesc(const String &value)
-{
-    setAttribute(longdescAttr, value);
-}
-
-String HTMLFrameElementBase::marginHeight() const
-{
-    return getAttribute(marginheightAttr);
-}
-
-void HTMLFrameElementBase::setMarginHeight(const String &value)
-{
-    setAttribute(marginheightAttr, value);
-}
-
-String HTMLFrameElementBase::marginWidth() const
-{
-    return getAttribute(marginwidthAttr);
-}
-
-void HTMLFrameElementBase::setMarginWidth(const String &value)
-{
-    setAttribute(marginwidthAttr, value);
-}
-
-String HTMLFrameElementBase::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLFrameElementBase::setName(const String &value)
-{
-    setAttribute(nameAttr, value);
-}
-
-void HTMLFrameElementBase::setNoResize(bool noResize)
-{
-    setAttribute(noresizeAttr, noResize ? "" : 0);
-}
-
-String HTMLFrameElementBase::scrolling() const
-{
-    return getAttribute(scrollingAttr);
-}
-
-void HTMLFrameElementBase::setScrolling(const String &value)
-{
-    setAttribute(scrollingAttr, value);
-}
-
-KURL HTMLFrameElementBase::src() const
-{
-    return document()->completeURL(getAttribute(srcAttr));
-}
-
-void HTMLFrameElementBase::setSrc(const String &value)
-{
-    setAttribute(srcAttr, value);
-}
-
 int HTMLFrameElementBase::width() const
 {
     if (!renderer())
diff --git a/WebCore/html/HTMLFrameElementBase.h b/WebCore/html/HTMLFrameElementBase.h
index 4a24451..c211ba7 100644
--- a/WebCore/html/HTMLFrameElementBase.h
+++ b/WebCore/html/HTMLFrameElementBase.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,60 +31,39 @@ namespace WebCore {
 
 class HTMLFrameElementBase : public HTMLFrameOwnerElement {
 public:
-    virtual void parseMappedAttribute(MappedAttribute*);
-
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
-
-    virtual void attach();
-    virtual bool canLazyAttach() { return false; }
-
     KURL location() const;
     void setLocation(const String&);
 
-    virtual bool isFocusable() const;
-    virtual void setFocus(bool);
-    
-    virtual bool isURLAttribute(Attribute*) const;
-
     virtual ScrollbarMode scrollingMode() const { return m_scrolling; }
     
     int getMarginWidth() const { return m_marginWidth; }
     int getMarginHeight() const { return m_marginHeight; }
 
-    String frameBorder() const;
-    void setFrameBorder(const String&);
-
-    String longDesc() const;
-    void setLongDesc(const String&);
+    int width() const;
+    int height() const;
 
-    String marginHeight() const;
-    void setMarginHeight(const String&);
+protected:
+    HTMLFrameElementBase(const QualifiedName&, Document*);
 
-    String marginWidth() const;
-    void setMarginWidth(const String&);
+    bool isURLAllowed() const;
 
-    String name() const;
-    void setName(const String&);
+    virtual void parseMappedAttribute(MappedAttribute*);
 
-    bool noResize() const { return m_noResize; }
-    void setNoResize(bool);
+    virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
 
-    String scrolling() const;
-    void setScrolling(const String&);
+    virtual void attach();
 
-    KURL src() const;
-    void setSrc(const String&);
+private:
+    virtual bool canLazyAttach() { return false; }
 
-    int width() const;
-    int height() const;
+    virtual bool supportsFocus() const;
+    virtual void setFocus(bool);
+    
+    virtual bool isURLAttribute(Attribute*) const;
 
     bool viewSourceMode() const { return m_viewSource; }
 
-protected:
-    HTMLFrameElementBase(const QualifiedName&, Document*);
-
-    bool isURLAllowed(const AtomicString&) const;
     void setNameAndOpenURL();
     void openURL();
 
@@ -98,7 +77,6 @@ protected:
     int m_marginWidth;
     int m_marginHeight;
 
-    bool m_noResize;
     bool m_viewSource;
 
     bool m_shouldOpenURLAfterAttach;
diff --git a/WebCore/html/HTMLFrameOwnerElement.cpp b/WebCore/html/HTMLFrameOwnerElement.cpp
index a98a3df..84958c2 100644
--- a/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,7 +33,7 @@
 namespace WebCore {
 
 HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document)
-    : HTMLElement(tagName, document)
+    : HTMLElement(tagName, document, CreateElement)
     , m_contentFrame(0)
 {
 }
diff --git a/WebCore/html/HTMLFrameOwnerElement.h b/WebCore/html/HTMLFrameOwnerElement.h
index 3f50a02..1437e2c 100644
--- a/WebCore/html/HTMLFrameOwnerElement.h
+++ b/WebCore/html/HTMLFrameOwnerElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,36 +27,36 @@ namespace WebCore {
 
 class DOMWindow;
 class Frame;
-class KeyboardEvent;
 
 #if ENABLE(SVG)
 class SVGDocument;
 #endif
 
 class HTMLFrameOwnerElement : public HTMLElement {
-protected:
-    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
-
 public:
     virtual ~HTMLFrameOwnerElement();
 
-    virtual void willRemove();
-
     Frame* contentFrame() const { return m_contentFrame; }
     DOMWindow* contentWindow() const;
     Document* contentDocument() const;
 
-    virtual bool isFrameOwnerElement() const { return true; }
-    virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
-    
-    virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
-
 #if ENABLE(SVG)
     SVGDocument* getSVGDocument(ExceptionCode&) const;
 #endif
 
+    virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
+
+protected:
+    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
+
 private:
     friend class Frame;
+
+    virtual bool isFrameOwnerElement() const { return true; }
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
+    
+    virtual void willRemove();
+
     Frame* m_contentFrame;
 };
 
diff --git a/WebCore/html/HTMLFrameSetElement.cpp b/WebCore/html/HTMLFrameSetElement.cpp
index a8f544b..5874b84 100644
--- a/WebCore/html/HTMLFrameSetElement.cpp
+++ b/WebCore/html/HTMLFrameSetElement.cpp
@@ -135,6 +135,10 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
         document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
+#if ENABLE(ORIENTATION_EVENTS)
+    else if (attr->name() == onorientationchangeAttr)
+        document()->setWindowAttributeEventListener(eventNames().orientationchangeEvent, createAttributeEventListener(document()->frame(), attr));
+#endif
     else if (attr->name() == onhashchangeAttr)
         document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onresizeAttr)
@@ -233,114 +237,4 @@ void HTMLFrameSetElement::setRows(const String &value)
     setAttribute(rowsAttr, value);
 }
 
-EventListener* HTMLFrameSetElement::onblur() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().blurEvent);
-}
-
-void HTMLFrameSetElement::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().blurEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onerror() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().errorEvent);
-}
-
-void HTMLFrameSetElement::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().errorEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onfocus() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().focusEvent);
-}
-
-void HTMLFrameSetElement::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().focusEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().loadEvent);
-}
-
-void HTMLFrameSetElement::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().loadEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onbeforeunload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().beforeunloadEvent);
-}
-
-void HTMLFrameSetElement::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onmessage() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().messageEvent);
-}
-
-void HTMLFrameSetElement::setOnmessage(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().messageEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onoffline() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().offlineEvent);
-}
-
-void HTMLFrameSetElement::setOnoffline(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().offlineEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::ononline() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().onlineEvent);
-}
-
-void HTMLFrameSetElement::setOnonline(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().onlineEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onresize() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().resizeEvent);
-}
-
-void HTMLFrameSetElement::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onstorage() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().storageEvent);
-}
-
-void HTMLFrameSetElement::setOnstorage(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().storageEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onunload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().unloadEvent);
-}
-
-void HTMLFrameSetElement::setOnunload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
-}
-
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameSetElement.h b/WebCore/html/HTMLFrameSetElement.h
index 4319c7a..2b2d7ea 100644
--- a/WebCore/html/HTMLFrameSetElement.h
+++ b/WebCore/html/HTMLFrameSetElement.h
@@ -24,8 +24,9 @@
 #ifndef HTMLFrameSetElement_h
 #define HTMLFrameSetElement_h
 
-#include "HTMLElement.h"
 #include "Color.h"
+#include "Document.h"
+#include "HTMLElement.h"
 
 namespace WebCore {
 
@@ -67,30 +68,23 @@ public:
     const Length* rowLengths() const { return m_rows; }
     const Length* colLengths() const { return m_cols; }
 
-    // Event handler attributes
-    virtual EventListener* onblur() const;
-    virtual void setOnblur(PassRefPtr<EventListener>);
-    virtual EventListener* onerror() const;
-    virtual void setOnerror(PassRefPtr<EventListener>);
-    virtual EventListener* onfocus() const;
-    virtual void setOnfocus(PassRefPtr<EventListener>);
-    virtual EventListener* onload() const;
-    virtual void setOnload(PassRefPtr<EventListener>);
-
-    EventListener* onbeforeunload() const;
-    void setOnbeforeunload(PassRefPtr<EventListener>);
-    EventListener* onmessage() const;
-    void setOnmessage(PassRefPtr<EventListener>);
-    EventListener* onoffline() const;
-    void setOnoffline(PassRefPtr<EventListener>);
-    EventListener* ononline() const;
-    void setOnonline(PassRefPtr<EventListener>);
-    EventListener* onresize() const;
-    void setOnresize(PassRefPtr<EventListener>);
-    EventListener* onstorage() const;
-    void setOnstorage(PassRefPtr<EventListener>);
-    EventListener* onunload() const;
-    void setOnunload(PassRefPtr<EventListener>);
+    // Declared virtual in Element
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(blur);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(focus);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(load);
+
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(beforeunload);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(hashchange);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
+#if ENABLE(ORIENTATION_EVENTS)
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(orientationchange);
+#endif
 
 private:
     Length* m_rows;
diff --git a/WebCore/html/HTMLFrameSetElement.idl b/WebCore/html/HTMLFrameSetElement.idl
index 4050f2c..b44a071 100644
--- a/WebCore/html/HTMLFrameSetElement.idl
+++ b/WebCore/html/HTMLFrameSetElement.idl
@@ -33,6 +33,7 @@ module html {
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler attributes
         attribute [DontEnum] EventListener onbeforeunload;
+        attribute [DontEnum] EventListener onhashchange;
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
@@ -40,7 +41,11 @@ module html {
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
 
-        // Overrides of Element attributes.
+#if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
+        attribute [DontEnum] EventListener onorientationchange;
+#endif
+
+        // Overrides of Element attributes (left in for completeness).
         // attribute [DontEnum] EventListener onblur;
         // attribute [DontEnum] EventListener onerror;
         // attribute [DontEnum] EventListener onfocus;
@@ -49,7 +54,6 @@ module html {
         // Not implemented yet.
         // attribute [DontEnum] EventListener onafterprint;
         // attribute [DontEnum] EventListener onbeforeprint;
-        // attribute [DontEnum] EventListener onhashchange;
         // attribute [DontEnum] EventListener onpopstate;
         // attribute [DontEnum] EventListener onredo;
         // attribute [DontEnum] EventListener onundo;
diff --git a/WebCore/html/HTMLIFrameElement.cpp b/WebCore/html/HTMLIFrameElement.cpp
index 478925a..cae9b8d 100644
--- a/WebCore/html/HTMLIFrameElement.cpp
+++ b/WebCore/html/HTMLIFrameElement.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,12 +35,17 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* document)
+inline HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* document)
     : HTMLFrameElementBase(tagName, document)
 {
     ASSERT(hasTagName(iframeTag));
 }
 
+PassRefPtr<HTMLIFrameElement> HTMLIFrameElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLIFrameElement(tagName, document));
+}
+
 bool HTMLIFrameElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (attrName == widthAttr || attrName == heightAttr) {
@@ -89,7 +94,7 @@ void HTMLIFrameElement::parseMappedAttribute(MappedAttribute* attr)
 
 bool HTMLIFrameElement::rendererIsNeeded(RenderStyle* style)
 {
-    return isURLAllowed(m_URL) && style->display() != NONE;
+    return isURLAllowed() && style->display() != NONE;
 }
 
 RenderObject* HTMLIFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -126,34 +131,4 @@ bool HTMLIFrameElement::isURLAttribute(Attribute* attr) const
     return attr->name() == srcAttr;
 }
 
-String HTMLIFrameElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLIFrameElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
-String HTMLIFrameElement::height() const
-{
-    return getAttribute(heightAttr);
-}
-
-void HTMLIFrameElement::setHeight(const String &value)
-{
-    setAttribute(heightAttr, value);
-}
-
-String HTMLIFrameElement::width() const
-{
-    return getAttribute(widthAttr);
-}
-
-void HTMLIFrameElement::setWidth(const String &value)
-{
-    setAttribute(widthAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLIFrameElement.h b/WebCore/html/HTMLIFrameElement.h
index 362b991..f1c6a35 100644
--- a/WebCore/html/HTMLIFrameElement.h
+++ b/WebCore/html/HTMLIFrameElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,6 +30,9 @@ namespace WebCore {
 
 class HTMLIFrameElement : public HTMLFrameElementBase {
 public:
+    static PassRefPtr<HTMLIFrameElement> create(const QualifiedName&, Document*);
+
+private:
     HTMLIFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
@@ -48,16 +51,6 @@ public:
     
     virtual bool isURLAttribute(Attribute*) const;
 
-    String align() const;
-    void setAlign(const String&);
-
-    String height() const;
-    void setHeight(const String&);
-
-    String width() const;
-    void setWidth(const String&);
-
-private:
     AtomicString m_name;
 };
 
diff --git a/WebCore/html/HTMLIFrameElement.idl b/WebCore/html/HTMLIFrameElement.idl
index b5684ca..e288b54 100644
--- a/WebCore/html/HTMLIFrameElement.idl
+++ b/WebCore/html/HTMLIFrameElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -26,16 +26,16 @@ module html {
         ImplementationUUID=370c6318-f804-49f9-bc8a-46b99cd87399
     ] HTMLIFrameElement : HTMLElement {
 
-                 attribute [ConvertNullToNullString] DOMString       align;
-                 attribute [ConvertNullToNullString] DOMString       frameBorder;
-                 attribute [ConvertNullToNullString] DOMString       height;
-                 attribute [ConvertNullToNullString] DOMString       longDesc;
-                 attribute [ConvertNullToNullString] DOMString       marginHeight;
-                 attribute [ConvertNullToNullString] DOMString       marginWidth;
-                 attribute [ConvertNullToNullString] DOMString       name;
-                 attribute [ConvertNullToNullString] DOMString       scrolling;
-                 attribute [ConvertNullToNullString, CustomSetter] DOMString       src;
-                 attribute [ConvertNullToNullString] DOMString       width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       align;
+                 attribute [ConvertNullToNullString, Reflect=frameborder] DOMString       frameBorder;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       height;
+                 attribute [ConvertNullToNullString, Reflect=longdesc] DOMString       longDesc;
+                 attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
+                 attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
+                 attribute [ConvertNullToNullString, CustomSetter, Reflect] DOMString       src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       width;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/WebCore/html/HTMLImageElement.cpp b/WebCore/html/HTMLImageElement.cpp
index 5173964..932e718 100644
--- a/WebCore/html/HTMLImageElement.cpp
+++ b/WebCore/html/HTMLImageElement.cpp
@@ -279,46 +279,11 @@ bool HTMLImageElement::isURLAttribute(Attribute* attr) const
         || (attr->name() == usemapAttr && attr->value().string()[0] != '#');
 }
 
-String HTMLImageElement::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLImageElement::setName(const String& value)
-{
-    setAttribute(nameAttr, value);
-}
-
-String HTMLImageElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLImageElement::setAlign(const String& value)
-{
-    setAttribute(alignAttr, value);
-}
-
-String HTMLImageElement::alt() const
+const AtomicString& HTMLImageElement::alt() const
 {
     return getAttribute(altAttr);
 }
 
-void HTMLImageElement::setAlt(const String& value)
-{
-    setAttribute(altAttr, value);
-}
-
-String HTMLImageElement::border() const
-{
-    return getAttribute(borderAttr);
-}
-
-void HTMLImageElement::setBorder(const String& value)
-{
-    setAttribute(borderAttr, value);
-}
-
 bool HTMLImageElement::draggable() const
 {
     // Image elements are draggable by default.
@@ -381,16 +346,6 @@ void HTMLImageElement::setSrc(const String& value)
     setAttribute(srcAttr, value);
 }
 
-String HTMLImageElement::useMap() const
-{
-    return getAttribute(usemapAttr);
-}
-
-void HTMLImageElement::setUseMap(const String& value)
-{
-    setAttribute(usemapAttr, value);
-}
-
 int HTMLImageElement::vspace() const
 {
     // ### return actual vspace
@@ -439,7 +394,8 @@ void HTMLImageElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) cons
     HTMLElement::addSubresourceAttributeURLs(urls);
 
     addSubresourceURL(urls, src());
-    addSubresourceURL(urls, document()->completeURL(useMap()));
+    // FIXME: What about when the usemap attribute begins with "#"?
+    addSubresourceURL(urls, document()->completeURL(getAttribute(usemapAttr)));
 }
 
 }
diff --git a/WebCore/html/HTMLImageElement.h b/WebCore/html/HTMLImageElement.h
index 5e82186..f58574d 100644
--- a/WebCore/html/HTMLImageElement.h
+++ b/WebCore/html/HTMLImageElement.h
@@ -69,17 +69,7 @@ public:
 
     void setLoadManually(bool loadManually) { m_imageLoader.setLoadManually(loadManually); }
 
-    String name() const;
-    void setName(const String&);
-
-    String align() const;
-    void setAlign(const String&);
-
-    String alt() const;
-    void setAlt(const String&);
-
-    String border() const;
-    void setBorder(const String&);
+    const AtomicString& alt() const;
 
     virtual bool draggable() const;
 
@@ -100,9 +90,6 @@ public:
     KURL src() const;
     void setSrc(const String&);
 
-    String useMap() const;
-    void setUseMap(const String&);
-
     int vspace() const;
     void setVspace(int);
 
diff --git a/WebCore/html/HTMLImageLoader.cpp b/WebCore/html/HTMLImageLoader.cpp
index 2b9f09c..c6f49aa 100644
--- a/WebCore/html/HTMLImageLoader.cpp
+++ b/WebCore/html/HTMLImageLoader.cpp
@@ -25,6 +25,7 @@
 #include "CSSHelper.h"
 #include "CachedImage.h"
 #include "Element.h"
+#include "Event.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
@@ -45,7 +46,7 @@ void HTMLImageLoader::dispatchLoadEvent()
     bool errorOccurred = image()->errorOccurred();
     if (!errorOccurred && image()->httpStatusCodeErrorOccurred())
         errorOccurred = element()->hasTagName(HTMLNames::objectTag); // An <object> considers a 404 to be an error and should fire onerror.
-    element()->dispatchEvent(errorOccurred ? eventNames().errorEvent : eventNames().loadEvent, false, false);
+    element()->dispatchEvent(Event::create(errorOccurred ? eventNames().errorEvent : eventNames().loadEvent, false, false));
 }
 
 String HTMLImageLoader::sourceURI(const AtomicString& attr) const
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index 59e4e2f..5689e73 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -34,14 +34,17 @@
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
+#include "ExceptionCode.h"
 #include "File.h"
 #include "FileList.h"
 #include "FocusController.h"
 #include "FormDataList.h"
 #include "Frame.h"
+#include "HTMLDataListElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "HTMLOptionElement.h"
 #include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
@@ -57,9 +60,13 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "TextEvent.h"
+<<<<<<< HEAD:WebCore/html/HTMLInputElement.cpp
 #ifdef ANDROID_ACCEPT_CHANGES_TO_FOCUSED_TEXTFIELDS
 #include "WebViewCore.h"
 #endif
+=======
+#include <wtf/MathExtras.h>
+>>>>>>> webkit.org at 49305:WebCore/html/HTMLInputElement.cpp
 #include <wtf/StdLibExtras.h>
 
 using namespace std;
@@ -71,7 +78,7 @@ using namespace HTMLNames;
 const int maxSavedResults = 256;
 
 HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
-    : HTMLFormControlElementWithState(tagName, doc, f)
+    : HTMLTextFormControlElement(tagName, doc, f)
     , m_xPos(0)
     , m_yPos(0)
     , m_maxResults(-1)
@@ -138,6 +145,8 @@ bool HTMLInputElement::valueMissing() const
             return !checked();
         case RADIO:
             return !document()->checkedRadioButtons().checkedButtonForGroup(name());
+        case COLOR:
+            return false;
         case HIDDEN:
         case RANGE:
         case SUBMIT:
@@ -166,6 +175,7 @@ bool HTMLInputElement::patternMismatch() const
         case BUTTON:
         case RANGE:
         case NUMBER:
+        case COLOR:
             return false;
         case TEXT:
         case SEARCH:
@@ -192,6 +202,98 @@ bool HTMLInputElement::patternMismatch() const
     return false;
 }
 
+bool HTMLInputElement::tooLong() const
+{
+    switch (inputType()) {
+    case EMAIL:
+    case PASSWORD:
+    case SEARCH:
+    case TELEPHONE:
+    case TEXT:
+    case URL: {
+        int max = maxLength();
+        if (max < 0)
+            return false;
+        // Return false for the default value even if it is longer than maxLength.
+        bool userEdited = !m_data.value().isNull();
+        if (!userEdited)
+            return false;
+        return value().length() > static_cast<unsigned>(max);
+    }
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case NUMBER:
+    case RADIO:
+    case RANGE:
+    case RESET:
+    case SUBMIT:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool HTMLInputElement::rangeUnderflow() const
+{
+    if (inputType() == NUMBER) {
+        double min = 0.0;
+        double doubleValue = 0.0;
+        if (formStringToDouble(getAttribute(minAttr), &min) && formStringToDouble(value(), &doubleValue))
+            return doubleValue < min;
+    } else if (inputType() == RANGE) {
+        double doubleValue;
+        if (formStringToDouble(value(), &doubleValue))
+            return doubleValue < rangeMinimum();
+    }
+    return false;
+}
+
+bool HTMLInputElement::rangeOverflow() const
+{
+    if (inputType() == NUMBER) {
+        double max = 0.0;
+        double doubleValue = 0.0;
+        if (formStringToDouble(getAttribute(maxAttr), &max) && formStringToDouble(value(), &doubleValue))
+            return doubleValue > max;
+    } else if (inputType() == RANGE) {
+        double doubleValue;
+        if (formStringToDouble(value(), &doubleValue))
+            return doubleValue > rangeMaximum();
+    }
+    return false;
+}
+
+double HTMLInputElement::rangeMinimum() const
+{
+    ASSERT(inputType() == RANGE);
+    // The range type's "default minimum" is 0.
+    double min = 0.0;
+    formStringToDouble(getAttribute(minAttr), &min);
+    return min;
+}
+
+double HTMLInputElement::rangeMaximum() const
+{
+    ASSERT(inputType() == RANGE);
+    // The range type's "default maximum" is 100.
+    static const double defaultMaximum = 100.0;
+    double max = defaultMaximum;
+    formStringToDouble(getAttribute(maxAttr), &max);
+    const double min = rangeMinimum();
+
+    if (max < min) {
+        // A remedy for the inconsistent min/max values.
+        // Sets the maxmimum to the default (100.0) or the minimum value.
+        max = min < defaultMaximum ? defaultMaximum : min;
+    }
+    return max;
+}
+
 static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
 {
     if (HTMLFormElement* form = element->form())
@@ -254,20 +356,17 @@ bool HTMLInputElement::shouldUseInputMethod() const
     return m_type == TEXT || m_type == SEARCH || m_type == ISINDEX;
 }
 
-void HTMLInputElement::dispatchFocusEvent()
+void HTMLInputElement::handleFocusEvent()
 {
-    InputElement::dispatchFocusEvent(m_data, this, this);
+    InputElement::dispatchFocusEvent(this, this);
 
     if (isTextField())
         m_autofilled = false;
-
-    HTMLFormControlElementWithState::dispatchFocusEvent();
 }
 
-void HTMLInputElement::dispatchBlurEvent()
+void HTMLInputElement::handleBlurEvent()
 {
-    InputElement::dispatchBlurEvent(m_data, this, this);
-    HTMLFormControlElementWithState::dispatchBlurEvent();
+    InputElement::dispatchBlurEvent(this, this);
 }
 
 void HTMLInputElement::setType(const String& t)
@@ -325,6 +424,8 @@ void HTMLInputElement::setInputType(const String& t)
         newType = TELEPHONE;
     else if (equalIgnoringCase(t, "url"))
         newType = URL;
+    else if (equalIgnoringCase(t, "color"))
+        newType = COLOR;
     else
         newType = TEXT;
 
@@ -359,7 +460,7 @@ void HTMLInputElement::setInputType(const String& t)
                 m_data.setValue(String());
             }
             if (!didStoreValue && willStoreValue)
-                m_data.setValue(constrainValue(getAttribute(valueAttr)));
+                m_data.setValue(sanitizeValue(getAttribute(valueAttr)));
             else
                 InputElement::updateValueIfNeeded(m_data, this);
 
@@ -389,6 +490,7 @@ void HTMLInputElement::setInputType(const String& t)
         }
 
         InputElement::notifyFormStateChanged(this);
+        updateValidity();
     }
     m_haveType = true;
 
@@ -408,6 +510,10 @@ const AtomicString& HTMLInputElement::formControlType() const
             DEFINE_STATIC_LOCAL(const AtomicString, checkbox, ("checkbox"));
             return checkbox;
         }
+        case COLOR: {
+            DEFINE_STATIC_LOCAL(const AtomicString, color, ("color"));
+            return color;
+        }
         case EMAIL: {
             DEFINE_STATIC_LOCAL(const AtomicString, email, ("email"));
             return email;
@@ -477,6 +583,7 @@ bool HTMLInputElement::saveFormControlState(String& result) const
 
     switch (inputType()) {
         case BUTTON:
+        case COLOR:
         case EMAIL:
         case FILE:
         case HIDDEN:
@@ -508,6 +615,7 @@ void HTMLInputElement::restoreFormControlState(const String& state)
     ASSERT(inputType() != PASSWORD); // should never save/restore password fields
     switch (inputType()) {
         case BUTTON:
+        case COLOR:
         case EMAIL:
         case FILE:
         case HIDDEN:
@@ -544,63 +652,6 @@ bool HTMLInputElement::canHaveSelection() const
     return isTextField();
 }
 
-int HTMLInputElement::selectionStart() const
-{
-    if (!isTextField())
-        return 0;
-    if (document()->focusedNode() != this && m_data.cachedSelectionStart() != -1)
-        return m_data.cachedSelectionStart();
-    if (!renderer())
-        return 0;
-    return toRenderTextControl(renderer())->selectionStart();
-}
-
-int HTMLInputElement::selectionEnd() const
-{
-    if (!isTextField())
-        return 0;
-    if (document()->focusedNode() != this && m_data.cachedSelectionEnd() != -1)
-        return m_data.cachedSelectionEnd();
-    if (!renderer())
-        return 0;
-    return toRenderTextControl(renderer())->selectionEnd();
-}
-
-static bool isTextFieldWithRenderer(HTMLInputElement* element)
-{
-    if (!element->isTextField())
-        return false;
-
-    element->document()->updateLayoutIgnorePendingStylesheets();
-    if (!element->renderer())
-        return false;
-
-    return true;
-}
-
-void HTMLInputElement::setSelectionStart(int start)
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->setSelectionStart(start);
-}
-
-void HTMLInputElement::setSelectionEnd(int end)
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->setSelectionEnd(end);
-}
-
-void HTMLInputElement::select()
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->select();
-}
-
-void HTMLInputElement::setSelectionRange(int start, int end)
-{
-    InputElement::updateSelectionRange(this, this, start, end);
-}
-
 void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
 {
     switch (inputType()) {
@@ -619,6 +670,7 @@ void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
         case HIDDEN:
             // a no-op for this type
             break;
+        case COLOR:
         case EMAIL:
         case ISINDEX:
         case NUMBER:
@@ -659,6 +711,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         checkedRadioButtons(this).removeButton(this);
         m_data.setName(attr->value());
         checkedRadioButtons(this).addButton(this);
+        HTMLFormControlElementWithState::parseMappedAttribute(attr);
     } else if (attr->name() == autocompleteAttr) {
         if (equalIgnoringCase(attr->value(), "off")) {
             m_autocomplete = Off;
@@ -678,12 +731,14 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         if (m_data.value().isNull())
             setNeedsStyleRecalc();
         setFormControlValueMatchesRenderer(false);
+        updateValidity();
     } else if (attr->name() == checkedAttr) {
         m_defaultChecked = !attr->isNull();
         if (m_useDefaultChecked) {
             setChecked(m_defaultChecked);
             m_useDefaultChecked = true;
         }
+        updateValidity();
     } else if (attr->name() == maxlengthAttr)
         InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
     else if (attr->name() == sizeAttr)
@@ -715,14 +770,6 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
     } else if (attr->name() == heightAttr) {
         if (respectHeightAndWidthAttrs())
             addCSSLength(attr, CSSPropertyHeight, attr->value());
-    } else if (attr->name() == onfocusAttr) {
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onblurAttr) {
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onselectAttr) {
-        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onchangeAttr) {
-        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     }
     // Search field and slider attributes all just cause updateFromElement to be called through style
     // recalcing.
@@ -730,7 +777,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == resultsAttr) {
         int oldResults = m_maxResults;
-        m_maxResults = !attr->isNull() ? min(attr->value().toInt(), maxSavedResults) : -1;
+        m_maxResults = !attr->isNull() ? std::min(attr->value().toInt(), maxSavedResults) : -1;
         // FIXME: Detaching just for maxResults change is not ideal.  We should figure out the right
         // time to relayout for this change.
         if (m_maxResults != oldResults && (m_maxResults <= 0 || oldResults <= 0) && attached()) {
@@ -738,9 +785,6 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             attach();
         }
         setNeedsStyleRecalc();
-    } else if (attr->name() == placeholderAttr) {
-        if (isTextField())
-            updatePlaceholderVisibility();
     } else if (attr->name() == autosaveAttr ||
              attr->name() == incrementalAttr ||
              attr->name() == minAttr ||
@@ -748,8 +792,15 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
              attr->name() == multipleAttr ||
              attr->name() == precisionAttr)
         setNeedsStyleRecalc();
+    else if (attr->name() == patternAttr)
+        updateValidity();
+#if ENABLE(DATALIST)
+    else if (attr->name() == listAttr)
+        m_hasNonEmptyList = !attr->isEmpty();
+        // FIXME: we need to tell this change to a renderer if the attribute affects the appearance.
+#endif
     else
-        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+        HTMLTextFormControlElement::parseMappedAttribute(attr);
 }
 
 bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
@@ -757,6 +808,7 @@ bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
     switch (inputType()) {
         case BUTTON:
         case CHECKBOX:
+        case COLOR:
         case EMAIL:
         case FILE:
         case IMAGE:
@@ -797,6 +849,7 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
             return new (arena) RenderImage(this);
         case RANGE:
             return new (arena) RenderSlider(this);
+        case COLOR:
         case EMAIL:
         case ISINDEX:
         case NUMBER:
@@ -805,7 +858,7 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
         case TELEPHONE:
         case TEXT:
         case URL:
-            return new (arena) RenderTextControlSingleLine(this);
+            return new (arena) RenderTextControlSingleLine(this, placeholderShouldBeVisible());
     }
     ASSERT(false);
     return 0;
@@ -883,6 +936,7 @@ bool HTMLInputElement::appendFormData(FormDataList& encoding, bool multipart)
         return false;
 
     switch (inputType()) {
+        case COLOR:
         case EMAIL:
         case HIDDEN:
         case ISINDEX:
@@ -990,7 +1044,7 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     // RenderTextView), but it's not possible to do it at the moment
     // because of the way the code is structured.
     if (renderer() && AXObjectCache::accessibilityEnabled())
-        renderer()->document()->axObjectCache()->postNotification(renderer(), "AXCheckedStateChanged", true);
+        renderer()->document()->axObjectCache()->postNotification(renderer(), AXObjectCache::AXCheckedStateChanged, true);
 
     // Only send a change event for items in the document (avoid firing during
     // parsing) and don't send a change event for a radio button that's getting
@@ -1043,7 +1097,7 @@ String HTMLInputElement::value() const
 
     String value = m_data.value();
     if (value.isNull()) {
-        value = constrainValue(getAttribute(valueAttr));
+        value = sanitizeValue(getAttribute(valueAttr));
 
         // If no attribute exists, then just use "on" or "" based off the checked() state of the control.
         if (value.isNull() && (inputType() == CHECKBOX || inputType() == RADIO))
@@ -1060,6 +1114,7 @@ String HTMLInputElement::valueWithDefault() const
         switch (inputType()) {
             case BUTTON:
             case CHECKBOX:
+            case COLOR:
             case EMAIL:
             case FILE:
             case HIDDEN:
@@ -1098,9 +1153,9 @@ void HTMLInputElement::setValue(const String& value)
         if (inputType() == FILE)
             m_fileList->clear();
         else {
-            m_data.setValue(constrainValue(value));
+            m_data.setValue(sanitizeValue(value));
             if (isTextField()) {
-                InputElement::updatePlaceholderVisibility(m_data, this, this);
+                updatePlaceholderVisibility(false);
                 if (inDocument())
                     document()->updateStyleIfNeeded();
             }
@@ -1109,7 +1164,7 @@ void HTMLInputElement::setValue(const String& value)
             renderer()->updateFromElement();
         setNeedsStyleRecalc();
     } else
-        setAttribute(valueAttr, constrainValue(value));
+        setAttribute(valueAttr, sanitizeValue(value));
     
     if (isTextField()) {
         unsigned max = m_data.value().length();
@@ -1123,6 +1178,7 @@ void HTMLInputElement::setValue(const String& value)
             cacheSelection(max, max);
     }
     InputElement::notifyFormStateChanged(this);
+    updateValidity();
 }
 
 String HTMLInputElement::placeholder() const
@@ -1144,7 +1200,9 @@ void HTMLInputElement::setValueFromRenderer(const String& value)
 {
     // File upload controls will always use setFileListFromRenderer.
     ASSERT(inputType() != FILE);
+    updatePlaceholderVisibility(false);
     InputElement::setValueFromRenderer(m_data, this, this, value);
+    updateValidity();
 }
 
 void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
@@ -1156,6 +1214,7 @@ void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
 
     setFormControlValueMatchesRenderer(true);
     InputElement::notifyFormStateChanged(this);
+    updateValidity();
 }
 
 bool HTMLInputElement::storesValueSeparateFromAttribute() const
@@ -1169,6 +1228,7 @@ bool HTMLInputElement::storesValueSeparateFromAttribute() const
         case RESET:
         case SUBMIT:
             return false;
+        case COLOR:
         case EMAIL:
         case FILE:
         case ISINDEX:
@@ -1344,6 +1404,7 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         if (charCode == '\r') {
             switch (inputType()) {
                 case CHECKBOX:
+                case COLOR:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
@@ -1472,6 +1533,7 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                     if (!checked())
                         clickElement = true;
                     break;
+                case COLOR:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
@@ -1516,7 +1578,7 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
     }
 
     if (evt->isBeforeTextInsertedEvent())
-        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, this, evt);
 
     if (isTextField() && renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
         toRenderTextControlSingleLine(renderer())->forwardEvent(evt);
@@ -1603,9 +1665,12 @@ int HTMLInputElement::maxLength() const
     return m_data.maxLength();
 }
 
-void HTMLInputElement::setMaxLength(int _maxLength)
+void HTMLInputElement::setMaxLength(int maxLength, ExceptionCode& ec)
 {
-    setAttribute(maxlengthAttr, String::number(_maxLength));
+    if (maxLength < 0)
+        ec = INDEX_SIZE_ERR;
+    else
+        setAttribute(maxlengthAttr, String::number(maxLength));
 }
 
 bool HTMLInputElement::multiple() const
@@ -1659,9 +1724,11 @@ FileList* HTMLInputElement::files()
     return m_fileList.get();
 }
 
-String HTMLInputElement::constrainValue(const String& proposedValue) const
+String HTMLInputElement::sanitizeValue(const String& proposedValue) const
 {
-    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
+    if (isTextField())
+        return InputElement::sanitizeValue(this, proposedValue);
+    return proposedValue;
 }
 
 bool HTMLInputElement::needsActivationCallback()
@@ -1704,6 +1771,7 @@ bool HTMLInputElement::isRequiredFormControl() const
         case IMAGE:
         case RESET:
         case BUTTON:
+        case COLOR:
         case ISINDEX:
             return false;
     }
@@ -1730,14 +1798,7 @@ void HTMLInputElement::onSearch()
     ASSERT(isSearchField());
     if (renderer())
         toRenderTextControlSingleLine(renderer())->stopSearchEventTimer();
-    dispatchEvent(eventNames().searchEvent, true, false);
-}
-
-VisibleSelection HTMLInputElement::selection() const
-{
-    if (!renderer() || !isTextField() || m_data.cachedSelectionStart() == -1 || m_data.cachedSelectionEnd() == -1)
-        return VisibleSelection();
-    return toRenderTextControl(renderer())->selection(m_data.cachedSelectionStart(), m_data.cachedSelectionEnd());
+    dispatchEvent(Event::create(eventNames().searchEvent, true, false));
 }
 
 void HTMLInputElement::documentDidBecomeActive()
@@ -1778,9 +1839,88 @@ bool HTMLInputElement::willValidate() const
            inputType() != BUTTON && inputType() != RESET;
 }
 
-bool HTMLInputElement::placeholderShouldBeVisible() const
+bool HTMLInputElement::formStringToDouble(const String& src, double* out)
 {
-    return m_data.placeholderShouldBeVisible();
+    // See HTML5 2.4.4.3 `Real numbers.'
+
+    if (src.isEmpty())
+        return false;
+    // String::toDouble() accepts leading + \t \n \v \f \r and SPACE, which are invalid in HTML5.
+    // So, check the first character.
+    if (src[0] != '-' && (src[0] < '0' || src[0] > '9'))
+        return false;
+
+    bool valid = false;
+    double value = src.toDouble(&valid);
+    if (!valid)
+        return false;
+    // NaN and Infinity are not valid numbers according to the standard.
+    if (isnan(value) || isinf(value))
+        return false;
+    if (out)
+        *out = value;
+    return true;
+}
+
+#if ENABLE(DATALIST)
+HTMLElement* HTMLInputElement::list() const
+{
+    return dataList();
+}
+
+HTMLDataListElement* HTMLInputElement::dataList() const
+{
+    if (!m_hasNonEmptyList)
+        return 0;
+
+    switch (inputType()) {
+    case TEXT:
+    case SEARCH:
+    case URL:
+    case TELEPHONE:
+    case EMAIL:
+    case NUMBER:
+    case RANGE:
+    case COLOR: {
+        Element* element = document()->getElementById(getAttribute(listAttr));
+        if (element && element->hasTagName(datalistTag))
+            return static_cast<HTMLDataListElement*>(element);
+        break;
+    }
+    case HIDDEN:
+    case PASSWORD:
+    case CHECKBOX:
+    case RADIO:
+    case FILE:
+    case SUBMIT:
+    case IMAGE:
+    case RESET:
+    case BUTTON:
+    case ISINDEX:
+        break;
+    }
+    return 0;
+}
+
+HTMLOptionElement* HTMLInputElement::selectedOption() const
+{
+    String currentValue = value();
+    // The empty value never matches to a datalist option because it
+    // doesn't represent a suggestion according to the standard.
+    if (currentValue.isEmpty())
+        return 0;
+
+    HTMLDataListElement* sourceElement = dataList();
+    if (!sourceElement)
+        return 0;
+    RefPtr<HTMLCollection> options = sourceElement->options();
+    for (unsigned i = 0; options && i < options->length(); ++i) {
+        HTMLOptionElement* option = static_cast<HTMLOptionElement*>(options->item(i));
+        if (!option->disabled() && currentValue == option->value())
+            return option;
+    }
+    return 0;
 }
+#endif  // ENABLE(DATALIST)
 
 } // namespace
diff --git a/WebCore/html/HTMLInputElement.h b/WebCore/html/HTMLInputElement.h
index 4d887f3..799d92c 100644
--- a/WebCore/html/HTMLInputElement.h
+++ b/WebCore/html/HTMLInputElement.h
@@ -31,11 +31,13 @@
 namespace WebCore {
 
 class FileList;
+class HTMLDataListElement;
 class HTMLImageLoader;
+class HTMLOptionElement;
 class KURL;
 class VisibleSelection;
 
-class HTMLInputElement : public HTMLFormControlElementWithState, public InputElement {
+class HTMLInputElement : public HTMLTextFormControlElement, public InputElement {
 public:
     enum InputType {
         TEXT,
@@ -54,7 +56,8 @@ public:
         EMAIL,
         NUMBER,
         TELEPHONE,
-        URL
+        URL,
+        COLOR
     };
     
     enum AutoCompleteSetting {
@@ -72,8 +75,6 @@ public:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
     virtual bool isEnumeratable() const { return inputType() != IMAGE; }
-    virtual void dispatchFocusEvent();
-    virtual void dispatchBlurEvent();
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     virtual void aboutToUnload();
     virtual bool shouldUseInputMethod() const;
@@ -92,10 +93,19 @@ public:
 
     virtual bool valueMissing() const;
     virtual bool patternMismatch() const;
+    virtual bool tooLong() const;
+    // For ValidityState
+    bool rangeUnderflow() const;
+    bool rangeOverflow() const;
+    // Returns the minimum value for type=range.  Don't call this for other types.
+    double rangeMinimum() const;
+    // Returns the maximum value for type=range.  Don't call this for other types.
+    // This always returns a value which is <= rangeMinimum().
+    double rangeMaximum() const;
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
-    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL; }
+    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL || m_type == COLOR; }
     virtual bool isSearchField() const { return m_type == SEARCH; }
     virtual bool isInputTypeHidden() const { return m_type == HIDDEN; }
     virtual bool isPasswordField() const { return m_type == PASSWORD; }
@@ -127,12 +137,7 @@ public:
     virtual bool canStartSelection() const;
     
     bool canHaveSelection() const;
-    int selectionStart() const;
-    int selectionEnd() const;
-    void setSelectionStart(int);
-    void setSelectionEnd(int);
-    virtual void select();
-    void setSelectionRange(int start, int end);
+    virtual void select() { HTMLTextFormControlElement::select(); }
 
     virtual void accessKeyAction(bool sendToAnyElement);
 
@@ -194,8 +199,13 @@ public:
     KURL src() const;
     void setSrc(const String&);
 
+#if ENABLE(DATALIST)
+    HTMLElement* list() const;
+    HTMLOptionElement* selectedOption() const;
+#endif
+
     int maxLength() const;
-    void setMaxLength(int);
+    void setMaxLength(int, ExceptionCode&);
 
     bool multiple() const;
     void setMultiple(bool);
@@ -212,9 +222,7 @@ public:
     void addSearchResult();
     void onSearch();
 
-    VisibleSelection selection() const;
-
-    virtual String constrainValue(const String& proposedValue) const;
+    virtual String sanitizeValue(const String&) const;
 
     virtual void documentDidBecomeActive();
 
@@ -222,17 +230,15 @@ public:
     
     virtual bool willValidate() const;
 
-    virtual bool placeholderShouldBeVisible() const;
+    // Converts the specified string to a floating number.
+    // If the conversion fails, the return value is false. Take care that leading or trailing unnecessary characters make failures.  This returns false for an empty string input.
+    // The double* parameter may be 0.
+    static bool formStringToDouble(const String&, double*);
     
 protected:
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
 
-    void updatePlaceholderVisibility()
-    {
-        InputElement::updatePlaceholderVisibility(m_data, this, this, true);
-    }
-
 private:
     bool storesValueSeparateFromAttribute() const;
 
@@ -240,9 +246,20 @@ private:
     void registerForActivationCallbackIfNeeded();
     void unregisterForActivationCallbackIfNeeded();
 
+    virtual bool supportsPlaceholder() const { return isTextField(); }
+    virtual bool isEmptyValue() const { return value().isEmpty(); }
+    virtual void handleFocusEvent();
+    virtual void handleBlurEvent();
+    virtual int cachedSelectionStart() const { return m_data.cachedSelectionStart(); }
+    virtual int cachedSelectionEnd() const { return m_data.cachedSelectionEnd(); }
+
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const;
 
+#if ENABLE(DATALIST)
+    HTMLDataListElement* dataList() const;
+#endif
+
     InputElementData m_data;
     int m_xPos;
     int m_yPos;
@@ -259,6 +276,9 @@ private:
     unsigned m_autocomplete : 2; // AutoCompleteSetting
     bool m_autofilled : 1;
     bool m_inited : 1;
+#if ENABLE(DATALIST)
+    bool m_hasNonEmptyList : 1;
+#endif
 };
 
 } //namespace
diff --git a/WebCore/html/HTMLInputElement.idl b/WebCore/html/HTMLInputElement.idl
index e15c6b5..59248f4 100644
--- a/WebCore/html/HTMLInputElement.idl
+++ b/WebCore/html/HTMLInputElement.idl
@@ -28,6 +28,7 @@ module html {
                  attribute [ConvertNullToNullString] DOMString defaultValue;
                  attribute boolean         defaultChecked;
         readonly attribute HTMLFormElement form;
+                 attribute boolean         formNoValidate;
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute ValidityState   validity;
 #endif
@@ -38,7 +39,17 @@ module html {
                  attribute boolean         checked;
                  attribute boolean         disabled;
                  attribute boolean         autofocus;
-                 attribute long            maxLength;
+#if defined(ENABLE_DATALIST) && ENABLE_DATALIST
+        readonly attribute HTMLElement     list;
+#endif
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+                 attribute [Reflect] DOMString max;
+#endif
+                 attribute long            maxLength
+                     setter raises(DOMException);
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+                 attribute [Reflect] DOMString min;
+#endif
                  attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [Reflect] DOMString       pattern;
@@ -55,7 +66,11 @@ module html {
                  attribute [ConvertNullToNullString, JSCCustomGetter] DOMString type; // readonly dropped as part of DOM level 2
                  attribute [ConvertNullToNullString] DOMString useMap;
                  attribute [ConvertNullToNullString] DOMString value;
+#if defined(ENABLE_DATALIST) && ENABLE_DATALIST
+        readonly attribute HTMLOptionElement selectedOption;
+#endif
         readonly attribute boolean         willValidate;
+        boolean            checkValidity();
         void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void               select();
         void               click();
diff --git a/WebCore/html/HTMLIsIndexElement.cpp b/WebCore/html/HTMLIsIndexElement.cpp
index bcfa623..31fafa6 100644
--- a/WebCore/html/HTMLIsIndexElement.cpp
+++ b/WebCore/html/HTMLIsIndexElement.cpp
@@ -44,7 +44,7 @@ void HTMLIsIndexElement::parseMappedAttribute(MappedAttribute* attr)
     if (attr->name() == promptAttr)
         setValue(attr->value());
     else if (attr->name() == placeholderAttr)
-        updatePlaceholderVisibility();
+        updatePlaceholderVisibility(true);
     else
         // don't call HTMLInputElement::parseMappedAttribute here, as it would
         // accept attributes this element does not support
diff --git a/WebCore/html/HTMLKeygenElement.cpp b/WebCore/html/HTMLKeygenElement.cpp
index b1b6238..6af088f 100644
--- a/WebCore/html/HTMLKeygenElement.cpp
+++ b/WebCore/html/HTMLKeygenElement.cpp
@@ -51,7 +51,7 @@ HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Document* doc
     for (Vector<String>::const_iterator it = keys.begin(); it != end; ++it) {
         HTMLOptionElement* o = new HTMLOptionElement(optionTag, doc, form());
         addChild(o);
-        o->addChild(new Text(doc, *it));
+        o->addChild(Text::create(doc, *it));
     }
 }
 
diff --git a/WebCore/html/HTMLLegendElement.cpp b/WebCore/html/HTMLLegendElement.cpp
index d6e08c7..516ca54 100644
--- a/WebCore/html/HTMLLegendElement.cpp
+++ b/WebCore/html/HTMLLegendElement.cpp
@@ -42,9 +42,9 @@ HTMLLegendElement::~HTMLLegendElement()
 {
 }
 
-bool HTMLLegendElement::isFocusable() const
+bool HTMLLegendElement::supportsFocus() const
 {
-    return HTMLElement::isFocusable();
+    return HTMLElement::supportsFocus();
 }
 
 const AtomicString& HTMLLegendElement::formControlType() const
diff --git a/WebCore/html/HTMLLegendElement.h b/WebCore/html/HTMLLegendElement.h
index 713d73c..1b394e4 100644
--- a/WebCore/html/HTMLLegendElement.h
+++ b/WebCore/html/HTMLLegendElement.h
@@ -33,7 +33,7 @@ public:
     HTMLLegendElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
     virtual ~HTMLLegendElement();
 
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
     virtual const AtomicString& formControlType() const;
     virtual void accessKeyAction(bool sendToAnyElement);
 
diff --git a/WebCore/html/HTMLLinkElement.cpp b/WebCore/html/HTMLLinkElement.cpp
index f1313bb..57b0b5d 100644
--- a/WebCore/html/HTMLLinkElement.cpp
+++ b/WebCore/html/HTMLLinkElement.cpp
@@ -38,6 +38,7 @@
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "Page.h"
+#include "ScriptEventListener.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -134,7 +135,9 @@ void HTMLLinkElement::parseMappedAttribute(MappedAttribute *attr)
         process();
     } else if (attr->name() == disabledAttr) {
         setDisabledState(!attr->isNull());
-    } else {
+    } else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else {
         if (attr->name() == titleAttr && m_sheet)
             m_sheet->setTitle(attr->value());
         HTMLElement::parseMappedAttribute(attr);
@@ -217,11 +220,7 @@ void HTMLLinkElement::process()
     // This was buggy and would incorrectly match <link rel="alternate">, which has a different specified meaning. -dwh
     if (m_disabledState != 2 && (m_isStyleSheet || acceptIfTypeContainsTextCSS && type.contains("text/css")) && document()->frame() && m_url.isValid()) {
         // also, don't load style sheets for standalone documents
-        // Add ourselves as a pending sheet, but only if we aren't an alternate 
-        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
-        if (!isAlternate())
-            document()->addPendingSheet();
-
+        
         String charset = getAttribute(charsetAttr);
         if (charset.isEmpty() && document()->frame())
             charset = document()->frame()->loader()->encoding();
@@ -230,14 +229,28 @@ void HTMLLinkElement::process()
             if (m_loading)
                 document()->removePendingSheet();
             m_cachedSheet->removeClient(this);
+            m_cachedSheet = 0;
         }
+
+        if (!dispatchBeforeLoadEvent(m_url))
+            return;
+        
         m_loading = true;
+        
+        // Add ourselves as a pending sheet, but only if we aren't an alternate 
+        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
+        if (!isAlternate())
+            document()->addPendingSheet();
+
         m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(m_url, charset);
+        
         if (m_cachedSheet)
             m_cachedSheet->addClient(this);
-        else if (!isAlternate()) { // The request may have been denied if stylesheet is local and document is remote.
+        else {
+            // The request may have been denied if (for example) the stylesheet is local and the document is remote.
             m_loading = false;
-            document()->removePendingSheet();
+            if (!isAlternate())
+                document()->removePendingSheet();
         }
     } else if (m_sheet) {
         // we no longer contain a stylesheet, e.g. perhaps rel or type was changed
@@ -282,7 +295,23 @@ void HTMLLinkElement::setCSSStyleSheet(const String& url, const String& charset,
     if (enforceMIMEType && document()->page() && !document()->page()->settings()->enforceCSSMIMETypeInStrictMode())
         enforceMIMEType = false;
 
-    m_sheet->parseString(sheet->sheetText(enforceMIMEType), strictParsing);
+    String sheetText = sheet->sheetText(enforceMIMEType);
+    m_sheet->parseString(sheetText, strictParsing);
+
+    if (strictParsing && document()->settings() && document()->settings()->needsSiteSpecificQuirks()) {
+        // Work around <https://bugs.webkit.org/show_bug.cgi?id=28350>.
+        DEFINE_STATIC_LOCAL(const String, slashKHTMLFixesDotCss, ("/KHTMLFixes.css"));
+        DEFINE_STATIC_LOCAL(const String, mediaWikiKHTMLFixesStyleSheet, ("/* KHTML fix stylesheet */\n/* work around the horizontal scrollbars */\n#column-content { margin-left: 0; }\n\n"));
+        // There are two variants of KHTMLFixes.css. One is equal to mediaWikiKHTMLFixesStyleSheet,
+        // while the other lacks the second trailing newline.
+        if (url.endsWith(slashKHTMLFixesDotCss) && !sheetText.isNull() && mediaWikiKHTMLFixesStyleSheet.startsWith(sheetText)
+                && sheetText.length() >= mediaWikiKHTMLFixesStyleSheet.length() - 1) {
+            ASSERT(m_sheet->length() == 1);
+            ExceptionCode ec;
+            m_sheet->deleteRule(0, ec);
+        }
+    }
+
     m_sheet->setTitle(title());
 
     RefPtr<MediaList> media = MediaList::createAllowingDescriptionSyntax(m_media);
diff --git a/WebCore/html/HTMLMediaElement.cpp b/WebCore/html/HTMLMediaElement.cpp
index 401d79f..e90db4a 100644
--- a/WebCore/html/HTMLMediaElement.cpp
+++ b/WebCore/html/HTMLMediaElement.cpp
@@ -28,6 +28,9 @@
 #if ENABLE(VIDEO)
 #include "HTMLMediaElement.h"
 
+#include "ClientRect.h"
+#include "ClientRectList.h"
+#include "ChromeClient.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
@@ -38,6 +41,8 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "FrameView.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
 #include "HTMLSourceElement.h"
@@ -52,6 +57,7 @@
 #include "Page.h"
 #include "ProgressEvent.h"
 #include "RenderVideo.h"
+#include "RenderView.h"
 #include "ScriptEventListener.h"
 #include "TimeRanges.h"
 #include <limits>
@@ -110,6 +116,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
     , m_sentEndEvent(false)
     , m_pausedInternal(false)
     , m_sendProgressEvents(true)
+    , m_isFullscreen(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_needWidgetUpdate(false)
 #endif
@@ -178,6 +185,8 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().loadeddataEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadedmetadataAttr)
         setAttributeEventListener(eventNames().loadedmetadataEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onloadendAttr)
+        setAttributeEventListener(eventNames().loadendEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadstartAttr)
         setAttributeEventListener(eventNames().loadstartEvent, createAttributeEventListener(this, attr));
     else if (attrName == onpauseAttr)
@@ -238,6 +247,12 @@ void HTMLMediaElement::insertedIntoDocument()
         scheduleLoad();
 }
 
+void HTMLMediaElement::willRemove()
+{
+    if (m_isFullscreen)
+        exitFullscreen();
+    HTMLElement::willRemove();
+}
 void HTMLMediaElement::removedFromDocument()
 {
     if (m_networkState > NETWORK_EMPTY)
@@ -269,6 +284,15 @@ void HTMLMediaElement::recalcStyle(StyleChange change)
 
 void HTMLMediaElement::scheduleLoad()
 {
+    if (m_loadTimer.isActive())
+        return;
+    prepareForLoad();
+    m_loadTimer.startOneShot(0);
+}
+
+void HTMLMediaElement::scheduleNextSourceChild()
+{
+    // Schedule the timer to try the next <source> element WITHOUT resetting state ala prepareForLoad.
     m_loadTimer.startOneShot(0);
 }
 
@@ -408,17 +432,15 @@ void HTMLMediaElement::load(ExceptionCode& ec)
 {
     if (m_restrictions & RequireUserGestureForLoadRestriction && !processingUserGesture())
         ec = INVALID_STATE_ERR;
-    else
+    else {
+        prepareForLoad();
         loadInternal();
+    }
 }
 
-void HTMLMediaElement::loadInternal()
+void HTMLMediaElement::prepareForLoad()
 {
-    // 1 - If the load() method for this element is already being invoked, then abort these steps.
-    if (m_processingLoad)
-        return;
-    m_processingLoad = true;
-    
+    // Perform the cleanup required for the resource load algorithm to run.
     stopPeriodicTimers();
     m_loadTimer.stop();
     m_sentStalledEvent = false;
@@ -430,21 +452,34 @@ void HTMLMediaElement::loadInternal()
     // 3 - If there are any tasks from the media element's media element event task source in 
     // one of the task queues, then remove those tasks.
     cancelPendingEventsAndCallbacks();
+}
+
+void HTMLMediaElement::loadInternal()
+{
+    // 1 - If the load() method for this element is already being invoked, then abort these steps.
+    if (m_processingLoad)
+        return;
+    m_processingLoad = true;
+    
+    // Steps 2 and 3 were done in prepareForLoad()
     
-    // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set the 
-    // error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED, 
-    // and fire a progress event called abort at the media element.
+    // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set
+    // the error attribute to a new MediaError object whose code attribute is set to
+    // MEDIA_ERR_ABORTED, fire a progress event called abort at the media element, in the
+    // context of the fetching process that is in progress for the element, and fire a progress
+    // event called loadend at the media element, in the context of the same fetching process.
     if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE) {
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
-        
-        // fire synchronous 'abort'
+
+        // fire synchronous 'abort' and 'loadend'
         bool totalKnown = m_player && m_player->totalBytesKnown();
         unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
         unsigned total = m_player ? m_player->totalBytes() : 0;
-        dispatchProgressEvent(eventNames().abortEvent, totalKnown, loaded, total);
+        dispatchEvent(ProgressEvent::create(eventNames().abortEvent, totalKnown, loaded, total));
+        dispatchEvent(ProgressEvent::create(eventNames().loadendEvent, totalKnown, loaded, total));
     }
-    
-    // 5 
+
+    // 5
     m_error = 0;
     m_autoplaying = true;
     m_playedTimeRanges = TimeRanges::create();
@@ -452,7 +487,7 @@ void HTMLMediaElement::loadInternal()
 
     // 6
     setPlaybackRate(defaultPlaybackRate());
-    
+
     // 7
     if (m_networkState != NETWORK_EMPTY) {
         m_networkState = NETWORK_EMPTY;
@@ -464,9 +499,9 @@ void HTMLMediaElement::loadInternal()
             m_playing = false;
             m_player->seek(0);
         }
-        dispatchEvent(eventNames().emptiedEvent, false, true);
+        dispatchEvent(Event::create(eventNames().emptiedEvent, false, true));
     }
-    
+
     selectMediaResource();
     m_processingLoad = false;
 }
@@ -530,9 +565,20 @@ void HTMLMediaElement::loadNextSourceChild()
     loadResource(mediaURL, contentType);
 }
 
-void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType)
+void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& contentType)
 {
-    ASSERT(isSafeToLoadURL(url, Complain));
+    ASSERT(isSafeToLoadURL(initialURL, Complain));
+
+    Frame* frame = document()->frame();
+    if (!frame)
+        return;
+    FrameLoader* loader = frame->loader();
+    if (!loader)
+        return;
+
+    KURL url(initialURL);
+    if (!loader->willLoadMediaElementURL(url))
+        return;
 
     // The resource fetch algorithm 
     m_networkState = NETWORK_LOADING;
@@ -570,8 +616,8 @@ bool HTMLMediaElement::isSafeToLoadURL(const KURL& url, InvalidSourceAction acti
     Frame* frame = document()->frame();
     FrameLoader* loader = frame ? frame->loader() : 0;
 
-    // don't allow remote to local urls
-    if (!loader || !loader->canLoad(url, String(), document())) {
+    // don't allow remote to local urls, and check with the frame loader client.
+    if (!loader || !SecurityOrigin::canLoad(url, String(), document())) {
         if (actionIfInvalid == Complain)
             FrameLoader::reportLocalLoadFailed(frame, url.string());
         return false;
@@ -597,22 +643,29 @@ void HTMLMediaElement::noneSupported()
     m_loadState = WaitingForSource;
     m_currentSourceNode = 0;
 
-    // 3 - Reaching this step indicates that either the URL failed to resolve, or the media 
-    // resource failed to load. Set the error attribute to a new MediaError object whose 
+    // 4 - Reaching this step indicates that either the URL failed to resolve, or the media
+    // resource failed to load. Set the error attribute to a new MediaError object whose
     // code attribute is set to MEDIA_ERR_SRC_NOT_SUPPORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_SRC_NOT_SUPPORTED);
 
-    // 4- Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
+    // 5 - Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
     m_networkState = NETWORK_NO_SOURCE;
 
-    // 5 - Queue a task to fire a progress event called error at the media element.
-    scheduleProgressEvent(eventNames().errorEvent); 
+    // 6 - Queue a task to fire a progress event called error at the media element, in
+    // the context of the fetching process that was used to try to obtain the media
+    // resource in the resource fetch algorithm.
+    scheduleProgressEvent(eventNames().errorEvent);
 
-    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    // 7 - Queue a task to fire a progress event called loadend at the media element, in
+    // the context of the fetching process that was used to try to obtain the media
+    // resource in the resource fetch algorithm.
+    scheduleProgressEvent(eventNames().loadendEvent);
+
+    // 8 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
-    // Abort these steps. Until the load() method is invoked, the element won't attempt to load another resource.
-    
+    // 9 -Abort these steps. Until the load() method is invoked, the element won't attempt to load another resource.
+
     if (isVideo())
         static_cast<HTMLVideoElement*>(this)->updatePosterImage();
     if (renderer())
@@ -629,20 +682,24 @@ void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
     // set to MEDIA_ERR_NETWORK/MEDIA_ERR_DECODE.
     m_error = err;
 
-    // 3 - Queue a task to fire a progress event called error at the media element.
-    scheduleProgressEvent(eventNames().errorEvent); 
+    // 3 - Queue a task to fire a progress event called error at the media element, in
+    // the context of the fetching process started by this instance of this algorithm.
+    scheduleProgressEvent(eventNames().errorEvent);
 
-    // 3 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a 
+    // 4 - Queue a task to fire a progress event called loadend at the media element, in
+    // the context of the fetching process started by this instance of this algorithm.
+    scheduleProgressEvent(eventNames().loadendEvent);
+
+    // 5 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
     // task to fire a simple event called emptied at the element.
     m_networkState = NETWORK_EMPTY;
     scheduleEvent(eventNames().emptiedEvent);
 
-    // 4 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
-    // 5 - Abort the overall resource selection algorithm.
+    // 7 - Abort the overall resource selection algorithm.
     m_currentSourceNode = 0;
-
 }
 
 void HTMLMediaElement::cancelPendingEventsAndCallbacks()
@@ -678,7 +735,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         if (m_readyState < HAVE_METADATA && m_loadState == LoadingFromSourceElement) {
             m_currentSourceNode->scheduleErrorEvent();
             if (havePotentialSourceChild())
-                scheduleLoad();
+                scheduleNextSourceChild();
             return;
         }
 
@@ -716,6 +773,10 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         if (oldState < NETWORK_LOADED || oldState == NETWORK_NO_SOURCE) {
             m_progressEventTimer.stop();
 
+            // Schedule one last progress event so we guarantee that at least one is fired
+            // for files that load very quickly.
+            scheduleProgressEvent(eventNames().progressEvent);
+
             // Check to see if readyState changes need to be dealt with before sending the 
             // 'load' event so we report 'canplaythrough' first. This is necessary because a
             //  media engine reports readyState and networkState changes separately
@@ -723,7 +784,8 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
             if (static_cast<ReadyState>(currentState) != m_readyState)
                 setReadyState(currentState);
 
-             scheduleProgressEvent(eventNames().loadEvent); 
+            scheduleProgressEvent(eventNames().loadEvent);
+            scheduleProgressEvent(eventNames().loadendEvent);
         }
     }
 }
@@ -748,21 +810,29 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
     if (m_readyState == oldState)
         return;
     
-    if (m_readyState >= HAVE_CURRENT_DATA)
-        m_seeking = false;
-    
     if (m_networkState == NETWORK_EMPTY)
         return;
 
-    if (m_seeking && m_readyState < HAVE_CURRENT_DATA) {
+    if (m_seeking) {
+        // 4.8.10.10, step 8
+        if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA)
+            scheduleEvent(eventNames().waitingEvent);
+
         // 4.8.10.10, step 9
-        scheduleEvent(eventNames().seekingEvent);
-    }
+        if (m_readyState < HAVE_CURRENT_DATA) {
+            if (oldState >= HAVE_CURRENT_DATA)
+                scheduleEvent(eventNames().seekingEvent);
+        } else {
+            // 4.8.10.10 step 12 & 13.
+            finishSeek();
+        }
 
-    if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA) {
-        // 4.8.10.9
-        scheduleTimeupdateEvent(false);
-        scheduleEvent(eventNames().waitingEvent);
+    } else {
+        if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA) {
+            // 4.8.10.9
+            scheduleTimeupdateEvent(false);
+            scheduleEvent(eventNames().waitingEvent);
+        }
     }
 
     if (m_readyState >= HAVE_METADATA && oldState < HAVE_METADATA) {
@@ -855,6 +925,13 @@ void HTMLMediaElement::returnToRealtime()
     setCurrentTime(maxTimeSeekable(), e);
 }  
 
+void HTMLMediaElement::addPlayedRange(float start, float end)
+{
+    if (!m_playedTimeRanges)
+        m_playedTimeRanges = TimeRanges::create();
+    m_playedTimeRanges->add(start, end);
+}  
+
 bool HTMLMediaElement::supportsSave() const
 {
     return m_player ? m_player->supportsSave() : false;
@@ -890,7 +967,7 @@ void HTMLMediaElement::seek(float time, ExceptionCode& ec)
     // 5
     if (m_playing) {
         if (m_lastSeekTime < now)
-            m_playedTimeRanges->add(m_lastSeekTime, now);
+            addPlayedRange(m_lastSeekTime, now);
     }
     m_lastSeekTime = time;
 
@@ -907,6 +984,15 @@ void HTMLMediaElement::seek(float time, ExceptionCode& ec)
     m_sentEndEvent = false;
 }
 
+void HTMLMediaElement::finishSeek()
+{
+    // 4.8.10.10 Seeking step 12
+    m_seeking = false;
+
+    // 4.8.10.10 Seeking step 13
+    scheduleEvent(eventNames().seekedEvent);
+}
+
 HTMLMediaElement::ReadyState HTMLMediaElement::readyState() const
 {
     return m_readyState;
@@ -917,6 +1003,11 @@ MediaPlayer::MovieLoadType HTMLMediaElement::movieLoadType() const
     return m_player ? m_player->movieLoadType() : MediaPlayer::Unknown;
 }
 
+bool HTMLMediaElement::hasAudio() const
+{
+    return m_player ? m_player->hasAudio() : false;
+}
+
 bool HTMLMediaElement::seeking() const
 {
     return m_seeking;
@@ -1232,7 +1323,19 @@ float HTMLMediaElement::percentLoaded() const
     if (!m_player)
         return 0;
     float duration = m_player->duration();
-    return duration ? m_player->maxTimeBuffered() / duration : 0;
+
+    if (!duration || isinf(duration))
+        return 0;
+
+    float buffered = 0;
+    RefPtr<TimeRanges> timeRanges = m_player->buffered();
+    for (unsigned i = 0; i < timeRanges->length(); ++i) {
+        ExceptionCode ignoredException;
+        float start = timeRanges->start(i, ignoredException);
+        float end = timeRanges->end(i, ignoredException);
+        buffered += end - start;
+    }
+    return buffered / duration;
 }
 
 bool HTMLMediaElement::havePotentialSourceChild()
@@ -1304,9 +1407,9 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
 {
     beginProcessingMediaPlayerCallback();
 
+    // 4.8.10.10 step 12 & 13.  Needed if no ReadyState change is associated with the seek.
     if (m_readyState >= HAVE_CURRENT_DATA && m_seeking) {
-        scheduleEvent(eventNames().seekedEvent);
-        m_seeking = false;
+        finishSeek();
     }
     
     float now = currentTime();
@@ -1411,23 +1514,22 @@ GraphicsLayer* HTMLMediaElement::mediaPlayerGraphicsLayer(MediaPlayer*)
 
 PassRefPtr<TimeRanges> HTMLMediaElement::buffered() const
 {
-    // FIXME real ranges support
-    if (!m_player || !m_player->maxTimeBuffered())
+    if (!m_player)
         return TimeRanges::create();
-    return TimeRanges::create(0, m_player->maxTimeBuffered());
+    return m_player->buffered();
 }
 
-PassRefPtr<TimeRanges> HTMLMediaElement::played() const
+PassRefPtr<TimeRanges> HTMLMediaElement::played()
 {
-    if (!m_playedTimeRanges) {
-        // We are not yet loaded
-        return TimeRanges::create();
-    }
     if (m_playing) {
         float time = currentTime();
-        if (m_lastSeekTime < time)
-            m_playedTimeRanges->add(m_lastSeekTime, time);
+        if (time > m_lastSeekTime)
+            addPlayedRange(m_lastSeekTime, time);
     }
+
+    if (!m_playedTimeRanges)
+        m_playedTimeRanges = TimeRanges::create();
+
     return m_playedTimeRanges->copy();
 }
 
@@ -1528,11 +1630,20 @@ void HTMLMediaElement::updatePlayState()
         m_playbackProgressTimer.stop();
         m_playing = false;
         float time = currentTime();
+<<<<<<< HEAD:WebCore/html/HTMLMediaElement.cpp
         if (m_lastSeekTime < time)
             m_playedTimeRanges->add(m_lastSeekTime, time);
+=======
+        if (time > m_lastSeekTime)
+            addPlayedRange(m_lastSeekTime, time);
+>>>>>>> webkit.org at 49305:WebCore/html/HTMLMediaElement.cpp
     } else if (couldPlayIfEnoughData() && playerPaused)
         m_player->prepareToPlay();
+<<<<<<< HEAD:WebCore/html/HTMLMediaElement.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/html/HTMLMediaElement.cpp
     if (renderer())
         renderer()->updateFromElement();
 }
@@ -1551,35 +1662,44 @@ void HTMLMediaElement::stopPeriodicTimers()
 
 void HTMLMediaElement::userCancelledLoad()
 {
-    if (m_networkState != NETWORK_EMPTY) {
+    if (m_networkState == NETWORK_EMPTY || m_networkState >= NETWORK_LOADED)
+        return;
 
-        // If the media data fetching process is aborted by the user:
+    // If the media data fetching process is aborted by the user:
 
-        // 1 - The user agent should cancel the fetching process.
+    // 1 - The user agent should cancel the fetching process.
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-        m_player.clear();
+    m_player.clear();
 #endif
-        stopPeriodicTimers();
+    stopPeriodicTimers();
 
-        // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORT.
-        m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
+    // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORT.
+    m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
 
-        // 3 - Queue a task to fire a progress event called abort at the media element.
-        scheduleProgressEvent(eventNames().abortEvent);
-
-        // 4 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the 
-        // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a 
-        // simple event called emptied at the element. Otherwise, set set the element's networkState 
-        // attribute to the NETWORK_IDLE value.
-        if (m_networkState >= NETWORK_LOADING) {
-            m_networkState = NETWORK_EMPTY;
-            m_readyState = HAVE_NOTHING;
-            scheduleEvent(eventNames().emptiedEvent);
-        }
+    // 3 - Queue a task to fire a progress event called abort at the media element, in the context
+    // of the fetching process started by this instance of this algorithm.
+    scheduleProgressEvent(eventNames().abortEvent);
 
-        // 5 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
-        m_delayingTheLoadEvent = false;
+    // 4 - Queue a task to fire a progress event called loadend at the media element, in the context
+    // of the fetching process started by this instance of this algorithm.
+    scheduleProgressEvent(eventNames().loadendEvent);
+
+    // 5 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the
+    // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a
+    // simple event called emptied at the element. Otherwise, set set the element's networkState
+    // attribute to the NETWORK_IDLE value.
+    if (m_readyState == HAVE_NOTHING) {
+        m_networkState = NETWORK_EMPTY;
+        scheduleEvent(eventNames().emptiedEvent);
     }
+    else
+        m_networkState = NETWORK_IDLE;
+
+    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    m_delayingTheLoadEvent = false;
+
+    // 7 - Abort the overall resource selection algorithm.
+    m_currentSourceNode = 0;
 }
 
 void HTMLMediaElement::documentWillBecomeInactive()
@@ -1610,7 +1730,7 @@ void HTMLMediaElement::documentDidBecomeActive()
         ExceptionCode ec;
         load(ec);
     }
-        
+
     if (renderer())
         renderer()->updateFromElement();
 }
@@ -1620,6 +1740,14 @@ void HTMLMediaElement::mediaVolumeDidChange()
     updateVolume();
 }
 
+const IntRect HTMLMediaElement::screenRect()
+{
+    IntRect elementRect;
+    if (renderer())
+        elementRect = renderer()->view()->frameView()->contentsToScreen(renderer()->absoluteBoundingBoxRect());
+    return elementRect;
+}
+    
 void HTMLMediaElement::defaultEventHandler(Event* event)
 {
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
@@ -1692,6 +1820,28 @@ void HTMLMediaElement::finishParsingChildren()
 
 #endif
 
+void HTMLMediaElement::enterFullscreen()
+{
+    ASSERT(!m_isFullscreen);
+    if (!renderer())
+        return;
+    if (document() && document()->page())
+        document()->page()->chrome()->client()->enterFullscreenForNode(this);
+    m_isFullscreen = true;
+}
+
+void HTMLMediaElement::exitFullscreen()
+{
+    ASSERT(m_isFullscreen);
+    if (document() && document()->page())
+        document()->page()->chrome()->client()->exitFullscreenForNode(this);
+    m_isFullscreen = false;
+}
+
+PlatformMedia HTMLMediaElement::platformMedia() const
+{
+    return m_player ? m_player->platformMedia() : NoPlatformMedia;
+}        
 }
 
 #endif
diff --git a/WebCore/html/HTMLMediaElement.h b/WebCore/html/HTMLMediaElement.h
index 9218ad6..0005e07 100644
--- a/WebCore/html/HTMLMediaElement.h
+++ b/WebCore/html/HTMLMediaElement.h
@@ -43,7 +43,7 @@ class HTMLSourceElement;
 class MediaError;
 class KURL;
 class TimeRanges;
-    
+
 class HTMLMediaElement : public HTMLElement, public MediaPlayerClient {
 public:
     HTMLMediaElement(const QualifiedName&, Document*);
@@ -57,6 +57,7 @@ public:
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void insertedIntoDocument();
+    virtual void willRemove();
     virtual void removedFromDocument();
     virtual void attach();
     virtual void recalcStyle(StyleChange);
@@ -65,6 +66,7 @@ public:
     
     virtual bool isVideo() const { return false; }
     virtual bool hasVideo() const { return false; }
+    virtual bool hasAudio() const;
 
     void rewind(float timeDelta);
     void returnToRealtime();
@@ -72,6 +74,8 @@ public:
     // Eventually overloaded in HTMLVideoElement
     virtual bool supportsFullscreen() const { return false; };
     virtual bool supportsSave() const;
+    
+    PlatformMedia platformMedia() const;
 
     void scheduleLoad();
     
@@ -119,7 +123,7 @@ public:
     void setPlaybackRate(float);
     bool webkitPreservesPitch() const;
     void setWebkitPreservesPitch(bool);
-    PassRefPtr<TimeRanges> played() const;
+    PassRefPtr<TimeRanges> played();
     PassRefPtr<TimeRanges> seekable() const;
     bool ended() const;
     bool autoplay() const;    
@@ -140,6 +144,8 @@ public:
     void beginScrubbing();
     void endScrubbing();
 
+    const IntRect screenRect();
+
     bool canPlay() const;
 
     float percentLoaded() const;
@@ -153,6 +159,9 @@ public:
 #endif
 
     bool hasSingleSecurityOrigin() const { return !m_player || m_player->hasSingleSecurityOrigin(); }
+    
+    void enterFullscreen();
+    void exitFullscreen();
 
 protected:
     float getTimeOffsetAttribute(const QualifiedName&, float valueOnError) const;
@@ -190,7 +199,9 @@ private:
     void stopPeriodicTimers();
 
     void seek(float time, ExceptionCode&);
+    void finishSeek();
     void checkIfSeekNeeded();
+    void addPlayedRange(float start, float end);
     
     void scheduleTimeupdateEvent(bool periodicEvent);
     void scheduleProgressEvent(const AtomicString& eventName);
@@ -200,6 +211,7 @@ private:
     // loading
     void selectMediaResource();
     void loadResource(const KURL&, ContentType&);
+    void scheduleNextSourceChild();
     void loadNextSourceChild();
     void userCancelledLoad();
     bool havePotentialSourceChild();
@@ -215,6 +227,8 @@ private:
     void loadInternal();
     void playInternal();
     void pauseInternal();
+
+    void prepareForLoad();
     
     bool processingUserGesture() const;
     bool processingMediaPlayerCallback() const { return m_processingMediaPlayerCallback > 0; }
@@ -305,6 +319,8 @@ protected:
     // support progress events so setting m_sendProgressEvents disables them 
     bool m_sendProgressEvents : 1;
 
+    bool m_isFullscreen : 1;
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     bool m_needWidgetUpdate : 1;
 #endif
diff --git a/WebCore/html/HTMLObjectElement.cpp b/WebCore/html/HTMLObjectElement.cpp
index 76a9c5a..d3ccfa4 100644
--- a/WebCore/html/HTMLObjectElement.cpp
+++ b/WebCore/html/HTMLObjectElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -45,8 +45,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* doc, bool createdByParser) 
-    : HTMLPlugInImageElement(tagName, doc)
+inline HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* document, bool createdByParser) 
+    : HTMLPlugInImageElement(tagName, document)
     , m_docNamedItem(true)
     , m_needWidgetUpdate(!createdByParser)
     , m_useFallbackContent(false)
@@ -54,8 +54,9 @@ HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* doc
     ASSERT(hasTagName(objectTag));
 }
 
-HTMLObjectElement::~HTMLObjectElement()
+PassRefPtr<HTMLObjectElement> HTMLObjectElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
 {
+    return adoptRef(new HTMLObjectElement(tagName, document, createdByParser));
 }
 
 RenderWidget* HTMLObjectElement::renderWidgetForJSBindings() const
@@ -94,9 +95,11 @@ void HTMLObjectElement::parseMappedAttribute(MappedAttribute *attr)
         m_classId = val;
         if (renderer())
           m_needWidgetUpdate = true;
-    } else if (attr->name() == onloadAttr) {
+    } else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == nameAttr) {
+    else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (isDocNamedItem() && inDocument() && document()->isHTMLDocument()) {
             HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
@@ -297,66 +300,6 @@ void HTMLObjectElement::updateDocNamedItem()
     m_docNamedItem = isNamedItem;
 }
 
-String HTMLObjectElement::code() const
-{
-    return getAttribute(codeAttr);
-}
-
-void HTMLObjectElement::setCode(const String& value)
-{
-    setAttribute(codeAttr, value);
-}
-
-String HTMLObjectElement::archive() const
-{
-    return getAttribute(archiveAttr);
-}
-
-void HTMLObjectElement::setArchive(const String& value)
-{
-    setAttribute(archiveAttr, value);
-}
-
-String HTMLObjectElement::border() const
-{
-    return getAttribute(borderAttr);
-}
-
-void HTMLObjectElement::setBorder(const String& value)
-{
-    setAttribute(borderAttr, value);
-}
-
-String HTMLObjectElement::codeBase() const
-{
-    return getAttribute(codebaseAttr);
-}
-
-void HTMLObjectElement::setCodeBase(const String& value)
-{
-    setAttribute(codebaseAttr, value);
-}
-
-String HTMLObjectElement::codeType() const
-{
-    return getAttribute(codetypeAttr);
-}
-
-void HTMLObjectElement::setCodeType(const String& value)
-{
-    setAttribute(codetypeAttr, value);
-}
-
-KURL HTMLObjectElement::data() const
-{
-    return document()->completeURL(getAttribute(dataAttr));
-}
-
-void HTMLObjectElement::setData(const String& value)
-{
-    setAttribute(dataAttr, value);
-}
-
 bool HTMLObjectElement::declare() const
 {
     return !getAttribute(declareAttr).isNull();
@@ -377,36 +320,6 @@ void HTMLObjectElement::setHspace(int value)
     setAttribute(hspaceAttr, String::number(value));
 }
 
-String HTMLObjectElement::standby() const
-{
-    return getAttribute(standbyAttr);
-}
-
-void HTMLObjectElement::setStandby(const String& value)
-{
-    setAttribute(standbyAttr, value);
-}
-
-String HTMLObjectElement::type() const
-{
-    return getAttribute(typeAttr);
-}
-
-void HTMLObjectElement::setType(const String& value)
-{
-    setAttribute(typeAttr, value);
-}
-
-String HTMLObjectElement::useMap() const
-{
-    return getAttribute(usemapAttr);
-}
-
-void HTMLObjectElement::setUseMap(const String& value)
-{
-    setAttribute(usemapAttr, value);
-}
-
 int HTMLObjectElement::vspace() const
 {
     return getAttribute(vspaceAttr).toInt();
@@ -419,21 +332,19 @@ void HTMLObjectElement::setVspace(int value)
 
 bool HTMLObjectElement::containsJavaApplet() const
 {
-    if (MIMETypeRegistry::isJavaAppletMIMEType(type()))
+    if (MIMETypeRegistry::isJavaAppletMIMEType(getAttribute(typeAttr)))
         return true;
         
-    Node* child = firstChild();
-    while (child) {
-        if (child->isElementNode()) {
-            Element* e = static_cast<Element*>(child);
-            if (e->hasTagName(paramTag) && equalIgnoringCase(e->getAttribute(nameAttr), "type") && MIMETypeRegistry::isJavaAppletMIMEType(e->getAttribute(valueAttr).string()))
-                return true;
-            else if (e->hasTagName(objectTag) && static_cast<HTMLObjectElement*>(e)->containsJavaApplet())
-                return true;
-            else if (e->hasTagName(appletTag))
-                return true;
-        }
-        child = child->nextSibling();
+    for (Element* child = firstElementChild(); child; child = child->nextElementSibling()) {
+        if (child->hasTagName(paramTag)
+                && equalIgnoringCase(child->getAttribute(nameAttr), "type")
+                && MIMETypeRegistry::isJavaAppletMIMEType(child->getAttribute(valueAttr).string()))
+            return true;
+        if (child->hasTagName(objectTag)
+                && static_cast<HTMLObjectElement*>(child)->containsJavaApplet())
+            return true;
+        if (child->hasTagName(appletTag))
+            return true;
     }
     
     return false;
@@ -443,9 +354,13 @@ void HTMLObjectElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) con
 {
     HTMLPlugInImageElement::addSubresourceAttributeURLs(urls);
 
-    addSubresourceURL(urls, data());
-    if (useMap().startsWith("#"))
-        addSubresourceURL(urls, document()->completeURL(useMap()));
+    addSubresourceURL(urls, document()->completeURL(getAttribute(dataAttr)));
+
+    // FIXME: Passing a string that starts with "#" to the completeURL function does
+    // not seem like it would work. The image element has similar but not identical code.
+    const AtomicString& useMap = getAttribute(usemapAttr);
+    if (useMap.startsWith("#"))
+        addSubresourceURL(urls, document()->completeURL(useMap));
 }
 
 }
diff --git a/WebCore/html/HTMLObjectElement.h b/WebCore/html/HTMLObjectElement.h
index 8f31bda..ec1132f 100644
--- a/WebCore/html/HTMLObjectElement.h
+++ b/WebCore/html/HTMLObjectElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,12 +27,31 @@
 
 namespace WebCore {
 
-class KURL;
-
 class HTMLObjectElement : public HTMLPlugInImageElement {
 public:
+    static PassRefPtr<HTMLObjectElement> create(const QualifiedName&, Document*, bool createdByParser);
+
+    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
+
+    void renderFallbackContent();
+
+    bool declare() const;
+    void setDeclare(bool);
+
+    int hspace() const;
+    void setHspace(int);
+
+    int vspace() const;
+    void setVspace(int);
+
+    bool isDocNamedItem() const { return m_docNamedItem; }
+
+    const String& classId() const { return m_classId; }
+
+    bool containsJavaApplet() const;
+
+private:
     HTMLObjectElement(const QualifiedName&, Document*, bool createdByParser);
-    ~HTMLObjectElement();
 
     virtual int tagPriority() const { return 5; }
 
@@ -54,57 +73,11 @@ public:
     virtual const QualifiedName& imageSourceAttributeName() const;
 
     virtual void updateWidget();
-    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
-
-    void renderFallbackContent();
 
     virtual RenderWidget* renderWidgetForJSBindings() const;
 
-    String archive() const;
-    void setArchive(const String&);
-
-    String border() const;
-    void setBorder(const String&);
-
-    String code() const;
-    void setCode(const String&);
-    
-    String codeBase() const;
-    void setCodeBase(const String&);
-
-    String codeType() const;
-    void setCodeType(const String&);
-    
-    KURL data() const;
-    void setData(const String&);
-
-    bool declare() const;
-    void setDeclare(bool);
-
-    int hspace() const;
-    void setHspace(int);
-
-    String standby() const;
-    void setStandby(const String&);
-
-    String type() const;
-    void setType(const String&);
-
-    String useMap() const;
-    void setUseMap(const String&);
-
-    int vspace() const;
-    void setVspace(int);
-
-    bool isDocNamedItem() const { return m_docNamedItem; }
-
-    const String& classId() const { return m_classId; }
-
-    bool containsJavaApplet() const;
-
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-private:
     void updateDocNamedItem();
 
     AtomicString m_id;
diff --git a/WebCore/html/HTMLObjectElement.idl b/WebCore/html/HTMLObjectElement.idl
index 1880836..b51c568 100644
--- a/WebCore/html/HTMLObjectElement.idl
+++ b/WebCore/html/HTMLObjectElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -30,22 +30,23 @@ module html {
         ImplementationUUID=2dd24554-6784-4ef9-9713-179f3d37b2f9
     ] HTMLObjectElement : HTMLElement {
         readonly attribute HTMLFormElement form;
-                 attribute [ConvertNullToNullString] DOMString       code;
-                 attribute [ConvertNullToNullString] DOMString       align;
-                 attribute [ConvertNullToNullString] DOMString       archive;
-                 attribute [ConvertNullToNullString] DOMString       border;
-                 attribute [ConvertNullToNullString] DOMString       codeBase;
-                 attribute [ConvertNullToNullString] DOMString       codeType;
-                 attribute [ConvertNullToNullString] DOMString       data;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       code;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       align;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       archive;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       border;
+                 attribute [ConvertNullToNullString, Reflect=codebase] DOMString       codeBase;
+                 attribute [ConvertNullToNullString, Reflect=codetype] DOMString       codeType;
+                 attribute [ConvertNullToNullString, ReflectURL] DOMString       data;
                  attribute boolean         declare;
-                 attribute [ConvertNullToNullString] DOMString       height;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       height;
                  attribute long            hspace;
-                 attribute [ConvertNullToNullString] DOMString       name;
-                 attribute [ConvertNullToNullString] DOMString       standby;
-                 attribute [ConvertNullToNullString] DOMString       type;
-                 attribute [ConvertNullToNullString] DOMString       useMap;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       standby;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       type;
+                 attribute [ConvertNullToNullString, Reflect=usemap] DOMString       useMap;
                  attribute long            vspace;
-                 attribute [ConvertNullToNullString] DOMString       width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       width;
+        readonly attribute boolean         willValidate;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/WebCore/html/HTMLOptGroupElement.cpp b/WebCore/html/HTMLOptGroupElement.cpp
index af81b07..90156da 100644
--- a/WebCore/html/HTMLOptGroupElement.cpp
+++ b/WebCore/html/HTMLOptGroupElement.cpp
@@ -44,9 +44,15 @@ HTMLOptGroupElement::HTMLOptGroupElement(const QualifiedName& tagName, Document*
     ASSERT(hasTagName(optgroupTag));
 }
 
+bool HTMLOptGroupElement::supportsFocus() const
+{
+    return HTMLElement::supportsFocus();
+}
+
 bool HTMLOptGroupElement::isFocusable() const
 {
-    return HTMLElement::isFocusable();
+    // Optgroup elements do not have a renderer so we check the renderStyle instead.
+    return supportsFocus() && renderStyle() && renderStyle()->display() != NONE;
 }
 
 const AtomicString& HTMLOptGroupElement::formControlType() const
diff --git a/WebCore/html/HTMLOptGroupElement.h b/WebCore/html/HTMLOptGroupElement.h
index 13e92ca..6e5b043 100644
--- a/WebCore/html/HTMLOptGroupElement.h
+++ b/WebCore/html/HTMLOptGroupElement.h
@@ -37,6 +37,7 @@ public:
 
     virtual bool checkDTD(const Node*);
     virtual const AtomicString& formControlType() const;
+    virtual bool supportsFocus() const;
     virtual bool isFocusable() const;
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
diff --git a/WebCore/html/HTMLOptionElement.cpp b/WebCore/html/HTMLOptionElement.cpp
index 009db47..501615f 100644
--- a/WebCore/html/HTMLOptionElement.cpp
+++ b/WebCore/html/HTMLOptionElement.cpp
@@ -66,9 +66,15 @@ void HTMLOptionElement::detach()
     HTMLFormControlElement::detach();
 }
 
+bool HTMLOptionElement::supportsFocus() const
+{
+    return HTMLElement::supportsFocus();
+}
+
 bool HTMLOptionElement::isFocusable() const
 {
-    return HTMLElement::isFocusable();
+    // Option elements do not have a renderer so we check the renderStyle instead.
+    return supportsFocus() && renderStyle() && renderStyle()->display() != NONE;
 }
 
 const AtomicString& HTMLOptionElement::formControlType() const
@@ -92,7 +98,7 @@ void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
     }
 
     removeChildren();
-    appendChild(new Text(document(), text), ec);
+    appendChild(Text::create(document(), text), ec);
 }
 
 void HTMLOptionElement::accessKeyAction(bool)
diff --git a/WebCore/html/HTMLOptionElement.h b/WebCore/html/HTMLOptionElement.h
index f13a802..843608f 100644
--- a/WebCore/html/HTMLOptionElement.h
+++ b/WebCore/html/HTMLOptionElement.h
@@ -42,6 +42,7 @@ public:
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusOptional; }
     virtual int tagPriority() const { return 2; }
     virtual bool checkDTD(const Node* newChild);
+    virtual bool supportsFocus() const;
     virtual bool isFocusable() const;
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
     virtual void attach();
diff --git a/WebCore/html/HTMLParser.cpp b/WebCore/html/HTMLParser.cpp
index 722f4e2..1cb47ae 100644
--- a/WebCore/html/HTMLParser.cpp
+++ b/WebCore/html/HTMLParser.cpp
@@ -692,13 +692,13 @@ typedef HashMap<AtomicStringImpl*, CreateErrorCheckFunc> FunctionMap;
 
 bool HTMLParser::textCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Text(m_document, t->text.get());
+    result = Text::create(m_document, t->text.get());
     return false;
 }
 
 bool HTMLParser::commentCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Comment(m_document, t->text.get());
+    result = Comment::create(m_document, t->text.get());
     return false;
 }
 
@@ -921,6 +921,7 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
         gFunctionMap.set(listingTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(mapTag.localName().impl(), &HTMLParser::mapCreateErrorCheck);
         gFunctionMap.set(menuTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
+        gFunctionMap.set(navTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(nobrTag.localName().impl(), &HTMLParser::nestedCreateErrorCheck);
         gFunctionMap.set(noembedTag.localName().impl(), &HTMLParser::noembedCreateErrorCheck);
         gFunctionMap.set(noframesTag.localName().impl(), &HTMLParser::noframesCreateErrorCheck);
@@ -1093,6 +1094,7 @@ bool HTMLParser::isAffectedByResidualStyle(const AtomicString& tagName)
         unaffectedTags.add(selectTag.localName().impl());
         unaffectedTags.add(objectTag.localName().impl());
         unaffectedTags.add(datagridTag.localName().impl());
+        unaffectedTags.add(datalistTag.localName().impl());
     }
     
     return !unaffectedTags.contains(tagName.impl());
@@ -1598,7 +1600,7 @@ PassRefPtr<Node> HTMLParser::handleIsindex(Token* t)
     }
 
     n->addChild(new HTMLHRElement(hrTag, m_document));
-    n->addChild(new Text(m_document, text));
+    n->addChild(Text::create(m_document, text));
     n->addChild(isIndex.release());
     n->addChild(new HTMLHRElement(hrTag, m_document));
 
diff --git a/WebCore/html/HTMLPlugInElement.cpp b/WebCore/html/HTMLPlugInElement.cpp
index 7aa6083..2f429b4 100644
--- a/WebCore/html/HTMLPlugInElement.cpp
+++ b/WebCore/html/HTMLPlugInElement.cpp
@@ -91,16 +91,6 @@ PassScriptInstance HTMLPlugInElement::getInstance() const
     return m_instance;
 }
 
-String HTMLPlugInElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLPlugInElement::setAlign(const String& value)
-{
-    setAttribute(alignAttr, value);
-}
-
 String HTMLPlugInElement::height() const
 {
     return getAttribute(heightAttr);
@@ -111,16 +101,6 @@ void HTMLPlugInElement::setHeight(const String& value)
     setAttribute(heightAttr, value);
 }
 
-String HTMLPlugInElement::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLPlugInElement::setName(const String& value)
-{
-    setAttribute(nameAttr, value);
-}
-
 String HTMLPlugInElement::width() const
 {
     return getAttribute(widthAttr);
diff --git a/WebCore/html/HTMLPlugInElement.h b/WebCore/html/HTMLPlugInElement.h
index a9cbcc9..9d3dc6d 100644
--- a/WebCore/html/HTMLPlugInElement.h
+++ b/WebCore/html/HTMLPlugInElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -36,43 +36,44 @@ class RenderWidget;
 
 class HTMLPlugInElement : public HTMLFrameOwnerElement {
 public:
-    HTMLPlugInElement(const QualifiedName& tagName, Document*);
     virtual ~HTMLPlugInElement();
 
-    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
-    virtual void parseMappedAttribute(MappedAttribute*);
-
-    virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
-    virtual bool checkDTD(const Node* newChild);
-
-    virtual void updateWidget() { }
-
-    String align() const;
-    void setAlign(const String&);
-    
     String height() const;
     void setHeight(const String&);
     
-    String name() const;
-    void setName(const String&);
-    
     String width() const;
     void setWidth(const String&);
 
-    virtual void defaultEventHandler(Event*);
-
-    virtual RenderWidget* renderWidgetForJSBindings() const = 0;
-    virtual void detach();
     PassScriptInstance getInstance() const;
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    virtual NPObject* getNPObject();
+    NPObject* getNPObject();
 #endif
 
 protected:
+    HTMLPlugInElement(const QualifiedName& tagName, Document*);
+
+    virtual void detach();
+
     static void updateWidgetCallback(Node*);
 
+    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+private:
+    virtual void defaultEventHandler(Event*);
+
+    virtual RenderWidget* renderWidgetForJSBindings() const = 0;
+
+    virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
+    virtual bool checkDTD(const Node* newChild);
+
+    virtual void updateWidget() { }
+
+protected:
     AtomicString m_name;
+
+private:
     mutable ScriptInstance m_instance;
 #if ENABLE(NETSCAPE_PLUGIN_API)
     NPObject* m_NPObject;
diff --git a/WebCore/html/HTMLPlugInImageElement.h b/WebCore/html/HTMLPlugInImageElement.h
index ec3b258..7725a5a 100644
--- a/WebCore/html/HTMLPlugInImageElement.h
+++ b/WebCore/html/HTMLPlugInImageElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,15 +30,16 @@ class HTMLImageLoader;
 
 class HTMLPlugInImageElement : public HTMLPlugInElement {
 public:
-    HTMLPlugInImageElement(const QualifiedName& tagName, Document*);
     virtual ~HTMLPlugInImageElement();
 
-    bool isImageType();
-
     const String& serviceType() const { return m_serviceType; }
     const String& url() const { return m_url; }
 
 protected:
+    HTMLPlugInImageElement(const QualifiedName& tagName, Document*);
+
+    bool isImageType();
+
     OwnPtr<HTMLImageLoader> m_imageLoader;
     String m_serviceType;
     String m_url;
diff --git a/WebCore/html/HTMLScriptElement.cpp b/WebCore/html/HTMLScriptElement.cpp
index 86cc3a2..636c579 100644
--- a/WebCore/html/HTMLScriptElement.cpp
+++ b/WebCore/html/HTMLScriptElement.cpp
@@ -24,6 +24,7 @@
 #include "HTMLScriptElement.h"
 
 #include "Document.h"
+#include "Event.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
 #include "MappedAttribute.h"
@@ -70,6 +71,8 @@ void HTMLScriptElement::parseMappedAttribute(MappedAttribute* attr)
         handleSourceAttribute(m_data, attr->value());
     else if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -216,18 +219,18 @@ String HTMLScriptElement::forAttributeValue() const
 {
     return getAttribute(forAttr).string();
 }
- 
+
 void HTMLScriptElement::dispatchLoadEvent()
 {
     ASSERT(!m_data.haveFiredLoadEvent());
     m_data.setHaveFiredLoadEvent(true);
 
-    dispatchEvent(eventNames().loadEvent, false, false);
+    dispatchEvent(Event::create(eventNames().loadEvent, false, false));
 }
 
 void HTMLScriptElement::dispatchErrorEvent()
 {
-    dispatchEvent(eventNames().errorEvent, true, false);
+    dispatchEvent(Event::create(eventNames().errorEvent, true, false));
 }
 
 }
diff --git a/WebCore/html/HTMLSelectElement.idl b/WebCore/html/HTMLSelectElement.idl
index 177895e..53fe848 100644
--- a/WebCore/html/HTMLSelectElement.idl
+++ b/WebCore/html/HTMLSelectElement.idl
@@ -45,6 +45,7 @@ module html {
         readonly attribute ValidityState   validity;
 #endif
         readonly attribute boolean         willValidate;
+        boolean            checkValidity();
         void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
         // Modified in DOM Level 2:
diff --git a/WebCore/html/HTMLSourceElement.cpp b/WebCore/html/HTMLSourceElement.cpp
index 2f09997..4b9401d 100644
--- a/WebCore/html/HTMLSourceElement.cpp
+++ b/WebCore/html/HTMLSourceElement.cpp
@@ -28,6 +28,7 @@
 #if ENABLE(VIDEO)
 #include "HTMLSourceElement.h"
 
+#include "Event.h"
 #include "EventNames.h"
 #include "HTMLDocument.h"
 #include "HTMLMediaElement.h"
@@ -105,7 +106,7 @@ void HTMLSourceElement::cancelPendingErrorEvent()
 
 void HTMLSourceElement::errorEventTimerFired(Timer<HTMLSourceElement>*)
 {
-    dispatchEvent(eventNames().errorEvent, false, true);
+    dispatchEvent(Event::create(eventNames().errorEvent, false, true));
 }
 
 }
diff --git a/WebCore/html/HTMLTagNames.in b/WebCore/html/HTMLTagNames.in
index c066e3c..8842b23 100644
--- a/WebCore/html/HTMLTagNames.in
+++ b/WebCore/html/HTMLTagNames.in
@@ -8,115 +8,118 @@ acronym interfaceName=HTMLElement
 address interfaceName=HTMLElement
 applet
 area
-audio wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
+audio wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
 b interfaceName=HTMLElement
-base
-basefont interfaceName=HTMLBaseFontElement
+base createWithNew
+basefont interfaceName=HTMLBaseFontElement, createWithNew
 bdo interfaceName=HTMLElement
 big interfaceName=HTMLElement
-blockquote
-body
-br interfaceName=HTMLBRElement
-button constructorNeedsFormElement
-canvas
-caption interfaceName=HTMLTableCaptionElement
+blockquote createWithNew
+body createWithNew
+br interfaceName=HTMLBRElement, createWithNew
+button constructorNeedsFormElement, createWithNew
+canvas createWithNew
+caption interfaceName=HTMLTableCaptionElement, createWithNew
 center interfaceName=HTMLElement
 cite interfaceName=HTMLElement
 code interfaceName=HTMLElement
-col interfaceName=HTMLTableColElement
-colgroup interfaceName=HTMLTableColElement
-datagrid interfaceName=HTMLDataGridElement,conditional=DATAGRID
-dcell interfaceName=HTMLDataGridCellElement,conditional=DATAGRID
-dcol interfaceName=HTMLDataGridColElement,conditional=DATAGRID
-drow interfaceName=HTMLDataGridRowElement,conditional=DATAGRID
+col interfaceName=HTMLTableColElement, createWithNew
+colgroup interfaceName=HTMLTableColElement, createWithNew
+datagrid interfaceName=HTMLDataGridElement, conditional=DATAGRID, createWithNew
+datalist interfaceName=HTMLDataListElement, conditional=DATALIST, createWithNew
+dcell interfaceName=HTMLDataGridCellElement, conditional=DATAGRID, createWithNew
+dcol interfaceName=HTMLDataGridColElement, conditional=DATAGRID, createWithNew
+drow interfaceName=HTMLDataGridRowElement, conditional=DATAGRID, createWithNew
 dd interfaceName=HTMLElement
-del interfaceName=HTMLModElement
+del interfaceName=HTMLModElement, createWithNew
 dfn interfaceName=HTMLElement
-dir interfaceName=HTMLDirectoryElement
-div
-dl interfaceName=HTMLDListElement
+dir interfaceName=HTMLDirectoryElement, createWithNew
+div createWithNew
+dl interfaceName=HTMLDListElement, createWithNew, createWithNew
 dt interfaceName=HTMLElement
 em interfaceName=HTMLElement
 embed
-fieldset interfaceName=HTMLFieldSetElement, constructorNeedsFormElement
-font
-form
+fieldset interfaceName=HTMLFieldSetElement, constructorNeedsFormElement, createWithNew
+font createWithNew
+form createWithNew
 frame
-frameset interfaceName=HTMLFrameSetElement
-head
-h1 interfaceName=HTMLHeadingElement
-h2 interfaceName=HTMLHeadingElement
-h3 interfaceName=HTMLHeadingElement
-h4 interfaceName=HTMLHeadingElement
-h5 interfaceName=HTMLHeadingElement
-h6 interfaceName=HTMLHeadingElement
-hr interfaceName=HTMLHRElement
-html
+frameset interfaceName=HTMLFrameSetElement, createWithNew
+h1 interfaceName=HTMLHeadingElement, createWithNew
+h2 interfaceName=HTMLHeadingElement, createWithNew
+h3 interfaceName=HTMLHeadingElement, createWithNew
+h4 interfaceName=HTMLHeadingElement, createWithNew
+h5 interfaceName=HTMLHeadingElement, createWithNew
+h6 interfaceName=HTMLHeadingElement, createWithNew
+head createWithNew
+hr interfaceName=HTMLHRElement, createWithNew
+html createWithNew
 i interfaceName=HTMLElement
 iframe interfaceName=HTMLIFrameElement
-image mapToTagName=img
-img interfaceName=HTMLImageElement, constructorNeedsFormElement
-input constructorNeedsFormElement
-ins interfaceName=HTMLModElement
-isindex interfaceName=HTMLIsIndexElement, constructorNeedsFormElement
+image mapToTagName=img, createWithNew
+img interfaceName=HTMLImageElement, constructorNeedsFormElement, createWithNew
+input constructorNeedsFormElement, createWithNew
+ins interfaceName=HTMLModElement, createWithNew
+isindex interfaceName=HTMLIsIndexElement, constructorNeedsFormElement, createWithNew
 kbd interfaceName=HTMLElement
-keygen JSInterfaceName=HTMLSelectElement, constructorNeedsFormElement
-label
+keygen JSInterfaceName=HTMLSelectElement, constructorNeedsFormElement, createWithNew
+label createWithNew
 layer interfaceName=HTMLElement
-legend constructorNeedsFormElement
-li interfaceName=HTMLLIElement
-link constructorNeedsCreatedByParser
-listing interfaceName=HTMLPreElement
-map
-marquee
-menu
-meta
+legend constructorNeedsFormElement, createWithNew
+li interfaceName=HTMLLIElement, createWithNew
+link constructorNeedsCreatedByParser, createWithNew
+listing interfaceName=HTMLPreElement, createWithNew
+map createWithNew
+marquee createWithNew
+menu createWithNew
+meta createWithNew
+nav interfaceName=HTMLElement
 nobr interfaceName=HTMLElement
 noembed interfaceName=HTMLElement
 noframes interfaceName=HTMLElement
 nolayer interfaceName=HTMLElement
-#if ENABLE_XHTMLMP
-noscript interfaceName=HTMLNoScriptElement
-#else
-noscript interfaceName=HTMLElement
-#endif
 object constructorNeedsCreatedByParser
-ol interfaceName=HTMLOListElement
-optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement
-option constructorNeedsFormElement
-p interfaceName=HTMLParagraphElement
-param
+ol interfaceName=HTMLOListElement, createWithNew
+optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement, createWithNew
+option constructorNeedsFormElement, createWithNew
+p interfaceName=HTMLParagraphElement, createWithNew
+param createWithNew
 plaintext interfaceName=HTMLElement
-pre
-q interfaceName=HTMLQuoteElement
+pre createWithNew
+q interfaceName=HTMLQuoteElement, createWithNew
 rp interfaceName=HTMLElement
 rt interfaceName=HTMLElement
 ruby interfaceName=HTMLElement
 s interfaceName=HTMLElement
 samp interfaceName=HTMLElement
-script constructorNeedsCreatedByParser
-select constructorNeedsFormElement
+script constructorNeedsCreatedByParser, createWithNew
+select constructorNeedsFormElement, createWithNew
 small interfaceName=HTMLElement
-source wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
+source wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
 span interfaceName=HTMLElement
 strike interfaceName=HTMLElement
 strong interfaceName=HTMLElement
-style constructorNeedsCreatedByParser
+style constructorNeedsCreatedByParser, createWithNew
 sub interfaceName=HTMLElement
 sup interfaceName=HTMLElement
-table
-tbody interfaceName=HTMLTableSectionElement
-td interfaceName=HTMLTableCellElement
-textarea interfaceName=HTMLTextAreaElement, constructorNeedsFormElement
-tfoot interfaceName=HTMLTableSectionElement
-th interfaceName=HTMLTableCellElement
-thead interfaceName=HTMLTableSectionElement
-title
-tr interfaceName=HTMLTableRowElement
+table createWithNew
+tbody interfaceName=HTMLTableSectionElement, createWithNew
+td interfaceName=HTMLTableCellElement, createWithNew
+textarea interfaceName=HTMLTextAreaElement, constructorNeedsFormElement, createWithNew
+tfoot interfaceName=HTMLTableSectionElement, createWithNew
+th interfaceName=HTMLTableCellElement, createWithNew
+thead interfaceName=HTMLTableSectionElement, createWithNew
+title createWithNew
+tr interfaceName=HTMLTableRowElement, createWithNew
 tt interfaceName=HTMLElement
 u interfaceName=HTMLElement
-ul interfaceName=HTMLUListElement
+ul interfaceName=HTMLUListElement, createWithNew
 var interfaceName=HTMLElement
-video wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
+video wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
 wbr interfaceName=HTMLElement
-xmp interfaceName=HTMLPreElement
+xmp interfaceName=HTMLPreElement, createWithNew
+
+#if ENABLE_XHTMLMP
+noscript interfaceName=HTMLNoScriptElement, createWithNew
+#else
+noscript interfaceName=HTMLElement
+#endif
diff --git a/WebCore/html/HTMLTextAreaElement.cpp b/WebCore/html/HTMLTextAreaElement.cpp
index 884cf3f..8d8208d 100644
--- a/WebCore/html/HTMLTextAreaElement.cpp
+++ b/WebCore/html/HTMLTextAreaElement.cpp
@@ -26,21 +26,25 @@
 #include "config.h"
 #include "HTMLTextAreaElement.h"
 
+#include "BeforeTextInsertedEvent.h"
 #include "ChromeClient.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
+#include "ExceptionCode.h"
 #include "FocusController.h"
 #include "FormDataList.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "InputElement.h"
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderStyle.h"
 #include "RenderTextControlMultiLine.h"
 #include "ScriptEventListener.h"
 #include "Text.h"
+#include "TextIterator.h"
 #include "VisibleSelection.h"
 #include <wtf/StdLibExtras.h>
 
@@ -64,12 +68,13 @@ static inline void notifyFormStateChanged(const HTMLTextAreaElement* element)
 }
 
 HTMLTextAreaElement::HTMLTextAreaElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLFormControlElementWithState(tagName, document, form)
+    : HTMLTextFormControlElement(tagName, document, form)
     , m_rows(defaultRows)
     , m_cols(defaultCols)
     , m_wrap(SoftWrap)
     , m_cachedSelectionStart(-1)
     , m_cachedSelectionEnd(-1)
+    , m_isDirty(false)
 {
     ASSERT(hasTagName(textareaTag));
     setFormControlValueMatchesRenderer(true);
@@ -93,54 +98,6 @@ void HTMLTextAreaElement::restoreFormControlState(const String& state)
     setDefaultValue(state);
 }
 
-int HTMLTextAreaElement::selectionStart()
-{
-    if (!renderer())
-        return 0;
-    if (document()->focusedNode() != this && m_cachedSelectionStart >= 0)
-        return m_cachedSelectionStart;
-    return toRenderTextControl(renderer())->selectionStart();
-}
-
-int HTMLTextAreaElement::selectionEnd()
-{
-    if (!renderer())
-        return 0;
-    if (document()->focusedNode() != this && m_cachedSelectionEnd >= 0)
-        return m_cachedSelectionEnd;
-    return toRenderTextControl(renderer())->selectionEnd();
-}
-
-static RenderTextControl* rendererAfterUpdateLayout(HTMLTextAreaElement* element)
-{
-    element->document()->updateLayoutIgnorePendingStylesheets();
-    return toRenderTextControl(element->renderer());
-}
-
-void HTMLTextAreaElement::setSelectionStart(int start)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionStart(start);
-}
-
-void HTMLTextAreaElement::setSelectionEnd(int end)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionEnd(end);
-}
-
-void HTMLTextAreaElement::select()
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->select();
-}
-
-void HTMLTextAreaElement::setSelectionRange(int start, int end)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionRange(start, end);
-}
-
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     setValue(defaultValue());
@@ -196,21 +153,13 @@ void HTMLTextAreaElement::parseMappedAttribute(MappedAttribute* attr)
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
-    } else if (attr->name() == onfocusAttr)
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onblurAttr)
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onselectAttr)
-        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onchangeAttr)
-        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
-    else
-        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+    } else
+        HTMLTextFormControlElement::parseMappedAttribute(attr);
 }
 
 RenderObject* HTMLTextAreaElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderTextControlMultiLine(this);
+    return new (arena) RenderTextControlMultiLine(this, placeholderShouldBeVisible());
 }
 
 bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
@@ -229,6 +178,7 @@ bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
 void HTMLTextAreaElement::reset()
 {
     setValue(defaultValue());
+    m_isDirty = false;
 }
 
 bool HTMLTextAreaElement::isKeyboardFocusable(KeyboardEvent*) const
@@ -272,10 +222,34 @@ void HTMLTextAreaElement::defaultEventHandler(Event* event)
 {
     if (renderer() && (event->isMouseEvent() || event->isDragEvent() || event->isWheelEvent() || event->type() == eventNames().blurEvent))
         toRenderTextControlMultiLine(renderer())->forwardEvent(event);
+    else if (renderer() && event->isBeforeTextInsertedEvent())
+        handleBeforeTextInsertedEvent(static_cast<BeforeTextInsertedEvent*>(event));
 
     HTMLFormControlElementWithState::defaultEventHandler(event);
 }
 
+void HTMLTextAreaElement::handleBeforeTextInsertedEvent(BeforeTextInsertedEvent* event) const
+{
+    ASSERT(event);
+    ASSERT(renderer());
+    int signedMaxLength = maxLength();
+    if (signedMaxLength < 0)
+        return;
+    unsigned unsignedMaxLength = static_cast<unsigned>(signedMaxLength);
+
+    unsigned currentLength = toRenderTextControl(renderer())->text().numGraphemeClusters();
+    unsigned selectionLength = plainText(document()->frame()->selection()->selection().toNormalizedRange().get()).numGraphemeClusters();
+    ASSERT(currentLength >= selectionLength);
+    unsigned baseLength = currentLength - selectionLength;
+    unsigned appendableLength = unsignedMaxLength > baseLength ? unsignedMaxLength - baseLength : 0;
+    event->setText(sanitizeUserInputValue(event->text(), appendableLength));
+}
+
+String HTMLTextAreaElement::sanitizeUserInputValue(const String& proposedValue, unsigned maxLength)
+{
+    return proposedValue.left(proposedValue.numCharactersInGraphemeClusters(maxLength));
+}
+
 void HTMLTextAreaElement::rendererWillBeDestroyed()
 {
     updateValue();
@@ -290,6 +264,7 @@ void HTMLTextAreaElement::updateValue() const
     m_value = toRenderTextControl(renderer())->text();
     const_cast<HTMLTextAreaElement*>(this)->setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
+    m_isDirty = true;
 }
 
 String HTMLTextAreaElement::value() const
@@ -313,6 +288,7 @@ void HTMLTextAreaElement::setValue(const String& value)
 
     m_value = normalizedValue;
     setFormControlValueMatchesRenderer(true);
+    updatePlaceholderVisibility(false);
     if (inDocument())
         document()->updateStyleIfNeeded();
     if (renderer())
@@ -330,6 +306,7 @@ void HTMLTextAreaElement::setValue(const String& value)
 
     setNeedsStyleRecalc();
     notifyFormStateChanged(this);
+    updateValidity();
 }
 
 String HTMLTextAreaElement::defaultValue() const
@@ -379,6 +356,33 @@ void HTMLTextAreaElement::setDefaultValue(const String& defaultValue)
     setValue(value);
 }
 
+int HTMLTextAreaElement::maxLength() const
+{
+    bool ok;
+    int value = getAttribute(maxlengthAttr).string().toInt(&ok);
+    return ok && value >= 0 ? value : -1;
+}
+
+void HTMLTextAreaElement::setMaxLength(int newValue, ExceptionCode& ec)
+{
+    if (newValue < 0)
+        ec = INDEX_SIZE_ERR;
+    else
+        setAttribute(maxlengthAttr, String::number(newValue));
+}
+
+bool HTMLTextAreaElement::tooLong() const
+{
+    // Return false for the default value even if it is longer than maxLength.
+    if (!m_isDirty)
+        return false;
+
+    int max = maxLength();
+    if (max < 0)
+        return false;
+    return value().length() > static_cast<unsigned>(max);
+}
+
 void HTMLTextAreaElement::accessKeyAction(bool)
 {
     focus();
@@ -404,13 +408,6 @@ void HTMLTextAreaElement::setRows(int rows)
     setAttribute(rowsAttr, String::number(rows));
 }
 
-VisibleSelection HTMLTextAreaElement::selection() const
-{
-    if (!renderer() || m_cachedSelectionStart < 0 || m_cachedSelectionEnd < 0)
-        return VisibleSelection();
-    return toRenderTextControl(renderer())->selection(m_cachedSelectionStart, m_cachedSelectionEnd);
-}
-
 bool HTMLTextAreaElement::shouldUseInputMethod() const
 {
     return true;
diff --git a/WebCore/html/HTMLTextAreaElement.h b/WebCore/html/HTMLTextAreaElement.h
index 5ef8e55..23f61d3 100644
--- a/WebCore/html/HTMLTextAreaElement.h
+++ b/WebCore/html/HTMLTextAreaElement.h
@@ -28,9 +28,10 @@
 
 namespace WebCore {
 
+class BeforeTextInsertedEvent;
 class VisibleSelection;
 
-class HTMLTextAreaElement : public HTMLFormControlElementWithState {
+class HTMLTextAreaElement : public HTMLTextFormControlElement {
 public:
     HTMLTextAreaElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
@@ -54,15 +55,6 @@ public:
 
     virtual bool valueMissing() const { return isRequiredFormControl() && !disabled() && !readOnly() && value().isEmpty(); }
 
-    int selectionStart();
-    int selectionEnd();
-
-    void setSelectionStart(int);
-    void setSelectionEnd(int);
-
-    void select();
-    void setSelectionRange(int, int);
-
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -77,6 +69,10 @@ public:
     void setValue(const String&);
     String defaultValue() const;
     void setDefaultValue(const String&);
+    int textLength() const { return value().length(); }
+    int maxLength() const;
+    void setMaxLength(int, ExceptionCode&);
+    virtual bool tooLong() const;
     
     void rendererWillBeDestroyed();
     
@@ -89,15 +85,21 @@ public:
     void setRows(int);
     
     void cacheSelection(int s, int e) { m_cachedSelectionStart = s; m_cachedSelectionEnd = e; };
-    VisibleSelection selection() const;
 
     virtual bool shouldUseInputMethod() const;
 
 private:
     enum WrapMethod { NoWrap, SoftWrap, HardWrap };
 
+    void handleBeforeTextInsertedEvent(BeforeTextInsertedEvent*) const;
+    static String sanitizeUserInputValue(const String&, unsigned maxLength);
     void updateValue() const;
 
+    virtual bool supportsPlaceholder() const { return true; }
+    virtual bool isEmptyValue() const { return value().isEmpty(); }
+    virtual int cachedSelectionStart() const { return m_cachedSelectionStart; }
+    virtual int cachedSelectionEnd() const { return m_cachedSelectionEnd; }
+
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const { return required(); }
 
@@ -107,6 +109,7 @@ private:
     mutable String m_value;
     int m_cachedSelectionStart;
     int m_cachedSelectionEnd;
+    mutable bool m_isDirty;
 };
 
 } //namespace
diff --git a/WebCore/html/HTMLTextAreaElement.idl b/WebCore/html/HTMLTextAreaElement.idl
index 5d2853e..db5154e 100644
--- a/WebCore/html/HTMLTextAreaElement.idl
+++ b/WebCore/html/HTMLTextAreaElement.idl
@@ -34,16 +34,21 @@ module html {
                  attribute  long                 cols;
                  attribute  boolean              disabled;
                  attribute  boolean              autofocus;
+                 attribute  long                 maxLength
+                     setter raises(DOMException);
                  attribute  [ConvertNullToNullString] DOMString            name;
+                 attribute  [ConvertNullToNullString, Reflect] DOMString   placeholder;
                  attribute  boolean              readOnly;
                  attribute  boolean              required;
                  attribute  long                 rows;
         readonly attribute  DOMString            type;
                  attribute  [ConvertNullToNullString] DOMString            value;
+        readonly attribute  unsigned long        textLength;
         
         void     select();
 
         readonly attribute boolean         willValidate;
+        boolean  checkValidity();
         void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
        // WinIE & FireFox extension:
diff --git a/WebCore/html/HTMLTokenizer.cpp b/WebCore/html/HTMLTokenizer.cpp
index 2850aec..9215dc3 100644
--- a/WebCore/html/HTMLTokenizer.cpp
+++ b/WebCore/html/HTMLTokenizer.cpp
@@ -32,6 +32,7 @@
 #include "CachedScript.h"
 #include "DocLoader.h"
 #include "DocumentFragment.h"
+#include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -41,6 +42,7 @@
 #include "HTMLParser.h"
 #include "HTMLScriptElement.h"
 #include "HTMLViewSourceDocument.h"
+#include "InspectorTimelineAgent.h"
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "PreloadScanner.h"
@@ -442,7 +444,8 @@ HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
 #endif
                 // The parser might have been stopped by for example a window.close call in an earlier script.
                 // If so, we don't want to load scripts.
-                if (!m_parserStopped && (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
+                if (!m_parserStopped && m_scriptNode->dispatchBeforeLoadEvent(m_scriptTagSrcAttrValue) &&
+                    (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
                     m_pendingScripts.append(cs);
                 else
                     m_scriptNode = 0;
@@ -1670,18 +1673,24 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
     if (!m_doc->ownerElement())
         printf("Beginning write at time %d\n", m_doc->elapsedTime());
 #endif
-    
+
     int processedCount = 0;
     double startTime = currentTime();
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::ParsingTimeCounter);
 #endif
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willWriteHTML();
+#endif
+  
     Frame* frame = m_doc->frame();
 
     State state = m_state;
 
-    while (!m_src.isEmpty() && (!frame || !frame->loader()->isScheduledLocationChangePending())) {
+    while (!m_src.isEmpty() && (!frame || !frame->redirectScheduler()->locationChangePending())) {
         if (!continueProcessing(processedCount, startTime, state))
             break;
 
@@ -1797,7 +1806,12 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
     if (!m_doc->ownerElement())
         printf("Ending write at time %d\n", m_doc->elapsedTime());
 #endif
-    
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didWriteHTML();
+#endif
+
     m_inWrite = wasInWrite;
 
     m_state = state;
@@ -2041,7 +2055,7 @@ void HTMLTokenizer::notifyFinished(CachedResource*)
 #endif
 
         if (errorOccurred)
-            n->dispatchEvent(eventNames().errorEvent, true, false);
+            n->dispatchEvent(Event::create(eventNames().errorEvent, true, false));
         else {
             if (static_cast<HTMLScriptElement*>(n.get())->shouldExecuteAsJavaScript())
                 m_state = scriptExecution(sourceCode, m_state);
@@ -2049,7 +2063,7 @@ void HTMLTokenizer::notifyFinished(CachedResource*)
             else
                 m_doc->setShouldProcessNoscriptElement(true);
 #endif
-            n->dispatchEvent(eventNames().loadEvent, false, false);
+            n->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
         }
 
         // The state of m_pendingScripts.isEmpty() can change inside the scriptExecution()
diff --git a/WebCore/html/HTMLVideoElement.cpp b/WebCore/html/HTMLVideoElement.cpp
index ecd74e7..5bbc167 100644
--- a/WebCore/html/HTMLVideoElement.cpp
+++ b/WebCore/html/HTMLVideoElement.cpp
@@ -28,6 +28,7 @@
 #if ENABLE(VIDEO)
 #include "HTMLVideoElement.h"
 
+#include "ChromeClient.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
@@ -112,6 +113,18 @@ void HTMLVideoElement::parseMappedAttribute(MappedAttribute* attr)
         HTMLMediaElement::parseMappedAttribute(attr);
 }
 
+bool HTMLVideoElement::supportsFullscreen() const
+{
+    Page* page = document() ? document()->page() : 0;
+    if (!page) 
+        return false;
+
+    if (!m_player || !m_player->supportsFullscreen())
+        return false;
+    
+    return page->chrome()->client()->supportsFullscreenForNode(this);
+}
+
 unsigned HTMLVideoElement::videoWidth() const
 {
     if (!m_player)
diff --git a/WebCore/html/HTMLVideoElement.h b/WebCore/html/HTMLVideoElement.h
index dc9714a..096eb53 100644
--- a/WebCore/html/HTMLVideoElement.h
+++ b/WebCore/html/HTMLVideoElement.h
@@ -49,7 +49,7 @@ public:
     virtual void parseMappedAttribute(MappedAttribute* attr);
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
-    virtual bool supportsFullscreen() const { return player() && player()->supportsFullscreen(); }
+    virtual bool supportsFullscreen() const;
     virtual bool isURLAttribute(Attribute*) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
 
diff --git a/WebCore/html/HTMLViewSourceDocument.cpp b/WebCore/html/HTMLViewSourceDocument.cpp
index 13404cc..ba718d1 100644
--- a/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/WebCore/html/HTMLViewSourceDocument.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,9 +47,6 @@ using namespace HTMLNames;
 HTMLViewSourceDocument::HTMLViewSourceDocument(Frame* frame, const String& mimeType)
     : HTMLDocument(frame)
     , m_type(mimeType)
-    , m_current(0)
-    , m_tbody(0)
-    , m_td(0)
 {
     setUsesBeforeAfterRules(true);
 }
@@ -70,23 +67,23 @@ Tokenizer* HTMLViewSourceDocument::createTokenizer()
 
 void HTMLViewSourceDocument::createContainingTable()
 {
-    RefPtr<Element> html = new HTMLHtmlElement(htmlTag, this);
+    RefPtr<HTMLHtmlElement> html = new HTMLHtmlElement(htmlTag, this);
     addChild(html);
     html->attach();
-    RefPtr<Element> body = new HTMLBodyElement(bodyTag, this);
+    RefPtr<HTMLBodyElement> body = new HTMLBodyElement(bodyTag, this);
     html->addChild(body);
     body->attach();
     
     // Create a line gutter div that can be used to make sure the gutter extends down the height of the whole
     // document.
-    RefPtr<Element> div = new HTMLDivElement(divTag, this);
+    RefPtr<HTMLDivElement> div = new HTMLDivElement(divTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-gutter-backdrop"));
     div->setAttributeMap(attrs.release());
     body->addChild(div);
     div->attach();
 
-    RefPtr<Element> table = new HTMLTableElement(tableTag, this);
+    RefPtr<HTMLTableElement> table = new HTMLTableElement(tableTag, this);
     body->addChild(table);
     table->attach();
     m_tbody = new HTMLTableSectionElement(tbodyTag, this);
@@ -205,31 +202,31 @@ void HTMLViewSourceDocument::addViewSourceDoctypeToken(DoctypeToken* doctypeToke
     addText(text, "webkit-html-doctype");
 }
 
-Element* HTMLViewSourceDocument::addSpanWithClassName(const String& className)
+PassRefPtr<Element> HTMLViewSourceDocument::addSpanWithClassName(const String& className)
 {
     if (m_current == m_tbody) {
         addLine(className);
         return m_current;
     }
 
-    Element* span = new HTMLElement(spanTag, this);
+    RefPtr<HTMLElement> span = HTMLElement::create(spanTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, className));
     span->setAttributeMap(attrs.release());
     m_current->addChild(span);
     span->attach();
-    return span;
+    return span.release();
 }
 
 void HTMLViewSourceDocument::addLine(const String& className)
 {
     // Create a table row.
-    RefPtr<Element> trow = new HTMLTableRowElement(trTag, this);
+    RefPtr<HTMLTableRowElement> trow = new HTMLTableRowElement(trTag, this);
     m_tbody->addChild(trow);
     trow->attach();
     
     // Create a cell that will hold the line number (it is generated in the stylesheet using counters).
-    Element* td = new HTMLTableCellElement(tdTag, this);
+    RefPtr<HTMLTableCellElement> td = new HTMLTableCellElement(tdTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-number"));
     td->setAttributeMap(attrs.release());
@@ -246,7 +243,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
     m_current = m_td = td;
 
 #ifdef DEBUG_LINE_NUMBERS
-    RefPtr<Text> lineNumberText = new Text(this, String::number(tokenizer()->lineNumber() + 1) + " ");
+    RefPtr<Text> lineNumberText = Text::create(this, String::number(tokenizer()->lineNumber() + 1) + " ");
     td->addChild(lineNumberText);
     lineNumberText->attach();
 #endif
@@ -277,7 +274,7 @@ void HTMLViewSourceDocument::addText(const String& text, const String& className
         }
         if (m_current == m_tbody)
             addLine(className);
-        RefPtr<Text> t = new Text(this, substring);
+        RefPtr<Text> t = Text::create(this, substring);
         m_current->addChild(t);
         t->attach();
         if (i < size - 1)
@@ -289,13 +286,13 @@ void HTMLViewSourceDocument::addText(const String& text, const String& className
         m_current = m_tbody;
 }
 
-Element* HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
+PassRefPtr<Element> HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
 {
     if (m_current == m_tbody)
         addLine("webkit-html-tag");
     
     // Now create a link for the attribute value instead of a span.
-    Element* anchor = new HTMLAnchorElement(aTag, this);
+    RefPtr<HTMLAnchorElement> anchor = HTMLAnchorElement::create(this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     const char* classValue;
     if (isAnchor)
@@ -308,7 +305,7 @@ Element* HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
     anchor->setAttributeMap(attrs.release());
     m_current->addChild(anchor);
     anchor->attach();
-    return anchor;
+    return anchor.release();
 }
 
 }
diff --git a/WebCore/html/HTMLViewSourceDocument.h b/WebCore/html/HTMLViewSourceDocument.h
index 57a8f21..e4eadb0 100644
--- a/WebCore/html/HTMLViewSourceDocument.h
+++ b/WebCore/html/HTMLViewSourceDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,18 +30,18 @@
 namespace WebCore {
 
 class DoctypeToken;
+class HTMLTableCellElement;
+class HTMLTableSectionElement;
+
 struct Token;
 
 class HTMLViewSourceDocument : public HTMLDocument {
 public:
     static PassRefPtr<HTMLViewSourceDocument> create(Frame* frame, const String& mimeType)
     {
-        return new HTMLViewSourceDocument(frame, mimeType);
+        return adoptRef(new HTMLViewSourceDocument(frame, mimeType));
     }
 
-    // Returns HTMLTokenizer or TextTokenizer based on m_type.
-    virtual Tokenizer* createTokenizer();
-
     void addViewSourceToken(Token*); // Used by the HTML tokenizer.
     void addViewSourceText(const String&); // Used by the plaintext tokenizer.
     void addViewSourceDoctypeToken(DoctypeToken*);
@@ -49,16 +49,19 @@ public:
 private:
     HTMLViewSourceDocument(Frame*, const String& mimeType);
 
+    // Returns HTMLTokenizer or TextTokenizer based on m_type.
+    virtual Tokenizer* createTokenizer();
+
     void createContainingTable();
-    Element* addSpanWithClassName(const String&);
+    PassRefPtr<Element> addSpanWithClassName(const String&);
     void addLine(const String& className);
     void addText(const String& text, const String& className);
-    Element* addLink(const String& url, bool isAnchor);
+    PassRefPtr<Element> addLink(const String& url, bool isAnchor);
 
     String m_type;
-    Element* m_current;
-    Element* m_tbody;
-    Element* m_td;
+    RefPtr<Element> m_current;
+    RefPtr<HTMLTableSectionElement> m_tbody;
+    RefPtr<HTMLTableCellElement> m_td;
 };
 
 }
diff --git a/WebCore/html/ValidityState.cpp b/WebCore/html/ValidityState.cpp
index 86227d4..5bf8382 100644
--- a/WebCore/html/ValidityState.cpp
+++ b/WebCore/html/ValidityState.cpp
@@ -23,14 +23,57 @@
 #include "config.h"
 #include "ValidityState.h"
 
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "KURL.h"
+
 namespace WebCore {
 
+using namespace HTMLNames;
+
 ValidityState::ValidityState(HTMLFormControlElement* parent)
     : m_control(parent)
 {
     ASSERT(parent);
 }
 
+bool ValidityState::typeMismatch()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(control());
+    String value = input->value();
+
+    if (value.isEmpty())
+        return false;
+
+    switch (input->inputType()) {
+    case HTMLInputElement::COLOR:
+        return !isValidColorString(value);
+    case HTMLInputElement::NUMBER:
+        return !HTMLInputElement::formStringToDouble(value, 0);
+    case HTMLInputElement::URL:
+        return !KURL(KURL(), value).isValid();
+    default:
+        return false;
+    }
+}
+
+bool ValidityState::rangeUnderflow()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->rangeUnderflow();
+}
+
+bool ValidityState::rangeOverflow()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->rangeOverflow();
+}
+
 bool ValidityState::valid()
 {
     bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow() ||
@@ -39,4 +82,17 @@ bool ValidityState::valid()
     return !someError;
 }
 
+bool ValidityState::isValidColorString(const String& value)
+{
+    if (value.isEmpty())
+        return false;
+    if (value[0] == '#') {
+        // We don't accept #rgb and #aarrggbb formats.
+        if (value.length() != 7)
+            return false;
+    }
+    Color color(value);  // This accepts named colors such as "white".
+    return color.isValid() && !color.hasAlpha();
+}
+
 } // namespace
diff --git a/WebCore/html/ValidityState.h b/WebCore/html/ValidityState.h
index 794822a..67afa53 100644
--- a/WebCore/html/ValidityState.h
+++ b/WebCore/html/ValidityState.h
@@ -41,11 +41,11 @@ namespace WebCore {
         void setCustomErrorMessage(const String& message) { m_customErrorMessage = message; }
 
         bool valueMissing() { return control()->valueMissing(); }
-        bool typeMismatch() { return false; }
+        bool typeMismatch();
         bool patternMismatch() { return control()->patternMismatch(); }
-        bool tooLong() { return false; }
-        bool rangeUnderflow() { return false; }
-        bool rangeOverflow() { return false; }
+        bool tooLong() { return control()->tooLong(); }
+        bool rangeUnderflow();
+        bool rangeOverflow();
         bool stepMismatch() { return false; }
         bool customError() { return !m_customErrorMessage.isEmpty(); }
         bool valid();
@@ -54,6 +54,8 @@ namespace WebCore {
         ValidityState(HTMLFormControlElement*);
         HTMLFormControlElement* m_control;
         String m_customErrorMessage;
+
+        static bool isValidColorString(const String&);
     };
 
 } // namespace WebCore
diff --git a/WebCore/html/canvas/CanvasArray.cpp b/WebCore/html/canvas/CanvasArray.cpp
new file mode 100644
index 0000000..6b5688a
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArray.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArray.h"
+#include "CanvasArrayBuffer.h"
+
+namespace WebCore {
+    CanvasArray::CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                             unsigned offset)
+        : m_offset(offset)
+        , m_buffer(buffer)
+    {
+        m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_offset) : 0;
+    }
+
+    CanvasArray::~CanvasArray()
+    {
+    }
+
+    unsigned CanvasArray::alignedSizeInBytes() const {
+        // Assume we only need to round up to 4-byte boundaries for alignment.
+        return ((sizeInBytes() + 3) / 4) * 4;
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasArray.h b/WebCore/html/canvas/CanvasArray.h
new file mode 100644
index 0000000..e34ad8c
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArray.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasArray_h
+#define CanvasArray_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include "CanvasArrayBuffer.h"
+
+namespace WebCore {
+    class CanvasArray : public RefCounted<CanvasArray> {
+    public:
+        PassRefPtr<CanvasArrayBuffer> buffer() {
+            return m_buffer;
+        }
+
+        void* baseAddress() {
+            return m_baseAddress;
+        }
+
+        unsigned offset() const {
+            return m_offset;
+        }
+
+        virtual unsigned length() const = 0;
+        virtual unsigned sizeInBytes() const = 0;
+        virtual unsigned alignedSizeInBytes() const;
+        virtual ~CanvasArray();
+
+    protected:
+        CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer, unsigned offset);
+
+        // This is the address of the CanvasArrayBuffer's storage, plus the offset.
+        void* m_baseAddress;
+        unsigned m_offset;
+        
+    private:
+        RefPtr<CanvasArrayBuffer> m_buffer;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasArray_h
diff --git a/WebCore/html/canvas/CanvasArray.idl b/WebCore/html/canvas/CanvasArray.idl
new file mode 100644
index 0000000..01bb37e
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArray.idl
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasArray {
+        readonly attribute long length;
+        int sizeInBytes();
+        int alignedSizeInBytes();
+    };
+}
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.cpp b/WebCore/html/canvas/CanvasArrayBuffer.cpp
new file mode 100644
index 0000000..c8a1397
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArrayBuffer.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasArrayBuffer> CanvasArrayBuffer::create(unsigned sizeInBytes)
+    {
+        return adoptRef(new CanvasArrayBuffer(sizeInBytes));
+    }
+    
+    CanvasArrayBuffer::CanvasArrayBuffer(unsigned sizeInBytes) {
+        m_sizeInBytes = sizeInBytes;
+        m_data = WTF::fastZeroedMalloc(sizeInBytes);
+    }
+    
+    void* CanvasArrayBuffer::data() {
+        return m_data;
+    }
+
+    unsigned CanvasArrayBuffer::byteLength() const {
+        return m_sizeInBytes;
+    }
+
+    CanvasArrayBuffer::~CanvasArrayBuffer() {
+        WTF::fastFree(m_data);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.h b/WebCore/html/canvas/CanvasArrayBuffer.h
new file mode 100644
index 0000000..e3ff2b0
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArrayBuffer.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasArrayBuffer_h
+#define CanvasArrayBuffer_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasArrayBuffer : public RefCounted<CanvasArrayBuffer> {
+    public:
+        static PassRefPtr<CanvasArrayBuffer> create(unsigned sizeInBytes);
+
+        void* data();
+        unsigned byteLength() const;
+
+        ~CanvasArrayBuffer();
+
+    private:
+        CanvasArrayBuffer(unsigned sizeInBytes);
+        unsigned m_sizeInBytes;
+        void* m_data;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasArrayBuffer_h
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.idl b/WebCore/html/canvas/CanvasArrayBuffer.idl
new file mode 100644
index 0000000..5dc0f7f
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArrayBuffer.idl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasArrayBuffer {
+        readonly attribute int byteLength;
+    };
+}
diff --git a/WebCore/html/canvas/CanvasBuffer.cpp b/WebCore/html/canvas/CanvasBuffer.cpp
new file mode 100644
index 0000000..009f8ad
--- /dev/null
+++ b/WebCore/html/canvas/CanvasBuffer.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasBuffer.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasBuffer> CanvasBuffer::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasBuffer(ctx));
+}
+
+CanvasBuffer::CanvasBuffer(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createBuffer());
+}
+
+void CanvasBuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteBuffer(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasBuffer.h b/WebCore/html/canvas/CanvasBuffer.h
new file mode 100644
index 0000000..8fdab82
--- /dev/null
+++ b/WebCore/html/canvas/CanvasBuffer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasBuffer_h
+#define CanvasBuffer_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasBuffer : public CanvasObject {
+    public:
+        virtual ~CanvasBuffer() { deleteObject(); }
+        
+        static PassRefPtr<CanvasBuffer> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasBuffer(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject o);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasBuffer_h
diff --git a/WebCore/svg/SVGDefinitionSrcElement.idl b/WebCore/html/canvas/CanvasBuffer.idl
index f221895..9bca42b 100644
--- a/WebCore/svg/SVGDefinitionSrcElement.idl
+++ b/WebCore/html/canvas/CanvasBuffer.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,9 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-module svg {
-
-    interface [Conditional=SVG&SVG_FONTS] SVGDefinitionSrcElement : SVGElement {
+module html {
+    interface [Conditional=3D_CANVAS] CanvasBuffer {
     };
-
 }
diff --git a/WebCore/html/canvas/CanvasByteArray.cpp b/WebCore/html/canvas/CanvasByteArray.cpp
new file mode 100644
index 0000000..0f72ccf
--- /dev/null
+++ b/WebCore/html/canvas/CanvasByteArray.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasByteArray.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasByteArray> CanvasByteArray::create(unsigned length)
+{
+    RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(signed char));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<CanvasByteArray> CanvasByteArray::create(signed char* array, unsigned length)
+{
+    RefPtr<CanvasByteArray> a = CanvasByteArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<CanvasByteArray> CanvasByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+{
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given CanvasArrayBuffer's storage.
+        if ((offset + (length * sizeof(signed char))) > buffer->byteLength())
+            return NULL;
+    }
+    
+    return adoptRef(new CanvasByteArray(buffer, offset, length));
+}
+
+CanvasByteArray::CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+    : CanvasArray(buffer, offset)
+    , m_size(length)
+{
+}
+
+unsigned CanvasByteArray::length() const {
+    return m_size;
+}
+    
+unsigned CanvasByteArray::sizeInBytes() const {
+    return length() * sizeof(signed char);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasByteArray.h b/WebCore/html/canvas/CanvasByteArray.h
new file mode 100644
index 0000000..329f396
--- /dev/null
+++ b/WebCore/html/canvas/CanvasByteArray.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasByteArray_h
+#define CanvasByteArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasArrayBuffer;
+
+    class CanvasByteArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasByteArray> create(unsigned length);
+        static PassRefPtr<CanvasByteArray> create(signed char* array, unsigned length);
+        static PassRefPtr<CanvasByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        char* data() { return static_cast<char*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<signed char>::min())
+                value = std::numeric_limits<signed char>::min();
+            else if (value > std::numeric_limits<signed char>::max())
+                value = std::numeric_limits<signed char>::max();
+            signed char* storage = static_cast<signed char*>(m_baseAddress);
+            storage[index] = static_cast<signed char>(value);
+        }
+        
+        bool get(unsigned index, signed char& result) const
+        {
+            if (index >= m_size)
+                return false;
+            signed char* storage = static_cast<signed char*>(m_baseAddress);
+            result = storage[index];
+            return true;
+        }
+
+        signed char item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            signed char* storage = static_cast<signed char*>(m_baseAddress);
+            return storage[index];
+        }
+    private:
+        CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                        int offset,
+                        unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasByteArray_h
diff --git a/WebCore/html/canvas/CanvasByteArray.idl b/WebCore/html/canvas/CanvasByteArray.idl
new file mode 100644
index 0000000..ccf49ad
--- /dev/null
+++ b/WebCore/html/canvas/CanvasByteArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasByteArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasFloatArray.cpp b/WebCore/html/canvas/CanvasFloatArray.cpp
new file mode 100644
index 0000000..09561cb
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFloatArray.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasFloatArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(float));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(float* array, unsigned length)
+    {
+        RefPtr<CanvasFloatArray> a = CanvasFloatArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(float)) != 0)
+            return NULL;
+
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(float))) > buffer->byteLength())
+                return NULL;
+        }
+        return adoptRef(new CanvasFloatArray(buffer, offset, length));
+    }
+    
+    CanvasFloatArray::CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasFloatArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasFloatArray::sizeInBytes() const {
+        return length() * sizeof(float);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasFloatArray.h b/WebCore/html/canvas/CanvasFloatArray.h
new file mode 100644
index 0000000..49bd897
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFloatArray.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasFloatArray_h
+#define CanvasFloatArray_h
+
+#include "CanvasArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasFloatArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasFloatArray> create(unsigned length);
+        static PassRefPtr<CanvasFloatArray> create(float* array, unsigned length);
+        static PassRefPtr<CanvasFloatArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        float* data() { return static_cast<float*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            float* storage = static_cast<float*>(m_baseAddress);
+            storage[index] = static_cast<float>(value);
+        }
+        
+        bool get(unsigned index, float& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        float item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            float* storage = static_cast<float*>(m_baseAddress);
+            float result = storage[index];
+            if (isnan(result)) {
+                // Clamp NaN to 0
+                result = 0;
+            }
+            return result;
+        }
+    private:
+        CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasFloatArray_h
diff --git a/WebCore/html/canvas/CanvasFloatArray.idl b/WebCore/html/canvas/CanvasFloatArray.idl
new file mode 100644
index 0000000..bb236b9
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFloatArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasFloatArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasFramebuffer.cpp b/WebCore/html/canvas/CanvasFramebuffer.cpp
new file mode 100644
index 0000000..9700354
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFramebuffer.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasFramebuffer.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasFramebuffer> CanvasFramebuffer::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasFramebuffer(ctx));
+}
+
+CanvasFramebuffer::CanvasFramebuffer(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createFramebuffer());
+}
+
+void CanvasFramebuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteFramebuffer(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasFramebuffer.h b/WebCore/html/canvas/CanvasFramebuffer.h
new file mode 100644
index 0000000..ec3cb97
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFramebuffer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasFramebuffer_h
+#define CanvasFramebuffer_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasFramebuffer : public CanvasObject {
+    public:
+        virtual ~CanvasFramebuffer() { deleteObject(); }
+        
+        static PassRefPtr<CanvasFramebuffer> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasFramebuffer(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasFramebuffer_h
diff --git a/WebCore/html/canvas/CanvasFramebuffer.idl b/WebCore/html/canvas/CanvasFramebuffer.idl
new file mode 100644
index 0000000..0a9b668
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFramebuffer.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasFramebuffer {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasIntArray.cpp b/WebCore/html/canvas/CanvasIntArray.cpp
new file mode 100644
index 0000000..4716d7b
--- /dev/null
+++ b/WebCore/html/canvas/CanvasIntArray.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasIntArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasIntArray> CanvasIntArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(int));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasIntArray> CanvasIntArray::create(int* array, unsigned length)
+    {
+        RefPtr<CanvasIntArray> a = CanvasIntArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasIntArray> CanvasIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                      int offset,
+                                                      unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(int)) != 0)
+            return NULL;
+
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(int))) > buffer->byteLength())
+                return NULL;
+        }
+        
+        return adoptRef(new CanvasIntArray(buffer, offset, length));
+    }
+    
+    CanvasIntArray::CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasIntArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasIntArray::sizeInBytes() const {
+        return length() * sizeof(int);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasIntArray.h b/WebCore/html/canvas/CanvasIntArray.h
new file mode 100644
index 0000000..8846be7
--- /dev/null
+++ b/WebCore/html/canvas/CanvasIntArray.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasIntArray_h
+#define CanvasIntArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasIntArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasIntArray> create(unsigned length);
+        static PassRefPtr<CanvasIntArray> create(int* array, unsigned length);
+        static PassRefPtr<CanvasIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        int* data() { return static_cast<int*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<int>::min())
+                value = std::numeric_limits<int>::min();
+            else if (value > std::numeric_limits<int>::max())
+                value = std::numeric_limits<int>::max();
+            int* storage = static_cast<int*>(m_baseAddress);
+            storage[index] = static_cast<int>(value);
+        }
+        
+        bool get(unsigned index, int& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        int item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            int* storage = static_cast<int*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                       int offset,
+                       unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasIntArray_h
diff --git a/WebCore/html/canvas/CanvasIntArray.idl b/WebCore/html/canvas/CanvasIntArray.idl
new file mode 100644
index 0000000..2c81b87
--- /dev/null
+++ b/WebCore/html/canvas/CanvasIntArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasIntArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasNumberArray.cpp b/WebCore/html/canvas/CanvasNumberArray.cpp
new file mode 100644
index 0000000..6cbdfff
--- /dev/null
+++ b/WebCore/html/canvas/CanvasNumberArray.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasNumberArray.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasNumberArray> CanvasNumberArray::create(unsigned length)
+{
+    return adoptRef(new CanvasNumberArray(length));
+}
+
+CanvasNumberArray::CanvasNumberArray(unsigned length)
+    : m_data(length)
+{
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasNumberArray.h b/WebCore/html/canvas/CanvasNumberArray.h
new file mode 100644
index 0000000..eb79866
--- /dev/null
+++ b/WebCore/html/canvas/CanvasNumberArray.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasNumberArray_h
+#define CanvasNumberArray_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+#include <limits>
+
+namespace WebCore {
+
+    class String;
+    
+    class CanvasNumberArray : public RefCounted<CanvasNumberArray> {
+    public:
+        static PassRefPtr<CanvasNumberArray> create(unsigned length);
+        
+        Vector<float>& data() { return m_data; }
+        const Vector<float>& data() const { return m_data; }
+
+        unsigned length() const { return m_data.size(); }
+        float item(unsigned index) const { return (index >= m_data.size()) ? 0 : m_data[index]; }
+
+    private:
+        CanvasNumberArray(unsigned length);
+        Vector<float> m_data;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasNumberArray_h
diff --git a/WebCore/html/canvas/CanvasNumberArray.idl b/WebCore/html/canvas/CanvasNumberArray.idl
new file mode 100644
index 0000000..56e807e
--- /dev/null
+++ b/WebCore/html/canvas/CanvasNumberArray.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        GenerateConstructor,
+        HasCustomIndexGetter
+    ] CanvasNumberArray {
+        readonly attribute unsigned long length;
+    };
+}
diff --git a/WebCore/html/canvas/CanvasObject.cpp b/WebCore/html/canvas/CanvasObject.cpp
new file mode 100644
index 0000000..8a71a45
--- /dev/null
+++ b/WebCore/html/canvas/CanvasObject.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasObject.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+CanvasObject::CanvasObject(CanvasRenderingContext3D* context)
+    : m_object(0)
+    , m_context(context)
+{
+}
+
+CanvasObject::~CanvasObject()
+{
+    if (m_context)
+        m_context->removeObject(this);
+}
+
+void CanvasObject::setObject(Platform3DObject object)
+{
+    if (object == m_object)
+        return;
+        
+    deleteObject();
+    m_object = object;
+}
+
+void CanvasObject::deleteObject()
+{
+    if (m_object) {
+        if (m_context) {
+            m_context->graphicsContext3D()->makeContextCurrent();
+            _deleteObject(m_object);
+        }
+        m_object = 0;
+    }
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasObject.h b/WebCore/html/canvas/CanvasObject.h
new file mode 100644
index 0000000..413da71
--- /dev/null
+++ b/WebCore/html/canvas/CanvasObject.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasObject_h
+#define CanvasObject_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+#include "GraphicsContext3D.h"
+
+namespace WebCore {
+
+    class CanvasRenderingContext3D;
+    
+    class CanvasObject : public RefCounted<CanvasObject> {
+    public:
+        virtual ~CanvasObject();
+        
+        Platform3DObject object() const { return m_object; }
+        void setObject(Platform3DObject);
+        void deleteObject();
+        
+        void detachContext()
+        {
+            deleteObject();
+            m_context = 0;
+        }
+        
+    protected:
+        CanvasObject(CanvasRenderingContext3D*);
+        virtual void _deleteObject(Platform3DObject) = 0;
+        
+        CanvasRenderingContext3D* context() const { return m_context; }
+    
+    private:
+        Platform3DObject m_object;
+        CanvasRenderingContext3D* m_context;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasObject_h
diff --git a/WebCore/html/canvas/CanvasPixelArray.h b/WebCore/html/canvas/CanvasPixelArray.h
index b91a642..8ac5163 100644
--- a/WebCore/html/canvas/CanvasPixelArray.h
+++ b/WebCore/html/canvas/CanvasPixelArray.h
@@ -48,12 +48,22 @@ namespace WebCore {
         {
             m_data->set(index, value);
         }
+
+        void set(unsigned index, unsigned char value)
+        {
+            m_data->set(index, value);
+        }
         
         bool get(unsigned index, unsigned char& result) const
         {
             return m_data->get(index, result);
         }
 
+        unsigned char get(unsigned index) const
+        {
+            return m_data->get(index);
+        }
+
     private:
         CanvasPixelArray(unsigned length);
         RefPtr<WTF::ByteArray> m_data;
diff --git a/WebCore/html/canvas/CanvasPixelArray.idl b/WebCore/html/canvas/CanvasPixelArray.idl
index c815788..2295af6 100644
--- a/WebCore/html/canvas/CanvasPixelArray.idl
+++ b/WebCore/html/canvas/CanvasPixelArray.idl
@@ -30,7 +30,7 @@ module html {
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT || defined(V8_BINDING) && V8_BINDING
     interface [
         CustomHeader,
-        HasCustomIndexGetter,
+        HasNumericIndexGetter,
         HasCustomIndexSetter
     ] CanvasPixelArray {
         readonly attribute long length;
diff --git a/WebCore/html/canvas/CanvasProgram.cpp b/WebCore/html/canvas/CanvasProgram.cpp
new file mode 100644
index 0000000..83da270
--- /dev/null
+++ b/WebCore/html/canvas/CanvasProgram.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasProgram.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasProgram> CanvasProgram::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasProgram(ctx));
+}
+
+CanvasProgram::CanvasProgram(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createProgram());
+}
+
+void CanvasProgram::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteProgram(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasProgram.h b/WebCore/html/canvas/CanvasProgram.h
new file mode 100644
index 0000000..af817c8
--- /dev/null
+++ b/WebCore/html/canvas/CanvasProgram.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasProgram_h
+#define CanvasProgram_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasProgram : public CanvasObject {
+    public:
+        virtual ~CanvasProgram() { deleteObject(); }
+        
+        static PassRefPtr<CanvasProgram> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasProgram(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasProgram_h
diff --git a/WebCore/html/canvas/CanvasProgram.idl b/WebCore/html/canvas/CanvasProgram.idl
new file mode 100644
index 0000000..46daaf2
--- /dev/null
+++ b/WebCore/html/canvas/CanvasProgram.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasProgram {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.cpp b/WebCore/html/canvas/CanvasRenderbuffer.cpp
new file mode 100644
index 0000000..51054cd
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderbuffer.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasRenderbuffer.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasRenderbuffer> CanvasRenderbuffer::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasRenderbuffer(ctx));
+}
+
+CanvasRenderbuffer::CanvasRenderbuffer(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createRenderbuffer());
+}
+
+void CanvasRenderbuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteRenderbuffer(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.h b/WebCore/html/canvas/CanvasRenderbuffer.h
new file mode 100644
index 0000000..3fb99e9
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderbuffer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasRenderbuffer_h
+#define CanvasRenderbuffer_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasRenderbuffer : public CanvasObject {
+    public:
+        virtual ~CanvasRenderbuffer() { deleteObject(); }
+        
+        static PassRefPtr<CanvasRenderbuffer> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasRenderbuffer(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasRenderbuffer_h
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.idl b/WebCore/html/canvas/CanvasRenderbuffer.idl
new file mode 100644
index 0000000..5e47cc3
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderbuffer.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasRenderbuffer {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasRenderingContext.cpp b/WebCore/html/canvas/CanvasRenderingContext.cpp
new file mode 100644
index 0000000..fed8cb2
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CanvasRenderingContext.h"
+
+#include "HTMLCanvasElement.h"
+
+namespace WebCore {
+
+CanvasRenderingContext::CanvasRenderingContext(HTMLCanvasElement* canvas)
+    : m_canvas(canvas)
+{
+}
+
+void CanvasRenderingContext::ref()
+{
+    m_canvas->ref();
+}
+
+void CanvasRenderingContext::deref()
+{
+    m_canvas->deref(); 
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/canvas/CanvasRenderingContext.h b/WebCore/html/canvas/CanvasRenderingContext.h
new file mode 100644
index 0000000..9ac9e57
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasRenderingContext_h
+#define CanvasRenderingContext_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+    class CanvasObject;
+    class HTMLCanvasElement;
+
+    class CanvasRenderingContext : public Noncopyable {
+    public:
+        CanvasRenderingContext(HTMLCanvasElement*);
+        virtual ~CanvasRenderingContext() { }
+        
+        void ref();
+        void deref();
+        
+        HTMLCanvasElement* canvas() const { return m_canvas; }
+        
+        virtual bool is2d() const { return false; }
+        virtual bool is3d() const { return false; }
+
+    protected:
+        HTMLCanvasElement* m_canvas;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/html/canvas/CanvasRenderingContext.idl b/WebCore/html/canvas/CanvasRenderingContext.idl
new file mode 100644
index 0000000..8701c80
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor,
+        CustomToJS,
+        InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
+        ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
+    ] CanvasRenderingContext {
+
+        readonly attribute HTMLCanvasElement canvas;
+    };
+
+}
+
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 20718e9..ed462fc 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -94,7 +94,7 @@ private:
 
 
 CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas)
-    : m_canvas(canvas)
+    : CanvasRenderingContext(canvas)
     , m_stateStack(1)
 {
     // Make sure that even if the drawingContext() has a different default
@@ -102,14 +102,8 @@ CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas)
     setLineWidth(lineWidth());
 }
 
-void CanvasRenderingContext2D::ref()
+CanvasRenderingContext2D::~CanvasRenderingContext2D()
 {
-    m_canvas->ref();
-}
-
-void CanvasRenderingContext2D::deref()
-{
-    m_canvas->deref(); 
 }
 
 void CanvasRenderingContext2D::reset()
@@ -941,16 +935,13 @@ static inline FloatRect normalizeRect(const FloatRect& rect)
 
 void CanvasRenderingContext2D::checkOrigin(const KURL& url)
 {
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
-    if (!m_canvas->document()->securityOrigin()->canAccess(origin.get()))
+    if (m_canvas->document()->securityOrigin()->taintsCanvas(url))
         m_canvas->setOriginTainted();
 }
 
 void CanvasRenderingContext2D::checkOrigin(const String& url)
 {
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(url);
-    if (!m_canvas->document()->securityOrigin()->canAccess(origin.get()))
-        m_canvas->setOriginTainted();
+    checkOrigin(KURL(KURL(), url));
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, float x, float y)
@@ -1214,8 +1205,7 @@ PassRefPtr<CanvasPattern> CanvasRenderingContext2D::createPattern(HTMLImageEleme
     if (!cachedImage || !image->cachedImage()->image())
         return CanvasPattern::create(Image::nullImage(), repeatX, repeatY, true);
 
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(cachedImage->url());
-    bool originClean = m_canvas->document()->securityOrigin()->canAccess(origin.get());
+    bool originClean = !m_canvas->document()->securityOrigin()->taintsCanvas(KURL(KURL(), cachedImage->url()));
     return CanvasPattern::create(cachedImage->image(), repeatX, repeatY, originClean);
 }
 
@@ -1278,8 +1268,13 @@ static PassRefPtr<ImageData> createEmptyImageData(const IntSize& size)
     return data.get();
 }
 
-PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh) const
+PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh, ExceptionCode& ec) const
 {
+    ec = 0;
+    if (!isfinite(sw) || !isfinite(sh)) {
+        ec = NOT_SUPPORTED_ERR;
+        return 0;
+    }
     FloatSize unscaledSize(sw, sh);
     IntSize scaledSize = m_canvas->convertLogicalToDevice(unscaledSize);
     if (scaledSize.width() < 1)
@@ -1306,7 +1301,7 @@ PassRefPtr<ImageData> CanvasRenderingContext2D::getImageData(float sx, float sy,
     ImageBuffer* buffer = m_canvas ? m_canvas->buffer() : 0;
     if (!buffer)
         return createEmptyImageData(scaledRect.size());
-    return buffer->getImageData(scaledRect);
+    return buffer->getUnmultipliedImageData(scaledRect);
 }
 
 void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy, ExceptionCode& ec)
@@ -1357,7 +1352,7 @@ void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy,
     sourceRect.move(-destOffset);
     IntPoint destPoint(destOffset.width(), destOffset.height());
     
-    buffer->putImageData(data, sourceRect, destPoint);
+    buffer->putUnmultipliedImageData(data, sourceRect, destPoint);
 }
 
 String CanvasRenderingContext2D::font() const
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.h b/WebCore/html/canvas/CanvasRenderingContext2D.h
index 9648ffc..283f92c 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -26,6 +26,7 @@
 #ifndef CanvasRenderingContext2D_h
 #define CanvasRenderingContext2D_h
 
+#include "CanvasRenderingContext.h"
 #include "TransformationMatrix.h"
 #include "FloatSize.h"
 #include "Font.h"
@@ -54,14 +55,13 @@ namespace WebCore {
 
     typedef int ExceptionCode;
 
-    class CanvasRenderingContext2D : public Noncopyable {
+    class CanvasRenderingContext2D : public CanvasRenderingContext {
     public:
         CanvasRenderingContext2D(HTMLCanvasElement*);
+
+        virtual ~CanvasRenderingContext2D();
         
-        void ref();
-        void deref();
-        
-        HTMLCanvasElement* canvas() const { return m_canvas; }
+        virtual bool is2d() const { return true; }
 
         CanvasStyle* strokeStyle() const;
         void setStrokeStyle(PassRefPtr<CanvasStyle>);
@@ -178,7 +178,7 @@ namespace WebCore {
         PassRefPtr<CanvasPattern> createPattern(HTMLImageElement*, const String& repetitionType, ExceptionCode&);
         PassRefPtr<CanvasPattern> createPattern(HTMLCanvasElement*, const String& repetitionType, ExceptionCode&);
         
-        PassRefPtr<ImageData> createImageData(float width, float height) const;
+        PassRefPtr<ImageData> createImageData(float width, float height, ExceptionCode&) const;
         PassRefPtr<ImageData> getImageData(float sx, float sy, float sw, float sh, ExceptionCode&) const;
         void putImageData(ImageData*, float dx, float dy, ExceptionCode&);
         void putImageData(ImageData*, float dx, float dy, float dirtyX, float dirtyY, float dirtyWidth, float dirtyHeight, ExceptionCode&);
@@ -262,7 +262,6 @@ namespace WebCore {
         void checkOrigin(const KURL&);
         void checkOrigin(const String&);
 
-        HTMLCanvasElement* m_canvas;
         Vector<State, 1> m_stateStack;
     };
 
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.idl b/WebCore/html/canvas/CanvasRenderingContext2D.idl
index a86b47d..ef66d1a 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.idl
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.idl
@@ -29,12 +29,10 @@ module html {
         GenerateConstructor,
         InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
         ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
-    ] CanvasRenderingContext2D {
+    ] CanvasRenderingContext2D : CanvasRenderingContext {
 
         // Web Applications 1.0 draft
 
-        readonly attribute HTMLCanvasElement canvas;
-
         void save();
         void restore();
 
@@ -113,7 +111,8 @@ module html {
         attribute [Custom] custom fillStyle;
         
         // pixel manipulation
-        ImageData createImageData(in float sw, in float sh);
+        ImageData createImageData(in float sw, in float sh)
+            raises (DOMException);
         ImageData getImageData(in float sx, in float sy, in float sw, in float sh)
             raises(DOMException);
         [Custom] void putImageData(/* in ImageData imagedata, in float dx, in float dy [, in float dirtyX, in float dirtyY, in float dirtyWidth, in float dirtyHeight] */);
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.cpp b/WebCore/html/canvas/CanvasRenderingContext3D.cpp
new file mode 100644
index 0000000..b810500
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext3D.cpp
@@ -0,0 +1,1401 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasRenderingContext3D.h"
+#include "CanvasBuffer.h"
+#include "CanvasFramebuffer.h"
+#include "CanvasProgram.h"
+#include "CanvasRenderbuffer.h"
+#include "CanvasTexture.h"
+#include "CanvasShader.h"
+#include "HTMLCanvasElement.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
+
+namespace WebCore {
+
+CanvasRenderingContext3D::CanvasRenderingContext3D(HTMLCanvasElement* canvas)
+    : CanvasRenderingContext(canvas)
+    , m_needsUpdate(true)
+    , m_markedCanvasDirty(false)
+{
+    m_context.reshape(m_canvas->width(), m_canvas->height());
+}
+
+CanvasRenderingContext3D::~CanvasRenderingContext3D()
+{
+    detachAndRemoveAllObjects();
+}
+
+void CanvasRenderingContext3D::markContextChanged()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_canvas->renderBox() && m_canvas->renderBox()->hasLayer()) {
+        m_canvas->renderBox()->layer()->rendererContentChanged();
+    } else {
+#endif
+        if (!m_markedCanvasDirty) {
+            // Make sure the canvas's image buffer is allocated.
+            m_canvas->buffer();
+            m_canvas->willDraw(FloatRect(0, 0, m_canvas->width(), m_canvas->height()));
+            m_markedCanvasDirty = true;
+        }
+#if USE(ACCELERATED_COMPOSITING)
+    }
+#endif
+}
+
+void CanvasRenderingContext3D::beginPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_context.beginPaint(this);
+    }
+}
+
+void CanvasRenderingContext3D::endPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_markedCanvasDirty = false;
+        m_context.endPaint();
+    }
+}
+
+void CanvasRenderingContext3D::reshape(int width, int height)
+{
+    if (m_needsUpdate) {
+#if USE(ACCELERATED_COMPOSITING)
+        if (m_canvas->renderBox() && m_canvas->renderBox()->hasLayer())
+            m_canvas->renderBox()->layer()->rendererContentChanged();
+#endif
+        m_needsUpdate = false;
+    }
+    
+    m_context.reshape(width, height);
+}
+
+int CanvasRenderingContext3D::sizeInBytes(int type, ExceptionCode& ec)
+{
+    int result = m_context.sizeInBytes(type);
+    if (result <= 0) {
+        ec = SYNTAX_ERR;
+    }
+    return result;
+}
+
+void CanvasRenderingContext3D::activeTexture(unsigned long texture)
+{
+    m_context.activeTexture(texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::attachShader(CanvasProgram* program, CanvasShader* shader)
+{
+    if (!program || !shader)
+        return;
+    m_context.attachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bindAttribLocation(CanvasProgram* program, unsigned long index, const String& name)
+{
+    if (!program)
+        return;
+    m_context.bindAttribLocation(program, index, name);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
+{
+    m_context.bindBuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
+{
+    m_context.bindFramebuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
+{
+    m_context.bindRenderbuffer(target, renderbuffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
+{
+    m_context.bindTexture(target, texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::blendColor(double red, double green, double blue, double alpha)
+{
+    m_context.blendColor(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::blendEquation( unsigned long mode )
+{
+    m_context.blendEquation(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
+{
+    m_context.blendEquationSeparate(modeRGB, modeAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
+{
+    m_context.blendFunc(sfactor, dfactor);
+    cleanupAfterGraphicsCall(false);
+}       
+
+void CanvasRenderingContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
+{
+    m_context.blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bufferData(unsigned long target, int size, unsigned long usage)
+{
+    m_context.bufferData(target, size, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bufferData(unsigned long target, CanvasArray* data, unsigned long usage)
+{
+    m_context.bufferData(target, data, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* data)
+{
+    m_context.bufferSubData(target, offset, data);
+    cleanupAfterGraphicsCall(false);
+}
+
+unsigned long CanvasRenderingContext3D::checkFramebufferStatus(unsigned long target)
+{
+    return m_context.checkFramebufferStatus(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::clear(unsigned long mask)
+{
+    m_context.clear(mask);
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::clearColor(double r, double g, double b, double a)
+{
+    if (isnan(r))
+        r = 0;
+    if (isnan(g))
+        g = 0;
+    if (isnan(b))
+        b = 0;
+    if (isnan(a))
+        a = 1;
+    m_context.clearColor(r, g, b, a);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::clearDepth(double depth)
+{
+    m_context.clearDepth(depth);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::clearStencil(long s)
+{
+    m_context.clearStencil(s);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
+{
+    m_context.colorMask(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::compileShader(CanvasShader* shader)
+{
+    m_context.compileShader(shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
+{
+    m_context.copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
+{
+    m_context.copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<CanvasBuffer> CanvasRenderingContext3D::createBuffer()
+{
+    RefPtr<CanvasBuffer> o = CanvasBuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+        
+PassRefPtr<CanvasFramebuffer> CanvasRenderingContext3D::createFramebuffer()
+{
+    RefPtr<CanvasFramebuffer> o = CanvasFramebuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasTexture> CanvasRenderingContext3D::createTexture()
+{
+    RefPtr<CanvasTexture> o = CanvasTexture::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasProgram> CanvasRenderingContext3D::createProgram()
+{
+    RefPtr<CanvasProgram> o = CanvasProgram::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasRenderbuffer> CanvasRenderingContext3D::createRenderbuffer()
+{
+    RefPtr<CanvasRenderbuffer> o = CanvasRenderbuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasShader> CanvasRenderingContext3D::createShader(unsigned long type)
+{
+    // FIXME: Need to include GL_ constants for internal use
+    // FIXME: Need to do param checking and throw exception if an illegal value is passed in
+    GraphicsContext3D::ShaderType shaderType = GraphicsContext3D::VERTEX_SHADER;
+    if (type == 0x8B30) // GL_FRAGMENT_SHADER
+        shaderType = GraphicsContext3D::FRAGMENT_SHADER;
+        
+    RefPtr<CanvasShader> o = CanvasShader::create(this, shaderType);
+    addObject(o.get());
+    return o;
+}
+
+void CanvasRenderingContext3D::cullFace(unsigned long mode)
+{
+    m_context.cullFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::deleteBuffer(CanvasBuffer* buffer)
+{
+    if (!buffer)
+        return;
+    
+    buffer->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteFramebuffer(CanvasFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return;
+    
+    framebuffer->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+    
+    program->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteRenderbuffer(CanvasRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return;
+    
+    renderbuffer->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteShader(CanvasShader* shader)
+{
+    if (!shader)
+        return;
+    
+    shader->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteTexture(CanvasTexture* texture)
+{
+    if (!texture)
+        return;
+    
+    texture->deleteObject();
+}
+
+void CanvasRenderingContext3D::depthFunc(unsigned long func)
+{
+    m_context.depthFunc(func);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::depthMask(bool flag)
+{
+    m_context.depthMask(flag);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::depthRange(double zNear, double zFar)
+{
+    m_context.depthRange(zNear, zFar);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::detachShader(CanvasProgram* program, CanvasShader* shader)
+{
+    if (!program || !shader)
+        return;
+
+    m_context.detachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::disable(unsigned long cap)
+{
+    m_context.disable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::disableVertexAttribArray(unsigned long index)
+{
+    m_context.disableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::drawArrays(unsigned long mode, long first, long count)
+{
+    m_context.drawArrays(mode, first, count);
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
+{
+    m_context.drawElements(mode, count, type, offset);
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::enable(unsigned long cap)
+{
+    m_context.enable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::enableVertexAttribArray(unsigned long index)
+{
+    m_context.enableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::finish()
+{
+    m_context.finish();
+    cleanupAfterGraphicsCall(true);
+}
+
+
+void CanvasRenderingContext3D::flush()
+{
+    m_context.flush();
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer* buffer)
+{
+    if (!buffer)
+        return;
+        
+    m_context.framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture* texture, long level)
+{
+    if (!texture)
+        return;
+        
+    m_context.framebufferTexture2D(target, attachment, textarget, texture, level);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::frontFace(unsigned long mode)
+{
+    m_context.frontFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::generateMipmap(unsigned long target)
+{
+    m_context.generateMipmap(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+int CanvasRenderingContext3D::getAttribLocation(CanvasProgram* program, const String& name)
+{
+    return m_context.getAttribLocation(program, name);
+}
+
+bool CanvasRenderingContext3D::getBoolean(unsigned long pname)
+{
+    bool result = m_context.getBoolean(pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasUnsignedByteArray> CanvasRenderingContext3D::getBooleanv(unsigned long pname)
+{
+    RefPtr<CanvasUnsignedByteArray> array = m_context.getBooleanv(pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
+{
+    int result = m_context.getBufferParameteri(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getBufferParameteriv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+unsigned long CanvasRenderingContext3D::getError()
+{
+    return m_context.getError();
+}
+
+float CanvasRenderingContext3D::getFloat(unsigned long pname)
+{
+    float result = m_context.getFloat(pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getFloatv(unsigned long pname)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getFloatv(pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
+{
+    int result = m_context.getFramebufferAttachmentParameteri(target, attachment, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getFramebufferAttachmentParameteriv(target, attachment, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getInteger(unsigned long pname)
+{
+    float result = m_context.getInteger(pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getIntegerv(unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getIntegerv(pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
+{
+    int result = m_context.getProgrami(program, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getProgramiv(program, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+String CanvasRenderingContext3D::getProgramInfoLog(CanvasProgram* program)
+{
+    String s = m_context.getProgramInfoLog(program);
+    cleanupAfterGraphicsCall(false);
+    return s;
+}
+
+int CanvasRenderingContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
+{
+    int result = m_context.getRenderbufferParameteri(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getRenderbufferParameteriv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
+{
+    int result = m_context.getShaderi(shader, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getShaderiv(shader, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+String CanvasRenderingContext3D::getShaderInfoLog(CanvasShader* shader)
+{
+    String s = m_context.getShaderInfoLog(shader);
+    cleanupAfterGraphicsCall(false);
+    return s;
+}
+
+String CanvasRenderingContext3D::getShaderSource(CanvasShader* shader)
+{
+    String s = m_context.getShaderSource(shader);
+    cleanupAfterGraphicsCall(false);
+    return s;
+}
+
+String CanvasRenderingContext3D::getString(unsigned long name)
+{
+    return m_context.getString(name);
+}
+
+float CanvasRenderingContext3D::getTexParameterf(unsigned long target, unsigned long pname)
+{
+    float result = m_context.getTexParameterf(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getTexParameterfv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getTexParameteri(unsigned long target, unsigned long pname)
+{
+    int result = m_context.getTexParameteri(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getTexParameteriv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+float CanvasRenderingContext3D::getUniformf(CanvasProgram* program, long location)
+{
+    float result = m_context.getUniformf(program, location);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getUniformfv(CanvasProgram* program, long location)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getUniformfv(program, location);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getUniformi(CanvasProgram* program, long location)
+{
+    long result = m_context.getUniformi(program, location);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getUniformiv(CanvasProgram* program, long location)
+{
+    RefPtr<CanvasIntArray> array = m_context.getUniformiv(program, location);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getUniformLocation(CanvasProgram* program, const String& name)
+{
+    return m_context.getUniformLocation(program, name);
+}
+
+float CanvasRenderingContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
+{
+    float result = m_context.getVertexAttribf(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getVertexAttribfv(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
+{
+    long result = m_context.getVertexAttribi(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getVertexAttribiv(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
+{
+    long result = m_context.getVertexAttribOffset(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+void CanvasRenderingContext3D::hint(unsigned long target, unsigned long mode)
+{
+    m_context.hint(target, mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+bool CanvasRenderingContext3D::isBuffer(CanvasBuffer* buffer)
+{
+    if (!buffer)
+        return false;
+        
+    return m_context.isBuffer(buffer);
+}
+
+bool CanvasRenderingContext3D::isEnabled(unsigned long cap)
+{
+    return m_context.isEnabled(cap);
+}
+
+bool CanvasRenderingContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
+{
+    return m_context.isFramebuffer(framebuffer);
+}
+
+bool CanvasRenderingContext3D::isProgram(CanvasProgram* program)
+{
+    return m_context.isProgram(program);
+}
+
+bool CanvasRenderingContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
+{
+    return m_context.isRenderbuffer(renderbuffer);
+}
+
+bool CanvasRenderingContext3D::isShader(CanvasShader* shader)
+{
+    return m_context.isShader(shader);
+}
+
+bool CanvasRenderingContext3D::isTexture(CanvasTexture* texture)
+{
+    return m_context.isTexture(texture);
+}
+
+void CanvasRenderingContext3D::lineWidth(double width)
+{
+    m_context.lineWidth((float) width);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::linkProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+        
+    m_context.linkProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::pixelStorei(unsigned long pname, long param)
+{
+    m_context.pixelStorei(pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::polygonOffset(double factor, double units)
+{
+    m_context.polygonOffset((float) factor, (float) units);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::releaseShaderCompiler()
+{
+    m_context.releaseShaderCompiler();
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    m_context.renderbufferStorage(target, internalformat, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::sampleCoverage(double value, bool invert)
+{
+    m_context.sampleCoverage((float) value, invert);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
+{
+    m_context.scissor(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::shaderSource(CanvasShader* shader, const String& string)
+{
+    m_context.shaderSource(shader, string);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
+{
+    m_context.stencilFunc(func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
+{
+    m_context.stencilFuncSeparate(face, func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilMask(unsigned long mask)
+{
+    m_context.stencilMask(mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
+{
+    m_context.stencilMaskSeparate(face, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context.stencilOp(fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context.stencilOpSeparate(face, fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, internalformat, width, height,
+                         border, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, internalformat, width, height,
+                         border, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, image, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, canvas, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, video, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texParameterf(unsigned target, unsigned pname, float param)
+{
+    m_context.texParameterf(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texParameteri(unsigned target, unsigned pname, int param)
+{
+    m_context.texParameteri(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLImageElement* image,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, image, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, canvas, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLVideoElement* video,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1f(long location, float x)
+{
+    m_context.uniform1f(location, x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1fv(location, v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1fv(location, v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1i(long location, int x)
+{
+    m_context.uniform1i(location, x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1iv(location, v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1iv(location, v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2f(long location, float x, float y)
+{
+    m_context.uniform2f(location, x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2fv(location, v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2fv(location, v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2i(long location, int x, int y)
+{
+    m_context.uniform2i(location, x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2iv(location, v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2iv(location, v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3f(long location, float x, float y, float z)
+{
+    m_context.uniform3f(location, x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3fv(location, v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3fv(location, v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3i(long location, int x, int y, int z)
+{
+    m_context.uniform3i(location, x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3iv(location, v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3iv(location, v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4f(long location, float x, float y, float z, float w)
+{
+    m_context.uniform4f(location, x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4fv(location, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4fv(location, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4i(long location, int x, int y, int z, int w)
+{
+    m_context.uniform4i(location, x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4iv(location, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4iv(location, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniformMatrix2fv(location, transpose, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniformMatrix2fv(location, transpose, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 9
+    m_context.uniformMatrix3fv(location, transpose, v->data(), v->length() / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 9
+    m_context.uniformMatrix3fv(location, transpose, v, size / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 16
+    m_context.uniformMatrix4fv(location, transpose, v->data(), v->length() / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 16
+    m_context.uniformMatrix4fv(location, transpose, v, size / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::useProgram(CanvasProgram* program)
+{
+    m_context.useProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::validateProgram(CanvasProgram* program)
+{
+    m_context.validateProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib1f(unsigned long indx, float v0)
+{
+    m_context.vertexAttrib1f(indx, v0);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib1fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib1fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
+{
+    m_context.vertexAttrib2f(indx, v0, v1);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib2fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib2fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
+{
+    m_context.vertexAttrib3f(indx, v0, v1, v2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib3fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib3fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
+{
+    m_context.vertexAttrib4f(indx, v0, v1, v2, v3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib4fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib4fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset)
+{
+    m_context.vertexAttribPointer(indx, size, type, normalized, stride, offset);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::viewport(long x, long y, unsigned long width, unsigned long height)
+{
+    if (isnan(x))
+        x = 0;
+    if (isnan(y))
+        y = 0;
+    if (isnan(width))
+        width = 100;
+    if (isnan(height))
+        height = 100;
+    m_context.viewport(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::removeObject(CanvasObject* object)
+{
+    m_canvasObjects.remove(object);
+}
+
+void CanvasRenderingContext3D::addObject(CanvasObject* object)
+{
+    removeObject(object);
+    m_canvasObjects.add(object);
+}
+
+void CanvasRenderingContext3D::detachAndRemoveAllObjects()
+{
+    HashSet<CanvasObject*>::iterator pend = m_canvasObjects.end();
+    for (HashSet<CanvasObject*>::iterator it = m_canvasObjects.begin(); it != pend; ++it)
+        (*it)->detachContext();
+        
+    m_canvasObjects.clear();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.h b/WebCore/html/canvas/CanvasRenderingContext3D.h
new file mode 100644
index 0000000..a4a68fc
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext3D.h
@@ -0,0 +1,321 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasRenderingContext3D_h
+#define CanvasRenderingContext3D_h
+
+#include "CanvasRenderingContext.h"
+#include "ExceptionCode.h"
+#include "CanvasFloatArray.h"
+#include "CanvasIntArray.h"
+#include "CanvasUnsignedByteArray.h"
+#include "GraphicsContext3D.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class CanvasBuffer;
+class CanvasFramebuffer;
+class CanvasObject;
+class CanvasProgram;
+class CanvasRenderbuffer;
+class CanvasShader;
+class CanvasTexture;
+class HTMLImageElement;
+class HTMLVideoElement;
+class ImageData;
+class WebKitCSSMatrix;
+
+    class CanvasRenderingContext3D : public CanvasRenderingContext {
+    public:
+        CanvasRenderingContext3D(HTMLCanvasElement*);
+        ~CanvasRenderingContext3D();
+
+        virtual bool is3d() const { return true; }
+
+        // Helper to return the size in bytes of OpenGL data types
+        // like GL_FLOAT, GL_INT, etc.
+        int sizeInBytes(int type, ExceptionCode& ec);
+
+        void activeTexture(unsigned long texture);
+        void attachShader(CanvasProgram*, CanvasShader*);
+        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
+        void bindBuffer(unsigned long target, CanvasBuffer*);
+        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
+        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
+        void bindTexture(unsigned long target, CanvasTexture*);
+        void blendColor(double red, double green, double blue, double alpha);
+        void blendEquation(unsigned long mode);
+        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
+        void blendFunc(unsigned long sfactor, unsigned long dfactor);
+        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
+
+        void bufferData(unsigned long target, int size, unsigned long usage);
+        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
+        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
+
+        unsigned long checkFramebufferStatus(unsigned long target);
+        void clear(unsigned long mask);
+        void clearColor(double red, double green, double blue, double alpha);
+        void clearDepth(double);
+        void clearStencil(long);
+        void colorMask(bool red, bool green, bool blue, bool alpha);
+        void compileShader(CanvasShader*);
+        
+        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
+        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
+        
+        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
+        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
+
+        PassRefPtr<CanvasBuffer> createBuffer();
+        PassRefPtr<CanvasFramebuffer> createFramebuffer();
+        PassRefPtr<CanvasProgram> createProgram();
+        PassRefPtr<CanvasRenderbuffer> createRenderbuffer();
+        PassRefPtr<CanvasShader> createShader(unsigned long type);
+        PassRefPtr<CanvasTexture> createTexture();
+
+        void cullFace(unsigned long mode);
+
+        void deleteBuffer(CanvasBuffer*);
+        void deleteFramebuffer(CanvasFramebuffer*);
+        void deleteProgram(CanvasProgram*);
+        void deleteRenderbuffer(CanvasRenderbuffer*);
+        void deleteShader(CanvasShader*);
+        void deleteTexture(CanvasTexture*);
+        
+        void depthFunc(unsigned long);
+        void depthMask(bool);
+        void depthRange(double zNear, double zFar);
+        void detachShader(CanvasProgram*, CanvasShader*);
+        void disable(unsigned long cap);
+        void disableVertexAttribArray(unsigned long index);
+        void drawArrays(unsigned long mode, long first, long count);
+        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset);
+
+        void enable(unsigned long cap);
+        void enableVertexAttribArray(unsigned long index);
+        void finish();
+        void flush();
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
+        void frontFace(unsigned long mode);
+        void generateMipmap(unsigned long target);
+        
+        int  getAttribLocation(CanvasProgram*, const String& name);
+
+        bool getBoolean(unsigned long pname);
+        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
+        int getBufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
+
+        unsigned long getError();
+
+        float getFloat(unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
+        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
+        int getInteger(unsigned long pname);
+        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
+        int getProgrami(CanvasProgram*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
+        String getProgramInfoLog(CanvasProgram*);
+        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
+        int getShaderi(CanvasShader*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
+
+        String getShaderInfoLog(CanvasShader*);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        String getShaderSource(CanvasShader*);
+        String getString(unsigned long name);
+
+        float getTexParameterf(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
+        int getTexParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
+
+        float getUniformf(CanvasProgram* program, long location);
+        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
+        long getUniformi(CanvasProgram* program, long location);
+        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
+
+        long getUniformLocation(CanvasProgram*, const String& name);
+
+        float getVertexAttribf(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
+        long getVertexAttribi(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
+
+        long getVertexAttribOffset(unsigned long index, unsigned long pname);
+
+        void hint(unsigned long target, unsigned long mode);
+        bool isBuffer(CanvasBuffer*);
+        bool isEnabled(unsigned long cap);
+        bool isFramebuffer(CanvasFramebuffer*);
+        bool isProgram(CanvasProgram*);
+        bool isRenderbuffer(CanvasRenderbuffer*);
+        bool isShader(CanvasShader*);
+        bool isTexture(CanvasTexture*);
+        void lineWidth(double);
+        void linkProgram(CanvasProgram*);
+        void pixelStorei(unsigned long pname, long param);
+        void polygonOffset(double factor, double units);
+        
+        // TBD
+        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        
+        void releaseShaderCompiler();
+        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
+        void sampleCoverage(double value, bool invert);
+        void scissor(long x, long y, unsigned long width, unsigned long height);
+        void shaderSource(CanvasShader*, const String&);
+        void stencilFunc(unsigned long func, long ref, unsigned long mask);
+        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
+        void stencilMask(unsigned long);
+        void stencilMaskSeparate(unsigned long face, unsigned long mask);
+        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
+        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
+
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void texParameterf(unsigned target, unsigned pname, float param);
+        void texParameteri(unsigned target, unsigned pname, int param);
+
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLImageElement* image,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLVideoElement* video,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void uniform1f(long location, float x);
+        void uniform1fv(long location, CanvasFloatArray* v);
+        void uniform1fv(long location, float* v, int size);
+        void uniform1i(long location, int x);
+        void uniform1iv(long location, CanvasIntArray* v);
+        void uniform1iv(long location, int* v, int size);
+        void uniform2f(long location, float x, float y);
+        void uniform2fv(long location, CanvasFloatArray* v);
+        void uniform2fv(long location, float* v, int size);
+        void uniform2i(long location, int x, int y);
+        void uniform2iv(long location, CanvasIntArray* v);
+        void uniform2iv(long location, int* v, int size);
+        void uniform3f(long location, float x, float y, float z);
+        void uniform3fv(long location, CanvasFloatArray* v);
+        void uniform3fv(long location, float* v, int size);
+        void uniform3i(long location, int x, int y, int z);
+        void uniform3iv(long location, CanvasIntArray* v);
+        void uniform3iv(long location, int* v, int size);
+        void uniform4f(long location, float x, float y, float z, float w);
+        void uniform4fv(long location, CanvasFloatArray* v);
+        void uniform4fv(long location, float* v, int size);
+        void uniform4i(long location, int x, int y, int z, int w);
+        void uniform4iv(long location, CanvasIntArray* v);
+        void uniform4iv(long location, int* v, int size);
+        void uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* value);
+        void uniformMatrix2fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* value);
+        void uniformMatrix3fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* value);
+        void uniformMatrix4fv(long location, bool transpose, float* value, int size);
+
+        void useProgram(CanvasProgram*);
+        void validateProgram(CanvasProgram*);
+
+        void vertexAttrib1f(unsigned long indx, float x);
+        void vertexAttrib1fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib1fv(unsigned long indx, float* values, int size);
+        void vertexAttrib2f(unsigned long indx, float x, float y);
+        void vertexAttrib2fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib2fv(unsigned long indx, float* values, int size);
+        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
+        void vertexAttrib3fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib3fv(unsigned long indx, float* values, int size);
+        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
+        void vertexAttrib4fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib4fv(unsigned long indx, float* values, int size);
+        void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
+                                 unsigned long stride, unsigned long offset);
+
+        void viewport(long x, long y, unsigned long width, unsigned long height);
+
+        GraphicsContext3D* graphicsContext3D() { return &m_context; }
+    
+        void reshape(int width, int height);
+
+        // Helpers for notification about paint events.
+        void beginPaint();
+        void endPaint();
+        
+        void removeObject(CanvasObject*);
+        
+    private:
+        friend class CanvasObject;
+        void addObject(CanvasObject*);
+        void detachAndRemoveAllObjects();
+
+        void markContextChanged();
+        void cleanupAfterGraphicsCall(bool changed)
+        {
+            m_context.checkError();
+            if (changed)
+                markContextChanged();
+        }
+        
+        GraphicsContext3D m_context;
+        bool m_needsUpdate;
+        bool m_markedCanvasDirty;
+        // FIXME: I think this is broken -- it does not increment any
+        // reference counts, so may refer to destroyed objects.
+        HashSet<CanvasObject*> m_canvasObjects;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.idl b/WebCore/html/canvas/CanvasRenderingContext3D.idl
new file mode 100644
index 0000000..4b9a889
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext3D.idl
@@ -0,0 +1,687 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        Conditional=3D_CANVAS,
+        GenerateConstructor,
+        InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
+        ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
+    ] CanvasRenderingContext3D : CanvasRenderingContext {
+
+        /* ClearBufferMask */
+        const unsigned int DEPTH_BUFFER_BIT               = 0x00000100;
+        const unsigned int STENCIL_BUFFER_BIT             = 0x00000400;
+        const unsigned int COLOR_BUFFER_BIT               = 0x00004000;
+
+        /* Boolean */
+        const unsigned int FALSE                          = 0;
+        const unsigned int TRUE                           = 1;
+
+        /* BeginMode */
+        const unsigned int POINTS                         = 0x0000;
+        const unsigned int LINES                          = 0x0001;
+        const unsigned int LINE_LOOP                      = 0x0002;
+        const unsigned int LINE_STRIP                     = 0x0003;
+        const unsigned int TRIANGLES                      = 0x0004;
+        const unsigned int TRIANGLE_STRIP                 = 0x0005;
+        const unsigned int TRIANGLE_FAN                   = 0x0006;
+
+        /* AlphaFunction (not supported in ES20) */
+        /*      NEVER */
+        /*      LESS */
+        /*      EQUAL */
+        /*      LEQUAL */
+        /*      GREATER */
+        /*      NOTEQUAL */
+        /*      GEQUAL */
+        /*      ALWAYS */
+
+        /* BlendingFactorDest */
+        const unsigned int ZERO                           = 0;
+        const unsigned int ONE                            = 1;
+        const unsigned int SRC_COLOR                      = 0x0300;
+        const unsigned int ONE_MINUS_SRC_COLOR            = 0x0301;
+        const unsigned int SRC_ALPHA                      = 0x0302;
+        const unsigned int ONE_MINUS_SRC_ALPHA            = 0x0303;
+        const unsigned int DST_ALPHA                      = 0x0304;
+        const unsigned int ONE_MINUS_DST_ALPHA            = 0x0305;
+
+        /* BlendingFactorSrc */
+        /*      ZERO */
+        /*      ONE */
+        const unsigned int DST_COLOR                      = 0x0306;
+        const unsigned int ONE_MINUS_DST_COLOR            = 0x0307;
+        const unsigned int SRC_ALPHA_SATURATE             = 0x0308;
+        /*      SRC_ALPHA */
+        /*      ONE_MINUS_SRC_ALPHA */
+        /*      DST_ALPHA */
+        /*      ONE_MINUS_DST_ALPHA */
+
+        /* BlendEquationSeparate */
+        const unsigned int FUNC_ADD                       = 0x8006;
+        const unsigned int BLEND_EQUATION                 = 0x8009;
+        const unsigned int BLEND_EQUATION_RGB             = 0x8009;   /* same as BLEND_EQUATION */
+        const unsigned int BLEND_EQUATION_ALPHA           = 0x883D;
+
+        /* BlendSubtract */
+        const unsigned int FUNC_SUBTRACT                  = 0x800A;
+        const unsigned int FUNC_REVERSE_SUBTRACT          = 0x800B;
+
+        /* Separate Blend Functions */
+        const unsigned int BLEND_DST_RGB                  = 0x80C8;
+        const unsigned int BLEND_SRC_RGB                  = 0x80C9;
+        const unsigned int BLEND_DST_ALPHA                = 0x80CA;
+        const unsigned int BLEND_SRC_ALPHA                = 0x80CB;
+        const unsigned int CONSTANT_COLOR                 = 0x8001;
+        const unsigned int ONE_MINUS_CONSTANT_COLOR       = 0x8002;
+        const unsigned int CONSTANT_ALPHA                 = 0x8003;
+        const unsigned int ONE_MINUS_CONSTANT_ALPHA       = 0x8004;
+        const unsigned int BLEND_COLOR                    = 0x8005;
+
+        /* Buffer Objects */
+        const unsigned int ARRAY_BUFFER                   = 0x8892;
+        const unsigned int ELEMENT_ARRAY_BUFFER           = 0x8893;
+        const unsigned int ARRAY_BUFFER_BINDING           = 0x8894;
+        const unsigned int ELEMENT_ARRAY_BUFFER_BINDING   = 0x8895;
+
+        const unsigned int STREAM_DRAW                    = 0x88E0;
+        const unsigned int STATIC_DRAW                    = 0x88E4;
+        const unsigned int DYNAMIC_DRAW                   = 0x88E8;
+
+        const unsigned int BUFFER_SIZE                    = 0x8764;
+        const unsigned int BUFFER_USAGE                   = 0x8765;
+
+        const unsigned int CURRENT_VERTEX_ATTRIB          = 0x8626;
+
+        /* CullFaceMode */
+        const unsigned int FRONT                          = 0x0404;
+        const unsigned int BACK                           = 0x0405;
+        const unsigned int FRONT_AND_BACK                 = 0x0408;
+
+        /* DepthFunction */
+        /*      NEVER */
+        /*      LESS */
+        /*      EQUAL */
+        /*      LEQUAL */
+        /*      GREATER */
+        /*      NOTEQUAL */
+        /*      GEQUAL */
+        /*      ALWAYS */
+
+        /* EnableCap */
+        const unsigned int TEXTURE_2D                     = 0x0DE1;
+        const unsigned int CULL_FACE                      = 0x0B44;
+        const unsigned int BLEND                          = 0x0BE2;
+        const unsigned int DITHER                         = 0x0BD0;
+        const unsigned int STENCIL_TEST                   = 0x0B90;
+        const unsigned int DEPTH_TEST                     = 0x0B71;
+        const unsigned int SCISSOR_TEST                   = 0x0C11;
+        const unsigned int POLYGON_OFFSET_FILL            = 0x8037;
+        const unsigned int SAMPLE_ALPHA_TO_COVERAGE       = 0x809E;
+        const unsigned int SAMPLE_COVERAGE                = 0x80A0;
+
+        /* ErrorCode */
+        const unsigned int NO_ERROR                       = 0;
+        const unsigned int INVALID_ENUM                   = 0x0500;
+        const unsigned int INVALID_VALUE                  = 0x0501;
+        const unsigned int INVALID_OPERATION              = 0x0502;
+        const unsigned int OUT_OF_MEMORY                  = 0x0505;
+
+        /* FrontFaceDirection */
+        const unsigned int CW                             = 0x0900;
+        const unsigned int CCW                            = 0x0901;
+
+        /* GetPName */
+        const unsigned int LINE_WIDTH                     = 0x0B21;
+        const unsigned int ALIASED_POINT_SIZE_RANGE       = 0x846D;
+        const unsigned int ALIASED_LINE_WIDTH_RANGE       = 0x846E;
+        const unsigned int CULL_FACE_MODE                 = 0x0B45;
+        const unsigned int FRONT_FACE                     = 0x0B46;
+        const unsigned int DEPTH_RANGE                    = 0x0B70;
+        const unsigned int DEPTH_WRITEMASK                = 0x0B72;
+        const unsigned int DEPTH_CLEAR_VALUE              = 0x0B73;
+        const unsigned int DEPTH_FUNC                     = 0x0B74;
+        const unsigned int STENCIL_CLEAR_VALUE            = 0x0B91;
+        const unsigned int STENCIL_FUNC                   = 0x0B92;
+        const unsigned int STENCIL_FAIL                   = 0x0B94;
+        const unsigned int STENCIL_PASS_DEPTH_FAIL        = 0x0B95;
+        const unsigned int STENCIL_PASS_DEPTH_PASS        = 0x0B96;
+        const unsigned int STENCIL_REF                    = 0x0B97;
+        const unsigned int STENCIL_VALUE_MASK             = 0x0B93;
+        const unsigned int STENCIL_WRITEMASK              = 0x0B98;
+        const unsigned int STENCIL_BACK_FUNC              = 0x8800;
+        const unsigned int STENCIL_BACK_FAIL              = 0x8801;
+        const unsigned int STENCIL_BACK_PASS_DEPTH_FAIL   = 0x8802;
+        const unsigned int STENCIL_BACK_PASS_DEPTH_PASS   = 0x8803;
+        const unsigned int STENCIL_BACK_REF               = 0x8CA3;
+        const unsigned int STENCIL_BACK_VALUE_MASK        = 0x8CA4;
+        const unsigned int STENCIL_BACK_WRITEMASK         = 0x8CA5;
+        const unsigned int VIEWPORT                       = 0x0BA2;
+        const unsigned int SCISSOR_BOX                    = 0x0C10;
+        /*      SCISSOR_TEST */
+        const unsigned int COLOR_CLEAR_VALUE              = 0x0C22;
+        const unsigned int COLOR_WRITEMASK                = 0x0C23;
+        const unsigned int UNPACK_ALIGNMENT               = 0x0CF5;
+        const unsigned int PACK_ALIGNMENT                 = 0x0D05;
+        const unsigned int MAX_TEXTURE_SIZE               = 0x0D33;
+        const unsigned int MAX_VIEWPORT_DIMS              = 0x0D3A;
+        const unsigned int SUBPIXEL_BITS                  = 0x0D50;
+        const unsigned int RED_BITS                       = 0x0D52;
+        const unsigned int GREEN_BITS                     = 0x0D53;
+        const unsigned int BLUE_BITS                      = 0x0D54;
+        const unsigned int ALPHA_BITS                     = 0x0D55;
+        const unsigned int DEPTH_BITS                     = 0x0D56;
+        const unsigned int STENCIL_BITS                   = 0x0D57;
+        const unsigned int POLYGON_OFFSET_UNITS           = 0x2A00;
+        /*      POLYGON_OFFSET_FILL */
+        const unsigned int POLYGON_OFFSET_FACTOR          = 0x8038;
+        const unsigned int TEXTURE_BINDING_2D             = 0x8069;
+        const unsigned int SAMPLE_BUFFERS                 = 0x80A8;
+        const unsigned int SAMPLES                        = 0x80A9;
+        const unsigned int SAMPLE_COVERAGE_VALUE          = 0x80AA;
+        const unsigned int SAMPLE_COVERAGE_INVERT         = 0x80AB;
+
+        /* GetTextureParameter */
+        /*      TEXTURE_MAG_FILTER */
+        /*      TEXTURE_MIN_FILTER */
+        /*      TEXTURE_WRAP_S */
+        /*      TEXTURE_WRAP_T */
+
+        const unsigned int NUM_COMPRESSED_TEXTURE_FORMATS = 0x86A2;
+        const unsigned int COMPRESSED_TEXTURE_FORMATS     = 0x86A3;
+
+        /* HintMode */
+        const unsigned int DONT_CARE                      = 0x1100;
+        const unsigned int FASTEST                        = 0x1101;
+        const unsigned int NICEST                         = 0x1102;
+
+        /* HintTarget */
+        const unsigned int GENERATE_MIPMAP_HINT            = 0x8192;
+
+        /* DataType */
+        const unsigned int BYTE                           = 0x1400;
+        const unsigned int UNSIGNED_BYTE                  = 0x1401;
+        const unsigned int SHORT                          = 0x1402;
+        const unsigned int UNSIGNED_SHORT                 = 0x1403;
+        const unsigned int INT                            = 0x1404;
+        const unsigned int UNSIGNED_INT                   = 0x1405;
+        const unsigned int FLOAT                          = 0x1406;
+        const unsigned int FIXED                          = 0x140C;
+
+        /* PixelFormat */
+        const unsigned int DEPTH_COMPONENT                = 0x1902;
+        const unsigned int ALPHA                          = 0x1906;
+        const unsigned int RGB                            = 0x1907;
+        const unsigned int RGBA                           = 0x1908;
+        const unsigned int LUMINANCE                      = 0x1909;
+        const unsigned int LUMINANCE_ALPHA                = 0x190A;
+
+        /* PixelType */
+        /*      UNSIGNED_BYTE */
+        const unsigned int UNSIGNED_SHORT_4_4_4_4         = 0x8033;
+        const unsigned int UNSIGNED_SHORT_5_5_5_1         = 0x8034;
+        const unsigned int UNSIGNED_SHORT_5_6_5           = 0x8363;
+
+        /* Shaders */
+        const unsigned int FRAGMENT_SHADER                  = 0x8B30;
+        const unsigned int VERTEX_SHADER                    = 0x8B31;
+        const unsigned int MAX_VERTEX_ATTRIBS               = 0x8869;
+        const unsigned int MAX_VERTEX_UNIFORM_VECTORS       = 0x8DFB;
+        const unsigned int MAX_VARYING_VECTORS              = 0x8DFC;
+        const unsigned int MAX_COMBINED_TEXTURE_IMAGE_UNITS = 0x8B4D;
+        const unsigned int MAX_VERTEX_TEXTURE_IMAGE_UNITS   = 0x8B4C;
+        const unsigned int MAX_TEXTURE_IMAGE_UNITS          = 0x8872;
+        const unsigned int MAX_FRAGMENT_UNIFORM_VECTORS     = 0x8DFD;
+        const unsigned int SHADER_TYPE                      = 0x8B4F;
+        const unsigned int DELETE_STATUS                    = 0x8B80;
+        const unsigned int LINK_STATUS                      = 0x8B82;
+        const unsigned int VALIDATE_STATUS                  = 0x8B83;
+        const unsigned int ATTACHED_SHADERS                 = 0x8B85;
+        const unsigned int ACTIVE_UNIFORMS                  = 0x8B86;
+        const unsigned int ACTIVE_UNIFORM_MAX_LENGTH        = 0x8B87;
+        const unsigned int ACTIVE_ATTRIBUTES                = 0x8B89;
+        const unsigned int ACTIVE_ATTRIBUTE_MAX_LENGTH      = 0x8B8A;
+        const unsigned int SHADING_LANGUAGE_VERSION         = 0x8B8C;
+        const unsigned int CURRENT_PROGRAM                  = 0x8B8D;
+
+        /* StencilFunction */
+        const unsigned int NEVER                          = 0x0200;
+        const unsigned int LESS                           = 0x0201;
+        const unsigned int EQUAL                          = 0x0202;
+        const unsigned int LEQUAL                         = 0x0203;
+        const unsigned int GREATER                        = 0x0204;
+        const unsigned int NOTEQUAL                       = 0x0205;
+        const unsigned int GEQUAL                         = 0x0206;
+        const unsigned int ALWAYS                         = 0x0207;
+
+        /* StencilOp */
+        /*      ZERO */
+        const unsigned int KEEP                           = 0x1E00;
+        const unsigned int REPLACE                        = 0x1E01;
+        const unsigned int INCR                           = 0x1E02;
+        const unsigned int DECR                           = 0x1E03;
+        const unsigned int INVERT                         = 0x150A;
+        const unsigned int INCR_WRAP                      = 0x8507;
+        const unsigned int DECR_WRAP                      = 0x8508;
+
+        /* StringName */
+        const unsigned int VENDOR                         = 0x1F00;
+        const unsigned int RENDERER                       = 0x1F01;
+        const unsigned int VERSION                        = 0x1F02;
+        const unsigned int EXTENSIONS                     = 0x1F03;
+
+        /* TextureMagFilter */
+        const unsigned int NEAREST                        = 0x2600;
+        const unsigned int LINEAR                         = 0x2601;
+
+        /* TextureMinFilter */
+        /*      NEAREST */
+        /*      LINEAR */
+        const unsigned int NEAREST_MIPMAP_NEAREST         = 0x2700;
+        const unsigned int LINEAR_MIPMAP_NEAREST          = 0x2701;
+        const unsigned int NEAREST_MIPMAP_LINEAR          = 0x2702;
+        const unsigned int LINEAR_MIPMAP_LINEAR           = 0x2703;
+
+        /* TextureParameterName */
+        const unsigned int TEXTURE_MAG_FILTER             = 0x2800;
+        const unsigned int TEXTURE_MIN_FILTER             = 0x2801;
+        const unsigned int TEXTURE_WRAP_S                 = 0x2802;
+        const unsigned int TEXTURE_WRAP_T                 = 0x2803;
+
+        /* TextureTarget */
+        /*      TEXTURE_2D */
+        const unsigned int TEXTURE                        = 0x1702;
+
+        const unsigned int TEXTURE_CUBE_MAP               = 0x8513;
+        const unsigned int TEXTURE_BINDING_CUBE_MAP       = 0x8514;
+        const unsigned int TEXTURE_CUBE_MAP_POSITIVE_X    = 0x8515;
+        const unsigned int TEXTURE_CUBE_MAP_NEGATIVE_X    = 0x8516;
+        const unsigned int TEXTURE_CUBE_MAP_POSITIVE_Y    = 0x8517;
+        const unsigned int TEXTURE_CUBE_MAP_NEGATIVE_Y    = 0x8518;
+        const unsigned int TEXTURE_CUBE_MAP_POSITIVE_Z    = 0x8519;
+        const unsigned int TEXTURE_CUBE_MAP_NEGATIVE_Z    = 0x851A;
+        const unsigned int MAX_CUBE_MAP_TEXTURE_SIZE      = 0x851C;
+
+        /* TextureUnit */
+        const unsigned int TEXTURE0                       = 0x84C0;
+        const unsigned int TEXTURE1                       = 0x84C1;
+        const unsigned int TEXTURE2                       = 0x84C2;
+        const unsigned int TEXTURE3                       = 0x84C3;
+        const unsigned int TEXTURE4                       = 0x84C4;
+        const unsigned int TEXTURE5                       = 0x84C5;
+        const unsigned int TEXTURE6                       = 0x84C6;
+        const unsigned int TEXTURE7                       = 0x84C7;
+        const unsigned int TEXTURE8                       = 0x84C8;
+        const unsigned int TEXTURE9                       = 0x84C9;
+        const unsigned int TEXTURE10                      = 0x84CA;
+        const unsigned int TEXTURE11                      = 0x84CB;
+        const unsigned int TEXTURE12                      = 0x84CC;
+        const unsigned int TEXTURE13                      = 0x84CD;
+        const unsigned int TEXTURE14                      = 0x84CE;
+        const unsigned int TEXTURE15                      = 0x84CF;
+        const unsigned int TEXTURE16                      = 0x84D0;
+        const unsigned int TEXTURE17                      = 0x84D1;
+        const unsigned int TEXTURE18                      = 0x84D2;
+        const unsigned int TEXTURE19                      = 0x84D3;
+        const unsigned int TEXTURE20                      = 0x84D4;
+        const unsigned int TEXTURE21                      = 0x84D5;
+        const unsigned int TEXTURE22                      = 0x84D6;
+        const unsigned int TEXTURE23                      = 0x84D7;
+        const unsigned int TEXTURE24                      = 0x84D8;
+        const unsigned int TEXTURE25                      = 0x84D9;
+        const unsigned int TEXTURE26                      = 0x84DA;
+        const unsigned int TEXTURE27                      = 0x84DB;
+        const unsigned int TEXTURE28                      = 0x84DC;
+        const unsigned int TEXTURE29                      = 0x84DD;
+        const unsigned int TEXTURE30                      = 0x84DE;
+        const unsigned int TEXTURE31                      = 0x84DF;
+        const unsigned int ACTIVE_TEXTURE                 = 0x84E0;
+
+        /* TextureWrapMode */
+        const unsigned int REPEAT                         = 0x2901;
+        const unsigned int CLAMP_TO_EDGE                  = 0x812F;
+        const unsigned int MIRRORED_REPEAT                = 0x8370;
+
+        /* Uniform Types */
+        const unsigned int FLOAT_VEC2                     = 0x8B50;
+        const unsigned int FLOAT_VEC3                     = 0x8B51;
+        const unsigned int FLOAT_VEC4                     = 0x8B52;
+        const unsigned int INT_VEC2                       = 0x8B53;
+        const unsigned int INT_VEC3                       = 0x8B54;
+        const unsigned int INT_VEC4                       = 0x8B55;
+        const unsigned int BOOL                           = 0x8B56;
+        const unsigned int BOOL_VEC2                      = 0x8B57;
+        const unsigned int BOOL_VEC3                      = 0x8B58;
+        const unsigned int BOOL_VEC4                      = 0x8B59;
+        const unsigned int FLOAT_MAT2                     = 0x8B5A;
+        const unsigned int FLOAT_MAT3                     = 0x8B5B;
+        const unsigned int FLOAT_MAT4                     = 0x8B5C;
+        const unsigned int SAMPLER_2D                     = 0x8B5E;
+        const unsigned int SAMPLER_CUBE                   = 0x8B60;
+
+        /* Vertex Arrays */
+        const unsigned int VERTEX_ATTRIB_ARRAY_ENABLED        = 0x8622;
+        const unsigned int VERTEX_ATTRIB_ARRAY_SIZE           = 0x8623;
+        const unsigned int VERTEX_ATTRIB_ARRAY_STRIDE         = 0x8624;
+        const unsigned int VERTEX_ATTRIB_ARRAY_TYPE           = 0x8625;
+        const unsigned int VERTEX_ATTRIB_ARRAY_NORMALIZED     = 0x886A;
+        const unsigned int VERTEX_ATTRIB_ARRAY_POINTER        = 0x8645;
+        const unsigned int VERTEX_ATTRIB_ARRAY_BUFFER_BINDING = 0x889F;
+
+        /* Read Format */
+        const unsigned int IMPLEMENTATION_COLOR_READ_TYPE   = 0x8B9A;
+        const unsigned int IMPLEMENTATION_COLOR_READ_FORMAT = 0x8B9B;
+
+        /* Shader Source */
+        const unsigned int COMPILE_STATUS                 = 0x8B81;
+        const unsigned int INFO_LOG_LENGTH                = 0x8B84;
+        const unsigned int SHADER_SOURCE_LENGTH           = 0x8B88;
+        const unsigned int SHADER_COMPILER                = 0x8DFA;
+
+        /* Shader Binary */
+        const unsigned int SHADER_BINARY_FORMATS          = 0x8DF8;
+        const unsigned int NUM_SHADER_BINARY_FORMATS      = 0x8DF9;
+
+        /* Shader Precision-Specified Types */
+        const unsigned int LOW_FLOAT                      = 0x8DF0;
+        const unsigned int MEDIUM_FLOAT                   = 0x8DF1;
+        const unsigned int HIGH_FLOAT                     = 0x8DF2;
+        const unsigned int LOW_INT                        = 0x8DF3;
+        const unsigned int MEDIUM_INT                     = 0x8DF4;
+        const unsigned int HIGH_INT                       = 0x8DF5;
+
+        /* Framebuffer Object. */
+        const unsigned int FRAMEBUFFER                    = 0x8D40;
+        const unsigned int RENDERBUFFER                   = 0x8D41;
+
+        const unsigned int RGBA4                          = 0x8056;
+        const unsigned int RGB5_A1                        = 0x8057;
+        const unsigned int RGB565                         = 0x8D62;
+        const unsigned int DEPTH_COMPONENT16              = 0x81A5;
+        const unsigned int STENCIL_INDEX                  = 0x1901;
+        const unsigned int STENCIL_INDEX8                 = 0x8D48;
+
+        const unsigned int RENDERBUFFER_WIDTH             = 0x8D42;
+        const unsigned int RENDERBUFFER_HEIGHT            = 0x8D43;
+        const unsigned int RENDERBUFFER_INTERNAL_FORMAT   = 0x8D44;
+        const unsigned int RENDERBUFFER_RED_SIZE          = 0x8D50;
+        const unsigned int RENDERBUFFER_GREEN_SIZE        = 0x8D51;
+        const unsigned int RENDERBUFFER_BLUE_SIZE         = 0x8D52;
+        const unsigned int RENDERBUFFER_ALPHA_SIZE        = 0x8D53;
+        const unsigned int RENDERBUFFER_DEPTH_SIZE        = 0x8D54;
+        const unsigned int RENDERBUFFER_STENCIL_SIZE      = 0x8D55;
+
+        const unsigned int FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE           = 0x8CD0;
+        const unsigned int FRAMEBUFFER_ATTACHMENT_OBJECT_NAME           = 0x8CD1;
+        const unsigned int FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL         = 0x8CD2;
+        const unsigned int FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE = 0x8CD3;
+
+        const unsigned int COLOR_ATTACHMENT0              = 0x8CE0;
+        const unsigned int DEPTH_ATTACHMENT               = 0x8D00;
+        const unsigned int STENCIL_ATTACHMENT             = 0x8D20;
+
+        const unsigned int NONE                           = 0;
+
+        const unsigned int FRAMEBUFFER_COMPLETE                      = 0x8CD5;
+        const unsigned int FRAMEBUFFER_INCOMPLETE_ATTACHMENT         = 0x8CD6;
+        const unsigned int FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT = 0x8CD7;
+        const unsigned int FRAMEBUFFER_INCOMPLETE_DIMENSIONS         = 0x8CD9;
+        const unsigned int FRAMEBUFFER_UNSUPPORTED                   = 0x8CDD;
+
+        const unsigned int FRAMEBUFFER_BINDING            = 0x8CA6;
+        const unsigned int RENDERBUFFER_BINDING           = 0x8CA7;
+        const unsigned int MAX_RENDERBUFFER_SIZE          = 0x84E8;
+
+        const unsigned int INVALID_FRAMEBUFFER_OPERATION  = 0x0506;
+
+        long sizeInBytes(in unsigned long type) raises(DOMException);
+
+        void         activeTexture(in unsigned long texture);
+        void         attachShader(in CanvasProgram program, in CanvasShader shader);
+        void         bindAttribLocation(in CanvasProgram program, in unsigned long index, in DOMString name);
+        void         bindBuffer(in unsigned long target, in CanvasBuffer buffer);
+        void         bindFramebuffer(in unsigned long target, in CanvasFramebuffer framebuffer);
+        void         bindRenderbuffer(in unsigned long target, in CanvasRenderbuffer renderbuffer);
+        void         bindTexture(in unsigned long target, in CanvasTexture texture);
+        void         blendColor(in double red, in double green, in double blue, in double alpha);
+        void         blendEquation( in unsigned long mode );
+        void         blendEquationSeparate(in unsigned long modeRGB, in unsigned long modeAlpha);
+        void         blendFunc(in unsigned long sfactor, in unsigned long dfactor);
+        void         blendFuncSeparate(in unsigned long srcRGB, in unsigned long dstRGB, in unsigned long srcAlpha, in unsigned long dstAlpha);
+        // Supported forms:
+        //   void bufferData (in GLenum target, in GLsizei size, in GLenum usage);
+        //   void bufferData (in GLenum target, in CanvasArray data, in GLenum usage);
+        [Custom] void bufferData();
+        // Supported forms:
+        //   void bufferSubData (in GLenum target, in GLsizeiptr offset, in CanvasArray data);
+        [Custom] void bufferSubData();
+
+        unsigned long checkFramebufferStatus(in unsigned long target);
+        void         clear(in unsigned long mask);
+        void         clearColor(in double red, in double green, in double blue, in double alpha);
+        void         clearDepth(in double depth);
+        void         clearStencil(in long s);
+        void         colorMask(in boolean red, in boolean green, in boolean blue, in boolean alpha);
+        void         compileShader(in CanvasShader shader);
+        
+        //void         compressedTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in unsigned long width, in unsigned long height, in long border, in unsigned long imageSize, const void* data);
+        //void         compressedTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long imageSize, const void* data);
+        
+        void         copyTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in long x, in long y, in unsigned long width, in unsigned long height, in long border);
+        void         copyTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in long x, in long y, in unsigned long width, in unsigned long height);
+
+        CanvasBuffer createBuffer();
+        CanvasFramebuffer createFramebuffer();
+        CanvasProgram createProgram();
+        CanvasRenderbuffer createRenderbuffer();
+        CanvasShader createShader(in unsigned long type);
+        CanvasTexture createTexture();
+
+        void         cullFace(in unsigned long mode);
+
+        void         deleteBuffer(in CanvasBuffer buffer);
+        void         deleteFramebuffer(in CanvasFramebuffer framebuffer);
+        void         deleteProgram(in CanvasProgram program);
+        void         deleteRenderbuffer(in CanvasRenderbuffer renderbuffer);
+        void         deleteShader(in CanvasShader shader);
+        void         deleteTexture(in CanvasTexture texture);
+
+        void         depthFunc(in unsigned long func);
+        void         depthMask(in boolean flag);
+        // FIXME: this differs from the current WebGL spec (depthRangef)
+        void         depthRange(in double zNear, in double zFar);
+        void         detachShader(in CanvasProgram program, in CanvasShader shader);
+        void         disable(in unsigned long cap);
+        void         disableVertexAttribArray(in unsigned long index);
+        void         drawArrays(in unsigned long mode, in long first, in unsigned long count);
+        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset);
+
+        void         enable(in unsigned long cap);
+        void         enableVertexAttribArray(in unsigned long index);
+        void         finish();
+        void         flush();
+        void         framebufferRenderbuffer(in unsigned long target, in unsigned long attachment, in unsigned long renderbuffertarget, in CanvasRenderbuffer renderbuffer);
+        void         framebufferTexture2D(in unsigned long target, in unsigned long attachment, in unsigned long textarget, in CanvasTexture texture, in long level);
+        void         frontFace(in unsigned long mode);
+        void         generateMipmap(in unsigned long target);
+        
+        // FIXME: these need to be added per the WebGL spec
+        // CanvasActiveInfo getActiveAttrib(GLuint program, GLuint index);
+        // CanvasActiveInfo getActiveUniform(GLuint program, GLuint index);
+        // CanvasShaderArray glGetAttachedShaders(GLuint program);
+
+        int          getAttribLocation(in CanvasProgram program, in DOMString name);
+
+        boolean getBoolean(in unsigned long pname);
+        CanvasUnsignedByteArray getBooleanv(in unsigned long pname);
+        long getBufferParameteri(in unsigned long target, in unsigned long pname);
+        CanvasIntArray getBufferParameteriv(in unsigned long target, in unsigned long pname);
+
+        unsigned long getError();
+
+        float getFloat(in unsigned long pname);
+        CanvasFloatArray getFloatv(in unsigned long pname);
+        long getFramebufferAttachmentParameteri(in unsigned long target, in unsigned long attachment, in unsigned long pname);
+        CanvasIntArray getFramebufferAttachmentParameteriv(in unsigned long target, in unsigned long attachment, in unsigned long pname);
+        long getInteger(in unsigned long pname);
+        CanvasIntArray getIntegerv(in unsigned long pname);
+        long getProgrami(in CanvasProgram program, in unsigned long pname);
+        CanvasIntArray getProgramiv(in CanvasProgram program, in unsigned long pname);
+        DOMString getProgramInfoLog(in CanvasProgram program);
+        long getRenderbufferParameteri(in unsigned long target, in unsigned long pname);
+        CanvasIntArray getRenderbufferParameteriv(in unsigned long target, in unsigned long pname);
+        long getShaderi(in CanvasShader shader, in unsigned long pname);
+        CanvasIntArray getShaderiv(in CanvasShader shader, in unsigned long pname);
+
+        DOMString    getShaderInfoLog(in CanvasShader shader);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        DOMString    getShaderSource(in CanvasShader shader);
+        DOMString    getString(in unsigned long name);
+
+        float getTexParameterf(in unsigned long target, in unsigned long pname);
+        CanvasFloatArray getTexParameterfv(in unsigned long target, in unsigned long pname);
+        long getTexParameteri(in unsigned long target, in unsigned long pname);
+        CanvasIntArray getTexParameteriv(in unsigned long target, in unsigned long pname);
+
+        float getUniformf(in CanvasProgram program, in long location);
+        CanvasFloatArray getUniformfv(in CanvasProgram program, in long location);
+        long getUniformi(in CanvasProgram program, in long location);
+        CanvasIntArray getUniformiv(in CanvasProgram program, in long location);
+        
+        long getUniformLocation(in CanvasProgram program, in DOMString name);
+
+        float getVertexAttribf(in unsigned long index, in unsigned long pname);
+        CanvasFloatArray getVertexAttribfv(in unsigned long index, in unsigned long pname);
+        long getVertexAttribi(in unsigned long index, in unsigned long pname);
+        CanvasIntArray getVertexAttribiv(in unsigned long index, in unsigned long pname);
+
+        long getVertexAttribOffset(in unsigned long index, in unsigned long pname);
+
+        void         hint(in unsigned long target, in unsigned long mode);
+        boolean      isBuffer(in CanvasBuffer buffer);
+        boolean      isEnabled(in unsigned long cap);
+        boolean      isFramebuffer(in CanvasFramebuffer framebuffer);
+        boolean      isProgram(in CanvasProgram program);
+        boolean      isRenderbuffer(in CanvasRenderbuffer renderbuffer);
+        boolean      isShader(in CanvasShader shader);
+        boolean      isTexture(in CanvasTexture texture);
+        void         lineWidth(in double width);
+        void         linkProgram(in CanvasProgram program);
+        void         pixelStorei(in unsigned long pname, in long param);
+        void         polygonOffset(in double factor, in double units);
+        
+        // FIXME
+        //void         readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type, void* pixels);
+        
+        void         releaseShaderCompiler();
+        void         renderbufferStorage(in unsigned long target, in unsigned long internalformat, in unsigned long width, in unsigned long height);
+        void         sampleCoverage(in double value, in boolean invert);
+        void         scissor(in long x, in long y, in unsigned long width, in unsigned long height);
+        void         shaderSource(in CanvasShader shader, in DOMString string);
+        void         stencilFunc(in unsigned long func, in long ref, in unsigned long mask);
+        void         stencilFuncSeparate(in unsigned long face, in unsigned long func, in long ref, in unsigned long mask);
+        void         stencilMask(in unsigned long mask);
+        void         stencilMaskSeparate(in unsigned long face, in unsigned long mask);
+        void         stencilOp(in unsigned long fail, in unsigned long zfail, in unsigned long zpass);
+        void         stencilOpSeparate(in unsigned long face, in unsigned long fail, in unsigned long zfail, in unsigned long zpass);
+
+        void         texParameterf(in unsigned long target, in unsigned long pname, in float param);
+        void         texParameteri(in unsigned long target, in unsigned long pname, in long param);
+
+        // Supported forms:
+        //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
+        //                   in GLint border, in GLenum format, in GLenum type, in CanvasArray pixels);
+        //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
+        //                   in GLint border, in GLenum format, in GLenum type, in ImageData pixels);
+        //   void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
+        //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texImage2D(in GLenum target, in GLint level, in HTMLCanvasElement canvas,
+        //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texImage2D(in GLenum target, in GLint level, in HTMLVideoElement video,
+        //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+        [Custom] void texImage2D();
+
+        // Supported forms:
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, 
+        //                      in GLenum format, in GLenum type, in CanvasArray pixels);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, 
+        //                      in GLenum format, in GLenum type, in ImageData pixels);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, in HTMLImageElement image,
+        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, in HTMLCanvasElement canvas,
+        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, in HTMLVideoElement video,
+        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        [Custom] void texSubImage2D();
+
+        void uniform1f(in long location, in float x);
+        [Custom] void uniform1fv(in long location, in CanvasFloatArray v);
+        void uniform1i(in long location, in long x);
+        [Custom] void uniform1iv(in long location, in CanvasIntArray v);
+        void uniform2f(in long location, in float x, in float y);
+        [Custom] void uniform2fv(in long location, in CanvasFloatArray v);
+        void uniform2i(in long location, in long x, in long y);
+        [Custom] void uniform2iv(in long location, in CanvasIntArray v);
+        void uniform3f(in long location, in float x, in float y, in float z);
+        [Custom] void uniform3fv(in long location, in CanvasFloatArray v);
+        void uniform3i(in long location, in long x, in long y, in long z);
+        [Custom] void uniform3iv(in long location, in CanvasIntArray v);
+        void uniform4f(in long location, in float x, in float y, in float z, in float w);
+        [Custom] void uniform4fv(in long location, in CanvasFloatArray v);
+        void uniform4i(in long location, in long x, in long y, in long z, in long w);
+        [Custom] void uniform4iv(in long location, in CanvasIntArray v);
+
+        [Custom] void uniformMatrix2fv(in long location, in boolean transpose, in CanvasFloatArray array);
+        [Custom] void uniformMatrix3fv(in long location, in boolean transpose, in CanvasFloatArray array);
+        [Custom] void uniformMatrix4fv(in long location, in boolean transpose, in CanvasFloatArray array);
+
+        void         useProgram(in CanvasProgram program);
+        void         validateProgram(in CanvasProgram program);
+
+        void         vertexAttrib1f(in unsigned long indx, in float x);
+        [Custom] void         vertexAttrib1fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttrib2f(in unsigned long indx, in float x, in float y);
+        [Custom] void         vertexAttrib2fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttrib3f(in unsigned long indx, in float x, in float y, in float z);
+        [Custom] void         vertexAttrib3fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttrib4f(in unsigned long indx, in float x, in float y, in float z, in float w);
+        [Custom] void         vertexAttrib4fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttribPointer(in unsigned long indx, in long size, in unsigned long type, in boolean normalized, 
+                                         in long stride, in unsigned long offset);
+
+        void         viewport(in long x, in long y, in unsigned long width, in unsigned long height);
+    };
+}
+
diff --git a/WebCore/html/canvas/CanvasShader.cpp b/WebCore/html/canvas/CanvasShader.cpp
new file mode 100644
index 0000000..7f134fa
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShader.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasShader.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasShader> CanvasShader::create(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+{
+    return adoptRef(new CanvasShader(ctx, type));
+}
+
+CanvasShader::CanvasShader(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createShader(type));
+}
+
+void CanvasShader::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteShader(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasShader.h b/WebCore/html/canvas/CanvasShader.h
new file mode 100644
index 0000000..bb7980e
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShader.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasShader_h
+#define CanvasShader_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasShader : public CanvasObject {
+    public:
+        virtual ~CanvasShader() { deleteObject(); }
+        
+        static PassRefPtr<CanvasShader> create(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+        
+    private:
+        CanvasShader(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasShader_h
diff --git a/WebCore/html/canvas/CanvasShader.idl b/WebCore/html/canvas/CanvasShader.idl
new file mode 100644
index 0000000..7474c3a
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShader.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasShader {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasShortArray.cpp b/WebCore/html/canvas/CanvasShortArray.cpp
new file mode 100644
index 0000000..d0cf135
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShortArray.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasShortArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasShortArray> CanvasShortArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(short));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasShortArray> CanvasShortArray::create(short* array, unsigned length)
+    {
+        RefPtr<CanvasShortArray> a = CanvasShortArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasShortArray> CanvasShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                          int offset,
+                                                          unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(short)) != 0)
+            return NULL;
+
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(short))) > buffer->byteLength())
+                return NULL;
+        }
+
+        return adoptRef(new CanvasShortArray(buffer, offset, length));
+    }
+    
+    CanvasShortArray::CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasShortArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasShortArray::sizeInBytes() const {
+        return length() * sizeof(short);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasShortArray.h b/WebCore/html/canvas/CanvasShortArray.h
new file mode 100644
index 0000000..00a170f
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShortArray.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasShortArray_h
+#define CanvasShortArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasShortArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasShortArray> create(unsigned length);
+        static PassRefPtr<CanvasShortArray> create(short* array, unsigned length);
+        static PassRefPtr<CanvasShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        short* data() { return static_cast<short*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<short>::min())
+                value = std::numeric_limits<short>::min();
+            else if (value > std::numeric_limits<short>::max())
+                value = std::numeric_limits<short>::max();
+            short* storage = static_cast<short*>(m_baseAddress);
+            storage[index] = static_cast<short>(value);
+        }
+        
+        bool get(unsigned index, short& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        short item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            short* storage = static_cast<short*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasShortArray_h
diff --git a/WebCore/html/canvas/CanvasShortArray.idl b/WebCore/html/canvas/CanvasShortArray.idl
new file mode 100644
index 0000000..6d64e1c
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShortArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasShortArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasTexture.cpp b/WebCore/html/canvas/CanvasTexture.cpp
new file mode 100644
index 0000000..624c275
--- /dev/null
+++ b/WebCore/html/canvas/CanvasTexture.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasTexture.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasTexture> CanvasTexture::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasTexture(ctx));
+}
+
+CanvasTexture::CanvasTexture(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+    , cubeMapRWrapModeInitialized(false)
+{
+    setObject(context()->graphicsContext3D()->createTexture());
+}
+
+void CanvasTexture::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteTexture(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasTexture.h b/WebCore/html/canvas/CanvasTexture.h
new file mode 100644
index 0000000..32a669a
--- /dev/null
+++ b/WebCore/html/canvas/CanvasTexture.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasTexture_h
+#define CanvasTexture_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasTexture : public CanvasObject {
+    public:
+        virtual ~CanvasTexture() { deleteObject(); }
+        
+        static PassRefPtr<CanvasTexture> create(CanvasRenderingContext3D*);
+    
+        bool isCubeMapRWrapModeInitialized() {
+            return cubeMapRWrapModeInitialized;
+        }
+
+        void setCubeMapRWrapModeInitialized(bool initialized) {
+            cubeMapRWrapModeInitialized = initialized;
+        }
+
+    protected:
+        CanvasTexture(CanvasRenderingContext3D*);
+
+        virtual void _deleteObject(Platform3DObject);
+
+    private:
+        bool cubeMapRWrapModeInitialized;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasTexture_h
diff --git a/WebCore/html/canvas/CanvasTexture.idl b/WebCore/html/canvas/CanvasTexture.idl
new file mode 100644
index 0000000..77eedd7
--- /dev/null
+++ b/WebCore/html/canvas/CanvasTexture.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasTexture {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.cpp b/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
new file mode 100644
index 0000000..a75066c
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedByteArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned char));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned char* array, unsigned length)
+    {
+        RefPtr<CanvasUnsignedByteArray> a = CanvasUnsignedByteArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                                        int offset,
+                                                                        unsigned length)
+    {
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned char))) > buffer->byteLength())
+                return NULL;
+        }
+
+        return adoptRef(new CanvasUnsignedByteArray(buffer, offset, length));
+    }
+    
+    CanvasUnsignedByteArray::CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasUnsignedByteArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasUnsignedByteArray::sizeInBytes() const {
+        return length() * sizeof(unsigned char);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.h b/WebCore/html/canvas/CanvasUnsignedByteArray.h
new file mode 100644
index 0000000..6293034
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedByteArray.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasUnsignedByteArray_h
+#define CanvasUnsignedByteArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasUnsignedByteArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned length);
+        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned char* array, unsigned length);
+        static PassRefPtr<CanvasUnsignedByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        unsigned char* data() { return static_cast<unsigned char*>(baseAddress()); }
+        
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<unsigned char>::min())
+                value = std::numeric_limits<unsigned char>::min();
+            else if (value > std::numeric_limits<unsigned char>::max())
+                value = std::numeric_limits<unsigned char>::max();
+            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+            storage[index] = static_cast<unsigned char>(value);
+        }
+        
+        bool get(unsigned index, unsigned char& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        unsigned char item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasUnsignedByteArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.idl b/WebCore/html/canvas/CanvasUnsignedByteArray.idl
new file mode 100644
index 0000000..d46f708
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedByteArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasUnsignedByteArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.cpp b/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
new file mode 100644
index 0000000..bd26343
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedIntArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned int));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned int* array, unsigned length)
+    {
+        RefPtr<CanvasUnsignedIntArray> a = CanvasUnsignedIntArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                                      int offset,
+                                                                      unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(unsigned int)) != 0) {
+            return NULL;
+        }
+
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned int))) > buffer->byteLength())
+                return NULL;
+        }
+
+        return adoptRef(new CanvasUnsignedIntArray(buffer, offset, length));
+    }
+    
+    CanvasUnsignedIntArray::CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasUnsignedIntArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasUnsignedIntArray::sizeInBytes() const {
+        return length() * sizeof(unsigned int);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.h b/WebCore/html/canvas/CanvasUnsignedIntArray.h
new file mode 100644
index 0000000..5b5994c
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedIntArray.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasUnsignedIntArray_h
+#define CanvasUnsignedIntArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasUnsignedIntArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned length);
+        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned int* array, unsigned length);
+        static PassRefPtr<CanvasUnsignedIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        unsigned int* data() { return static_cast<unsigned int*>(baseAddress()); }
+        
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<unsigned int>::min())
+                value = std::numeric_limits<unsigned int>::min();
+            else if (value > std::numeric_limits<unsigned int>::max())
+                value = std::numeric_limits<unsigned int>::max();
+            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+            storage[index] = static_cast<unsigned int>(value);
+        }
+        
+        bool get(unsigned index, unsigned int& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        unsigned int item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasUnsignedIntArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.idl b/WebCore/html/canvas/CanvasUnsignedIntArray.idl
new file mode 100644
index 0000000..3ab60d6
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedIntArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasUnsignedIntArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.cpp b/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
new file mode 100644
index 0000000..45d827b
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedShortArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned short));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned short* array, unsigned length)
+    {
+        RefPtr<CanvasUnsignedShortArray> a = CanvasUnsignedShortArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                                          int offset,
+                                                                          unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(unsigned short)) != 0) {
+            return NULL;
+        }
+
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned short))) > buffer->byteLength()) 
+                return NULL;
+        }
+
+        return adoptRef(new CanvasUnsignedShortArray(buffer, offset, length));
+    }
+    
+    CanvasUnsignedShortArray::CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                                         int offset,
+                                         unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasUnsignedShortArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasUnsignedShortArray::sizeInBytes() const {
+        return length() * sizeof(unsigned short);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.h b/WebCore/html/canvas/CanvasUnsignedShortArray.h
new file mode 100644
index 0000000..1f6252e
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedShortArray.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasUnsignedShortArray_h
+#define CanvasUnsignedShortArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasUnsignedShortArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned length);
+        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned short* array, unsigned length);
+        static PassRefPtr<CanvasUnsignedShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        unsigned short* data() { return static_cast<unsigned short*>(baseAddress()); }
+        
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<unsigned short>::min())
+                value = std::numeric_limits<unsigned short>::min();
+            else if (value > std::numeric_limits<unsigned short>::max())
+                value = std::numeric_limits<unsigned short>::max();
+            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+            storage[index] = static_cast<unsigned short>(value);
+        }
+        
+        bool get(unsigned index, unsigned short& result) const
+        {
+            if (index >= m_size)
+                return false;
+            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+            result = storage[index];
+            return true;
+        }
+        
+        unsigned short item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,int offset,unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasUnsignedShortArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.idl b/WebCore/html/canvas/CanvasUnsignedShortArray.idl
new file mode 100644
index 0000000..99fc6a2
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedShortArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasUnsignedShortArray : CanvasArray {
+    };
+}
diff --git a/WebCore/inspector/ConsoleMessage.cpp b/WebCore/inspector/ConsoleMessage.cpp
index f9d8708..6cfb75e 100644
--- a/WebCore/inspector/ConsoleMessage.cpp
+++ b/WebCore/inspector/ConsoleMessage.cpp
@@ -54,7 +54,9 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, S
     : m_source(s)
     , m_type(t)
     , m_level(l)
+#if ENABLE(INSPECTOR)
     , m_wrappedArguments(callStack->at(0).argumentCount())
+#endif
     , m_frames(storeTrace ? callStack->size() : 0)
     , m_groupLevel(g)
     , m_repeatCount(1)
@@ -71,10 +73,13 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, S
             m_frames[i] = callStack->at(i).functionName();
     }
 
+#if ENABLE(INSPECTOR)
     for (unsigned i = 0; i < lastCaller.argumentCount(); ++i)
         m_wrappedArguments[i] = quarantineValue(callStack->state(), lastCaller.argumentAt(i));
+#endif
 }
 
+#if ENABLE(INSPECTOR)
 void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
 {
     ScriptObject jsonObj = frontend->newScriptObject();
@@ -87,9 +92,11 @@ void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
     jsonObj.set("repeatCount", static_cast<int>(m_repeatCount));
     frontend->addMessageToConsole(jsonObj, m_frames, m_wrappedArguments,  m_message);
 }
+#endif // ENABLE(INSPECTOR)
 
 bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
 {
+#if ENABLE(INSPECTOR)
     if (msg->m_wrappedArguments.size() != m_wrappedArguments.size())
         return false;
     if (!state && msg->m_wrappedArguments.size())
@@ -101,6 +108,9 @@ bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
         if (!m_wrappedArguments[i].isEqual(state, msg->m_wrappedArguments[i]))
             return false;
     }
+#else
+    UNUSED_PARAM(state);
+#endif // ENABLE(INSPECTOR)
 
     size_t frameCount = msg->m_frames.size();
     if (frameCount != m_frames.size())
diff --git a/WebCore/inspector/ConsoleMessage.h b/WebCore/inspector/ConsoleMessage.h
index 910a007..d03f2b7 100644
--- a/WebCore/inspector/ConsoleMessage.h
+++ b/WebCore/inspector/ConsoleMessage.h
@@ -47,7 +47,9 @@ namespace WebCore {
         ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, unsigned li, const String& u, unsigned g);        
         ConsoleMessage(MessageSource, MessageType, MessageLevel, ScriptCallStack*, unsigned g, bool storeTrace = false);
 
+#if ENABLE(INSPECTOR)
         void addToConsole(InspectorFrontend* frontend);
+#endif
         void incrementCount() { ++m_repeatCount; };
         bool isEqual(ScriptState*, ConsoleMessage* msg) const;
 
@@ -59,7 +61,9 @@ namespace WebCore {
         MessageType m_type;
         MessageLevel m_level;
         String m_message;
+#if ENABLE(INSPECTOR)
         Vector<ScriptValue> m_wrappedArguments;
+#endif
         Vector<ScriptString> m_frames;
         unsigned m_line;
         String m_url;
diff --git a/WebCore/inspector/DOMDispatchTimelineItem.cpp b/WebCore/inspector/DOMDispatchTimelineItem.cpp
new file mode 100644
index 0000000..acff513
--- /dev/null
+++ b/WebCore/inspector/DOMDispatchTimelineItem.cpp
@@ -0,0 +1,58 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "DOMDispatchTimelineItem.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Event.h"
+#include "InspectorFrontend.h"
+
+namespace WebCore {
+
+DOMDispatchTimelineItem::DOMDispatchTimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, const Event& event)
+    : TimelineItem(previous, startTime, DOMDispatchTimelineItemType)
+    , m_eventType(event.type().string())
+{
+}
+
+ScriptObject DOMDispatchTimelineItem::convertToScriptObject(InspectorFrontend* frontend)
+{
+    ScriptObject selfObj = TimelineItem::convertToScriptObject(frontend);
+    ScriptObject dataObj = frontend->newScriptObject();
+    dataObj.set("type", m_eventType);
+    selfObj.set("data", dataObj);
+    return selfObj;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/DOMDispatchTimelineItem.h b/WebCore/inspector/DOMDispatchTimelineItem.h
new file mode 100644
index 0000000..384ce25
--- /dev/null
+++ b/WebCore/inspector/DOMDispatchTimelineItem.h
@@ -0,0 +1,58 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef DOMDispatchTimelineItem_h
+#define DOMDispatchTimelineItem_h
+
+#include "TimelineItem.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+    class Event;
+    class InspectorFrontend;
+
+    class DOMDispatchTimelineItem : public TimelineItem {
+    public:
+        DOMDispatchTimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, const Event&);
+
+        virtual ~DOMDispatchTimelineItem() { }
+
+    protected:
+        virtual ScriptObject convertToScriptObject(InspectorFrontend*);
+
+    private:
+        String m_eventType;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(DOMDispatchTimelineItem_h)
+
diff --git a/WebCore/inspector/InspectorBackend.cpp b/WebCore/inspector/InspectorBackend.cpp
index 1eb10e8..1273512 100644
--- a/WebCore/inspector/InspectorBackend.cpp
+++ b/WebCore/inspector/InspectorBackend.cpp
@@ -30,6 +30,12 @@
 #include "config.h"
 #include "InspectorBackend.h"
 
+#if ENABLE(INSPECTOR)
+
+#if ENABLE(DATABASE)
+#include "Database.h"
+#endif
+
 #include "Element.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -37,7 +43,15 @@
 #include "InspectorClient.h"
 #include "InspectorController.h"
 #include "InspectorDOMAgent.h"
+#include "InspectorFrontend.h"
 #include "InspectorResource.h"
+#include "Pasteboard.h"
+#include "ScriptArray.h"
+#include "ScriptFunctionCall.h"
+
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
@@ -45,6 +59,8 @@
 using namespace JSC;
 #endif
 
+#include "markup.h"
+
 #include <wtf/RefPtr.h>
 #include <wtf/StdLibExtras.h>
 
@@ -139,10 +155,10 @@ bool InspectorBackend::addSourceToFrame(const String& mimeType, const String& so
     return true;
 }
 
-void InspectorBackend::clearMessages()
+void InspectorBackend::clearMessages(bool clearUI)
 {
     if (m_inspectorController)
-        m_inspectorController->clearConsoleMessages();
+        m_inspectorController->clearConsoleMessages(clearUI);
 }
 
 void InspectorBackend::toggleNodeSearch()
@@ -182,10 +198,10 @@ bool InspectorBackend::searchingForNode()
     return false;
 }
 
-void InspectorBackend::loaded(bool enableDOMAgent)
+void InspectorBackend::loaded()
 {
     if (m_inspectorController)
-        m_inspectorController->scriptObjectReady(enableDOMAgent);
+        m_inspectorController->scriptObjectReady();
 }
 
 void InspectorBackend::enableResourceTracking(bool always)
@@ -242,9 +258,28 @@ const String& InspectorBackend::platform() const
     return platform;
 }
 
+void InspectorBackend::enableTimeline(bool always)
+{
+    if (m_inspectorController)
+        m_inspectorController->enableTimeline(always);
+}
+
+void InspectorBackend::disableTimeline(bool always)
+{
+    if (m_inspectorController)
+        m_inspectorController->disableTimeline(always);
+}
+
+bool InspectorBackend::timelineEnabled() const
+{
+    if (m_inspectorController)
+        return m_inspectorController->timelineEnabled();
+    return false;
+}
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 const ProfilesArray& InspectorBackend::profiles() const
-{    
+{
     if (m_inspectorController)
         return m_inspectorController->profiles();
     return m_emptyProfiles;
@@ -305,10 +340,16 @@ JavaScriptCallFrame* InspectorBackend::currentCallFrame() const
     return JavaScriptDebugServer::shared().currentCallFrame();
 }
 
-void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber)
+void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
+{
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber, condition);
+}
+
+void InspectorBackend::updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
 {
     intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber);
+    JavaScriptDebugServer::shared().updateBreakpoint(sourceIDValue, lineNumber, condition);
 }
 
 void InspectorBackend::removeBreakpoint(const String& sourceID, unsigned lineNumber)
@@ -355,34 +396,213 @@ void InspectorBackend::stepOutOfFunctionInDebugger()
 
 #endif
 
-void InspectorBackend::getChildNodes(long callId, long elementId)
+void InspectorBackend::dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async)
 {
-    if (m_inspectorController)
-        m_inspectorController->domAgent()->getChildNodes(callId, elementId);
+    InspectorFrontend* frontend = inspectorFrontend();
+    if (!frontend)
+        return;
+
+    ScriptFunctionCall function(m_inspectorController->m_scriptState, m_inspectorController->m_injectedScriptObj, "dispatch");
+    function.appendArgument(methodName);
+    function.appendArgument(arguments);
+    if (async)
+        function.appendArgument(static_cast<int>(callId));
+    bool hadException = false;
+    ScriptValue result = function.call(hadException);
+    if (async)
+        return;  // InjectedScript will return result asynchronously by means of ::reportDidDispatchOnInjectedScript.
+    if (hadException)
+        frontend->didDispatchOnInjectedScript(callId, "", true);
+    else
+        frontend->didDispatchOnInjectedScript(callId, result.toString(m_inspectorController->m_scriptState), false);
+}
+
+void InspectorBackend::getChildNodes(long callId, long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->getChildNodes(callId, nodeId);
 }
 
 void InspectorBackend::setAttribute(long callId, long elementId, const String& name, const String& value)
 {
-    if (m_inspectorController)
-        m_inspectorController->domAgent()->setAttribute(callId, elementId, name, value);
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->setAttribute(callId, elementId, name, value);
 }
 
 void InspectorBackend::removeAttribute(long callId, long elementId, const String& name)
 {
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->removeAttribute(callId, elementId, name);
+}
+
+void InspectorBackend::setTextNodeValue(long callId, long nodeId, const String& value)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->setTextNodeValue(callId, nodeId, value);
+}
+
+void InspectorBackend::getEventListenersForNode(long callId, long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->getEventListenersForNode(callId, nodeId);
+}
+
+void InspectorBackend::copyNode(long nodeId)
+{
+    Node* node = nodeForId(nodeId);
+    if (!node)
+        return;
+    String markup = createMarkup(node);
+    Pasteboard::generalPasteboard()->writePlainText(markup);
+}
+
+void InspectorBackend::getCookies(long callId, const String& domain)
+{
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->getCookies(callId, domain);
+}
+
+void InspectorBackend::deleteCookie(const String& cookieName, const String& domain)
+{
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->deleteCookie(cookieName, domain);
+}
+
+void InspectorBackend::highlight(long nodeId)
+{
+    if (Node* node = nodeForId(nodeId))
+        m_inspectorController->highlight(node);
+}
+
+Node* InspectorBackend::nodeForId(long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        return domAgent->nodeForId(nodeId);
+    return 0;
+}
+
+ScriptValue InspectorBackend::wrapObject(const ScriptValue& object, const String& objectGroup)
+{
     if (m_inspectorController)
-        m_inspectorController->domAgent()->removeAttribute(callId, elementId, name);
+        return m_inspectorController->wrapObject(object, objectGroup);
+    return ScriptValue();
 }
 
-void InspectorBackend::setTextNodeValue(long callId, long elementId, const String& value)
+ScriptValue InspectorBackend::unwrapObject(const String& objectId)
 {
     if (m_inspectorController)
-        m_inspectorController->domAgent()->setTextNodeValue(callId, elementId, value);
+        return m_inspectorController->unwrapObject(objectId);
+    return ScriptValue();
 }
 
-void InspectorBackend::highlight(Node* node)
+void InspectorBackend::releaseWrapperObjectGroup(const String& objectGroup)
 {
     if (m_inspectorController)
-        m_inspectorController->highlight(node);
+        m_inspectorController->releaseWrapperObjectGroup(objectGroup);
+}
+
+long InspectorBackend::pushNodePathToFrontend(Node* node, bool selectInUI)
+{
+    InspectorFrontend* frontend = inspectorFrontend();
+    InspectorDOMAgent* domAgent = inspectorDOMAgent();
+    if (!domAgent || !frontend)
+        return 0;
+    long id = domAgent->pushNodePathToFrontend(node);
+    if (selectInUI)
+        frontend->updateFocusedNode(id);
+    return id;
+}
+
+void InspectorBackend::addNodesToSearchResult(const String& nodeIds)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->addNodesToSearchResult(nodeIds);
+}
+
+#if ENABLE(DATABASE)
+Database* InspectorBackend::databaseForId(long databaseId)
+{
+    if (m_inspectorController)
+        return m_inspectorController->databaseForId(databaseId);
+    return 0;
+}
+
+void InspectorBackend::selectDatabase(Database* database)
+{
+    if (m_inspectorController)
+        m_inspectorController->selectDatabase(database);
+}
+
+void InspectorBackend::getDatabaseTableNames(long callId, long databaseId)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend()) {
+        ScriptArray result = frontend->newScriptArray();
+        Database* database = m_inspectorController->databaseForId(databaseId);
+        if (database) {
+            Vector<String> tableNames = database->tableNames();
+            unsigned length = tableNames.size();
+            for (unsigned i = 0; i < length; ++i)
+                result.set(i, tableNames[i]);
+        }
+        frontend->didGetDatabaseTableNames(callId, result);
+    }
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+void InspectorBackend::selectDOMStorage(Storage* storage)
+{
+    if (m_inspectorController)
+        m_inspectorController->selectDOMStorage(storage);
+}
+
+void InspectorBackend::getDOMStorageEntries(long callId, long storageId)
+{
+    if (m_inspectorController)
+        m_inspectorController->getDOMStorageEntries(callId, storageId);
+}
+
+void InspectorBackend::setDOMStorageItem(long callId, long storageId, const String& key, const String& value)
+{
+    if (m_inspectorController)
+        m_inspectorController->setDOMStorageItem(callId, storageId, key, value);
+}
+
+void InspectorBackend::removeDOMStorageItem(long callId, long storageId, const String& key)
+{
+    if (m_inspectorController)
+        m_inspectorController->removeDOMStorageItem(callId, storageId, key);
+}
+#endif
+
+void InspectorBackend::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
+{
+    if (m_inspectorController)
+        m_inspectorController->didEvaluateForTestInFrontend(callId, jsonResult);
+}
+
+void InspectorBackend::reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->didDispatchOnInjectedScript(callId, result, isException);
+}
+
+InspectorDOMAgent* InspectorBackend::inspectorDOMAgent()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->domAgent();
+}
+
+InspectorFrontend* InspectorBackend::inspectorFrontend()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->m_frontend.get();
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorBackend.h b/WebCore/inspector/InspectorBackend.h
index daa16b4..d7eea8c 100644
--- a/WebCore/inspector/InspectorBackend.h
+++ b/WebCore/inspector/InspectorBackend.h
@@ -38,10 +38,12 @@
 namespace WebCore {
 
 class CachedResource;
+class Database;
 class InspectorClient;
 class InspectorDOMAgent;
 class JavaScriptCallFrame;
 class Node;
+class Storage;
 
 class InspectorBackend : public RefCounted<InspectorBackend>
 {
@@ -69,7 +71,7 @@ public:
     void addResourceSourceToFrame(long identifier, Node* frame);
     bool addSourceToFrame(const String& mimeType, const String& source, Node* frame);
 
-    void clearMessages();
+    void clearMessages(bool clearUI);
 
     void toggleNodeSearch();
 
@@ -82,7 +84,7 @@ public:
 
     bool searchingForNode();
 
-    void loaded(bool enableDOMAgent);
+    void loaded();
 
     void enableResourceTracking(bool always);
     void disableResourceTracking(bool always);
@@ -93,6 +95,10 @@ public:
 
     const String& platform() const;
 
+    void enableTimeline(bool always);
+    void disableTimeline(bool always);
+    bool timelineEnabled() const;
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     const ProfilesArray& profiles() const;
 
@@ -109,7 +115,8 @@ public:
 
     JavaScriptCallFrame* currentCallFrame() const;
 
-    void addBreakpoint(const String& sourceID, unsigned lineNumber);
+    void addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
+    void updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
     void removeBreakpoint(const String& sourceID, unsigned lineNumber);
 
     bool pauseOnExceptions();
@@ -123,16 +130,43 @@ public:
     void stepOutOfFunctionInDebugger();
 #endif
 
-    void getChildNodes(long callId, long elementId);
+    void dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async);
+    void getChildNodes(long callId, long nodeId);
     void setAttribute(long callId, long elementId, const String& name, const String& value);
     void removeAttribute(long callId, long elementId, const String& name);
-    void setTextNodeValue(long callId, long elementId, const String& value);
+    void setTextNodeValue(long callId, long nodeId, const String& value);
+    void getEventListenersForNode(long callId, long nodeId);
+    void copyNode(long nodeId);
+
+    void getCookies(long callId, const String& domain);
+    void deleteCookie(const String& cookieName, const String& domain);
 
     // Generic code called from custom implementations.
-    void highlight(Node* node);
+    void highlight(long nodeId);
+    Node* nodeForId(long nodeId);
+    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
+    ScriptValue unwrapObject(const String& objectId);
+    void releaseWrapperObjectGroup(const String& objectGroup);
+    long pushNodePathToFrontend(Node* node, bool selectInUI);
+    void addNodesToSearchResult(const String& nodeIds);
+#if ENABLE(DATABASE)
+    Database* databaseForId(long databaseId);
+    void selectDatabase(Database* database);
+    void getDatabaseTableNames(long callId, long databaseId);
+#endif
+#if ENABLE(DOM_STORAGE)
+    void selectDOMStorage(Storage* storage);
+    void getDOMStorageEntries(long callId, long storageId);
+    void setDOMStorageItem(long callId, long storageId, const String& key, const String& value);
+    void removeDOMStorageItem(long callId, long storageId, const String& key);
+#endif
+    void reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException);
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
 
 private:
     InspectorBackend(InspectorController* inspectorController, InspectorClient* client);
+    InspectorDOMAgent* inspectorDOMAgent();
+    InspectorFrontend* inspectorFrontend();
 
     InspectorController* m_inspectorController;
     InspectorClient* m_client;
diff --git a/WebCore/inspector/InspectorBackend.idl b/WebCore/inspector/InspectorBackend.idl
index bae1f26..8803765 100644
--- a/WebCore/inspector/InspectorBackend.idl
+++ b/WebCore/inspector/InspectorBackend.idl
@@ -35,14 +35,14 @@ module core {
         GenerateConstructor
     ] InspectorBackend {
         void hideDOMNodeHighlight();
-        [Custom] void highlightDOMNode(in Node node);
-        void loaded(in boolean enableDOMAgent);
+        [Custom] void highlightDOMNode(in long nodeId);
+        void loaded();
         void windowUnloading();
         void attach();
         void detach();
 
         void closeWindow();
-        void clearMessages();
+        void clearMessages(in boolean clearUI);
         void toggleNodeSearch();
 
         boolean isWindowVisible();
@@ -52,14 +52,18 @@ module core {
         boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
         [Custom] void search(in Node node, in DOMString query);
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        [Custom] DOMObject databaseTableNames(in Database database);
+        void getDatabaseTableNames(in long callId, in long databaseId);
 #endif
+
         [Custom] DOMObject setting(in DOMString key);
         [Custom] void setSetting(in DOMString key, in DOMObject  value);
         [Custom] DOMWindow inspectedWindow();
         DOMString localizedStringsURL();
         DOMString hiddenPanels();
         DOMString platform();
+        void enableTimeline(in boolean always);
+        void disableTimeline(in boolean always);
+        boolean timelineEnabled();
         [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
         void setAttachedWindowHeight(in unsigned long height);
         [Custom] DOMObject wrapCallback(in DOMObject callback);
@@ -73,7 +77,8 @@ module core {
         void enableDebugger(in boolean always);
         void disableDebugger(in boolean always);
 
-        void addBreakpoint(in DOMString sourceID, in unsigned long lineNumber);
+        void addBreakpoint(in DOMString sourceID, in unsigned long lineNumber, in DOMString condition);
+        void updateBreakpoint(in DOMString sourceID, in unsigned long lineNumber, in DOMString condition);
         void removeBreakpoint(in DOMString sourceID, in unsigned long lineNumber);
 
         void pauseInDebugger();
@@ -97,9 +102,36 @@ module core {
 
         [Custom] Array profiles();
 #endif
-        void getChildNodes(in long callId, in long elementId);
+        void dispatchOnInjectedScript(in long callId, in DOMString methodName, in DOMString arguments, in boolean async);
+        void getChildNodes(in long callId, in long nodeId);
         void setAttribute(in long callId, in long elementId, in DOMString name, in DOMString value);
         void removeAttribute(in long callId, in long elementId, in DOMString name);
-        void setTextNodeValue(in long callId, in long elementId, in DOMString value);
+        void setTextNodeValue(in long callId, in long nodeId, in DOMString value);
+        void getEventListenersForNode(in long callId, in long nodeId);
+        void copyNode(in long nodeId);
+
+        void getCookies(in long callId, in DOMString domain);
+        void deleteCookie(in DOMString cookieName, in DOMString domain);
+
+        // Called from InjectedScript.
+        // TODO: extract into a separate IDL.
+        [Custom] DOMObject nodeForId(in long nodeId);
+        [Custom] long wrapObject(in DOMObject object, in DOMString objectGroup);
+        [Custom] DOMObject unwrapObject(in long objectId);
+        void releaseWrapperObjectGroup(in DOMString objectGroup);
+        [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean selectInUI);
+        void addNodesToSearchResult(in DOMString nodeIds);
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
+        [Custom] void selectDatabase(in DOMObject database);
+        [Custom] DOMObject databaseForId(in long databaseId);
+#endif
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
+        [Custom] void selectDOMStorage(in DOMObject storage);
+        void getDOMStorageEntries(in long callId, in long storageId);
+        void setDOMStorageItem(in long callId, in long storageId, in DOMString key, in DOMString value);
+        void removeDOMStorageItem(in long callId, in long storageId, in DOMString key);
+#endif
+        void reportDidDispatchOnInjectedScript(in long callId, in DOMString result, in boolean isException);
+        void didEvaluateForTestInFrontend(in long callId, in DOMString jsonResult);
     };
- }
+}
diff --git a/WebCore/inspector/InspectorController.cpp b/WebCore/inspector/InspectorController.cpp
index c3351e5..0922d7d 100644
--- a/WebCore/inspector/InspectorController.cpp
+++ b/WebCore/inspector/InspectorController.cpp
@@ -30,12 +30,17 @@
 #include "config.h"
 #include "InspectorController.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "CString.h"
 #include "CachedResource.h"
 #include "Console.h"
 #include "ConsoleMessage.h"
+#include "Cookie.h"
+#include "CookieJar.h"
 #include "Document.h"
 #include "DocumentLoader.h"
+#include "DOMWindow.h"
 #include "Element.h"
 #include "FloatConversion.h"
 #include "FloatQuad.h"
@@ -53,6 +58,7 @@
 #include "InspectorDatabaseResource.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorDOMStorageResource.h"
+#include "InspectorTimelineAgent.h"
 #include "InspectorResource.h"
 #include "JavaScriptProfile.h"
 #include "Page.h"
@@ -61,7 +67,9 @@
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "ScriptCallStack.h"
+#include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
+#include "ScriptObjectQuarantine.h"
 #include "ScriptString.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -69,6 +77,7 @@
 #include "TextEncoding.h"
 #include "TextIterator.h"
 #include <wtf/CurrentTime.h>
+#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/StdLibExtras.h>
 
@@ -103,6 +112,7 @@ static const char* const debuggerEnabledSettingName = "debuggerEnabled";
 static const char* const profilerEnabledSettingName = "profilerEnabled";
 static const char* const inspectorAttachedHeightName = "inspectorAttachedHeight";
 static const char* const lastActivePanelSettingName = "lastActivePanel";
+static const char* const timelineEnabledSettingName = "timelineEnabled";
 
 static const unsigned defaultAttachedHeight = 300;
 static const float minimumAttachedHeight = 250.0f;
@@ -125,6 +135,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* client)
     , m_resourceTrackingEnabled(false)
     , m_resourceTrackingSettingsLoaded(false)
     , m_inspectorBackend(InspectorBackend::create(this, client))
+    , m_lastBoundObjectId(1)
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     , m_debuggerEnabled(false)
     , m_attachDebuggerWhenShown(false)
@@ -170,11 +181,6 @@ void InspectorController::inspectedPageDestroyed()
     if (m_scriptState)
         ScriptGlobalObject::remove(m_scriptState, "InspectorController");
 
-    if (m_page) {
-        m_page->setParentInspectorController(0);
-        m_page = 0;
-    }
-
     ASSERT(m_inspectedPage);
     m_inspectedPage = 0;
 
@@ -258,8 +264,7 @@ void InspectorController::inspect(Node* node)
         return;
     }
 
-    if (windowVisible())
-        focusNode();
+    focusNode();
 }
 
 void InspectorController::focusNode()
@@ -270,7 +275,8 @@ void InspectorController::focusNode()
     ASSERT(m_frontend);
     ASSERT(m_nodeToFocus);
 
-    m_frontend->updateFocusedNode(m_nodeToFocus.get());
+    long id = m_domAgent->pushNodePathToFrontend(m_nodeToFocus.get());
+    m_frontend->updateFocusedNode(id);
     m_nodeToFocus = 0;
 }
 
@@ -298,14 +304,11 @@ bool InspectorController::windowVisible()
 
 void InspectorController::setWindowVisible(bool visible, bool attached)
 {
-    if (visible == m_windowVisible)
+    if (visible == m_windowVisible || !m_frontend)
         return;
 
     m_windowVisible = visible;
 
-    if (!m_frontend)
-        return;
-
     if (m_windowVisible) {
         setAttachedWindow(attached);
         populateScriptObjects();
@@ -374,16 +377,21 @@ void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMes
         m_consoleMessages.append(consoleMessage);
     }
 
-    if (windowVisible())
+    if (m_frontend)
         m_previousMessage->addToConsole(m_frontend.get());
 }
 
-void InspectorController::clearConsoleMessages()
+void InspectorController::clearConsoleMessages(bool clearUI)
 {
     deleteAllValues(m_consoleMessages);
     m_consoleMessages.clear();
     m_previousMessage = 0;
     m_groupLevel = 0;
+    releaseWrapperObjectGroup("console");
+    if (m_domAgent)
+        m_domAgent->releaseDanglingNodes();
+    if (clearUI && m_frontend)
+        m_frontend->clearConsoleMessages();
 }
 
 void InspectorController::startGroup(MessageSource source, ScriptCallStack* callStack)
@@ -494,10 +502,9 @@ void InspectorController::handleMousePressOnNode(Node* node)
 
 void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame)
 {
-    if (!enabled() || !m_frontend)
+    if (!enabled() || !m_frontend || frame != m_inspectedPage->mainFrame())
         return;
-
-    m_frontend->inspectedWindowScriptObjectCleared(frame);
+    resetInjectedScript();
 }
 
 void InspectorController::windowScriptObjectAvailable()
@@ -511,7 +518,7 @@ void InspectorController::windowScriptObjectAvailable()
     ScriptGlobalObject::set(m_scriptState, "InspectorController", m_inspectorBackend.get());
 }
 
-void InspectorController::scriptObjectReady(bool enableDOMAgent)
+void InspectorController::scriptObjectReady()
 {
     ASSERT(m_scriptState);
     if (!m_scriptState)
@@ -520,9 +527,10 @@ void InspectorController::scriptObjectReady(bool enableDOMAgent)
     ScriptObject webInspectorObj;
     if (!ScriptGlobalObject::get(m_scriptState, "WebInspector", webInspectorObj))
         return;
-    setFrontendProxyObject(m_scriptState, webInspectorObj);
-    if (enableDOMAgent)
-        m_domAgent = new InspectorDOMAgent(m_frontend.get());
+    ScriptObject injectedScriptObj;
+    if (!ScriptGlobalObject::get(m_scriptState, "InjectedScript", injectedScriptObj))
+        return;
+    setFrontendProxyObject(m_scriptState, webInspectorObj, injectedScriptObj);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     Setting debuggerEnabled = setting(debuggerEnabledSettingName);
@@ -539,9 +547,16 @@ void InspectorController::scriptObjectReady(bool enableDOMAgent)
     m_client->inspectorWindowObjectCleared();
 }
 
-void InspectorController::setFrontendProxyObject(ScriptState* scriptState, ScriptObject webInspectorObj)
+void InspectorController::setFrontendProxyObject(ScriptState* scriptState, ScriptObject webInspectorObj, ScriptObject injectedScriptObj)
 {
-    m_frontend.set(new InspectorFrontend(scriptState, webInspectorObj));
+    m_scriptState = scriptState;
+    m_injectedScriptObj = injectedScriptObj;
+    m_frontend.set(new InspectorFrontend(this, scriptState, webInspectorObj));
+    m_domAgent = new InspectorDOMAgent(m_frontend.get());
+
+    Setting timelineEnabled = setting(timelineEnabledSettingName);
+    if (m_timelineAgent.get() || (timelineEnabled.type() == Setting::BooleanType && timelineEnabled.booleanValue()))
+        m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
 }
 
 void InspectorController::show()
@@ -595,11 +610,17 @@ void InspectorController::close()
     closeWindow();
 
     m_frontend.set(0);
-    if (m_domAgent) {
+    m_injectedScriptObj = ScriptObject();
+    // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
+    // no references to the DOM agent from the DOM tree.
+    if (m_domAgent)
         m_domAgent->setDocument(0);
-        m_domAgent = 0;
-    }
+    m_domAgent = 0;
+    m_timelineAgent = 0;
     m_scriptState = 0;
+    if (m_page)
+        m_page->setParentInspectorController(0);
+    m_page = 0;
 }
 
 void InspectorController::showWindow()
@@ -630,28 +651,35 @@ void InspectorController::populateScriptObjects()
     if (!m_frontend)
         return;
 
+    m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
+
     ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
         it->second->createScriptObject(m_frontend.get());
-
+        m_frontend->addCookieDomain(it->second->frame()->document()->url().host());
+    }
+        
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
         m_consoleMessages[i]->addToConsole(m_frontend.get());
 
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        (*it)->bind(m_frontend.get());
+    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        it->second->bind(m_frontend.get());
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        (*it)->bind(m_frontend.get());
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        it->second->bind(m_frontend.get());
 #endif
 
-    if (m_domAgent)
-        m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
     m_frontend->populateInterface();
+
+    // Dispatch pending frontend commands
+    for (Vector<pair<long, String> >::iterator it = m_pendingEvaluateTestCommands.begin(); it != m_pendingEvaluateTestCommands.end(); ++it)
+        m_frontend->evaluateForTestInFrontend((*it).first, (*it).second);
+    m_pendingEvaluateTestCommands.clear();
 }
 
 void InspectorController::resetScriptObjects()
@@ -664,17 +692,23 @@ void InspectorController::resetScriptObjects()
         it->second->releaseScriptObject(m_frontend.get(), false);
 
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        (*it)->unbind();
+    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        it->second->unbind();
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        (*it)->unbind();
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        it->second->unbind();
 #endif
 
+    if (m_timelineAgent)
+        m_timelineAgent->reset();
+
     m_frontend->reset();
+    m_domAgent->setDocument(0);
+    m_objectGroups.clear();
+    m_idToWrappedObject.clear();
 }
 
 void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoader* loaderToKeep)
@@ -690,7 +724,7 @@ void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoad
 
         if (!loaderToKeep || !resource->isSameLoader(loaderToKeep)) {
             removeResource(resource);
-            if (windowVisible())
+            if (m_frontend)
                 resource->releaseScriptObject(m_frontend.get(), true);
         }
     }
@@ -706,7 +740,7 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
     if (loader->frame() == m_inspectedPage->mainFrame()) {
         m_client->inspectedURLChanged(loader->url().string());
 
-        clearConsoleMessages();
+        clearConsoleMessages(false);
 
         m_times.clear();
         m_counts.clear();
@@ -715,6 +749,9 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
         m_currentUserInitiatedProfileNumber = 1;
         m_nextUserInitiatedProfileNumber = 1;
 #endif
+        // resetScriptObjects should be called before database and DOM storage
+        // resources are cleared so that it has a chance to unbind them.
+        resetScriptObjects();
 #if ENABLE(DATABASE)
         m_databaseResources.clear();
 #endif
@@ -722,10 +759,8 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
         m_domStorageResources.clear();
 #endif
 
-        if (windowVisible()) {
-            resetScriptObjects();
-
-            if (!loader->isLoadingFromCachedPage()) {
+        if (m_frontend) {
+            if (!loader->frameLoader()->isLoadingFromCachedPage()) {
                 ASSERT(m_mainResource && m_mainResource->isSameLoader(loader));
                 // We don't add the main resource until its load is committed. This is
                 // needed to keep the load for a user-entered URL from showing up in the
@@ -738,10 +773,11 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
                 // identifierForInitialRequest.
                 m_mainResource = 0;
             }
+            if (windowVisible()) {
+                m_frontend->didCommitLoad();
+                m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
+            }
         }
-
-        if (m_domAgent)
-            m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
     }
 
     for (Frame* frame = loader->frame(); frame; frame = frame->tree()->traverseNext(loader->frame()))
@@ -819,7 +855,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
         return;
 
     ASSERT(m_inspectedPage);
-    bool isMainResource = isMainResourceLoader(loader, KURL(cachedResource->url()));
+    bool isMainResource = isMainResourceLoader(loader, KURL(ParsedURLString, cachedResource->url()));
     ensureResourceTrackingSettingsLoaded();
     if (!isMainResource && !m_resourceTrackingEnabled)
         return;
@@ -833,7 +869,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
 
     addResource(resource.get());
 
-    if (windowVisible())
+    if (m_frontend)
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -859,10 +895,28 @@ void InspectorController::identifierForInitialRequest(unsigned long identifier,
 
     addResource(resource.get());
 
-    if (windowVisible() && loader->isLoadingFromCachedPage() && resource == m_mainResource)
+    if (m_frontend && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
         resource->createScriptObject(m_frontend.get());
 }
 
+void InspectorController::mainResourceFiredDOMContentEvent(DocumentLoader* loader, const KURL& url)
+{
+    if (!enabled() || !isMainResourceLoader(loader, url))
+        return;
+
+    if (m_mainResource)
+        m_mainResource->markDOMContentEventTime();
+}
+
+void InspectorController::mainResourceFiredLoadEvent(DocumentLoader* loader, const KURL& url)
+{
+    if (!enabled() || !isMainResourceLoader(loader, url))
+        return;
+
+    if (m_mainResource)
+        m_mainResource->markLoadEventTime();
+}
+
 bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
 {
     return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
@@ -881,7 +935,7 @@ void InspectorController::willSendRequest(DocumentLoader*, unsigned long identif
         resource->updateResponse(redirectResponse);
     }
 
-    if (resource != m_mainResource && windowVisible())
+    if (resource != m_mainResource && m_frontend)
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -894,7 +948,7 @@ void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long iden
     resource->updateResponse(response);
     resource->markResponseReceivedTime();
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -906,7 +960,7 @@ void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long
 
     resource->addLength(lengthReceived);
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -922,8 +976,10 @@ void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identi
 
     addResource(resource.get());
 
-    if (windowVisible())
+    if (m_frontend) {
         resource->updateScriptObject(m_frontend.get());
+        m_frontend->addCookieDomain(resource->frame()->document()->url().host());
+    }
 }
 
 void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& /*error*/)
@@ -939,7 +995,7 @@ void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifi
 
     addResource(resource.get());
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -954,7 +1010,7 @@ void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identi
 
     resource->setXMLHttpResponseText(sourceString);
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -971,7 +1027,7 @@ void InspectorController::scriptImported(unsigned long identifier, const String&
     // thing by the Inspector. They should be made into distinct types.
     resource->setXMLHttpResponseText(ScriptString(sourceString));
     
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -1019,7 +1075,68 @@ void InspectorController::ensureResourceTrackingSettingsLoaded()
         m_resourceTrackingEnabled = true;
 }
 
+void InspectorController::enableTimeline(bool always)
+{
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(timelineEnabledSettingName, Setting(true));
+
+    if (m_timelineAgent.get())
+        return;
+
+    m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
+    if (m_frontend)
+        m_frontend->timelineWasEnabled();
+}
+
+void InspectorController::disableTimeline(bool always)
+{
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(timelineEnabledSettingName, Setting(false));
+
+    if (!m_timelineAgent.get())
+        return;
+
+    m_timelineAgent.set(0);
+    if (m_frontend)
+        m_frontend->timelineWasDisabled();
+}
+
+bool InspectorController::timelineEnabled() const
+{
+    if (!enabled())
+        return false;
+
+    return m_timelineAgent.get();
+}
+
 #if ENABLE(DATABASE)
+void InspectorController::selectDatabase(Database* database)
+{
+    if (!m_frontend)
+        return;
+
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != m_databaseResources.end(); ++it) {
+        if (it->second->database() == database) {
+            m_frontend->selectDatabase(it->first);
+            break;
+        }
+    }
+}
+
+Database* InspectorController::databaseForId(int databaseId)
+{
+    DatabaseResourcesMap::iterator it = m_databaseResources.find(databaseId);
+    if (it == m_databaseResources.end())
+        return 0;
+    return it->second->database();
+}
+
 void InspectorController::didOpenDatabase(Database* database, const String& domain, const String& name, const String& version)
 {
     if (!enabled())
@@ -1027,31 +1144,182 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
 
     RefPtr<InspectorDatabaseResource> resource = InspectorDatabaseResource::create(database, domain, name, version);
 
-    m_databaseResources.add(resource);
+    m_databaseResources.set(resource->id(), resource);
 
-    if (windowVisible())
+    // Resources are only bound while visible.
+    if (m_frontend && windowVisible())
         resource->bind(m_frontend.get());
 }
 #endif
 
+void InspectorController::getCookies(long callId, const String& host)
+{
+    if (!m_frontend)
+        return;
+    
+    // If we can get raw cookies.
+    ListHashSet<Cookie> rawCookiesList;
+    
+    // If we can't get raw cookies - fall back to String representation
+    String stringCookiesList;
+    
+    // Return value to getRawCookies should be the same for every call because
+    // the return value is platform/network backend specific, and the call will
+    // always return the same true/false value.
+    bool rawCookiesImplemented = false;
+    
+    ResourcesMap::iterator resourcesEnd = m_resources.end();
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+        Document* document = it->second->frame()->document();
+        if (document->url().host() == host) {
+            Vector<Cookie> docCookiesList;
+            rawCookiesImplemented = getRawCookies(document, document->cookieURL(), docCookiesList);
+            
+            if (!rawCookiesImplemented)
+                // FIXME: We need duplication checking for the String representation of cookies.
+                stringCookiesList += document->cookie();
+            else {
+                int cookiesSize = docCookiesList.size();
+                for (int i = 0; i < cookiesSize; i++) {
+                    if (!rawCookiesList.contains(docCookiesList[i]))
+                        rawCookiesList.add(docCookiesList[i]);
+                }
+            }
+        }
+    }
+    
+    if (!rawCookiesImplemented)
+        m_frontend->didGetCookies(callId, m_frontend->newScriptArray(), stringCookiesList);
+    else
+        m_frontend->didGetCookies(callId, buildArrayForCookies(rawCookiesList), String());
+}
+    
+ScriptArray InspectorController::buildArrayForCookies(ListHashSet<Cookie>& cookiesList)
+{
+    ScriptArray cookies = m_frontend->newScriptArray();
+
+    ListHashSet<Cookie>::iterator end = cookiesList.end();
+    ListHashSet<Cookie>::iterator it = cookiesList.begin();
+    for (int i = 0; it != end; ++it, i++)
+        cookies.set(i, buildObjectForCookie(*it));
+
+    return cookies;
+}
+
+ScriptObject InspectorController::buildObjectForCookie(const Cookie& cookie)
+{
+    ScriptObject value = m_frontend->newScriptObject();
+    value.set("name", cookie.name);
+    value.set("value", cookie.value);
+    value.set("domain", cookie.domain);
+    value.set("path", cookie.path);
+    value.set("expires", cookie.expires);
+    value.set("size", (cookie.name.length() + cookie.value.length()));
+    value.set("httpOnly", cookie.httpOnly);
+    value.set("secure", cookie.secure);
+    value.set("session", cookie.session);
+    return value;
+}
+    
 #if ENABLE(DOM_STORAGE)
 void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame)
 {
     if (!enabled())
         return;
 
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        if ((*it)->isSameHostAndType(frame, isLocalStorage))
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        if (it->second->isSameHostAndType(frame, isLocalStorage))
             return;
 
     RefPtr<Storage> domStorage = Storage::create(frame, storageArea);
     RefPtr<InspectorDOMStorageResource> resource = InspectorDOMStorageResource::create(domStorage.get(), isLocalStorage, frame);
 
-    m_domStorageResources.add(resource);
-    if (windowVisible())
+    m_domStorageResources.set(resource->id(), resource);
+
+    // Resources are only bound while visible.
+    if (m_frontend && windowVisible())
         resource->bind(m_frontend.get());
 }
+
+void InspectorController::selectDOMStorage(Storage* storage)
+{
+    ASSERT(storage);
+    if (!m_frontend)
+        return;
+
+    Frame* frame = storage->frame();
+    bool isLocalStorage = (frame->domWindow()->localStorage() == storage);
+    int storageResourceId = 0;
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it) {
+        if (it->second->isSameHostAndType(frame, isLocalStorage)) {
+            storageResourceId = it->first;
+            break;
+        }
+    }
+    if (storageResourceId)
+        m_frontend->selectDOMStorage(storageResourceId);
+}
+
+void InspectorController::getDOMStorageEntries(int callId, int storageId)
+{
+    if (!m_frontend)
+        return;
+
+    ScriptArray jsonArray = m_frontend->newScriptArray();
+    InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
+    if (storageResource) {
+        storageResource->startReportingChangesToFrontend();
+        Storage* domStorage = storageResource->domStorage();
+        for (unsigned i = 0; i < domStorage->length(); ++i) {
+            String name(domStorage->key(i));
+            String value(domStorage->getItem(name));
+            ScriptArray entry = m_frontend->newScriptArray();
+            entry.set(0, name);
+            entry.set(1, value);
+            jsonArray.set(i, entry);
+        }
+    }
+    m_frontend->didGetDOMStorageEntries(callId, jsonArray);
+}
+
+void InspectorController::setDOMStorageItem(long callId, long storageId, const String& key, const String& value)
+{
+    if (!m_frontend)
+        return;
+
+    bool success = false;
+    InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
+    if (storageResource) {
+        ExceptionCode exception = 0;
+        storageResource->domStorage()->setItem(key, value, exception);
+        success = (exception == 0);
+    }
+    m_frontend->didSetDOMStorageItem(callId, success);
+}
+
+void InspectorController::removeDOMStorageItem(long callId, long storageId, const String& key)
+{
+    if (!m_frontend)
+        return;
+
+    bool success = false;
+    InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
+    if (storageResource) {
+        storageResource->domStorage()->removeItem(key);
+        success = true;
+    }
+    m_frontend->didRemoveDOMStorageItem(callId, success);
+}
+
+InspectorDOMStorageResource* InspectorController::getDOMStorageResourceForId(int storageId)
+{
+    DOMStorageResourcesMap::iterator it = m_domStorageResources.find(storageId);
+    if (it == m_domStorageResources.end())
+        return 0;
+    return it->second.get();
+}
 #endif
 
 void InspectorController::moveWindowBy(float x, float y) const
@@ -1073,8 +1341,10 @@ void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned li
     RefPtr<Profile> profile = prpProfile;
     m_profiles.append(profile);
 
-    if (windowVisible())
-        addScriptProfile(profile.get());
+    if (m_frontend) {
+        JSLock lock(SilenceAssertionsOnly);
+        m_frontend->addProfile(toJS(m_scriptState, profile.get()));
+    }
 
     addProfileFinishedMessageToConsole(profile, lineNumber, sourceURL);
 }
@@ -1099,15 +1369,6 @@ void InspectorController::addStartProfilingMessageToConsole(const UString& title
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
-void InspectorController::addScriptProfile(Profile* profile)
-{
-    if (!m_frontend)
-        return;
-
-    JSLock lock(SilenceAssertionsOnly);
-    m_frontend->addProfile(toJS(m_scriptState, profile));
-}
-
 UString InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
 {
     if (incrementProfileNumber)
@@ -1274,7 +1535,9 @@ void InspectorController::failedToParseSource(ExecState*, const SourceCode& sour
 
 void InspectorController::didPause()
 {
-    m_frontend->pausedScript();
+    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "getCallFrames");
+    ScriptValue callFrames = function.call();
+    m_frontend->pausedScript(callFrames);
 }
 
 void InspectorController::didContinue()
@@ -1284,6 +1547,25 @@ void InspectorController::didContinue()
 
 #endif
 
+void InspectorController::evaluateForTestInFrontend(long callId, const String& script)
+{
+    if (m_frontend && windowVisible())
+        m_frontend->evaluateForTestInFrontend(callId, script);
+    else
+        m_pendingEvaluateTestCommands.append(pair<long, String>(callId, script));
+}
+
+void InspectorController::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
+{
+    ScriptState* scriptState = scriptStateFromPage(m_inspectedPage);
+    ScriptObject window;
+    ScriptGlobalObject::get(scriptState, "window", window);
+    ScriptFunctionCall function(scriptState, window, "didEvaluateForTestInFrontend");
+    function.appendArgument(static_cast<int>(callId));
+    function.appendArgument(jsonResult);
+    function.call();
+}
+
 static Path quadToPath(const FloatQuad& quad)
 {
     Path quadPath;
@@ -1472,10 +1754,66 @@ InspectorController::SpecialPanels InspectorController::specialPanelForJSName(co
         return ScriptsPanel;
     else if (panelName == "profiles")
         return ProfilesPanel;
-    else if (panelName == "databases")
-        return DatabasesPanel;
+    else if (panelName == "storage" || panelName == "databases")
+        return StoragePanel;
     else
         return ElementsPanel;
 }
 
+ScriptValue InspectorController::wrapObject(const ScriptValue& quarantinedObject, const String& objectGroup)
+{
+    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "createProxyObject");
+    function.appendArgument(quarantinedObject);
+    if (quarantinedObject.isObject()) {
+        long id = m_lastBoundObjectId++;
+        String objectId = String::format("object#%ld", id);
+        m_idToWrappedObject.set(objectId, quarantinedObject);
+        ObjectGroupsMap::iterator it = m_objectGroups.find(objectGroup);
+        if (it == m_objectGroups.end())
+            it = m_objectGroups.set(objectGroup, Vector<String>()).first;
+        it->second.append(objectId);
+        function.appendArgument(objectId);
+    }
+    ScriptValue wrapper = function.call();
+    return wrapper;
+}
+
+ScriptValue InspectorController::unwrapObject(const String& objectId)
+{
+    HashMap<String, ScriptValue>::iterator it = m_idToWrappedObject.find(objectId);
+    if (it != m_idToWrappedObject.end())
+        return it->second;
+    return ScriptValue();
+}
+
+void InspectorController::releaseWrapperObjectGroup(const String& objectGroup)
+{
+    ObjectGroupsMap::iterator groupIt = m_objectGroups.find(objectGroup);
+    if (groupIt == m_objectGroups.end())
+        return;
+
+    Vector<String>& groupIds = groupIt->second;
+    for (Vector<String>::iterator it = groupIds.begin(); it != groupIds.end(); ++it)
+        m_idToWrappedObject.remove(*it);
+    m_objectGroups.remove(groupIt);
+}
+
+void InspectorController::resetInjectedScript()
+{
+    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "reset");
+    function.call();
+}
+
+void InspectorController::deleteCookie(const String& cookieName, const String& domain)
+{
+    ResourcesMap::iterator resourcesEnd = m_resources.end();
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+        Document* document = it->second->frame()->document();
+        if (document->url().host() == domain)
+            WebCore::deleteCookie(document, document->cookieURL(), cookieName);
+    }
+}
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorController.h b/WebCore/inspector/InspectorController.h
index 632b0ce..6c6fcfb 100644
--- a/WebCore/inspector/InspectorController.h
+++ b/WebCore/inspector/InspectorController.h
@@ -30,13 +30,18 @@
 #define InspectorController_h
 
 #include "Console.h"
+#include "Cookie.h"
 #include "PlatformString.h"
+#include "ScriptArray.h"
+#include "ScriptObject.h"
 #include "ScriptState.h"
+#include "ScriptValue.h"
 #include "StringHash.h"
 #include "Timer.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
@@ -59,8 +64,12 @@ class GraphicsContext;
 class HitTestResult;
 class InspectorClient;
 class InspectorDOMAgent;
+<<<<<<< HEAD:WebCore/inspector/InspectorController.h
+=======
+class InspectorFrontend;
+class InspectorTimelineAgent;
+>>>>>>> webkit.org at 49305:WebCore/inspector/InspectorController.h
 class JavaScriptCallFrame;
-class StorageArea;
 class KURL;
 class Node;
 class Page;
@@ -68,9 +77,10 @@ struct ResourceRequest;
 class ResourceResponse;
 class ResourceError;
 class ScriptCallStack;
-class ScriptObject;
 class ScriptString;
 class SharedBuffer;
+class Storage;
+class StorageArea;
 
 class ConsoleMessage;
 class InspectorDatabaseResource;
@@ -90,17 +100,18 @@ class InspectorController
 public:
     typedef HashMap<long long, RefPtr<InspectorResource> > ResourcesMap;
     typedef HashMap<RefPtr<Frame>, ResourcesMap*> FrameResourcesMap;
-    typedef HashSet<RefPtr<InspectorDatabaseResource> > DatabaseResourcesSet;
-    typedef HashSet<RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesSet;
+    typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
+    typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
+    typedef HashMap<String, Vector<String> > ObjectGroupsMap;
 
     typedef enum {
         CurrentPanel,
         ConsolePanel,
-        DatabasesPanel,
         ElementsPanel,
         ProfilesPanel,
         ResourcesPanel,
-        ScriptsPanel
+        ScriptsPanel,
+        StoragePanel
     } SpecialPanels;
 
     struct Setting {
@@ -187,7 +198,7 @@ public:
 
     void addMessageToConsole(MessageSource, MessageType, MessageLevel, ScriptCallStack*);
     void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID);
-    void clearConsoleMessages();
+    void clearConsoleMessages(bool clearUI);
     const Vector<ConsoleMessage*>& consoleMessages() const { return m_consoleMessages; }
 
     void attachWindow();
@@ -201,7 +212,8 @@ public:
     void inspectedWindowScriptObjectCleared(Frame*);
     void windowScriptObjectAvailable();
 
-    void setFrontendProxyObject(ScriptState* state, ScriptObject object);
+    void setFrontendProxyObject(ScriptState* state, ScriptObject webInspectorObj, ScriptObject injectedScriptObj = ScriptObject());
+    ScriptState* frontendScriptState() const { return m_scriptState; }
 
     void populateScriptObjects();
     void resetScriptObjects();
@@ -225,11 +237,25 @@ public:
     bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
     void ensureResourceTrackingSettingsLoaded();
 
+    void enableTimeline(bool always = false);
+    void disableTimeline(bool always = false);
+    bool timelineEnabled() const;
+    InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
+
+    void mainResourceFiredLoadEvent(DocumentLoader*, const KURL&);
+    void mainResourceFiredDOMContentEvent(DocumentLoader*, const KURL&);
+                                                        
+    void getCookies(long callId, const String& url);
+
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
 #endif
 #if ENABLE(DOM_STORAGE)
     void didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame);
+    void selectDOMStorage(Storage* storage);
+    void getDOMStorageEntries(int callId, int storageId);
+    void setDOMStorageItem(long callId, long storageId, const String& key, const String& value);
+    void removeDOMStorageItem(long callId, long storageId, const String& key);
 #endif
 
     const ResourcesMap& resources() const { return m_resources; }
@@ -248,7 +274,6 @@ public:
     void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addProfileFinishedMessageToConsole(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addStartProfilingMessageToConsole(const JSC::UString& title, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addScriptProfile(JSC::Profile*);
     const ProfilesArray& profiles() const { return m_profiles; }
 
     bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
@@ -273,13 +298,18 @@ public:
     virtual void didContinue();
 #endif
 
+    void evaluateForTestInFrontend(long callId, const String& script);
+
 private:
 #if !PLATFORM(ANDROID)
     friend class InspectorBackend;
+<<<<<<< HEAD:WebCore/inspector/InspectorController.h
 #endif
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/inspector/InspectorController.h
     // Following are used from InspectorBackend and internally.
-    void scriptObjectReady(bool enableDOMAgent);
+    void scriptObjectReady();
     void moveWindowBy(float x, float y) const;
     void setAttachedWindow(bool);
     void setAttachedWindowHeight(unsigned height);
@@ -287,11 +317,33 @@ private:
     void closeWindow();
     InspectorDOMAgent* domAgent() { return m_domAgent.get(); }
 
+    friend class InspectorFrontend;
+    // Following are used from InspectorFrontend only. We don't want to expose them to the
+    // rest of the InspectorController clients.
+    // TODO: extract these into a separate interface.
+    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
+    ScriptValue unwrapObject(const String& objectId);
+    void releaseWrapperObjectGroup(const String& objectGroup);
+    
+    void resetInjectedScript();
+
+    void deleteCookie(const String& cookieName, const String& domain);
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     void startUserInitiatedProfilingSoon();
     void toggleRecordButton(bool);
     void enableDebuggerFromFrontend(bool always);
 #endif
+#if ENABLE(DATABASE)
+    void selectDatabase(Database* database);
+    Database* databaseForId(int databaseId);
+#endif
+#if ENABLE(DOM_STORAGE)
+    InspectorDOMStorageResource* getDOMStorageResourceForId(int storageId);
+#endif
+                                                        
+    ScriptObject buildObjectForCookie(const Cookie&);
+    ScriptArray buildArrayForCookies(ListHashSet<Cookie>&);
 
     void focusNode();
 
@@ -310,10 +362,14 @@ private:
 
     SpecialPanels specialPanelForJSName(const String& panelName);
 
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
+
     Page* m_inspectedPage;
     InspectorClient* m_client;
 
     RefPtr<InspectorDOMAgent> m_domAgent;
+    OwnPtr<InspectorTimelineAgent> m_timelineAgent;
+    ScriptObject m_injectedScriptObj;
     Page* m_page;
     RefPtr<Node> m_nodeToFocus;
     RefPtr<InspectorResource> m_mainResource;
@@ -324,10 +380,10 @@ private:
     HashMap<String, double> m_times;
     HashMap<String, unsigned> m_counts;
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet m_databaseResources;
+    DatabaseResourcesMap m_databaseResources;
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet m_domStorageResources;
+    DOMStorageResourcesMap m_domStorageResources;
 #endif
     ScriptState* m_scriptState;
     bool m_windowVisible;
@@ -342,7 +398,15 @@ private:
 #if !PLATFORM(ANDROID)
     OwnPtr<InspectorFrontend> m_frontend;
     RefPtr<InspectorBackend> m_inspectorBackend;
+<<<<<<< HEAD:WebCore/inspector/InspectorController.h
 #endif
+=======
+    HashMap<String, ScriptValue> m_idToWrappedObject;
+    ObjectGroupsMap m_objectGroups;
+
+    long m_lastBoundObjectId;
+    Vector<pair<long, String> > m_pendingEvaluateTestCommands;
+>>>>>>> webkit.org at 49305:WebCore/inspector/InspectorController.h
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     bool m_debuggerEnabled;
     bool m_attachDebuggerWhenShown;
diff --git a/WebCore/inspector/InspectorDOMAgent.cpp b/WebCore/inspector/InspectorDOMAgent.cpp
index f222239..f6c2d46 100644
--- a/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/WebCore/inspector/InspectorDOMAgent.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,7 +31,12 @@
 #include "config.h"
 #include "InspectorDOMAgent.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "AtomicString.h"
+#include "ContainerNode.h"
+#include "Cookie.h"
+#include "CookieJar.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "Event.h"
@@ -44,6 +50,7 @@
 #include "Node.h"
 #include "NodeList.h"
 #include "PlatformString.h"
+#include "ScriptEventListener.h"
 #include "ScriptObject.h"
 #include "Text.h"
 
@@ -53,7 +60,8 @@
 namespace WebCore {
 
 InspectorDOMAgent::InspectorDOMAgent(InspectorFrontend* frontend)
-    : m_frontend(frontend)
+    : EventListener(InspectorDOMAgentType)
+    , m_frontend(frontend)
     , m_lastNodeId(1)
 {
 }
@@ -67,6 +75,7 @@ void InspectorDOMAgent::setDocument(Document* doc)
 {
     if (doc == mainFrameDocument())
         return;
+    discardBindings();
 
     ListHashSet<RefPtr<Document> > copy = m_documents;
     for (ListHashSet<RefPtr<Document> >::iterator it = copy.begin(); it != copy.end(); ++it)
@@ -77,13 +86,17 @@ void InspectorDOMAgent::setDocument(Document* doc)
     if (doc) {
         startListening(doc);
         if (doc->documentElement()) {
-            pushDocumentElementToFrontend();
+            pushDocumentToFrontend();
         }
-    } else {
-        discardBindings();
     }
 }
 
+void InspectorDOMAgent::releaseDanglingNodes()
+{
+    deleteAllValues(m_danglingNodeToIdMaps);
+    m_danglingNodeToIdMaps.clear();
+}
+
 void InspectorDOMAgent::startListening(Document* doc)
 {
     if (m_documents.contains(doc))
@@ -92,8 +105,8 @@ void InspectorDOMAgent::startListening(Document* doc)
     doc->addEventListener(eventNames().DOMContentLoadedEvent, this, false);
     doc->addEventListener(eventNames().DOMNodeInsertedEvent, this, false);
     doc->addEventListener(eventNames().DOMNodeRemovedEvent, this, false);
-    doc->addEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, this, true);
     doc->addEventListener(eventNames().DOMAttrModifiedEvent, this, false);
+    doc->addEventListener(eventNames().loadEvent, this, true);
     m_documents.add(doc);
 }
 
@@ -105,24 +118,18 @@ void InspectorDOMAgent::stopListening(Document* doc)
     doc->removeEventListener(eventNames().DOMContentLoadedEvent, this, false);
     doc->removeEventListener(eventNames().DOMNodeInsertedEvent, this, false);
     doc->removeEventListener(eventNames().DOMNodeRemovedEvent, this, false);
-    doc->removeEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, this, true);
     doc->removeEventListener(eventNames().DOMAttrModifiedEvent, this, false);
+    doc->removeEventListener(eventNames().loadEvent, this, true);
     m_documents.remove(doc);
 }
 
-void InspectorDOMAgent::handleEvent(Event* event, bool)
+void InspectorDOMAgent::handleEvent(ScriptExecutionContext*, Event* event)
 {
     AtomicString type = event->type();
     Node* node = event->target()->toNode();
 
-    // Remove mapping entry if necessary.
-    if (type == eventNames().DOMNodeRemovedFromDocumentEvent) {
-        unbind(node);
-        return;
-    }
-
     if (type == eventNames().DOMAttrModifiedEvent) {
-        long id = idForNode(node);
+        long id = m_documentNodeToIdMap.get(node);
         // If node is not mapped yet -> ignore the event.
         if (!id)
             return;
@@ -133,20 +140,23 @@ void InspectorDOMAgent::handleEvent(Event* event, bool)
         if (isWhitespace(node))
             return;
 
+        // We could be attaching existing subtree. Forget the bindings.
+        unbind(node, &m_documentNodeToIdMap);
+
         Node* parent = static_cast<MutationEvent*>(event)->relatedNode();
-        long parentId = idForNode(parent);
+        long parentId = m_documentNodeToIdMap.get(parent);
         // Return if parent is not mapped yet.
         if (!parentId)
             return;
 
         if (!m_childrenRequested.contains(parentId)) {
             // No children are mapped yet -> only notify on changes of hasChildren.
-            m_frontend->hasChildrenUpdated(parentId, true);
+            m_frontend->childNodeCountUpdated(parentId, innerChildNodeCount(parent));
         } else {
             // Children have been requested -> return value of a new child.
-            long prevId = idForNode(innerPreviousSibling(node));
-
-            ScriptObject value = buildObjectForNode(node, 0);
+            Node* prevSibling = innerPreviousSibling(node);
+            long prevId = prevSibling ? m_documentNodeToIdMap.get(prevSibling) : 0;
+            ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
             m_frontend->childNodeInserted(parentId, prevId, value);
         }
     } else if (type == eventNames().DOMNodeRemovedEvent) {
@@ -154,7 +164,7 @@ void InspectorDOMAgent::handleEvent(Event* event, bool)
             return;
 
         Node* parent = static_cast<MutationEvent*>(event)->relatedNode();
-        long parentId = idForNode(parent);
+        long parentId = m_documentNodeToIdMap.get(parent);
         // If parent is not mapped yet -> ignore the event.
         if (!parentId)
             return;
@@ -162,92 +172,115 @@ void InspectorDOMAgent::handleEvent(Event* event, bool)
         if (!m_childrenRequested.contains(parentId)) {
             // No children are mapped yet -> only notify on changes of hasChildren.
             if (innerChildNodeCount(parent) == 1)
-                m_frontend->hasChildrenUpdated(parentId, false);
+                m_frontend->childNodeCountUpdated(parentId, 0);
         } else {
-            m_frontend->childNodeRemoved(parentId, idForNode(node));
+            m_frontend->childNodeRemoved(parentId, m_documentNodeToIdMap.get(node));
         }
+        unbind(node, &m_documentNodeToIdMap);
     } else if (type == eventNames().DOMContentLoadedEvent) {
         // Re-push document once it is loaded.
         discardBindings();
-        pushDocumentElementToFrontend();
+        pushDocumentToFrontend();
+    } else if (type == eventNames().loadEvent) {
+        long frameOwnerId = m_documentNodeToIdMap.get(node);
+        if (!frameOwnerId)
+            return;
+
+        if (!m_childrenRequested.contains(frameOwnerId)) {
+            // No children are mapped yet -> only notify on changes of hasChildren.
+            m_frontend->childNodeCountUpdated(frameOwnerId, innerChildNodeCount(node));
+        } else {
+            // Re-add frame owner element together with its new children.
+            long parentId = m_documentNodeToIdMap.get(innerParentNode(node));
+            m_frontend->childNodeRemoved(parentId, frameOwnerId);
+            long prevId = m_documentNodeToIdMap.get(innerPreviousSibling(node));
+            ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
+            m_frontend->childNodeInserted(parentId, prevId, value);
+            // Invalidate children requested flag for the element.
+            m_childrenRequested.remove(m_childrenRequested.find(frameOwnerId));
+        }
     }
 }
 
-long InspectorDOMAgent::bind(Node* node)
+long InspectorDOMAgent::bind(Node* node, NodeToIdMap* nodesMap)
 {
-    HashMap<Node*, long>::iterator it = m_nodeToId.find(node);
-    if (it != m_nodeToId.end())
-        return it->second;
-    long id = m_lastNodeId++;
-    m_nodeToId.set(node, id);
+    long id = nodesMap->get(node);
+    if (id)
+        return id;
+    id = m_lastNodeId++;
+    nodesMap->set(node, id);
     m_idToNode.set(id, node);
+    m_idToNodesMap.set(id, nodesMap);
     return id;
 }
 
-void InspectorDOMAgent::unbind(Node* node)
+void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
 {
     if (node->isFrameOwnerElement()) {
         const HTMLFrameOwnerElement* frameOwner = static_cast<const HTMLFrameOwnerElement*>(node);
         stopListening(frameOwner->contentDocument());
     }
 
-    HashMap<Node*, long>::iterator it = m_nodeToId.find(node);
-    if (it != m_nodeToId.end()) {
-        m_idToNode.remove(m_idToNode.find(it->second));
-        m_childrenRequested.remove(m_childrenRequested.find(it->second));
-        m_nodeToId.remove(it);
+    int id = nodesMap->get(node);
+    if (!id)
+        return;
+    m_idToNode.remove(id);
+    nodesMap->remove(node);
+    bool childrenRequested = m_childrenRequested.contains(id);
+    if (childrenRequested) {
+        // Unbind subtree known to client recursively.
+        m_childrenRequested.remove(id);
+        Node* child = innerFirstChild(node);
+        while (child) {
+            unbind(child, nodesMap);
+            child = innerNextSibling(child);
+        }
     }
 }
 
-void InspectorDOMAgent::pushDocumentElementToFrontend()
+void InspectorDOMAgent::pushDocumentToFrontend()
 {
-    Element* docElem = mainFrameDocument()->documentElement();
-    if (!m_nodeToId.contains(docElem))
-        m_frontend->setDocumentElement(buildObjectForNode(docElem, 0));
+    Document* document = mainFrameDocument();
+    if (!m_documentNodeToIdMap.contains(document))
+        m_frontend->setDocument(buildObjectForNode(document, 2, &m_documentNodeToIdMap));
 }
 
-void InspectorDOMAgent::pushChildNodesToFrontend(long elementId)
+void InspectorDOMAgent::pushChildNodesToFrontend(long nodeId)
 {
-    Node* node = nodeForId(elementId);
-    if (!node || (node->nodeType() != Node::ELEMENT_NODE))
+    Node* node = nodeForId(nodeId);
+    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE))
         return;
-    if (m_childrenRequested.contains(elementId))
+    if (m_childrenRequested.contains(nodeId))
         return;
 
-    Element* element = static_cast<Element*>(node);
-    ScriptArray children = buildArrayForElementChildren(element, 1);
-    m_childrenRequested.add(elementId);
-    m_frontend->setChildNodes(elementId, children);
+    NodeToIdMap* nodeMap = m_idToNodesMap.get(nodeId);
+    ScriptArray children = buildArrayForContainerChildren(node, 1, nodeMap);
+    m_childrenRequested.add(nodeId);
+    m_frontend->setChildNodes(nodeId, children);
 }
 
 void InspectorDOMAgent::discardBindings()
 {
-    m_nodeToId.clear();
+    m_documentNodeToIdMap.clear();
     m_idToNode.clear();
+    releaseDanglingNodes();
     m_childrenRequested.clear();
 }
 
 Node* InspectorDOMAgent::nodeForId(long id)
 {
+    if (!id)
+        return 0;
+
     HashMap<long, Node*>::iterator it = m_idToNode.find(id);
     if (it != m_idToNode.end())
         return it->second;
     return 0;
 }
 
-long InspectorDOMAgent::idForNode(Node* node)
+void InspectorDOMAgent::getChildNodes(long callId, long nodeId)
 {
-    if (!node)
-        return 0;
-    HashMap<Node*, long>::iterator it = m_nodeToId.find(node);
-    if (it != m_nodeToId.end())
-        return it->second;
-    return 0;
-}
-
-void InspectorDOMAgent::getChildNodes(long callId, long elementId)
-{
-    pushChildNodesToFrontend(elementId);
+    pushChildNodesToFrontend(nodeId);
     m_frontend->didGetChildNodes(callId);
 }
 
@@ -256,31 +289,40 @@ long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
     ASSERT(nodeToPush);  // Invalid input
 
     // If we are sending information to the client that is currently being created. Send root node first.
-    pushDocumentElementToFrontend();
+    pushDocumentToFrontend();
 
     // Return id in case the node is known.
-    long result = idForNode(nodeToPush);
+    long result = m_documentNodeToIdMap.get(nodeToPush);
     if (result)
         return result;
 
-    Element* element = innerParentElement(nodeToPush);
-    ASSERT(element);  // Node is detached or is a document itself
-
-    Vector<Element*> path;
-    while (element && !idForNode(element)) {
-        path.append(element);
-        element = innerParentElement(element);
+    Node* node = nodeToPush;
+    Vector<Node*> path;
+    NodeToIdMap* danglingMap = 0;
+    while (true) {
+        Node* parent = innerParentNode(node);
+        if (!parent) {
+            // Node being pushed is detached -> push subtree root.
+            danglingMap = new NodeToIdMap();
+            m_danglingNodeToIdMaps.append(danglingMap);
+            m_frontend->setDetachedRoot(buildObjectForNode(node, 0, danglingMap));
+            break;
+        } else {
+            path.append(parent);
+            if (m_documentNodeToIdMap.get(parent))
+                break;
+            else
+                node = parent;
+        }
     }
 
-    // element is known to the client
-    ASSERT(element);
-    path.append(element);
+    NodeToIdMap* map = danglingMap ? danglingMap : &m_documentNodeToIdMap;
     for (int i = path.size() - 1; i >= 0; --i) {
-        long nodeId = idForNode(path.at(i));
+        long nodeId = map->get(path.at(i));
         ASSERT(nodeId);
         pushChildNodesToFrontend(nodeId);
     }
-    return idForNode(nodeToPush);
+    return map->get(nodeToPush);
 }
 
 void InspectorDOMAgent::setAttribute(long callId, long elementId, const String& name, const String& value)
@@ -309,9 +351,9 @@ void InspectorDOMAgent::removeAttribute(long callId, long elementId, const Strin
     }
 }
 
-void InspectorDOMAgent::setTextNodeValue(long callId, long elementId, const String& value)
+void InspectorDOMAgent::setTextNodeValue(long callId, long nodeId, const String& value)
 {
-    Node* node = nodeForId(elementId);
+    Node* node = nodeForId(nodeId);
     if (node && (node->nodeType() == Node::TEXT_NODE)) {
         Text* text_node = static_cast<Text*>(node);
         ExceptionCode ec = 0;
@@ -322,12 +364,87 @@ void InspectorDOMAgent::setTextNodeValue(long callId, long elementId, const Stri
     }
 }
 
-ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth)
+void InspectorDOMAgent::getEventListenersForNode(long callId, long nodeId)
+{
+    Node* node = nodeForId(nodeId);
+    ScriptArray listenersArray = m_frontend->newScriptArray();
+    unsigned counter = 0;
+    EventTargetData* d;
+
+    // Quick break if a null node or no listeners at all
+    if (!node || !(d = node->eventTargetData())) {
+        m_frontend->didGetEventListenersForNode(callId, nodeId, listenersArray);
+        return;
+    }
+
+    // Get the list of event types this Node is concerned with
+    Vector<AtomicString> eventTypes;
+    const EventListenerMap& listenerMap = d->eventListenerMap;
+    HashMap<AtomicString, EventListenerVector>::const_iterator end = listenerMap.end();
+    for (HashMap<AtomicString, EventListenerVector>::const_iterator iter = listenerMap.begin(); iter != end; ++iter)
+        eventTypes.append(iter->first);
+
+    // Quick break if no useful listeners
+    size_t eventTypesLength = eventTypes.size();
+    if (eventTypesLength == 0) {
+        m_frontend->didGetEventListenersForNode(callId, nodeId, listenersArray);
+        return;
+    }
+
+    // The Node's Event Ancestors (not including self)
+    Vector<RefPtr<ContainerNode> > ancestors;
+    node->eventAncestors(ancestors);
+
+    // Nodes and their Listeners for the concerned event types (order is top to bottom)
+    Vector<EventListenerInfo> eventInformation;
+    for (size_t i = ancestors.size(); i; --i) {
+        ContainerNode* ancestor = ancestors[i - 1].get();
+        for (size_t j = 0; j < eventTypesLength; ++j) {
+            AtomicString& type = eventTypes[j];
+            if (ancestor->hasEventListeners(type))
+                eventInformation.append(EventListenerInfo(static_cast<Node*>(ancestor), type, ancestor->getEventListeners(type)));
+        }
+    }
+
+    // Insert the Current Node at the end of that list (last in capturing, first in bubbling)
+    for (size_t i = 0; i < eventTypesLength; ++i) {
+        const AtomicString& type = eventTypes[i];
+        eventInformation.append(EventListenerInfo(node, type, node->getEventListeners(type)));
+    }
+
+    // Get Capturing Listeners (in this order)
+    size_t eventInformationLength = eventInformation.size();
+    for (size_t i = 0; i < eventInformationLength; ++i) {
+        const EventListenerInfo& info = eventInformation[i];
+        const EventListenerVector& vector = info.eventListenerVector;
+        for (size_t j = 0; j < vector.size(); ++j) {
+            const RegisteredEventListener& listener = vector[j];
+            if (listener.useCapture)
+                listenersArray.set(counter++, buildObjectForEventListener(listener, info.eventType, info.node));
+        }
+    }
+
+    // Get Bubbling Listeners (reverse order)
+    for (size_t i = eventInformationLength; i; --i) {
+        const EventListenerInfo& info = eventInformation[i - 1];
+        const EventListenerVector& vector = info.eventListenerVector;
+        for (size_t j = 0; j < vector.size(); ++j) {
+            const RegisteredEventListener& listener = vector[j];
+            if (!listener.useCapture)
+                listenersArray.set(counter++, buildObjectForEventListener(listener, info.eventType, info.node));
+        }
+    }
+
+    m_frontend->didGetEventListenersForNode(callId, nodeId, listenersArray);
+}
+
+ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap)
 {
     ScriptObject value = m_frontend->newScriptObject();
 
-    long id = bind(node);
+    long id = bind(node, nodesMap);
     String nodeName;
+    String localName;
     String nodeValue;
 
     switch (node->nodeType()) {
@@ -336,27 +453,32 @@ ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth)
             nodeValue = node->nodeValue();
             break;
         case Node::ATTRIBUTE_NODE:
-        case Node::DOCUMENT_NODE:
+            localName = node->localName();
+            break;
         case Node::DOCUMENT_FRAGMENT_NODE:
             break;
+        case Node::DOCUMENT_NODE:
         case Node::ELEMENT_NODE:
         default:
             nodeName = node->nodeName();
+            localName = node->localName();
             break;
     }
 
     value.set("id", static_cast<int>(id));
     value.set("nodeType", node->nodeType());
     value.set("nodeName", nodeName);
+    value.set("localName", localName);
     value.set("nodeValue", nodeValue);
 
     if (node->nodeType() == Node::ELEMENT_NODE) {
         Element* element = static_cast<Element*>(node);
         value.set("attributes", buildArrayForElementAttributes(element));
-        int nodeCount = innerChildNodeCount(element);
+    }
+    if (node->nodeType() == Node::ELEMENT_NODE || node->nodeType() == Node::DOCUMENT_NODE) {
+        int nodeCount = innerChildNodeCount(node);
         value.set("childNodeCount", nodeCount);
-
-        ScriptArray children = buildArrayForElementChildren(element, depth);
+        ScriptArray children = buildArrayForContainerChildren(node, depth, nodesMap);
         if (children.length() > 0)
             value.set("children", children);
     }
@@ -381,16 +503,16 @@ ScriptArray InspectorDOMAgent::buildArrayForElementAttributes(Element* element)
     return attributesValue;
 }
 
-ScriptArray InspectorDOMAgent::buildArrayForElementChildren(Element* element, int depth)
+ScriptArray InspectorDOMAgent::buildArrayForContainerChildren(Node* container, int depth, NodeToIdMap* nodesMap)
 {
     ScriptArray children = m_frontend->newScriptArray();
     if (depth == 0) {
         int index = 0;
         // Special case the_only text child.
-        if (innerChildNodeCount(element) == 1) {
-            Node *child = innerFirstChild(element);
+        if (innerChildNodeCount(container) == 1) {
+            Node *child = innerFirstChild(container);
             if (child->nodeType() == Node::TEXT_NODE)
-                children.set(index++, buildObjectForNode(child, 0));
+                children.set(index++, buildObjectForNode(child, 0, nodesMap));
         }
         return children;
     } else if (depth > 0) {
@@ -398,11 +520,23 @@ ScriptArray InspectorDOMAgent::buildArrayForElementChildren(Element* element, in
     }
 
     int index = 0;
-    for (Node *child = innerFirstChild(element); child; child = innerNextSibling(child))
-        children.set(index++, buildObjectForNode(child, depth));
+    for (Node *child = innerFirstChild(container); child; child = innerNextSibling(child))
+        children.set(index++, buildObjectForNode(child, depth, nodesMap));
     return children;
 }
 
+ScriptObject InspectorDOMAgent::buildObjectForEventListener(const RegisteredEventListener& registeredEventListener, const AtomicString& eventType, Node* node)
+{
+    RefPtr<EventListener> eventListener = registeredEventListener.listener;
+    ScriptObject value = m_frontend->newScriptObject();
+    value.set("type", eventType);
+    value.set("useCapture", registeredEventListener.useCapture);
+    value.set("isAttribute", eventListener->isAttribute());
+    value.set("nodeId", static_cast<long long>(pushNodePathToFrontend(node)));
+    value.set("listener", getEventListenerHandlerBody(node->document(), m_frontend->scriptState(), eventListener.get()));
+    return value;
+}
+
 Node* InspectorDOMAgent::innerFirstChild(Node* node)
 {
     if (node->isFrameOwnerElement()) {
@@ -446,12 +580,12 @@ int InspectorDOMAgent::innerChildNodeCount(Node* node)
     return count;
 }
 
-Element* InspectorDOMAgent::innerParentElement(Node* node)
+Node* InspectorDOMAgent::innerParentNode(Node* node)
 {
-    Element* element = node->parentElement();
-    if (!element)
-        return node->ownerDocument()->ownerElement();
-    return element;
+    Node* parent = node->parentNode();
+    if (parent && parent->nodeType() == Node::DOCUMENT_NODE)
+        return static_cast<Document*>(parent)->ownerElement();
+    return parent;
 }
 
 bool InspectorDOMAgent::isWhitespace(Node* node)
@@ -460,12 +594,21 @@ bool InspectorDOMAgent::isWhitespace(Node* node)
     return node && node->nodeType() == Node::TEXT_NODE && node->nodeValue().stripWhiteSpace().length() == 0;
 }
 
-Document* InspectorDOMAgent::mainFrameDocument()
+Document* InspectorDOMAgent::mainFrameDocument() const
 {
-    ListHashSet<RefPtr<Document> >::iterator it = m_documents.begin();
+    ListHashSet<RefPtr<Document> >::const_iterator it = m_documents.begin();
     if (it != m_documents.end())
         return it->get();
     return 0;
 }
 
+bool InspectorDOMAgent::operator==(const EventListener& listener)
+{
+    if (const InspectorDOMAgent* inspectorDOMAgentListener = InspectorDOMAgent::cast(&listener))
+        return mainFrameDocument() == inspectorDOMAgentListener->mainFrameDocument();
+    return false;
+}
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorDOMAgent.h b/WebCore/inspector/InspectorDOMAgent.h
index 28c3a22..b9bdb6b 100644
--- a/WebCore/inspector/InspectorDOMAgent.h
+++ b/WebCore/inspector/InspectorDOMAgent.h
@@ -30,7 +30,9 @@
 #ifndef InspectorDOMAgent_h
 #define InspectorDOMAgent_h
 
+#include "AtomicString.h"
 #include "EventListener.h"
+#include "EventTarget.h"
 #include "ScriptArray.h"
 #include "ScriptObject.h"
 #include "ScriptState.h"
@@ -42,6 +44,7 @@
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
+    class ContainerNode;
     class Element;
     class Event;
     class Document;
@@ -50,39 +53,65 @@ namespace WebCore {
     class Node;
     class Page;
 
+    struct EventListenerInfo {
+        EventListenerInfo(Node* node, const AtomicString& eventType, const EventListenerVector& eventListenerVector)
+            : node(node)
+            , eventType(eventType)
+            , eventListenerVector(eventListenerVector)
+        {
+        }
+
+        Node* node;
+        const AtomicString eventType;
+        const EventListenerVector eventListenerVector;
+    };
+
     class InspectorDOMAgent : public EventListener {
     public:
+        static const InspectorDOMAgent* cast(const EventListener* listener)
+        {
+            return listener->type() == InspectorDOMAgentType
+                ? static_cast<const InspectorDOMAgent*>(listener)
+                : 0;
+        }
+
         InspectorDOMAgent(InspectorFrontend* frontend);
         ~InspectorDOMAgent();
 
+        virtual bool operator==(const EventListener& other);
+
         // Methods called from the frontend.
-        void getChildNodes(long callId, long elementId);
+        void getChildNodes(long callId, long nodeId);
         void setAttribute(long callId, long elementId, const String& name, const String& value);
         void removeAttribute(long callId, long elementId, const String& name);
-        void setTextNodeValue(long callId, long elementId, const String& value);
+        void setTextNodeValue(long callId, long nodeId, const String& value);
+        void getEventListenersForNode(long callId, long nodeId);
 
         // Methods called from the InspectorController.
         void setDocument(Document* document);
+        void releaseDanglingNodes();
 
         Node* nodeForId(long nodeId);
-        long idForNode(Node* node);
         long pushNodePathToFrontend(Node* node);
 
    private:
         void startListening(Document* document);
         void stopListening(Document* document);
 
-        virtual void handleEvent(Event* event, bool isWindowEvent);
+        virtual void handleEvent(ScriptExecutionContext*, Event* event);
+
+        typedef HashMap<RefPtr<Node>, long> NodeToIdMap;
+        long bind(Node* node, NodeToIdMap* nodesMap);
+        void unbind(Node* node, NodeToIdMap* nodesMap);
 
-        long bind(Node* node);
-        void unbind(Node* node);
+        void pushDocumentToFrontend();
+        void pushChildNodesToFrontend(long nodeId);
 
-        void pushDocumentElementToFrontend();
-        void pushChildNodesToFrontend(long elementId);
+        ScriptObject buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap);
+        ScriptArray buildArrayForElementAttributes(Element* element);
+        ScriptArray buildArrayForContainerChildren(Node* container, int depth, NodeToIdMap* nodesMap);
 
-        ScriptObject buildObjectForNode(Node* node, int depth);
-        ScriptArray buildArrayForElementAttributes(Element* elemen);
-        ScriptArray buildArrayForElementChildren(Element* element, int depth);
+        ScriptObject buildObjectForEventListener(const RegisteredEventListener& registeredEventListener, const AtomicString& eventType, Node* node);
 
         // We represent embedded doms as a part of the same hierarchy. Hence we treat children of frame owners differently.
         // We also skip whitespace text nodes conditionally. Following methods encapsulate these specifics.
@@ -90,19 +119,21 @@ namespace WebCore {
         Node* innerNextSibling(Node* node);
         Node* innerPreviousSibling(Node* node);
         int innerChildNodeCount(Node* node);
-        Element* innerParentElement(Node* node);
+        Node* innerParentNode(Node* node);
         bool isWhitespace(Node* node);
 
-        Document* mainFrameDocument();
+        Document* mainFrameDocument() const;
         void discardBindings();
 
         InspectorFrontend* m_frontend;
-        HashMap<Node*, long> m_nodeToId;
+        NodeToIdMap m_documentNodeToIdMap;
+        // Owns node mappings for dangling nodes.
+        Vector<NodeToIdMap*> m_danglingNodeToIdMaps;
         HashMap<long, Node*> m_idToNode;
+        HashMap<long, NodeToIdMap*> m_idToNodesMap;
         HashSet<long> m_childrenRequested;
         long m_lastNodeId;
         ListHashSet<RefPtr<Document> > m_documents;
-        RefPtr<EventListener> m_eventListener;
     };
 
 
diff --git a/WebCore/inspector/InspectorDOMStorageResource.cpp b/WebCore/inspector/InspectorDOMStorageResource.cpp
index 03db649..37818e7 100644
--- a/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -29,26 +29,34 @@
  */
 
 #include "config.h"
-#if ENABLE(DOM_STORAGE)
+
+#if ENABLE(DOM_STORAGE) && ENABLE(INSPECTOR)
 
 #include "InspectorDOMStorageResource.h"
 
 #include "Document.h"
+#include "DOMWindow.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "InspectorFrontend.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 #include "Storage.h"
+#include "StorageEvent.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+int InspectorDOMStorageResource::s_nextUnusedId = 1;
+
 InspectorDOMStorageResource::InspectorDOMStorageResource(Storage* domStorage, bool isLocalStorage, Frame* frame)
-    : m_domStorage(domStorage)
+    :  EventListener(InspectorDOMStorageResourceType)
+    , m_domStorage(domStorage)
     , m_isLocalStorage(isLocalStorage)
     , m_frame(frame)
-    , m_scriptObjectCreated(false)
+    , m_frontend(0)
+    , m_id(s_nextUnusedId++)
+    , m_reportingChangesToFrontend(false)
 {
 }
 
@@ -59,25 +67,54 @@ bool InspectorDOMStorageResource::isSameHostAndType(Frame* frame, bool isLocalSt
 
 void InspectorDOMStorageResource::bind(InspectorFrontend* frontend)
 {
-    if (m_scriptObjectCreated)
-        return;
+    ASSERT(!m_frontend);
+    m_frontend = frontend;
 
     ScriptObject jsonObject = frontend->newScriptObject();
-    ScriptObject domStorage;
-    if (!getQuarantinedScriptObject(m_frame.get(), m_domStorage.get(), domStorage))
-        return;
-    jsonObject.set("domStorage", domStorage);
     jsonObject.set("host", m_frame->document()->securityOrigin()->host());
     jsonObject.set("isLocalStorage", m_isLocalStorage);
-    if (frontend->addDOMStorage(jsonObject))
-        m_scriptObjectCreated = true;
+    jsonObject.set("id", m_id);
+    frontend->addDOMStorage(jsonObject);
 }
 
 void InspectorDOMStorageResource::unbind()
 {
-    m_scriptObjectCreated = false;
+    if (!m_frontend)
+        return;  // Already unbound.
+
+    if (m_reportingChangesToFrontend) {
+        m_frame->domWindow()->removeEventListener(eventNames().storageEvent, this, true);
+        m_reportingChangesToFrontend = false;
+    }
+    m_frontend = 0;
+}
+
+void InspectorDOMStorageResource::startReportingChangesToFrontend()
+{
+    ASSERT(m_frontend);
+    if (!m_reportingChangesToFrontend) {
+        m_frame->domWindow()->addEventListener(eventNames().storageEvent, this, true);
+        m_reportingChangesToFrontend = true;
+    }
+}
+
+void InspectorDOMStorageResource::handleEvent(ScriptExecutionContext*, Event* event)
+{
+    ASSERT(m_frontend);
+    ASSERT(eventNames().storageEvent == event->type());
+    StorageEvent* storageEvent = static_cast<StorageEvent*>(event);
+    Storage* storage = storageEvent->storageArea();
+    bool isLocalStorage = storageEvent->source()->localStorage() == storage;
+    if (isSameHostAndType(storage->frame(), isLocalStorage))
+        m_frontend->updateDOMStorage(m_id);
+}
+
+bool InspectorDOMStorageResource::operator==(const EventListener& listener)
+{
+    return (this == InspectorDOMStorageResource::cast(&listener));
 }
 
 } // namespace WebCore
 
-#endif
+#endif // ENABLE(DOM_STORAGE) && ENABLE(INSPECTOR)
+
diff --git a/WebCore/inspector/InspectorDOMStorageResource.h b/WebCore/inspector/InspectorDOMStorageResource.h
index 3e05897..2b18b24 100644
--- a/WebCore/inspector/InspectorDOMStorageResource.h
+++ b/WebCore/inspector/InspectorDOMStorageResource.h
@@ -33,6 +33,7 @@
 
 #if ENABLE(DOM_STORAGE)
 
+#include "EventListener.h"
 #include "ScriptObject.h"
 #include "ScriptState.h"
 
@@ -46,17 +47,27 @@ namespace WebCore {
     class Frame;
     class InspectorFrontend;
 
-    class InspectorDOMStorageResource : public RefCounted<InspectorDOMStorageResource> {
+    class InspectorDOMStorageResource : public EventListener {
     public:
         static PassRefPtr<InspectorDOMStorageResource> create(Storage* domStorage, bool isLocalStorage, Frame* frame)
         {
             return adoptRef(new InspectorDOMStorageResource(domStorage, isLocalStorage, frame));
         }
+        static const InspectorDOMStorageResource* cast(const EventListener* listener)
+        {
+            return listener->type() == InspectorDOMStorageResourceType ? static_cast<const InspectorDOMStorageResource*>(listener) : 0;
+        }
 
         void bind(InspectorFrontend* frontend);
         void unbind();
+        void startReportingChangesToFrontend();
+
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
+        virtual bool operator==(const EventListener& listener);
 
         bool isSameHostAndType(Frame*, bool isLocalStorage) const;
+        long id() const { return m_id; }
+        Storage* domStorage() const { return m_domStorage.get(); }
 
     private:
 
@@ -65,8 +76,11 @@ namespace WebCore {
         RefPtr<Storage> m_domStorage;
         bool m_isLocalStorage;
         RefPtr<Frame> m_frame;
-        bool m_scriptObjectCreated;
+        InspectorFrontend* m_frontend;
+        int m_id;
+        bool m_reportingChangesToFrontend;
 
+        static int s_nextUnusedId;
     };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorDatabaseResource.cpp b/WebCore/inspector/InspectorDatabaseResource.cpp
index fba50a5..c2dc5c6 100644
--- a/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -29,9 +29,9 @@
  */
 
 #include "config.h"
-#if ENABLE(DATABASE)
 #include "InspectorDatabaseResource.h"
 
+#if ENABLE(DATABASE) && ENABLE(INSPECTOR)
 #include "Database.h"
 #include "Document.h"
 #include "Frame.h"
@@ -39,11 +39,13 @@
 #include "ScriptObject.h"
 #include "ScriptObjectQuarantine.h"
 
-
 namespace WebCore {
 
+int InspectorDatabaseResource::s_nextUnusedId = 1;
+
 InspectorDatabaseResource::InspectorDatabaseResource(Database* database, const String& domain, const String& name, const String& version)
     : m_database(database)
+    , m_id(s_nextUnusedId++)
     , m_domain(domain)
     , m_name(name)
     , m_version(version)
@@ -60,7 +62,7 @@ void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
     ScriptObject database;
     if (!getQuarantinedScriptObject(m_database.get(), database))
         return;
-    jsonObject.set("database", database);
+    jsonObject.set("id", m_id);
     jsonObject.set("domain", m_domain);
     jsonObject.set("name", m_name);
     jsonObject.set("version", m_version);
@@ -75,4 +77,4 @@ void InspectorDatabaseResource::unbind()
 
 } // namespace WebCore
 
-#endif // ENABLE(DATABASE)
+#endif // ENABLE(DATABASE) && ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorDatabaseResource.h b/WebCore/inspector/InspectorDatabaseResource.h
index 38f9fa1..f82d898 100644
--- a/WebCore/inspector/InspectorDatabaseResource.h
+++ b/WebCore/inspector/InspectorDatabaseResource.h
@@ -53,16 +53,19 @@ namespace WebCore {
 
         void bind(InspectorFrontend* frontend);
         void unbind();
-
+        Database* database() { return m_database.get(); }
+        long id() const { return m_id; }
     private:
         InspectorDatabaseResource(Database*, const String& domain, const String& name, const String& version);
         
         RefPtr<Database> m_database;
+        int m_id;
         String m_domain;
         String m_name;
         String m_version;
         bool m_scriptObjectCreated;
 
+        static int s_nextUnusedId;
     };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorFrontend.cpp b/WebCore/inspector/InspectorFrontend.cpp
index af65fb4..ad935a8 100644
--- a/WebCore/inspector/InspectorFrontend.cpp
+++ b/WebCore/inspector/InspectorFrontend.cpp
@@ -30,9 +30,11 @@
 #include "config.h"
 #include "InspectorFrontend.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "ConsoleMessage.h"
 #include "Frame.h"
-#include "InspectorController.h"  // TODO(pfeldman): Extract SpecialPanels to remove include.
+#include "InspectorController.h"
 #include "Node.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
@@ -49,8 +51,9 @@
 
 namespace WebCore {
 
-InspectorFrontend::InspectorFrontend(ScriptState* scriptState, ScriptObject webInspector)
-    : m_scriptState(scriptState)
+InspectorFrontend::InspectorFrontend(InspectorController* inspectorController, ScriptState* scriptState, ScriptObject webInspector)
+    : m_inspectorController(inspectorController)
+    , m_scriptState(scriptState)
     , m_webInspector(webInspector)
 {
 }
@@ -70,6 +73,11 @@ ScriptObject InspectorFrontend::newScriptObject()
     return ScriptObject::createNew(m_scriptState);
 }
 
+void InspectorFrontend::didCommitLoad()
+{
+    callSimpleFunction("didCommitLoad");
+}
+
 void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("addMessageToConsole"));
@@ -79,12 +87,17 @@ void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, cons
             function->appendArgument(frames[i]);
     } else if (!wrappedArguments.isEmpty()) {
         for (unsigned i = 0; i < wrappedArguments.size(); ++i)
-            function->appendArgument(wrappedArguments[i]);
+            function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i], "console"));
     } else
         function->appendArgument(message);
     function->call();
 }
 
+void InspectorFrontend::clearConsoleMessages()
+{
+    callSimpleFunction("clearConsoleMessages");
+}
+
 bool InspectorFrontend::addResource(long long identifier, const ScriptObject& resourceObj)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("addResource"));
@@ -112,14 +125,17 @@ void InspectorFrontend::removeResource(long long identifier)
     function->call();
 }
 
-void InspectorFrontend::updateFocusedNode(Node* node)
+void InspectorFrontend::addCookieDomain(String domain)
 {
-    ScriptObject quarantinedNode;
-    if (!getQuarantinedScriptObject(node, quarantinedNode))
-        return;
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addCookieDomain"));
+    function->appendArgument(domain);
+    function->call();
+}
 
+void InspectorFrontend::updateFocusedNode(long long nodeId)
+{
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
-    function->appendArgument(quarantinedNode);
+    function->appendArgument(nodeId);
     function->call();
 }
 
@@ -130,17 +146,6 @@ void InspectorFrontend::setAttachedWindow(bool attached)
     function->call();
 }
 
-void InspectorFrontend::inspectedWindowScriptObjectCleared(Frame* frame)
-{
-    ScriptObject domWindow;
-    if (!getQuarantinedScriptObject(frame->domWindow(), domWindow))
-        return;
-
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("inspectedWindowCleared"));
-    function->appendArgument(domWindow);
-    function->call();
-}
-
 void InspectorFrontend::showPanel(int panel)
 {
     const char* showFunctionName;
@@ -148,9 +153,6 @@ void InspectorFrontend::showPanel(int panel)
         case InspectorController::ConsolePanel:
             showFunctionName = "showConsole";
             break;
-        case InspectorController::DatabasesPanel:
-            showFunctionName = "showDatabasesPanel";
-            break;
         case InspectorController::ElementsPanel:
             showFunctionName = "showElementsPanel";
             break;
@@ -163,6 +165,9 @@ void InspectorFrontend::showPanel(int panel)
         case InspectorController::ScriptsPanel:
             showFunctionName = "showScriptsPanel";
             break;
+        case InspectorController::StoragePanel:
+            showFunctionName = "showStoragePanel";
+            break;
         default:
             ASSERT_NOT_REACHED();
             showFunctionName = 0;
@@ -192,6 +197,23 @@ void InspectorFrontend::resourceTrackingWasDisabled()
     callSimpleFunction("resourceTrackingWasDisabled");
 }
 
+void InspectorFrontend::timelineWasEnabled()
+{
+    callSimpleFunction("timelineWasEnabled");
+}
+
+void InspectorFrontend::timelineWasDisabled()
+{
+    callSimpleFunction("timelineWasDisabled");
+}
+
+void InspectorFrontend::addItemToTimeline(const ScriptObject& itemObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addItemToTimeline"));
+    function->appendArgument(itemObj);
+    function->call();
+}
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 void InspectorFrontend::attachDebuggerWhenShown()
 {
@@ -253,9 +275,11 @@ void InspectorFrontend::setRecordingProfile(bool isProfiling)
     function->call();
 }
 
-void InspectorFrontend::pausedScript()
+void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
 {
-    callSimpleFunction("pausedScript");
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
+    function->appendArgument(callFrames);
+    function->call();
 }
 
 void InspectorFrontend::resumedScript()
@@ -264,31 +288,16 @@ void InspectorFrontend::resumedScript()
 }
 #endif
 
-#if ENABLE(DATABASE)
-bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
+void InspectorFrontend::setDocument(const ScriptObject& root)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
-    function->appendArgument(dbObject);
-    bool hadException = false;
-    function->call(hadException);
-    return !hadException;
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
-{
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
-    function->appendArgument(domStorageObj);
-    bool hadException = false;
-    function->call(hadException);
-    return !hadException;
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDocument"));
+    function->appendArgument(root);
+    function->call();
 }
-#endif
 
-void InspectorFrontend::setDocumentElement(const ScriptObject& root)
+void InspectorFrontend::setDetachedRoot(const ScriptObject& root)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDocumentElement"));
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDetachedRoot"));
     function->appendArgument(root);
     function->call();
 }
@@ -301,9 +310,9 @@ void InspectorFrontend::setChildNodes(int parentId, const ScriptArray& nodes)
     function->call();
 }
 
-void InspectorFrontend::hasChildrenUpdated(int id, bool newValue)
+void InspectorFrontend::childNodeCountUpdated(int id, int newValue)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("hasChildrenUpdated"));
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeCountUpdated"));
     function->appendArgument(id);
     function->appendArgument(newValue);
     function->call();
@@ -349,6 +358,122 @@ void InspectorFrontend::didApplyDomChange(int callId, bool success)
     function->call();
 }
 
+void InspectorFrontend::didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetEventListenersForNode"));
+    function->appendArgument(callId);
+    function->appendArgument(nodeId);
+    function->appendArgument(listenersArray);
+    function->call();
+}
+
+void InspectorFrontend::didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetCookies"));
+    function->appendArgument(callId);
+    function->appendArgument(cookies);
+    function->appendArgument(cookiesString);
+    function->call();
+}
+
+void InspectorFrontend::didDispatchOnInjectedScript(int callId, const String& result, bool isException)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didDispatchOnInjectedScript"));
+    function->appendArgument(callId);
+    function->appendArgument(result);
+    function->appendArgument(isException);
+    function->call();
+}
+
+#if ENABLE(DATABASE)
+bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
+    function->appendArgument(dbObject);
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+void InspectorFrontend::selectDatabase(int databaseId)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDatabase"));
+    function->appendArgument(databaseId);
+    function->call();
+}
+void InspectorFrontend::didGetDatabaseTableNames(int callId, const ScriptArray& tableNames)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDatabaseTableNames"));
+    function->appendArgument(callId);
+    function->appendArgument(tableNames);
+    function->call();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
+    function->appendArgument(domStorageObj);
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+void InspectorFrontend::selectDOMStorage(int storageId)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDOMStorage"));
+    function->appendArgument(storageId);
+    function->call();
+}
+
+void InspectorFrontend::didGetDOMStorageEntries(int callId, const ScriptArray& entries)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDOMStorageEntries"));
+    function->appendArgument(callId);
+    function->appendArgument(entries);
+    function->call();
+}
+
+void InspectorFrontend::didSetDOMStorageItem(int callId, bool success)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didSetDOMStorageItem"));
+    function->appendArgument(callId);
+    function->appendArgument(success);
+    function->call();
+}
+
+void InspectorFrontend::didRemoveDOMStorageItem(int callId, bool success)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveDOMStorageItem"));
+    function->appendArgument(callId);
+    function->appendArgument(success);
+    function->call();
+}
+
+void InspectorFrontend::updateDOMStorage(int storageId)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateDOMStorage"));
+    function->appendArgument(storageId);
+    function->call();
+}
+#endif
+
+void InspectorFrontend::addNodesToSearchResult(const String& nodeIds)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addNodesToSearchResult"));
+    function->appendArgument(nodeIds);
+    function->call();
+}
+
+void InspectorFrontend::evaluateForTestInFrontend(int callId, const String& script)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("evaluateForTestInFrontend"));
+    function->appendArgument(callId);
+    function->appendArgument(script);
+    function->call();
+}
+
 PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
 {
     ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
@@ -364,3 +489,5 @@ void InspectorFrontend::callSimpleFunction(const String& functionName)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorFrontend.h b/WebCore/inspector/InspectorFrontend.h
index 7a48b62..f7055bd 100644
--- a/WebCore/inspector/InspectorFrontend.h
+++ b/WebCore/inspector/InspectorFrontend.h
@@ -45,28 +45,35 @@ namespace JSC {
 
 namespace WebCore {
     class ConsoleMessage;
+    class Database;
+    class Frame;
+    class InspectorController;
     class InspectorResource;
     class Node;
     class ScriptFunctionCall;
     class ScriptString;
+    class Storage;
 
     class InspectorFrontend {
     public:
-        InspectorFrontend(ScriptState*, ScriptObject webInspector);
+        InspectorFrontend(InspectorController* inspectorController, ScriptState*, ScriptObject webInspector);
         ~InspectorFrontend();
 
         ScriptArray newScriptArray();
         ScriptObject newScriptObject();
 
+        void didCommitLoad();
         void addMessageToConsole(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
-        
+        void clearConsoleMessages();
+
         bool addResource(long long identifier, const ScriptObject& resourceObj);
         bool updateResource(long long identifier, const ScriptObject& resourceObj);
         void removeResource(long long identifier);
 
-        void updateFocusedNode(Node* node);
+        void addCookieDomain(String);
+
+        void updateFocusedNode(long long nodeId);
         void setAttachedWindow(bool attached);
-        void inspectedWindowScriptObjectCleared(Frame* frame);
         void showPanel(int panel);
         void populateInterface();
         void reset();
@@ -84,30 +91,52 @@ namespace WebCore {
         void failedToParseScriptSource(const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
         void addProfile(const JSC::JSValue& profile);
         void setRecordingProfile(bool isProfiling);
-        void pausedScript();
+        void pausedScript(const ScriptValue& callFrames);
         void resumedScript();
 #endif
 
 #if ENABLE(DATABASE)
         bool addDatabase(const ScriptObject& dbObj);
+        void selectDatabase(int databaseId);
+        void didGetDatabaseTableNames(int callId, const ScriptArray& tableNames);
 #endif
         
 #if ENABLE(DOM_STORAGE)
         bool addDOMStorage(const ScriptObject& domStorageObj);
+        void selectDOMStorage(int storageId);
+        void didGetDOMStorageEntries(int callId, const ScriptArray& entries);
+        void didSetDOMStorageItem(int callId, bool success);
+        void didRemoveDOMStorageItem(int callId, bool success);
+        void updateDOMStorage(int storageId);
 #endif
 
-        void setDocumentElement(const ScriptObject& root);
+        void setDocument(const ScriptObject& root);
+        void setDetachedRoot(const ScriptObject& root);
         void setChildNodes(int parentId, const ScriptArray& nodes);
-        void hasChildrenUpdated(int id, bool newValue);
+        void childNodeCountUpdated(int id, int newValue);
         void childNodeInserted(int parentId, int prevId, const ScriptObject& node);
         void childNodeRemoved(int parentId, int id);
         void attributesUpdated(int id, const ScriptArray& attributes);
         void didGetChildNodes(int callId);
         void didApplyDomChange(int callId, bool success);
+        void didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray);
+
+        void timelineWasEnabled();
+        void timelineWasDisabled();
+        void addItemToTimeline(const ScriptObject& itemObj);
+
+        void didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString);
+        void didDispatchOnInjectedScript(int callId, const String& result, bool isException);
+
+        void addNodesToSearchResult(const String& nodeIds);
+
+        ScriptState* scriptState() const { return m_scriptState; }
 
+        void evaluateForTestInFrontend(int callId, const String& script);
     private:
         PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
         void callSimpleFunction(const String& functionName);
+        InspectorController* m_inspectorController;
         ScriptState* m_scriptState;
         ScriptObject m_webInspector;
     };
diff --git a/WebCore/inspector/InspectorResource.cpp b/WebCore/inspector/InspectorResource.cpp
index 8e6e9b1..69ab39b 100644
--- a/WebCore/inspector/InspectorResource.cpp
+++ b/WebCore/inspector/InspectorResource.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "InspectorResource.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "CachedResource.h"
 #include "DocLoader.h"
 #include "DocumentLoader.h"
@@ -57,6 +59,8 @@ InspectorResource::InspectorResource(long long identifier, DocumentLoader* loade
     , m_startTime(-1.0)
     , m_responseReceivedTime(-1.0)
     , m_endTime(-1.0)
+    , m_loadEventTime(-1.0)
+    , m_domContentEventTime(-1.0)
     , m_isMainResource(false)
 {
 }
@@ -71,7 +75,7 @@ PassRefPtr<InspectorResource> InspectorResource::createCached(long long identifi
 
     resource->m_finished = true;
 
-    resource->m_requestURL = KURL(cachedResource->url());
+    resource->m_requestURL = KURL(ParsedURLString, cachedResource->url());
     resource->updateResponse(cachedResource->response());
 
     resource->m_length = cachedResource->encodedSize();
@@ -89,6 +93,9 @@ void InspectorResource::updateRequest(const ResourceRequest& request)
 {
     m_requestHeaderFields = request.httpHeaderFields();
     m_requestURL = request.url();
+    m_requestMethod = request.httpMethod();
+    if (request.httpBody() && !request.httpBody()->isEmpty())
+        m_requestFormData = request.httpBody()->flattenToString();
 
     m_changes.set(RequestChange);
 }
@@ -126,6 +133,8 @@ void InspectorResource::createScriptObject(InspectorFrontend* frontend)
         jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
         jsonObject.set("isMainResource", m_isMainResource);
         jsonObject.set("cached", m_cached);
+        jsonObject.set("requestMethod", m_requestMethod);
+        jsonObject.set("requestFormData", m_requestFormData);
         if (!frontend->addResource(m_identifier, jsonObject))
             return;
 
@@ -153,6 +162,8 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
         populateHeadersObject(&requestHeaders, m_requestHeaderFields);
         jsonObject.set("requestHeaders", requestHeaders);
         jsonObject.set("mainResource", m_isMainResource);
+        jsonObject.set("requestMethod", m_requestMethod);
+        jsonObject.set("requestFormData", m_requestFormData);
         jsonObject.set("didRequestChange", true);
     }
 
@@ -191,6 +202,10 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
             jsonObject.set("responseReceivedTime", m_responseReceivedTime);
         if (m_endTime > 0)
             jsonObject.set("endTime", m_endTime);
+        if (m_loadEventTime > 0)
+            jsonObject.set("loadEventTime", m_loadEventTime);
+        if (m_domContentEventTime > 0)
+            jsonObject.set("domContentEventTime", m_domContentEventTime);
         jsonObject.set("didTimingChange", true);
     }
     if (!frontend->updateResource(m_identifier, jsonObject))
@@ -255,32 +270,8 @@ String InspectorResource::sourceString() const
     if (!m_xmlHttpResponseText.isNull())
         return String(m_xmlHttpResponseText);
 
-    RefPtr<SharedBuffer> buffer;
     String textEncodingName;
-
-    if (m_requestURL == m_loader->requestURL()) {
-        buffer = m_loader->mainResourceData();
-        textEncodingName = m_frame->document()->inputEncoding();
-    } else {
-        CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
-        if (!cachedResource)
-            return String();
-
-        if (cachedResource->isPurgeable()) {
-            // If the resource is purgeable then make it unpurgeable to get
-            // get its data. This might fail, in which case we return an
-            // empty String.
-            // FIXME: should we do something else in the case of a purged
-            // resource that informs the user why there is no data in the
-            // inspector?
-            if (!cachedResource->makePurgeable(false))
-                return String();
-        }
-
-        buffer = cachedResource->data();
-        textEncodingName = cachedResource->encoding();
-    }
-
+    RefPtr<SharedBuffer> buffer = resourceData(&textEncodingName);
     if (!buffer)
         return String();
 
@@ -290,6 +281,31 @@ String InspectorResource::sourceString() const
     return encoding.decode(buffer->data(), buffer->size());
 }
 
+PassRefPtr<SharedBuffer> InspectorResource::resourceData(String* textEncodingName) const {
+    if (m_requestURL == m_loader->requestURL()) {
+        *textEncodingName = m_frame->document()->inputEncoding();
+        return m_loader->mainResourceData();
+    }
+
+    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
+    if (!cachedResource)
+        return 0;
+
+    if (cachedResource->isPurgeable()) {
+        // If the resource is purgeable then make it unpurgeable to get
+        // get its data. This might fail, in which case we return an
+        // empty String.
+        // FIXME: should we do something else in the case of a purged
+        // resource that informs the user why there is no data in the
+        // inspector?
+        if (!cachedResource->makePurgeable(false))
+            return 0;
+    }
+
+    *textEncodingName = cachedResource->encoding();
+    return cachedResource->data();
+}
+
 void InspectorResource::startTiming()
 {
     m_startTime = currentTime();
@@ -310,6 +326,18 @@ void InspectorResource::endTiming()
     m_changes.set(CompletionChange);
 }
 
+void InspectorResource::markDOMContentEventTime()
+{
+    m_domContentEventTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
+void InspectorResource::markLoadEventTime()
+{
+    m_loadEventTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
 void InspectorResource::markFailed()
 {
     m_failed = true;
@@ -323,3 +351,5 @@ void InspectorResource::addLength(int lengthReceived)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorResource.h b/WebCore/inspector/InspectorResource.h
index 8380a8f..880eab7 100644
--- a/WebCore/inspector/InspectorResource.h
+++ b/WebCore/inspector/InspectorResource.h
@@ -87,14 +87,24 @@ namespace WebCore {
         void setXMLHttpResponseText(const ScriptString& data);
 
         String sourceString() const;
+        PassRefPtr<SharedBuffer> resourceData(String* textEncodingName) const;
+
         bool isSameLoader(DocumentLoader* loader) const { return loader == m_loader; }
         void markMainResource() { m_isMainResource = true; }
         long long identifier() const { return m_identifier; }
         String requestURL() const { return m_requestURL.string(); }
         Frame* frame() const { return m_frame.get(); }
         const String& mimeType() const { return m_mimeType; }
+        const HTTPHeaderMap& requestHeaderFields() const { return m_requestHeaderFields; }
+        const HTTPHeaderMap& responseHeaderFields() const { return m_responseHeaderFields; }
+        int responseStatusCode() const { return m_responseStatusCode; }
+        String requestMethod() const { return m_requestMethod; }
+        String requestFormData() const { return m_requestFormData; }
+
         void startTiming();
         void markResponseReceivedTime();
+        void markLoadEventTime();
+        void markDOMContentEventTime();
         void endTiming();
 
         void markFailed();
@@ -153,9 +163,13 @@ namespace WebCore {
         double m_startTime;
         double m_responseReceivedTime;
         double m_endTime;
+        double m_loadEventTime;
+        double m_domContentEventTime;
         ScriptString m_xmlHttpResponseText;
         Changes m_changes;
         bool m_isMainResource;
+        String m_requestMethod;
+        String m_requestFormData;
     };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorTimelineAgent.cpp b/WebCore/inspector/InspectorTimelineAgent.cpp
new file mode 100644
index 0000000..c3ad075
--- /dev/null
+++ b/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -0,0 +1,142 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "InspectorTimelineAgent.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "DOMDispatchTimelineItem.h"
+#include "Event.h"
+#include "InspectorFrontend.h"
+#include "TimelineItem.h"
+
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+InspectorTimelineAgent::InspectorTimelineAgent(InspectorFrontend* frontend)
+    : m_sessionStartTime(currentTimeInMilliseconds())
+    , m_frontend(frontend)
+    , m_currentTimelineItem(0)
+{
+    ASSERT(m_frontend);
+}
+
+InspectorTimelineAgent::~InspectorTimelineAgent()
+{
+}
+
+void InspectorTimelineAgent::willDispatchDOMEvent(const Event& event)
+{
+    m_currentTimelineItem = new DOMDispatchTimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), event);
+}
+
+void InspectorTimelineAgent::didDispatchDOMEvent()
+{
+    ASSERT(m_currentTimelineItem->type() == DOMDispatchTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willLayout()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), LayoutTimelineItemType);
+}
+
+void InspectorTimelineAgent::didLayout()
+{
+    ASSERT(m_currentTimelineItem->type() == LayoutTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willRecalculateStyle()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), RecalculateStylesTimelineItemType);
+}
+
+void InspectorTimelineAgent::didRecalculateStyle()
+{
+    ASSERT(m_currentTimelineItem->type() == RecalculateStylesTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willPaint()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), PaintTimelineItemType);
+}
+
+void InspectorTimelineAgent::didPaint()
+{
+    ASSERT(m_currentTimelineItem->type() == PaintTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willWriteHTML()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), ParseHTMLTimelineItemType);
+}
+
+void InspectorTimelineAgent::didWriteHTML()
+{
+    ASSERT(m_currentTimelineItem->type() == ParseHTMLTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::reset()
+{
+    m_sessionStartTime = currentTimeInMilliseconds();
+    m_currentTimelineItem.set(0);
+}
+
+void InspectorTimelineAgent::didCompleteCurrentRecord()
+{
+    OwnPtr<TimelineItem> item(m_currentTimelineItem.release());
+    m_currentTimelineItem = item->releasePrevious();
+
+    item->setEndTime(sessionTimeInMilliseconds());
+    if (m_currentTimelineItem.get())
+        m_currentTimelineItem->addChildItem(item.release());
+    else
+        item->addToTimeline(m_frontend);
+}
+
+double InspectorTimelineAgent::currentTimeInMilliseconds()
+{
+    return currentTime() * 1000.0;
+}
+
+double InspectorTimelineAgent::sessionTimeInMilliseconds()
+{
+    return currentTimeInMilliseconds() - m_sessionStartTime;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorTimelineAgent.h b/WebCore/inspector/InspectorTimelineAgent.h
new file mode 100644
index 0000000..4095fed
--- /dev/null
+++ b/WebCore/inspector/InspectorTimelineAgent.h
@@ -0,0 +1,77 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef InspectorTimelineAgent_h
+#define InspectorTimelineAgent_h
+
+#include "ScriptObject.h"
+#include "ScriptArray.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+    class Event;
+    class InspectorFrontend;
+    class TimelineItem;
+
+    class InspectorTimelineAgent {
+    public:
+        InspectorTimelineAgent(InspectorFrontend* frontend);
+        ~InspectorTimelineAgent();
+
+        void reset();
+
+        // Methods called from WebCore.
+        void willDispatchDOMEvent(const Event&);
+        void didDispatchDOMEvent();
+        void willLayout();
+        void didLayout();
+        void willRecalculateStyle();
+        void didRecalculateStyle();
+        void willPaint();
+        void didPaint();
+        void didWriteHTML();
+        void willWriteHTML();
+    private:
+        double sessionTimeInMilliseconds();
+
+        static double currentTimeInMilliseconds();
+
+        void didCompleteCurrentRecord();
+
+        double m_sessionStartTime;
+        InspectorFrontend* m_frontend;
+        OwnPtr<TimelineItem> m_currentTimelineItem;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(InspectorTimelineAgent_h)
diff --git a/WebCore/inspector/JavaScriptDebugServer.cpp b/WebCore/inspector/JavaScriptDebugServer.cpp
index 10eff26..e460ae8 100644
--- a/WebCore/inspector/JavaScriptDebugServer.cpp
+++ b/WebCore/inspector/JavaScriptDebugServer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,10 +45,8 @@
 #include "ScrollView.h"
 #include "Widget.h"
 #include "ScriptController.h"
-#include <runtime/CollectorHeapIterator.h>
 #include <debugger/DebuggerCallFrame.h>
 #include <runtime/JSLock.h>
-#include <parser/Parser.h>
 #include <wtf/MainThread.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/UnusedParam.h>
@@ -59,6 +57,16 @@ namespace WebCore {
 
 typedef JavaScriptDebugServer::ListenerSet ListenerSet;
 
+inline const UString& JavaScriptDebugServer::BreakpointInfo::condition() const
+{
+    return m_condition;
+}
+
+void JavaScriptDebugServer::BreakpointInfo::setCondition(const UString& condition)
+{
+    m_condition = condition;
+}
+
 JavaScriptDebugServer& JavaScriptDebugServer::shared()
 {
     DEFINE_STATIC_LOCAL(JavaScriptDebugServer, server, ());
@@ -157,42 +165,86 @@ bool JavaScriptDebugServer::hasListenersInterestedInPage(Page* page)
     return m_pageListenersMap.contains(page);
 }
 
-void JavaScriptDebugServer::addBreakpoint(intptr_t sourceID, unsigned lineNumber)
+void JavaScriptDebugServer::addBreakpoint(intptr_t sourceID, unsigned lineNumber, const UString& condition)
 {
-    HashSet<unsigned>* lines = m_breakpoints.get(sourceID);
-    if (!lines) {
-        lines = new HashSet<unsigned>;
-        m_breakpoints.set(sourceID, lines);
+    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
+    if (!sourceBreakpoints) {
+        sourceBreakpoints = new LineToBreakpointInfoMap;
+        m_breakpoints.set(sourceID, sourceBreakpoints);
     }
+    BreakpointInfo* info = sourceBreakpoints->get(lineNumber);
+    if (!info)
+        sourceBreakpoints->set(lineNumber, new BreakpointInfo(condition));
+    else
+        updateBreakpointInfo(info, condition);
+}
 
-    lines->add(lineNumber);
+JavaScriptDebugServer::BreakpointInfo* JavaScriptDebugServer::breakpointInfo(intptr_t sourceID, unsigned lineNumber) const
+{
+    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
+    if (!sourceBreakpoints)
+        return 0;
+    return sourceBreakpoints->get(lineNumber);
 }
 
-void JavaScriptDebugServer::removeBreakpoint(intptr_t sourceID, unsigned lineNumber)
+void JavaScriptDebugServer::updateBreakpoint(intptr_t sourceID, unsigned lineNumber, const UString& condition)
 {
-    HashSet<unsigned>* lines = m_breakpoints.get(sourceID);
-    if (!lines)
+    BreakpointInfo* info = breakpointInfo(sourceID, lineNumber);
+    if (!info)
         return;
+    updateBreakpointInfo(info, condition);
+}
 
-    lines->remove(lineNumber);
+void JavaScriptDebugServer::updateBreakpointInfo(BreakpointInfo* info, const UString& condition)
+{
+    info->setCondition(condition);
+}
 
-    if (!lines->isEmpty())
+void JavaScriptDebugServer::removeBreakpoint(intptr_t sourceID, unsigned lineNumber)
+{
+    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
+    if (!sourceBreakpoints)
         return;
 
-    m_breakpoints.remove(sourceID);
-    delete lines;
+    BreakpointInfo* info = sourceBreakpoints->get(lineNumber);
+    if (!info)
+        return;
+
+    sourceBreakpoints->remove(lineNumber);
+    delete info;
+
+    if (sourceBreakpoints->isEmpty()) {
+        m_breakpoints.remove(sourceID);
+        delete sourceBreakpoints;
+    }
 }
 
 bool JavaScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const
 {
-    HashSet<unsigned>* lines = m_breakpoints.get(sourceID);
-    if (!lines)
+    BreakpointInfo* info = breakpointInfo(sourceID, lineNumber);
+    if (!info)
         return false;
-    return lines->contains(lineNumber);
+
+    // An empty condition counts as no condition which is equivalent to "true".
+    if (info->condition().isEmpty())
+        return true;
+
+    JSValue exception;
+    JSValue result = m_currentCallFrame->evaluate(info->condition(), exception);
+    if (exception) {
+        // An erroneous condition counts as "false".
+        return false;
+    }
+    return result.toBoolean(m_currentCallFrame->scopeChain()->globalObject->globalExec());
 }
 
 void JavaScriptDebugServer::clearBreakpoints()
 {
+    BreakpointsMap::iterator end = m_breakpoints.end();
+    for (BreakpointsMap::iterator it = m_breakpoints.begin(); it != end; ++it) {
+        deleteAllValues(*(it->second));
+        it->second->clear();
+    }
     deleteAllValues(m_breakpoints);
     m_breakpoints.clear();
 }
@@ -299,8 +351,6 @@ void JavaScriptDebugServer::sourceParsed(ExecState* exec, const SourceCode& sour
 
     m_callingListeners = true;
 
-    ASSERT(hasListeners());
-
     bool isError = errorLine != -1;
 
     if (hasGlobalListeners()) {
@@ -555,60 +605,7 @@ void JavaScriptDebugServer::recompileAllJSFunctionsSoon()
 void JavaScriptDebugServer::recompileAllJSFunctions(Timer<JavaScriptDebugServer>*)
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSGlobalData* globalData = JSDOMWindow::commonJSGlobalData();
-
-    // If JavaScript is running, it's not safe to recompile, since we'll end
-    // up throwing away code that is live on the stack.
-    ASSERT(!globalData->dynamicGlobalObject);
-    if (globalData->dynamicGlobalObject)
-        return;
-
-    Vector<ProtectedPtr<JSFunction> > functions;
-    Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
-    for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
-        if ((*it)->isObject(&JSFunction::info)) {
-            JSFunction* function = static_cast<JSFunction*>(*it);
-            if (!function->isHostFunction())
-                functions.append(function);
-        }
-    }
-
-    typedef HashMap<RefPtr<FunctionBodyNode>, RefPtr<FunctionBodyNode> > FunctionBodyMap;
-    typedef HashMap<SourceProvider*, ExecState*> SourceProviderMap;
-
-    FunctionBodyMap functionBodies;
-    SourceProviderMap sourceProviders;
-
-    size_t size = functions.size();
-    for (size_t i = 0; i < size; ++i) {
-        JSFunction* function = functions[i];
-
-        FunctionBodyNode* oldBody = function->body();
-        pair<FunctionBodyMap::iterator, bool> result = functionBodies.add(oldBody, 0);
-        if (!result.second) {
-            function->setBody(result.first->second.get());
-            continue;
-        }
-
-        ExecState* exec = function->scope().globalObject()->JSGlobalObject::globalExec();
-        const SourceCode& sourceCode = oldBody->source();
-
-        RefPtr<FunctionBodyNode> newBody = globalData->parser->parse<FunctionBodyNode>(exec, 0, sourceCode);
-        ASSERT(newBody);
-        newBody->finishParsing(oldBody->copyParameters(), oldBody->parameterCount());
-
-        result.first->second = newBody;
-        function->setBody(newBody.release());
-
-        if (hasListeners() && function->scope().globalObject()->debugger() == this)
-            sourceProviders.add(sourceCode.provider(), exec);
-    }
-
-    // Call sourceParsed() after reparsing all functions because it will execute
-    // JavaScript in the inspector.
-    SourceProviderMap::const_iterator end = sourceProviders.end();
-    for (SourceProviderMap::const_iterator iter = sourceProviders.begin(); iter != end; ++iter)
-        sourceParsed((*iter).second, SourceCode((*iter).first), -1, 0);
+    Debugger::recompileAllJSFunctions(JSDOMWindow::commonJSGlobalData());
 }
 
 void JavaScriptDebugServer::didAddListener(Page* page)
diff --git a/WebCore/inspector/JavaScriptDebugServer.h b/WebCore/inspector/JavaScriptDebugServer.h
index baa6699..33c6e3d 100644
--- a/WebCore/inspector/JavaScriptDebugServer.h
+++ b/WebCore/inspector/JavaScriptDebugServer.h
@@ -33,6 +33,7 @@
 
 #include "Timer.h"
 #include <debugger/Debugger.h>
+#include <runtime/UString.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
@@ -61,7 +62,8 @@ namespace WebCore {
         void addListener(JavaScriptDebugListener*, Page*);
         void removeListener(JavaScriptDebugListener*, Page*);
 
-        void addBreakpoint(intptr_t sourceID, unsigned lineNumber);
+        void addBreakpoint(intptr_t sourceID, unsigned lineNumber, const JSC::UString& condition);
+        void updateBreakpoint(intptr_t sourceID, unsigned lineNumber, const JSC::UString& condition);
         void removeBreakpoint(intptr_t sourceID, unsigned lineNumber);
         bool hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const;
         void clearBreakpoints();
@@ -86,6 +88,15 @@ namespace WebCore {
         typedef void (JavaScriptDebugListener::*JavaScriptExecutionCallback)();
 
     private:
+        class BreakpointInfo {
+        public:
+            BreakpointInfo(const JSC::UString& condition) : m_condition(condition) {}
+            const JSC::UString& condition() const;
+            void setCondition(const JSC::UString& condition);
+        private:
+            JSC::UString m_condition;
+        };
+
         JavaScriptDebugServer();
         ~JavaScriptDebugServer();
 
@@ -100,7 +111,9 @@ namespace WebCore {
 
         void dispatchFunctionToListeners(JavaScriptExecutionCallback, Page*);
         void pauseIfNeeded(Page*);
-        
+        BreakpointInfo* breakpointInfo(intptr_t sourceID, unsigned lineNumber) const;
+        void updateBreakpointInfo(BreakpointInfo* info, const JSC::UString& condition);
+
         virtual void detach(JSC::JSGlobalObject*);
 
         virtual void sourceParsed(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMsg);
@@ -111,12 +124,15 @@ namespace WebCore {
         virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
         virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
         virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-        
+
         void didAddListener(Page*);
         void didRemoveListener(Page*);
         void didRemoveLastListener();
 
         typedef HashMap<Page*, ListenerSet*> PageListenersMap;
+        typedef HashMap<unsigned, BreakpointInfo*> LineToBreakpointInfoMap;
+        typedef HashMap<intptr_t, LineToBreakpointInfoMap*> BreakpointsMap;
+
         PageListenersMap m_pageListenersMap;
         ListenerSet m_listeners;
         bool m_callingListeners;
@@ -126,7 +142,7 @@ namespace WebCore {
         bool m_doneProcessingDebuggerEvents;
         JavaScriptCallFrame* m_pauseOnCallFrame;
         RefPtr<JavaScriptCallFrame> m_currentCallFrame;
-        HashMap<intptr_t, HashSet<unsigned>*> m_breakpoints;
+        BreakpointsMap m_breakpoints;
         Timer<JavaScriptDebugServer> m_recompileTimer;
     };
 
diff --git a/WebCore/inspector/TimelineItem.cpp b/WebCore/inspector/TimelineItem.cpp
new file mode 100644
index 0000000..b368c49
--- /dev/null
+++ b/WebCore/inspector/TimelineItem.cpp
@@ -0,0 +1,81 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "TimelineItem.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "InspectorFrontend.h"
+#include "ScriptArray.h"
+#include "ScriptObject.h"
+
+namespace WebCore {
+
+TimelineItem::TimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, TimelineItemType itemType)
+    : m_startTime(startTime)
+    , m_endTime(0.0)
+    , m_itemType(itemType)
+    , m_previous(previous)
+{
+}
+
+void TimelineItem::addToTimeline(InspectorFrontend* frontend)
+{
+    frontend->addItemToTimeline(convertToScriptObject(frontend));
+}
+
+ScriptObject TimelineItem::convertToScriptObject(InspectorFrontend* frontend)
+{
+    ScriptObject selfObj = frontend->newScriptObject();
+    selfObj.set("time", m_startTime);
+    selfObj.set("type", static_cast<int>(m_itemType));
+    selfObj.set("duration", m_endTime - m_startTime);
+    ScriptArray children = convertChildrenToScriptArray(frontend);
+    selfObj.set("children", children);
+    return selfObj;
+}
+
+ScriptArray TimelineItem::convertChildrenToScriptArray(InspectorFrontend* frontend)
+{
+    ScriptArray children = frontend->newScriptArray();
+    for (unsigned i = 0; i < m_children.size(); ++i)
+        children.set(i, m_children[i]->convertToScriptObject(frontend));
+    return children;
+}
+
+void TimelineItem::addChildItem(PassOwnPtr<TimelineItem> timelineItem)
+{
+    m_children.append(timelineItem);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/TimelineItem.h b/WebCore/inspector/TimelineItem.h
new file mode 100644
index 0000000..1909230
--- /dev/null
+++ b/WebCore/inspector/TimelineItem.h
@@ -0,0 +1,88 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef TimelineItem_h
+#define TimelineItem_h
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class InspectorFrontend;
+    class TimelineItem;
+    class ScriptArray;
+    class ScriptObject;
+
+    typedef Vector<OwnPtr<TimelineItem> > TimelineItems;
+
+    // Must be kept in sync with TimelineAgent.js
+    enum TimelineItemType {
+        DOMDispatchTimelineItemType = 0,
+        LayoutTimelineItemType = 1,
+        RecalculateStylesTimelineItemType = 2,
+        PaintTimelineItemType = 3,
+        ParseHTMLTimelineItemType = 4,
+    };
+
+    class TimelineItem {
+    public:
+        TimelineItem(PassOwnPtr<TimelineItem>, double startTime, TimelineItemType);
+
+        virtual ~TimelineItem() { }
+
+        TimelineItem* previous() const { return m_previous.get(); }
+
+        PassOwnPtr<TimelineItem*> releasePrevious() { return m_previous.release(); }
+
+        void addToTimeline(InspectorFrontend*);
+
+        void addChildItem(PassOwnPtr<TimelineItem>);
+
+        void setEndTime(double endTime) { m_endTime = endTime; }
+
+        TimelineItemType type() { return m_itemType; }
+    protected:
+        virtual ScriptObject convertToScriptObject(InspectorFrontend*);
+
+        ScriptArray convertChildrenToScriptArray(InspectorFrontend*);
+      
+    private:
+        double m_startTime;
+        double m_endTime;
+        TimelineItemType m_itemType;
+        OwnPtr<TimelineItem> m_previous;
+        TimelineItems m_children;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(TimelineItem_h)
diff --git a/WebCore/inspector/front-end/Breakpoint.js b/WebCore/inspector/front-end/Breakpoint.js
index 347df60..292975a 100644
--- a/WebCore/inspector/front-end/Breakpoint.js
+++ b/WebCore/inspector/front-end/Breakpoint.js
@@ -23,13 +23,14 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Breakpoint = function(url, line, sourceID)
+WebInspector.Breakpoint = function(url, line, sourceID, condition)
 {
     this.url = url;
     this.line = line;
     this.sourceID = sourceID;
     this._enabled = true;
     this._sourceText = "";
+    this._condition = condition || "";
 }
 
 WebInspector.Breakpoint.prototype = {
@@ -71,6 +72,24 @@ WebInspector.Breakpoint.prototype = {
     get id()
     {
         return this.sourceID + ":" + this.line;
+    },
+
+    get condition()
+    {
+        return this._condition;
+    },
+
+    set condition(c)
+    {
+        c = c || "";
+        if (this._condition === c)
+            return;
+
+        this._condition = c;
+        this.dispatchEventToListeners("condition-changed");
+
+        if (this.enabled)
+            InspectorController.updateBreakpoint(this.sourceID, this.line, c);
     }
 }
 
diff --git a/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index 14f8c06..e6edece 100644
--- a/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -62,7 +62,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             return;
 
         if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line);
+            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
     },
 
     _appendBreakpointElement: function(breakpoint)
@@ -150,7 +150,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             return;
 
         if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line);
+            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
         else
             InspectorController.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
     },
diff --git a/WebCore/inspector/front-end/CallStackSidebarPane.js b/WebCore/inspector/front-end/CallStackSidebarPane.js
index c08cc7a..2fe4315 100644
--- a/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -39,14 +39,14 @@ WebInspector.CallStackSidebarPane = function()
 }
 
 WebInspector.CallStackSidebarPane.prototype = {
-    update: function(callFrame, sourceIDMap)
+    update: function(callFrames, sourceIDMap)
     {
         this.bodyElement.removeChildren();
 
         this.placards = [];
         delete this._selectedCallFrame;
 
-        if (!callFrame) {
+        if (!callFrames) {
             var infoElement = document.createElement("div");
             infoElement.className = "info";
             infoElement.textContent = WebInspector.UIString("Not Paused");
@@ -58,7 +58,8 @@ WebInspector.CallStackSidebarPane.prototype = {
         var subtitle;
         var scriptOrResource;
 
-        do {
+        for (var i = 0; i < callFrames.length; ++i) {
+            var callFrame = callFrames[i];
             switch (callFrame.type) {
             case "function":
                 title = callFrame.functionName || WebInspector.UIString("(anonymous function)");
@@ -85,9 +86,7 @@ WebInspector.CallStackSidebarPane.prototype = {
 
             this.placards.push(placard);
             this.bodyElement.appendChild(placard.element);
-
-            callFrame = callFrame.caller;
-        } while (callFrame);
+        }
     },
 
     get selectedCallFrame()
diff --git a/WebCore/inspector/front-end/Color.js b/WebCore/inspector/front-end/Color.js
index 7968ee4..9d9cd76 100644
--- a/WebCore/inspector/front-end/Color.js
+++ b/WebCore/inspector/front-end/Color.js
@@ -30,7 +30,7 @@
 WebInspector.Color = function(str)
 {
     this.value = str;
-    this.parse();
+    this._parse();
 }
 
 WebInspector.Color.prototype = {
@@ -70,7 +70,7 @@ WebInspector.Color.prototype = {
             return this._rgb;
 
         if (this.simple)
-            this._rgb = this.hexToRgb(this.hex);
+            this._rgb = this._hexToRGB(this.hex);
         else {
             var rgba = this.rgba;
             this._rgb = [rgba[0], rgba[1], rgba[2]];
@@ -89,7 +89,7 @@ WebInspector.Color.prototype = {
         if ("_hsl" in this)
             return this._hsl;
 
-        this._hsl = this.rgbToHsl(this.rgb);
+        this._hsl = this._rgbToHSL(this.rgb);
         return this._hsl;
     },
 
@@ -137,44 +137,34 @@ WebInspector.Color.prototype = {
         return (shorthex && shorthex.length === 3);
     },
 
-    toRgb: function()
+    toString: function(format)
     {
-        return "rgb(" + this.rgb.join(", ") + ")";
-    },
-
-    toHsl: function()
-    {
-        var hsl = this.hsl;
-        return "hsl(" + hsl[0] + ", " + hsl[1] + "%, " + hsl[2] + "%)";
-    },
-
-    toShortHex: function()
-    {
-        return "#" + this.shorthex;
-    },
-
-    toHex: function()
-    {
-        return "#" + this.hex;
-    },
-
-    toRgba: function()
-    {
-        return "rgba(" + this.rgba.join(", ") + ")";
-    },
-
-    toHsla: function()
-    {
-        var hsla = this.hsla;
-        return "hsla(" + hsla[0] + ", " + hsla[1] + "%, " + hsla[2] + "%, " + hsla[3] + ")";
-    },
+        if (!format)
+            format = this.format;
+
+        switch (format) {
+            case "rgb":
+                return "rgb(" + this.rgb.join(", ") + ")";
+            case "rgba":
+                return "rgba(" + this.rgba.join(", ") + ")";
+            case "hsl":
+                var hsl = this.hsl;
+                return "hsl(" + hsl[0] + ", " + hsl[1] + "%, " + hsl[2] + "%)";
+            case "hsla":
+                var hsla = this.hsla;
+                return "hsla(" + hsla[0] + ", " + hsla[1] + "%, " + hsla[2] + "%, " + hsla[3] + ")";
+            case "hex":
+                return "#" + this.hex;
+            case "shorthex":
+                return "#" + this.shorthex;
+            case "nickname":
+                return this.nickname;
+        }
 
-    toNickname: function()
-    {
-        return this.nickname;
+        throw "invalid color format";
     },
 
-    rgbToHex: function(rgb)
+    _rgbToHex: function(rgb)
     {
         var r = parseInt(rgb[0]).toString(16);
         var g = parseInt(rgb[1]).toString(16);
@@ -189,7 +179,7 @@ WebInspector.Color.prototype = {
         return (r + g + b).toUpperCase();
     },
 
-    hexToRgb: function(hex)
+    _hexToRGB: function(hex)
     {
         var r = parseInt(hex.substring(0,2), 16);
         var g = parseInt(hex.substring(2,4), 16);
@@ -198,7 +188,7 @@ WebInspector.Color.prototype = {
         return [r, g, b];
     },
 
-    rgbToHsl: function(rgb)
+    _rgbToHSL: function(rgb)
     {
         var r = parseInt(rgb[0]) / 255;
         var g = parseInt(rgb[1]) / 255;
@@ -235,7 +225,7 @@ WebInspector.Color.prototype = {
         return [h, s, l];
     },
 
-    hslToRgb: function(hsl)
+    _hslToRGB: function(hsl)
     {
         var h = parseFloat(hsl[0]) / 360;
         var s = parseFloat(hsl[1]) / 100;
@@ -252,12 +242,12 @@ WebInspector.Color.prototype = {
         var tg = h;
         var tb = h - (1 / 3);
 
-        var r = Math.round(hueToRgb(p, q, tr) * 255);
-        var g = Math.round(hueToRgb(p, q, tg) * 255);
-        var b = Math.round(hueToRgb(p, q, tb) * 255);
+        var r = Math.round(hueToRGB(p, q, tr) * 255);
+        var g = Math.round(hueToRGB(p, q, tg) * 255);
+        var b = Math.round(hueToRGB(p, q, tb) * 255);
         return [r, g, b];
 
-        function hueToRgb(p, q, h) {
+        function hueToRGB(p, q, h) {
             if (h < 0)
                 h += 1;
             else if (h > 1)
@@ -274,28 +264,28 @@ WebInspector.Color.prototype = {
         }
     },
 
-    rgbaToHsla: function(rgba)
+    _rgbaToHSLA: function(rgba)
     {
         var alpha = rgba[3];
-        var hsl = this.rgbToHsl(rgba)
+        var hsl = this._rgbToHSL(rgba)
         hsl.push(alpha);
         return hsl;
     },
 
-    hslaToRgba: function(hsla)
+    _hslaToRGBA: function(hsla)
     {
         var alpha = hsla[3];
-        var rgb = this.hslToRgb(hsla);
+        var rgb = this._hslToRGB(hsla);
         rgb.push(alpha);
         return rgb;
     },
 
-    parse: function()
+    _parse: function()
     {
         // Special Values - Advanced but Must Be Parsed First - transparent
         var value = this.value.toLowerCase().replace(/%|\s+/g, "");
         if (value in WebInspector.Color.AdvancedNickNames) {
-            this.mode = "nickname";
+            this.format = "nickname";
             var set = WebInspector.Color.AdvancedNickNames[value];
             this.simple = false;
             this.rgba = set[0];
@@ -314,30 +304,30 @@ WebInspector.Color.prototype = {
             if (match[1]) { // hex
                 var hex = match[1].toUpperCase();
                 if (hex.length === 3) {
-                    this.mode = "shorthex";
+                    this.format = "shorthex";
                     this.hex = hex.charAt(0) + hex.charAt(0) + hex.charAt(1) + hex.charAt(1) + hex.charAt(2) + hex.charAt(2);
                 } else {
-                    this.mode = "hex";
+                    this.format = "hex";
                     this.hex = hex;
                 }
             } else if (match[2]) { // rgb
-                this.mode = "rgb";
+                this.format = "rgb";
                 var rgb = match[2].split(/\s*,\s*/);
                 this.rgb = rgb;
-                this.hex = this.rgbToHex(rgb);
+                this.hex = this._rgbToHex(rgb);
             } else if (match[3]) { // nickname
                 var nickname = match[3].toLowerCase();
                 if (nickname in WebInspector.Color.Nicknames) {
-                    this.mode = "nickname";
+                    this.format = "nickname";
                     this.hex = WebInspector.Color.Nicknames[nickname];
                 } else // unknown name
-                    throw("unknown color name");
+                    throw "unknown color name";
             } else if (match[4]) { // hsl
-                this.mode = "hsl";
+                this.format = "hsl";
                 var hsl = match[4].replace(/%g/, "").split(/\s*,\s*/);
                 this.hsl = hsl;
-                this.rgb = this.hslToRgb(hsl);
-                this.hex = this.rgbToHex(this.rgb);
+                this.rgb = this._hslToRGB(hsl);
+                this.hex = this._rgbToHex(this.rgb);
             }
 
             // Fill in the values if this is a known hex color
@@ -358,14 +348,14 @@ WebInspector.Color.prototype = {
         if (match) {
             this.simple = false;
             if (match[1]) { // rgba
-                this.mode = "rgba";
+                this.format = "rgba";
                 this.rgba = match[1].split(/\s*,\s*/);
-                this.hsla = this.rgbaToHsla(this.rgba);
+                this.hsla = this._rgbaToHSLA(this.rgba);
                 this.alpha = this.rgba[3];
             } else if (match[2]) { // hsla
-                this.mode = "hsla";
+                this.format = "hsla";
                 this.hsla = match[2].replace(/%/g, "").split(/\s*,\s*/);
-                this.rgba = this.hslaToRgba(this.hsla);
+                this.rgba = this._hslaToRGBA(this.hsla);
                 this.alpha = this.hsla[3];
             }
 
@@ -373,7 +363,7 @@ WebInspector.Color.prototype = {
         }
 
         // Could not parse as a valid color
-        throw("could not parse color");
+        throw "could not parse color";
     }
 }
 
diff --git a/WebCore/inspector/front-end/ConsoleView.js b/WebCore/inspector/front-end/ConsoleView.js
index 6851eea..3782d32 100644
--- a/WebCore/inspector/front-end/ConsoleView.js
+++ b/WebCore/inspector/front-end/ConsoleView.js
@@ -57,10 +57,87 @@ WebInspector.ConsoleView = function(drawer)
 
     var anchoredStatusBar = document.getElementById("anchored-status-bar-items");
     anchoredStatusBar.appendChild(this.toggleConsoleButton);
-
+    
+    // Will hold the list of filter elements
+    this.filterBarElement = document.getElementById("console-filter");
+    
+    function createDividerElement() {
+        var dividerElement = document.createElement("div");
+        
+        dividerElement.addStyleClass("divider");
+        
+        this.filterBarElement.appendChild(dividerElement);
+    }
+    
+    function createFilterElement(category) {
+        var categoryElement = document.createElement("li");
+        categoryElement.category = category;
+     
+        categoryElement.addStyleClass(categoryElement.category);
+            
+        var label = category.toString();
+        categoryElement.appendChild(document.createTextNode(label));
+     
+        categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
+     
+        this.filterBarElement.appendChild(categoryElement);
+        return categoryElement;
+    }
+    
+    this.allElement = createFilterElement.call(this, "All");
+    
+    createDividerElement.call(this);
+    
+    this.errorElement = createFilterElement.call(this, "Errors");
+    this.warningElement = createFilterElement.call(this, "Warnings");
+    this.logElement = createFilterElement.call(this, "Logs");
+
+    this.filter(this.allElement);
 }
 
 WebInspector.ConsoleView.prototype = {
+    
+    _updateFilter: function(e)
+    {
+        this.filter(e.target);
+    },
+    
+    filter: function(target)
+    {
+        if (target.category == "All") {
+            if (target.hasStyleClass("selected")) {
+                // We can't unselect all, so we break early here
+                return;
+            }
+            
+            this.errorElement.removeStyleClass("selected");
+            this.warningElement.removeStyleClass("selected");
+            this.logElement.removeStyleClass("selected");
+            
+            document.getElementById("console-messages").removeStyleClass("filter-errors");
+            document.getElementById("console-messages").removeStyleClass("filter-warnings");
+            document.getElementById("console-messages").removeStyleClass("filter-logs");
+        } else {
+            // Something other than all is being selected, so we want to unselect all
+            if (this.allElement.hasStyleClass("selected")) {
+                this.allElement.removeStyleClass("selected");
+                document.getElementById("console-messages").removeStyleClass("filter-all");
+            }
+        }
+        
+        if (target.hasStyleClass("selected")) {
+            target.removeStyleClass("selected");
+            var newClass = "filter-" + target.category.toLowerCase();
+            var filterElement = document.getElementById("console-messages");
+            filterElement.removeStyleClass(newClass);
+        } else {
+            target.addStyleClass("selected");
+            var newClass = "filter-" + target.category.toLowerCase();
+            var filterElement = document.getElementById("console-messages");
+            filterElement.addStyleClass(newClass);
+        }
+    },
+    
     _toggleConsoleButtonClicked: function()
     {
         this.drawer.visibleView = this;
@@ -70,6 +147,7 @@ WebInspector.ConsoleView.prototype = {
     {
         mainElement.appendChild(this.element);
         statusBarElement.appendChild(this.clearButton);
+        statusBarElement.appendChild(this.filterBarElement);
     },
 
     show: function()
@@ -175,7 +253,7 @@ WebInspector.ConsoleView.prototype = {
     clearMessages: function(clearInspectorController)
     {
         if (clearInspectorController)
-            InspectorController.clearMessages();
+            InspectorController.clearMessages(false);
         if (WebInspector.panels.resources)
             WebInspector.panels.resources.clearMessages();
 
@@ -212,10 +290,28 @@ WebInspector.ConsoleView.prototype = {
             return;
 
         var reportCompletions = this._reportCompletions.bind(this, bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix);
-        this._evalInInspectedWindow(expressionString, reportCompletions);
+        // Collect comma separated object properties for the completion.
+
+        if (!expressionString) {
+            if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
+                // Evaluate into properties in scope of the selected call frame.
+                reportCompletions(WebInspector.panels.scripts.variablesInSelectedCallFrame());
+                return;
+            } else {
+                expressionString = "this";
+            }
+        }
+
+        var includeInspectorCommandLineAPI = (!dotNotation && !bracketNotation);
+        if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused)
+            var callFrameId = WebInspector.panels.scripts.selectedCallFrameId();
+        InjectedScriptAccess.getCompletions(expressionString, includeInspectorCommandLineAPI, callFrameId, reportCompletions);
     },
 
-    _reportCompletions: function(bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix, result) {
+    _reportCompletions: function(bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix, result, isException) {
+        if (isException)
+            return;
+
         if (bracketNotation) {
             if (prefix.length && prefix[0] === "'")
                 var quoteUsed = "'";
@@ -224,16 +320,7 @@ WebInspector.ConsoleView.prototype = {
         }
 
         var results = [];
-        var properties = Object.properties(result);
-        if (!dotNotation && !bracketNotation && result._inspectorCommandLineAPI) {
-            var commandLineAPI = Object.properties(result._inspectorCommandLineAPI);
-            for (var i = 0; i < commandLineAPI.length; ++i) {
-                var property = commandLineAPI[i];
-                if (property.charAt(0) !== "_")
-                    properties.push(property);
-            }
-        }
-        properties.sort();
+        var properties = Object.sortedProperties(result);
 
         for (var i = 0; i < properties.length; ++i) {
             var property = properties[i];
@@ -288,7 +375,7 @@ WebInspector.ConsoleView.prototype = {
         if (!link || !link.representedNode)
             return;
 
-        WebInspector.updateFocusedNode(link.representedNode);
+        WebInspector.updateFocusedNode(link.representedNode.id);
         event.stopPropagation();
         event.preventDefault();
     },
@@ -304,106 +391,27 @@ WebInspector.ConsoleView.prototype = {
         this.prompt.handleKeyEvent(event);
     },
 
-    _evalInInspectedWindow: function(expression, callback)
+    evalInInspectedWindow: function(expression, objectGroup, callback)
     {
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
-            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, callback);
+            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, objectGroup, callback);
             return;
         }
-        this.doEvalInWindow(expression, callback);
-    },
-
-    _ensureCommandLineAPIInstalled: function(inspectedWindow)
-    {
-        if (!inspectedWindow._inspectorCommandLineAPI) {
-            inspectedWindow.eval("window._inspectorCommandLineAPI = { \
-                $: function() { return document.getElementById.apply(document, arguments) }, \
-                $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
-                $x: function(xpath, context) { \
-                    var nodes = []; \
-                    try { \
-                        var doc = context || document; \
-                        var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \
-                        var node; \
-                        while (node = results.iterateNext()) nodes.push(node); \
-                    } catch (e) {} \
-                    return nodes; \
-                }, \
-                dir: function() { return console.dir.apply(console, arguments) }, \
-                dirxml: function() { return console.dirxml.apply(console, arguments) }, \
-                keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \
-                values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
-                profile: function() { return console.profile.apply(console, arguments) }, \
-                profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
-                _inspectedNodes: [], \
-                get $0() { return _inspectorCommandLineAPI._inspectedNodes[0] }, \
-                get $1() { return _inspectorCommandLineAPI._inspectedNodes[1] }, \
-                get $2() { return _inspectorCommandLineAPI._inspectedNodes[2] }, \
-                get $3() { return _inspectorCommandLineAPI._inspectedNodes[3] }, \
-                get $4() { return _inspectorCommandLineAPI._inspectedNodes[4] } \
-            };");
-
-            inspectedWindow._inspectorCommandLineAPI.clear = InspectorController.wrapCallback(this.clearMessages.bind(this));
-            inspectedWindow._inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(inspectObject.bind(this));
-
-            function inspectObject(o)
-            {
-                if (arguments.length === 0)
-                    return;
-
-                InspectorController.inspectedWindow().console.log(o);
-                if (Object.type(o, InspectorController.inspectedWindow()) === "node") {
-                    WebInspector.showElementsPanel();
-                    WebInspector.panels.elements.treeOutline.revealAndSelectNode(o);
-                } else {
-                    switch (Object.describe(o)) {
-                        case "Database":
-                            WebInspector.showDatabasesPanel();
-                            WebInspector.panels.databases.selectDatabase(o);
-                            break;
-                        case "Storage":
-                            WebInspector.showDatabasesPanel();
-                            WebInspector.panels.databases.selectDOMStorage(o);
-                            break;
-                    }
-                }
-            }
-        }
+        this.doEvalInWindow(expression, objectGroup, callback);
     },
 
-    addInspectedNode: function(node)
-    {
-        var inspectedWindow = InspectorController.inspectedWindow();
-        this._ensureCommandLineAPIInstalled(inspectedWindow);
-        var inspectedNodes = inspectedWindow._inspectorCommandLineAPI._inspectedNodes;
-        inspectedNodes.unshift(node);
-        if (inspectedNodes.length >= 5)
-            inspectedNodes.pop();
-    },
-
-    doEvalInWindow: function(expression, callback)
+    doEvalInWindow: function(expression, objectGroup, callback)
     {
         if (!expression) {
             // There is no expression, so the completion should happen against global properties.
             expression = "this";
         }
 
-        // Surround the expression in with statements to inject our command line API so that
-        // the window object properties still take more precedent than our API functions.
-        expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
-
-        var self = this;
-        function delayedEvaluation()
+        function evalCallback(result)
         {
-            var inspectedWindow = InspectorController.inspectedWindow();
-            self._ensureCommandLineAPIInstalled(inspectedWindow);
-            try {
-                callback(inspectedWindow.eval(expression));
-            } catch (e) {
-                callback(e, true);
-            }
-        }
-        setTimeout(delayedEvaluation, 0);
+            callback(result.value, result.isException);
+        };
+        InjectedScriptAccess.evaluate(expression, objectGroup, evalCallback);
     },
 
     _enterKeyPressed: function(event)
@@ -431,18 +439,23 @@ WebInspector.ConsoleView.prototype = {
             self.prompt.text = "";
             self.addMessage(new WebInspector.ConsoleCommandResult(result, exception, commandMessage));
         }
-        this._evalInInspectedWindow(str, printResult);
+        this.evalInInspectedWindow(str, "console", printResult);
     },
 
     _format: function(output, forceObjectFormat)
     {
-        var inspectedWindow = InspectorController.inspectedWindow();
+        var isProxy = (output != null && typeof output === "object");
+
         if (forceObjectFormat)
             var type = "object";
-        else if (output instanceof inspectedWindow.NodeList)
-            var type = "array";
         else
-            var type = Object.type(output, inspectedWindow);
+            var type = Object.proxyType(output);
+
+        if (isProxy && type !== "object" && type !== "function" && type !== "array" && type !== "node") {
+            // Unwrap primitive value, skip decoration.
+            output = output.description;
+            type = "undecorated"
+        }
 
         // We don't perform any special formatting on these types, so we just
         // pass them through the simple _formatvalue function.
@@ -451,8 +464,7 @@ WebInspector.ConsoleView.prototype = {
             "null": 1,
             "boolean": 1,
             "number": 1,
-            "date": 1,
-            "function": 1,
+            "undecorated": 1
         };
 
         var formatter;
@@ -479,6 +491,16 @@ WebInspector.ConsoleView.prototype = {
         elem.appendChild(document.createTextNode(val));
     },
 
+    _formatfunction: function(func, elem)
+    {
+        elem.appendChild(document.createTextNode(func.description));
+    },
+
+    _formatdate: function(date, elem)
+    {
+        elem.appendChild(document.createTextNode(date));
+    },
+
     _formatstring: function(str, elem)
     {
         elem.appendChild(document.createTextNode("\"" + str + "\""));
@@ -486,34 +508,48 @@ WebInspector.ConsoleView.prototype = {
 
     _formatregexp: function(re, elem)
     {
-        var formatted = String(re).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
+        var formatted = String(re.description).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
         elem.appendChild(document.createTextNode(formatted));
     },
 
     _formatarray: function(arr, elem)
     {
-        elem.appendChild(document.createTextNode("["));
-        for (var i = 0; i < arr.length; ++i) {
-            elem.appendChild(this._format(arr[i]));
-            if (i < arr.length - 1)
-                elem.appendChild(document.createTextNode(", "));
+        var self = this;
+        function printResult(properties)
+        {
+            if (!properties)
+                return;
+            elem.appendChild(document.createTextNode("["));
+            for (var i = 0; i < properties.length; ++i) {
+                var property = properties[i].value;
+                elem.appendChild(self._format(property));
+                if (i < properties.length - 1)
+                    elem.appendChild(document.createTextNode(", "));
+            }
+            elem.appendChild(document.createTextNode("]"));
         }
-        elem.appendChild(document.createTextNode("]"));
+        InjectedScriptAccess.getProperties(arr, false, printResult);
     },
 
-    _formatnode: function(node, elem)
+    _formatnode: function(object, elem)
     {
-        var treeOutline = new WebInspector.ElementsTreeOutline();
-        treeOutline.rootDOMNode = node;
-        treeOutline.element.addStyleClass("outline-disclosure");
-        if (!treeOutline.children[0].hasChildren)
-            treeOutline.element.addStyleClass("single-node");
-        elem.appendChild(treeOutline.element);
+        function printNode(nodeId)
+        {
+            if (!nodeId)
+                return;
+            var treeOutline = new WebInspector.ElementsTreeOutline();
+            treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
+            treeOutline.element.addStyleClass("outline-disclosure");
+            if (!treeOutline.children[0].hasChildren)
+                treeOutline.element.addStyleClass("single-node");
+            elem.appendChild(treeOutline.element);
+        }
+        InjectedScriptAccess.pushNodeToFrontend(object, printNode);
     },
 
     _formatobject: function(obj, elem)
     {
-        elem.appendChild(new WebInspector.ObjectPropertiesSection(new WebInspector.ObjectProxy(obj), Object.describe(obj, true), null, null, true).element);
+        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
     },
 
     _formaterror: function(obj, elem)
@@ -595,6 +631,13 @@ WebInspector.ConsoleMessage.prototype = {
         if (!parameters.length)
             return formattedResult;
 
+        // Formatting code below assumes that parameters are all wrappers whereas frontend console
+        // API allows passing arbitrary values as messages (strings, numberts, etc.). Wrap them here.
+        for (var i = 0; i < parameters.length; ++i) {
+            if (typeof parameters[i] !== "object" && typeof parameters[i] !== "function")
+                parameters[i] = WebInspector.ObjectProxy.wrapPrimitiveValue(parameters[i]);
+        }
+
         function formatForConsole(obj)
         {
             return WebInspector.console._format(obj);
@@ -605,7 +648,7 @@ WebInspector.ConsoleMessage.prototype = {
             return WebInspector.console._format(obj, true);
         }
 
-        if (Object.type(parameters[0], InspectorController.inspectedWindow()) === "string") {
+        if (Object.proxyType(parameters[0]) === "string") {
             var formatters = {}
             for (var i in String.standardFormatters)
                 formatters[i] = String.standardFormatters[i];
@@ -626,7 +669,7 @@ WebInspector.ConsoleMessage.prototype = {
                 return a;
             }
 
-            var result = String.format(parameters[0], parameters.slice(1), formatters, formattedResult, append);
+            var result = String.format(parameters[0].description, parameters.slice(1), formatters, formattedResult, append);
             formattedResult = result.formattedResult;
             parameters = result.unusedSubstitutions;
             if (parameters.length)
@@ -634,8 +677,8 @@ WebInspector.ConsoleMessage.prototype = {
         }
 
         for (var i = 0; i < parameters.length; ++i) {
-            if (typeof parameters[i] === "string")
-                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(parameters[i]));
+            if (Object.proxyType(parameters[i]) === "string")
+                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(parameters[i].description));
             else
                 formattedResult.appendChild(formatForConsole(parameters[i]));
 
@@ -683,6 +726,9 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageLevel.Log:
                 element.addStyleClass("console-log-level");
                 break;
+            case WebInspector.ConsoleMessage.MessageLevel.Debug:
+                element.addStyleClass("console-debug-level");
+                break;
             case WebInspector.ConsoleMessage.MessageLevel.Warning:
                 element.addStyleClass("console-warning-level");
                 break;
@@ -789,6 +835,9 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageLevel.Warning:
                 levelString = "Warning";
                 break;
+            case WebInspector.ConsoleMessage.MessageLevel.Debug:
+                levelString = "Debug";
+                break;
             case WebInspector.ConsoleMessage.MessageLevel.Error:
                 levelString = "Error";
                 break;
@@ -835,7 +884,8 @@ WebInspector.ConsoleMessage.MessageLevel = {
     Tip: 0,
     Log: 1,
     Warning: 2,
-    Error: 3
+    Error: 3,
+    Debug: 4
 }
 
 WebInspector.ConsoleCommand = function(command)
@@ -859,10 +909,18 @@ WebInspector.ConsoleCommand.prototype = {
     }
 }
 
+WebInspector.ConsoleTextMessage = function(text, level)
+{
+    level = level || WebInspector.ConsoleMessage.MessageLevel.Log;
+    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, WebInspector.ConsoleMessage.MessageType.Log, level, 0, null, null, 1, text);
+}
+
+WebInspector.ConsoleTextMessage.prototype.__proto__ = WebInspector.ConsoleMessage.prototype;
+
 WebInspector.ConsoleCommandResult = function(result, exception, originatingCommand)
 {
     var level = (exception ? WebInspector.ConsoleMessage.MessageLevel.Error : WebInspector.ConsoleMessage.MessageLevel.Log);
-    var message = (exception ? String(result) : result);
+    var message = result;
     var line = (exception ? result.line : -1);
     var url = (exception ? result.sourceURL : null);
 
diff --git a/WebCore/inspector/front-end/CookieItemsView.js b/WebCore/inspector/front-end/CookieItemsView.js
new file mode 100644
index 0000000..9397e7c
--- /dev/null
+++ b/WebCore/inspector/front-end/CookieItemsView.js
@@ -0,0 +1,275 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.CookieItemsView = function(cookieDomain)
+{
+    WebInspector.View.call(this);
+
+    this.element.addStyleClass("storage-view");
+    this.element.addStyleClass("table");
+
+    this.deleteButton = new WebInspector.StatusBarButton(WebInspector.UIString("Delete"), "delete-storage-status-bar-item");
+    this.deleteButton.visible = false;
+    this.deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
+
+    this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
+    this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
+    
+    this._cookieDomain = cookieDomain;
+}
+
+WebInspector.CookieItemsView.prototype = {
+    get statusBarItems()
+    {
+        return [this.refreshButton.element, this.deleteButton.element];
+    },
+
+    show: function(parentElement)
+    {
+        WebInspector.View.prototype.show.call(this, parentElement);
+        this.update();
+    },
+
+    hide: function()
+    {
+        WebInspector.View.prototype.hide.call(this);
+        this.deleteButton.visible = false;
+    },
+
+    update: function()
+    {
+        this.element.removeChildren();
+
+        var self = this;
+        function callback(cookies, isAdvanced) {
+            var dataGrid = (isAdvanced ? self.dataGridForCookies(cookies) : self.simpleDataGridForCookies(cookies));
+            if (dataGrid) {
+                self._dataGrid = dataGrid;
+                self.element.appendChild(dataGrid.element);
+                self._dataGrid.updateWidths();
+                if (isAdvanced)
+                    self.deleteButton.visible = true;
+            } else {
+                var emptyMsgElement = document.createElement("div");
+                emptyMsgElement.className = "storage-table-empty";
+                emptyMsgElement.textContent = WebInspector.UIString("This site has no cookies.");
+                self.element.appendChild(emptyMsgElement);
+                self._dataGrid = null;
+                self.deleteButton.visible = false;
+            }
+        }
+
+        WebInspector.Cookies.getCookiesAsync(callback, this._cookieDomain);
+    },
+
+    dataGridForCookies: function(cookies)
+    {
+        if (!cookies.length)
+            return null;
+
+        for (var i = 0; i < cookies.length; ++i)
+            cookies[i].expires = new Date(cookies[i].expires);
+
+        var columns = { 0: {}, 1: {}, 2: {}, 3: {}, 4: {}, 5: {}, 6: {}, 7: {} };
+        columns[0].title = WebInspector.UIString("Name");
+        columns[0].width = columns[0].title.length;
+        columns[1].title = WebInspector.UIString("Value");
+        columns[1].width = columns[1].title.length;
+        columns[2].title = WebInspector.UIString("Domain");
+        columns[2].width = columns[2].title.length;
+        columns[3].title = WebInspector.UIString("Path");
+        columns[3].width = columns[3].title.length;
+        columns[4].title = WebInspector.UIString("Expires");
+        columns[4].width = columns[4].title.length;
+        columns[5].title = WebInspector.UIString("Size");
+        columns[5].width = columns[5].title.length;
+        columns[5].aligned = "right";
+        columns[6].title = WebInspector.UIString("HTTP");
+        columns[6].width = columns[6].title.length;
+        columns[6].aligned = "centered";
+        columns[7].title = WebInspector.UIString("Secure");
+        columns[7].width = columns[7].title.length;
+        columns[7].aligned = "centered";
+
+        function updateDataAndColumn(index, value) {
+            data[index] = value;
+            if (value.length > columns[index].width)
+                columns[index].width = value.length;
+        }
+
+        var data;
+        var nodes = [];
+        for (var i = 0; i < cookies.length; ++i) {
+            var cookie = cookies[i];
+            data = {};
+
+            updateDataAndColumn(0, cookie.name);
+            updateDataAndColumn(1, cookie.value);
+            updateDataAndColumn(2, cookie.domain);
+            updateDataAndColumn(3, cookie.path);
+            updateDataAndColumn(4, (cookie.session ? WebInspector.UIString("Session") : cookie.expires.toGMTString()));
+            updateDataAndColumn(5, Number.bytesToString(cookie.size, WebInspector.UIString));
+            updateDataAndColumn(6, (cookie.httpOnly ? "\u2713" : "")); // Checkmark
+            updateDataAndColumn(7, (cookie.secure ? "\u2713" : "")); // Checkmark
+
+            var node = new WebInspector.DataGridNode(data, false);
+            node.cookie = cookie;
+            node.selectable = true;
+            nodes.push(node);
+        }
+
+        var totalColumnWidths = 0;
+        for (var columnIdentifier in columns)
+            totalColumnWidths += columns[columnIdentifier].width;
+
+        // Enforce the Value column (the 2nd column) to be a max of 33%
+        // tweaking the raw total width because may massively outshadow the others
+        var valueColumnWidth = columns[1].width;
+        if (valueColumnWidth / totalColumnWidths > 0.33) {
+            totalColumnWidths -= valueColumnWidth;
+            totalColumnWidths *= 1.33;
+            columns[1].width = totalColumnWidths * 0.33;
+        }
+
+        // Calculate the percentage width for the columns.
+        const minimumPrecent = 6;
+        var recoupPercent = 0;
+        for (var columnIdentifier in columns) {
+            var width = columns[columnIdentifier].width;
+            width = Math.round((width / totalColumnWidths) * 100);
+            if (width < minimumPrecent) {
+                recoupPercent += (minimumPrecent - width);
+                width = minimumPrecent;
+            }
+            columns[columnIdentifier].width = width;
+        }
+
+        // Enforce the minimum percentage width. (need to narrow total percentage due to earlier additions)
+        while (recoupPercent > 0) {
+            for (var columnIdentifier in columns) {
+                if (columns[columnIdentifier].width > minimumPrecent) {
+                    --columns[columnIdentifier].width;
+                    --recoupPercent;
+                    if (!recoupPercent)
+                        break;
+                }
+            }
+        }
+
+        for (var columnIdentifier in columns)
+            columns[columnIdentifier].width += "%";
+
+        var dataGrid = new WebInspector.DataGrid(columns);
+        var length = nodes.length;
+        for (var i = 0; i < length; ++i)
+            dataGrid.appendChild(nodes[i]);
+        if (length > 0)
+            nodes[0].selected = true;
+
+        return dataGrid;
+    },
+
+    simpleDataGridForCookies: function(cookies)
+    {
+        if (!cookies.length)
+            return null;
+
+        var columns = {};
+        columns[0] = {};
+        columns[1] = {};
+        columns[0].title = WebInspector.UIString("Name");
+        columns[0].width = columns[0].title.length;
+        columns[1].title = WebInspector.UIString("Value");
+        columns[1].width = columns[1].title.length;
+
+        var nodes = [];
+        for (var i = 0; i < cookies.length; ++i) {
+            var cookie = cookies[i];
+            var data = {};
+
+            var name = cookie.name;
+            data[0] = name;
+            if (name.length > columns[0].width)
+                columns[0].width = name.length;
+
+            var value = cookie.value;
+            data[1] = value;
+            if (value.length > columns[1].width)
+                columns[1].width = value.length;
+
+            var node = new WebInspector.DataGridNode(data, false);
+            node.selectable = true;
+            nodes.push(node);
+        }
+
+        var totalColumnWidths = columns[0].width + columns[1].width;
+        var width = Math.round((columns[0].width * 100) / totalColumnWidths);
+        const minimumPrecent = 20;
+        if (width < minimumPrecent)
+            width = minimumPrecent;
+        if (width > 100 - minimumPrecent)
+            width = 100 - minimumPrecent;
+        columns[0].width = width;
+        columns[1].width = 100 - width;
+        columns[0].width += "%";
+        columns[1].width += "%";
+
+        var dataGrid = new WebInspector.DataGrid(columns);
+        var length = nodes.length;
+        for (var i = 0; i < length; ++i)
+            dataGrid.appendChild(nodes[i]);
+        if (length > 0)
+            nodes[0].selected = true;
+
+        return dataGrid;
+    },
+    
+    resize: function()
+    {
+        if (this._datagrid)
+            this._dataGrid.updateWidths();
+    },
+
+    _deleteButtonClicked: function(event)
+    {
+        if (!this._dataGrid)
+            return;
+
+        var cookie = this._dataGrid.selectedNode.cookie;
+        InspectorController.deleteCookie(cookie.name, this._cookieDomain);
+        this.update();
+    },
+
+    _refreshButtonClicked: function(event)
+    {
+        this.update();
+    }
+}
+
+WebInspector.CookieItemsView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/WebCore/inspector/front-end/DOMAgent.js b/WebCore/inspector/front-end/DOMAgent.js
index 5aacd41..25ffafa 100644
--- a/WebCore/inspector/front-end/DOMAgent.js
+++ b/WebCore/inspector/front-end/DOMAgent.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,9 +32,10 @@
 WebInspector.DOMNode = function(doc, payload) {
     this.ownerDocument = doc;
 
-    this._id = payload.id;
+    this.id = payload.id;
     this.nodeType = payload.nodeType;
     this.nodeName = payload.nodeName;
+    this.localName = payload.localName;
     this._nodeValue = payload.nodeValue;
     this.textContent = this.nodeValue;
 
@@ -48,14 +50,22 @@ WebInspector.DOMNode = function(doc, payload) {
     this.nextSibling = null;
     this.prevSibling = null;
     this.firstChild = null;
+    this.lastChild = null;
     this.parentNode = null;
 
-    if (payload.childNodes)
-        this._setChildrenPayload(payload.childNodes);
+    if (payload.children)
+        this._setChildrenPayload(payload.children);
 
     this._computedStyle = null;
     this.style = null;
     this._matchedCSSRules = [];
+
+    if (this.nodeType == Node.ELEMENT_NODE) {
+        if (this.nodeName == "HTML")
+            this.ownerDocument.documentElement = this;
+        if (this.nodeName == "BODY")
+            this.ownerDocument.body = this;
+    }
 }
 
 WebInspector.DOMNode.prototype = {
@@ -161,9 +171,11 @@ WebInspector.DOMNode.prototype = {
         this._childNodeCount = this.children.length;
         if (this._childNodeCount == 0) {
             this.firstChild = null;
+            this.lastChild = null;
             return;
         }
         this.firstChild = this.children[0];
+        this.lastChild = this.children[this._childNodeCount - 1];
         for (var i = 0; i < this._childNodeCount; ++i) {
             var child = this.children[i];
             child.nextSibling = i + 1 < this._childNodeCount ? this.children[i + 1] : null;
@@ -208,17 +220,9 @@ WebInspector.DOMNode.prototype = {
     }
 }
 
-WebInspector.DOMDocument = function(domAgent, defaultView)
+WebInspector.DOMDocument = function(domAgent, defaultView, payload)
 {
-    WebInspector.DOMNode.call(this, null,
-        {
-            id: 0,
-            nodeType: Node.DOCUMENT_NODE,
-            nodeName: "",
-            nodeValue: "",
-            attributes: [],
-            childNodeCount: 0
-        });
+    WebInspector.DOMNode.call(this, this, payload);
     this._listeners = {};
     this._domAgent = domAgent;
     this.defaultView = defaultView;
@@ -226,7 +230,7 @@ WebInspector.DOMDocument = function(domAgent, defaultView)
 
 WebInspector.DOMDocument.prototype = {
 
-    addEventListener: function(name, callback, useCapture)
+    addEventListener: function(name, callback)
     {
         var listeners = this._listeners[name];
         if (!listeners) {
@@ -236,7 +240,7 @@ WebInspector.DOMDocument.prototype = {
         listeners.push(callback);
     },
 
-    removeEventListener: function(name, callback, useCapture)
+    removeEventListener: function(name, callback)
     {
         var listeners = this._listeners[name];
         if (!listeners)
@@ -251,10 +255,12 @@ WebInspector.DOMDocument.prototype = {
     {
         var listeners = this._listeners[name];
         if (!listeners)
-          return;
+            return;
 
-        for (var i = 0; i < listeners.length; ++i)
-          listeners[i](event);
+        for (var i = 0; i < listeners.length; ++i) {
+            var listener = listeners[i];
+            listener.call(this, event);
+        }
     }
 }
 
@@ -301,68 +307,44 @@ WebInspector.DOMAgent = function() {
     this._window = new WebInspector.DOMWindow(this);
     this._idToDOMNode = null;
     this.document = null;
-
-    // Install onpopulate handler. This is a temporary measure.
-    // TODO: add this code into the original updateChildren once domAgent
-    // becomes primary source of DOM information.
-    // TODO2: update ElementsPanel to not track embedded iframes - it is already being handled
-    // in the agent backend.
-    var domAgent = this;
-    var originalUpdateChildren = WebInspector.ElementsTreeElement.prototype.updateChildren;
-    WebInspector.ElementsTreeElement.prototype.updateChildren = function()
-    {
-        domAgent.getChildNodesAsync(this.representedObject, originalUpdateChildren.bind(this));
-    };
-
-    // Mute console handle to avoid crash on selection change.
-    // TODO: Re-implement inspectorConsoleAPI to work in a serialized way and remove this workaround.
-    WebInspector.Console.prototype.addInspectedNode = function()
-    {
-    };
-
-    // Whitespace is ignored in InspectorDOMAgent already -> no need to filter.
-    // TODO: Either remove all of its usages or push value into the agent backend.
-    Preferences.ignoreWhitespace = false;
 }
 
 WebInspector.DOMAgent.prototype = {
-    get inspectedWindow()
+    get domWindow()
     {
         return this._window;
     },
 
-    getChildNodesAsync: function(parent, opt_callback)
+    getChildNodesAsync: function(parent, callback)
     {
         var children = parent.children;
-        if (children && opt_callback) {
-          opt_callback(children);
-          return;
+        if (children) {
+            callback(children);
+            return;
+        }
+        function mycallback() {
+            callback(parent.children);
         }
-        var mycallback = function() {
-            if (opt_callback) {
-                opt_callback(parent.children);
-            }
-        };
         var callId = WebInspector.Callback.wrap(mycallback);
-        InspectorController.getChildNodes(callId, parent._id);
+        InspectorController.getChildNodes(callId, parent.id);
     },
 
     setAttributeAsync: function(node, name, value, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.setAttribute(WebInspector.Callback.wrap(mycallback), node._id, name, value);
+        InspectorController.setAttribute(WebInspector.Callback.wrap(mycallback), node.id, name, value);
     },
 
     removeAttributeAsync: function(node, name, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.removeAttribute(WebInspector.Callback.wrap(mycallback), node._id, name);
+        InspectorController.removeAttribute(WebInspector.Callback.wrap(mycallback), node.id, name);
     },
 
     setTextNodeValueAsync: function(node, text, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node._id, text);
+        InspectorController.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node.id, text);
     },
 
     _didApplyDomChange: function(node, callback, success)
@@ -383,26 +365,31 @@ WebInspector.DOMAgent.prototype = {
         node._setAttributesPayload(attrsArray);
     },
 
-    getNodeForId: function(nodeId) {
+    nodeForId: function(nodeId) {
         return this._idToDOMNode[nodeId];
     },
 
-    _setDocumentElement: function(payload)
+    _setDocument: function(payload)
     {
-        this.document = new WebInspector.DOMDocument(this, this._window);
-        this._idToDOMNode = { 0 : this.document };
-        this._setChildNodes(0, [payload]);
-        this.document.documentElement = this.document.firstChild;
-        this.document.documentElement.ownerDocument = this.document;
+        this._idToDOMNode = {};
+        if (payload) {
+            this.document = new WebInspector.DOMDocument(this, this._window, payload);
+            this._idToDOMNode[payload.id] = this.document;
+            this._bindNodes(this.document.children);
+        } else
+            this.document = null;
         WebInspector.panels.elements.reset();
     },
 
+    _setDetachedRoot: function(payload)
+    {
+        var root = new WebInspector.DOMNode(this.document, payload);
+        this._idToDOMNode[payload.id] = root;
+    },
+
     _setChildNodes: function(parentId, payloads)
     {
         var parent = this._idToDOMNode[parentId];
-        if (parent.children) {
-          return;
-        }
         parent._setChildrenPayload(payloads);
         this._bindNodes(parent.children);
     },
@@ -411,21 +398,20 @@ WebInspector.DOMAgent.prototype = {
     {
         for (var i = 0; i < children.length; ++i) {
             var child = children[i];
-            this._idToDOMNode[child._id] = child;
+            this._idToDOMNode[child.id] = child;
             if (child.children)
                 this._bindNodes(child.children);
         }
     },
 
-    _hasChildrenUpdated: function(nodeId, newValue)
+    _childNodeCountUpdated: function(nodeId, newValue)
     {
         var node = this._idToDOMNode[nodeId];
+        node._childNodeCount = newValue;
         var outline = WebInspector.panels.elements.treeOutline;
         var treeElement = outline.findTreeElement(node);
-        if (treeElement) {
+        if (treeElement)
             treeElement.hasChildren = newValue;
-            treeElement.whitespaceIgnored = Preferences.ignoreWhitespace;
-        }
     },
 
     _childNodeInserted: function(parentId, prevId, payload)
@@ -433,7 +419,7 @@ WebInspector.DOMAgent.prototype = {
         var parent = this._idToDOMNode[parentId];
         var prev = this._idToDOMNode[prevId];
         var node = parent._insertChild(prev, payload);
-        this._idToDOMNode[node._id] = node;
+        this._idToDOMNode[node.id] = node;
         var event = { target : node, relatedNode : parent };
         this.document._fireDomEvent("DOMNodeInserted", event);
     },
@@ -449,8 +435,53 @@ WebInspector.DOMAgent.prototype = {
     }
 }
 
-WebInspector.CSSStyleDeclaration = function(payload) {
-    this._id = payload.id;
+WebInspector.Cookies = {}
+
+WebInspector.Cookies.getCookiesAsync = function(callback, cookieDomain)
+{
+    function mycallback(cookies, cookiesString) {
+        if (cookiesString)
+            callback(WebInspector.Cookies.buildCookiesFromString(cookiesString), false);
+        else
+            callback(cookies, true);
+    }
+    var callId = WebInspector.Callback.wrap(mycallback);
+    InspectorController.getCookies(callId, cookieDomain);
+}
+
+WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
+{
+    var rawCookies = rawCookieString.split(/;\s*/);
+    var cookies = [];
+
+    if (!(/^\s*$/.test(rawCookieString))) {
+        for (var i = 0; i < rawCookies.length; ++i) {
+            var cookie = rawCookies[i];
+            var delimIndex = cookie.indexOf("=");
+            var name = cookie.substring(0, delimIndex);
+            var value = cookie.substring(delimIndex + 1);
+            var size = name.length + value.length;
+            cookies.push({ name: name, value: value, size: size });
+        }
+    }
+
+    return cookies;
+}
+
+WebInspector.EventListeners = {}
+
+WebInspector.EventListeners.getEventListenersForNodeAsync = function(node, callback)
+{
+    if (!node)
+        return;
+
+    var callId = WebInspector.Callback.wrap(callback);
+    InspectorController.getEventListenersForNode(callId, node.id);
+}
+
+WebInspector.CSSStyleDeclaration = function(payload)
+{
+    this.id = payload.id;
     this.width = payload.width;
     this.height = payload.height;
     this.__disabledProperties = payload.__disabledProperties;
@@ -492,12 +523,13 @@ WebInspector.CSSStyleDeclaration.parseStyle = function(payload)
 WebInspector.CSSStyleDeclaration.parseRule = function(payload)
 {
     var rule = {};
-    rule._id = payload.id;
+    rule.id = payload.id;
     rule.selectorText = payload.selectorText;
     rule.style = new WebInspector.CSSStyleDeclaration(payload.style);
     rule.style.parentRule = rule;
     rule.isUserAgent = payload.isUserAgent;
     rule.isUser = payload.isUser;
+    rule.isViaInspector = payload.isViaInspector;
     if (payload.parentStyleSheet)
         rule.parentStyleSheet = { href: payload.parentStyleSheet.href };
 
@@ -586,9 +618,14 @@ WebInspector.attributesUpdated = function()
     this.domAgent._attributesUpdated.apply(this.domAgent, arguments);
 }
 
-WebInspector.setDocumentElement = function()
+WebInspector.setDocument = function()
 {
-    this.domAgent._setDocumentElement.apply(this.domAgent, arguments);
+    this.domAgent._setDocument.apply(this.domAgent, arguments);
+}
+
+WebInspector.setDetachedRoot = function()
+{
+    this.domAgent._setDetachedRoot.apply(this.domAgent, arguments);
 }
 
 WebInspector.setChildNodes = function()
@@ -596,129 +633,25 @@ WebInspector.setChildNodes = function()
     this.domAgent._setChildNodes.apply(this.domAgent, arguments);
 }
 
-WebInspector.hasChildrenUpdated = function()
+WebInspector.childNodeCountUpdated = function()
 {
-    this.domAgent._hasChildrenUpdated.apply(this.domAgent, arguments);
+    this.domAgent._childNodeCountUpdated.apply(this.domAgent, arguments);
 }
 
 WebInspector.childNodeInserted = function()
 {
     this.domAgent._childNodeInserted.apply(this.domAgent, arguments);
-    this._childNodeInserted.bind(this);
 }
 
 WebInspector.childNodeRemoved = function()
 {
     this.domAgent._childNodeRemoved.apply(this.domAgent, arguments);
-    this._childNodeRemoved.bind(this);
 }
 
+WebInspector.didGetCookies = WebInspector.Callback.processCallback;
 WebInspector.didGetChildNodes = WebInspector.Callback.processCallback;
 WebInspector.didPerformSearch = WebInspector.Callback.processCallback;
 WebInspector.didApplyDomChange = WebInspector.Callback.processCallback;
 WebInspector.didRemoveAttribute = WebInspector.Callback.processCallback;
 WebInspector.didSetTextNodeValue = WebInspector.Callback.processCallback;
-
-// Temporary methods for DOMAgent migration.
-WebInspector.wrapNodeWithStyles = function(node, styles)
-{
-    var windowStub = new WebInspector.DOMWindow(null);
-    var docStub = new WebInspector.DOMDocument(null, windowStub);
-    var payload = {};
-    payload.nodeType = node.nodeType;
-    payload.nodeName = node.nodeName;
-    payload.nodeValue = node.nodeValue;
-    payload.attributes = [];
-    payload.childNodeCount = 0;
-
-    for (var i = 0; i < node.attributes.length; ++i) {
-        var attr = node.attributes[i];
-        payload.attributes.push(attr.name);
-        payload.attributes.push(attr.value);
-    }
-    var nodeStub = new WebInspector.DOMNode(docStub, payload);
-    nodeStub._setStyles(styles.computedStyle, styles.inlineStyle, styles.styleAttributes, styles.matchedCSSRules);
-    return nodeStub;
-}
-
-// Temporary methods that will be dispatched via InspectorController into the injected context.
-InspectorController.getStyles = function(nodeId, authorOnly, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.getStyles(nodeId, authorOnly));
-    }, 0)
-}
-
-InspectorController.getComputedStyle = function(nodeId, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.getComputedStyle(nodeId));
-    }, 0)
-}
-
-InspectorController.getInlineStyle = function(nodeId, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.getInlineStyle(nodeId));
-    }, 0)
-}
-
-InspectorController.applyStyleText = function(styleId, styleText, propertyName, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.applyStyleText(styleId, styleText, propertyName));
-    }, 0)
-}
-
-InspectorController.setStyleText = function(style, cssText, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.setStyleText(style, cssText));
-    }, 0)
-}
-
-InspectorController.toggleStyleEnabled = function(styleId, propertyName, disabled, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.toggleStyleEnabled(styleId, propertyName, disabled));
-    }, 0)
-}
-
-InspectorController.applyStyleRuleText = function(ruleId, newContent, selectedNode, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.applyStyleRuleText(ruleId, newContent, selectedNode));
-    }, 0)
-}
-
-InspectorController.addStyleSelector = function(newContent, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.addStyleSelector(newContent));
-    }, 0)
-}
-
-InspectorController.setStyleProperty = function(styleId, name, value, callback) {
-    setTimeout(function() {
-        callback(InjectedScript.setStyleProperty(styleId, name, value));
-    }, 0)
-}
-
-InspectorController.getPrototypes = function(objectProxy, callback) {
-    setTimeout(function() {
-        callback(InjectedScript.getPrototypes(objectProxy));
-    }, 0)
-}
-
-InspectorController.getProperties = function(objectProxy, ignoreHasOwnProperty, callback) {
-    setTimeout(function() {
-        callback(InjectedScript.getProperties(objectProxy, ignoreHasOwnProperty));
-    }, 0)
-}
-
-InspectorController.setPropertyValue = function(objectProxy, propertyName, expression, callback) {
-    setTimeout(function() {
-        callback(InjectedScript.setPropertyValue(objectProxy, propertyName, expression));
-    }, 0)
-}
-
+WebInspector.didGetEventListenersForNode = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/DOMStorage.js b/WebCore/inspector/front-end/DOMStorage.js
index 5207b69..03a10bf 100644
--- a/WebCore/inspector/front-end/DOMStorage.js
+++ b/WebCore/inspector/front-end/DOMStorage.js
@@ -26,24 +26,22 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.DOMStorage = function(domStorage, domain, isLocalStorage)
+WebInspector.DOMStorage = function(id, domain, isLocalStorage)
 {
-    this.domStorage = domStorage;
-    this.domain = domain;
-    this.isLocalStorage = isLocalStorage;
+    this._id = id;
+    this._domain = domain;
+    this._isLocalStorage = isLocalStorage;
 }
 
 WebInspector.DOMStorage.prototype = {
-    get domStorage()
+    get id()
     {
-        return this._domStorage;
+        return this._id;
     },
 
-    set domStorage(x)
+    get domStorage()
     {
-        if (this._domStorage === x)
-            return;
-        this._domStorage = x;
+        return this._domStorage;
     },
 
     get domain()
@@ -51,22 +49,30 @@ WebInspector.DOMStorage.prototype = {
         return this._domain;
     },
 
-    set domain(x)
+    get isLocalStorage()
+    {
+        return this._isLocalStorage;
+    },
+
+    getEntries: function(callback)
     {
-        if (this._domain === x)
-            return;
-        this._domain = x;
+        var callId = WebInspector.Callback.wrap(callback);
+        InspectorController.getDOMStorageEntries(callId, this._id);
     },
     
-    get isLocalStorage()
+    setItem: function(key, value, callback)
     {
-        return this._isLocalStorage;
+        var callId = WebInspector.Callback.wrap(callback);
+        InspectorController.setDOMStorageItem(callId, this._id, key, value);
     },
     
-    set isLocalStorage(x)
+    removeItem: function(key, callback)
     {
-        if (this._isLocalStorage === x)
-            return;
-        this._isLocalStorage = x;
+        var callId = WebInspector.Callback.wrap(callback);
+        InspectorController.removeDOMStorageItem(callId, this._id, key);
     }
 }
+
+WebInspector.didGetDOMStorageEntries = WebInspector.Callback.processCallback;
+WebInspector.didSetDOMStorageItem = WebInspector.Callback.processCallback;
+WebInspector.didRemoveDOMStorageItem = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/DOMStorageDataGrid.js b/WebCore/inspector/front-end/DOMStorageDataGrid.js
index 0326bc7..45a9ba1 100644
--- a/WebCore/inspector/front-end/DOMStorageDataGrid.js
+++ b/WebCore/inspector/front-end/DOMStorageDataGrid.js
@@ -23,10 +23,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.DOMStorageDataGrid = function(columns)
+WebInspector.DOMStorageDataGrid = function(columns, domStorage, keys)
 {
     WebInspector.DataGrid.call(this, columns);
     this.dataTableBody.addEventListener("dblclick", this._ondblclick.bind(this), false);
+    this._domStorage = domStorage;
+    this._keys = keys;
 }
 
 WebInspector.DOMStorageDataGrid.prototype = {
@@ -44,7 +46,6 @@ WebInspector.DOMStorageDataGrid.prototype = {
         this._editing = true;
         this._editingNode = node;
         this._editingNode.select();
-        WebInspector.panels.databases._unregisterStorageEventListener();
 
         var element = this._editingNode._element.children[column];
         WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
@@ -69,7 +70,6 @@ WebInspector.DOMStorageDataGrid.prototype = {
             return this._startEditingColumnOfDataGridNode(this._editingNode, 0);
 
         this._editing = true;
-        WebInspector.panels.databases._unregisterStorageEventListener();
         WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
         window.getSelection().setBaseAndExtent(element, 0, element, 1);
     },
@@ -118,22 +118,20 @@ WebInspector.DOMStorageDataGrid.prototype = {
             return;
         }
 
-        var domStorage = WebInspector.panels.databases.visibleView.domStorage.domStorage;
-        if (domStorage) {
-            if (columnIdentifier == 0) {
-                if (domStorage.getItem(newText) != null) {
-                    element.textContent = this._editingNode.data[0];
-                    this._editingCancelled(element);
-                    moveToNextIfNeeded.call(this, false);
-                    return;
-                }
-                domStorage.removeItem(this._editingNode.data[0]);
-                domStorage.setItem(newText, this._editingNode.data[1]);
-                this._editingNode.data[0] = newText;            
-            } else {
-                domStorage.setItem(this._editingNode.data[0], newText);
-                this._editingNode.data[1] = newText;
+        var domStorage = this._domStorage;
+        if (columnIdentifier === 0) {
+            if (this._keys.indexOf(newText) !== -1) {
+                element.textContent = this._editingNode.data[0];
+                this._editingCancelled(element);
+                moveToNextIfNeeded.call(this, false);
+                return;
             }
+            domStorage.removeItem(this._editingNode.data[0]);
+            domStorage.setItem(newText, this._editingNode.data[1]);
+            this._editingNode.data[0] = newText;
+        } else {
+            domStorage.setItem(this._editingNode.data[0], newText);
+            this._editingNode.data[1] = newText;
         }
 
         if (this._editingNode.isCreationNode)
@@ -147,18 +145,16 @@ WebInspector.DOMStorageDataGrid.prototype = {
     {
         delete this._editing;
         this._editingNode = null;
-        WebInspector.panels.databases._registerStorageEventListener();
     },
 
     deleteSelectedRow: function()
     {
         var node = this.selectedNode;
-        if (this.selectedNode.isCreationNode)
+        if (!node || node.isCreationNode)
             return;
 
-        var domStorage = WebInspector.panels.databases.visibleView.domStorage.domStorage;
-        if (node && domStorage)
-            domStorage.removeItem(node.data[0]);
+        if (this._domStorage)
+            this._domStorage.removeItem(node.data[0]);
     }
 }
 
diff --git a/WebCore/inspector/front-end/DOMStorageItemsView.js b/WebCore/inspector/front-end/DOMStorageItemsView.js
index fad6e3c..a7da370 100644
--- a/WebCore/inspector/front-end/DOMStorageItemsView.js
+++ b/WebCore/inspector/front-end/DOMStorageItemsView.js
@@ -32,21 +32,18 @@ WebInspector.DOMStorageItemsView = function(domStorage)
     this.element.addStyleClass("storage-view");
     this.element.addStyleClass("table");
 
-    this.deleteButton = document.createElement("button");
-    this.deleteButton.title = WebInspector.UIString("Delete");
-    this.deleteButton.className = "delete-storage-status-bar-item status-bar-item hidden";
+    this.deleteButton = new WebInspector.StatusBarButton(WebInspector.UIString("Delete"), "delete-storage-status-bar-item");
+    this.deleteButton.visible = false;
     this.deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
 
-    this.refreshButton = document.createElement("button");
-    this.refreshButton.title = WebInspector.UIString("Refresh");
-    this.refreshButton.className = "refresh-storage-status-bar-item status-bar-item";
+    this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
     this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
 }
 
 WebInspector.DOMStorageItemsView.prototype = {
     get statusBarItems()
     {
-        return [this.refreshButton, this.deleteButton];
+        return [this.refreshButton.element, this.deleteButton.element];
     },
 
     show: function(parentElement)
@@ -58,45 +55,94 @@ WebInspector.DOMStorageItemsView.prototype = {
     hide: function()
     {
         WebInspector.View.prototype.hide.call(this);
-        this.deleteButton.addStyleClass("hidden");
+        this.deleteButton.visible = false;
     },
 
     update: function()
     {
         this.element.removeChildren();
-        var hasDOMStorage = this.domStorage;
-        if (hasDOMStorage)
-            hasDOMStorage = this.domStorage.domStorage;
-
-        if (hasDOMStorage) {
-            var dataGrid = WebInspector.panels.databases.dataGridForDOMStorage(this.domStorage.domStorage);
-            if (!dataGrid)
-                hasDOMStorage = 0;
-            else {
-                this._dataGrid = dataGrid;
-                this.element.appendChild(dataGrid.element);
-                this._dataGrid.updateWidths();
-                this.deleteButton.removeStyleClass("hidden");
-            }
-        }
+        var callback = this._showDOMStorageEntries.bind(this);
+        this.domStorage.getEntries(callback);
+    },
 
-        if (!hasDOMStorage) {
+    _showDOMStorageEntries: function(entries) 
+    {
+        if (entries.length > 0) {
+            this._dataGrid = this._dataGridForDOMStorageEntries(entries);
+            this.element.appendChild(this._dataGrid.element);
+            this._dataGrid.updateWidths();
+            this.deleteButton.visible = true;
+        } else {
             var emptyMsgElement = document.createElement("div");
             emptyMsgElement.className = "storage-table-empty";
             if (this.domStorage)
-            emptyMsgElement.textContent = WebInspector.UIString("This storage is empty.");
+                emptyMsgElement.textContent = WebInspector.UIString("This storage is empty.");
             this.element.appendChild(emptyMsgElement);
             this._dataGrid = null;
-            this.deleteButton.addStyleClass("hidden");
+            this.deleteButton.visible = false;
         }
     },
-    
+
     resize: function()
     {
         if (this._dataGrid)
             this._dataGrid.updateWidths();
     },
 
+    _dataGridForDOMStorageEntries: function(entries)
+    {
+        var columns = {};
+        columns[0] = {};
+        columns[1] = {};
+        columns[0].title = WebInspector.UIString("Key");
+        columns[0].width = columns[0].title.length;
+        columns[1].title = WebInspector.UIString("Value");
+        columns[1].width = columns[1].title.length;
+
+        var nodes = [];
+
+        var keys = [];
+        var length = entries.length;
+        for (var i = 0; i < entries.length; i++) {
+            var data = {};
+
+            var key = entries[i][0];
+            data[0] = key;
+            if (key.length > columns[0].width)
+                columns[0].width = key.length;
+
+            var value = entries[i][1];
+            data[1] = value;
+            if (value.length > columns[1].width)
+                columns[1].width = value.length;
+            var node = new WebInspector.DataGridNode(data, false);
+            node.selectable = true;
+            nodes.push(node);
+            keys.push(key);
+        }
+
+        var totalColumnWidths = columns[0].width + columns[1].width;
+        var width = Math.round((columns[0].width * 100) / totalColumnWidths);
+        const minimumPrecent = 10;
+        if (width < minimumPrecent)
+            width = minimumPrecent;
+        if (width > 100 - minimumPrecent)
+            width = 100 - minimumPrecent;
+        columns[0].width = width;
+        columns[1].width = 100 - width;
+        columns[0].width += "%";
+        columns[1].width += "%";
+
+        var dataGrid = new WebInspector.DOMStorageDataGrid(columns, this.domStorage, keys);
+        var length = nodes.length;
+        for (var i = 0; i < length; ++i)
+            dataGrid.appendChild(nodes[i]);
+        dataGrid.addCreationNode(false);
+        if (length > 0)
+            nodes[0].selected = true;
+        return dataGrid;
+    },
+
     _deleteButtonClicked: function(event)
     {
         if (this._dataGrid) {
diff --git a/WebCore/inspector/front-end/DataGrid.js b/WebCore/inspector/front-end/DataGrid.js
index 42e001c..ce61548 100644
--- a/WebCore/inspector/front-end/DataGrid.js
+++ b/WebCore/inspector/front-end/DataGrid.js
@@ -39,6 +39,8 @@ WebInspector.DataGrid = function(columns)
     this._dataTable.addEventListener("mousedown", this._mouseDownInDataTable.bind(this), true);
     this._dataTable.addEventListener("click", this._clickInDataTable.bind(this), true);
 
+    this.aligned = {};
+
     var scrollContainer = document.createElement("div");
     scrollContainer.className = "data-container";
     scrollContainer.appendChild(this._dataTable);
@@ -78,6 +80,11 @@ WebInspector.DataGrid = function(columns)
             cell.addStyleClass("sortable");
         }
 
+        if (column.aligned) {
+            cell.addStyleClass(column.aligned);
+            this.aligned[columnIdentifier] = column.aligned;
+        }
+
         headerRow.appendChild(cell);
 
         ++columnCount;
@@ -752,6 +759,10 @@ WebInspector.DataGridNode.prototype = {
         var cell = document.createElement("td");
         cell.className = columnIdentifier + "-column";
 
+        var alignment = this.dataGrid.aligned[columnIdentifier];
+        if (alignment)
+            cell.addStyleClass(alignment);
+
         var div = document.createElement("div");
         div.textContent = this.data[columnIdentifier];
         cell.appendChild(div);
diff --git a/WebCore/inspector/front-end/Database.js b/WebCore/inspector/front-end/Database.js
index ef42e15..1a348fc 100644
--- a/WebCore/inspector/front-end/Database.js
+++ b/WebCore/inspector/front-end/Database.js
@@ -26,25 +26,18 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Database = function(database, domain, name, version)
+WebInspector.Database = function(id, domain, name, version)
 {
-    this.database = database;
-    this.domain = domain;
-    this.name = name;
-    this.version = version;
+    this._id = id;
+    this._domain = domain;
+    this._name = name;
+    this._version = version;
 }
 
 WebInspector.Database.prototype = {
-    get database()
+    get id()
     {
-        return this._database;
-    },
-
-    set database(x)
-    {
-        if (this._database === x)
-            return;
-        this._database = x;
+        return this._id;
     },
 
     get name()
@@ -54,8 +47,6 @@ WebInspector.Database.prototype = {
 
     set name(x)
     {
-        if (this._name === x)
-            return;
         this._name = x;
     },
 
@@ -66,8 +57,6 @@ WebInspector.Database.prototype = {
 
     set version(x)
     {
-        if (this._version === x)
-            return;
         this._version = x;
     },
 
@@ -78,8 +67,6 @@ WebInspector.Database.prototype = {
 
     set domain(x)
     {
-        if (this._domain === x)
-            return;
         this._domain = x;
     },
 
@@ -88,8 +75,28 @@ WebInspector.Database.prototype = {
         return WebInspector.Resource.prototype.__lookupGetter__("displayDomain").call(this);
     },
 
-    get tableNames()
+    getTableNames: function(callback)
     {
-        return InspectorController.databaseTableNames(this.database).sort();
+        function sortingCallback(names)
+        {
+            callback(names.sort());
+        }
+        var callId = WebInspector.Callback.wrap(sortingCallback);
+        InspectorController.getDatabaseTableNames(callId, this._id);
+    },
+    
+    executeSql: function(query, onSuccess, onError)
+    {
+        function callback(result)
+        {
+            if (!(result instanceof Array)) {
+                onError(result);
+                return;
+            }
+            onSuccess(result);
+        }
+        InjectedScriptAccess.executeSql(this._id, query, callback);
     }
 }
+
+WebInspector.didGetDatabaseTableNames = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/DatabaseQueryView.js b/WebCore/inspector/front-end/DatabaseQueryView.js
index 429c2c3..6c5fa02 100644
--- a/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -81,11 +81,15 @@ WebInspector.DatabaseQueryView.prototype = {
                     return;
             }
         }
+        
+        function tableNamesCallback(tableNames)
+        {
+            accumulateMatches(tableNames.map(function(name) { return name + " " }));
+            accumulateMatches(["SELECT ", "FROM ", "WHERE ", "LIMIT ", "DELETE FROM ", "CREATE ", "DROP ", "TABLE ", "INDEX ", "UPDATE ", "INSERT INTO ", "VALUES ("]);
 
-        accumulateMatches(this.database.tableNames.map(function(name) { return name + " " }));
-        accumulateMatches(["SELECT ", "FROM ", "WHERE ", "LIMIT ", "DELETE FROM ", "CREATE ", "DROP ", "TABLE ", "INDEX ", "UPDATE ", "INSERT INTO ", "VALUES ("]);
-
-        completionsReadyCallback(results);
+            completionsReadyCallback(results);
+        }
+        this.database.getTableNames(tableNamesCallback);
     },
 
     _promptKeyDown: function(event)
@@ -132,22 +136,19 @@ WebInspector.DatabaseQueryView.prototype = {
         this.prompt.historyOffset = 0;
         this.prompt.text = "";
 
-        function queryTransaction(tx)
-        {
-            tx.executeSql(query, null, InspectorController.wrapCallback(this._queryFinished.bind(this, query)), InspectorController.wrapCallback(this._executeSqlError.bind(this, query)));
-        }
-
-        this.database.database.transaction(InspectorController.wrapCallback(queryTransaction.bind(this)), InspectorController.wrapCallback(this._queryError.bind(this, query)));
+        this.database.executeSql(query, this._queryFinished.bind(this, query), this._queryError.bind(this, query));
     },
 
-    _queryFinished: function(query, tx, result)
+    _queryFinished: function(query, result)
     {
-        var dataGrid = WebInspector.panels.databases.dataGridForResult(result);
+        var dataGrid = WebInspector.panels.storage.dataGridForResult(result);
+        if (!dataGrid)
+            return;
         dataGrid.element.addStyleClass("inline");
         this._appendQueryResult(query, dataGrid.element);
 
         if (query.match(/^create /i) || query.match(/^drop table /i))
-            WebInspector.panels.databases.updateDatabaseTables(this.database);
+            WebInspector.panels.storage.updateDatabaseTables(this.database);
     },
 
     _queryError: function(query, error)
@@ -162,11 +163,6 @@ WebInspector.DatabaseQueryView.prototype = {
         this._appendQueryResult(query, message, "error");
     },
 
-    _executeSqlError: function(query, tx, error)
-    {
-        this._queryError(query, error);
-    },
-
     _appendQueryResult: function(query, result, resultClassName)
     {
         var element = document.createElement("div");
diff --git a/WebCore/inspector/front-end/DatabaseTableView.js b/WebCore/inspector/front-end/DatabaseTableView.js
index bbca9d0..aa76794 100644
--- a/WebCore/inspector/front-end/DatabaseTableView.js
+++ b/WebCore/inspector/front-end/DatabaseTableView.js
@@ -33,9 +33,7 @@ WebInspector.DatabaseTableView = function(database, tableName)
     this.element.addStyleClass("storage-view");
     this.element.addStyleClass("table");
 
-    this.refreshButton = document.createElement("button");
-    this.refreshButton.title = WebInspector.UIString("Refresh");
-    this.refreshButton.className = "refresh-storage-status-bar-item status-bar-item";
+    this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
     this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
 }
 
@@ -53,19 +51,14 @@ WebInspector.DatabaseTableView.prototype = {
 
     update: function()
     {
-        function queryTransaction(tx)
-        {
-            tx.executeSql("SELECT * FROM " + this.tableName, null, InspectorController.wrapCallback(this._queryFinished.bind(this)), InspectorController.wrapCallback(this._queryError.bind(this)));
-        }
-
-        this.database.database.transaction(InspectorController.wrapCallback(queryTransaction.bind(this)), InspectorController.wrapCallback(this._queryError.bind(this)));
+        this.database.executeSql("SELECT * FROM " + this.tableName, this._queryFinished.bind(this), this._queryError.bind(this));
     },
 
-    _queryFinished: function(tx, result)
+    _queryFinished: function(result)
     {
         this.element.removeChildren();
 
-        var dataGrid = WebInspector.panels.databases.dataGridForResult(result);
+        var dataGrid = WebInspector.panels.storage.dataGridForResult(result);
         if (!dataGrid) {
             var emptyMsgElement = document.createElement("div");
             emptyMsgElement.className = "storage-table-empty";
@@ -77,7 +70,7 @@ WebInspector.DatabaseTableView.prototype = {
         this.element.appendChild(dataGrid.element);
     },
 
-    _queryError: function(tx, error)
+    _queryError: function(error)
     {
         this.element.removeChildren();
 
diff --git a/WebCore/inspector/front-end/Drawer.js b/WebCore/inspector/front-end/Drawer.js
index 23dc483..1b50f91 100644
--- a/WebCore/inspector/front-end/Drawer.js
+++ b/WebCore/inspector/front-end/Drawer.js
@@ -64,6 +64,12 @@ WebInspector.Drawer.prototype = {
         }
     },
 
+    showView: function(view)
+    {
+        if (!this.visible || this.visibleView !== view)
+            this.visibleView = view;
+    },
+
     show: function()
     {
         if (this._animating || this.visible)
diff --git a/WebCore/inspector/front-end/ElementsPanel.js b/WebCore/inspector/front-end/ElementsPanel.js
index ffa0000..fd0874a 100644
--- a/WebCore/inspector/front-end/ElementsPanel.js
+++ b/WebCore/inspector/front-end/ElementsPanel.js
@@ -56,12 +56,14 @@ WebInspector.ElementsPanel = function()
         this.panel.updateStyles(true);
         this.panel.updateMetrics();
         this.panel.updateProperties();
+        this.panel.updateEventListeners();
 
         if (InspectorController.searchingForNode()) {
             InspectorController.toggleNodeSearch();
-            this.panel.nodeSearchButton.removeStyleClass("toggled-on");
+            this.panel.nodeSearchButton.toggled = false;
         }
-        WebInspector.console.addInspectedNode(this._focusedDOMNode);
+        if (this._focusedDOMNode)
+            InjectedScriptAccess.addInspectedNode(this._focusedDOMNode.id, function() {});
     };
 
     this.contentElement.appendChild(this.treeOutline.element);
@@ -75,10 +77,12 @@ WebInspector.ElementsPanel = function()
     this.sidebarPanes.styles = new WebInspector.StylesSidebarPane();
     this.sidebarPanes.metrics = new WebInspector.MetricsSidebarPane();
     this.sidebarPanes.properties = new WebInspector.PropertiesSidebarPane();
+    this.sidebarPanes.eventListeners = new WebInspector.EventListenersSidebarPane();
 
     this.sidebarPanes.styles.onexpand = this.updateStyles.bind(this);
     this.sidebarPanes.metrics.onexpand = this.updateMetrics.bind(this);
     this.sidebarPanes.properties.onexpand = this.updateProperties.bind(this);
+    this.sidebarPanes.eventListeners.onexpand = this.updateEventListeners.bind(this);
 
     this.sidebarPanes.styles.expanded = true;
 
@@ -92,15 +96,13 @@ WebInspector.ElementsPanel = function()
     this.sidebarElement.appendChild(this.sidebarPanes.styles.element);
     this.sidebarElement.appendChild(this.sidebarPanes.metrics.element);
     this.sidebarElement.appendChild(this.sidebarPanes.properties.element);
+    this.sidebarElement.appendChild(this.sidebarPanes.eventListeners.element);
 
     this.sidebarResizeElement = document.createElement("div");
     this.sidebarResizeElement.className = "sidebar-resizer-vertical";
     this.sidebarResizeElement.addEventListener("mousedown", this.rightSidebarResizerDragStart.bind(this), false);
 
-    this.nodeSearchButton = this.createStatusBarButton();
-    this.nodeSearchButton.title = WebInspector.UIString("Select an element in the page to inspect it.");
-    this.nodeSearchButton.id = "node-search-status-bar-item";
-    this.nodeSearchButton.className = "status-bar-item";
+    this.nodeSearchButton = new WebInspector.StatusBarButton(WebInspector.UIString("Select an element in the page to inspect it."), "node-search-status-bar-item");
     this.nodeSearchButton.addEventListener("click", this._nodeSearchButtonClicked.bind(this), false);
 
     this.searchingForNode = false;
@@ -109,13 +111,7 @@ WebInspector.ElementsPanel = function()
     this.element.appendChild(this.sidebarElement);
     this.element.appendChild(this.sidebarResizeElement);
 
-    this._mutationMonitoredWindows = [];
-    this._nodeInsertedEventListener = InspectorController.wrapCallback(this._nodeInserted.bind(this));
-    this._nodeRemovedEventListener = InspectorController.wrapCallback(this._nodeRemoved.bind(this));
-    this._contentLoadedEventListener = InspectorController.wrapCallback(this._contentLoaded.bind(this));
-
-    this.stylesheet = null;
-    this.styles = {};
+    this._changedStyles = {};
 
     this.reset();
 }
@@ -130,7 +126,7 @@ WebInspector.ElementsPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.nodeSearchButton, this.crumbsElement];
+        return [this.nodeSearchButton.element, this.crumbsElement];
     },
 
     updateStatusBarItems: function()
@@ -156,7 +152,7 @@ WebInspector.ElementsPanel.prototype = {
 
         if (InspectorController.searchingForNode()) {
             InspectorController.toggleNodeSearch();
-            this.nodeSearchButton.removeStyleClass("toggled-on");
+            this.nodeSearchButton.toggled = false;
         }
     },
 
@@ -175,40 +171,27 @@ WebInspector.ElementsPanel.prototype = {
 
         if (InspectorController.searchingForNode()) {
             InspectorController.toggleNodeSearch();
-            this.nodeSearchButton.removeStyleClass("toggled-on");
+            this.nodeSearchButton.toggled = false;
         }
 
         this.recentlyModifiedNodes = [];
-        this.unregisterAllMutationEventListeners();
 
         delete this.currentQuery;
         this.searchCanceled();
 
-        var inspectedWindow = Preferences.useDOMAgent ? WebInspector.domAgent.inspectedWindow : InspectorController.inspectedWindow();
-        if (!inspectedWindow || !inspectedWindow.document)
+        var domWindow = WebInspector.domAgent.domWindow;
+        if (!domWindow || !domWindow.document || !domWindow.document.firstChild)
             return;
 
-        if (!inspectedWindow.document.firstChild) {
-            function contentLoaded()
-            {
-                inspectedWindow.document.removeEventListener("DOMContentLoaded", contentLoadedCallback, false);
-
-                this.reset();
-            }
-
-            var contentLoadedCallback = InspectorController.wrapCallback(contentLoaded.bind(this));
-            inspectedWindow.document.addEventListener("DOMContentLoaded", contentLoadedCallback, false);
-            return;
-        }
-
         // If the window isn't visible, return early so the DOM tree isn't built
         // and mutation event listeners are not added.
         if (!InspectorController.isWindowVisible())
             return;
 
-        this.registerMutationEventListeners(inspectedWindow);
+        var inspectedRootDocument = domWindow.document;
+        inspectedRootDocument.addEventListener("DOMNodeInserted", this._nodeInserted.bind(this));
+        inspectedRootDocument.addEventListener("DOMNodeRemoved", this._nodeRemoved.bind(this));
 
-        var inspectedRootDocument = inspectedWindow.document;
         this.rootDOMNode = inspectedRootDocument;
 
         var canidateFocusNode = inspectedRootDocument.body || inspectedRootDocument.documentElement;
@@ -222,19 +205,11 @@ WebInspector.ElementsPanel.prototype = {
         }
     },
 
-    includedInSearchResultsPropertyName: "__includedInInspectorSearchResults",
-
     searchCanceled: function()
     {
         if (this._searchResults) {
-            const searchResultsProperty = this.includedInSearchResultsPropertyName;
             for (var i = 0; i < this._searchResults.length; ++i) {
-                var node = this._searchResults[i];
-
-                // Remove the searchResultsProperty since there might be an unfinished search.
-                delete node[searchResultsProperty];
-
-                var treeElement = this.treeOutline.findTreeElement(node);
+                var treeElement = this.treeOutline.findTreeElement(this._searchResults[i]);
                 if (treeElement)
                     treeElement.highlighted = false;
             }
@@ -242,13 +217,9 @@ WebInspector.ElementsPanel.prototype = {
 
         WebInspector.updateSearchMatchesCount(0, this);
 
-        if (this._currentSearchChunkIntervalIdentifier) {
-            clearInterval(this._currentSearchChunkIntervalIdentifier);
-            delete this._currentSearchChunkIntervalIdentifier;
-        }
-
         this._currentSearchResultIndex = 0;
         this._searchResults = [];
+        InjectedScriptAccess.searchCanceled(function() {});
     },
 
     performSearch: function(query)
@@ -260,241 +231,56 @@ WebInspector.ElementsPanel.prototype = {
         if (!whitespaceTrimmedQuery.length)
             return;
 
-        var tagNameQuery = whitespaceTrimmedQuery;
-        var attributeNameQuery = whitespaceTrimmedQuery;
-        var startTagFound = (tagNameQuery.indexOf("<") === 0);
-        var endTagFound = (tagNameQuery.lastIndexOf(">") === (tagNameQuery.length - 1));
-
-        if (startTagFound || endTagFound) {
-            var tagNameQueryLength = tagNameQuery.length;
-            tagNameQuery = tagNameQuery.substring((startTagFound ? 1 : 0), (endTagFound ? (tagNameQueryLength - 1) : tagNameQueryLength));
-        }
-
-        // Check the tagNameQuery is it is a possibly valid tag name.
-        if (!/^[a-zA-Z0-9\-_:]+$/.test(tagNameQuery))
-            tagNameQuery = null;
-
-        // Check the attributeNameQuery is it is a possibly valid tag name.
-        if (!/^[a-zA-Z0-9\-_:]+$/.test(attributeNameQuery))
-            attributeNameQuery = null;
-
-        const escapedQuery = query.escapeCharacters("'");
-        const escapedTagNameQuery = (tagNameQuery ? tagNameQuery.escapeCharacters("'") : null);
-        const escapedWhitespaceTrimmedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
-        const searchResultsProperty = this.includedInSearchResultsPropertyName;
-
-        var updatedMatchCountOnce = false;
-        var matchesCountUpdateTimeout = null;
-
-        function updateMatchesCount()
-        {
-            WebInspector.updateSearchMatchesCount(this._searchResults.length, this);
-            matchesCountUpdateTimeout = null;
-            updatedMatchCountOnce = true;
-        }
-
-        function updateMatchesCountSoon()
-        {
-            if (!updatedMatchCountOnce)
-                return updateMatchesCount.call(this);
-            if (matchesCountUpdateTimeout)
-                return;
-            // Update the matches count every half-second so it doesn't feel twitchy.
-            matchesCountUpdateTimeout = setTimeout(updateMatchesCount.bind(this), 500);
-        }
-
-        function addNodesToResults(nodes, length, getItem)
-        {
-            if (!length)
-                return;
-
-            for (var i = 0; i < length; ++i) {
-                var node = getItem.call(nodes, i);
-                // Skip this node if it already has the property.
-                if (searchResultsProperty in node)
-                    continue;
-
-                if (!this._searchResults.length) {
-                    this._currentSearchResultIndex = 0;
-                    this.focusedDOMNode = node;
-                }
-
-                node[searchResultsProperty] = true;
-                this._searchResults.push(node);
-
-                // Highlight the tree element to show it matched the search.
-                // FIXME: highlight the substrings in text nodes and attributes.
-                var treeElement = this.treeOutline.findTreeElement(node);
-                if (treeElement)
-                    treeElement.highlighted = true;
-            }
-
-            updateMatchesCountSoon.call(this);
-        }
-
-        function matchExactItems(doc)
-        {
-            matchExactId.call(this, doc);
-            matchExactClassNames.call(this, doc);
-            matchExactTagNames.call(this, doc);
-            matchExactAttributeNames.call(this, doc);
-        }
-
-        function matchExactId(doc)
-        {
-            const result = doc.__proto__.getElementById.call(doc, whitespaceTrimmedQuery);
-            addNodesToResults.call(this, result, (result ? 1 : 0), function() { return this });
-        }
-
-        function matchExactClassNames(doc)
-        {
-            const result = doc.__proto__.getElementsByClassName.call(doc, whitespaceTrimmedQuery);
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchExactTagNames(doc)
-        {
-            if (!tagNameQuery)
-                return;
-            const result = doc.__proto__.getElementsByTagName.call(doc, tagNameQuery);
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchExactAttributeNames(doc)
-        {
-            if (!attributeNameQuery)
-                return;
-            const result = doc.__proto__.querySelectorAll.call(doc, "[" + attributeNameQuery + "]");
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchPartialTagNames(doc)
-        {
-            if (!tagNameQuery)
-                return;
-            const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchStartOfTagNames(doc)
-        {
-            if (!tagNameQuery)
-                return;
-            const result = doc.__proto__.evaluate.call(doc, "//*[starts-with(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchPartialTagNamesAndAttributeValues(doc)
-        {
-            if (!tagNameQuery) {
-                matchPartialAttributeValues.call(this, doc);
-                return;
-            }
-
-            const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "') or contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchPartialAttributeValues(doc)
-        {
-            const result = doc.__proto__.evaluate.call(doc, "//*[contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchStyleSelector(doc)
-        {
-            const result = doc.__proto__.querySelectorAll.call(doc, whitespaceTrimmedQuery);
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchPlainText(doc)
-        {
-            const result = doc.__proto__.evaluate.call(doc, "//text()[contains(., '" + escapedQuery + "')] | //comment()[contains(., '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchXPathQuery(doc)
-        {
-            const result = doc.__proto__.evaluate.call(doc, whitespaceTrimmedQuery, doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
+        this._updatedMatchCountOnce = false;
+        this._matchesCountUpdateTimeout = null;
 
-        function finishedSearching()
-        {
-            // Remove the searchResultsProperty now that the search is finished.
-            for (var i = 0; i < this._searchResults.length; ++i)
-                delete this._searchResults[i][searchResultsProperty];
-        }
+        InjectedScriptAccess.performSearch(whitespaceTrimmedQuery, function() {});
+    },
 
-        const mainFrameDocument = InspectorController.inspectedWindow().document;
-        const searchDocuments = [mainFrameDocument];
-
-        if (tagNameQuery && startTagFound && endTagFound)
-            const searchFunctions = [matchExactTagNames, matchPlainText];
-        else if (tagNameQuery && startTagFound)
-            const searchFunctions = [matchStartOfTagNames, matchPlainText];
-        else if (tagNameQuery && endTagFound) {
-            // FIXME: we should have a matchEndOfTagNames search function if endTagFound is true but not startTagFound.
-            // This requires ends-with() support in XPath, WebKit only supports starts-with() and contains().
-            const searchFunctions = [matchPartialTagNames, matchPlainText];
-        } else if (whitespaceTrimmedQuery === "//*" || whitespaceTrimmedQuery === "*") {
-            // These queries will match every node. Matching everything isn't useful and can be slow for large pages,
-            // so limit the search functions list to plain text and attribute matching.
-            const searchFunctions = [matchPartialAttributeValues, matchPlainText];
-        } else
-            const searchFunctions = [matchExactItems, matchStyleSelector, matchPartialTagNamesAndAttributeValues, matchPlainText, matchXPathQuery];
-
-        // Find all frames, iframes and object elements to search their documents.
-        const querySelectorAllFunction = InspectorController.inspectedWindow().Document.prototype.querySelectorAll;
-        const subdocumentResult = querySelectorAllFunction.call(mainFrameDocument, "iframe, frame, object");
-
-        for (var i = 0; i < subdocumentResult.length; ++i) {
-            var element = subdocumentResult.item(i);
-            if (element.contentDocument)
-                searchDocuments.push(element.contentDocument);
-        }
+    _updateMatchesCount: function()
+    {
+        WebInspector.updateSearchMatchesCount(this._searchResults.length, this);
+        this._matchesCountUpdateTimeout = null;
+        this._updatedMatchCountOnce = true;
+    },
 
-        const panel = this;
-        var documentIndex = 0;
-        var searchFunctionIndex = 0;
-        var chunkIntervalIdentifier = null;
+    _updateMatchesCountSoon: function()
+    {
+        if (!this._updatedMatchCountOnce)
+            return this._updateMatchesCount();
+        if (this._matchesCountUpdateTimeout)
+            return;
+        // Update the matches count every half-second so it doesn't feel twitchy.
+        this._matchesCountUpdateTimeout = setTimeout(this._updateMatchesCount.bind(this), 500);
+    },
 
-        // Split up the work into chunks so we don't block the UI thread while processing.
+    addNodesToSearchResult: function(nodeIds)
+    {
+        if (!nodeIds)
+            return;
 
-        function processChunk()
-        {
-            var searchDocument = searchDocuments[documentIndex];
-            var searchFunction = searchFunctions[searchFunctionIndex];
-
-            if (++searchFunctionIndex > searchFunctions.length) {
-                searchFunction = searchFunctions[0];
-                searchFunctionIndex = 0;
-
-                if (++documentIndex > searchDocuments.length) {
-                    if (panel._currentSearchChunkIntervalIdentifier === chunkIntervalIdentifier)
-                        delete panel._currentSearchChunkIntervalIdentifier;
-                    clearInterval(chunkIntervalIdentifier);
-                    finishedSearching.call(panel);
-                    return;
-                }
+        var nodeIdsArray = nodeIds.split(",");
+        for (var i = 0; i < nodeIdsArray.length; ++i) {
+            var nodeId = nodeIdsArray[i];
+            var node = WebInspector.domAgent.nodeForId(nodeId);
+            if (!node)
+                continue;
 
-                searchDocument = searchDocuments[documentIndex];
+            if (!this._searchResults.length) {
+                this._currentSearchResultIndex = 0;
+                this.focusedDOMNode = node;
             }
 
-            if (!searchDocument || !searchFunction)
-                return;
+            this._searchResults.push(node);
 
-            try {
-                searchFunction.call(panel, searchDocument);
-            } catch(err) {
-                // ignore any exceptions. the query might be malformed, but we allow that.
-            }
+            // Highlight the tree element to show it matched the search.
+            // FIXME: highlight the substrings in text nodes and attributes.
+            var treeElement = this.treeOutline.findTreeElement(node);
+            if (treeElement)
+                treeElement.highlighted = true;
         }
 
-        processChunk();
-
-        chunkIntervalIdentifier = setInterval(processChunk, 25);
-        this._currentSearchChunkIntervalIdentifier = chunkIntervalIdentifier;
+        this._updateMatchesCountSoon();
     },
 
     jumpToNextSearchResult: function()
@@ -515,12 +301,6 @@ WebInspector.ElementsPanel.prototype = {
         this.focusedDOMNode = this._searchResults[this._currentSearchResultIndex];
     },
 
-    inspectedWindowCleared: function(window)
-    {
-        if (InspectorController.isWindowVisible())
-            this.updateMutationEventListeners(window);
-    },
-
     renameSelector: function(oldIdentifier, newIdentifier, oldSelector, newSelector)
     {
         // TODO: Implement Shifting the oldSelector, and its contents to a newSelector
@@ -532,16 +312,16 @@ WebInspector.ElementsPanel.prototype = {
             return;
 
         var selector = style.parentRule.selectorText;
-        if (!this.styles[identifier])
-            this.styles[identifier] = {};
+        if (!this._changedStyles[identifier])
+            this._changedStyles[identifier] = {};
 
-        if (!this.styles[identifier][selector])
-            this.styles[identifier][selector] = {};
+        if (!this._changedStyles[identifier][selector])
+            this._changedStyles[identifier][selector] = {};
 
-        if (!this.styles[identifier][selector][property])
+        if (!this._changedStyles[identifier][selector][property])
             WebInspector.styleChanges += 1;
 
-        this.styles[identifier][selector][property] = style.getPropertyValue(property);
+        this._changedStyles[identifier][selector][property] = style.getPropertyValue(property);
     },
 
     removeStyleChange: function(identifier, style, property)
@@ -550,11 +330,11 @@ WebInspector.ElementsPanel.prototype = {
             return;
 
         var selector = style.parentRule.selectorText;
-        if (!this.styles[identifier] || !this.styles[identifier][selector])
+        if (!this._changedStyles[identifier] || !this._changedStyles[identifier][selector])
             return;
 
-        if (this.styles[identifier][selector][property]) {
-            delete this.styles[identifier][selector][property];
+        if (this._changedStyles[identifier][selector][property]) {
+            delete this._changedStyles[identifier][selector][property];
             WebInspector.styleChanges -= 1;
         }
     },
@@ -566,24 +346,24 @@ WebInspector.ElementsPanel.prototype = {
 
         // Merge Down to Just Selectors
         var mergedSelectors = {};
-        for (var identifier in this.styles) {
-            for (var selector in this.styles[identifier]) {
+        for (var identifier in this._changedStyles) {
+            for (var selector in this._changedStyles[identifier]) {
                 if (!mergedSelectors[selector])
-                    mergedSelectors[selector] = this.styles[identifier][selector];
+                    mergedSelectors[selector] = this._changedStyles[identifier][selector];
                 else { // merge on selector
                     var merge = {};
                     for (var property in mergedSelectors[selector])
                         merge[property] = mergedSelectors[selector][property];
-                    for (var property in this.styles[identifier][selector]) {
+                    for (var property in this._changedStyles[identifier][selector]) {
                         if (!merge[property])
-                            merge[property] = this.styles[identifier][selector][property];
+                            merge[property] = this._changedStyles[identifier][selector][property];
                         else { // merge on property within a selector, include comment to notify user
                             var value1 = merge[property];
-                            var value2 = this.styles[identifier][selector][property];
+                            var value2 = this._changedStyles[identifier][selector][property];
 
                             if (value1 === value2)
                                 merge[property] = [value1];
-                            else if (Object.type(value1) === "array")
+                            else if (value1 instanceof Array)
                                 merge[property].push(value2);
                             else
                                 merge[property] = [value1, value2];
@@ -615,7 +395,7 @@ WebInspector.ElementsPanel.prototype = {
                 for (var i = 0; i < properties.length; ++i) {
                     var property = properties[i];
                     var value = psuedoStyle[property];
-                    if (Object.type(value) !== "array")
+                    if (!(value instanceof Array))
                         builder.push(displayProperty(property, value));
                     else {
                         if (value.length === 1)
@@ -632,55 +412,7 @@ WebInspector.ElementsPanel.prototype = {
         }
 
         WebInspector.showConsole();
-        var result = builder.join("\n");
-        InspectorController.inspectedWindow().console.log(result);
-    },
-
-    _addMutationEventListeners: function(monitoredWindow)
-    {
-        monitoredWindow.document.addEventListener("DOMNodeInserted", this._nodeInsertedEventListener, true);
-        monitoredWindow.document.addEventListener("DOMNodeRemoved", this._nodeRemovedEventListener, true);
-        if (monitoredWindow.frameElement)
-            monitoredWindow.addEventListener("DOMContentLoaded", this._contentLoadedEventListener, true);
-    },
-
-    _removeMutationEventListeners: function(monitoredWindow)
-    {
-        if (monitoredWindow.frameElement)
-            monitoredWindow.removeEventListener("DOMContentLoaded", this._contentLoadedEventListener, true);
-        if (!monitoredWindow.document)
-            return;
-        monitoredWindow.document.removeEventListener("DOMNodeInserted", this._nodeInsertedEventListener, true);
-        monitoredWindow.document.removeEventListener("DOMNodeRemoved", this._nodeRemovedEventListener, true);
-    },
-
-    updateMutationEventListeners: function(monitoredWindow)
-    {
-        this._addMutationEventListeners(monitoredWindow);
-    },
-
-    registerMutationEventListeners: function(monitoredWindow)
-    {
-        if (!monitoredWindow || this._mutationMonitoredWindows.indexOf(monitoredWindow) !== -1)
-            return;
-        this._mutationMonitoredWindows.push(monitoredWindow);
-        if (InspectorController.isWindowVisible())
-            this._addMutationEventListeners(monitoredWindow);
-    },
-
-    unregisterMutationEventListeners: function(monitoredWindow)
-    {
-        if (!monitoredWindow || this._mutationMonitoredWindows.indexOf(monitoredWindow) === -1)
-            return;
-        this._mutationMonitoredWindows.remove(monitoredWindow);
-        this._removeMutationEventListeners(monitoredWindow);
-    },
-
-    unregisterAllMutationEventListeners: function()
-    {
-        for (var i = 0; i < this._mutationMonitoredWindows.length; ++i)
-            this._removeMutationEventListeners(this._mutationMonitoredWindows[i]);
-        this._mutationMonitoredWindows = [];
+        WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage(builder.join("\n")));
     },
 
     get rootDOMNode()
@@ -703,13 +435,6 @@ WebInspector.ElementsPanel.prototype = {
         this.treeOutline.focusedDOMNode = x;
     },
 
-    _contentLoaded: function(event)
-    {
-        this.recentlyModifiedNodes.push({node: event.target, parent: event.target.defaultView.frameElement, replaced: true});
-        if (this.visible)
-            this._updateModifiedNodesSoon();
-    },
-
     _nodeInserted: function(event)
     {
         this.recentlyModifiedNodes.push({node: event.target, parent: event.relatedNode, inserted: true});
@@ -747,14 +472,14 @@ WebInspector.ElementsPanel.prototype = {
             if (!parent)
                 continue;
 
-            var parentNodeItem = this.treeOutline.findTreeElement(parent, null, null, objectsAreSame);
+            var parentNodeItem = this.treeOutline.findTreeElement(parent);
             if (parentNodeItem && !parentNodeItem.alreadyUpdatedChildren) {
                 parentNodeItem.updateChildren(replaced);
                 parentNodeItem.alreadyUpdatedChildren = true;
                 updatedParentTreeElements.push(parentNodeItem);
             }
 
-            if (!updateBreadcrumbs && (objectsAreSame(this.focusedDOMNode, parent) || isAncestorIncludingParentFrames(this.focusedDOMNode, parent)))
+            if (!updateBreadcrumbs && (this.focusedDOMNode === parent || isAncestor(this.focusedDOMNode, parent)))
                 updateBreadcrumbs = true;
         }
 
@@ -814,7 +539,7 @@ WebInspector.ElementsPanel.prototype = {
         var foundRoot = false;
         var crumb = crumbs.firstChild;
         while (crumb) {
-            if (objectsAreSame(crumb.representedObject, this.rootDOMNode))
+            if (crumb.representedObject === this.rootDOMNode)
                 foundRoot = true;
 
             if (foundRoot)
@@ -822,7 +547,7 @@ WebInspector.ElementsPanel.prototype = {
             else
                 crumb.removeStyleClass("dimmed");
 
-            if (objectsAreSame(crumb.representedObject, this.focusedDOMNode)) {
+            if (crumb.representedObject === this.focusedDOMNode) {
                 crumb.addStyleClass("selected");
                 handled = true;
             } else {
@@ -875,11 +600,11 @@ WebInspector.ElementsPanel.prototype = {
         }
 
         foundRoot = false;
-        for (var current = this.focusedDOMNode; current; current = parentNodeOrFrameElement(current)) {
+        for (var current = this.focusedDOMNode; current; current = current.parentNode) {
             if (current.nodeType === Node.DOCUMENT_NODE)
                 continue;
 
-            if (objectsAreSame(current, this.rootDOMNode))
+            if (current === this.rootDOMNode)
                 foundRoot = true;
 
             var crumb = document.createElement("span");
@@ -962,7 +687,7 @@ WebInspector.ElementsPanel.prototype = {
 
             if (foundRoot)
                 crumb.addStyleClass("dimmed");
-            if (objectsAreSame(current, this.focusedDOMNode))
+            if (current === this.focusedDOMNode)
                 crumb.addStyleClass("selected");
             if (!crumbs.childNodes.length)
                 crumb.addStyleClass("end");
@@ -1256,6 +981,16 @@ WebInspector.ElementsPanel.prototype = {
         propertiesSidebarPane.needsUpdate = false;
     },
 
+    updateEventListeners: function()
+    {
+        var eventListenersSidebarPane = this.sidebarPanes.eventListeners;
+        if (!eventListenersSidebarPane.expanded || !eventListenersSidebarPane.needsUpdate)
+            return;
+
+        eventListenersSidebarPane.update(this.focusedDOMNode);
+        eventListenersSidebarPane.needsUpdate = false;
+    },
+
     handleKeyEvent: function(event)
     {
         this.treeOutline.handleKeyEvent(event);
@@ -1266,26 +1001,9 @@ WebInspector.ElementsPanel.prototype = {
         // Don't prevent the normal copy if the user has a selection.
         if (!window.getSelection().isCollapsed)
             return;
-
-        switch (this.focusedDOMNode.nodeType) {
-            case Node.ELEMENT_NODE:
-                var data = this.focusedDOMNode.outerHTML;
-                break;
-
-            case Node.COMMENT_NODE:
-                var data = "<!--" + this.focusedDOMNode.nodeValue + "-->";
-                break;
-
-            default:
-            case Node.TEXT_NODE:
-                var data = this.focusedDOMNode.nodeValue;
-        }
-
         event.clipboardData.clearData();
         event.preventDefault();
-
-        if (data)
-            event.clipboardData.setData("text/plain", data);
+        InspectorController.copyNode(this.focusedDOMNode.id);
     },
 
     rightSidebarResizerDragStart: function(event)
@@ -1316,10 +1034,7 @@ WebInspector.ElementsPanel.prototype = {
     {
         InspectorController.toggleNodeSearch();
 
-        if (InspectorController.searchingForNode())
-            this.nodeSearchButton.addStyleClass("toggled-on");
-        else
-            this.nodeSearchButton.removeStyleClass("toggled-on");
+        this.nodeSearchButton.toggled = InspectorController.searchingForNode();
     }
 }
 
diff --git a/WebCore/inspector/front-end/ElementsTreeOutline.js b/WebCore/inspector/front-end/ElementsTreeOutline.js
index ef53209..9e13773 100644
--- a/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -31,7 +31,6 @@
 WebInspector.ElementsTreeOutline = function() {
     this.element = document.createElement("ol");
     this.element.addEventListener("mousedown", this._onmousedown.bind(this), false);
-    this.element.addEventListener("dblclick", this._ondblclick.bind(this), false);
     this.element.addEventListener("mousemove", this._onmousemove.bind(this), false);
     this.element.addEventListener("mouseout", this._onmouseout.bind(this), false);
 
@@ -51,7 +50,7 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     set rootDOMNode(x)
     {
-        if (objectsAreSame(this._rootDOMNode, x))
+        if (this._rootDOMNode === x)
             return;
 
         this._rootDOMNode = x;
@@ -66,7 +65,7 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     set focusedDOMNode(x)
     {
-        if (objectsAreSame(this._focusedDOMNode, x)) {
+        if (this._focusedDOMNode === x) {
             this.revealAndSelectNode(x);
             return;
         }
@@ -79,11 +78,11 @@ WebInspector.ElementsTreeOutline.prototype = {
         // and the select() call would change the focusedDOMNode and reenter this setter. So to
         // avoid calling focusedNodeChanged() twice, first check if _focusedDOMNode is the same
         // node as the one passed in.
-        if (objectsAreSame(this._focusedDOMNode, x)) {
+        if (this._focusedDOMNode === x) {
             this.focusedNodeChanged();
 
             if (x && !this.suppressSelectHighlight) {
-                InspectorController.highlightDOMNode(x);
+                InspectorController.highlightDOMNode(x.id);
 
                 if ("_restorePreviousHighlightNodeTimeout" in this)
                     clearTimeout(this._restorePreviousHighlightNodeTimeout);
@@ -92,7 +91,7 @@ WebInspector.ElementsTreeOutline.prototype = {
                 {
                     var hoveredNode = WebInspector.hoveredDOMNode;
                     if (hoveredNode)
-                        InspectorController.highlightDOMNode(hoveredNode);
+                        InspectorController.highlightDOMNode(hoveredNode.id);
                     else
                         InspectorController.hideDOMNodeHighlight();
                 }
@@ -116,12 +115,12 @@ WebInspector.ElementsTreeOutline.prototype = {
             this.appendChild(treeElement);
         } else {
             // FIXME: this could use findTreeElement to reuse a tree element if it already exists
-            var node = (Preferences.ignoreWhitespace ? firstChildSkippingWhitespace.call(this.rootDOMNode) : this.rootDOMNode.firstChild);
+            var node = this.rootDOMNode.firstChild;
             while (node) {
                 treeElement = new WebInspector.ElementsTreeElement(node);
                 treeElement.selectable = this.selectEnabled;
                 this.appendChild(treeElement);
-                node = Preferences.ignoreWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling;
+                node = node.nextSibling;
             }
         }
 
@@ -138,19 +137,12 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     focusedNodeChanged: function(forceUpdate) {},
 
-    findTreeElement: function(node, isAncestor, getParent, equal)
+    findTreeElement: function(node)
     {
-        if (typeof isAncestor === "undefined")
-            isAncestor = isAncestorIncludingParentFrames;
-        if (typeof getParent === "undefined")
-            getParent = parentNodeOrFrameElement;
-        if (typeof equal === "undefined")
-            equal = objectsAreSame;
-
-        var treeElement = TreeOutline.prototype.findTreeElement.call(this, node, isAncestor, getParent, equal);
+        var treeElement = TreeOutline.prototype.findTreeElement.call(this, node, isAncestorNode, parentNode);
         if (!treeElement && node.nodeType === Node.TEXT_NODE) {
             // The text node might have been inlined if it was short, so try to find the parent element.
-            treeElement = TreeOutline.prototype.findTreeElement.call(this, node.parentNode, isAncestor, getParent, equal);
+            treeElement = TreeOutline.prototype.findTreeElement.call(this, node.parentNode, isAncestorNode, parentNode);
         }
 
         return treeElement;
@@ -193,16 +185,6 @@ WebInspector.ElementsTreeOutline.prototype = {
         return element;
     },
 
-    _ondblclick: function(event)
-    {
-        var element = this._treeElementFromEvent(event);
-
-        if (!element || !element.ondblclick)
-            return;
-
-        element.ondblclick(element, event);
-    },
-
     _onmousedown: function(event)
     {
         var element = this._treeElementFromEvent(event);
@@ -232,7 +214,7 @@ WebInspector.ElementsTreeOutline.prototype = {
     _onmouseout: function(event)
     {
         var nodeUnderMouse = document.elementFromPoint(event.pageX, event.pageY);
-        if (nodeUnderMouse.isDescendant(this.element))
+        if (nodeUnderMouse && nodeUnderMouse.isDescendant(this.element))
             return;
 
         if (this._previousHoveredElement) {
@@ -248,14 +230,10 @@ WebInspector.ElementsTreeOutline.prototype.__proto__ = TreeOutline.prototype;
 
 WebInspector.ElementsTreeElement = function(node)
 {
-    var hasChildren = node.contentDocument || (Preferences.ignoreWhitespace ? (firstChildSkippingWhitespace.call(node) ? true : false) : node.hasChildNodes());
-    var titleInfo = nodeTitleInfo.call(node, hasChildren, WebInspector.linkifyURL);
-
-    if (titleInfo.hasChildren) 
-        this.whitespaceIgnored = Preferences.ignoreWhitespace;
+    var hasChildrenOverride = node.hasChildNodes() && !this._showInlineText(node);
 
     // The title will be updated in onattach.
-    TreeElement.call(this, "", node, titleInfo.hasChildren);
+    TreeElement.call(this, "", node, hasChildrenOverride);
 
     if (this.representedObject.nodeType == Node.ELEMENT_NODE)
         this._canAddAttributes = true;
@@ -380,16 +358,19 @@ WebInspector.ElementsTreeElement.prototype = {
 
     onpopulate: function()
     {
-        if (this.children.length || this.whitespaceIgnored !== Preferences.ignoreWhitespace)
+        if (this.children.length || this._showInlineText(this.representedObject))
             return;
 
-        this.whitespaceIgnored = Preferences.ignoreWhitespace;
-
         this.updateChildren();
     },
-
+    
     updateChildren: function(fullRefresh)
     {
+        WebInspector.domAgent.getChildNodesAsync(this.representedObject, this._updateChildren.bind(this, fullRefresh));
+    },
+
+    _updateChildren: function(fullRefresh)
+    {
         if (fullRefresh) {
             var selectedTreeElement = this.treeOutline.selectedTreeElement;
             if (selectedTreeElement && selectedTreeElement.hasAncestor(this))
@@ -403,14 +384,14 @@ WebInspector.ElementsTreeElement.prototype = {
         function updateChildrenOfNode(node)
         {
             var treeOutline = treeElement.treeOutline;
-            var child = (Preferences.ignoreWhitespace ? firstChildSkippingWhitespace.call(node) : node.firstChild);
+            var child = node.firstChild;
             while (child) {
                 var currentTreeElement = treeElement.children[treeChildIndex];
-                if (!currentTreeElement || !objectsAreSame(currentTreeElement.representedObject, child)) {
+                if (!currentTreeElement || currentTreeElement.representedObject !== child) {
                     // Find any existing element that is later in the children list.
                     var existingTreeElement = null;
                     for (var i = (treeChildIndex + 1); i < treeElement.children.length; ++i) {
-                        if (objectsAreSame(treeElement.children[i].representedObject, child)) {
+                        if (treeElement.children[i].representedObject === child) {
                             existingTreeElement = treeElement.children[i];
                             break;
                         }
@@ -431,7 +412,7 @@ WebInspector.ElementsTreeElement.prototype = {
                     }
                 }
 
-                child = Preferences.ignoreWhitespace ? nextSiblingSkippingWhitespace.call(child) : child.nextSibling;
+                child = child.nextSibling;
                 ++treeChildIndex;
             }
         }
@@ -445,9 +426,7 @@ WebInspector.ElementsTreeElement.prototype = {
             var currentNode = currentChild.representedObject;
             var currentParentNode = currentNode.parentNode;
 
-            if (objectsAreSame(currentParentNode, this.representedObject))
-                continue;
-            if (this.representedObject.contentDocument && objectsAreSame(currentParentNode, this.representedObject.contentDocument))
+            if (currentParentNode === this.representedObject)
                 continue;
 
             var selectedTreeElement = this.treeOutline.selectedTreeElement;
@@ -455,13 +434,8 @@ WebInspector.ElementsTreeElement.prototype = {
                 this.select();
 
             this.removeChildAtIndex(i);
-
-            if (this.treeOutline.panel && currentNode.contentDocument)
-                this.treeOutline.panel.unregisterMutationEventListeners(currentNode.contentDocument.defaultView);
         }
 
-        if (this.representedObject.contentDocument)
-            updateChildrenOfNode(this.representedObject.contentDocument);
         updateChildrenOfNode(this.representedObject);
 
         var lastChild = this.children[this.children.length - 1];
@@ -477,9 +451,6 @@ WebInspector.ElementsTreeElement.prototype = {
     onexpand: function()
     {
         this.treeOutline.updateSelection();
-
-        if (this.treeOutline.panel && this.representedObject.contentDocument)
-            this.treeOutline.panel.registerMutationEventListeners(this.representedObject.contentDocument.defaultView);
     },
 
     oncollapse: function()
@@ -693,7 +664,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
 
         if (!parseElement.hasAttributes()) {
-            InspectorController.inspectedWindow().Element.prototype.removeAttribute.call(this.representedObject, attributeName);
+            this.representedObject.removeAttribute(attributeName);
             this._updateTitle();
             moveToNextAttributeIfNeeded.call(this);
             return;
@@ -704,12 +675,12 @@ WebInspector.ElementsTreeElement.prototype = {
             var attr = parseElement.attributes[i];
             foundOriginalAttribute = foundOriginalAttribute || attr.name === attributeName;
             try {
-                InspectorController.inspectedWindow().Element.prototype.setAttribute.call(this.representedObject, attr.name, attr.value);
+                this.representedObject.setAttribute(attr.name, attr.value);
             } catch(e) {} // ignore invalid attribute (innerHTML doesn't throw errors, but this can)
         }
 
         if (!foundOriginalAttribute)
-            InspectorController.inspectedWindow().Element.prototype.removeAttribute.call(this.representedObject, attributeName);
+            this.representedObject.removeAttribute(attributeName);
 
         this._updateTitle();
 
@@ -743,12 +714,115 @@ WebInspector.ElementsTreeElement.prototype = {
 
     _updateTitle: function()
     {
-        var title = nodeTitleInfo.call(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
+        var title = this._nodeTitleInfo(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
         this.title = "<span class=\"highlight\">" + title + "</span>";
         delete this.selectionElement;
         this.updateSelection();
         this._preventFollowingLinksOnDoubleClick();
     },
+
+    _nodeTitleInfo: function(node, hasChildren, linkify)
+    {
+        var info = {title: "", hasChildren: hasChildren};
+        
+        switch (node.nodeType) {
+            case Node.DOCUMENT_NODE:
+                info.title = "Document";
+                break;
+                
+            case Node.ELEMENT_NODE:
+                info.title = "<span class=\"webkit-html-tag\">&lt;" + node.nodeName.toLowerCase().escapeHTML();
+                
+                if (node.hasAttributes()) {
+                    for (var i = 0; i < node.attributes.length; ++i) {
+                        var attr = node.attributes[i];
+                        info.title += " <span class=\"webkit-html-attribute\"><span class=\"webkit-html-attribute-name\">" + attr.name.escapeHTML() + "</span>=&#8203;\"";
+                        
+                        var value = attr.value;
+                        if (linkify && (attr.name === "src" || attr.name === "href")) {
+                            var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
+                            info.title += linkify(attr.value, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() == "a");
+                        } else {
+                            var value = value.escapeHTML();
+                            value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
+                            info.title += "<span class=\"webkit-html-attribute-value\">" + value + "</span>";
+                        }
+                        info.title += "\"</span>";
+                    }
+                }
+                info.title += "&gt;</span>&#8203;";
+                
+                // If this element only has a single child that is a text node,
+                // just show that text and the closing tag inline rather than
+                // create a subtree for them
+                
+                var textChild = onlyTextChild.call(node);
+                var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
+                
+                if (showInlineText) {
+                    info.title += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;<span class=\"webkit-html-tag\">&lt;/" + node.nodeName.toLowerCase().escapeHTML() + "&gt;</span>";
+                    info.hasChildren = false;
+                }
+                break;
+                
+            case Node.TEXT_NODE:
+                if (isNodeWhitespace.call(node))
+                    info.title = "(whitespace)";
+                else {
+                    if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "script") {
+                        var newNode = document.createElement("span");
+                        newNode.textContent = node.textContent;
+                        
+                        var javascriptSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(null, null);
+                        javascriptSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        
+                        info.title = "<span class=\"webkit-html-text-node webkit-html-js-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
+                    } else if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "style") {
+                        var newNode = document.createElement("span");
+                        newNode.textContent = node.textContent;
+                        
+                        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(null, null);
+                        cssSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        
+                        info.title = "<span class=\"webkit-html-text-node webkit-html-css-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
+                    } else {
+                        info.title = "\"<span class=\"webkit-html-text-node\">" + node.nodeValue.escapeHTML() + "</span>\""; 
+                    }
+                } 
+                break;
+                
+            case Node.COMMENT_NODE:
+                info.title = "<span class=\"webkit-html-comment\">&lt;!--" + node.nodeValue.escapeHTML() + "--&gt;</span>";
+                break;
+                
+            case Node.DOCUMENT_TYPE_NODE:
+                info.title = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + node.nodeName;
+                if (node.publicId) {
+                    info.title += " PUBLIC \"" + node.publicId + "\"";
+                    if (node.systemId)
+                        info.title += " \"" + node.systemId + "\"";
+                } else if (node.systemId)
+                    info.title += " SYSTEM \"" + node.systemId + "\"";
+                if (node.internalSubset)
+                    info.title += " [" + node.internalSubset + "]";
+                info.title += "&gt;</span>";
+                break;
+            default:
+                info.title = node.nodeName.toLowerCase().collapseWhitespace().escapeHTML();
+        }
+        
+        return info;
+    },
+
+    _showInlineText: function(node)
+    {
+        if (node.nodeType === Node.ELEMENT_NODE) {
+            var textChild = onlyTextChild.call(node);
+            if (textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength)
+                return true;
+        }
+        return false;
+    }
 }
 
 WebInspector.ElementsTreeElement.prototype.__proto__ = TreeElement.prototype;
diff --git a/WebCore/inspector/front-end/EventListenersSidebarPane.js b/WebCore/inspector/front-end/EventListenersSidebarPane.js
new file mode 100644
index 0000000..55b8e55
--- /dev/null
+++ b/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.EventListenersSidebarPane = function()
+{
+    WebInspector.SidebarPane.call(this, WebInspector.UIString("Event Listeners"));
+    this.bodyElement.addStyleClass("events-pane");
+
+    this.sections = [];
+
+    this.settingsSelectElement = document.createElement("select");
+
+    var option = document.createElement("option");
+    option.value = "all";
+    if (Preferences.eventListenersFilter === "all")
+        option.selected = true;
+    option.label = WebInspector.UIString("All Nodes");
+    this.settingsSelectElement.appendChild(option);
+
+    option = document.createElement("option");
+    option.value = "selected";
+    if (Preferences.eventListenersFilter === "selected")
+        option.selected = true;
+    option.label = WebInspector.UIString("Selected Node Only");
+    this.settingsSelectElement.appendChild(option);
+
+    this.settingsSelectElement.addEventListener("click", function(event) { event.stopPropagation() }, false);
+    this.settingsSelectElement.addEventListener("change", this._changeSetting.bind(this), false);
+
+    this.titleElement.appendChild(this.settingsSelectElement);
+}
+
+WebInspector.EventListenersSidebarPane.prototype = {
+    update: function(node)
+    {
+        var body = this.bodyElement;
+        body.removeChildren();
+        this.sections = [];
+
+        var self = this;
+        function callback(nodeId, eventListeners) {
+            var sectionNames = [];
+            var sectionMap = {};
+            for (var i = 0; i < eventListeners.length; ++i) {
+                var eventListener = eventListeners[i];
+                eventListener.node = WebInspector.domAgent.nodeForId(eventListener.nodeId);
+                delete eventListener.nodeId; // no longer needed
+                var type = eventListener.type;
+                var section = sectionMap[type];
+                if (!section) {
+                    section = new WebInspector.EventListenersSection(type, nodeId);
+                    sectionMap[type] = section;
+                    sectionNames.push(type);
+                    self.sections.push(section);
+                }
+                section.addListener(eventListener);
+            }
+            
+            if (sectionNames.length === 0) {
+                var div = document.createElement("div");
+                div.className = "info";
+                div.textContent = WebInspector.UIString("No Event Listeners");
+                body.appendChild(div);
+                return;
+            }
+
+            sectionNames.sort();
+            for (var i = 0; i < sectionNames.length; ++i) {
+                var section = sectionMap[sectionNames[i]];
+                section.update();
+                body.appendChild(section.element);
+            }
+        }
+
+        WebInspector.EventListeners.getEventListenersForNodeAsync(node, callback);
+    },
+
+    _changeSetting: function(event)
+    {
+        var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
+        Preferences.eventListenersFilter = selectedOption.value;
+
+        InspectorController.setSetting("event-listeners-filter", Preferences.eventListenersFilter);
+
+        for (var i = 0; i < this.sections.length; ++i)
+            this.sections[i].update();
+    }
+}
+
+WebInspector.EventListenersSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
+
+WebInspector.EventListenersSection = function(title, nodeId)
+{
+    this.eventListeners = [];
+    this._nodeId = nodeId;
+    WebInspector.PropertiesSection.call(this, title);
+
+    // Changed from a Properties List
+    this.propertiesElement.parentNode.removeChild(this.propertiesElement);
+    delete this.propertiesElement;
+    delete this.propertiesTreeOutline;
+
+    this.eventBars = document.createElement("div");
+    this.eventBars.className = "event-bars";
+    this.element.appendChild(this.eventBars);
+}
+
+WebInspector.EventListenersSection.prototype = {
+    update: function()
+    {
+        // A Filtered Array simplifies when to create connectors
+        var filteredEventListeners = this.eventListeners;
+        if (Preferences.eventListenersFilter === "selected") {
+            filteredEventListeners = [];
+            for (var i = 0; i < this.eventListeners.length; ++i) {
+                var eventListener = this.eventListeners[i];
+                if (eventListener.node.id === this._nodeId)
+                    filteredEventListeners.push(eventListener);
+            }
+        }
+
+        this.eventBars.removeChildren();
+        var length = filteredEventListeners.length;
+        for (var i = 0; i < length; ++i) {
+            var eventListener = filteredEventListeners[i];
+            var eventListenerBar = new WebInspector.EventListenerBar(eventListener);
+            if (i < length - 1) {
+                var connector = document.createElement("div");
+                connector.className = "event-bar-connector";
+                eventListenerBar.element.appendChild(connector);
+            }
+
+            this.eventBars.appendChild(eventListenerBar.element);
+        }
+    },
+
+    addListener: function(eventListener)
+    {
+        this.eventListeners.push(eventListener);
+    }
+}
+
+WebInspector.EventListenersSection.prototype.__proto__ = WebInspector.PropertiesSection.prototype;
+
+WebInspector.EventListenerBar = function(eventListener)
+{
+    this.eventListener = eventListener;
+    WebInspector.ObjectPropertiesSection.call(this, null, this._getFunctionDisplayName(), this._getNodeDisplayName());
+    this.editable = false;
+    this.element.className = "event-bar"; /* Changed from "section" */
+    this.propertiesElement.className = "event-properties"; /* Changed from "properties" */
+}
+
+WebInspector.EventListenerBar.prototype = {
+    update: function()
+    {
+        var properties = [];
+        for (var propertyName in this.eventListener) {
+            // Just build properties in place - no need to reach out for injected script.
+            var value = this.eventListener[propertyName];
+            if (value instanceof WebInspector.DOMNode)
+                value = new WebInspector.ObjectProxy(value.id, [], 0, appropriateSelectorForNode(value), true);
+            else
+                value = WebInspector.ObjectProxy.wrapPrimitiveValue(value);
+            properties.push(new WebInspector.ObjectPropertyProxy(propertyName, value));
+        }
+        this.updateProperties(properties);
+    },
+
+    _getNodeDisplayName: function()
+    {
+        var node = this.eventListener.node;
+        if (!node)
+            return "";
+
+        if (node.nodeType === Node.DOCUMENT_NODE)
+            return "document";
+        
+        return appropriateSelectorForNode(node);
+    },
+
+    _getFunctionDisplayName: function()
+    {
+        // TODO: v8 does not yet provide the raw function, this handles such a case with a placeholder
+        // I didn't make this a UIString because it should be implemented eventually.
+        if (!this.eventListener.listener)
+            return "(listener)";
+
+        // Requires that Function.toString() return at least the function's signature
+        var match = this.eventListener.listener.toString().match(/function ([^\(]+?)\(/);
+        return (match ? match[1] : WebInspector.UIString("(anonymous function)"));
+    }
+}
+
+WebInspector.EventListenerBar.prototype.__proto__ = WebInspector.ObjectPropertiesSection.prototype;
diff --git a/WebCore/inspector/front-end/ImageView.js b/WebCore/inspector/front-end/ImageView.js
index 001ffdd..96e1a6e 100644
--- a/WebCore/inspector/front-end/ImageView.js
+++ b/WebCore/inspector/front-end/ImageView.js
@@ -37,6 +37,7 @@ WebInspector.ImageView = function(resource)
     this.contentElement.appendChild(container);
 
     this.imagePreviewElement = document.createElement("img");
+    this.imagePreviewElement.addStyleClass("resource-image-view");
     this.imagePreviewElement.setAttribute("src", this.resource.url);
 
     container.appendChild(this.imagePreviewElement);
diff --git a/WebCore/inspector/front-end/Images/cookie.png b/WebCore/inspector/front-end/Images/cookie.png
new file mode 100644
index 0000000..90c3c15
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/cookie.png
diff --git a/WebCore/inspector/front-end/Images/domStorage.png b/WebCore/inspector/front-end/Images/domStorage.png
deleted file mode 100644
index 028550c..0000000
--- a/WebCore/inspector/front-end/Images/domStorage.png
+++ /dev/null
diff --git a/WebCore/inspector/front-end/Images/errorRedDot.png b/WebCore/inspector/front-end/Images/errorRedDot.png
new file mode 100644
index 0000000..6f0b164
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/errorRedDot.png
diff --git a/WebCore/inspector/front-end/Images/grayConnectorPoint.png b/WebCore/inspector/front-end/Images/grayConnectorPoint.png
new file mode 100644
index 0000000..fddc7ea
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/grayConnectorPoint.png
diff --git a/WebCore/inspector/front-end/Images/localStorage.png b/WebCore/inspector/front-end/Images/localStorage.png
new file mode 100644
index 0000000..44a3019
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/localStorage.png
diff --git a/WebCore/inspector/front-end/Images/paneSettingsButtons.png b/WebCore/inspector/front-end/Images/paneSettingsButtons.png
new file mode 100644
index 0000000..36a6244
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/paneSettingsButtons.png
diff --git a/WebCore/inspector/front-end/Images/sessionStorage.png b/WebCore/inspector/front-end/Images/sessionStorage.png
new file mode 100644
index 0000000..4d50e35
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/sessionStorage.png
diff --git a/WebCore/inspector/front-end/Images/databasesIcon.png b/WebCore/inspector/front-end/Images/storageIcon.png
index 79c7bb3..79c7bb3 100644
--- a/WebCore/inspector/front-end/Images/databasesIcon.png
+++ b/WebCore/inspector/front-end/Images/storageIcon.png
diff --git a/WebCore/inspector/front-end/Images/successGreenDot.png b/WebCore/inspector/front-end/Images/successGreenDot.png
new file mode 100644
index 0000000..8b9319c
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/successGreenDot.png
diff --git a/WebCore/inspector/front-end/Images/warningOrangeDot.png b/WebCore/inspector/front-end/Images/warningOrangeDot.png
new file mode 100644
index 0000000..8c8b635
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/warningOrangeDot.png
diff --git a/WebCore/inspector/front-end/Images/whiteConnectorPoint.png b/WebCore/inspector/front-end/Images/whiteConnectorPoint.png
new file mode 100644
index 0000000..c8fb1cf
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/whiteConnectorPoint.png
diff --git a/WebCore/inspector/front-end/InjectedScript.js b/WebCore/inspector/front-end/InjectedScript.js
index 4611b48..75c8ced 100644
--- a/WebCore/inspector/front-end/InjectedScript.js
+++ b/WebCore/inspector/front-end/InjectedScript.js
@@ -1,6 +1,5 @@
 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
- * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,12 +26,33 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-var InjectedScript = {
-    _styles: {},
-    _styleRules: {},
-    _lastStyleId: 0,
-    _lastStyleRuleId: 0
-};
+var InjectedScript = {};
+
+// Called from within InspectorController on the 'inspected page' side.
+InjectedScript.reset = function()
+{
+    InjectedScript._styles = {};
+    InjectedScript._styleRules = {};
+    InjectedScript._lastStyleId = 0;
+    InjectedScript._lastStyleRuleId = 0;
+    InjectedScript._searchResults = [];
+    InjectedScript._includedInSearchResultsPropertyName = "__includedInInspectorSearchResults";
+}
+
+InjectedScript.reset();
+
+InjectedScript.dispatch = function(methodName, args, callId)
+{
+    var argsArray = JSON.parse(args);
+    if (callId)
+        argsArray.splice(0, 0, callId);  // Methods that run asynchronously have a call back id parameter.
+    var result = InjectedScript[methodName].apply(InjectedScript, argsArray);
+    if (typeof result === "undefined") {
+        InjectedScript._window().console.error("Web Inspector error: InjectedScript.%s returns undefined", methodName);
+        result = null;
+    }
+    return JSON.stringify(result);
+}
 
 InjectedScript.getStyles = function(nodeId, authorOnly)
 {
@@ -99,6 +119,10 @@ InjectedScript.applyStyleText = function(styleId, styleText, propertyName)
             style.removeProperty(propertyName);
     }
 
+    // Notify caller that the property was successfully deleted.
+    if (!styleTextLength)
+        return [null, [propertyName]];
+
     if (!tempStyle.length)
         return false;
 
@@ -133,6 +157,7 @@ InjectedScript.applyStyleText = function(styleId, styleText, propertyName)
 InjectedScript.setStyleText = function(style, cssText)
 {
     style.cssText = cssText;
+    return true;
 }
 
 InjectedScript.toggleStyleEnabled = function(styleId, propertyName, disabled)
@@ -174,12 +199,14 @@ InjectedScript.toggleStyleEnabled = function(styleId, propertyName, disabled)
     return InjectedScript._serializeStyle(style, true);
 }
 
-InjectedScript.applyStyleRuleText = function(ruleId, newContent, selectedNode)
+InjectedScript.applyStyleRuleText = function(ruleId, newContent, selectedNodeId)
 {
     var rule = InjectedScript._styleRules[ruleId];
     if (!rule)
         return false;
 
+    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
+
     try {
         var stylesheet = rule.parentStyleSheet;
         stylesheet.addRule(newContent);
@@ -194,20 +221,14 @@ InjectedScript.applyStyleRuleText = function(ruleId, newContent, selectedNode)
             }
         }
 
-        var nodes = selectedNode.ownerDocument.querySelectorAll(newContent);
-        for (var i = 0; i < nodes.length; ++i) {
-            if (nodes[i] === selectedNode) {
-                return [InjectedScript._serializeRule(newRule), true];
-            }
-        }
-        return [InjectedScript._serializeRule(newRule), false];
+        return [InjectedScript._serializeRule(newRule), InjectedScript._doesSelectorAffectNode(newContent, selectedNode)];
     } catch(e) {
         // Report invalid syntax.
         return false;
     }
 }
 
-InjectedScript.addStyleSelector = function(newContent)
+InjectedScript.addStyleSelector = function(newContent, selectedNodeId)
 {
     var stylesheet = InjectedScript.stylesheet;
     if (!stylesheet) {
@@ -227,10 +248,28 @@ InjectedScript.addStyleSelector = function(newContent)
         return false;
     }
 
-    return InjectedScript._serializeRule(stylesheet.cssRules[stylesheet.cssRules.length - 1]);
+    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
+    var rule = stylesheet.cssRules[stylesheet.cssRules.length - 1];
+    rule.__isViaInspector = true;
+
+    return [ InjectedScript._serializeRule(rule), InjectedScript._doesSelectorAffectNode(newContent, selectedNode) ];
 }
 
-InjectedScript.setStyleProperty = function(styleId, name, value) {
+InjectedScript._doesSelectorAffectNode = function(selectorText, node)
+{
+    if (!node)
+        return false;
+    var nodes = node.ownerDocument.querySelectorAll(selectorText);
+    for (var i = 0; i < nodes.length; ++i) {
+        if (nodes[i] === node) {
+            return true;
+        }
+    }
+    return false;
+}
+
+InjectedScript.setStyleProperty = function(styleId, name, value)
+{
     var style = InjectedScript._styles[styleId];
     if (!style)
         return false;
@@ -251,17 +290,18 @@ InjectedScript._serializeRule = function(rule)
     }
     ruleValue.isUserAgent = parentStyleSheet && !parentStyleSheet.ownerNode && !parentStyleSheet.href;
     ruleValue.isUser = parentStyleSheet && parentStyleSheet.ownerNode && parentStyleSheet.ownerNode.nodeName == "#document";
+    ruleValue.isViaInspector = !!rule.__isViaInspector;
 
     // Bind editable scripts only.
     var doBind = !ruleValue.isUserAgent && !ruleValue.isUser;
     ruleValue.style = InjectedScript._serializeStyle(rule.style, doBind);
 
     if (doBind) {
-        if (!rule._id) {
-            rule._id = InjectedScript._lastStyleRuleId++;
-            InjectedScript._styleRules[rule._id] = rule;
+        if (!rule.id) {
+            rule.id = InjectedScript._lastStyleRuleId++;
+            InjectedScript._styleRules[rule.id] = rule;
         }
-        ruleValue.id = rule._id;
+        ruleValue.id = rule.id;
     }
     return ruleValue;
 }
@@ -295,11 +335,11 @@ InjectedScript._serializeStyle = function(style, doBind)
     result.uniqueStyleProperties = InjectedScript._getUniqueStyleProperties(style);
 
     if (doBind) {
-        if (!style._id) {
-            style._id = InjectedScript._lastStyleId++;
-            InjectedScript._styles[style._id] = style;
+        if (!style.id) {
+            style.id = InjectedScript._lastStyleId++;
+            InjectedScript._styles[style.id] = style;
         }
-        result.id = style._id;
+        result.id = style.id;
     }
     return result;
 }
@@ -389,7 +429,7 @@ InjectedScript.getPrototypes = function(nodeId)
 
     var result = [];
     for (var prototype = node; prototype; prototype = prototype.__proto__) {
-        var title = Object.describe(prototype);
+        var title = Object.describe(prototype, true);
         if (title.match(/Prototype$/)) {
             title = title.replace(/Prototype$/, "");
         }
@@ -405,39 +445,26 @@ InjectedScript.getProperties = function(objectProxy, ignoreHasOwnProperty)
         return false;
 
     var properties = [];
+
     // Go over properties, prepare results.
     for (var propertyName in object) {
         if (!ignoreHasOwnProperty && "hasOwnProperty" in object && !object.hasOwnProperty(propertyName))
             continue;
 
-        //TODO: remove this once object becomes really remote.
-        if (propertyName === "__treeElementIdentifier")
-            continue;
         var property = {};
         property.name = propertyName;
+        property.parentObjectProxy = objectProxy;
         var isGetter = object["__lookupGetter__"] && object.__lookupGetter__(propertyName);
         if (!property.isGetter) {
             var childObject = object[propertyName];
-            property.type = typeof childObject;
-            property.textContent = Object.describe(childObject, true);
-            property.parentObjectProxy = objectProxy;
-            var parentPath = objectProxy.path.slice();
-            property.childObjectProxy = {
-                objectId : objectProxy.objectId,
-                path : parentPath.splice(parentPath.length, 0, propertyName),
-                protoDepth : objectProxy.protoDepth
-            };
-            if (childObject && (property.type === "object" || property.type === "function")) {
-                for (var subPropertyName in childObject) {
-                    if (propertyName === "__treeElementIdentifier")
-                        continue;
-                    property.hasChildren = true;
-                    break;
-                }
-            }
+            var childObjectProxy = new InjectedScript.createProxyObject(childObject, objectProxy.objectId, true);
+            childObjectProxy.path = objectProxy.path ? objectProxy.path.slice() : [];
+            childObjectProxy.path.push(propertyName);
+            childObjectProxy.protoDepth = objectProxy.protoDepth || 0;
+            property.value = childObjectProxy;
         } else {
             // FIXME: this should show something like "getter" (bug 16734).
-            property.textContent = "\u2014"; // em dash
+            property.value = { description: "\u2014" }; // em dash
             property.isGetter = true;
         }
         properties.push(property);
@@ -479,6 +506,418 @@ InjectedScript.setPropertyValue = function(objectProxy, propertyName, expression
     }
 }
 
+
+InjectedScript.getCompletions = function(expression, includeInspectorCommandLineAPI, callFrameId)
+{
+    var props = {};
+    try {
+        var expressionResult;
+        // Evaluate on call frame if call frame id is available.
+        if (typeof callFrameId === "number") {
+            var callFrame = InjectedScript._callFrameForId(callFrameId);
+            if (!callFrame)
+                return props;
+            expressionResult = InjectedScript._evaluateOn(callFrame.evaluate, callFrame, expression);
+        } else {
+            expressionResult = InjectedScript._evaluateOn(InjectedScript._window().eval, InjectedScript._window(), expression);
+        }
+        for (var prop in expressionResult)
+            props[prop] = true;
+        if (includeInspectorCommandLineAPI)
+            for (var prop in InjectedScript._window()._inspectorCommandLineAPI)
+                if (prop.charAt(0) !== '_')
+                    props[prop] = true;
+    } catch(e) {
+    }
+    return props;
+}
+
+InjectedScript.evaluate = function(expression, objectGroup)
+{
+    return InjectedScript._evaluateAndWrap(InjectedScript._window().eval, InjectedScript._window(), expression, objectGroup);
+}
+
+InjectedScript._evaluateAndWrap = function(evalFunction, object, expression, objectGroup)
+{
+    var result = {};
+    try {
+        result.value = InspectorController.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression), objectGroup);
+        // Handle error that might have happened while describing result.
+        if (result.value.errorText) {
+            result.value = result.value.errorText;
+            result.isException = true;
+        }
+    } catch (e) {
+        result.value = e.toString();
+        result.isException = true;
+    }
+    return result;
+}
+
+InjectedScript._evaluateOn = function(evalFunction, object, expression)
+{
+    InjectedScript._ensureCommandLineAPIInstalled(evalFunction, object);
+    // Surround the expression in with statements to inject our command line API so that
+    // the window object properties still take more precedent than our API functions.
+    expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
+    var value = evalFunction.call(object, expression);
+
+    // When evaluating on call frame error is not thrown, but returned as a value.
+    if (Object.type(value) === "error")
+        throw value.toString();
+
+    return value;
+}
+
+InjectedScript.addInspectedNode = function(nodeId)
+{
+    var node = InjectedScript._nodeForId(nodeId);
+    if (!node)
+        return false;
+
+    InjectedScript._ensureCommandLineAPIInstalled(InjectedScript._window().eval, InjectedScript._window());
+    var inspectedNodes = InjectedScript._window()._inspectorCommandLineAPI._inspectedNodes;
+    inspectedNodes.unshift(node);
+    if (inspectedNodes.length >= 5)
+        inspectedNodes.pop();
+    return true;
+}
+
+InjectedScript.performSearch = function(whitespaceTrimmedQuery)
+{
+    var tagNameQuery = whitespaceTrimmedQuery;
+    var attributeNameQuery = whitespaceTrimmedQuery;
+    var startTagFound = (tagNameQuery.indexOf("<") === 0);
+    var endTagFound = (tagNameQuery.lastIndexOf(">") === (tagNameQuery.length - 1));
+
+    if (startTagFound || endTagFound) {
+        var tagNameQueryLength = tagNameQuery.length;
+        tagNameQuery = tagNameQuery.substring((startTagFound ? 1 : 0), (endTagFound ? (tagNameQueryLength - 1) : tagNameQueryLength));
+    }
+
+    // Check the tagNameQuery is it is a possibly valid tag name.
+    if (!/^[a-zA-Z0-9\-_:]+$/.test(tagNameQuery))
+        tagNameQuery = null;
+
+    // Check the attributeNameQuery is it is a possibly valid tag name.
+    if (!/^[a-zA-Z0-9\-_:]+$/.test(attributeNameQuery))
+        attributeNameQuery = null;
+
+    const escapedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
+    const escapedTagNameQuery = (tagNameQuery ? tagNameQuery.escapeCharacters("'") : null);
+    const escapedWhitespaceTrimmedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
+    const searchResultsProperty = InjectedScript._includedInSearchResultsPropertyName;
+
+    function addNodesToResults(nodes, length, getItem)
+    {
+        if (!length)
+            return;
+
+        var nodeIds = [];
+        for (var i = 0; i < length; ++i) {
+            var node = getItem.call(nodes, i);
+            // Skip this node if it already has the property.
+            if (searchResultsProperty in node)
+                continue;
+
+            if (!InjectedScript._searchResults.length) {
+                InjectedScript._currentSearchResultIndex = 0;
+            }
+
+            node[searchResultsProperty] = true;
+            InjectedScript._searchResults.push(node);
+            var nodeId = InspectorController.pushNodePathToFrontend(node, false);
+            nodeIds.push(nodeId);
+        }
+        InspectorController.addNodesToSearchResult(nodeIds.join(","));
+    }
+
+    function matchExactItems(doc)
+    {
+        matchExactId.call(this, doc);
+        matchExactClassNames.call(this, doc);
+        matchExactTagNames.call(this, doc);
+        matchExactAttributeNames.call(this, doc);
+    }
+
+    function matchExactId(doc)
+    {
+        const result = doc.__proto__.getElementById.call(doc, whitespaceTrimmedQuery);
+        addNodesToResults.call(this, result, (result ? 1 : 0), function() { return this });
+    }
+
+    function matchExactClassNames(doc)
+    {
+        const result = doc.__proto__.getElementsByClassName.call(doc, whitespaceTrimmedQuery);
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchExactTagNames(doc)
+    {
+        if (!tagNameQuery)
+            return;
+        const result = doc.__proto__.getElementsByTagName.call(doc, tagNameQuery);
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchExactAttributeNames(doc)
+    {
+        if (!attributeNameQuery)
+            return;
+        const result = doc.__proto__.querySelectorAll.call(doc, "[" + attributeNameQuery + "]");
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchPartialTagNames(doc)
+    {
+        if (!tagNameQuery)
+            return;
+        const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchStartOfTagNames(doc)
+    {
+        if (!tagNameQuery)
+            return;
+        const result = doc.__proto__.evaluate.call(doc, "//*[starts-with(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchPartialTagNamesAndAttributeValues(doc)
+    {
+        if (!tagNameQuery) {
+            matchPartialAttributeValues.call(this, doc);
+            return;
+        }
+
+        const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "') or contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchPartialAttributeValues(doc)
+    {
+        const result = doc.__proto__.evaluate.call(doc, "//*[contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchStyleSelector(doc)
+    {
+        const result = doc.__proto__.querySelectorAll.call(doc, whitespaceTrimmedQuery);
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchPlainText(doc)
+    {
+        const result = doc.__proto__.evaluate.call(doc, "//text()[contains(., '" + escapedQuery + "')] | //comment()[contains(., '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchXPathQuery(doc)
+    {
+        const result = doc.__proto__.evaluate.call(doc, whitespaceTrimmedQuery, doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function finishedSearching()
+    {
+        // Remove the searchResultsProperty now that the search is finished.
+        for (var i = 0; i < InjectedScript._searchResults.length; ++i)
+            delete InjectedScript._searchResults[i][searchResultsProperty];
+    }
+
+    const mainFrameDocument = InjectedScript._window().document;
+    const searchDocuments = [mainFrameDocument];
+    var searchFunctions;
+    if (tagNameQuery && startTagFound && endTagFound)
+        searchFunctions = [matchExactTagNames, matchPlainText];
+    else if (tagNameQuery && startTagFound)
+        searchFunctions = [matchStartOfTagNames, matchPlainText];
+    else if (tagNameQuery && endTagFound) {
+        // FIXME: we should have a matchEndOfTagNames search function if endTagFound is true but not startTagFound.
+        // This requires ends-with() support in XPath, WebKit only supports starts-with() and contains().
+        searchFunctions = [matchPartialTagNames, matchPlainText];
+    } else if (whitespaceTrimmedQuery === "//*" || whitespaceTrimmedQuery === "*") {
+        // These queries will match every node. Matching everything isn't useful and can be slow for large pages,
+        // so limit the search functions list to plain text and attribute matching.
+        searchFunctions = [matchPartialAttributeValues, matchPlainText];
+    } else
+        searchFunctions = [matchExactItems, matchStyleSelector, matchPartialTagNamesAndAttributeValues, matchPlainText, matchXPathQuery];
+
+    // Find all frames, iframes and object elements to search their documents.
+    const querySelectorAllFunction = InjectedScript._window().Document.prototype.querySelectorAll;
+    const subdocumentResult = querySelectorAllFunction.call(mainFrameDocument, "iframe, frame, object");
+
+    for (var i = 0; i < subdocumentResult.length; ++i) {
+        var element = subdocumentResult.item(i);
+        if (element.contentDocument)
+            searchDocuments.push(element.contentDocument);
+    }
+
+    const panel = InjectedScript;
+    var documentIndex = 0;
+    var searchFunctionIndex = 0;
+    var chunkIntervalIdentifier = null;
+
+    // Split up the work into chunks so we don't block the UI thread while processing.
+
+    function processChunk()
+    {
+        var searchDocument = searchDocuments[documentIndex];
+        var searchFunction = searchFunctions[searchFunctionIndex];
+
+        if (++searchFunctionIndex > searchFunctions.length) {
+            searchFunction = searchFunctions[0];
+            searchFunctionIndex = 0;
+
+            if (++documentIndex > searchDocuments.length) {
+                if (panel._currentSearchChunkIntervalIdentifier === chunkIntervalIdentifier)
+                    delete panel._currentSearchChunkIntervalIdentifier;
+                clearInterval(chunkIntervalIdentifier);
+                finishedSearching.call(panel);
+                return;
+            }
+
+            searchDocument = searchDocuments[documentIndex];
+        }
+
+        if (!searchDocument || !searchFunction)
+            return;
+
+        try {
+            searchFunction.call(panel, searchDocument);
+        } catch(err) {
+            // ignore any exceptions. the query might be malformed, but we allow that.
+        }
+    }
+
+    processChunk();
+
+    chunkIntervalIdentifier = setInterval(processChunk, 25);
+    InjectedScript._currentSearchChunkIntervalIdentifier = chunkIntervalIdentifier;
+    return true;
+}
+
+InjectedScript.searchCanceled = function()
+{
+    if (InjectedScript._searchResults) {
+        const searchResultsProperty = InjectedScript._includedInSearchResultsPropertyName;
+        for (var i = 0; i < this._searchResults.length; ++i) {
+            var node = this._searchResults[i];
+
+            // Remove the searchResultsProperty since there might be an unfinished search.
+            delete node[searchResultsProperty];
+        }
+    }
+
+    if (InjectedScript._currentSearchChunkIntervalIdentifier) {
+        clearInterval(InjectedScript._currentSearchChunkIntervalIdentifier);
+        delete InjectedScript._currentSearchChunkIntervalIdentifier;
+    }
+    InjectedScript._searchResults = [];
+    return true;
+}
+
+InjectedScript.openInInspectedWindow = function(url)
+{
+    // Don't call window.open on wrapper - popup blocker mutes it.
+    // URIs should have no double quotes.
+    InjectedScript._window().eval("window.open(\"" + url + "\")");
+    return true;
+}
+
+InjectedScript.getCallFrames = function()
+{
+    var callFrame = InspectorController.currentCallFrame();
+    if (!callFrame)
+        return false;
+
+    var result = [];
+    var depth = 0;
+    do {
+        result.push(new InjectedScript.CallFrameProxy(depth++, callFrame));
+        callFrame = callFrame.caller;
+    } while (callFrame);
+    return result;
+}
+
+InjectedScript.evaluateInCallFrame = function(callFrameId, code, objectGroup)
+{
+    var callFrame = InjectedScript._callFrameForId(callFrameId);
+    if (!callFrame)
+        return false;
+    return InjectedScript._evaluateAndWrap(callFrame.evaluate, callFrame, code, objectGroup);
+}
+
+InjectedScript._callFrameForId = function(id)
+{
+    var callFrame = InspectorController.currentCallFrame();
+    while (--id >= 0 && callFrame)
+        callFrame = callFrame.caller;
+    return callFrame;
+}
+
+InjectedScript._clearConsoleMessages = function()
+{
+    InspectorController.clearMessages(true);
+}
+
+InjectedScript._inspectObject = function(o)
+{
+    if (arguments.length === 0)
+        return;
+
+    var inspectedWindow = InjectedScript._window();
+    inspectedWindow.console.log(o);
+    if (Object.type(o) === "node") {
+        InspectorController.pushNodePathToFrontend(o, true);
+    } else {
+        switch (Object.describe(o)) {
+            case "Database":
+                InspectorController.selectDatabase(o);
+                break;
+            case "Storage":
+                InspectorController.selectDOMStorage(o);
+                break;
+        }
+    }
+}
+
+InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObject)
+{
+    if (evalFunction.call(evalObject, "window._inspectorCommandLineAPI"))
+        return;
+    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window._inspectorCommandLineAPI = { \
+        $: function() { return document.getElementById.apply(document, arguments) }, \
+        $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
+        $x: function(xpath, context) { \
+            var nodes = []; \
+            try { \
+                var doc = context || document; \
+                var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \
+                var node; \
+                while (node = results.iterateNext()) nodes.push(node); \
+            } catch (e) {} \
+            return nodes; \
+        }, \
+        dir: function() { return console.dir.apply(console, arguments) }, \
+        dirxml: function() { return console.dirxml.apply(console, arguments) }, \
+        keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \
+        values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
+        profile: function() { return console.profile.apply(console, arguments) }, \
+        profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
+        _inspectedNodes: [], \
+        get $0() { return _inspectorCommandLineAPI._inspectedNodes[0] }, \
+        get $1() { return _inspectorCommandLineAPI._inspectedNodes[1] }, \
+        get $2() { return _inspectorCommandLineAPI._inspectedNodes[2] }, \
+        get $3() { return _inspectorCommandLineAPI._inspectedNodes[3] }, \
+        get $4() { return _inspectorCommandLineAPI._inspectedNodes[4] } \
+    };");
+
+    inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
+    inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(InjectedScript._inspectObject);
+}
+
 InjectedScript._resolveObject = function(objectProxy)
 {
     var object = InjectedScript._objectForId(objectProxy.objectId);
@@ -486,11 +925,11 @@ InjectedScript._resolveObject = function(objectProxy)
     var protoDepth = objectProxy.protoDepth;
 
     // Follow the property path.
-    for (var i = 0; object && i < path.length; ++i)
+    for (var i = 0; object && path && i < path.length; ++i)
         object = object[path[i]];
 
     // Get to the necessary proto layer.
-    for (var i = 0; object && i < protoDepth; ++i)
+    for (var i = 0; object && protoDepth && i < protoDepth; ++i)
         object = object.__proto__;
 
     return object;
@@ -505,12 +944,251 @@ InjectedScript._window = function()
 
 InjectedScript._nodeForId = function(nodeId)
 {
-    // TODO: replace with node lookup in the InspectorDOMAgent once DOMAgent nodes are used.
-    return nodeId;
+    if (!nodeId)
+        return null;
+    return InspectorController.nodeForId(nodeId);
 }
 
 InjectedScript._objectForId = function(objectId)
 {
-    // TODO: replace with node lookups for node ids and evaluation result lookups for the rest of ids.
+    // There are three types of object ids used:
+    // - numbers point to DOM Node via the InspectorDOMAgent mapping
+    // - strings point to console objects cached in InspectorController for lazy evaluation upon them
+    // - objects contain complex ids and are currently used for scoped objects
+    if (typeof objectId === "number") {
+        return InjectedScript._nodeForId(objectId);
+    } else if (typeof objectId === "string") {
+        return InspectorController.unwrapObject(objectId);
+    } else if (typeof objectId === "object") {
+        var callFrame = InjectedScript._callFrameForId(objectId.callFrame);
+        if (objectId.thisObject)
+            return callFrame.thisObject;
+        else
+            return callFrame.scopeChain[objectId.chainIndex];
+    }
     return objectId;
 }
+
+InjectedScript.pushNodeToFrontend = function(objectProxy)
+{
+    var object = InjectedScript._resolveObject(objectProxy);
+    if (!object || Object.type(object) !== "node")
+        return false;
+    return InspectorController.pushNodePathToFrontend(object, false);
+}
+
+// Called from within InspectorController on the 'inspected page' side.
+InjectedScript.createProxyObject = function(object, objectId, abbreviate)
+{
+    var result = {};
+    result.objectId = objectId;
+    result.type = Object.type(object);
+
+    var type = typeof object;
+    if ((type === "object" && object !== null) || type === "function") {
+        for (var subPropertyName in object) {
+            result.hasChildren = true;
+            break;
+        }
+    }
+    try {
+        result.description = Object.describe(object, abbreviate);
+    } catch (e) {
+        result.errorText = e.toString();
+    }
+    return result;
+}
+
+InjectedScript.CallFrameProxy = function(id, callFrame)
+{
+    this.id = id;
+    this.type = callFrame.type;
+    this.functionName = (this.type === "function" ? callFrame.functionName : "");
+    this.sourceID = callFrame.sourceID;
+    this.line = callFrame.line;
+    this.scopeChain = this._wrapScopeChain(callFrame);
+}
+
+InjectedScript.CallFrameProxy.prototype = {
+    _wrapScopeChain: function(callFrame)
+    {
+        var foundLocalScope = false;
+        var scopeChain = callFrame.scopeChain;
+        var scopeChainProxy = [];
+        for (var i = 0; i < scopeChain.length; ++i) {
+            var scopeObject = scopeChain[i];
+            var scopeObjectProxy = InjectedScript.createProxyObject(scopeObject, { callFrame: this.id, chainIndex: i }, true);
+
+            if (Object.prototype.toString.call(scopeObject) === "[object JSActivation]") {
+                if (!foundLocalScope)
+                    scopeObjectProxy.thisObject = InjectedScript.createProxyObject(callFrame.thisObject, { callFrame: this.id, thisObject: true }, true);
+                else
+                    scopeObjectProxy.isClosure = true;
+                foundLocalScope = true;
+                scopeObjectProxy.isLocal = true;
+            } else if (foundLocalScope && scopeObject instanceof InjectedScript._window().Element)
+                scopeObjectProxy.isElement = true;
+            else if (foundLocalScope && scopeObject instanceof InjectedScript._window().Document)
+                scopeObjectProxy.isDocument = true;
+            else if (!foundLocalScope)
+                scopeObjectProxy.isWithBlock = true;
+            scopeObjectProxy.properties = [];
+            try {
+                for (var propertyName in scopeObject)
+                    scopeObjectProxy.properties.push(propertyName);
+            } catch (e) {
+            }
+            scopeChainProxy.push(scopeObjectProxy);
+        }
+        return scopeChainProxy;
+    }
+}
+
+InjectedScript.executeSql = function(callId, databaseId, query)
+{
+    function successCallback(tx, result)
+    {
+        var rows = result.rows;
+        var result = [];
+        var length = rows.length;
+        for (var i = 0; i < length; ++i) {
+            var data = {};
+            result.push(data);
+            var row = rows.item(i);
+            for (var columnIdentifier in row) {
+                // FIXME: (Bug 19439) We should specially format SQL NULL here
+                // (which is represented by JavaScript null here, and turned
+                // into the string "null" by the String() function).
+                var text = row[columnIdentifier];
+                data[columnIdentifier] = String(text);
+            }
+        }
+        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(result), false);
+    }
+
+    function errorCallback(tx, error)
+    {
+        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(error), false);
+    }
+
+    function queryTransaction(tx)
+    {
+        tx.executeSql(query, null, InspectorController.wrapCallback(successCallback), InspectorController.wrapCallback(errorCallback));
+    }
+
+    var database = InspectorController.databaseForId(databaseId);
+    if (!database)
+        errorCallback(null, { code : 2 });  // Return as unexpected version.
+    database.transaction(InspectorController.wrapCallback(queryTransaction), InspectorController.wrapCallback(errorCallback));
+    return true;
+}
+
+Object.type = function(obj)
+{
+    if (obj === null)
+        return "null";
+
+    var type = typeof obj;
+    if (type !== "object" && type !== "function")
+        return type;
+
+    var win = InjectedScript._window();
+
+    if (obj instanceof win.Node)
+        return (obj.nodeType === undefined ? type : "node");
+    if (obj instanceof win.String)
+        return "string";
+    if (obj instanceof win.Array)
+        return "array";
+    if (obj instanceof win.Boolean)
+        return "boolean";
+    if (obj instanceof win.Number)
+        return "number";
+    if (obj instanceof win.Date)
+        return "date";
+    if (obj instanceof win.RegExp)
+        return "regexp";
+    if (obj instanceof win.NodeList)
+        return "array";
+    if (obj instanceof win.Error)
+        return "error";
+    return type;
+}
+
+Object.hasProperties = function(obj)
+{
+    if (typeof obj === "undefined" || typeof obj === "null")
+        return false;
+    for (var name in obj)
+        return true;
+    return false;
+}
+
+Object.describe = function(obj, abbreviated)
+{
+    var type1 = Object.type(obj);
+    var type2 = Object.className(obj);
+
+    switch (type1) {
+    case "object":
+    case "node":
+        return type2;
+    case "array":
+        return "[" + obj.toString() + "]";
+    case "string":
+        if (!abbreviated)
+            return obj;
+        if (obj.length > 100)
+            return "\"" + obj.substring(0, 100) + "\u2026\"";
+        return "\"" + obj + "\"";
+    case "function":
+        var objectText = String(obj);
+        if (!/^function /.test(objectText))
+            objectText = (type2 == "object") ? type1 : type2;
+        else if (abbreviated)
+            objectText = /.*/.exec(obj)[0].replace(/ +$/g, "");
+        return objectText;
+    case "regexp":
+        return String(obj).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
+    default:
+        return String(obj);
+    }
+}
+
+Object.className = function(obj)
+{
+    return Object.prototype.toString.call(obj).replace(/^\[object (.*)\]$/i, "$1")
+}
+
+// Although Function.prototype.bind and String.prototype.escapeCharacters are defined in utilities.js they will soon become
+// unavailable in the InjectedScript context. So we define them here for the local use.
+// TODO: remove this comment once InjectedScript runs in a separate context.
+Function.prototype.bind = function(thisObject)
+{
+    var func = this;
+    var args = Array.prototype.slice.call(arguments, 1);
+    return function() { return func.apply(thisObject, args.concat(Array.prototype.slice.call(arguments, 0))) };
+}
+
+String.prototype.escapeCharacters = function(chars)
+{
+    var foundChar = false;
+    for (var i = 0; i < chars.length; ++i) {
+        if (this.indexOf(chars.charAt(i)) !== -1) {
+            foundChar = true;
+            break;
+        }
+    }
+
+    if (!foundChar)
+        return this;
+
+    var result = "";
+    for (var i = 0; i < this.length; ++i) {
+        if (chars.indexOf(this.charAt(i)) !== -1)
+            result += "\\";
+        result += this.charAt(i);
+    }
+
+    return result;
+}
diff --git a/WebCore/inspector/front-end/InjectedScriptAccess.js b/WebCore/inspector/front-end/InjectedScriptAccess.js
new file mode 100644
index 0000000..c6d4b65
--- /dev/null
+++ b/WebCore/inspector/front-end/InjectedScriptAccess.js
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+var InjectedScriptAccess = {};
+
+InjectedScriptAccess._installHandler = function(methodName, async)
+{
+    InjectedScriptAccess[methodName] = function()
+    {
+        var allArgs = Array.prototype.slice.call(arguments);
+        var callback = allArgs[allArgs.length - 1];
+        var argsString = JSON.stringify(Array.prototype.slice.call(allArgs, 0, allArgs.length - 1));
+        
+        function myCallback(result, isException)
+        {
+            if (!isException)
+                callback(JSON.parse(result));
+            else
+                WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage("Error dispatching: " + methodName));
+        }
+        var callId = WebInspector.Callback.wrap(myCallback);
+        InspectorController.dispatchOnInjectedScript(callId, methodName, argsString, !!async);
+    };
+}
+
+// InjectedScriptAccess message forwarding puts some constraints on the way methods are imlpemented and called:
+// - Make sure corresponding methods in InjectedScript return non-null and non-undefined values,
+// - Make sure last parameter of all the InjectedSriptAccess.* calls is a callback function.
+// We keep these sorted.
+InjectedScriptAccess._installHandler("addInspectedNode");
+InjectedScriptAccess._installHandler("addStyleSelector");
+InjectedScriptAccess._installHandler("applyStyleRuleText");
+InjectedScriptAccess._installHandler("applyStyleText");
+InjectedScriptAccess._installHandler("evaluate");
+InjectedScriptAccess._installHandler("evaluateInCallFrame");
+InjectedScriptAccess._installHandler("getCompletions");
+InjectedScriptAccess._installHandler("getComputedStyle");
+InjectedScriptAccess._installHandler("getInlineStyle");
+InjectedScriptAccess._installHandler("getProperties");
+InjectedScriptAccess._installHandler("getPrototypes");
+InjectedScriptAccess._installHandler("getStyles");
+InjectedScriptAccess._installHandler("openInInspectedWindow");
+InjectedScriptAccess._installHandler("performSearch");
+InjectedScriptAccess._installHandler("pushNodeToFrontend");
+InjectedScriptAccess._installHandler("searchCanceled");
+InjectedScriptAccess._installHandler("setPropertyValue");
+InjectedScriptAccess._installHandler("setStyleProperty");
+InjectedScriptAccess._installHandler("setStyleText");
+InjectedScriptAccess._installHandler("toggleStyleEnabled");
+
+// Some methods can't run synchronously even on the injected script side (such as DB transactions).
+// Mark them as asynchronous here.
+InjectedScriptAccess._installHandler("executeSql", true);
+
+WebInspector.didDispatchOnInjectedScript = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/MetricsSidebarPane.js b/WebCore/inspector/front-end/MetricsSidebarPane.js
index 8712dcd..a33653b 100644
--- a/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -57,14 +57,14 @@ WebInspector.MetricsSidebarPane.prototype = {
             var style = WebInspector.CSSStyleDeclaration.parseStyle(stylePayload);
             self._update(node, body, style);
         };
-        InspectorController.getComputedStyle(node, callback);
+        InjectedScriptAccess.getComputedStyle(node.id, callback);
 
         var inlineStyleCallback = function(stylePayload) {
             if (!stylePayload)
                 return;
             self._inlineStyleId = stylePayload.id;
         };
-        InspectorController.getInlineStyle(node, inlineStyleCallback);
+        InjectedScriptAccess.getInlineStyle(node.id, inlineStyleCallback);
     },
 
     _update: function(node, body, style)
@@ -208,7 +208,7 @@ WebInspector.MetricsSidebarPane.prototype = {
             self.dispatchEventToListeners("metrics edited");
             self.update();
         };
-        InspectorController.setStyleProperty(this._inlineStyleId, context.styleProperty, userInput, callback);
+        InjectedScriptAccess.setStyleProperty(this._inlineStyleId, context.styleProperty, userInput, callback);
     }
 }
 
diff --git a/WebCore/inspector/front-end/Object.js b/WebCore/inspector/front-end/Object.js
index 80202b0..74fb56e 100644
--- a/WebCore/inspector/front-end/Object.js
+++ b/WebCore/inspector/front-end/Object.js
@@ -67,10 +67,10 @@ WebInspector.Object.prototype = {
         }
 
         var event = {target: this, type: eventType, defaultPrevented: false};
-        event.stopPropagation = stopPropagation.bind(event);
-        event.preventDefault = preventDefault.bind(event);
+        event.stopPropagation = stopPropagation;
+        event.preventDefault = preventDefault;
 
-        var listeners = this._listeners[eventType];
+        var listeners = this._listeners[eventType].slice(0);
         for (var i = 0; i < listeners.length; ++i) {
             listeners[i].listener.call(listeners[i].thisObject, event);
             if (stoppedPropagation)
diff --git a/WebCore/inspector/front-end/ObjectPropertiesSection.js b/WebCore/inspector/front-end/ObjectPropertiesSection.js
index 9b03940..8bb4e35 100644
--- a/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -48,73 +48,81 @@ WebInspector.ObjectPropertiesSection.prototype = {
         var callback = function(properties) {
             if (!properties)
                 return;
-            self._update(properties);
+            self.updateProperties(properties);
         };
-        InspectorController.getProperties(this.object, this.ignoreHasOwnProperty, callback);
+        InjectedScriptAccess.getProperties(this.object, this.ignoreHasOwnProperty, callback);
     },
 
-    _update: function(properties)
+    updateProperties: function(properties, rootTreeElementConstructor, rootPropertyComparer)
     {
+        if (!rootTreeElementConstructor)
+            rootTreeElementConstructor = this.treeElementConstructor;
+            
+        if (!rootPropertyComparer)
+            rootPropertyComparer = WebInspector.ObjectPropertiesSection.CompareProperties;
+            
         if (this.extraProperties)
-            for (var prop in this.extraProperties)
-                properties.push(new WebInspector.ObjectPropertyProxy(prop, this.extraProperties[prop]));
-        properties.sort(this._displaySort);
+            for (var i = 0; i < this.extraProperties.length; ++i)
+                properties.push(this.extraProperties[i]);
+                
+        properties.sort(rootPropertyComparer);
 
         this.propertiesTreeOutline.removeChildren();
 
         for (var i = 0; i < properties.length; ++i)
-            this.propertiesTreeOutline.appendChild(new this.treeElementConstructor(properties[i]));
+            this.propertiesTreeOutline.appendChild(new rootTreeElementConstructor(properties[i]));
 
         if (!this.propertiesTreeOutline.children.length) {
             var title = "<div class=\"info\">" + this.emptyPlaceholder + "</div>";
             var infoElement = new TreeElement(title, null, false);
             this.propertiesTreeOutline.appendChild(infoElement);
         }
-    },
-
-    _displaySort: function(propertyA, propertyB) {
-        var a = propertyA.name;
-        var b = propertyB.name;
-
-        // if used elsewhere make sure to
-        //  - convert a and b to strings (not needed here, properties are all strings)
-        //  - check if a == b (not needed here, no two properties can be the same)
-
-        var diff = 0;
-        var chunk = /^\d+|^\D+/;
-        var chunka, chunkb, anum, bnum;
-        while (diff === 0) {
-            if (!a && b)
-                return -1;
-            if (!b && a)
-                return 1;
-            chunka = a.match(chunk)[0];
-            chunkb = b.match(chunk)[0];
-            anum = !isNaN(chunka);
-            bnum = !isNaN(chunkb);
-            if (anum && !bnum)
-                return -1;
-            if (bnum && !anum)
-                return 1;
-            if (anum && bnum) {
-                diff = chunka - chunkb;
-                if (diff === 0 && chunka.length !== chunkb.length) {
-                    if (!+chunka && !+chunkb) // chunks are strings of all 0s (special case)
-                        return chunka.length - chunkb.length;
-                    else
-                        return chunkb.length - chunka.length;
-                }
-            } else if (chunka !== chunkb)
-                return (chunka < chunkb) ? -1 : 1;
-            a = a.substring(chunka.length);
-            b = b.substring(chunkb.length);
-        }
-        return diff;
     }
 }
 
 WebInspector.ObjectPropertiesSection.prototype.__proto__ = WebInspector.PropertiesSection.prototype;
 
+WebInspector.ObjectPropertiesSection.CompareProperties = function(propertyA, propertyB) 
+{
+    var a = propertyA.name;
+    var b = propertyB.name;
+
+    // if used elsewhere make sure to
+    //  - convert a and b to strings (not needed here, properties are all strings)
+    //  - check if a == b (not needed here, no two properties can be the same)
+
+    var diff = 0;
+    var chunk = /^\d+|^\D+/;
+    var chunka, chunkb, anum, bnum;
+    while (diff === 0) {
+        if (!a && b)
+            return -1;
+        if (!b && a)
+            return 1;
+        chunka = a.match(chunk)[0];
+        chunkb = b.match(chunk)[0];
+        anum = !isNaN(chunka);
+        bnum = !isNaN(chunkb);
+        if (anum && !bnum)
+            return -1;
+        if (bnum && !anum)
+            return 1;
+        if (anum && bnum) {
+            diff = chunka - chunkb;
+            if (diff === 0 && chunka.length !== chunkb.length) {
+                if (!+chunka && !+chunkb) // chunks are strings of all 0s (special case)
+                    return chunka.length - chunkb.length;
+                else
+                    return chunkb.length - chunka.length;
+            }
+        } else if (chunka !== chunkb)
+            return (chunka < chunkb) ? -1 : 1;
+        a = a.substring(chunka.length);
+        b = b.substring(chunkb.length);
+    }
+    return diff;
+}
+
 WebInspector.ObjectPropertyTreeElement = function(property)
 {
     this.property = property;
@@ -124,30 +132,22 @@ WebInspector.ObjectPropertyTreeElement = function(property)
 }
 
 WebInspector.ObjectPropertyTreeElement.prototype = {
-    safePropertyValue: function(object, propertyName)
-    {
-        if (object["__lookupGetter__"] && object.__lookupGetter__(propertyName))
-            return;
-        return object[propertyName];
-    },
-
     onpopulate: function()
     {
         if (this.children.length && !this.shouldRefreshChildren)
             return;
 
-        var self = this;
         var callback = function(properties) {
-            self.removeChildren();
+            this.removeChildren();
             if (!properties)
                 return;
 
-            properties.sort(self._displaySort);
+            properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
             for (var i = 0; i < properties.length; ++i) {
-                self.appendChild(new self.treeOutline.section.treeElementConstructor(properties[i]));
+                this.appendChild(new this.treeOutline.section.treeElementConstructor(properties[i]));
             }
         };
-        InspectorController.getProperties(this.property.childObjectProxy, false, callback);
+        InjectedScriptAccess.getProperties(this.property.value, false, callback.bind(this));
     },
 
     ondblclick: function(element, event)
@@ -162,22 +162,26 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 
     update: function()
     {
-        var nameElement = document.createElement("span");
-        nameElement.className = "name";
-        nameElement.textContent = this.property.name;
-
+        this.nameElement = document.createElement("span");
+        this.nameElement.className = "name";
+        this.nameElement.textContent = this.property.name;
+
+        var separatorElement = document.createElement("span");
+        separatorElement.className = "separator";
+        separatorElement.textContent = ": ";
+        
         this.valueElement = document.createElement("span");
         this.valueElement.className = "value";
-        this.valueElement.textContent = this.property.textContent;
+        this.valueElement.textContent = this.property.value.description;
         if (this.property.isGetter)
            this.valueElement.addStyleClass("dimmed");
 
         this.listItemElement.removeChildren();
 
-        this.listItemElement.appendChild(nameElement);
-        this.listItemElement.appendChild(document.createTextNode(": "));
+        this.listItemElement.appendChild(this.nameElement);
+        this.listItemElement.appendChild(separatorElement);
         this.listItemElement.appendChild(this.valueElement);
-        this.hasChildren = this.property.hasChildren;
+        this.hasChildren = this.property.value.hasChildren;
     },
 
     updateSiblings: function()
@@ -247,7 +251,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
                 self.updateSiblings();
             }
         };
-        InspectorController.setPropertyValue(this.property.parentObjectProxy, this.property.name, expression.trimWhitespace(), callback);
+        InjectedScriptAccess.setPropertyValue(this.property.parentObjectProxy, this.property.name, expression.trimWhitespace(), callback);
     }
 }
 
diff --git a/WebCore/inspector/front-end/ObjectProxy.js b/WebCore/inspector/front-end/ObjectProxy.js
index fa7816e..bb4afa5 100644
--- a/WebCore/inspector/front-end/ObjectProxy.js
+++ b/WebCore/inspector/front-end/ObjectProxy.js
@@ -28,18 +28,25 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.ObjectProxy = function(objectId, path, protoDepth)
+WebInspector.ObjectProxy = function(objectId, path, protoDepth, description, hasChildren)
 {
     this.objectId = objectId;
     this.path = path || [];
     this.protoDepth = protoDepth || 0;
+    this.description = description;
+    this.hasChildren = hasChildren;
 }
 
-WebInspector.ObjectPropertyProxy = function(name, object)
+WebInspector.ObjectProxy.wrapPrimitiveValue = function(value)
+{
+    var proxy = new WebInspector.ObjectProxy();
+    proxy.type = typeof value;
+    proxy.description = value;
+    return proxy;
+}
+
+WebInspector.ObjectPropertyProxy = function(name, value)
 {
     this.name = name;
-    this.type = "object";
-    this.hasChildren = true;
-    this.textContent = Object.describe(object, true);
-    this.childObjectProxy = new WebInspector.ObjectProxy(object);
+    this.value = value;
 }
diff --git a/WebCore/inspector/front-end/Panel.js b/WebCore/inspector/front-end/Panel.js
index 3e2212c..5046f6b 100644
--- a/WebCore/inspector/front-end/Panel.js
+++ b/WebCore/inspector/front-end/Panel.js
@@ -66,18 +66,6 @@ WebInspector.Panel.prototype = {
         return this._toolbarItem;
     },
 
-    createStatusBarButton: function()
-    {
-        var button = document.createElement("button");
-        var glyph = document.createElement("div");
-        glyph.className = "glyph";
-        button.appendChild(glyph);
-        var glyphShadow = document.createElement("div");
-        glyphShadow.className = "glyph shadow";
-        button.appendChild(glyphShadow);
-        return button;
-    },
-
     show: function()
     {
         WebInspector.View.prototype.show.call(this);
diff --git a/WebCore/inspector/front-end/Popup.js b/WebCore/inspector/front-end/Popup.js
new file mode 100644
index 0000000..9c8ef24
--- /dev/null
+++ b/WebCore/inspector/front-end/Popup.js
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * This class provides a popup that can be shown relative to an anchor element
+ * or at an arbitrary absolute position.
+ * Points are Objects: {x: xValue, y: yValue}.
+ * Rectangles are Objects: {x: xValue, y: yValue, width: widthValue, height: heightValue}.
+ *
+ * element is an optional unparented visible element (style.display != "none" AND style.visibility != "hidden").
+ * If the element is absent/undefined, it must have been set with the element(x) setter before the show() method invocation.
+ */
+WebInspector.Popup = function(element)
+{
+    if (element)
+        this.element = element;
+    this._keyHandler = this._keyEventHandler.bind(this);
+    this._mouseDownHandler = this._mouseDownEventHandler.bind(this);
+    this._visible = false;
+    this._autoHide = true;
+}
+
+WebInspector.Popup.prototype = {
+    show: function()
+    {
+        if (this.visible)
+            return;
+        var ownerDocument = this._contentElement.ownerDocument;
+        if (!ownerDocument)
+            return;
+
+        this._glasspaneElement = ownerDocument.createElement("div");
+        this._glasspaneElement.className = "popup-glasspane";
+        ownerDocument.body.appendChild(this._glasspaneElement);
+
+        this._contentElement.positionAt(0, 0);
+        this._contentElement.removeStyleClass("hidden");
+        ownerDocument.body.appendChild(this._contentElement);
+
+        this.positionElement();
+        this._visible = true;
+        ownerDocument.addEventListener("keydown", this._keyHandler, false);
+        ownerDocument.addEventListener("mousedown", this._mouseDownHandler, false);
+    },
+
+    hide: function()
+    {
+        if (this.visible) {
+            this._visible = false;
+            this._contentElement.ownerDocument.removeEventListener("keydown", this._keyHandler, false);
+            this._contentElement.ownerDocument.removeEventListener("mousedown", this._mouseDownHandler, false);
+            this._glasspaneElement.parentElement.removeChild(this._glasspaneElement);
+            this._contentElement.parentElement.removeChild(this._contentElement);
+        }
+    },
+
+    get visible()
+    {
+        return this._visible;
+    },
+
+    set element(x)
+    {
+        this._checkNotVisible();
+        this._contentElement = x;
+        this._contentElement.addStyleClass("hidden");
+    },
+
+    get element()
+    {
+        return this._contentElement;
+    },
+
+    positionElement: function()
+    {
+        var element = this._contentElement;
+        var anchorElement = this._anchorElement;
+
+        var targetDocument = element.ownerDocument;
+        var targetDocumentBody = targetDocument.body;
+        var targetDocumentElement = targetDocument.documentElement;
+        var clippingBox = {x: 0, y: 0, width: targetDocumentElement.clientWidth, height: targetDocumentElement.clientHeight};
+        var parentElement = element.offsetParent || element.parentElement;
+
+        var anchorPosition = {x: anchorElement.totalOffsetLeft, y: anchorElement.totalOffsetTop};
+
+        // FIXME(apavlov@chromium.org): Translate anchorPosition to the element.ownerDocument frame when https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed.
+        var anchorBox = {x: anchorPosition.x, y: anchorPosition.y, width: anchorElement.offsetWidth, height: anchorElement.offsetHeight};
+        var elementBox = {x: element.totalOffsetLeft, y: element.totalOffsetTop, width: element.offsetWidth, height: element.offsetHeight};
+        var newElementPosition = {x: 0, y: 0};
+
+        if (anchorBox.y - elementBox.height >= clippingBox.y)
+            newElementPosition.y = anchorBox.y - elementBox.height;
+        else
+            newElementPosition.y = Math.min(anchorBox.y + anchorBox.height, Math.max(clippingBox.y, clippingBox.y + clippingBox.height - elementBox.height));
+
+        if (anchorBox.x + elementBox.height <= clippingBox.x + clippingBox.height)
+            newElementPosition.x = anchorBox.x;
+        else
+            newElementPosition.x = Math.max(clippingBox.x, clippingBox.x + clippingBox.height - elementBox.height);
+        element.positionAt(newElementPosition.x, newElementPosition.y);
+    },
+
+    set anchor(x)
+    {
+        this._checkNotVisible();
+        this._anchorElement = x;
+    },
+
+    get anchor()
+    {
+        return this._anchorElement;
+    },
+
+    set autoHide(x)
+    {
+        this._autoHide = x;
+    },
+
+    _checkNotVisible: function()
+    {
+        if (this.visible)
+            throw new Error("The popup must not be visible.");
+    },
+
+    _keyEventHandler: function(event)
+    {
+        // Escape hides the popup.
+        if (event.keyIdentifier == "U+001B") {
+            this.hide();
+            event.preventDefault();
+            event.handled = true;
+        }
+    },
+
+    _mouseDownEventHandler: function(event)
+    {
+        if (this._autoHide && event.originalTarget === this._glasspaneElement)
+            this.hide();
+    }
+}
diff --git a/WebCore/inspector/front-end/ProfileDataGridTree.js b/WebCore/inspector/front-end/ProfileDataGridTree.js
index 84d9923..3fb0e00 100644
--- a/WebCore/inspector/front-end/ProfileDataGridTree.js
+++ b/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -50,7 +50,7 @@ WebInspector.ProfileDataGridNode.prototype = {
     {
         function formatMilliseconds(time)
         {
-            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), true);
+            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), !Preferences.samplingCPUProfiler);
         }
 
         var data = {};
@@ -153,8 +153,11 @@ WebInspector.ProfileDataGridNode.prototype = {
 
                 // If the grid node is collapsed, then don't sort children (save operation for later).
                 // If the grid node has the same sorting as previously, then there is no point in sorting it again.
-                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator)
+                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator) {
+                    if (gridNode.children.length)
+                        gridNode.shouldRefreshChildren = true;
                     continue;
+                }
 
                 gridNode.lastComparator = comparator;
 
diff --git a/WebCore/inspector/front-end/ProfileView.js b/WebCore/inspector/front-end/ProfileView.js
index 2517bd2..2b8c6ce 100644
--- a/WebCore/inspector/front-end/ProfileView.js
+++ b/WebCore/inspector/front-end/ProfileView.js
@@ -39,6 +39,11 @@ WebInspector.ProfileView = function(profile)
                     "calls": { title: WebInspector.UIString("Calls"), width: "54px", sortable: true },
                     "function": { title: WebInspector.UIString("Function"), disclosure: true, sortable: true } };
 
+    if (Preferences.samplingCPUProfiler) {
+        delete columns.average;
+        delete columns.calls;
+    }
+
     this.dataGrid = new WebInspector.DataGrid(columns);
     this.dataGrid.addEventListener("sorting changed", this._sortData, this);
     this.dataGrid.element.addEventListener("mousedown", this._mouseDownInDataGrid.bind(this), true);
@@ -56,25 +61,19 @@ WebInspector.ProfileView = function(profile)
     this.viewSelectElement.appendChild(heavyViewOption);
     this.viewSelectElement.appendChild(treeViewOption);
 
-    this.percentButton = document.createElement("button");
-    this.percentButton.className = "percent-time-status-bar-item status-bar-item";
+    this.percentButton = new WebInspector.StatusBarButton("", "percent-time-status-bar-item");
     this.percentButton.addEventListener("click", this._percentClicked.bind(this), false);
 
-    this.focusButton = document.createElement("button");
-    this.focusButton.title = WebInspector.UIString("Focus selected function.");
-    this.focusButton.className = "focus-profile-node-status-bar-item status-bar-item";
+    this.focusButton = new WebInspector.StatusBarButton(WebInspector.UIString("Focus selected function."), "focus-profile-node-status-bar-item");
     this.focusButton.disabled = true;
     this.focusButton.addEventListener("click", this._focusClicked.bind(this), false);
 
-    this.excludeButton = document.createElement("button");
-    this.excludeButton.title = WebInspector.UIString("Exclude selected function.");
-    this.excludeButton.className = "exclude-profile-node-status-bar-item status-bar-item";
+    this.excludeButton = new WebInspector.StatusBarButton(WebInspector.UIString("Exclude selected function."), "exclude-profile-node-status-bar-item");
     this.excludeButton.disabled = true;
     this.excludeButton.addEventListener("click", this._excludeClicked.bind(this), false);
 
-    this.resetButton = document.createElement("button");
-    this.resetButton.title = WebInspector.UIString("Restore all functions.");
-    this.resetButton.className = "reset-profile-status-bar-item status-bar-item hidden";
+    this.resetButton = new WebInspector.StatusBarButton(WebInspector.UIString("Restore all functions."), "reset-profile-status-bar-item");
+    this.resetButton.visible = false;
     this.resetButton.addEventListener("click", this._resetClicked.bind(this), false);
 
     this.profile = profile;
@@ -90,7 +89,7 @@ WebInspector.ProfileView = function(profile)
 WebInspector.ProfileView.prototype = {
     get statusBarItems()
     {
-        return [this.viewSelectElement, this.percentButton, this.focusButton, this.excludeButton, this.resetButton];
+        return [this.viewSelectElement, this.percentButton.element, this.focusButton.element, this.excludeButton.element, this.resetButton.element];
     },
 
     get profile()
@@ -439,10 +438,10 @@ WebInspector.ProfileView.prototype = {
     {
         if (this.showSelfTimeAsPercent && this.showTotalTimeAsPercent && this.showAverageTimeAsPercent) {
             this.percentButton.title = WebInspector.UIString("Show absolute total and self times.");
-            this.percentButton.addStyleClass("toggled-on");
+            this.percentButton.toggled = true;
         } else {
             this.percentButton.title = WebInspector.UIString("Show total and self times as percentages.");
-            this.percentButton.removeStyleClass("toggled-on");
+            this.percentButton.toggled = false;
         }
     },
 
@@ -451,7 +450,7 @@ WebInspector.ProfileView.prototype = {
         if (!this.dataGrid.selectedNode)
             return;
 
-        this.resetButton.removeStyleClass("hidden");
+        this.resetButton.visible = true;
         this.profileDataGridTree.focus(this.dataGrid.selectedNode);
         this.refresh();
         this.refreshVisibleData();
@@ -466,7 +465,7 @@ WebInspector.ProfileView.prototype = {
 
         selectedNode.deselect();
 
-        this.resetButton.removeStyleClass("hidden");
+        this.resetButton.visible = true;
         this.profileDataGridTree.exclude(selectedNode);
         this.refresh();
         this.refreshVisibleData();
@@ -474,7 +473,7 @@ WebInspector.ProfileView.prototype = {
 
     _resetClicked: function(event)
     {
-        this.resetButton.addStyleClass("hidden");
+        this.resetButton.visible = false;
         this.profileDataGridTree.restore();
         this.refresh();
         this.refreshVisibleData();
diff --git a/WebCore/inspector/front-end/ProfilesPanel.js b/WebCore/inspector/front-end/ProfilesPanel.js
index c8b948a..3bd4464 100644
--- a/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/WebCore/inspector/front-end/ProfilesPanel.js
@@ -55,22 +55,32 @@ WebInspector.ProfilesPanel = function()
 
     this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
 
+    this.profilesListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("CPU PROFILES"), null, true);
+    this.sidebarTree.appendChild(this.profilesListTreeElement);
+    this.profilesListTreeElement.expand();
+
+    this.snapshotsListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("HEAP SNAPSHOTS"), null, true);
+    if (Preferences.heapProfilerPresent) {
+        this.sidebarTree.appendChild(this.snapshotsListTreeElement);
+        this.snapshotsListTreeElement.expand();
+    }
+
     this.profileViews = document.createElement("div");
     this.profileViews.id = "profile-views";
     this.element.appendChild(this.profileViews);
 
-    this.enableToggleButton = this.createStatusBarButton();
-    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleProfiling.bind(this), false);
 
-    this.recordButton = this.createStatusBarButton();
-    this.recordButton.title = WebInspector.UIString("Start profiling.");
-    this.recordButton.id = "record-profile-status-bar-item";
-    this.recordButton.className = "status-bar-item";
+    this.recordButton = new WebInspector.StatusBarButton(WebInspector.UIString("Start profiling."), "record-profile-status-bar-item");
     this.recordButton.addEventListener("click", this._recordClicked.bind(this), false);
 
     this.recording = false;
 
+    this.snapshotButton = new WebInspector.StatusBarButton(WebInspector.UIString("Take heap snapshot."), "heap-snapshot-status-bar-item");
+    this.snapshotButton.visible = Preferences.heapProfilerPresent;
+    this.snapshotButton.addEventListener("click", this._snapshotClicked.bind(this), false);
+
     this.profileViewStatusBarItemsContainer = document.createElement("div");
     this.profileViewStatusBarItemsContainer.id = "profile-view-status-bar-items";
 
@@ -87,7 +97,7 @@ WebInspector.ProfilesPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton, this.recordButton, this.profileViewStatusBarItemsContainer];
+        return [this.enableToggleButton.element, this.recordButton.element, this.snapshotButton.element, this.profileViewStatusBarItemsContainer];
     },
 
     show: function()
@@ -137,7 +147,8 @@ WebInspector.ProfilesPanel.prototype = {
 
         this.sidebarTreeElement.removeStyleClass("some-expandable");
 
-        this.sidebarTree.removeChildren();
+        this.profilesListTreeElement.removeChildren();
+        this.snapshotsListTreeElement.removeChildren();
         this.profileViews.removeChildren();
 
         this.profileViewStatusBarItemsContainer.removeChildren();
@@ -155,7 +166,7 @@ WebInspector.ProfilesPanel.prototype = {
         this._profiles.push(profile);
         this._profilesIdMap[profile.uid] = profile;
 
-        var sidebarParent = this.sidebarTree;
+        var sidebarParent = this.profilesListTreeElement;
         var small = false;
         var alternateTitle;
 
@@ -317,10 +328,10 @@ WebInspector.ProfilesPanel.prototype = {
         this.recording = isProfiling;
 
         if (isProfiling) {
-            this.recordButton.addStyleClass("toggled-on");
+            this.recordButton.toggled = true;
             this.recordButton.title = WebInspector.UIString("Stop profiling.");
         } else {
-            this.recordButton.removeStyleClass("toggled-on");
+            this.recordButton.toggled = false;
             this.recordButton.title = WebInspector.UIString("Start profiling.");
         }
     },
@@ -336,14 +347,17 @@ WebInspector.ProfilesPanel.prototype = {
     {
         if (InspectorController.profilerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Profiling enabled. Click to disable.");
-            this.enableToggleButton.addStyleClass("toggled-on");
-            this.recordButton.removeStyleClass("hidden");
+            this.enableToggleButton.toggled = true;
+            this.recordButton.visible = true;
+            if (Preferences.heapProfilerPresent)
+                this.snapshotButton.visible = true;
             this.profileViewStatusBarItemsContainer.removeStyleClass("hidden");
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Profiling disabled. Click to enable.");
-            this.enableToggleButton.removeStyleClass("toggled-on");
-            this.recordButton.addStyleClass("hidden");
+            this.enableToggleButton.toggled = false;
+            this.recordButton.visible = false;
+            this.snapshotButton.visible = false;
             this.profileViewStatusBarItemsContainer.addStyleClass("hidden");
             this.panelEnablerView.visible = true;
         }
@@ -359,6 +373,11 @@ WebInspector.ProfilesPanel.prototype = {
             InspectorController.stopProfiling();
     },
 
+    _snapshotClicked: function()
+    {
+        InspectorController.takeHeapSnapshot();
+    },
+
     _enableProfiling: function()
     {
         if (InspectorController.profilerEnabled())
@@ -376,7 +395,10 @@ WebInspector.ProfilesPanel.prototype = {
 
     _populateProfiles: function()
     {
-        if (this.sidebarTree.children.length)
+        // FIXME: This code needs to be adjusted when more profiling types are added.
+        // Currently defaults to CPU profiles.
+        var cpuProfiles = this.sidebarTree.children[0];
+        if (cpuProfiles.children.length)
             return;
 
         var profiles = InspectorController.profiles();
@@ -386,8 +408,8 @@ WebInspector.ProfilesPanel.prototype = {
             this.addProfile(profile);
         }
 
-        if (this.sidebarTree.children[0])
-            this.sidebarTree.children[0].select();
+        if (cpuProfiles.children[0])
+            cpuProfiles.children[0].select();
 
         delete this._shouldPopulateProfiles;
     },
diff --git a/WebCore/inspector/front-end/PropertiesSidebarPane.js b/WebCore/inspector/front-end/PropertiesSidebarPane.js
index 2d32137..ec08210 100644
--- a/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -32,7 +32,7 @@ WebInspector.PropertiesSidebarPane = function()
 }
 
 WebInspector.PropertiesSidebarPane.prototype = {
-    update: function(object)
+    update: function(node)
     {
         var body = this.bodyElement;
 
@@ -40,7 +40,7 @@ WebInspector.PropertiesSidebarPane.prototype = {
 
         this.sections = [];
 
-        if (!object)
+        if (!node)
             return;
 
         var self = this;
@@ -51,13 +51,13 @@ WebInspector.PropertiesSidebarPane.prototype = {
 
             // Get array of prototype user-friendly names.
             for (var i = 0; i < prototypes.length; ++i) {
-                var prototype = new WebInspector.ObjectProxy(object, [], i);
+                var prototype = new WebInspector.ObjectProxy(node.id, [], i);
                 var section = new WebInspector.ObjectPropertiesSection(prototype, prototypes[i], WebInspector.UIString("Prototype"));
                 self.sections.push(section);
                 body.appendChild(section.element);
             }
         };
-        InspectorController.getPrototypes(object, callback);
+        InjectedScriptAccess.getPrototypes(node.id, callback);
     }
 }
 
diff --git a/WebCore/inspector/front-end/Resource.js b/WebCore/inspector/front-end/Resource.js
index bcb7b2a..56696e3 100644
--- a/WebCore/inspector/front-end/Resource.js
+++ b/WebCore/inspector/front-end/Resource.js
@@ -26,7 +26,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComponent, identifier, mainResource, cached)
+WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComponent, identifier, mainResource, cached, requestMethod, requestFormData)
 {
     this.identifier = identifier;
 
@@ -39,10 +39,70 @@ WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComp
     this.path = path;
     this.lastPathComponent = lastPathComponent;
     this.cached = cached;
+    this.requestMethod = requestMethod || "";
+    this.requestFormData = requestFormData || "";
 
     this.category = WebInspector.resourceCategories.other;
 }
 
+
+WebInspector.Resource.StatusText = {
+    100: "Continue",
+    101: "Switching Protocols",
+    102: "Processing (WebDav)",
+    200: "OK",
+    201: "Created",
+    202: "Accepted",
+    203: "Non-Authoritative Information",
+    204: "No Content",
+    205: "Reset Content",
+    206: "Partial Content",
+    207: "Multi-Status (WebDav)",
+    300: "Multiple Choices",
+    301: "Moved Permanently",
+    302: "Found",
+    303: "See Other",
+    304: "Not Modified",
+    305: "Use Proxy",
+    306: "Switch Proxy",
+    307: "Temporary",
+    400: "Bad Request",
+    401: "Unauthorized",
+    402: "Payment Required",
+    403: "Forbidden",
+    404: "Not Found",
+    405: "Method Not Allowed",
+    406: "Not Acceptable",
+    407: "Proxy Authentication Required",
+    408: "Request Timeout",
+    409: "Conflict",
+    410: "Gone",
+    411: "Length Required",
+    412: "Precondition Failed",
+    413: "Request Entity Too Large",
+    414: "Request-URI Too Long",
+    415: "Unsupported Media Type",
+    416: "Requested Range Not Satisfiable",
+    417: "Expectation Failed",
+    418: "I'm a teapot",
+    422: "Unprocessable Entity (WebDav)",
+    423: "Locked (WebDav)",
+    424: "Failed Dependency (WebDav)",
+    425: "Unordered Collection",
+    426: "Upgrade Required",
+    449: "Retry With",
+    500: "Internal Server Error",
+    501: "Not Implemented",
+    502: "Bad Gateway",
+    503: "Service Unavailable",
+    504: "Gateway Timeout",
+    505: "HTTP Version Not Supported",
+    506: "Variant Also Negotiates",
+    507: "Insufficient Storage (WebDav)",
+    509: "Bandwidth Limit Exceeded",
+    510: "Not Extended"
+};
+
 // Keep these in sync with WebCore::InspectorResource::Type
 WebInspector.Resource.Type = {
     Document:   0,
@@ -538,7 +598,6 @@ WebInspector.Resource.prototype = {
 
     _checkWarning: function(warning)
     {
-        var addWarning = false;
         var msg;
         switch (warning.id) {
             case WebInspector.Warnings.IncorrectMIMEType.id:
@@ -619,3 +678,8 @@ WebInspector.Resource.CompareBySize = function(a, b)
         return 1;
     return 0;
 }
+
+WebInspector.Resource.StatusTextForCode = function(code)
+{
+    return code ? code + " " + WebInspector.Resource.StatusText[code] : "";
+}
diff --git a/WebCore/inspector/front-end/ResourceView.js b/WebCore/inspector/front-end/ResourceView.js
index b480362..28586f6 100644
--- a/WebCore/inspector/front-end/ResourceView.js
+++ b/WebCore/inspector/front-end/ResourceView.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) IBM Corp. 2009  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -53,11 +54,37 @@ WebInspector.ResourceView = function(resource)
     this.urlTreeElement.selectable = false;
     this.headersTreeOutline.appendChild(this.urlTreeElement);
 
+    this.httpInformationTreeElement = new TreeElement("", null, true);
+    this.httpInformationTreeElement.expanded = false;
+    this.httpInformationTreeElement.selectable = false;
+    this.headersTreeOutline.appendChild(this.httpInformationTreeElement);
+     
     this.requestHeadersTreeElement = new TreeElement("", null, true);
     this.requestHeadersTreeElement.expanded = false;
     this.requestHeadersTreeElement.selectable = false;
     this.headersTreeOutline.appendChild(this.requestHeadersTreeElement);
 
+    this._decodeHover = WebInspector.UIString("Double-Click to toggle between URL encoded and decoded formats");
+    this._decodeRequestParameters = true;
+
+    this.queryStringTreeElement = new TreeElement("", null, true);
+    this.queryStringTreeElement.expanded = false;
+    this.queryStringTreeElement.selectable = false;
+    this.queryStringTreeElement.hidden = true;
+    this.headersTreeOutline.appendChild(this.queryStringTreeElement);
+
+    this.formDataTreeElement = new TreeElement("", null, true);
+    this.formDataTreeElement.expanded = false;
+    this.formDataTreeElement.selectable = false;
+    this.formDataTreeElement.hidden = true;
+    this.headersTreeOutline.appendChild(this.formDataTreeElement);
+
+    this.requestPayloadTreeElement = new TreeElement(WebInspector.UIString("Request Payload"), null, true);
+    this.requestPayloadTreeElement.expanded = false;
+    this.requestPayloadTreeElement.selectable = false;
+    this.requestPayloadTreeElement.hidden = true;
+    this.headersTreeOutline.appendChild(this.requestPayloadTreeElement);
+
     this.responseHeadersTreeElement = new TreeElement("", null, true);
     this.responseHeadersTreeElement.expanded = false;
     this.responseHeadersTreeElement.selectable = false;
@@ -68,10 +95,12 @@ WebInspector.ResourceView = function(resource)
     resource.addEventListener("url changed", this._refreshURL, this);
     resource.addEventListener("requestHeaders changed", this._refreshRequestHeaders, this);
     resource.addEventListener("responseHeaders changed", this._refreshResponseHeaders, this);
+    resource.addEventListener("finished", this._refreshHTTPInformation, this);
 
     this._refreshURL();
     this._refreshRequestHeaders();
     this._refreshResponseHeaders();
+    this._refreshHTTPInformation();
 }
 
 WebInspector.ResourceView.prototype = {
@@ -104,12 +133,141 @@ WebInspector.ResourceView.prototype = {
 
     _refreshURL: function()
     {
-        this.urlTreeElement.title = this.resource.url.escapeHTML();
+        var url = this.resource.url;
+        var statusCodeImage = "";
+        if (this.resource.statusCode) {
+            var statusImageSource = "";
+            
+            if (this.resource.statusCode < 300)
+                statusImageSource = "Images/successGreenDot.png";
+            else if (this.resource.statusCode < 400)
+                statusImageSource = "Images/warningOrangeDot.png";
+            else
+                statusImageSource = "Images/errorRedDot.png";
+        
+            statusCodeImage = "<img class=\"resource-status-image\" src=\"" + statusImageSource + "\" title=\"" + WebInspector.Resource.StatusTextForCode(this.resource.statusCode) + "\">";
+        }
+
+        this.urlTreeElement.title = statusCodeImage + "<span class=\"resource-url\">" + url.escapeHTML() + "</span>";
+        this._refreshQueryString();
+    },
+
+    _refreshQueryString: function()
+    {
+        var url = this.resource.url;
+        var hasQueryString = url.indexOf("?") >= 0;
+
+        if (!hasQueryString) {
+            this.queryStringTreeElement.hidden = true;
+            return;
+        }
+
+        this.queryStringTreeElement.hidden = false;
+        var parmString = url.split("?", 2)[1];
+        this._refreshParms(WebInspector.UIString("Query String Parameters"), parmString, this.queryStringTreeElement);
+    },
+
+    _refreshFormData: function()
+    {
+        this.formDataTreeElement.hidden = true;
+        this.requestPayloadTreeElement.hidden = true;
+
+        var isFormData = this.resource.requestFormData;
+        if (!isFormData)
+            return;
+
+        var isFormEncoded = false;
+        var requestContentType = this._getHeaderValue(this.resource.requestHeaders, "Content-Type");
+        if (requestContentType.match(/^application\/x-www-form-urlencoded\s*(;.*)?$/i))
+            isFormEncoded = true;
+
+        if (isFormEncoded) {
+            this.formDataTreeElement.hidden = false;
+            this._refreshParms(WebInspector.UIString("Form Data"), this.resource.requestFormData, this.formDataTreeElement);
+        } else {
+            this.requestPayloadTreeElement.hidden = false;
+            this._refreshRequestPayload(this.resource.requestFormData);
+        }
+    },
+
+    _refreshRequestPayload: function(formData)
+    {
+        this.requestPayloadTreeElement.removeChildren();
+
+        var title = "<div class=\"header-name\">&nbsp;</div>";
+        title += "<div class=\"raw-form-data header-value\">" + formData.escapeHTML() + "</div>";
+        var parmTreeElement = new TreeElement(title, null, false);
+        parmTreeElement.selectable = false;
+        this.requestPayloadTreeElement.appendChild(parmTreeElement);
+    },
+
+    _refreshParms: function(title, parmString, parmsTreeElement)
+    {
+        var parms = parmString.split("&");
+        for (var i = 0; i < parms.length; ++i) {
+            var parm = parms[i];
+            parm = parm.split("=", 2);
+            if (parm.length == 1)
+                parm.push("");
+            parms[i] = parm;
+        }
+
+        parmsTreeElement.removeChildren();
+
+        parmsTreeElement.title = title + "<span class=\"header-count\">" + WebInspector.UIString(" (%d)", parms.length) + "</span>";
+
+        for (var i = 0; i < parms.length; ++i) {
+            var key = parms[i][0];
+            var value = parms[i][1];
+
+            var errorDecoding = false;
+            if (this._decodeRequestParameters) {
+                if (value.indexOf("%") >= 0) {
+                    try {
+                        value = decodeURIComponent(value);
+                    } catch(e) {
+                        errorDecoding = true;
+                    }
+                }
+                    
+                value = value.replace(/\+/g, " ");
+            }
+
+            valueEscaped = value.escapeHTML();
+            if (errorDecoding)
+                valueEscaped += " <span class=\"error-message\">" + WebInspector.UIString("(unable to decode value)").escapeHTML() + "</span>";
+
+            var title = "<div class=\"header-name\">" + key.escapeHTML() + ":</div>";
+            title += "<div class=\"header-value\">" + valueEscaped + "</div>";
+
+            var parmTreeElement = new TreeElement(title, null, false);
+            parmTreeElement.selectable = false;
+            parmTreeElement.tooltip = this._decodeHover;
+            parmTreeElement.ondblclick = this._toggleURLdecoding.bind(this);
+            parmsTreeElement.appendChild(parmTreeElement);
+        }
+    },
+
+    _toggleURLdecoding: function(treeElement, event)
+    {
+        this._decodeRequestParameters = !this._decodeRequestParameters;
+        this._refreshQueryString();
+        this._refreshFormData();
+    },
+
+    _getHeaderValue: function(headers, key)
+    {
+        var lowerKey = key.toLowerCase();
+        for (var testKey in headers) {
+            if (testKey.toLowerCase() === lowerKey)
+                return headers[testKey];
+        }
     },
 
     _refreshRequestHeaders: function()
     {
         this._refreshHeaders(WebInspector.UIString("Request Headers"), this.resource.sortedRequestHeaders, this.requestHeadersTreeElement);
+        this._refreshFormData();
     },
 
     _refreshResponseHeaders: function()
@@ -117,6 +275,33 @@ WebInspector.ResourceView.prototype = {
         this._refreshHeaders(WebInspector.UIString("Response Headers"), this.resource.sortedResponseHeaders, this.responseHeadersTreeElement);
     },
 
+    _refreshHTTPInformation: function()
+    {
+        const listElements = 2;
+
+        var headerElement = this.httpInformationTreeElement;
+        headerElement.removeChildren();
+        headerElement.hidden = !this.resource.statusCode;
+
+        if (this.resource.statusCode) {
+            headerElement.title = WebInspector.UIString("HTTP Information") +  "<span class=\"header-count\">" + WebInspector.UIString(" (%d)", listElements) + "</span>";
+        
+            var title = "<div class=\"header-name\">" + WebInspector.UIString("Request Method") + ":</div>";
+            title += "<div class=\"header-value\">" + this.resource.requestMethod + "</div>"
+            
+            var headerTreeElement = new TreeElement(title, null, false);
+            headerTreeElement.selectable = false;
+            headerElement.appendChild(headerTreeElement);
+            
+            title = "<div class=\"header-name\">" + WebInspector.UIString("Status Code") + ":</div>";
+            title += "<div class=\"header-value\">" + WebInspector.Resource.StatusTextForCode(this.resource.statusCode) + "</div>"
+            
+            headerTreeElement = new TreeElement(title, null, false);
+            headerTreeElement.selectable = false;
+            headerElement.appendChild(headerTreeElement);
+        }
+    },
+    
     _refreshHeaders: function(title, headers, headersTreeElement)
     {
         headersTreeElement.removeChildren();
diff --git a/WebCore/inspector/front-end/ResourcesPanel.js b/WebCore/inspector/front-end/ResourcesPanel.js
index fb43551..b575fc3 100644
--- a/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/WebCore/inspector/front-end/ResourcesPanel.js
@@ -60,9 +60,9 @@ WebInspector.ResourcesPanel = function()
     this.containerContentElement.id = "resources-container-content";
     this.containerElement.appendChild(this.containerContentElement);
 
-    this.summaryElement = document.createElement("div");
-    this.summaryElement.id = "resources-summary";
-    this.containerContentElement.appendChild(this.summaryElement);
+    this.summaryBar = new WebInspector.SummaryBar(this.categories);
+    this.summaryBar.element.id = "resources-summary";
+    this.containerContentElement.appendChild(this.summaryBar.element);
 
     this.resourcesGraphsElement = document.createElement("div");
     this.resourcesGraphsElement.id = "resources-graphs";
@@ -76,16 +76,6 @@ WebInspector.ResourcesPanel = function()
     this.dividersLabelBarElement.id = "resources-dividers-label-bar";
     this.containerContentElement.appendChild(this.dividersLabelBarElement);
 
-    this.summaryGraphElement = document.createElement("canvas");
-    this.summaryGraphElement.setAttribute("width", "450");
-    this.summaryGraphElement.setAttribute("height", "38");
-    this.summaryGraphElement.id = "resources-summary-graph";
-    this.summaryElement.appendChild(this.summaryGraphElement);
-
-    this.legendElement = document.createElement("div");
-    this.legendElement.id = "resources-graph-legend";
-    this.summaryElement.appendChild(this.legendElement);
-
     this.sidebarTreeElement = document.createElement("ol");
     this.sidebarTreeElement.className = "sidebar-tree";
     this.sidebarElement.appendChild(this.sidebarTreeElement);
@@ -139,15 +129,16 @@ WebInspector.ResourcesPanel = function()
 
     this.element.appendChild(this.panelEnablerView.element);
 
-    this.enableToggleButton = this.createStatusBarButton();
-    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
 
-    this.largerResourcesButton = this.createStatusBarButton();
-    this.largerResourcesButton.id = "resources-larger-resources-status-bar-item";
-    this.largerResourcesButton.className = "status-bar-item toggled-on";
-    this.largerResourcesButton.title = WebInspector.UIString("Use small resource rows.");
+    this.largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "resources-larger-resources-status-bar-item");
+    this.largerResourcesButton.toggled = Preferences.resourcesLargeRows;
     this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
+    if (!Preferences.resourcesLargeRows) {
+        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
+        this._toggleLargerResources(); // this will toggle the preference back to the original
+    }
 
     this.sortingSelectElement = document.createElement("select");
     this.sortingSelectElement.className = "status-bar-item";
@@ -168,8 +159,8 @@ WebInspector.ResourcesPanel = function()
 
     var allElement = createFilterElement.call(this, "all");
     this.filter(allElement.category);
-    for (var i = 0; i < this.categoryOrder.length; i++)
-        createFilterElement.call(this, this.categoryOrder[i]);
+    for (var category in this.categories)
+        createFilterElement.call(this, category);
 
     this.reset();
 
@@ -179,7 +170,16 @@ WebInspector.ResourcesPanel = function()
 WebInspector.ResourcesPanel.prototype = {
     toolbarItemClass: "resources",
 
-    categoryOrder: ["documents", "stylesheets", "images", "scripts", "xhr", "fonts", "other"],
+    get categories()
+    {
+        if (!this._categories) {
+            this._categories = {documents: {color: {r: 47, g: 102, b: 236}}, stylesheets: {color: {r: 157, g: 231, b: 119}}, images: {color: {r: 164, g: 60, b: 255}}, scripts: {color: {r: 255, g: 121, b: 0}}, xhr: {color: {r: 231, g: 231, b: 10}}, fonts: {color: {r: 255, g: 82, b: 62}}, other: {color: {r: 186, g: 186, b: 186}}};
+            for (var category in this._categories) {
+                this._categories[category].title = WebInspector.resourceCategories[category].title;
+            }
+        }
+        return this._categories; 
+    },
 
     filter: function (category) {
         if (this._filterCategory && this._filterCategory === category)
@@ -208,10 +208,41 @@ WebInspector.ResourcesPanel.prototype = {
     {
         return WebInspector.UIString("Resources");
     },
+    
+    get mainResourceLoadTime()
+    {
+        return this._mainResourceLoadTime || -1;
+    },
+    
+    set mainResourceLoadTime(x)
+    {
+        if (this._mainResourceLoadTime === x)
+            return;
+        
+        this._mainResourceLoadTime = x;
+        
+        // Update the dividers to draw the new line
+        this._updateGraphDividersIfNeeded(true);
+    },
+    
+    get mainResourceDOMContentTime()
+    {
+        return this._mainResourceDOMContentTime || -1;
+    },
+    
+    set mainResourceDOMContentTime(x)
+    {
+        if (this._mainResourceDOMContentTime === x)
+            return;
+        
+        this._mainResourceDOMContentTime = x;
+        
+        this._updateGraphDividersIfNeeded(true);
+    },
 
     get statusBarItems()
     {
-        return [this.enableToggleButton, this.largerResourcesButton, this.sortingSelectElement];
+        return [this.enableToggleButton.element, this.largerResourcesButton.element, this.sortingSelectElement];
     },
 
     show: function()
@@ -455,26 +486,27 @@ WebInspector.ResourcesPanel.prototype = {
 
         this._resources = [];
         this._staleResources = [];
+        
+        this.mainResourceLoadTime = -1;
+        this.mainResourceDOMContentTime = -1;
 
         this.resourcesTreeElement.removeChildren();
         this.viewsContainerElement.removeChildren();
         this.resourcesGraphsElement.removeChildren();
-        this.legendElement.removeChildren();
+        this.summaryBar.reset();
 
         this._updateGraphDividersIfNeeded(true);
 
-        this._drawSummaryGraph(); // draws an empty graph
-
         if (InspectorController.resourceTrackingEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
-            this.enableToggleButton.addStyleClass("toggled-on");
-            this.largerResourcesButton.removeStyleClass("hidden");
+            this.enableToggleButton.toggled = true;
+            this.largerResourcesButton.visible = true;
             this.sortingSelectElement.removeStyleClass("hidden");
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking disabled. Click to enable.");
-            this.enableToggleButton.removeStyleClass("toggled-on");
-            this.largerResourcesButton.addStyleClass("hidden");
+            this.enableToggleButton.toggled = false;
+            this.largerResourcesButton.visible = false;
             this.sortingSelectElement.addStyleClass("hidden");
             this.panelEnablerView.visible = true;
         }
@@ -665,40 +697,6 @@ WebInspector.ResourcesPanel.prototype = {
         this.sidebarTree.handleKeyEvent(event);
     },
 
-    _makeLegendElement: function(label, value, color)
-    {
-        var legendElement = document.createElement("label");
-        legendElement.className = "resources-graph-legend-item";
-
-        if (color) {
-            var swatch = document.createElement("canvas");
-            swatch.className = "resources-graph-legend-swatch";
-            swatch.setAttribute("width", "13");
-            swatch.setAttribute("height", "24");
-
-            legendElement.appendChild(swatch);
-
-            this._drawSwatch(swatch, color);
-        }
-
-        var labelElement = document.createElement("div");
-        labelElement.className = "resources-graph-legend-label";
-        legendElement.appendChild(labelElement);
-
-        var headerElement = document.createElement("div");
-        var headerElement = document.createElement("div");
-        headerElement.className = "resources-graph-legend-header";
-        headerElement.textContent = label;
-        labelElement.appendChild(headerElement);
-
-        var valueElement = document.createElement("div");
-        valueElement.className = "resources-graph-legend-value";
-        valueElement.textContent = value;
-        labelElement.appendChild(valueElement);
-
-        return legendElement;
-    },
-
     _sortResourcesIfNeeded: function()
     {
         var sortedElements = [].concat(this.resourcesTreeElement.children);
@@ -761,283 +759,42 @@ WebInspector.ResourcesPanel.prototype = {
 
             this.dividersLabelBarElement.appendChild(divider);
         }
-    },
-
-    _fadeOutRect: function(ctx, x, y, w, h, a1, a2)
-    {
-        ctx.save();
-
-        var gradient = ctx.createLinearGradient(x, y, x, y + h);
-        gradient.addColorStop(0.0, "rgba(0, 0, 0, " + (1.0 - a1) + ")");
-        gradient.addColorStop(0.8, "rgba(0, 0, 0, " + (1.0 - a2) + ")");
-        gradient.addColorStop(1.0, "rgba(0, 0, 0, 1.0)");
-
-        ctx.globalCompositeOperation = "destination-out";
-
-        ctx.fillStyle = gradient;
-        ctx.fillRect(x, y, w, h);
-
-        ctx.restore();
-    },
-
-    _drawSwatch: function(canvas, color)
-    {
-        var ctx = canvas.getContext("2d");
-
-        function drawSwatchSquare() {
-            ctx.fillStyle = color;
-            ctx.fillRect(0, 0, 13, 13);
 
-            var gradient = ctx.createLinearGradient(0, 0, 13, 13);
-            gradient.addColorStop(0.0, "rgba(255, 255, 255, 0.2)");
-            gradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
-
-            ctx.fillStyle = gradient;
-            ctx.fillRect(0, 0, 13, 13);
-
-            gradient = ctx.createLinearGradient(13, 13, 0, 0);
-            gradient.addColorStop(0.0, "rgba(0, 0, 0, 0.2)");
-            gradient.addColorStop(1.0, "rgba(0, 0, 0, 0.0)");
-
-            ctx.fillStyle = gradient;
-            ctx.fillRect(0, 0, 13, 13);
-
-            ctx.strokeStyle = "rgba(0, 0, 0, 0.6)";
-            ctx.strokeRect(0.5, 0.5, 12, 12);
-        }
-
-        ctx.clearRect(0, 0, 13, 24);
-
-        drawSwatchSquare();
-
-        ctx.save();
-
-        ctx.translate(0, 25);
-        ctx.scale(1, -1);
-
-        drawSwatchSquare();
-
-        ctx.restore();
-
-        this._fadeOutRect(ctx, 0, 13, 13, 13, 0.5, 0.0);
-    },
-
-    _drawSummaryGraph: function(segments)
-    {
-        if (!this.summaryGraphElement)
+        if (this.calculator.startAtZero) {
+            // If our current sorting method starts at zero, that means it shows all
+            // resources starting at the same point, and so onLoad event and DOMContent
+            // event lines really wouldn't make much sense here, so don't render them.
             return;
-
-        if (!segments || !segments.length) {
-            segments = [{color: "white", value: 1}];
-            this._showingEmptySummaryGraph = true;
-        } else
-            delete this._showingEmptySummaryGraph;
-
-        // Calculate the total of all segments.
-        var total = 0;
-        for (var i = 0; i < segments.length; ++i)
-            total += segments[i].value;
-
-        // Calculate the percentage of each segment, rounded to the nearest percent.
-        var percents = segments.map(function(s) { return Math.max(Math.round(100 * s.value / total), 1) });
-
-        // Calculate the total percentage.
-        var percentTotal = 0;
-        for (var i = 0; i < percents.length; ++i)
-            percentTotal += percents[i];
-
-        // Make sure our percentage total is not greater-than 100, it can be greater
-        // if we rounded up for a few segments.
-        while (percentTotal > 100) {
-            for (var i = 0; i < percents.length && percentTotal > 100; ++i) {
-                if (percents[i] > 1) {
-                    --percents[i];
-                    --percentTotal;
-                }
-            }
         }
 
-        // Make sure our percentage total is not less-than 100, it can be less
-        // if we rounded down for a few segments.
-        while (percentTotal < 100) {
-            for (var i = 0; i < percents.length && percentTotal < 100; ++i) {
-                ++percents[i];
-                ++percentTotal;
-            }
+        if (this.mainResourceLoadTime !== -1) {
+            var percent = this.calculator.computePercentageFromEventTime(this.mainResourceLoadTime);
+            var loadDivider = document.createElement("div");
+            loadDivider.className = "resources-onload-divider";
+            loadDivider.style.left = percent + "%";
+            loadDivider.title = WebInspector.UIString("Load event fired");
+            this.dividersElement.appendChild(loadDivider);
         }
-
-        var ctx = this.summaryGraphElement.getContext("2d");
-
-        var x = 0;
-        var y = 0;
-        var w = 450;
-        var h = 19;
-        var r = (h / 2);
-
-        function drawPillShadow()
-        {
-            // This draws a line with a shadow that is offset away from the line. The line is stroked
-            // twice with different X shadow offsets to give more feathered edges. Later we erase the
-            // line with destination-out 100% transparent black, leaving only the shadow. This only
-            // works if nothing has been drawn into the canvas yet.
-
-            ctx.beginPath();
-            ctx.moveTo(x + 4, y + h - 3 - 0.5);
-            ctx.lineTo(x + w - 4, y + h - 3 - 0.5);
-            ctx.closePath();
-
-            ctx.save();
-
-            ctx.shadowBlur = 2;
-            ctx.shadowColor = "rgba(0, 0, 0, 0.5)";
-            ctx.shadowOffsetX = 3;
-            ctx.shadowOffsetY = 5;
-
-            ctx.strokeStyle = "white";
-            ctx.lineWidth = 1;
-
-            ctx.stroke();
-
-            ctx.shadowOffsetX = -3;
-
-            ctx.stroke();
-
-            ctx.restore();
-
-            ctx.save();
-
-            ctx.globalCompositeOperation = "destination-out";
-            ctx.strokeStyle = "rgba(0, 0, 0, 1)";
-            ctx.lineWidth = 1;
-
-            ctx.stroke();
-
-            ctx.restore();
-        }
-
-        function drawPill()
-        {
-            // Make a rounded rect path.
-            ctx.beginPath();
-            ctx.moveTo(x, y + r);
-            ctx.lineTo(x, y + h - r);
-            ctx.quadraticCurveTo(x, y + h, x + r, y + h);
-            ctx.lineTo(x + w - r, y + h);
-            ctx.quadraticCurveTo(x + w, y + h, x + w, y + h - r);
-            ctx.lineTo(x + w, y + r);
-            ctx.quadraticCurveTo(x + w, y, x + w - r, y);
-            ctx.lineTo(x + r, y);
-            ctx.quadraticCurveTo(x, y, x, y + r);
-            ctx.closePath();
-
-            // Clip to the rounded rect path.
-            ctx.save();
-            ctx.clip();
-
-            // Fill the segments with the associated color.
-            var previousSegmentsWidth = 0;
-            for (var i = 0; i < segments.length; ++i) {
-                var segmentWidth = Math.round(w * percents[i] / 100);
-                ctx.fillStyle = segments[i].color;
-                ctx.fillRect(x + previousSegmentsWidth, y, segmentWidth, h);
-                previousSegmentsWidth += segmentWidth;
-            }
-
-            // Draw the segment divider lines.
-            ctx.lineWidth = 1;
-            for (var i = 1; i < 20; ++i) {
-                ctx.beginPath();
-                ctx.moveTo(x + (i * Math.round(w / 20)) + 0.5, y);
-                ctx.lineTo(x + (i * Math.round(w / 20)) + 0.5, y + h);
-                ctx.closePath();
-
-                ctx.strokeStyle = "rgba(0, 0, 0, 0.2)";
-                ctx.stroke();
-
-                ctx.beginPath();
-                ctx.moveTo(x + (i * Math.round(w / 20)) + 1.5, y);
-                ctx.lineTo(x + (i * Math.round(w / 20)) + 1.5, y + h);
-                ctx.closePath();
-
-                ctx.strokeStyle = "rgba(255, 255, 255, 0.2)";
-                ctx.stroke();
-            }
-
-            // Draw the pill shading.
-            var lightGradient = ctx.createLinearGradient(x, y, x, y + (h / 1.5));
-            lightGradient.addColorStop(0.0, "rgba(220, 220, 220, 0.6)");
-            lightGradient.addColorStop(0.4, "rgba(220, 220, 220, 0.2)");
-            lightGradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
-
-            var darkGradient = ctx.createLinearGradient(x, y + (h / 3), x, y + h);
-            darkGradient.addColorStop(0.0, "rgba(0, 0, 0, 0.0)");
-            darkGradient.addColorStop(0.8, "rgba(0, 0, 0, 0.2)");
-            darkGradient.addColorStop(1.0, "rgba(0, 0, 0, 0.5)");
-
-            ctx.fillStyle = darkGradient;
-            ctx.fillRect(x, y, w, h);
-
-            ctx.fillStyle = lightGradient;
-            ctx.fillRect(x, y, w, h);
-
-            ctx.restore();
+        
+        if (this.mainResourceDOMContentTime !== -1) {
+            var percent = this.calculator.computePercentageFromEventTime(this.mainResourceDOMContentTime);
+            var domContentDivider = document.createElement("div");
+            domContentDivider.className = "resources-ondomcontent-divider";
+            domContentDivider.title = WebInspector.UIString("DOMContent event fired");
+            domContentDivider.style.left = percent + "%";
+            this.dividersElement.appendChild(domContentDivider);
         }
-
-        ctx.clearRect(x, y, w, (h * 2));
-
-        drawPillShadow();
-        drawPill();
-
-        ctx.save();
-
-        ctx.translate(0, (h * 2) + 1);
-        ctx.scale(1, -1);
-
-        drawPill();
-
-        ctx.restore();
-
-        this._fadeOutRect(ctx, x, y + h + 1, w, h, 0.5, 0.0);
     },
 
     _updateSummaryGraph: function()
     {
-        var graphInfo = this.calculator.computeSummaryValues(this._resources);
-
-        var categoryColors = {documents: {r: 47, g: 102, b: 236}, stylesheets: {r: 157, g: 231, b: 119}, images: {r: 164, g: 60, b: 255}, scripts: {r: 255, g: 121, b: 0}, xhr: {r: 231, g: 231, b: 10}, fonts: {r: 255, g: 82, b: 62}, other: {r: 186, g: 186, b: 186}};
-        var fillSegments = [];
-
-        this.legendElement.removeChildren();
-
-        for (var i = 0; i < this.categoryOrder.length; ++i) {
-            var category = this.categoryOrder[i];
-            var size = graphInfo.categoryValues[category];
-            if (!size)
-                continue;
-
-            var color = categoryColors[category];
-            var colorString = "rgb(" + color.r + ", " + color.g + ", " + color.b + ")";
-
-            var fillSegment = {color: colorString, value: size};
-            fillSegments.push(fillSegment);
-
-            var legendLabel = this._makeLegendElement(WebInspector.resourceCategories[category].title, this.calculator.formatValue(size), colorString);
-            this.legendElement.appendChild(legendLabel);
-        }
-
-        if (graphInfo.total) {
-            var totalLegendLabel = this._makeLegendElement(WebInspector.UIString("Total"), this.calculator.formatValue(graphInfo.total));
-            totalLegendLabel.addStyleClass("total");
-            this.legendElement.appendChild(totalLegendLabel);
-        }
-
-        this._drawSummaryGraph(fillSegments);
+        this.summaryBar.update(this._resources);
     },
 
     _updateDividersLabelBarPosition: function()
     {
         var scrollTop = this.containerElement.scrollTop;
-        var dividersTop = (scrollTop < this.summaryElement.offsetHeight ? this.summaryElement.offsetHeight : scrollTop);
+        var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
         this.dividersElement.style.top = scrollTop + "px";
         this.dividersLabelBarElement.style.top = dividersTop + "px";
     },
@@ -1072,16 +829,18 @@ WebInspector.ResourcesPanel.prototype = {
             return;
 
         this.resourcesTreeElement.smallChildren = !this.resourcesTreeElement.smallChildren;
+        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
+        InspectorController.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
 
         if (this.resourcesTreeElement.smallChildren) {
             this.resourcesGraphsElement.addStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use large resource rows.");
-            this.largerResourcesButton.removeStyleClass("toggled-on");
+            this.largerResourcesButton.toggled = false;
             this._adjustScrollPosition();
         } else {
             this.resourcesGraphsElement.removeStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use small resource rows.");
-            this.largerResourcesButton.addStyleClass("toggled-on");
+            this.largerResourcesButton.toggled = true;
         }
     },
 
@@ -1096,7 +855,7 @@ WebInspector.ResourcesPanel.prototype = {
     {
         var selectedOption = this.sortingSelectElement[this.sortingSelectElement.selectedIndex];
         this.sortingFunction = selectedOption.sortingFunction;
-        this.calculator = selectedOption.calculator;
+        this.calculator = this.summaryBar.calculator = selectedOption.calculator;
     },
 
     _createResourceView: function(resource)
@@ -1354,6 +1113,17 @@ WebInspector.ResourceTimeCalculator.prototype = {
 
         return {start: start, middle: middle, end: end};
     },
+    
+    computePercentageFromEventTime: function(eventTime)
+    {
+        // This function computes a percentage in terms of the total loading time
+        // of a specific event. If startAtZero is set, then this is useless, and we
+        // want to return 0.
+        if (eventTime !== -1 && !this.startAtZero)
+            return ((eventTime - this.minimumBoundary) / this.boundarySpan) * 100;
+
+        return 0;
+    },
 
     computeBarGraphLabels: function(resource)
     {
@@ -1515,7 +1285,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
     
     ondblclick: function(treeElement, event)
     {
-        InspectorController.inspectedWindow().open(this.resource.url);
+        InjectedScriptAccess.openInInspectedWindow(this.resource.url, function() {});
     },
 
     get mainTitle()
@@ -1546,6 +1316,11 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         // Do nothing.
     },
 
+    get selectable()
+    {
+        return WebInspector.panels.resources._filterCategory == "all" || WebInspector.panels.resources._filterCategory == this.resource.category.name;
+    },
+
     createIconElement: function()
     {
         var previousIconElement = this.iconElement;
diff --git a/WebCore/inspector/front-end/ScopeChainSidebarPane.js b/WebCore/inspector/front-end/ScopeChainSidebarPane.js
index a293fa0..fdfcd38 100644
--- a/WebCore/inspector/front-end/ScopeChainSidebarPane.js
+++ b/WebCore/inspector/front-end/ScopeChainSidebarPane.js
@@ -26,6 +26,7 @@
 WebInspector.ScopeChainSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Scope Variables"));
+    this._expandedProperties = [];
 }
 
 WebInspector.ScopeChainSidebarPane.prototype = {
@@ -44,52 +45,43 @@ WebInspector.ScopeChainSidebarPane.prototype = {
             return;
         }
 
-        if (!callFrame._expandedProperties) {
-            // FIXME: fix this when https://bugs.webkit.org/show_bug.cgi?id=19410 is fixed.
-            // The callFrame is a JSInspectedObjectWrapper, so we are not allowed to assign
-            // an object created in the Inspector's context to that object. So create an
-            // Object from the inspectedWindow.
-            var inspectedWindow = InspectorController.inspectedWindow();
-            callFrame._expandedProperties = new inspectedWindow.Object;
-        }
-
         var foundLocalScope = false;
         var scopeChain = callFrame.scopeChain;
         for (var i = 0; i < scopeChain.length; ++i) {
-            var scopeObject = scopeChain[i];
+            var scopeObjectProxy = scopeChain[i];
             var title = null;
-            var subtitle = Object.describe(scopeObject, true);
+            var subtitle = scopeObjectProxy.description;
             var emptyPlaceholder = null;
-            var localScope = false;
             var extraProperties = null;
 
-            if (Object.prototype.toString.call(scopeObject) === "[object JSActivation]") {
-                if (!foundLocalScope) {
-                    extraProperties = { "this": callFrame.thisObject };
-                    title = WebInspector.UIString("Local");
-                } else
-                    title = WebInspector.UIString("Closure");
+            if (scopeObjectProxy.isLocal) {
+                foundLocalScope = true;
+                title = WebInspector.UIString("Local");
+                emptyPlaceholder = WebInspector.UIString("No Variables");
+                subtitle = null;
+                if (scopeObjectProxy.thisObject)
+                    extraProperties = [ new WebInspector.ObjectPropertyProxy("this", scopeObjectProxy.thisObject) ];
+            } else if (scopeObjectProxy.isClosure) {
+                title = WebInspector.UIString("Closure");
                 emptyPlaceholder = WebInspector.UIString("No Variables");
                 subtitle = null;
-                foundLocalScope = true;
-                localScope = true;
             } else if (i === (scopeChain.length - 1))
                 title = WebInspector.UIString("Global");
-            else if (foundLocalScope && scopeObject instanceof InspectorController.inspectedWindow().Element)
+            else if (scopeObjectProxy.isElement)
                 title = WebInspector.UIString("Event Target");
-            else if (foundLocalScope && scopeObject instanceof InspectorController.inspectedWindow().Document)
+            else if (scopeObjectProxy.isDocument)
                 title = WebInspector.UIString("Event Document");
-            else if (!foundLocalScope && !localScope)
+            else if (scopeObjectProxy.isWithBlock)
                 title = WebInspector.UIString("With Block");
 
             if (!title || title === subtitle)
                 subtitle = null;
 
-            var section = new WebInspector.ObjectPropertiesSection(new WebInspector.ObjectProxy(scopeObject), title, subtitle, emptyPlaceholder, true, extraProperties, WebInspector.ScopeVariableTreeElement);
+            var section = new WebInspector.ObjectPropertiesSection(scopeObjectProxy, title, subtitle, emptyPlaceholder, true, extraProperties, WebInspector.ScopeVariableTreeElement);
             section.editInSelectedCallFrameWhenPaused = true;
             section.pane = this;
 
-            if (!foundLocalScope || localScope)
+            if (!foundLocalScope || scopeObjectProxy.isLocal)
                 section.expanded = true;
 
             this.sections.push(section);
@@ -109,18 +101,18 @@ WebInspector.ScopeVariableTreeElement.prototype = {
     onattach: function()
     {
         WebInspector.ObjectPropertyTreeElement.prototype.onattach.call(this);
-        if (this.hasChildren && this.propertyIdentifier in this.treeOutline.section.pane.callFrame._expandedProperties)
+        if (this.hasChildren && this.propertyIdentifier in this.treeOutline.section.pane._expandedProperties)
             this.expand();
     },
 
     onexpand: function()
     {
-        this.treeOutline.section.pane.callFrame._expandedProperties[this.propertyIdentifier] = true;
+        this.treeOutline.section.pane._expandedProperties[this.propertyIdentifier] = true;
     },
 
     oncollapse: function()
     {
-        delete this.treeOutline.section.pane.callFrame._expandedProperties[this.propertyIdentifier];
+        delete this.treeOutline.section.pane._expandedProperties[this.propertyIdentifier];
     },
 
     get propertyIdentifier()
diff --git a/WebCore/inspector/front-end/ScriptsPanel.js b/WebCore/inspector/front-end/ScriptsPanel.js
index 0058374..05ec197 100644
--- a/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/WebCore/inspector/front-end/ScriptsPanel.js
@@ -126,6 +126,7 @@ WebInspector.ScriptsPanel = function()
     this.topStatusBar.appendChild(this.sidebarResizeWidgetElement);
 
     this.sidebarPanes = {};
+    this.sidebarPanes.watchExpressions = new WebInspector.WatchExpressionsSidebarPane();
     this.sidebarPanes.callstack = new WebInspector.CallStackSidebarPane();
     this.sidebarPanes.scopechain = new WebInspector.ScopeChainSidebarPane();
     this.sidebarPanes.breakpoints = new WebInspector.BreakpointsSidebarPane();
@@ -151,13 +152,10 @@ WebInspector.ScriptsPanel = function()
     this.element.appendChild(this.sidebarElement);
     this.element.appendChild(this.sidebarResizeElement);
 
-    this.enableToggleButton = this.createStatusBarButton();
-    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleDebugging.bind(this), false);
 
-    this.pauseOnExceptionButton = this.createStatusBarButton();
-    this.pauseOnExceptionButton.id = "scripts-pause-on-exceptions-status-bar-item";
-    this.pauseOnExceptionButton.className = "status-bar-item";
+    this.pauseOnExceptionButton = new WebInspector.StatusBarButton("", "scripts-pause-on-exceptions-status-bar-item");
     this.pauseOnExceptionButton.addEventListener("click", this._togglePauseOnExceptions.bind(this), false);
 
     this._breakpointsURLMap = {};
@@ -208,7 +206,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton, this.pauseOnExceptionButton];
+        return [this.enableToggleButton.element, this.pauseOnExceptionButton.element];
     },
 
     get paused()
@@ -286,7 +284,7 @@ WebInspector.ScriptsPanel.prototype = {
                 if (startingLine <= breakpoint.line) {
                     breakpoint.sourceID = sourceID;
                     if (breakpoint.enabled)
-                        InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line);
+                        InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
                 }
             }
         }
@@ -353,7 +351,15 @@ WebInspector.ScriptsPanel.prototype = {
             sourceFrame.removeBreakpoint(breakpoint);
     },
 
-    evaluateInSelectedCallFrame: function(code, updateInterface, callback)
+    selectedCallFrameId: function()
+    {
+        var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
+        if (!selectedCallFrame)
+            return null;
+        return selectedCallFrame.id;
+    },
+
+    evaluateInSelectedCallFrame: function(code, updateInterface, objectGroup, callback)
     {
         var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
         if (!this._paused || !selectedCallFrame)
@@ -369,41 +375,36 @@ WebInspector.ScriptsPanel.prototype = {
             if (updateInterface)
                 self.sidebarPanes.scopechain.update(selectedCallFrame);
         }
-        this.doEvalInCallFrame(selectedCallFrame, code, updatingCallbackWrapper);
+        this.doEvalInCallFrame(selectedCallFrame, code, objectGroup, updatingCallbackWrapper);
     },
 
-    doEvalInCallFrame: function(callFrame, code, callback)
+    doEvalInCallFrame: function(callFrame, code, objectGroup, callback)
     {
-        var panel = this;
-        function delayedEvaluation()
+        function evalCallback(result)
         {
-            if (!code) {
-                // Evaluate into properties in scope of the selected call frame.
-                callback(panel._variablesInScope(callFrame));
-                return;
-            }
-            try {
-                callback(callFrame.evaluate(code));
-            } catch (e) {
-                callback(e, true);
-            }
+            if (result)
+                callback(result.value, result.isException);
         }
-        setTimeout(delayedEvaluation, 0);
+        InjectedScriptAccess.evaluateInCallFrame(callFrame.id, code, objectGroup, evalCallback);
     },
 
-    _variablesInScope: function(callFrame)
+    variablesInSelectedCallFrame: function()
     {
+        var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
+        if (!this._paused || !selectedCallFrame)
+            return {};
+
         var result = {};
-        var scopeChain = callFrame.scopeChain;
+        var scopeChain = selectedCallFrame.scopeChain;
         for (var i = 0; i < scopeChain.length; ++i) {
-            var scopeObject = scopeChain[i];
-            for (var property in scopeObject)
-                result[property] = true;
+            var scopeObjectProperties = scopeChain[i].properties;
+            for (var j = 0; j < scopeObjectProperties.length; ++j)
+                result[scopeObjectProperties[j]] = true;
         }
         return result;
     },
 
-    debuggerPaused: function()
+    debuggerPaused: function(callFrames)
     {
         this._paused = true;
         this._waitingToPause = false;
@@ -411,10 +412,8 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._updateDebuggerButtons();
 
-        var callStackPane = this.sidebarPanes.callstack;
-        var currentFrame = InspectorController.currentCallFrame();
-        callStackPane.update(currentFrame, this._sourceIDMap);
-        callStackPane.selectedCallFrame = currentFrame;
+        this.sidebarPanes.callstack.update(callFrames, this._sourceIDMap);
+        this.sidebarPanes.callstack.selectedCallFrame = callFrames[0];
 
         WebInspector.currentPanel = this;
         window.focus();
@@ -481,6 +480,8 @@ WebInspector.ScriptsPanel.prototype = {
         }
 
         this._sourceIDMap = {};
+        
+        this.sidebarPanes.watchExpressions.refreshExpressions();
     },
 
     get visibleView()
@@ -714,6 +715,7 @@ WebInspector.ScriptsPanel.prototype = {
             return;
 
         this.sidebarPanes.scopechain.update(currentFrame);
+        this.sidebarPanes.watchExpressions.refreshExpressions();
 
         var scriptOrResource = this._sourceIDMap[currentFrame.sourceID];
         this._showScriptOrResource(scriptOrResource, currentFrame.line);
@@ -764,10 +766,10 @@ WebInspector.ScriptsPanel.prototype = {
     {
         if (InspectorController.pauseOnExceptions()) {
             this.pauseOnExceptionButton.title = WebInspector.UIString("Don't pause on exceptions.");
-            this.pauseOnExceptionButton.addStyleClass("toggled-on");
+            this.pauseOnExceptionButton.toggled = true;
         } else {
             this.pauseOnExceptionButton.title = WebInspector.UIString("Pause on exceptions.");
-            this.pauseOnExceptionButton.removeStyleClass("toggled-on");
+            this.pauseOnExceptionButton.toggled = false;
         }
     },
 
@@ -775,13 +777,13 @@ WebInspector.ScriptsPanel.prototype = {
     {
         if (InspectorController.debuggerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Debugging enabled. Click to disable.");
-            this.enableToggleButton.addStyleClass("toggled-on");
-            this.pauseOnExceptionButton.removeStyleClass("hidden");
+            this.enableToggleButton.toggled = true;
+            this.pauseOnExceptionButton.visible = true;
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Debugging disabled. Click to enable.");
-            this.enableToggleButton.removeStyleClass("toggled-on");
-            this.pauseOnExceptionButton.addStyleClass("hidden");
+            this.enableToggleButton.toggled = false;
+            this.pauseOnExceptionButton.visible = false;
             this.panelEnablerView.visible = true;
         }
 
diff --git a/WebCore/inspector/front-end/SourceFrame.js b/WebCore/inspector/front-end/SourceFrame.js
index 930eb16..790055a 100644
--- a/WebCore/inspector/front-end/SourceFrame.js
+++ b/WebCore/inspector/front-end/SourceFrame.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -115,7 +116,7 @@ WebInspector.SourceFrame.prototype = {
             this._lineNumberToReveal = lineNumber;
             return;
         }
-    
+
         var row = this.sourceRow(lineNumber);
         if (row)
             row.scrollIntoViewIfNeeded(true);
@@ -199,6 +200,7 @@ WebInspector.SourceFrame.prototype = {
     _loaded: function()
     {
         WebInspector.addMainEventListeners(this.element.contentDocument);
+        this.element.contentDocument.addEventListener("contextmenu", this._documentContextMenu.bind(this), true);
         this.element.contentDocument.addEventListener("mousedown", this._documentMouseDown.bind(this), true);
         this.element.contentDocument.addEventListener("keydown", this._documentKeyDown.bind(this), true);
         this.element.contentDocument.addEventListener("keyup", WebInspector.documentKeyUp.bind(WebInspector), true);
@@ -215,27 +217,45 @@ WebInspector.SourceFrame.prototype = {
             headElement = this.element.contentDocument.createElement("head");
             this.element.contentDocument.documentElement.insertBefore(headElement, this.element.contentDocument.documentElement.firstChild);
         }
+        
+        var linkElement = this.element.contentDocument.createElement("link");
+        linkElement.type = "text/css";
+        linkElement.rel = "stylesheet";
+        linkElement.href = "inspectorSyntaxHighlight.css";
+        headElement.appendChild(linkElement);
 
         var styleElement = this.element.contentDocument.createElement("style");
         headElement.appendChild(styleElement);
 
         // Add these style rules here since they are specific to the Inspector. They also behave oddly and not
-        // all properties apply if added to view-source.css (becuase it is a user agent sheet.)
+        // all properties apply if added to view-source.css (because it is a user agent sheet.)
         var styleText = ".webkit-line-number { background-repeat: no-repeat; background-position: right 1px; }\n";
+        styleText += ".webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(program-counter); }\n";
+
         styleText += ".webkit-breakpoint .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint); }\n";
         styleText += ".webkit-breakpoint-disabled .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-disabled); }\n";
-        styleText += ".webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(program-counter); }\n";
         styleText += ".webkit-breakpoint.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-program-counter); }\n";
         styleText += ".webkit-breakpoint-disabled.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-disabled-program-counter); }\n";
+
+        styleText += ".webkit-breakpoint.webkit-breakpoint-conditional .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-conditional); }\n";
+        styleText += ".webkit-breakpoint-disabled.webkit-breakpoint-conditional .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-disabled-conditional); }\n";
+        styleText += ".webkit-breakpoint.webkit-breakpoint-conditional.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-conditional-program-counter); }\n";
+        styleText += ".webkit-breakpoint-disabled.webkit-breakpoint-conditional.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-disabled-conditional-program-counter); }\n";
+
         styleText += ".webkit-execution-line .webkit-line-content { background-color: rgb(171, 191, 254); outline: 1px solid rgb(64, 115, 244); }\n";
         styleText += ".webkit-height-sized-to-fit { overflow-y: hidden }\n";
         styleText += ".webkit-line-content { background-color: white; }\n";
         styleText += "@-webkit-keyframes fadeout {from {background-color: rgb(255, 255, 120);} to { background-color: white;}}\n";
         styleText += ".webkit-highlighted-line .webkit-line-content { background-color: rgb(255, 255, 120); -webkit-animation: 'fadeout' 2s 500ms}\n";
-        styleText += ".webkit-javascript-comment { color: rgb(0, 116, 0); }\n";
-        styleText += ".webkit-javascript-keyword { color: rgb(170, 13, 145); }\n";
-        styleText += ".webkit-javascript-number { color: rgb(28, 0, 207); }\n";
-        styleText += ".webkit-javascript-string, .webkit-javascript-regexp { color: rgb(196, 26, 22); }\n";
+
+        // TODO: Move these styles into inspector.css once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed and popup moved into the top frame.
+        styleText += ".popup-content { position: absolute; z-index: 10000; padding: 4px; background-color: rgb(203, 226, 255); -webkit-border-radius: 7px; border: 2px solid rgb(169, 172, 203); }";
+        styleText += ".popup-glasspane { position: absolute; top: 0; left: 0; height: 100%; width: 100%; opacity: 0; z-index: 9900; }";
+        styleText += ".popup-message { background-color: transparent; font-family: Lucida Grande, sans-serif; font-weight: normal; font-size: 11px; text-align: left; text-shadow: none; color: rgb(85, 85, 85); cursor: default; margin: 0 0 2px 0; }";
+        styleText += ".popup-content.breakpoint-condition { width: 90%; }";
+        styleText += ".popup-content input#bp-condition { font-family: monospace; margin: 0; border: 1px inset rgb(190, 190, 190) !important; width: 100%; box-shadow: none !important; outline: none !important; -webkit-user-modify: read-write; }";
+        // This class is already in inspector.css
+        styleText += ".hidden { display: none !important; }";
 
         styleElement.textContent = styleText;
 
@@ -244,8 +264,12 @@ WebInspector.SourceFrame.prototype = {
 
         this.element.contentWindow.Element.prototype.addStyleClass = Element.prototype.addStyleClass;
         this.element.contentWindow.Element.prototype.removeStyleClass = Element.prototype.removeStyleClass;
+        this.element.contentWindow.Element.prototype.positionAt = Element.prototype.positionAt;
         this.element.contentWindow.Element.prototype.removeMatchingStyleClasses = Element.prototype.removeMatchingStyleClasses;
         this.element.contentWindow.Element.prototype.hasStyleClass = Element.prototype.hasStyleClass;
+        this.element.contentWindow.Element.prototype.pageOffsetRelativeToWindow = Element.prototype.pageOffsetRelativeToWindow;
+        this.element.contentWindow.Element.prototype.__defineGetter__("totalOffsetLeft", Element.prototype.__lookupGetter__("totalOffsetLeft"));
+        this.element.contentWindow.Element.prototype.__defineGetter__("totalOffsetTop", Element.prototype.__lookupGetter__("totalOffsetTop"));
         this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeName = Node.prototype.enclosingNodeOrSelfWithNodeName;
         this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = Node.prototype.enclosingNodeOrSelfWithNodeNameInArray;
 
@@ -257,20 +281,20 @@ WebInspector.SourceFrame.prototype = {
 
         if (this.autoSizesToFitContentHeight)
             this.sizeToFitContentHeight();
-            
+
         if (this._lineNumberToReveal) {
             this.revealLine(this._lineNumberToReveal);
             delete this._lineNumberToReveal;
         }
-    
+
         if (this._lineNumberToHighlight) {
             this.highlightLine(this._lineNumberToHighlight);
             delete this._lineNumberToHighlight;
         }
-        
+
         this.dispatchEventToListeners("content loaded");
     },
-    
+
     _isContentLoaded: function() {
         var doc = this.element.contentDocument;
         return doc && doc.getElementsByTagName("table")[0];
@@ -283,18 +307,102 @@ WebInspector.SourceFrame.prototype = {
         this.sizeToFitContentHeight();
     },
 
-    _documentMouseDown: function(event)
+    _documentContextMenu: function(event)
     {
         if (!event.target.hasStyleClass("webkit-line-number"))
             return;
+        var sourceRow = event.target.enclosingNodeOrSelfWithNodeName("tr");
+        if (!sourceRow._breakpointObject && this.addBreakpointDelegate)
+            this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
+
+        var breakpoint = sourceRow._breakpointObject;
+        if (!breakpoint)
+            return;
 
+        this._editBreakpointCondition(event.target, sourceRow, breakpoint);
+        event.preventDefault();
+    },
+
+    _documentMouseDown: function(event)
+    {
+        if (!event.target.hasStyleClass("webkit-line-number"))
+            return;
+        if (event.button != 0 || event.altKey || event.ctrlKey || event.metaKey || event.shiftKey)
+            return;
         var sourceRow = event.target.enclosingNodeOrSelfWithNodeName("tr");
-        if (sourceRow._breakpointObject)
-            sourceRow._breakpointObject.enabled = !sourceRow._breakpointObject.enabled;
+        if (sourceRow._breakpointObject && sourceRow._breakpointObject.enabled)
+            sourceRow._breakpointObject.enabled = false;
+        else if (sourceRow._breakpointObject)
+            WebInspector.panels.scripts.removeBreakpoint(sourceRow._breakpointObject);
         else if (this.addBreakpointDelegate)
             this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
     },
 
+    _editBreakpointCondition: function(eventTarget, sourceRow, breakpoint)
+    {
+        // TODO: Migrate the popup to the top-level document and remove the blur listener from conditionElement once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed.
+        var popupDocument = this.element.contentDocument;
+        this._showBreakpointConditionPopup(eventTarget, breakpoint.line, popupDocument);
+
+        function committed(element, newText)
+        {
+            breakpoint.condition = newText;
+            if (breakpoint.condition)
+                sourceRow.addStyleClass("webkit-breakpoint-conditional");
+            else
+                sourceRow.removeStyleClass("webkit-breakpoint-conditional");
+            dismissed.call(this);
+        }
+
+        function dismissed()
+        {
+            this._popup.hide();
+            delete this._conditionEditorElement;
+        }
+
+        var dismissedHandler = dismissed.bind(this);
+        this._conditionEditorElement.addEventListener("blur", dismissedHandler, false);
+
+        WebInspector.startEditing(this._conditionEditorElement, committed.bind(this), dismissedHandler);
+        this._conditionEditorElement.value = breakpoint.condition;
+        this._conditionEditorElement.select();
+    },
+
+    _showBreakpointConditionPopup: function(clickedElement, lineNumber, popupDocument)
+    {
+        var popupContentElement = this._createPopupElement(lineNumber, popupDocument);
+        var lineElement = clickedElement.enclosingNodeOrSelfWithNodeName("td").nextSibling;
+        if (this._popup) {
+            this._popup.hide();
+            this._popup.element = popupContentElement;
+        } else {
+            this._popup = new WebInspector.Popup(popupContentElement);
+            this._popup.autoHide = true;
+        }
+        this._popup.anchor = lineElement;
+        this._popup.show();
+    },
+
+    _createPopupElement: function(lineNumber, popupDocument)
+    {
+        var popupContentElement = popupDocument.createElement("div");
+        popupContentElement.className = "popup-content breakpoint-condition";
+
+        var labelElement = document.createElement("label");
+        labelElement.className = "popup-message";
+        labelElement.htmlFor = "bp-condition";
+        labelElement.appendChild(document.createTextNode(WebInspector.UIString("The breakpoint on line %d will stop only if this expression is true:", lineNumber)));
+        popupContentElement.appendChild(labelElement);
+
+        var editorElement = document.createElement("input");
+        editorElement.id = "bp-condition";
+        editorElement.type = "text"
+        popupContentElement.appendChild(editorElement);
+        this._conditionEditorElement = editorElement;
+
+        return popupContentElement;
+    },
+
     _documentKeyDown: function(event)
     {
         var shortcut = WebInspector.KeyboardShortcut.makeKeyFromEvent(event);
@@ -380,6 +488,8 @@ WebInspector.SourceFrame.prototype = {
         sourceRow.addStyleClass("webkit-breakpoint");
         if (!breakpoint.enabled)
             sourceRow.addStyleClass("webkit-breakpoint-disabled");
+        if (breakpoint.condition)
+            sourceRow.addStyleClass("webkit-breakpoint-conditional");
     },
 
     _removeBreakpointFromSource: function(breakpoint)
@@ -392,8 +502,9 @@ WebInspector.SourceFrame.prototype = {
 
         sourceRow.removeStyleClass("webkit-breakpoint");
         sourceRow.removeStyleClass("webkit-breakpoint-disabled");
+        sourceRow.removeStyleClass("webkit-breakpoint-conditional");
     },
-    
+
     _incrementMessageRepeatCount: function(msg, repeatDelta)
     {
         if (!msg._resourceMessageLineElement)
@@ -518,12 +629,12 @@ WebInspector.SourceFrame.prototype = {
         delete this._needsProgramCounterImage;
     },
 
-    _drawBreakpointImagesIfNeeded: function()
+    _drawBreakpointImagesIfNeeded: function(conditional)
     {
         if (!this._needsBreakpointImages || !this.element.contentDocument)
             return;
 
-        function drawBreakpoint(ctx, disabled)
+        function drawBreakpoint(ctx, disabled, conditional)
         {
             ctx.beginPath();
             ctx.moveTo(0, 2);
@@ -534,8 +645,8 @@ WebInspector.SourceFrame.prototype = {
             ctx.lineTo(2, 11);
             ctx.lineTo(0, 9);
             ctx.closePath();
-            ctx.fillStyle = "rgb(1, 142, 217)";
-            ctx.strokeStyle = "rgb(0, 103, 205)";
+            ctx.fillStyle = conditional ? "rgb(217, 142, 1)" : "rgb(1, 142, 217)";
+            ctx.strokeStyle = conditional ? "rgb(205, 103, 0)" : "rgb(0, 103, 205)";
             ctx.lineWidth = 3;
             ctx.fill();
             ctx.save();
@@ -553,6 +664,9 @@ WebInspector.SourceFrame.prototype = {
             ctx.restore();
         }
 
+
+        // Unconditional breakpoints.
+
         var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint", 26, 11);
         ctx.clearRect(0, 0, 26, 11);
         drawBreakpoint(ctx);
@@ -573,6 +687,29 @@ WebInspector.SourceFrame.prototype = {
         ctx.clearRect(20, 0, 6, 11);
         this._drawProgramCounterInContext(ctx, true);
 
+
+        // Conditional breakpoints.
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-conditional", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, false, true);
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-conditional-program-counter", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, false, true);
+        ctx.clearRect(20, 0, 6, 11);
+        this._drawProgramCounterInContext(ctx, true);
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-disabled-conditional", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, true, true);
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-disabled-conditional-program-counter", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, true, true);
+        ctx.clearRect(20, 0, 6, 11);
+        this._drawProgramCounterInContext(ctx, true);
+
         delete this._needsBreakpointImages;
     },
 
@@ -582,190 +719,394 @@ WebInspector.SourceFrame.prototype = {
         if (!table)
             return;
 
-        function deleteContinueFlags(cell)
-        {
-            if (!cell)
-                return;
-            delete cell._commentContinues;
-            delete cell._singleQuoteStringContinues;
-            delete cell._doubleQuoteStringContinues;
-            delete cell._regexpContinues;
-        }
+        var jsSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(table, this);
+        jsSyntaxHighlighter.process();
+    },
 
-        function createSpan(content, className)
-        {
-            var span = document.createElement("span");
-            span.className = className;
-            span.appendChild(document.createTextNode(content));
-            return span;
-        }
+    syntaxHighlightCSS: function()
+    {
+        var table = this.element.contentDocument.getElementsByTagName("table")[0];
+        if (!table)
+            return;
 
-        function generateFinder(regex, matchNumber, className)
-        {
-            return function(str) {
-                var match = regex.exec(str);
-                if (!match)
-                    return null;
-                previousMatchLength = match[matchNumber].length;
-                return createSpan(match[matchNumber], className);
-            };
-        }
+        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(table, this);
+        cssSyntaxHighlighter.process();
+    }
+}
 
-        var findNumber = generateFinder(/^(-?(\d+\.?\d*([eE][+-]\d+)?|0[xX]\h+|Infinity)|NaN)(?:\W|$)/, 1, "webkit-javascript-number");
-        var findKeyword = generateFinder(/^(null|true|false|break|case|catch|const|default|finally|for|instanceof|new|var|continue|function|return|void|delete|if|this|do|while|else|in|switch|throw|try|typeof|with|debugger|class|enum|export|extends|import|super|get|set)(?:\W|$)/, 1, "webkit-javascript-keyword");
-        var findSingleLineString = generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-javascript-string"); // " this quote keeps Xcode happy
-        var findMultilineCommentStart = generateFinder(/^\/\*.*$/, 0, "webkit-javascript-comment");
-        var findMultilineCommentEnd = generateFinder(/^.*?\*\//, 0, "webkit-javascript-comment");
-        var findMultilineSingleQuoteStringStart = generateFinder(/^'(?:[^'\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-        var findMultilineSingleQuoteStringEnd = generateFinder(/^(?:[^'\\]|\\.)*?'/, 0, "webkit-javascript-string");
-        var findMultilineDoubleQuoteStringStart = generateFinder(/^"(?:[^"\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-        var findMultilineDoubleQuoteStringEnd = generateFinder(/^(?:[^"\\]|\\.)*?"/, 0, "webkit-javascript-string");
-        var findMultilineRegExpEnd = generateFinder(/^(?:[^\/\\]|\\.)*?\/([gim]{0,3})/, 0, "webkit-javascript-regexp");
-        var findSingleLineComment = generateFinder(/^\/\/.*|^\/\*.*?\*\//, 0, "webkit-javascript-comment");
-
-        function findMultilineRegExpStart(str)
-        {
-            var match = /^\/(?:[^\/\\]|\\.)*\\$/.exec(str);
-            if (!match || !/\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[0]))
+WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.SourceSyntaxHighligher = function(table, sourceFrame)
+{
+    this.table = table;
+    this.sourceFrame = sourceFrame;
+}
+
+WebInspector.SourceSyntaxHighligher.prototype = {
+    createSpan: function(content, className)
+    {
+        var span = document.createElement("span");
+        span.className = className;
+        span.appendChild(document.createTextNode(content));
+        return span;
+    },
+
+    generateFinder: function(regex, matchNumber, className)
+    {
+        return function(str) {
+            var match = regex.exec(str);
+            if (!match)
                 return null;
-            var node = createSpan(match[0], "webkit-javascript-regexp");
-            previousMatchLength = match[0].length;
-            return node;
-        }
+            this.previousMatchLength = match[matchNumber].length;
+            return this.createSpan(match[matchNumber], className);
+        };
+    },
+
+    process: function()
+    {
+        // Split up the work into chunks so we don't block the
+        // UI thread while processing.
+
+        var i = 0;
+        var rows = this.table.rows;
+        var rowsLength = rows.length;
+        var previousCell = null;
+        const linesPerChunk = 10;
 
-        function findSingleLineRegExp(str)
+        function processChunk()
         {
-            var match = /^(\/(?:[^\/\\]|\\.)*\/([gim]{0,3}))(.?)/.exec(str);
-            if (!match || !(match[2].length > 0 || /\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[1]) || /\.|;|,/.test(match[3])))
-                return null;
-            var node = createSpan(match[1], "webkit-javascript-regexp");
-            previousMatchLength = match[1].length;
-            return node;
+            for (var end = Math.min(i + linesPerChunk, rowsLength); i < end; ++i) {
+                var row = rows[i];
+                if (!row)
+                    continue;
+                var cell = row.cells[1];
+                if (!cell)
+                    continue;
+                this.syntaxHighlightLine(cell, previousCell);
+                if (i < (end - 1))
+                    this.deleteContinueFlags(previousCell);
+                previousCell = cell;
+            }
+
+            if (i >= rowsLength && processChunkInterval) {
+                this.deleteContinueFlags(previousCell);
+                delete this.previousMatchLength;
+                clearInterval(processChunkInterval);
+
+                this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+            }
         }
 
-        function syntaxHighlightJavascriptLine(line, prevLine)
-        {
-            var messageBubble = line.lastChild;
-            if (messageBubble && messageBubble.nodeType === Node.ELEMENT_NODE && messageBubble.hasStyleClass("webkit-html-message-bubble"))
-                line.removeChild(messageBubble);
-            else
-                messageBubble = null;
+        var boundProcessChunk = processChunk.bind(this);
+        var processChunkInterval = setInterval(boundProcessChunk, 25);
+        boundProcessChunk();
+    }
+}
+
+WebInspector.CSSSourceSyntaxHighligher = function(table, sourceFrame) {
+    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
+
+    this.findNumber = this.generateFinder(/^((-?(\d+|\d*\.\d+))|^(#[a-fA-F0-9]{3,6}))(?:\D|$)/, 1, "webkit-css-number");
+    this.findUnits = this.generateFinder(/^(px|em|pt|in|cm|mm|pc|ex)(?:\W|$)/, 1, "webkit-css-unit");
+    this.findKeyword = this.generateFinder(/^(rgba?|hsla?|var)(?:\W|$)/, 1, "webkit-css-keyword");
+    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-css-string"); // " this quote keeps Xcode happy
+    this.findSingleLineComment = this.generateFinder(/^\/\*.*?\*\//, 0, "webkit-css-comment");
+    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-css-comment");
+    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-css-comment");
+    this.findSelector = this.generateFinder(/^([#\.]?[_a-zA-Z].*?)(?:\W|$)/, 1, "webkit-css-selector");
+    this.findProperty = this.generateFinder(/^(-?[_a-z0-9][_a-z0-9-]*\s*)(?:\:)/, 1, "webkit-css-property");
+    this.findGenericIdent = this.generateFinder(/^([@-]?[_a-z0-9][_a-z0-9-]*)(?:\W|$)/, 1, "webkit-css-string");
+}
+
+WebInspector.CSSSourceSyntaxHighligher.prototype = {
+    deleteContinueFlags: function(cell)
+    {
+        if (!cell)
+            return;
+        delete cell._commentContinues;
+        delete cell._inSelector;
+    },
+
+    findPseudoClass: function(str)
+    {
+        var match = /^(::?)([_a-z0-9][_a-z0-9-]*)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        var span = document.createElement("span");
+        span.appendChild(document.createTextNode(match[1]));
+        span.appendChild(this.createSpan(match[2], "webkit-css-pseudo-class"));
+        return span;
+    },
+
+    findURL: function(str)
+    {
+        var match = /^(?:local|url)\(([^\)]*?)\)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        var innerUrlSpan = this.createSpan(match[1], "webkit-css-url");
+        var outerSpan = document.createElement("span");
+        outerSpan.appendChild(this.createSpan("url", "webkit-css-keyword"));
+        outerSpan.appendChild(document.createTextNode("("));
+        outerSpan.appendChild(innerUrlSpan);
+        outerSpan.appendChild(document.createTextNode(")"));
+        return outerSpan;
+    },
+
+    findAtRule: function(str)
+    {
+        var match = /^@[_a-z0-9][_a-z0-9-]*(?:\W|$)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        return this.createSpan(match[0], "webkit-css-at-rule");
+    },
 
-            var code = line.textContent;
+    syntaxHighlightLine: function(line, prevLine)
+    {
+        var code = line.textContent;
+        while (line.firstChild)
+            line.removeChild(line.firstChild);
 
-            while (line.firstChild)
-                line.removeChild(line.firstChild);
+        var token;
+        var tmp = 0;
+        var i = 0;
+        this.previousMatchLength = 0;
 
-            var token;
-            var tmp = 0;
-            var i = 0;
-            previousMatchLength = 0;
+        if (prevLine) {
+            if (prevLine._commentContinues) {
+                if (!(token = this.findMultilineCommentEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-comment");
+                    line._commentContinues = true;
+                }
+            }
+            if (token) {
+                i += this.previousMatchLength ? this.previousMatchLength : code.length;
+                tmp = i;
+                line.appendChild(token);
+            }
+        }
 
-            if (prevLine) {
-                if (prevLine._commentContinues) {
-                    if (!(token = findMultilineCommentEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-comment");
-                        line._commentContinues = true;
+        var inSelector = (prevLine && prevLine._inSelector); // inside a selector, we can now parse properties and values
+        var inAtRuleBlock = (prevLine && prevLine._inAtRuleBlock); // inside an @rule block, but not necessarily inside a selector yet
+        var atRuleStarted = (prevLine && prevLine._atRuleStarted); // we received an @rule, we may stop the @rule at a semicolon or open a block and become inAtRuleBlock
+        var atRuleIsSelector = (prevLine && prevLine._atRuleIsSelector); // when this @rule opens a block it immediately goes into parsing properties and values instead of selectors
+
+        for ( ; i < code.length; ++i) {
+            var codeFragment = code.substr(i);
+            var prevChar = code[i - 1];
+            var currChar = codeFragment[0];
+            token = this.findSingleLineComment(codeFragment);
+            if (!token) {
+                if ((token = this.findMultilineCommentStart(codeFragment)))
+                    line._commentContinues = true;
+                else if (currChar === ";" && !inAtRuleBlock)
+                    atRuleStarted = false;
+                else if (currChar === "}") {
+                    if (inSelector && inAtRuleBlock && atRuleIsSelector) {
+                        inSelector = false;
+                        inAtRuleBlock = false;
+                        atRuleStarted = false;
+                    } else if (inSelector) {
+                        inSelector = false;
+                    } else if (inAtRuleBlock) {
+                        inAtRuleBlock = false;
+                        atRuleStarted = false;
                     }
-                } else if (prevLine._singleQuoteStringContinues) {
-                    if (!(token = findMultilineSingleQuoteStringEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-string");
-                        line._singleQuoteStringContinues = true;
+                } else if (currChar === "{") {
+                    if (!atRuleStarted || inAtRuleBlock) {
+                        inSelector = true;
+                    } else if (!inAtRuleBlock && atRuleIsSelector) {
+                        inAtRuleBlock = true;
+                        inSelector = true;
+                    } else if (!inAtRuleBlock) {
+                        inAtRuleBlock = true;
+                        inSelector = false;
                     }
-                } else if (prevLine._doubleQuoteStringContinues) {
-                    if (!(token = findMultilineDoubleQuoteStringEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-string");
-                        line._doubleQuoteStringContinues = true;
+                } else if (inSelector) {
+                    if (!prevChar || /^\d/.test(prevChar)) {
+                        token = this.findUnits(codeFragment);
+                    } else if (!prevChar || /^\W/.test(prevChar)) {
+                        token = this.findNumber(codeFragment) ||
+                                this.findKeyword(codeFragment) ||
+                                this.findURL(codeFragment) ||
+                                this.findProperty(codeFragment) ||
+                                this.findAtRule(codeFragment) ||
+                                this.findGenericIdent(codeFragment) ||
+                                this.findSingleLineString(codeFragment);
                     }
-                } else if (prevLine._regexpContinues) {
-                    if (!(token = findMultilineRegExpEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-regexp");
-                        line._regexpContinues = true;
+                } else if (!inSelector) {
+                    if (atRuleStarted && !inAtRuleBlock)
+                        token = this.findURL(codeFragment); // for @import
+                    if (!token) {
+                        token = this.findSelector(codeFragment) ||
+                                this.findPseudoClass(codeFragment) ||
+                                this.findAtRule(codeFragment);
                     }
                 }
-                if (token) {
-                    i += previousMatchLength ? previousMatchLength : code.length;
-                    tmp = i;
-                    line.appendChild(token);
-                }
             }
 
-            for ( ; i < code.length; ++i) {
-                var codeFragment = code.substr(i);
-                var prevChar = code[i - 1];
-                token = findSingleLineComment(codeFragment);
-                if (!token) {
-                    if ((token = findMultilineCommentStart(codeFragment)))
-                        line._commentContinues = true;
-                    else if (!prevChar || /^\W/.test(prevChar)) {
-                        token = findNumber(codeFragment, code[i - 1]) ||
-                                findKeyword(codeFragment, code[i - 1]) ||
-                                findSingleLineString(codeFragment) ||
-                                findSingleLineRegExp(codeFragment);
-                        if (!token) {
-                            if (token = findMultilineSingleQuoteStringStart(codeFragment))
-                                line._singleQuoteStringContinues = true;
-                            else if (token = findMultilineDoubleQuoteStringStart(codeFragment))
-                                line._doubleQuoteStringContinues = true;
-                            else if (token = findMultilineRegExpStart(codeFragment))
-                                line._regexpContinues = true;
-                        }
-                    }
-                }
+            if (token) {
+                if (currChar === "@") {
+                    atRuleStarted = true;
 
-                if (token) {
-                    if (tmp !== i)
-                        line.appendChild(document.createTextNode(code.substring(tmp, i)));
-                    line.appendChild(token);
-                    i += previousMatchLength - 1;
-                    tmp = i + 1;
+                    // The @font-face, @page, and @variables at-rules do not contain selectors like other at-rules
+                    // instead it acts as a selector and contains properties and values.
+                    var text = token.textContent;
+                    atRuleIsSelector = /font-face/.test(text) || /page/.test(text) || /variables/.test(text);
                 }
+
+                if (tmp !== i)
+                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
+                line.appendChild(token);
+                i += this.previousMatchLength - 1;
+                tmp = i + 1;
             }
+        }
 
-            if (tmp < code.length)
-                line.appendChild(document.createTextNode(code.substring(tmp, i)));
+        line._inSelector = inSelector;
+        line._inAtRuleBlock = inAtRuleBlock;
+        line._atRuleStarted = atRuleStarted;
+        line._atRuleIsSelector = atRuleIsSelector;
 
-            if (messageBubble)
-                line.appendChild(messageBubble);
-        }
+        if (tmp < code.length)
+            line.appendChild(document.createTextNode(code.substring(tmp, i)));
+    }
+}
 
-        var i = 0;
-        var rows = table.rows;
-        var rowsLength = rows.length;
-        var previousCell = null;
-        var previousMatchLength = 0;
-        var sourceFrame = this;
+WebInspector.CSSSourceSyntaxHighligher.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
+
+WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
+    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
+
+    this.findNumber = this.generateFinder(/^(-?(\d+\.?\d*([eE][+-]\d+)?|0[xX]\h+|Infinity)|NaN)(?:\W|$)/, 1, "webkit-javascript-number");
+    this.findKeyword = this.generateFinder(/^(null|true|false|break|case|catch|const|default|finally|for|instanceof|new|var|continue|function|return|void|delete|if|this|do|while|else|in|switch|throw|try|typeof|with|debugger|class|enum|export|extends|import|super|get|set)(?:\W|$)/, 1, "webkit-javascript-keyword");
+    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-javascript-string"); // " this quote keeps Xcode happy
+    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-javascript-comment");
+    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-javascript-comment");
+    this.findMultilineSingleQuoteStringStart = this.generateFinder(/^'(?:[^'\\]|\\.)*\\$/, 0, "webkit-javascript-string");
+    this.findMultilineSingleQuoteStringEnd = this.generateFinder(/^(?:[^'\\]|\\.)*?'/, 0, "webkit-javascript-string");
+    this.findMultilineDoubleQuoteStringStart = this.generateFinder(/^"(?:[^"\\]|\\.)*\\$/, 0, "webkit-javascript-string");
+    this.findMultilineDoubleQuoteStringEnd = this.generateFinder(/^(?:[^"\\]|\\.)*?"/, 0, "webkit-javascript-string");
+    this.findMultilineRegExpEnd = this.generateFinder(/^(?:[^\/\\]|\\.)*?\/([gim]{0,3})/, 0, "webkit-javascript-regexp");
+    this.findSingleLineComment = this.generateFinder(/^\/\/.*|^\/\*.*?\*\//, 0, "webkit-javascript-comment");
+}
 
-        // Split up the work into chunks so we don't block the
-        // UI thread while processing.
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
+    deleteContinueFlags: function(cell)
+    {
+        if (!cell)
+            return;
+        delete cell._commentContinues;
+        delete cell._singleQuoteStringContinues;
+        delete cell._doubleQuoteStringContinues;
+        delete cell._regexpContinues;
+    },
 
-        function processChunk()
-        {
-            for (var end = Math.min(i + 10, rowsLength); i < end; ++i) {
-                var row = rows[i];
-                if (!row)
-                    continue;
-                var cell = row.cells[1];
-                if (!cell)
-                    continue;
-                syntaxHighlightJavascriptLine(cell, previousCell);
-                if (i < (end - 1))
-                    deleteContinueFlags(previousCell);
-                previousCell = cell;
+    findMultilineRegExpStart: function(str)
+    {
+        var match = /^\/(?:[^\/\\]|\\.)*\\$/.exec(str);
+        if (!match || !/\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[0]))
+            return null;
+        this.previousMatchLength = match[0].length;
+        return this.createSpan(match[0], "webkit-javascript-regexp");
+    },
+
+    findSingleLineRegExp: function(str)
+    {
+        var match = /^(\/(?:[^\/\\]|\\.)*\/([gim]{0,3}))(.?)/.exec(str);
+        if (!match || !(match[2].length > 0 || /\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[1]) || /\.|;|,/.test(match[3])))
+            return null;
+        this.previousMatchLength = match[1].length;
+        return this.createSpan(match[1], "webkit-javascript-regexp");
+    },
+
+    syntaxHighlightLine: function(line, prevLine)
+    {
+        var messageBubble = line.lastChild;
+        if (messageBubble && messageBubble.nodeType === Node.ELEMENT_NODE && messageBubble.hasStyleClass("webkit-html-message-bubble"))
+            line.removeChild(messageBubble);
+        else
+            messageBubble = null;
+
+        var code = line.textContent;
+
+        while (line.firstChild)
+            line.removeChild(line.firstChild);
+
+        var token;
+        var tmp = 0;
+        var i = 0;
+        this.previousMatchLength = 0;
+
+        if (prevLine) {
+            if (prevLine._commentContinues) {
+                if (!(token = this.findMultilineCommentEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-comment");
+                    line._commentContinues = true;
+                }
+            } else if (prevLine._singleQuoteStringContinues) {
+                if (!(token = this.findMultilineSingleQuoteStringEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-string");
+                    line._singleQuoteStringContinues = true;
+                }
+            } else if (prevLine._doubleQuoteStringContinues) {
+                if (!(token = this.findMultilineDoubleQuoteStringEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-string");
+                    line._doubleQuoteStringContinues = true;
+                }
+            } else if (prevLine._regexpContinues) {
+                if (!(token = this.findMultilineRegExpEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-regexp");
+                    line._regexpContinues = true;
+                }
+            }
+            if (token) {
+                i += this.previousMatchLength ? this.previousMatchLength : code.length;
+                tmp = i;
+                line.appendChild(token);
             }
+        }
 
-            if (i >= rowsLength && processChunkInterval) {
-                deleteContinueFlags(previousCell);
-                clearInterval(processChunkInterval);
+        for ( ; i < code.length; ++i) {
+            var codeFragment = code.substr(i);
+            var prevChar = code[i - 1];
+            token = this.findSingleLineComment(codeFragment);
+            if (!token) {
+                if ((token = this.findMultilineCommentStart(codeFragment)))
+                    line._commentContinues = true;
+                else if (!prevChar || /^\W/.test(prevChar)) {
+                    token = this.findNumber(codeFragment) ||
+                            this.findKeyword(codeFragment) ||
+                            this.findSingleLineString(codeFragment) ||
+                            this.findSingleLineRegExp(codeFragment);
+                    if (!token) {
+                        if (token = this.findMultilineSingleQuoteStringStart(codeFragment))
+                            line._singleQuoteStringContinues = true;
+                        else if (token = this.findMultilineDoubleQuoteStringStart(codeFragment))
+                            line._doubleQuoteStringContinues = true;
+                        else if (token = this.findMultilineRegExpStart(codeFragment))
+                            line._regexpContinues = true;
+                    }
+                }
+            }
 
-                sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+            if (token) {
+                if (tmp !== i)
+                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
+                line.appendChild(token);
+                i += this.previousMatchLength - 1;
+                tmp = i + 1;
             }
         }
 
-        processChunk();
+        if (tmp < code.length)
+            line.appendChild(document.createTextNode(code.substring(tmp, i)));
 
-        var processChunkInterval = setInterval(processChunk, 25);
+        if (messageBubble)
+            line.appendChild(messageBubble);
     }
 }
 
-WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
diff --git a/WebCore/inspector/front-end/SourceView.js b/WebCore/inspector/front-end/SourceView.js
index 97a5bd5..c1b1bbf 100644
--- a/WebCore/inspector/front-end/SourceView.js
+++ b/WebCore/inspector/front-end/SourceView.js
@@ -106,11 +106,16 @@ WebInspector.SourceView.prototype = {
         this.sourceFrame.removeEventListener("content loaded", this._contentLoaded, this);
         
         if (this.resource.type === WebInspector.Resource.Type.Script
-            || this.resource.mimeType === 'application/json'
-            || this.resource.mimeType === 'application/javascript'
+            || this.resource.mimeType === "application/json"
+            || this.resource.mimeType === "application/javascript"
             || /\.js(on)?$/.test(this.resource.lastPathComponent) ) {
             this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
             this.sourceFrame.syntaxHighlightJavascript();
+        } else if (this.resource.type === WebInspector.Resource.Type.Stylesheet
+            || this.resource.mimeType === "text/css"
+            || /\.css$/.test(this.resource.lastPathComponent) ) {
+            this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
+            this.sourceFrame.syntaxHighlightCSS();
         } else
             this._sourceFrameSetupFinished();
     },
diff --git a/WebCore/inspector/front-end/StatusBarButton.js b/WebCore/inspector/front-end/StatusBarButton.js
new file mode 100644
index 0000000..5c69ed5
--- /dev/null
+++ b/WebCore/inspector/front-end/StatusBarButton.js
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.StatusBarButton = function(title, className)
+{
+    this.element = document.createElement("button");
+    this.element.className = className + " status-bar-item";
+    this.element.addEventListener("click", this._clicked.bind(this), false);
+
+    this.glyph = document.createElement("div");
+    this.glyph.className = "glyph";
+    this.element.appendChild(this.glyph);
+
+    this.glyphShadow = document.createElement("div");
+    this.glyphShadow.className = "glyph shadow";
+    this.element.appendChild(this.glyphShadow);
+
+    this.title = title;
+    this.disabled = false;
+    this._toggled = false;
+    this._visible = true;
+}
+
+WebInspector.StatusBarButton.prototype = {
+    _clicked: function()
+    {
+        this.dispatchEventToListeners("click");
+    },
+
+    get disabled()
+    {
+        return this._disabled;
+    },
+
+    set disabled(x)
+    {
+        if (this._disabled === x)
+            return;
+        this._disabled = x;
+        this.element.disabled = x;
+    },
+
+    get title()
+    {
+        return this._title;
+    },
+
+    set title(x)
+    {
+        if (this._title === x)
+            return;
+        this._title = x;
+        this.element.title = x;
+    },
+
+    get toggled()
+    {
+        return this._toggled;
+    },
+
+    set toggled(x)
+    {
+        if (this._toggled === x)
+            return;
+
+        if (x)
+            this.element.addStyleClass("toggled-on");
+        else
+            this.element.removeStyleClass("toggled-on");
+        this._toggled = x;
+    },
+
+    get visible()
+    {
+        return this._visible;
+    },
+
+    set visible(x)
+    {
+        if (this._visible === x)
+            return;
+
+        if (x)
+            this.element.removeStyleClass("hidden");
+        else
+            this.element.addStyleClass("hidden");
+        this._visible = x;
+    }
+}
+
+WebInspector.StatusBarButton.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/WebCore/inspector/front-end/DatabasesPanel.js b/WebCore/inspector/front-end/StoragePanel.js
index a31e3ff..089bb98 100644
--- a/WebCore/inspector/front-end/DatabasesPanel.js
+++ b/WebCore/inspector/front-end/StoragePanel.js
@@ -27,12 +27,12 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.DatabasesPanel = function(database)
+WebInspector.StoragePanel = function(database)
 {
     WebInspector.Panel.call(this);
 
     this.sidebarElement = document.createElement("div");
-    this.sidebarElement.id = "databases-sidebar";
+    this.sidebarElement.id = "storage-sidebar";
     this.sidebarElement.className = "sidebar";
     this.element.appendChild(this.sidebarElement);
 
@@ -59,6 +59,10 @@ WebInspector.DatabasesPanel = function(database)
     this.sidebarTree.appendChild(this.sessionStorageListTreeElement);
     this.sessionStorageListTreeElement.expand();
 
+    this.cookieListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("COOKIES"), {}, true);
+    this.sidebarTree.appendChild(this.cookieListTreeElement);
+    this.cookieListTreeElement.expand();
+
     this.storageViews = document.createElement("div");
     this.storageViews.id = "storage-views";
     this.element.appendChild(this.storageViews);
@@ -69,12 +73,12 @@ WebInspector.DatabasesPanel = function(database)
     this.reset();
 }
 
-WebInspector.DatabasesPanel.prototype = {
-    toolbarItemClass: "databases",
+WebInspector.StoragePanel.prototype = {
+    toolbarItemClass: "storage",
 
     get toolbarItemLabel()
     {
-        return WebInspector.UIString("Databases");
+        return WebInspector.UIString("Storage");
     },
 
     get statusBarItems()
@@ -86,7 +90,6 @@ WebInspector.DatabasesPanel.prototype = {
     {
         WebInspector.Panel.prototype.show.call(this);
         this._updateSidebarWidth();
-        this._registerStorageEventListener();
     },
 
     reset: function()
@@ -103,8 +106,6 @@ WebInspector.DatabasesPanel.prototype = {
 
         this._databases = [];
 
-        this._unregisterStorageEventListener();
-
         if (this._domStorage) {
             var domStorageLength = this._domStorage.length;
             for (var i = 0; i < domStorageLength; ++i) {
@@ -116,12 +117,20 @@ WebInspector.DatabasesPanel.prototype = {
 
         this._domStorage = [];
 
+        this._cookieDomains = {};
+        this._cookieViews = {};
+
         this.databasesListTreeElement.removeChildren();
         this.localStorageListTreeElement.removeChildren();
         this.sessionStorageListTreeElement.removeChildren();
-        this.storageViews.removeChildren();
-        
+        this.cookieListTreeElement.removeChildren();
+
+        this.storageViews.removeChildren();        
+
         this.storageViewStatusBarItemsContainer.removeChildren();
+        
+        if (this.sidebarTree.selectedTreeElement)
+            this.sidebarTree.selectedTreeElement.deselect();
     },
 
     handleKeyEvent: function(event)
@@ -137,11 +146,22 @@ WebInspector.DatabasesPanel.prototype = {
         database._databasesTreeElement = databaseTreeElement;
         this.databasesListTreeElement.appendChild(databaseTreeElement);
     },
+    
+    addCookieDomain: function(domain)
+    {
+        // Eliminate duplicate domains from the list.
+        if (typeof this._cookieDomains[domain] !== "undefined")
+            return;
+
+        var cookieDomainTreeElement = new WebInspector.CookieSidebarTreeElement(domain);
+        this.cookieListTreeElement.appendChild(cookieDomainTreeElement);
+        this._cookieDomains[domain] = true;
+    },
 
     addDOMStorage: function(domStorage)
     {
         this._domStorage.push(domStorage);
-        var domStorageTreeElement = new WebInspector.DOMStorageSidebarTreeElement(domStorage);
+        var domStorageTreeElement = new WebInspector.DOMStorageSidebarTreeElement(domStorage, (domStorage.isLocalStorage ? "local-storage" : "session-storage"));
         domStorage._domStorageTreeElement = domStorageTreeElement;
         if (domStorage.isLocalStorage)
             this.localStorageListTreeElement.appendChild(domStorageTreeElement);
@@ -149,12 +169,12 @@ WebInspector.DatabasesPanel.prototype = {
             this.sessionStorageListTreeElement.appendChild(domStorageTreeElement);
     },
 
-    selectDatabase: function(db)
+    selectDatabase: function(databaseId)
     {
         var database;
         for (var i = 0, len = this._databases.length; i < len; ++i) {
             database = this._databases[i];
-            if ( db === database.database ) {
+            if (database.id === databaseId) {
                 this.showDatabase(database);
                 database._databasesTreeElement.select();
                 return;
@@ -162,16 +182,12 @@ WebInspector.DatabasesPanel.prototype = {
         }
     },
 
-    selectDOMStorage: function(s)
+    selectDOMStorage: function(storageId)
     {
-        var isLocalStorage = (s === InspectorController.inspectedWindow().localStorage);
-        for (var i = 0, len = this._domStorage.length; i < len; ++i) {
-            var storage = this._domStorage[i];
-            if ( isLocalStorage === storage.isLocalStorage ) {
-                this.showDOMStorage(storage);
-                storage._domStorageTreeElement.select();
-                return;
-            }
+        var domStorage = this._domStorageForId(storageId);
+        if (domStorage) {
+            this.showDOMStorage(domStorage);
+            domStorage._domStorageTreeElement.select();
         }
     },
 
@@ -207,7 +223,7 @@ WebInspector.DatabasesPanel.prototype = {
         this.storageViewStatusBarItemsContainer.removeChildren();
         var statusBarItems = view.statusBarItems || [];
         for (var i = 0; i < statusBarItems.length; ++i)
-            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
+            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i].element);
     },
 
     showDOMStorage: function(domStorage)
@@ -235,6 +251,27 @@ WebInspector.DatabasesPanel.prototype = {
             this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
     },
 
+    showCookies: function(cookieDomain)
+    {
+        if (this.visibleView)
+            this.visibleView.hide();
+
+        var view = this._cookieViews[cookieDomain];
+        if (!view) {
+            view = new WebInspector.CookieItemsView(cookieDomain);
+            this._cookieViews[cookieDomain] = view;
+        }
+
+        view.show(this.storageViews);
+
+        this.visibleView = view;
+
+        this.storageViewStatusBarItemsContainer.removeChildren();
+        var statusBarItems = view.statusBarItems;
+        for (var i = 0; i < statusBarItems.length; ++i)
+            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
+    },
+
     closeVisibleView: function()
     {
         if (this.visibleView)
@@ -253,34 +290,39 @@ WebInspector.DatabasesPanel.prototype = {
             return;
 
         var tableNamesHash = {};
-        var tableNames = database.tableNames;
-        var tableNamesLength = tableNames.length;
-        for (var i = 0; i < tableNamesLength; ++i)
-            tableNamesHash[tableNames[i]] = true;
-
-        for (var tableName in database._tableViews) {
-            if (!(tableName in tableNamesHash)) {
-                if (this.visibleView === database._tableViews[tableName])
-                    this.closeVisibleView();
-                delete database._tableViews[tableName];
+        var self = this;
+        function tableNamesCallback(tableNames)
+        {
+            var tableNamesLength = tableNames.length;
+            for (var i = 0; i < tableNamesLength; ++i)
+                tableNamesHash[tableNames[i]] = true;
+
+            for (var tableName in database._tableViews) {
+                if (!(tableName in tableNamesHash)) {
+                    if (self.visibleView === database._tableViews[tableName])
+                        self.closeVisibleView();
+                    delete database._tableViews[tableName];
+                }
             }
         }
+        database.getTableNames(tableNamesCallback);
     },
 
-    dataGridForResult: function(result)
+    dataGridForResult: function(rows)
     {
-        if (!result.rows.length)
+        if (!rows.length)
             return null;
 
         var columns = {};
+        var numColumns = 0;
 
-        var rows = result.rows;
-        for (var columnIdentifier in rows.item(0)) {
+        for (var columnIdentifier in rows[0]) {
             var column = {};
             column.width = columnIdentifier.length;
             column.title = columnIdentifier;
 
             columns[columnIdentifier] = column;
+            ++numColumns;
         }
 
         var nodes = [];
@@ -288,12 +330,9 @@ WebInspector.DatabasesPanel.prototype = {
         for (var i = 0; i < length; ++i) {
             var data = {};
 
-            var row = rows.item(i);
+            var row = rows[i];
             for (var columnIdentifier in row) {
-                // FIXME: (Bug 19439) We should specially format SQL NULL here
-                // (which is represented by JavaScript null here, and turned
-                // into the string "null" by the String() function).
-                var text = String(row[columnIdentifier]);
+                var text = row[columnIdentifier];
                 data[columnIdentifier] = text;
                 if (text.length > columns[columnIdentifier].width)
                     columns[columnIdentifier].width = text.length;
@@ -309,7 +348,7 @@ WebInspector.DatabasesPanel.prototype = {
             totalColumnWidths += columns[columnIdentifier].width;
 
         // Calculate the percentage width for the columns.
-        const minimumPrecent = 5;
+        const minimumPrecent = Math.min(5, Math.floor(100/numColumns));
         var recoupPercent = 0;
         for (var columnIdentifier in columns) {
             var width = columns[columnIdentifier].width;
@@ -346,61 +385,6 @@ WebInspector.DatabasesPanel.prototype = {
         return dataGrid;
     },
 
-    dataGridForDOMStorage: function(domStorage)
-    {
-        if (!domStorage.length)
-            return null;
-
-        var columns = {};
-        columns[0] = {};
-        columns[1] = {};
-        columns[0].title = WebInspector.UIString("Key");
-        columns[0].width = columns[0].title.length;
-        columns[1].title = WebInspector.UIString("Value");
-        columns[1].width = columns[0].title.length;
-
-        var nodes = [];
-        
-        var length = domStorage.length;
-        for (var index = 0; index < domStorage.length; index++) {
-            var data = {};
-       
-            var key = String(domStorage.key(index));
-            data[0] = key;
-            if (key.length > columns[0].width)
-                columns[0].width = key.length;
-        
-            var value = String(domStorage.getItem(key));
-            data[1] = value;
-            if (value.length > columns[1].width)
-                columns[1].width = value.length;
-            var node = new WebInspector.DataGridNode(data, false);
-            node.selectable = true;
-            nodes.push(node);
-        }
-
-        var totalColumnWidths = columns[0].width + columns[1].width;
-        width = Math.round((columns[0].width * 100) / totalColumnWidths);
-        const minimumPrecent = 10;
-        if (width < minimumPrecent)
-            width = minimumPrecent;
-        if (width > 100 - minimumPrecent)
-            width = 100 - minimumPrecent;
-        columns[0].width = width;
-        columns[1].width = 100 - width;
-        columns[0].width += "%";
-        columns[1].width += "%";
-
-        var dataGrid = new WebInspector.DOMStorageDataGrid(columns);
-        var length = nodes.length;
-        for (var i = 0; i < length; ++i)
-            dataGrid.appendChild(nodes[i]);
-        dataGrid.addCreationNode(false);
-        if (length > 0)
-            nodes[0].selected = true;
-        return dataGrid;
-    },
-    
     resize: function()
     {
         var visibleView = this.visibleView;
@@ -408,44 +392,28 @@ WebInspector.DatabasesPanel.prototype = {
             visibleView.resize();
     },
 
-    _registerStorageEventListener: function()
+    updateDOMStorage: function(storageId)
     {
-        var inspectedWindow = InspectorController.inspectedWindow();
-        if (!inspectedWindow || !inspectedWindow.document)
-            return;
-
-        this._storageEventListener = InspectorController.wrapCallback(this._storageEvent.bind(this));
-        inspectedWindow.addEventListener("storage", this._storageEventListener, true);
-    },
-
-    _unregisterStorageEventListener: function()
-    {
-        if (!this._storageEventListener)
-            return;
-
-        var inspectedWindow = InspectorController.inspectedWindow();
-        if (!inspectedWindow || !inspectedWindow.document)
+        var domStorage = this._domStorageForId(storageId);
+        if (!domStorage)
             return;
 
-        inspectedWindow.removeEventListener("storage", this._storageEventListener, true);
-        delete this._storageEventListener;
+        var view = domStorage._domStorageView;
+        if (this.visibleView && view === this.visibleView)
+            domStorage._domStorageView.update();
     },
 
-    _storageEvent: function(event)
+    _domStorageForId: function(storageId)
     {
         if (!this._domStorage)
-            return;
-
-        var isLocalStorage = (event.storageArea === InspectorController.inspectedWindow().localStorage);
+            return null;
         var domStorageLength = this._domStorage.length;
         for (var i = 0; i < domStorageLength; ++i) {
             var domStorage = this._domStorage[i];
-            if (isLocalStorage === domStorage.isLocalStorage) {
-                var view = domStorage._domStorageView;
-                if (this.visibleView && view === this.visibleView)
-                    domStorage._domStorageView.update();
-            }
+            if (domStorage.id == storageId)
+                return domStorage;
         }
+        return null;
     },
 
     _startSidebarDragging: function(event)
@@ -494,7 +462,7 @@ WebInspector.DatabasesPanel.prototype = {
     }
 }
 
-WebInspector.DatabasesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
+WebInspector.StoragePanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
 WebInspector.DatabaseSidebarTreeElement = function(database)
 {
@@ -508,7 +476,7 @@ WebInspector.DatabaseSidebarTreeElement = function(database)
 WebInspector.DatabaseSidebarTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.databases.showDatabase(this.database);
+        WebInspector.panels.storage.showDatabase(this.database);
     },
 
     oncollapse: function()
@@ -522,10 +490,14 @@ WebInspector.DatabaseSidebarTreeElement.prototype = {
     {
         this.removeChildren();
 
-        var tableNames = this.database.tableNames;
-        var tableNamesLength = tableNames.length;
-        for (var i = 0; i < tableNamesLength; ++i)
-            this.appendChild(new WebInspector.SidebarDatabaseTableTreeElement(this.database, tableNames[i]));
+        var self = this;
+        function tableNamesCallback(tableNames)
+        {
+            var tableNamesLength = tableNames.length;
+            for (var i = 0; i < tableNamesLength; ++i)
+                self.appendChild(new WebInspector.SidebarDatabaseTableTreeElement(self.database, tableNames[i]));
+        }
+        this.database.getTableNames(tableNamesCallback);
     },
 
     get mainTitle()
@@ -562,18 +534,18 @@ WebInspector.SidebarDatabaseTableTreeElement = function(database, tableName)
 WebInspector.SidebarDatabaseTableTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.databases.showDatabase(this.database, this.tableName);
+        WebInspector.panels.storage.showDatabase(this.database, this.tableName);
     }
 }
 
 WebInspector.SidebarDatabaseTableTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
 
-WebInspector.DOMStorageSidebarTreeElement = function(domStorage)
+WebInspector.DOMStorageSidebarTreeElement = function(domStorage, className)
 {
 
     this.domStorage = domStorage;
 
-    WebInspector.SidebarTreeElement.call(this, "domstorage-sidebar-tree-item", domStorage, "", null, false);
+    WebInspector.SidebarTreeElement.call(this, "domstorage-sidebar-tree-item " + className, domStorage, "", null, false);
 
     this.refreshTitles();
 }
@@ -581,7 +553,7 @@ WebInspector.DOMStorageSidebarTreeElement = function(domStorage)
 WebInspector.DOMStorageSidebarTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.databases.showDOMStorage(this.domStorage);
+        WebInspector.panels.storage.showDOMStorage(this.domStorage);
     },
 
     get mainTitle()
@@ -606,3 +578,30 @@ WebInspector.DOMStorageSidebarTreeElement.prototype = {
 }
 
 WebInspector.DOMStorageSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
+
+WebInspector.CookieSidebarTreeElement = function(cookieDomain)
+{
+    WebInspector.SidebarTreeElement.call(this, "cookie-sidebar-tree-item", cookieDomain, "", null, false);
+    this._cookieDomain = cookieDomain;
+
+    this.refreshTitles();
+}
+
+WebInspector.CookieSidebarTreeElement.prototype = {
+    onselect: function()
+    {
+        WebInspector.panels.storage.showCookies(this._cookieDomain);
+    },
+
+    get subtitle()
+    {
+        return "";
+    },
+
+    set subtitle(x)
+    {
+        // Do nothing.
+    }
+}
+
+WebInspector.CookieSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
diff --git a/WebCore/inspector/front-end/StylesSidebarPane.js b/WebCore/inspector/front-end/StylesSidebarPane.js
index 8a3a67f..3582f96 100644
--- a/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -30,6 +30,44 @@
 WebInspector.StylesSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Styles"));
+
+    this.settingsSelectElement = document.createElement("select");
+
+    var option = document.createElement("option");
+    option.value = "hex";
+    option.action = this._changeColorFormat.bind(this);
+    if (Preferences.colorFormat === "hex")
+        option.selected = true;
+    option.label = WebInspector.UIString("Hex Colors");
+    this.settingsSelectElement.appendChild(option);
+
+    option = document.createElement("option");
+    option.value = "rgb";
+    option.action = this._changeColorFormat.bind(this);
+    if (Preferences.colorFormat === "rgb")
+        option.selected = true;
+    option.label = WebInspector.UIString("RGB Colors");
+    this.settingsSelectElement.appendChild(option);
+
+    option = document.createElement("option");
+    option.value = "hsl";
+    option.action = this._changeColorFormat.bind(this);
+    if (Preferences.colorFormat === "hsl")
+        option.selected = true;
+    option.label = WebInspector.UIString("HSL Colors");
+    this.settingsSelectElement.appendChild(option);
+
+    this.settingsSelectElement.appendChild(document.createElement("hr"));
+
+    option = document.createElement("option");
+    option.action = this._createNewRule.bind(this);
+    option.label = WebInspector.UIString("New Style Rule");
+    this.settingsSelectElement.appendChild(option);
+
+    this.settingsSelectElement.addEventListener("click", function(event) { event.stopPropagation() }, false);
+    this.settingsSelectElement.addEventListener("change", this._changeSetting.bind(this), false);
+
+    this.titleElement.appendChild(this.settingsSelectElement);
 }
 
 WebInspector.StylesSidebarPane.prototype = {
@@ -64,13 +102,15 @@ WebInspector.StylesSidebarPane.prototype = {
             return;
 
         var self = this;
-        var callback = function(styles) {
+        function callback(styles)
+        {
             if (!styles)
                 return;
-            var nodeWrapper = WebInspector.wrapNodeWithStyles(node, styles);
-            self._update(refresh, body, nodeWrapper, editedSection, forceUpdate);
-        };
-        InspectorController.getStyles(node, !Preferences.showUserAgentStyles, callback);
+            node._setStyles(styles.computedStyle, styles.inlineStyle, styles.styleAttributes, styles.matchedCSSRules);
+            self._update(refresh, body, node, editedSection, forceUpdate);
+        }
+
+        InjectedScriptAccess.getStyles(node.id, !Preferences.showUserAgentStyles, callback);
     },
 
     _update: function(refresh, body, node, editedSection, forceUpdate)
@@ -85,7 +125,7 @@ WebInspector.StylesSidebarPane.prototype = {
         if (refresh) {
             for (var i = 0; i < this.sections.length; ++i) {
                 var section = this.sections[i];
-                if (section._blank)
+                if (section instanceof WebInspector.BlankStylePropertiesSection)
                     continue;
                 if (section.computedStyle)
                     section.styleRule.style = node.ownerDocument.defaultView.getComputedStyle(node);
@@ -269,41 +309,64 @@ WebInspector.StylesSidebarPane.prototype = {
                 body.appendChild(section.element);
                 this.sections.push(section);
             }
+        }
+    },
 
-            this.addBlankSection();
+    _changeSetting: function(event)
+    {
+        var options = this.settingsSelectElement.options;
+        var selectedOption = options[this.settingsSelectElement.selectedIndex];
+        selectedOption.action(event);
+
+        // Select the correct color format setting again, since it needs to be selected.
+        var selectedIndex = 0;
+        for (var i = 0; i < options.length; ++i) {
+            if (options[i].value === Preferences.colorFormat) {
+                selectedIndex = i;
+                break;
+            }
         }
+
+        this.settingsSelectElement.selectedIndex = selectedIndex;
     },
 
-    addBlankSection: function()
+    _changeColorFormat: function(event)
     {
-        var blankSection = new WebInspector.BlankStylePropertiesSection();
-        blankSection.pane = this;
+        var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
+        Preferences.colorFormat = selectedOption.value;
+
+        InspectorController.setSetting("color-format", Preferences.colorFormat);
 
-        this.bodyElement.insertBefore(blankSection.element, this.bodyElement.firstChild.nextSibling.nextSibling); // 0 is computed, 1 is element.style
-        var computed = this.sections.shift();
-        var elementStyle = this.sections.shift();
-        this.sections.unshift(blankSection);
-        this.sections.unshift(elementStyle);
-        this.sections.unshift(computed);
+        for (var i = 0; i < this.sections.length; ++i)
+            this.sections[i].update(true);
     },
 
-    appropriateSelectorForNode: function()
+    _createNewRule: function(event)
     {
-        var node = this.node;
-        if (!node)
-            return;
+        this.addBlankSection().startEditingSelector();
+    },
 
-        if (node.id)
-            return "#" + node.id;
+    addBlankSection: function()
+    {
+        var blankSection = new WebInspector.BlankStylePropertiesSection(appropriateSelectorForNode(this.node, true));
+        blankSection.pane = this;
 
-        if (node.className)
-            return "." + node.className.replace(/\s+/, ".");
+        var elementStyleSection = this.sections[1];        
+        this.bodyElement.insertBefore(blankSection.element, elementStyleSection.element.nextSibling);
 
-        var nodeName = node.nodeName.toLowerCase();
-        if (nodeName === "input" && node.type)
-            return nodeName + "[type=\"" + node.type + "\"]";
+        this.sections.splice(2, 0, blankSection);
 
-        return nodeName;
+        return blankSection;
+    },
+
+    removeSection: function(section)
+    {
+        var index = this.sections.indexOf(section);
+        if (index === -1)
+            return;
+        this.sections.splice(index, 1);
+        if (section.element.parentNode)
+            section.element.parentNode.removeChild(section.element);
     }
 }
 
@@ -312,6 +375,7 @@ WebInspector.StylesSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.pr
 WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyle, usedProperties, editable)
 {
     WebInspector.PropertiesSection.call(this, styleRule.selectorText);
+
     this.titleElement.addEventListener("click", function(e) { e.stopPropagation(); }, false);
     this.titleElement.addEventListener("dblclick", this._dblclickSelector.bind(this), false);
     this.element.addEventListener("dblclick", this._dblclickEmptySpace.bind(this), false);
@@ -322,8 +386,9 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
     this.editable = (editable && !computedStyle);
 
     // Prevent editing the user agent and user rules.
-    var isUserAgent = this.styleRule.isUserAgent;
-    var isUser = this.styleRule.isUser;
+    var isUserAgent = this.rule && this.rule.isUserAgent;
+    var isUser = this.rule && this.rule.isUser;
+    var isViaInspector = this.rule && this.rule.isViaInspector;
 
     if (isUserAgent || isUser)
         this.editable = false;
@@ -366,7 +431,7 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
                 subtitle = WebInspector.UIString("user agent stylesheet");
             else if (isUser)
                 subtitle = WebInspector.UIString("user stylesheet");
-            else if (this.styleRule.parentStyleSheet === WebInspector.panels.elements.stylesheet)
+            else if (isViaInspector)
                 subtitle = WebInspector.UIString("via inspector");
             else
                 subtitle = WebInspector.UIString("inline stylesheet");
@@ -394,9 +459,6 @@ WebInspector.StylePropertiesSection.prototype = {
 
     expand: function(dontRememberState)
     {
-        if (this._blank)
-            return;
-
         WebInspector.PropertiesSection.prototype.expand.call(this);
         if (dontRememberState)
             return;
@@ -559,8 +621,7 @@ WebInspector.StylePropertiesSection.prototype = {
         if (WebInspector.isBeingEdited(element))
             return;
 
-        var context = this.styleRule.selectorText;
-        WebInspector.startEditing(this.titleElement, this.editingSelectorCommitted.bind(this), this.editingSelectorCancelled.bind(this), context);
+        WebInspector.startEditing(this.titleElement, this.editingSelectorCommitted.bind(this), this.editingSelectorCancelled.bind(this), null);
         window.getSelection().setBaseAndExtent(element, 0, element, 1);
     },
 
@@ -583,10 +644,10 @@ WebInspector.StylePropertiesSection.prototype = {
             return moveToNextIfNeeded.call(this);
 
         var self = this;
-        var callback = function(result) {
+        function callback(result)
+        {
             if (!result) {
                 // Invalid Syntax for a Selector
-                self.editingSelectorCancelled(element, context);
                 moveToNextIfNeeded.call(self);
                 return;
             }
@@ -604,84 +665,61 @@ WebInspector.StylePropertiesSection.prototype = {
             var newRule = WebInspector.CSSStyleDeclaration.parseRule(newRulePayload);
             self.rule = newRule;
             self.styleRule = { section: self, style: newRule.style, selectorText: newRule.selectorText, parentStyleSheet: newRule.parentStyleSheet, rule: newRule };
+
             var oldIdentifier = this.identifier;
             self.identifier = newRule.selectorText + ":" + self.subtitleElement.textContent;
-            self.pane.update(null, true);
+
+            self.pane.update();
+
             WebInspector.panels.elements.renameSelector(oldIdentifier, this.identifier, oldContent, newContent);
-            moveToNextIfNeeded.call(self);
-        };
 
-        InspectorController.applyStyleRuleText(this.rule._id, newContent, this.pane.node, callback);
-    },
+            moveToNextIfNeeded.call(self);
+        }
 
-    editingSelectorCancelled: function(element, context)
-    {
-        element.textContent = context;
+        InjectedScriptAccess.applyStyleRuleText(this.rule.id, newContent, this.pane.node.id, callback);
     },
 
-    _doesSelectorAffectSelectedNode: function(selector)
+    editingSelectorCancelled: function()
     {
-        var selectedNode = this.pane.node;
-        var nodes = selectedNode.ownerDocument.querySelectorAll(selector);
-        for (var i = 0; i < nodes.length; ++i) {
-            if (nodes[i] === selectedNode)
-                return true;
-        }
-
-        return false;
+        // Do nothing, this is overridden by BlankStylePropertiesSection.
     }
 }
 
 WebInspector.StylePropertiesSection.prototype.__proto__ = WebInspector.PropertiesSection.prototype;
 
-WebInspector.BlankStylePropertiesSection = function()
+WebInspector.BlankStylePropertiesSection = function(defaultSelectorText)
 {
-    WebInspector.PropertiesSection.call(this, WebInspector.UIString("Double-Click to Add"), null);
+    WebInspector.StylePropertiesSection.call(this, {selectorText: defaultSelectorText, rule: {isViaInspector: true}}, "", false, {}, false);
 
-    this._blank = true;
-    this._dblclickListener = this._dblclick.bind(this);
     this.element.addStyleClass("blank-section");
-    this.titleElement.addStyleClass("blank-title");
-    this.titleElement.addEventListener("click", function(e) { e.stopPropagation(); }, false);
-    this.titleElement.addEventListener("dblclick", this._dblclickListener, false);
 }
 
 WebInspector.BlankStylePropertiesSection.prototype = {
-    _dblclick: function(event)
-    {
-        this.startEditing();
-    },
-
-    startEditing: function()
-    {
-        var element = this.titleElement;
-        if (WebInspector.isBeingEdited(element))
-            return;
-
-        this.titleElement.textContent = this.pane.appropriateSelectorForNode();
-        this.titleElement.removeStyleClass("blank-title");
-        WebInspector.startEditing(this.titleElement, this.editingCommitted.bind(this), this.editingCancelled.bind(this), "");
-        window.getSelection().setBaseAndExtent(element, 0, element, 1);
-    },
-
-    editingCancelled: function()
+    expand: function()
     {
-        this.titleElement.textContent = WebInspector.UIString("Double-Click to Add");
-        this.titleElement.addStyleClass("blank-title");
+        // Do nothing, blank sections are not expandable.
     },
 
-    editingCommitted: function(element, newContent, oldContent, context)
+    editingSelectorCommitted: function(element, newContent, oldContent, context)
     {
         var self = this;
-        var callback = function(styleRule) {
-            if (!styleRule) {
+        function callback(result)
+        {
+            if (!result) {
                 // Invalid Syntax for a Selector
-                self.editingCancelled();
+                self.editingSelectorCancelled();
                 return;
             }
-            self.makeNormal(WebInspector.CSSStyleDeclaration.parseRule(styleRule));
 
-            if (!self._doesSelectorAffectSelectedNode(newContent)) {
+            var rule = result[0];
+            var doesSelectorAffectSelectedNode = result[1];
+
+            var styleRule = WebInspector.CSSStyleDeclaration.parseRule(rule);
+            styleRule.rule = rule;
+
+            self.makeNormal(styleRule);
+
+            if (!doesSelectorAffectSelectedNode) {
                 self.noAffect = true;
                 self.element.addStyleClass("no-affect");
             }
@@ -689,31 +727,28 @@ WebInspector.BlankStylePropertiesSection.prototype = {
             self.subtitleElement.textContent = WebInspector.UIString("via inspector");
             self.expand();
 
-            self.pane.addBlankSection();
             self.addNewBlankProperty().startEditing();
-        };
-        InspectorController.addStyleSelector(newContent, callback);
+        }
+
+        InjectedScriptAccess.addStyleSelector(newContent, this.pane.node.id, callback);
+    },
+
+    editingSelectorCancelled: function()
+    {
+        this.pane.removeSection(this);
     },
 
     makeNormal: function(styleRule)
     {
-        this.titleElement.removeEventListener("dblclick", this._dblclickListener, false);
-        this.titleElement.addEventListener("dblclick", this._dblclickSelector.bind(this), false);
-        this.element.addEventListener("dblclick", this._dblclickEmptySpace.bind(this), false);
         this.element.removeStyleClass("blank-section");
-        delete this._blank;
-        delete this._dblclick;
-        delete this.startEditing;
-        delete this.editingCancelled;
-        delete this.editingCommitted;
-        delete this._dblclickListener;
-        delete this.makeNormal;
+
         this.styleRule = styleRule;
         this.rule = styleRule.rule;
         this.computedStyle = false;
         this.editable = true;
-        this.identifier = styleRule.selectorText + ":inspector";
-        // leftovers are: this.noAffect if applicable
+        this.identifier = styleRule.selectorText + ":via inspector";
+
+        this.__proto__ = WebInspector.StylePropertiesSection.prototype;
     }
 }
 
@@ -794,49 +829,14 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
     updateTitle: function()
     {
-        // "Nicknames" for some common values that are easier to read.
-        var valueNicknames = {
-            "rgb(0, 0, 0)": "black",
-            "#000": "black",
-            "#000000": "black",
-            "rgb(255, 255, 255)": "white",
-            "#fff": "white",
-            "#ffffff": "white",
-            "#FFF": "white",
-            "#FFFFFF": "white",
-            "rgba(0, 0, 0, 0)": "transparent",
-            "rgb(255, 0, 0)": "red",
-            "rgb(0, 255, 0)": "lime",
-            "rgb(0, 0, 255)": "blue",
-            "rgb(255, 255, 0)": "yellow",
-            "rgb(255, 0, 255)": "magenta",
-            "rgb(0, 255, 255)": "cyan"
-        };
-
         var priority = this.priority;
         var value = this.value;
-        var htmlValue = value;
 
         if (priority && !priority.length)
             delete priority;
         if (priority)
             priority = "!" + priority;
 
-        if (value) {
-            var urls = value.match(/url\([^)]+\)/);
-            if (urls) {
-                for (var i = 0; i < urls.length; ++i) {
-                    var url = urls[i].substring(4, urls[i].length - 1);
-                    htmlValue = htmlValue.replace(urls[i], "url(" + WebInspector.linkifyURL(url) + ")");
-                }
-            } else {
-                if (value in valueNicknames)
-                    htmlValue = valueNicknames[value];
-                htmlValue = htmlValue.escapeHTML();
-            }
-        } else
-            htmlValue = value = "";
-
         this.updateState();
 
         var enabledCheckboxElement = document.createElement("input");
@@ -852,113 +852,156 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
         var valueElement = document.createElement("span");
         valueElement.className = "value";
-        valueElement.innerHTML = htmlValue;
         this.valueElement = valueElement;
 
-        if (priority) {
-            var priorityElement = document.createElement("span");
-            priorityElement.className = "priority";
-            priorityElement.textContent = priority;
-        }
-
-        this.listItemElement.removeChildren();
-
-        // Append the checkbox for root elements of an editable section.
-        if (this.treeOutline.section && this.treeOutline.section.editable && this.parent.root)
-            this.listItemElement.appendChild(enabledCheckboxElement);
-        this.listItemElement.appendChild(nameElement);
-        this.listItemElement.appendChild(document.createTextNode(": "));
-        this.listItemElement.appendChild(valueElement);
+        if (value) {
+            function processValue(regex, processor, nextProcessor, valueText)
+            {
+                var container = document.createDocumentFragment();
+
+                var items = valueText.replace(regex, "\0$1\0").split("\0");
+                for (var i = 0; i < items.length; ++i) {
+                    if ((i % 2) === 0) {
+                        if (nextProcessor)
+                            container.appendChild(nextProcessor(items[i]));
+                        else
+                            container.appendChild(document.createTextNode(items[i]));
+                    } else {
+                        var processedNode = processor(items[i]);
+                        if (processedNode)
+                            container.appendChild(processedNode);
+                    }
+                }
 
-        if (priorityElement) {
-            this.listItemElement.appendChild(document.createTextNode(" "));
-            this.listItemElement.appendChild(priorityElement);
-        }
+                return container;
+            }
 
-        this.listItemElement.appendChild(document.createTextNode(";"));
+            function linkifyURL(url)
+            {
+                var container = document.createDocumentFragment();
+                container.appendChild(document.createTextNode("url("));
+                container.appendChild(WebInspector.linkifyURLAsNode(url, url, null, (url in WebInspector.resourceURLMap)));
+                container.appendChild(document.createTextNode(")"));
+                return container;
+            }
 
-        if (value) {
-            // FIXME: this only covers W3C and CSS 16 valid color names
-            var colors = value.match(/((rgb|hsl)a?\([^)]+\))|(#[0-9a-fA-F]{6})|(#[0-9a-fA-F]{3})|aqua|black|blue|fuchsia|gray|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow|transparent/g);
-            var swatch;
-            if (colors) {
-                var colorsLength = colors.length;
-                for (var i = 0; i < colorsLength; ++i) {
-                    var swatchElement = document.createElement("span");
-                    swatchElement.className = "swatch";
-                    swatchElement.style.setProperty("background-color", colors[i]);
-                    this.listItemElement.appendChild(swatchElement);
-                    swatch = swatchElement;
+            function processColor(text)
+            {
+                try {
+                    var color = new WebInspector.Color(text);
+                } catch (e) {
+                    return document.createTextNode(text);
                 }
-            }
 
-            // Rotate through Color Representations by Clicking on the Swatch
-            // Simple: rgb -> hsl -> nickname? -> shorthex? -> hex -> ...
-            // Advanced: rgba -> hsla -> nickname? -> ...            
-            if (colors && colors.length === 1) {
-                var color = new WebInspector.Color(htmlValue);
-                swatch.addEventListener("click", changeColorDisplay, false);
-                swatch.addEventListener("dblclick", function(event) {
-                    event.stopPropagation();
-                }, false);
-
-                var mode = color.mode;
-                var valueElement = this.valueElement;
-                function changeColorDisplay(event) {
-
-                    function changeTo(newMode, content) {
-                        mode = newMode;
-                        valueElement.textContent = content;
-                    }
+                var swatchElement = document.createElement("span");
+                swatchElement.title = WebInspector.UIString("Click to change color format");
+                swatchElement.className = "swatch";
+                swatchElement.style.setProperty("background-color", text);
+
+                swatchElement.addEventListener("click", changeColorDisplay, false);
+                swatchElement.addEventListener("dblclick", function(event) { event.stopPropagation() }, false);
+
+                var format;
+                if (Preferences.showColorNicknames && color.nickname)
+                    format = "nickname";
+                else if (Preferences.colorFormat === "rgb")
+                    format = (color.simple ? "rgb" : "rgba");
+                else if (Preferences.colorFormat === "hsl")
+                    format = (color.simple ? "hsl" : "hsla");
+                else if (color.simple)
+                    format = (color.hasShortHex() ? "shorthex" : "hex");
+                else
+                    format = "rgba";
 
-                    switch (mode) {
+                var colorValueElement = document.createElement("span");
+                colorValueElement.textContent = color.toString(format);
+
+                function changeColorDisplay(event)
+                {
+                    switch (format) {
                         case "rgb":
-                            changeTo("hsl", color.toHsl());
+                            format = "hsl";
                             break;
 
                         case "shorthex":
-                            changeTo("hex", color.toHex());
+                            format = "hex";
                             break;
 
                         case "hex":
-                            changeTo("rgb", color.toRgb());
+                            format = "rgb";
                             break;
 
                         case "nickname":
                             if (color.simple) {
                                 if (color.hasShortHex())
-                                    changeTo("shorthex", color.toShortHex());
+                                    format = "shorthex";
                                 else
-                                    changeTo("hex", color.toHex());
-                            } else
-                                changeTo("rgba", color.toRgba());
+                                    format = "hex";
+                                break;
+                            }
+
+                            format = "rgba";
                             break;
 
                         case "hsl":
                             if (color.nickname)
-                                changeTo("nickname", color.toNickname());
+                                format = "nickname";
                             else if (color.hasShortHex())
-                                changeTo("shorthex", color.toShortHex());
+                                format = "shorthex";
                             else
-                                changeTo("hex", color.toHex());
+                                format = "hex";
                             break;
 
                         case "rgba":
-                            changeTo("hsla", color.toHsla());
+                            format = "hsla";
                             break;
 
                         case "hsla":
                             if (color.nickname)
-                                changeTo("nickname", color.toNickname());
+                                format = "nickname";
                             else
-                                changeTo("rgba", color.toRgba());
+                                format = "rgba";
                             break;
                     }
+
+                    colorValueElement.textContent = color.toString(format);
                 }
+
+                var container = document.createDocumentFragment();
+                container.appendChild(swatchElement);
+                container.appendChild(colorValueElement);
+                return container;
             }
+
+            var colorRegex = /((?:rgb|hsl)a?\([^)]+\)|#[0-9a-fA-F]{6}|#[0-9a-fA-F]{3}|\b\w+\b)/g;
+            var colorProcessor = processValue.bind(window, colorRegex, processColor, null);
+
+            valueElement.appendChild(processValue(/url\(([^)]+)\)/g, linkifyURL, colorProcessor, value));
+        }
+
+        if (priority) {
+            var priorityElement = document.createElement("span");
+            priorityElement.className = "priority";
+            priorityElement.textContent = priority;
+        }
+
+        this.listItemElement.removeChildren();
+
+        // Append the checkbox for root elements of an editable section.
+        if (this.treeOutline.section && this.treeOutline.section.editable && this.parent.root)
+            this.listItemElement.appendChild(enabledCheckboxElement);
+        this.listItemElement.appendChild(nameElement);
+        this.listItemElement.appendChild(document.createTextNode(": "));
+        this.listItemElement.appendChild(valueElement);
+
+        if (priorityElement) {
+            this.listItemElement.appendChild(document.createTextNode(" "));
+            this.listItemElement.appendChild(priorityElement);
         }
 
-        this.tooltip = this.name + ": " + (valueNicknames[value] || value) + (priority ? " " + priority : "");
+        this.listItemElement.appendChild(document.createTextNode(";"));
+
+        this.tooltip = this.name + ": " + valueElement.textContent + (priority ? " " + priority : "");
     },
 
     updateAll: function(updateAllRules)
@@ -976,7 +1019,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
         var disabled = !event.target.checked;
 
         var self = this;
-        var callback = function(newPayload) {
+        function callback(newPayload)
+        {
             if (!newPayload)
                 return;
 
@@ -991,8 +1035,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 self.treeOutline.section.pane.dispatchEventToListeners("style property toggled");
 
             self.updateAll(true);
-        };
-        InspectorController.toggleStyleEnabled(this.style._id, this.name, disabled, callback);
+        }
+
+        InjectedScriptAccess.toggleStyleEnabled(this.style.id, this.name, disabled, callback);
     },
 
     updateState: function()
@@ -1155,7 +1200,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         } else {
             // Restore the original CSS text before applying user changes. This is needed to prevent
             // new properties from sticking around if the user adds one, then removes it.
-            InspectorController.setStyleText(this.style, this.originalCSSText);
+            InjectedScriptAccess.setStyleText(this.style.id, this.originalCSSText);
         }
 
         this.applyStyleText(this.listItemElement.textContent);
@@ -1175,7 +1220,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (this._newProperty)
             this.treeOutline.removeChild(this);
         else if (this.originalCSSText) {
-            InspectorController.setStyleText(this.style, this.originalCSSText);
+            InjectedScriptAccess.setStyleText(this.style.id, this.originalCSSText);
 
             if (this.treeOutline.section && this.treeOutline.section.pane)
                 this.treeOutline.section.pane.dispatchEventToListeners("style edited");
@@ -1210,7 +1255,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
             moveToNextCallback(this._newProperty, false, this.treeOutline.section, false);
 
         // The Callback to start editing the next property
-        function moveToNextCallback(alreadyNew, valueChanged, section) {
+        function moveToNextCallback(alreadyNew, valueChanged, section)
+        {
             if (!moveDirection)
                 return;
 
@@ -1249,21 +1295,19 @@ WebInspector.StylePropertyTreeElement.prototype = {
         var section = this.treeOutline.section;
         var elementsPanel = WebInspector.panels.elements;
         var styleTextLength = styleText.trimWhitespace().length;
-        if (!styleTextLength) {
-            if (updateInterface) {
+        if (!styleTextLength && updateInterface) {
+            if (this._newProperty) {
                 // The user deleted everything, so remove the tree element and update.
-                if (!this._newProperty)
-                    delete section._afterUpdate;
-                if (section && section.pane)
-                    section.pane.update();
                 this.parent.removeChild(this);
-                elementsPanel.removeStyleChange(section.identifier, this.style, this.name);
+                return;
+            } else {
+                delete section._afterUpdate;
             }
-            return;
         }
 
         var self = this;
-        var callback = function(result) {
+        function callback(result)
+        {
             if (!result) {
                 // The user typed something, but it didn't parse. Just abort and restore
                 // the original title for this property.  If this was a new attribute and
@@ -1281,10 +1325,16 @@ WebInspector.StylePropertyTreeElement.prototype = {
             var changedProperties = result[1];
             elementsPanel.removeStyleChange(section.identifier, self.style, self.name);
 
-            self.style = WebInspector.CSSStyleDeclaration.parseStyle(newPayload);
-            for (var i = 0; i < changedProperties.length; ++i)
-                elementsPanel.addStyleChange(section.identifier, self.style, changedProperties[i]);
-            self._styleRule.style = self.style;
+            if (!styleTextLength) {
+                // Do remove ourselves from UI when the property removal is confirmed.
+                self.parent.removeChild(self);
+            } else {
+                self.style = WebInspector.CSSStyleDeclaration.parseStyle(newPayload);
+                for (var i = 0; i < changedProperties.length; ++i)
+                    elementsPanel.addStyleChange(section.identifier, self.style, changedProperties[i]);
+                self._styleRule.style = self.style;
+            }
+
             if (section && section.pane)
                 section.pane.dispatchEventToListeners("style edited");
 
@@ -1293,8 +1343,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
             if (!self.rule)
                 WebInspector.panels.elements.treeOutline.update();
-        };
-        InspectorController.applyStyleText(this.style._id, styleText.trimWhitespace(), this.name, callback);
+        }
+
+        InjectedScriptAccess.applyStyleText(this.style.id, styleText.trimWhitespace(), this.name, callback);
     }
 }
 
diff --git a/WebCore/inspector/front-end/SummaryBar.js b/WebCore/inspector/front-end/SummaryBar.js
new file mode 100644
index 0000000..bbf2b1a
--- /dev/null
+++ b/WebCore/inspector/front-end/SummaryBar.js
@@ -0,0 +1,364 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.SummaryBar = function(categories)
+{
+    this.categories = categories;
+
+    this.element = document.createElement("div");
+    this.element.className = "summary-bar";
+
+    this.graphElement = document.createElement("canvas");
+    this.graphElement.setAttribute("width", "450");
+    this.graphElement.setAttribute("height", "38");
+    this.graphElement.className = "summary-graph";
+    this.element.appendChild(this.graphElement);
+
+    this.legendElement = document.createElement("div");
+    this.legendElement.className = "summary-graph-legend";
+    this.element.appendChild(this.legendElement);
+}
+
+WebInspector.SummaryBar.prototype = {
+
+    get calculator() {
+        return this._calculator;
+    },
+
+    set calculator(x) {
+        this._calculator = x;
+    },
+
+    reset: function()
+    {
+        this.legendElement.removeChildren();
+        this._drawSummaryGraph();
+    },
+
+    update: function(data)
+    {
+        var graphInfo = this.calculator.computeSummaryValues(data);
+
+        var fillSegments = [];
+
+        this.legendElement.removeChildren();
+
+        for (var category in this.categories) {
+            var size = graphInfo.categoryValues[category];
+            if (!size)
+                continue;
+
+            var color = this.categories[category].color;
+            var colorString = "rgb(" + color.r + ", " + color.g + ", " + color.b + ")";
+
+            var fillSegment = {color: colorString, value: size};
+            fillSegments.push(fillSegment);
+
+            var legendLabel = this._makeLegendElement(this.categories[category].title, this.calculator.formatValue(size), colorString);
+            this.legendElement.appendChild(legendLabel);
+        }
+
+        if (graphInfo.total) {
+            var totalLegendLabel = this._makeLegendElement(WebInspector.UIString("Total"), this.calculator.formatValue(graphInfo.total));
+            totalLegendLabel.addStyleClass("total");
+            this.legendElement.appendChild(totalLegendLabel);
+        }
+
+        this._drawSummaryGraph(fillSegments);
+    },
+
+    _drawSwatch: function(canvas, color)
+    {
+        var ctx = canvas.getContext("2d");
+
+        function drawSwatchSquare() {
+            ctx.fillStyle = color;
+            ctx.fillRect(0, 0, 13, 13);
+
+            var gradient = ctx.createLinearGradient(0, 0, 13, 13);
+            gradient.addColorStop(0.0, "rgba(255, 255, 255, 0.2)");
+            gradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
+
+            ctx.fillStyle = gradient;
+            ctx.fillRect(0, 0, 13, 13);
+
+            gradient = ctx.createLinearGradient(13, 13, 0, 0);
+            gradient.addColorStop(0.0, "rgba(0, 0, 0, 0.2)");
+            gradient.addColorStop(1.0, "rgba(0, 0, 0, 0.0)");
+
+            ctx.fillStyle = gradient;
+            ctx.fillRect(0, 0, 13, 13);
+
+            ctx.strokeStyle = "rgba(0, 0, 0, 0.6)";
+            ctx.strokeRect(0.5, 0.5, 12, 12);
+        }
+
+        ctx.clearRect(0, 0, 13, 24);
+
+        drawSwatchSquare();
+
+        ctx.save();
+
+        ctx.translate(0, 25);
+        ctx.scale(1, -1);
+
+        drawSwatchSquare();
+
+        ctx.restore();
+
+        this._fadeOutRect(ctx, 0, 13, 13, 13, 0.5, 0.0);
+    },
+
+    _drawSummaryGraph: function(segments)
+    {
+        if (!segments || !segments.length) {
+            segments = [{color: "white", value: 1}];
+            this._showingEmptySummaryGraph = true;
+        } else
+            delete this._showingEmptySummaryGraph;
+
+        // Calculate the total of all segments.
+        var total = 0;
+        for (var i = 0; i < segments.length; ++i)
+            total += segments[i].value;
+
+        // Calculate the percentage of each segment, rounded to the nearest percent.
+        var percents = segments.map(function(s) { return Math.max(Math.round(100 * s.value / total), 1) });
+
+        // Calculate the total percentage.
+        var percentTotal = 0;
+        for (var i = 0; i < percents.length; ++i)
+            percentTotal += percents[i];
+
+        // Make sure our percentage total is not greater-than 100, it can be greater
+        // if we rounded up for a few segments.
+        while (percentTotal > 100) {
+            for (var i = 0; i < percents.length && percentTotal > 100; ++i) {
+                if (percents[i] > 1) {
+                    --percents[i];
+                    --percentTotal;
+                }
+            }
+        }
+
+        // Make sure our percentage total is not less-than 100, it can be less
+        // if we rounded down for a few segments.
+        while (percentTotal < 100) {
+            for (var i = 0; i < percents.length && percentTotal < 100; ++i) {
+                ++percents[i];
+                ++percentTotal;
+            }
+        }
+
+        var ctx = this.graphElement.getContext("2d");
+
+        var x = 0;
+        var y = 0;
+        var w = 450;
+        var h = 19;
+        var r = (h / 2);
+
+        function drawPillShadow()
+        {
+            // This draws a line with a shadow that is offset away from the line. The line is stroked
+            // twice with different X shadow offsets to give more feathered edges. Later we erase the
+            // line with destination-out 100% transparent black, leaving only the shadow. This only
+            // works if nothing has been drawn into the canvas yet.
+
+            ctx.beginPath();
+            ctx.moveTo(x + 4, y + h - 3 - 0.5);
+            ctx.lineTo(x + w - 4, y + h - 3 - 0.5);
+            ctx.closePath();
+
+            ctx.save();
+
+            ctx.shadowBlur = 2;
+            ctx.shadowColor = "rgba(0, 0, 0, 0.5)";
+            ctx.shadowOffsetX = 3;
+            ctx.shadowOffsetY = 5;
+
+            ctx.strokeStyle = "white";
+            ctx.lineWidth = 1;
+
+            ctx.stroke();
+
+            ctx.shadowOffsetX = -3;
+
+            ctx.stroke();
+
+            ctx.restore();
+
+            ctx.save();
+
+            ctx.globalCompositeOperation = "destination-out";
+            ctx.strokeStyle = "rgba(0, 0, 0, 1)";
+            ctx.lineWidth = 1;
+
+            ctx.stroke();
+
+            ctx.restore();
+        }
+
+        function drawPill()
+        {
+            // Make a rounded rect path.
+            ctx.beginPath();
+            ctx.moveTo(x, y + r);
+            ctx.lineTo(x, y + h - r);
+            ctx.quadraticCurveTo(x, y + h, x + r, y + h);
+            ctx.lineTo(x + w - r, y + h);
+            ctx.quadraticCurveTo(x + w, y + h, x + w, y + h - r);
+            ctx.lineTo(x + w, y + r);
+            ctx.quadraticCurveTo(x + w, y, x + w - r, y);
+            ctx.lineTo(x + r, y);
+            ctx.quadraticCurveTo(x, y, x, y + r);
+            ctx.closePath();
+
+            // Clip to the rounded rect path.
+            ctx.save();
+            ctx.clip();
+
+            // Fill the segments with the associated color.
+            var previousSegmentsWidth = 0;
+            for (var i = 0; i < segments.length; ++i) {
+                var segmentWidth = Math.round(w * percents[i] / 100);
+                ctx.fillStyle = segments[i].color;
+                ctx.fillRect(x + previousSegmentsWidth, y, segmentWidth, h);
+                previousSegmentsWidth += segmentWidth;
+            }
+
+            // Draw the segment divider lines.
+            ctx.lineWidth = 1;
+            for (var i = 1; i < 20; ++i) {
+                ctx.beginPath();
+                ctx.moveTo(x + (i * Math.round(w / 20)) + 0.5, y);
+                ctx.lineTo(x + (i * Math.round(w / 20)) + 0.5, y + h);
+                ctx.closePath();
+
+                ctx.strokeStyle = "rgba(0, 0, 0, 0.2)";
+                ctx.stroke();
+
+                ctx.beginPath();
+                ctx.moveTo(x + (i * Math.round(w / 20)) + 1.5, y);
+                ctx.lineTo(x + (i * Math.round(w / 20)) + 1.5, y + h);
+                ctx.closePath();
+
+                ctx.strokeStyle = "rgba(255, 255, 255, 0.2)";
+                ctx.stroke();
+            }
+
+            // Draw the pill shading.
+            var lightGradient = ctx.createLinearGradient(x, y, x, y + (h / 1.5));
+            lightGradient.addColorStop(0.0, "rgba(220, 220, 220, 0.6)");
+            lightGradient.addColorStop(0.4, "rgba(220, 220, 220, 0.2)");
+            lightGradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
+
+            var darkGradient = ctx.createLinearGradient(x, y + (h / 3), x, y + h);
+            darkGradient.addColorStop(0.0, "rgba(0, 0, 0, 0.0)");
+            darkGradient.addColorStop(0.8, "rgba(0, 0, 0, 0.2)");
+            darkGradient.addColorStop(1.0, "rgba(0, 0, 0, 0.5)");
+
+            ctx.fillStyle = darkGradient;
+            ctx.fillRect(x, y, w, h);
+
+            ctx.fillStyle = lightGradient;
+            ctx.fillRect(x, y, w, h);
+
+            ctx.restore();
+        }
+
+        ctx.clearRect(x, y, w, (h * 2));
+
+        drawPillShadow();
+        drawPill();
+
+        ctx.save();
+
+        ctx.translate(0, (h * 2) + 1);
+        ctx.scale(1, -1);
+
+        drawPill();
+
+        ctx.restore();
+
+        this._fadeOutRect(ctx, x, y + h + 1, w, h, 0.5, 0.0);
+    },
+
+    _fadeOutRect: function(ctx, x, y, w, h, a1, a2)
+    {
+        ctx.save();
+
+        var gradient = ctx.createLinearGradient(x, y, x, y + h);
+        gradient.addColorStop(0.0, "rgba(0, 0, 0, " + (1.0 - a1) + ")");
+        gradient.addColorStop(0.8, "rgba(0, 0, 0, " + (1.0 - a2) + ")");
+        gradient.addColorStop(1.0, "rgba(0, 0, 0, 1.0)");
+
+        ctx.globalCompositeOperation = "destination-out";
+
+        ctx.fillStyle = gradient;
+        ctx.fillRect(x, y, w, h);
+
+        ctx.restore();
+    },
+
+    _makeLegendElement: function(label, value, color)
+    {
+        var legendElement = document.createElement("label");
+        legendElement.className = "summary-graph-legend-item";
+
+        if (color) {
+            var swatch = document.createElement("canvas");
+            swatch.className = "summary-graph-legend-swatch";
+            swatch.setAttribute("width", "13");
+            swatch.setAttribute("height", "24");
+
+            legendElement.appendChild(swatch);
+
+            this._drawSwatch(swatch, color);
+        }
+
+        var labelElement = document.createElement("div");
+        labelElement.className = "summary-graph-legend-label";
+        legendElement.appendChild(labelElement);
+
+        var headerElement = document.createElement("div");
+        headerElement.className = "summary-graph-legend-header";
+        headerElement.textContent = label;
+        labelElement.appendChild(headerElement);
+
+        var valueElement = document.createElement("div");
+        valueElement.className = "summary-graph-legend-value";
+        valueElement.textContent = value;
+        labelElement.appendChild(valueElement);
+
+        return legendElement;
+    }
+}
+
+WebInspector.SummaryBar.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/WebCore/inspector/front-end/TextPrompt.js b/WebCore/inspector/front-end/TextPrompt.js
index 5ff774f..f73ab0d 100644
--- a/WebCore/inspector/front-end/TextPrompt.js
+++ b/WebCore/inspector/front-end/TextPrompt.js
@@ -252,7 +252,7 @@ WebInspector.TextPrompt.prototype = {
                 foundNextText = true;
             }
 
-            node = node.traverseNextNode(false, this.element);
+            node = node.traverseNextNode(this.element);
         }
 
         return true;
diff --git a/WebCore/inspector/front-end/TimelineAgent.js b/WebCore/inspector/front-end/TimelineAgent.js
new file mode 100644
index 0000000..6d18732
--- /dev/null
+++ b/WebCore/inspector/front-end/TimelineAgent.js
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelineAgent = function() {
+    // Not implemented.
+}
+
+// Must be kept in sync with TimelineItem.h
+WebInspector.TimelineAgent.ItemType = {
+    DOMDispatch       : 0,
+    Layout            : 1,
+    RecalculateStyles : 2,
+    Paint             : 3,
+    ParseHTML         : 4
+};
+
+WebInspector.addItemToTimeline = function(record) {
+    // Not implemented.
+}
+
+WebInspector.timelineWasEnabled = function() {
+    // Not implemented.
+}
+
+WebInspector.timelineWasDisabled = function() {
+    // Not implemented.
+}
diff --git a/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
new file mode 100644
index 0000000..96a20ab
--- /dev/null
+++ b/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -0,0 +1,285 @@
+/*
+ * Copyright (C) IBM Corp. 2009  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of IBM Corp. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.WatchExpressionsSidebarPane = function()
+{
+    WebInspector.SidebarPane.call(this, WebInspector.UIString("Watch Expressions"));
+
+    this.section = new WebInspector.WatchExpressionsSection();
+
+    this.bodyElement.appendChild(this.section.element);
+
+    var addElement = document.createElement("button");
+    addElement.setAttribute("type", "button");
+    addElement.textContent = WebInspector.UIString("Add");
+    addElement.addEventListener("click", this.section.addExpression.bind(this.section), false);
+
+    var refreshElement = document.createElement("button");
+    refreshElement.setAttribute("type", "button");
+    refreshElement.textContent = WebInspector.UIString("Refresh");
+    refreshElement.addEventListener("click", this.section.update.bind(this.section), false);
+
+    var centerElement = document.createElement("div");
+    centerElement.addStyleClass("watch-expressions-buttons-container");
+    centerElement.appendChild(addElement);
+    centerElement.appendChild(refreshElement);
+    this.bodyElement.appendChild(centerElement);
+
+    this.expanded = this.section.loadSavedExpressions().length > 0;
+    this.onexpand = this.refreshExpressions.bind(this);
+}
+
+WebInspector.WatchExpressionsSidebarPane.prototype = {
+    refreshExpressions: function()
+    {
+        this.section.update();
+    }
+}
+
+WebInspector.WatchExpressionsSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
+
+WebInspector.WatchExpressionsSection = function()
+{
+    WebInspector.ObjectPropertiesSection.call(this);
+
+    this.watchExpressions = this.loadSavedExpressions();
+
+    this.headerElement.className = "hidden";
+    this.editable = true;
+    this.expanded = true;
+    this.propertiesElement.addStyleClass("watch-expressions");
+
+    this._watchObjectGroupId = "watch-group";
+}
+
+WebInspector.WatchExpressionsSection.NewWatchExpression = "\xA0";
+
+WebInspector.WatchExpressionsSection.prototype = {
+    update: function()
+    {
+        function appendResult(expression, watchIndex, result, exception)
+        {
+            if (exception) {
+                // Exception results are not wrappers, but text messages.
+                result = WebInspector.ObjectProxy.wrapPrimitiveValue(result);
+            } else if (result.type === "string") {
+                // Evaluation result is intentionally not abbreviated. However, we'd like to distinguish between null and "null"
+                result.description = "\"" + result.description + "\"";
+            }
+
+            var property = new WebInspector.ObjectPropertyProxy(expression, result);
+            property.watchIndex = watchIndex;
+            property.isException = exception;
+
+            // For newly added, empty expressions, set description to "",
+            // since otherwise you get DOMWindow
+            if (property.name === WebInspector.WatchExpressionsSection.NewWatchExpression) 
+                property.value.description = "";
+
+            // To clarify what's going on here: 
+            // In the outer function, we calculate the number of properties
+            // that we're going to be updating, and set that in the
+            // propertyCount variable.  
+            // In this function, we test to see when we are processing the 
+            // last property, and then call the superclass's updateProperties() 
+            // method to get all the properties refreshed at once.
+            properties.push(property);
+            
+            if (properties.length == propertyCount)
+                this.updateProperties(properties, WebInspector.WatchExpressionTreeElement, WebInspector.WatchExpressionsSection.CompareProperties);
+        }
+
+        InspectorController.releaseWrapperObjectGroup(this._watchObjectGroupId)
+        var properties = [];
+
+        // Count the properties, so we known when to call this.updateProperties()
+        // in appendResult()
+        var propertyCount = 0;
+        for (var i = 0; i < this.watchExpressions.length; ++i) {
+            if (!this.watchExpressions[i]) 
+                continue;
+            ++propertyCount;
+        }
+
+        // Now process all the expressions, since we have the actual count,
+        // which is checked in the appendResult inner function.
+        for (var i = 0; i < this.watchExpressions.length; ++i) {
+            var expression = this.watchExpressions[i];
+            if (!expression)
+                continue;
+
+            WebInspector.console.evalInInspectedWindow("(" + expression + ")", this._watchObjectGroupId, appendResult.bind(this, expression, i));
+        }
+
+        // note this is setting the expansion of the tree, not the section;
+        // with no expressions, and expanded tree, we get some extra vertical
+        // white space
+        // FIXME: should change to use header buttons instead of the buttons
+        // at the bottom of the section, then we can add a "No Watch Expressions
+        // element when there are no watch expressions, and this issue should
+        // go away.
+        this.expanded = (propertyCount != 0);
+    },
+
+    addExpression: function()
+    {
+        this.watchExpressions.push(WebInspector.WatchExpressionsSection.NewWatchExpression);
+        this.update();
+
+        // After update(), the new empty expression to be edited
+        // will be in the tree, but we have to find it.
+        treeElement = this.findAddedTreeElement();
+        if (treeElement)
+            treeElement.startEditing();
+    },
+
+    updateExpression: function(element, value)
+    {
+        this.watchExpressions[element.property.watchIndex] = value;
+        this.saveExpressions();
+        this.update();
+    },
+
+    findAddedTreeElement: function()
+    {
+        var children = this.propertiesTreeOutline.children;
+        for (var i = 0; i < children.length; ++i)
+            if (children[i].property.name === WebInspector.WatchExpressionsSection.NewWatchExpression)
+                return children[i];
+    },
+
+    loadSavedExpressions: function()
+    {
+        var json = InspectorController.setting("watchExpressions");
+        if (!json)
+            return [];
+
+        try {
+            json = JSON.parse(json);
+        } catch(e) {
+            return [];
+        }
+
+        return json.expressions || [];
+    },
+
+    saveExpressions: function()
+    {
+        var toSave = [];
+        for (var i = 0; i < this.watchExpressions.length; i++)
+            if (this.watchExpressions[i])
+                toSave.push(this.watchExpressions[i]);
+
+        var json = JSON.stringify({expressions: toSave});
+        InspectorController.setSetting("watchExpressions", json);
+
+        return toSave.length;
+    }
+}
+
+WebInspector.WatchExpressionsSection.prototype.__proto__ = WebInspector.ObjectPropertiesSection.prototype;
+
+WebInspector.WatchExpressionsSection.CompareProperties = function(propertyA, propertyB) 
+{
+    if (propertyA.watchIndex == propertyB.watchIndex)
+        return 0;
+    else if (propertyA.watchIndex < propertyB.watchIndex)
+        return -1;
+    else
+        return 1;
+}
+
+WebInspector.WatchExpressionTreeElement = function(property)
+{
+    WebInspector.ObjectPropertyTreeElement.call(this, property);
+}
+
+WebInspector.WatchExpressionTreeElement.prototype = {
+    update: function()
+    {
+        WebInspector.ObjectPropertyTreeElement.prototype.update.call(this);
+
+        if (this.property.isException)
+            this.valueElement.addStyleClass("watch-expressions-error-level");
+
+        var deleteButton = document.createElement("input");
+        deleteButton.type = "button";
+        deleteButton.title = WebInspector.UIString("Delete watch expression.");
+        deleteButton.addStyleClass("enabled-button");
+        deleteButton.addStyleClass("delete-button");
+        deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
+
+        this.listItemElement.insertBefore(deleteButton, this.listItemElement.firstChild);
+    },
+
+    _deleteButtonClicked: function()
+    {
+        this.treeOutline.section.updateExpression(this, null);
+    },
+
+    startEditing: function()
+    {
+        if (WebInspector.isBeingEdited(this.nameElement) || !this.treeOutline.section.editable)
+            return;
+
+        this.nameElement.textContent = this.property.name.trimWhitespace();
+
+        var context = { expanded: this.expanded };
+
+        // collapse temporarily, if required
+        this.hasChildren = false;
+
+        this.listItemElement.addStyleClass("editing-sub-part");
+
+        WebInspector.startEditing(this.nameElement, this.editingCommitted.bind(this), this.editingCancelled.bind(this), context);
+    },
+
+    editingCancelled: function(element, context)
+    {
+        if (!this.nameElement.textContent)
+            this.treeOutline.section.updateExpression(this, null);
+            
+        this.update();
+        this.editingEnded(context);
+    },
+
+    applyExpression: function(expression, updateInterface)
+    {
+        expression = expression.trimWhitespace();
+
+        if (!expression)
+            expression = null;
+
+        this.property.name = expression;
+        this.treeOutline.section.updateExpression(this, expression);
+    }
+}
+
+WebInspector.WatchExpressionTreeElement.prototype.__proto__ = WebInspector.ObjectPropertyTreeElement.prototype;
diff --git a/WebCore/inspector/front-end/WebKit.qrc b/WebCore/inspector/front-end/WebKit.qrc
index c39c95b..c0f282c 100644
--- a/WebCore/inspector/front-end/WebKit.qrc
+++ b/WebCore/inspector/front-end/WebKit.qrc
@@ -9,9 +9,9 @@
     <file>ChangesView.js</file>
     <file>Color.js</file>
     <file>ConsoleView.js</file>
+    <file>CookieItemsView.js</file>
     <file>Database.js</file>
     <file>DatabaseQueryView.js</file>
-    <file>DatabasesPanel.js</file>
     <file>DatabaseTableView.js</file>
     <file>DataGrid.js</file>
     <file>DOMAgent.js</file>
@@ -21,9 +21,11 @@
     <file>Drawer.js</file>
     <file>ElementsPanel.js</file>
     <file>ElementsTreeOutline.js</file>
+    <file>EventListenersSidebarPane.js</file>
     <file>FontView.js</file>
     <file>ImageView.js</file>
     <file>InjectedScript.js</file>
+    <file>InjectedScriptAccess.js</file>
     <file>inspector.js</file>
     <file>KeyboardShortcut.js</file>
     <file>MetricsSidebarPane.js</file>
@@ -33,6 +35,7 @@
     <file>Panel.js</file>
     <file>PanelEnablerView.js</file>
     <file>Placard.js</file>
+    <file>Popup.js</file>
     <file>ProfileDataGridTree.js</file>
     <file>ProfilesPanel.js</file>
     <file>ProfileView.js</file>
@@ -50,20 +53,26 @@
     <file>SidebarTreeElement.js</file>
     <file>SourceFrame.js</file>
     <file>SourceView.js</file>
+    <file>StatusBarButton.js</file>
+    <file>StoragePanel.js</file>
     <file>StylesSidebarPane.js</file>
+    <file>SummaryBar.js</file>
     <file>TextPrompt.js</file>
+    <file>TimelineAgent.js</file>
     <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
     <file>utilities.js</file>
     <file>View.js</file>
+    <file>WatchExpressionsSidebarPane.js</file>
     <file>inspector.css</file>
+    <file>inspectorSyntaxHighlight.css</file>
     <file>Images/back.png</file>
     <file>Images/checker.png</file>
     <file>Images/clearConsoleButtonGlyph.png</file>
     <file>Images/closeButtons.png</file>
     <file>Images/consoleButtonGlyph.png</file>
+    <file>Images/cookie.png</file>
     <file>Images/database.png</file>
-    <file>Images/databasesIcon.png</file>
     <file>Images/databaseTable.png</file>
     <file>Images/debuggerContinue.png</file>
     <file>Images/debuggerPause.png</file>
@@ -80,12 +89,12 @@
     <file>Images/disclosureTriangleSmallRightDownWhite.png</file>
     <file>Images/disclosureTriangleSmallRightWhite.png</file>
     <file>Images/dockButtonGlyph.png</file>
-    <file>Images/domStorage.png</file>
     <file>Images/elementsIcon.png</file>
     <file>Images/enableOutlineButtonGlyph.png</file>
     <file>Images/enableSolidButtonGlyph.png</file>
     <file>Images/errorIcon.png</file>
     <file>Images/errorMediumIcon.png</file>
+    <file>Images/errorRedDot.png</file>
     <file>Images/excludeButtonGlyph.png</file>
     <file>Images/focusButtonGlyph.png</file>
     <file>Images/forward.png</file>
@@ -96,11 +105,14 @@
     <file>Images/goArrow.png</file>
     <file>Images/graphLabelCalloutLeft.png</file>
     <file>Images/graphLabelCalloutRight.png</file>
+    <file>Images/grayConnectorPoint.png</file>
     <file>Images/largerResourcesButtonGlyph.png</file>
+    <file>Images/localStorage.png</file>
     <file>Images/nodeSearchButtonGlyph.png</file>
     <file>Images/paneBottomGrow.png</file>
     <file>Images/paneBottomGrowActive.png</file>
     <file>Images/paneGrowHandleLine.png</file>
+    <file>Images/paneSettingsButtons.png</file>
     <file>Images/pauseOnExceptionButtonGlyph.png</file>
     <file>Images/percentButtonGlyph.png</file>
     <file>Images/profileGroupIcon.png</file>
@@ -134,6 +146,7 @@
     <file>Images/segmentHoverEnd.png</file>
     <file>Images/segmentSelected.png</file>
     <file>Images/segmentSelectedEnd.png</file>
+    <file>Images/sessionStorage.png</file>
     <file>Images/splitviewDimple.png</file>
     <file>Images/splitviewDividerBackground.png</file>
     <file>Images/statusbarBackground.png</file>
@@ -143,6 +156,8 @@
     <file>Images/statusbarMenuButtonSelected.png</file>
     <file>Images/statusbarResizerHorizontal.png</file>
     <file>Images/statusbarResizerVertical.png</file>
+    <file>Images/storageIcon.png</file>
+    <file>Images/successGreenDot.png</file>
     <file>Images/timelineHollowPillBlue.png</file>
     <file>Images/timelineHollowPillGray.png</file>
     <file>Images/timelineHollowPillGreen.png</file>
@@ -174,6 +189,8 @@
     <file>Images/userInputResultIcon.png</file>
     <file>Images/warningIcon.png</file>
     <file>Images/warningMediumIcon.png</file>
+    <file>Images/warningOrangeDot.png</file>
     <file>Images/warningsErrors.png</file>
+    <file>Images/whiteConnectorPoint.png</file>
 </qresource>
 </RCC>
diff --git a/WebCore/inspector/front-end/inspector.css b/WebCore/inspector/front-end/inspector.css
index 51d626a..3d7c99a 100644
--- a/WebCore/inspector/front-end/inspector.css
+++ b/WebCore/inspector/front-end/inspector.css
@@ -94,6 +94,10 @@ body.attached #toolbar {
     padding-left: 0;
 }
 
+body.attached.platform-qt #toolbar {
+    cursor: auto;
+}
+
 body.attached.inactive #toolbar {
     border-top: 1px solid rgb(64%, 64%, 64%);
 }
@@ -199,15 +203,15 @@ body.attached #search-results-matches {
     background-image: url(Images/scriptsIcon.png);
 }
 
-.toolbar-item.databases .toolbar-icon {
-    background-image: url(Images/databasesIcon.png);
+.toolbar-item.storage .toolbar-icon {
+    background-image: url(Images/storageIcon.png);
 }
 
 .toolbar-item.profiles .toolbar-icon {
     background-image: url(Images/profilesIcon.png);
 }
 
-#close-button {
+#close-button-left, #close-button-right {
     width: 14px;
     height: 14px;
     background-image: url(Images/closeButtons.png);
@@ -217,15 +221,27 @@ body.attached #search-results-matches {
     margin: 5px 0;
 }
 
-#close-button:hover {
+#close-button-left:hover, #close-button-right:hover {
     background-position: 14px 0;
 }
 
-#close-button:active {
+#close-button-left:active, #close-button-right:active {
     background-position: 28px 0;
 }
 
-body.detached .toolbar-item.close {
+body.detached .toolbar-item.close-left, body.detached .toolbar-item.close-right {
+    display: none;
+}
+
+body.attached.platform-qt .toolbar-item.close-left, body.attached.platform-qt .toolbar-item.close-right {
+    display: none;
+}
+
+body.platform-mac-tiger .toolbar-item.close-right, body.platform-mac-leopard .toolbar-item.close-right { 
+    display: none;
+}
+
+body:not(.platform-mac-tiger):not(.platform-mac-leopard) .toolbar-item.close-left { 
     display: none;
 }
 
@@ -372,6 +388,10 @@ body.detached #dock-status-bar-item .glyph {
     -webkit-mask-image: url(Images/dockButtonGlyph.png);
 }
 
+body.platform-qt #dock-status-bar-item {
+    display: none
+}
+
 #console-status-bar-item .glyph {
     -webkit-mask-image: url(Images/consoleButtonGlyph.png);
 }
@@ -543,7 +563,7 @@ body.drawer-visible #drawer {
     padding-left: 6px;
 }
 
-.repeated-message.console-error-level::before, .repeated-message.console-warning-level:before {
+.repeated-message.console-error-level::before, .repeated-message.console-warning-level:before, .repeated-message.console-debug-level:before {
     visibility: hidden;
 }
 
@@ -574,6 +594,14 @@ body.drawer-visible #drawer {
     color: red;
 }
 
+.console-debug-level .console-message-text {
+    color: blue;
+}
+
+.console-debug-level::before {
+    background-image: url(Images/searchSmallBrightBlue.png);
+}
+
 .console-error-level::before {
     background-image: url(Images/errorIcon.png);
 }
@@ -773,6 +801,10 @@ body.drawer-visible #drawer {
     margin-right: 100px;
 }
 
+.resource-view-headers .outline-disclosure .raw-form-data {
+    white-space:pre-wrap;
+}
+
 .resource-view .resource-view-content {
     position: absolute;
     top: 0;
@@ -830,7 +862,7 @@ body.drawer-visible #drawer {
     -webkit-user-select: text;
 }
 
-.resource-view.image img {
+.resource-view.image img.resource-image-view {
     max-width: 100%;
     max-height: 1000px;
     background-image: url(Images/checker.png);
@@ -839,6 +871,14 @@ body.drawer-visible #drawer {
     -webkit-user-drag: auto;
 }
 
+.resource-url {
+    vertical-align: middle;
+}
+
+.resource-status-image {
+    vertical-align: middle;
+}
+
 .resource-view.image .title {
     text-align: center;
     font-size: 13px;
@@ -1190,10 +1230,22 @@ body.inactive .placard.selected {
     margin-top: 1px;
 }
 
-.section:nth-last-of-type(1) {
+.section:nth-last-of-type(1), .event-bar:nth-last-of-type(1) {
     margin-bottom: 1px;
 }
 
+.watch-expressions-buttons-container {
+    text-align: center;
+}
+
+.event-bar:first-child {
+    margin-top: 1px;
+}
+
+.event-bar:nth-last-of-type(1) .header {
+    border-bottom: 1px solid rgb(163, 163, 163);
+}
+
 .section .header {
     padding: 2px 8px 4px 18px;
     border-top: 1px solid rgb(145, 160, 192);
@@ -1225,7 +1277,7 @@ body.inactive .placard.selected {
     content: url(Images/treeDownTriangleWhite.png);
 }
 
-.section .header .title {
+.section .header .title, .event-bar .header .title {
     color: white;
     font-weight: bold;
     word-wrap: break-word;
@@ -1236,11 +1288,11 @@ body.inactive .placard.selected {
     font-style: italic;
 }
 
-.section .header label {
+.section .header label, .event-bar .header label {
     display: none;
 }
 
-.section.expanded .header label {
+.section.expanded .header label, .event-bar.expanded .header label {
     display: inline;
 }
 
@@ -1253,7 +1305,7 @@ body.inactive .placard.selected {
     vertical-align: 2px;
 }
 
-.section .header .subtitle {
+.section .header .subtitle, .event-bar .header .subtitle {
     float: right;
     font-size: 10px;
     margin-left: 5px;
@@ -1267,7 +1319,7 @@ body.inactive .placard.selected {
     color: inherit;
 }
 
-.section .properties {
+.section .properties, .event-bar .event-properties {
     display: none;
     margin: 0;
     padding: 2px 6px 3px;
@@ -1284,11 +1336,11 @@ body.inactive .placard.selected {
     opacity: 1.0;
 }
 
-.section.expanded .properties {
+.section.expanded .properties, .event-bar.expanded .event-properties {
     display: block;
 }
 
-.section .properties li {
+.section .properties li, .event-properties li {
     margin-left: 12px;
     white-space: nowrap;
     text-overflow: ellipsis;
@@ -1297,22 +1349,22 @@ body.inactive .placard.selected {
     cursor: auto;
 }
 
-.section .properties li.parent {
+.section .properties li.parent, .event-properties li.parent {
     margin-left: 1px;
 }
 
-.section .properties ol {
+.section .properties ol, .event-properties ol {
     display: none;
     margin: 0;
     -webkit-padding-start: 12px;
     list-style: none;
 }
 
-.section .properties ol.expanded {
+.section .properties ol.expanded, .event-properties ol.expanded {
     display: block;
 }
 
-.section .properties li.parent::before {
+.section .properties li.parent::before, .event-properties li.parent::before {
     content: url(Images/treeRightTriangleBlack.png);
     opacity: 0.75;
     float: left;
@@ -1324,16 +1376,79 @@ body.inactive .placard.selected {
     cursor: default;
 }
 
-.section .properties li.parent.expanded::before {
+.section .properties li.parent.expanded::before, .event-properties li.parent.expanded::before {
     content: url(Images/treeDownTriangleBlack.png);
     margin-top: 1px;
 }
 
-.section .properties li .info {
+.section .properties li .info, .event-properties li .info {
     padding-top: 4px;
     padding-bottom: 3px;
 }
 
+.section .event-bars {
+    display: none;
+}
+
+.section.expanded .event-bars {
+    display: block;
+}
+
+.event-bar {
+    position: relative;
+}
+
+.event-bar-connector {
+    position: absolute;
+    left: 75%;
+    bottom: -7px;
+    margin-left: -7px;
+    content: url(Images/grayConnectorPoint.png);
+    z-index: 3;
+}
+
+.event-bar.expanded .event-bar-connector {
+    content: url(Images/whiteConnectorPoint.png);
+}
+
+.event-bars .event-bar .header {
+    padding: 2px 8px 4px 18px;
+    border-top: 1px solid rgb(163, 163, 163);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(243, 243, 243)), to(rgb(207, 207, 207)));
+    min-height: 18px;
+    white-space: nowrap;
+    -webkit-background-origin: padding;
+    -webkit-background-clip: padding;
+}
+
+.event-bars .event-bar.expanded .header {
+    border-bottom: 1px solid rgb(163, 163, 163);
+}
+
+.event-bars .event-bar .header .title {
+    font-weight: bold;
+    color: #333;
+    text-shadow: white 0 1px 0; 
+}
+
+.event-bars .event-bar .header .subtitle {
+    color: rgba(90, 90, 90, 0.742188);
+}
+
+.event-bars .event-bar .header::before {
+    position: absolute;
+    top: 4px;
+    left: 7px;
+    width: 8px;
+    height: 8px;
+    opacity: 0.75;
+    content: url(Images/treeRightTriangleBlack.png);
+}
+
+.event-bars .event-bar.expanded .header::before {
+    content: url(Images/treeDownTriangleBlack.png);
+}
+
 .editing {
     -webkit-user-select: text;
     -webkit-box-shadow: rgba(0, 0, 0, .5) 3px 3px 4px;
@@ -1360,10 +1475,23 @@ body.inactive .placard.selected {
     text-overflow: clip;
 }
 
-li.editing .swatch, li.editing .enabled-button {
+li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-button {
     display: none !important;
 }
 
+.watch-expressions > li.editing-sub-part .name {
+    display: block; 
+    width: 100%;
+}
+
+.watch-expressions > li.editing-sub-part .value, .watch-expressions > li.editing-sub-part .separator  {
+    display: none;
+}
+
+.watch-expressions-error-level {
+    color: red;
+}
+
 .section .properties li.editing-sub-part {
     padding: 3px 6px 8px 18px;
     margin: -3px -6px -8px -6px;
@@ -1397,11 +1525,22 @@ li.editing .swatch, li.editing .enabled-button {
     z-index: 1;
 }
 
+/* FIXME: need a better icon (comment in bug 27514) */
+.section .properties .delete-button {
+    width: 10px;
+    height: 10px;
+    background-image: url(Images/errorIcon.png);
+    background-position: 0 0;
+    background-color: transparent;
+    background-repeat: no-repeat;
+    border: 0 none transparent;
+}
+
 .section:hover .properties .enabled-button {
     display: block;
 }
 
-.section .properties .name {
+.section .properties .name, .event-properties .name {
     color: rgb(136, 19, 145);
 }
 
@@ -1409,7 +1548,7 @@ li.editing .swatch, li.editing .enabled-button {
     color: rgb(100, 100, 100);
 }
 
-.section .properties .number {
+.section .properties .number, .event-properties .number {
     color: blue;
 }
 
@@ -1417,22 +1556,27 @@ li.editing .swatch, li.editing .enabled-button {
     color: rgb(128, 0, 0);
 }
 
-.section .properties .keyword {
+.section .properties .keyword, .event-properties .keyword {
     color: rgb(136, 19, 79);
 }
 
-.section .properties .color {
+.section .properties .color, .event-properties .color {
     color: rgb(118, 15, 21);
 }
 
 .swatch {
     display: inline-block;
     vertical-align: baseline;
-    margin-left: 4px;
+    margin-left: 1px;
+    margin-right: 2px;
     margin-bottom: -1px;
     width: 1em;
     height: 1em;
-    border: 1px solid rgb(180, 180, 180);
+    border: 1px solid rgba(128, 128, 128, 0.6);
+}
+
+.swatch:hover {
+    border: 1px solid rgba(64, 64, 64, 0.8);
 }
 
 .pane:not(.expanded) + .pane, .pane:first-of-type {
@@ -1473,6 +1617,34 @@ li.editing .swatch, li.editing .enabled-button {
     content: url(Images/disclosureTriangleSmallDownBlack.png);
 }
 
+.pane > .title > select {
+    display: none;
+    float: right;
+    width: 23px;
+    height: 17px;
+    color: transparent;
+    background-color: transparent;
+    border: none;
+    background-image: url(Images/paneSettingsButtons.png);
+    background-repeat: no-repeat;
+    margin: 1px 0 0 0;
+    padding: 0;
+    -webkit-border-radius: 0;
+    -webkit-appearance: none;
+}
+
+.pane.expanded:hover > .title > select {
+    display: inline-block;
+}
+
+.pane > .title > select:hover {
+    background-position: -23px 0px;
+}
+
+.pane > .title > select:active {
+    background-position: -46px 0px;
+}
+
 .pane > .body {
     position: relative;
     display: none;
@@ -1622,8 +1794,16 @@ body.inactive .sidebar {
     content: url(Images/databaseTable.png);
 }
 
-.domstorage-sidebar-tree-item .icon {
-    content: url(Images/domStorage.png);
+.domstorage-sidebar-tree-item.local-storage .icon {
+    content: url(Images/localStorage.png);
+}
+
+.domstorage-sidebar-tree-item.session-storage .icon {
+    content: url(Images/sessionStorage.png);
+}
+
+.cookie-sidebar-tree-item .icon {
+    content: url(Images/cookie.png);
 }
 
 #storage-views {
@@ -1785,6 +1965,14 @@ body.inactive .sidebar {
     overflow: hidden;
 }
 
+.data-grid .centered div {
+    text-align: center;
+}
+
+.data-grid .right div {
+    text-align: right;
+}
+
 .data-grid th.sortable div {
     position: relative;
 }
@@ -2091,7 +2279,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-mask-image: url(Images/enableSolidButtonGlyph.png);
 }
 
-#scripts-pause-on-exceptions-status-bar-item .glyph {
+.scripts-pause-on-exceptions-status-bar-item .glyph {
     -webkit-mask-image: url(Images/pauseOnExceptionButtonGlyph.png);
 }
 
@@ -2209,7 +2397,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     overflow: auto;
 }
 
-#resources-larger-resources-status-bar-item .glyph {
+.resources-larger-resources-status-bar-item .glyph {
     -webkit-mask-image: url(Images/largerResourcesButtonGlyph.png);
 }
 
@@ -2221,7 +2409,13 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     overflow: hidden;
 }
 
-#resources-filter li {
+#console-filter {
+    height: 24px;
+    padding: 2px 10px 0;
+    overflow: hidden;
+}
+
+#resources-filter li, #console-filter li {
     display: inline-block;
     margin: 1px 1px 0 0;
     padding: 0 6px 3px;
@@ -2236,7 +2430,17 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     text-shadow: rgba(255, 255, 255, 0.5) 1px 1px 0;
 }
 
-#resources-filter li.selected, #resources-filter li:hover, #resources-filter li:active {
+#console-filter div.divider {
+    margin-left: 5px;
+    margin-right: 5px;
+    /* Only want a border-left here because border on both sides
+    made the divider too thick */
+    border-left: 1px solid gray;
+    display: inline;
+}
+
+#resources-filter li.selected, #resources-filter li:hover, #resources-filter li:active,
+#console-filter li.selected, #console-filter li:hover, #console-filter li:active {
     color: white;
     text-shadow: rgb(80, 80, 80) 1px 1px 1px;
     background: rgba(20, 20, 20, 0.4);
@@ -2244,13 +2448,15 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-box-shadow: 0 1px 0px rgba(255, 255, 255, 0.5);
 }
 
-#resources-filter li:hover {
+#resources-filter li:hover,
+#console-filter li:hover {
     background: rgba(20, 20, 20, 0.4);
     border-color: transparent;
     -webkit-box-shadow: none;
 }
 
-#resources-filter li:active {
+#resources-filter li:active,
+#console-filter li:active {
     background: rgba(20, 20, 20, 0.6);
 }
 
@@ -2316,36 +2522,36 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-background-clip: padding;
 }
 
-#resources-graph-legend {
+.summary-graph-legend {
     margin-top: -10px;
     padding-left: 15px;
 }
 
-.resources-graph-legend-item {
+.summary-graph-legend-item {
     display: inline-block;
     font-weight: bold;
     margin-right: 15px;
     vertical-align: top;
 }
 
-.resources-graph-legend-item.total {
+.summary-graph-legend-item.total {
     margin-left: 10px;
 }
 
-.resources-graph-legend-label {
+.summary-graph-legend-label {
     display: inline-block;
     text-align: left;
 }
 
-.resources-graph-legend-header {
+.summary-graph-legend-header {
     font-size: 12px;
 }
 
-.resources-graph-legend-value {
+.summary-graph-legend-value {
     font-size: 10px;
 }
 
-.resources-graph-legend-swatch {
+.summary-graph-legend-swatch {
     vertical-align: top;
     margin-top: 1px;
     margin-right: 3px;
@@ -2380,6 +2586,24 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     background-color: rgba(0, 0, 0, 0.1);
 }
 
+.resources-onload-divider {
+    position: absolute;
+    width: 2px;
+    top: 0;
+    bottom: 0;
+    z-index: 300;
+    background-color: rgba(255, 0, 0, 0.5);
+}
+
+.resources-ondomcontent-divider {
+    position: absolute;
+    width: 2px;
+    top: 0;
+    bottom: 0;
+    z-index: 300;
+    background-color: rgba(0, 0, 255, 0.5);
+}
+
 .resources-divider.last {
     background-color: transparent;
 }
@@ -2477,6 +2701,16 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     display: list-item;
 }
 
+.console-warning-level, .console-error-level, .console-log-level {
+    display: none;
+}
+
+.filter-all .console-warning-level, .filter-warnings .console-warning-level,
+.filter-all .console-error-level, .filter-errors .console-error-level,
+.filter-all .console-log-level, .filter-logs .console-log-level {
+    display: block;
+}
+
 .resources-graph-bar.waiting {
     opacity: 0.35;
 }
@@ -2970,6 +3204,10 @@ body.inactive .sidebar-tree-item.selected {
     content: url(Images/resourceDocumentIconSmall.png);
 }
 
+.bubble.debug, .console-debug-level .bubble {
+    background-color: rgb(0, 0, 255) !important;
+}
+
 .bubble.warning, .console-warning-level .bubble {
     background-color: rgb(232, 164, 0) !important;
 }
@@ -3093,16 +3331,21 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
 button.enable-toggle-status-bar-item .glyph {
 }
 
-#record-profile-status-bar-item .glyph {
+.record-profile-status-bar-item .glyph {
     -webkit-mask-image: url(Images/recordButtonGlyph.png);
 }
 
-#record-profile-status-bar-item.toggled-on .glyph {
+.record-profile-status-bar-item.toggled-on .glyph {
     -webkit-mask-image: url(Images/recordToggledButtonGlyph.png);
-    background-color: rgb(216, 0, 0);
+    background-color: rgb(216, 0, 0) !important;
 }
 
-#node-search-status-bar-item .glyph {
+/* FIXME: should have its own glyph. */
+.heap-snapshot-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/focusButtonGlyph.png);
+}
+
+.node-search-status-bar-item .glyph {
     -webkit-mask-image: url(Images/nodeSearchButtonGlyph.png);
 }
 
@@ -3136,12 +3379,8 @@ button.enable-toggle-status-bar-item .glyph {
     margin-left: -1px;
 }
 
-.refresh-storage-status-bar-item {
-    background-image: url(Images/reloadButtons.png) !important;
-}
-
-.refresh-storage-status-bar-item:active {
-    background-position: 32px 0;
+.refresh-storage-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/reloadButtonGlyph.png);
 }
 
 #storage-view-status-bar-items {
@@ -3191,3 +3430,7 @@ ol.breakpoint-list {
 .breakpoint-list a:hover {
     color: rgb(15%, 15%, 15%);
 }
+
+.webkit-html-js-node, .webkit-html-css-node {
+    white-space: pre;
+}
diff --git a/WebCore/inspector/front-end/inspector.html b/WebCore/inspector/front-end/inspector.html
index a3dc407..db9bfd7 100644
--- a/WebCore/inspector/front-end/inspector.html
+++ b/WebCore/inspector/front-end/inspector.html
@@ -6,13 +6,13 @@ modification, are permitted provided that the following conditions
 are met:
 
 1.  Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer. 
+    notice, this list of conditions and the following disclaimer.
 2.  Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
-    documentation and/or other materials provided with the distribution. 
+    documentation and/or other materials provided with the distribution.
 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
     its contributors may be used to endorse or promote products derived
-    from this software without specific prior written permission. 
+    from this software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
 EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -30,12 +30,14 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 <head>
     <meta http-equiv="content-type" content="text/html; charset=utf-8">
     <link rel="stylesheet" type="text/css" href="inspector.css">
+    <link rel="stylesheet" type="text/css" href="inspectorSyntaxHighlight.css">
     <script type="text/javascript" src="utilities.js"></script>
     <script type="text/javascript" src="treeoutline.js"></script>
     <script type="text/javascript" src="inspector.js"></script>
     <script type="text/javascript" src="Object.js"></script>
     <script type="text/javascript" src="KeyboardShortcut.js"></script>
     <script type="text/javascript" src="TextPrompt.js"></script>
+    <script type="text/javascript" src="Popup.js"></script>
     <script type="text/javascript" src="Placard.js"></script>
     <script type="text/javascript" src="View.js"></script>
     <script type="text/javascript" src="Callback.js"></script>
@@ -49,6 +51,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DOMStorageItemsView.js"></script>
     <script type="text/javascript" src="DataGrid.js"></script>
     <script type="text/javascript" src="DOMStorageDataGrid.js"></script>
+    <script type="text/javascript" src="CookieItemsView.js"></script>
     <script type="text/javascript" src="Script.js"></script>
     <script type="text/javascript" src="Breakpoint.js"></script>
     <script type="text/javascript" src="SidebarPane.js"></script>
@@ -60,16 +63,20 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="BreakpointsSidebarPane.js"></script>
     <script type="text/javascript" src="CallStackSidebarPane.js"></script>
     <script type="text/javascript" src="ScopeChainSidebarPane.js"></script>
+    <script type="text/javascript" src="WatchExpressionsSidebarPane.js"></script>
     <script type="text/javascript" src="MetricsSidebarPane.js"></script>
     <script type="text/javascript" src="PropertiesSidebarPane.js"></script>
+    <script type="text/javascript" src="EventListenersSidebarPane.js"></script>
     <script type="text/javascript" src="Color.js"></script>
     <script type="text/javascript" src="StylesSidebarPane.js"></script>
     <script type="text/javascript" src="Panel.js"></script>
     <script type="text/javascript" src="PanelEnablerView.js"></script>
+    <script type="text/javascript" src="StatusBarButton.js"></script>
+    <script type="text/javascript" src="SummaryBar.js"></script>
     <script type="text/javascript" src="ElementsPanel.js"></script>
     <script type="text/javascript" src="ResourcesPanel.js"></script>
     <script type="text/javascript" src="ScriptsPanel.js"></script>
-    <script type="text/javascript" src="DatabasesPanel.js"></script>
+    <script type="text/javascript" src="StoragePanel.js"></script>
     <script type="text/javascript" src="ProfilesPanel.js"></script>
     <script type="text/javascript" src="ResourceView.js"></script>
     <script type="text/javascript" src="SourceFrame.js"></script>
@@ -85,13 +92,16 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ProfileView.js"></script>
     <script type="text/javascript" src="DOMAgent.js"></script>
     <script type="text/javascript" src="InjectedScript.js"></script>
+    <script type="text/javascript" src="InjectedScriptAccess.js"></script>
+    <script type="text/javascript" src="TimelineAgent.js"></script>
 </head>
 <body class="detached">
     <div id="toolbar">
-        <div class="toolbar-item close"><button id="close-button"></button></div>
+        <div class="toolbar-item close-left"><button id="close-button-left"></button></div>
         <div class="toolbar-item flexable-space"></div>
         <div class="toolbar-item hidden" id="search-results-matches"></div>
         <div class="toolbar-item"><input id="search" type="search" incremental results="0"><div id="search-toolbar-label" class="toolbar-label"></div></div>
+        <div class="toolbar-item close-right"><button id="close-button-right"></button></div>
     </div>
     <div id="main">
         <div id="main-panels" tabindex="0" spellcheck="false"></div>
@@ -99,7 +109,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     </div>
     <div id="drawer">
         <div id="console-view"><div id="console-messages"><div id="console-prompt" spellcheck="false"><br></div></div></div>
-        <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button></div></div>
+        <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><div id="console-filter" class="status-bar-item"></div></div></div>
     </div>
 </body>
 </html>
diff --git a/WebCore/inspector/front-end/inspector.js b/WebCore/inspector/front-end/inspector.js
index aa21a86..f090d3a 100644
--- a/WebCore/inspector/front-end/inspector.js
+++ b/WebCore/inspector/front-end/inspector.js
@@ -8,13 +8,13 @@
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
+ *     documentation and/or other materials provided with the distribution.
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
+ *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -29,7 +29,6 @@
  */
 
 var Preferences = {
-    ignoreWhitespace: true,
     showUserAgentStyles: true,
     maxInlineTextChildLength: 80,
     minConsoleHeight: 75,
@@ -39,7 +38,12 @@ var Preferences = {
     showInheritedComputedStyleProperties: false,
     styleRulesExpandedState: {},
     showMissingLocalizedStrings: false,
-    useDOMAgent: false
+    heapProfilerPresent: false,
+    samplingCPUProfiler: false,
+    showColorNicknames: true,
+    colorFormat: "hex",
+    eventListenersFilter: "all",
+    resourcesLargeRows: true
 }
 
 var WebInspector = {
@@ -70,7 +74,7 @@ var WebInspector = {
             // there isn't already a caret selection inside.
             var selection = window.getSelection();
             if (selection.isCollapsed && !this._currentFocusElement.isInsertionCaretInside()) {
-                var selectionRange = document.createRange();
+                var selectionRange = this._currentFocusElement.ownerDocument.createRange();
                 selectionRange.setStart(this._currentFocusElement, 0);
                 selectionRange.setEnd(this._currentFocusElement, 0);
 
@@ -119,13 +123,13 @@ var WebInspector = {
                 }
             }
         }
-        
+
         for (var panelName in WebInspector.panels) {
             if (WebInspector.panels[panelName] == x)
                 InspectorController.storeLastActivePanel(panelName);
         }
     },
-  
+
     _createPanels: function()
     {
         var hiddenPanels = (InspectorController.hiddenPanels() || "").split(',');
@@ -137,8 +141,23 @@ var WebInspector = {
             this.panels.scripts = new WebInspector.ScriptsPanel();
         if (hiddenPanels.indexOf("profiles") === -1)
             this.panels.profiles = new WebInspector.ProfilesPanel();
-        if (hiddenPanels.indexOf("databases") === -1)
-            this.panels.databases = new WebInspector.DatabasesPanel();      
+        if (hiddenPanels.indexOf("storage") === -1 && hiddenPanels.indexOf("databases") === -1)
+            this.panels.storage = new WebInspector.StoragePanel();      
+    },
+
+    _loadPreferences: function()
+    {
+        var colorFormat = InspectorController.setting("color-format");
+        if (colorFormat)
+            Preferences.colorFormat = colorFormat;
+
+        var eventListenersFilter = InspectorController.setting("event-listeners-filter");
+        if (eventListenersFilter)
+            Preferences.eventListenersFilter = eventListenersFilter;
+
+        var resourcesLargeRows = InspectorController.setting("resources-large-rows");
+        if (typeof resourcesLargeRows !== "undefined")
+            Preferences.resourcesLargeRows = resourcesLargeRows;
     },
 
     get attached()
@@ -307,7 +326,7 @@ var WebInspector = {
 
     set hoveredDOMNode(x)
     {
-        if (objectsAreSame(this._hoveredDOMNode, x))
+        if (this._hoveredDOMNode === x)
             return;
 
         this._hoveredDOMNode = x;
@@ -333,7 +352,7 @@ var WebInspector = {
         }
 
         if (this._hoveredDOMNode) {
-            InspectorController.highlightDOMNode(this._hoveredDOMNode);
+            InspectorController.highlightDOMNode(this._hoveredDOMNode.id);
             this.showingDOMNodeHighlight = true;
         } else {
             InspectorController.hideDOMNodeHighlight();
@@ -347,15 +366,15 @@ WebInspector.loaded = function()
     var platform = InspectorController.platform();
     document.body.addStyleClass("platform-" + platform);
 
+    this._loadPreferences();
+
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
     // TODO: Uncomment when enabling the Changes Panel
     // this.changes = new WebInspector.ChangesView(this.drawer);
     // TODO: Remove class="hidden" from inspector.html on button#changes-status-bar-item
     this.drawer.visibleView = this.console;
-
-    if (Preferences.useDOMAgent)
-        this.domAgent = new WebInspector.DOMAgent();
+    this.domAgent = new WebInspector.DOMAgent();
 
     this.resourceCategories = {
         documents: new WebInspector.ResourceCategory(WebInspector.UIString("Documents"), "documents"),
@@ -404,6 +423,7 @@ WebInspector.loaded = function()
     document.addEventListener("keyup", this.documentKeyUp.bind(this), true);
     document.addEventListener("beforecopy", this.documentCanCopy.bind(this), true);
     document.addEventListener("copy", this.documentCopy.bind(this), true);
+    document.addEventListener("contextmenu", this.contextMenu.bind(this), true);
 
     var mainPanelsElement = document.getElementById("main-panels");
     mainPanelsElement.handleKeyEvent = this.mainKeyDown.bind(this);
@@ -438,10 +458,11 @@ WebInspector.loaded = function()
     searchField.addEventListener("keyup", this.searchKeyUp.bind(this), false);
     searchField.addEventListener("search", this.performSearch.bind(this), false); // when the search is emptied
 
-    document.getElementById("toolbar").addEventListener("mousedown", this.toolbarDragStart, true);
-    document.getElementById("close-button").addEventListener("click", this.close, true);
+    toolbarElement.addEventListener("mousedown", this.toolbarDragStart, true);
+    document.getElementById("close-button-left").addEventListener("click", this.close, true);
+    document.getElementById("close-button-right").addEventListener("click", this.close, true);
 
-    InspectorController.loaded(Preferences.useDOMAgent);
+    InspectorController.loaded();
 }
 
 var windowLoaded = function()
@@ -658,6 +679,12 @@ WebInspector.documentCopy = function(event)
         WebInspector[this.currentFocusElement.id + "Copy"](event);
 }
 
+WebInspector.contextMenu = function(event)
+{
+    if (event.handled || event.target.hasStyleClass("popup-glasspane"))
+        event.preventDefault();
+}
+
 WebInspector.mainKeyDown = function(event)
 {
     if (this.currentPanel && this.currentPanel.handleKeyEvent)
@@ -772,7 +799,7 @@ WebInspector.toggleAttach = function()
 
 WebInspector.toolbarDragStart = function(event)
 {
-    if (!WebInspector.attached && InspectorController.platform() !== "mac-leopard")
+    if ((!WebInspector.attached && InspectorController.platform() !== "mac-leopard") || InspectorController.platform() == "qt")
         return;
 
     var target = event.target;
@@ -822,7 +849,7 @@ WebInspector.toolbarDrag = function(event)
     event.preventDefault();
 }
 
-WebInspector.elementDragStart = function(element, dividerDrag, elementDragEnd, event, cursor) 
+WebInspector.elementDragStart = function(element, dividerDrag, elementDragEnd, event, cursor)
 {
     if (this._elementDraggingEventListener || this._elementEndDraggingEventListener)
         this.elementDragEnd(event);
@@ -853,12 +880,12 @@ WebInspector.elementDragEnd = function(event)
 
 WebInspector.showConsole = function()
 {
-    this.drawer.visibleView = this.console;
+    this.drawer.showView(this.console);
 }
 
 WebInspector.showChanges = function()
 {
-    this.drawer.visibleView = this.changes;
+    this.drawer.showView(this.changes);
 }
 
 WebInspector.showElementsPanel = function()
@@ -881,9 +908,9 @@ WebInspector.showProfilesPanel = function()
     this.currentPanel = this.panels.profiles;
 }
 
-WebInspector.showDatabasesPanel = function()
+WebInspector.showStoragePanel = function()
 {
-    this.currentPanel = this.panels.databases;
+    this.currentPanel = this.panels.storage;
 }
 
 WebInspector.addResource = function(identifier, payload)
@@ -896,19 +923,36 @@ WebInspector.addResource = function(identifier, payload)
         payload.lastPathComponent,
         identifier,
         payload.isMainResource,
-        payload.cached);
+        payload.cached,
+        payload.requestMethod,
+        payload.requestFormData);
     this.resources[identifier] = resource;
     this.resourceURLMap[resource.url] = resource;
 
-    if (resource.mainResource) {
+    if (resource.mainResource)
         this.mainResource = resource;
-        this.panels.elements.reset();
-    }
 
     if (this.panels.resources)
         this.panels.resources.addResource(resource);
 }
 
+WebInspector.clearConsoleMessages = function()
+{
+    WebInspector.console.clearMessages(false);
+}
+
+WebInspector.selectDatabase = function(o)
+{
+    WebInspector.showStoragePanel();
+    WebInspector.panels.storage.selectDatabase(o);
+}
+
+WebInspector.selectDOMStorage = function(o)
+{
+    WebInspector.showStoragePanel();
+    WebInspector.panels.storage.selectDOMStorage(o);
+}
+
 WebInspector.updateResource = function(identifier, payload)
 {
     var resource = this.resources[identifier];
@@ -922,6 +966,8 @@ WebInspector.updateResource = function(identifier, payload)
         resource.lastPathComponent = payload.lastPathComponent;
         resource.requestHeaders = payload.requestHeaders;
         resource.mainResource = payload.mainResource;
+        resource.requestMethod = payload.requestMethod;
+        resource.requestFormData = payload.requestFormData;
     }
 
     if (payload.didResponseChange) {
@@ -936,7 +982,7 @@ WebInspector.updateResource = function(identifier, payload)
     if (payload.didTypeChange) {
         resource.type = payload.type;
     }
-    
+
     if (payload.didLengthChange) {
         resource.contentLength = payload.contentLength;
     }
@@ -953,6 +999,21 @@ WebInspector.updateResource = function(identifier, payload)
             resource.responseReceivedTime = payload.responseReceivedTime;
         if (payload.endTime)
             resource.endTime = payload.endTime;
+        
+        if (payload.loadEventTime) {
+            // This loadEventTime is for the main resource, and we want to show it
+            // for all resources on this page. This means we want to set it as a member
+            // of the resources panel instead of the individual resource.
+            if (this.panels.resources)
+                this.panels.resources.mainResourceLoadTime = payload.loadEventTime;
+        }
+        
+        if (payload.domContentEventTime) {
+            // This domContentEventTime is for the main resource, so it should go in
+            // the resources panel for the same reasons as above.
+            if (this.panels.resources)
+                this.panels.resources.mainResourceDOMContentTime = payload.domContentEventTime;
+        }
     }
 }
 
@@ -973,20 +1034,30 @@ WebInspector.removeResource = function(identifier)
 WebInspector.addDatabase = function(payload)
 {
     var database = new WebInspector.Database(
-        payload.database,
+        payload.id,
         payload.domain,
         payload.name,
         payload.version);
-    this.panels.databases.addDatabase(database);
+    this.panels.storage.addDatabase(database);
+}
+
+WebInspector.addCookieDomain = function(domain)
+{
+    this.panels.storage.addCookieDomain(domain);
 }
 
 WebInspector.addDOMStorage = function(payload)
 {
     var domStorage = new WebInspector.DOMStorage(
-        payload.domStorage,
+        payload.id,
         payload.host,
         payload.isLocalStorage);
-    this.panels.databases.addDOMStorage(domStorage);
+    this.panels.storage.addDOMStorage(domStorage);
+}
+
+WebInspector.updateDOMStorage = function(storageId)
+{
+    this.panels.storage.updateDOMStorage(storageId);
 }
 
 WebInspector.resourceTrackingWasEnabled = function()
@@ -1034,9 +1105,9 @@ WebInspector.failedToParseScriptSource = function(sourceURL, source, startingLin
     this.panels.scripts.addScript(null, sourceURL, source, startingLine, errorLine, errorMessage);
 }
 
-WebInspector.pausedScript = function()
+WebInspector.pausedScript = function(callFrames)
 {
-    this.panels.scripts.debuggerPaused();
+    this.panels.scripts.debuggerPaused(callFrames);
 }
 
 WebInspector.resumedScript = function()
@@ -1073,17 +1144,18 @@ WebInspector.reset = function()
     this.console.clearMessages();
 }
 
-WebInspector.inspectedWindowCleared = function(inspectedWindow)
-{
-    this.panels.elements.inspectedWindowCleared(inspectedWindow);
-}
-
 WebInspector.resourceURLChanged = function(resource, oldURL)
 {
     delete this.resourceURLMap[oldURL];
     this.resourceURLMap[resource.url] = resource;
 }
 
+WebInspector.didCommitLoad = function()
+{
+    // Cleanup elements panel early on inspected page refresh.
+    WebInspector.setDocument(null);
+}
+
 WebInspector.addMessageToConsole = function(payload)
 {
     var consoleMessage = new WebInspector.ConsoleMessage(
@@ -1098,6 +1170,90 @@ WebInspector.addMessageToConsole = function(payload)
     this.console.addMessage(consoleMessage);
 }
 
+WebInspector.log = function(message)
+{
+    // remember 'this' for setInterval() callback
+    var self = this;
+    
+    // return indication if we can actually log a message
+    function isLogAvailable()
+    {
+        return WebInspector.ConsoleMessage && WebInspector.ObjectProxy && self.console;
+    }
+    
+    // flush the queue of pending messages
+    function flushQueue()
+    {
+        var queued = WebInspector.log.queued;
+        if (!queued) 
+            return;
+            
+        for (var i = 0; i < queued.length; ++i)
+            logMessage(queued[i]);
+        
+        delete WebInspector.log.queued;
+    }
+
+    // flush the queue if it console is available
+    // - this function is run on an interval
+    function flushQueueIfAvailable()
+    {
+        if (!isLogAvailable())
+            return;
+            
+        clearInterval(WebInspector.log.interval);
+        delete WebInspector.log.interval;
+        
+        flushQueue();
+    }
+    
+    // actually log the message
+    function logMessage(message)
+    {
+        var repeatCount = 1;
+        if (message == WebInspector.log.lastMessage)
+            repeatCount = WebInspector.log.repeatCount + 1;
+    
+        WebInspector.log.lastMessage = message;
+        WebInspector.log.repeatCount = repeatCount;
+        
+        // ConsoleMessage expects a proxy object
+        message = new WebInspector.ObjectProxy(null, [], 0, message, false);
+        
+        // post the message
+        var msg = new WebInspector.ConsoleMessage(
+            WebInspector.ConsoleMessage.MessageSource.Other,
+            WebInspector.ConsoleMessage.MessageType.Log,
+            WebInspector.ConsoleMessage.MessageLevel.Debug,
+            -1,
+            null,
+            null,
+            repeatCount,
+            message);
+    
+        self.console.addMessage(msg);
+    }
+    
+    // if we can't log the message, queue it
+    if (!isLogAvailable()) {
+        if (!WebInspector.log.queued)
+            WebInspector.log.queued = [];
+            
+        WebInspector.log.queued.push(message);
+        
+        if (!WebInspector.log.interval)
+            WebInspector.log.interval = setInterval(flushQueueIfAvailable, 1000);
+        
+        return;
+    }
+
+    // flush the pending queue if any
+    flushQueue();
+
+    // log the message
+    logMessage(message);
+}
+
 WebInspector.addProfile = function(profile)
 {
     this.panels.profiles.addProfile(profile);
@@ -1117,7 +1273,7 @@ WebInspector.drawLoadingPieChart = function(canvas, percent) {
     var r = 7;
 
     g.beginPath();
-    g.arc(cx, cy, r, 0, Math.PI * 2, false); 
+    g.arc(cx, cy, r, 0, Math.PI * 2, false);
     g.closePath();
 
     g.lineWidth = 1;
@@ -1131,15 +1287,16 @@ WebInspector.drawLoadingPieChart = function(canvas, percent) {
 
     g.beginPath();
     g.moveTo(cx, cy);
-    g.arc(cx, cy, r, startangle, endangle, false); 
+    g.arc(cx, cy, r, startangle, endangle, false);
     g.closePath();
 
     g.fillStyle = darkColor;
     g.fill();
 }
 
-WebInspector.updateFocusedNode = function(node)
+WebInspector.updateFocusedNode = function(nodeId)
 {
+    var node = WebInspector.domAgent.nodeForId(nodeId);
     if (!node)
         // FIXME: Should we deselect if null is passed in?
         return;
@@ -1247,7 +1404,7 @@ WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
     a.title = url;
     a.target = "_blank";
     a.textContent = linkText;
-    
+
     return a;
 }
 
@@ -1329,6 +1486,11 @@ WebInspector.performSearch = function(event)
     this.currentPanel.performSearch(query);
 }
 
+WebInspector.addNodesToSearchResult = function(nodeIds)
+{
+    WebInspector.panels.elements.addNodesToSearchResult(nodeIds);
+}
+
 WebInspector.updateSearchMatchesCount = function(matches, panel)
 {
     if (!panel)
@@ -1385,7 +1547,7 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         return;
     element.__editing = true;
 
-    var oldText = element.textContent;
+    var oldText = getContent(element);
     var oldHandleKeyEvent = element.handleKeyEvent;
     var moveDirection = "";
 
@@ -1399,6 +1561,13 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         editingCommitted.call(element);
     }
 
+    function getContent(element) {
+        if (element.tagName === "INPUT" && element.type === "text")
+            return element.value;
+        else
+            return element.textContent;
+    }
+
     function cleanUpAfterEditing() {
         delete this.__editing;
 
@@ -1415,17 +1584,22 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
     }
 
     function editingCancelled() {
-        this.innerText = oldText;
+        if (this.tagName === "INPUT" && this.type === "text")
+            this.value = oldText;
+        else
+            this.textContent = oldText;
 
         cleanUpAfterEditing.call(this);
 
-        cancelledCallback(this, context);
+        if (cancelledCallback)
+            cancelledCallback(this, context);
     }
 
     function editingCommitted() {
         cleanUpAfterEditing.call(this);
 
-        committedCallback(this, this.textContent, oldText, context, moveDirection);
+        if (committedCallback)
+            committedCallback(this, getContent(this), oldText, context, moveDirection);
     }
 
     element.handleKeyEvent = function(event) {
@@ -1456,6 +1630,11 @@ WebInspector._toolbarItemClicked = function(event)
     this.currentPanel = toolbarItem.panel;
 }
 
+WebInspector.evaluateForTestInFrontend = function(callId, script)
+{
+    InspectorController.didEvaluateForTestInFrontend(callId, JSON.stringify(window.eval(script)));
+}
+
 // This table maps MIME types to the Resource.Types which are valid for them.
 // The following line:
 //    "text/html":                {0: 1},
diff --git a/WebCore/inspector/front-end/inspectorSyntaxHighlight.css b/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
new file mode 100644
index 0000000..2cbb3c5
--- /dev/null
+++ b/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+.webkit-css-comment { 
+    color: rgb(0, 116, 0);
+}
+
+.webkit-css-string, .webkit-css-keyword, .webkit-css-unit {
+    color: rgb(7, 144, 154);
+}
+
+.webkit-css-number {
+    color: rgb(50, 0, 255);
+}
+
+.webkit-css-property, .webkit-css-at-rule {
+    color: rgb(200, 0, 0);
+}
+
+.webkit-css-url {
+    color: rgb(0, 0, 0);
+}
+
+.webkit-css-selector {
+    color: rgb(0, 0, 0);
+}
+
+.webkit-css-pseudo-class {
+    color: rgb(128, 128, 128);
+}
+
+.webkit-javascript-comment {
+    color: rgb(0, 116, 0);
+}
+
+.webkit-javascript-keyword {
+    color: rgb(170, 13, 145);
+}
+
+.webkit-javascript-number {
+    color: rgb(28, 0, 207);
+}
+
+.webkit-javascript-string, .webkit-javascript-regexp {
+    color: rgb(196, 26, 22);
+}
diff --git a/WebCore/inspector/front-end/treeoutline.js b/WebCore/inspector/front-end/treeoutline.js
index 579e7fb..ecc322b 100644
--- a/WebCore/inspector/front-end/treeoutline.js
+++ b/WebCore/inspector/front-end/treeoutline.js
@@ -249,35 +249,40 @@ TreeOutline.prototype._forgetChildrenRecursive = function(parentElement)
     }
 }
 
-TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor, getParent, equal)
+TreeOutline.prototype.getCachedTreeElement = function(representedObject)
 {
     if (!representedObject)
         return null;
 
-    if (!equal)
-        equal = function(a, b) { return a === b };
-
     if ("__treeElementIdentifier" in representedObject) {
         // If this representedObject has a tree element identifier, and it is a known TreeElement
         // in our tree we can just return that tree element.
         var elements = this._knownTreeElements[representedObject.__treeElementIdentifier];
         if (elements) {
             for (var i = 0; i < elements.length; ++i)
-                if (equal(elements[i].representedObject, representedObject))
+                if (elements[i].representedObject === representedObject)
                     return elements[i];
         }
     }
+    return null;
+}
 
-    if (!isAncestor || !(isAncestor instanceof Function) || !getParent || !(getParent instanceof Function))
+TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor, getParent)
+{
+    if (!representedObject)
         return null;
 
+    var cachedElement = this.getCachedTreeElement(representedObject);
+    if (cachedElement)
+        return cachedElement;
+
     // The representedObject isn't know, so we start at the top of the tree and work down to find the first
     // tree element that represents representedObject or one of its ancestors.
     var item;
     var found = false;
     for (var i = 0; i < this.children.length; ++i) {
         item = this.children[i];
-        if (equal(item.representedObject, representedObject) || isAncestor(item.representedObject, representedObject)) {
+        if (item.representedObject === representedObject || isAncestor(item.representedObject, representedObject)) {
             found = true;
             break;
         }
@@ -292,7 +297,7 @@ TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor,
     var currentObject = representedObject;
     while (currentObject) {
         ancestors.unshift(currentObject);
-        if (equal(currentObject, item.representedObject))
+        if (currentObject === item.representedObject)
             break;
         currentObject = getParent(currentObject);
     }
@@ -301,18 +306,16 @@ TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor,
     for (var i = 0; i < ancestors.length; ++i) {
         // Make sure we don't call findTreeElement with the same representedObject
         // again, to prevent infinite recursion.
-        if (equal(ancestors[i], representedObject))
+        if (ancestors[i] === representedObject)
             continue;
         // FIXME: we could do something faster than findTreeElement since we will know the next
         // ancestor exists in the tree.
-        item = this.findTreeElement(ancestors[i], isAncestor, getParent, equal);
+        item = this.findTreeElement(ancestors[i], isAncestor, getParent);
         if (item && item.onpopulate)
             item.onpopulate(item);
     }
 
-    // Now that all the ancestors are populated, try to find the representedObject again. This time
-    // without the isAncestor and getParent functions to prevent an infinite recursion if it isn't found.
-    return this.findTreeElement(representedObject, null, null, equal);
+    return this.getCachedTreeElement(representedObject);
 }
 
 TreeOutline.prototype.treeElementFromPoint = function(x, y)
diff --git a/WebCore/inspector/front-end/utilities.js b/WebCore/inspector/front-end/utilities.js
index eec0b87..6df23de 100644
--- a/WebCore/inspector/front-end/utilities.js
+++ b/WebCore/inspector/front-end/utilities.js
@@ -26,72 +26,16 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-Object.type = function(obj, win)
+Object.proxyType = function(objectProxy)
 {
-    if (obj === null)
+    if (objectProxy === null)
         return "null";
 
-    var type = typeof obj;
+    var type = typeof objectProxy;
     if (type !== "object" && type !== "function")
         return type;
 
-    win = win || window;
-
-    if (obj instanceof win.Node)
-        return (obj.nodeType === undefined ? type : "node");
-    if (obj instanceof win.String)
-        return "string";
-    if (obj instanceof win.Array)
-        return "array";
-    if (obj instanceof win.Boolean)
-        return "boolean";
-    if (obj instanceof win.Number)
-        return "number";
-    if (obj instanceof win.Date)
-        return "date";
-    if (obj instanceof win.RegExp)
-        return "regexp";
-    if (obj instanceof win.Error)
-        return "error";
-    return type;
-}
-
-Object.hasProperties = function(obj)
-{
-    if (typeof obj === "undefined" || typeof obj === "null")
-        return false;
-    for (var name in obj)
-        return true;
-    return false;
-}
-
-Object.describe = function(obj, abbreviated)
-{
-    var type1 = Object.type(obj);
-    var type2 = Object.prototype.toString.call(obj).replace(/^\[object (.*)\]$/i, "$1");
-
-    switch (type1) {
-    case "object":
-    case "node":
-        return type2;
-    case "array":
-        return "[" + obj.toString() + "]";
-    case "string":
-        if (obj.length > 100)
-            return "\"" + obj.substring(0, 100) + "\u2026\"";
-        return "\"" + obj + "\"";
-    case "function":
-        var objectText = String(obj);
-        if (!/^function /.test(objectText))
-            objectText = (type2 == "object") ? type1 : type2;
-        else if (abbreviated)
-            objectText = /.*/.exec(obj)[0].replace(/ +$/g, "");
-        return objectText;
-    case "regexp":
-        return String(obj).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
-    default:
-        return String(obj);
-    }
+    return objectProxy.type;
 }
 
 Object.properties = function(obj)
@@ -147,7 +91,7 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
             if (startNode)
                 break;
 
-            node = node.traversePreviousNode(false, stayWithinNode);
+            node = node.traversePreviousNode(stayWithinNode);
         }
 
         if (!startNode) {
@@ -182,7 +126,7 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
             if (endNode)
                 break;
 
-            node = node.traverseNextNode(false, stayWithinNode);
+            node = node.traverseNextNode(stayWithinNode);
         }
 
         if (!endNode) {
@@ -236,9 +180,15 @@ Element.prototype.hasStyleClass = function(className)
     return regex.test(this.className);
 }
 
+Element.prototype.positionAt = function(x, y)
+{
+    this.style.left = x + "px";
+    this.style.top = y + "px";
+}
+
 Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = function(nameArray)
 {
-    for (var node = this; node && !objectsAreSame(node, this.ownerDocument); node = node.parentNode)
+    for (var node = this; node && node !== this.ownerDocument; node = node.parentNode)
         for (var i = 0; i < nameArray.length; ++i)
             if (node.nodeName.toLowerCase() === nameArray[i].toLowerCase())
                 return node;
@@ -252,7 +202,7 @@ Node.prototype.enclosingNodeOrSelfWithNodeName = function(nodeName)
 
 Node.prototype.enclosingNodeOrSelfWithClass = function(className)
 {
-    for (var node = this; node && !objectsAreSame(node, this.ownerDocument); node = node.parentNode)
+    for (var node = this; node && node !== this.ownerDocument; node = node.parentNode)
         if (node.nodeType === Node.ELEMENT_NODE && node.hasStyleClass(className))
             return node;
     return null;
@@ -301,18 +251,31 @@ Element.prototype.__defineGetter__("totalOffsetTop", function()
     return total;
 });
 
-Element.prototype.firstChildSkippingWhitespace = firstChildSkippingWhitespace;
-Element.prototype.lastChildSkippingWhitespace = lastChildSkippingWhitespace;
+Element.prototype.offsetRelativeToWindow = function(targetWindow)
+{
+    var elementOffset = {x: 0, y: 0};
+    var curElement = this;
+    var curWindow = this.ownerDocument.defaultView;
+    while (curWindow && curElement) {
+        elementOffset.x += curElement.totalOffsetLeft;
+        elementOffset.y += curElement.totalOffsetTop;
+        if (curWindow === targetWindow)
+            break;
+
+        curElement = curWindow.frameElement;
+        curWindow = curWindow.parent;
+    }
+
+    return elementOffset;
+}
 
 Node.prototype.isWhitespace = isNodeWhitespace;
-Node.prototype.nodeTypeName = nodeTypeName;
 Node.prototype.displayName = nodeDisplayName;
-Node.prototype.contentPreview = nodeContentPreview;
-Node.prototype.isAncestor = isAncestorNode;
+Node.prototype.isAncestor = function(node)
+{
+    return isAncestorNode(this, node);
+};
 Node.prototype.isDescendant = isDescendantNode;
-Node.prototype.firstCommonAncestor = firstCommonNodeAncestor;
-Node.prototype.nextSiblingSkippingWhitespace = nextSiblingSkippingWhitespace;
-Node.prototype.previousSiblingSkippingWhitespace = previousSiblingSkippingWhitespace;
 Node.prototype.traverseNextNode = traverseNextNode;
 Node.prototype.traversePreviousNode = traversePreviousNode;
 Node.prototype.onlyTextChild = onlyTextChild;
@@ -394,29 +357,6 @@ function isNodeWhitespace()
     return this.nodeValue.match(/^[\s\xA0]+$/);
 }
 
-function nodeTypeName()
-{
-    if (!this)
-        return "(unknown)";
-
-    switch (this.nodeType) {
-        case Node.ELEMENT_NODE: return "Element";
-        case Node.ATTRIBUTE_NODE: return "Attribute";
-        case Node.TEXT_NODE: return "Text";
-        case Node.CDATA_SECTION_NODE: return "Character Data";
-        case Node.ENTITY_REFERENCE_NODE: return "Entity Reference";
-        case Node.ENTITY_NODE: return "Entity";
-        case Node.PROCESSING_INSTRUCTION_NODE: return "Processing Instruction";
-        case Node.COMMENT_NODE: return "Comment";
-        case Node.DOCUMENT_NODE: return "Document";
-        case Node.DOCUMENT_TYPE_NODE: return "Document Type";
-        case Node.DOCUMENT_FRAGMENT_NODE: return "Document Fragment";
-        case Node.NOTATION_NODE: return "Notation";
-    }
-
-    return "(unknown)";
-}
-
 function nodeDisplayName()
 {
     if (!this)
@@ -491,277 +431,110 @@ function nodeDisplayName()
     return this.nodeName.toLowerCase().collapseWhitespace();
 }
 
-function nodeContentPreview()
+function isAncestorNode(ancestor, node)
 {
-    if (!this || !this.hasChildNodes || !this.hasChildNodes())
-        return "";
-
-    var limit = 0;
-    var preview = "";
-
-    // always skip whitespace here
-    var currentNode = traverseNextNode.call(this, true, this);
-    while (currentNode) {
-        if (currentNode.nodeType === Node.TEXT_NODE)
-            preview += currentNode.nodeValue.escapeHTML();
-        else
-            preview += nodeDisplayName.call(currentNode).escapeHTML();
-
-        currentNode = traverseNextNode.call(currentNode, true, this);
-
-        if (++limit > 4) {
-            preview += "&#x2026;"; // ellipsis
-            break;
-        }
-    }
-
-    return preview.collapseWhitespace();
-}
-
-function objectsAreSame(a, b)
-{
-    // FIXME: Make this more generic so is works with any wrapped object, not just nodes.
-    // This function is used to compare nodes that might be JSInspectedObjectWrappers, since
-    // JavaScript equality is not true for JSInspectedObjectWrappers of the same node wrapped
-    // with different global ExecStates, we use isSameNode to compare them.
-    if (a === b)
-        return true;
-    if (!a || !b)
-        return false;
-    if (a.isSameNode && b.isSameNode)
-        return a.isSameNode(b);
-    return false;
-}
-
-function isAncestorNode(ancestor)
-{
-    if (!this || !ancestor)
+    if (!node || !ancestor)
         return false;
 
-    var currentNode = ancestor.parentNode;
+    var currentNode = node.parentNode;
     while (currentNode) {
-        if (objectsAreSame(this, currentNode))
+        if (ancestor === currentNode)
             return true;
         currentNode = currentNode.parentNode;
     }
-
     return false;
 }
 
 function isDescendantNode(descendant)
 {
-    return isAncestorNode.call(descendant, this);
-}
-
-function firstCommonNodeAncestor(node)
-{
-    if (!this || !node)
-        return;
-
-    var node1 = this.parentNode;
-    var node2 = node.parentNode;
-
-    if ((!node1 || !node2) || !objectsAreSame(node1, node2))
-        return null;
-
-    while (node1 && node2) {
-        if (!node1.parentNode || !node2.parentNode)
-            break;
-        if (!objectsAreSame(node1, node2))
-            break;
-
-        node1 = node1.parentNode;
-        node2 = node2.parentNode;
-    }
-
-    return node1;
-}
-
-function nextSiblingSkippingWhitespace()
-{
-    if (!this)
-        return;
-    var node = this.nextSibling;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = node.nextSibling;
-    return node;
+    return isAncestorNode(descendant, this);
 }
 
-function previousSiblingSkippingWhitespace()
+function traverseNextNode(stayWithin)
 {
     if (!this)
         return;
-    var node = this.previousSibling;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = node.previousSibling;
-    return node;
-}
 
-function firstChildSkippingWhitespace()
-{
-    if (!this)
-        return;
     var node = this.firstChild;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = nextSiblingSkippingWhitespace.call(node);
-    return node;
-}
-
-function lastChildSkippingWhitespace()
-{
-    if (!this)
-        return;
-    var node = this.lastChild;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = previousSiblingSkippingWhitespace.call(node);
-    return node;
-}
-
-function traverseNextNode(skipWhitespace, stayWithin)
-{
-    if (!this)
-        return;
-
-    var node = skipWhitespace ? firstChildSkippingWhitespace.call(this) : this.firstChild;
     if (node)
         return node;
 
-    if (stayWithin && objectsAreSame(this, stayWithin))
+    if (stayWithin && this === stayWithin)
         return null;
 
-    node = skipWhitespace ? nextSiblingSkippingWhitespace.call(this) : this.nextSibling;
+    node = this.nextSibling;
     if (node)
         return node;
 
     node = this;
-    while (node && !(skipWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling) && (!stayWithin || !node.parentNode || !objectsAreSame(node.parentNode, stayWithin)))
+    while (node && !node.nextSibling && (!stayWithin || !node.parentNode || node.parentNode !== stayWithin))
         node = node.parentNode;
     if (!node)
         return null;
 
-    return skipWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling;
+    return node.nextSibling;
 }
 
-function traversePreviousNode(skipWhitespace, stayWithin)
+function traversePreviousNode(stayWithin)
 {
     if (!this)
         return;
-    if (stayWithin && objectsAreSame(this, stayWithin))
+    if (stayWithin && this === stayWithin)
         return null;
-    var node = skipWhitespace ? previousSiblingSkippingWhitespace.call(this) : this.previousSibling;
-    while (node && (skipWhitespace ? lastChildSkippingWhitespace.call(node) : node.lastChild) )
-        node = skipWhitespace ? lastChildSkippingWhitespace.call(node) : node.lastChild;
+    var node = this.previousSibling;
+    while (node && node.lastChild)
+        node = node.lastChild;
     if (node)
         return node;
     return this.parentNode;
 }
 
-function onlyTextChild(ignoreWhitespace)
+function onlyTextChild()
 {
     if (!this)
         return null;
 
-    var firstChild = ignoreWhitespace ? firstChildSkippingWhitespace.call(this) : this.firstChild;
+    var firstChild = this.firstChild;
     if (!firstChild || firstChild.nodeType !== Node.TEXT_NODE)
         return null;
 
-    var sibling = ignoreWhitespace ? nextSiblingSkippingWhitespace.call(firstChild) : firstChild.nextSibling;
+    var sibling = firstChild.nextSibling;
     return sibling ? null : firstChild;
 }
 
-function nodeTitleInfo(hasChildren, linkify)
+function appropriateSelectorForNode(node, justSelector)
 {
-    var info = {title: "", hasChildren: hasChildren};
-
-    switch (this.nodeType) {
-        case Node.DOCUMENT_NODE:
-            info.title = "Document";
-            break;
-
-        case Node.ELEMENT_NODE:
-            info.title = "<span class=\"webkit-html-tag\">&lt;" + this.nodeName.toLowerCase().escapeHTML();
-
-            if (this.hasAttributes()) {
-                for (var i = 0; i < this.attributes.length; ++i) {
-                    var attr = this.attributes[i];
-                    info.title += " <span class=\"webkit-html-attribute\"><span class=\"webkit-html-attribute-name\">" + attr.name.escapeHTML() + "</span>=&#8203;\"";
-
-                    var value = attr.value;
-                    if (linkify && (attr.name === "src" || attr.name === "href")) {
-                        var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
-                        info.title += linkify(attr.value, value, "webkit-html-attribute-value", this.nodeName.toLowerCase() == "a");
-                    } else {
-                        var value = value.escapeHTML();
-                        value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
-                        info.title += "<span class=\"webkit-html-attribute-value\">" + value + "</span>";
-                    }
-                    info.title += "\"</span>";
-                }
-            }
-            info.title += "&gt;</span>&#8203;";
-
-            // If this element only has a single child that is a text node,
-            // just show that text and the closing tag inline rather than
-            // create a subtree for them
-
-            var textChild = onlyTextChild.call(this, Preferences.ignoreWhitespace);
-            var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
-
-            if (showInlineText) {
-                info.title += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;<span class=\"webkit-html-tag\">&lt;/" + this.nodeName.toLowerCase().escapeHTML() + "&gt;</span>";
-                info.hasChildren = false;
-            }
-            break;
+    if (!node)
+        return "";
 
-        case Node.TEXT_NODE:
-            if (isNodeWhitespace.call(this))
-                info.title = "(whitespace)";
-            else
-                info.title = "\"<span class=\"webkit-html-text-node\">" + this.nodeValue.escapeHTML() + "</span>\"";
-            break
+    var lowerCaseName = node.localName || node.nodeName.toLowerCase();
 
-        case Node.COMMENT_NODE:
-            info.title = "<span class=\"webkit-html-comment\">&lt;!--" + this.nodeValue.escapeHTML() + "--&gt;</span>";
-            break;
+    var id = node.getAttribute("id");
+    if (id) {
+        var selector = "#" + id;
+        return (justSelector ? selector : lowerCaseName + selector);
+    }
 
-        case Node.DOCUMENT_TYPE_NODE:
-            info.title = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + this.nodeName;
-            if (this.publicId) {
-                info.title += " PUBLIC \"" + this.publicId + "\"";
-                if (this.systemId)
-                    info.title += " \"" + this.systemId + "\"";
-            } else if (this.systemId)
-                info.title += " SYSTEM \"" + this.systemId + "\"";
-            if (this.internalSubset)
-                info.title += " [" + this.internalSubset + "]";
-            info.title += "&gt;</span>";
-            break;
-        default:
-            info.title = this.nodeName.toLowerCase().collapseWhitespace().escapeHTML();
+    var className = node.getAttribute("class");
+    if (className) {
+        var selector = "." + className.replace(/\s+/, ".");
+        return (justSelector ? selector : lowerCaseName + selector);
     }
 
-    return info;
-}
+    if (lowerCaseName === "input" && node.getAttribute("type"))
+        return lowerCaseName + "[type=\"" + node.getAttribute("type") + "\"]";
 
-function getDocumentForNode(node) {
-    return node.nodeType == Node.DOCUMENT_NODE ? node : node.ownerDocument;
+    return lowerCaseName;
 }
 
-function parentNodeOrFrameElement(node) {
-    var parent = node.parentNode;
-    if (parent)
-        return parent;
-
-    return getDocumentForNode(node).defaultView.frameElement;
+function getDocumentForNode(node)
+{
+    return node.nodeType == Node.DOCUMENT_NODE ? node : node.ownerDocument;
 }
 
-function isAncestorIncludingParentFrames(a, b) {
-    if (objectsAreSame(a, b))
-        return false;
-    for (var node = b; node; node = getDocumentForNode(node).defaultView.frameElement)
-        if (objectsAreSame(a, node) || isAncestorNode.call(a, node))
-            return true;
-    return false;
+function parentNode(node)
+{
+    return node.parentNode;
 }
 
 Number.secondsToString = function(seconds, formatterFunction, higherResolution)
@@ -790,20 +563,27 @@ Number.secondsToString = function(seconds, formatterFunction, higherResolution)
     return formatterFunction("%.1f days", days);
 }
 
-Number.bytesToString = function(bytes, formatterFunction)
+Number.bytesToString = function(bytes, formatterFunction, higherResolution)
 {
     if (!formatterFunction)
         formatterFunction = String.sprintf;
+    if (typeof higherResolution === "undefined")
+        higherResolution = true;
 
     if (bytes < 1024)
         return formatterFunction("%.0fB", bytes);
 
     var kilobytes = bytes / 1024;
-    if (kilobytes < 1024)
+    if (higherResolution && kilobytes < 1024)
         return formatterFunction("%.2fKB", kilobytes);
+    else if (kilobytes < 1024)
+        return formatterFunction("%.0fKB", kilobytes);
 
     var megabytes = kilobytes / 1024;
-    return formatterFunction("%.3fMB", megabytes);
+    if (higherResolution)
+        return formatterFunction("%.3fMB", megabytes);
+    else
+        return formatterFunction("%.0fMB", megabytes);
 }
 
 Number.constrain = function(num, min, max)
@@ -942,12 +722,16 @@ String.tokenizeFormatString = function(format)
 String.standardFormatters = {
     d: function(substitution)
     {
+        if (typeof substitution == "object" && Object.proxyType(substitution) === "number")
+            substitution = substitution.description;
         substitution = parseInt(substitution);
         return !isNaN(substitution) ? substitution : 0;
     },
 
     f: function(substitution, token)
     {
+        if (typeof substitution == "object" && Object.proxyType(substitution) === "number")
+            substitution = substitution.description;
         substitution = parseFloat(substitution);
         if (substitution && token.precision > -1)
             substitution = substitution.toFixed(token.precision);
@@ -956,6 +740,8 @@ String.standardFormatters = {
 
     s: function(substitution)
     {
+        if (typeof substitution == "object" && Object.proxyType(substitution) !== "null")
+            substitution = substitution.description;
         return substitution;
     },
 };
diff --git a/WebCore/loader/Cache.cpp b/WebCore/loader/Cache.cpp
index 6eeba77..1f28709 100644
--- a/WebCore/loader/Cache.cpp
+++ b/WebCore/loader/Cache.cpp
@@ -34,6 +34,7 @@
 #include "FrameView.h"
 #include "Image.h"
 #include "ResourceHandle.h"
+#include "SecurityOrigin.h"
 #include <stdio.h>
 #include <wtf/CurrentTime.h>
 
@@ -105,7 +106,7 @@ CachedResource* Cache::requestResource(DocLoader* docLoader, CachedResource::Typ
     if (resource && requestIsPreload && !resource->isPreloaded())
         return 0;
     
-    if (FrameLoader::restrictAccessToLocal() && !FrameLoader::canLoad(url, String(), docLoader->doc())) {
+    if (SecurityOrigin::restrictAccessToLocal() && !SecurityOrigin::canLoad(url, String(), docLoader->doc())) {
         Document* doc = docLoader->doc();
         if (doc && !requestIsPreload)
             FrameLoader::reportLocalLoadFailed(doc->frame(), url.string());
@@ -183,6 +184,7 @@ void Cache::revalidateResource(CachedResource* resource, DocLoader* docLoader)
 {
     ASSERT(resource);
     ASSERT(resource->inCache());
+    ASSERT(resource == m_resources.get(resource->url()));
     ASSERT(!disabled());
     if (resource->resourceToRevalidate())
         return;
@@ -191,7 +193,7 @@ void Cache::revalidateResource(CachedResource* resource, DocLoader* docLoader)
         return;
     }
     const String& url = resource->url();
-    CachedResource* newResource = createResource(resource->type(), KURL(url), resource->encoding());
+    CachedResource* newResource = createResource(resource->type(), KURL(ParsedURLString, url), resource->encoding());
     newResource->setResourceToRevalidate(resource);
     evict(resource);
     m_resources.set(url, newResource);
@@ -206,6 +208,7 @@ void Cache::revalidationSucceeded(CachedResource* revalidatingResource, const Re
     ASSERT(resource);
     ASSERT(!resource->inCache());
     ASSERT(resource->isLoaded());
+    ASSERT(revalidatingResource->inCache());
     
     evict(revalidatingResource);
 
@@ -352,7 +355,7 @@ void Cache::pruneDeadResources()
         current = m_allResources[i].m_tail;
         while (current) {
             CachedResource* prev = current->m_prevInAllResourcesList;
-            if (!current->hasClients() && !current->isPreloaded()) {
+            if (!current->hasClients() && !current->isPreloaded() && !current->isCacheValidator()) {
                 evict(current);
                 // If evict() caused pruneDeadResources() to be re-entered, bail out. This can happen when removing an
                 // SVG CachedImage that has subresources.
diff --git a/WebCore/loader/CachedFont.cpp b/WebCore/loader/CachedFont.cpp
index dfb9dd8..9cf152d 100644
--- a/WebCore/loader/CachedFont.cpp
+++ b/WebCore/loader/CachedFont.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,12 +27,16 @@
 #include "config.h"
 #include "CachedFont.h"
 
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX))) || PLATFORM(HAIKU) || PLATFORM(WINCE)
+#define STORE_FONT_CUSTOM_PLATFORM_DATA
+#endif
+
 #include "Cache.h"
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
 #include "DOMImplementation.h"
 #include "FontPlatformData.h"
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX)))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
 #include "FontCustomPlatformData.h"
 #endif
 #include "TextResourceDecoder.h"
@@ -60,7 +65,7 @@ CachedFont::CachedFont(const String &url)
 
 CachedFont::~CachedFont()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX)))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     delete m_fontData;
 #endif
 }
@@ -98,7 +103,7 @@ void CachedFont::beginLoadIfNeeded(DocLoader* dl)
 
 bool CachedFont::ensureCustomFontData()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX)))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
 #if ENABLE(SVG_FONTS)
     ASSERT(!m_isSVGFont);
 #endif
@@ -117,7 +122,7 @@ FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, b
     if (m_externalSVGDocument)
         return FontPlatformData(size, bold, italic);
 #endif
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX)))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     ASSERT(m_fontData);
     return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, renderingMode);
 #else
@@ -173,7 +178,7 @@ SVGFontElement* CachedFont::getSVGFontById(const String& fontName) const
 
 void CachedFont::allClientsRemoved()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX)))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     if (m_fontData) {
         delete m_fontData;
         m_fontData = 0;
diff --git a/WebCore/loader/CachedResource.cpp b/WebCore/loader/CachedResource.cpp
index 478873f..43de633 100644
--- a/WebCore/loader/CachedResource.cpp
+++ b/WebCore/loader/CachedResource.cpp
@@ -59,7 +59,7 @@ CachedResource::CachedResource(const String& url, Type type)
     , m_docLoader(0)
     , m_handleCount(0)
     , m_resourceToRevalidate(0)
-    , m_isBeingRevalidated(false)
+    , m_proxyResource(0)
 {
 #ifndef NDEBUG
     cachedResourceLeakCounter.increment();
@@ -89,6 +89,8 @@ CachedResource::CachedResource(const String& url, Type type)
 
 CachedResource::~CachedResource()
 {
+    ASSERT(!m_resourceToRevalidate); // Should be true because canDelete() checks this.
+    ASSERT(canDelete());
     ASSERT(!inCache());
     ASSERT(!m_deleted);
     ASSERT(url().isNull() || cache()->resourceForURL(url()) != this);
@@ -97,9 +99,6 @@ CachedResource::~CachedResource()
     cachedResourceLeakCounter.decrement();
 #endif
 
-    if (m_resourceToRevalidate)
-        m_resourceToRevalidate->m_isBeingRevalidated = false;
-
     if (m_docLoader)
         m_docLoader->removeCachedResource(this);
 }
@@ -298,18 +297,26 @@ void CachedResource::setResourceToRevalidate(CachedResource* resource)
     ASSERT(resource);
     ASSERT(!m_resourceToRevalidate);
     ASSERT(resource != this);
-    ASSERT(!resource->m_isBeingRevalidated);
     ASSERT(m_handlesToRevalidate.isEmpty());
     ASSERT(resource->type() == type());
-    resource->m_isBeingRevalidated = true;
+
+    // The following assert should be investigated whenever it occurs. Although it should never fire, it currently does in rare circumstances.
+    // https://bugs.webkit.org/show_bug.cgi?id=28604.
+    // So the code needs to be robust to this assert failing thus the "if (m_resourceToRevalidate->m_proxyResource == this)" in CachedResource::clearResourceToRevalidate.
+    ASSERT(!resource->m_proxyResource);
+
+    resource->m_proxyResource = this;
     m_resourceToRevalidate = resource;
 }
 
 void CachedResource::clearResourceToRevalidate() 
 { 
     ASSERT(m_resourceToRevalidate);
-    m_resourceToRevalidate->m_isBeingRevalidated = false;
-    m_resourceToRevalidate->deleteIfPossible();
+    // A resource may start revalidation before this method has been called, so check that this resource is still the proxy resource before clearing it out.
+    if (m_resourceToRevalidate->m_proxyResource == this) {
+        m_resourceToRevalidate->m_proxyResource = 0;
+        m_resourceToRevalidate->deleteIfPossible();
+    }
     m_handlesToRevalidate.clear();
     m_resourceToRevalidate = 0;
     deleteIfPossible();
@@ -403,7 +410,7 @@ bool CachedResource::mustRevalidate(CachePolicy cachePolicy) const
 
 bool CachedResource::isSafeToMakePurgeable() const
 { 
-    return !hasClients() && !m_isBeingRevalidated && !m_resourceToRevalidate; 
+    return !hasClients() && !m_proxyResource && !m_resourceToRevalidate;
 }
 
 bool CachedResource::makePurgeable(bool purgeable) 
diff --git a/WebCore/loader/CachedResource.h b/WebCore/loader/CachedResource.h
index babdf89..05d24fc 100644
--- a/WebCore/loader/CachedResource.h
+++ b/WebCore/loader/CachedResource.h
@@ -129,7 +129,7 @@ public:
     // while still being referenced. This means the object should delete itself
     // if the number of clients observing it ever drops to 0.
     // The resource can be brought back to cache after successful revalidation.
-    void setInCache(bool b) { m_inCache = b; if (b) m_isBeingRevalidated = false; }
+    void setInCache(bool inCache) { m_inCache = inCache; }
     bool inCache() const { return m_inCache; }
     
     void setInLiveDecodedResourcesList(bool b) { m_inLiveDecodedResourcesList = b; }
@@ -142,7 +142,7 @@ public:
     void setResponse(const ResourceResponse&);
     const ResourceResponse& response() const { return m_response; }
 
-    bool canDelete() const { return !hasClients() && !m_request && !m_preloadCount && !m_handleCount && !m_resourceToRevalidate && !m_isBeingRevalidated; }
+    bool canDelete() const { return !hasClients() && !m_request && !m_preloadCount && !m_handleCount && !m_resourceToRevalidate && !m_proxyResource; }
 
     bool isExpired() const;
 
@@ -251,7 +251,10 @@ private:
     // to to be clients of m_resourceToRevalidate and the resource is deleted. If not, the field is zeroed and this
     // resources becomes normal resource load.
     CachedResource* m_resourceToRevalidate;
-    bool m_isBeingRevalidated;
+
+    // If this field is non-null, the resource has a proxy for checking whether it is still up to date (see m_resourceToRevalidate).
+    CachedResource* m_proxyResource;
+
     // These handles will need to be updated to point to the m_resourceToRevalidate in case we get 304 response.
     HashSet<CachedResourceHandleBase*> m_handlesToRevalidate;
 };
diff --git a/WebCore/loader/CachedResourceClient.h b/WebCore/loader/CachedResourceClient.h
index 2e0b15b..dd9bb94 100644
--- a/WebCore/loader/CachedResourceClient.h
+++ b/WebCore/loader/CachedResourceClient.h
@@ -25,6 +25,8 @@
 #ifndef CachedResourceClient_h
 #define CachedResourceClient_h
 
+#include <wtf/FastAllocBase.h>
+
 #if ENABLE(XBL)
 namespace XBL {
     class XBLDocument;
@@ -48,7 +50,7 @@ namespace WebCore {
      * inherit from this class and overload one of the 3 functions
      *
      */
-    class CachedResourceClient
+    class CachedResourceClient : public FastAllocBase
     {
     public:
         virtual ~CachedResourceClient() { }
diff --git a/WebCore/loader/CachedResourceHandle.h b/WebCore/loader/CachedResourceHandle.h
index 13c03c7..9d45b94 100644
--- a/WebCore/loader/CachedResourceHandle.h
+++ b/WebCore/loader/CachedResourceHandle.h
@@ -38,7 +38,8 @@ namespace WebCore {
         bool operator!() const { return !m_resource; }
         
         // This conversion operator allows implicit conversion to bool but not to other integer types.
-        typedef CachedResource* CachedResourceHandleBase::*UnspecifiedBoolType;
+        // Parenthesis is needed for winscw compiler to resolve class qualifier in this case.
+        typedef CachedResource* (CachedResourceHandleBase::*UnspecifiedBoolType);
         operator UnspecifiedBoolType() const { return m_resource ? &CachedResourceHandleBase::m_resource : 0; }
 
     protected:
diff --git a/WebCore/loader/CrossOriginPreflightResultCache.cpp b/WebCore/loader/CrossOriginPreflightResultCache.cpp
index 4bd05b2..cea66b1 100644
--- a/WebCore/loader/CrossOriginPreflightResultCache.cpp
+++ b/WebCore/loader/CrossOriginPreflightResultCache.cpp
@@ -30,6 +30,8 @@
 #include "CrossOriginAccessControl.h"
 #include "ResourceResponse.h"
 #include <wtf/CurrentTime.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Threading.h>
 
 namespace WebCore {
 
@@ -64,8 +66,7 @@ static void addToAccessControlAllowList(const String& string, unsigned start, un
     while (end && isSpaceOrNewline((*stringImpl)[end]))
         --end;
 
-    // substringCopy() is called on the strings because the cache is accessed on multiple threads.
-    set.add(string.substringCopy(start, end - start + 1));
+    set.add(string.substring(start, end - start + 1));
 }
 
 template<class HashType>
@@ -137,20 +138,20 @@ bool CrossOriginPreflightResultCacheItem::allowsRequest(bool includeCredentials,
 
 CrossOriginPreflightResultCache& CrossOriginPreflightResultCache::shared()
 {
-    AtomicallyInitializedStatic(CrossOriginPreflightResultCache&, cache = *new CrossOriginPreflightResultCache);
+    DEFINE_STATIC_LOCAL(CrossOriginPreflightResultCache, cache, ());
+    ASSERT(isMainThread());
     return cache;
 }
 
 void CrossOriginPreflightResultCache::appendEntry(const String& origin, const KURL& url, CrossOriginPreflightResultCacheItem* preflightResult)
 {
-    MutexLocker lock(m_mutex);
-    // Note that the entry may already be present in the HashMap if another thread is accessing the same location.
-    m_preflightHashMap.set(std::make_pair(origin.copy(), url.copy()), preflightResult);
+    ASSERT(isMainThread());
+    m_preflightHashMap.set(std::make_pair(origin, url), preflightResult);
 }
 
 bool CrossOriginPreflightResultCache::canSkipPreflight(const String& origin, const KURL& url, bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders)
 {
-    MutexLocker lock(m_mutex);
+    ASSERT(isMainThread());
     CrossOriginPreflightResultHashMap::iterator cacheIt = m_preflightHashMap.find(std::make_pair(origin, url));
     if (cacheIt == m_preflightHashMap.end())
         return false;
@@ -165,7 +166,7 @@ bool CrossOriginPreflightResultCache::canSkipPreflight(const String& origin, con
 
 void CrossOriginPreflightResultCache::empty()
 {
-    MutexLocker lock(m_mutex);
+    ASSERT(isMainThread());
     deleteAllValues(m_preflightHashMap);
     m_preflightHashMap.clear();
 }
diff --git a/WebCore/loader/CrossOriginPreflightResultCache.h b/WebCore/loader/CrossOriginPreflightResultCache.h
index f71d1c8..97b526a 100644
--- a/WebCore/loader/CrossOriginPreflightResultCache.h
+++ b/WebCore/loader/CrossOriginPreflightResultCache.h
@@ -72,7 +72,6 @@ namespace WebCore {
         typedef HashMap<std::pair<String, KURL>, CrossOriginPreflightResultCacheItem*> CrossOriginPreflightResultHashMap;
 
         CrossOriginPreflightResultHashMap m_preflightHashMap;
-        Mutex m_mutex;
     };
 
 } // namespace WebCore
diff --git a/WebCore/loader/DocLoader.cpp b/WebCore/loader/DocLoader.cpp
index 9c11a88..9e97354 100644
--- a/WebCore/loader/DocLoader.cpp
+++ b/WebCore/loader/DocLoader.cpp
@@ -200,6 +200,41 @@ bool DocLoader::canRequest(CachedResource::Type type, const KURL& url)
         ASSERT_NOT_REACHED();
         break;
     }
+
+    // Given that the load is allowed by the same-origin policy, we should
+    // check whether the load passes the mixed-content policy.
+    //
+    // Note: Currently, we always allow mixed content, but we generate a
+    //       callback to the FrameLoaderClient in case the embedder wants to
+    //       update any security indicators.
+    // 
+    switch (type) {
+    case CachedResource::Script:
+#if ENABLE(XSLT)
+    case CachedResource::XSLStyleSheet:
+#endif
+#if ENABLE(XBL)
+    case CachedResource::XBL:
+#endif
+        // These resource can inject script into the current document.
+        if (Frame* f = frame())
+            f->loader()->checkIfRunInsecureContent(m_doc->securityOrigin(), url);
+        break;
+    case CachedResource::ImageResource:
+    case CachedResource::CSSStyleSheet:
+    case CachedResource::FontResource: {
+        // These resources can corrupt only the frame's pixels.
+        if (Frame* f = frame()) {
+            Frame* top = f->tree()->top();
+            top->loader()->checkIfDisplayInsecureContent(top->document()->securityOrigin(), url);
+        }
+        break;
+    }
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+    // FIXME: Consider letting the embedder block mixed content loads.
     return true;
 }
 
@@ -224,7 +259,7 @@ CachedResource* DocLoader::requestResource(CachedResource::Type type, const Stri
     if (resource) {
         // Check final URL of resource to catch redirects.
         // See <https://bugs.webkit.org/show_bug.cgi?id=21963>.
-        if (!canRequest(type, KURL(resource->url())))
+        if (fullURL != resource->url() && !canRequest(type, KURL(ParsedURLString, resource->url())))
             return 0;
 
         m_documentResources.set(resource->url(), resource);
diff --git a/WebCore/loader/DocumentLoader.cpp b/WebCore/loader/DocumentLoader.cpp
index 4ec69a7..5ca6e58 100644
--- a/WebCore/loader/DocumentLoader.cpp
+++ b/WebCore/loader/DocumentLoader.cpp
@@ -148,7 +148,6 @@ DocumentLoader::DocumentLoader(const ResourceRequest& req, const SubstituteData&
     , m_gotFirstByte(false)
     , m_primaryLoadComplete(false)
     , m_isClientRedirect(false)
-    , m_loadingFromCachedPage(false)
     , m_stopRecordingResponses(false)
     , m_substituteResourceDeliveryTimer(this, &DocumentLoader::substituteResourceDeliveryTimerFired)
     , m_didCreateGlobalHistoryEntry(false)
@@ -278,7 +277,7 @@ void DocumentLoader::stopLoading(DatabasePolicy databasePolicy)
         Document* doc = m_frame->document();
         
         if (loading || doc->parsing())
-            m_frame->loader()->stopLoading(false, databasePolicy);
+            m_frame->loader()->stopLoading(UnloadEventPolicyNone, databasePolicy);
     }
 
     // Always cancel multipart loaders
@@ -568,7 +567,7 @@ void DocumentLoader::getSubresources(Vector<PassRefPtr<ArchiveResource> >& subre
     const DocLoader::DocumentResourceMap& allResources = document->docLoader()->allCachedResources();
     DocLoader::DocumentResourceMap::const_iterator end = allResources.end();
     for (DocLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
-        RefPtr<ArchiveResource> subresource = this->subresource(KURL(it->second->url()));
+        RefPtr<ArchiveResource> subresource = this->subresource(KURL(ParsedURLString, it->second->url()));
         if (subresource)
             subresources.append(subresource.release());
     }
@@ -697,16 +696,6 @@ bool DocumentLoader::urlForHistoryReflectsFailure() const
     return m_substituteData.isValid() || m_response.httpStatusCode() >= 400;
 }
 
-void DocumentLoader::loadFromCachedPage(PassRefPtr<CachedPage> cachedPage)
-{
-    LOG(PageCache, "WebCorePageCache: DocumentLoader %p loading from cached page %p", this, cachedPage.get());
-    
-    prepareForLoadStart();
-    setLoadingFromCachedPage(true);
-    setCommitted(true);
-    frameLoader()->commitProvisionalLoad(cachedPage);
-}
-
 const KURL& DocumentLoader::originalURL() const
 {
     return m_originalRequestCopy.url();
diff --git a/WebCore/loader/DocumentLoader.h b/WebCore/loader/DocumentLoader.h
index 134d954..1220a0e 100644
--- a/WebCore/loader/DocumentLoader.h
+++ b/WebCore/loader/DocumentLoader.h
@@ -43,8 +43,11 @@ namespace WebCore {
     class Archive;
     class ArchiveResource;
     class ArchiveResourceCollection;
+<<<<<<< HEAD:WebCore/loader/DocumentLoader.h
 #endif
     class CachedPage;
+=======
+>>>>>>> webkit.org at 49305:WebCore/loader/DocumentLoader.h
     class Frame;
     class FrameLoader;
     class MainResourceLoader;
@@ -174,10 +177,6 @@ namespace WebCore {
         bool didCreateGlobalHistoryEntry() const { return m_didCreateGlobalHistoryEntry; }
         void setDidCreateGlobalHistoryEntry(bool didCreateGlobalHistoryEntry) { m_didCreateGlobalHistoryEntry = didCreateGlobalHistoryEntry; }
         
-        void loadFromCachedPage(PassRefPtr<CachedPage>);
-        void setLoadingFromCachedPage(bool loading) { m_loadingFromCachedPage = loading; }
-        bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
-        
         void setDefersLoading(bool);
 
         bool startLoadingMainResource(unsigned long identifier);
@@ -264,7 +263,6 @@ namespace WebCore {
         bool m_gotFirstByte;
         bool m_primaryLoadComplete;
         bool m_isClientRedirect;
-        bool m_loadingFromCachedPage;
 
         String m_pageTitle;
 
diff --git a/WebCore/loader/DocumentThreadableLoader.cpp b/WebCore/loader/DocumentThreadableLoader.cpp
index dd5ca76..8a223fd 100644
--- a/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/WebCore/loader/DocumentThreadableLoader.cpp
@@ -32,8 +32,9 @@
 #include "DocumentThreadableLoader.h"
 
 #include "AuthenticationChallenge.h"
+#include "CrossOriginAccessControl.h"
+#include "CrossOriginPreflightResultCache.h"
 #include "Document.h"
-#include "DocumentThreadableLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "ResourceRequest.h"
@@ -43,61 +44,106 @@
 
 namespace WebCore {
 
-void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
-    bool sameOriginRequest = document->securityOrigin()->canRequest(request.url());
-
-    Vector<char> data;
-    ResourceError error;
-    ResourceResponse response;
-    unsigned long identifier = std::numeric_limits<unsigned long>::max();
-    if (document->frame())
-        identifier = document->frame()->loader()->loadResourceSynchronously(request, storedCredentials, error, response, data);
-
-    // No exception for file:/// resources, see <rdar://problem/4962298>.
-    // Also, if we have an HTTP response, then it wasn't a network error in fact.
-    if (!error.isNull() && !request.url().isLocalFile() && response.httpStatusCode() <= 0) {
-        client.didFail(error);
-        return;
-    }
-
-    // FIXME: This check along with the one in willSendRequest is specific to xhr and
-    // should be made more generic.
-    if (sameOriginRequest && !document->securityOrigin()->canRequest(response.url())) {
-        client.didFailRedirectCheck();
-        return;
-    }
-
-    client.didReceiveResponse(response);
-
-    const char* bytes = static_cast<const char*>(data.data());
-    int len = static_cast<int>(data.size());
-    client.didReceiveData(bytes, len);
-
-    client.didFinishLoading(identifier);
+    // The loader will be deleted as soon as this function exits.
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, &client, LoadSynchronously, request, options));
+    ASSERT(loader->hasOneRef());
 }
 
-PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, const ThreadableLoaderOptions& options)
 {
-    ASSERT(document);
-    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, LoadAsynchronously, request, options));
     if (!loader->m_loader)
         loader = 0;
     return loader.release();
 }
 
-DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, BlockingBehavior blockingBehavior, const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_client(client)
     , m_document(document)
-    , m_allowStoredCredentials(storedCredentials == AllowStoredCredentials)
+    , m_options(options)
     , m_sameOriginRequest(document->securityOrigin()->canRequest(request.url()))
-    , m_denyCrossOriginRedirect(crossOriginRedirectPolicy == DenyCrossOriginRedirect)
+    , m_async(blockingBehavior == LoadAsynchronously)
 {
     ASSERT(document);
     ASSERT(client);
-    ASSERT(storedCredentials == AllowStoredCredentials || storedCredentials == DoNotAllowStoredCredentials);
-    ASSERT(crossOriginRedirectPolicy == DenyCrossOriginRedirect || crossOriginRedirectPolicy == AllowCrossOriginRedirect);
-    m_loader = SubresourceLoader::create(document->frame(), this, request, false, callbacksSetting == SendLoadCallbacks, contentSniff == SniffContent);
+
+    if (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests) {
+        bool skipCanLoadCheck = false;
+        loadRequest(request, skipCanLoadCheck);
+        return;
+    }
+
+    if (m_options.crossOriginRequestPolicy == DenyCrossOriginRequests) {
+        m_client->didFail(ResourceError());
+        return;
+    }
+    
+    ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl);
+
+    if (!m_options.forcePreflight && isSimpleCrossOriginAccessRequest(request.httpMethod(), request.httpHeaderFields()))
+        makeSimpleCrossOriginAccessRequest(request);
+    else {
+        m_actualRequest.set(new ResourceRequest(request));
+        m_actualRequest->setAllowCookies(m_options.allowCredentials);
+
+        if (CrossOriginPreflightResultCache::shared().canSkipPreflight(document->securityOrigin()->toString(), request.url(), m_options.allowCredentials, request.httpMethod(), request.httpHeaderFields()))
+            preflightSuccess();
+        else
+            makeCrossOriginAccessRequestWithPreflight(request);
+    }
+}
+
+void DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest(const ResourceRequest& request)
+{
+    ASSERT(isSimpleCrossOriginAccessRequest(request.httpMethod(), request.httpHeaderFields()));
+
+    // Cross-origin requests are only defined for HTTP. We would catch this when checking response headers later, but there is no reason to send a request that's guaranteed to be denied.
+    if (!request.url().protocolInHTTPFamily()) {
+        m_client->didFail(ResourceError());
+        return;
+    }
+
+    // Make a copy of the passed request so that we can modify some details.
+    ResourceRequest crossOriginRequest(request);
+    crossOriginRequest.removeCredentials();
+    crossOriginRequest.setAllowCookies(m_options.allowCredentials);
+    crossOriginRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
+
+    bool skipCanLoadCheck = false;
+    loadRequest(crossOriginRequest, skipCanLoadCheck);
+}
+
+void DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight(const ResourceRequest& request)
+{
+    ResourceRequest preflightRequest(request.url());
+    preflightRequest.removeCredentials();
+    preflightRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
+    preflightRequest.setAllowCookies(m_options.allowCredentials);
+    preflightRequest.setHTTPMethod("OPTIONS");
+    preflightRequest.setHTTPHeaderField("Access-Control-Request-Method", request.httpMethod());
+
+    const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields();
+
+    if (requestHeaderFields.size() > 0) {
+        Vector<UChar> headerBuffer;
+        HTTPHeaderMap::const_iterator it = requestHeaderFields.begin();
+        append(headerBuffer, it->first);
+        ++it;
+
+        HTTPHeaderMap::const_iterator end = requestHeaderFields.end();
+        for (; it != end; ++it) {
+            headerBuffer.append(',');
+            headerBuffer.append(' ');
+            append(headerBuffer, it->first);
+        }
+
+        preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
+    }
+
+    bool skipCanLoadCheck = false;
+    loadRequest(preflightRequest, skipCanLoadCheck);
 }
 
 DocumentThreadableLoader::~DocumentThreadableLoader()
@@ -122,8 +168,7 @@ void DocumentThreadableLoader::willSendRequest(SubresourceLoader* loader, Resour
     ASSERT(m_client);
     ASSERT_UNUSED(loader, loader == m_loader);
 
-    // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
-    if (m_denyCrossOriginRedirect && !m_document->securityOrigin()->canRequest(request.url())) {
+    if (!isAllowedRedirect(request.url())) {
         RefPtr<DocumentThreadableLoader> protect(this);
         m_client->didFailRedirectCheck();
         request = ResourceRequest();
@@ -143,7 +188,31 @@ void DocumentThreadableLoader::didReceiveResponse(SubresourceLoader* loader, con
     ASSERT(m_client);
     ASSERT_UNUSED(loader, loader == m_loader);
 
-    m_client->didReceiveResponse(response);
+    if (m_actualRequest) {
+        if (!passesAccessControlCheck(response, m_options.allowCredentials, m_document->securityOrigin())) {
+            preflightFailure();
+            return;
+        }
+
+        OwnPtr<CrossOriginPreflightResultCacheItem> preflightResult(new CrossOriginPreflightResultCacheItem(m_options.allowCredentials));
+        if (!preflightResult->parse(response)
+            || !preflightResult->allowsCrossOriginMethod(m_actualRequest->httpMethod())
+            || !preflightResult->allowsCrossOriginHeaders(m_actualRequest->httpHeaderFields())) {
+            preflightFailure();
+            return;
+        }
+
+        CrossOriginPreflightResultCache::shared().appendEntry(m_document->securityOrigin()->toString(), m_actualRequest->url(), preflightResult.release());
+    } else {
+        if (!m_sameOriginRequest && m_options.crossOriginRequestPolicy == UseAccessControl) {
+            if (!passesAccessControlCheck(response, m_options.allowCredentials, m_document->securityOrigin())) {
+                m_client->didFail(ResourceError());
+                return;
+            }
+        }
+
+        m_client->didReceiveResponse(response);
+    }
 }
 
 void DocumentThreadableLoader::didReceiveData(SubresourceLoader* loader, const char* data, int lengthReceived)
@@ -158,7 +227,17 @@ void DocumentThreadableLoader::didFinishLoading(SubresourceLoader* loader)
 {
     ASSERT(loader == m_loader);
     ASSERT(m_client);
-    m_client->didFinishLoading(loader->identifier());
+    didFinishLoading(loader->identifier());
+}
+
+void DocumentThreadableLoader::didFinishLoading(unsigned long identifier)
+{
+    if (m_actualRequest) {
+        ASSERT(!m_sameOriginRequest);
+        ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl);
+        preflightSuccess();
+    } else
+        m_client->didFinishLoading(identifier);
 }
 
 void DocumentThreadableLoader::didFail(SubresourceLoader* loader, const ResourceError& error)
@@ -172,9 +251,9 @@ void DocumentThreadableLoader::didFail(SubresourceLoader* loader, const Resource
 
 bool DocumentThreadableLoader::getShouldUseCredentialStorage(SubresourceLoader* loader, bool& shouldUseCredentialStorage)
 {
-    ASSERT_UNUSED(loader, loader == m_loader);
+    ASSERT_UNUSED(loader, loader == m_loader || !m_loader);
 
-    if (!m_allowStoredCredentials) {
+    if (!m_options.allowCredentials) {
         shouldUseCredentialStorage = false;
         return true;
     }
@@ -200,4 +279,76 @@ void DocumentThreadableLoader::receivedCancellation(SubresourceLoader* loader, c
     m_client->didReceiveAuthenticationCancellation(challenge.failureResponse());
 }
 
+void DocumentThreadableLoader::preflightSuccess()
+{
+    OwnPtr<ResourceRequest> actualRequest;
+    actualRequest.swap(m_actualRequest);
+
+    bool skipCanLoadCheck = true;  // ok to skip load check since we already asked about the preflight request
+    loadRequest(*actualRequest, skipCanLoadCheck);
+}
+
+void DocumentThreadableLoader::preflightFailure()
+{
+    m_client->didFail(ResourceError());
+}
+
+void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, bool skipCanLoadCheck)
+{
+    if (m_async) {
+        // Don't sniff content or send load callbacks for the preflight request.
+        bool sendLoadCallbacks = m_options.sendLoadCallbacks && !m_actualRequest;
+        bool sniffContent = m_options.sniffContent && !m_actualRequest;
+
+        // Clear the loader so that any callbacks from SubresourceLoader::create will not have the old loader.
+        m_loader = 0;
+        m_loader = SubresourceLoader::create(m_document->frame(), this, request, skipCanLoadCheck, sendLoadCallbacks, sniffContent);
+        return;
+    }
+    
+    // FIXME: ThreadableLoaderOptions.sniffContent is not supported for synchronous requests.
+    StoredCredentials storedCredentials = m_options.allowCredentials ? AllowStoredCredentials : DoNotAllowStoredCredentials;
+
+    Vector<char> data;
+    ResourceError error;
+    ResourceResponse response;
+    unsigned long identifier = std::numeric_limits<unsigned long>::max();
+    if (m_document->frame())
+        identifier = m_document->frame()->loader()->loadResourceSynchronously(request, storedCredentials, error, response, data);
+
+    // No exception for file:/// resources, see <rdar://problem/4962298>.
+    // Also, if we have an HTTP response, then it wasn't a network error in fact.
+    if (!error.isNull() && !request.url().isLocalFile() && response.httpStatusCode() <= 0) {
+        m_client->didFail(error);
+        return;
+    }
+
+    // FIXME: FrameLoader::loadSynchronously() does not tell us whether a redirect happened or not, so we guess by comparing the
+    // request and response URLs. This isn't a perfect test though, since a server can serve a redirect to the same URL that was
+    // requested.
+    if (request.url() != response.url() && !isAllowedRedirect(response.url())) {
+        m_client->didFailRedirectCheck();
+        return;
+    }
+
+    didReceiveResponse(0, response);
+
+    const char* bytes = static_cast<const char*>(data.data());
+    int len = static_cast<int>(data.size());
+    didReceiveData(0, bytes, len);
+
+    didFinishLoading(identifier);
+}
+
+bool DocumentThreadableLoader::isAllowedRedirect(const KURL& url)
+{
+    if (m_options.crossOriginRequestPolicy == AllowCrossOriginRequests)
+        return true;
+
+    // FIXME: We need to implement access control for each redirect. This will require some refactoring though, because the code
+    // that processes redirects doesn't know about access control and expects a synchronous answer from its client about whether
+    // a redirect should proceed.
+    return m_sameOriginRequest && m_document->securityOrigin()->canRequest(url);
+}
+
 } // namespace WebCore
diff --git a/WebCore/loader/DocumentThreadableLoader.h b/WebCore/loader/DocumentThreadableLoader.h
index 465475f..64b1a22 100644
--- a/WebCore/loader/DocumentThreadableLoader.h
+++ b/WebCore/loader/DocumentThreadableLoader.h
@@ -33,19 +33,21 @@
 
 #include "SubresourceLoaderClient.h"
 #include "ThreadableLoader.h"
+#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
     class Document;
+    class KURL;
     struct ResourceRequest;
     class ThreadableLoaderClient;
 
     class DocumentThreadableLoader : public RefCounted<DocumentThreadableLoader>, public ThreadableLoader, private SubresourceLoaderClient  {
     public:
-        static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
-        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
+        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, const ThreadableLoaderOptions&);
         virtual ~DocumentThreadableLoader();
 
         virtual void cancel();
@@ -58,7 +60,13 @@ namespace WebCore {
         virtual void derefThreadableLoader() { deref(); }
 
     private:
-        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        enum BlockingBehavior {
+            LoadSynchronously,
+            LoadAsynchronously
+        };
+
+        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, BlockingBehavior blockingBehavior, const ResourceRequest&, const ThreadableLoaderOptions& options);
+
         virtual void willSendRequest(SubresourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
 
@@ -71,12 +79,22 @@ namespace WebCore {
         virtual void didReceiveAuthenticationChallenge(SubresourceLoader*, const AuthenticationChallenge&);
         virtual void receivedCancellation(SubresourceLoader*, const AuthenticationChallenge&);
 
+        void didFinishLoading(unsigned long identifier);
+        void makeSimpleCrossOriginAccessRequest(const ResourceRequest& request);
+        void makeCrossOriginAccessRequestWithPreflight(const ResourceRequest& request);
+        void preflightSuccess();
+        void preflightFailure();
+
+        void loadRequest(const ResourceRequest&, bool skipCanLoadCheck);
+        bool isAllowedRedirect(const KURL&);
+
         RefPtr<SubresourceLoader> m_loader;
         ThreadableLoaderClient* m_client;
         Document* m_document;
-        bool m_allowStoredCredentials;
+        ThreadableLoaderOptions m_options;
         bool m_sameOriginRequest;
-        bool m_denyCrossOriginRedirect;
+        bool m_async;
+        OwnPtr<ResourceRequest> m_actualRequest;  // non-null during Access Control preflight checks
     };
 
 } // namespace WebCore
diff --git a/WebCore/loader/EmptyClients.h b/WebCore/loader/EmptyClients.h
index 3f70c43..d9e09fb 100644
--- a/WebCore/loader/EmptyClients.h
+++ b/WebCore/loader/EmptyClients.h
@@ -39,6 +39,7 @@
 #include "FormState.h"
 #include "FrameLoaderClient.h"
 #include "InspectorClient.h"
+#include "PluginHalterClient.h"
 #include "ResourceError.h"
 #include "SharedBuffer.h"
 
@@ -120,9 +121,10 @@ public:
     virtual void scroll(const IntSize&, const IntRect&, const IntRect&) { }
     virtual IntPoint screenToWindow(const IntPoint& p) const { return p; }
     virtual IntRect windowToScreen(const IntRect& r) const { return r; }
-    virtual PlatformWidget platformWindow() const { return 0; }
+    virtual PlatformPageClient platformPageClient() const { return 0; }
     virtual void contentsSizeChanged(Frame*, const IntSize&) const { }
 
+    virtual void scrollbarsModeDidChange() const { }
     virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned) { }
 
     virtual void setToolTip(const String&, TextDirection) { }
@@ -137,6 +139,10 @@ public:
     virtual void reachedMaxAppCacheSize(int64_t) { }
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    virtual NotificationPresenter* notificationPresenter() const { return 0; }
+#endif
+
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) { }
 
     virtual void formStateDidChange(const Node*) { }
@@ -280,7 +286,8 @@ public:
 #endif
     virtual void saveViewStateToItem(HistoryItem*) { }
     virtual bool canCachePage() const { return false; }
-
+    virtual void didDisplayInsecureContent() { }
+    virtual void didRunInsecureContent(SecurityOrigin*) { }
     virtual PassRefPtr<Frame> createFrame(const KURL&, const String&, HTMLFrameOwnerElement*, const String&, bool, int, int) { return 0; }
     virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool) { return 0; }
     virtual PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL&, const Vector<String>&, const Vector<String>&) { return 0; }
@@ -414,6 +421,7 @@ public:
 
 };
 
+#if ENABLE(CONTEXT_MENUS)
 class EmptyContextMenuClient : public ContextMenuClient {
 public:
     virtual ~EmptyContextMenuClient() {  }
@@ -434,7 +442,9 @@ public:
     virtual void searchWithSpotlight() { }
 #endif
 };
+#endif // ENABLE(CONTEXT_MENUS)
 
+#if ENABLE(DRAG_SUPPORT)
 class EmptyDragClient : public DragClient {
 public:
     virtual ~EmptyDragClient() {}
@@ -446,6 +456,7 @@ public:
     virtual DragImageRef createDragImageForLink(KURL&, const String&, Frame*) { return 0; }
     virtual void dragControllerDestroyed() { }
 };
+#endif // ENABLE(DRAG_SUPPORT)
 
 class EmptyInspectorClient : public InspectorClient {
 public:
@@ -478,6 +489,12 @@ public:
     virtual void inspectorWindowObjectCleared() { }
 };
 
+class EmptyPluginHalterClient : public PluginHalterClient
+{
+public:
+    virtual bool shouldHaltPlugin(Node*) const { return false; }
+};
+
 }
 
 #endif // EmptyClients_h
diff --git a/WebCore/loader/FTPDirectoryDocument.cpp b/WebCore/loader/FTPDirectoryDocument.cpp
index ace4cfe..ee0f4ca 100644
--- a/WebCore/loader/FTPDirectoryDocument.cpp
+++ b/WebCore/loader/FTPDirectoryDocument.cpp
@@ -118,7 +118,7 @@ void FTPDirectoryTokenizer::appendEntry(const String& filename, const String& si
     rowElement->setAttribute("class", "ftpDirectoryEntryRow", ec);
    
     RefPtr<Element> element = m_doc->createElement(tdTag, false);
-    element->appendChild(new Text(m_doc, String(&noBreakSpace, 1)), ec);
+    element->appendChild(Text::create(m_doc, String(&noBreakSpace, 1)), ec);
     if (isDirectory)
         element->setAttribute("class", "ftpDirectoryIcon ftpDirectoryTypeDirectory", ec);
     else
@@ -130,12 +130,12 @@ void FTPDirectoryTokenizer::appendEntry(const String& filename, const String& si
     rowElement->appendChild(element, ec);
     
     element = m_doc->createElement(tdTag, false);
-    element->appendChild(new Text(m_doc, date), ec);
+    element->appendChild(Text::create(m_doc, date), ec);
     element->setAttribute("class", "ftpDirectoryFileDate", ec);
     rowElement->appendChild(element, ec);
     
     element = m_doc->createElement(tdTag, false);
-    element->appendChild(new Text(m_doc, size), ec);
+    element->appendChild(Text::create(m_doc, size), ec);
     element->setAttribute("class", "ftpDirectoryFileSize", ec);
     rowElement->appendChild(element, ec);
 }
@@ -152,7 +152,7 @@ PassRefPtr<Element> FTPDirectoryTokenizer::createTDForFilename(const String& fil
 
     RefPtr<Element> anchorElement = m_doc->createElement(aTag, false);
     anchorElement->setAttribute("href", fullURL, ec);
-    anchorElement->appendChild(new Text(m_doc, filename), ec);
+    anchorElement->appendChild(Text::create(m_doc, filename), ec);
     
     RefPtr<Element> tdElement = m_doc->createElement(tdTag, false);
     tdElement->appendChild(anchorElement, ec);
diff --git a/WebCore/loader/FTPDirectoryDocument.h b/WebCore/loader/FTPDirectoryDocument.h
index ecc6f73..b208c4e 100644
--- a/WebCore/loader/FTPDirectoryDocument.h
+++ b/WebCore/loader/FTPDirectoryDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@ class FTPDirectoryDocument : public HTMLDocument {
 public:
     static PassRefPtr<FTPDirectoryDocument> create(Frame* frame)
     {
-        return new FTPDirectoryDocument(frame);
+        return adoptRef(new FTPDirectoryDocument(frame));
     }
 
 private:
diff --git a/WebCore/loader/FTPDirectoryParser.cpp b/WebCore/loader/FTPDirectoryParser.cpp
index 6573fb6..40bd714 100644
--- a/WebCore/loader/FTPDirectoryParser.cpp
+++ b/WebCore/loader/FTPDirectoryParser.cpp
@@ -57,6 +57,13 @@ static struct tm *gmtimeQt(const time_t *const timep, struct tm *result)
 #endif
 #endif
 
+static inline FTPEntryType ParsingFailed(ListState& state)
+{
+  if (state.parsedOne || state.listStyle) /* junk if we fail to parse */
+    return FTPJunkEntry;      /* this time but had previously parsed sucessfully */
+  return FTPMiscEntry;        /* its part of a comment or error message */
+}
+
 FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& result)
 {
   result.clear();
@@ -126,6 +133,9 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
       }
     }    
 
+    if (!numtoks)
+      return ParsingFailed(state);
+
     linelen_sans_wsp = &(tokens[numtoks-1][toklen[numtoks-1]]) - tokens[0];
     if (numtoks == (sizeof(tokens)/sizeof(tokens[0])) )
     {
@@ -356,11 +366,16 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
               pos++;
               p++;
             }
-            if (lstyle && pos < (toklen[0]-1) && *p == ']')
+            if (lstyle && pos < (toklen[0]-1))
             {
+              /* ']' was found and there is at least one character after it */
+              ASSERT(*p == ']');
               pos++;
               p++;
               tokmarker = pos; /* length of leading "[DIR1.DIR2.etc]" */
+            } else {
+              /* not a CMU style listing */
+              lstyle = 0;
             }
           }
           while (lstyle && pos < toklen[0] && *p != ';')
@@ -387,7 +402,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
           pos -= tokmarker;      /* => fnlength sans "[DIR1.DIR2.etc]" */
           p = &(tokens[0][tokmarker]); /* offset of basename */
 
-          if (!lstyle || pos > 80) /* VMS filenames can't be longer than that */
+          if (!lstyle || pos == 0 || pos > 80) /* VMS filenames can't be longer than that */
           {
             lstyle = 0;
           }
@@ -780,7 +795,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
         state.parsedOne = true;
         state.listStyle = lstyle;
 
-        p = &(line[linelen_sans_wsp]); /* line end sans wsp */
+        p = &(line[linelen]); /* line end */
         result.caseSensitive = true;
         result.filename = tokens[3];
         result.filenameLength = p - tokens[3];
@@ -788,29 +803,46 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
 
         if (*tokens[2] != '<') /* not <DIR> or <JUNCTION> */
         {
+          // try to handle correctly spaces at the beginning of the filename
+          // filesize (token[2]) must end at offset 38
+          if (tokens[2] + toklen[2] - line == 38) {
+            result.filename = &(line[39]);
+            result.filenameLength = p - result.filename;
+          }
           result.type = FTPFileEntry;
           pos = toklen[2];
           result.fileSize = String(tokens[2], pos);
         }
-        else if ((tokens[2][1]) != 'D') /* not <DIR> */
-        {
-          result.type = FTPJunkEntry; /* unknown until junc for sure */
-          if (result.filenameLength > 4)
+        else {
+          // try to handle correctly spaces at the beginning of the filename
+          // token[2] must begin at offset 24, the length is 5 or 10
+          // token[3] must begin at offset 39 or higher
+          if (tokens[2] - line == 24 && (toklen[2] == 5 || toklen[2] == 10) &&
+              tokens[3] - line >= 39) {
+            result.filename = &(line[39]);
+            result.filenameLength = p - result.filename;
+          }
+
+          if ((tokens[2][1]) != 'D') /* not <DIR> */
           {
-            p = result.filename;
-            for (pos = result.filenameLength - 4; pos > 0; pos--)
+            result.type = FTPJunkEntry; /* unknown until junc for sure */
+            if (result.filenameLength > 4)
             {
-              if (p[0] == ' ' && p[3] == ' ' && p[2] == '>' &&
-                  (p[1] == '=' || p[1] == '-'))
+              p = result.filename;
+              for (pos = result.filenameLength - 4; pos > 0; pos--)
               {
-                result.type = FTPLinkEntry;
-                result.filenameLength = p - result.filename;
-                result.linkname = p + 4;
-                result.linknameLength = &(line[linelen_sans_wsp]) 
-                                   - result.linkname;
-                break;
+                if (p[0] == ' ' && p[3] == ' ' && p[2] == '>' &&
+                    (p[1] == '=' || p[1] == '-'))
+                {
+                  result.type = FTPLinkEntry;
+                  result.filenameLength = p - result.filename;
+                  result.linkname = p + 4;
+                  result.linknameLength = &(line[linelen]) 
+                                     - result.linkname;
+                  break;
+                }
+                p++;
               }
-              p++;
             }    
           }
         }
@@ -821,8 +853,13 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
           result.modifiedTime.tm_mon--;
           result.modifiedTime.tm_mday = atoi(tokens[0]+3);
           result.modifiedTime.tm_year = atoi(tokens[0]+6);
+          /* if year has only two digits then assume that
+               00-79 is 2000-2079
+               80-99 is 1980-1999 */
           if (result.modifiedTime.tm_year < 80)
-            result.modifiedTime.tm_year += 100;
+            result.modifiedTime.tm_year += 2000;
+          else if (result.modifiedTime.tm_year < 100)
+            result.modifiedTime.tm_year += 1900;
         }
 
         result.modifiedTime.tm_hour = atoi(tokens[1]+0);
@@ -974,6 +1011,8 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
        * "drwxr-xr-x  2 0  0  512 May 28 22:17 etc"
       */
     
+      bool isOldHellsoft = false;
+    
       if (numtoks >= 6)
       {
         /* there are two perm formats (Hellsoft/NetWare and *IX strmode(3)).
@@ -999,6 +1038,8 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
             {
               /* rest is FMA[S] or AFM[S] */
               lstyle = 'U'; /* very likely one of the NetWare servers */
+              if (toklen[0] == 10)
+                isOldHellsoft = true;
             }
           }
         }
@@ -1063,7 +1104,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
 
             /* check that size is numeric */
             p = tokens[tokmarker];
-            for (pos = 0; lstyle && pos < toklen[tokmarker]; pos++)
+            for (unsigned int i = 0; lstyle && i < toklen[tokmarker]; ++i)
             {
               if (!isASCIIDigit(*p++))
                 lstyle = 0;
@@ -1072,11 +1113,11 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
             {
               month_num = 0;
               p = tokens[tokmarker+1];
-              for (pos = 0;pos < (12*3); pos+=3)
+              for (unsigned int i = 0; i < (12*3); i+=3)
               {
-                if (p[0] == month_names[pos+0] && 
-                    p[1] == month_names[pos+1] && 
-                    p[2] == month_names[pos+2])
+                if (p[0] == month_names[i+0] && 
+                    p[1] == month_names[i+1] && 
+                    p[2] == month_names[i+2])
                   break;
                 month_num++;
               }
@@ -1084,8 +1125,8 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
                 lstyle = 0;
             }
           } /* relative position test */
-        } /* while (pos+5) < numtoks */
-      } /* if (numtoks >= 4) */
+        } /* for (pos = (numtoks-5); !lstyle && pos > 1; pos--) */
+      } /* if (lstyle == 'U') */
 
       if (lstyle == 'U')
       {
@@ -1144,24 +1185,49 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
        
         } /* time/year */
         
-        result.filename = tokens[tokmarker+4];
-        result.filenameLength = (&(line[linelen_sans_wsp]))
+        // there is exacly 1 space between filename and previous token in all
+        // outputs except old Hellsoft
+        if (!isOldHellsoft)
+          result.filename = tokens[tokmarker+3] + toklen[tokmarker+3] + 1;
+        else
+          result.filename = tokens[tokmarker+4];
+
+        result.filenameLength = (&(line[linelen]))
                            - (result.filename);
 
         if (result.type == FTPLinkEntry && result.filenameLength > 4)
         {
-          p = result.filename + 1;
-          for (pos = 1; pos < (result.filenameLength - 4); pos++)
+          /* First try to use result.fe_size to find " -> " sequence.
+             This can give proper result for cases like "aaa -> bbb -> ccc". */
+          unsigned int fileSize = result.fileSize.toUInt();
+
+          if (result.filenameLength > (fileSize + 4) &&
+              strncmp(result.filename + result.filenameLength - fileSize - 4, " -> ", 4) == 0)
+          {
+            result.linkname = result.filename + (result.filenameLength - fileSize);
+            result.linknameLength = (&(line[linelen])) - (result.linkname);
+            result.filenameLength -= fileSize + 4;
+          }
+          else
           {
-            if (*p == ' ' && p[1] == '-' && p[2] == '>' && p[3] == ' ')
+            /* Search for sequence " -> " from the end for case when there are
+               more occurrences. F.e. if ftpd returns "a -> b -> c" assume
+               "a -> b" as a name. Powerusers can remove unnecessary parts
+               manually but there is no way to follow the link when some
+               essential part is missing. */
+            p = result.filename + (result.filenameLength - 5);
+            for (pos = (result.filenameLength - 5); pos > 0; pos--)
             {
-              result.linkname = p + 4;
-              result.linknameLength = (&(line[linelen_sans_wsp]))
-                               - (result.linkname);
-              result.filenameLength = pos;
-              break;
+              if (strncmp(p, " -> ", 4) == 0)
+              {
+                result.linkname = p + 4;
+                result.linknameLength = (&(line[linelen]))
+                                 - (result.linkname);
+                result.filenameLength = pos;
+                break;
+              }
+              p--;
             }
-            p++;
           }
         }
 
@@ -1618,9 +1684,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
 
   } /* if (linelen > 0) */
 
-  if (state.parsedOne || state.listStyle) /* junk if we fail to parse */
-    return FTPJunkEntry;      /* this time but had previously parsed sucessfully */
-  return FTPMiscEntry;        /* its part of a comment or error message */
+  return ParsingFailed(state);
 }
 
 } // namespace WebCore
diff --git a/WebCore/loader/FrameLoader.cpp b/WebCore/loader/FrameLoader.cpp
index c28040f..9dfefcd 100644
--- a/WebCore/loader/FrameLoader.cpp
+++ b/WebCore/loader/FrameLoader.cpp
@@ -73,6 +73,7 @@
 #include "Page.h"
 #include "PageCache.h"
 #include "PageGroup.h"
+#include "PageTransitionEvent.h"
 #include "PlaceholderDocument.h"
 #include "PluginData.h"
 #include "PluginDocument.h"
@@ -89,6 +90,11 @@
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "Settings.h"
+
+#if ENABLE(SHARED_WORKERS)
+#include "SharedWorkerRepository.h"
+#endif
+
 #include "TextResourceDecoder.h"
 #include "WindowFeatures.h"
 #include "XMLHttpRequest.h"
@@ -108,6 +114,7 @@
 #include "SVGViewSpec.h"
 #endif
 
+<<<<<<< HEAD:WebCore/loader/FrameLoader.cpp
 #ifdef ANDROID_INSTRUMENT
 #include "TimeCounter.h"
 #include "RenderArena.h"
@@ -115,6 +122,10 @@
 
 #if PLATFORM(ANDROID)
 #include "WebCoreFrameBridge.h"
+=======
+#if PLATFORM(MAC) || PLATFORM(WIN)
+#define PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
+>>>>>>> webkit.org at 49305:WebCore/loader/FrameLoader.cpp
 #endif
 
 namespace WebCore {
@@ -124,91 +135,12 @@ using namespace SVGNames;
 #endif
 using namespace HTMLNames;
 
-struct ScheduledRedirection {
-    enum Type { redirection, locationChange, historyNavigation, formSubmission };
-
-    const Type type;
-    const double delay;
-    const String url;
-    const String referrer;
-    const FrameLoadRequest frameRequest;
-    const RefPtr<Event> event;
-    const RefPtr<FormState> formState;
-    const int historySteps;
-    const bool lockHistory;
-    const bool lockBackForwardList;
-    const bool wasUserGesture;
-    const bool wasRefresh;
-    const bool wasDuringLoad;
-
-    ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
-        : type(redirection)
-        , delay(delay)
-        , url(url)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(wasUserGesture)
-        , wasRefresh(refresh)
-        , wasDuringLoad(false)
-    {
-        ASSERT(!url.isEmpty());
-    }
-
-    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
-        : type(locationChange)
-        , delay(0)
-        , url(url)
-        , referrer(referrer)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(wasUserGesture)
-        , wasRefresh(refresh)
-        , wasDuringLoad(duringLoad)
-    {
-        ASSERT(!url.isEmpty());
-    }
-
-    explicit ScheduledRedirection(int historyNavigationSteps)
-        : type(historyNavigation)
-        , delay(0)
-        , historySteps(historyNavigationSteps)
-        , lockHistory(false)
-        , lockBackForwardList(false)
-        , wasUserGesture(false)
-        , wasRefresh(false)
-        , wasDuringLoad(false)
-    {
-    }
-
-    ScheduledRedirection(const FrameLoadRequest& frameRequest,
-            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
-            bool duringLoad)
-        : type(formSubmission)
-        , delay(0)
-        , frameRequest(frameRequest)
-        , event(event)
-        , formState(formState)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(false)
-        , wasRefresh(false)
-        , wasDuringLoad(duringLoad)
-    {
-        ASSERT(!frameRequest.isEmpty());
-        ASSERT(this->formState);
-    }
-};
- 
 #if ENABLE(XHTMLMP)
 static const char defaultAcceptHeader[] = "application/xml,application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
 #else
 static const char defaultAcceptHeader[] = "application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
 #endif
 static double storedTimeOfLastCompletedLoad;
-static FrameLoader::LocalLoadPolicy localLoadPolicy = FrameLoader::AllowLocalLoadsForLocalOnly;
 
 bool isBackForwardLoadType(FrameLoadType type)
 {
@@ -246,12 +178,10 @@ static inline bool canReferToParentFrameEncoding(const Frame* frame, const Frame
 FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     : m_frame(frame)
     , m_client(client)
+    , m_policyChecker(frame)
     , m_state(FrameStateCommittedPage)
     , m_loadType(FrameLoadTypeStandard)
-    , m_policyLoadType(FrameLoadTypeStandard)
     , m_delegateIsHandlingProvisionalLoadError(false)
-    , m_delegateIsDecidingNavigationPolicy(false)
-    , m_delegateIsHandlingUnimplementablePolicy(false)
     , m_firstLayoutDone(false)
     , m_quickRedirectComing(false)
     , m_sentRedirectNotification(false)
@@ -263,20 +193,19 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_unloadEventBeingDispatched(false)
     , m_isComplete(false)
     , m_isLoadingMainResource(false)
-    , m_cancellingWithLoadInProgress(false)
     , m_needsClear(false)
     , m_receivedData(false)
     , m_encodingWasChosenByUser(false)
     , m_containsPlugIns(false)
-    , m_redirectionTimer(this, &FrameLoader::redirectionTimerFired)
-    , m_checkCompletedTimer(this, &FrameLoader::checkCompletedTimerFired)
-    , m_checkLoadCompleteTimer(this, &FrameLoader::checkLoadCompleteTimerFired)
+    , m_checkTimer(this, &FrameLoader::checkTimerFired)
+    , m_shouldCallCheckCompleted(false)
+    , m_shouldCallCheckLoadComplete(false)
     , m_opener(0)
-    , m_openedByDOM(false)
     , m_creatingInitialEmptyDocument(false)
     , m_isDisplayingInitialEmptyDocument(false)
     , m_committedFirstRealDocumentLoad(false)
     , m_didPerformFirstNavigation(false)
+    , m_loadingFromCachedPage(false)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
@@ -299,7 +228,7 @@ void FrameLoader::init()
     // this somewhat odd set of steps is needed to give the frame an initial empty document
     m_isDisplayingInitialEmptyDocument = false;
     m_creatingInitialEmptyDocument = true;
-    setPolicyDocumentLoader(m_client->createDocumentLoader(ResourceRequest(KURL("")), SubstituteData()).get());
+    setPolicyDocumentLoader(m_client->createDocumentLoader(ResourceRequest(KURL(ParsedURLString, "")), SubstituteData()).get());
     setProvisionalDocumentLoader(m_policyDocumentLoader.get());
     setState(FrameStateProvisional);
     m_provisionalDocumentLoader->setResponse(ResourceResponse(KURL(), "text/html", 0, String(), String()));
@@ -319,6 +248,11 @@ void FrameLoader::setDefersLoading(bool defers)
         m_provisionalDocumentLoader->setDefersLoading(defers);
     if (m_policyDocumentLoader)
         m_policyDocumentLoader->setDefersLoading(defers);
+
+    if (!defers) {
+        m_frame->redirectScheduler()->startTimer();
+        startCheckCompleteTimer();
+    }
 }
 
 Frame* FrameLoader::createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest& request, const WindowFeatures& features, bool& created)
@@ -433,7 +367,7 @@ bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String
 
     Frame* frame = ownerElement->contentFrame();
     if (frame)
-        frame->loader()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, isProcessingUserGesture());
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, isProcessingUserGesture());
     else
         frame = loadSubframe(ownerElement, url, frameName, m_outgoingReferrer);
     
@@ -458,12 +392,12 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
         marginHeight = o->getMarginHeight();
     }
 
-    if (!canLoad(url, referrer)) {
+    if (!SecurityOrigin::canLoad(url, referrer, 0)) {
         FrameLoader::reportLocalLoadFailed(m_frame, url.string());
         return 0;
     }
 
-    bool hideReferrer = shouldHideReferrer(url, referrer);
+    bool hideReferrer = SecurityOrigin::shouldHideReferrer(url, referrer);
     RefPtr<Frame> frame = m_client->createFrame(url, name, ownerElement, hideReferrer ? String() : referrer, allowsScrolling, marginWidth, marginHeight);
 
     if (!frame)  {
@@ -571,23 +505,27 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     frameRequest.resourceRequest().setURL(u);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
-    targetFrame->loader()->scheduleFormSubmission(frameRequest, lockHistory, event, formState);
+    targetFrame->redirectScheduler()->scheduleFormSubmission(frameRequest, lockHistory, event, formState);
 }
 
-void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
+void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolicy databasePolicy)
 {
     if (m_frame->document() && m_frame->document()->tokenizer())
         m_frame->document()->tokenizer()->stopParsing();
 
-    if (sendUnload) {
+    if (unloadEventPolicy != UnloadEventPolicyNone) {
         if (m_frame->document()) {
             if (m_didCallImplicitClose && !m_wasUnloadEventEmitted) {
                 Node* currentFocusedNode = m_frame->document()->focusedNode();
                 if (currentFocusedNode)
                     currentFocusedNode->aboutToUnload();
                 m_unloadEventBeingDispatched = true;
-                if (m_frame->domWindow())
-                    m_frame->domWindow()->dispatchUnloadEvent();
+                if (m_frame->domWindow()) {
+                    if (unloadEventPolicy == UnloadEventPolicyUnloadAndPageHide)
+                        m_frame->domWindow()->dispatchEvent(PageTransitionEvent::create(EventNames().pagehideEvent, m_frame->document()->inPageCache()), m_frame->document());
+                    if (!m_frame->document()->inPageCache())
+                        m_frame->domWindow()->dispatchEvent(Event::create(eventNames().unloadEvent, false, false), m_frame->domWindow()->document());
+                }
                 m_unloadEventBeingDispatched = false;
                 if (m_frame->document())
                     m_frame->document()->updateStyleIfNeeded();
@@ -600,7 +538,7 @@ void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
             m_frame->document()->removeAllEventListeners();
     }
 
-    m_isComplete = true; // to avoid calling completed() in finishedParsing() (David)
+    m_isComplete = true; // to avoid calling completed() in finishedParsing()
     m_isLoadingMainResource = false;
     m_didCallImplicitClose = true; // don't want that one either
 
@@ -623,9 +561,9 @@ void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
 
     // tell all subframes to stop as well
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->loader()->stopLoading(sendUnload);
+        child->loader()->stopLoading(unloadEventPolicy);
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 }
 
 void FrameLoader::stop()
@@ -645,20 +583,15 @@ void FrameLoader::stop()
 bool FrameLoader::closeURL()
 {
     saveDocumentState();
-    stopLoading(true);
+    
+    // Should only send the pagehide event here if the current document exists and has not been placed in the page cache.    
+    Document* currentDocument = m_frame->document();
+    stopLoading(currentDocument && !currentDocument->inPageCache() ? UnloadEventPolicyUnloadAndPageHide : UnloadEventPolicyUnloadOnly);
+    
     m_frame->editor()->clearUndoRedoOperations();
     return true;
 }
 
-void FrameLoader::cancelRedirection(bool cancelWithLoadInProgress)
-{
-    m_cancellingWithLoadInProgress = cancelWithLoadInProgress;
-
-    stopRedirectionTimer();
-
-    m_scheduledRedirection.clear();
-}
-
 KURL FrameLoader::iconURL()
 {
     // If this isn't a top level frame, return nothing
@@ -667,7 +600,7 @@ KURL FrameLoader::iconURL()
 
     // If we have an iconURL from a Link element, return that
     if (!m_frame->document()->iconURL().isEmpty())
-        return KURL(m_frame->document()->iconURL());
+        return KURL(ParsedURLString, m_frame->document()->iconURL());
 
     // Don't return a favicon iconURL unless we're http or https
     if (!m_URL.protocolInHTTPFamily())
@@ -684,13 +617,13 @@ KURL FrameLoader::iconURL()
 
 bool FrameLoader::didOpenURL(const KURL& url)
 {
-    if (m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad) {
+    if (m_frame->redirectScheduler()->redirectScheduledDuringLoad()) {
         // A redirect was scheduled before the document was created.
         // This can happen when one frame changes another frame's location.
         return false;
     }
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
     m_frame->editor()->clearLastEditCommand();
     closeURL();
 
@@ -727,7 +660,7 @@ void FrameLoader::didExplicitOpen()
     // from a subsequent window.document.open / window.document.write call. 
     // Cancelling redirection here works for all cases because document.open 
     // implicitly precedes document.write.
-    cancelRedirection(); 
+    m_frame->redirectScheduler()->cancel(); 
     if (m_frame->document()->url() != blankURL())
         m_URL = m_frame->document()->url();
 }
@@ -742,8 +675,10 @@ bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool
 
     const int javascriptSchemeLength = sizeof("javascript:") - 1;
 
-    String script = decodeURLEscapeSequences(url.string().substring(javascriptSchemeLength));
-    ScriptValue result = executeScript(script, userGesture);
+    String script = url.string().substring(javascriptSchemeLength);
+    ScriptValue result;
+    if (m_frame->script()->xssAuditor()->canEvaluateJavaScriptURL(script))
+        result = executeScript(decodeURLEscapeSequences(script), userGesture);
 
     String scriptResult;
     if (!result.getString(scriptResult))
@@ -789,7 +724,7 @@ ScriptValue FrameLoader::executeScript(const ScriptSourceCode& sourceCode)
 
 void FrameLoader::cancelAndClear()
 {
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 
     if (!m_isComplete)
         closeURL();
@@ -798,7 +733,7 @@ void FrameLoader::cancelAndClear()
     m_frame->script()->updatePlatformScriptObjects();
 }
 
-void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects)
+void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView)
 {
     m_frame->editor()->clear();
 
@@ -825,7 +760,7 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects)
 
     m_frame->selection()->clear();
     m_frame->eventHandler()->clear();
-    if (m_frame->view())
+    if (clearFrameView && m_frame->view())
         m_frame->view()->clear();
 
     m_frame->setSelectionGranularity(CharacterGranularity);
@@ -840,11 +775,11 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects)
     if (clearScriptObjects)
         m_frame->script()->clearScriptObjects();
 
-    m_redirectionTimer.stop();
-    m_scheduledRedirection.clear();
+    m_frame->redirectScheduler()->clear();
 
-    m_checkCompletedTimer.stop();
-    m_checkLoadCompleteTimer.stop();
+    m_checkTimer.stop();
+    m_shouldCallCheckCompleted = false;
+    m_shouldCallCheckLoadComplete = false;
 
     m_receivedData = false;
     m_isDisplayingInitialEmptyDocument = false;
@@ -881,7 +816,7 @@ void FrameLoader::receivedFirstData()
     else
         url = m_frame->document()->completeURL(url).string();
 
-    scheduleHTTPRedirection(delay, url);
+    m_frame->redirectScheduler()->scheduleRedirect(delay, url);
 }
 
 const String& FrameLoader::responseMIMEType() const
@@ -933,12 +868,9 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_outgoingReferrer = ref.string();
     m_URL = url;
 
+    document->setURL(m_URL);
     m_frame->setDocument(document);
 
-    if (dispatch)
-        dispatchWindowObjectAvailable();
-
-    document->setURL(m_URL);
     if (m_decoder)
         document->setDecoder(m_decoder.get());
     if (forcedSecurityOrigin)
@@ -947,6 +879,9 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_frame->domWindow()->setURL(document->url());
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
+    if (dispatch)
+        dispatchWindowObjectAvailable();
+    
     updateFirstPartyForCookies();
 
     Settings* settings = document->settings();
@@ -961,12 +896,6 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
             document->parseDNSPrefetchControlHeader(dnsPrefetchControl);
     }
 
-#if FRAME_LOADS_USER_STYLESHEET
-    KURL userStyleSheet = settings ? settings->userStyleSheetLocation() : KURL();
-    if (!userStyleSheet.isEmpty())
-        m_frame->setUserStyleSheetLocation(userStyleSheet);
-#endif
-
     restoreDocumentState();
 
     document->implicitOpen();
@@ -1146,21 +1075,6 @@ void FrameLoader::startIconLoader()
     m_iconLoader->startLoading();
 }
 
-void FrameLoader::setLocalLoadPolicy(LocalLoadPolicy policy)
-{
-    localLoadPolicy = policy;
-}
-
-bool FrameLoader::restrictAccessToLocal()
-{
-    return localLoadPolicy != FrameLoader::AllowLocalLoadsForAll;
-}
-
-bool FrameLoader::allowSubstituteDataAccessToLocal()
-{
-    return localLoadPolicy != FrameLoader::AllowLocalLoadsForLocalOnly;
-}
-
 void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
 {
     ASSERT(iconDatabase());
@@ -1220,6 +1134,8 @@ void FrameLoader::finishedParsing()
     if (m_creatingInitialEmptyDocument)
         return;
 
+    m_frame->injectUserScripts(InjectAtDocumentEnd);
+
     // This can be called from the Frame's destructor, in which case we shouldn't protect ourselves
     // because doing so will cause us to re-enter the destructor when protector goes out of scope.
     // Null-checking the FrameView indicates whether or not we're in the destructor.
@@ -1244,15 +1160,34 @@ void FrameLoader::loadDone()
     checkCompleted();
 }
 
+bool FrameLoader::allChildrenAreComplete() const
+{
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
+        if (!child->loader()->m_isComplete)
+            return false;
+    }
+    return true;
+}
+
+bool FrameLoader::allAncestorsAreComplete() const
+{
+    for (Frame* ancestor = m_frame; ancestor; ancestor = ancestor->tree()->parent()) {
+        if (!ancestor->loader()->m_isComplete)
+            return false;
+    }
+    return true;
+}
+
 void FrameLoader::checkCompleted()
 {
+    m_shouldCallCheckCompleted = false;
+
     if (m_frame->view())
         m_frame->view()->checkStopDelayingDeferredRepaints();
 
     // Any frame that hasn't completed yet?
-    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        if (!child->loader()->m_isComplete)
-            return;
+    if (!allChildrenAreComplete())
+        return;
 
     // Have we completed before?
     if (m_isComplete)
@@ -1272,38 +1207,44 @@ void FrameLoader::checkCompleted()
     RefPtr<Frame> protect(m_frame);
     checkCallImplicitClose(); // if we didn't do it before
 
-    // Do not start a redirection timer for subframes here.
-    // That is deferred until the parent is completed.
-    if (m_scheduledRedirection && !m_frame->tree()->parent())
-        startRedirectionTimer();
+    m_frame->redirectScheduler()->startTimer();
 
     completed();
     if (m_frame->page())
         checkLoadComplete();
 }
 
-void FrameLoader::checkCompletedTimerFired(Timer<FrameLoader>*)
+void FrameLoader::checkTimerFired(Timer<FrameLoader>*)
 {
-    checkCompleted();
+    if (Page* page = m_frame->page()) {
+        if (page->defersLoading())
+            return;
+    }
+    if (m_shouldCallCheckCompleted)
+        checkCompleted();
+    if (m_shouldCallCheckLoadComplete)
+        checkLoadComplete();
 }
 
-void FrameLoader::scheduleCheckCompleted()
+void FrameLoader::startCheckCompleteTimer()
 {
-    if (!m_checkCompletedTimer.isActive())
-        m_checkCompletedTimer.startOneShot(0);
+    if (!(m_shouldCallCheckCompleted || m_shouldCallCheckLoadComplete))
+        return;
+    if (m_checkTimer.isActive())
+        return;
+    m_checkTimer.startOneShot(0);
 }
 
-void FrameLoader::checkLoadCompleteTimerFired(Timer<FrameLoader>*)
+void FrameLoader::scheduleCheckCompleted()
 {
-    if (!m_frame->page())
-        return;
-    checkLoadComplete();
+    m_shouldCallCheckCompleted = true;
+    startCheckCompleteTimer();
 }
 
 void FrameLoader::scheduleCheckLoadComplete()
 {
-    if (!m_checkLoadCompleteTimer.isActive())
-        m_checkLoadCompleteTimer.startOneShot(0);
+    m_shouldCallCheckLoadComplete = true;
+    startCheckCompleteTimer();
 }
 
 void FrameLoader::checkCallImplicitClose()
@@ -1311,9 +1252,8 @@ void FrameLoader::checkCallImplicitClose()
     if (m_didCallImplicitClose || m_frame->document()->parsing())
         return;
 
-    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        if (!child->loader()->m_isComplete) // still got a frame running -> too early
-            return;
+    if (!allChildrenAreComplete())
+        return; // still got a frame running -> too early
 
     m_didCallImplicitClose = true;
     m_wasUnloadEventEmitted = false;
@@ -1332,183 +1272,6 @@ KURL FrameLoader::completeURL(const String& url)
     return m_frame->document()->completeURL(url);
 }
 
-void FrameLoader::scheduleHTTPRedirection(double delay, const String& url)
-{
-    if (delay < 0 || delay > INT_MAX / 1000)
-        return;
-        
-    if (!m_frame->page())
-        return;
-
-    if (url.isEmpty())
-        return;
-
-    // We want a new history item if the refresh timeout is > 1 second.
-    if (!m_scheduledRedirection || delay <= m_scheduledRedirection->delay)
-        scheduleRedirection(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
-}
-
-static bool mustLockBackForwardList(Frame* targetFrame)
-{
-    // Navigation of a subframe during loading of an ancestor frame does not create a new back/forward item.
-    // The definition of "during load" is any time before all handlers for the load event have been run.
-    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
-    
-    for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
-        Document* document = ancestor->document();
-        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
-            return true;
-    }
-    return false;
-}    
-
-void FrameLoader::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
-{
-    if (!m_frame->page())
-        return;
-
-    if (url.isEmpty())
-        return;
-
-    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame);
-
-    // If the URL we're going to navigate to is the same as the current one, except for the
-    // fragment part, we don't need to schedule the location change.
-    KURL parsedURL(url);
-    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(m_URL, parsedURL)) {
-        changeLocation(completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
-        return;
-    }
-
-    // Handle a location change of a page with no document as a special case.
-    // This may happen when a frame changes the location of another frame.
-    bool duringLoad = !m_committedFirstRealDocumentLoad;
-
-    scheduleRedirection(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
-}
-
-void FrameLoader::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
-    bool lockHistory, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
-{
-    ASSERT(m_frame->page());
-    ASSERT(!frameRequest.isEmpty());
-
-    // FIXME: Do we need special handling for form submissions where the URL is the same
-    // as the current one except for the fragment part? See scheduleLocationChange above.
-
-    // Handle a location change of a page with no document as a special case.
-    // This may happen when a frame changes the location of another frame.
-    bool duringLoad = !m_committedFirstRealDocumentLoad;
-
-    scheduleRedirection(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
-}
-
-void FrameLoader::scheduleRefresh(bool wasUserGesture)
-{
-    if (!m_frame->page())
-        return;
-
-    if (m_URL.isEmpty())
-        return;
-
-    scheduleRedirection(new ScheduledRedirection(m_URL.string(), m_outgoingReferrer, true, true, wasUserGesture, true, false));
-}
-
-bool FrameLoader::isLocationChange(const ScheduledRedirection& redirection)
-{
-    switch (redirection.type) {
-        case ScheduledRedirection::redirection:
-            return false;
-        case ScheduledRedirection::historyNavigation:
-        case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::formSubmission:
-            return true;
-    }
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-void FrameLoader::scheduleHistoryNavigation(int steps)
-{
-    if (!m_frame->page())
-        return;
-
-    // navigation will always be allowed in the 0 steps case, which is OK because that's supposed to force a reload.
-    if (!canGoBackOrForward(steps)) {
-        cancelRedirection();
-        return;
-    }
-
-    scheduleRedirection(new ScheduledRedirection(steps));
-}
-
-void FrameLoader::goBackOrForward(int distance)
-{
-    if (distance == 0)
-        return;
-        
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-    BackForwardList* list = page->backForwardList();
-    if (!list)
-        return;
-    
-    HistoryItem* item = list->itemAtIndex(distance);
-    if (!item) {
-        if (distance > 0) {
-            int forwardListCount = list->forwardListCount();
-            if (forwardListCount > 0) 
-                item = list->itemAtIndex(forwardListCount);
-        } else {
-            int backListCount = list->backListCount();
-            if (backListCount > 0)
-                item = list->itemAtIndex(-backListCount);
-        }
-    }
-    
-    ASSERT(item); // we should not reach this line with an empty back/forward list
-    if (item)
-        page->goToItem(item, FrameLoadTypeIndexedBackForward);
-}
-
-void FrameLoader::redirectionTimerFired(Timer<FrameLoader>*)
-{
-    ASSERT(m_frame->page());
-
-    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
-
-    switch (redirection->type) {
-        case ScheduledRedirection::redirection:
-        case ScheduledRedirection::locationChange:
-            changeLocation(KURL(redirection->url), redirection->referrer,
-                redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
-            return;
-        case ScheduledRedirection::historyNavigation:
-            if (redirection->historySteps == 0) {
-                // Special case for go(0) from a frame -> reload only the frame
-                urlSelected(m_URL, "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture);
-                return;
-            }
-            // go(i!=0) from a frame navigates into the history of the frame only,
-            // in both IE and NS (but not in Mozilla). We can't easily do that.
-            goBackOrForward(redirection->historySteps);
-            return;
-        case ScheduledRedirection::formSubmission:
-            // The submitForm function will find a target frame before using the redirection timer.
-            // Now that the timer has fired, we need to repeat the security check which normally is done when
-            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
-            // without leaving a time window. If we fail the check just silently drop the form submission.
-            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
-                return;
-            loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
-                redirection->event, redirection->formState);
-            return;
-    }
-
-    ASSERT_NOT_REACHED();
-}
-
 void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer, Frame* childFrame)
 {
     ASSERT(childFrame);
@@ -1527,7 +1290,7 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
             // Use the original URL to ensure we get all the side-effects, such as
             // onLoad handlers, of any redirects that happened. An example of where
             // this is needed is Radar 3213556.
-            workingURL = KURL(childItem->originalURLString());
+            workingURL = KURL(ParsedURLString, childItem->originalURLString());
             childLoadType = loadType;
             childFrame->loader()->m_provisionalHistoryItem = childItem;
         }
@@ -1716,7 +1479,7 @@ bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String
     if (renderer && !useFallback) {
         HTMLPlugInElement* element = toPlugInElement(renderer->node());
 
-        if (!canLoad(url, String(), frame()->document())) {
+        if (!SecurityOrigin::canLoad(url, String(), frame()->document())) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return false;
         }
@@ -1733,12 +1496,6 @@ bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String
     return widget != 0;
 }
 
-void FrameLoader::parentCompleted()
-{
-    if (m_scheduledRedirection && !m_redirectionTimer.isActive())
-        startRedirectionTimer();
-}
-
 String FrameLoader::outgoingReferrer() const
 {
     return m_outgoingReferrer;
@@ -1749,6 +1506,33 @@ String FrameLoader::outgoingOrigin() const
     return m_frame->document()->securityOrigin()->toString();
 }
 
+bool FrameLoader::isMixedContent(SecurityOrigin* context, const KURL& url)
+{
+    if (context->protocol() != "https")
+        return false;  // We only care about HTTPS security origins.
+
+    if (url.protocolIs("https") || url.protocolIs("about") || url.protocolIs("data"))
+        return false;  // Loading these protocols is secure.
+
+    return true;
+}
+
+void FrameLoader::checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL& url)
+{
+    if (!isMixedContent(context, url))
+        return;
+
+    m_client->didDisplayInsecureContent();
+}
+
+void FrameLoader::checkIfRunInsecureContent(SecurityOrigin* context, const KURL& url)
+{
+    if (!isMixedContent(context, url))
+        return;
+
+    m_client->didRunInsecureContent(context);
+}
+
 Frame* FrameLoader::opener()
 {
     return m_opener;
@@ -1768,16 +1552,6 @@ void FrameLoader::setOpener(Frame* opener)
     }
 }
 
-bool FrameLoader::openedByDOM() const
-{
-    return m_openedByDOM;
-}
-
-void FrameLoader::setOpenedByDOM()
-{
-    m_openedByDOM = true;
-}
-
 void FrameLoader::handleFallbackContent()
 {
     HTMLFrameOwnerElement* owner = m_frame->ownerElement();
@@ -1793,7 +1567,7 @@ void FrameLoader::provisionalLoadStarted()
         android::TimeCounter::reset();
 #endif
     m_firstLayoutDone = false;
-    cancelRedirection(true);
+    m_frame->redirectScheduler()->cancel(true);
     m_client->provisionalLoadStarted();
 }
 
@@ -1839,9 +1613,13 @@ static inline bool frameContainsWMLContent(Frame* frame)
 
 bool FrameLoader::canCachePageContainingThisFrame()
 {
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
+        if (!child->loader()->canCachePageContainingThisFrame())
+            return false;
+    }
+            
     return m_documentLoader
         && m_documentLoader->mainDocumentError().isNull()
-        && !m_frame->tree()->childCount()
         // FIXME: If we ever change this so that frames with plug-ins will be cached,
         // we need to make sure that we don't cache frames that have outstanding NPObjects
         // (objects created by the plug-in). Since there is no way to pause/resume a Netscape plug-in,
@@ -1849,10 +1627,15 @@ bool FrameLoader::canCachePageContainingThisFrame()
         // the right NPObjects. See <rdar://problem/5197041> for more information.
         && !m_containsPlugIns
         && !m_URL.protocolIs("https")
-        && (!m_frame->domWindow() || !m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
+#ifndef PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
+        && (!m_frame->domWindow() || !m_frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
+#endif
 #if ENABLE(DATABASE)
         && !m_frame->document()->hasOpenDatabases()
 #endif
+#if ENABLE(SHARED_WORKERS)
+        && !SharedWorkerRepository::hasSharedWorkers(m_frame->document())
+#endif
         && !m_frame->document()->usingGeolocation()
         && m_currentHistoryItem
         && !m_quickRedirectComing
@@ -1987,18 +1770,22 @@ bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
         }
         if (!m_documentLoader->mainDocumentError().isNull())
             { PCLOG("   -Main document has an error"); cannotCache = true; }
-        if (m_frame->tree()->childCount())
-            { PCLOG("   -Frame has child frames"); cannotCache = true; }
         if (m_containsPlugIns)
             { PCLOG("   -Frame contains plugins"); cannotCache = true; }
         if (m_URL.protocolIs("https"))
             { PCLOG("   -Frame is HTTPS"); cannotCache = true; }
-        if (m_frame->domWindow() && m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
+#ifndef PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
+        if (m_frame->domWindow() && m_frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
             { PCLOG("   -Frame has an unload event listener"); cannotCache = true; }
+#endif
 #if ENABLE(DATABASE)
         if (m_frame->document()->hasOpenDatabases())
             { PCLOG("   -Frame has open database handles"); cannotCache = true; }
 #endif
+#if ENABLE(SHARED_WORKERS)
+        if (SharedWorkerRepository::hasSharedWorkers(m_frame->document()))
+            { PCLOG("   -Frame has associated SharedWorkers"); cannotCache = true; }
+#endif
         if (m_frame->document()->usingGeolocation())
             { PCLOG("   -Frame uses Geolocation"); cannotCache = true; }
         if (!m_currentHistoryItem)
@@ -2055,7 +1842,7 @@ public:
     virtual void performTask(ScriptExecutionContext* context)
     {
         ASSERT_UNUSED(context, context->isDocument());
-        m_document->dispatchWindowEvent(eventNames().hashchangeEvent, false, false);
+        m_document->dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
     }
     
 private:
@@ -2067,7 +1854,7 @@ private:
     
     RefPtr<Document> m_document;
 };
-    
+
 // This does the same kind of work that didOpenURL does, except it relies on the fact
 // that a higher level already checked that the URLs match and the scrolling is the right thing to do.
 void FrameLoader::scrollToAnchor(const KURL& url)
@@ -2097,86 +1884,11 @@ bool FrameLoader::isComplete() const
     return m_isComplete;
 }
 
-void FrameLoader::scheduleRedirection(ScheduledRedirection* redirection)
-{
-    ASSERT(m_frame->page());
-
-    // If a redirect was scheduled during a load, then stop the current load.
-    // Otherwise when the current load transitions from a provisional to a 
-    // committed state, pending redirects may be cancelled. 
-    if (redirection->wasDuringLoad) {
-        if (m_provisionalDocumentLoader)
-            m_provisionalDocumentLoader->stopLoading();
-        stopLoading(true);   
-    }
-
-    stopRedirectionTimer();
-    m_scheduledRedirection.set(redirection);
-    if (!m_isComplete && redirection->type != ScheduledRedirection::redirection)
-        completed();
-    if (m_isComplete || redirection->type != ScheduledRedirection::redirection)
-        startRedirectionTimer();
-}
-
-void FrameLoader::startRedirectionTimer()
-{
-    ASSERT(m_frame->page());
-    ASSERT(m_scheduledRedirection);
-
-    m_redirectionTimer.stop();
-    m_redirectionTimer.startOneShot(m_scheduledRedirection->delay);
-
-    switch (m_scheduledRedirection->type) {
-        case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::redirection:
-            clientRedirected(KURL(m_scheduledRedirection->url),
-                m_scheduledRedirection->delay,
-                currentTime() + m_redirectionTimer.nextFireInterval(),
-                m_scheduledRedirection->lockBackForwardList);
-            return;
-        case ScheduledRedirection::formSubmission:
-            // FIXME: It would make sense to report form submissions as client redirects too.
-            // But we didn't do that in the past when form submission used a separate delay
-            // mechanism, so doing it will be a behavior change.
-            return;
-        case ScheduledRedirection::historyNavigation:
-            // Don't report history navigations.
-            return;
-    }
-    ASSERT_NOT_REACHED();
-}
-
-void FrameLoader::stopRedirectionTimer()
-{
-    if (!m_redirectionTimer.isActive())
-        return;
-
-    m_redirectionTimer.stop();
-
-    if (m_scheduledRedirection) {
-        switch (m_scheduledRedirection->type) {
-            case ScheduledRedirection::locationChange:
-            case ScheduledRedirection::redirection:
-                clientRedirectCancelledOrFinished(m_cancellingWithLoadInProgress);
-                return;
-            case ScheduledRedirection::formSubmission:
-                // FIXME: It would make sense to report form submissions as client redirects too.
-                // But we didn't do that in the past when form submission used a separate delay
-                // mechanism, so doing it will be a behavior change.
-                return;
-            case ScheduledRedirection::historyNavigation:
-                // Don't report history navigations.
-                return;
-        }
-        ASSERT_NOT_REACHED();
-    }
-}
-
 void FrameLoader::completed()
 {
     RefPtr<Frame> protect(m_frame);
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->loader()->parentCompleted();
+        child->redirectScheduler()->startTimer();
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
     if (m_frame->view())
@@ -2243,13 +1955,13 @@ void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHis
 
     ASSERT(frame()->document());
     if (SecurityOrigin::shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
-        if (!canLoad(url, String(), frame()->document()) && !canLoad(url, referrer)) {
+        if (!SecurityOrigin::canLoad(url, String(), frame()->document()) && !SecurityOrigin::canLoad(url, referrer, 0)) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return;
         }
     }
 
-    if (shouldHideReferrer(url, referrer))
+    if (SecurityOrigin::shouldHideReferrer(url, referrer))
         referrer = String();
     
     FrameLoadType loadType;
@@ -2319,10 +2031,14 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
         return;
     }
 
+    if (m_unloadEventBeingDispatched)
+        return;
+
     NavigationAction action(newURL, newLoadType, isFormSubmission, event);
 
     if (!targetFrame && !frameName.isEmpty()) {
-        checkNewWindowPolicy(action, request, formState.release(), frameName);
+        policyChecker()->checkNewWindowPolicy(action, FrameLoader::callContinueLoadAfterNewWindowPolicy,
+            request, formState.release(), frameName, this);
         return;
     }
 
@@ -2335,8 +2051,9 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
     // work properly.
     if (shouldScrollToAnchor(isFormSubmission, newLoadType, newURL)) {
         oldDocumentLoader->setTriggeringAction(action);
-        stopPolicyCheck();
-        checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
+        policyChecker()->stopCheck();
+        policyChecker()->setLoadType(newLoadType);
+        policyChecker()->checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         // must grab this now, since this load may stop the previous load and clear this flag
@@ -2385,7 +2102,7 @@ void FrameLoader::load(const ResourceRequest& request, const String& frameName,
         return;
     }
 
-    checkNewWindowPolicy(NavigationAction(request.url(), NavigationTypeOther), request, 0, frameName);
+    policyChecker()->checkNewWindowPolicy(NavigationAction(request.url(), NavigationTypeOther), FrameLoader::callContinueLoadAfterNewWindowPolicy, request, 0, frameName, this);
 }
 
 void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const NavigationAction& action, bool lockHistory, FrameLoadType type, PassRefPtr<FormState> formState)
@@ -2440,54 +2157,37 @@ void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType t
 
     ASSERT(m_frame->view());
 
-    m_policyLoadType = type;
+    if (m_unloadEventBeingDispatched)
+        return;
+
+    policyChecker()->setLoadType(type);
     RefPtr<FormState> formState = prpFormState;
     bool isFormSubmission = formState;
 
     const KURL& newURL = loader->request().url();
 
-    if (shouldScrollToAnchor(isFormSubmission, m_policyLoadType, newURL)) {
+    if (shouldScrollToAnchor(isFormSubmission, policyChecker()->loadType(), newURL)) {
         RefPtr<DocumentLoader> oldDocumentLoader = m_documentLoader;
-        NavigationAction action(newURL, m_policyLoadType, isFormSubmission);
+        NavigationAction action(newURL, policyChecker()->loadType(), isFormSubmission);
 
         oldDocumentLoader->setTriggeringAction(action);
-        stopPolicyCheck();
-        checkNavigationPolicy(loader->request(), oldDocumentLoader.get(), formState,
+        policyChecker()->stopCheck();
+        policyChecker()->checkNavigationPolicy(loader->request(), oldDocumentLoader.get(), formState,
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         if (Frame* parent = m_frame->tree()->parent())
             loader->setOverrideEncoding(parent->loader()->documentLoader()->overrideEncoding());
 
-        stopPolicyCheck();
+        policyChecker()->stopCheck();
         setPolicyDocumentLoader(loader);
         if (loader->triggeringAction().isEmpty())
-            loader->setTriggeringAction(NavigationAction(newURL, m_policyLoadType, isFormSubmission));
+            loader->setTriggeringAction(NavigationAction(newURL, policyChecker()->loadType(), isFormSubmission));
 
-        checkNavigationPolicy(loader->request(), loader, formState,
+        policyChecker()->checkNavigationPolicy(loader->request(), loader, formState,
             callContinueLoadAfterNavigationPolicy, this);
     }
 }
 
-bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Document* doc)
-{
-    return canLoad(url, referrer, doc ? doc->securityOrigin() : 0);
-}
-
-bool FrameLoader::canLoad(const KURL& url, const String& referrer, const SecurityOrigin* securityOrigin)
-{
-    // We can always load any URL that isn't considered local (e.g. http URLs).
-    if (!SecurityOrigin::shouldTreatURLAsLocal(url.string()))
-        return true;
-
-    // If we were provided a document, we let its local file policy dictate the result,
-    // otherwise we allow local loads only if the supplied referrer is also local.
-    if (securityOrigin)
-        return securityOrigin->canLoadLocalResources();
-    if (!referrer.isEmpty())
-        return SecurityOrigin::shouldTreatURLAsLocal(referrer);
-    return false;
-}
-
 void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
 {
     ASSERT(!url.isEmpty());
@@ -2497,22 +2197,6 @@ void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
     frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Not allowed to load local resource: " + url, 0, String());
 }
 
-bool FrameLoader::shouldHideReferrer(const KURL& url, const String& referrer)
-{
-    bool referrerIsSecureURL = protocolIs(referrer, "https");
-    bool referrerIsWebURL = referrerIsSecureURL || protocolIs(referrer, "http");
-
-    if (!referrerIsWebURL)
-        return true;
-
-    if (!referrerIsSecureURL)
-        return false;
-
-    bool URLIsSecureURL = url.protocolIs("https");
-
-    return !URLIsSecureURL;
-}
-
 const ResourceRequest& FrameLoader::initialRequest() const
 {
     return activeDocumentLoader()->originalRequest();
@@ -2523,50 +2207,26 @@ void FrameLoader::receivedData(const char* data, int length)
     activeDocumentLoader()->receivedData(data, length);
 }
 
-void FrameLoader::handleUnimplementablePolicy(const ResourceError& error)
+bool FrameLoader::willLoadMediaElementURL(KURL& url)
 {
-    m_delegateIsHandlingUnimplementablePolicy = true;
-    m_client->dispatchUnableToImplementPolicy(error);
-    m_delegateIsHandlingUnimplementablePolicy = false;
-}
+    if (!m_client->shouldLoadMediaElementURL(url))
+        return false;
 
-void FrameLoader::cannotShowMIMEType(const ResourceResponse& response)
-{
-    handleUnimplementablePolicy(m_client->cannotShowMIMETypeError(response));
-}
+    ResourceRequest request(url);
 
-ResourceError FrameLoader::interruptionForPolicyChangeError(const ResourceRequest& request)
-{
-    return m_client->interruptForPolicyChangeError(request);
-}
+    unsigned long identifier;
+    ResourceError error;
+    requestFromDelegate(request, identifier, error);
+    sendRemainingDelegateMessages(identifier, ResourceResponse(url, String(), -1, String(), String()), -1, error);
 
-void FrameLoader::checkNavigationPolicy(const ResourceRequest& newRequest, NavigationPolicyDecisionFunction function, void* argument)
-{
-    checkNavigationPolicy(newRequest, activeDocumentLoader(), 0, function, argument);
+    url = request.url();
+
+    return error.isNull();
 }
 
-void FrameLoader::checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction function, void* argument)
+ResourceError FrameLoader::interruptionForPolicyChangeError(const ResourceRequest& request)
 {
-    ASSERT(activeDocumentLoader());
-    
-    // Always show content with valid substitute data.
-    if (activeDocumentLoader()->substituteData().isValid()) {
-        function(argument, PolicyUse);
-        return;
-    }
-
-#if ENABLE(FTPDIR)
-    // Respect the hidden FTP Directory Listing pref so it can be tested even if the policy delegate might otherwise disallow it
-    Settings* settings = m_frame->settings();
-    if (settings && settings->forceFTPDirectoryListings() && MIMEType == "application/x-ftp-directory") {
-        function(argument, PolicyUse);
-        return;
-    }
-#endif
-
-    m_policyCheck.set(function, argument);
-    m_client->dispatchDecidePolicyForMIMEType(&FrameLoader::continueAfterContentPolicy,
-        MIMEType, activeDocumentLoader()->request());
+    return m_client->interruptForPolicyChangeError(request);
 }
 
 bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
@@ -2576,7 +2236,7 @@ bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
     if (unreachableURL.isEmpty())
         return false;
 
-    if (!isBackForwardLoadType(m_policyLoadType))
+    if (!isBackForwardLoadType(policyChecker()->loadType()))
         return false;
 
     // We only treat unreachableURLs specially during the delegate callbacks
@@ -2585,7 +2245,7 @@ bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
     // case handles malformed URLs and unknown schemes. Loading alternate content
     // at other times behaves like a standard load.
     DocumentLoader* compareDocumentLoader = 0;
-    if (m_delegateIsDecidingNavigationPolicy || m_delegateIsHandlingUnimplementablePolicy)
+    if (policyChecker()->delegateIsDecidingNavigationPolicy() || policyChecker()->delegateIsHandlingUnimplementablePolicy())
         compareDocumentLoader = m_policyDocumentLoader.get();
     else if (m_delegateIsHandlingProvisionalLoadError)
         compareDocumentLoader = m_provisionalDocumentLoader.get();
@@ -2676,7 +2336,8 @@ bool FrameLoader::shouldAllowNavigation(Frame* targetFrame) const
     //
     // Or the target frame is:
     //   - a top-level frame in the frame hierarchy and the active frame can
-    //     navigate the target frame's opener per above.
+    //     navigate the target frame's opener per above or it is the opener of
+    //     the target frame.
 
     if (!targetFrame)
         return true;
@@ -2691,6 +2352,10 @@ bool FrameLoader::shouldAllowNavigation(Frame* targetFrame) const
     if (targetFrame == m_frame->tree()->top())
         return true;
 
+    // Let a frame navigate its opener if the opener is a top-level window.
+    if (!targetFrame->tree()->parent() && m_frame->loader()->opener() == targetFrame)
+        return true;
+
     Document* activeDocument = m_frame->document();
     ASSERT(activeDocument);
     const SecurityOrigin* activeSecurityOrigin = activeDocument->securityOrigin();
@@ -2725,6 +2390,7 @@ void FrameLoader::stopLoadingSubframes()
 
 void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
 {
+    ASSERT(!m_frame->document() || !m_frame->document()->inPageCache());
     if (m_unloadEventBeingDispatched)
         return;
 
@@ -2734,7 +2400,7 @@ void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
 
     m_inStopAllLoaders = true;
 
-    stopPolicyCheck();
+    policyChecker()->stopCheck();
 
     stopLoadingSubframes();
     if (m_provisionalDocumentLoader)
@@ -2862,7 +2528,8 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     RefPtr<CachedPage> cachedPage = prpCachedPage;
     RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
 
-    LOG(Loading, "WebCoreLoading %s: About to commit provisional load from previous URL %s", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data());
+    LOG(PageCache, "WebCoreLoading %s: About to commit provisional load from previous URL '%s' to new URL '%s'", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data(), 
+        pdl ? pdl->url().string().utf8().data() : "<no provisional DocumentLoader>");
 
     // Check to see if we need to cache the page we are navigating away from into the back/forward cache.
     // We are doing this here because we know for sure that a new page is about to be loaded.
@@ -2883,10 +2550,9 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     if (m_sentRedirectNotification)
         clientRedirectCancelledOrFinished(false);
     
-    if (cachedPage && cachedPage->document()) {
+    if (cachedPage && cachedPage->document())
         open(*cachedPage);
-        cachedPage->clear();
-    } else {        
+    else {        
         KURL url = pdl->substituteData().responseURL();
         if (url.isEmpty())
             url = pdl->url();
@@ -2903,11 +2569,11 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
         updateHistoryForClientRedirect();
 
-    if (m_documentLoader->isLoadingFromCachedPage()) {
+    if (m_loadingFromCachedPage) {
         m_frame->document()->documentDidBecomeActive();
         
         // Force a layout to update view size and thereby update scrollbars.
-        m_client->forceLayout();
+        m_frame->view()->forceLayout();
 
         const ResponseVector& responses = m_documentLoader->responses();
         size_t count = responses.size();
@@ -3104,7 +2770,7 @@ void FrameLoader::open(CachedPage& cachedPage)
     ASSERT(m_frame->page());
     ASSERT(m_frame->page()->mainFrame() == m_frame);
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 
     // We still have to close the previous part page.
     closeURL();
@@ -3115,13 +2781,12 @@ void FrameLoader::open(CachedPage& cachedPage)
         m_frame->setJSDefaultStatusBarText(String());
     }
 
-    open(*cachedPage.cachedMainFrame());
     cachedPage.restore(m_frame->page());
 
     checkCompleted();
 }
 
-void FrameLoader::open(CachedFrame& cachedFrame)
+void FrameLoader::open(CachedFrameBase& cachedFrame)
 {
     m_isComplete = false;
     
@@ -3137,8 +2802,7 @@ void FrameLoader::open(CachedFrame& cachedFrame)
     m_workingURL = url;
 
     started();
-
-    clear();
+    clear(true, true, cachedFrame.isMainFrame());
 
     Document* document = cachedFrame.document();
     ASSERT(document);
@@ -3153,8 +2817,11 @@ void FrameLoader::open(CachedFrame& cachedFrame)
     
     // When navigating to a CachedFrame its FrameView should never be null.  If it is we'll crash in creative ways downstream.
     ASSERT(view);
-    if (view)
-        view->setWasScrolledByUser(false);
+    view->setWasScrolledByUser(false);
+
+    // Use the current ScrollView's frame rect.
+    if (m_frame->view())
+        view->setFrameRect(m_frame->view()->frameRect());
     m_frame->setView(view);
     
     m_frame->setDocument(document);
@@ -3215,12 +2882,6 @@ String FrameLoader::generatedMIMETypeForURLScheme(const String& URLScheme)
     return m_client->generatedMIMETypeForURLScheme(URLScheme);
 }
 
-void FrameLoader::cancelContentPolicyCheck()
-{
-    m_client->cancelPolicyCheck();
-    m_policyCheck.clear();
-}
-
 void FrameLoader::didReceiveServerRedirectForProvisionalLoadForFrame()
 {
     m_client->dispatchDidReceiveServerRedirectForProvisionalLoad();
@@ -3344,14 +3005,6 @@ CachePolicy FrameLoader::subresourceCachePolicy() const
     return CachePolicyVerify;
 }
 
-void FrameLoader::stopPolicyCheck()
-{
-    m_client->cancelPolicyCheck();
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-    check.cancel();
-}
-
 void FrameLoader::checkLoadCompleteForThisFrame()
 {
     ASSERT(m_client->hasWebView());
@@ -3456,14 +3109,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
     ASSERT_NOT_REACHED();
 }
 
-void FrameLoader::continueAfterContentPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-    check.call(policy);
-}
-
-void FrameLoader::continueLoadAfterWillSubmitForm(PolicyAction)
+void FrameLoader::continueLoadAfterWillSubmitForm()
 {
     if (!m_provisionalDocumentLoader)
         return;
@@ -3480,7 +3126,7 @@ void FrameLoader::continueLoadAfterWillSubmitForm(PolicyAction)
     if (activeDocLoader && activeDocLoader->isLoadingMainResource())
         return;
 
-    m_provisionalDocumentLoader->setLoadingFromCachedPage(false);
+    m_loadingFromCachedPage = false;
 
     unsigned long identifier = 0;
 
@@ -3544,7 +3190,7 @@ void FrameLoader::closeAndRemoveChild(Frame* child)
     child->tree()->detachFromParent();
 
     child->setView(0);
-    if (child->ownerElement())
+    if (child->ownerElement() && child->page())
         child->page()->decrementFrameCount();
     child->pageDestroyed();
 
@@ -3570,6 +3216,8 @@ void FrameLoader::checkLoadComplete()
 {
     ASSERT(m_client->hasWebView());
     
+    m_shouldCallCheckLoadComplete = false;
+
     // FIXME: Always traversing the entire frame tree is a bit inefficient, but 
     // is currently needed in order to null out the previous history item for all frames.
     if (Page* page = m_frame->page())
@@ -3618,12 +3266,13 @@ void FrameLoader::detachFromParent()
     saveScrollPositionAndViewStateToItem(currentHistoryItem());
     detachChildren();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->frameDetachedFromParent(m_frame);
+#endif
+
+    detachViewsAndDocumentLoader();
 
-    m_client->detachedFromParent2();
-    setDocumentLoader(0);
-    m_client->detachedFromParent3();
     if (Frame* parent = m_frame->tree()->parent()) {
         parent->loader()->closeAndRemoveChild(m_frame);
         parent->loader()->scheduleCheckCompleted();
@@ -3632,6 +3281,13 @@ void FrameLoader::detachFromParent()
         m_frame->pageDestroyed();
     }
 }
+
+void FrameLoader::detachViewsAndDocumentLoader()
+{
+    m_client->detachedFromParent2();
+    setDocumentLoader(0);
+    m_client->detachedFromParent3();
+}
     
 void FrameLoader::addExtraFieldsToSubresourceRequest(ResourceRequest& request)
 {
@@ -3759,7 +3415,7 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
         if (Frame* targetFrame = formState ? 0 : findFrameForNavigation(frameName))
             targetFrame->loader()->loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());
         else
-            checkNewWindowPolicy(action, workingResourceRequest, formState.release(), frameName);
+            policyChecker()->checkNewWindowPolicy(action, FrameLoader::callContinueLoadAfterNewWindowPolicy, workingResourceRequest, formState.release(), frameName, this);
     } else
         loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());    
 }
@@ -3767,7 +3423,7 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
 unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& data)
 {
     String referrer = m_outgoingReferrer;
-    if (shouldHideReferrer(request.url(), referrer))
+    if (SecurityOrigin::shouldHideReferrer(request.url(), referrer))
         referrer = String();
     
     ResourceRequest initialRequest = request;
@@ -3898,7 +3554,7 @@ void FrameLoader::callContinueFragmentScrollAfterNavigationPolicy(void* argument
 
 void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequest& request, bool shouldContinue)
 {
-    bool isRedirect = m_quickRedirectComing || m_policyLoadType == FrameLoadTypeRedirectWithLockedBackForwardList;
+    bool isRedirect = m_quickRedirectComing || policyChecker()->loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;
     m_quickRedirectComing = false;
 
     if (!shouldContinue)
@@ -3961,101 +3617,6 @@ bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, FrameLoadType load
         && !m_frame->document()->isFrameSet();
 }
 
-void FrameLoader::checkNewWindowPolicy(const NavigationAction& action, const ResourceRequest& request,
-    PassRefPtr<FormState> formState, const String& frameName)
-{
-    m_policyCheck.set(request, formState, frameName,
-        callContinueLoadAfterNewWindowPolicy, this);
-    m_client->dispatchDecidePolicyForNewWindowAction(&FrameLoader::continueAfterNewWindowPolicy,
-        action, request, formState, frameName);
-}
-
-void FrameLoader::continueAfterNewWindowPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-
-    switch (policy) {
-        case PolicyIgnore:
-            check.clearRequest();
-            break;
-        case PolicyDownload:
-            m_client->startDownload(check.request());
-            check.clearRequest();
-            break;
-        case PolicyUse:
-            break;
-    }
-
-    check.call(policy == PolicyUse);
-}
-
-void FrameLoader::checkNavigationPolicy(const ResourceRequest& request, DocumentLoader* loader,
-    PassRefPtr<FormState> formState, NavigationPolicyDecisionFunction function, void* argument)
-{
-    NavigationAction action = loader->triggeringAction();
-    if (action.isEmpty()) {
-        action = NavigationAction(request.url(), NavigationTypeOther);
-        loader->setTriggeringAction(action);
-    }
-        
-    // Don't ask more than once for the same request or if we are loading an empty URL.
-    // This avoids confusion on the part of the client.
-    if (equalIgnoringHeaderFields(request, loader->lastCheckedRequest()) || (!request.isNull() && request.url().isEmpty())) {
-        function(argument, request, 0, true);
-        loader->setLastCheckedRequest(request);
-        return;
-    }
-    
-    // We are always willing to show alternate content for unreachable URLs;
-    // treat it like a reload so it maintains the right state for b/f list.
-    if (loader->substituteData().isValid() && !loader->substituteData().failingURL().isEmpty()) {
-        if (isBackForwardLoadType(m_policyLoadType))
-            m_policyLoadType = FrameLoadTypeReload;
-        function(argument, request, 0, true);
-        return;
-    }
-    
-    loader->setLastCheckedRequest(request);
-
-    m_policyCheck.set(request, formState.get(), function, argument);
-
-    m_delegateIsDecidingNavigationPolicy = true;
-    m_client->dispatchDecidePolicyForNavigationAction(&FrameLoader::continueAfterNavigationPolicy,
-        action, request, formState);
-    m_delegateIsDecidingNavigationPolicy = false;
-}
-
-void FrameLoader::continueAfterNavigationPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-
-    bool shouldContinue = policy == PolicyUse;
-    
-    switch (policy) {
-        case PolicyIgnore:
-            check.clearRequest();
-            break;
-        case PolicyDownload:
-            m_client->startDownload(check.request());
-            check.clearRequest();
-            break;
-        case PolicyUse: {
-            ResourceRequest request(check.request());
-            
-            if (!m_client->canHandleRequest(request)) {
-                handleUnimplementablePolicy(m_client->cannotShowURLError(check.request()));
-                check.clearRequest();
-                shouldContinue = false;
-            }
-            break;
-        }
-    }
-
-    check.call(shouldContinue);
-}
-
 void FrameLoader::callContinueLoadAfterNavigationPolicy(void* argument,
     const ResourceRequest& request, PassRefPtr<FormState> formState, bool shouldContinue)
 {
@@ -4090,7 +3651,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         // If the navigation request came from the back/forward menu, and we punt on it, we have the 
         // problem that we have optimistically moved the b/f cursor already, so move it back.  For sanity, 
         // we only do this when punting a navigation for the target frame or top-level frame.  
-        if ((isTargetItem || isLoadingMainFrame()) && isBackForwardLoadType(m_policyLoadType))
+        if ((isTargetItem || isLoadingMainFrame()) && isBackForwardLoadType(policyChecker()->loadType()))
             if (Page* page = m_frame->page()) {
                 Frame* mainFrame = page->mainFrame();
                 if (HistoryItem* resetItem = mainFrame->loader()->m_currentHistoryItem.get()) {
@@ -4102,7 +3663,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         return;
     }
 
-    FrameLoadType type = m_policyLoadType;
+    FrameLoadType type = policyChecker()->loadType();
     stopAllLoaders();
     
     // <rdar://problem/6250856> - In certain circumstances on pages with multiple frames, stopAllLoaders()
@@ -4110,7 +3671,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     if (!m_frame->page())
         return;
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame() == m_frame)
             page->inspectorController()->resumeDebugger();
@@ -4127,12 +3688,11 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         return;
 
     if (formState)
-        m_client->dispatchWillSubmitForm(&FrameLoader::continueLoadAfterWillSubmitForm, formState);
+        m_client->dispatchWillSubmitForm(&PolicyChecker::continueLoadAfterWillSubmitForm, formState);
     else
         continueLoadAfterWillSubmitForm();
 }
 
-
 void FrameLoader::callContinueLoadAfterNewWindowPolicy(void* argument,
     const ResourceRequest& request, PassRefPtr<FormState> formState, const String& frameName, bool shouldContinue)
 {
@@ -4154,7 +3714,7 @@ void FrameLoader::continueLoadAfterNewWindowPolicy(const ResourceRequest& reques
     if (frameName != "_blank")
         mainFrame->tree()->setName(frameName);
 
-    mainFrame->loader()->setOpenedByDOM();
+    mainFrame->page()->setOpenedByDOM();
     mainFrame->loader()->m_client->dispatchShow();
     mainFrame->loader()->setOpener(frame.get());
     mainFrame->loader()->loadWithNavigationAction(request, NavigationAction(), false, FrameLoadTypeStandard, formState);
@@ -4201,7 +3761,9 @@ void FrameLoader::loadedResourceFromMemoryCache(const CachedResource* resource)
     if (!page)
         return;
 
+#if ENABLE(INSPECTOR)
     page->inspectorController()->didLoadResourceFromMemoryCache(m_documentLoader.get(), resource);
+#endif
 
     if (!resource->sendResourceLoadCallbacks() || m_documentLoader->haveToldClientAboutLoad(resource->url()))
         return;
@@ -4249,26 +3811,6 @@ bool FrameLoader::shouldInterruptLoadForXFrameOptions(const String& content, con
     return false;
 }
 
-bool FrameLoader::canGoBackOrForward(int distance) const
-{
-    if (Page* page = m_frame->page()) {
-        if (distance == 0)
-            return true;
-        if (distance > 0 && distance <= page->backForwardList()->forwardListCount())
-            return true;
-        if (distance < 0 && -distance <= page->backForwardList()->backListCount())
-            return true;
-    }
-    return false;
-}
-
-int FrameLoader::getHistoryLength()
-{
-    if (Page* page = m_frame->page())
-        return page->backForwardList()->backListCount() + 1;
-    return 0;
-}
-
 void FrameLoader::addHistoryItemForFragmentScroll()
 {
     addBackForwardItemClippedAtTarget(false);
@@ -4279,7 +3821,17 @@ bool FrameLoader::loadProvisionalItemFromCachedPage()
     RefPtr<CachedPage> cachedPage = pageCache()->get(m_provisionalHistoryItem.get());
     if (!cachedPage || !cachedPage->document())
         return false;
-    provisionalDocumentLoader()->loadFromCachedPage(cachedPage.release());
+
+    DocumentLoader *provisionalLoader = provisionalDocumentLoader();
+    LOG(PageCache, "WebCorePageCache: FrameLoader %p loading provisional DocumentLoader %p with URL '%s' from CachedPage %p", this, provisionalLoader, provisionalLoader->url().string().utf8().data(), cachedPage.get());
+    
+    provisionalLoader->prepareForLoadStart();
+
+    m_loadingFromCachedPage = true;
+
+    provisionalLoader->setCommitted(true);
+    commitProvisionalLoad(cachedPage);
+    
     return true;
 }
 
@@ -4288,12 +3840,26 @@ void FrameLoader::cachePageForHistoryItem(HistoryItem* item)
     if (!canCachePage() || item->isInPageCache())
         return;
 
+    pageHidden();
+    
     if (Page* page = m_frame->page()) {
         RefPtr<CachedPage> cachedPage = CachedPage::create(page);
         pageCache()->add(item, cachedPage.release());
     }
 }
 
+void FrameLoader::pageHidden()
+{
+    m_unloadEventBeingDispatched = true;
+    if (m_frame->domWindow())
+        m_frame->domWindow()->dispatchEvent(PageTransitionEvent::create(EventNames().pagehideEvent, true), m_frame->document());
+    m_unloadEventBeingDispatched = false;
+
+    // Send pagehide event for subframes as well
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        child->loader()->pageHidden();
+}
+
 bool FrameLoader::shouldTreatURLAsSameAsCurrent(const KURL& url) const
 {
     if (!m_currentHistoryItem)
@@ -5038,94 +4604,6 @@ void FrameLoader::didCancelAuthenticationChallenge(ResourceLoader* loader, const
     m_client->dispatchDidCancelAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
 }
 
-PolicyCheck::PolicyCheck()
-    : m_navigationFunction(0)
-    , m_newWindowFunction(0)
-    , m_contentFunction(0)
-{
-}
-
-void PolicyCheck::clear()
-{
-    clearRequest();
-    m_navigationFunction = 0;
-    m_newWindowFunction = 0;
-    m_contentFunction = 0;
-}
-
-void PolicyCheck::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
-    NavigationPolicyDecisionFunction function, void* argument)
-{
-    m_request = request;
-    m_formState = formState;
-    m_frameName = String();
-
-    m_navigationFunction = function;
-    m_newWindowFunction = 0;
-    m_contentFunction = 0;
-    m_argument = argument;
-}
-
-void PolicyCheck::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
-    const String& frameName, NewWindowPolicyDecisionFunction function, void* argument)
-{
-    m_request = request;
-    m_formState = formState;
-    m_frameName = frameName;
-
-    m_navigationFunction = 0;
-    m_newWindowFunction = function;
-    m_contentFunction = 0;
-    m_argument = argument;
-}
-
-void PolicyCheck::set(ContentPolicyDecisionFunction function, void* argument)
-{
-    m_request = ResourceRequest();
-    m_formState = 0;
-    m_frameName = String();
-
-    m_navigationFunction = 0;
-    m_newWindowFunction = 0;
-    m_contentFunction = function;
-    m_argument = argument;
-}
-
-void PolicyCheck::call(bool shouldContinue)
-{
-    if (m_navigationFunction)
-        m_navigationFunction(m_argument, m_request, m_formState.get(), shouldContinue);
-    if (m_newWindowFunction)
-        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, shouldContinue);
-    ASSERT(!m_contentFunction);
-}
-
-void PolicyCheck::call(PolicyAction action)
-{
-    ASSERT(!m_navigationFunction);
-    ASSERT(!m_newWindowFunction);
-    ASSERT(m_contentFunction);
-    m_contentFunction(m_argument, action);
-}
-
-void PolicyCheck::clearRequest()
-{
-    m_request = ResourceRequest();
-    m_formState = 0;
-    m_frameName = String();
-}
-
-void PolicyCheck::cancel()
-{
-    clearRequest();
-    if (m_navigationFunction)
-        m_navigationFunction(m_argument, m_request, m_formState.get(), false);
-    if (m_newWindowFunction)
-        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, false);
-    if (m_contentFunction)
-        m_contentFunction(m_argument, PolicyIgnore);
-}
-
 void FrameLoader::setTitle(const String& title)
 {
     documentLoader()->setTitle(title);
@@ -5143,6 +4621,7 @@ String FrameLoader::referrer() const
 
 void FrameLoader::dispatchDocumentElementAvailable()
 {
+    m_frame->injectUserScripts(InjectAtDocumentStart);
     m_client->documentElementAvailable();
 }
 
@@ -5153,12 +4632,14 @@ void FrameLoader::dispatchWindowObjectAvailable()
 
     m_client->windowObjectCleared();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
         if (InspectorController* inspector = page->inspectorController())
             inspector->inspectedWindowScriptObjectCleared(m_frame);
         if (InspectorController* inspector = page->parentInspectorController())
             inspector->windowScriptObjectAvailable();
     }
+#endif
 }
 
 PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
@@ -5179,7 +4660,7 @@ PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTML
 
     if (!codeBaseURLString.isEmpty()) {
         KURL codeBaseURL = completeURL(codeBaseURLString);
-        if (!canLoad(codeBaseURL, String(), element->document())) {
+        if (!SecurityOrigin::canLoad(codeBaseURL, String(), element->document())) {
             FrameLoader::reportLocalLoadFailed(m_frame, codeBaseURL.string());
             return 0;
         }
@@ -5223,16 +4704,20 @@ void FrameLoader::dispatchDidCommitLoad()
 
     m_client->dispatchDidCommitLoad();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didCommitLoad(m_documentLoader.get());
+#endif
 }
 
 void FrameLoader::dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
 {
     m_client->assignIdentifierToInitialRequest(identifier, loader, request);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->identifierForInitialRequest(identifier, loader, request);
+#endif
 }
 
 void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
@@ -5246,32 +4731,40 @@ void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long
     if (!request.isNull() && oldRequestURL != request.url().string().impl())
         m_documentLoader->didTellClientAboutLoad(request.url());
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
+#endif
 }
 
 void FrameLoader::dispatchDidReceiveResponse(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
 {
     m_client->dispatchDidReceiveResponse(loader, identifier, r);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didReceiveResponse(loader, identifier, r);
+#endif
 }
 
 void FrameLoader::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
 {
     m_client->dispatchDidReceiveContentLength(loader, identifier, length);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didReceiveContentLength(loader, identifier, length);
+#endif
 }
 
 void FrameLoader::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier)
 {
     m_client->dispatchDidFinishLoading(loader, identifier);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didFinishLoading(loader, identifier);
+#endif
 }
 
 void FrameLoader::tellClientAboutPastMemoryCacheLoads()
diff --git a/WebCore/loader/FrameLoader.h b/WebCore/loader/FrameLoader.h
index 3d3f9c3..3a1d27f 100644
--- a/WebCore/loader/FrameLoader.h
+++ b/WebCore/loader/FrameLoader.h
@@ -32,9 +32,13 @@
 
 #include "CachePolicy.h"
 #include "FrameLoaderTypes.h"
+#include "PolicyCallback.h"
+#include "PolicyChecker.h"
+#include "RedirectScheduler.h"
 #include "ResourceRequest.h"
 #include "ThreadableLoader.h"
 #include "Timer.h"
+#include <wtf/Forward.h>
 
 namespace WebCore {
 
@@ -42,7 +46,7 @@ namespace WebCore {
     class Archive;
 #endif
     class AuthenticationChallenge;
-    class CachedFrame;
+    class CachedFrameBase;
     class CachedPage;
     class CachedResource;
     class Document;
@@ -73,46 +77,10 @@ namespace WebCore {
     class Widget;
 
     struct FrameLoadRequest;
-    struct ScheduledRedirection;
     struct WindowFeatures;
 
     bool isBackForwardLoadType(FrameLoadType);
 
-    typedef void (*NavigationPolicyDecisionFunction)(void* argument,
-        const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-    typedef void (*NewWindowPolicyDecisionFunction)(void* argument,
-        const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-    typedef void (*ContentPolicyDecisionFunction)(void* argument, PolicyAction);
-
-    class PolicyCheck {
-    public:
-        PolicyCheck();
-
-        void clear();
-        void set(const ResourceRequest&, PassRefPtr<FormState>,
-            NavigationPolicyDecisionFunction, void* argument);
-        void set(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName,
-            NewWindowPolicyDecisionFunction, void* argument);
-        void set(ContentPolicyDecisionFunction, void* argument);
-
-        const ResourceRequest& request() const { return m_request; }
-        void clearRequest();
-
-        void call(bool shouldContinue);
-        void call(PolicyAction);
-        void cancel();
-
-    private:
-        ResourceRequest m_request;
-        RefPtr<FormState> m_formState;
-        String m_frameName;
-
-        NavigationPolicyDecisionFunction m_navigationFunction;
-        NewWindowPolicyDecisionFunction m_newWindowFunction;
-        ContentPolicyDecisionFunction m_contentFunction;
-        void* m_argument;
-    };
-
     class FrameLoader : public Noncopyable {
     public:
         FrameLoader(Frame*, FrameLoaderClient*);
@@ -122,6 +90,8 @@ namespace WebCore {
 
         Frame* frame() const { return m_frame; }
 
+        PolicyChecker* policyChecker() { return &m_policyChecker; }
+
         // FIXME: This is not cool, people. There are too many different functions that all start loads.
         // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
         // the logic by extracting common code paths.
@@ -144,14 +114,8 @@ namespace WebCore {
         void loadArchive(PassRefPtr<Archive>);
 #endif
 
-        // Returns true for any non-local URL. If document parameter is supplied, its local load policy dictates,
-        // otherwise if referrer is non-empty and represents a local file, then the local load is allowed.
-        static bool canLoad(const KURL&, const String& referrer, const Document*);
-        static bool canLoad(const KURL&, const String& referrer, const SecurityOrigin* = 0);
         static void reportLocalLoadFailed(Frame*, const String& url);
 
-        static bool shouldHideReferrer(const KURL&, const String& referrer);
-
         // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
         Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
 
@@ -195,6 +159,8 @@ namespace WebCore {
         void receivedMainResourceError(const ResourceError&, bool isComplete);
         void receivedData(const char*, int);
 
+        bool willLoadMediaElementURL(KURL&);
+
         void handleFallbackContent();
         bool isStopping() const;
 
@@ -204,8 +170,6 @@ namespace WebCore {
         ResourceError fileDoesNotExistError(const ResourceResponse&) const;
         ResourceError blockedError(const ResourceRequest&) const;
         ResourceError cannotShowURLError(const ResourceRequest&) const;
-
-        void cannotShowMIMEType(const ResourceResponse&);
         ResourceError interruptionForPolicyChangeError(const ResourceRequest&);
 
         bool isHostedByObjectElement() const;
@@ -214,10 +178,6 @@ namespace WebCore {
         bool representationExistsForURLScheme(const String& URLScheme);
         String generatedMIMETypeForURLScheme(const String& URLScheme);
 
-        void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction function, void* argument);
-        void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
-        void cancelContentPolicyCheck();
-
         void reload(bool endToEndReload = false);
         void reloadWithOverrideEncoding(const String& overrideEncoding);
 
@@ -246,6 +206,7 @@ namespace WebCore {
 
         void checkLoadComplete();
         void detachFromParent();
+        void detachViewsAndDocumentLoader();
 
         void addExtraFieldsToSubresourceRequest(ResourceRequest&);
         void addExtraFieldsToMainResourceRequest(ResourceRequest&);
@@ -265,7 +226,7 @@ namespace WebCore {
             bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
 
         void stop();
-        void stopLoading(bool sendUnload, DatabasePolicy = DatabasePolicyStop);
+        void stopLoading(UnloadEventPolicy, DatabasePolicy = DatabasePolicyStop);
         bool closeURL();
 
         void didExplicitOpen();
@@ -275,16 +236,6 @@ namespace WebCore {
 
         KURL baseURL() const;
 
-        bool isScheduledLocationChangePending() const { return m_scheduledRedirection && isLocationChange(*m_scheduledRedirection); }
-        void scheduleHTTPRedirection(double delay, const String& url);
-        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
-        void scheduleRefresh(bool userGesture = false);
-        void scheduleHistoryNavigation(int steps);
-
-        bool canGoBackOrForward(int distance) const;
-        void goBackOrForward(int distance);
-        int getHistoryLength();
-
         void begin();
         void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
 
@@ -312,10 +263,13 @@ namespace WebCore {
         void dispatchDocumentElementAvailable();
         void restoreDocumentState();
 
+        // Mixed content related functions.
+        static bool isMixedContent(SecurityOrigin* context, const KURL&);
+        void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
+        void checkIfRunInsecureContent(SecurityOrigin* context, const KURL&);
+
         Frame* opener();
         void setOpener(Frame*);
-        bool openedByDOM() const;
-        void setOpenedByDOM();
 
         bool isProcessingUserGesture();
 
@@ -350,6 +304,7 @@ namespace WebCore {
         void setTitle(const String&);
 
         void commitProvisionalLoad(PassRefPtr<CachedPage>);
+        bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
 
         void goToItem(HistoryItem*, FrameLoadType);
         void saveDocumentAndScrollState();
@@ -357,16 +312,8 @@ namespace WebCore {
         HistoryItem* currentHistoryItem();
         void setCurrentHistoryItem(PassRefPtr<HistoryItem>);
 
-        enum LocalLoadPolicy {
-            AllowLocalLoadsForAll,  // No restriction on local loads.
-            AllowLocalLoadsForLocalAndSubstituteData,
-            AllowLocalLoadsForLocalOnly,
-        };
-        static void setLocalLoadPolicy(LocalLoadPolicy);
-        static bool restrictAccessToLocal();
-        static bool allowSubstituteDataAccessToLocal();
-
         bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
+        bool committedFirstRealDocumentLoad() const { return m_committedFirstRealDocumentLoad; }
 
         void iconLoadDecisionAvailable();
 
@@ -379,6 +326,20 @@ namespace WebCore {
 
         bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
 
+        void open(CachedFrameBase&);
+
+        // FIXME: Should these really be public?
+        void completed();
+        bool allAncestorsAreComplete() const; // including this
+        bool allChildrenAreComplete() const; // immediate children, not all descendants
+        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
+        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
+
+        // FIXME: This is public because this asynchronous callback from the FrameLoaderClient
+        // uses the policy machinery (and therefore is called via the PolicyChecker).  Once we
+        // introduce a proper callback type for this function, we should make it private again.
+        void continueLoadAfterWillSubmitForm();
+
     private:
         PassRefPtr<HistoryItem> createHistoryItem(bool useOriginal);
         PassRefPtr<HistoryItem> createHistoryItemTree(Frame* targetFrame, bool clipAtTarget);
@@ -405,17 +366,10 @@ namespace WebCore {
         void updateHistoryForClientRedirect();
         void updateHistoryForCommit();
         void updateHistoryForAnchorScroll();
-    
-        void redirectionTimerFired(Timer<FrameLoader>*);
-        void checkCompletedTimerFired(Timer<FrameLoader>*);
-        void checkLoadCompleteTimerFired(Timer<FrameLoader>*);
-        
-        void cancelRedirection(bool newLoadInProgress = false);
 
-        void started();
+        void checkTimerFired(Timer<FrameLoader>*);
 
-        void completed();
-        void parentCompleted();
+        void started();
 
         bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
         bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
@@ -423,6 +377,7 @@ namespace WebCore {
         
         bool loadProvisionalItemFromCachedPage();
         void cachePageForHistoryItem(HistoryItem*);
+        void pageHidden();
 
         void receivedFirstData();
 
@@ -443,25 +398,17 @@ namespace WebCore {
 
         void setLoadType(FrameLoadType);
 
-        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
-        void checkNewWindowPolicy(const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName);
-
-        void continueAfterNavigationPolicy(PolicyAction);
-        void continueAfterNewWindowPolicy(PolicyAction);
-        void continueAfterContentPolicy(PolicyAction);
-        void continueLoadAfterWillSubmitForm(PolicyAction = PolicyUse);
-
         static void callContinueLoadAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-        void continueLoadAfterNavigationPolicy(const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
         static void callContinueLoadAfterNewWindowPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-        void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
         static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+
+        void continueLoadAfterNavigationPolicy(const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+        void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
         void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
+
         bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
         void addHistoryItemForFragmentScroll();
 
-        void stopPolicyCheck();
-
         void checkLoadCompleteForThisFrame();
 
         void setDocumentLoader(DocumentLoader*);
@@ -472,18 +419,12 @@ namespace WebCore {
 
         void closeOldDataSources();
         void open(CachedPage&);
-        void open(CachedFrame&);
 
         void updateHistoryAfterClientRedirect();
 
-        void clear(bool clearWindowProperties = true, bool clearScriptObjects = true);
+        void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
 
         bool shouldReloadToHandleUnreachableURL(DocumentLoader*);
-        void handleUnimplementablePolicy(const ResourceError&);
-
-        void scheduleRedirection(ScheduledRedirection*);
-        void startRedirectionTimer();
-        void stopRedirectionTimer();
 
         void dispatchDidCommitLoad();
         void dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
@@ -492,9 +433,6 @@ namespace WebCore {
         void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int length);
         void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
 
-        static bool isLocationChange(const ScheduledRedirection&);
-        void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
-
         void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
         void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
 
@@ -513,8 +451,6 @@ namespace WebCore {
             bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
 #endif
 
-        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
-        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
         bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
 
         void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
@@ -541,6 +477,7 @@ namespace WebCore {
 
         void scheduleCheckCompleted();
         void scheduleCheckLoadComplete();
+        void startCheckCompleteTimer();
 
         KURL originalRequestURL() const;
 
@@ -551,6 +488,8 @@ namespace WebCore {
         Frame* m_frame;
         FrameLoaderClient* m_client;
 
+        PolicyChecker m_policyChecker;
+
         FrameState m_state;
         FrameLoadType m_loadType;
 
@@ -562,15 +501,7 @@ namespace WebCore {
         RefPtr<DocumentLoader> m_provisionalDocumentLoader;
         RefPtr<DocumentLoader> m_policyDocumentLoader;
 
-        // This identifies the type of navigation action which prompted this load. Note 
-        // that WebKit conveys this value as the WebActionNavigationTypeKey value
-        // on navigation action delegate callbacks.
-        FrameLoadType m_policyLoadType;
-        PolicyCheck m_policyCheck;
-
         bool m_delegateIsHandlingProvisionalLoadError;
-        bool m_delegateIsDecidingNavigationPolicy;
-        bool m_delegateIsHandlingUnimplementablePolicy;
 
         bool m_firstLayoutDone;
         bool m_quickRedirectComing;
@@ -598,8 +529,6 @@ namespace WebCore {
 
         bool m_cancellingWithLoadInProgress;
 
-        OwnPtr<ScheduledRedirection> m_scheduledRedirection;
-
         bool m_needsClear;
         bool m_receivedData;
 
@@ -610,16 +539,14 @@ namespace WebCore {
         bool m_containsPlugIns;
 
         KURL m_submittedFormURL;
-    
-        Timer<FrameLoader> m_redirectionTimer;
-        Timer<FrameLoader> m_checkCompletedTimer;
-        Timer<FrameLoader> m_checkLoadCompleteTimer;
+
+        Timer<FrameLoader> m_checkTimer;
+        bool m_shouldCallCheckCompleted;
+        bool m_shouldCallCheckLoadComplete;
 
         Frame* m_opener;
         HashSet<Frame*> m_openedFrames;
 
-        bool m_openedByDOM;
-
         bool m_creatingInitialEmptyDocument;
         bool m_isDisplayingInitialEmptyDocument;
         bool m_committedFirstRealDocumentLoad;
@@ -629,6 +556,7 @@ namespace WebCore {
         RefPtr<HistoryItem> m_provisionalHistoryItem;
         
         bool m_didPerformFirstNavigation;
+        bool m_loadingFromCachedPage;
         
 #ifndef NDEBUG
         bool m_didDispatchDidCommitLoad;
diff --git a/WebCore/loader/FrameLoaderClient.h b/WebCore/loader/FrameLoaderClient.h
index bca0d0b..7973ca5 100644
--- a/WebCore/loader/FrameLoaderClient.h
+++ b/WebCore/loader/FrameLoaderClient.h
@@ -60,22 +60,28 @@ namespace WebCore {
     class KURL;
     class NavigationAction;
     class PluginView;
+    class PolicyChecker;
     class ResourceError;
     class ResourceHandle;
     class ResourceLoader;
     struct ResourceRequest;
     class ResourceResponse;
     class ScriptString;
+    class SecurityOrigin;
     class SharedBuffer;
     class SubstituteData;
     class String;
     class Widget;
 
+<<<<<<< HEAD:WebCore/loader/FrameLoaderClient.h
 #ifdef ANDROID_HISTORY_CLIENT
     class BackForwardList;
 #endif
 
     typedef void (FrameLoader::*FramePolicyFunction)(PolicyAction);
+=======
+    typedef void (PolicyChecker::*FramePolicyFunction)(PolicyAction);
+>>>>>>> webkit.org at 49305:WebCore/loader/FrameLoaderClient.h
 
     class FrameLoaderClient {
     public:
@@ -173,6 +179,15 @@ namespace WebCore {
         virtual void dispatchDidChangeHistoryIndex(BackForwardList*) const = 0;
 #endif
 
+        // This frame has displayed inactive content (such as an image) from an
+        // insecure source.  Inactive content cannot spread to other frames.
+        virtual void didDisplayInsecureContent() = 0;
+
+        // The indicated security origin has run active content (such as a
+        // script) from an insecure source.  Note that the insecure content can
+        // spread to other frames in the same origin.
+        virtual void didRunInsecureContent(SecurityOrigin*) = 0;
+
         virtual ResourceError cancelledError(const ResourceRequest&) = 0;
         virtual ResourceError blockedError(const ResourceRequest&) = 0;
         virtual ResourceError cannotShowURLError(const ResourceRequest&) = 0;
@@ -246,6 +261,7 @@ namespace WebCore {
 #endif
 
         virtual bool shouldUsePluginDocument(const String& /*mimeType*/) const { return false; }
+        virtual bool shouldLoadMediaElementURL(const KURL&) const { return true; }
     };
 
 } // namespace WebCore
diff --git a/WebCore/loader/FrameLoaderTypes.h b/WebCore/loader/FrameLoaderTypes.h
index 940bb7f..76299f5 100644
--- a/WebCore/loader/FrameLoaderTypes.h
+++ b/WebCore/loader/FrameLoaderTypes.h
@@ -81,6 +81,12 @@ namespace WebCore {
         ObjectContentNetscapePlugin,
         ObjectContentOtherPlugin
     };
+    
+    enum UnloadEventPolicy {
+        UnloadEventPolicyNone,
+        UnloadEventPolicyUnloadOnly,
+        UnloadEventPolicyUnloadAndPageHide
+    };
 }
 
 #endif
diff --git a/WebCore/loader/ImageDocument.cpp b/WebCore/loader/ImageDocument.cpp
index 08f2e9a..9b5598d 100644
--- a/WebCore/loader/ImageDocument.cpp
+++ b/WebCore/loader/ImageDocument.cpp
@@ -54,10 +54,24 @@ using namespace HTMLNames;
 class ImageEventListener : public EventListener {
 public:
     static PassRefPtr<ImageEventListener> create(ImageDocument* document) { return adoptRef(new ImageEventListener(document)); }
-    virtual void handleEvent(Event*, bool isWindowEvent);
+    static const ImageEventListener* cast(const EventListener* listener)
+    {
+        return listener->type() == ImageEventListenerType
+            ? static_cast<const ImageEventListener*>(listener)
+            : 0;
+    }
+
+    virtual bool operator==(const EventListener& other);
 
 private:
-    ImageEventListener(ImageDocument* document) : m_doc(document) { }
+    ImageEventListener(ImageDocument* document)
+        : EventListener(ImageEventListenerType)
+        , m_doc(document)
+    {
+    }
+
+    virtual void handleEvent(ScriptExecutionContext*, Event*);
+
     ImageDocument* m_doc;
 };
     
@@ -344,7 +358,7 @@ bool ImageDocument::shouldShrinkToFit() const
 
 // --------
 
-void ImageEventListener::handleEvent(Event* event, bool)
+void ImageEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
     if (event->type() == eventNames().resizeEvent)
         m_doc->windowSizeChanged();
@@ -354,6 +368,13 @@ void ImageEventListener::handleEvent(Event* event, bool)
     }
 }
 
+bool ImageEventListener::operator==(const EventListener& listener)
+{
+    if (const ImageEventListener* imageEventListener = ImageEventListener::cast(&listener))
+        return m_doc == imageEventListener->m_doc;
+    return false;
+}
+
 // --------
 
 ImageDocumentElement::~ImageDocumentElement()
diff --git a/WebCore/loader/ImageDocument.h b/WebCore/loader/ImageDocument.h
index 1bc5245..080b250 100644
--- a/WebCore/loader/ImageDocument.h
+++ b/WebCore/loader/ImageDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@ class ImageDocument : public HTMLDocument {
 public:
     static PassRefPtr<ImageDocument> create(Frame* frame)
     {
-        return new ImageDocument(frame);
+        return adoptRef(new ImageDocument(frame));
     }
 
     CachedImage* cachedImage();
diff --git a/WebCore/loader/MainResourceLoader.cpp b/WebCore/loader/MainResourceLoader.cpp
index 6c843e9..e7bdbcb 100644
--- a/WebCore/loader/MainResourceLoader.cpp
+++ b/WebCore/loader/MainResourceLoader.cpp
@@ -93,7 +93,7 @@ void MainResourceLoader::didCancel(const ResourceError& error)
     RefPtr<MainResourceLoader> protect(this);
 
     if (m_waitingForContentPolicy) {
-        frameLoader()->cancelContentPolicyCheck();
+        frameLoader()->policyChecker()->cancelCheck();
         ASSERT(m_waitingForContentPolicy);
         m_waitingForContentPolicy = false;
         deref(); // balances ref in didReceiveResponse
@@ -172,13 +172,17 @@ void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const Reso
     // Don't set this on the first request. It is set when the main load was started.
     m_documentLoader->setRequest(newRequest);
 
+    Frame* top = m_frame->tree()->top();
+    if (top != m_frame)
+        frameLoader()->checkIfDisplayInsecureContent(top->document()->securityOrigin(), newRequest.url());
+
     // FIXME: Ideally we'd stop the I/O until we hear back from the navigation policy delegate
     // listener. But there's no way to do that in practice. So instead we cancel later if the
     // listener tells us to. In practice that means the navigation policy needs to be decided
     // synchronously for these redirect cases.
     if (!redirectResponse.isNull()) {
         ref(); // balanced by deref in continueAfterNavigationPolicy
-        frameLoader()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
+        frameLoader()->policyChecker()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
     }
 }
 
@@ -201,7 +205,7 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
         // Prevent remote web archives from loading because they can claim to be from any domain and thus avoid cross-domain security checks (4120255).
         bool isRemoteWebArchive = equalIgnoringCase("application/x-webarchive", mimeType) && !m_substituteData.isValid() && !url.isLocalFile();
         if (!frameLoader()->canShowMIMEType(mimeType) || isRemoteWebArchive) {
-            frameLoader()->cannotShowMIMEType(r);
+            frameLoader()->policyChecker()->cannotShowMIMEType(r);
             // Check reachedTerminalState since the load may have already been cancelled inside of _handleUnimplementablePolicyWithErrorCode::.
             if (!reachedTerminalState())
                 stopLoadingForPolicyChange();
@@ -316,7 +320,25 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     ASSERT(!m_waitingForContentPolicy);
     m_waitingForContentPolicy = true;
     ref(); // balanced by deref in continueAfterContentPolicy and didCancel
-    frameLoader()->checkContentPolicy(m_response.mimeType(), callContinueAfterContentPolicy, this);
+
+    ASSERT(frameLoader()->activeDocumentLoader());
+
+    // Always show content with valid substitute data.
+    if (frameLoader()->activeDocumentLoader()->substituteData().isValid()) {
+        callContinueAfterContentPolicy(this, PolicyUse);
+        return;
+    }
+
+#if ENABLE(FTPDIR)
+    // Respect the hidden FTP Directory Listing pref so it can be tested even if the policy delegate might otherwise disallow it
+    Settings* settings = m_frame->settings();
+    if (settings && settings->forceFTPDirectoryListings() && m_response.mimeType() == "application/x-ftp-directory") {
+        callContinueAfterContentPolicy(this, PolicyUse);
+        return;
+    }
+#endif
+
+    frameLoader()->policyChecker()->checkContentPolicy(m_response.mimeType(), callContinueAfterContentPolicy, this);
 }
 
 void MainResourceLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
diff --git a/WebCore/loader/MediaDocument.cpp b/WebCore/loader/MediaDocument.cpp
index 0b1fd59..656d0a0 100644
--- a/WebCore/loader/MediaDocument.cpp
+++ b/WebCore/loader/MediaDocument.cpp
@@ -226,8 +226,8 @@ void MediaDocument::replaceMediaElementTimerFired(Timer<MediaDocument>*)
         embedElement->setAttribute(widthAttr, "100%");
         embedElement->setAttribute(heightAttr, "100%");
         embedElement->setAttribute(nameAttr, "plugin");
-        embedElement->setSrc(url().string());
-        embedElement->setType(frame()->loader()->responseMIMEType());
+        embedElement->setAttribute(srcAttr, url().string());
+        embedElement->setAttribute(typeAttr, frame()->loader()->responseMIMEType());
 
         ExceptionCode ec;
         videoElement->parent()->replaceChild(embedElement, videoElement, ec);
diff --git a/WebCore/loader/MediaDocument.h b/WebCore/loader/MediaDocument.h
index ac286f0..aa751ab 100644
--- a/WebCore/loader/MediaDocument.h
+++ b/WebCore/loader/MediaDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008,2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,22 +36,23 @@ class MediaDocument : public HTMLDocument {
 public:
     static PassRefPtr<MediaDocument> create(Frame* frame)
     {
-        return new MediaDocument(frame);
+        return adoptRef(new MediaDocument(frame));
     }
-
-    virtual void defaultEventHandler(Event*);
+    virtual ~MediaDocument();
 
     void mediaElementSawUnsupportedTracks();
 
 private:
     MediaDocument(Frame*);
-    virtual ~MediaDocument();
-    Timer<MediaDocument> m_replaceMediaElementTimer;
 
     virtual bool isMediaDocument() const { return true; }        
     virtual Tokenizer* createTokenizer();
 
+    virtual void defaultEventHandler(Event*);
+
     void replaceMediaElementTimerFired(Timer<MediaDocument>*);
+
+    Timer<MediaDocument> m_replaceMediaElementTimer;
 };
     
 }
diff --git a/WebCore/loader/PlaceholderDocument.cpp b/WebCore/loader/PlaceholderDocument.cpp
index e071aa8..af14c72 100644
--- a/WebCore/loader/PlaceholderDocument.cpp
+++ b/WebCore/loader/PlaceholderDocument.cpp
@@ -37,7 +37,7 @@ void PlaceholderDocument::attach()
 
     if (!styleSelector()) {
         RefPtr<StyleSheetList> styleSheetList = StyleSheetList::create(this);
-        setStyleSelector(new CSSStyleSelector(this, userStyleSheet(), styleSheetList.get(), 0, true, false));
+        setStyleSelector(new CSSStyleSelector(this, styleSheetList.get(), 0, pageUserSheet(), pageGroupUserSheets(), true, false));
     }
 
     // Skipping Document::attach().
diff --git a/WebCore/loader/PlaceholderDocument.h b/WebCore/loader/PlaceholderDocument.h
index c542370..a759266 100644
--- a/WebCore/loader/PlaceholderDocument.h
+++ b/WebCore/loader/PlaceholderDocument.h
@@ -34,7 +34,7 @@ class PlaceholderDocument : public Document {
 public:
     static PassRefPtr<PlaceholderDocument> create(Frame* frame)
     {
-        return new PlaceholderDocument(frame);
+        return adoptRef(new PlaceholderDocument(frame));
     }
 
     virtual void attach();
diff --git a/WebCore/loader/PluginDocument.cpp b/WebCore/loader/PluginDocument.cpp
index 3500c98..788691f 100644
--- a/WebCore/loader/PluginDocument.cpp
+++ b/WebCore/loader/PluginDocument.cpp
@@ -88,8 +88,8 @@ void PluginTokenizer::createDocumentStructure()
     m_embedElement->setAttribute(heightAttr, "100%");
     
     m_embedElement->setAttribute(nameAttr, "plugin");
-    m_embedElement->setSrc(m_doc->url().string());
-    m_embedElement->setType(m_doc->frame()->loader()->responseMIMEType());
+    m_embedElement->setAttribute(srcAttr, m_doc->url().string());
+    m_embedElement->setAttribute(typeAttr, m_doc->frame()->loader()->responseMIMEType());
     
     body->appendChild(embedElement, ec);    
 }
diff --git a/WebCore/loader/PluginDocument.h b/WebCore/loader/PluginDocument.h
index 35e4038..1d5c964 100644
--- a/WebCore/loader/PluginDocument.h
+++ b/WebCore/loader/PluginDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,7 +33,7 @@ class PluginDocument : public HTMLDocument {
 public:
     static PassRefPtr<PluginDocument> create(Frame* frame)
     {
-        return new PluginDocument(frame);
+        return adoptRef(new PluginDocument(frame));
     }
 
 private:
diff --git a/WebCore/loader/PolicyCallback.cpp b/WebCore/loader/PolicyCallback.cpp
new file mode 100644
index 0000000..14799cf
--- /dev/null
+++ b/WebCore/loader/PolicyCallback.cpp
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PolicyCallback.h"
+
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLFormElement.h"
+
+namespace WebCore {
+
+PolicyCallback::PolicyCallback()
+    : m_navigationFunction(0)
+    , m_newWindowFunction(0)
+    , m_contentFunction(0)
+{
+}
+
+PolicyCallback::~PolicyCallback()
+{
+}
+
+void PolicyCallback::clear()
+{
+    clearRequest();
+    m_navigationFunction = 0;
+    m_newWindowFunction = 0;
+    m_contentFunction = 0;
+}
+
+void PolicyCallback::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
+    NavigationPolicyDecisionFunction function, void* argument)
+{
+    m_request = request;
+    m_formState = formState;
+    m_frameName = String();
+
+    m_navigationFunction = function;
+    m_newWindowFunction = 0;
+    m_contentFunction = 0;
+    m_argument = argument;
+}
+
+void PolicyCallback::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
+    const String& frameName, NewWindowPolicyDecisionFunction function, void* argument)
+{
+    m_request = request;
+    m_formState = formState;
+    m_frameName = frameName;
+
+    m_navigationFunction = 0;
+    m_newWindowFunction = function;
+    m_contentFunction = 0;
+    m_argument = argument;
+}
+
+void PolicyCallback::set(ContentPolicyDecisionFunction function, void* argument)
+{
+    m_request = ResourceRequest();
+    m_formState = 0;
+    m_frameName = String();
+
+    m_navigationFunction = 0;
+    m_newWindowFunction = 0;
+    m_contentFunction = function;
+    m_argument = argument;
+}
+
+void PolicyCallback::call(bool shouldContinue)
+{
+    if (m_navigationFunction)
+        m_navigationFunction(m_argument, m_request, m_formState.get(), shouldContinue);
+    if (m_newWindowFunction)
+        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, shouldContinue);
+    ASSERT(!m_contentFunction);
+}
+
+void PolicyCallback::call(PolicyAction action)
+{
+    ASSERT(!m_navigationFunction);
+    ASSERT(!m_newWindowFunction);
+    ASSERT(m_contentFunction);
+    m_contentFunction(m_argument, action);
+}
+
+void PolicyCallback::clearRequest()
+{
+    m_request = ResourceRequest();
+    m_formState = 0;
+    m_frameName = String();
+}
+
+void PolicyCallback::cancel()
+{
+    clearRequest();
+    if (m_navigationFunction)
+        m_navigationFunction(m_argument, m_request, m_formState.get(), false);
+    if (m_newWindowFunction)
+        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, false);
+    if (m_contentFunction)
+        m_contentFunction(m_argument, PolicyIgnore);
+}
+
+} // namespace WebCore
diff --git a/WebCore/loader/PolicyCallback.h b/WebCore/loader/PolicyCallback.h
new file mode 100644
index 0000000..2aa7c7c
--- /dev/null
+++ b/WebCore/loader/PolicyCallback.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PolicyCallback_h
+#define PolicyCallback_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include "ResourceRequest.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class FormState;
+
+    typedef void (*NavigationPolicyDecisionFunction)(void* argument,
+        const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+    typedef void (*NewWindowPolicyDecisionFunction)(void* argument,
+        const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+    typedef void (*ContentPolicyDecisionFunction)(void* argument, PolicyAction);
+
+    class PolicyCallback {
+    public:
+        PolicyCallback();
+        ~PolicyCallback();
+
+        void clear();
+        void set(const ResourceRequest&, PassRefPtr<FormState>,
+            NavigationPolicyDecisionFunction, void* argument);
+        void set(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName,
+            NewWindowPolicyDecisionFunction, void* argument);
+        void set(ContentPolicyDecisionFunction, void* argument);
+
+        const ResourceRequest& request() const { return m_request; }
+        void clearRequest();
+
+        void call(bool shouldContinue);
+        void call(PolicyAction);
+        void cancel();
+
+    private:
+        ResourceRequest m_request;
+        RefPtr<FormState> m_formState;
+        String m_frameName;
+
+        NavigationPolicyDecisionFunction m_navigationFunction;
+        NewWindowPolicyDecisionFunction m_newWindowFunction;
+        ContentPolicyDecisionFunction m_contentFunction;
+        void* m_argument;
+    };
+
+} // namespace WebCore
+
+#endif // PolicyCallback_h
diff --git a/WebCore/loader/PolicyChecker.cpp b/WebCore/loader/PolicyChecker.cpp
new file mode 100644
index 0000000..196ab4f
--- /dev/null
+++ b/WebCore/loader/PolicyChecker.cpp
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PolicyChecker.h"
+
+#include "DocumentLoader.h"
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "HTMLFormElement.h"
+
+namespace WebCore {
+
+PolicyChecker::PolicyChecker(Frame* frame)
+    : m_frame(frame)
+    , m_delegateIsDecidingNavigationPolicy(false)
+    , m_delegateIsHandlingUnimplementablePolicy(false)
+    , m_loadType(FrameLoadTypeStandard)
+{
+}
+
+void PolicyChecker::checkNavigationPolicy(const ResourceRequest& newRequest, NavigationPolicyDecisionFunction function, void* argument)
+{
+    checkNavigationPolicy(newRequest, m_frame->loader()->activeDocumentLoader(), 0, function, argument);
+}
+
+void PolicyChecker::checkNavigationPolicy(const ResourceRequest& request, DocumentLoader* loader,
+    PassRefPtr<FormState> formState, NavigationPolicyDecisionFunction function, void* argument)
+{
+    NavigationAction action = loader->triggeringAction();
+    if (action.isEmpty()) {
+        action = NavigationAction(request.url(), NavigationTypeOther);
+        loader->setTriggeringAction(action);
+    }
+
+    // Don't ask more than once for the same request or if we are loading an empty URL.
+    // This avoids confusion on the part of the client.
+    if (equalIgnoringHeaderFields(request, loader->lastCheckedRequest()) || (!request.isNull() && request.url().isEmpty())) {
+        function(argument, request, 0, true);
+        loader->setLastCheckedRequest(request);
+        return;
+    }
+    
+    // We are always willing to show alternate content for unreachable URLs;
+    // treat it like a reload so it maintains the right state for b/f list.
+    if (loader->substituteData().isValid() && !loader->substituteData().failingURL().isEmpty()) {
+        if (isBackForwardLoadType(m_loadType))
+            m_loadType = FrameLoadTypeReload;
+        function(argument, request, 0, true);
+        return;
+    }
+    
+    loader->setLastCheckedRequest(request);
+
+    m_callback.set(request, formState.get(), function, argument);
+
+    m_delegateIsDecidingNavigationPolicy = true;
+    m_frame->loader()->client()->dispatchDecidePolicyForNavigationAction(&PolicyChecker::continueAfterNavigationPolicy,
+        action, request, formState);
+    m_delegateIsDecidingNavigationPolicy = false;
+}
+
+void PolicyChecker::checkNewWindowPolicy(const NavigationAction& action, NewWindowPolicyDecisionFunction function,
+    const ResourceRequest& request, PassRefPtr<FormState> formState, const String& frameName, void* argument)
+{
+    m_callback.set(request, formState, frameName, function, argument);
+    m_frame->loader()->client()->dispatchDecidePolicyForNewWindowAction(&PolicyChecker::continueAfterNewWindowPolicy,
+        action, request, formState, frameName);
+}
+
+void PolicyChecker::checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction function, void* argument)
+{
+    m_callback.set(function, argument);
+    m_frame->loader()->client()->dispatchDecidePolicyForMIMEType(&PolicyChecker::continueAfterContentPolicy,
+        MIMEType, m_frame->loader()->activeDocumentLoader()->request());
+}
+
+void PolicyChecker::cancelCheck()
+{
+    m_frame->loader()->client()->cancelPolicyCheck();
+    m_callback.clear();
+}
+
+void PolicyChecker::stopCheck()
+{
+    m_frame->loader()->client()->cancelPolicyCheck();
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+    callback.cancel();
+}
+
+void PolicyChecker::cannotShowMIMEType(const ResourceResponse& response)
+{
+    handleUnimplementablePolicy(m_frame->loader()->client()->cannotShowMIMETypeError(response));
+}
+
+void PolicyChecker::continueLoadAfterWillSubmitForm(PolicyAction)
+{
+    // See header file for an explaination of why this function
+    // isn't like the others.
+    m_frame->loader()->continueLoadAfterWillSubmitForm();
+}
+
+void PolicyChecker::continueAfterNavigationPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+
+    bool shouldContinue = policy == PolicyUse;
+
+    switch (policy) {
+        case PolicyIgnore:
+            callback.clearRequest();
+            break;
+        case PolicyDownload:
+            m_frame->loader()->client()->startDownload(callback.request());
+            callback.clearRequest();
+            break;
+        case PolicyUse: {
+            ResourceRequest request(callback.request());
+
+            if (!m_frame->loader()->client()->canHandleRequest(request)) {
+                handleUnimplementablePolicy(m_frame->loader()->cannotShowURLError(callback.request()));
+                callback.clearRequest();
+                shouldContinue = false;
+            }
+            break;
+        }
+    }
+
+    callback.call(shouldContinue);
+}
+
+void PolicyChecker::continueAfterNewWindowPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+
+    switch (policy) {
+        case PolicyIgnore:
+            callback.clearRequest();
+            break;
+        case PolicyDownload:
+            m_frame->loader()->client()->startDownload(callback.request());
+            callback.clearRequest();
+            break;
+        case PolicyUse:
+            break;
+    }
+
+    callback.call(policy == PolicyUse);
+}
+
+void PolicyChecker::continueAfterContentPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+    callback.call(policy);
+}
+
+void PolicyChecker::handleUnimplementablePolicy(const ResourceError& error)
+{
+    m_delegateIsHandlingUnimplementablePolicy = true;
+    m_frame->loader()->client()->dispatchUnableToImplementPolicy(error);
+    m_delegateIsHandlingUnimplementablePolicy = false;
+}
+
+} // namespace WebCore
diff --git a/WebCore/loader/PolicyChecker.h b/WebCore/loader/PolicyChecker.h
new file mode 100644
index 0000000..c667f5b
--- /dev/null
+++ b/WebCore/loader/PolicyChecker.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PolicyChecker_h
+#define PolicyChecker_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include "PolicyCallback.h"
+#include "ResourceRequest.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class DocumentLoader;
+    class FormState;
+    class Frame;
+    class NavigationAction;
+    class ResourceError;
+    class ResourceResponse;
+
+    class PolicyChecker : public Noncopyable {
+    public:
+        PolicyChecker(Frame*);
+
+        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
+        void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction, void* argument);
+        void checkNewWindowPolicy(const NavigationAction&, NewWindowPolicyDecisionFunction, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, void* argument);
+        void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
+
+        // FIXME: These are different.  They could use better names.
+        void cancelCheck();
+        void stopCheck();
+
+        void cannotShowMIMEType(const ResourceResponse&);
+
+        FrameLoadType loadType() const { return m_loadType; }
+        void setLoadType(FrameLoadType loadType) { m_loadType = loadType; }
+
+        bool delegateIsDecidingNavigationPolicy() const { return m_delegateIsDecidingNavigationPolicy; }
+        bool delegateIsHandlingUnimplementablePolicy() const { return m_delegateIsHandlingUnimplementablePolicy; }
+
+        // FIXME: This function is a cheat.  Basically, this is just an asynchronouc callback
+        // from the FrameLoaderClient, but this callback uses the policy types and so has to
+        // live on this object.  In the long term, we should create a type for non-policy
+        // callbacks from the FrameLoaderClient and remove this vestige.  I just don't have
+        // the heart to hack on all the platforms to make that happen right now.
+        void continueLoadAfterWillSubmitForm(PolicyAction);
+
+    private:
+        void continueAfterNavigationPolicy(PolicyAction);
+        void continueAfterNewWindowPolicy(PolicyAction);
+        void continueAfterContentPolicy(PolicyAction);
+
+        void handleUnimplementablePolicy(const ResourceError&);
+
+        Frame* m_frame;
+
+        bool m_delegateIsDecidingNavigationPolicy;
+        bool m_delegateIsHandlingUnimplementablePolicy;
+
+        // This identifies the type of navigation action which prompted this load. Note 
+        // that WebKit conveys this value as the WebActionNavigationTypeKey value
+        // on navigation action delegate callbacks.
+        FrameLoadType m_loadType;
+        PolicyCallback m_callback;
+    };
+
+} // namespace WebCore
+
+#endif // PolicyChecker_h
diff --git a/WebCore/loader/RedirectScheduler.cpp b/WebCore/loader/RedirectScheduler.cpp
new file mode 100644
index 0000000..819cbdd
--- /dev/null
+++ b/WebCore/loader/RedirectScheduler.cpp
@@ -0,0 +1,374 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Adam Barth. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RedirectScheduler.h"
+
+#include "DocumentLoader.h"
+#include "Event.h"
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "HTMLFormElement.h"
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+struct ScheduledRedirection {
+    enum Type { redirection, locationChange, historyNavigation, formSubmission };
+
+    const Type type;
+    const double delay;
+    const String url;
+    const String referrer;
+    const FrameLoadRequest frameRequest;
+    const RefPtr<Event> event;
+    const RefPtr<FormState> formState;
+    const int historySteps;
+    const bool lockHistory;
+    const bool lockBackForwardList;
+    const bool wasUserGesture;
+    const bool wasRefresh;
+    const bool wasDuringLoad;
+    bool toldClient;
+
+    ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
+        : type(redirection)
+        , delay(delay)
+        , url(url)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
+        , wasRefresh(refresh)
+        , wasDuringLoad(false)
+        , toldClient(false)
+    {
+        ASSERT(!url.isEmpty());
+    }
+
+    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
+        : type(locationChange)
+        , delay(0)
+        , url(url)
+        , referrer(referrer)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
+        , wasRefresh(refresh)
+        , wasDuringLoad(duringLoad)
+        , toldClient(false)
+    {
+        ASSERT(!url.isEmpty());
+    }
+
+    explicit ScheduledRedirection(int historyNavigationSteps)
+        : type(historyNavigation)
+        , delay(0)
+        , historySteps(historyNavigationSteps)
+        , lockHistory(false)
+        , lockBackForwardList(false)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(false)
+        , toldClient(false)
+    {
+    }
+
+    ScheduledRedirection(const FrameLoadRequest& frameRequest,
+            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
+            bool duringLoad)
+        : type(formSubmission)
+        , delay(0)
+        , frameRequest(frameRequest)
+        , event(event)
+        , formState(formState)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(duringLoad)
+        , toldClient(false)
+    {
+        ASSERT(!frameRequest.isEmpty());
+        ASSERT(this->formState);
+    }
+};
+
+RedirectScheduler::RedirectScheduler(Frame* frame)
+    : m_frame(frame)
+    , m_timer(this, &RedirectScheduler::timerFired)
+{
+}
+
+RedirectScheduler::~RedirectScheduler()
+{
+}
+
+bool RedirectScheduler::redirectScheduledDuringLoad()
+{
+    return m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad;
+}
+
+void RedirectScheduler::clear()
+{
+    m_timer.stop();
+    m_scheduledRedirection.clear();
+}
+
+void RedirectScheduler::scheduleRedirect(double delay, const String& url)
+{
+    if (delay < 0 || delay > INT_MAX / 1000)
+        return;
+        
+    if (!m_frame->page())
+        return;
+
+    if (url.isEmpty())
+        return;
+
+    // We want a new history item if the refresh timeout is > 1 second.
+    if (!m_scheduledRedirection || delay <= m_scheduledRedirection->delay)
+        schedule(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
+}
+
+bool RedirectScheduler::mustLockBackForwardList(Frame* targetFrame)
+{
+    // Navigation of a subframe during loading of an ancestor frame does not create a new back/forward item.
+    // The definition of "during load" is any time before all handlers for the load event have been run.
+    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
+    
+    for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
+        Document* document = ancestor->document();
+        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
+            return true;
+    }
+    return false;
+}
+
+void RedirectScheduler::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
+{
+    if (!m_frame->page())
+        return;
+
+    if (url.isEmpty())
+        return;
+
+    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame);
+
+    FrameLoader* loader = m_frame->loader();
+    
+    // If the URL we're going to navigate to is the same as the current one, except for the
+    // fragment part, we don't need to schedule the location change.
+    KURL parsedURL(ParsedURLString, url);
+    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(loader->url(), parsedURL)) {
+        loader->changeLocation(loader->completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
+        return;
+    }
+
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !loader->committedFirstRealDocumentLoad();
+
+    schedule(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
+}
+
+void RedirectScheduler::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
+    bool lockHistory, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+{
+    ASSERT(m_frame->page());
+    ASSERT(!frameRequest.isEmpty());
+
+    // FIXME: Do we need special handling for form submissions where the URL is the same
+    // as the current one except for the fragment part? See scheduleLocationChange above.
+
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !m_frame->loader()->committedFirstRealDocumentLoad();
+
+    schedule(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
+}
+
+void RedirectScheduler::scheduleRefresh(bool wasUserGesture)
+{
+    if (!m_frame->page())
+        return;
+    
+    const KURL& url = m_frame->loader()->url();
+
+    if (url.isEmpty())
+        return;
+
+    schedule(new ScheduledRedirection(url.string(), m_frame->loader()->outgoingReferrer(), true, true, wasUserGesture, true, false));
+}
+
+bool RedirectScheduler::locationChangePending()
+{
+    if (!m_scheduledRedirection)
+        return false;
+
+    switch (m_scheduledRedirection->type) {
+        case ScheduledRedirection::redirection:
+            return false;
+        case ScheduledRedirection::historyNavigation:
+        case ScheduledRedirection::locationChange:
+        case ScheduledRedirection::formSubmission:
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+void RedirectScheduler::scheduleHistoryNavigation(int steps)
+{
+    if (!m_frame->page())
+        return;
+
+    schedule(new ScheduledRedirection(steps));
+}
+
+void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
+{
+    ASSERT(m_frame->page());
+
+    if (m_frame->page()->defersLoading())
+        return;
+
+    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
+    FrameLoader* loader = m_frame->loader();
+
+    switch (redirection->type) {
+        case ScheduledRedirection::redirection:
+        case ScheduledRedirection::locationChange:
+            loader->changeLocation(KURL(ParsedURLString, redirection->url), redirection->referrer,
+                redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
+            return;
+        case ScheduledRedirection::historyNavigation:
+            if (redirection->historySteps == 0) {
+                // Special case for go(0) from a frame -> reload only the frame
+                loader->urlSelected(loader->url(), "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture);
+                return;
+            }
+            // go(i!=0) from a frame navigates into the history of the frame only,
+            // in both IE and NS (but not in Mozilla). We can't easily do that.
+            if (m_frame->page()->canGoBackOrForward(redirection->historySteps))
+                m_frame->page()->goBackOrForward(redirection->historySteps);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // The submitForm function will find a target frame before using the redirection timer.
+            // Now that the timer has fired, we need to repeat the security check which normally is done when
+            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
+            // without leaving a time window. If we fail the check just silently drop the form submission.
+            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
+                return;
+            loader->loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
+                redirection->event, redirection->formState);
+            return;
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
+void RedirectScheduler::schedule(PassOwnPtr<ScheduledRedirection> redirection)
+{
+    ASSERT(m_frame->page());
+    FrameLoader* loader = m_frame->loader();
+
+    // If a redirect was scheduled during a load, then stop the current load.
+    // Otherwise when the current load transitions from a provisional to a 
+    // committed state, pending redirects may be cancelled. 
+    if (redirection->wasDuringLoad) {
+        if (DocumentLoader* provisionalDocumentLoader = loader->provisionalDocumentLoader())
+            provisionalDocumentLoader->stopLoading();
+        loader->stopLoading(UnloadEventPolicyUnloadAndPageHide);   
+    }
+
+    cancel();
+    m_scheduledRedirection = redirection;
+    if (!loader->isComplete() && m_scheduledRedirection->type != ScheduledRedirection::redirection)
+        loader->completed();
+    startTimer();
+}
+
+void RedirectScheduler::startTimer()
+{
+    if (!m_scheduledRedirection)
+        return;
+
+    ASSERT(m_frame->page());
+    
+    FrameLoader* loader = m_frame->loader();
+
+    if (m_timer.isActive())
+        return;
+
+    if (m_scheduledRedirection->type == ScheduledRedirection::redirection && !loader->allAncestorsAreComplete())
+        return;
+
+    m_timer.startOneShot(m_scheduledRedirection->delay);
+
+    switch (m_scheduledRedirection->type) {
+        case ScheduledRedirection::locationChange:
+        case ScheduledRedirection::redirection:
+            if (m_scheduledRedirection->toldClient)
+                return;
+            m_scheduledRedirection->toldClient = true;
+            loader->clientRedirected(KURL(ParsedURLString, m_scheduledRedirection->url),
+                m_scheduledRedirection->delay,
+                currentTime() + m_timer.nextFireInterval(),
+                m_scheduledRedirection->lockBackForwardList);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // FIXME: It would make sense to report form submissions as client redirects too.
+            // But we didn't do that in the past when form submission used a separate delay
+            // mechanism, so doing it will be a behavior change.
+            return;
+        case ScheduledRedirection::historyNavigation:
+            // Don't report history navigations.
+            return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+void RedirectScheduler::cancel(bool newLoadInProgress)
+{
+    m_timer.stop();
+
+    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
+    if (redirection && redirection->toldClient)
+        m_frame->loader()->clientRedirectCancelledOrFinished(newLoadInProgress);
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/loader/RedirectScheduler.h b/WebCore/loader/RedirectScheduler.h
new file mode 100644
index 0000000..bf076d6
--- /dev/null
+++ b/WebCore/loader/RedirectScheduler.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Adam Barth. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RedirectScheduler_h
+#define RedirectScheduler_h
+
+#include "Event.h"
+#include "Timer.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class FormState;
+    class Frame;
+    class String;
+
+    struct FrameLoadRequest;
+    struct ScheduledRedirection;
+
+    class RedirectScheduler : public Noncopyable {
+    public:
+        RedirectScheduler(Frame*);
+        ~RedirectScheduler();
+
+        bool redirectScheduledDuringLoad();
+        bool locationChangePending();
+
+        void scheduleRedirect(double delay, const String& url);
+        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
+        void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
+        void scheduleRefresh(bool userGesture = false);
+        void scheduleHistoryNavigation(int steps);
+
+        void startTimer();
+
+        void cancel(bool newLoadInProgress = false);
+        void clear();
+
+    private:
+        void timerFired(Timer<RedirectScheduler>*);
+        void schedule(PassOwnPtr<ScheduledRedirection>);
+
+        static bool mustLockBackForwardList(Frame* targetFrame);
+
+        Frame* m_frame;
+        Timer<RedirectScheduler> m_timer;
+        OwnPtr<ScheduledRedirection> m_scheduledRedirection;
+    };
+
+} // namespace WebCore
+
+#endif // FrameLoader_h
diff --git a/WebCore/loader/ResourceLoader.cpp b/WebCore/loader/ResourceLoader.cpp
index 5ad181b..2dac844 100644
--- a/WebCore/loader/ResourceLoader.cpp
+++ b/WebCore/loader/ResourceLoader.cpp
@@ -94,8 +94,9 @@ void ResourceLoader::releaseResources()
 
     if (m_handle) {
         // Clear out the ResourceHandle's client so that it doesn't try to call
-        // us back after we release it.
-        m_handle->setClient(0);
+        // us back after we release it, unless it has been replaced by someone else.
+        if (m_handle->client() == this)
+            m_handle->setClient(0);
         m_handle = 0;
     }
 
diff --git a/WebCore/loader/SubresourceLoader.cpp b/WebCore/loader/SubresourceLoader.cpp
index 047cc6d..2ee4626 100644
--- a/WebCore/loader/SubresourceLoader.cpp
+++ b/WebCore/loader/SubresourceLoader.cpp
@@ -33,6 +33,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "ResourceHandle.h"
+#include "SecurityOrigin.h"
 #include "SubresourceLoaderClient.h"
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -72,13 +73,13 @@ PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, Subresourc
     ResourceRequest newRequest = request;
 
     if (!skipCanLoadCheck
-            && FrameLoader::restrictAccessToLocal()
-            && !FrameLoader::canLoad(request.url(), String(), frame->document())) {
+            && SecurityOrigin::restrictAccessToLocal()
+            && !SecurityOrigin::canLoad(request.url(), String(), frame->document())) {
         FrameLoader::reportLocalLoadFailed(frame, request.url().string());
         return 0;
     }
     
-    if (FrameLoader::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
+    if (SecurityOrigin::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
         newRequest.clearHTTPReferrer();
     else if (!request.httpReferrer())
         newRequest.setHTTPReferrer(fl->outgoingReferrer());
diff --git a/WebCore/loader/TextDocument.h b/WebCore/loader/TextDocument.h
index c67fea5..53e3074 100644
--- a/WebCore/loader/TextDocument.h
+++ b/WebCore/loader/TextDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@ class TextDocument : public HTMLDocument {
 public:
     static PassRefPtr<TextDocument> create(Frame* frame)
     {
-        return new TextDocument(frame);
+        return adoptRef(new TextDocument(frame));
     }
 
 private:
diff --git a/WebCore/loader/TextResourceDecoder.cpp b/WebCore/loader/TextResourceDecoder.cpp
index db68441..6ddd604 100644
--- a/WebCore/loader/TextResourceDecoder.cpp
+++ b/WebCore/loader/TextResourceDecoder.cpp
@@ -798,23 +798,15 @@ String TextResourceDecoder::decode(const char* data, size_t len)
         if (!checkForHeadCharset(data, len, movedDataToBuffer))
             return "";
 
-    // FIXME: It seems wrong to change our encoding downstream after
-    // we have already done some decoding. However, it's not possible
-    // to avoid in a sense in two cases below because triggering conditions
-    // for both cases depend on the information that won't be available
-    // until we do partial read. 
-    // The first case had better be removed altogether (see bug 21990)
-    // or at least be made to be invoked only when the encoding detection
-    // is turned on. 
-    // Do the auto-detect 1) using Japanese detector if our default encoding is
-    // one of the Japanese detector or 2) using detectTextEncoding if encoding
-    // detection is turned on.
-    if (m_source != UserChosenEncoding && m_source != AutoDetectedEncoding && m_encoding.isJapanese())
-        detectJapaneseEncoding(data, len);
-    else if (shouldAutoDetect()) {
-        TextEncoding detectedEncoding;
-        if (detectTextEncoding(data, len, m_hintEncoding, &detectedEncoding))
-            setEncoding(detectedEncoding, AutoDetectedEncoding);
+    // FIXME: It is wrong to change the encoding downstream after we have already done some decoding.
+    if (shouldAutoDetect()) {
+        if (m_encoding.isJapanese())
+            detectJapaneseEncoding(data, len); // FIXME: We should use detectTextEncoding() for all languages.
+        else {
+            TextEncoding detectedEncoding;
+            if (detectTextEncoding(data, len, m_hintEncoding, &detectedEncoding))
+                setEncoding(detectedEncoding, AutoDetectedEncoding);
+        }
     }
 
     ASSERT(m_encoding.isValid());
diff --git a/WebCore/loader/ThreadableLoader.cpp b/WebCore/loader/ThreadableLoader.cpp
index b174af7..720ba4e 100644
--- a/WebCore/loader/ThreadableLoader.cpp
+++ b/WebCore/loader/ThreadableLoader.cpp
@@ -40,33 +40,33 @@
 
 namespace WebCore {
 
-PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy) 
+PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, const ThreadableLoaderOptions& options) 
 {
     ASSERT(client);
     ASSERT(context);
 
 #if ENABLE(WORKERS)
     if (context->isWorkerContext())
-        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, options);
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, options);
 }
 
-void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
     ASSERT(context);
 
 #if ENABLE(WORKERS)
     if (context->isWorkerContext()) {
-        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, storedCredentials, DenyCrossOriginRedirect);
+        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, options);
         return;
     }
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client, storedCredentials);
+    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client, options);
 }
 
 } // namespace WebCore
diff --git a/WebCore/loader/ThreadableLoader.h b/WebCore/loader/ThreadableLoader.h
index 1ac12cb..a52bfad 100644
--- a/WebCore/loader/ThreadableLoader.h
+++ b/WebCore/loader/ThreadableLoader.h
@@ -43,32 +43,32 @@ namespace WebCore {
     class ScriptExecutionContext;
     class ThreadableLoaderClient;
 
-    enum LoadCallbacks {
-        SendLoadCallbacks,
-        DoNotSendLoadCallbacks
-    };
-
-    enum ContentSniff {
-        SniffContent,
-        DoNotSniffContent
-    };
-
     enum StoredCredentials {
         AllowStoredCredentials,
         DoNotAllowStoredCredentials
     };
-
-    enum CrossOriginRedirectPolicy {
-        DenyCrossOriginRedirect,
-        AllowCrossOriginRedirect
+    
+    enum CrossOriginRequestPolicy {
+        DenyCrossOriginRequests,
+        UseAccessControl,
+        AllowCrossOriginRequests
+    };
+    
+    struct ThreadableLoaderOptions {
+        ThreadableLoaderOptions() : sendLoadCallbacks(false), sniffContent(false), allowCredentials(false), forcePreflight(false), crossOriginRequestPolicy(DenyCrossOriginRequests) { }
+        bool sendLoadCallbacks;
+        bool sniffContent;
+        bool allowCredentials;  // Whether HTTP credentials and cookies are sent with the request.
+        bool forcePreflight;  // If AccessControl is used, whether to force a preflight.
+        CrossOriginRequestPolicy crossOriginRequestPolicy;
     };
 
     // Useful for doing loader operations from any thread (not threadsafe, 
     // just able to run on threads other than the main thread).
     class ThreadableLoader : public Noncopyable {
     public:
-        static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
-        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
+        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, const ThreadableLoaderOptions&);
 
         virtual void cancel() = 0;
         void ref() { refThreadableLoader(); }
diff --git a/WebCore/loader/WorkerThreadableLoader.cpp b/WebCore/loader/WorkerThreadableLoader.cpp
index 4d12b8d..bd362f4 100644
--- a/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/WebCore/loader/WorkerThreadableLoader.cpp
@@ -53,11 +53,10 @@ namespace WebCore {
 
 static const char loadResourceSynchronouslyMode[] = "loadResourceSynchronouslyMode";
 
-WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting,
-                                               ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_workerContext(workerContext)
     , m_workerClientWrapper(ThreadableLoaderClientWrapper::create(client))
-    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy)))
+    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, options)))
 {
 }
 
@@ -66,7 +65,7 @@ WorkerThreadableLoader::~WorkerThreadableLoader()
     m_bridge.destroy();
 }
 
-void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
     WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
 
@@ -74,9 +73,7 @@ void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerCont
     String mode = loadResourceSynchronouslyMode;
     mode.append(String::number(runLoop.createUniqueId()));
 
-    ContentSniff contentSniff = request.url().isLocalFile() ? SniffContent : DoNotSniffContent;
-    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, DoNotSendLoadCallbacks, contentSniff, storedCredentials, crossOriginRedirectPolicy);
-
+    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, options);
     MessageQueueWaitResult result = MessageQueueMessageReceived;
     while (!loader->done() && result != MessageQueueTerminated)
         result = runLoop.runInMode(workerContext, mode);
@@ -91,21 +88,20 @@ void WorkerThreadableLoader::cancel()
 }
 
 WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerLoaderProxy& loaderProxy, const String& taskMode,
-                                                           const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials,
-                                                           CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+                                                           const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_workerClientWrapper(workerClientWrapper)
     , m_loaderProxy(loaderProxy)
-    , m_taskMode(taskMode.copy())
+    , m_taskMode(taskMode.crossThreadString())
 {
     ASSERT(m_workerClientWrapper.get());
-    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, options));
 }
 
 WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge()
 {
 }
 
-void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, ThreadableLoaderOptions options)
 {
     ASSERT(isMainThread());
     ASSERT(context->isDocument());
@@ -117,7 +113,7 @@ void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExec
     // FIXME: If the a site requests a local resource, then this will return a non-zero value but the sync path
     // will return a 0 value.  Either this should return 0 or the other code path should do a callback with
     // a failure.
-    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, options);
     ASSERT(thisPtr->m_mainThreadLoader);
 }
 
diff --git a/WebCore/loader/WorkerThreadableLoader.h b/WebCore/loader/WorkerThreadableLoader.h
index 8b11b70..230c77d 100644
--- a/WebCore/loader/WorkerThreadableLoader.h
+++ b/WebCore/loader/WorkerThreadableLoader.h
@@ -55,10 +55,10 @@ namespace WebCore {
 
     class WorkerThreadableLoader : public RefCounted<WorkerThreadableLoader>, public ThreadableLoader {
     public:
-        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials, CrossOriginRedirectPolicy);
-        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
+        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, const ThreadableLoaderOptions& options)
         {
-            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, options));
         }
 
         ~WorkerThreadableLoader();
@@ -97,7 +97,7 @@ namespace WebCore {
         class MainThreadBridge : ThreadableLoaderClient {
         public:
             // All executed on the worker context's thread.
-            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
             void cancel();
             void destroy();
 
@@ -109,7 +109,7 @@ namespace WebCore {
             static void mainThreadDestroy(ScriptExecutionContext*, MainThreadBridge*);
             ~MainThreadBridge();
 
-            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, ThreadableLoaderOptions);
             static void mainThreadCancel(ScriptExecutionContext*, MainThreadBridge*);
             virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
             virtual void didReceiveResponse(const ResourceResponse&);
@@ -133,7 +133,7 @@ namespace WebCore {
             String m_taskMode;
         };
 
-        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
 
         RefPtr<WorkerContext> m_workerContext;
         RefPtr<ThreadableLoaderClientWrapper> m_workerClientWrapper;
diff --git a/WebCore/loader/appcache/ApplicationCache.cpp b/WebCore/loader/appcache/ApplicationCache.cpp
index 34dace4..c0cd3ea 100644
--- a/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/WebCore/loader/appcache/ApplicationCache.cpp
@@ -111,7 +111,7 @@ unsigned ApplicationCache::removeResource(const String& url)
     
 ApplicationCacheResource* ApplicationCache::resourceForURL(const String& url)
 {
-    ASSERT(!KURL(url).hasFragmentIdentifier());
+    ASSERT(!KURL(ParsedURLString, url).hasFragmentIdentifier());
     return m_resources.get(url).get();
 }    
 
@@ -147,6 +147,9 @@ void ApplicationCache::setOnlineWhitelist(const Vector<KURL>& onlineWhitelist)
 
 bool ApplicationCache::isURLInOnlineWhitelist(const KURL& url)
 {
+    if (m_allowAllNetworkRequests)
+        return true;
+
     size_t whitelistSize = m_onlineWhitelist.size();
     for (size_t i = 0; i < whitelistSize; ++i) {
         if (protocolHostAndPortAreEqual(url, m_onlineWhitelist[i]) && url.string().startsWith(m_onlineWhitelist[i].string()))
diff --git a/WebCore/loader/appcache/ApplicationCache.h b/WebCore/loader/appcache/ApplicationCache.h
index b1753be..d1444c0 100644
--- a/WebCore/loader/appcache/ApplicationCache.h
+++ b/WebCore/loader/appcache/ApplicationCache.h
@@ -65,6 +65,8 @@ public:
     ApplicationCacheResource* resourceForRequest(const ResourceRequest&);
     ApplicationCacheResource* resourceForURL(const String& url);
 
+    void setAllowsAllNetworkRequests(bool value) { m_allowAllNetworkRequests = value; }
+    bool allowsAllNetworkRequests() const { return m_allowAllNetworkRequests; }
     void setOnlineWhitelist(const Vector<KURL>& onlineWhitelist);
     const Vector<KURL>& onlineWhitelist() const { return m_onlineWhitelist; }
     bool isURLInOnlineWhitelist(const KURL&); // There is an entry in online whitelist that has the same origin as the resource's URL and that is a prefix match for the resource's URL.
@@ -96,6 +98,7 @@ private:
     ResourceMap m_resources;
     ApplicationCacheResource* m_manifest;
 
+    bool m_allowAllNetworkRequests;
     Vector<KURL> m_onlineWhitelist;
     FallbackURLVector m_fallbackURLs;
 
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 41c5cac..a3d551b 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -158,7 +158,7 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& passedManifest
             // Restart the current navigation from the top of the navigation algorithm, undoing any changes that were made
             // as part of the initial load.
             // The navigation will not result in the same resource being loaded, because "foreign" entries are never picked during navigation.
-            frame->loader()->scheduleLocationChange(documentLoader->url(), frame->loader()->referrer(), true);
+            frame->redirectScheduler()->scheduleLocationChange(documentLoader->url(), frame->loader()->referrer(), true);
         }
         
         return;
@@ -672,6 +672,7 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
     
     m_cacheBeingUpdated->setOnlineWhitelist(manifest.onlineWhitelistedURLs);
     m_cacheBeingUpdated->setFallbackURLs(manifest.fallbackURLs);
+    m_cacheBeingUpdated->setAllowsAllNetworkRequests(manifest.allowAllNetworkRequests);
     
     startLoadingEntry();
 }
@@ -852,7 +853,7 @@ void ApplicationCacheGroup::startLoadingEntry()
 
     ASSERT(!m_currentHandle);
     
-    m_currentHandle = createResourceHandle(KURL(it->first), m_newestCache ? m_newestCache->resourceForURL(it->first) : 0);
+    m_currentHandle = createResourceHandle(KURL(ParsedURLString, it->first), m_newestCache ? m_newestCache->resourceForURL(it->first) : 0);
 }
 
 void ApplicationCacheGroup::deliverDelayedMainResources()
@@ -879,7 +880,7 @@ void ApplicationCacheGroup::deliverDelayedMainResources()
 void ApplicationCacheGroup::addEntry(const String& url, unsigned type)
 {
     ASSERT(m_cacheBeingUpdated);
-    ASSERT(!KURL(url).hasFragmentIdentifier());
+    ASSERT(!KURL(ParsedURLString, url).hasFragmentIdentifier());
     
     // Don't add the URL if we already have an master resource in the cache
     // (i.e., the main resource finished loading before the manifest).
@@ -962,7 +963,7 @@ public:
     
         ASSERT(frame->loader()->documentLoader() == m_documentLoader.get());
 
-        m_documentLoader->applicationCacheHost()->notifyEventListener(m_eventID);
+        m_documentLoader->applicationCacheHost()->notifyDOMApplicationCache(m_eventID);
     }
 
 private:
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.h b/WebCore/loader/appcache/ApplicationCacheGroup.h
index 939646f..8df52cc 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.h
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.h
@@ -97,6 +97,10 @@ private:
 
     PassRefPtr<ResourceHandle> createResourceHandle(const KURL&, ApplicationCacheResource* newestCachedResource);
 
+    // For normal resource loading, WebKit client is asked about each resource individually. Since application cache does not belong to any particular document,
+    // the existing client callback cannot be used, so assume that any client that enables application cache also wants it to use credential storage.
+    virtual bool shouldUseCredentialStorage(ResourceHandle*) { return true; }
+
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
     virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
     virtual void didFinishLoading(ResourceHandle*);
diff --git a/WebCore/loader/appcache/ApplicationCacheHost.cpp b/WebCore/loader/appcache/ApplicationCacheHost.cpp
index b0c9e74..751efc1 100644
--- a/WebCore/loader/appcache/ApplicationCacheHost.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheHost.cpp
@@ -227,10 +227,13 @@ void ApplicationCacheHost::setDOMApplicationCache(DOMApplicationCache* domApplic
     m_domApplicationCache = domApplicationCache;
 }
 
-void ApplicationCacheHost::notifyEventListener(EventID id)
+void ApplicationCacheHost::notifyDOMApplicationCache(EventID id)
 {
-    if (m_domApplicationCache)
-        m_domApplicationCache->callEventListener(id);
+    if (m_domApplicationCache) {
+        ExceptionCode ec = 0;
+        m_domApplicationCache->dispatchEvent(Event::create(DOMApplicationCache::toEventType(id), false, false), ec);
+        ASSERT(!ec);    
+    }
 }
 
 void ApplicationCacheHost::setCandidateApplicationCacheGroup(ApplicationCacheGroup* group)
@@ -255,8 +258,9 @@ bool ApplicationCacheHost::shouldLoadResourceFromApplicationCache(const Resource
     if (!cache || !cache->isComplete())
         return false;
 
-    // If the resource is not a HTTP/HTTPS GET, then abort
-    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
+    // If the resource is not to be fetched using the HTTP GET mechanism or equivalent, or if its URL has a different
+    // <scheme> component than the application cache's manifest, then fetch the resource normally.
+    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request) || !equalIgnoringCase(request.url().protocol(), cache->manifestResource()->url().protocol()))
         return false;
 
     // If the resource's URL is an master entry, the manifest, an explicit entry, or a fallback entry
diff --git a/WebCore/loader/appcache/ApplicationCacheHost.h b/WebCore/loader/appcache/ApplicationCacheHost.h
index cb68862..236013d 100644
--- a/WebCore/loader/appcache/ApplicationCacheHost.h
+++ b/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -108,7 +108,7 @@ namespace WebCore {
         bool swapCache();
 
         void setDOMApplicationCache(DOMApplicationCache* domApplicationCache);
-        void notifyEventListener(EventID id);
+        void notifyDOMApplicationCache(EventID id);
 
     private:
         bool isApplicationCacheEnabled();
diff --git a/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 5a2b642..d6ee723 100644
--- a/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -216,7 +216,7 @@ ApplicationCacheGroup* ApplicationCacheStorage::cacheGroupForURL(const KURL& url
     
     int result;
     while ((result = statement.step()) == SQLResultRow) {
-        KURL manifestURL = KURL(statement.getColumnText(1));
+        KURL manifestURL = KURL(ParsedURLString, statement.getColumnText(1));
 
         if (m_cachesInMemory.contains(manifestURL))
             continue;
@@ -284,7 +284,7 @@ ApplicationCacheGroup* ApplicationCacheStorage::fallbackCacheGroupForURL(const K
     
     int result;
     while ((result = statement.step()) == SQLResultRow) {
-        KURL manifestURL = KURL(statement.getColumnText(1));
+        KURL manifestURL = KURL(ParsedURLString, statement.getColumnText(1));
 
         if (m_cachesInMemory.contains(manifestURL))
             continue;
@@ -427,7 +427,7 @@ bool ApplicationCacheStorage::executeSQLCommand(const String& sql)
     return result;
 }
 
-static const int schemaVersion = 4;
+static const int schemaVersion = 5;
     
 void ApplicationCacheStorage::verifySchemaVersion()
 {
@@ -479,6 +479,7 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
                       "manifestHostHash INTEGER NOT NULL ON CONFLICT FAIL, manifestURL TEXT UNIQUE ON CONFLICT FAIL, newestCache INTEGER)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS Caches (id INTEGER PRIMARY KEY AUTOINCREMENT, cacheGroup INTEGER, size INTEGER)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheWhitelistURLs (url TEXT NOT NULL ON CONFLICT FAIL, cache INTEGER NOT NULL ON CONFLICT FAIL)");
+    executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheAllowsAllNetworkRequests (wildcard INTEGER NOT NULL ON CONFLICT FAIL, cache INTEGER NOT NULL ON CONFLICT FAIL)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS FallbackURLs (namespace TEXT NOT NULL ON CONFLICT FAIL, fallbackURL TEXT NOT NULL ON CONFLICT FAIL, "
                       "cache INTEGER NOT NULL ON CONFLICT FAIL)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheEntries (cache INTEGER NOT NULL ON CONFLICT FAIL, type INTEGER, resource INTEGER NOT NULL)");
@@ -491,6 +492,7 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
                       " FOR EACH ROW BEGIN"
                       "  DELETE FROM CacheEntries WHERE cache = OLD.id;"
                       "  DELETE FROM CacheWhitelistURLs WHERE cache = OLD.id;"
+                      "  DELETE FROM CacheAllowsAllNetworkRequests WHERE cache = OLD.id;"
                       "  DELETE FROM FallbackURLs WHERE cache = OLD.id;"
                       " END");
 
@@ -584,6 +586,18 @@ bool ApplicationCacheStorage::store(ApplicationCache* cache, ResourceStorageIDJo
                 return false;
         }
     }
+
+    // Store online whitelist wildcard flag.
+    {
+        SQLiteStatement statement(m_database, "INSERT INTO CacheAllowsAllNetworkRequests (wildcard, cache) VALUES (?, ?)");
+        statement.prepare();
+
+        statement.bindInt64(1, cache->allowsAllNetworkRequests());
+        statement.bindInt64(2, cacheStorageID);
+
+        if (!executeStatement(statement))
+            return false;
+    }
     
     // Store fallback URLs.
     const FallbackURLVector& fallbackURLs = cache->fallbackURLs();
@@ -821,7 +835,7 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     
     int result;
     while ((result = cacheStatement.step()) == SQLResultRow) {
-        KURL url(cacheStatement.getColumnText(0));
+        KURL url(ParsedURLString, cacheStatement.getColumnText(0));
         
         unsigned type = static_cast<unsigned>(cacheStatement.getColumnInt64(1));
 
@@ -857,13 +871,28 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     
     Vector<KURL> whitelist;
     while ((result = whitelistStatement.step()) == SQLResultRow) 
-        whitelist.append(whitelistStatement.getColumnText(0));
+        whitelist.append(KURL(ParsedURLString, whitelistStatement.getColumnText(0)));
 
     if (result != SQLResultDone)
         LOG_ERROR("Could not load cache online whitelist, error \"%s\"", m_database.lastErrorMsg());
 
     cache->setOnlineWhitelist(whitelist);
 
+    // Load online whitelist wildcard flag.
+    SQLiteStatement whitelistWildcardStatement(m_database, "SELECT wildcard FROM CacheAllowsAllNetworkRequests WHERE cache=?");
+    if (whitelistWildcardStatement.prepare() != SQLResultOk)
+        return 0;
+    whitelistWildcardStatement.bindInt64(1, storageID);
+    
+    result = whitelistWildcardStatement.step();
+    if (result != SQLResultRow)
+        LOG_ERROR("Could not load cache online whitelist wildcard flag, error \"%s\"", m_database.lastErrorMsg());
+
+    cache->setAllowsAllNetworkRequests(whitelistWildcardStatement.getColumnInt64(0));
+
+    if (whitelistWildcardStatement.step() != SQLResultDone)
+        LOG_ERROR("Too many rows for online whitelist wildcard flag");
+
     // Load fallback URLs.
     SQLiteStatement fallbackStatement(m_database, "SELECT namespace, fallbackURL FROM FallbackURLs WHERE cache=?");
     if (fallbackStatement.prepare() != SQLResultOk)
@@ -872,7 +901,7 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     
     FallbackURLVector fallbackURLs;
     while ((result = fallbackStatement.step()) == SQLResultRow) 
-        fallbackURLs.append(make_pair(fallbackStatement.getColumnText(0), fallbackStatement.getColumnText(1)));
+        fallbackURLs.append(make_pair(KURL(ParsedURLString, fallbackStatement.getColumnText(0)), KURL(ParsedURLString, fallbackStatement.getColumnText(1))));
 
     if (result != SQLResultDone)
         LOG_ERROR("Could not load fallback URLs, error \"%s\"", m_database.lastErrorMsg());
@@ -987,7 +1016,7 @@ bool ApplicationCacheStorage::manifestURLs(Vector<KURL>* urls)
         return false;
 
     while (selectURLs.step() == SQLResultRow)
-        urls->append(selectURLs.getColumnText(0));
+        urls->append(KURL(ParsedURLString, selectURLs.getColumnText(0)));
 
     return true;
 }
diff --git a/WebCore/loader/appcache/DOMApplicationCache.cpp b/WebCore/loader/appcache/DOMApplicationCache.cpp
index ab5802f..1496b8a 100644
--- a/WebCore/loader/appcache/DOMApplicationCache.cpp
+++ b/WebCore/loader/appcache/DOMApplicationCache.cpp
@@ -42,8 +42,10 @@ namespace WebCore {
 DOMApplicationCache::DOMApplicationCache(Frame* frame)
     : m_frame(frame)
 {
-    ASSERT(applicationCacheHost());
-    applicationCacheHost()->setDOMApplicationCache(this);
+    ASSERT(!m_frame || applicationCacheHost());
+    ApplicationCacheHost* cacheHost = applicationCacheHost();
+    if (cacheHost)
+        cacheHost->setDOMApplicationCache(this);
 }
 
 void DOMApplicationCache::disconnectFrame()
@@ -76,90 +78,17 @@ void DOMApplicationCache::update(ExceptionCode& ec)
         ec = INVALID_STATE_ERR;
 }
 
-bool DOMApplicationCache::swapCache()
-{
-    ApplicationCacheHost* cacheHost = applicationCacheHost();
-    if (!cacheHost)
-        return false;
-    return cacheHost->swapCache();
-}
-    
 void DOMApplicationCache::swapCache(ExceptionCode& ec)
 {
-    if (!swapCache())
+    ApplicationCacheHost* cacheHost = applicationCacheHost();
+    if (!cacheHost || !cacheHost->swapCache())
         ec = INVALID_STATE_ERR;
 }
 
 ScriptExecutionContext* DOMApplicationCache::scriptExecutionContext() const
 {
-    return m_frame->document();
-}
-
-void DOMApplicationCache::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
-                return;
-        }
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }    
-}
-
-void DOMApplicationCache::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-    
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
-}
-
-bool DOMApplicationCache::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
-{
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    ListenerVector listenersCopy = m_eventListeners.get(event->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(event.get(), false);
-    }
-    
-    return !event->defaultPrevented();
-}
-
-void DOMApplicationCache::callListener(const AtomicString& eventType, EventListener* listener)
-{
     ASSERT(m_frame);
-    
-    RefPtr<Event> event = Event::create(eventType, false, false);
-    if (listener) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listener->handleEvent(event.get(), false);
-    }
-    
-    ExceptionCode ec = 0;
-    dispatchEvent(event.release(), ec);
-    ASSERT(!ec);    
+    return m_frame->document();
 }
 
 const AtomicString& DOMApplicationCache::toEventType(ApplicationCacheHost::EventID id)
@@ -186,29 +115,19 @@ const AtomicString& DOMApplicationCache::toEventType(ApplicationCacheHost::Event
     return eventNames().errorEvent;
 }
 
-ApplicationCacheHost::EventID DOMApplicationCache::toEventID(const AtomicString& eventType)
+EventTargetData* DOMApplicationCache::eventTargetData()
 {
-    if (eventType == eventNames().checkingEvent)
-        return ApplicationCacheHost::CHECKING_EVENT;
-    if (eventType == eventNames().errorEvent)
-        return ApplicationCacheHost::ERROR_EVENT;
-    if (eventType == eventNames().noupdateEvent)
-        return ApplicationCacheHost::NOUPDATE_EVENT;
-    if (eventType == eventNames().downloadingEvent)
-        return ApplicationCacheHost::DOWNLOADING_EVENT;
-    if (eventType == eventNames().progressEvent)
-        return ApplicationCacheHost::PROGRESS_EVENT;
-    if (eventType == eventNames().updatereadyEvent)
-        return ApplicationCacheHost::UPDATEREADY_EVENT;
-    if (eventType == eventNames().cachedEvent)
-        return ApplicationCacheHost::CACHED_EVENT;
-    if (eventType == eventNames().obsoleteEvent)
-        return ApplicationCacheHost::OBSOLETE_EVENT;
-  
-    ASSERT_NOT_REACHED();
-    return ApplicationCacheHost::ERROR_EVENT;
+    return &m_eventTargetData;
+}
+
+<<<<<<< HEAD:WebCore/loader/appcache/DOMApplicationCache.cpp
+=======
+EventTargetData* DOMApplicationCache::ensureEventTargetData()
+{
+    return &m_eventTargetData;
 }
 
+>>>>>>> webkit.org at 49305:WebCore/loader/appcache/DOMApplicationCache.cpp
 } // namespace WebCore
 
 #endif // ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/WebCore/loader/appcache/DOMApplicationCache.h b/WebCore/loader/appcache/DOMApplicationCache.h
index 276f50e..077cae0 100644
--- a/WebCore/loader/appcache/DOMApplicationCache.h
+++ b/WebCore/loader/appcache/DOMApplicationCache.h
@@ -30,8 +30,9 @@
 
 #include "ApplicationCacheHost.h"
 #include "AtomicStringHash.h"
-#include "EventTarget.h"
 #include "EventListener.h"
+#include "EventNames.h"
+#include "EventTarget.h"
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -55,73 +56,39 @@ public:
     void update(ExceptionCode&);
     void swapCache(ExceptionCode&);
 
-    // Event listener attributes by EventID
-
-    void setAttributeEventListener(ApplicationCacheHost::EventID id, PassRefPtr<EventListener> eventListener) { m_attributeEventListeners[id] = eventListener; }
-    EventListener* getAttributeEventListener(ApplicationCacheHost::EventID id) const { return m_attributeEventListeners[id].get(); }
-    void clearAttributeEventListener(ApplicationCacheHost::EventID id) { m_attributeEventListeners[id] = 0; }
-    void callEventListener(ApplicationCacheHost::EventID id) { callListener(toEventType(id), getAttributeEventListener(id)); }
-
     // EventTarget impl
 
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-    typedef Vector<RefPtr<EventListener> > ListenerVector;
-    typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-    EventListenersMap& eventListeners() { return m_eventListeners; }
-
     using RefCounted<DOMApplicationCache>::ref;
     using RefCounted<DOMApplicationCache>::deref;
 
     // Explicitly named attribute event listener helpers
 
-    void setOnchecking(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::CHECKING_EVENT, listener); }
-    EventListener* onchecking() const { return getAttributeEventListener(ApplicationCacheHost::CHECKING_EVENT); }
-
-    void setOnerror(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::ERROR_EVENT, listener);}
-    EventListener* onerror() const { return getAttributeEventListener(ApplicationCacheHost::ERROR_EVENT); }
-
-    void setOnnoupdate(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::NOUPDATE_EVENT, listener); }
-    EventListener* onnoupdate() const { return getAttributeEventListener(ApplicationCacheHost::NOUPDATE_EVENT); }
-
-    void setOndownloading(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::DOWNLOADING_EVENT, listener); }
-    EventListener* ondownloading() const { return getAttributeEventListener(ApplicationCacheHost::DOWNLOADING_EVENT); }
-
-    void setOnprogress(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::PROGRESS_EVENT, listener); }
-    EventListener* onprogress() const { return getAttributeEventListener(ApplicationCacheHost::PROGRESS_EVENT); }
-
-    void setOnupdateready(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::UPDATEREADY_EVENT, listener); }
-    EventListener* onupdateready() const { return getAttributeEventListener(ApplicationCacheHost::UPDATEREADY_EVENT); }
-
-    void setOncached(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::CACHED_EVENT, listener); }
-    EventListener* oncached() const { return getAttributeEventListener(ApplicationCacheHost::CACHED_EVENT); }
-
-    void setOnobsolete(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::OBSOLETE_EVENT, listener); }
-    EventListener* onobsolete() const { return getAttributeEventListener(ApplicationCacheHost::OBSOLETE_EVENT); }
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(checking);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(noupdate);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(downloading);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(updateready);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(cached);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(obsolete);
 
     virtual ScriptExecutionContext* scriptExecutionContext() const;
     DOMApplicationCache* toDOMApplicationCache() { return this; }
 
     static const AtomicString& toEventType(ApplicationCacheHost::EventID id);
-    static ApplicationCacheHost::EventID toEventID(const AtomicString& eventType);
 
 private:
     DOMApplicationCache(Frame*);
 
-    void callListener(const AtomicString& eventType, EventListener*);
-    
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
 
     ApplicationCacheHost* applicationCacheHost() const;
-    bool swapCache();
-    
-    RefPtr<EventListener> m_attributeEventListeners[ApplicationCacheHost::OBSOLETE_EVENT + 1];
-
-    EventListenersMap m_eventListeners;
 
     Frame* m_frame;
+    EventTargetData m_eventTargetData;
 };
 
 } // namespace WebCore
diff --git a/WebCore/loader/appcache/DOMApplicationCache.idl b/WebCore/loader/appcache/DOMApplicationCache.idl
index ebc1d19..dd5468a 100644
--- a/WebCore/loader/appcache/DOMApplicationCache.idl
+++ b/WebCore/loader/appcache/DOMApplicationCache.idl
@@ -27,7 +27,7 @@ module offline {
  
     interface [
         Conditional=OFFLINE_WEB_APPLICATIONS,
-        CustomMarkFunction
+        EventTarget
     ] DOMApplicationCache {
         // update status
         const unsigned short UNCACHED = 0;
diff --git a/WebCore/loader/appcache/ManifestParser.cpp b/WebCore/loader/appcache/ManifestParser.cpp
index a2df825..b001bff 100644
--- a/WebCore/loader/appcache/ManifestParser.cpp
+++ b/WebCore/loader/appcache/ManifestParser.cpp
@@ -43,7 +43,8 @@ bool parseManifest(const KURL& manifestURL, const char* data, int length, Manife
     ASSERT(manifest.explicitURLs.isEmpty());
     ASSERT(manifest.onlineWhitelistedURLs.isEmpty());
     ASSERT(manifest.fallbackURLs.isEmpty());
-    
+    manifest.allowAllNetworkRequests = false;
+
     Mode mode = Explicit;
 
     RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create("text/cache-manifest", "UTF-8");
@@ -109,6 +110,12 @@ bool parseManifest(const KURL& manifestURL, const char* data, int length, Manife
             while (p < lineEnd && *p != '\t' && *p != ' ') 
                 p++;
 
+            if (mode == OnlineWhitelist && p - line.characters() == 1 && *line.characters() == '*') {
+                // Wildcard was found.
+                manifest.allowAllNetworkRequests = true;
+                continue;
+            }
+
             KURL url(manifestURL, String(line.characters(), p - line.characters()));
             
             if (!url.isValid())
diff --git a/WebCore/loader/appcache/ManifestParser.h b/WebCore/loader/appcache/ManifestParser.h
index c03cf27..f0369ee 100644
--- a/WebCore/loader/appcache/ManifestParser.h
+++ b/WebCore/loader/appcache/ManifestParser.h
@@ -38,6 +38,7 @@ namespace WebCore {
         Vector<KURL> onlineWhitelistedURLs;
         HashSet<String> explicitURLs;
         FallbackURLVector fallbackURLs;
+        bool allowAllNetworkRequests; // Wildcard found in NETWORK section.
     };
 
     bool parseManifest(const KURL& manifestURL, const char* data, int length, Manifest&);
diff --git a/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/WebCore/loader/archive/cf/LegacyWebArchive.cpp
index d1269cc..3141e98 100644
--- a/WebCore/loader/archive/cf/LegacyWebArchive.cpp
+++ b/WebCore/loader/archive/cf/LegacyWebArchive.cpp
@@ -233,7 +233,7 @@ PassRefPtr<ArchiveResource> LegacyWebArchive::createResource(CFDictionaryRef dic
         response = createResourceResponseFromPropertyListData(resourceResponseData, resourceResponseVersion);
     }
     
-    return ArchiveResource::create(SharedBuffer::create(CFDataGetBytePtr(resourceData), CFDataGetLength(resourceData)), KURL(url), mimeType, textEncoding, frameName, response);
+    return ArchiveResource::create(SharedBuffer::create(CFDataGetBytePtr(resourceData), CFDataGetLength(resourceData)), KURL(ParsedURLString, url), mimeType, textEncoding, frameName, response);
 }
 
 PassRefPtr<LegacyWebArchive> LegacyWebArchive::create()
@@ -489,7 +489,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
     // it's possible to have a response without a URL here
     // <rdar://problem/5454935>
     if (responseURL.isNull())
-        responseURL = KURL("");
+        responseURL = KURL(ParsedURLString, "");
         
     PassRefPtr<ArchiveResource> mainResource = ArchiveResource::create(utf8Buffer(markupString), responseURL, response.mimeType(), "UTF-8", frame->tree()->name());
 
@@ -548,7 +548,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
         const String& iconURL = iconDatabase()->iconURLForPageURL(responseURL);
         if (!iconURL.isEmpty() && iconDatabase()->iconDataKnownForIconURL(iconURL)) {
             if (Image* iconImage = iconDatabase()->iconForPageURL(responseURL, IntSize(16, 16))) {
-                if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(iconURL), "image/x-icon", "", ""))
+                if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(ParsedURLString, iconURL), "image/x-icon", "", ""))
                     subresources.append(resource.release());
             }
         }
diff --git a/WebCore/loader/icon/IconDatabase.cpp b/WebCore/loader/icon/IconDatabase.cpp
index c0af78f..8982cda 100644
--- a/WebCore/loader/icon/IconDatabase.cpp
+++ b/WebCore/loader/icon/IconDatabase.cpp
@@ -137,7 +137,7 @@ bool IconDatabase::open(const String& databasePath)
         return false;
     }
 
-    m_databaseDirectory = databasePath.copy();
+    m_databaseDirectory = databasePath.crossThreadString();
 
     // Formulate the full path for the database file
     m_completeDatabasePath = pathByAppendingComponent(m_databaseDirectory, defaultDatabaseFilename());
@@ -241,7 +241,7 @@ Image* IconDatabase::iconForPageURL(const String& pageURLOriginal, const IntSize
     
     PageURLRecord* pageRecord = m_pageURLToRecordMap.get(pageURLOriginal);
     if (!pageRecord) {
-        pageURLCopy = pageURLOriginal.copy();
+        pageURLCopy = pageURLOriginal.crossThreadString();
         pageRecord = getOrCreatePageURLRecord(pageURLCopy);
     }
     
@@ -277,7 +277,7 @@ Image* IconDatabase::iconForPageURL(const String& pageURLOriginal, const IntSize
     // mark it to be read by the background thread
     if (iconRecord->imageDataStatus() == ImageDataStatusUnknown) {
         if (pageURLCopy.isNull())
-            pageURLCopy = pageURLOriginal.copy();
+            pageURLCopy = pageURLOriginal.crossThreadString();
     
         MutexLocker locker(m_pendingReadingLock);
         m_pageURLsInterestedInIcons.add(pageURLCopy);
@@ -326,7 +326,7 @@ String IconDatabase::iconURLForPageURL(const String& pageURLOriginal)
     
     PageURLRecord* pageRecord = m_pageURLToRecordMap.get(pageURLOriginal);
     if (!pageRecord)
-        pageRecord = getOrCreatePageURLRecord(pageURLOriginal.copy());
+        pageRecord = getOrCreatePageURLRecord(pageURLOriginal.crossThreadString());
     
     // If pageRecord is NULL, one of two things is true -
     // 1 - The initial url import is incomplete and this pageURL has already been marked to be notified once it is complete if an iconURL exists
@@ -335,7 +335,7 @@ String IconDatabase::iconURLForPageURL(const String& pageURLOriginal)
         return String();
     
     // Possible the pageRecord is around because it's a retained pageURL with no iconURL, so we have to check
-    return pageRecord->iconRecord() ? pageRecord->iconRecord()->iconURL().copy() : String();
+    return pageRecord->iconRecord() ? pageRecord->iconRecord()->iconURL().threadsafeCopy() : String();
 }
 
 #ifdef CAN_THEME_URL_ICON
@@ -419,7 +419,7 @@ void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
     String pageURL;
     
     if (!record) {
-        pageURL = pageURLOriginal.copy();
+        pageURL = pageURLOriginal.crossThreadString();
 
         record = new PageURLRecord(pageURL);
         m_pageURLToRecordMap.set(pageURL, record);
@@ -427,7 +427,7 @@ void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
     
     if (!record->retain()) {
         if (pageURL.isNull())
-            pageURL = pageURLOriginal.copy();
+            pageURL = pageURLOriginal.crossThreadString();
 
         // This page just had its retain count bumped from 0 to 1 - Record that fact
         m_retainedPageURLs.add(pageURL);
@@ -502,7 +502,7 @@ void IconDatabase::releaseIconForPageURL(const String& pageURLOriginal)
     // Mark stuff for deletion from the database only if we're not in private browsing
     if (!m_privateBrowsingEnabled) {
         MutexLocker locker(m_pendingSyncLock);
-        m_pageURLsPendingSync.set(pageURLOriginal.copy(), pageRecord->snapshot(true));
+        m_pageURLsPendingSync.set(pageURLOriginal.crossThreadString(), pageRecord->snapshot(true));
     
         // If this page is the last page to refer to a particular IconRecord, that IconRecord needs to
         // be marked for deletion
@@ -526,7 +526,7 @@ void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> dataOriginal,
         return;
     
     RefPtr<SharedBuffer> data = dataOriginal ? dataOriginal->copy() : 0;
-    String iconURL = iconURLOriginal.copy();
+    String iconURL = iconURLOriginal.crossThreadString();
     
     Vector<String> pageURLs;
     {
@@ -603,8 +603,8 @@ void IconDatabase::setIconURLForPageURL(const String& iconURLOriginal, const Str
         if (pageRecord && pageRecord->iconRecord() && pageRecord->iconRecord()->iconURL() == iconURLOriginal)
             return;
             
-        pageURL = pageURLOriginal.copy();
-        iconURL = iconURLOriginal.copy();
+        pageURL = pageURLOriginal.crossThreadString();
+        iconURL = iconURLOriginal.crossThreadString();
 
         if (!pageRecord) {
             pageRecord = new PageURLRecord(pageURL);
@@ -861,13 +861,13 @@ bool IconDatabase::isOpen() const
 String IconDatabase::databasePath() const
 {
     MutexLocker locker(m_syncLock);
-    return m_completeDatabasePath.copy();
+    return m_completeDatabasePath.threadsafeCopy();
 }
 
 String IconDatabase::defaultDatabaseFilename()
 {
     DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("WebpageIcons.db"));
-    return defaultDatabaseFilename.copy();
+    return defaultDatabaseFilename.threadsafeCopy();
 }
 
 // Unlike getOrCreatePageURLRecord(), getOrCreateIconRecord() does not mark the icon as "interested in import"
diff --git a/WebCore/loader/icon/IconDatabaseNone.cpp b/WebCore/loader/icon/IconDatabaseNone.cpp
index 03a7964..7b7cc9f 100644
--- a/WebCore/loader/icon/IconDatabaseNone.cpp
+++ b/WebCore/loader/icon/IconDatabaseNone.cpp
@@ -53,7 +53,7 @@ const int updateTimerDelay = 5;
 String IconDatabase::defaultDatabaseFilename()
 {
     DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("Icons.db"));
-    return defaultDatabaseFilename.copy();
+    return defaultDatabaseFilename.threadsafeCopy();
 }
 
 IconDatabase* iconDatabase()
diff --git a/WebCore/loader/loader.cpp b/WebCore/loader/loader.cpp
index 65d15a5..eb606d8 100644
--- a/WebCore/loader/loader.cpp
+++ b/WebCore/loader/loader.cpp
@@ -102,7 +102,7 @@ void Loader::load(DocLoader* docLoader, CachedResource* resource, bool increment
     Request* request = new Request(docLoader, resource, incremental, skipCanLoadCheck, sendResourceLoadCallbacks);
 
     RefPtr<Host> host;
-    KURL url(resource->url());
+    KURL url(ParsedURLString, resource->url());
     if (url.protocolInHTTPFamily()) {
         AtomicString hostName = url.host();
         host = m_hosts.get(hostName.impl());
@@ -355,7 +355,7 @@ void Loader::Host::didFinishLoading(SubresourceLoader* loader)
     DocLoader* docLoader = request->docLoader();
     // Prevent the document from being destroyed before we are done with
     // the docLoader that it will delete when the document gets deleted.
-    DocPtr<Document> protector(docLoader->doc());
+    RefPtr<Document> protector(docLoader->doc());
     if (!request->isMultipart())
         docLoader->decrementRequestCount();
 
@@ -403,7 +403,7 @@ void Loader::Host::didFail(SubresourceLoader* loader, bool cancelled)
     DocLoader* docLoader = request->docLoader();
     // Prevent the document from being destroyed before we are done with
     // the docLoader that it will delete when the document gets deleted.
-    DocPtr<Document> protector(docLoader->doc());
+    RefPtr<Document> protector(docLoader->doc());
     if (!request->isMultipart())
         docLoader->decrementRequestCount();
 
diff --git a/WebCore/make-generated-sources.sh b/WebCore/make-generated-sources.sh
index 88173d5..96b2112 100755
--- a/WebCore/make-generated-sources.sh
+++ b/WebCore/make-generated-sources.sh
@@ -2,7 +2,6 @@
 export SOURCE_ROOT=$PWD
 export SRCROOT=$PWD
 export WebCore=$PWD
-export CREATE_HASH_TABLE="$SRCROOT/../JavaScriptCore/create_hash_table"
 
 mkdir -p DerivedSources/WebCore &&
 make -C DerivedSources/WebCore -f ../../DerivedSources.make $@
diff --git a/WebCore/manual-tests/audio-volume.html b/WebCore/manual-tests/audio-volume.html
new file mode 100644
index 0000000..f7e698c
--- /dev/null
+++ b/WebCore/manual-tests/audio-volume.html
@@ -0,0 +1,28 @@
+<html>
+    <script>
+        function load()
+        {
+            var url="http://movies.apple.com/movies/us/apple/ipoditunes/2007/touch/ads/apple_ipodtouch_touch_r640-9cie.mov";
+            var vid = document.getElementById('vid')
+            vid.src = url;
+            vid.volume = 0.05;
+            vid.load();
+        }
+        function setVolume(vol)
+        {
+            var vid = document.getElementById('vid')
+            vid.volume = vol;
+        }
+    </script>
+            
+    <body>
+
+        <video id=vid controls autoplay>
+        </video>
+        <p>TEST: Audio volume should be 0.05 when the movie begins playing.</p>
+        <input type="button" value="Load movie" onclick="load()">
+        <br>
+        <input type="button" value="volume=1.0" onclick="setVolume(1.0)">
+        <input type="button" value="volume=0.05" onclick="setVolume(0.05)">
+    </body>
+</html?
diff --git a/WebCore/manual-tests/autofill-popup-width-and-item-direction.html b/WebCore/manual-tests/autofill-popup-width-and-item-direction.html
new file mode 100644
index 0000000..fa0a80a
--- /dev/null
+++ b/WebCore/manual-tests/autofill-popup-width-and-item-direction.html
@@ -0,0 +1,37 @@
+<html>
+<head>
+<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-8">
+<title>
+Test the popup list box's width and its items' display directionality
+</title>
+</head>
+<body>
+<p>
+Autofill popup list box should have the same width as its input field's width.
+If the submitted input text is longer, it will be truncated to fit in the 
+input field's width
+<p> Try type some long text in the "Last name" input box,
+   Say "abcd abcd abcd abcd abcd abcd".
+then click "Submit". Open the file again, and type the first letter "a",
+the form autofill pop-up should show up now with the width the same as
+the width of the input field, and the text "abcd abcd abcd abcd abcd abcd" got
+truncated to fit in.
+<p> Try type the following text into the "First name" and "Last name".
+<ul>
+<li>abcd efg
+<li>שששששש ננננננ בבבבבבבבב
+<li>abc אאא defghijklmnopq
+<li>אאאאאאאאאא  abcdefghijklmn בבבבבבב
+<li>hi!
+<li>אא!
+</ul>
+They should be displayed as RTL in the popup of "First name", 
+and should be displayed as LTR in the popup of the "Last name".
+<br>
+<form action="form_action.asp" method="get">
+  First name: <input type="text" name="fname" dir="rtl"/><br />
+  Last name: <input type="text" name="lname" /><br />
+  <input type="submit" value="Submit" />
+</form>
+</body>
+</html>
diff --git a/WebCore/manual-tests/autofill_alignment.html b/WebCore/manual-tests/autofill_alignment.html
new file mode 100644
index 0000000..4863e41
--- /dev/null
+++ b/WebCore/manual-tests/autofill_alignment.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-8">
+<title>
+Test auto-fill drop-down items' alignment
+</title>
+</head>
+<body>
+<p>
+Autofill drop-down item's alignment should be the same as the input field.
+It should align left if the input field's direction is ltr. It should 
+align right if the input field's direction is rtl.
+<p> Try type some text in the "First name" and "Last name" input box,
+then click "Submit". Open the file again, double click the "First name"
+field, the drop-down box should be opened with the items aligned right.
+Double click the "Last name" field, the drop-down box should be opened
+with the items aligned left.
+<br>
+<form action="form_action.asp" method="get">
+  First name: <input type="text" name="fname" dir="rtl"/><br />
+  Last name: <input type="text" name="lname" /><br />
+  <input type="submit" value="Submit" />
+</form>
+</body>
+</html>
diff --git a/WebCore/manual-tests/drag-cursor-notallowed.html b/WebCore/manual-tests/drag-cursor-notallowed.html
new file mode 100644
index 0000000..e6cb6d4
--- /dev/null
+++ b/WebCore/manual-tests/drag-cursor-notallowed.html
@@ -0,0 +1,111 @@
+<html>
+<head>
+<style>
+#dropTarget, #dragMe { text-align: center; display: table-cell; vertical-align: middle }
+#dropTarget {width: 256px; height: 256px; border: 1px dashed}
+#dragMe {-webkit-user-drag: element; -webkit-user-select: none; background: #ff0000; width: 64px; height: 64px; color: white}
+.pass { font-weight: bold; color: green; }
+.fail { font-weight: bold; color: red; }
+</style>
+<script>
+    var dragMe;
+    var dropTarget;
+    var messageElm;
+    var defaultMessageElm;
+    var event;
+    
+    var ALLOWED_EFFECTS = 'move';
+    var DROP_EFFECT = 'copy';
+    
+    window.onload = function()
+    {
+        dragMe = document.getElementById("dragMe");
+        dropTarget = document.getElementById("dropTarget");
+        messageElm = document.getElementById("message");
+        defaultMessageElm = document.getElementById("default-message");
+        
+        if (!dragMe || !dropTarget || !messageElm || !defaultMessageElm)
+            return;
+        
+        dragMe.ondragstart = dragStart;
+        dragMe.ondragend = dragEnd;
+        
+        dropTarget.ondragenter = dragEntered;
+        dropTarget.ondragover = dragOver;
+        dropTarget.ondrop = drop;
+    }
+    
+    function dragStart(e)
+    {
+        event = e;
+        e.dataTransfer.effectAllowed = ALLOWED_EFFECTS;
+        e.dataTransfer.setData('Text', e.target.textContent);
+    }
+    
+    function dragEnd(e)
+    {
+        messageElm.style.visibility = "hidden";
+        defaultMessageElm.style.visibility = "visible";
+        return;
+    }
+    
+    function dragEntered(e)
+    {
+        messageElm.style.visibility = "visible";
+        defaultMessageElm.style.visibility = "hidden";
+        dragEnteredAndUpdated(e);
+    }
+    
+    function dragOver(e)
+    {
+        dragEnteredAndUpdated(e);
+    }
+    
+    function dragEnteredAndUpdated(e)
+    {
+        event = e;
+        e.dataTransfer.dropEffect = DROP_EFFECT;
+        cancelDrag(e);
+    }
+    
+    function drop(e)
+    {
+        cancelDrag(e);
+    }
+    
+    function cancelDrag(e)
+    {
+        if (e.preventDefault)
+            e.preventDefault();
+        else {
+            // Assume this script is executing within Internet Explorer
+            e.returnValue = false;
+        }
+    }
+</script>
+</head>
+<body>
+    <p id="description">This test can be used to verify that the not-allowed cursor is shown during an invalid drag-and-drop operation. 
+        In particular, if the effectAllowed is <code><script>document.write(ALLOWED_EFFECTS)</script></code> and the dropEffect of the 
+        drop target is <code><script>document.write(DROP_EFFECT)</script></code> then the drop is not allowed and the cursor should
+        change to the not-allowed cursor. Note, this test only pertains to the Windows build since the Mac build does not show a drop cursor
+        for a not-allowed drop operation (see bug #25925).
+        <br/><br/>
+        Drag the red square over the drop target (demarcated by the dashed boundary). While hovering over the drop target, if the cursor 
+        is <img alt="not-allowed" src="data:image/gif;base64,R0lGODlhEgASAIAAAAAAAP///yH5BAAAAAAALAAAAAASABIAAAIvjA+px6ifmnmM1ijDmlbuuHmAhoWXaTqYKq7sObZw3HwgXd8cPr8yDGxBXEJioAAAOw=="> then the test <span class="pass">PASSED</span>. Otherwise, the test <span class="fail">FAILED</span>.</p>
+    <div id="test-container">
+        <label for="effectAllowed">effectAllowed:</label> <code><script>document.write(ALLOWED_EFFECTS)</script></code>
+        <br/><br/>
+        <div id="dropTarget">
+            <div id="default-message">Drag the red square over me.<br/><br/>
+                <label for="dropEffect">Expects dropEffect:</label> <code><script>document.write(DROP_EFFECT)</script></code>
+            </div>
+            <div id="message" style="visibility:hidden">The cursor should be <img alt="not-allowed" src="data:image/gif;base64,R0lGODlhEgASAIAAAAAAAP///yH5BAAAAAAALAAAAAASABIAAAIvjA+px6ifmnmM1ijDmlbuuHmAhoWXaTqYKq7sObZw3HwgXd8cPr8yDGxBXEJioAAAOw==">. Is it?</div>
+        </div>
+        <hr/>
+        <p>Items that can be dragged to the drop target:</p>
+        <div id="dragMe" draggable="true">Square</div>
+        <hr/>
+    </div>
+</body>
+</html>
diff --git a/WebCore/manual-tests/go-back-after-alert.html b/WebCore/manual-tests/go-back-after-alert.html
new file mode 100644
index 0000000..b3a1e1a
--- /dev/null
+++ b/WebCore/manual-tests/go-back-after-alert.html
@@ -0,0 +1,7 @@
+<html>
+<body>
+This tests a bug where going back just before putting up an alert can lead to a crash.
+<hr>
+<a href="resources/alert-and-go-back.html">Click this link to run the test.</a>
+</body>
+</html>
diff --git a/WebCore/manual-tests/gtk/caret-browsing.html b/WebCore/manual-tests/gtk/caret-browsing.html
new file mode 100644
index 0000000..182b043
--- /dev/null
+++ b/WebCore/manual-tests/gtk/caret-browsing.html
@@ -0,0 +1,7 @@
+<html>
+<body>
+<p>Manual test for Caret Browsing. Resize your window until the first paragraph fills at least two lines of text . Enable caret browsing mode (usually by pressing theF7 key). Press down. Now you should be on the second line of the first paragraph. Press up. Now you should be on the first line again. Now press Ctrl+Down.</p>
+<p>You should be on the first line of the second paragraph now. Press Ctrl+Down again.</p>
+<p>You should be on the first line of the third paragraph now. Press Ctrl+Up, and you should be back on the second paragraph.</p>
+</body>
+</html>
diff --git a/WebCore/manual-tests/gtk/copy-htmltext.html b/WebCore/manual-tests/gtk/copy-htmltext.html
new file mode 100644
index 0000000..0b811f6
--- /dev/null
+++ b/WebCore/manual-tests/gtk/copy-htmltext.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+    <head>
+        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+        <title>Copy HTML content</title>
+    </head>
+    <body>
+        <h1>Copy HTML content from currently editable area</h1>
+        <div title="EditableArea" contentEditable="true" 
+            style="display: block; border: 2px solid black; margin: 5px; padding: 15px;">
+            Here is a Editable Area,<br />
+            <img title="It's the test image" src="http://webkit.org/images/icon-gold.png" /><br /><br />
+            <b>STEPS TO TEST:</b><br />
+            <ol>
+                <li>Select all that text or picture in this editable area (type <b>Ctrl-A</b> / Option-A)</li>
+                <li><b>Copy</b> them use <b>Ctrl-C</b> / Option-C</li>
+                <li>Move the cursor to a blank line below</li>
+                <li>Paste them use <b>Ctrl-V</b> / Option-V</li>
+            </ol>
+            <p><b>Ensure</b> that text and image has been pasted with formats and no garbled.</p>
+            <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
+        </div>       
+    </body>
+</html>
diff --git a/WebCore/manual-tests/gtk/cursor-image.html b/WebCore/manual-tests/gtk/cursor-image.html
new file mode 100644
index 0000000..a231337
--- /dev/null
+++ b/WebCore/manual-tests/gtk/cursor-image.html
@@ -0,0 +1,4 @@
+<div>Mouse over the grey block below to change the cursor to a small cross.</div>
+<div style="width: 100px; height: 100px; background: lightblue; cursor:url(resources/cell.cur), default;">&nbsp;</div>
+<div>Mouse over the grey block below to change the cursor to three small crosses.</div>
+<div style="width: 100px; height: 100px; background: lightblue; cursor:url(resources/long_cell.cur), default;">&nbsp;</div>
diff --git a/WebCore/manual-tests/gtk/resources/cell.cur b/WebCore/manual-tests/gtk/resources/cell.cur
new file mode 100644
index 0000000..decfbdc
--- /dev/null
+++ b/WebCore/manual-tests/gtk/resources/cell.cur
diff --git a/WebCore/manual-tests/gtk/resources/long_cell.cur b/WebCore/manual-tests/gtk/resources/long_cell.cur
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/WebCore/manual-tests/gtk/resources/long_cell.cur
diff --git a/WebCore/manual-tests/input-starved-by-timers.html b/WebCore/manual-tests/input-starved-by-timers.html
new file mode 100644
index 0000000..f26cfa7
--- /dev/null
+++ b/WebCore/manual-tests/input-starved-by-timers.html
@@ -0,0 +1,51 @@
+<html>
+<head>
+<script>
+function log(m) {
+    document.getElementById("log").innerHTML += m + "<br>";
+}
+
+var multiplyFactor = 2;   // Create this many timers in every timer callback.
+var targetLatency = 10000; // Multiply timers until it takes this much to fire all their callbacks.
+var timerCount = 1;
+
+function timerCallback(creationTimestamp) {
+    --timerCount;
+
+    if (!multiplyFactor) {
+        if (timerCount == 0)
+            log("No more timers - UI should be responsive now.");
+        return;
+    }
+
+    // Create more timers. Capture the current time so when callbacks are fired,
+    // we can check how long it actually took (latency caused by a long timer queue).
+    var timestamp = new Date().getTime();
+    for (i = 0; i < multiplyFactor; ++i) {
+        setTimeout(function() { timerCallback(timestamp); }, 0);
+        ++timerCount;
+    }
+
+    // Once the timer queue gets long enough for the timer firing latency to be over the limit,
+    // stop multplying them and keep the number of timers constant.
+    if (multiplyFactor > 1 && new Date().getTime() - creationTimestamp > targetLatency)
+        multiplyFactor = 1;
+}
+
+function runTest() {
+    log("Freezing UI...");
+    setTimeout(function() { timerCallback(new Date().getTime()); }, 0);
+    setTimeout("multiplyFactor = 0; log('Finishing. Started to drain timers.');", 10000);
+}
+
+</script>
+</head>
+<body onload="runTest()">
+This test will create enough timers to freeze browser UI. After 10 seconds, it
+will start drain the timers so the UI becomes responsive again in a few seconds.
+You don't need to kill the browser.<br>If the bug is fixed, there will be no
+UI freeze. Refresh the page to repeat the experiment.<br>Try to click at this
+button (or browser's menu) while UI is frozen: <button onclick="log('clicked')">Click Me</button> <hr>
+<div id="log"></div>
+</body>
+</html>
diff --git a/WebCore/manual-tests/inspector/debugger-watch-expressions.html b/WebCore/manual-tests/inspector/debugger-watch-expressions.html
new file mode 100644
index 0000000..eb883c9
--- /dev/null
+++ b/WebCore/manual-tests/inspector/debugger-watch-expressions.html
@@ -0,0 +1,115 @@
+<p>Test for 
+<a href="https://bugs.webkit.org/show_bug.cgi?id=27514">Bug 27514 - add support for watched expression</a>.
+
+<p>To begin test, open web inspector, go the scripts panel 
+(enabling script debugging if necccessary), and then click this link:
+<a href="javascript:runTest()">[begin test]</a>.
+
+<p>Perform the following steps, and note the expected results:
+    
+<ol>
+    
+<li><p>After clicking the link above, you should now be paused in the body of 
+the test method, thanks to the <code>debugger</code> statement.
+
+<li><p>Add the following expressions to the "Watch Expressions" section of the
+Scripts panel sidebar pane: "<code>this</code>", "<code>a</code>", 
+"<code>b</code>", "<code>c</code>" and "<code>d</code>". Do <b>NOT</b> enter the quotes.
+
+<li><p>The values of the expressions as shown in the window should a 
+<code>DOMWindow</code> for <code>this</code>, <code>undefined</code> for
+the <code>a</code>, <code>b</code>, and <code>c</code> variables, and a 
+value of <code>ReferenceError: Can't find variable: d</code>
+for the <code>d</code> variable.
+
+<li><p>Note that the value for <code>d</code> should not change for the life of 
+the test, as the variable <code>d</code> is never introduced in the program.
+
+<li><p>Step through the code, and you'll see the values of <code>a</code>,
+<code>b</code>, and <code>c</code> change, as the variables are assigned.
+Also note that as the scope changes due to the function invocation, values
+will be changed to refer to their current scope.  The <code>this</code>
+expression will change when the method is invoked on the object constructed by
+the test.
+
+<li><p>Click different stack frames in the Call Stack section to ensure the
+expressions change value appropriately as the current stack frame changes.
+
+<li><p>Drive the debugger through the end of the outermost function, so that
+the debugger is no longer in paused state.  The values of 
+<code>a</code>, <code>b</code>, and <code>c</code> should all be a
+ReferenceError like <code>d</code>, since these variables are defined in the
+<code>runTest()</code> function, and the expressions are being evaluated against
+the global object.
+
+<li><p>From the console, execute the statement "<code>a = 1</code>".  The
+watch expressions do not currently refresh, so the value for <code>a</code>
+should still be ReferenceError.
+
+<li><p>Click the "Refresh" button in the Watch Expressions section and the
+value for "<code>a</code>" should now be "<code>1</code>".
+
+<li><p>Close down the browser, start it back up, traverse to a web site,
+bring up web inspector, go to the Scripts panel.  You should see the same
+set of Watch Expressions in the list as you had when you last used web
+inspector.
+
+<li><p>Delete an expression by moving the mouse into the Watch Expression
+section, and clicking the X icon which appears to the right of an 
+expression (on hover).
+
+<li><p>Delete an expression by double-clicking anywhere on a top-level line
+of a watch expression, and changing the expression to an empty string or 
+nothing but white-space.
+
+<li><p>Modify an entry by double-clicking anywhere on a top-level line
+of a watch expression, and changing the expression.
+
+<li><p>Enter a new expression, "<code>new Date()</code>".  The value should be
+a toString() version of the date.  Repeatedly press the Refresh button to see
+the value updated with the current time.
+
+</ol>
+
+<script>
+function runTest() {
+    
+    // a nested function
+    function subFunction() {
+        debugger;
+        var a = "a in subFunction()";
+        
+        subSubFunction();
+        
+        // another nested function
+        function subSubFunction() {
+            debugger;
+            var b = "b in subSubFunction()";
+        }
+    }
+    
+    // a class
+    function aClass() {
+        this.x = "xxx";
+        this.y = "yyy";
+    }
+    
+    aClass.prototype.aMethod = function() {
+        debugger;
+        var c = "c in aMethod()";
+    }
+    
+    // main logic
+    debugger;
+    
+    var a = "a in runTest()";
+    var b = "b in runTest()";
+    var c = "c in runTest()";
+    
+    subFunction();
+    
+    var object = new aClass();
+    object.aMethod();
+    
+}
+</script>
diff --git a/WebCore/manual-tests/inspector/display-form-data.html b/WebCore/manual-tests/inspector/display-form-data.html
new file mode 100644
index 0000000..48cd817
--- /dev/null
+++ b/WebCore/manual-tests/inspector/display-form-data.html
@@ -0,0 +1,249 @@
+<html>
+<head>
+<title>Tests for Bug 22920</title>
+<meta http-equiv="Content-Type" content="text/html;charset=utf-8" >
+</head>
+
+<body>
+<p>Tests for 
+<ul>    
+<li><p><a href="https://bugs.webkit.org/show_bug.cgi?id=22920">Bug 22920: Inspector Request Headers Should Show Data/Variables/Parameters Sent With Request</a>
+<li><p><a href="https://bugs.webkit.org/show_bug.cgi?id=28970">Bug 28970: content-type parameters not taken into account when building form-data</a>
+</ul>
+
+<p>To test, open the Inspector on this page, go to the Resources panel,
+and select the various resources created by this page in the left column of the
+Resources panel.  Note that for test-4 ...
+test-11, the -sync and -async versions should show the same Form Data,
+Request Payload and/or Query String Parameter values.
+
+<ul>
+
+<li><p><b>test-1</b>:
+<br>no Form Data, Request Payload or Query String Parameters
+
+<li><p><b>test-2</b>:
+<br>Query String Parameters (1): "parm1: abc"
+
+<li><p><b>test-3</b>:
+<br>Query String Parameters (2): "parm1: def" and "parm2: g h i";
+Hovering over either parm should yield a tooltip:
+<i>"Double-Click to toggle between URL encoded and decoded formats"</i>.
+Double-clicking on either parm should toggle between encoded and decoded
+versions of the string.  The decoded form is initially displayed.
+The encoded form of parm2 is "g%20h+i".
+
+<li><p><b>test-4</b>:
+<br>no Form Data, Request Payload or Query String Parameters
+
+<li><p><b>test-5</b>:
+<br>Query String Parameters (1): "parm1: abc"
+
+<li><p><b>test-6</b>:
+<br>Query String Parameters (3): "parm1: def" and "parm2: g h i" and "parm3: jj kk ll"
+
+<li><p><b>test-7</b>:
+<br>Request Payload: 3 lines of text data with a very long 2nd line which should wrap
+
+<li><p><b>test-8</b>:
+<br>Request Payload: 3 lines of text data with a very long 2nd line which should wrap
+
+<li><p><b>test-9</b>:
+<br>Request Payload: 3 lines of text data with a very long 2nd line of binary data which should wrap
+
+<li><p><b>test-10</b>:
+<br>Form Data (1): "parm1: abc"
+
+<li><p><b>test-11</b>:
+<br>Form Data (2): "parm1: def" and "parm2: g h i"
+
+<li><p><b>test-12</b>:
+<br>Query String Parameters (2): "parm1: abc" and "parm2: d e f"
+<br>Form Data (2): "parm1: ghi" and "parm2: j k l"
+
+<li><p><b>test-13</b>:
+<br>Query String Parameters (2): "parm1: &auml;bc" and "parm2: d &#x11B; f"
+<br>Form Data (2): "parm1: ghi" and "parm2: j k l"
+<p>Note that you should view the encoded values of the query string parameters
+by double-clicking on one of the parameters.  The values should be:
+<pre>
+parm1: %C3%A4bc
+parm2: d%20%C4%9B+f
+</pre>
+
+<li><p><b>test-14</b>:
+<br>Same results as for test-13, a slightly different but compatible Content-Type
+is used for the form data.
+
+<li><p><b>test-15</b>:
+<br>Query String Parameters (2): "parm1: % (unable to decode value)" and "parm2: % (unable to decode value)",
+with the parenthesized part in red.
+<br>Form Data (2): "parm1: % (unable to decode value)" and "parm2: % (unable to decode value)",
+with the parenthesized part in red.
+<p>Note that you should view the encoded values of the query string parameters
+by double-clicking on one of the parameters.  The values for all four parameters should be "%".
+
+<li><p><b>test-form</b>:
+<br>For this test, invoke the form at the bottom of the page
+by pressing the submit button.  The Resources panel should have a "test-form"
+resource, with the following data:
+<p>Form Data (2): "field1: value &auml;;b;c" and "field2:value d;&#x11B;;f"
+<p>Note that you should view the encoded values of the query string parameters
+by double-clicking on one of the parameters.  The values should be:
+<pre>
+field1: value+%C3%A4%3Bb%3Bc
+field2: value+d%3B%C4%9B%3Bf</pre>
+</ul>
+
+<p><b>test-form</b>
+<form id="form" action="http://example.org/test-form" method="post" enctype="application/x-www-form-urlencoded">
+<span style="font-size:200%">field1:</span> <input style="font-size:200%" type="text" name="field1" value="value &auml;;b;c"><br>
+<span style="font-size:200%">field2:</span> <input style="font-size:200%" type="text" name="field2" value="value d;&#x11B;;f"><br>
+<input type="submit">
+</form>
+
+<div style="display:none">
+
+<img src="http://example.org/test-1">
+<img src="http://example.org/test-2?parm1=abc">
+<img src="http://example.org/test-3?parm1=def&amp;parm2=g%20h+i">
+
+</div>
+
+<hr>
+
+<p><b>NLS sample info</b>
+
+<pre>
+<span style="font-size:300%">&auml;</span> - LATIN SMALL LETTER A WITH DIAERESIS
+Unicode: 0x00E4 == 228    
+UTF8:    C3 A4 
+HTML:    &amp;auml;
+
+<span style="font-size:300%">&#x11B;</span> - LATIN SMALL LETTER E WITH CARON
+Unicode: 0x011B == 283    
+UTF8:    C4 9B
+HTML:    &amp;#x11B;
+</pre>
+    
+<script>
+
+function getReadyState(num) {
+    switch(num) {
+        case 0: return "uninitialized";
+        case 1: return "loading";
+        case 2: return "loaded";
+        case 3: return "interactive";
+        case 4: return "complete";
+        default: return "unknown: " + num;
+    }
+}
+
+function getProcessXHR(request) {
+    return function() {
+        if (true) return;
+        var rs = getReadyState(request.readyState);
+        console.log("ready state change for " + request.url);
+        console.log("   ready state:   " + rs);
+        console.log("   response text: " + request.responseText);
+        if (request.readyState == 4) {
+            console.log("   status:        " + request.status);
+            console.log("   status text:   " + request.statusText);
+        }
+    }
+}
+
+function sendXHR(url, method, headers, body) {
+    if (!method) method = "GET";
+    if (!headers) headers = [];
+    if (!body) body="";
+
+    // copy headers
+    var headersNew = [];
+    for (var i=0; i<headers.length; i++) {
+        headersNew.push(headers[i]);
+    }
+    headers = headersNew;
+
+    if (body != "") {
+        headers.push(["Content-Length", body.length.toString()]);
+    }
+
+    // sync
+    var req = new XMLHttpRequest();
+
+    req.url = url.replace("^","-sync");
+    req.onreadystatechange = getProcessXHR(req);
+    req.open(method, req.url, false);
+
+    for (var i=0; i<headers.length; i++) {
+        req.setRequestHeader(headers[i][0], headers[i][1]);
+    }
+
+    req.send(body);
+
+    // async
+    var req = new XMLHttpRequest();
+
+    req.url = url.replace("^","-async");
+    req.onreadystatechange = getProcessXHR(req);
+    req.open(method, req.url, true);
+
+    for (var i=0; i<headers.length; i++) {
+        req.setRequestHeader(headers[i][0], headers[i][1]);
+    }
+
+    req.send(body);
+}
+
+var headersPlain = [
+    ["Content-Type", "text/plain"]
+];
+
+var headersForm = [
+    ["Content-Type", "application/x-www-form-urlencoded"]
+];
+
+var headersFormExtra1 = [
+    ["Content-Type", "application/x-www-form-urlencoded;something-else=here"]
+];
+
+var headersFormExtra2 = [
+    ["Content-Type", "application/x-www-form-urlencoded ; something-else=here"]
+];
+
+var headersBinary = [
+    ["Content-Type", "application/octet-stream"]
+];
+
+var longText = "some text with a \n";
+for (var i=0; i<40; i++) {
+    longText += "very-";
+}
+longText += "long\nline in it";
+
+var binaryData = "some text with binary data\n";
+for (var i=0; i<256; i++) {
+    binaryData += String.fromCharCode(i);
+}
+binaryData += "\nin the middle of it";
+
+
+sendXHR("http://example.org/test-4^");
+sendXHR("http://example.org/test-5^?parm1=abc");
+sendXHR("http://example.org/test-6^?parm1=def&parm2=g%20h+i&parm3=jj++kk%20%20ll");
+
+sendXHR("http://example.org/test-7^", "POST", null, longText);
+sendXHR("http://example.org/test-8^", "POST", headersPlain, longText);
+sendXHR("http://example.org/test-9^", "POST", headersBinary, binaryData);
+sendXHR("http://example.org/test-10^", "POST", headersForm, "parm1=abc");
+sendXHR("http://example.org/test-11^", "POST", headersForm, "parm1=def&parm2=g%20h+i");
+sendXHR("http://example.org/test-12^?parm1=abc&parm2=d%20e+f", "POST", headersForm, "parm1=ghi&parm2=j%20k+l");
+sendXHR("http://example.org/test-13^?parm1=%C3%A4bc&parm2=d%20%C4%9B+f", "POST", headersFormExtra1, "parm1=ghi&parm2=j%20k+l");
+sendXHR("http://example.org/test-14^?parm1=%C3%A4bc&parm2=d%20%C4%9B+f", "POST", headersFormExtra2, "parm1=ghi&parm2=j%20k+l");
+sendXHR("http://example.org/test-15^?parm1=%&parm2=%", "POST", headersForm, "parm1=%&parm2=%");
+
+</script>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/WebCore/manual-tests/inspector/webinspector-log.html b/WebCore/manual-tests/inspector/webinspector-log.html
new file mode 100644
index 0000000..cdc5663
--- /dev/null
+++ b/WebCore/manual-tests/inspector/webinspector-log.html
@@ -0,0 +1,22 @@
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=28047">Bug 28047: add utility method to enable logging messages for inspector development</a>.</p>
+
+<ul>
+<li>Open a browser, go to any web page.
+<li>Open web inspector
+<li>Open the console panel
+<li>Open a web inspector on the web inspector
+<li>Open that inspector's console panel
+<li>In that panel, run the code:
+<pre>
+   WebInspector.log("hello, world")
+</pre>
+</ul>
+
+<p>Results:
+<br>In the original inspector window, there should now be a message
+in the console with the text "hello, world".  There will be a blue
+maginifying glass icon to the left of the message.  Run the same 
+command again, and you should see the repeat count go to 2.
+The message and repeat count are blue.
+
+
diff --git a/WebCore/manual-tests/js-timers-beneath-modal-dialog.html b/WebCore/manual-tests/js-timers-beneath-modal-dialog.html
new file mode 100644
index 0000000..6d5f2c7
--- /dev/null
+++ b/WebCore/manual-tests/js-timers-beneath-modal-dialog.html
@@ -0,0 +1,19 @@
+<p>JS timers should be paused while a modal dialog (or alert) is displayed.</p>
+<p>Please disable popup blocker for this test.</p>
+<div>0</div>
+<script>
+function f()
+{
+    var d = document.getElementsByTagName("div")[0];
+    d.innerHTML = parseInt(d.innerHTML) + 1;
+}
+
+var timerId = setInterval(f, 100);
+
+alert("Numbers in main window should not increase while this alert is displayed");
+showModalDialog("data:text/html,<p>Numbers in main window should not increase while this modal dialog is displayed</p>");
+document.getElementsByTagName("div")[0].innerHTML = "DONE";
+
+clearInterval(timerId);
+
+</script>
diff --git a/WebCore/manual-tests/keyboard_select_elements_with_same_beginning.html b/WebCore/manual-tests/keyboard_select_elements_with_same_beginning.html
new file mode 100644
index 0000000..8e3c102
--- /dev/null
+++ b/WebCore/manual-tests/keyboard_select_elements_with_same_beginning.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-8">
+<title>
+Test select on elements with same beginning letter
+</title>
+</head>
+<body>
+See bug:<a href="https://bugs.webkit.org/show_bug.cgi?id=28205">28205</a>.
+<p>
+Click the drop-down to show selections (not navigate to the selection box).
+Type the first letter 'A' to go to the elements start with 'A'.
+It should select the first item starts with 'A'.
+In windows, Continue typing 'A', it should continue to select the next item starts with 'A'.
+<p>
+<select name="selOrigin"> 
+    <option value="">Select Station</option> 
+    <option value="37169_NJCL">Aberdeen Matawan</option> 
+    <option value="2_ATLC">Absecon</option> 
+    <option value="3_MNBN">Allendale</option> 
+    <option value="4_NJCL">Allenhurst</option> 
+    <option value="12_MNE">Basking Ridge</option> 
+    <option value="13_NJCL">Bay Head</option> 
+    <option value="14_BNTN">Bay Street</option> 
+    <option value="15_NJCL">Belmar</option> 
+</select>
+</body>
+</html>
diff --git a/WebCore/manual-tests/resources/alert-and-go-back.html b/WebCore/manual-tests/resources/alert-and-go-back.html
new file mode 100644
index 0000000..55a5b50
--- /dev/null
+++ b/WebCore/manual-tests/resources/alert-and-go-back.html
@@ -0,0 +1,4 @@
+<script>
+history.back();
+alert("Wait a moment and then dismiss this alert. If there is no crash, the test succeeded.");
+</script>
diff --git a/WebCore/manual-tests/select-popup-on-spacebar.html b/WebCore/manual-tests/select-popup-on-spacebar.html
index dfcee40..7503eca 100644
--- a/WebCore/manual-tests/select-popup-on-spacebar.html
+++ b/WebCore/manual-tests/select-popup-on-spacebar.html
@@ -6,8 +6,8 @@
 <body onload="document.getElementById('selectId').focus()">
 <p><b>BUG ID:<a href="https://bugs.webkit.org/show_bug.cgi?id=18363">18363</a>.</p>
 <p id="description">
-This test ensures that pressing spacebar on Mac and Gtk ports or pressing
-return in Gtk port will popup the select control when focused.
+This test ensures that pressing spacebar on Mac, Gtk and Chromium ports or pressing
+return in Gtk and Chromium ports will popup the select control when focused.
 </p>
 
 <p id="test" style="background-color:skyblue; padding:3px;"><b>STEPS TO TEST:</b> <br>
diff --git a/WebCore/manual-tests/select_alignment.html b/WebCore/manual-tests/select_alignment.html
new file mode 100644
index 0000000..7c1bc0e
--- /dev/null
+++ b/WebCore/manual-tests/select_alignment.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" >
+<head>
+<title>Test drop-down item's alignment in <select>/<option></title>
+<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-8">
+</head>
+<body>
+<p>
+select drop-down items' alignment should be determined by the directionality of
+&lt;select&gt; tag.
+<p>
+The drop-down items in the following &lt;select&gt; should be left-aligned.
+<br>
+<select>
+<option>abc def</option>
+<option>שנב גקכ</option>
+<option dir="rtl">abc שנב def</option>
+<option dir="ltr">שנב abc גקכ</option>
+<option dir="rtl">hi!</option>
+<option dir="ltr">hi!</option>
+</select>
+<br>
+The drop-down items in the second &lt;select&gt; should be right-aligned.
+<p>
+<select dir="rtl">
+<option>abc def</option>
+<option>שנב גקכ</option>
+<option dir="rtl">abc שנב def</option>
+<option dir="ltr">שנב abc גקכ</option>
+<option dir="rtl">hi!</option>
+<option dir="ltr">hi!</option>
+</select>
+</body>
+</html>
diff --git a/WebCore/manual-tests/showModalDialog-returnValue.html b/WebCore/manual-tests/showModalDialog-returnValue.html
new file mode 100644
index 0000000..fbc3ee3
--- /dev/null
+++ b/WebCore/manual-tests/showModalDialog-returnValue.html
@@ -0,0 +1,13 @@
+This test makes sure we don't crash when storing the return value from showModalDialog.  Popup blocking needs to be disabled for this test to run.<br>
+<script>
+if (showModalDialog("data:text/html,<script>returnValue={value:'PASS'}; close()</"+"script>").value == "PASS")
+    document.write("<span style='color:green'>Test passed.<br>");
+else
+    document.write("<span style='color:red'>Test failed due to incorrect result.<br>");
+value = showModalDialog("data:text/html,<script>close()</"+"script>");
+if (!value)
+    document.write("<span style='color:green'>Test passed.<br>");
+else
+    document.write("<span style='color:red'>Test failed due to incorrect result.<br>");
+
+</script>
\ No newline at end of file
diff --git a/WebCore/manual-tests/video-waiting-seeking.html b/WebCore/manual-tests/video-waiting-seeking.html
new file mode 100644
index 0000000..508df1d
--- /dev/null
+++ b/WebCore/manual-tests/video-waiting-seeking.html
@@ -0,0 +1,81 @@
+<html>
+    <head>
+        <script src="../../LayoutTests/media/video-test.js"></script>
+        <script>
+
+            var seekedCount = 0;
+            var counter = 0;
+
+            function trySeek(seekTo)
+            {
+                if (isInTimeRanges(video.seekable, seekTo)) {
+                    if (isInTimeRanges(video.buffered, seekTo)) {
+                        consoleWrite("Warining: Seeking into buffered region. May not generate waiting or seeking events.");
+                    }
+                    run("video.currentTime = " + seekTo);
+                } else {
+                    failTest("Cannot seek to " + seekTo + ". Does engine support seeking into unbuffered region?");
+                }
+            }
+
+            function seeked()
+            { 
+                ++seekedCount; 
+                consoleWrite("");
+            }
+
+            function scheduleSeek() {
+                setTimeout(someTimeLater, 200);
+            }
+
+            function someTimeLater()
+            {
+                consoleWrite("Running scheduled seek");
+                testExpected("seekedCount", counter);
+                testExpected("video.currentTime", counter, ">=");
+
+                if (counter == 3)
+                {
+                    consoleWrite("");
+                    return;
+                    endTest();
+                }
+
+                ++counter;
+
+                scheduleSeek();
+                trySeek(counter);
+                consoleWrite("");
+            }
+
+            function start()
+            {
+                findMediaElement();
+
+                waitForEvent('waiting');
+                waitForEvent('seeking');
+                waitForEvent('seeked', seeked);
+                waitForEvent('play', someTimeLater);
+
+                consoleWrite("Start Load");
+                video.src = "http://127.0.0.1:8000/media/video-throttled-load.cgi?name=../../../media/content/test.mp4&throttle=25";
+                video.load();
+                video.play();
+            }
+        </script>
+    </head>
+    <body onload="start()">
+        <video controls></video>
+
+        <p>Attempt to seek out of the buffered range.  If supported, this
+        should cause a waiting and seeking event to be fired for each seek.
+        This test makes assumptions on the size of the input file, the bitrate
+        of delivery, and the duration of the file.
+        </p>
+        <p>
+        Source is assumed to be about 188k with a uniform bitrate, &gt; 4
+        seconds in length, and served at 25kb/s.  This should make seeking one
+        second ahead every 200ms always leave the buffered region.
+        </p>
+    </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/Earth.html b/WebCore/manual-tests/webgl/Earth.html
new file mode 100644
index 0000000..fa59a20
--- /dev/null
+++ b/WebCore/manual-tests/webgl/Earth.html
@@ -0,0 +1,166 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Canvas3d example</title>
+    <script src="resources/CanvasMatrix.js"> </script>
+    <script src="resources/utils3d.js"> </script>
+    
+    <script id="vshader" type="x-shader/x-vertex">
+        uniform mat4 u_modelViewMatrix;
+        uniform mat4 u_modelViewProjMatrix;
+        uniform mat4 u_normalMatrix;
+        uniform vec3 lightDir;
+
+        attribute vec3 vNormal;
+        attribute vec4 vTexCoord;
+        attribute vec4 vPosition;
+        
+        varying float v_Dot;
+        varying vec2 v_texCoord;
+        
+        void main()
+        {
+            gl_Position = u_modelViewProjMatrix * vPosition;
+            v_texCoord = vTexCoord.st;
+            vec4 transNormal = u_normalMatrix * vec4(vNormal,1);
+            v_Dot = max(dot(transNormal.xyz, lightDir), 0.0);
+        }
+    </script>
+
+    <script id="fshader" type="x-shader/x-fragment">
+        uniform sampler2D sampler2d;
+
+        varying float v_Dot;
+        varying vec2 v_texCoord;
+        
+        void main()
+        {
+            vec4 color = texture2D(sampler2d,v_texCoord);
+            color += vec4(0.1,0.1,0.1,1);
+            gl_FragColor = vec4(color.xyz * v_Dot, color.a);
+        }
+    </script>
+
+    <script>
+        function init()
+        {
+            var gl = initWebGL("example", "vshader", "fshader", 
+                                [ "vNormal", "vTexCoord", "vPosition"],
+                                [ 0, 0, 0, 1 ], 10000);
+
+            gl.uniform3f(gl.getUniformLocation(gl.program, "lightDir"), 0, 0, 1);
+            gl.uniform1i(gl.getUniformLocation(gl.program, "sampler2d"), 0);
+
+            gl.enable(gl.TEXTURE_2D);
+
+            gl.sphere = makeSphere(gl, 1, 30, 30);
+            
+            // get the images
+            earthTexture = loadImageTexture(gl, "resources/earthmap1k.jpg");
+            marsTexture = loadImageTexture(gl, "resources/mars500x250.png");
+
+            return gl;
+        }
+        
+        width = -1;
+        height = -1;
+        
+        function reshape(ctx)
+        {
+            var canvas = document.getElementById('example');
+            if (canvas.clientWidth == width && canvas.clientHeight == height)
+                return;
+
+            width = canvas.clientWidth;
+            height = canvas.clientHeight;
+            
+            ctx.viewport(0, 0, width, height);
+
+            ctx.perspectiveMatrix = new CanvasMatrix4();
+            ctx.perspectiveMatrix.lookat(0,0,6, 0, 0, 0, 0, 1, 0);
+            ctx.perspectiveMatrix.perspective(30, width/height, 1, 10000);
+        }
+        
+        function drawOne(ctx, angle, x, y, z, scale, texture)
+        {
+            // setup VBOs
+            ctx.enableVertexAttribArray(0);
+            ctx.enableVertexAttribArray(1);
+            ctx.enableVertexAttribArray(2);
+
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.vertexObject);
+            ctx.vertexAttribPointer(2, 3, ctx.FLOAT, false, 0, 0);
+            
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.normalObject);
+            ctx.vertexAttribPointer(0, 3, ctx.FLOAT, false, 0, 0);
+            
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.texCoordObject);
+            ctx.vertexAttribPointer(1, 2, ctx.FLOAT, false, 0, 0);
+
+            ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, ctx.sphere.indexObject);
+
+            // generate the model-view matrix
+            var mvMatrix = new CanvasMatrix4();
+            mvMatrix.scale(scale, scale, scale);
+            mvMatrix.rotate(angle, 0,1,0);
+            mvMatrix.rotate(30, 1,0,0);
+            mvMatrix.translate(x,y,z);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            // construct the normal matrix from the model-view matrix
+            var normalMatrix = new CanvasMatrix4(mvMatrix);
+            normalMatrix.invert();
+            normalMatrix.transpose();
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_normalMatrix"), false, normalMatrix.getAsCanvasFloatArray());
+            
+            // construct the model-view * projection matrix
+            var mvpMatrix = new CanvasMatrix4(mvMatrix);
+            mvpMatrix.multRight(ctx.perspectiveMatrix);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewProjMatrix"), false, mvpMatrix.getAsCanvasFloatArray());
+
+            ctx.bindTexture(ctx.TEXTURE_2D, texture);
+            ctx.drawElements(ctx.TRIANGLES, ctx.sphere.numIndices, ctx.UNSIGNED_SHORT, 0);
+        }
+        
+        function drawPicture(ctx)
+        {
+            reshape(ctx);
+            ctx.clear(ctx.COLOR_BUFFER_BIT | ctx.DEPTH_BUFFER_BIT);
+            
+            drawOne(ctx, currentAngle, -1, 0, 0, 1, earthTexture);
+            drawOne(ctx, -currentAngle, 1, 0, 0, 0.6, marsTexture);
+            ctx.flush();
+            
+            framerate.snapshot();
+            
+            currentAngle += incAngle;
+            if (currentAngle > 360)
+                currentAngle -= 360;
+        }
+        
+        function start()
+        {
+            var ctx = init();
+            currentAngle = 0;
+            incAngle = 0.2;
+            var f = function() { drawPicture(ctx) };
+            setInterval(f, 10);
+            framerate = new Framerate("framerate");
+        }
+    </script>
+    <style type="text/css">
+        canvas {
+            border: 2px solid black;
+            width:90%;
+            height:90%;
+        }
+    </style>
+  </head>
+  <body onload="start()">
+    <canvas id="example">
+    There is supposed to be an example drawing here, but it's not important.
+    </canvas>
+    <div id="framerate"></div>
+    <div id="console"></div>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/ManyPlanetsDeep.html b/WebCore/manual-tests/webgl/ManyPlanetsDeep.html
new file mode 100644
index 0000000..e5bb773
--- /dev/null
+++ b/WebCore/manual-tests/webgl/ManyPlanetsDeep.html
@@ -0,0 +1,202 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Canvas3d example</title>
+    <script src="resources/CanvasMatrix.js"> </script>
+    <script src="resources/utils3d.js"> </script>
+    
+    <script id="vshader" type="x-shader/x-vertex">
+        uniform mat4 u_modelViewMatrix;
+        uniform mat4 u_modelViewProjMatrix;
+        uniform mat4 u_normalMatrix;
+        uniform vec3 lightDir;
+
+        attribute vec3 vNormal;
+        attribute vec4 vTexCoord;
+        attribute vec4 vPosition;
+        
+        varying float v_Dot;
+        varying vec2 v_texCoord;
+        
+        void main()
+        {
+            gl_Position = u_modelViewProjMatrix * vPosition;
+            v_texCoord = vTexCoord.st;
+            vec4 transNormal = u_normalMatrix * vec4(vNormal,1);
+            v_Dot = max(dot(transNormal.xyz, lightDir), 0.0);
+        }
+    </script>
+
+    <script id="fshader" type="x-shader/x-fragment">
+        uniform sampler2D sampler2d;
+
+        varying float v_Dot;
+        varying vec2 v_texCoord;
+        
+        void main()
+        {
+            vec4 color = texture2D(sampler2d,v_texCoord);
+            color += vec4(0.1,0.1,0.1,1);
+            gl_FragColor = vec4(color.xyz * v_Dot, color.a);
+        }
+    </script>
+
+    <script>
+        const numRowCols = 4;
+        const numLayers = 3;
+        const layoutWidth = 10;
+        const layoutHeight = 8;
+        const globeSize = 25;
+        const minIncAngle = 0.2;
+        const maxIncAngle = 2;
+    
+        function init()
+        {
+            var gl = initWebGL("example", "vshader", "fshader", 
+                                [ "vNormal", "vTexCoord", "vPosition"],
+                                [ 0, 0, 0, 1 ], 10000);
+
+            gl.uniform3f(gl.getUniformLocation(gl.program, "lightDir"), 0, 0, 1);
+            gl.uniform1i(gl.getUniformLocation(gl.program, "sampler2d"), 0);
+
+            gl.enable(gl.TEXTURE_2D);
+
+            gl.sphere = makeSphere(gl, 1, 30, 30);
+            
+            // get the images
+            earthTexture = loadImageTexture(gl, "resources/earthmap1k.jpg");
+            marsTexture = loadImageTexture(gl, "resources/mars500x250.png");
+
+            return gl;
+        }
+        
+        width = -1;
+        height = -1;
+        
+        function reshape(ctx)
+        {
+            var canvas = document.getElementById('example');
+            if (canvas.clientWidth == width && canvas.clientHeight == height)
+                return;
+
+            width = canvas.clientWidth;
+            height = canvas.clientHeight;
+            
+            ctx.viewport(0, 0, width, height);
+
+            ctx.perspectiveMatrix = new CanvasMatrix4();
+            ctx.perspectiveMatrix.lookat(0,0,20, 0, 0, 0, 0, 1, 0);
+            ctx.perspectiveMatrix.perspective(30, width/height, 1, 10000);
+        }
+        
+        function drawOne(ctx, angle, x, y, z, scale, texture)
+        {
+            // setup VBOs
+            ctx.enableVertexAttribArray(0);
+            ctx.enableVertexAttribArray(1);
+            ctx.enableVertexAttribArray(2);
+
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.vertexObject);
+            ctx.vertexAttribPointer(2, 3, ctx.FLOAT, false, 0, 0);
+            
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.normalObject);
+            ctx.vertexAttribPointer(0, 3, ctx.FLOAT, false, 0, 0);
+            
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.texCoordObject);
+            ctx.vertexAttribPointer(1, 2, ctx.FLOAT, false, 0, 0);
+
+            ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, ctx.sphere.indexObject);
+
+            // generate the model-view matrix
+            var mvMatrix = new CanvasMatrix4();
+            mvMatrix.scale(scale, scale, scale);
+            mvMatrix.rotate(angle, 0,1,0);
+            mvMatrix.rotate(30, 1,0,0);
+            mvMatrix.translate(x,y,z);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            // construct the normal matrix from the model-view matrix
+            var normalMatrix = new CanvasMatrix4(mvMatrix);
+            normalMatrix.invert();
+            normalMatrix.transpose();
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_normalMatrix"), false, normalMatrix.getAsCanvasFloatArray());
+            
+            // construct the model-view * projection matrix
+            var mvpMatrix = new CanvasMatrix4(mvMatrix);
+            mvpMatrix.multRight(ctx.perspectiveMatrix);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewProjMatrix"), false, mvpMatrix.getAsCanvasFloatArray());
+
+            ctx.bindTexture(ctx.TEXTURE_2D, texture);
+            ctx.drawElements(ctx.TRIANGLES, ctx.sphere.numIndices, ctx.UNSIGNED_SHORT, 0);
+        }
+        
+        function drawPicture(ctx)
+        {
+            reshape(ctx);
+            ctx.clear(ctx.COLOR_BUFFER_BIT | ctx.DEPTH_BUFFER_BIT);
+    
+            var startX = -layoutWidth/2;
+            var startY = -layoutHeight/2;
+            var startZ = 0;
+            var incX = layoutWidth / (numRowCols-1);
+            var incY = layoutHeight / (numRowCols-1);
+            var incZ = -5;
+            
+            for (i = 0; i < numLayers; ++i) {
+                for (j = 0; j < numRowCols; ++j) {
+                    for (k = 0; k < numRowCols; ++k) {
+                        var index = i * numLayers * numRowCols + j * numRowCols + k;
+                    
+                        drawOne(ctx, currentAngles[index], 
+                                startX + incX * k, 
+                                startY + incY * j, 
+                                startZ + incZ * i, 
+                                showEarth[index] ? 1 : 0.6, showEarth[index] ? earthTexture : marsTexture);
+                    
+                        currentAngles[index] += incAngles[i];
+                        if (currentAngles[index] > 360)
+                            currentAngles[index] -= 360;
+                    }
+                }
+            }
+
+            ctx.bindTexture(ctx.TEXTURE_2D, 0);
+            ctx.flush();
+            
+            framerate.snapshot();
+        }
+
+        function start()
+        {
+            var ctx = init();
+            currentAngles = [ ];
+            incAngles = [ ];
+            showEarth = [ ];
+            
+            for (var i = 0; i < numRowCols * numRowCols * numLayers; ++i) {
+                currentAngles[i] = 0;
+                incAngles[i] = Math.random() * (maxIncAngle - minIncAngle) + minIncAngle;
+                showEarth[i] = Math.random() > 0.5;
+            }
+                
+            framerate = new Framerate("framerate");
+
+            var f = function() { drawPicture(ctx) };
+            setInterval(f, 10);
+        }
+    </script>
+    <style type="text/css">
+        canvas {
+            border: 2px solid black;
+            width:90%;
+            height:90%;
+        }
+    </style>
+  </head>
+  <body onload="start()">
+    <canvas id="example">
+    There is supposed to be an example drawing here, but it's not important.
+    </canvas>
+    <div id="framerate"></div>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/SpinningBox.html b/WebCore/manual-tests/webgl/SpinningBox.html
new file mode 100644
index 0000000..203d7bd
--- /dev/null
+++ b/WebCore/manual-tests/webgl/SpinningBox.html
@@ -0,0 +1,149 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Canvas3d example</title>
+    <script src="resources/CanvasMatrix.js"> </script>
+    <script src="resources/utils3d.js"> </script>
+    <script id="vshader" type="x-shader/x-vertex">
+        uniform mat4 pMatrix;
+        uniform mat4 mvMatrix;
+        uniform vec3 lightDir;
+
+        attribute vec3 vNormal;
+        attribute vec4 vColor;
+        attribute vec4 vPosition;
+        
+        varying float v_Dot;
+        
+        void main()
+        {
+            gl_FrontColor = vColor;
+            vec4 transNormal = mvMatrix * vec4(vNormal,1);
+            v_Dot = max(dot(transNormal.xyz, lightDir), 0.0);
+            gl_Position = pMatrix * mvMatrix * vPosition;
+        }
+    </script>
+
+    <script id="fshader" type="x-shader/x-fragment">
+        varying float v_Dot;
+        
+        void main()
+        {
+            gl_FragColor = vec4(gl_Color.xyz * v_Dot, gl_Color.a);
+        }
+    </script>
+
+    <script>
+        function init()
+        {
+            var gl = initWebGL("example", "vshader", "fshader", 
+                                [ "vNormal", "vColor", "vPosition"],
+                                [ 0, 0, 0, 1 ], 10000);
+
+            gl.uniform3f(gl.getUniformLocation(gl.program, "lightDir"), 0, 0, 1);
+            
+            gl.box = makeBox(gl);
+
+            // color array
+            var colors = new CanvasUnsignedByteArray(
+                [  0, 0, 1, 1,   0, 0, 1, 1,   0, 0, 1, 1,   0, 0, 1, 1,     // v0-v1-v2-v3 front
+                   1, 0, 0, 1,   1, 0, 0, 1,   1, 0, 0, 1,   1, 0, 0, 1,     // v0-v3-v4-v5 right
+                   0, 1, 0, 1,   0, 1, 0, 1,   0, 1, 0, 1,   0, 1, 0, 1,     // v0-v5-v6-v1 top
+                   1, 1, 0, 1,   1, 1, 0, 1,   1, 1, 0, 1,   1, 1, 0, 1,     // v1-v6-v7-v2 left
+                   1, 0, 1, 1,   1, 0, 1, 1,   1, 0, 1, 1,   1, 0, 1, 1,     // v7-v4-v3-v2 bottom
+                   0, 1, 1, 1,   0, 1, 1, 1,   0, 1, 1, 1,   0, 1, 1, 1 ]    // v4-v7-v6-v5 back
+            );
+            
+            gl.box.colorObject = gl.createBuffer();
+            gl.bindBuffer(gl.ARRAY_BUFFER, gl.box.colorObject);
+            gl.bufferData(gl.ARRAY_BUFFER, colors, gl.STATIC_DRAW);
+                                    
+            return gl;
+        }
+        
+        width = -1;
+        height = -1;
+        
+        function reshape(gl)
+        {
+            var canvas = document.getElementById('example');
+            if (canvas.clientWidth == width && canvas.clientHeight == height)
+                return;
+
+            width = canvas.clientWidth;
+            height = canvas.clientHeight;
+            
+            gl.viewport(0, 0, width, height);
+            var pMatrix = new CanvasMatrix4();
+            pMatrix.lookat(0,0,10, 0, 0, 0, 0, 1, 0);
+            pMatrix.perspective(30, width/height, 1, 10000);
+            gl.uniformMatrix4fv(gl.getUniformLocation(gl.program, "pMatrix"), false, pMatrix.getAsCanvasFloatArray());
+        }
+        
+        function drawPicture(gl)
+        {
+            reshape(gl);
+            gl.clear(gl.COLOR_BUFFER_BIT | gl.DEPTH_BUFFER_BIT);
+
+            var mvMatrix = new CanvasMatrix4();
+            mvMatrix.rotate(currentAngle, 0,1,0);
+            mvMatrix.rotate(20, 1,0,0);
+            gl.uniformMatrix4fv(gl.getUniformLocation(gl.program, "mvMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            gl.enableVertexAttribArray(0);
+            gl.enableVertexAttribArray(1);
+            gl.enableVertexAttribArray(2);
+
+            gl.bindBuffer(gl.ARRAY_BUFFER, gl.box.vertexObject);
+            gl.vertexAttribPointer(2, 3, gl.FLOAT, false, 0, 0);
+            
+            gl.bindBuffer(gl.ARRAY_BUFFER, gl.box.normalObject);
+            gl.vertexAttribPointer(0, 3, gl.FLOAT, false, 0, 0);
+            
+            gl.bindBuffer(gl.ARRAY_BUFFER, gl.box.colorObject);
+            gl.vertexAttribPointer(1, 4, gl.UNSIGNED_BYTE, false, 0, 0);
+
+            gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, gl.box.indexObject);
+            gl.drawElements(gl.TRIANGLES, gl.box.numIndices, gl.UNSIGNED_BYTE, 0);
+
+            gl.flush();
+            
+            framerate.snapshot();
+            
+            currentAngle += incAngle;
+            if (currentAngle > 360)
+                currentAngle -= 360;
+        }
+        
+        function start()
+        {
+            var gl = init();
+            currentAngle = 0;
+            incAngle = 0.5;
+            framerate = new Framerate("framerate");
+            setInterval(function() { drawPicture(gl) }, 10);
+        }
+    </script>
+    <style type="text/css">
+        canvas {
+            border: 2px solid black;
+            width:90%;
+            height:90%;
+        }
+        .text {
+            position:absolute;
+            top:100px;
+            left:20px;
+            font-size:2em;
+            color: blue;
+        }
+    </style>
+  </head>
+  <body onload="start()">
+    <canvas id="example">
+    There is supposed to be an example drawing here, but it's not important.
+    </canvas>
+    <div class="text">This is some text under the canvas</div>
+    <div id="framerate"></div>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/TeapotPerPixel.html b/WebCore/manual-tests/webgl/TeapotPerPixel.html
new file mode 100644
index 0000000..6274c8b
--- /dev/null
+++ b/WebCore/manual-tests/webgl/TeapotPerPixel.html
@@ -0,0 +1,332 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Canvas3d example</title>
+    <script src="resources/CanvasMatrix.js"> </script>
+    <script src="resources/utils3d.js"> </script>
+    <script id="vshader" type="x-shader/x-vertex">
+        /*
+          Copyright (c) 2008 Seneca College
+          Licenced under the MIT License (http://www.c3dl.org/index.php/mit-license/)
+        */
+        
+        // We need to create our own light structure since we can't access 
+        // the light() function in the 2.0 context.
+        struct Light 
+        { 
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            vec4 position;
+            
+            vec3 halfVector;
+        };
+        
+        struct Material
+        {
+            vec4 emission;
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            float shininess;
+        };
+
+        //
+        // vertex attributes
+        //
+        attribute vec4 a_vertex; 
+        attribute vec3 a_normal; 
+        attribute vec4 a_texCoord; 
+
+        // for every model we multiply the projection, view and model matrices
+        // once to prevent having to do it for every vertex, however we still need
+        // the view matrix to calculate lighting.
+        uniform mat4 u_modelViewMatrix;
+
+        // we can calculate this once per model to speed up processing done on the js side.
+        uniform mat4 u_modelViewProjMatrix;
+
+        // matrix to transform the vertex normals
+        uniform mat4 u_normalMatrix;
+
+         // custom light structures need to be used since we don't have access to 
+        // light states.
+        uniform Light u_light;
+        
+        // material
+        uniform vec4 u_globalAmbientColor;
+        uniform Material u_frontMaterial;
+        uniform Material u_backMaterial;
+        
+        // passed to fragment shader
+        varying vec4 v_diffuse, v_ambient;
+        varying vec3 v_normal, v_lightDir;
+        varying vec2 v_texCoord;
+
+        /*
+            Given a reference to the ambient and diffuse  lighting variables,
+            this function will calculate how much each component contributes to the scene.
+
+            Light light - the light in view space
+            vec3 normal - 
+            vec4 ambient - 
+            vec4 diffuse - 
+        */
+        vec3 directionalLight(inout vec4 ambient, inout vec4 diffuse)
+        {
+            ambient += u_light.ambient;
+            diffuse += u_light.diffuse;
+            return normalize(vec3(u_light.position));
+        }
+
+        void main()
+        { 
+            v_normal = normalize(u_normalMatrix * vec4(a_normal, 1)).xyz; 
+
+            vec4 ambient = vec4(0.0, 0.0, 0.0, 1.0); 
+            vec4 diffuse = vec4(0.0, 0.0, 0.0, 1.0); 
+            vec4 specular = vec4(0.0, 0.0, 0.0, 1.0); 
+
+            // place the current vertex into view space
+            // ecPos = eye coordinate position.
+            vec4 ecPos4 = u_modelViewMatrix * a_vertex;
+
+            // the current vertex in eye coordinate space
+            vec3 ecPos = ecPos4.xyz/ecPos4.w;
+            v_lightDir = directionalLight(ambient, diffuse);
+            
+            v_ambient = u_frontMaterial.ambient * ambient;
+            v_ambient += u_globalAmbientColor * u_frontMaterial.ambient;
+            v_diffuse = u_frontMaterial.diffuse * diffuse;
+
+            gl_Position =  u_modelViewProjMatrix * a_vertex;
+            v_texCoord = a_texCoord.st; 
+        }
+    </script>
+
+    <script id="fshader" type="x-shader/x-fragment">
+        struct Light 
+        { 
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            vec4 position;
+        
+            vec3 halfVector;
+        };
+    
+        struct Material
+        {
+            vec4 emission;
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            float shininess;
+        };
+        
+        uniform sampler2D u_sampler2d;
+        uniform Light u_light;
+        uniform Material u_frontMaterial;
+        uniform Material u_backMaterial;
+        
+        varying vec4 v_diffuse, v_ambient;
+        varying vec3 v_normal, v_lightDir;
+        varying vec2 v_texCoord;
+
+        void main()
+        {
+            vec4 color = v_diffuse;
+                
+            vec3 n = normalize(v_normal);
+
+            Light light = u_light;
+            vec3 lightDir = v_lightDir;
+            float nDotL = max(dot(n, lightDir), 0.0);
+            if (nDotL > 0.0) {
+                color = vec4(color.rgb * nDotL, color.a);
+                float nDotHV = max(dot(n, light.halfVector), 0.0);
+                vec4 specular = u_frontMaterial.specular * light.specular;
+                color += vec4(specular.rgb * pow(nDotHV, u_frontMaterial.shininess), specular.a);
+            }
+            
+            gl_FragColor = color + v_ambient;
+        }
+    </script>
+
+    <script>
+    console.log("Hello");
+    function setDirectionalLight(ctx, program, eyeVector, direction, ambient, diffuse, specular)
+    {
+        var lightString = "u_light.";
+        
+        ctx.uniform4f(ctx.getUniformLocation(program, lightString+"ambient"), 
+                                                ambient[0], ambient[1], ambient[2], ambient[3]);
+        ctx.uniform4f(ctx.getUniformLocation(program, lightString+"diffuse"), 
+                                                diffuse[0], diffuse[1], diffuse[2], diffuse[3]);
+        ctx.uniform4f(ctx.getUniformLocation(program, lightString+"specular"), 
+                                                specular[0], specular[1], specular[2], specular[3]);
+        ctx.uniform4f(ctx.getUniformLocation(program, lightString+"position"), 
+                                                direction[0], direction[1], direction[2], direction[3]);
+                                                
+        // compute the half vector
+        var halfVector = [ eyeVector[0] + direction[0], eyeVector[1] + direction[1], eyeVector[2] + direction[2] ];
+        var length = Math.sqrt(halfVector[0] * halfVector[0] + 
+                               halfVector[1] * halfVector[1] + 
+                               halfVector[2] * halfVector[2]);
+        if (length == 0)
+            halfVector = [ 0, 0, 1 ];
+        else {
+            halfVector[0] /= length;
+            halfVector[1] /= length;
+            halfVector[2] /= length;
+        }
+
+        ctx.uniform3f(ctx.getUniformLocation(program, lightString+"halfVector"), 
+                                                halfVector[0], halfVector[1], halfVector[2]);
+    }
+        
+        function setMaterial(ctx, program, emission, ambient, diffuse, specular, shininess)
+        {
+            var matString = "u_frontMaterial.";
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"emission"), 
+                                                    emission[0], emission[1], emission[2], emission[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"ambient"), 
+                                                    ambient[0], ambient[1], ambient[2], ambient[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"diffuse"), 
+                                                    diffuse[0], diffuse[1], diffuse[2], diffuse[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"specular"), 
+                                                    specular[0], specular[1], specular[2], specular[3]);
+            ctx.uniform1f(ctx.getUniformLocation(program, matString+"shininess"), shininess);
+        }
+
+        function init()
+        {
+           var gl = initWebGL("example", "vshader", "fshader", 
+                                [ "a_normal", "a_texCoord", "a_vertex"],
+                                [ 0, 0, 0, 1 ], 10000);
+
+            gl.uniform1i(gl.getUniformLocation(gl.program, "u_sampler2d"), 0);
+            gl.uniform4f(gl.getUniformLocation(gl.program, "u_globalAmbientColor"), 0.2, 0.2, 0.2, 1);
+
+            setDirectionalLight(gl, gl.program, 
+                                [ 0, 0, 1 ],            // eyeVector
+                                [0, 0, 1, 1],           // position
+                                [0.1, 0.1, 0.1, 1],     // ambient
+                                [1, 1, 1, 1],           // diffuse
+                                [1, 1, 1, 1]);          // specular
+
+            setMaterial(gl, gl.program, 
+                [ 0, 0, 0, 0 ],         // emission
+                [ 0.1, 0.1, 0.1, 1 ],   // ambient
+                [ 0.8, 0.2, 0, 1 ], // diffuse
+                [ 0, 0, 1, 1 ],     // specular
+                32);                    // shininess
+            
+            obj = loadObj(gl, "resources/teapot.obj");
+
+            mvMatrix = new CanvasMatrix4();
+            normalMatrix = new CanvasMatrix4();
+            
+            return gl;
+        }
+                
+        width = -1;
+        height = -1;
+        loaded = false;
+        
+        function reshape(ctx)
+        {
+            var canvas = document.getElementById('example');
+            if (canvas.clientWidth == width && canvas.clientHeight == height)
+                return;
+
+            width = canvas.clientWidth;
+            height = canvas.clientHeight;
+            
+            ctx.viewport(0, 0, width, height);
+    
+            ctx.perspectiveMatrix = new CanvasMatrix4();
+            ctx.perspectiveMatrix.lookat(0,0,50, 0, 0, 0, 0, 1, 0);
+            ctx.perspectiveMatrix.perspective(30, width/height, 1, 10000);
+        }
+        
+        function drawPicture(ctx)
+        {
+            var startRenderTime = new Date().getTime();
+            
+            reshape(ctx);
+            ctx.clear(ctx.COLOR_BUFFER_BIT | ctx.DEPTH_BUFFER_BIT);
+
+            if (!loaded && obj.loaded) {
+                loaded = true;
+
+                ctx.enableVertexAttribArray(0);
+                ctx.enableVertexAttribArray(1);
+                ctx.enableVertexAttribArray(2);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.vertexObject);
+                ctx.vertexAttribPointer(2, 3, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.normalObject);
+                ctx.vertexAttribPointer(0, 3, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.texCoordObject);
+                ctx.vertexAttribPointer(1, 2, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, obj.indexObject);
+            }
+            
+            if (!loaded)
+                return;
+            
+            // generate the model-view matrix
+            mvMatrix.makeIdentity();
+            mvMatrix.rotate(currentAngle, 0, 1, 0);
+            mvMatrix.rotate(10, 1,0,0);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            // construct the normal matrix from the model-view matrix
+            normalMatrix.load(mvMatrix);
+            normalMatrix.invert();
+            normalMatrix.transpose();
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_normalMatrix"), false, normalMatrix.getAsCanvasFloatArray());
+            
+            mvMatrix.multRight(ctx.perspectiveMatrix);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewProjMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            ctx.drawElements(ctx.TRIANGLES, obj.numIndices, ctx.UNSIGNED_SHORT, 0);
+            
+            ctx.flush();
+            
+            framerate.snapshot();
+            
+            currentAngle += incAngle;
+            if (currentAngle > 360)
+                currentAngle -= 360;
+        }
+        
+        function start()
+        {
+            var ctx = init();
+            currentAngle = 0;
+            incAngle = 0.2;
+            framerate = new Framerate("framerate");
+            var f = function() { drawPicture(ctx) };
+            setInterval(f, 10);
+        }
+    </script>
+    <style type="text/css">
+        canvas {
+            border: 2px solid black;
+            width:90%;
+            height:90%;
+        }
+    </style>
+  </head>
+  <body onload="start()">
+    <canvas id="example">
+    There is supposed to be an example drawing here, but it's not important.
+    </canvas>
+    <div id="framerate"></div>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/TeapotPerVertex.html b/WebCore/manual-tests/webgl/TeapotPerVertex.html
new file mode 100644
index 0000000..d2544a3
--- /dev/null
+++ b/WebCore/manual-tests/webgl/TeapotPerVertex.html
@@ -0,0 +1,305 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Canvas3d example</title>
+    <script src="resources/CanvasMatrix.js"> </script>
+    <script src="resources/utils3d.js"> </script>
+    <script id="vshader" type="x-shader/x-vertex">
+        /*
+          Copyright (c) 2008 Seneca College
+          Licenced under the MIT License (http://www.c3dl.org/index.php/mit-license/)
+        */
+        
+        // We need to create our own light structure since we can't access 
+        // the light() function in the 2.0 context.
+        struct Light 
+        { 
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            vec4 position;
+            
+            vec3 halfVector;
+        };
+        
+        struct Material
+        {
+            vec4 emission;
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            float shininess;
+        };
+
+        //
+        // vertex attributes
+        //
+        attribute vec3 a_normal; 
+        attribute vec4 a_texCoord; 
+        attribute vec4 a_vertex; 
+
+        // for every model we multiply the projection, view and model matrices
+        // once to prevent having to do it for every vertex, however we still need
+        // the view matrix to calculate lighting.
+        uniform mat4 u_modelViewMatrix;
+
+        // we can calculate this once per model to speed up processing done on the js side.
+        uniform mat4 u_modelViewProjMatrix;
+
+        // matrix to transform the vertex normals
+        uniform mat4 u_normalMatrix;
+
+        // custom light structures need to be used since we don't have access to 
+        // light states.
+        uniform Light u_light;
+        
+        // material
+        uniform vec4 u_globalAmbientColor;
+        uniform Material u_frontMaterial;
+        uniform Material u_backMaterial;
+        
+        // passed to fragment shader
+        varying vec4 v_diffuse, v_specular;
+        varying vec2 v_texCoord;
+
+        /*
+            Given a reference to the ambient and diffuse  lighting variables,
+            this function will calculate how much each component contributes to the scene.
+
+            Light light - the light in view space
+            vec3 normal - 
+            vec4 ambient - 
+            vec4 diffuse - 
+        */
+        void directionalLight(in vec3 normal, inout vec4 ambient, inout vec4 diffuse, inout vec4 specular)
+        {
+            vec3 lightDir = normalize(vec3(u_light.position));
+            ambient += u_light.ambient;
+            
+            float nDotL = max(dot(normal, lightDir), 0.0);
+            if (nDotL > 0.0) {
+                diffuse += u_light.diffuse * nDotL;
+                float nDotHV = max(dot(normal, u_light.halfVector), 0.0);
+                nDotHV += 0.3;
+                vec4 specularColor = u_frontMaterial.specular * u_light.specular;
+                specular += vec4(specularColor.rgb * pow(nDotHV, u_frontMaterial.shininess), specularColor.a);
+            }
+        }
+
+        void main()
+        { 
+            vec3 normal = normalize(u_normalMatrix * vec4(a_normal, 1)).xyz; 
+
+            vec4 ambient = vec4(0.0, 0.0, 0.0, 1.0); 
+            vec4 diffuse = vec4(0.0, 0.0, 0.0, 1.0); 
+            vec4 specular = vec4(0.0, 0.0, 0.0, 1.0); 
+
+            // place the current vertex into view space
+            // ecPos = eye coordinate position.
+            vec4 ecPos4 = u_modelViewMatrix * a_vertex;
+
+            // the current vertex in eye coordinate space
+            vec3 ecPos = ecPos4.xyz/ecPos4.w;
+            directionalLight(normal, ambient, diffuse, specular);
+            
+            ambient = u_frontMaterial.ambient * ambient;
+            ambient += u_globalAmbientColor * u_frontMaterial.ambient;
+            diffuse = u_frontMaterial.diffuse * diffuse;
+
+            v_diffuse = diffuse;
+            v_specular = specular + ambient;
+            gl_Position =  u_modelViewProjMatrix * a_vertex;
+            v_texCoord = a_texCoord.st;
+        }
+    </script>
+
+    <script id="fshader" type="x-shader/x-fragment">
+        uniform sampler2D u_sampler2d;
+
+        varying vec4 v_diffuse, v_specular;
+        varying vec2 v_texCoord;
+
+        void main()
+        {
+            vec4 color = v_diffuse;
+            
+            gl_FragColor = color + v_specular;
+        }
+    </script>
+
+    <script>
+        function setDirectionalLight(ctx, program, eyeVector, direction, ambient, diffuse, specular)
+        {
+            var lightString = "u_light.";
+            
+            ctx.uniform4f(ctx.getUniformLocation(program, lightString+"ambient"), 
+                                                    ambient[0], ambient[1], ambient[2], ambient[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, lightString+"diffuse"), 
+                                                    diffuse[0], diffuse[1], diffuse[2], diffuse[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, lightString+"specular"), 
+                                                    specular[0], specular[1], specular[2], specular[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, lightString+"position"), 
+                                                    direction[0], direction[1], direction[2], direction[3]);
+                                                    
+            // compute the half vector
+            var halfVector = [ eyeVector[0] + direction[0], eyeVector[1] + direction[1], eyeVector[2] + direction[2] ];
+            var length = Math.sqrt(halfVector[0] * halfVector[0] + 
+                                   halfVector[1] * halfVector[1] + 
+                                   halfVector[2] * halfVector[2]);
+            if (length == 0)
+                halfVector = [ 0, 0, 1 ];
+            else {
+                halfVector[0] /= length;
+                halfVector[1] /= length;
+                halfVector[2] /= length;
+            }
+
+            ctx.uniform3f(ctx.getUniformLocation(program, lightString+"halfVector"), 
+                                                    halfVector[0], halfVector[1], halfVector[2]);
+        }
+        
+        function setMaterial(ctx, program, emission, ambient, diffuse, specular, shininess)
+        {
+            var matString = "u_frontMaterial.";
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"emission"), 
+                                                    emission[0], emission[1], emission[2], emission[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"ambient"), 
+                                                    ambient[0], ambient[1], ambient[2], ambient[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"diffuse"), 
+                                                    diffuse[0], diffuse[1], diffuse[2], diffuse[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"specular"), 
+                                                    specular[0], specular[1], specular[2], specular[3]);
+            ctx.uniform1f(ctx.getUniformLocation(program, matString+"shininess"), shininess);
+        }
+
+        function init()
+        {
+            var gl = initWebGL("example", "vshader", "fshader", 
+                                [ "a_normal", "a_texCoord", "a_vertex"],
+                                [ 0, 0, 0, 1 ], 10000);
+
+            gl.uniform1i(gl.getUniformLocation(gl.program, "u_sampler2d"), 0);
+            gl.uniform4f(gl.getUniformLocation(gl.program, "u_globalAmbientColor"), 0.2, 0.2, 0.2, 1);
+
+            setDirectionalLight(gl, gl.program, 
+                                [ 0, 0, 1 ],            // eyeVector
+                                [0, 0, 1, 1],           // position
+                                [0.1, 0.1, 0.1, 1],     // ambient
+                                [1, 1, 1, 1],           // diffuse
+                                [1, 1, 1, 1]);          // specular
+
+            setMaterial(gl, gl.program, 
+                [ 0, 0, 0, 0 ],         // emission
+                [ 0.1, 0.1, 0.1, 1 ],   // ambient
+                [ 0.8, 0.2, 0, 1 ], // diffuse
+                [ 0, 0, 1, 1 ],     // specular
+                32);                    // shininess
+            
+            obj = loadObj(gl, "resources/teapot.obj");
+
+            mvMatrix = new CanvasMatrix4();
+            normalMatrix = new CanvasMatrix4();
+            
+            return gl;
+        }
+        
+        width = -1;
+        height = -1;
+        loaded = false;
+        
+        function reshape(ctx)
+        {
+            var canvas = document.getElementById('example');
+            if (canvas.clientWidth == width && canvas.clientHeight == height)
+                return;
+
+            width = canvas.clientWidth;
+            height = canvas.clientHeight;
+            
+            ctx.viewport(0, 0, width, height);
+    
+            ctx.perspectiveMatrix = new CanvasMatrix4();
+            ctx.perspectiveMatrix.lookat(0,0,50, 0, 0, 0, 0, 1, 0);
+            ctx.perspectiveMatrix.perspective(30, width/height, 1, 10000);
+        }
+        
+        function drawPicture(ctx)
+        {
+            var startRenderTime = new Date().getTime();
+            
+            reshape(ctx);
+            ctx.clear(ctx.COLOR_BUFFER_BIT | ctx.DEPTH_BUFFER_BIT);
+
+            if (!loaded && obj.loaded) {
+                loaded = true;
+
+                ctx.enableVertexAttribArray(0);
+                ctx.enableVertexAttribArray(1);
+                ctx.enableVertexAttribArray(2);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.normalObject);
+                ctx.vertexAttribPointer(0, 3, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.texCoordObject);
+                ctx.vertexAttribPointer(1, 2, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.vertexObject);
+                ctx.vertexAttribPointer(2, 3, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, obj.indexObject);
+            }
+            
+            if (!loaded)
+                return;
+            
+            // generate the model-view matrix
+            mvMatrix.makeIdentity();
+            mvMatrix.rotate(currentAngle, 0, 1, 0);
+            mvMatrix.rotate(10, 1,0,0);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            // construct the normal matrix from the model-view matrix
+            normalMatrix.load(mvMatrix);
+            normalMatrix.invert();
+            normalMatrix.transpose();
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_normalMatrix"), false, normalMatrix.getAsCanvasFloatArray());
+            
+            mvMatrix.multRight(ctx.perspectiveMatrix);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewProjMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            ctx.drawElements(ctx.TRIANGLES, obj.numIndices, ctx.UNSIGNED_SHORT, 0);
+            
+            ctx.flush();
+            
+            framerate.snapshot();
+            
+            currentAngle += incAngle;
+            if (currentAngle > 360)
+                currentAngle -= 360;
+        }
+        
+        function start()
+        {
+            var ctx = init();
+            currentAngle = 0;
+            incAngle = 0.2;
+            framerate = new Framerate("framerate");
+            var f = function() { drawPicture(ctx) };
+            setInterval(f, 10);
+        }
+    </script>
+    <style type="text/css">
+        canvas {
+            border: 2px solid black;
+            width:90%;
+            height:90%;
+        }
+    </style>
+  </head>
+  <body onload="start()">
+    <canvas id="example">
+    There is supposed to be an example drawing here, but it's not important.
+    </canvas>
+    <div id="framerate"></div>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/resources/CanvasMatrix.js b/WebCore/manual-tests/webgl/resources/CanvasMatrix.js
new file mode 100644
index 0000000..f35727f
--- /dev/null
+++ b/WebCore/manual-tests/webgl/resources/CanvasMatrix.js
@@ -0,0 +1,698 @@
+/*
+    CanvasMatrix4 class
+    
+    This class implements a 4x4 matrix. It has functions which
+    duplicate the functionality of the OpenGL matrix stack and
+    glut functions.
+    
+    IDL:
+    
+    [
+        Constructor(in CanvasMatrix4 matrix),           // copy passed matrix into new CanvasMatrix4
+        Constructor(in sequence<float> array)           // create new CanvasMatrix4 with 16 floats (row major)
+        Constructor()                                   // create new CanvasMatrix4 with identity matrix
+    ]
+    interface CanvasMatrix4 {
+        attribute float m11;
+        attribute float m12;
+        attribute float m13;
+        attribute float m14;
+        attribute float m21;
+        attribute float m22;
+        attribute float m23;
+        attribute float m24;
+        attribute float m31;
+        attribute float m32;
+        attribute float m33;
+        attribute float m34;
+        attribute float m41;
+        attribute float m42;
+        attribute float m43;
+        attribute float m44;
+
+        void load(in CanvasMatrix4 matrix);                 // copy the values from the passed matrix
+        void load(in sequence<float> array);                // copy 16 floats into the matrix
+        sequence<float> getAsArray();                       // return the matrix as an array of 16 floats
+        CanvasFloatArray getAsCanvasFloatArray();           // return the matrix as a CanvasFloatArray with 16 values
+        void makeIdentity();                                // replace the matrix with identity
+        void transpose();                                   // replace the matrix with its transpose
+        void invert();                                      // replace the matrix with its inverse
+        
+        void translate(in float x, in float y, in float z); // multiply the matrix by passed translation values on the right
+        void scale(in float x, in float y, in float z);     // multiply the matrix by passed scale values on the right
+        void rotate(in float angle,                         // multiply the matrix by passed rotation values on the right
+                    in float x, in float y, in float z);    // (angle is in degrees)
+        void multRight(in CanvasMatrix matrix);             // multiply the matrix by the passed matrix on the right
+        void multLeft(in CanvasMatrix matrix);              // multiply the matrix by the passed matrix on the left
+        void ortho(in float left, in float right,           // multiply the matrix by the passed ortho values on the right
+                   in float bottom, in float top, 
+                   in float near, in float far);
+        void frustum(in float left, in float right,         // multiply the matrix by the passed frustum values on the right
+                     in float bottom, in float top, 
+                     in float near, in float far);
+        void perspective(in float fovy, in float aspect,    // multiply the matrix by the passed perspective values on the right
+                         in float zNear, in float zFar);
+        void lookat(in float eyex, in float eyey, in float eyez,    // multiply the matrix by the passed lookat 
+                    in float ctrx, in float ctry, in float ctrz,    // values on the right
+                    in float upx, in float upy, in float upz);
+    }
+*/
+
+CanvasMatrix4 = function(m)
+{
+    if (typeof m == 'object') {
+        if ("length" in m && m.length >= 16) {
+            this.load(m[0], m[1], m[2], m[3], m[4], m[5], m[6], m[7], m[8], m[9], m[10], m[11], m[12], m[13], m[14], m[15]);
+            return;
+        }
+        else if (m instanceof CanvasMatrix4) {
+            this.load(m);
+            return;
+        }
+    }
+    this.makeIdentity();
+}
+
+CanvasMatrix4.prototype.load = function()
+{
+    if (arguments.length == 1 && typeof arguments[0] == 'object') {
+        var matrix = arguments[0];
+        
+        if ("length" in matrix && matrix.length == 16) {
+            this.m11 = matrix[0];
+            this.m12 = matrix[1];
+            this.m13 = matrix[2];
+            this.m14 = matrix[3];
+
+            this.m21 = matrix[4];
+            this.m22 = matrix[5];
+            this.m23 = matrix[6];
+            this.m24 = matrix[7];
+
+            this.m31 = matrix[8];
+            this.m32 = matrix[9];
+            this.m33 = matrix[10];
+            this.m34 = matrix[11];
+
+            this.m41 = matrix[12];
+            this.m42 = matrix[13];
+            this.m43 = matrix[14];
+            this.m44 = matrix[15];
+            return;
+        }
+            
+        if (arguments[0] instanceof CanvasMatrix4) {
+        
+            this.m11 = matrix.m11;
+            this.m12 = matrix.m12;
+            this.m13 = matrix.m13;
+            this.m14 = matrix.m14;
+
+            this.m21 = matrix.m21;
+            this.m22 = matrix.m22;
+            this.m23 = matrix.m23;
+            this.m24 = matrix.m24;
+
+            this.m31 = matrix.m31;
+            this.m32 = matrix.m32;
+            this.m33 = matrix.m33;
+            this.m34 = matrix.m34;
+
+            this.m41 = matrix.m41;
+            this.m42 = matrix.m42;
+            this.m43 = matrix.m43;
+            this.m44 = matrix.m44;
+            return;
+        }
+    }
+    
+    this.makeIdentity();
+}
+
+CanvasMatrix4.prototype.getAsArray = function()
+{
+    return [
+        this.m11, this.m12, this.m13, this.m14, 
+        this.m21, this.m22, this.m23, this.m24, 
+        this.m31, this.m32, this.m33, this.m34, 
+        this.m41, this.m42, this.m43, this.m44
+    ];
+}
+
+CanvasMatrix4.prototype.getAsCanvasFloatArray = function()
+{
+    return new CanvasFloatArray(this.getAsArray());
+}
+
+CanvasMatrix4.prototype.makeIdentity = function()
+{
+    this.m11 = 1;
+    this.m12 = 0;
+    this.m13 = 0;
+    this.m14 = 0;
+    
+    this.m21 = 0;
+    this.m22 = 1;
+    this.m23 = 0;
+    this.m24 = 0;
+    
+    this.m31 = 0;
+    this.m32 = 0;
+    this.m33 = 1;
+    this.m34 = 0;
+    
+    this.m41 = 0;
+    this.m42 = 0;
+    this.m43 = 0;
+    this.m44 = 1;
+}
+
+CanvasMatrix4.prototype.transpose = function()
+{
+    var tmp = this.m12;
+    this.m12 = this.m21;
+    this.m21 = tmp;
+    
+    tmp = this.m13;
+    this.m13 = this.m31;
+    this.m31 = tmp;
+    
+    tmp = this.m14;
+    this.m14 = this.m41;
+    this.m41 = tmp;
+    
+    tmp = this.m23;
+    this.m23 = this.m32;
+    this.m32 = tmp;
+    
+    tmp = this.m24;
+    this.m24 = this.m42;
+    this.m42 = tmp;
+    
+    tmp = this.m34;
+    this.m34 = this.m43;
+    this.m43 = tmp;
+}
+
+CanvasMatrix4.prototype.invert = function()
+{
+    // Calculate the 4x4 determinant
+    // If the determinant is zero, 
+    // then the inverse matrix is not unique.
+    var det = this._determinant4x4();
+
+    if (Math.abs(det) < 1e-8)
+        return null;
+
+    this._makeAdjoint();
+
+    // Scale the adjoint matrix to get the inverse
+    this.m11 /= det;
+    this.m12 /= det;
+    this.m13 /= det;
+    this.m14 /= det;
+    
+    this.m21 /= det;
+    this.m22 /= det;
+    this.m23 /= det;
+    this.m24 /= det;
+    
+    this.m31 /= det;
+    this.m32 /= det;
+    this.m33 /= det;
+    this.m34 /= det;
+    
+    this.m41 /= det;
+    this.m42 /= det;
+    this.m43 /= det;
+    this.m44 /= det;
+}
+
+CanvasMatrix4.prototype.translate = function(x,y,z)
+{
+    if (x == undefined)
+        x = 0;
+        if (y == undefined)
+            y = 0;
+    if (z == undefined)
+        z = 0;
+    
+    var matrix = new CanvasMatrix4();
+    matrix.m41 = x;
+    matrix.m42 = y;
+    matrix.m43 = z;
+
+    this.multRight(matrix);
+}
+
+CanvasMatrix4.prototype.scale = function(x,y,z)
+{
+    if (x == undefined)
+        x = 1;
+    if (z == undefined) {
+        if (y == undefined) {
+            y = x;
+            z = x;
+        }
+        else
+            z = 1;
+    }
+    else if (y == undefined)
+        y = x;
+    
+    var matrix = new CanvasMatrix4();
+    matrix.m11 = x;
+    matrix.m22 = y;
+    matrix.m33 = z;
+    
+    this.multRight(matrix);
+}
+
+CanvasMatrix4.prototype.rotate = function(angle,x,y,z)
+{
+    // angles are in degrees. Switch to radians
+    angle = angle / 180 * Math.PI;
+    
+    angle /= 2;
+    var sinA = Math.sin(angle);
+    var cosA = Math.cos(angle);
+    var sinA2 = sinA * sinA;
+    
+    // normalize
+    var length = Math.sqrt(x * x + y * y + z * z);
+    if (length == 0) {
+        // bad vector, just use something reasonable
+        x = 0;
+        y = 0;
+        z = 1;
+    } else if (length != 1) {
+        x /= length;
+        y /= length;
+        z /= length;
+    }
+    
+    var mat = new CanvasMatrix4();
+
+    // optimize case where axis is along major axis
+    if (x == 1 && y == 0 && z == 0) {
+        mat.m11 = 1;
+        mat.m12 = 0;
+        mat.m13 = 0;
+        mat.m21 = 0;
+        mat.m22 = 1 - 2 * sinA2;
+        mat.m23 = 2 * sinA * cosA;
+        mat.m31 = 0;
+        mat.m32 = -2 * sinA * cosA;
+        mat.m33 = 1 - 2 * sinA2;
+        mat.m14 = mat.m24 = mat.m34 = 0;
+        mat.m41 = mat.m42 = mat.m43 = 0;
+        mat.m44 = 1;
+    } else if (x == 0 && y == 1 && z == 0) {
+        mat.m11 = 1 - 2 * sinA2;
+        mat.m12 = 0;
+        mat.m13 = -2 * sinA * cosA;
+        mat.m21 = 0;
+        mat.m22 = 1;
+        mat.m23 = 0;
+        mat.m31 = 2 * sinA * cosA;
+        mat.m32 = 0;
+        mat.m33 = 1 - 2 * sinA2;
+        mat.m14 = mat.m24 = mat.m34 = 0;
+        mat.m41 = mat.m42 = mat.m43 = 0;
+        mat.m44 = 1;
+    } else if (x == 0 && y == 0 && z == 1) {
+        mat.m11 = 1 - 2 * sinA2;
+        mat.m12 = 2 * sinA * cosA;
+        mat.m13 = 0;
+        mat.m21 = -2 * sinA * cosA;
+        mat.m22 = 1 - 2 * sinA2;
+        mat.m23 = 0;
+        mat.m31 = 0;
+        mat.m32 = 0;
+        mat.m33 = 1;
+        mat.m14 = mat.m24 = mat.m34 = 0;
+        mat.m41 = mat.m42 = mat.m43 = 0;
+        mat.m44 = 1;
+    } else {
+        var x2 = x*x;
+        var y2 = y*y;
+        var z2 = z*z;
+    
+        mat.m11 = 1 - 2 * (y2 + z2) * sinA2;
+        mat.m12 = 2 * (x * y * sinA2 + z * sinA * cosA);
+        mat.m13 = 2 * (x * z * sinA2 - y * sinA * cosA);
+        mat.m21 = 2 * (y * x * sinA2 - z * sinA * cosA);
+        mat.m22 = 1 - 2 * (z2 + x2) * sinA2;
+        mat.m23 = 2 * (y * z * sinA2 + x * sinA * cosA);
+        mat.m31 = 2 * (z * x * sinA2 + y * sinA * cosA);
+        mat.m32 = 2 * (z * y * sinA2 - x * sinA * cosA);
+        mat.m33 = 1 - 2 * (x2 + y2) * sinA2;
+        mat.m14 = mat.m24 = mat.m34 = 0;
+        mat.m41 = mat.m42 = mat.m43 = 0;
+        mat.m44 = 1;
+    }
+    this.multRight(mat);
+}
+
+CanvasMatrix4.prototype.multRight = function(mat)
+{
+    var m11 = (this.m11 * mat.m11 + this.m12 * mat.m21
+               + this.m13 * mat.m31 + this.m14 * mat.m41);
+    var m12 = (this.m11 * mat.m12 + this.m12 * mat.m22
+               + this.m13 * mat.m32 + this.m14 * mat.m42);
+    var m13 = (this.m11 * mat.m13 + this.m12 * mat.m23
+               + this.m13 * mat.m33 + this.m14 * mat.m43);
+    var m14 = (this.m11 * mat.m14 + this.m12 * mat.m24
+               + this.m13 * mat.m34 + this.m14 * mat.m44);
+
+    var m21 = (this.m21 * mat.m11 + this.m22 * mat.m21
+               + this.m23 * mat.m31 + this.m24 * mat.m41);
+    var m22 = (this.m21 * mat.m12 + this.m22 * mat.m22
+               + this.m23 * mat.m32 + this.m24 * mat.m42);
+    var m23 = (this.m21 * mat.m13 + this.m22 * mat.m23
+               + this.m23 * mat.m33 + this.m24 * mat.m43);
+    var m24 = (this.m21 * mat.m14 + this.m22 * mat.m24
+               + this.m23 * mat.m34 + this.m24 * mat.m44);
+
+    var m31 = (this.m31 * mat.m11 + this.m32 * mat.m21
+               + this.m33 * mat.m31 + this.m34 * mat.m41);
+    var m32 = (this.m31 * mat.m12 + this.m32 * mat.m22
+               + this.m33 * mat.m32 + this.m34 * mat.m42);
+    var m33 = (this.m31 * mat.m13 + this.m32 * mat.m23
+               + this.m33 * mat.m33 + this.m34 * mat.m43);
+    var m34 = (this.m31 * mat.m14 + this.m32 * mat.m24
+               + this.m33 * mat.m34 + this.m34 * mat.m44);
+
+    var m41 = (this.m41 * mat.m11 + this.m42 * mat.m21
+               + this.m43 * mat.m31 + this.m44 * mat.m41);
+    var m42 = (this.m41 * mat.m12 + this.m42 * mat.m22
+               + this.m43 * mat.m32 + this.m44 * mat.m42);
+    var m43 = (this.m41 * mat.m13 + this.m42 * mat.m23
+               + this.m43 * mat.m33 + this.m44 * mat.m43);
+    var m44 = (this.m41 * mat.m14 + this.m42 * mat.m24
+               + this.m43 * mat.m34 + this.m44 * mat.m44);
+    
+    this.m11 = m11;
+    this.m12 = m12;
+    this.m13 = m13;
+    this.m14 = m14;
+    
+    this.m21 = m21;
+    this.m22 = m22;
+    this.m23 = m23;
+    this.m24 = m24;
+    
+    this.m31 = m31;
+    this.m32 = m32;
+    this.m33 = m33;
+    this.m34 = m34;
+    
+    this.m41 = m41;
+    this.m42 = m42;
+    this.m43 = m43;
+    this.m44 = m44;
+}
+
+CanvasMatrix4.prototype.multLeft = function(mat)
+{
+    var m11 = (mat.m11 * this.m11 + mat.m12 * this.m21
+               + mat.m13 * this.m31 + mat.m14 * this.m41);
+    var m12 = (mat.m11 * this.m12 + mat.m12 * this.m22
+               + mat.m13 * this.m32 + mat.m14 * this.m42);
+    var m13 = (mat.m11 * this.m13 + mat.m12 * this.m23
+               + mat.m13 * this.m33 + mat.m14 * this.m43);
+    var m14 = (mat.m11 * this.m14 + mat.m12 * this.m24
+               + mat.m13 * this.m34 + mat.m14 * this.m44);
+
+    var m21 = (mat.m21 * this.m11 + mat.m22 * this.m21
+               + mat.m23 * this.m31 + mat.m24 * this.m41);
+    var m22 = (mat.m21 * this.m12 + mat.m22 * this.m22
+               + mat.m23 * this.m32 + mat.m24 * this.m42);
+    var m23 = (mat.m21 * this.m13 + mat.m22 * this.m23
+               + mat.m23 * this.m33 + mat.m24 * this.m43);
+    var m24 = (mat.m21 * this.m14 + mat.m22 * this.m24
+               + mat.m23 * this.m34 + mat.m24 * this.m44);
+
+    var m31 = (mat.m31 * this.m11 + mat.m32 * this.m21
+               + mat.m33 * this.m31 + mat.m34 * this.m41);
+    var m32 = (mat.m31 * this.m12 + mat.m32 * this.m22
+               + mat.m33 * this.m32 + mat.m34 * this.m42);
+    var m33 = (mat.m31 * this.m13 + mat.m32 * this.m23
+               + mat.m33 * this.m33 + mat.m34 * this.m43);
+    var m34 = (mat.m31 * this.m14 + mat.m32 * this.m24
+               + mat.m33 * this.m34 + mat.m34 * this.m44);
+
+    var m41 = (mat.m41 * this.m11 + mat.m42 * this.m21
+               + mat.m43 * this.m31 + mat.m44 * this.m41);
+    var m42 = (mat.m41 * this.m12 + mat.m42 * this.m22
+               + mat.m43 * this.m32 + mat.m44 * this.m42);
+    var m43 = (mat.m41 * this.m13 + mat.m42 * this.m23
+               + mat.m43 * this.m33 + mat.m44 * this.m43);
+    var m44 = (mat.m41 * this.m14 + mat.m42 * this.m24
+               + mat.m43 * this.m34 + mat.m44 * this.m44);
+    
+    this.m11 = m11;
+    this.m12 = m12;
+    this.m13 = m13;
+    this.m14 = m14;
+
+    this.m21 = m21;
+    this.m22 = m22;
+    this.m23 = m23;
+    this.m24 = m24;
+
+    this.m31 = m31;
+    this.m32 = m32;
+    this.m33 = m33;
+    this.m34 = m34;
+
+    this.m41 = m41;
+    this.m42 = m42;
+    this.m43 = m43;
+    this.m44 = m44;
+}
+
+CanvasMatrix4.prototype.ortho = function(left, right, bottom, top, near, far)
+{
+    var tx = (left + right) / (left - right);
+    var ty = (top + bottom) / (top - bottom);
+    var tz = (far + near) / (far - near);
+    
+    var matrix = new CanvasMatrix4();
+    matrix.m11 = 2 / (left - right);
+    matrix.m12 = 0;
+    matrix.m13 = 0;
+    matrix.m14 = 0;
+    matrix.m21 = 0;
+    matrix.m22 = 2 / (top - bottom);
+    matrix.m23 = 0;
+    matrix.m24 = 0;
+    matrix.m31 = 0;
+    matrix.m32 = 0;
+    matrix.m33 = -2 / (far - near);
+    matrix.m34 = 0;
+    matrix.m41 = tx;
+    matrix.m42 = ty;
+    matrix.m43 = tz;
+    matrix.m44 = 1;
+    
+    this.multRight(matrix);
+}
+
+CanvasMatrix4.prototype.frustum = function(left, right, bottom, top, near, far)
+{
+    var matrix = new CanvasMatrix4();
+    var A = (right + left) / (right - left);
+    var B = (top + bottom) / (top - bottom);
+    var C = -(far + near) / (far - near);
+    var D = -(2 * far * near) / (far - near);
+    
+    matrix.m11 = (2 * near) / (right - left);
+    matrix.m12 = 0;
+    matrix.m13 = 0;
+    matrix.m14 = 0;
+    
+    matrix.m21 = 0;
+    matrix.m22 = 2 * near / (top - bottom);
+    matrix.m23 = 0;
+    matrix.m24 = 0;
+    
+    matrix.m31 = A;
+    matrix.m32 = B;
+    matrix.m33 = C;
+    matrix.m34 = -1;
+    
+    matrix.m41 = 0;
+    matrix.m42 = 0;
+    matrix.m43 = D;
+    matrix.m44 = 0;
+    
+    this.multRight(matrix);
+}
+
+CanvasMatrix4.prototype.perspective = function(fovy, aspect, zNear, zFar)
+{
+    var top = Math.tan(fovy * Math.PI / 360) * zNear;
+    var bottom = -top;
+    var left = aspect * bottom;
+    var right = aspect * top;
+    this.frustum(left, right, bottom, top, zNear, zFar);
+}
+
+CanvasMatrix4.prototype.lookat = function(eyex, eyey, eyez, centerx, centery, centerz, upx, upy, upz)
+{
+    var matrix = new CanvasMatrix4();
+    
+    // Make rotation matrix
+
+    // Z vector
+    var zx = eyex - centerx;
+    var zy = eyey - centery;
+    var zz = eyez - centerz;
+    var mag = Math.sqrt(zx * zx + zy * zy + zz * zz);
+    if (mag) {
+        zx /= mag;
+        zy /= mag;
+        zz /= mag;
+    }
+
+    // Y vector
+    var yx = upx;
+    var yy = upy;
+    var yz = upz;
+
+    // X vector = Y cross Z
+    xx =  yy * zz - yz * zy;
+    xy = -yx * zz + yz * zx;
+    xz =  yx * zy - yy * zx;
+
+    // Recompute Y = Z cross X
+    yx = zy * xz - zz * xy;
+    yy = -zx * xz + zz * xx;
+    yx = zx * xy - zy * xx;
+
+    // cross product gives area of parallelogram, which is < 1.0 for
+    // non-perpendicular unit-length vectors; so normalize x, y here
+
+    mag = Math.sqrt(xx * xx + xy * xy + xz * xz);
+    if (mag) {
+        xx /= mag;
+        xy /= mag;
+        xz /= mag;
+    }
+
+    mag = Math.sqrt(yx * yx + yy * yy + yz * yz);
+    if (mag) {
+        yx /= mag;
+        yy /= mag;
+        yz /= mag;
+    }
+
+    matrix.m11 = xx;
+    matrix.m12 = xy;
+    matrix.m13 = xz;
+    matrix.m14 = 0;
+    
+    matrix.m21 = yx;
+    matrix.m22 = yy;
+    matrix.m23 = yz;
+    matrix.m24 = 0;
+    
+    matrix.m31 = zx;
+    matrix.m32 = zy;
+    matrix.m33 = zz;
+    matrix.m34 = 0;
+    
+    matrix.m41 = 0;
+    matrix.m42 = 0;
+    matrix.m43 = 0;
+    matrix.m44 = 1;
+    matrix.translate(-eyex, -eyey, -eyez);
+    
+    this.multRight(matrix);
+}
+
+// Support functions
+CanvasMatrix4.prototype._determinant2x2 = function(a, b, c, d)
+{
+    return a * d - b * c;
+}
+
+CanvasMatrix4.prototype._determinant3x3 = function(a1, a2, a3, b1, b2, b3, c1, c2, c3)
+{
+    return a1 * this._determinant2x2(b2, b3, c2, c3)
+         - b1 * this._determinant2x2(a2, a3, c2, c3)
+         + c1 * this._determinant2x2(a2, a3, b2, b3);
+}
+
+CanvasMatrix4.prototype._determinant4x4 = function()
+{
+    var a1 = this.m11;
+    var b1 = this.m12; 
+    var c1 = this.m13;
+    var d1 = this.m14;
+
+    var a2 = this.m21;
+    var b2 = this.m22; 
+    var c2 = this.m23;
+    var d2 = this.m24;
+
+    var a3 = this.m31;
+    var b3 = this.m32; 
+    var c3 = this.m33;
+    var d3 = this.m34;
+
+    var a4 = this.m41;
+    var b4 = this.m42; 
+    var c4 = this.m43;
+    var d4 = this.m44;
+
+    return a1 * this._determinant3x3(b2, b3, b4, c2, c3, c4, d2, d3, d4)
+         - b1 * this._determinant3x3(a2, a3, a4, c2, c3, c4, d2, d3, d4)
+         + c1 * this._determinant3x3(a2, a3, a4, b2, b3, b4, d2, d3, d4)
+         - d1 * this._determinant3x3(a2, a3, a4, b2, b3, b4, c2, c3, c4);
+}
+
+CanvasMatrix4.prototype._makeAdjoint = function()
+{
+    var a1 = this.m11;
+    var b1 = this.m12; 
+    var c1 = this.m13;
+    var d1 = this.m14;
+
+    var a2 = this.m21;
+    var b2 = this.m22; 
+    var c2 = this.m23;
+    var d2 = this.m24;
+
+    var a3 = this.m31;
+    var b3 = this.m32; 
+    var c3 = this.m33;
+    var d3 = this.m34;
+
+    var a4 = this.m41;
+    var b4 = this.m42; 
+    var c4 = this.m43;
+    var d4 = this.m44;
+
+    // Row column labeling reversed since we transpose rows & columns
+    this.m11  =   this._determinant3x3(b2, b3, b4, c2, c3, c4, d2, d3, d4);
+    this.m21  = - this._determinant3x3(a2, a3, a4, c2, c3, c4, d2, d3, d4);
+    this.m31  =   this._determinant3x3(a2, a3, a4, b2, b3, b4, d2, d3, d4);
+    this.m41  = - this._determinant3x3(a2, a3, a4, b2, b3, b4, c2, c3, c4);
+        
+    this.m12  = - this._determinant3x3(b1, b3, b4, c1, c3, c4, d1, d3, d4);
+    this.m22  =   this._determinant3x3(a1, a3, a4, c1, c3, c4, d1, d3, d4);
+    this.m32  = - this._determinant3x3(a1, a3, a4, b1, b3, b4, d1, d3, d4);
+    this.m42  =   this._determinant3x3(a1, a3, a4, b1, b3, b4, c1, c3, c4);
+        
+    this.m13  =   this._determinant3x3(b1, b2, b4, c1, c2, c4, d1, d2, d4);
+    this.m23  = - this._determinant3x3(a1, a2, a4, c1, c2, c4, d1, d2, d4);
+    this.m33  =   this._determinant3x3(a1, a2, a4, b1, b2, b4, d1, d2, d4);
+    this.m43  = - this._determinant3x3(a1, a2, a4, b1, b2, b4, c1, c2, c4);
+        
+    this.m14  = - this._determinant3x3(b1, b2, b3, c1, c2, c3, d1, d2, d3);
+    this.m24  =   this._determinant3x3(a1, a2, a3, c1, c2, c3, d1, d2, d3);
+    this.m34  = - this._determinant3x3(a1, a2, a3, b1, b2, b3, d1, d2, d3);
+    this.m44  =   this._determinant3x3(a1, a2, a3, b1, b2, b3, c1, c2, c3);
+}
diff --git a/WebCore/manual-tests/webgl/resources/earthmap1k.jpg b/WebCore/manual-tests/webgl/resources/earthmap1k.jpg
new file mode 100644
index 0000000..7dcab8a
--- /dev/null
+++ b/WebCore/manual-tests/webgl/resources/earthmap1k.jpg
diff --git a/WebCore/manual-tests/webgl/resources/mars500x250.png b/WebCore/manual-tests/webgl/resources/mars500x250.png
new file mode 100644
index 0000000..f38ef09
--- /dev/null
+++ b/WebCore/manual-tests/webgl/resources/mars500x250.png
diff --git a/WebCore/manual-tests/webgl/resources/teapot.obj b/WebCore/manual-tests/webgl/resources/teapot.obj
new file mode 100644
index 0000000..b6c6810
--- /dev/null
+++ b/WebCore/manual-tests/webgl/resources/teapot.obj
@@ -0,0 +1,2866 @@
+# Max2Obj Version 4.0 Mar 10th, 2001
+#
+# object Teapot01 to come ...
+#
+v  5.929688 4.125000 0.000000
+v  5.832031 4.494141 0.000000
+v  5.945313 4.617188 0.000000
+v  6.175781 4.494141 0.000000
+v  6.429688 4.125000 0.000000
+v  5.387188 4.125000 2.747500
+v  5.297100 4.494141 2.709170
+v  5.401602 4.617188 2.753633
+v  5.614209 4.494141 2.844092
+v  5.848437 4.125000 2.943750
+v  3.899688 4.125000 4.970000
+v  3.830352 4.494141 4.900664
+v  3.910782 4.617188 4.981094
+v  4.074414 4.494141 5.144727
+v  4.254687 4.125000 5.325000
+v  1.677188 4.125000 6.457500
+v  1.638858 4.494141 6.367412
+v  1.683320 4.617188 6.471914
+v  1.773780 4.494141 6.684522
+v  1.873438 4.125000 6.918750
+v  -1.070312 4.125000 7.000000
+v  -1.070312 4.494141 6.902344
+v  -1.070312 4.617188 7.015625
+v  -1.070312 4.494141 7.246094
+v  -1.070312 4.125000 7.500000
+v  -4.007656 4.125000 6.457500
+v  -3.859572 4.494141 6.367412
+v  -3.847676 4.617188 6.471914
+v  -3.917371 4.494141 6.684522
+v  -4.014062 4.125000 6.918750
+v  -6.209063 4.125000 4.970000
+v  -6.042168 4.494141 4.900664
+v  -6.072500 4.617188 4.981094
+v  -6.217675 4.494141 5.144727
+v  -6.395312 4.125000 5.325000
+v  -7.591093 4.125000 2.747500
+v  -7.464421 4.494141 2.709170
+v  -7.550137 4.617188 2.753633
+v  -7.755822 4.494141 2.844092
+v  -7.989062 4.125000 2.943750
+v  -8.070313 4.125000 0.000000
+v  -7.972656 4.494141 0.000000
+v  -8.085938 4.617188 0.000000
+v  -8.316406 4.494141 0.000000
+v  -8.570313 4.125000 0.000000
+v  -7.527812 4.125000 -2.747500
+v  -7.437724 4.494141 -2.709170
+v  -7.542227 4.617188 -2.753633
+v  -7.754834 4.494141 -2.844092
+v  -7.989062 4.125000 -2.943750
+v  -6.040312 4.125000 -4.970000
+v  -5.970977 4.494141 -4.900664
+v  -6.051406 4.617188 -4.981094
+v  -6.215039 4.494141 -5.144727
+v  -6.395312 4.125000 -5.325000
+v  -3.817812 4.125000 -6.457500
+v  -3.779482 4.494141 -6.367412
+v  -3.823945 4.617188 -6.471914
+v  -3.914404 4.494141 -6.684522
+v  -4.014062 4.125000 -6.918750
+v  -1.070312 4.125000 -7.000000
+v  -1.070312 4.494141 -6.902344
+v  -1.070312 4.617188 -7.015625
+v  -1.070312 4.494141 -7.246094
+v  -1.070312 4.125000 -7.500000
+v  1.677188 4.125000 -6.457500
+v  1.638858 4.494141 -6.367412
+v  1.683320 4.617188 -6.471914
+v  1.773780 4.494141 -6.684522
+v  1.873438 4.125000 -6.918750
+v  3.899688 4.125000 -4.970000
+v  3.830352 4.494141 -4.900664
+v  3.910782 4.617188 -4.981094
+v  4.074414 4.494141 -5.144727
+v  4.254687 4.125000 -5.325000
+v  5.387188 4.125000 -2.747500
+v  5.297100 4.494141 -2.709170
+v  5.401602 4.617188 -2.753633
+v  5.614209 4.494141 -2.844092
+v  5.848437 4.125000 -2.943750
+v  7.347656 2.162109 0.000000
+v  8.148438 0.234375 0.000000
+v  8.714844 -1.623047 0.000000
+v  8.929688 -3.375000 0.000000
+v  6.695264 2.162109 3.304053
+v  7.433985 0.234375 3.618360
+v  7.956494 -1.623047 3.840674
+v  8.154688 -3.375000 3.925000
+v  4.906446 2.162109 5.976758
+v  5.475000 0.234375 6.545312
+v  5.877149 -1.623047 6.947461
+v  6.029688 -3.375000 7.100000
+v  2.233740 2.162109 7.765576
+v  2.548047 0.234375 8.504297
+v  2.770362 -1.623047 9.026807
+v  2.854688 -3.375000 9.225000
+v  -1.070312 2.162109 8.417969
+v  -1.070312 0.234375 9.218750
+v  -1.070312 -1.623047 9.785156
+v  -1.070312 -3.375000 10.000000
+v  -4.374365 2.162109 7.765576
+v  -4.688672 0.234375 8.504297
+v  -4.910986 -1.623047 9.026807
+v  -4.995313 -3.375000 9.225000
+v  -7.047071 2.162109 5.976758
+v  -7.615624 0.234375 6.545312
+v  -8.017773 -1.623047 6.947461
+v  -8.170312 -3.375000 7.100000
+v  -8.835889 2.162109 3.304053
+v  -9.574610 0.234375 3.618360
+v  -10.097119 -1.623047 3.840674
+v  -10.295313 -3.375000 3.925000
+v  -9.488281 2.162109 0.000000
+v  -10.289063 0.234375 0.000000
+v  -10.855469 -1.623047 0.000000
+v  -11.070313 -3.375000 0.000000
+v  -8.835889 2.162109 -3.304053
+v  -9.574610 0.234375 -3.618360
+v  -10.097119 -1.623047 -3.840674
+v  -10.295313 -3.375000 -3.925000
+v  -7.047071 2.162109 -5.976758
+v  -7.615624 0.234375 -6.545312
+v  -8.017773 -1.623047 -6.947461
+v  -8.170312 -3.375000 -7.100000
+v  -4.374365 2.162109 -7.765576
+v  -4.688672 0.234375 -8.504297
+v  -4.910986 -1.623047 -9.026807
+v  -4.995313 -3.375000 -9.225000
+v  -1.070312 2.162109 -8.417969
+v  -1.070312 0.234375 -9.218750
+v  -1.070312 -1.623047 -9.785156
+v  -1.070312 -3.375000 -10.000000
+v  2.233740 2.162109 -7.765576
+v  2.548047 0.234375 -8.504297
+v  2.770362 -1.623047 -9.026807
+v  2.854688 -3.375000 -9.225000
+v  4.906446 2.162109 -5.976758
+v  5.475000 0.234375 -6.545312
+v  5.877149 -1.623047 -6.947461
+v  6.029688 -3.375000 -7.100000
+v  6.695264 2.162109 -3.304053
+v  7.433985 0.234375 -3.618360
+v  7.956494 -1.623047 -3.840674
+v  8.154688 -3.375000 -3.925000
+v  8.539063 -4.857422 0.000000
+v  7.679688 -5.953125 0.000000
+v  6.820313 -6.697266 0.000000
+v  6.429688 -7.125000 0.000000
+v  7.794336 -4.857422 3.771680
+v  7.001562 -5.953125 3.434375
+v  6.208789 -6.697266 3.097070
+v  5.848437 -7.125000 2.943750
+v  5.752343 -4.857422 6.822656
+v  5.142187 -5.953125 6.212500
+v  4.532031 -6.697266 5.602344
+v  4.254687 -7.125000 5.325000
+v  2.701367 -4.857422 8.864649
+v  2.364063 -5.953125 8.071875
+v  2.026758 -6.697266 7.279101
+v  1.873438 -7.125000 6.918750
+v  -1.070312 -4.857422 9.609375
+v  -1.070312 -5.953125 8.750000
+v  -1.070312 -6.697266 7.890625
+v  -1.070312 -7.125000 7.500000
+v  -4.841992 -4.857422 8.864649
+v  -4.504687 -5.953125 8.071875
+v  -4.167383 -6.697266 7.279101
+v  -4.014062 -7.125000 6.918750
+v  -7.892968 -4.857422 6.822656
+v  -7.282812 -5.953125 6.212500
+v  -6.672656 -6.697266 5.602344
+v  -6.395312 -7.125000 5.325000
+v  -9.934961 -4.857422 3.771680
+v  -9.142187 -5.953125 3.434375
+v  -8.349414 -6.697266 3.097070
+v  -7.989062 -7.125000 2.943750
+v  -10.679688 -4.857422 0.000000
+v  -9.820313 -5.953125 0.000000
+v  -8.960938 -6.697266 0.000000
+v  -8.570313 -7.125000 0.000000
+v  -9.934961 -4.857422 -3.771680
+v  -9.142187 -5.953125 -3.434375
+v  -8.349414 -6.697266 -3.097070
+v  -7.989062 -7.125000 -2.943750
+v  -7.892968 -4.857422 -6.822656
+v  -7.282812 -5.953125 -6.212500
+v  -6.672656 -6.697266 -5.602344
+v  -6.395312 -7.125000 -5.325000
+v  -4.841992 -4.857422 -8.864649
+v  -4.504687 -5.953125 -8.071875
+v  -4.167383 -6.697266 -7.279101
+v  -4.014062 -7.125000 -6.918750
+v  -1.070312 -4.857422 -9.609375
+v  -1.070312 -5.953125 -8.750000
+v  -1.070312 -6.697266 -7.890625
+v  -1.070312 -7.125000 -7.500000
+v  2.701367 -4.857422 -8.864649
+v  2.364063 -5.953125 -8.071875
+v  2.026758 -6.697266 -7.279101
+v  1.873438 -7.125000 -6.918750
+v  5.752343 -4.857422 -6.822656
+v  5.142187 -5.953125 -6.212500
+v  4.532031 -6.697266 -5.602344
+v  4.254687 -7.125000 -5.325000
+v  7.794336 -4.857422 -3.771680
+v  7.001562 -5.953125 -3.434375
+v  6.208789 -6.697266 -3.097070
+v  5.848437 -7.125000 -2.943750
+v  6.259766 -7.400391 0.000000
+v  5.351563 -7.640625 0.000000
+v  3.107422 -7.810547 0.000000
+v  -1.070312 -7.875000 0.000000
+v  5.691685 -7.400391 2.877056
+v  4.853868 -7.640625 2.520586
+v  2.783648 -7.810547 1.639761
+v  4.134043 -7.400391 5.204355
+v  3.489219 -7.640625 4.559531
+v  1.895879 -7.810547 2.966191
+v  1.806743 -7.400391 6.761997
+v  1.450274 -7.640625 5.924180
+v  0.569448 -7.810547 3.853960
+v  -1.070312 -7.400391 7.330078
+v  -1.070312 -7.640625 6.421875
+v  -1.070312 -7.810547 4.177734
+v  -3.947368 -7.400391 6.761997
+v  -3.590898 -7.640625 5.924180
+v  -2.710073 -7.810547 3.853960
+v  -6.274668 -7.400391 5.204355
+v  -5.629844 -7.640625 4.559531
+v  -4.036504 -7.810547 2.966191
+v  -7.832309 -7.400391 2.877056
+v  -6.994492 -7.640625 2.520586
+v  -4.924272 -7.810547 1.639761
+v  -8.400391 -7.400391 0.000000
+v  -7.492188 -7.640625 0.000000
+v  -5.248047 -7.810547 0.000000
+v  -7.832309 -7.400391 -2.877056
+v  -6.994492 -7.640625 -2.520586
+v  -4.924272 -7.810547 -1.639761
+v  -6.274668 -7.400391 -5.204355
+v  -5.629844 -7.640625 -4.559531
+v  -4.036504 -7.810547 -2.966191
+v  -3.947368 -7.400391 -6.761997
+v  -3.590898 -7.640625 -5.924180
+v  -2.710073 -7.810547 -3.853960
+v  -1.070312 -7.400391 -7.330078
+v  -1.070312 -7.640625 -6.421875
+v  -1.070312 -7.810547 -4.177734
+v  1.806743 -7.400391 -6.761997
+v  1.450274 -7.640625 -5.924180
+v  0.569448 -7.810547 -3.853960
+v  4.134043 -7.400391 -5.204355
+v  3.489219 -7.640625 -4.559531
+v  1.895879 -7.810547 -2.966191
+v  5.691685 -7.400391 -2.877056
+v  4.853868 -7.640625 -2.520586
+v  2.783648 -7.810547 -1.639761
+v  -9.070313 2.250000 0.000000
+v  -11.406250 2.232422 0.000000
+v  -13.132813 2.109375 0.000000
+v  -14.203125 1.775391 0.000000
+v  -14.570313 1.125000 0.000000
+v  -8.992188 2.425781 0.843750
+v  -11.475830 2.405457 0.843750
+v  -13.298828 2.263184 0.843750
+v  -14.421631 1.877014 0.843750
+v  -14.804688 1.125000 0.843750
+v  -8.820313 2.812500 1.125000
+v  -11.628906 2.786134 1.125000
+v  -13.664063 2.601563 1.125000
+v  -14.902344 2.100586 1.125000
+v  -15.320313 1.125000 1.125000
+v  -8.648438 3.199219 0.843750
+v  -11.781982 3.166809 0.843750
+v  -14.029297 2.939941 0.843750
+v  -15.383057 2.324158 0.843750
+v  -15.835938 1.125000 0.843750
+v  -8.570313 3.375000 0.000000
+v  -11.851563 3.339844 0.000000
+v  -14.195313 3.093750 0.000000
+v  -15.601563 2.425781 0.000000
+v  -16.070313 1.125000 0.000000
+v  -8.648438 3.199219 -0.843750
+v  -11.781982 3.166809 -0.843750
+v  -14.029297 2.939941 -0.843750
+v  -15.383057 2.324158 -0.843750
+v  -15.835938 1.125000 -0.843750
+v  -8.820313 2.812500 -1.125000
+v  -11.628906 2.786134 -1.125000
+v  -13.664063 2.601563 -1.125000
+v  -14.902344 2.100586 -1.125000
+v  -15.320313 1.125000 -1.125000
+v  -8.992188 2.425781 -0.843750
+v  -11.475830 2.405457 -0.843750
+v  -13.298828 2.263184 -0.843750
+v  -14.421631 1.877014 -0.843750
+v  -14.804688 1.125000 -0.843750
+v  -14.375000 0.105469 0.000000
+v  -13.757813 -1.125000 0.000000
+v  -12.671875 -2.355469 0.000000
+v  -11.070313 -3.375000 0.000000
+v  -14.588013 0.007050 0.843750
+v  -13.909180 -1.275146 0.843750
+v  -12.724976 -2.540863 0.843750
+v  -10.992188 -3.609375 0.843750
+v  -15.056641 -0.209473 1.125000
+v  -14.242188 -1.605469 1.125000
+v  -12.841797 -2.948730 1.125000
+v  -10.820313 -4.125000 1.125000
+v  -15.525269 -0.425995 0.843750
+v  -14.575195 -1.935791 0.843750
+v  -12.958618 -3.356598 0.843750
+v  -10.648438 -4.640625 0.843750
+v  -15.738281 -0.524414 0.000000
+v  -14.726563 -2.085938 0.000000
+v  -13.011719 -3.541992 0.000000
+v  -10.570313 -4.875000 0.000000
+v  -15.525269 -0.425995 -0.843750
+v  -14.575195 -1.935791 -0.843750
+v  -12.958618 -3.356598 -0.843750
+v  -10.648438 -4.640625 -0.843750
+v  -15.056641 -0.209473 -1.125000
+v  -14.242188 -1.605469 -1.125000
+v  -12.841797 -2.948730 -1.125000
+v  -10.820313 -4.125000 -1.125000
+v  -14.588013 0.007050 -0.843750
+v  -13.909180 -1.275146 -0.843750
+v  -12.724976 -2.540863 -0.843750
+v  -10.992188 -3.609375 -0.843750
+v  7.429688 -0.750000 0.000000
+v  9.828125 -0.199219 0.000000
+v  10.867188 1.125000 0.000000
+v  11.437500 2.730469 0.000000
+v  12.429688 4.125000 0.000000
+v  7.429688 -1.394531 1.856250
+v  10.011230 -0.677124 1.676074
+v  11.101563 0.846680 1.279688
+v  11.723145 2.629761 0.883301
+v  12.898438 4.125000 0.703125
+v  7.429688 -2.812500 2.475000
+v  10.414063 -1.728516 2.234766
+v  11.617188 0.234375 1.706250
+v  12.351563 2.408203 1.177734
+v  13.929688 4.125000 0.937500
+v  7.429688 -4.230469 1.856250
+v  10.816895 -2.779907 1.676074
+v  12.132813 -0.377930 1.279688
+v  12.979980 2.186646 0.883301
+v  14.960938 4.125000 0.703125
+v  7.429688 -4.875000 0.000000
+v  11.000000 -3.257813 0.000000
+v  12.367188 -0.656250 0.000000
+v  13.265625 2.085938 0.000000
+v  15.429688 4.125000 0.000000
+v  7.429688 -4.230469 -1.856250
+v  10.816895 -2.779907 -1.676074
+v  12.132813 -0.377930 -1.279688
+v  12.979980 2.186646 -0.883301
+v  14.960938 4.125000 -0.703125
+v  7.429688 -2.812500 -2.475000
+v  10.414063 -1.728516 -2.234766
+v  11.617188 0.234375 -1.706250
+v  12.351563 2.408203 -1.177734
+v  13.929688 4.125000 -0.937500
+v  7.429688 -1.394531 -1.856250
+v  10.011230 -0.677124 -1.676074
+v  11.101563 0.846680 -1.279688
+v  11.723145 2.629761 -0.883301
+v  12.898438 4.125000 -0.703125
+v  12.789063 4.335938 0.000000
+v  13.054688 4.406250 0.000000
+v  13.132813 4.335938 0.000000
+v  12.929688 4.125000 0.000000
+v  13.291077 4.346237 0.659180
+v  13.525879 4.422729 0.562500
+v  13.532898 4.350357 0.465820
+v  13.242188 4.125000 0.421875
+v  14.395508 4.368896 0.878906
+v  14.562500 4.458984 0.750000
+v  14.413086 4.382080 0.621094
+v  13.929688 4.125000 0.562500
+v  15.499939 4.391556 0.659180
+v  15.599121 4.495239 0.562500
+v  15.293274 4.413804 0.465820
+v  14.617188 4.125000 0.421875
+v  16.001953 4.401855 0.000000
+v  16.070313 4.511719 0.000000
+v  15.693359 4.428224 0.000000
+v  14.929688 4.125000 0.000000
+v  15.499939 4.391556 -0.659180
+v  15.599121 4.495239 -0.562500
+v  15.293274 4.413804 -0.465820
+v  14.617188 4.125000 -0.421875
+v  14.395508 4.368896 -0.878906
+v  14.562500 4.458984 -0.750000
+v  14.413086 4.382080 -0.621094
+v  13.929688 4.125000 -0.562500
+v  13.291077 4.346237 -0.659180
+v  13.525879 4.422729 -0.562500
+v  13.532898 4.350357 -0.465820
+v  13.242188 4.125000 -0.421875
+v  -1.070312 7.875000 0.000000
+v  0.632813 7.628906 0.000000
+v  0.554688 7.031250 0.000000
+v  -0.085937 6.292969 0.000000
+v  -0.070312 5.625000 0.000000
+v  0.501414 7.628906 0.670256
+v  0.429278 7.031250 0.639395
+v  -0.162029 6.292969 0.386960
+v  -0.147812 5.625000 0.392500
+v  0.140489 7.628906 1.210801
+v  0.084844 7.031250 1.155156
+v  -0.370879 6.292969 0.699434
+v  -0.360312 5.625000 0.710000
+v  -0.400056 7.628906 1.571726
+v  -0.430918 7.031250 1.499590
+v  -0.683352 6.292969 0.908284
+v  -0.677812 5.625000 0.922500
+v  -1.070312 7.628906 1.703125
+v  -1.070312 7.031250 1.625000
+v  -1.070312 6.292969 0.984375
+v  -1.070312 5.625000 1.000000
+v  -1.740569 7.628906 1.571726
+v  -1.709707 7.031250 1.499590
+v  -1.457273 6.292969 0.908284
+v  -1.462812 5.625000 0.922500
+v  -2.281113 7.628906 1.210801
+v  -2.225469 7.031250 1.155156
+v  -1.769746 6.292969 0.699434
+v  -1.780312 5.625000 0.710000
+v  -2.642038 7.628906 0.670256
+v  -2.569902 7.031250 0.639395
+v  -1.978596 6.292969 0.386960
+v  -1.992812 5.625000 0.392500
+v  -2.773438 7.628906 0.000000
+v  -2.695313 7.031250 0.000000
+v  -2.054687 6.292969 0.000000
+v  -2.070312 5.625000 0.000000
+v  -2.642038 7.628906 -0.670256
+v  -2.569902 7.031250 -0.639395
+v  -1.978596 6.292969 -0.386960
+v  -1.992812 5.625000 -0.392500
+v  -2.281113 7.628906 -1.210801
+v  -2.225469 7.031250 -1.155156
+v  -1.769746 6.292969 -0.699434
+v  -1.780312 5.625000 -0.710000
+v  -1.740569 7.628906 -1.571726
+v  -1.709707 7.031250 -1.499590
+v  -1.457273 6.292969 -0.908284
+v  -1.462812 5.625000 -0.922500
+v  -1.070312 7.628906 -1.703125
+v  -1.070312 7.031250 -1.625000
+v  -1.070312 6.292969 -0.984375
+v  -1.070312 5.625000 -1.000000
+v  -0.400056 7.628906 -1.571726
+v  -0.430918 7.031250 -1.499590
+v  -0.683352 6.292969 -0.908284
+v  -0.677812 5.625000 -0.922500
+v  0.140489 7.628906 -1.210801
+v  0.084844 7.031250 -1.155156
+v  -0.370879 6.292969 -0.699434
+v  -0.360312 5.625000 -0.710000
+v  0.501414 7.628906 -0.670256
+v  0.429278 7.031250 -0.639395
+v  -0.162029 6.292969 -0.386960
+v  -0.147812 5.625000 -0.392500
+v  1.210938 5.179688 0.000000
+v  3.054688 4.875000 0.000000
+v  4.710938 4.570313 0.000000
+v  5.429688 4.125000 0.000000
+v  1.034141 5.179688 0.895391
+v  2.735000 4.875000 1.619062
+v  4.262891 4.570313 2.269140
+v  4.925938 4.125000 2.551250
+v  0.549375 5.179688 1.619688
+v  1.858438 4.875000 2.928750
+v  3.034375 4.570313 4.104687
+v  3.544688 4.125000 4.615000
+v  -0.174922 5.179688 2.104453
+v  0.548750 4.875000 3.805313
+v  1.198828 4.570313 5.333203
+v  1.480938 4.125000 5.996250
+v  -1.070312 5.179688 2.281250
+v  -1.070312 4.875000 4.125000
+v  -1.070312 4.570313 5.781250
+v  -1.070312 4.125000 6.500000
+v  -1.965703 5.179688 2.104453
+v  -2.689375 4.875000 3.805313
+v  -3.339453 4.570313 5.333203
+v  -3.621562 4.125000 5.996250
+v  -2.690000 5.179688 1.619688
+v  -3.999062 4.875000 2.928750
+v  -5.174999 4.570313 4.104687
+v  -5.685312 4.125000 4.615000
+v  -3.174765 5.179688 0.895391
+v  -4.875625 4.875000 1.619062
+v  -6.403516 4.570313 2.269140
+v  -7.066563 4.125000 2.551250
+v  -3.351562 5.179688 0.000000
+v  -5.195313 4.875000 0.000000
+v  -6.851563 4.570313 0.000000
+v  -7.570313 4.125000 0.000000
+v  -3.174765 5.179688 -0.895391
+v  -4.875625 4.875000 -1.619062
+v  -6.403516 4.570313 -2.269140
+v  -7.066563 4.125000 -2.551250
+v  -2.690000 5.179688 -1.619688
+v  -3.999062 4.875000 -2.928750
+v  -5.174999 4.570313 -4.104687
+v  -5.685312 4.125000 -4.615000
+v  -1.965703 5.179688 -2.104453
+v  -2.689375 4.875000 -3.805313
+v  -3.339453 4.570313 -5.333203
+v  -3.621562 4.125000 -5.996250
+v  -1.070312 5.179688 -2.281250
+v  -1.070312 4.875000 -4.125000
+v  -1.070312 4.570313 -5.781250
+v  -1.070312 4.125000 -6.500000
+v  -0.174922 5.179688 -2.104453
+v  0.548750 4.875000 -3.805313
+v  1.198828 4.570313 -5.333203
+v  1.480938 4.125000 -5.996250
+v  0.549375 5.179688 -1.619688
+v  1.858438 4.875000 -2.928750
+v  3.034375 4.570313 -4.104687
+v  3.544688 4.125000 -4.615000
+v  1.034141 5.179688 -0.895391
+v  2.735000 4.875000 -1.619062
+v  4.262891 4.570313 -2.269140
+v  4.925938 4.125000 -2.551250
+# 530 vertices
+
+vt  2.000000 2.000000 0.000000
+vt  2.000000 1.975000 0.000000
+vt  2.000000 1.950000 0.000000
+vt  2.000000 1.925000 0.000000
+vt  2.000000 1.900000 0.000000
+vt  1.750000 2.000000 0.000000
+vt  1.750000 1.975000 0.000000
+vt  1.750000 1.950000 0.000000
+vt  1.750000 1.925000 0.000000
+vt  1.750000 1.900000 0.000000
+vt  1.500000 2.000000 0.000000
+vt  1.500000 1.975000 0.000000
+vt  1.500000 1.950000 0.000000
+vt  1.500000 1.925000 0.000000
+vt  1.500000 1.900000 0.000000
+vt  1.250000 2.000000 0.000000
+vt  1.250000 1.975000 0.000000
+vt  1.250000 1.950000 0.000000
+vt  1.250000 1.925000 0.000000
+vt  1.250000 1.900000 0.000000
+vt  1.000000 2.000000 0.000000
+vt  1.000000 1.975000 0.000000
+vt  1.000000 1.950000 0.000000
+vt  1.000000 1.925000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 2.000000 0.000000
+vt  1.000000 1.975000 0.000000
+vt  1.000000 1.950000 0.000000
+vt  1.000000 1.925000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  0.750000 2.000000 0.000000
+vt  0.750000 1.975000 0.000000
+vt  0.750000 1.950000 0.000000
+vt  0.750000 1.925000 0.000000
+vt  0.750000 1.900000 0.000000
+vt  0.500000 2.000000 0.000000
+vt  0.500000 1.975000 0.000000
+vt  0.500000 1.950000 0.000000
+vt  0.500000 1.925000 0.000000
+vt  0.500000 1.900000 0.000000
+vt  0.250000 2.000000 0.000000
+vt  0.250000 1.975000 0.000000
+vt  0.250000 1.950000 0.000000
+vt  0.250000 1.925000 0.000000
+vt  0.250000 1.900000 0.000000
+vt  0.000000 2.000000 0.000000
+vt  0.000000 1.975000 0.000000
+vt  0.000000 1.950000 0.000000
+vt  0.000000 1.925000 0.000000
+vt  0.000000 1.900000 0.000000
+vt  2.000000 2.000000 0.000000
+vt  2.000000 1.975000 0.000000
+vt  2.000000 1.950000 0.000000
+vt  2.000000 1.925000 0.000000
+vt  2.000000 1.900000 0.000000
+vt  1.750000 2.000000 0.000000
+vt  1.750000 1.975000 0.000000
+vt  1.750000 1.950000 0.000000
+vt  1.750000 1.925000 0.000000
+vt  1.750000 1.900000 0.000000
+vt  1.500000 2.000000 0.000000
+vt  1.500000 1.975000 0.000000
+vt  1.500000 1.950000 0.000000
+vt  1.500000 1.925000 0.000000
+vt  1.500000 1.900000 0.000000
+vt  1.250000 2.000000 0.000000
+vt  1.250000 1.975000 0.000000
+vt  1.250000 1.950000 0.000000
+vt  1.250000 1.925000 0.000000
+vt  1.250000 1.900000 0.000000
+vt  1.000000 2.000000 0.000000
+vt  1.000000 1.975000 0.000000
+vt  1.000000 1.950000 0.000000
+vt  1.000000 1.925000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 2.000000 0.000000
+vt  1.000000 1.975000 0.000000
+vt  1.000000 1.950000 0.000000
+vt  1.000000 1.925000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  0.750000 2.000000 0.000000
+vt  0.750000 1.975000 0.000000
+vt  0.750000 1.950000 0.000000
+vt  0.750000 1.925000 0.000000
+vt  0.750000 1.900000 0.000000
+vt  0.500000 2.000000 0.000000
+vt  0.500000 1.975000 0.000000
+vt  0.500000 1.950000 0.000000
+vt  0.500000 1.925000 0.000000
+vt  0.500000 1.900000 0.000000
+vt  0.250000 2.000000 0.000000
+vt  0.250000 1.975000 0.000000
+vt  0.250000 1.950000 0.000000
+vt  0.250000 1.925000 0.000000
+vt  0.250000 1.900000 0.000000
+vt  0.000000 2.000000 0.000000
+vt  0.000000 1.975000 0.000000
+vt  0.000000 1.950000 0.000000
+vt  0.000000 1.925000 0.000000
+vt  0.000000 1.900000 0.000000
+vt  2.000000 1.900000 0.000000
+vt  2.000000 1.675000 0.000000
+vt  2.000000 1.450000 0.000000
+vt  2.000000 1.225000 0.000000
+vt  2.000000 1.000000 0.000000
+vt  1.750000 1.900000 0.000000
+vt  1.750000 1.675000 0.000000
+vt  1.750000 1.450000 0.000000
+vt  1.750000 1.225000 0.000000
+vt  1.750000 1.000000 0.000000
+vt  1.500000 1.900000 0.000000
+vt  1.500000 1.675000 0.000000
+vt  1.500000 1.450000 0.000000
+vt  1.500000 1.225000 0.000000
+vt  1.500000 1.000000 0.000000
+vt  1.250000 1.900000 0.000000
+vt  1.250000 1.675000 0.000000
+vt  1.250000 1.450000 0.000000
+vt  1.250000 1.225000 0.000000
+vt  1.250000 1.000000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 1.675000 0.000000
+vt  1.000000 1.450000 0.000000
+vt  1.000000 1.225000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 1.675000 0.000000
+vt  1.000000 1.450000 0.000000
+vt  1.000000 1.225000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  0.750000 1.900000 0.000000
+vt  0.750000 1.675000 0.000000
+vt  0.750000 1.450000 0.000000
+vt  0.750000 1.225000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.500000 1.900000 0.000000
+vt  0.500000 1.675000 0.000000
+vt  0.500000 1.450000 0.000000
+vt  0.500000 1.225000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.250000 1.900000 0.000000
+vt  0.250000 1.675000 0.000000
+vt  0.250000 1.450000 0.000000
+vt  0.250000 1.225000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.000000 1.900000 0.000000
+vt  0.000000 1.675000 0.000000
+vt  0.000000 1.450000 0.000000
+vt  0.000000 1.225000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  2.000000 1.900000 0.000000
+vt  2.000000 1.675000 0.000000
+vt  2.000000 1.450000 0.000000
+vt  2.000000 1.225000 0.000000
+vt  2.000000 1.000000 0.000000
+vt  1.750000 1.900000 0.000000
+vt  1.750000 1.675000 0.000000
+vt  1.750000 1.450000 0.000000
+vt  1.750000 1.225000 0.000000
+vt  1.750000 1.000000 0.000000
+vt  1.500000 1.900000 0.000000
+vt  1.500000 1.675000 0.000000
+vt  1.500000 1.450000 0.000000
+vt  1.500000 1.225000 0.000000
+vt  1.500000 1.000000 0.000000
+vt  1.250000 1.900000 0.000000
+vt  1.250000 1.675000 0.000000
+vt  1.250000 1.450000 0.000000
+vt  1.250000 1.225000 0.000000
+vt  1.250000 1.000000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 1.675000 0.000000
+vt  1.000000 1.450000 0.000000
+vt  1.000000 1.225000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 1.675000 0.000000
+vt  1.000000 1.450000 0.000000
+vt  1.000000 1.225000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  0.750000 1.900000 0.000000
+vt  0.750000 1.675000 0.000000
+vt  0.750000 1.450000 0.000000
+vt  0.750000 1.225000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.500000 1.900000 0.000000
+vt  0.500000 1.675000 0.000000
+vt  0.500000 1.450000 0.000000
+vt  0.500000 1.225000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.250000 1.900000 0.000000
+vt  0.250000 1.675000 0.000000
+vt  0.250000 1.450000 0.000000
+vt  0.250000 1.225000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.000000 1.900000 0.000000
+vt  0.000000 1.675000 0.000000
+vt  0.000000 1.450000 0.000000
+vt  0.000000 1.225000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  2.000000 1.000000 0.000000
+vt  2.000000 0.850000 0.000000
+vt  2.000000 0.700000 0.000000
+vt  2.000000 0.550000 0.000000
+vt  2.000000 0.400000 0.000000
+vt  1.750000 1.000000 0.000000
+vt  1.750000 0.850000 0.000000
+vt  1.750000 0.700000 0.000000
+vt  1.750000 0.550000 0.000000
+vt  1.750000 0.400000 0.000000
+vt  1.500000 1.000000 0.000000
+vt  1.500000 0.850000 0.000000
+vt  1.500000 0.700000 0.000000
+vt  1.500000 0.550000 0.000000
+vt  1.500000 0.400000 0.000000
+vt  1.250000 1.000000 0.000000
+vt  1.250000 0.850000 0.000000
+vt  1.250000 0.700000 0.000000
+vt  1.250000 0.550000 0.000000
+vt  1.250000 0.400000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.850000 0.000000
+vt  1.000000 0.700000 0.000000
+vt  1.000000 0.550000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.850000 0.000000
+vt  1.000000 0.700000 0.000000
+vt  1.000000 0.550000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.850000 0.000000
+vt  0.750000 0.700000 0.000000
+vt  0.750000 0.550000 0.000000
+vt  0.750000 0.400000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.850000 0.000000
+vt  0.500000 0.700000 0.000000
+vt  0.500000 0.550000 0.000000
+vt  0.500000 0.400000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.850000 0.000000
+vt  0.250000 0.700000 0.000000
+vt  0.250000 0.550000 0.000000
+vt  0.250000 0.400000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.850000 0.000000
+vt  0.000000 0.700000 0.000000
+vt  0.000000 0.550000 0.000000
+vt  0.000000 0.400000 0.000000
+vt  2.000000 1.000000 0.000000
+vt  2.000000 0.850000 0.000000
+vt  2.000000 0.700000 0.000000
+vt  2.000000 0.550000 0.000000
+vt  2.000000 0.400000 0.000000
+vt  1.750000 1.000000 0.000000
+vt  1.750000 0.850000 0.000000
+vt  1.750000 0.700000 0.000000
+vt  1.750000 0.550000 0.000000
+vt  1.750000 0.400000 0.000000
+vt  1.500000 1.000000 0.000000
+vt  1.500000 0.850000 0.000000
+vt  1.500000 0.700000 0.000000
+vt  1.500000 0.550000 0.000000
+vt  1.500000 0.400000 0.000000
+vt  1.250000 1.000000 0.000000
+vt  1.250000 0.850000 0.000000
+vt  1.250000 0.700000 0.000000
+vt  1.250000 0.550000 0.000000
+vt  1.250000 0.400000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.850000 0.000000
+vt  1.000000 0.700000 0.000000
+vt  1.000000 0.550000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.850000 0.000000
+vt  1.000000 0.700000 0.000000
+vt  1.000000 0.550000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.850000 0.000000
+vt  0.750000 0.700000 0.000000
+vt  0.750000 0.550000 0.000000
+vt  0.750000 0.400000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.850000 0.000000
+vt  0.500000 0.700000 0.000000
+vt  0.500000 0.550000 0.000000
+vt  0.500000 0.400000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.850000 0.000000
+vt  0.250000 0.700000 0.000000
+vt  0.250000 0.550000 0.000000
+vt  0.250000 0.400000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.850000 0.000000
+vt  0.000000 0.700000 0.000000
+vt  0.000000 0.550000 0.000000
+vt  0.000000 0.400000 0.000000
+vt  2.000000 0.400000 0.000000
+vt  2.000000 0.300000 0.000000
+vt  2.000000 0.200000 0.000000
+vt  2.000000 0.100000 0.000000
+vt  2.000000 0.000000 0.000000
+vt  1.750000 0.400000 0.000000
+vt  1.750000 0.300000 0.000000
+vt  1.750000 0.200000 0.000000
+vt  1.750000 0.100000 0.000000
+vt  1.750000 0.000000 0.000000
+vt  1.500000 0.400000 0.000000
+vt  1.500000 0.300000 0.000000
+vt  1.500000 0.200000 0.000000
+vt  1.500000 0.100000 0.000000
+vt  1.500000 0.000000 0.000000
+vt  1.250000 0.400000 0.000000
+vt  1.250000 0.300000 0.000000
+vt  1.250000 0.200000 0.000000
+vt  1.250000 0.100000 0.000000
+vt  1.250000 0.000000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 0.300000 0.000000
+vt  1.000000 0.200000 0.000000
+vt  1.000000 0.100000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 0.300000 0.000000
+vt  1.000000 0.200000 0.000000
+vt  1.000000 0.100000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.750000 0.400000 0.000000
+vt  0.750000 0.300000 0.000000
+vt  0.750000 0.200000 0.000000
+vt  0.750000 0.100000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.500000 0.400000 0.000000
+vt  0.500000 0.300000 0.000000
+vt  0.500000 0.200000 0.000000
+vt  0.500000 0.100000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.250000 0.400000 0.000000
+vt  0.250000 0.300000 0.000000
+vt  0.250000 0.200000 0.000000
+vt  0.250000 0.100000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.000000 0.400000 0.000000
+vt  0.000000 0.300000 0.000000
+vt  0.000000 0.200000 0.000000
+vt  0.000000 0.100000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  2.000000 0.400000 0.000000
+vt  2.000000 0.300000 0.000000
+vt  2.000000 0.200000 0.000000
+vt  2.000000 0.100000 0.000000
+vt  2.000000 0.000000 0.000000
+vt  1.750000 0.400000 0.000000
+vt  1.750000 0.300000 0.000000
+vt  1.750000 0.200000 0.000000
+vt  1.750000 0.100000 0.000000
+vt  1.750000 0.000000 0.000000
+vt  1.500000 0.400000 0.000000
+vt  1.500000 0.300000 0.000000
+vt  1.500000 0.200000 0.000000
+vt  1.500000 0.100000 0.000000
+vt  1.500000 0.000000 0.000000
+vt  1.250000 0.400000 0.000000
+vt  1.250000 0.300000 0.000000
+vt  1.250000 0.200000 0.000000
+vt  1.250000 0.100000 0.000000
+vt  1.250000 0.000000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 0.300000 0.000000
+vt  1.000000 0.200000 0.000000
+vt  1.000000 0.100000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 0.300000 0.000000
+vt  1.000000 0.200000 0.000000
+vt  1.000000 0.100000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.750000 0.400000 0.000000
+vt  0.750000 0.300000 0.000000
+vt  0.750000 0.200000 0.000000
+vt  0.750000 0.100000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.500000 0.400000 0.000000
+vt  0.500000 0.300000 0.000000
+vt  0.500000 0.200000 0.000000
+vt  0.500000 0.100000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.250000 0.400000 0.000000
+vt  0.250000 0.300000 0.000000
+vt  0.250000 0.200000 0.000000
+vt  0.250000 0.100000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.000000 0.400000 0.000000
+vt  0.000000 0.300000 0.000000
+vt  0.000000 0.200000 0.000000
+vt  0.000000 0.100000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.875000 0.000000
+vt  1.000000 0.750000 0.000000
+vt  1.000000 0.625000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  0.875000 0.875000 0.000000
+vt  0.875000 0.750000 0.000000
+vt  0.875000 0.625000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.875000 0.000000
+vt  0.750000 0.750000 0.000000
+vt  0.750000 0.625000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.625000 0.875000 0.000000
+vt  0.625000 0.750000 0.000000
+vt  0.625000 0.625000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.875000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.625000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.875000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.625000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.375000 0.875000 0.000000
+vt  0.375000 0.750000 0.000000
+vt  0.375000 0.625000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.875000 0.000000
+vt  0.250000 0.750000 0.000000
+vt  0.250000 0.625000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.125000 0.875000 0.000000
+vt  0.125000 0.750000 0.000000
+vt  0.125000 0.625000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.875000 0.000000
+vt  0.000000 0.750000 0.000000
+vt  0.000000 0.625000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  1.000000 0.375000 0.000000
+vt  1.000000 0.250000 0.000000
+vt  1.000000 0.125000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.875000 0.375000 0.000000
+vt  0.875000 0.250000 0.000000
+vt  0.875000 0.125000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.750000 0.375000 0.000000
+vt  0.750000 0.250000 0.000000
+vt  0.750000 0.125000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.625000 0.375000 0.000000
+vt  0.625000 0.250000 0.000000
+vt  0.625000 0.125000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.375000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.125000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.375000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.125000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.375000 0.375000 0.000000
+vt  0.375000 0.250000 0.000000
+vt  0.375000 0.125000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.250000 0.375000 0.000000
+vt  0.250000 0.250000 0.000000
+vt  0.250000 0.125000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.125000 0.375000 0.000000
+vt  0.125000 0.250000 0.000000
+vt  0.125000 0.125000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  0.000000 0.375000 0.000000
+vt  0.000000 0.250000 0.000000
+vt  0.000000 0.125000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 0.225000 0.000000
+vt  0.500000 0.450000 0.000000
+vt  0.500000 0.675000 0.000000
+vt  0.500000 0.900000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.625000 0.225000 0.000000
+vt  0.625000 0.450000 0.000000
+vt  0.625000 0.675000 0.000000
+vt  0.625000 0.900000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.750000 0.225000 0.000000
+vt  0.750000 0.450000 0.000000
+vt  0.750000 0.675000 0.000000
+vt  0.750000 0.900000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.875000 0.225000 0.000000
+vt  0.875000 0.450000 0.000000
+vt  0.875000 0.675000 0.000000
+vt  0.875000 0.900000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  1.000000 0.225000 0.000000
+vt  1.000000 0.450000 0.000000
+vt  1.000000 0.675000 0.000000
+vt  1.000000 0.900000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  0.000000 0.225000 0.000000
+vt  0.000000 0.450000 0.000000
+vt  0.000000 0.675000 0.000000
+vt  0.000000 0.900000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.125000 0.225000 0.000000
+vt  0.125000 0.450000 0.000000
+vt  0.125000 0.675000 0.000000
+vt  0.125000 0.900000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.250000 0.225000 0.000000
+vt  0.250000 0.450000 0.000000
+vt  0.250000 0.675000 0.000000
+vt  0.250000 0.900000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.375000 0.225000 0.000000
+vt  0.375000 0.450000 0.000000
+vt  0.375000 0.675000 0.000000
+vt  0.375000 0.900000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 0.225000 0.000000
+vt  0.500000 0.450000 0.000000
+vt  0.500000 0.675000 0.000000
+vt  0.500000 0.900000 0.000000
+vt  0.500000 0.900000 0.000000
+vt  0.500000 0.925000 0.000000
+vt  0.500000 0.950000 0.000000
+vt  0.500000 0.975000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.625000 0.900000 0.000000
+vt  0.625000 0.925000 0.000000
+vt  0.625000 0.950000 0.000000
+vt  0.625000 0.975000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.750000 0.900000 0.000000
+vt  0.750000 0.925000 0.000000
+vt  0.750000 0.950000 0.000000
+vt  0.750000 0.975000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.875000 0.900000 0.000000
+vt  0.875000 0.925000 0.000000
+vt  0.875000 0.950000 0.000000
+vt  0.875000 0.975000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  1.000000 0.900000 0.000000
+vt  1.000000 0.925000 0.000000
+vt  1.000000 0.950000 0.000000
+vt  1.000000 0.975000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  0.000000 0.900000 0.000000
+vt  0.000000 0.925000 0.000000
+vt  0.000000 0.950000 0.000000
+vt  0.000000 0.975000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.125000 0.900000 0.000000
+vt  0.125000 0.925000 0.000000
+vt  0.125000 0.950000 0.000000
+vt  0.125000 0.975000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.250000 0.900000 0.000000
+vt  0.250000 0.925000 0.000000
+vt  0.250000 0.950000 0.000000
+vt  0.250000 0.975000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.375000 0.900000 0.000000
+vt  0.375000 0.925000 0.000000
+vt  0.375000 0.950000 0.000000
+vt  0.375000 0.975000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.500000 0.900000 0.000000
+vt  0.500000 0.925000 0.000000
+vt  0.500000 0.950000 0.000000
+vt  0.500000 0.975000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.750000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  1.000000 0.250000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  0.875000 0.750000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.875000 0.250000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.750000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.750000 0.250000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.625000 0.750000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.625000 0.250000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.375000 0.750000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.375000 0.250000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.750000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.250000 0.250000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.125000 0.750000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.125000 0.250000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.750000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  0.000000 0.250000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.750000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  1.000000 0.250000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  0.875000 0.750000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.875000 0.250000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.750000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.750000 0.250000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.625000 0.750000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.625000 0.250000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.375000 0.750000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.375000 0.250000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.750000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.250000 0.250000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.125000 0.750000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.125000 0.250000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.750000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  0.000000 0.250000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.750000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  1.000000 0.250000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  0.875000 0.750000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.875000 0.250000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.750000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.750000 0.250000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.625000 0.750000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.625000 0.250000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.375000 0.750000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.375000 0.250000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.750000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.250000 0.250000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.125000 0.750000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.125000 0.250000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.750000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  0.000000 0.250000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.750000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  1.000000 0.250000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  0.875000 0.750000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.875000 0.250000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.750000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.750000 0.250000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.625000 0.750000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.625000 0.250000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.375000 0.750000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.375000 0.250000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.750000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.250000 0.250000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.125000 0.750000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.125000 0.250000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.750000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  0.000000 0.250000 0.000000
+vt  0.000000 0.000000 0.000000
+# 800 texture vertices
+
+vn  -0.966742 -0.255752 0.000000
+vn  -0.966824 0.255443 0.000000
+vn  -0.092052 0.995754 0.000000
+vn  0.682050 0.731305 0.000000
+vn  0.870301 0.492521 0.000000
+vn  -0.893014 -0.256345 -0.369882
+vn  -0.893437 0.255996 -0.369102
+vn  -0.083877 0.995843 -0.035507
+vn  0.629724 0.731860 0.260439
+vn  0.803725 0.493370 0.332584
+vn  -0.683407 -0.256728 -0.683407
+vn  -0.683531 0.256068 -0.683531
+vn  -0.064925 0.995776 -0.064925
+vn  0.481399 0.732469 0.481399
+vn  0.614804 0.493997 0.614804
+vn  -0.369882 -0.256345 -0.893014
+vn  -0.369102 0.255996 -0.893437
+vn  -0.035507 0.995843 -0.083877
+vn  0.260439 0.731860 0.629724
+vn  0.332584 0.493369 0.803725
+vn  -0.002848 -0.257863 -0.966177
+vn  -0.001923 0.254736 -0.967009
+vn  -0.000266 0.995734 -0.092270
+vn  0.000024 0.731295 0.682061
+vn  -0.000000 0.492521 0.870301
+vn  0.379058 -0.359300 -0.852771
+vn  0.377110 0.149085 -0.914091
+vn  0.027502 0.992081 -0.122552
+vn  -0.261010 0.726762 0.635367
+vn  -0.332485 0.492546 0.804271
+vn  0.663548 -0.410790 -0.625264
+vn  0.712664 0.073722 -0.697621
+vn  0.099726 0.987509 -0.121983
+vn  -0.487320 0.723754 0.488569
+vn  -0.615242 0.492602 0.615484
+vn  0.880028 -0.332906 -0.338709
+vn  0.917276 0.167113 -0.361493
+vn  0.113584 0.992365 -0.048070
+vn  -0.634150 0.727508 0.261889
+vn  -0.804126 0.492634 0.332705
+vn  0.966690 -0.255738 0.010454
+vn  0.967442 0.252962 0.008103
+vn  0.093436 0.995624 0.001281
+vn  -0.682167 0.731196 -0.000343
+vn  -0.870322 0.492483 -0.000054
+vn  0.893014 -0.256345 0.369882
+vn  0.893437 0.255996 0.369102
+vn  0.083877 0.995843 0.035507
+vn  -0.629724 0.731860 -0.260439
+vn  -0.803725 0.493370 -0.332584
+vn  0.683407 -0.256728 0.683407
+vn  0.683531 0.256068 0.683531
+vn  0.064925 0.995776 0.064925
+vn  -0.481399 0.732469 -0.481399
+vn  -0.614804 0.493997 -0.614804
+vn  0.369882 -0.256345 0.893014
+vn  0.369102 0.255996 0.893437
+vn  0.035507 0.995843 0.083877
+vn  -0.260439 0.731860 -0.629724
+vn  -0.332584 0.493369 -0.803725
+vn  0.000000 -0.255752 0.966742
+vn  0.000000 0.255443 0.966824
+vn  0.000000 0.995754 0.092052
+vn  0.000000 0.731305 -0.682050
+vn  0.000000 0.492521 -0.870301
+vn  -0.369882 -0.256345 0.893014
+vn  -0.369102 0.255996 0.893437
+vn  -0.035507 0.995843 0.083877
+vn  0.260439 0.731860 -0.629724
+vn  0.332584 0.493370 -0.803725
+vn  -0.683407 -0.256728 0.683407
+vn  -0.683531 0.256068 0.683531
+vn  -0.064925 0.995776 0.064925
+vn  0.481399 0.732469 -0.481399
+vn  0.614804 0.493997 -0.614804
+vn  -0.893014 -0.256345 0.369882
+vn  -0.893437 0.255996 0.369102
+vn  -0.083877 0.995843 0.035507
+vn  0.629724 0.731860 -0.260439
+vn  0.803725 0.493369 -0.332584
+vn  0.915321 0.402725 -0.000000
+vn  0.941808 0.336151 0.000000
+vn  0.978690 0.205342 0.000000
+vn  0.997804 -0.066240 -0.000000
+vn  0.845438 0.403546 0.349835
+vn  0.869996 0.336859 0.360047
+vn  0.904193 0.205791 0.374280
+vn  0.921879 -0.066370 0.381752
+vn  0.646802 0.404096 0.646802
+vn  0.665655 0.337351 0.665655
+vn  0.691923 0.206120 0.691923
+vn  0.705543 -0.066480 0.705542
+vn  0.349835 0.403546 0.845438
+vn  0.360047 0.336859 0.869996
+vn  0.374280 0.205791 0.904193
+vn  0.381752 -0.066369 0.921879
+vn  0.000000 0.402725 0.915321
+vn  -0.000000 0.336151 0.941808
+vn  0.000000 0.205342 0.978690
+vn  0.000000 -0.066240 0.997804
+vn  -0.349835 0.403546 0.845438
+vn  -0.360047 0.336859 0.869996
+vn  -0.374280 0.205791 0.904193
+vn  -0.381752 -0.066370 0.921879
+vn  -0.646802 0.404096 0.646802
+vn  -0.665655 0.337351 0.665655
+vn  -0.691923 0.206120 0.691923
+vn  -0.705542 -0.066480 0.705543
+vn  -0.845438 0.403546 0.349835
+vn  -0.869996 0.336859 0.360047
+vn  -0.904193 0.205791 0.374280
+vn  -0.921879 -0.066369 0.381752
+vn  -0.915321 0.402725 0.000000
+vn  -0.941808 0.336151 -0.000000
+vn  -0.978690 0.205342 0.000000
+vn  -0.997804 -0.066240 0.000000
+vn  -0.845438 0.403546 -0.349835
+vn  -0.869996 0.336859 -0.360047
+vn  -0.904193 0.205791 -0.374280
+vn  -0.921879 -0.066370 -0.381752
+vn  -0.646802 0.404096 -0.646802
+vn  -0.665655 0.337351 -0.665655
+vn  -0.691923 0.206120 -0.691923
+vn  -0.705543 -0.066480 -0.705542
+vn  -0.349835 0.403546 -0.845438
+vn  -0.360047 0.336859 -0.869996
+vn  -0.374280 0.205791 -0.904193
+vn  -0.381752 -0.066369 -0.921879
+vn  -0.000000 0.402725 -0.915321
+vn  0.000000 0.336151 -0.941808
+vn  -0.000000 0.205342 -0.978690
+vn  -0.000000 -0.066240 -0.997804
+vn  0.349835 0.403546 -0.845438
+vn  0.360047 0.336859 -0.869996
+vn  0.374280 0.205791 -0.904193
+vn  0.381752 -0.066370 -0.921879
+vn  0.646802 0.404096 -0.646802
+vn  0.665655 0.337351 -0.665655
+vn  0.691923 0.206120 -0.691923
+vn  0.705542 -0.066480 -0.705543
+vn  0.845438 0.403546 -0.349835
+vn  0.869996 0.336859 -0.360047
+vn  0.904193 0.205791 -0.374280
+vn  0.921879 -0.066369 -0.381752
+vn  0.900182 -0.435513 0.000000
+vn  0.729611 -0.683863 0.000000
+vn  0.693951 -0.720022 -0.000000
+vn  0.793950 -0.607983 0.000000
+vn  0.831437 -0.436180 0.344179
+vn  0.673512 -0.684666 0.278594
+vn  0.640399 -0.720924 0.264874
+vn  0.732949 -0.608995 0.303167
+vn  0.636092 -0.436778 0.636092
+vn  0.514965 -0.685290 0.514965
+vn  0.489651 -0.721446 0.489651
+vn  0.560555 -0.609554 0.560555
+vn  0.344179 -0.436180 0.831437
+vn  0.278595 -0.684666 0.673512
+vn  0.264874 -0.720924 0.640399
+vn  0.303167 -0.608995 0.732949
+vn  -0.000000 -0.435513 0.900182
+vn  -0.000000 -0.683863 0.729611
+vn  0.000000 -0.720022 0.693951
+vn  -0.000000 -0.607983 0.793950
+vn  -0.344179 -0.436180 0.831437
+vn  -0.278594 -0.684666 0.673512
+vn  -0.264874 -0.720924 0.640399
+vn  -0.303167 -0.608995 0.732949
+vn  -0.636092 -0.436778 0.636092
+vn  -0.514965 -0.685290 0.514965
+vn  -0.489651 -0.721446 0.489651
+vn  -0.560555 -0.609554 0.560555
+vn  -0.831437 -0.436180 0.344179
+vn  -0.673512 -0.684666 0.278595
+vn  -0.640399 -0.720924 0.264874
+vn  -0.732949 -0.608995 0.303167
+vn  -0.900182 -0.435513 -0.000000
+vn  -0.729611 -0.683863 -0.000000
+vn  -0.693951 -0.720022 0.000000
+vn  -0.793950 -0.607983 -0.000000
+vn  -0.831437 -0.436180 -0.344179
+vn  -0.673512 -0.684666 -0.278594
+vn  -0.640399 -0.720924 -0.264874
+vn  -0.732949 -0.608995 -0.303167
+vn  -0.636092 -0.436778 -0.636092
+vn  -0.514965 -0.685290 -0.514965
+vn  -0.489651 -0.721446 -0.489651
+vn  -0.560555 -0.609554 -0.560555
+vn  -0.344179 -0.436180 -0.831437
+vn  -0.278595 -0.684666 -0.673512
+vn  -0.264874 -0.720924 -0.640399
+vn  -0.303167 -0.608995 -0.732949
+vn  0.000000 -0.435513 -0.900182
+vn  0.000000 -0.683863 -0.729611
+vn  -0.000000 -0.720022 -0.693951
+vn  0.000000 -0.607983 -0.793950
+vn  0.344179 -0.436180 -0.831437
+vn  0.278594 -0.684666 -0.673512
+vn  0.264874 -0.720924 -0.640399
+vn  0.303167 -0.608995 -0.732949
+vn  0.636092 -0.436778 -0.636092
+vn  0.514965 -0.685290 -0.514965
+vn  0.489651 -0.721446 -0.489651
+vn  0.560555 -0.609554 -0.560555
+vn  0.831437 -0.436180 -0.344179
+vn  0.673512 -0.684666 -0.278595
+vn  0.640399 -0.720924 -0.264874
+vn  0.732949 -0.608995 -0.303167
+vn  0.623860 -0.781536 0.000000
+vn  0.177291 -0.984159 -0.000000
+vn  0.049207 -0.998789 0.000000
+vn  0.000000 -1.000000 0.000000
+vn  0.576230 -0.781801 0.238217
+vn  0.163628 -0.984208 0.067527
+vn  0.045422 -0.998792 0.018736
+vn  0.440416 -0.782348 0.440416
+vn  0.124903 -0.984276 0.124903
+vn  0.034662 -0.998798 0.034662
+vn  0.238217 -0.781801 0.576230
+vn  0.067527 -0.984208 0.163628
+vn  0.018736 -0.998792 0.045422
+vn  -0.000000 -0.781536 0.623860
+vn  0.000000 -0.984159 0.177291
+vn  -0.000000 -0.998789 0.049207
+vn  -0.238217 -0.781801 0.576230
+vn  -0.067527 -0.984208 0.163628
+vn  -0.018736 -0.998792 0.045422
+vn  -0.440416 -0.782348 0.440416
+vn  -0.124903 -0.984276 0.124903
+vn  -0.034662 -0.998798 0.034662
+vn  -0.576230 -0.781801 0.238217
+vn  -0.163628 -0.984208 0.067527
+vn  -0.045422 -0.998792 0.018736
+vn  -0.623860 -0.781536 -0.000000
+vn  -0.177291 -0.984159 0.000000
+vn  -0.049207 -0.998789 -0.000000
+vn  -0.576230 -0.781801 -0.238217
+vn  -0.163628 -0.984208 -0.067527
+vn  -0.045422 -0.998792 -0.018736
+vn  -0.440416 -0.782348 -0.440416
+vn  -0.124903 -0.984276 -0.124903
+vn  -0.034662 -0.998798 -0.034662
+vn  -0.238217 -0.781801 -0.576230
+vn  -0.067527 -0.984208 -0.163628
+vn  -0.018736 -0.998792 -0.045422
+vn  0.000000 -0.781536 -0.623860
+vn  -0.000000 -0.984159 -0.177291
+vn  0.000000 -0.998789 -0.049207
+vn  0.238217 -0.781801 -0.576230
+vn  0.067527 -0.984208 -0.163628
+vn  0.018736 -0.998792 -0.045422
+vn  0.440416 -0.782348 -0.440416
+vn  0.124903 -0.984276 -0.124903
+vn  0.034662 -0.998798 -0.034662
+vn  0.576230 -0.781801 -0.238217
+vn  0.163628 -0.984208 -0.067527
+vn  0.045422 -0.998792 -0.018736
+vn  0.007786 -0.999970 -0.000216
+vn  0.039138 -0.999233 -0.000989
+vn  0.179512 -0.983746 -0.004369
+vn  0.612299 -0.790557 -0.010460
+vn  0.986152 -0.165708 -0.006670
+vn  0.007039 -0.812495 0.582926
+vn  0.036127 -0.837257 0.545614
+vn  0.161846 -0.810421 0.563048
+vn  0.482365 -0.595148 0.642746
+vn  0.738720 -0.114594 0.664199
+vn  -0.001909 0.162121 0.986769
+vn  0.002762 0.017107 0.999850
+vn  0.010533 0.073398 0.997247
+vn  -0.066041 0.130070 0.989303
+vn  -0.094427 0.016594 0.995393
+vn  -0.009203 0.871509 0.490293
+vn  -0.048606 0.840609 0.539457
+vn  -0.223298 0.802880 0.552739
+vn  -0.596365 0.559971 0.575135
+vn  -0.803337 0.068236 0.591603
+vn  -0.010561 0.999944 0.000103
+vn  -0.058798 0.998270 0.000710
+vn  -0.280710 0.959787 0.003269
+vn  -0.749723 0.661738 0.004268
+vn  -0.997351 0.072714 0.002059
+vn  -0.008792 0.871493 -0.490330
+vn  -0.046494 0.841178 -0.538756
+vn  -0.217909 0.806807 -0.549161
+vn  -0.597291 0.560026 -0.574121
+vn  -0.804000 0.062913 -0.591292
+vn  -0.001806 0.161691 -0.986840
+vn  0.002031 0.014555 -0.999892
+vn  0.009215 0.060069 -0.998152
+vn  -0.059334 0.113865 -0.991723
+vn  -0.086899 0.012290 -0.996141
+vn  0.006418 -0.812379 -0.583095
+vn  0.033783 -0.837512 -0.545373
+vn  0.157113 -0.811947 -0.562190
+vn  0.484406 -0.589366 -0.646528
+vn  0.738870 -0.101320 -0.666187
+vn  0.946512 0.322650 -0.003357
+vn  0.825830 0.563870 -0.007452
+vn  0.650011 0.759893 -0.006937
+vn  0.532429 0.846459 -0.005245
+vn  0.725608 0.259351 0.637361
+vn  0.645945 0.461988 0.607719
+vn  0.531615 0.636660 0.558614
+vn  0.424964 0.681717 0.595540
+vn  -0.049562 -0.019755 0.998576
+vn  -0.037816 -0.035624 0.998650
+vn  -0.037914 -0.036512 0.998614
+vn  -0.168854 -0.297945 0.939530
+vn  -0.742342 -0.299166 0.599523
+vn  -0.619602 -0.529406 0.579502
+vn  -0.483708 -0.685760 0.543837
+vn  -0.445293 -0.794355 0.413177
+vn  -0.926513 -0.376258 0.001996
+vn  -0.753920 -0.656952 0.004317
+vn  -0.566224 -0.824244 0.003461
+vn  -0.481804 -0.876277 0.001850
+vn  -0.744675 -0.294425 -0.598977
+vn  -0.621949 -0.528114 -0.578165
+vn  -0.481171 -0.688340 -0.542828
+vn  -0.438055 -0.797035 -0.415744
+vn  -0.044337 -0.017056 -0.998871
+vn  -0.026176 -0.028166 -0.999260
+vn  -0.025294 -0.028332 -0.999278
+vn  -0.157482 -0.289392 -0.944167
+vn  0.728244 0.252410 -0.637142
+vn  0.647055 0.459725 -0.608254
+vn  0.522994 0.640657 -0.562170
+vn  0.409978 0.682857 -0.604669
+vn  -0.230787 0.972982 -0.006523
+vn  -0.548936 0.835863 -0.001511
+vn  -0.875671 0.482806 0.009893
+vn  -0.877554 0.479097 0.019092
+vn  -0.696190 0.717439 0.024497
+vn  -0.152877 0.687211 0.710190
+vn  -0.316721 0.637750 0.702113
+vn  -0.601067 0.471452 0.645330
+vn  -0.635889 0.446090 0.629801
+vn  -0.435746 0.601008 0.670011
+vn  0.111113 -0.085070 0.990160
+vn  0.223310 0.006540 0.974726
+vn  0.190097 0.154964 0.969458
+vn  0.005271 0.189482 0.981870
+vn  -0.011752 0.246688 0.969024
+vn  0.343906 -0.722796 0.599412
+vn  0.572489 -0.567656 0.591627
+vn  0.787436 -0.256459 0.560512
+vn  0.647097 -0.306374 0.698141
+vn  0.427528 -0.499343 0.753576
+vn  0.410926 -0.911668 0.001284
+vn  0.671520 -0.740986 -0.000899
+vn  0.922026 -0.387060 -0.007253
+vn  0.846910 -0.531556 -0.013854
+vn  0.535924 -0.844201 -0.010505
+vn  0.341188 -0.722823 -0.600931
+vn  0.578664 -0.561139 -0.591838
+vn  0.784869 -0.251020 -0.566542
+vn  0.642681 -0.302257 -0.703990
+vn  0.418589 -0.500042 -0.758117
+vn  0.115806 -0.079139 -0.990114
+vn  0.232811 0.012565 -0.972441
+vn  0.206662 0.153601 -0.966280
+vn  0.024500 0.161443 -0.986578
+vn  0.003382 0.211115 -0.977455
+vn  -0.134912 0.687491 -0.713551
+vn  -0.319540 0.633073 -0.705063
+vn  -0.603902 0.461442 -0.649903
+vn  -0.631815 0.437169 -0.640072
+vn  -0.424306 0.612706 -0.666750
+vn  -0.425801 0.904753 0.010805
+vn  0.022046 0.999756 0.001623
+vn  0.999598 0.025875 0.011556
+vn  0.709587 -0.704552 0.009672
+vn  -0.259858 0.791937 0.552548
+vn  0.009539 0.999720 -0.021674
+vn  0.410157 0.332912 -0.849082
+vn  0.541523 -0.548619 -0.637001
+vn  0.046311 0.455223 0.889172
+vn  -0.010688 0.988794 0.148900
+vn  -0.044376 0.682946 -0.729120
+vn  0.122824 0.009233 -0.992385
+vn  0.481839 -0.180440 0.857480
+vn  0.455272 0.736752 0.499925
+vn  -0.220542 0.907193 -0.358277
+vn  -0.235919 0.657250 -0.715797
+vn  0.728094 -0.685300 -0.015585
+vn  0.888738 0.458112 -0.016679
+vn  -0.260098 0.965582 0.000800
+vn  -0.371611 0.928378 -0.004418
+vn  0.480165 -0.178362 -0.858853
+vn  0.488102 0.716802 -0.497947
+vn  -0.222004 0.905399 0.361892
+vn  -0.235405 0.663180 0.710477
+vn  0.058720 0.437702 -0.897200
+vn  0.001326 0.986459 -0.164002
+vn  -0.044190 0.681675 0.730319
+vn  0.138801 -0.034188 0.989730
+vn  -0.258890 0.797206 -0.545380
+vn  0.012270 0.999739 0.019287
+vn  0.398632 0.354890 0.845663
+vn  0.537564 -0.581398 0.610738
+vn  0.000000 1.000000 0.000000
+vn  0.824540 0.565804 0.000017
+vn  0.917701 -0.397272 0.000034
+vn  0.935269 -0.353939 0.000113
+vn  0.780712 0.624890 0.000075
+vn  0.762640 0.565035 0.314825
+vn  0.847982 -0.397998 0.350034
+vn  0.864141 -0.355261 0.356441
+vn  0.720992 0.625625 0.297933
+vn  0.583357 0.565165 0.583338
+vn  0.648485 -0.398726 0.648448
+vn  0.660872 -0.355894 0.660748
+vn  0.551862 0.625290 0.551780
+vn  0.314824 0.565051 0.762629
+vn  0.350045 -0.397976 0.847988
+vn  0.356474 -0.355199 0.864153
+vn  0.297983 0.625515 0.721067
+vn  -0.000017 0.565804 0.824540
+vn  -0.000034 -0.397272 0.917701
+vn  -0.000113 -0.353939 0.935269
+vn  -0.000075 0.624890 0.780712
+vn  -0.314825 0.565035 0.762640
+vn  -0.350034 -0.397998 0.847982
+vn  -0.356441 -0.355261 0.864141
+vn  -0.297933 0.625625 0.720992
+vn  -0.583338 0.565165 0.583357
+vn  -0.648448 -0.398726 0.648485
+vn  -0.660748 -0.355894 0.660872
+vn  -0.551780 0.625290 0.551862
+vn  -0.762629 0.565051 0.314824
+vn  -0.847988 -0.397976 0.350045
+vn  -0.864153 -0.355199 0.356474
+vn  -0.721067 0.625515 0.297983
+vn  -0.824540 0.565804 -0.000017
+vn  -0.917701 -0.397272 -0.000034
+vn  -0.935269 -0.353939 -0.000113
+vn  -0.780712 0.624890 -0.000075
+vn  -0.762640 0.565035 -0.314825
+vn  -0.847982 -0.397998 -0.350034
+vn  -0.864141 -0.355261 -0.356441
+vn  -0.720992 0.625625 -0.297933
+vn  -0.583357 0.565165 -0.583338
+vn  -0.648485 -0.398726 -0.648448
+vn  -0.660872 -0.355894 -0.660748
+vn  -0.551862 0.625290 -0.551780
+vn  -0.314824 0.565051 -0.762629
+vn  -0.350045 -0.397976 -0.847988
+vn  -0.356474 -0.355199 -0.864153
+vn  -0.297983 0.625515 -0.721067
+vn  0.000017 0.565804 -0.824540
+vn  0.000034 -0.397272 -0.917701
+vn  0.000113 -0.353939 -0.935269
+vn  0.000075 0.624890 -0.780712
+vn  0.314825 0.565035 -0.762640
+vn  0.350034 -0.397998 -0.847982
+vn  0.356441 -0.355261 -0.864141
+vn  0.297933 0.625625 -0.720992
+vn  0.583338 0.565165 -0.583357
+vn  0.648448 -0.398726 -0.648485
+vn  0.660748 -0.355894 -0.660872
+vn  0.551780 0.625290 -0.551862
+vn  0.762629 0.565051 -0.314824
+vn  0.847988 -0.397976 -0.350045
+vn  0.864153 -0.355199 -0.356474
+vn  0.721067 0.625515 -0.297983
+vn  0.236583 0.971611 -0.000000
+vn  0.173084 0.984907 -0.000000
+vn  0.379703 0.925108 -0.000000
+vn  0.526673 0.850068 0.000000
+vn  0.217978 0.971775 0.090216
+vn  0.159589 0.984977 0.065961
+vn  0.350498 0.925311 0.144740
+vn  0.485590 0.850653 0.201474
+vn  0.166631 0.971838 0.166631
+vn  0.121908 0.985026 0.121908
+vn  0.267668 0.925585 0.267668
+vn  0.371315 0.851029 0.371315
+vn  0.090216 0.971775 0.217978
+vn  0.065961 0.984977 0.159589
+vn  0.144740 0.925311 0.350498
+vn  0.201475 0.850653 0.485590
+vn  0.000000 0.971611 0.236583
+vn  0.000000 0.984907 0.173084
+vn  0.000000 0.925108 0.379703
+vn  -0.000000 0.850068 0.526673
+vn  -0.090216 0.971775 0.217978
+vn  -0.065961 0.984977 0.159589
+vn  -0.144740 0.925311 0.350498
+vn  -0.201474 0.850653 0.485590
+vn  -0.166631 0.971838 0.166631
+vn  -0.121908 0.985026 0.121908
+vn  -0.267668 0.925585 0.267668
+vn  -0.371315 0.851029 0.371315
+vn  -0.217978 0.971775 0.090216
+vn  -0.159589 0.984977 0.065961
+vn  -0.350498 0.925311 0.144740
+vn  -0.485590 0.850653 0.201475
+vn  -0.236583 0.971611 0.000000
+vn  -0.173084 0.984907 0.000000
+vn  -0.379703 0.925108 0.000000
+vn  -0.526673 0.850068 -0.000000
+vn  -0.217978 0.971775 -0.090216
+vn  -0.159589 0.984977 -0.065961
+vn  -0.350498 0.925311 -0.144740
+vn  -0.485590 0.850653 -0.201474
+vn  -0.166631 0.971838 -0.166631
+vn  -0.121908 0.985026 -0.121908
+vn  -0.267668 0.925585 -0.267668
+vn  -0.371315 0.851029 -0.371315
+vn  -0.090216 0.971775 -0.217978
+vn  -0.065961 0.984977 -0.159589
+vn  -0.144740 0.925311 -0.350498
+vn  -0.201475 0.850653 -0.485590
+vn  -0.000000 0.971611 -0.236583
+vn  -0.000000 0.984907 -0.173084
+vn  -0.000000 0.925108 -0.379703
+vn  0.000000 0.850068 -0.526673
+vn  0.090216 0.971775 -0.217978
+vn  0.065961 0.984977 -0.159589
+vn  0.144740 0.925311 -0.350498
+vn  0.201474 0.850653 -0.485590
+vn  0.166631 0.971838 -0.166631
+vn  0.121908 0.985026 -0.121908
+vn  0.267668 0.925585 -0.267668
+vn  0.371315 0.851029 -0.371315
+vn  0.217978 0.971775 -0.090216
+vn  0.159589 0.984977 -0.065961
+vn  0.350498 0.925311 -0.144740
+vn  0.485590 0.850653 -0.201475
+# 530 vertex normals
+
+g Teapot01
+f 1/1/1 6/6/6 7/7/7
+f 7/7/7 2/2/2 1/1/1
+f 2/2/2 7/7/7 8/8/8
+f 8/8/8 3/3/3 2/2/2
+f 3/3/3 8/8/8 9/9/9
+f 9/9/9 4/4/4 3/3/3
+f 4/4/4 9/9/9 10/10/10
+f 10/10/10 5/5/5 4/4/4
+f 6/6/6 11/11/11 12/12/12
+f 12/12/12 7/7/7 6/6/6
+f 7/7/7 12/12/12 13/13/13
+f 13/13/13 8/8/8 7/7/7
+f 8/8/8 13/13/13 14/14/14
+f 14/14/14 9/9/9 8/8/8
+f 9/9/9 14/14/14 15/15/15
+f 15/15/15 10/10/10 9/9/9
+f 11/11/11 16/16/16 17/17/17
+f 17/17/17 12/12/12 11/11/11
+f 12/12/12 17/17/17 18/18/18
+f 18/18/18 13/13/13 12/12/12
+f 13/13/13 18/18/18 19/19/19
+f 19/19/19 14/14/14 13/13/13
+f 14/14/14 19/19/19 20/20/20
+f 20/20/20 15/15/15 14/14/14
+f 16/16/16 21/21/21 22/22/22
+f 22/22/22 17/17/17 16/16/16
+f 17/17/17 22/22/22 23/23/23
+f 23/23/23 18/18/18 17/17/17
+f 18/18/18 23/23/23 24/24/24
+f 24/24/24 19/19/19 18/18/18
+f 19/19/19 24/24/24 25/25/25
+f 25/25/25 20/20/20 19/19/19
+f 21/26/21 26/31/26 27/32/27
+f 27/32/27 22/27/22 21/26/21
+f 22/27/22 27/32/27 28/33/28
+f 28/33/28 23/28/23 22/27/22
+f 23/28/23 28/33/28 29/34/29
+f 29/34/29 24/29/24 23/28/23
+f 24/29/24 29/34/29 30/35/30
+f 30/35/30 25/30/25 24/29/24
+f 26/31/26 31/36/31 32/37/32
+f 32/37/32 27/32/27 26/31/26
+f 27/32/27 32/37/32 33/38/33
+f 33/38/33 28/33/28 27/32/27
+f 28/33/28 33/38/33 34/39/34
+f 34/39/34 29/34/29 28/33/28
+f 29/34/29 34/39/34 35/40/35
+f 35/40/35 30/35/30 29/34/29
+f 31/36/31 36/41/36 37/42/37
+f 37/42/37 32/37/32 31/36/31
+f 32/37/32 37/42/37 38/43/38
+f 38/43/38 33/38/33 32/37/32
+f 33/38/33 38/43/38 39/44/39
+f 39/44/39 34/39/34 33/38/33
+f 34/39/34 39/44/39 40/45/40
+f 40/45/40 35/40/35 34/39/34
+f 36/41/36 41/46/41 42/47/42
+f 42/47/42 37/42/37 36/41/36
+f 37/42/37 42/47/42 43/48/43
+f 43/48/43 38/43/38 37/42/37
+f 38/43/38 43/48/43 44/49/44
+f 44/49/44 39/44/39 38/43/38
+f 39/44/39 44/49/44 45/50/45
+f 45/50/45 40/45/40 39/44/39
+f 41/51/41 46/56/46 47/57/47
+f 47/57/47 42/52/42 41/51/41
+f 42/52/42 47/57/47 48/58/48
+f 48/58/48 43/53/43 42/52/42
+f 43/53/43 48/58/48 49/59/49
+f 49/59/49 44/54/44 43/53/43
+f 44/54/44 49/59/49 50/60/50
+f 50/60/50 45/55/45 44/54/44
+f 46/56/46 51/61/51 52/62/52
+f 52/62/52 47/57/47 46/56/46
+f 47/57/47 52/62/52 53/63/53
+f 53/63/53 48/58/48 47/57/47
+f 48/58/48 53/63/53 54/64/54
+f 54/64/54 49/59/49 48/58/48
+f 49/59/49 54/64/54 55/65/55
+f 55/65/55 50/60/50 49/59/49
+f 51/61/51 56/66/56 57/67/57
+f 57/67/57 52/62/52 51/61/51
+f 52/62/52 57/67/57 58/68/58
+f 58/68/58 53/63/53 52/62/52
+f 53/63/53 58/68/58 59/69/59
+f 59/69/59 54/64/54 53/63/53
+f 54/64/54 59/69/59 60/70/60
+f 60/70/60 55/65/55 54/64/54
+f 56/66/56 61/71/61 62/72/62
+f 62/72/62 57/67/57 56/66/56
+f 57/67/57 62/72/62 63/73/63
+f 63/73/63 58/68/58 57/67/57
+f 58/68/58 63/73/63 64/74/64
+f 64/74/64 59/69/59 58/68/58
+f 59/69/59 64/74/64 65/75/65
+f 65/75/65 60/70/60 59/69/59
+f 61/76/61 66/81/66 67/82/67
+f 67/82/67 62/77/62 61/76/61
+f 62/77/62 67/82/67 68/83/68
+f 68/83/68 63/78/63 62/77/62
+f 63/78/63 68/83/68 69/84/69
+f 69/84/69 64/79/64 63/78/63
+f 64/79/64 69/84/69 70/85/70
+f 70/85/70 65/80/65 64/79/64
+f 66/81/66 71/86/71 72/87/72
+f 72/87/72 67/82/67 66/81/66
+f 67/82/67 72/87/72 73/88/73
+f 73/88/73 68/83/68 67/82/67
+f 68/83/68 73/88/73 74/89/74
+f 74/89/74 69/84/69 68/83/68
+f 69/84/69 74/89/74 75/90/75
+f 75/90/75 70/85/70 69/84/69
+f 71/86/71 76/91/76 77/92/77
+f 77/92/77 72/87/72 71/86/71
+f 72/87/72 77/92/77 78/93/78
+f 78/93/78 73/88/73 72/87/72
+f 73/88/73 78/93/78 79/94/79
+f 79/94/79 74/89/74 73/88/73
+f 74/89/74 79/94/79 80/95/80
+f 80/95/80 75/90/75 74/89/74
+f 76/91/76 1/96/1 2/97/2
+f 2/97/2 77/92/77 76/91/76
+f 77/92/77 2/97/2 3/98/3
+f 3/98/3 78/93/78 77/92/77
+f 78/93/78 3/98/3 4/99/4
+f 4/99/4 79/94/79 78/93/78
+f 79/94/79 4/99/4 5/100/5
+f 5/100/5 80/95/80 79/94/79
+f 5/101/5 10/106/10 85/107/85
+f 85/107/85 81/102/81 5/101/5
+f 81/102/81 85/107/85 86/108/86
+f 86/108/86 82/103/82 81/102/81
+f 82/103/82 86/108/86 87/109/87
+f 87/109/87 83/104/83 82/103/82
+f 83/104/83 87/109/87 88/110/88
+f 88/110/88 84/105/84 83/104/83
+f 10/106/10 15/111/15 89/112/89
+f 89/112/89 85/107/85 10/106/10
+f 85/107/85 89/112/89 90/113/90
+f 90/113/90 86/108/86 85/107/85
+f 86/108/86 90/113/90 91/114/91
+f 91/114/91 87/109/87 86/108/86
+f 87/109/87 91/114/91 92/115/92
+f 92/115/92 88/110/88 87/109/87
+f 15/111/15 20/116/20 93/117/93
+f 93/117/93 89/112/89 15/111/15
+f 89/112/89 93/117/93 94/118/94
+f 94/118/94 90/113/90 89/112/89
+f 90/113/90 94/118/94 95/119/95
+f 95/119/95 91/114/91 90/113/90
+f 91/114/91 95/119/95 96/120/96
+f 96/120/96 92/115/92 91/114/91
+f 20/116/20 25/121/25 97/122/97
+f 97/122/97 93/117/93 20/116/20
+f 93/117/93 97/122/97 98/123/98
+f 98/123/98 94/118/94 93/117/93
+f 94/118/94 98/123/98 99/124/99
+f 99/124/99 95/119/95 94/118/94
+f 95/119/95 99/124/99 100/125/100
+f 100/125/100 96/120/96 95/119/95
+f 25/126/25 30/131/30 101/132/101
+f 101/132/101 97/127/97 25/126/25
+f 97/127/97 101/132/101 102/133/102
+f 102/133/102 98/128/98 97/127/97
+f 98/128/98 102/133/102 103/134/103
+f 103/134/103 99/129/99 98/128/98
+f 99/129/99 103/134/103 104/135/104
+f 104/135/104 100/130/100 99/129/99
+f 30/131/30 35/136/35 105/137/105
+f 105/137/105 101/132/101 30/131/30
+f 101/132/101 105/137/105 106/138/106
+f 106/138/106 102/133/102 101/132/101
+f 102/133/102 106/138/106 107/139/107
+f 107/139/107 103/134/103 102/133/102
+f 103/134/103 107/139/107 108/140/108
+f 108/140/108 104/135/104 103/134/103
+f 35/136/35 40/141/40 109/142/109
+f 109/142/109 105/137/105 35/136/35
+f 105/137/105 109/142/109 110/143/110
+f 110/143/110 106/138/106 105/137/105
+f 106/138/106 110/143/110 111/144/111
+f 111/144/111 107/139/107 106/138/106
+f 107/139/107 111/144/111 112/145/112
+f 112/145/112 108/140/108 107/139/107
+f 40/141/40 45/146/45 113/147/113
+f 113/147/113 109/142/109 40/141/40
+f 109/142/109 113/147/113 114/148/114
+f 114/148/114 110/143/110 109/142/109
+f 110/143/110 114/148/114 115/149/115
+f 115/149/115 111/144/111 110/143/110
+f 111/144/111 115/149/115 116/150/116
+f 116/150/116 112/145/112 111/144/111
+f 45/151/45 50/156/50 117/157/117
+f 117/157/117 113/152/113 45/151/45
+f 113/152/113 117/157/117 118/158/118
+f 118/158/118 114/153/114 113/152/113
+f 114/153/114 118/158/118 119/159/119
+f 119/159/119 115/154/115 114/153/114
+f 115/154/115 119/159/119 120/160/120
+f 120/160/120 116/155/116 115/154/115
+f 50/156/50 55/161/55 121/162/121
+f 121/162/121 117/157/117 50/156/50
+f 117/157/117 121/162/121 122/163/122
+f 122/163/122 118/158/118 117/157/117
+f 118/158/118 122/163/122 123/164/123
+f 123/164/123 119/159/119 118/158/118
+f 119/159/119 123/164/123 124/165/124
+f 124/165/124 120/160/120 119/159/119
+f 55/161/55 60/166/60 125/167/125
+f 125/167/125 121/162/121 55/161/55
+f 121/162/121 125/167/125 126/168/126
+f 126/168/126 122/163/122 121/162/121
+f 122/163/122 126/168/126 127/169/127
+f 127/169/127 123/164/123 122/163/122
+f 123/164/123 127/169/127 128/170/128
+f 128/170/128 124/165/124 123/164/123
+f 60/166/60 65/171/65 129/172/129
+f 129/172/129 125/167/125 60/166/60
+f 125/167/125 129/172/129 130/173/130
+f 130/173/130 126/168/126 125/167/125
+f 126/168/126 130/173/130 131/174/131
+f 131/174/131 127/169/127 126/168/126
+f 127/169/127 131/174/131 132/175/132
+f 132/175/132 128/170/128 127/169/127
+f 65/176/65 70/181/70 133/182/133
+f 133/182/133 129/177/129 65/176/65
+f 129/177/129 133/182/133 134/183/134
+f 134/183/134 130/178/130 129/177/129
+f 130/178/130 134/183/134 135/184/135
+f 135/184/135 131/179/131 130/178/130
+f 131/179/131 135/184/135 136/185/136
+f 136/185/136 132/180/132 131/179/131
+f 70/181/70 75/186/75 137/187/137
+f 137/187/137 133/182/133 70/181/70
+f 133/182/133 137/187/137 138/188/138
+f 138/188/138 134/183/134 133/182/133
+f 134/183/134 138/188/138 139/189/139
+f 139/189/139 135/184/135 134/183/134
+f 135/184/135 139/189/139 140/190/140
+f 140/190/140 136/185/136 135/184/135
+f 75/186/75 80/191/80 141/192/141
+f 141/192/141 137/187/137 75/186/75
+f 137/187/137 141/192/141 142/193/142
+f 142/193/142 138/188/138 137/187/137
+f 138/188/138 142/193/142 143/194/143
+f 143/194/143 139/189/139 138/188/138
+f 139/189/139 143/194/143 144/195/144
+f 144/195/144 140/190/140 139/189/139
+f 80/191/80 5/196/5 81/197/81
+f 81/197/81 141/192/141 80/191/80
+f 141/192/141 81/197/81 82/198/82
+f 82/198/82 142/193/142 141/192/141
+f 142/193/142 82/198/82 83/199/83
+f 83/199/83 143/194/143 142/193/142
+f 143/194/143 83/199/83 84/200/84
+f 84/200/84 144/195/144 143/194/143
+f 84/201/84 88/206/88 149/207/149
+f 149/207/149 145/202/145 84/201/84
+f 145/202/145 149/207/149 150/208/150
+f 150/208/150 146/203/146 145/202/145
+f 146/203/146 150/208/150 151/209/151
+f 151/209/151 147/204/147 146/203/146
+f 147/204/147 151/209/151 152/210/152
+f 152/210/152 148/205/148 147/204/147
+f 88/206/88 92/211/92 153/212/153
+f 153/212/153 149/207/149 88/206/88
+f 149/207/149 153/212/153 154/213/154
+f 154/213/154 150/208/150 149/207/149
+f 150/208/150 154/213/154 155/214/155
+f 155/214/155 151/209/151 150/208/150
+f 151/209/151 155/214/155 156/215/156
+f 156/215/156 152/210/152 151/209/151
+f 92/211/92 96/216/96 157/217/157
+f 157/217/157 153/212/153 92/211/92
+f 153/212/153 157/217/157 158/218/158
+f 158/218/158 154/213/154 153/212/153
+f 154/213/154 158/218/158 159/219/159
+f 159/219/159 155/214/155 154/213/154
+f 155/214/155 159/219/159 160/220/160
+f 160/220/160 156/215/156 155/214/155
+f 96/216/96 100/221/100 161/222/161
+f 161/222/161 157/217/157 96/216/96
+f 157/217/157 161/222/161 162/223/162
+f 162/223/162 158/218/158 157/217/157
+f 158/218/158 162/223/162 163/224/163
+f 163/224/163 159/219/159 158/218/158
+f 159/219/159 163/224/163 164/225/164
+f 164/225/164 160/220/160 159/219/159
+f 100/226/100 104/231/104 165/232/165
+f 165/232/165 161/227/161 100/226/100
+f 161/227/161 165/232/165 166/233/166
+f 166/233/166 162/228/162 161/227/161
+f 162/228/162 166/233/166 167/234/167
+f 167/234/167 163/229/163 162/228/162
+f 163/229/163 167/234/167 168/235/168
+f 168/235/168 164/230/164 163/229/163
+f 104/231/104 108/236/108 169/237/169
+f 169/237/169 165/232/165 104/231/104
+f 165/232/165 169/237/169 170/238/170
+f 170/238/170 166/233/166 165/232/165
+f 166/233/166 170/238/170 171/239/171
+f 171/239/171 167/234/167 166/233/166
+f 167/234/167 171/239/171 172/240/172
+f 172/240/172 168/235/168 167/234/167
+f 108/236/108 112/241/112 173/242/173
+f 173/242/173 169/237/169 108/236/108
+f 169/237/169 173/242/173 174/243/174
+f 174/243/174 170/238/170 169/237/169
+f 170/238/170 174/243/174 175/244/175
+f 175/244/175 171/239/171 170/238/170
+f 171/239/171 175/244/175 176/245/176
+f 176/245/176 172/240/172 171/239/171
+f 112/241/112 116/246/116 177/247/177
+f 177/247/177 173/242/173 112/241/112
+f 173/242/173 177/247/177 178/248/178
+f 178/248/178 174/243/174 173/242/173
+f 174/243/174 178/248/178 179/249/179
+f 179/249/179 175/244/175 174/243/174
+f 175/244/175 179/249/179 180/250/180
+f 180/250/180 176/245/176 175/244/175
+f 116/251/116 120/256/120 181/257/181
+f 181/257/181 177/252/177 116/251/116
+f 177/252/177 181/257/181 182/258/182
+f 182/258/182 178/253/178 177/252/177
+f 178/253/178 182/258/182 183/259/183
+f 183/259/183 179/254/179 178/253/178
+f 179/254/179 183/259/183 184/260/184
+f 184/260/184 180/255/180 179/254/179
+f 120/256/120 124/261/124 185/262/185
+f 185/262/185 181/257/181 120/256/120
+f 181/257/181 185/262/185 186/263/186
+f 186/263/186 182/258/182 181/257/181
+f 182/258/182 186/263/186 187/264/187
+f 187/264/187 183/259/183 182/258/182
+f 183/259/183 187/264/187 188/265/188
+f 188/265/188 184/260/184 183/259/183
+f 124/261/124 128/266/128 189/267/189
+f 189/267/189 185/262/185 124/261/124
+f 185/262/185 189/267/189 190/268/190
+f 190/268/190 186/263/186 185/262/185
+f 186/263/186 190/268/190 191/269/191
+f 191/269/191 187/264/187 186/263/186
+f 187/264/187 191/269/191 192/270/192
+f 192/270/192 188/265/188 187/264/187
+f 128/266/128 132/271/132 193/272/193
+f 193/272/193 189/267/189 128/266/128
+f 189/267/189 193/272/193 194/273/194
+f 194/273/194 190/268/190 189/267/189
+f 190/268/190 194/273/194 195/274/195
+f 195/274/195 191/269/191 190/268/190
+f 191/269/191 195/274/195 196/275/196
+f 196/275/196 192/270/192 191/269/191
+f 132/276/132 136/281/136 197/282/197
+f 197/282/197 193/277/193 132/276/132
+f 193/277/193 197/282/197 198/283/198
+f 198/283/198 194/278/194 193/277/193
+f 194/278/194 198/283/198 199/284/199
+f 199/284/199 195/279/195 194/278/194
+f 195/279/195 199/284/199 200/285/200
+f 200/285/200 196/280/196 195/279/195
+f 136/281/136 140/286/140 201/287/201
+f 201/287/201 197/282/197 136/281/136
+f 197/282/197 201/287/201 202/288/202
+f 202/288/202 198/283/198 197/282/197
+f 198/283/198 202/288/202 203/289/203
+f 203/289/203 199/284/199 198/283/198
+f 199/284/199 203/289/203 204/290/204
+f 204/290/204 200/285/200 199/284/199
+f 140/286/140 144/291/144 205/292/205
+f 205/292/205 201/287/201 140/286/140
+f 201/287/201 205/292/205 206/293/206
+f 206/293/206 202/288/202 201/287/201
+f 202/288/202 206/293/206 207/294/207
+f 207/294/207 203/289/203 202/288/202
+f 203/289/203 207/294/207 208/295/208
+f 208/295/208 204/290/204 203/289/203
+f 144/291/144 84/296/84 145/297/145
+f 145/297/145 205/292/205 144/291/144
+f 205/292/205 145/297/145 146/298/146
+f 146/298/146 206/293/206 205/292/205
+f 206/293/206 146/298/146 147/299/147
+f 147/299/147 207/294/207 206/293/206
+f 207/294/207 147/299/147 148/300/148
+f 148/300/148 208/295/208 207/294/207
+f 148/301/148 152/306/152 213/307/213
+f 213/307/213 209/302/209 148/301/148
+f 209/302/209 213/307/213 214/308/214
+f 214/308/214 210/303/210 209/302/209
+f 210/303/210 214/308/214 215/309/215
+f 215/309/215 211/304/211 210/303/210
+f 211/304/211 215/309/215 212/310/212
+f 152/306/152 156/311/156 216/312/216
+f 216/312/216 213/307/213 152/306/152
+f 213/307/213 216/312/216 217/313/217
+f 217/313/217 214/308/214 213/307/213
+f 214/308/214 217/313/217 218/314/218
+f 218/314/218 215/309/215 214/308/214
+f 215/309/215 218/314/218 212/315/212
+f 156/311/156 160/316/160 219/317/219
+f 219/317/219 216/312/216 156/311/156
+f 216/312/216 219/317/219 220/318/220
+f 220/318/220 217/313/217 216/312/216
+f 217/313/217 220/318/220 221/319/221
+f 221/319/221 218/314/218 217/313/217
+f 218/314/218 221/319/221 212/320/212
+f 160/316/160 164/321/164 222/322/222
+f 222/322/222 219/317/219 160/316/160
+f 219/317/219 222/322/222 223/323/223
+f 223/323/223 220/318/220 219/317/219
+f 220/318/220 223/323/223 224/324/224
+f 224/324/224 221/319/221 220/318/220
+f 221/319/221 224/324/224 212/325/212
+f 164/326/164 168/331/168 225/332/225
+f 225/332/225 222/327/222 164/326/164
+f 222/327/222 225/332/225 226/333/226
+f 226/333/226 223/328/223 222/327/222
+f 223/328/223 226/333/226 227/334/227
+f 227/334/227 224/329/224 223/328/223
+f 224/329/224 227/334/227 212/335/212
+f 168/331/168 172/336/172 228/337/228
+f 228/337/228 225/332/225 168/331/168
+f 225/332/225 228/337/228 229/338/229
+f 229/338/229 226/333/226 225/332/225
+f 226/333/226 229/338/229 230/339/230
+f 230/339/230 227/334/227 226/333/226
+f 227/334/227 230/339/230 212/340/212
+f 172/336/172 176/341/176 231/342/231
+f 231/342/231 228/337/228 172/336/172
+f 228/337/228 231/342/231 232/343/232
+f 232/343/232 229/338/229 228/337/228
+f 229/338/229 232/343/232 233/344/233
+f 233/344/233 230/339/230 229/338/229
+f 230/339/230 233/344/233 212/345/212
+f 176/341/176 180/346/180 234/347/234
+f 234/347/234 231/342/231 176/341/176
+f 231/342/231 234/347/234 235/348/235
+f 235/348/235 232/343/232 231/342/231
+f 232/343/232 235/348/235 236/349/236
+f 236/349/236 233/344/233 232/343/232
+f 233/344/233 236/349/236 212/350/212
+f 180/351/180 184/356/184 237/357/237
+f 237/357/237 234/352/234 180/351/180
+f 234/352/234 237/357/237 238/358/238
+f 238/358/238 235/353/235 234/352/234
+f 235/353/235 238/358/238 239/359/239
+f 239/359/239 236/354/236 235/353/235
+f 236/354/236 239/359/239 212/360/212
+f 184/356/184 188/361/188 240/362/240
+f 240/362/240 237/357/237 184/356/184
+f 237/357/237 240/362/240 241/363/241
+f 241/363/241 238/358/238 237/357/237
+f 238/358/238 241/363/241 242/364/242
+f 242/364/242 239/359/239 238/358/238
+f 239/359/239 242/364/242 212/365/212
+f 188/361/188 192/366/192 243/367/243
+f 243/367/243 240/362/240 188/361/188
+f 240/362/240 243/367/243 244/368/244
+f 244/368/244 241/363/241 240/362/240
+f 241/363/241 244/368/244 245/369/245
+f 245/369/245 242/364/242 241/363/241
+f 242/364/242 245/369/245 212/370/212
+f 192/366/192 196/371/196 246/372/246
+f 246/372/246 243/367/243 192/366/192
+f 243/367/243 246/372/246 247/373/247
+f 247/373/247 244/368/244 243/367/243
+f 244/368/244 247/373/247 248/374/248
+f 248/374/248 245/369/245 244/368/244
+f 245/369/245 248/374/248 212/375/212
+f 196/376/196 200/381/200 249/382/249
+f 249/382/249 246/377/246 196/376/196
+f 246/377/246 249/382/249 250/383/250
+f 250/383/250 247/378/247 246/377/246
+f 247/378/247 250/383/250 251/384/251
+f 251/384/251 248/379/248 247/378/247
+f 248/379/248 251/384/251 212/385/212
+f 200/381/200 204/386/204 252/387/252
+f 252/387/252 249/382/249 200/381/200
+f 249/382/249 252/387/252 253/388/253
+f 253/388/253 250/383/250 249/382/249
+f 250/383/250 253/388/253 254/389/254
+f 254/389/254 251/384/251 250/383/250
+f 251/384/251 254/389/254 212/390/212
+f 204/386/204 208/391/208 255/392/255
+f 255/392/255 252/387/252 204/386/204
+f 252/387/252 255/392/255 256/393/256
+f 256/393/256 253/388/253 252/387/252
+f 253/388/253 256/393/256 257/394/257
+f 257/394/257 254/389/254 253/388/253
+f 254/389/254 257/394/257 212/395/212
+f 208/391/208 148/396/148 209/397/209
+f 209/397/209 255/392/255 208/391/208
+f 255/392/255 209/397/209 210/398/210
+f 210/398/210 256/393/256 255/392/255
+f 256/393/256 210/398/210 211/399/211
+f 211/399/211 257/394/257 256/393/256
+f 257/394/257 211/399/211 212/400/212
+f 258/401/258 263/406/263 264/407/264
+f 264/407/264 259/402/259 258/401/258
+f 259/402/259 264/407/264 265/408/265
+f 265/408/265 260/403/260 259/402/259
+f 260/403/260 265/408/265 266/409/266
+f 266/409/266 261/404/261 260/403/260
+f 261/404/261 266/409/266 267/410/267
+f 267/410/267 262/405/262 261/404/261
+f 263/406/263 268/411/268 269/412/269
+f 269/412/269 264/407/264 263/406/263
+f 264/407/264 269/412/269 270/413/270
+f 270/413/270 265/408/265 264/407/264
+f 265/408/265 270/413/270 271/414/271
+f 271/414/271 266/409/266 265/408/265
+f 266/409/266 271/414/271 272/415/272
+f 272/415/272 267/410/267 266/409/266
+f 268/411/268 273/416/273 274/417/274
+f 274/417/274 269/412/269 268/411/268
+f 269/412/269 274/417/274 275/418/275
+f 275/418/275 270/413/270 269/412/269
+f 270/413/270 275/418/275 276/419/276
+f 276/419/276 271/414/271 270/413/270
+f 271/414/271 276/419/276 277/420/277
+f 277/420/277 272/415/272 271/414/271
+f 273/416/273 278/421/278 279/422/279
+f 279/422/279 274/417/274 273/416/273
+f 274/417/274 279/422/279 280/423/280
+f 280/423/280 275/418/275 274/417/274
+f 275/418/275 280/423/280 281/424/281
+f 281/424/281 276/419/276 275/418/275
+f 276/419/276 281/424/281 282/425/282
+f 282/425/282 277/420/277 276/419/276
+f 278/426/278 283/431/283 284/432/284
+f 284/432/284 279/427/279 278/426/278
+f 279/427/279 284/432/284 285/433/285
+f 285/433/285 280/428/280 279/427/279
+f 280/428/280 285/433/285 286/434/286
+f 286/434/286 281/429/281 280/428/280
+f 281/429/281 286/434/286 287/435/287
+f 287/435/287 282/430/282 281/429/281
+f 283/431/283 288/436/288 289/437/289
+f 289/437/289 284/432/284 283/431/283
+f 284/432/284 289/437/289 290/438/290
+f 290/438/290 285/433/285 284/432/284
+f 285/433/285 290/438/290 291/439/291
+f 291/439/291 286/434/286 285/433/285
+f 286/434/286 291/439/291 292/440/292
+f 292/440/292 287/435/287 286/434/286
+f 288/436/288 293/441/293 294/442/294
+f 294/442/294 289/437/289 288/436/288
+f 289/437/289 294/442/294 295/443/295
+f 295/443/295 290/438/290 289/437/289
+f 290/438/290 295/443/295 296/444/296
+f 296/444/296 291/439/291 290/438/290
+f 291/439/291 296/444/296 297/445/297
+f 297/445/297 292/440/292 291/439/291
+f 293/441/293 258/446/258 259/447/259
+f 259/447/259 294/442/294 293/441/293
+f 294/442/294 259/447/259 260/448/260
+f 260/448/260 295/443/295 294/442/294
+f 295/443/295 260/448/260 261/449/261
+f 261/449/261 296/444/296 295/443/295
+f 296/444/296 261/449/261 262/450/262
+f 262/450/262 297/445/297 296/444/296
+f 262/451/262 267/456/267 302/457/302
+f 302/457/302 298/452/298 262/451/262
+f 298/452/298 302/457/302 303/458/303
+f 303/458/303 299/453/299 298/452/298
+f 299/453/299 303/458/303 304/459/304
+f 304/459/304 300/454/300 299/453/299
+f 300/454/300 304/459/304 305/460/305
+f 305/460/305 301/455/301 300/454/300
+f 267/456/267 272/461/272 306/462/306
+f 306/462/306 302/457/302 267/456/267
+f 302/457/302 306/462/306 307/463/307
+f 307/463/307 303/458/303 302/457/302
+f 303/458/303 307/463/307 308/464/308
+f 308/464/308 304/459/304 303/458/303
+f 304/459/304 308/464/308 309/465/309
+f 309/465/309 305/460/305 304/459/304
+f 272/461/272 277/466/277 310/467/310
+f 310/467/310 306/462/306 272/461/272
+f 306/462/306 310/467/310 311/468/311
+f 311/468/311 307/463/307 306/462/306
+f 307/463/307 311/468/311 312/469/312
+f 312/469/312 308/464/308 307/463/307
+f 308/464/308 312/469/312 313/470/313
+f 313/470/313 309/465/309 308/464/308
+f 277/466/277 282/471/282 314/472/314
+f 314/472/314 310/467/310 277/466/277
+f 310/467/310 314/472/314 315/473/315
+f 315/473/315 311/468/311 310/467/310
+f 311/468/311 315/473/315 316/474/316
+f 316/474/316 312/469/312 311/468/311
+f 312/469/312 316/474/316 317/475/317
+f 317/475/317 313/470/313 312/469/312
+f 282/476/282 287/481/287 318/482/318
+f 318/482/318 314/477/314 282/476/282
+f 314/477/314 318/482/318 319/483/319
+f 319/483/319 315/478/315 314/477/314
+f 315/478/315 319/483/319 320/484/320
+f 320/484/320 316/479/316 315/478/315
+f 316/479/316 320/484/320 321/485/321
+f 321/485/321 317/480/317 316/479/316
+f 287/481/287 292/486/292 322/487/322
+f 322/487/322 318/482/318 287/481/287
+f 318/482/318 322/487/322 323/488/323
+f 323/488/323 319/483/319 318/482/318
+f 319/483/319 323/488/323 324/489/324
+f 324/489/324 320/484/320 319/483/319
+f 320/484/320 324/489/324 325/490/325
+f 325/490/325 321/485/321 320/484/320
+f 292/486/292 297/491/297 326/492/326
+f 326/492/326 322/487/322 292/486/292
+f 322/487/322 326/492/326 327/493/327
+f 327/493/327 323/488/323 322/487/322
+f 323/488/323 327/493/327 328/494/328
+f 328/494/328 324/489/324 323/488/323
+f 324/489/324 328/494/328 329/495/329
+f 329/495/329 325/490/325 324/489/324
+f 297/491/297 262/496/262 298/497/298
+f 298/497/298 326/492/326 297/491/297
+f 326/492/326 298/497/298 299/498/299
+f 299/498/299 327/493/327 326/492/326
+f 327/493/327 299/498/299 300/499/300
+f 300/499/300 328/494/328 327/493/327
+f 328/494/328 300/499/300 301/500/301
+f 301/500/301 329/495/329 328/494/328
+f 330/501/330 335/506/335 336/507/336
+f 336/507/336 331/502/331 330/501/330
+f 331/502/331 336/507/336 337/508/337
+f 337/508/337 332/503/332 331/502/331
+f 332/503/332 337/508/337 338/509/338
+f 338/509/338 333/504/333 332/503/332
+f 333/504/333 338/509/338 339/510/339
+f 339/510/339 334/505/334 333/504/333
+f 335/506/335 340/511/340 341/512/341
+f 341/512/341 336/507/336 335/506/335
+f 336/507/336 341/512/341 342/513/342
+f 342/513/342 337/508/337 336/507/336
+f 337/508/337 342/513/342 343/514/343
+f 343/514/343 338/509/338 337/508/337
+f 338/509/338 343/514/343 344/515/344
+f 344/515/344 339/510/339 338/509/338
+f 340/511/340 345/516/345 346/517/346
+f 346/517/346 341/512/341 340/511/340
+f 341/512/341 346/517/346 347/518/347
+f 347/518/347 342/513/342 341/512/341
+f 342/513/342 347/518/347 348/519/348
+f 348/519/348 343/514/343 342/513/342
+f 343/514/343 348/519/348 349/520/349
+f 349/520/349 344/515/344 343/514/343
+f 345/516/345 350/521/350 351/522/351
+f 351/522/351 346/517/346 345/516/345
+f 346/517/346 351/522/351 352/523/352
+f 352/523/352 347/518/347 346/517/346
+f 347/518/347 352/523/352 353/524/353
+f 353/524/353 348/519/348 347/518/347
+f 348/519/348 353/524/353 354/525/354
+f 354/525/354 349/520/349 348/519/348
+f 350/526/350 355/531/355 356/532/356
+f 356/532/356 351/527/351 350/526/350
+f 351/527/351 356/532/356 357/533/357
+f 357/533/357 352/528/352 351/527/351
+f 352/528/352 357/533/357 358/534/358
+f 358/534/358 353/529/353 352/528/352
+f 353/529/353 358/534/358 359/535/359
+f 359/535/359 354/530/354 353/529/353
+f 355/531/355 360/536/360 361/537/361
+f 361/537/361 356/532/356 355/531/355
+f 356/532/356 361/537/361 362/538/362
+f 362/538/362 357/533/357 356/532/356
+f 357/533/357 362/538/362 363/539/363
+f 363/539/363 358/534/358 357/533/357
+f 358/534/358 363/539/363 364/540/364
+f 364/540/364 359/535/359 358/534/358
+f 360/536/360 365/541/365 366/542/366
+f 366/542/366 361/537/361 360/536/360
+f 361/537/361 366/542/366 367/543/367
+f 367/543/367 362/538/362 361/537/361
+f 362/538/362 367/543/367 368/544/368
+f 368/544/368 363/539/363 362/538/362
+f 363/539/363 368/544/368 369/545/369
+f 369/545/369 364/540/364 363/539/363
+f 365/541/365 330/546/330 331/547/331
+f 331/547/331 366/542/366 365/541/365
+f 366/542/366 331/547/331 332/548/332
+f 332/548/332 367/543/367 366/542/366
+f 367/543/367 332/548/332 333/549/333
+f 333/549/333 368/544/368 367/543/367
+f 368/544/368 333/549/333 334/550/334
+f 334/550/334 369/545/369 368/544/368
+f 334/551/334 339/556/339 374/557/374
+f 374/557/374 370/552/370 334/551/334
+f 370/552/370 374/557/374 375/558/375
+f 375/558/375 371/553/371 370/552/370
+f 371/553/371 375/558/375 376/559/376
+f 376/559/376 372/554/372 371/553/371
+f 372/554/372 376/559/376 377/560/377
+f 377/560/377 373/555/373 372/554/372
+f 339/556/339 344/561/344 378/562/378
+f 378/562/378 374/557/374 339/556/339
+f 374/557/374 378/562/378 379/563/379
+f 379/563/379 375/558/375 374/557/374
+f 375/558/375 379/563/379 380/564/380
+f 380/564/380 376/559/376 375/558/375
+f 376/559/376 380/564/380 381/565/381
+f 381/565/381 377/560/377 376/559/376
+f 344/561/344 349/566/349 382/567/382
+f 382/567/382 378/562/378 344/561/344
+f 378/562/378 382/567/382 383/568/383
+f 383/568/383 379/563/379 378/562/378
+f 379/563/379 383/568/383 384/569/384
+f 384/569/384 380/564/380 379/563/379
+f 380/564/380 384/569/384 385/570/385
+f 385/570/385 381/565/381 380/564/380
+f 349/566/349 354/571/354 386/572/386
+f 386/572/386 382/567/382 349/566/349
+f 382/567/382 386/572/386 387/573/387
+f 387/573/387 383/568/383 382/567/382
+f 383/568/383 387/573/387 388/574/388
+f 388/574/388 384/569/384 383/568/383
+f 384/569/384 388/574/388 389/575/389
+f 389/575/389 385/570/385 384/569/384
+f 354/576/354 359/581/359 390/582/390
+f 390/582/390 386/577/386 354/576/354
+f 386/577/386 390/582/390 391/583/391
+f 391/583/391 387/578/387 386/577/386
+f 387/578/387 391/583/391 392/584/392
+f 392/584/392 388/579/388 387/578/387
+f 388/579/388 392/584/392 393/585/393
+f 393/585/393 389/580/389 388/579/388
+f 359/581/359 364/586/364 394/587/394
+f 394/587/394 390/582/390 359/581/359
+f 390/582/390 394/587/394 395/588/395
+f 395/588/395 391/583/391 390/582/390
+f 391/583/391 395/588/395 396/589/396
+f 396/589/396 392/584/392 391/583/391
+f 392/584/392 396/589/396 397/590/397
+f 397/590/397 393/585/393 392/584/392
+f 364/586/364 369/591/369 398/592/398
+f 398/592/398 394/587/394 364/586/364
+f 394/587/394 398/592/398 399/593/399
+f 399/593/399 395/588/395 394/587/394
+f 395/588/395 399/593/399 400/594/400
+f 400/594/400 396/589/396 395/588/395
+f 396/589/396 400/594/400 401/595/401
+f 401/595/401 397/590/397 396/589/396
+f 369/591/369 334/596/334 370/597/370
+f 370/597/370 398/592/398 369/591/369
+f 398/592/398 370/597/370 371/598/371
+f 371/598/371 399/593/399 398/592/398
+f 399/593/399 371/598/371 372/599/372
+f 372/599/372 400/594/400 399/593/399
+f 400/594/400 372/599/372 373/600/373
+f 373/600/373 401/595/401 400/594/400
+f 407/607/407 403/602/403 402/601/402
+f 403/602/403 407/607/407 408/608/408
+f 408/608/408 404/603/404 403/602/403
+f 404/603/404 408/608/408 409/609/409
+f 409/609/409 405/604/405 404/603/404
+f 405/604/405 409/609/409 410/610/410
+f 410/610/410 406/605/406 405/604/405
+f 411/612/411 407/607/407 402/606/402
+f 407/607/407 411/612/411 412/613/412
+f 412/613/412 408/608/408 407/607/407
+f 408/608/408 412/613/412 413/614/413
+f 413/614/413 409/609/409 408/608/408
+f 409/609/409 413/614/413 414/615/414
+f 414/615/414 410/610/410 409/609/409
+f 415/617/415 411/612/411 402/611/402
+f 411/612/411 415/617/415 416/618/416
+f 416/618/416 412/613/412 411/612/411
+f 412/613/412 416/618/416 417/619/417
+f 417/619/417 413/614/413 412/613/412
+f 413/614/413 417/619/417 418/620/418
+f 418/620/418 414/615/414 413/614/413
+f 419/622/419 415/617/415 402/616/402
+f 415/617/415 419/622/419 420/623/420
+f 420/623/420 416/618/416 415/617/415
+f 416/618/416 420/623/420 421/624/421
+f 421/624/421 417/619/417 416/618/416
+f 417/619/417 421/624/421 422/625/422
+f 422/625/422 418/620/418 417/619/417
+f 423/632/423 419/627/419 402/626/402
+f 419/627/419 423/632/423 424/633/424
+f 424/633/424 420/628/420 419/627/419
+f 420/628/420 424/633/424 425/634/425
+f 425/634/425 421/629/421 420/628/420
+f 421/629/421 425/634/425 426/635/426
+f 426/635/426 422/630/422 421/629/421
+f 427/637/427 423/632/423 402/631/402
+f 423/632/423 427/637/427 428/638/428
+f 428/638/428 424/633/424 423/632/423
+f 424/633/424 428/638/428 429/639/429
+f 429/639/429 425/634/425 424/633/424
+f 425/634/425 429/639/429 430/640/430
+f 430/640/430 426/635/426 425/634/425
+f 431/642/431 427/637/427 402/636/402
+f 427/637/427 431/642/431 432/643/432
+f 432/643/432 428/638/428 427/637/427
+f 428/638/428 432/643/432 433/644/433
+f 433/644/433 429/639/429 428/638/428
+f 429/639/429 433/644/433 434/645/434
+f 434/645/434 430/640/430 429/639/429
+f 435/647/435 431/642/431 402/641/402
+f 431/642/431 435/647/435 436/648/436
+f 436/648/436 432/643/432 431/642/431
+f 432/643/432 436/648/436 437/649/437
+f 437/649/437 433/644/433 432/643/432
+f 433/644/433 437/649/437 438/650/438
+f 438/650/438 434/645/434 433/644/433
+f 439/657/439 435/652/435 402/651/402
+f 435/652/435 439/657/439 440/658/440
+f 440/658/440 436/653/436 435/652/435
+f 436/653/436 440/658/440 441/659/441
+f 441/659/441 437/654/437 436/653/436
+f 437/654/437 441/659/441 442/660/442
+f 442/660/442 438/655/438 437/654/437
+f 443/662/443 439/657/439 402/656/402
+f 439/657/439 443/662/443 444/663/444
+f 444/663/444 440/658/440 439/657/439
+f 440/658/440 444/663/444 445/664/445
+f 445/664/445 441/659/441 440/658/440
+f 441/659/441 445/664/445 446/665/446
+f 446/665/446 442/660/442 441/659/441
+f 447/667/447 443/662/443 402/661/402
+f 443/662/443 447/667/447 448/668/448
+f 448/668/448 444/663/444 443/662/443
+f 444/663/444 448/668/448 449/669/449
+f 449/669/449 445/664/445 444/663/444
+f 445/664/445 449/669/449 450/670/450
+f 450/670/450 446/665/446 445/664/445
+f 451/672/451 447/667/447 402/666/402
+f 447/667/447 451/672/451 452/673/452
+f 452/673/452 448/668/448 447/667/447
+f 448/668/448 452/673/452 453/674/453
+f 453/674/453 449/669/449 448/668/448
+f 449/669/449 453/674/453 454/675/454
+f 454/675/454 450/670/450 449/669/449
+f 455/682/455 451/677/451 402/676/402
+f 451/677/451 455/682/455 456/683/456
+f 456/683/456 452/678/452 451/677/451
+f 452/678/452 456/683/456 457/684/457
+f 457/684/457 453/679/453 452/678/452
+f 453/679/453 457/684/457 458/685/458
+f 458/685/458 454/680/454 453/679/453
+f 459/687/459 455/682/455 402/681/402
+f 455/682/455 459/687/459 460/688/460
+f 460/688/460 456/683/456 455/682/455
+f 456/683/456 460/688/460 461/689/461
+f 461/689/461 457/684/457 456/683/456
+f 457/684/457 461/689/461 462/690/462
+f 462/690/462 458/685/458 457/684/457
+f 463/692/463 459/687/459 402/686/402
+f 459/687/459 463/692/463 464/693/464
+f 464/693/464 460/688/460 459/687/459
+f 460/688/460 464/693/464 465/694/465
+f 465/694/465 461/689/461 460/688/460
+f 461/689/461 465/694/465 466/695/466
+f 466/695/466 462/690/462 461/689/461
+f 403/697/403 463/692/463 402/691/402
+f 463/692/463 403/697/403 404/698/404
+f 404/698/404 464/693/464 463/692/463
+f 464/693/464 404/698/404 405/699/405
+f 405/699/405 465/694/465 464/693/464
+f 465/694/465 405/699/405 406/700/406
+f 406/700/406 466/695/466 465/694/465
+f 406/701/406 410/706/410 471/707/471
+f 471/707/471 467/702/467 406/701/406
+f 467/702/467 471/707/471 472/708/472
+f 472/708/472 468/703/468 467/702/467
+f 468/703/468 472/708/472 473/709/473
+f 473/709/473 469/704/469 468/703/468
+f 469/704/469 473/709/473 474/710/474
+f 474/710/474 470/705/470 469/704/469
+f 410/706/410 414/711/414 475/712/475
+f 475/712/475 471/707/471 410/706/410
+f 471/707/471 475/712/475 476/713/476
+f 476/713/476 472/708/472 471/707/471
+f 472/708/472 476/713/476 477/714/477
+f 477/714/477 473/709/473 472/708/472
+f 473/709/473 477/714/477 478/715/478
+f 478/715/478 474/710/474 473/709/473
+f 414/711/414 418/716/418 479/717/479
+f 479/717/479 475/712/475 414/711/414
+f 475/712/475 479/717/479 480/718/480
+f 480/718/480 476/713/476 475/712/475
+f 476/713/476 480/718/480 481/719/481
+f 481/719/481 477/714/477 476/713/476
+f 477/714/477 481/719/481 482/720/482
+f 482/720/482 478/715/478 477/714/477
+f 418/716/418 422/721/422 483/722/483
+f 483/722/483 479/717/479 418/716/418
+f 479/717/479 483/722/483 484/723/484
+f 484/723/484 480/718/480 479/717/479
+f 480/718/480 484/723/484 485/724/485
+f 485/724/485 481/719/481 480/718/480
+f 481/719/481 485/724/485 486/725/486
+f 486/725/486 482/720/482 481/719/481
+f 422/726/422 426/731/426 487/732/487
+f 487/732/487 483/727/483 422/726/422
+f 483/727/483 487/732/487 488/733/488
+f 488/733/488 484/728/484 483/727/483
+f 484/728/484 488/733/488 489/734/489
+f 489/734/489 485/729/485 484/728/484
+f 485/729/485 489/734/489 490/735/490
+f 490/735/490 486/730/486 485/729/485
+f 426/731/426 430/736/430 491/737/491
+f 491/737/491 487/732/487 426/731/426
+f 487/732/487 491/737/491 492/738/492
+f 492/738/492 488/733/488 487/732/487
+f 488/733/488 492/738/492 493/739/493
+f 493/739/493 489/734/489 488/733/488
+f 489/734/489 493/739/493 494/740/494
+f 494/740/494 490/735/490 489/734/489
+f 430/736/430 434/741/434 495/742/495
+f 495/742/495 491/737/491 430/736/430
+f 491/737/491 495/742/495 496/743/496
+f 496/743/496 492/738/492 491/737/491
+f 492/738/492 496/743/496 497/744/497
+f 497/744/497 493/739/493 492/738/492
+f 493/739/493 497/744/497 498/745/498
+f 498/745/498 494/740/494 493/739/493
+f 434/741/434 438/746/438 499/747/499
+f 499/747/499 495/742/495 434/741/434
+f 495/742/495 499/747/499 500/748/500
+f 500/748/500 496/743/496 495/742/495
+f 496/743/496 500/748/500 501/749/501
+f 501/749/501 497/744/497 496/743/496
+f 497/744/497 501/749/501 502/750/502
+f 502/750/502 498/745/498 497/744/497
+f 438/751/438 442/756/442 503/757/503
+f 503/757/503 499/752/499 438/751/438
+f 499/752/499 503/757/503 504/758/504
+f 504/758/504 500/753/500 499/752/499
+f 500/753/500 504/758/504 505/759/505
+f 505/759/505 501/754/501 500/753/500
+f 501/754/501 505/759/505 506/760/506
+f 506/760/506 502/755/502 501/754/501
+f 442/756/442 446/761/446 507/762/507
+f 507/762/507 503/757/503 442/756/442
+f 503/757/503 507/762/507 508/763/508
+f 508/763/508 504/758/504 503/757/503
+f 504/758/504 508/763/508 509/764/509
+f 509/764/509 505/759/505 504/758/504
+f 505/759/505 509/764/509 510/765/510
+f 510/765/510 506/760/506 505/759/505
+f 446/761/446 450/766/450 511/767/511
+f 511/767/511 507/762/507 446/761/446
+f 507/762/507 511/767/511 512/768/512
+f 512/768/512 508/763/508 507/762/507
+f 508/763/508 512/768/512 513/769/513
+f 513/769/513 509/764/509 508/763/508
+f 509/764/509 513/769/513 514/770/514
+f 514/770/514 510/765/510 509/764/509
+f 450/766/450 454/771/454 515/772/515
+f 515/772/515 511/767/511 450/766/450
+f 511/767/511 515/772/515 516/773/516
+f 516/773/516 512/768/512 511/767/511
+f 512/768/512 516/773/516 517/774/517
+f 517/774/517 513/769/513 512/768/512
+f 513/769/513 517/774/517 518/775/518
+f 518/775/518 514/770/514 513/769/513
+f 454/776/454 458/781/458 519/782/519
+f 519/782/519 515/777/515 454/776/454
+f 515/777/515 519/782/519 520/783/520
+f 520/783/520 516/778/516 515/777/515
+f 516/778/516 520/783/520 521/784/521
+f 521/784/521 517/779/517 516/778/516
+f 517/779/517 521/784/521 522/785/522
+f 522/785/522 518/780/518 517/779/517
+f 458/781/458 462/786/462 523/787/523
+f 523/787/523 519/782/519 458/781/458
+f 519/782/519 523/787/523 524/788/524
+f 524/788/524 520/783/520 519/782/519
+f 520/783/520 524/788/524 525/789/525
+f 525/789/525 521/784/521 520/783/520
+f 521/784/521 525/789/525 526/790/526
+f 526/790/526 522/785/522 521/784/521
+f 462/786/462 466/791/466 527/792/527
+f 527/792/527 523/787/523 462/786/462
+f 523/787/523 527/792/527 528/793/528
+f 528/793/528 524/788/524 523/787/523
+f 524/788/524 528/793/528 529/794/529
+f 529/794/529 525/789/525 524/788/524
+f 525/789/525 529/794/529 530/795/530
+f 530/795/530 526/790/526 525/789/525
+f 466/791/466 406/796/406 467/797/467
+f 467/797/467 527/792/527 466/791/466
+f 527/792/527 467/797/467 468/798/468
+f 468/798/468 528/793/528 527/792/527
+f 528/793/528 468/798/468 469/799/469
+f 469/799/469 529/794/529 528/793/528
+f 529/794/529 469/799/469 470/800/470
+f 470/800/470 530/795/530 529/794/529
+# 992 faces
+
+g
diff --git a/WebCore/manual-tests/webgl/resources/utils3d.js b/WebCore/manual-tests/webgl/resources/utils3d.js
new file mode 100644
index 0000000..0ffd7c4
--- /dev/null
+++ b/WebCore/manual-tests/webgl/resources/utils3d.js
@@ -0,0 +1,531 @@
+//
+// initWebGL
+//
+// Initialize the Canvas element with the passed name as a WebGL object and return the
+// CanvasRenderingContext3D. 
+//
+// Load shaders with the passed names and create a program with them. Return this program 
+// in the 'program' property of the returned context.
+//
+// For each string in the passed attribs array, bind an attrib with that name at that index.
+// Once the attribs are bound, link the program and then use it.
+//
+// Set the clear color to the passed array (4 values) and set the clear depth to the passed value.
+// Enable depth testing and blending with a blend func of (SRC_ALPHA, ONE_MINUS_SRC_ALPHA)
+//
+function initWebGL(canvasName, vshader, fshader, attribs, clearColor, clearDepth)
+{
+    var canvas = document.getElementById(canvasName);
+    var gl = canvas.getContext("webkit-3d");
+
+    // create our shaders
+    var vertexShader = loadShader(gl, vshader);
+    var fragmentShader = loadShader(gl, fshader);
+
+    if (!vertexShader || !fragmentShader)
+        return null;
+
+    // Create the program object
+    gl.program = gl.createProgram();
+
+    if (!gl.program)
+        return null;
+
+    // Attach our two shaders to the program
+    gl.attachShader (gl.program, vertexShader);
+    gl.attachShader (gl.program, fragmentShader);
+
+    // Bind attributes
+    for (var i in attribs)
+        gl.bindAttribLocation (gl.program, i, attribs[i]);
+
+    // Link the program
+    gl.linkProgram(gl.program);
+
+    // Check the link status
+    var linked = gl.getProgrami(gl.program, gl.LINK_STATUS);
+    if (!linked) {
+        // something went wrong with the link
+        var error = gl.getProgramInfoLog (gl.program);
+        console.log("Error in program linking:"+error);
+
+        gl.deleteProgram(gl.program);
+        gl.deleteProgram(fragmentShader);
+        gl.deleteProgram(vertexShader);
+
+        return null;
+    }
+
+    gl.useProgram(gl.program);
+
+    gl.clearColor (clearColor[0], clearColor[1], clearColor[2], clearColor[3]);
+    gl.clearDepth (clearDepth);
+
+    gl.enable(gl.DEPTH_TEST);
+    gl.enable(gl.BLEND);
+    gl.blendFunc(gl.SRC_ALPHA, gl.ONE_MINUS_SRC_ALPHA);
+
+    return gl;
+}
+
+//
+// loadShader
+//
+// 'shaderId' is the id of a <script> element containing the shader source string.
+// Load this shader and return the CanvasShader object corresponding to it.
+//
+function loadShader(ctx, shaderId)
+{
+    var shaderScript = document.getElementById(shaderId);
+    if (!shaderScript) {
+        console.log("*** Error: shader script '"+shaderId+"' not found");
+        return null;
+    }
+        
+    if (shaderScript.type == "x-shader/x-vertex")
+        var shaderType = ctx.VERTEX_SHADER;
+    else if (shaderScript.type == "x-shader/x-fragment")
+        var shaderType = ctx.FRAGMENT_SHADER;
+    else {
+        console.log("*** Error: shader script '"+shaderId+"' of undefined type '"+shaderScript.type+"'");       
+        return null;
+    }
+
+    // Create the shader object
+    var shader = ctx.createShader(shaderType);
+    if (shader == null) {
+        console.log("*** Error: unable to create shader '"+shaderId+"'");       
+        return null;
+    }
+
+    // Load the shader source
+    ctx.shaderSource(shader, shaderScript.text);
+
+    // Compile the shader
+    ctx.compileShader(shader);
+
+    // Check the compile status
+    var compiled = ctx.getShaderi(shader, ctx.COMPILE_STATUS);
+    if (!compiled) {
+        // Something went wrong during compilation; get the error
+        var error = ctx.getShaderInfoLog(shader);
+        console.log("*** Error compiling shader '"+shaderId+"':"+error);
+        ctx.deleteShader(shader);
+        return null;
+    }
+
+    return shader;
+}
+
+// 
+// makeBox
+//
+// Create a box with vertices, normals and texCoords. Create VBOs for each as well as the index array.
+// Return an object with the following properties:
+//
+//  normalObject        CanvasBuffer object for normals
+//  texCoordObject      CanvasBuffer object for texCoords
+//  vertexObject        CanvasBuffer object for vertices
+//  indexObject         CanvasBuffer object for indices
+//  numIndices          The number of indices in the indexObject
+// 
+function makeBox(ctx)
+{
+    // box
+    //    v6----- v5
+    //   /|      /|
+    //  v1------v0|
+    //  | |     | |
+    //  | |v7---|-|v4
+    //  |/      |/
+    //  v2------v3
+    //
+    // vertex coords array
+    var vertices = new CanvasFloatArray(
+        [  1, 1, 1,  -1, 1, 1,  -1,-1, 1,   1,-1, 1,    // v0-v1-v2-v3 front
+           1, 1, 1,   1,-1, 1,   1,-1,-1,   1, 1,-1,    // v0-v3-v4-v5 right
+           1, 1, 1,   1, 1,-1,  -1, 1,-1,  -1, 1, 1,    // v0-v5-v6-v1 top
+          -1, 1, 1,  -1, 1,-1,  -1,-1,-1,  -1,-1, 1,    // v1-v6-v7-v2 left
+          -1,-1,-1,   1,-1,-1,   1,-1, 1,  -1,-1, 1,    // v7-v4-v3-v2 bottom
+           1,-1,-1,  -1,-1,-1,  -1, 1,-1,   1, 1,-1 ]   // v4-v7-v6-v5 back
+    );
+
+    // normal array
+    var normals = new CanvasFloatArray(
+        [  0, 0, 1,   0, 0, 1,   0, 0, 1,   0, 0, 1,     // v0-v1-v2-v3 front
+           1, 0, 0,   1, 0, 0,   1, 0, 0,   1, 0, 0,     // v0-v3-v4-v5 right
+           0, 1, 0,   0, 1, 0,   0, 1, 0,   0, 1, 0,     // v0-v5-v6-v1 top
+          -1, 0, 0,  -1, 0, 0,  -1, 0, 0,  -1, 0, 0,     // v1-v6-v7-v2 left
+           0,-1, 0,   0,-1, 0,   0,-1, 0,   0,-1, 0,     // v7-v4-v3-v2 bottom
+           0, 0,-1,   0, 0,-1,   0, 0,-1,   0, 0,-1 ]    // v4-v7-v6-v5 back
+       );
+
+
+    // texCoord array
+    var texCoords = new CanvasFloatArray(
+        [  1, 1,   0, 1,   0, 0,   1, 0,    // v0-v1-v2-v3 front
+           0, 1,   0, 0,   1, 0,   1, 1,    // v0-v3-v4-v5 right
+           1, 0,   1, 1,   0, 1,   0, 0,    // v0-v5-v6-v1 top
+           1, 1,   0, 1,   0, 0,   1, 0,    // v1-v6-v7-v2 left
+           0, 0,   1, 0,   1, 1,   0, 1,    // v7-v4-v3-v2 bottom
+           0, 0,   1, 0,   1, 1,   0, 1 ]   // v4-v7-v6-v5 back
+       );
+
+    // index array
+    var indices = new CanvasUnsignedByteArray(
+        [  0, 1, 2,   0, 2, 3,    // front
+           4, 5, 6,   4, 6, 7,    // right
+           8, 9,10,   8,10,11,    // top
+          12,13,14,  12,14,15,    // left
+          16,17,18,  16,18,19,    // bottom
+          20,21,22,  20,22,23 ]   // back
+      );
+
+    var retval = { };
+    
+    retval.normalObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.normalObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, normals, ctx.STATIC_DRAW);
+    
+    retval.texCoordObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.texCoordObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, texCoords, ctx.STATIC_DRAW);
+
+    retval.vertexObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.vertexObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, vertices, ctx.STATIC_DRAW);
+    
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, 0);
+
+    retval.indexObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, retval.indexObject);
+    ctx.bufferData(ctx.ELEMENT_ARRAY_BUFFER, indices, ctx.STATIC_DRAW);
+    ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, 0);
+    
+    retval.numIndices = indices.length;
+
+    return retval;
+}
+
+// 
+// makeSphere
+//
+// Create a sphere with the passed number of latitude and longitude bands and the passed radius. 
+// Sphere has vertices, normals and texCoords. Create VBOs for each as well as the index array.
+// Return an object with the following properties:
+//
+//  normalObject        CanvasBuffer object for normals
+//  texCoordObject      CanvasBuffer object for texCoords
+//  vertexObject        CanvasBuffer object for vertices
+//  indexObject         CanvasBuffer object for indices
+//  numIndices          The number of indices in the indexObject
+// 
+function makeSphere(ctx, radius, lats, longs)
+{
+    var geometryData = [ ];
+    var normalData = [ ];
+    var texCoordData = [ ];
+    var indexData = [ ];
+    
+    for (var latNumber = 0; latNumber <= lats; ++latNumber) {
+        for (var longNumber = 0; longNumber <= longs; ++longNumber) {
+            var theta = latNumber * Math.PI / lats;
+            var phi = longNumber * 2 * Math.PI / longs;
+            var sinTheta = Math.sin(theta);
+            var sinPhi = Math.sin(phi);
+            var cosTheta = Math.cos(theta);
+            var cosPhi = Math.cos(phi);
+            
+            var x = cosPhi * sinTheta;
+            var y = cosTheta;
+            var z = sinPhi * sinTheta;
+            var u = 1-(longNumber/longs);
+            var v = latNumber/lats;
+            
+            normalData.push(x);
+            normalData.push(y);
+            normalData.push(z);
+            texCoordData.push(u);
+            texCoordData.push(v);
+            geometryData.push(radius * x);
+            geometryData.push(radius * y);
+            geometryData.push(radius * z);
+        }
+    }
+    
+    longs += 1;
+    for (var latNumber = 0; latNumber < lats; ++latNumber) {
+        for (var longNumber = 0; longNumber < longs; ++longNumber) {
+            var first = (latNumber * longs) + (longNumber % longs);
+            var second = first + longs;
+            indexData.push(first);
+            indexData.push(second);
+            indexData.push(first+1);
+
+            indexData.push(second);
+            indexData.push(second+1);
+            indexData.push(first+1);
+        }
+    }
+    
+    var retval = { };
+    
+    retval.normalObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.normalObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(normalData), ctx.STATIC_DRAW);
+
+    retval.texCoordObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.texCoordObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(texCoordData), ctx.STATIC_DRAW);
+
+    retval.vertexObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.vertexObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(geometryData), ctx.STATIC_DRAW);
+    
+    retval.numIndices = indexData.length;
+    retval.indexObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, retval.indexObject);
+    ctx.bufferData(ctx.ELEMENT_ARRAY_BUFFER, new CanvasUnsignedShortArray(indexData), ctx.STREAM_DRAW);
+    
+    return retval;
+}
+
+//
+// loadObj
+//
+// Load a .obj file from the passed URL. Return an object with a 'loaded' property set to false.
+// When the object load is complete, the 'loaded' property becomes true and the following 
+// properties are set:
+//
+//  normalObject        CanvasBuffer object for normals
+//  texCoordObject      CanvasBuffer object for texCoords
+//  vertexObject        CanvasBuffer object for vertices
+//  indexObject         CanvasBuffer object for indices
+//  numIndices          The number of indices in the indexObject
+//  
+function loadObj(ctx, url)
+{
+    var obj = { loaded : false };
+    obj.ctx = ctx;
+    var req = new XMLHttpRequest();
+    req.obj = obj;
+    req.onreadystatechange = function () { processLoadObj(req) };
+    req.open("GET", url, true);
+    req.send(null);
+    return obj;
+}
+
+function processLoadObj(req) 
+{
+    console.log("req="+req)
+    // only if req shows "complete"
+    if (req.readyState == 4) {
+        doLoadObj(req.obj, req.responseText);
+    }
+}
+
+function doLoadObj(obj, text)
+{
+    vertexArray = [ ];
+    normalArray = [ ];
+    textureArray = [ ];
+    indexArray = [ ];
+    
+    var vertex = [ ];
+    var normal = [ ];
+    var texture = [ ];
+    var facemap = { };
+    var index = 0;
+        
+    var lines = text.split("\n");
+    for (var lineIndex in lines) {
+        var line = lines[lineIndex].replace(/[ \t]+/g, " ").replace(/\s\s*$/, "");
+        
+        // ignore comments
+        if (line[0] == "#")
+            continue;
+            
+        var array = line.split(" ");
+        if (array[0] == "v") {
+            // vertex
+            vertex.push(parseFloat(array[1]));
+            vertex.push(parseFloat(array[2]));
+            vertex.push(parseFloat(array[3]));
+        }
+        else if (array[0] == "vt") {
+            // normal
+            texture.push(parseFloat(array[1]));
+            texture.push(parseFloat(array[2]));
+        }
+        else if (array[0] == "vn") {
+            // normal
+            normal.push(parseFloat(array[1]));
+            normal.push(parseFloat(array[2]));
+            normal.push(parseFloat(array[3]));
+        }
+        else if (array[0] == "f") {
+            // face
+            if (array.length != 4) {
+                console.log("*** Error: face '"+line+"' not handled");
+                continue;
+            }
+            
+            for (var i = 1; i < 4; ++i) {
+                if (!(array[i] in facemap)) {
+                    // add a new entry to the map and arrays
+                    var f = array[i].split("/");
+                    var vtx, nor, tex;
+                    
+                    if (f.length == 1) {
+                        vtx = parseInt(f[0]) - 1;
+                        nor = vtx;
+                        tex = vtx;
+                    }
+                    else if (f.length = 3) {
+                        vtx = parseInt(f[0]) - 1;
+                        tex = parseInt(f[1]) - 1;
+                        nor = parseInt(f[2]) - 1;
+                    }
+                    else {
+                        console.log("*** Error: did not understand face '"+array[i]+"'");
+                        return null;
+                    }
+                    
+                    // do the vertices
+                    var x = 0;
+                    var y = 0;
+                    var z = 0;
+                    if (vtx * 3 + 2 < vertex.length) {
+                        x = vertex[vtx*3];
+                        y = vertex[vtx*3+1];
+                        z = vertex[vtx*3+2];
+                    }
+                    vertexArray.push(x);
+                    vertexArray.push(y);
+                    vertexArray.push(z);
+                    
+                    // do the textures
+                    x = 0;
+                    y = 0;
+                    if (tex * 2 + 1 < texture.length) {
+                        x = texture[tex*2];
+                        y = texture[tex*2+1];
+                    }
+                    textureArray.push(x);
+                    textureArray.push(y);
+                    
+                    // do the normals
+                    x = 0;
+                    y = 0;
+                    z = 1;
+                    if (nor * 3 + 2 < normal.length) {
+                        x = normal[nor*3];
+                        y = normal[nor*3+1];
+                        z = normal[nor*3+2];
+                    }
+                    normalArray.push(x);
+                    normalArray.push(y);
+                    normalArray.push(z);
+                    
+                    facemap[array[i]] = index++;
+                }
+                
+                indexArray.push(facemap[array[i]]);
+            }
+        }
+    }
+
+    // set the VBOs
+    obj.normalObject = obj.ctx.createBuffer();
+    obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.normalObject);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(normalArray), obj.ctx.STATIC_DRAW);
+
+    obj.texCoordObject = obj.ctx.createBuffer();
+    obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.texCoordObject);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(textureArray), obj.ctx.STATIC_DRAW);
+
+    obj.vertexObject = obj.ctx.createBuffer();
+    obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.vertexObject);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(vertexArray), obj.ctx.STATIC_DRAW);
+    
+    obj.numIndices = indexArray.length;
+    obj.indexObject = obj.ctx.createBuffer();
+    obj.ctx.bindBuffer(obj.ctx.ELEMENT_ARRAY_BUFFER, obj.indexObject);
+    obj.ctx.bufferData(obj.ctx.ELEMENT_ARRAY_BUFFER, new CanvasUnsignedShortArray(indexArray), obj.ctx.STREAM_DRAW);
+    
+    obj.loaded = true;
+}
+
+//
+// loadImageTexture
+//
+// Load the image at the passed url, place it in a new CanvasTexture object and return the CanvasTexture.
+//
+function loadImageTexture(ctx, url)
+{
+    var texture = ctx.createTexture();
+    texture.image = new Image();
+    texture.image.onload = function() { doLoadImageTexture(ctx, texture.image, texture) }
+    texture.image.src = url;
+    return texture;
+}
+
+function doLoadImageTexture(ctx, image, texture)
+{
+    ctx.enable(ctx.TEXTURE_2D);
+    ctx.bindTexture(ctx.TEXTURE_2D, texture);
+    ctx.texImage2D(ctx.TEXTURE_2D, 0, image);
+    ctx.texParameteri(ctx.TEXTURE_2D, ctx.TEXTURE_MAG_FILTER, ctx.LINEAR);
+    ctx.texParameteri(ctx.TEXTURE_2D, ctx.TEXTURE_MIN_FILTER, ctx.LINEAR_MIPMAP_LINEAR);
+    ctx.texParameteri(ctx.TEXTURE_2D, ctx.TEXTURE_WRAP_S, ctx.CLAMP_TO_EDGE);
+    ctx.texParameteri(ctx.TEXTURE_2D, ctx.TEXTURE_WRAP_T, ctx.CLAMP_TO_EDGE);
+    ctx.generateMipmap(ctx.TEXTURE_2D)
+    ctx.bindTexture(ctx.TEXTURE_2D, 0);
+}
+
+//
+// Framerate object
+//
+// This object keeps track of framerate and displays it as the innerHTML text of the 
+// HTML element with the passed id. Once created you call snapshot at the end
+// of every rendering cycle. Every 500ms the framerate is updated in the HTML element.
+//
+Framerate = function(id)
+{
+    this.numFramerates = 10;
+    this.framerateUpdateInterval = 500;
+    this.id = id;
+
+    this.renderTime = -1;
+    this.framerates = [ ];
+    self = this;
+    var fr = function() { self.updateFramerate() }
+    setInterval(fr, this.framerateUpdateInterval);
+}
+
+Framerate.prototype.updateFramerate = function()
+{
+    var tot = 0;
+    for (var i = 0; i < this.framerates.length; ++i)
+        tot += this.framerates[i];
+        
+    var framerate = tot / this.framerates.length;
+    framerate = Math.round(framerate);
+    document.getElementById(this.id).innerHTML = "Framerate:"+framerate+"fps";
+}
+
+Framerate.prototype.snapshot = function()
+{
+    if (this.renderTime < 0)
+        this.renderTime = new Date().getTime();
+    else {
+        var newTime = new Date().getTime();
+        var t = newTime - this.renderTime;
+        var framerate = 1000/t;
+        this.framerates.push(framerate);
+        while (this.framerates.length > this.numFramerates)
+            this.framerates.shift();
+        this.renderTime = newTime;
+    }
+}
+
diff --git a/WebCore/manual-tests/wml/select-onpick-event-crash.wml b/WebCore/manual-tests/wml/select-onpick-event-crash.wml
new file mode 100644
index 0000000..07d0262
--- /dev/null
+++ b/WebCore/manual-tests/wml/select-onpick-event-crash.wml
@@ -0,0 +1,12 @@
+<?xml version="1.0"?>
+<!DOCTYPE wml PUBLIC "-//WAPFORUM//DTD WML 1.1//EN" "http://www.wapforum.org/DTD/wml_1.1.xml">
+<wml>
+    <card>
+        <select name="result" dmultiple="true">
+            <option onpick="#card2" value="foo">Foo</option>
+            <option onpick="#card2" value="bar">Bar</option>
+        </select>
+    </card>
+
+    <card id="card2">Test pass, if it didn't crash.</card>
+</wml>
diff --git a/WebCore/mathml/MathMLElement.cpp b/WebCore/mathml/MathMLElement.cpp
new file mode 100644
index 0000000..14febe5
--- /dev/null
+++ b/WebCore/mathml/MathMLElement.cpp
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "MathMLElement.h"
+
+#include "MathMLNames.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+    
+MathMLElement::MathMLElement(const QualifiedName& tagName, Document* document)
+    : StyledElement(tagName, document, CreateElementZeroRefCount)
+{
+}
+    
+PassRefPtr<MathMLElement> MathMLElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new MathMLElement(tagName, document);
+}
+
+RenderObject* MathMLElement::createRenderer(RenderArena*, RenderStyle* style)
+{
+    return RenderObject::createObject(this, style);
+}
+    
+    
+}
+
+#endif // ENABLE(MATHML)
diff --git a/WebCore/mathml/MathMLElement.h b/WebCore/mathml/MathMLElement.h
new file mode 100644
index 0000000..b00af47
--- /dev/null
+++ b/WebCore/mathml/MathMLElement.h
@@ -0,0 +1,45 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#ifndef MathMLElement_h
+#define MathMLElement_h
+
+#if ENABLE(MATHML)
+#include "StyledElement.h"
+
+namespace WebCore {
+    
+class MathMLElement : public StyledElement {
+public:
+    static PassRefPtr<MathMLElement> create(const QualifiedName& tagName, Document*);
+    
+    virtual bool isMathMLElement() const { return true; }
+    
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    
+protected:
+    MathMLElement(const QualifiedName& tagName, Document*);
+    
+};
+    
+}
+
+#endif // ENABLE(MATHML)
+#endif // MathMLElement_h
diff --git a/WebCore/mathml/MathMLInlineContainerElement.cpp b/WebCore/mathml/MathMLInlineContainerElement.cpp
new file mode 100644
index 0000000..2bb02f6
--- /dev/null
+++ b/WebCore/mathml/MathMLInlineContainerElement.cpp
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "MathMLInlineContainerElement.h"
+
+#include "MathMLNames.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+
+MathMLInlineContainerElement::MathMLInlineContainerElement(const QualifiedName& tagName, Document* document)
+    : MathMLElement(tagName, document)
+{
+}
+
+PassRefPtr<MathMLInlineContainerElement> MathMLInlineContainerElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new MathMLInlineContainerElement(tagName, document);
+}
+
+RenderObject* MathMLInlineContainerElement::createRenderer(RenderArena *, RenderStyle* style)
+{
+    // FIXME: This method will contain the specialized renderers based on element name
+    return RenderObject::createObject(this, style);
+}
+    
+    
+}
+
+#endif // ENABLE(MATHML)
+
diff --git a/WebCore/mathml/MathMLInlineContainerElement.h b/WebCore/mathml/MathMLInlineContainerElement.h
new file mode 100644
index 0000000..4529d3b
--- /dev/null
+++ b/WebCore/mathml/MathMLInlineContainerElement.h
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#ifndef MathMLInlineContainerElement_h
+#define MathMLInlineContainerElement_h
+
+#if ENABLE(MATHML)
+#include "MathMLElement.h"
+
+namespace WebCore {
+    
+class MathMLInlineContainerElement : public MathMLElement {
+public:
+    static PassRefPtr<MathMLInlineContainerElement> create(const QualifiedName& tagName, Document*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
+protected:
+    MathMLInlineContainerElement(const QualifiedName& tagName, Document*);
+
+};
+    
+}
+
+#endif // ENABLE(MATHML)
+#endif // MathMLInlineContainerElement_h
diff --git a/WebCore/mathml/MathMLMathElement.cpp b/WebCore/mathml/MathMLMathElement.cpp
new file mode 100644
index 0000000..8b083f4
--- /dev/null
+++ b/WebCore/mathml/MathMLMathElement.cpp
@@ -0,0 +1,46 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "MathMLMathElement.h"
+
+#include "MathMLNames.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+
+MathMLMathElement::MathMLMathElement(const QualifiedName& tagName, Document* document)
+    : MathMLInlineContainerElement(tagName, document)
+{
+}
+
+PassRefPtr<MathMLMathElement> MathMLMathElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new MathMLMathElement(tagName, document);
+}
+
+}
+
+#endif // ENABLE(MATHML)
diff --git a/WebCore/mathml/MathMLMathElement.h b/WebCore/mathml/MathMLMathElement.h
new file mode 100644
index 0000000..f363cd2
--- /dev/null
+++ b/WebCore/mathml/MathMLMathElement.h
@@ -0,0 +1,41 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#ifndef MathMLMathElement_h
+#define MathMLMathElement_h
+
+#if ENABLE(MATHML)
+#include "MathMLInlineContainerElement.h"
+
+namespace WebCore {
+    
+class MathMLMathElement : public MathMLInlineContainerElement {
+public:
+    static PassRefPtr<MathMLMathElement> create(const QualifiedName& tagName, Document*);
+    
+protected:
+    MathMLMathElement(const QualifiedName& tagName, Document*);
+    
+};
+    
+}
+
+#endif // ENABLE(MATHML)
+#endif // MathMLMathElement_h
diff --git a/WebCore/mathml/mathtags.in b/WebCore/mathml/mathtags.in
new file mode 100644
index 0000000..8704dbf
--- /dev/null
+++ b/WebCore/mathml/mathtags.in
@@ -0,0 +1,21 @@
+namespace="MathML"
+namespaceURI="http://www.w3.org/1998/Math/MathML"
+guardFactoryWith="ENABLE(MATHML)"
+exportStrings
+
+math
+mfrac interfaceName=MathMLInlineContainerElement
+mfenced interfaceName=MathMLInlineContainerElement
+msubsup interfaceName=MathMLInlineContainerElement
+mrow interfaceName=MathMLInlineContainerElement
+mover interfaceName=MathMLInlineContainerElement
+munder interfaceName=MathMLInlineContainerElement
+munderover interfaceName=MathMLInlineContainerElement
+msqrt interfaceName=MathMLInlineContainerElement
+mroot interfaceName=MathMLInlineContainerElement
+mi interfaceName=MathMLElement, createWithNew
+mn interfaceName=MathMLElement, createWithNew
+mo interfaceName=MathMLElement, createWithNew
+msub interfaceName=MathMLElement, createWithNew
+msup interfaceName=MathMLElement, createWithNew
+
diff --git a/WebCore/notifications/Notification.cpp b/WebCore/notifications/Notification.cpp
new file mode 100644
index 0000000..8dd168f
--- /dev/null
+++ b/WebCore/notifications/Notification.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "Notification.h"
+#include "NotificationContents.h"
+
+#include "Document.h"
+#include "EventNames.h"
+#include "WorkerContext.h" 
+
+namespace WebCore {
+
+Notification::Notification(const String& url, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider)
+    : ActiveDOMObject(context, this)
+    , m_isHTML(true)
+    , m_isShowing(false)
+    , m_presenter(provider)
+{
+    if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    m_notificationURL = context->completeURL(url);
+    if (url.isEmpty() || !m_notificationURL.isValid()) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+}
+
+Notification::Notification(const NotificationContents& contents, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider)
+    : ActiveDOMObject(context, this)
+    , m_isHTML(false)
+    , m_contents(contents)
+    , m_isShowing(false)
+    , m_presenter(provider)
+{
+    if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    KURL icon = context->completeURL(contents.icon());
+    if (!icon.isEmpty() && !icon.isValid()) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+}
+
+Notification::~Notification() 
+{
+    m_presenter->notificationObjectDestroyed(this);
+}
+
+void Notification::show() 
+{
+    // prevent double-showing
+    if (!m_isShowing)
+        m_isShowing = m_presenter->show(this);
+}
+
+void Notification::cancel() 
+{
+    if (m_isShowing)
+        m_presenter->cancel(this);
+}
+
+EventTargetData* Notification::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* Notification::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/WebCore/notifications/Notification.h b/WebCore/notifications/Notification.h
new file mode 100644
index 0000000..6545579
--- /dev/null
+++ b/WebCore/notifications/Notification.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Notification_h  
+#define Notification_h
+
+#include "ActiveDOMObject.h"
+#include "AtomicStringHash.h"
+#include "Event.h"
+#include "EventListener.h"
+#include "EventNames.h"
+#include "EventTarget.h"
+#include "ExceptionCode.h"
+#include "KURL.h"
+#include "NotificationPresenter.h"
+#include "NotificationContents.h"
+#include "RegisteredEventListener.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+#if ENABLE(NOTIFICATIONS)
+namespace WebCore {
+
+    class WorkerContext;
+
+    class Notification : public RefCounted<Notification>, public ActiveDOMObject, public EventTarget { 
+    public:
+        static Notification* create(const String& url, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider) { return new Notification(url, context, ec, provider); }
+        static Notification* create(const NotificationContents& contents, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider) { return new Notification(contents, context, ec, provider); }
+        
+        virtual ~Notification();
+
+        void show();
+        void cancel();
+    
+        bool isHTML() { return m_isHTML; }
+        KURL url() { return m_notificationURL; }
+        NotificationContents& contents() { return m_contents; }
+
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(display);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(close);
+    
+        using RefCounted<Notification>::ref;
+        using RefCounted<Notification>::deref;
+    
+        // EventTarget interface
+        virtual ScriptExecutionContext* scriptExecutionContext() const { return ActiveDOMObject::scriptExecutionContext(); }
+        virtual Notification* toNotification() { return this; }
+
+    private:
+        Notification(const String& url, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider);
+        Notification(const NotificationContents& fields, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider);
+
+        // EventTarget interface
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
+
+        bool m_isHTML;
+        KURL m_notificationURL;
+        NotificationContents m_contents;
+
+        bool m_isShowing;
+
+        NotificationPresenter* m_presenter;
+        
+        EventTargetData m_eventTargetData;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // Notifications_h
diff --git a/WebCore/notifications/Notification.idl b/WebCore/notifications/Notification.idl
new file mode 100644
index 0000000..ec6a9c8
--- /dev/null
+++ b/WebCore/notifications/Notification.idl
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module threads {
+
+    interface [
+        Conditional=NOTIFICATIONS,
+        EventTarget
+    ] Notification {
+        void show();
+        void cancel();
+
+        attribute EventListener ondisplay;
+        attribute EventListener onerror;
+        attribute EventListener onclose;
+
+        // EventTarget interface
+        [Custom] void addEventListener(in DOMString type, 
+                                       in EventListener listener, 
+                                       in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type, 
+                                          in EventListener listener, 
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
+    };
+
+}
diff --git a/WebCore/bindings/v8/V8WorkerContextObjectEventListener.cpp b/WebCore/notifications/NotificationCenter.cpp
index ce56563..94976a2 100644
--- a/WebCore/bindings/v8/V8WorkerContextObjectEventListener.cpp
+++ b/WebCore/notifications/NotificationCenter.cpp
@@ -30,30 +30,31 @@
 
 #include "config.h"
 
-#if ENABLE(WORKERS)
+#if ENABLE(NOTIFICATIONS)
 
-#include "V8WorkerContextObjectEventListener.h"
+#include "NotificationCenter.h"
 
-#include "WorkerContextExecutionProxy.h"
+#include "Document.h"
+#include "VoidCallback.h"
+#include "WorkerContext.h"
 
 namespace WebCore {
 
-static void weakObjectEventListenerCallback(v8::Persistent<v8::Value>, void* parameter)
-{
-    V8WorkerContextObjectEventListener* listener = static_cast<V8WorkerContextObjectEventListener*>(parameter);
-
-    // Remove the wrapper
-    listener->proxy()->removeEventListener(listener);
+NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter) 
+    : ActiveDOMObject(context, this)
+    , m_scriptExecutionContext(context)
+    , m_notificationPresenter(presenter) {}
 
-    listener->disposeListenerObject();
+int NotificationCenter::checkPermission() 
+{
+    return m_notificationPresenter->checkPermission(m_scriptExecutionContext->securityOrigin());
 }
 
-V8WorkerContextObjectEventListener::V8WorkerContextObjectEventListener(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
-    : V8WorkerContextEventListener(proxy, listener, isInline)
+void NotificationCenter::requestPermission(PassRefPtr<VoidCallback> callback)
 {
-    m_listener.MakeWeak(this, weakObjectEventListenerCallback);
+    m_notificationPresenter->requestPermission(m_scriptExecutionContext->securityOrigin(), callback);
 }
 
 } // namespace WebCore
 
-#endif // WORKERS
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/WebCore/notifications/NotificationCenter.h b/WebCore/notifications/NotificationCenter.h
new file mode 100644
index 0000000..596ab8b
--- /dev/null
+++ b/WebCore/notifications/NotificationCenter.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NotificationCenter_h
+#define NotificationCenter_h
+
+#include "Notification.h"
+#include "NotificationContents.h"
+#include "WorkerThread.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebCore {
+
+    class ScriptExecutionContext;
+
+    class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject { 
+    public:
+        static PassRefPtr<NotificationCenter> create(ScriptExecutionContext* context, NotificationPresenter* presenter) { return adoptRef(new NotificationCenter(context, presenter)); }
+        
+        Notification* createHTMLNotification(const String& URI, ExceptionCode& ec)
+        {
+            return Notification::create(KURL(ParsedURLString, URI), context(), ec, presenter());
+        }
+
+        Notification* createNotification(const String& iconURI, const String& title, const String& body, ExceptionCode& ec)
+        {
+            NotificationContents contents(iconURI, title, body);
+            return Notification::create(contents, context(), ec, presenter());
+        }
+
+        ScriptExecutionContext* context() const { return m_scriptExecutionContext; }
+        NotificationPresenter* presenter() const { return m_notificationPresenter; }
+
+        int checkPermission();
+        void requestPermission(PassRefPtr<VoidCallback> callback);
+
+    private:
+        NotificationCenter(ScriptExecutionContext*, NotificationPresenter*);
+
+        ScriptExecutionContext* m_scriptExecutionContext;
+        NotificationPresenter* m_notificationPresenter;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // NotificationCenter_h
diff --git a/WebCore/notifications/NotificationCenter.idl b/WebCore/notifications/NotificationCenter.idl
new file mode 100644
index 0000000..3f6e369
--- /dev/null
+++ b/WebCore/notifications/NotificationCenter.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module threads {
+
+    interface [
+        Conditional=NOTIFICATIONS
+    ] NotificationCenter {
+       [V8Custom] Notification createHTMLNotification(in DOMString url) raises(Exception);
+       [V8Custom] Notification createNotification(in DOMString iconUrl, in DOMString title, in DOMString body) raises(Exception);
+
+       int checkPermission();
+       [Custom] void requestPermission(in VoidCallback callback);
+    };
+
+}
diff --git a/WebCore/notifications/NotificationContents.h b/WebCore/notifications/NotificationContents.h
new file mode 100644
index 0000000..ebdc514
--- /dev/null
+++ b/WebCore/notifications/NotificationContents.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NotificationContents_h
+#define NotificationContents_h
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebCore {
+
+    class NotificationContents { 
+    public:
+        NotificationContents() {}
+        NotificationContents(const String& iconUrl, const String& title, const String& body) 
+            : m_icon(iconUrl)
+            , m_title(title)
+            , m_body(body) {}
+
+        String icon() const { return m_icon; }
+        String title() const { return m_title; }
+        String body() const { return m_body; }
+
+    private:
+        String m_icon;
+        String m_title;
+        String m_body;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // NotificationContents_h
diff --git a/WebCore/notifications/NotificationPresenter.h b/WebCore/notifications/NotificationPresenter.h
new file mode 100644
index 0000000..d70a3e9
--- /dev/null
+++ b/WebCore/notifications/NotificationPresenter.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NotificationPresenter_h
+#define NotificationPresenter_h
+
+#include <wtf/PassRefPtr.h>
+#include "VoidCallback.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebCore {
+
+    class Notification;
+    class SecurityOrigin;
+    class String;
+    
+    class NotificationPresenter {
+
+    public:
+        enum Permission { 
+            PermissionAllowed,     // User has allowed notifications
+            PermissionNotAllowed,  // User has not yet allowed
+            PermissionDenied       // User has explictly denied permission
+        };
+
+        virtual ~NotificationPresenter() {}
+
+        // Requests that a notification be shown.
+        virtual bool show(Notification* object) = 0;
+
+        // Requests that a notification that has already been shown be canceled.
+        virtual void cancel(Notification* object) = 0;
+
+        // Informs the presenter that a Notification object has been destroyed 
+        // (such as by a page transition).  The presenter may continue showing
+        // the notification, but must not attempt to call the event handlers.
+        virtual void notificationObjectDestroyed(Notification* object) = 0;
+
+        // Requests user permission to show desktop notifications from a particular
+        // origin.  The callback parameter should be run when the user has
+        // made a decision.
+        virtual void requestPermission(SecurityOrigin* origin, PassRefPtr<VoidCallback> callback) = 0;
+
+        // Checks the current level of permission.
+        virtual Permission checkPermission(SecurityOrigin* origin) = 0;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // NotificationPresenter_h
diff --git a/WebCore/page/Chrome.cpp b/WebCore/page/Chrome.cpp
index 5a5670e..96f0fb7 100644
--- a/WebCore/page/Chrome.cpp
+++ b/WebCore/page/Chrome.cpp
@@ -87,9 +87,9 @@ IntRect Chrome::windowToScreen(const IntRect& rect) const
     return m_client->windowToScreen(rect);
 }
 
-PlatformWidget Chrome::platformWindow() const
+PlatformPageClient Chrome::platformPageClient() const
 {
-    return m_client->platformWindow();
+    return m_client->platformPageClient();
 }
 
 void Chrome::contentsSizeChanged(Frame* frame, const IntSize& size) const
@@ -102,6 +102,11 @@ void Chrome::scrollRectIntoView(const IntRect& rect, const ScrollView* scrollVie
     m_client->scrollRectIntoView(rect, scrollView);
 }
 
+void Chrome::scrollbarsModeDidChange() const
+{
+    m_client->scrollbarsModeDidChange();
+}
+
 void Chrome::setWindowRect(const FloatRect& rect) const
 {
     m_client->setWindowRect(rect);
@@ -311,8 +316,10 @@ void Chrome::mouseDidMoveOverElement(const HitTestResult& result, unsigned modif
     }
     m_client->mouseDidMoveOverElement(result, modifierFlags);
 
+#if ENABLE(INSPECTOR)
     if (InspectorController* inspector = m_page->inspectorController())
         inspector->mouseDidMoveOverElement(result, modifierFlags);
+#endif
 }
 
 void Chrome::setToolTip(const HitTestResult& result)
@@ -403,6 +410,13 @@ bool Chrome::setCursor(PlatformCursorHandle cursor)
     return m_client->setCursor(cursor);
 }
 
+#if ENABLE(NOTIFICATIONS)
+NotificationPresenter* Chrome::notificationPresenter() const
+{
+    return m_client->notificationPresenter();
+}
+#endif
+
 // --------
 
 #if ENABLE(DASHBOARD_SUPPORT)
diff --git a/WebCore/page/Chrome.h b/WebCore/page/Chrome.h
index c26e450..033311d 100644
--- a/WebCore/page/Chrome.h
+++ b/WebCore/page/Chrome.h
@@ -44,6 +44,9 @@ namespace WebCore {
     class IntRect;
     class Page;
     class String;
+#if ENABLE(NOTIFICATIONS)
+    class NotificationPresenter;
+#endif
 
     struct FrameLoadRequest;
     struct WindowFeatures;
@@ -60,8 +63,9 @@ namespace WebCore {
         virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
         virtual IntPoint screenToWindow(const IntPoint&) const;
         virtual IntRect windowToScreen(const IntRect&) const;
-        virtual PlatformWidget platformWindow() const;
+        virtual PlatformPageClient platformPageClient() const;
         virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const;
+        virtual void scrollbarsModeDidChange() const;
 
         void contentsSizeChanged(Frame*, const IntSize&) const;
 
@@ -128,6 +132,10 @@ namespace WebCore {
         void focusNSView(NSView*);
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* notificationPresenter() const; 
+#endif
+
     private:
         Page* m_page;
         ChromeClient* m_client;
diff --git a/WebCore/page/ChromeClient.h b/WebCore/page/ChromeClient.h
index 409a492..5231603 100644
--- a/WebCore/page/ChromeClient.h
+++ b/WebCore/page/ChromeClient.h
@@ -62,6 +62,10 @@ namespace WebCore {
     class GraphicsLayer;
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    class NotificationPresenter;
+#endif
+
     class ChromeClient {
     public:
         virtual void chromeDestroyed() = 0;
@@ -124,11 +128,12 @@ namespace WebCore {
         virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect) = 0;
         virtual IntPoint screenToWindow(const IntPoint&) const = 0;
         virtual IntRect windowToScreen(const IntRect&) const = 0;
-        virtual PlatformWidget platformWindow() const = 0;
+        virtual PlatformPageClient platformPageClient() const = 0;
         virtual void contentsSizeChanged(Frame*, const IntSize&) const = 0;
         virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0; // Currently only Mac has a non empty implementation.
         // End methods used by HostWindow.
 
+        virtual void scrollbarsModeDidChange() const = 0;
         virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags) = 0;
 
         virtual void setToolTip(const String&, TextDirection) = 0;
@@ -152,6 +157,10 @@ namespace WebCore {
         virtual void dashboardRegionsChanged();
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+        virtual NotificationPresenter* notificationPresenter() const = 0;
+#endif
+
         virtual void populateVisitedLinks();
 
         virtual FloatRect customHighlightRect(Node*, const AtomicString& type, const FloatRect& lineRect);
@@ -166,7 +175,7 @@ namespace WebCore {
                                           float value, float proportion, ScrollbarControlPartMask);
         virtual bool paintCustomScrollCorner(GraphicsContext*, const FloatRect&);
 
-        // This is an asynchronous call. The ChromeClient can display UI asking the user for permission
+        // This can be either a synchronous or asynchronous call. The ChromeClient can display UI asking the user for permission
         // to use Geolococation. The ChromeClient must call Geolocation::setShouldClearCache() appropriately.
         virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) = 0;
             
@@ -194,6 +203,10 @@ namespace WebCore {
         virtual void scheduleCompositingLayerSync() = 0;
 #endif
 
+        virtual bool supportsFullscreenForNode(const Node*) { return false; }
+        virtual void enterFullscreenForNode(Node*) { }
+        virtual void exitFullscreenForNode(Node*) { }
+        
 #if PLATFORM(MAC)
         virtual KeyboardUIMode keyboardUIMode() { return KeyboardAccessDefault; }
 
diff --git a/WebCore/page/Console.cpp b/WebCore/page/Console.cpp
index b5c9bb2..79613d3 100644
--- a/WebCore/page/Console.cpp
+++ b/WebCore/page/Console.cpp
@@ -129,6 +129,9 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
     case ErrorMessageLevel:
         levelString = "ERROR";
         break;
+    case DebugMessageLevel:
+        levelString = "DEBUG";
+        break;
     default:
         ASSERT_NOT_REACHED();
         levelString = "UNKNOWN";
@@ -147,7 +150,9 @@ void Console::addMessage(MessageSource source, MessageType type, MessageLevel le
     if (source == JSMessageSource)
         page->chrome()->client()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
 
+#if ENABLE(INSPECTOR)
     page->inspectorController()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
+#endif
 
     if (!Console::shouldPrintExceptions())
         return;
@@ -173,7 +178,9 @@ void Console::addMessage(MessageType type, MessageLevel level, ScriptCallStack*
     if (getFirstArgumentAsString(callStack->state(), lastCaller, message))
         page->chrome()->client()->addMessageToConsole(JSMessageSource, type, level, message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
 
+#if ENABLE(INSPECTOR)
     page->inspectorController()->addMessageToConsole(JSMessageSource, type, level, callStack);
+#endif
 
     if (!Console::shouldPrintExceptions())
         return;
@@ -246,6 +253,7 @@ void Console::assertCondition(bool condition, ScriptCallStack* callStack)
 
 void Console::count(ScriptCallStack* callStack)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
@@ -257,6 +265,9 @@ void Console::count(ScriptCallStack* callStack)
     getFirstArgumentAsString(callStack->state(), lastCaller, title);
 
     page->inspectorController()->count(title, lastCaller.lineNumber(), lastCaller.sourceURL().string());
+#else
+    UNUSED_PARAM(callStack);
+#endif
 }
 
 #if ENABLE(WML)
@@ -293,19 +304,27 @@ void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
     if (!page)
         return;
 
+#if ENABLE(INSPECTOR)
     InspectorController* controller = page->inspectorController();
     // FIXME: log a console message when profiling is disabled.
     if (!controller->profilerEnabled())
         return;
+#endif
 
     JSC::UString resolvedTitle = title;
     if (title.isNull())   // no title so give it the next user initiated profile title.
+#if ENABLE(INSPECTOR)
         resolvedTitle = controller->getCurrentUserInitiatedProfileName(true);
+#else
+        resolvedTitle = "";
+#endif
 
     JSC::Profiler::profiler()->startProfiling(callStack->state(), resolvedTitle);
 
+#if ENABLE(INSPECTOR)
     const ScriptCallFrame& lastCaller = callStack->at(0);
     controller->addStartProfilingMessageToConsole(resolvedTitle, lastCaller.lineNumber(), lastCaller.sourceURL());
+#endif
 }
 
 void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
@@ -317,9 +336,11 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
     if (!this->page())
         return;
 
+#if ENABLE(INSPECTOR)
     InspectorController* controller = page->inspectorController();
     if (!controller->profilerEnabled())
         return;
+#endif
 
     RefPtr<JSC::Profile> profile = JSC::Profiler::profiler()->stopProfiling(callStack->state(), title);
     if (!profile)
@@ -327,14 +348,17 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
 
     m_profiles.append(profile);
 
+#if ENABLE(INSPECTOR)
     const ScriptCallFrame& lastCaller = callStack->at(0);
     controller->addProfile(profile, lastCaller.lineNumber(), lastCaller.sourceURL());
+#endif
 }
 
 #endif
 
 void Console::time(const String& title)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
@@ -345,10 +369,14 @@ void Console::time(const String& title)
         return;
 
     page->inspectorController()->startTiming(title);
+#else
+    UNUSED_PARAM(title);
+#endif
 }
 
 void Console::timeEnd(const String& title, ScriptCallStack* callStack)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
@@ -366,24 +394,34 @@ void Console::timeEnd(const String& title, ScriptCallStack* callStack)
 
     const ScriptCallFrame& lastCaller = callStack->at(0);
     page->inspectorController()->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lastCaller.lineNumber(), lastCaller.sourceURL().string());
+#else
+    UNUSED_PARAM(title);
+    UNUSED_PARAM(callStack);
+#endif
 }
 
 void Console::group(ScriptCallStack* callStack)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
 
     page->inspectorController()->startGroup(JSMessageSource, callStack);
+#else
+    UNUSED_PARAM(callStack);
+#endif
 }
 
 void Console::groupEnd()
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
 
     page->inspectorController()->endGroup(JSMessageSource, 0, String());
+#endif
 }
 
 void Console::warn(ScriptCallStack* callStack)
diff --git a/WebCore/page/Console.h b/WebCore/page/Console.h
index 6d4dbce..08d43e3 100644
--- a/WebCore/page/Console.h
+++ b/WebCore/page/Console.h
@@ -71,7 +71,8 @@ namespace WebCore {
         TipMessageLevel,
         LogMessageLevel,
         WarningMessageLevel,
-        ErrorMessageLevel
+        ErrorMessageLevel,
+        DebugMessageLevel
     };
 
     class Console : public RefCounted<Console> {
diff --git a/WebCore/page/ContextMenuController.cpp b/WebCore/page/ContextMenuController.cpp
index 0ec9d1c..1cf0014 100644
--- a/WebCore/page/ContextMenuController.cpp
+++ b/WebCore/page/ContextMenuController.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ContextMenuController.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "Chrome.h"
 #include "ContextMenu.h"
 #include "ContextMenuClient.h"
@@ -95,8 +97,10 @@ void ContextMenuController::handleContextMenuEvent(Event* event)
 
     m_contextMenu.set(new ContextMenu(result));
     m_contextMenu->populate();
+#if ENABLE(INSPECTOR)
     if (m_page->inspectorController()->enabled())
         m_contextMenu->addInspectElementItem();
+#endif
 
     PlatformMenuDescription customMenu = m_client->getCustomMenuFromDefaultItems(m_contextMenu.get());
     m_contextMenu->setPlatformDescription(customMenu);
@@ -162,10 +166,12 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         frame->editor()->copy();
         break;
     case ContextMenuItemTagGoBack:
-        frame->loader()->goBackOrForward(-1);
+        if (Page* page = frame->page())
+            page->goBackOrForward(-1);
         break;
     case ContextMenuItemTagGoForward:
-        frame->loader()->goBackOrForward(1);
+        if (Page* page = frame->page())
+            page->goBackOrForward(1);
         break;
     case ContextMenuItemTagStop:
         frame->loader()->stop();
@@ -325,13 +331,17 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         frame->editor()->changeBackToReplacedString(result.replacedString());
         break;
 #endif
+#if ENABLE(INSPECTOR)
     case ContextMenuItemTagInspectElement:
         if (Page* page = frame->page())
             page->inspectorController()->inspect(result.innerNonSharedNode());
         break;
+#endif
     default:
         break;
     }
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/WebCore/page/Coordinates.h b/WebCore/page/Coordinates.h
index 43870a1..bd29d42 100644
--- a/WebCore/page/Coordinates.h
+++ b/WebCore/page/Coordinates.h
@@ -50,7 +50,11 @@ public:
     bool canProvideAltitudeAccuracy() const { return m_canProvideAltitudeAccuracy; }
     bool canProvideHeading() const { return m_canProvideHeading; }
     bool canProvideSpeed() const { return m_canProvideSpeed; }
+<<<<<<< HEAD:WebCore/page/Coordinates.h
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Coordinates.h
 private:
     Coordinates(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed)
         : m_latitude(latitude)
diff --git a/WebCore/page/DOMTimer.cpp b/WebCore/page/DOMTimer.cpp
index c42a0dc..dd1e842 100644
--- a/WebCore/page/DOMTimer.cpp
+++ b/WebCore/page/DOMTimer.cpp
@@ -47,6 +47,9 @@ DOMTimer::DOMTimer(ScriptExecutionContext* context, ScheduledAction* action, int
     , m_action(action)
     , m_nextFireInterval(0)
     , m_repeatInterval(0)
+#if !ASSERT_DISABLED
+    , m_suspended(false)
+#endif
 {
     static int lastUsedTimeoutId = 0;
     ++lastUsedTimeoutId;
@@ -148,7 +151,10 @@ void DOMTimer::stop()
 
 void DOMTimer::suspend()
 {
-    ASSERT(!m_nextFireInterval && !m_repeatInterval);
+#if !ASSERT_DISABLED
+    ASSERT(!m_suspended);
+    m_suspended = true;
+#endif
     m_nextFireInterval = nextFireInterval();
     m_repeatInterval = repeatInterval();
     TimerBase::stop();
@@ -156,9 +162,11 @@ void DOMTimer::suspend()
 
 void DOMTimer::resume()
 {
+#if !ASSERT_DISABLED
+    ASSERT(m_suspended);
+    m_suspended = false;
+#endif
     start(m_nextFireInterval, m_repeatInterval);
-    m_nextFireInterval = 0;
-    m_repeatInterval = 0;
 }
 
 
diff --git a/WebCore/page/DOMTimer.h b/WebCore/page/DOMTimer.h
index 6d6271f..3c65258 100644
--- a/WebCore/page/DOMTimer.h
+++ b/WebCore/page/DOMTimer.h
@@ -66,6 +66,9 @@ namespace WebCore {
         OwnPtr<ScheduledAction> m_action;
         double m_nextFireInterval;
         double m_repeatInterval;
+#if !ASSERT_DISABLED
+        bool m_suspended;
+#endif
         static double s_minTimerInterval;
     };
 
diff --git a/WebCore/page/DOMWindow.cpp b/WebCore/page/DOMWindow.cpp
index e50b488..e80ce87 100644
--- a/WebCore/page/DOMWindow.cpp
+++ b/WebCore/page/DOMWindow.cpp
@@ -34,8 +34,11 @@
 #include "CString.h"
 #include "Chrome.h"
 #include "Console.h"
+#include "Database.h"
+#include "DOMApplicationCache.h"
 #include "DOMSelection.h"
 #include "DOMTimer.h"
+#include "PageTransitionEvent.h"
 #include "Document.h"
 #include "Element.h"
 #include "EventException.h"
@@ -54,32 +57,23 @@
 #include "Media.h"
 #include "MessageEvent.h"
 #include "Navigator.h"
+#include "NotificationCenter.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "PlatformScreen.h"
 #include "PlatformString.h"
 #include "Screen.h"
 #include "SecurityOrigin.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
+#include "Storage.h"
+#include "StorageArea.h"
+#include "StorageNamespace.h"
 #include "SuddenTermination.h"
 #include "WebKitPoint.h"
 #include <algorithm>
 #include <wtf/MathExtras.h>
 
-#if ENABLE(DATABASE)
-#include "Database.h"
-#endif
-
-#if ENABLE(DOM_STORAGE)
-#include "Storage.h"
-#include "StorageArea.h"
-#include "StorageNamespace.h"
-#endif
-
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "DOMApplicationCache.h"
-#endif
-
 using std::min;
 using std::max;
 
@@ -87,24 +81,20 @@ namespace WebCore {
 
 class PostMessageTimer : public TimerBase {
 public:
-    PostMessageTimer(DOMWindow* window, const String& message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannel> channel, SecurityOrigin* targetOrigin)
+    PostMessageTimer(DOMWindow* window, PassRefPtr<SerializedScriptValue> message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannelArray> channels, SecurityOrigin* targetOrigin)
         : m_window(window)
         , m_message(message)
         , m_origin(sourceOrigin)
         , m_source(source)
-        , m_channel(channel)
+        , m_channels(channels)
         , m_targetOrigin(targetOrigin)
     {
     }
 
     PassRefPtr<MessageEvent> event(ScriptExecutionContext* context)
     {
-        RefPtr<MessagePort> messagePort;
-        if (m_channel) {
-            messagePort = MessagePort::create(*context);
-            messagePort->entangle(m_channel.release());
-        }
-        return MessageEvent::create(m_message, m_origin, "", m_source, messagePort.release());
+        OwnPtr<MessagePortArray> messagePorts = MessagePort::entanglePorts(*context, m_channels.release());
+        return MessageEvent::create(messagePorts.release(), m_message, m_origin, "", m_source);
     }
     SecurityOrigin* targetOrigin() const { return m_targetOrigin.get(); }
 
@@ -115,90 +105,103 @@ private:
     }
 
     RefPtr<DOMWindow> m_window;
-    String m_message;
+    RefPtr<SerializedScriptValue> m_message;
     String m_origin;
     RefPtr<DOMWindow> m_source;
-    OwnPtr<MessagePortChannel> m_channel;
+    OwnPtr<MessagePortChannelArray> m_channels;
     RefPtr<SecurityOrigin> m_targetOrigin;
 };
 
-typedef HashMap<DOMWindow*, RegisteredEventListenerVector*> DOMWindowRegisteredEventListenerMap;
+typedef HashCountedSet<DOMWindow*> DOMWindowSet;
 
-static DOMWindowRegisteredEventListenerMap& pendingUnloadEventListenerMap()
+static DOMWindowSet& windowsWithUnloadEventListeners()
 {
-    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
-    return eventListenerMap;
+    DEFINE_STATIC_LOCAL(DOMWindowSet, windowsWithUnloadEventListeners, ());
+    return windowsWithUnloadEventListeners;
 }
 
-static DOMWindowRegisteredEventListenerMap& pendingBeforeUnloadEventListenerMap()
+static DOMWindowSet& windowsWithBeforeUnloadEventListeners()
 {
-    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
-    return eventListenerMap;
+    DEFINE_STATIC_LOCAL(DOMWindowSet, windowsWithBeforeUnloadEventListeners, ());
+    return windowsWithBeforeUnloadEventListeners;
 }
 
-static bool allowsPendingBeforeUnloadListeners(DOMWindow* window)
+static void addUnloadEventListener(DOMWindow* domWindow)
 {
-    ASSERT_ARG(window, window);
-    Frame* frame = window->frame();
-    Page* page = frame->page();
-    return page && frame == page->mainFrame();
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    if (set.isEmpty())
+        disableSuddenTermination();
+    set.add(domWindow);
 }
 
-static void addPendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
+static void removeUnloadEventListener(DOMWindow* domWindow)
 {
-    ASSERT_ARG(window, window);
-    ASSERT_ARG(listener, listener);
-
-    if (map.isEmpty())
-        disableSuddenTermination();
-
-    pair<DOMWindowRegisteredEventListenerMap::iterator, bool> result = map.add(window, 0);
-    if (result.second)
-        result.first->second = new RegisteredEventListenerVector;
-    result.first->second->append(listener);
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
+        return;
+    set.remove(it);
+    if (set.isEmpty())
+        enableSuddenTermination();
 }
 
-static void removePendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
+static void removeAllUnloadEventListeners(DOMWindow* domWindow)
 {
-    ASSERT_ARG(window, window);
-    ASSERT_ARG(listener, listener);
-
-    DOMWindowRegisteredEventListenerMap::iterator it = map.find(window);
-    ASSERT(it != map.end());
-
-    RegisteredEventListenerVector* listeners = it->second;
-    size_t index = listeners->find(listener);
-    ASSERT(index != WTF::notFound);
-    listeners->remove(index);
-
-    if (!listeners->isEmpty())
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
         return;
-
-    map.remove(it);
-    delete listeners;
-
-    if (map.isEmpty())
+    set.removeAll(it);
+    if (set.isEmpty())
         enableSuddenTermination();
 }
 
-static void removePendingEventListeners(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window)
+static void addBeforeUnloadEventListener(DOMWindow* domWindow)
 {
-    ASSERT_ARG(window, window);
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    if (set.isEmpty())
+        disableSuddenTermination();
+    set.add(domWindow);
+}
 
-    RegisteredEventListenerVector* listeners = map.take(window);
-    if (!listeners)
+static void removeBeforeUnloadEventListener(DOMWindow* domWindow)
+{
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
         return;
+    set.remove(it);
+    if (set.isEmpty())
+        enableSuddenTermination();
+}
 
-    delete listeners;
-
-    if (map.isEmpty())
+static void removeAllBeforeUnloadEventListeners(DOMWindow* domWindow)
+{
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
+        return;
+    set.removeAll(it);
+    if (set.isEmpty())
         enableSuddenTermination();
 }
 
+static bool allowsBeforeUnloadListeners(DOMWindow* window)
+{
+    ASSERT_ARG(window, window);
+    Frame* frame = window->frame();
+    if (!frame)
+        return false;
+    Page* page = frame->page();
+    if (!page)
+        return false;
+    return frame == page->mainFrame();
+}
+
 bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
 {
-    DOMWindowRegisteredEventListenerMap& map = pendingBeforeUnloadEventListenerMap();
-    if (map.isEmpty())
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    if (set.isEmpty())
         return true;
 
     static bool alreadyDispatched = false;
@@ -207,20 +210,21 @@ bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
         return true;
 
     Vector<RefPtr<DOMWindow> > windows;
-    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
-    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+    DOMWindowSet::iterator end = set.end();
+    for (DOMWindowSet::iterator it = set.begin(); it != end; ++it)
         windows.append(it->first);
 
     size_t size = windows.size();
     for (size_t i = 0; i < size; ++i) {
         DOMWindow* window = windows[i].get();
-        RegisteredEventListenerVector* listeners = map.get(window);
-        if (!listeners)
+        if (!set.contains(window))
             continue;
 
-        RegisteredEventListenerVector listenersCopy = *listeners;
         Frame* frame = window->frame();
-        if (!frame->shouldClose(&listenersCopy))
+        if (!frame)
+            continue;
+
+        if (!frame->shouldClose())
             return false;
     }
 
@@ -233,14 +237,13 @@ bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
 
 unsigned DOMWindow::pendingUnloadEventListeners() const
 {
-    RegisteredEventListenerVector* listeners = pendingUnloadEventListenerMap().get(const_cast<DOMWindow*>(this));
-    return listeners ? listeners->size() : 0;
+    return windowsWithUnloadEventListeners().count(const_cast<DOMWindow*>(this));
 }
 
 void DOMWindow::dispatchAllPendingUnloadEvents()
 {
-    DOMWindowRegisteredEventListenerMap& map = pendingUnloadEventListenerMap();
-    if (map.isEmpty())
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    if (set.isEmpty())
         return;
 
     static bool alreadyDispatched = false;
@@ -249,18 +252,18 @@ void DOMWindow::dispatchAllPendingUnloadEvents()
         return;
 
     Vector<RefPtr<DOMWindow> > windows;
-    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
-    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+    DOMWindowSet::iterator end = set.end();
+    for (DOMWindowSet::iterator it = set.begin(); it != end; ++it)
         windows.append(it->first);
 
     size_t size = windows.size();
     for (size_t i = 0; i < size; ++i) {
         DOMWindow* window = windows[i].get();
-        RegisteredEventListenerVector* listeners = map.get(window);
-        if (!listeners)
+        if (!set.contains(window))
             continue;
-        RegisteredEventListenerVector listenersCopy = *listeners;
-        window->dispatchUnloadEvent(&listenersCopy);
+
+        window->dispatchEvent(PageTransitionEvent::create(EventNames().pagehideEvent, false), window->document());
+        window->dispatchEvent(Event::create(eventNames().unloadEvent, false, false), window->document());
     }
 
     enableSuddenTermination();
@@ -374,8 +377,8 @@ DOMWindow::~DOMWindow()
     if (m_frame)
         m_frame->clearFormerDOMWindow(this);
 
-    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
-    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
+    removeAllUnloadEventListeners(this);
+    removeAllBeforeUnloadEventListeners(this);
 }
 
 ScriptExecutionContext* DOMWindow::scriptExecutionContext() const
@@ -454,8 +457,22 @@ void DOMWindow::clear()
         m_applicationCache->disconnectFrame();
     m_applicationCache = 0;
 #endif
+
+#if ENABLE(NOTIFICATIONS)
+    m_notifications = 0;
+#endif
 }
 
+#if ENABLE(ORIENTATION_EVENTS)
+int DOMWindow::orientation() const
+{
+    if (!m_frame)
+        return 0;
+    
+    return m_frame->orientation();
+}
+#endif
+
 Screen* DOMWindow::screen() const
 {
     if (!m_screen)
@@ -522,7 +539,7 @@ Console* DOMWindow::console() const
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 DOMApplicationCache* DOMWindow::applicationCache() const
 {
-    if (!m_applicationCache && m_frame && m_frame->settings() && m_frame->settings()->offlineWebApplicationCacheEnabled())
+    if (!m_applicationCache)
         m_applicationCache = DOMApplicationCache::create(m_frame);
     return m_applicationCache.get();
 }
@@ -560,7 +577,9 @@ Storage* DOMWindow::sessionStorage() const
         return 0;
 
     RefPtr<StorageArea> storageArea = page->sessionStorage()->storageArea(document->securityOrigin());
+#if ENABLE(INSPECTOR)
     page->inspectorController()->didUseDOMStorage(storageArea.get(), false, m_frame);
+#endif
 
     m_sessionStorage = Storage::create(m_frame, storageArea.release());
     return m_sessionStorage.get();
@@ -582,18 +601,50 @@ Storage* DOMWindow::localStorage() const
     if (!page->settings()->localStorageEnabled())
         return 0;
 
-    StorageNamespace* localStorage = page->group().localStorage();
-    RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(document->securityOrigin()) : 0; 
-    if (storageArea) {
-        page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
-        m_localStorage = Storage::create(m_frame, storageArea.release());
-    }
+    RefPtr<StorageArea> storageArea = page->group().localStorage()->storageArea(document->securityOrigin());
+#if ENABLE(INSPECTOR)
+    page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
+#endif
 
+    m_localStorage = Storage::create(m_frame, storageArea.release());
     return m_localStorage.get();
 }
 #endif
 
-void DOMWindow::postMessage(const String& message, MessagePort* messagePort, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
+#if ENABLE(NOTIFICATIONS)
+NotificationCenter* DOMWindow::webkitNotifications() const
+{
+    if (m_notifications)
+        return m_notifications.get();
+
+    Document* document = this->document();
+    if (!document)
+        return 0;
+    
+    Page* page = document->page();
+    if (!page)
+        return 0;
+
+    if (!page->settings()->experimentalNotificationsEnabled())
+        return 0;
+
+    NotificationPresenter* provider = page->chrome()->notificationPresenter();
+    if (provider) 
+        m_notifications = NotificationCenter::create(document, provider);    
+      
+    return m_notifications.get();
+}
+#endif
+
+void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
+{
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, targetOrigin, source, ec);
+}
+
+void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     if (!m_frame)
         return;
@@ -609,9 +660,7 @@ void DOMWindow::postMessage(const String& message, MessagePort* messagePort, con
         }
     }
 
-    OwnPtr<MessagePortChannel> channel;
-    if (messagePort)
-        channel = messagePort->disentangle(ec);
+    OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
     if (ec)
         return;
 
@@ -623,7 +672,7 @@ void DOMWindow::postMessage(const String& message, MessagePort* messagePort, con
     String sourceOrigin = sourceDocument->securityOrigin()->toString();
 
     // Schedule the message.
-    PostMessageTimer* timer = new PostMessageTimer(this, message, sourceOrigin, source, channel.release(), target.get());
+    PostMessageTimer* timer = new PostMessageTimer(this, message, sourceOrigin, source, channels.release(), target.get());
     timer->startOneShot(0);
 }
 
@@ -644,8 +693,7 @@ void DOMWindow::postMessageTimerFired(PostMessageTimer* t)
         }
     }
 
-    ExceptionCode ec = 0;
-    dispatchEvent(timer->event(document()), ec);
+    dispatchEvent(timer->event(document()));
 }
 
 DOMSelection* DOMWindow::getSelection()
@@ -692,12 +740,9 @@ void DOMWindow::close()
         return;
 
     Settings* settings = m_frame->settings();
-    bool allowScriptsToCloseWindows =
-        settings && settings->allowScriptsToCloseWindows();
+    bool allowScriptsToCloseWindows = settings && settings->allowScriptsToCloseWindows();
 
-    if (m_frame->loader()->openedByDOM()
-        || m_frame->loader()->getHistoryLength() <= 1
-        || allowScriptsToCloseWindows)
+    if (page->openedByDOM() || page->getHistoryLength() <= 1 || allowScriptsToCloseWindows)
         m_frame->scheduleClose();
 }
 
@@ -1214,104 +1259,38 @@ void DOMWindow::clearInterval(int timeoutId)
     DOMTimer::removeById(scriptExecutionContext(), timeoutId);
 }
 
-void DOMWindow::handleEvent(Event* event, bool useCapture, RegisteredEventListenerVector* alternateListeners)
+bool DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    RegisteredEventListenerVector& listeners = (alternateListeners ? *alternateListeners : m_eventListeners);
-    if (listeners.isEmpty())
-        return;
-
-    // If any HTML event listeners are registered on the window, dispatch them here.
-    RegisteredEventListenerVector listenersCopy = listeners;
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, true);
-    }
-}
+    if (!EventTarget::addEventListener(eventType, listener, useCapture))
+        return false;
 
-void DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-{
-    // Remove existing identical listener set with identical arguments.
-    // The DOM 2 spec says that "duplicate instances are discarded" in this case.
-    removeEventListener(eventType, listener.get(), useCapture);
     if (Document* document = this->document())
         document->addListenerTypeIfNeeded(eventType);
 
-    RefPtr<RegisteredEventListener> registeredListener = RegisteredEventListener::create(eventType, listener, useCapture);
-    m_eventListeners.append(registeredListener);
-
     if (eventType == eventNames().unloadEvent)
-        addPendingEventListener(pendingUnloadEventListenerMap(), this, registeredListener.get());
-    else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
-        addPendingEventListener(pendingBeforeUnloadEventListenerMap(), this, registeredListener.get());
-}
+        addUnloadEventListener(this);
+    else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
+        addBeforeUnloadEventListener(this);
 
-void DOMWindow::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_eventListeners[i];
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
-            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
-                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
-            r.setRemoved(true);
-            m_eventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-bool DOMWindow::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
-{
-    ASSERT(!eventDispatchForbidden());
-
-    RefPtr<Event> event = e;
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    RefPtr<DOMWindow> protect(this);
-
-    event->setTarget(this);
-    event->setCurrentTarget(this);
-
-    handleEvent(event.get(), true);
-    handleEvent(event.get(), false);
-
-    return !event->defaultPrevented();
-}
-
-void DOMWindow::dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    dispatchEvent(Event::create(eventType, canBubble, cancelable), ec);
+    return true;
 }
 
-// This function accommodates the Firefox quirk of dispatching the load, unload and
-// beforeunload events on the window, but setting event.target to be the Document. 
-inline void DOMWindow::dispatchEventWithDocumentAsTarget(PassRefPtr<Event> e, RegisteredEventListenerVector* alternateEventListeners)
+bool DOMWindow::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    ASSERT(!eventDispatchForbidden());
-
-    RefPtr<Event> event = e;
-    RefPtr<DOMWindow> protect(this);
-    RefPtr<Document> document = this->document();
+    if (!EventTarget::removeEventListener(eventType, listener, useCapture))
+        return false;
 
-    event->setTarget(document);
-    event->setCurrentTarget(this);
+    if (eventType == eventNames().unloadEvent)
+        removeUnloadEventListener(this);
+    else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
+        removeBeforeUnloadEventListener(this);
 
-    handleEvent(event.get(), true, alternateEventListeners);
-    handleEvent(event.get(), false, alternateEventListeners);
+    return true;
 }
 
 void DOMWindow::dispatchLoadEvent()
 {
-    dispatchEventWithDocumentAsTarget(Event::create(eventNames().loadEvent, false, false));
+    dispatchEvent(Event::create(eventNames().loadEvent, false, false), document());
 
     // For load events, send a separate load event to the enclosing frame only.
     // This is a DOM extension and is independent of bubbling/capturing rules of
@@ -1322,704 +1301,54 @@ void DOMWindow::dispatchLoadEvent()
         ownerEvent->setTarget(ownerElement);
         ownerElement->dispatchGenericEvent(ownerEvent.release());
     }
-}
-
-void DOMWindow::dispatchUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
-{
-    dispatchEventWithDocumentAsTarget(Event::create(eventNames().unloadEvent, false, false), alternateEventListeners);
-}
 
-PassRefPtr<BeforeUnloadEvent> DOMWindow::dispatchBeforeUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
-{
-    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
-    dispatchEventWithDocumentAsTarget(beforeUnloadEvent.get(), alternateEventListeners);
-    return beforeUnloadEvent.release();
-}
-
-void DOMWindow::removeAllEventListeners()
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i)
-        m_eventListeners[i]->setRemoved(true);
-    m_eventListeners.clear();
-
-    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
-    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
-}
-
-bool DOMWindow::hasEventListener(const AtomicString& eventType)
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_eventListeners[i]->eventType() == eventType)
-            return true;
-    }
-    return false;
-}
-
-void DOMWindow::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    clearAttributeEventListener(eventType);
-    if (listener)
-        addEventListener(eventType, listener, false);
-}
-
-void DOMWindow::clearAttributeEventListener(const AtomicString& eventType)
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_eventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isAttribute()) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
-            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
-                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
-            r.setRemoved(true);
-            m_eventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-EventListener* DOMWindow::getAttributeEventListener(const AtomicString& eventType) const
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_eventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isAttribute())
-            return r.listener();
-    }
-    return 0;
-}
-
-EventListener* DOMWindow::onabort() const
-{
-    return getAttributeEventListener(eventNames().abortEvent);
-}
-
-void DOMWindow::setOnabort(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().abortEvent, eventListener);
-}
-
-EventListener* DOMWindow::onblur() const
-{
-    return getAttributeEventListener(eventNames().blurEvent);
-}
-
-void DOMWindow::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().blurEvent, eventListener);
-}
-
-EventListener* DOMWindow::onchange() const
-{
-    return getAttributeEventListener(eventNames().changeEvent);
-}
-
-void DOMWindow::setOnchange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().changeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onclick() const
-{
-    return getAttributeEventListener(eventNames().clickEvent);
-}
-
-void DOMWindow::setOnclick(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().clickEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondblclick() const
-{
-    return getAttributeEventListener(eventNames().dblclickEvent);
-}
-
-void DOMWindow::setOndblclick(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dblclickEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondrag() const
-{
-    return getAttributeEventListener(eventNames().dragEvent);
-}
-
-void DOMWindow::setOndrag(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragend() const
-{
-    return getAttributeEventListener(eventNames().dragendEvent);
-}
-
-void DOMWindow::setOndragend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragendEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragenter() const
-{
-    return getAttributeEventListener(eventNames().dragenterEvent);
-}
-
-void DOMWindow::setOndragenter(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragenterEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragleave() const
-{
-    return getAttributeEventListener(eventNames().dragleaveEvent);
-}
-
-void DOMWindow::setOndragleave(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragover() const
-{
-    return getAttributeEventListener(eventNames().dragoverEvent);
-}
-
-void DOMWindow::setOndragover(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragoverEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragstart() const
-{
-    return getAttributeEventListener(eventNames().dragstartEvent);
-}
-
-void DOMWindow::setOndragstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragstartEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondrop() const
-{
-    return getAttributeEventListener(eventNames().dropEvent);
-}
-
-void DOMWindow::setOndrop(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dropEvent, eventListener);
-}
-
-EventListener* DOMWindow::onerror() const
-{
-    return getAttributeEventListener(eventNames().errorEvent);
-}
-
-void DOMWindow::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().errorEvent, eventListener);
-}
-
-EventListener* DOMWindow::onfocus() const
-{
-    return getAttributeEventListener(eventNames().focusEvent);
-}
-
-void DOMWindow::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().focusEvent, eventListener);
-}
-
-EventListener* DOMWindow::onkeydown() const
-{
-    return getAttributeEventListener(eventNames().keydownEvent);
-}
-
-void DOMWindow::setOnkeydown(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keydownEvent, eventListener);
-}
-
-EventListener* DOMWindow::onkeypress() const
-{
-    return getAttributeEventListener(eventNames().keypressEvent);
-}
-
-void DOMWindow::setOnkeypress(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keypressEvent, eventListener);
-}
-
-EventListener* DOMWindow::onkeyup() const
-{
-    return getAttributeEventListener(eventNames().keyupEvent);
-}
-
-void DOMWindow::setOnkeyup(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keyupEvent, eventListener);
-}
-
-EventListener* DOMWindow::onload() const
-{
-    return getAttributeEventListener(eventNames().loadEvent);
-}
-
-void DOMWindow::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmousedown() const
-{
-    return getAttributeEventListener(eventNames().mousedownEvent);
-}
-
-void DOMWindow::setOnmousedown(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousedownEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmousemove() const
-{
-    return getAttributeEventListener(eventNames().mousemoveEvent);
-}
-
-void DOMWindow::setOnmousemove(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmouseout() const
-{
-    return getAttributeEventListener(eventNames().mouseoutEvent);
-}
-
-void DOMWindow::setOnmouseout(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmouseover() const
-{
-    return getAttributeEventListener(eventNames().mouseoverEvent);
-}
-
-void DOMWindow::setOnmouseover(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmouseup() const
-{
-    return getAttributeEventListener(eventNames().mouseupEvent);
-}
-
-void DOMWindow::setOnmouseup(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseupEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmousewheel() const
-{
-    return getAttributeEventListener(eventNames().mousewheelEvent);
-}
-
-void DOMWindow::setOnmousewheel(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
-}
-
-EventListener* DOMWindow::onoffline() const
-{
-    return getAttributeEventListener(eventNames().offlineEvent);
-}
-
-void DOMWindow::setOnoffline(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().offlineEvent, eventListener);
-}
-
-EventListener* DOMWindow::ononline() const
-{
-    return getAttributeEventListener(eventNames().onlineEvent);
-}
-
-void DOMWindow::setOnonline(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().onlineEvent, eventListener);
-}
-
-EventListener* DOMWindow::onreset() const
-{
-    return getAttributeEventListener(eventNames().resetEvent);
-}
-
-void DOMWindow::setOnreset(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().resetEvent, eventListener);
-}
-
-EventListener* DOMWindow::onresize() const
-{
-    return getAttributeEventListener(eventNames().resizeEvent);
-}
-
-void DOMWindow::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onscroll() const
-{
-    return getAttributeEventListener(eventNames().scrollEvent);
-}
-
-void DOMWindow::setOnscroll(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().scrollEvent, eventListener);
-}
-
-EventListener* DOMWindow::onsearch() const
-{
-    return getAttributeEventListener(eventNames().searchEvent);
-}
-
-void DOMWindow::setOnsearch(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().searchEvent, eventListener);
-}
-
-EventListener* DOMWindow::onselect() const
-{
-    return getAttributeEventListener(eventNames().selectEvent);
-}
-
-void DOMWindow::setOnselect(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().selectEvent, eventListener);
-}
-
-EventListener* DOMWindow::onstorage() const
-{
-    return getAttributeEventListener(eventNames().storageEvent);
-}
-
-void DOMWindow::setOnstorage(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().storageEvent, eventListener);
-}
-
-EventListener* DOMWindow::onsubmit() const
-{
-    return getAttributeEventListener(eventNames().submitEvent);
-}
-
-void DOMWindow::setOnsubmit(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().submitEvent, eventListener);
-}
-
-EventListener* DOMWindow::onunload() const
-{
-    return getAttributeEventListener(eventNames().unloadEvent);
-}
-
-void DOMWindow::setOnunload(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().unloadEvent, eventListener);
-}
-
-EventListener* DOMWindow::onbeforeunload() const
-{
-    return getAttributeEventListener(eventNames().beforeunloadEvent);
-}
-
-void DOMWindow::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkitanimationstart() const
-{
-    return getAttributeEventListener(eventNames().webkitAnimationStartEvent);
-}
-
-void DOMWindow::setOnwebkitanimationstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitAnimationStartEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkitanimationiteration() const
-{
-    return getAttributeEventListener(eventNames().webkitAnimationIterationEvent);
-}
-
-void DOMWindow::setOnwebkitanimationiteration(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitAnimationIterationEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkitanimationend() const
-{
-    return getAttributeEventListener(eventNames().webkitAnimationEndEvent);
-}
-
-void DOMWindow::setOnwebkitanimationend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitAnimationEndEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkittransitionend() const
-{
-    return getAttributeEventListener(eventNames().webkitTransitionEndEvent);
-}
-
-void DOMWindow::setOnwebkittransitionend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitTransitionEndEvent, eventListener);
-}
-
-EventListener* DOMWindow::oncanplay() const
-{
-    return getAttributeEventListener(eventNames().canplayEvent);
-}
-
-void DOMWindow::setOncanplay(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().canplayEvent, eventListener);
-}
-
-EventListener* DOMWindow::oncanplaythrough() const
-{
-    return getAttributeEventListener(eventNames().canplaythroughEvent);
-}
-
-void DOMWindow::setOncanplaythrough(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().canplaythroughEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondurationchange() const
-{
-    return getAttributeEventListener(eventNames().durationchangeEvent);
-}
-
-void DOMWindow::setOndurationchange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().durationchangeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onemptied() const
-{
-    return getAttributeEventListener(eventNames().emptiedEvent);
-}
-
-void DOMWindow::setOnemptied(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().emptiedEvent, eventListener);
-}
-
-EventListener* DOMWindow::onended() const
-{
-    return getAttributeEventListener(eventNames().endedEvent);
-}
-
-void DOMWindow::setOnended(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().endedEvent, eventListener);
-}
-
-EventListener* DOMWindow::onloadeddata() const
-{
-    return getAttributeEventListener(eventNames().loadeddataEvent);
-}
-
-void DOMWindow::setOnloadeddata(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadeddataEvent, eventListener);
-}
-
-EventListener* DOMWindow::onloadedmetadata() const
-{
-    return getAttributeEventListener(eventNames().loadedmetadataEvent);
-}
-
-void DOMWindow::setOnloadedmetadata(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadedmetadataEvent, eventListener);
-}
-
-EventListener* DOMWindow::onpause() const
-{
-    return getAttributeEventListener(eventNames().pauseEvent);
-}
-
-void DOMWindow::setOnpause(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().pauseEvent, eventListener);
-}
-
-EventListener* DOMWindow::onplay() const
-{
-    return getAttributeEventListener(eventNames().playEvent);
-}
-
-void DOMWindow::setOnplay(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().playEvent, eventListener);
-}
-
-EventListener* DOMWindow::onplaying() const
-{
-    return getAttributeEventListener(eventNames().playingEvent);
-}
-
-void DOMWindow::setOnplaying(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().playingEvent, eventListener);
-}
-
-EventListener* DOMWindow::onratechange() const
-{
-    return getAttributeEventListener(eventNames().ratechangeEvent);
-}
-
-void DOMWindow::setOnratechange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().ratechangeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onseeked() const
-{
-    return getAttributeEventListener(eventNames().seekedEvent);
-}
-
-void DOMWindow::setOnseeked(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().seekedEvent, eventListener);
-}
-
-EventListener* DOMWindow::onseeking() const
-{
-    return getAttributeEventListener(eventNames().seekingEvent);
-}
-
-void DOMWindow::setOnseeking(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().seekingEvent, eventListener);
-}
-
-EventListener* DOMWindow::ontimeupdate() const
-{
-    return getAttributeEventListener(eventNames().timeupdateEvent);
-}
-
-void DOMWindow::setOntimeupdate(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().timeupdateEvent, eventListener);
-}
-
-EventListener* DOMWindow::onvolumechange() const
-{
-    return getAttributeEventListener(eventNames().volumechangeEvent);
-}
-
-void DOMWindow::setOnvolumechange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().volumechangeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwaiting() const
-{
-    return getAttributeEventListener(eventNames().waitingEvent);
-}
-
-void DOMWindow::setOnwaiting(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().waitingEvent, eventListener);
-}
-
-EventListener* DOMWindow::onloadstart() const
-{
-    return getAttributeEventListener(eventNames().loadstartEvent);
-}
-
-void DOMWindow::setOnloadstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadstartEvent, eventListener);
-}
-
-EventListener* DOMWindow::onprogress() const
-{
-    return getAttributeEventListener(eventNames().progressEvent);
-}
-
-void DOMWindow::setOnprogress(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().progressEvent, eventListener);
-}
-
-EventListener* DOMWindow::onstalled() const
-{
-    return getAttributeEventListener(eventNames().stalledEvent);
-}
-
-void DOMWindow::setOnstalled(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().stalledEvent, eventListener);
-}
+#if ENABLE(INSPECTOR)
+    if (!frame() || !frame()->page())
+        return;
 
-EventListener* DOMWindow::onsuspend() const
-{
-    return getAttributeEventListener(eventNames().suspendEvent);
+    if (InspectorController* controller = frame()->page()->inspectorController())
+        controller->mainResourceFiredLoadEvent(frame()->loader()->documentLoader(), url());
+#endif
 }
 
-void DOMWindow::setOnsuspend(PassRefPtr<EventListener> eventListener)
+bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
 {
-    setAttributeEventListener(eventNames().suspendEvent, eventListener);
-}
+    RefPtr<EventTarget> protect = this;
+    RefPtr<Event> event = prpEvent;
 
-EventListener* DOMWindow::oninput() const
-{
-    return getAttributeEventListener(eventNames().inputEvent);
-}
+    event->setTarget(prpTarget ? prpTarget : this);
+    event->setCurrentTarget(this);
+    event->setEventPhase(Event::AT_TARGET);
 
-void DOMWindow::setOninput(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().inputEvent, eventListener);
+    return fireEventListeners(event.get());
 }
 
-EventListener* DOMWindow::onmessage() const
+void DOMWindow::removeAllEventListeners()
 {
-    return getAttributeEventListener(eventNames().messageEvent);
-}
+    EventTarget::removeAllEventListeners();
 
-void DOMWindow::setOnmessage(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().messageEvent, eventListener);
+    removeAllUnloadEventListeners(this);
+    removeAllBeforeUnloadEventListeners(this);
 }
 
-EventListener* DOMWindow::oncontextmenu() const
+void DOMWindow::captureEvents()
 {
-    return getAttributeEventListener(eventNames().contextmenuEvent);
+    // Not implemented.
 }
 
-void DOMWindow::setOncontextmenu(PassRefPtr<EventListener> eventListener)
+void DOMWindow::releaseEvents()
 {
-    setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
+    // Not implemented.
 }
 
-void DOMWindow::captureEvents()
+EventTargetData* DOMWindow::eventTargetData()
 {
-    // Not implemented.
+    return &m_eventTargetData;
 }
 
-void DOMWindow::releaseEvents()
+EventTargetData* DOMWindow::ensureEventTargetData()
 {
-    // Not implemented.
+    return &m_eventTargetData;
 }
 
 #if ENABLE(TOUCH_EVENTS) // Android
diff --git a/WebCore/page/DOMWindow.h b/WebCore/page/DOMWindow.h
index 12caf7e..3e3cbb4 100644
--- a/WebCore/page/DOMWindow.h
+++ b/WebCore/page/DOMWindow.h
@@ -28,6 +28,7 @@
 
 #include "EventTarget.h"
 #include "KURL.h"
+#include "MessagePort.h"
 #include "PlatformString.h"
 #include "RegisteredEventListener.h"
 #include "SecurityOrigin.h"
@@ -53,11 +54,12 @@ namespace WebCore {
     class History;
     class Location;
     class Media;
-    class MessagePort;
     class Navigator;
     class Node;
+    class NotificationCenter;
     class PostMessageTimer;
     class ScheduledAction;
+    class SerializedScriptValue;
     class Screen;
     class WebKitPoint;
 
@@ -84,6 +86,13 @@ namespace WebCore {
 
         void clear();
 
+#if ENABLE(ORIENTATION_EVENTS)
+        // This is the interface orientation in degrees. Some examples are:
+        //  0 is straight up; -90 is when the device is rotated 90 clockwise;
+        //  90 is when rotated counter clockwise.
+        int orientation() const;
+#endif
+
         void setSecurityOrigin(SecurityOrigin* securityOrigin) { m_securityOrigin = securityOrigin; }
         SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
 
@@ -205,7 +214,13 @@ namespace WebCore {
         DOMApplicationCache* applicationCache() const;
 #endif
 
-        void postMessage(const String& message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
+#if ENABLE(NOTIFICATIONS)
+        NotificationCenter* webkitNotifications() const;
+#endif
+
+        void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         void postMessageTimerFired(PostMessageTimer*);
 
         void scrollBy(int x, int y) const;
@@ -226,17 +241,20 @@ namespace WebCore {
 
         // Events
         // EventTarget API
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+        virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual void removeAllEventListeners();
 
-        void handleEvent(Event*, bool useCapture, RegisteredEventListenerVector* = 0);
-
-        void dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+        using EventTarget::dispatchEvent;
+        bool dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget);
         void dispatchLoadEvent();
+<<<<<<< HEAD:WebCore/page/DOMWindow.h
         void dispatchUnloadEvent(RegisteredEventListenerVector* = 0);
         PassRefPtr<BeforeUnloadEvent> dispatchBeforeUnloadEvent(RegisteredEventListenerVector* = 0);
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/DOMWindow.h
 
+<<<<<<< HEAD:WebCore/page/DOMWindow.h
         // Used for legacy "onEvent" property APIs.
         void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
         void clearAttributeEventListener(const AtomicString& eventType);
@@ -333,7 +351,74 @@ namespace WebCore {
         void setOntouchmove(PassRefPtr<EventListener>);
         EventListener* ontouchcancel() const;
         void setOntouchcancel(PassRefPtr<EventListener>);
+=======
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(blur);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragenter);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragleave);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(hashchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseover);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseup);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mousewheel);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(offline);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(online);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pagehide);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pageshow);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(resize);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(storage);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(unload);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(timeupdate);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(volumechange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(waiting);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+#if ENABLE(ORIENTATION_EVENTS)
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(orientationchange);
+>>>>>>> webkit.org at 49305:WebCore/page/DOMWindow.h
 #endif
+<<<<<<< HEAD:WebCore/page/DOMWindow.h
         
         EventListener* oncanplay() const;
         void setOncanplay(PassRefPtr<EventListener>);
@@ -381,6 +466,13 @@ namespace WebCore {
         void setOnmessage(PassRefPtr<EventListener>);
         EventListener* oncontextmenu() const;
         void setOncontextmenu(PassRefPtr<EventListener>);
+=======
+
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationstart, webkitAnimationStart);
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationiteration, webkitAnimationIteration);
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationend, webkitAnimationEnd);
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkittransitionend, webkitTransitionEnd);
+>>>>>>> webkit.org at 49305:WebCore/page/DOMWindow.h
 
         void captureEvents();
         void releaseEvents();
@@ -415,8 +507,8 @@ namespace WebCore {
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
-
-        void dispatchEventWithDocumentAsTarget(PassRefPtr<Event>, RegisteredEventListenerVector* = 0);
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         KURL m_url;
@@ -441,8 +533,11 @@ namespace WebCore {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         mutable RefPtr<DOMApplicationCache> m_applicationCache;
 #endif
+#if ENABLE(NOTIFICATIONS)
+        mutable RefPtr<NotificationCenter> m_notifications;
+#endif
 
-        RegisteredEventListenerVector m_eventListeners;
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/DOMWindow.idl b/WebCore/page/DOMWindow.idl
index aba92f0..c8eafe6 100644
--- a/WebCore/page/DOMWindow.idl
+++ b/WebCore/page/DOMWindow.idl
@@ -39,6 +39,7 @@ module window {
         CustomNativeConverter,
         CustomPutFunction,
         ExtendsDOMGlobalObject,
+        EventTarget,
         GenerateNativeConverter,
         LegacyParent=JSDOMWindowBase
     ] DOMWindow {
@@ -55,7 +56,7 @@ module window {
         attribute [Replaceable] Navigator clientInformation;
         attribute [DoNotCheckDomainSecurity, JSCCustom, V8CustomSetter, V8DisallowShadowing] Location location;
 
-        attribute [Replaceable, CustomGetter] Event event;
+        attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;
 
         readonly attribute [Custom] Crypto crypto;
 
@@ -74,7 +75,7 @@ module window {
                                 in DOMString name,
                                 in [Optional] DOMString options);
 
-        [Custom] DOMObject showModalDialog(in DOMString url, 
+        [Custom] DOMObject showModalDialog(in DOMString url,
                                            in [Optional] DOMObject dialogArgs,
                                            in [Optional] DOMString featureArgs);
 
@@ -169,12 +170,28 @@ module window {
         readonly attribute Storage sessionStorage;
         readonly attribute Storage localStorage;
 #endif
+#if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
+        readonly attribute NotificationCenter webkitNotifications;
+#endif
+
+#if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
+        // This is the interface orientation in degrees. Some examples are:
+        //  0 is straight up; -90 is when the device is rotated 90 clockwise;
+        //  90 is when rotated counter clockwise.
+        readonly attribute long orientation;
+#endif
 
                  attribute [Replaceable] Console console;
 
         // cross-document messaging
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in DOMString message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] Array messagePorts, in DOMString targetOrigin)
             raises(DOMException);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
+        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
+            raises(DOMException);
+#endif
 
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
@@ -221,7 +238,9 @@ module window {
         attribute EventListener onended;
         attribute EventListener onerror;
         attribute EventListener onfocus;
+        attribute EventListener onhashchange;
         attribute EventListener oninput;
+        attribute EventListener oninvalid;
         attribute EventListener onkeydown;
         attribute EventListener onkeypress;
         attribute EventListener onkeyup;
@@ -238,6 +257,8 @@ module window {
         attribute EventListener onmousewheel;
         attribute EventListener onoffline;
         attribute EventListener ononline;
+        attribute EventListener onpagehide;
+        attribute EventListener onpageshow;
         attribute EventListener onpause;
         attribute EventListener onplay;
         attribute EventListener onplaying;
@@ -262,8 +283,6 @@ module window {
         // attribute EventListener onbeforeprint;
         // attribute EventListener onformchange;
         // attribute EventListener onforminput;
-        // attribute EventListener onhashchange;
-        // attribute EventListener oninvalid;
         // attribute EventListener onpopstate;
         // attribute EventListener onreadystatechange;
         // attribute EventListener onredo;
@@ -277,6 +296,9 @@ module window {
         attribute EventListener onwebkitanimationiteration;
         attribute EventListener onwebkitanimationstart;
         attribute EventListener onwebkittransitionend;
+#if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
+        attribute EventListener onorientationchange;
+#endif
 
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type,
@@ -419,13 +441,25 @@ module window {
         attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
 
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
+        attribute [Conditional=3D_CANVAS] CanvasRenderingContext3DConstructor CanvasRenderingContext3D;
         attribute TextMetricsConstructor TextMetrics;
 
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasArrayBufferConstructor CanvasArrayBuffer; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasByteArrayConstructor CanvasByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedByteArrayConstructor CanvasUnsignedByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasShortArrayConstructor CanvasShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedShortArrayConstructor CanvasUnsignedShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasIntArrayConstructor CanvasIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedIntArrayConstructor CanvasUnsignedIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasFloatArrayConstructor CanvasFloatArray; // Usable with new operator
+
         attribute EventConstructor Event;
+        attribute BeforeLoadEventConstructor BeforeLoadEvent;
         attribute KeyboardEventConstructor KeyboardEvent;
         attribute MouseEventConstructor MouseEvent;
         attribute MutationEventConstructor MutationEvent;
         attribute OverflowEventConstructor OverflowEvent;
+        attribute PageTransitionEventConstructor PageTransitionEvent;
         attribute ProgressEventConstructor ProgressEvent;
         attribute TextEventConstructor TextEvent;
         attribute UIEventConstructor UIEvent;
@@ -454,6 +488,10 @@ module window {
         attribute RangeConstructor Range;
         attribute RangeExceptionConstructor RangeException;
 
+#if ENABLE_EVENTSOURCE
+        attribute [JSCCustomGetter] EventSourceConstructor EventSource; // Usable with new the operator
+#endif
+
         // Mozilla has a separate XMLDocument object for XML documents. 
         // We just use Document for this.
         attribute DocumentConstructor XMLDocument;
@@ -465,9 +503,7 @@ module window {
         attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
         attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
 
-#if defined(ENABLE_XSLT) && ENABLE_XSLT
-        attribute [JSCCustomGetter] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
-#endif
+        attribute [JSCCustomGetter,Conditional=XSLT] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
 
 #if defined(ENABLE_CHANNEL_MESSAGING) && ENABLE_CHANNEL_MESSAGING
         attribute MessagePortConstructor MessagePort;
@@ -482,6 +518,10 @@ module window {
         attribute [JSCCustomGetter] SharedWorkerConstructor SharedWorker; // Usable with the new operator
 #endif
 
+#if defined(ENABLE_WEB_SOCKETS) && ENABLE_WEB_SOCKETS
+        attribute [JSCCustomGetter] WebSocketConstructor WebSocket; // Usable with the new operator
+#endif
+
         attribute PluginConstructor Plugin;
         attribute PluginArrayConstructor PluginArray;
 
diff --git a/WebCore/page/DragController.cpp b/WebCore/page/DragController.cpp
index 08fb872..634595a 100644
--- a/WebCore/page/DragController.cpp
+++ b/WebCore/page/DragController.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DragController.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #include "CSSStyleDeclaration.h"
 #include "Clipboard.h"
 #include "ClipboardAccessPolicy.h"
@@ -46,6 +47,7 @@
 #include "HTMLAnchorElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "HitTestRequest.h"
 #include "HitTestResult.h"
 #include "Image.h"
 #include "MoveSelectionCommand.h"
@@ -53,6 +55,7 @@
 #include "Page.h"
 #include "RenderFileUploadControl.h"
 #include "RenderImage.h"
+#include "RenderView.h"
 #include "ReplaceSelectionCommand.h"
 #include "ResourceRequest.h"
 #include "SelectionController.h"
@@ -107,7 +110,7 @@ static PassRefPtr<DocumentFragment> documentFragmentFromDragData(DragData* dragD
             String title;
             String url = dragData->asURL(&title);
             if (!url.isEmpty()) {
-                RefPtr<HTMLAnchorElement> anchor = new HTMLAnchorElement(document);
+                RefPtr<HTMLAnchorElement> anchor = HTMLAnchorElement::create(document);
                 anchor->setHref(url);
                 ExceptionCode ec;
                 RefPtr<Node> anchorText = document->createTextNode(title);
@@ -253,6 +256,25 @@ static HTMLInputElement* asFileInput(Node* node)
     return 0;
 }
 
+static Element* elementUnderMouse(Document* documentUnderMouse, const IntPoint& p)
+{
+    float zoomFactor = documentUnderMouse->frame()->pageZoomFactor();
+    IntPoint point = roundedIntPoint(FloatPoint(p.x() * zoomFactor, p.y() * zoomFactor));
+
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+    HitTestResult result(point);
+    documentUnderMouse->renderView()->layer()->hitTest(request, result);
+
+    Node* n = result.innerNode();
+    while (n && !n->isElementNode())
+        n = n->parentNode();
+    if (n)
+        n = n->shadowAncestorNode();
+
+    ASSERT(n);
+    return static_cast<Element*>(n);
+}
+
 bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction actionMask, DragOperation& operation)
 {
     ASSERT(dragData);
@@ -287,10 +309,8 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
             return true;
         }
 
-        IntPoint dragPos = dragData->clientPosition();
-        IntPoint point = frameView->windowToContents(dragPos);
-        Element* element = m_documentUnderMouse->elementFromPoint(point.x(), point.y());
-        ASSERT(element);
+        IntPoint point = frameView->windowToContents(dragData->clientPosition());
+        Element* element = elementUnderMouse(m_documentUnderMouse, point);
         if (!asFileInput(element)) {
             VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
             m_page->dragCaretController()->setSelection(dragCaret);
@@ -340,8 +360,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
         return false;
 
     IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
-    Element* element =  m_documentUnderMouse->elementFromPoint(point.x(), point.y());
-    ASSERT(element);
+    Element* element = elementUnderMouse(m_documentUnderMouse, point);
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);
 
@@ -630,6 +649,12 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
 
     if (isDHTMLDrag)
         dragImage = clipboard->createDragImage(dragImageOffset);
+    else {
+        // This drag operation is not a DHTML drag and may go outside the WebView.
+        // We provide a default set of allowed drag operations that follows from:
+        // http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430
+        m_sourceDragOperation = (DragOperation)(DragOperationGeneric | DragOperationCopy);
+    }
 
     // We allow DHTML/JS to set the drag image, even if its a link, image or text we're dragging.
     // This is in the spirit of the IE API, which allows overriding of pasteboard data and DragOp.
@@ -785,3 +810,5 @@ void DragController::placeDragCaret(const IntPoint& windowPoint)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index 937f08f..6b4031e 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -87,6 +87,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+#if ENABLE(DRAG_SUPPORT)
 // The link drag hysteresis is much larger than the others because there
 // needs to be enough space to cancel the link press without starting a link drag,
 // and because dragging links is rare.
@@ -94,6 +95,7 @@ const int LinkDragHysteresis = 40;
 const int ImageDragHysteresis = 5;
 const int TextDragHysteresis = 3;
 const int GeneralDragHysteresis = 3;
+#endif // ENABLE(DRAG_SUPPORT)
 
 // Match key code of composition keydown event on windows.
 // IE sends VK_PROCESSKEY which has value 229;
@@ -106,10 +108,9 @@ using namespace SVGNames;
 // When the autoscroll or the panScroll is triggered when do the scroll every 0.05s to make it smooth
 const double autoscrollInterval = 0.05;
 
-static Frame* subframeForTargetNode(Node*);
 static Frame* subframeForHitTestResult(const MouseEventWithHitTestResults&);
 
-static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDirection, ScrollDirection negativeDirection, PlatformWheelEvent& e, Node* node)
+static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDirection, ScrollDirection negativeDirection, PlatformWheelEvent& e, Node* node, Node** stopNode)
 {
     if (!delta)
         return;
@@ -118,12 +119,13 @@ static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDir
     RenderBox* enclosingBox = node->renderer()->enclosingBox();
 
     if (e.granularity() == ScrollByPageWheelEvent) {
-        if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1))
+        if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1, stopNode))
             e.accept();
         return;
-    } 
+    }
+
     float pixelsToScroll = delta > 0 ? delta : -delta;
-    if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll))
+    if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll, stopNode))
         e.accept();
 }
 
@@ -146,7 +148,9 @@ EventHandler::EventHandler(Frame* frame)
     , m_mousePressed(false)
     , m_capturesDragging(false)
     , m_mouseDownMayStartSelect(false)
+#if ENABLE(DRAG_SUPPORT)
     , m_mouseDownMayStartDrag(false)
+#endif
     , m_mouseDownWasSingleClickInSelection(false)
     , m_beganSelectingText(false)
     , m_panScrollInProgress(false)
@@ -179,11 +183,13 @@ EventHandler::~EventHandler()
 {
 }
     
+#if ENABLE(DRAG_SUPPORT)
 EventHandler::EventHandlerDragState& EventHandler::dragState()
 {
     DEFINE_STATIC_LOCAL(EventHandlerDragState, state, ());
     return state;
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 void EventHandler::clear()
 {
@@ -203,13 +209,16 @@ void EventHandler::clear()
     m_touch = 0;
 #endif
     m_frameSetBeingResized = 0;
+#if ENABLE(DRAG_SUPPORT)
     m_dragTarget = 0;
+#endif
     m_currentMousePosition = IntPoint();
     m_mousePressNode = 0;
     m_mousePressed = false;
     m_capturesDragging = false;
     m_capturingMouseEventsNode = 0;
     m_latchedWheelEventNode = 0;
+    m_previousWheelScrolledNode = 0;
 }
 
 void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
@@ -357,8 +366,10 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
 
 bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& event)
 {
+#if ENABLE(DRAG_SUPPORT)
     // Reset drag state.
     dragState().m_dragSrc = 0;
+#endif
 
     if (ScrollView* scrollView = m_frame->view()) {
         if (scrollView->isPointInScrollbarCorner(event.event().pos()))
@@ -371,8 +382,10 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     // so it's allowed to start a drag or selection.
     m_mouseDownMayStartSelect = canMouseDownStartSelect(event.targetNode());
     
+#if ENABLE(DRAG_SUPPORT)
     // Careful that the drag starting logic stays in sync with eventMayStartDrag()
     m_mouseDownMayStartDrag = singleClick;
+#endif
 
     m_mouseDownWasSingleClickInSelection = false;
 
@@ -400,7 +413,9 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     Node* innerNode = event.targetNode();
 
     m_mousePressNode = innerNode;
+#if ENABLE(DRAG_SUPPORT)
     m_dragStartPos = event.event().pos();
+#endif
 
     bool swallowEvent = false;
     m_frame->selection()->setCaretBlinkingSuspended(true);
@@ -420,6 +435,7 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     return swallowEvent;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& event)
 {
     if (handleDrag(event))
@@ -442,7 +458,7 @@ bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& e
         // If the selection is contained in a layer that can scroll, that layer should handle the autoscroll
         // Otherwise, let the bridge handle it so the view can scroll itself.
         RenderObject* renderer = targetNode->renderer();
-        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeProgramaticallyScrolled(false))) {
+        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeScrolledAndHasScrollableArea())) {
             if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
                 renderer = renderer->document()->ownerElement()->renderer();
             else
@@ -559,6 +575,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
         m_frame->selection()->setSelection(newSelection);
     }
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 bool EventHandler::handleMouseUp(const MouseEventWithHitTestResults& event)
 {
@@ -586,7 +603,9 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
     m_frame->selection()->setCaretBlinkingSuspended(false);
     m_mousePressed = false;
     m_capturesDragging = false;
+#if ENABLE(DRAG_SUPPORT)
     m_mouseDownMayStartDrag = false;
+#endif
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
     m_mouseDownWasInSubframe = false;
@@ -598,7 +617,9 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
     // on the selection, the selection goes away.  However, if we are
     // editing, place the caret.
     if (m_mouseDownWasSingleClickInSelection && !m_beganSelectingText
+#if ENABLE(DRAG_SUPPORT)
             && m_dragStartPos == event.event().pos()
+#endif
             && m_frame->selection()->isRange()
             && event.event().button() != RightButton) {
         VisibleSelection newSelection;
@@ -732,7 +753,7 @@ void EventHandler::updateAutoscrollRenderer()
     if (Node* nodeAtPoint = hitTest.innerNode())
         m_autoscrollRenderer = nodeAtPoint->renderer();
 
-    while (m_autoscrollRenderer && (!m_autoscrollRenderer->isBox() || !toRenderBox(m_autoscrollRenderer)->canBeProgramaticallyScrolled(false)))
+    while (m_autoscrollRenderer && (!m_autoscrollRenderer->isBox() || !toRenderBox(m_autoscrollRenderer)->canBeScrolledAndHasScrollableArea()))
         m_autoscrollRenderer = m_autoscrollRenderer->parent();
 }
 
@@ -741,6 +762,7 @@ void EventHandler::setAutoscrollRenderer(RenderObject* renderer)
     m_autoscrollRenderer = renderer;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
 {
     flagDHTML = false;
@@ -761,6 +783,7 @@ void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
     flagDHTML = (mask & DragSourceActionDHTML) != DragSourceActionNone;
     flagUA = ((mask & DragSourceActionImage) || (mask & DragSourceActionLink) || (mask & DragSourceActionSelection));
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent, bool ignoreClipping, HitTestScrollbars testScrollbars)
 {
@@ -883,8 +906,10 @@ bool EventHandler::scrollOverflow(ScrollDirection direction, ScrollGranularity g
     
     if (node) {
         RenderObject* r = node->renderer();
-        if (r && !r->isListBox())
-            return r->enclosingBox()->scroll(direction, granularity);
+        if (r && !r->isListBox() && r->enclosingBox()->scroll(direction, granularity)) {
+            setFrameWasScrolledByUser();
+            return true;
+        }
     }
 
     return false;
@@ -914,10 +939,10 @@ Frame* subframeForHitTestResult(const MouseEventWithHitTestResults& hitTestResul
 {
     if (!hitTestResult.isOverWidget())
         return 0;
-    return subframeForTargetNode(hitTestResult.targetNode());
+    return EventHandler::subframeForTargetNode(hitTestResult.targetNode());
 }
 
-Frame* subframeForTargetNode(Node* node)
+Frame* EventHandler::subframeForTargetNode(Node* node)
 {
     if (!node)
         return 0;
@@ -1117,7 +1142,9 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
     m_capturesDragging = true;
     m_currentMousePosition = mouseEvent.pos();
     m_mouseDownTimestamp = mouseEvent.timestamp();
+#if ENABLE(DRAG_SUPPORT)
     m_mouseDownMayStartDrag = false;
+#endif
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
     if (FrameView* view = m_frame->view())
@@ -1141,6 +1168,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 
     m_mousePressNode = mev.targetNode();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
         InspectorController* inspector = page->inspectorController();
         if (inspector && inspector->enabled() && inspector->searchingForNodeInPage()) {
@@ -1149,6 +1177,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
             return true;
         }
     }
+#endif
 
     Frame* subframe = subframeForHitTestResult(mev);
     if (subframe && passMousePressEventToSubframe(mev, subframe)) {
@@ -1172,7 +1201,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
     if (mouseEvent.button() == MiddleButton && !mev.isOverLink()) {
         RenderObject* renderer = mev.targetNode()->renderer();
 
-        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeProgramaticallyScrolled(false))) {
+        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeScrolledAndHasScrollableArea())) {
             if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
                 renderer = renderer->document()->ownerElement()->renderer();
             else
@@ -1393,8 +1422,10 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
         return true;
     
     swallowEvent = dispatchMouseEvent(eventNames().mousemoveEvent, mev.targetNode(), false, 0, mouseEvent, true);
+#if ENABLE(DRAG_SUPPORT)
     if (!swallowEvent)
         swallowEvent = handleMouseDraggedEvent(mev);
+#endif // ENABLE(DRAG_SUPPORT)
 
     return swallowEvent;
 }
@@ -1464,6 +1495,7 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
     return swallowMouseUpEvent || swallowClickEvent || swallowMouseReleaseEvent;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::dispatchDragEvent(const AtomicString& eventType, Node* dragTarget, const PlatformMouseEvent& event, Clipboard* clipboard)
 {
     FrameView* view = m_frame->view();
@@ -1508,15 +1540,15 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         // it is sometimes incorrect when dragging within subframes, as seen with
         // LayoutTests/fast/events/drag-in-frames.html.
         if (newTarget) {
-            if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
-                accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
+            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
+            if (frame)
+                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
         }
 
         if (m_dragTarget) {
-            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
-                            ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
+            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
             if (frame)
                 accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
@@ -1524,8 +1556,9 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         }
     } else {
         if (newTarget) {
-            if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
-                accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
+            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
+            if (frame)
+                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
         }
@@ -1571,6 +1604,7 @@ void EventHandler::clearDragState()
     m_sendingEventToSubview = false;
 #endif
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 void EventHandler::setCapturingMouseEventsNode(PassRefPtr<Node> n)
 {
@@ -1692,12 +1726,15 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
         swallowEvent = m_nodeUnderMouse->dispatchMouseEvent(mouseEvent, eventType, clickCount);
     
     if (!swallowEvent && eventType == eventNames().mousedownEvent) {
+        // The layout needs to be up to date to determine if an element is focusable.
+        m_frame->document()->updateLayoutIgnorePendingStylesheets();
+
         // Blur current focus node when a link/button is clicked; this
         // is expected by some sites that rely on onChange handlers running
         // from form fields before the button click is processed.
         Node* node = m_nodeUnderMouse.get();
         RenderObject* renderer = node ? node->renderer() : 0;
-                
+
         // Walk up the render tree to search for a node to focus.
         // Walking up the DOM tree wouldn't work for shadow trees, like those behind the engine-based text fields.
         while (renderer) {
@@ -1736,6 +1773,13 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
     return swallowEvent;
 }
 
+#if !PLATFORM(GTK)
+bool EventHandler::shouldTurnVerticalTicksIntoHorizontal(const HitTestResult&) const
+{
+    return false;
+}
+#endif
+
 bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
 {
     Document* doc = m_frame->document();
@@ -1749,35 +1793,39 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
     FrameView* view = m_frame->view();
     if (!view)
         return false;
+    setFrameWasScrolledByUser();
     IntPoint vPoint = view->windowToContents(e.pos());
 
     Node* node;
     bool isOverWidget;
     bool didSetLatchedNode = false;
-    
+
+    HitTestRequest request(HitTestRequest::ReadOnly);
+    HitTestResult result(vPoint);
+    doc->renderView()->layer()->hitTest(request, result);
+
     if (m_useLatchedWheelEventNode) {
         if (!m_latchedWheelEventNode) {
-            HitTestRequest request(HitTestRequest::ReadOnly);
-            HitTestResult result(vPoint);
-            doc->renderView()->layer()->hitTest(request, result);
             m_latchedWheelEventNode = result.innerNode();
             m_widgetIsLatched = result.isOverWidget();
             didSetLatchedNode = true;
         }
-        
+
         node = m_latchedWheelEventNode.get();
         isOverWidget = m_widgetIsLatched;
     } else {
         if (m_latchedWheelEventNode)
             m_latchedWheelEventNode = 0;
-        
-        HitTestRequest request(HitTestRequest::ReadOnly);
-        HitTestResult result(vPoint);
-        doc->renderView()->layer()->hitTest(request, result);
+        if (m_previousWheelScrolledNode)
+            m_previousWheelScrolledNode = 0;
+
         node = result.innerNode();
         isOverWidget = result.isOverWidget();
     }
-    
+
+    if (shouldTurnVerticalTicksIntoHorizontal(result))
+        e.turnVerticalTicksIntoHorizontal();
+
     if (node) {
         // Figure out which view to send the event to.
         RenderObject* target = node->renderer();
@@ -1794,17 +1842,20 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         node->dispatchWheelEvent(e);
         if (e.isAccepted())
             return true;
-        
+
         // If we don't have a renderer, send the wheel event to the first node we find with a renderer.
         // This is needed for <option> and <optgroup> elements so that <select>s get a wheel scroll.
         while (node && !node->renderer())
             node = node->parent();
-        
+
         if (node && node->renderer()) {
             // Just break up into two scrolls if we need to.  Diagonal movement on 
             // a MacBook pro is an example of a 2-dimensional mouse wheel event (where both deltaX and deltaY can be set).
-            scrollAndAcceptEvent(e.deltaX(), ScrollLeft, ScrollRight, e, node);
-            scrollAndAcceptEvent(e.deltaY(), ScrollUp, ScrollDown, e, node);
+            Node* stopNode = m_previousWheelScrolledNode.get();
+            scrollAndAcceptEvent(e.deltaX(), ScrollLeft, ScrollRight, e, node, &stopNode);
+            scrollAndAcceptEvent(e.deltaY(), ScrollUp, ScrollDown, e, node, &stopNode);
+            if (!m_useLatchedWheelEventNode)
+                m_previousWheelScrolledNode = stopNode;
         }
     }
 
@@ -1819,6 +1870,7 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
     return e.isAccepted();
 }
 
+#if ENABLE(CONTEXT_MENUS)
 bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
 {
     Document* doc = m_frame->document();
@@ -1849,6 +1901,7 @@ bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
     
     return swallowEvent;
 }
+#endif // ENABLE(CONTEXT_MENUS)
 
 void EventHandler::scheduleHoverStateUpdate()
 {
@@ -1868,12 +1921,13 @@ bool EventHandler::canMouseDownStartSelect(Node* node)
             
     for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
         if (Node* node = curr->node())
-            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
+            return node->dispatchEvent(Event::create(eventNames().selectstartEvent, true, true));
     }
 
     return true;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::canMouseDragExtendSelect(Node* node)
 {
     if (!node || !node->renderer())
@@ -1881,11 +1935,12 @@ bool EventHandler::canMouseDragExtendSelect(Node* node)
             
     for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
         if (Node* node = curr->node())
-            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
+            return node->dispatchEvent(Event::create(eventNames().selectstartEvent, true, true));
     }
 
     return true;
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 void EventHandler::setResizingFrameSet(HTMLFrameSetElement* frameSet)
 {
@@ -2109,6 +2164,7 @@ void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event)
     }
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::dragHysteresisExceeded(const FloatPoint& floatDragViewportLocation) const
 {
     IntPoint dragViewportLocation((int)floatDragViewportLocation.x(), (int)floatDragViewportLocation.y());
@@ -2142,7 +2198,7 @@ void EventHandler::freeClipboard()
 
 bool EventHandler::shouldDragAutoNode(Node* node, const IntPoint& point) const
 {
-    if (!node || node->hasChildNodes() || !m_frame->view())
+    if (!node || !m_frame->view())
         return false;
     Page* page = m_frame->page();
     return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point);
@@ -2308,6 +2364,7 @@ cleanupDrag:
     // No more default handling (like selection), whether we're past the hysteresis bounds or not
     return true;
 }
+#endif // ENABLE(DRAG_SUPPORT)
   
 bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEvent, bool isLineBreak, bool isBackTab)
 {
@@ -2339,7 +2396,7 @@ bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEve
 }
     
     
-#if !PLATFORM(MAC) && !PLATFORM(QT)
+#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(HAIKU)
 bool EventHandler::invertSenseOfTabsToLinks(KeyboardEvent*) const
 {
     return false;
@@ -2440,22 +2497,28 @@ void EventHandler::capsLockStateMayHaveChanged()
 
 void EventHandler::sendResizeEvent()
 {
-    m_frame->document()->dispatchWindowEvent(eventNames().resizeEvent, false, false);
+    m_frame->document()->dispatchWindowEvent(Event::create(eventNames().resizeEvent, false, false));
 }
 
 void EventHandler::sendScrollEvent()
 {
+    setFrameWasScrolledByUser();
+    if (m_frame->view())
+        m_frame->document()->dispatchEvent(Event::create(eventNames().scrollEvent, true, false));
+}
+
+void EventHandler::setFrameWasScrolledByUser()
+{
     FrameView* v = m_frame->view();
-    if (!v)
-        return;
-    v->setWasScrolledByUser(true);
-    m_frame->document()->dispatchEvent(eventNames().scrollEvent, true, false);
+    if (v)
+        v->setWasScrolledByUser(true);
 }
 
 bool EventHandler::passMousePressEventToScrollbar(MouseEventWithHitTestResults& mev, Scrollbar* scrollbar)
 {
     if (!scrollbar || !scrollbar->enabled())
         return false;
+    setFrameWasScrolledByUser();
     return scrollbar->mouseDown(mev.event());
 }
 
diff --git a/WebCore/page/EventHandler.h b/WebCore/page/EventHandler.h
index 7fe64ad..3348366 100644
--- a/WebCore/page/EventHandler.h
+++ b/WebCore/page/EventHandler.h
@@ -66,10 +66,12 @@ class PlatformTouchEvent;
 class Touch;
 #endif
     
+#if ENABLE(DRAG_SUPPORT)
 extern const int LinkDragHysteresis;
 extern const int ImageDragHysteresis;
 extern const int TextDragHysteresis;
 extern const int GeneralDragHysteresis;
+#endif // ENABLE(DRAG_SUPPORT)
 
 enum HitTestScrollbars { ShouldHitTestScrollbars, DontHitTestScrollbars };
 
@@ -80,7 +82,9 @@ public:
 
     void clear();
 
+#if ENABLE(DRAG_SUPPORT)
     void updateSelectionForMouseDrag();
+#endif
 
     Node* mousePressNode() const;
     void setMousePressNode(PassRefPtr<Node>);
@@ -99,9 +103,11 @@ public:
 
     void setCapturingMouseEventsNode(PassRefPtr<Node>);
 
+#if ENABLE(DRAG_SUPPORT)
     bool updateDragAndDrop(const PlatformMouseEvent&, Clipboard*);
     void cancelDragAndDrop(const PlatformMouseEvent&, Clipboard*);
     bool performDragAndDrop(const PlatformMouseEvent&, Clipboard*);
+#endif
 
     void scheduleHoverStateUpdate();
 
@@ -113,11 +119,17 @@ public:
 
     void setIgnoreWheelEvents(bool);
 
+    static Frame* subframeForTargetNode(Node*);
+
     bool scrollOverflow(ScrollDirection, ScrollGranularity);
 
     bool scrollRecursively(ScrollDirection, ScrollGranularity);
 
+#if ENABLE(DRAG_SUPPORT)
     bool shouldDragAutoNode(Node*, const IntPoint&) const; // -webkit-user-drag == auto
+#endif
+
+    bool shouldTurnVerticalTicksIntoHorizontal(const HitTestResult&) const;
 
     bool tabsToLinks(KeyboardEvent*) const;
     bool tabsToAllControls(KeyboardEvent*) const;
@@ -131,11 +143,16 @@ public:
     bool handleMouseReleaseEvent(const PlatformMouseEvent&);
     bool handleWheelEvent(PlatformWheelEvent&);
 
+<<<<<<< HEAD:WebCore/page/EventHandler.h
 #if ENABLE(TOUCH_EVENTS) // Android
     bool handleTouchEvent(const PlatformTouchEvent&);
 #endif
 
+=======
+#if ENABLE(CONTEXT_MENUS)
+>>>>>>> webkit.org at 49305:WebCore/page/EventHandler.h
     bool sendContextMenuEvent(const PlatformMouseEvent&);
+#endif
 
     void setMouseDownMayStartAutoscroll() { m_mouseDownMayStartAutoscroll = true; }
 
@@ -150,10 +167,12 @@ public:
         bool isLineBreak = false, bool isBackTab = false);
     void defaultTextInputEventHandler(TextEvent*);
 
+#if ENABLE(DRAG_SUPPORT)
     bool eventMayStartDrag(const PlatformMouseEvent&) const;
     
     void dragSourceMovedTo(const PlatformMouseEvent&);
     void dragSourceEndedAt(const PlatformMouseEvent&, DragOperation);
+#endif
 
     void focusDocumentView();
 
@@ -172,7 +191,9 @@ public:
     bool keyEvent(NSEvent *);
     bool wheelEvent(NSEvent *);
 
+#if ENABLE(CONTEXT_MENUS)
     bool sendContextMenuEvent(NSEvent *);
+#endif
     bool eventMayStartDrag(NSEvent *);
 
     void sendFakeEventsAfterWidgetTracking(NSEvent *initiatingEvent);
@@ -183,6 +204,7 @@ public:
 #endif
 
 private:
+#if ENABLE(DRAG_SUPPORT)
     struct EventHandlerDragState {
         RefPtr<Node> m_dragSrc; // element that may be a drag source, for the current mouse gesture
         bool m_dragSrcIsLink;
@@ -197,6 +219,7 @@ private:
     static const double TextDragDelay;
     
     PassRefPtr<Clipboard> createDraggingClipboard() const;
+#endif // ENABLE(DRAG_SUPPORT)
     
     bool eventActivatedView(const PlatformMouseEvent&) const;
     void selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults&);
@@ -208,7 +231,9 @@ private:
     bool handleMousePressEventSingleClick(const MouseEventWithHitTestResults&);
     bool handleMousePressEventDoubleClick(const MouseEventWithHitTestResults&);
     bool handleMousePressEventTripleClick(const MouseEventWithHitTestResults&);
+#if ENABLE(DRAG_SUPPORT)
     bool handleMouseDraggedEvent(const MouseEventWithHitTestResults&);
+#endif
     bool handleMouseReleaseEvent(const MouseEventWithHitTestResults&);
 
     void handleKeyboardSelectionMovement(KeyboardEvent*);
@@ -221,7 +246,9 @@ private:
     void hoverTimerFired(Timer<EventHandler>*);
 
     static bool canMouseDownStartSelect(Node*);
+#if ENABLE(DRAG_SUPPORT)
     static bool canMouseDragExtendSelect(Node*);
+#endif
 
     void handleAutoscroll(RenderObject*);
     void startAutoscrollTimer();
@@ -238,18 +265,22 @@ private:
     MouseEventWithHitTestResults prepareMouseEvent(const HitTestRequest&, const PlatformMouseEvent&);
 
     bool dispatchMouseEvent(const AtomicString& eventType, Node* target, bool cancelable, int clickCount, const PlatformMouseEvent&, bool setUnder);
+#if ENABLE(DRAG_SUPPORT)
     bool dispatchDragEvent(const AtomicString& eventType, Node* target, const PlatformMouseEvent&, Clipboard*);
 
     void freeClipboard();
 
     bool handleDrag(const MouseEventWithHitTestResults&);
+#endif
     bool handleMouseUp(const MouseEventWithHitTestResults&);
+#if ENABLE(DRAG_SUPPORT)
     void clearDragState();
 
     bool dispatchDragSrcEvent(const AtomicString& eventType, const PlatformMouseEvent&);
 
     bool dragHysteresisExceeded(const FloatPoint&) const;
     bool dragHysteresisExceeded(const IntPoint&) const;
+#endif // ENABLE(DRAG_SUPPORT)
 
     bool passMousePressEventToSubframe(MouseEventWithHitTestResults&, Frame* subframe);
     bool passMouseMoveEventToSubframe(MouseEventWithHitTestResults&, Frame* subframe, HitTestResult* hoveredNode = 0);
@@ -268,18 +299,26 @@ private:
     void defaultSpaceEventHandler(KeyboardEvent*);
     void defaultTabEventHandler(KeyboardEvent*);
 
+#if ENABLE(DRAG_SUPPORT)
     void allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const;
+#endif
 
     // The following are called at the beginning of handleMouseUp and handleDrag.  
     // If they return true it indicates that they have consumed the event.
     bool eventLoopHandleMouseUp(const MouseEventWithHitTestResults&);
+#if ENABLE(DRAG_SUPPORT)
     bool eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&);
+#endif
 
     bool invertSenseOfTabsToLinks(KeyboardEvent*) const;
 
+#if ENABLE(DRAG_SUPPORT)
     void updateSelectionForMouseDrag(Node* targetNode, const IntPoint& localPoint);
+#endif
 
     void updateLastScrollbarUnderMouse(Scrollbar*, bool);
+    
+    void setFrameWasScrolledByUser();
 
     bool capturesDragging() const { return m_capturesDragging; }
 
@@ -296,11 +335,15 @@ private:
     RefPtr<Node> m_mousePressNode;
 
     bool m_mouseDownMayStartSelect;
+#if ENABLE(DRAG_SUPPORT)
     bool m_mouseDownMayStartDrag;
+#endif
     bool m_mouseDownWasSingleClickInSelection;
     bool m_beganSelectingText;
 
+#if ENABLE(DRAG_SUPPORT)
     IntPoint m_dragStartPos;
+#endif
 
     IntPoint m_panScrollStartPos;
     bool m_panScrollInProgress;
@@ -337,7 +380,9 @@ private:
     RefPtr<Touch> m_touch;
 #endif
 
+#if ENABLE(DRAG_SUPPORT)
     RefPtr<Node> m_dragTarget;
+#endif
     
     RefPtr<HTMLFrameSetElement> m_frameSetBeingResized;
 
@@ -351,7 +396,9 @@ private:
     bool m_useLatchedWheelEventNode;
     RefPtr<Node> m_latchedWheelEventNode;
     bool m_widgetIsLatched;
-    
+
+    RefPtr<Node> m_previousWheelScrolledNode;
+
 #if PLATFORM(MAC)
     NSView *m_mouseDownView;
     bool m_sendingEventToSubview;
diff --git a/WebCore/page/EventSource.cpp b/WebCore/page/EventSource.cpp
new file mode 100644
index 0000000..2c9a343
--- /dev/null
+++ b/WebCore/page/EventSource.cpp
@@ -0,0 +1,314 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "EventSource.h"
+
+#include "Cache.h"
+#include "DOMWindow.h"
+#include "Event.h"
+#include "EventException.h"
+#include "PlatformString.h"
+#include "MessageEvent.h"
+#include "ResourceError.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "ScriptExecutionContext.h"
+#include "SerializedScriptValue.h"
+#include "TextResourceDecoder.h"
+#include "ThreadableLoader.h"
+
+namespace WebCore {
+
+const unsigned long long EventSource::defaultReconnectDelay = 3000;
+
+EventSource::EventSource(const String& url, ScriptExecutionContext* context, ExceptionCode& ec)
+    : ActiveDOMObject(context, this)
+    , m_state(CONNECTING)
+    , m_reconnectTimer(this, &EventSource::reconnectTimerFired)
+    , m_failSilently(false)
+    , m_requestInFlight(false)
+    , m_reconnectDelay(defaultReconnectDelay)
+{
+    if (url.isEmpty() || !(m_url = context->completeURL(url)).isValid()) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+    // FIXME: should support cross-origin requests
+    if (!scriptExecutionContext()->securityOrigin()->canRequest(m_url)) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    m_origin = scriptExecutionContext()->securityOrigin()->toString();
+    m_decoder = TextResourceDecoder::create("text/plain", "UTF-8");
+
+    setPendingActivity(this);
+    connect();
+}
+
+EventSource::~EventSource()
+{
+}
+
+void EventSource::connect()
+{
+    ResourceRequest request(m_url);
+    request.setHTTPMethod("GET");
+    request.setHTTPHeaderField("Accept", "text/event-stream");
+    request.setHTTPHeaderField("Cache-Control", "no-cache");
+    if (!m_lastEventId.isEmpty())
+        request.setHTTPHeaderField("Last-Event-ID", m_lastEventId);
+
+    ThreadableLoaderOptions options;
+    options.sendLoadCallbacks = true;
+    options.sniffContent = false;
+    options.allowCredentials = true;
+
+    m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, options);
+
+    m_requestInFlight = true;
+
+    if (!scriptExecutionContext()->isWorkerContext())
+        cache()->loader()->nonCacheRequestInFlight(m_url);
+}
+
+void EventSource::endRequest()
+{
+    m_requestInFlight = false;
+
+    if (!m_failSilently)
+        dispatchEvent(Event::create(eventNames().errorEvent, false, false));
+
+    if (!scriptExecutionContext()->isWorkerContext())
+        cache()->loader()->nonCacheRequestComplete(m_url);
+
+    if (m_state != CLOSED)
+        scheduleReconnect();
+    else
+        unsetPendingActivity(this);
+}
+
+void EventSource::scheduleReconnect()
+{
+    m_state = CONNECTING;
+    m_reconnectTimer.startOneShot(m_reconnectDelay / 1000);
+}
+
+void EventSource::reconnectTimerFired(Timer<EventSource>*)
+{
+    connect();
+}
+
+String EventSource::url() const
+{
+    return m_url.string();
+}
+
+EventSource::State EventSource::readyState() const
+{
+    return m_state;
+}
+
+void EventSource::close()
+{
+    if (m_state == CLOSED)
+        return;
+
+    if (m_reconnectTimer.isActive()) {
+        m_reconnectTimer.stop();
+        unsetPendingActivity(this);
+    }
+
+    m_state = CLOSED;
+    m_failSilently = true;
+
+    if (m_requestInFlight)
+        m_loader->cancel();
+}
+
+ScriptExecutionContext* EventSource::scriptExecutionContext() const
+{
+    return ActiveDOMObject::scriptExecutionContext();
+}
+
+void EventSource::didReceiveResponse(const ResourceResponse& response)
+{
+    int statusCode = response.httpStatusCode();
+    if (statusCode == 200 && response.httpHeaderField("Content-Type") == "text/event-stream") {
+        m_state = OPEN;
+        dispatchEvent(Event::create(eventNames().openEvent, false, false));
+    } else {
+        if (statusCode <= 200 || statusCode > 299)
+            m_state = CLOSED;
+        m_loader->cancel();
+    }
+}
+
+void EventSource::didReceiveData(const char* data, int length)
+{
+    append(m_receiveBuf, m_decoder->decode(data, length));
+    parseEventStream();
+}
+
+void EventSource::didFinishLoading(unsigned long)
+{
+    if (m_receiveBuf.size() > 0 || m_data.size() > 0) {
+        append(m_receiveBuf, "\n\n");
+        parseEventStream();
+    }
+    m_state = CONNECTING;
+    endRequest();
+}
+
+void EventSource::didFail(const ResourceError& error)
+{
+    int canceled = error.isCancellation();
+    if (((m_state == CONNECTING) && !canceled) || ((m_state == OPEN) && canceled))
+        m_state = CLOSED;
+    endRequest();
+}
+
+void EventSource::didFailRedirectCheck()
+{
+    m_state = CLOSED;
+    m_loader->cancel();
+}
+
+void EventSource::parseEventStream()
+{
+    unsigned int bufPos = 0;
+    unsigned int bufSize = m_receiveBuf.size();
+    for (;;) {
+        int lineLength = -1;
+        int fieldLength = -1;
+        int carriageReturn = 0;
+        for (unsigned int i = bufPos; lineLength < 0 && i < bufSize; i++) {
+            switch (m_receiveBuf[i]) {
+            case ':':
+                if (fieldLength < 0)
+                    fieldLength = i - bufPos;
+                break;
+            case '\n':
+                if (i > bufPos && m_receiveBuf[i - 1] == '\r') {
+                    carriageReturn++;
+                    i--;
+                }
+                lineLength = i - bufPos;
+                break;
+            }
+        }
+
+        if (lineLength < 0)
+            break;
+
+        parseEventStreamLine(bufPos, fieldLength, lineLength);
+        bufPos += lineLength + carriageReturn + 1;
+    }
+
+    if (bufPos == bufSize)
+        m_receiveBuf.clear();
+    else if (bufPos)
+        m_receiveBuf.remove(0, bufPos);
+}
+
+void EventSource::parseEventStreamLine(unsigned int bufPos, int fieldLength, int lineLength)
+{
+    if (!lineLength) {
+        if (!m_data.isEmpty())
+            dispatchEvent(createMessageEvent());
+        if (!m_eventName.isEmpty())
+            m_eventName = "";
+    } else if (fieldLength) {
+        bool noValue = fieldLength < 0;
+
+        String field(&m_receiveBuf[bufPos], noValue ? lineLength : fieldLength);
+        int step;
+        if (noValue)
+            step = lineLength;
+        else if (m_receiveBuf[bufPos + fieldLength + 1] != ' ')
+            step = fieldLength + 1;
+        else
+            step = fieldLength + 2;
+        bufPos += step;
+        int valueLength = lineLength - step;
+
+        if (field == "data") {
+            if (m_data.size() > 0)
+                m_data.append('\n');
+            if (valueLength)
+                m_data.append(&m_receiveBuf[bufPos], valueLength);
+        } else if (field == "event")
+            m_eventName = valueLength ? String(&m_receiveBuf[bufPos], valueLength) : "";
+        else if (field == "id")
+            m_lastEventId = valueLength ? String(&m_receiveBuf[bufPos], valueLength) : "";
+        else if (field == "retry") {
+            if (!valueLength)
+                m_reconnectDelay = defaultReconnectDelay;
+            else {
+                String value(&m_receiveBuf[bufPos], valueLength);
+                bool ok;
+                unsigned long long retry = value.toUInt64(&ok);
+                if (ok)
+                    m_reconnectDelay = retry;
+            }
+        }
+    }
+}
+
+void EventSource::stop()
+{
+    close();
+}
+
+PassRefPtr<MessageEvent> EventSource::createMessageEvent()
+{
+    RefPtr<MessageEvent> event = MessageEvent::create();
+    event->initMessageEvent(m_eventName.isEmpty() ? eventNames().messageEvent : AtomicString(m_eventName), false, false, SerializedScriptValue::create(String::adopt(m_data)), m_origin, m_lastEventId, 0, 0);
+    return event.release();
+}
+
+EventTargetData* EventSource::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* EventSource::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/WebCore/page/EventSource.h b/WebCore/page/EventSource.h
new file mode 100644
index 0000000..5b037a4
--- /dev/null
+++ b/WebCore/page/EventSource.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EventSource_h
+#define EventSource_h
+
+#if ENABLE(EVENTSOURCE)
+
+#include "ActiveDOMObject.h"
+#include "AtomicStringHash.h"
+#include "EventListener.h"
+#include "EventNames.h"
+#include "EventTarget.h"
+#include "KURL.h"
+#include "ThreadableLoaderClient.h"
+#include "Timer.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class MessageEvent;
+    class ResourceResponse;
+    class TextResourceDecoder;
+    class ThreadableLoader;
+
+    class EventSource : public RefCounted<EventSource>, public EventTarget, private ThreadableLoaderClient, public ActiveDOMObject {
+    public:
+        static PassRefPtr<EventSource> create(const String& url, ScriptExecutionContext* context, ExceptionCode& ec) { return adoptRef(new EventSource(url, context, ec)); }
+        virtual ~EventSource();
+
+        static const unsigned long long defaultReconnectDelay;
+
+        String url() const;
+
+        enum State {
+            CONNECTING = 0,
+            OPEN = 1,
+            CLOSED = 2,
+        };
+
+        State readyState() const;
+
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(open);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+
+        void close();
+
+        using RefCounted<EventSource>::ref;
+        using RefCounted<EventSource>::deref;
+
+        virtual EventSource* toEventSource() { return this; }
+        virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+        virtual void stop();
+
+    private:
+        EventSource(const String& url, ScriptExecutionContext* context, ExceptionCode& ec);
+
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
+
+        virtual void didReceiveResponse(const ResourceResponse& response);
+        virtual void didReceiveData(const char* data, int length);
+        virtual void didFinishLoading(unsigned long);
+        virtual void didFail(const ResourceError& error);
+        virtual void didFailRedirectCheck();
+
+        void connect();
+        void endRequest();
+        void scheduleReconnect();
+        void reconnectTimerFired(Timer<EventSource>*);
+        void parseEventStream();
+        void parseEventStreamLine(unsigned int pos, int fieldLength, int lineLength);
+        PassRefPtr<MessageEvent> createMessageEvent();
+
+        KURL m_url;
+        State m_state;
+
+        RefPtr<TextResourceDecoder> m_decoder;
+        RefPtr<ThreadableLoader> m_loader;
+        Timer<EventSource> m_reconnectTimer;
+        Vector<UChar> m_receiveBuf;
+        bool m_failSilently;
+        bool m_requestInFlight;
+
+        String m_eventName;
+        Vector<UChar> m_data;
+        String m_lastEventId;
+        unsigned long long m_reconnectDelay;
+        String m_origin;
+        
+        EventTargetData m_eventTargetData;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
+
+#endif // EventSource_h
diff --git a/WebCore/page/EventSource.idl b/WebCore/page/EventSource.idl
new file mode 100644
index 0000000..561bd68
--- /dev/null
+++ b/WebCore/page/EventSource.idl
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        Conditional=EVENTSOURCE,
+        EventTarget,
+        NoStaticTables
+    ] EventSource {
+
+        readonly attribute DOMString URL;
+
+        // ready state
+        const unsigned short CONNECTING = 0;
+        const unsigned short OPEN = 1;
+        const unsigned short CLOSED = 2;
+        readonly attribute unsigned short readyState;
+
+        // networking
+        attribute EventListener onopen;
+        attribute EventListener onmessage;
+        attribute EventListener onerror;
+        void close();
+
+        // EventTarget interface
+        [Custom] void addEventListener(in DOMString type,
+                                      in EventListener listener,
+                                      in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type,
+                                          in EventListener listener,
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
+
+    };
+}
diff --git a/WebCore/page/FocusController.cpp b/WebCore/page/FocusController.cpp
index 817801c..5e78c7d 100644
--- a/WebCore/page/FocusController.cpp
+++ b/WebCore/page/FocusController.cpp
@@ -36,6 +36,7 @@
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "FrameTree.h"
@@ -55,6 +56,18 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static inline void dispatchEventsOnWindowAndFocusedNode(Document* document, bool focused)
+{
+    // If we have a focused node we should dispatch blur on it before we blur the window.
+    // If we have a focused node we should dispatch focus on it after we focus the window.
+    // https://bugs.webkit.org/show_bug.cgi?id=27105
+    if (!focused && document->focusedNode())
+        document->focusedNode()->dispatchBlurEvent();
+    document->dispatchWindowEvent(Event::create(focused ? eventNames().focusEvent : eventNames().blurEvent, false, false));
+    if (focused && document->focusedNode())
+        document->focusedNode()->dispatchFocusEvent();
+}
+
 FocusController::FocusController(Page* page)
     : m_page(page)
     , m_isActive(false)
@@ -75,12 +88,12 @@ void FocusController::setFocusedFrame(PassRefPtr<Frame> frame)
     // Now that the frame is updated, fire events and update the selection focused states of both frames.
     if (oldFrame && oldFrame->view()) {
         oldFrame->selection()->setFocused(false);
-        oldFrame->document()->dispatchWindowEvent(eventNames().blurEvent, false, false);
+        oldFrame->document()->dispatchWindowEvent(Event::create(eventNames().blurEvent, false, false));
     }
 
     if (newFrame && newFrame->view() && isFocused()) {
         newFrame->selection()->setFocused(true);
-        newFrame->document()->dispatchWindowEvent(eventNames().focusEvent, false, false);
+        newFrame->document()->dispatchWindowEvent(Event::create(eventNames().focusEvent, false, false));
     }
 }
 
@@ -100,7 +113,7 @@ void FocusController::setFocused(bool focused)
     
     if (m_focusedFrame && m_focusedFrame->view()) {
         m_focusedFrame->selection()->setFocused(focused);
-        m_focusedFrame->document()->dispatchWindowEvent(focused ? eventNames().focusEvent : eventNames().blurEvent, false, false);
+        dispatchEventsOnWindowAndFocusedNode(m_focusedFrame->document(), focused);
     }
 }
 
@@ -146,6 +159,8 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
     if (caretBrowsing && !currentNode)
         currentNode = frame->selection()->start().node();
 
+    document->updateLayoutIgnorePendingStylesheets();
+
     Node* node = (direction == FocusDirectionForward)
         ? document->nextFocusableNode(currentNode, event)
         : document->previousFocusableNode(currentNode, event);
@@ -341,7 +356,7 @@ void FocusController::setActive(bool active)
     focusedOrMainFrame()->selection()->pageActivationChanged();
     
     if (m_focusedFrame && isFocused())
-        m_focusedFrame->document()->dispatchWindowEvent(active ? eventNames().focusEvent : eventNames().blurEvent, false, false);
+        dispatchEventsOnWindowAndFocusedNode(m_focusedFrame->document(), active);
 }
 
 } // namespace WebCore
diff --git a/WebCore/page/Frame.cpp b/WebCore/page/Frame.cpp
index 78cc25c..c03efb0 100644
--- a/WebCore/page/Frame.cpp
+++ b/WebCore/page/Frame.cpp
@@ -59,6 +59,7 @@
 #include "Navigator.h"
 #include "NodeList.h"
 #include "Page.h"
+#include "PageGroup.h"
 #include "RegularExpression.h"
 #include "RenderPart.h"
 #include "RenderTableCell.h"
@@ -66,9 +67,12 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "ScriptController.h"
+#include "ScriptSourceCode.h"
+#include "ScriptValue.h"
 #include "Settings.h"
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
+#include "UserContentURLPattern.h"
 #include "XMLNames.h"
 #include "htmlediting.h"
 #include "markup.h"
@@ -82,10 +86,6 @@
 #include "runtime_root.h"
 #endif
 
-#if FRAME_LOADS_USER_STYLESHEET
-#include "UserStyleSheetLoader.h"
-#endif
-
 #if ENABLE(SVG)
 #include "SVGDocument.h"
 #include "SVGDocumentExtensions.h"
@@ -101,6 +101,10 @@
 #include "WMLNames.h"
 #endif
 
+#if ENABLE(MATHML)
+#include "MathMLNames.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -122,6 +126,7 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     : m_page(page)
     , m_treeNode(this, parentFromOwnerElement(ownerElement))
     , m_loader(this, frameLoaderClient)
+    , m_redirectScheduler(this)
     , m_ownerElement(ownerElement)
     , m_script(this)
     , m_selectionGranularity(CharacterGranularity)
@@ -131,6 +136,9 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     , m_eventHandler(this)
     , m_animationController(this)
     , m_lifeSupportTimer(this, &Frame::lifeSupportTimerFired)
+#if ENABLE(ORIENTATION_EVENTS)
+    , m_orientation(0)
+#endif
     , m_caretVisible(false)
     , m_caretPaint(true)
     , m_highlightTextMatches(false)
@@ -138,9 +146,6 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     , m_needsReapplyStyles(false)
     , m_isDisconnected(false)
     , m_excludeFromTextSearch(false)
-#if FRAME_LOADS_USER_STYLESHEET
-    , m_userStyleSheetLoader(0)
-#endif
 {
     Frame* parent = parentFromOwnerElement(ownerElement);
     m_zoomFactor = parent ? parent->m_zoomFactor : 1.0f;
@@ -159,6 +164,10 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     WMLNames::init();
 #endif
 
+#if ENABLE(MATHML)
+    MathMLNames::init();
+#endif
+
     XMLNames::init();
 
     if (!ownerElement)
@@ -203,10 +212,6 @@ Frame::~Frame()
     }
 
     ASSERT(!m_lifeSupportTimer.isActive());
-
-#if FRAME_LOADS_USER_STYLESHEET
-    delete m_userStyleSheetLoader;
-#endif
 }
 
 void Frame::init()
@@ -219,6 +224,11 @@ FrameLoader* Frame::loader() const
     return &m_loader;
 }
 
+RedirectScheduler* Frame::redirectScheduler() const
+{
+    return &m_redirectScheduler;
+}
+
 FrameView* Frame::view() const
 {
     return m_view.get();
@@ -226,6 +236,12 @@ FrameView* Frame::view() const
 
 void Frame::setView(PassRefPtr<FrameView> view)
 {
+    // We the custom scroll bars as early as possible to prevent m_doc->detach()
+    // from messing with the view such that its scroll bars won't be torn down.
+    // FIXME: We should revisit this.
+    if (m_view)
+        m_view->detachCustomScrollbars();
+
     // Detach the document now, so any onUnload handlers get run - if
     // we wait until the view is destroyed, then things won't be
     // hooked up enough for some JavaScript calls to work.
@@ -273,6 +289,15 @@ void Frame::setDocument(PassRefPtr<Document> newDoc)
     m_script.updateDocument();
 }
 
+#if ENABLE(ORIENTATION_EVENTS)
+void Frame::sendOrientationChangeEvent(int orientation)
+{
+    m_orientation = orientation;
+    if (Document* doc = document())
+        doc->dispatchWindowEvent(eventNames().orientationchangeEvent, false, false);
+}
+#endif // ENABLE(ORIENTATION_EVENTS)
+    
 Settings* Frame::settings() const
 {
     return m_page ? m_page->settings() : 0;
@@ -829,14 +854,6 @@ void Frame::reapplyStyles()
     // We should probably eventually move it into its own function.
     m_doc->docLoader()->setAutoLoadImages(m_page && m_page->settings()->loadsImagesAutomatically());
 
-#if FRAME_LOADS_USER_STYLESHEET
-    const KURL userStyleSheetLocation = m_page ? m_page->settings()->userStyleSheetLocation() : KURL();
-    if (!userStyleSheetLocation.isEmpty())
-        setUserStyleSheetLocation(userStyleSheetLocation);
-    else
-        setUserStyleSheet(String());
-#endif
-
     // FIXME: It's not entirely clear why the following is needed.
     // The document automatically does this as required when you set the style sheet.
     // But we had problems when this code was removed. Details are in
@@ -844,6 +861,39 @@ void Frame::reapplyStyles()
     m_doc->updateStyleSelector();
 }
 
+void Frame::injectUserScripts(UserScriptInjectionTime injectionTime)
+{
+    if (!m_page)
+        return;
+    
+    // Walk the hashtable. Inject by world.
+    const UserScriptMap* userScripts = m_page->group().userScripts();
+    if (!userScripts)
+        return;
+    UserScriptMap::const_iterator end = userScripts->end();
+    for (UserScriptMap::const_iterator it = userScripts->begin(); it != end; ++it)
+        injectUserScriptsForWorld(it->first, *it->second, injectionTime);
+}
+
+void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector& userScripts, UserScriptInjectionTime injectionTime)
+{
+    if (userScripts.isEmpty())
+        return;
+
+    Document* doc = document();
+    if (!doc)
+        return;
+
+    Vector<ScriptSourceCode> sourceCode;
+    unsigned count = userScripts.size();
+    for (unsigned i = 0; i < count; ++i) {
+        UserScript* script = userScripts[i].get();
+        if (script->injectionTime() == injectionTime && UserContentURLPattern::matchesPatterns(doc->url(), script->whitelist(), script->blacklist()))
+            sourceCode.append(ScriptSourceCode(script->source(), script->url()));
+    }
+    script()->evaluateInIsolatedWorld(worldID, sourceCode);
+}
+
 bool Frame::shouldChangeSelection(const VisibleSelection& newSelection) const
 {
     return shouldChangeSelection(selection()->selection(), newSelection, newSelection.affinity(), false);
@@ -1559,6 +1609,11 @@ Page* Frame::page() const
     return m_page;
 }
 
+void Frame::detachFromPage()
+{
+    m_page = 0;
+}
+
 EventHandler* Frame::eventHandler() const
 {
     return &m_eventHandler;
@@ -1579,7 +1634,7 @@ void Frame::pageDestroyed()
     script()->clearScriptObjects();
     script()->updatePlatformScriptObjects();
 
-    m_page = 0;
+    detachFromPage();
 }
 
 void Frame::disconnectOwnerElement()
@@ -1624,7 +1679,7 @@ void Frame::unfocusWindow()
         page()->chrome()->unfocus();
 }
 
-bool Frame::shouldClose(RegisteredEventListenerVector* alternateEventListeners)
+bool Frame::shouldClose()
 {
     Chrome* chrome = page() ? page()->chrome() : 0;
     if (!chrome || !chrome->canRunBeforeUnloadConfirmPanel())
@@ -1638,7 +1693,8 @@ bool Frame::shouldClose(RegisteredEventListenerVector* alternateEventListeners)
     if (!body)
         return true;
 
-    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = m_domWindow->dispatchBeforeUnloadEvent(alternateEventListeners);
+    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
+    m_domWindow->dispatchEvent(beforeUnloadEvent.get(), m_domWindow->document());
 
     if (!beforeUnloadEvent->defaultPrevented())
         doc->defaultEventHandler(beforeUnloadEvent.get());
@@ -1759,7 +1815,6 @@ void Frame::createView(const IntSize& viewportSize,
         frameView = FrameView::create(this);
 
     frameView->setScrollbarModes(horizontalScrollbarMode, verticalScrollbarMode);
-    frameView->updateDefaultScrollbarState();
 
     setView(frameView);
 
diff --git a/WebCore/page/Frame.h b/WebCore/page/Frame.h
index 652269a..6208bbd 100644
--- a/WebCore/page/Frame.h
+++ b/WebCore/page/Frame.h
@@ -41,6 +41,7 @@
 #include "ScrollBehavior.h"
 #include "SelectionController.h"
 #include "TextGranularity.h"
+#include "UserScriptTypes.h"
 
 #if PLATFORM(WIN)
 #include "FrameWin.h"
@@ -66,6 +67,7 @@ namespace WebCore {
     class Editor;
     class EventHandler;
     class FrameLoader;
+    class RedirectScheduler;
     class FrameLoaderClient;
     class FrameTree;
     class FrameView;
@@ -79,10 +81,6 @@ namespace WebCore {
     class VisibleSelection;
     class Widget;
 
-#if FRAME_LOADS_USER_STYLESHEET
-    class UserStyleSheetLoader;
-#endif
-
     template <typename T> class Timer;
 
     class Frame : public RefCounted<Frame> {
@@ -97,6 +95,7 @@ namespace WebCore {
         void init();
 
         Page* page() const;
+        void detachFromPage();
         HTMLFrameOwnerElement* ownerElement() const;
 
         void pageDestroyed();
@@ -112,6 +111,7 @@ namespace WebCore {
         Editor* editor() const;
         EventHandler* eventHandler() const;
         FrameLoader* loader() const;
+        RedirectScheduler* redirectScheduler() const;
         SelectionController* selection() const;
         FrameTree* tree() const;
         AnimationController* animation() const;
@@ -128,6 +128,10 @@ namespace WebCore {
         void createView(const IntSize&, const Color&, bool, const IntSize &, bool,
                         ScrollbarMode = ScrollbarAuto, ScrollbarMode = ScrollbarAuto);
 
+        void injectUserScripts(UserScriptInjectionTime);
+
+    private:
+        void injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&, UserScriptInjectionTime);
 
     private:
         Frame(Page*, HTMLFrameOwnerElement*, FrameLoaderClient*);
@@ -139,11 +143,6 @@ namespace WebCore {
 
         Settings* settings() const; // can be NULL
 
-    #if FRAME_LOADS_USER_STYLESHEET
-        void setUserStyleSheetLocation(const KURL&);
-        void setUserStyleSheet(const String& styleSheetData);
-    #endif
-
         void setPrinting(bool printing, float minPageWidth, float maxPageWidth, bool adjustViewSize);
 
         bool inViewSourceMode() const;
@@ -156,6 +155,14 @@ namespace WebCore {
 
         void setDocument(PassRefPtr<Document>);
 
+#if ENABLE(ORIENTATION_EVENTS)
+        // Orientation is the interface orientation in degrees. Some examples are:
+        //  0 is straight up; -90 is when the device is rotated 90 clockwise;
+        //  90 is when rotated counter clockwise.
+        void sendOrientationChangeEvent(int orientation);
+        int orientation() const { return m_orientation; }
+#endif
+
         void clearTimers();
         static void clearTimers(FrameView*, Document*);
 
@@ -193,7 +200,7 @@ namespace WebCore {
     public:
         void focusWindow();
         void unfocusWindow();
-        bool shouldClose(RegisteredEventListenerVector* alternateEventListeners = 0);
+        bool shouldClose();
         void scheduleClose();
 
         void setJSStatusBarText(const String&);
@@ -329,6 +336,7 @@ namespace WebCore {
         Page* m_page;
         mutable FrameTree m_treeNode;
         mutable FrameLoader m_loader;
+        mutable RedirectScheduler m_redirectScheduler;
 
         mutable RefPtr<DOMWindow> m_domWindow;
         HashSet<DOMWindow*> m_liveFormerWindows;
@@ -357,6 +365,10 @@ namespace WebCore {
 
         Timer<Frame> m_lifeSupportTimer;
 
+#if ENABLE(ORIENTATION_EVENTS)
+        int m_orientation;
+#endif
+        
         bool m_caretVisible;
         bool m_caretPaint;
 
@@ -365,11 +377,6 @@ namespace WebCore {
         bool m_needsReapplyStyles;
         bool m_isDisconnected;
         bool m_excludeFromTextSearch;
-
-    #if FRAME_LOADS_USER_STYLESHEET
-        UserStyleSheetLoader* m_userStyleSheetLoader;
-    #endif
-
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/FrameTree.cpp b/WebCore/page/FrameTree.cpp
index 24f125d..41caa9c 100644
--- a/WebCore/page/FrameTree.cpp
+++ b/WebCore/page/FrameTree.cpp
@@ -91,7 +91,7 @@ void FrameTree::removeChild(Frame* child)
     RefPtr<Frame>& newLocationForNext = m_firstChild == child ? m_firstChild : child->tree()->m_previousSibling->tree()->m_nextSibling;
     Frame*& newLocationForPrevious = m_lastChild == child ? m_lastChild : child->tree()->m_nextSibling->tree()->m_previousSibling;
     swap(newLocationForNext, child->tree()->m_nextSibling);
-    // For some inexplicable reason, the following line does not compile without the explicit std:: namepsace
+    // For some inexplicable reason, the following line does not compile without the explicit std:: namespace
     std::swap(newLocationForPrevious, child->tree()->m_previousSibling);
 
     child->tree()->m_previousSibling = 0;
diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index ed91587..e7006ed 100644
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -42,11 +42,12 @@
 #include "HTMLFrameElement.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "InspectorTimelineAgent.h"
 #include "OverflowEvent.h"
-#include "Page.h"
 #include "RenderPart.h"
 #include "RenderPartObject.h"
 #include "RenderScrollbar.h"
+#include "RenderScrollbarPart.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Settings.h"
@@ -96,13 +97,10 @@ struct ScheduledEvent {
 
 FrameView::FrameView(Frame* frame)
     : m_frame(frame)
-    , m_vmode(ScrollbarAuto)
-    , m_hmode(ScrollbarAuto)
     , m_slowRepaintObjectCount(0)
     , m_layoutTimer(this, &FrameView::layoutTimerFired)
     , m_layoutRoot(0)
     , m_postLayoutTasksTimer(this, &FrameView::postLayoutTimerFired)
-    , m_needToInitScrollbars(true)
     , m_isTransparent(false)
     , m_baseBackgroundColor(Color::white)
     , m_mediaType("screen")
@@ -115,6 +113,7 @@ FrameView::FrameView(Frame* frame)
     , m_shouldUpdateWhileOffscreen(true)
     , m_deferSetNeedsLayouts(0)
     , m_setNeedsLayoutWasDeferred(false)
+    , m_scrollCorner(0)
 {
     init();
 }
@@ -143,9 +142,15 @@ FrameView::~FrameView()
     }
 
     resetScrollbars();
+
+    // Custom scrollbars should already be destroyed at this point
+    ASSERT(!horizontalScrollbar() || !horizontalScrollbar()->isCustomScrollbar());
+    ASSERT(!verticalScrollbar() || !verticalScrollbar()->isCustomScrollbar());
+
     setHasHorizontalScrollbar(false); // Remove native scrollbars now before we lose the connection to the HostWindow.
     setHasVerticalScrollbar(false);
     
+    ASSERT(!m_scrollCorner);
     ASSERT(m_scheduledEvents.isEmpty());
     ASSERT(!m_enqueueEvents);
 
@@ -206,7 +211,7 @@ void FrameView::resetScrollbars()
     // Reset the document's scrollbars back to our defaults before we yield the floor.
     m_firstLayout = true;
     setScrollbarsSuppressed(true);
-    setScrollbarModes(m_hmode, m_vmode);
+    setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
     setScrollbarsSuppressed(false);
 }
 
@@ -237,23 +242,18 @@ void FrameView::detachCustomScrollbars()
     if (!m_frame)
         return;
 
-    Document* document = m_frame->document();
-    if (!document)
-        return;
-
-    Element* body = document->body();
-    if (!body)
-        return;
-
-    RenderBox* renderBox = body->renderBox();
-
     Scrollbar* horizontalBar = horizontalScrollbar();
-    if (horizontalBar && horizontalBar->isCustomScrollbar() && toRenderScrollbar(horizontalBar)->owningRenderer() == renderBox)
+    if (horizontalBar && horizontalBar->isCustomScrollbar() && !toRenderScrollbar(horizontalBar)->owningRenderer()->isRenderPart())
         setHasHorizontalScrollbar(false);
 
     Scrollbar* verticalBar = verticalScrollbar();
-    if (verticalBar && verticalBar->isCustomScrollbar() && toRenderScrollbar(verticalBar)->owningRenderer() == renderBox)
+    if (verticalBar && verticalBar->isCustomScrollbar() && !toRenderScrollbar(verticalBar)->owningRenderer()->isRenderPart())
         setHasVerticalScrollbar(false);
+
+    if (m_scrollCorner) {
+        m_scrollCorner->destroy();
+        m_scrollCorner = 0;
+    }
 }
 
 void FrameView::clear()
@@ -275,21 +275,6 @@ bool FrameView::didFirstLayout() const
     return !m_firstLayout;
 }
 
-void FrameView::initScrollbars()
-{
-    if (!m_needToInitScrollbars)
-        return;
-    m_needToInitScrollbars = false;
-    updateDefaultScrollbarState();
-}
-
-void FrameView::updateDefaultScrollbarState()
-{
-    m_hmode = horizontalScrollbarMode();
-    m_vmode = verticalScrollbarMode();
-    setScrollbarModes(m_hmode, m_vmode);
-}
-
 void FrameView::invalidateRect(const IntRect& rect)
 {
     if (!parent()) {
@@ -323,12 +308,6 @@ void FrameView::setMarginHeight(int h)
     m_margins.setHeight(h);
 }
 
-void FrameView::setCanHaveScrollbars(bool canScroll)
-{
-    ScrollView::setCanHaveScrollbars(canScroll);
-    scrollbarModes(m_hmode, m_vmode);
-}
-
 PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
 {
     // FIXME: We need to update the scrollbar dynamically as documents change (or as doc elements and bodies get discovered that have custom styles).
@@ -377,7 +356,7 @@ void FrameView::adjustViewSize()
     RenderView* root = m_frame->contentRenderer();
     if (!root)
         return;
-    setContentsSize(IntSize(root->overflowWidth(), root->overflowHeight()));
+    setContentsSize(IntSize(root->rightLayoutOverflow(), root->bottomLayoutOverflow()));
 }
 
 void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, ScrollbarMode& vMode)
@@ -517,6 +496,12 @@ void FrameView::layout(bool allowSubtree)
     if (isPainting())
         return;
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willLayout();
+#endif
+
     if (!allowSubtree && m_layoutRoot) {
         m_layoutRoot->markContainingBlocksForLayout(false);
         m_layoutRoot = 0;
@@ -573,8 +558,9 @@ void FrameView::layout(bool allowSubtree)
 
     m_nestedLayoutCount++;
 
-    ScrollbarMode hMode = m_hmode;
-    ScrollbarMode vMode = m_vmode;
+    ScrollbarMode hMode;
+    ScrollbarMode vMode;
+    scrollbarModes(hMode, vMode);
 
     if (!subtree) {
         RenderObject* rootRenderer = document->documentElement() ? document->documentElement()->renderer() : 0;
@@ -674,7 +660,7 @@ void FrameView::layout(bool allowSubtree)
 
 #if PLATFORM(MAC)
     if (AXObjectCache::accessibilityEnabled())
-        root->document()->axObjectCache()->postNotification(root, "AXLayoutComplete", true);
+        root->document()->axObjectCache()->postNotification(root, AXObjectCache::AXLayoutComplete, true);
 #endif
 #if ENABLE(DASHBOARD_SUPPORT)
     updateDashboardRegions();
@@ -709,6 +695,11 @@ void FrameView::layout(bool allowSubtree)
         ASSERT(m_enqueueEvents);
     }
 
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didLayout();
+#endif
+
     m_nestedLayoutCount--;
 }
 
@@ -825,6 +816,22 @@ void FrameView::setScrollPosition(const IntPoint& scrollPoint)
     m_inProgrammaticScroll = wasInProgrammaticScroll;
 }
 
+void FrameView::scrollPositionChanged()
+{
+    frame()->eventHandler()->sendScrollEvent();
+
+#if USE(ACCELERATED_COMPOSITING)
+    // We need to update layer positions after scrolling to account for position:fixed layers.
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    RenderLayer* layer = document->renderer() ? document->renderer()->enclosingLayer() : 0;
+    if (layer)
+        layer->updateLayerPositions(RenderLayer::UpdateCompositingLayers);
+#endif
+}
+
 HostWindow* FrameView::hostWindow() const
 {
     Page* page = frame() ? frame()->page() : 0;
@@ -857,9 +864,9 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
             m_repaintRects.append(unionedRect);
         }
         if (m_repaintCount < cRepaintRectUnionThreshold)
-            m_repaintRects.append(r);
+            m_repaintRects.append(visibleContent);
         else
-            m_repaintRects[0].unite(r);
+            m_repaintRects[0].unite(visibleContent);
         m_repaintCount++;
     
         if (!m_deferringRepaints && !m_deferredRepaintTimer.isActive())
@@ -997,7 +1004,8 @@ void FrameView::layoutTimerFired(Timer<FrameView>*)
 
 void FrameView::scheduleRelayout()
 {
-    ASSERT(!m_frame->document()->inPageCache());
+    // FIXME: We should assert the page is not in the page cache, but that is causing
+    // too many false assertions.  See <rdar://problem/7218118>.
     ASSERT(m_frame->view() == this);
 
     if (m_layoutRoot) {
@@ -1221,6 +1229,9 @@ void FrameView::scrollToAnchor()
     // Align to the top and to the closest side (this matches other browsers).
     anchorNode->renderer()->enclosingLayer()->scrollRectToVisible(rect, true, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
 
+    if (AXObjectCache::accessibilityEnabled())
+        m_frame->document()->axObjectCache()->handleScrolledToAnchor(anchorNode.get());
+
     // scrollRectToVisible can call into scrollRectIntoViewRecursively(), which resets m_maintainScrollPositionAnchor.
     m_maintainScrollPositionAnchor = anchorNode;
 }
@@ -1427,6 +1438,86 @@ void FrameView::updateDashboardRegions()
 }
 #endif
 
+void FrameView::invalidateScrollCorner()
+{
+    invalidateRect(scrollCornerRect());
+}
+
+void FrameView::updateScrollCorner()
+{
+    RenderObject* renderer = 0;
+    RefPtr<RenderStyle> cornerStyle;
+    
+    if (!scrollCornerRect().isEmpty()) {
+        // Try the <body> element first as a scroll corner source.
+        Document* doc = m_frame->document();
+        Element* body = doc ? doc->body() : 0;
+        if (body && body->renderer()) {
+            renderer = body->renderer();
+            cornerStyle = renderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, renderer->style());
+        }
+        
+        if (!cornerStyle) {
+            // If the <body> didn't have a custom style, then the root element might.
+            Element* docElement = doc ? doc->documentElement() : 0;
+            if (docElement && docElement->renderer()) {
+                renderer = docElement->renderer();
+                cornerStyle = renderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, renderer->style());
+            }
+        }
+        
+        if (!cornerStyle) {
+            // If we have an owning iframe/frame element, then it can set the custom scrollbar also.
+            if (RenderPart* renderer = m_frame->ownerRenderer())
+                cornerStyle = renderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, renderer->style());
+        }
+    }
+
+    if (cornerStyle) {
+        if (!m_scrollCorner)
+            m_scrollCorner = new (renderer->renderArena()) RenderScrollbarPart(renderer->document());
+        m_scrollCorner->setStyle(cornerStyle.release());
+        invalidateRect(scrollCornerRect());
+    } else if (m_scrollCorner) {
+        m_scrollCorner->destroy();
+        m_scrollCorner = 0;
+    }
+}
+
+void FrameView::paintScrollCorner(GraphicsContext* context, const IntRect& cornerRect)
+{
+    if (context->updatingControlTints()) {
+        updateScrollCorner();
+        return;
+    }
+
+    if (m_scrollCorner) {
+        m_scrollCorner->paintIntoRect(context, cornerRect.x(), cornerRect.y(), cornerRect);
+        return;
+    }
+
+    ScrollView::paintScrollCorner(context, cornerRect);
+}
+
+bool FrameView::hasCustomScrollbars() const
+{
+    const HashSet<RefPtr<Widget> >* viewChildren = children();
+    HashSet<RefPtr<Widget> >::const_iterator end = viewChildren->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator current = viewChildren->begin(); current != end; ++current) {
+        Widget* widget = current->get();
+        if (widget->isFrameView()) {
+            if (static_cast<FrameView*>(widget)->hasCustomScrollbars())
+                return true;
+        } else if (widget->isScrollbar()) {
+            Scrollbar* scrollbar = static_cast<Scrollbar*>(widget);
+            if (scrollbar->isCustomScrollbar())
+                return true;
+        }
+    }
+
+    return false;
+}
+
 void FrameView::updateControlTints()
 {
     // This is called when control tints are changed from aqua/graphite to clear and vice versa.
@@ -1438,7 +1529,7 @@ void FrameView::updateControlTints()
     if (!m_frame || m_frame->loader()->url().isEmpty())
         return;
 
-    if (m_frame->contentRenderer() && m_frame->contentRenderer()->theme()->supportsControlTints()) {
+    if ((m_frame->contentRenderer() && m_frame->contentRenderer()->theme()->supportsControlTints()) || hasCustomScrollbars())  {
         if (needsLayout())
             layout();
         PlatformGraphicsContext* const noContext = 0;
@@ -1468,7 +1559,13 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
 {
     if (!frame())
         return;
-    
+
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willPaint();
+#endif
+
     Document* document = frame()->document();
 
 #ifndef NDEBUG
@@ -1532,6 +1629,11 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
 
     if (isTopLevelPainter)
         sCurrentPaintTimeStamp = 0;
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didPaint();
+#endif
 }
 
 void FrameView::setPaintRestriction(PaintRestriction pr)
@@ -1573,10 +1675,15 @@ void FrameView::layoutIfNeededRecursive()
 
     // layoutIfNeededRecursive is called when we need to make sure layout is up-to-date before
     // painting, so we need to flush out any deferred repaints too.
-    if (m_deferredRepaintTimer.isActive()) {
-        m_deferredRepaintTimer.stop();
-        doDeferredRepaints();
-    }
+    flushDeferredRepaints();
+}
+    
+void FrameView::flushDeferredRepaints()
+{
+    if (!m_deferredRepaintTimer.isActive())
+        return;
+    m_deferredRepaintTimer.stop();
+    doDeferredRepaints();
 }
 
 void FrameView::forceLayout(bool allowSubtree)
@@ -1626,7 +1733,7 @@ void FrameView::adjustPageHeight(float *newBottom, float oldTop, float oldBottom
         // Use a context with painting disabled.
         GraphicsContext context((PlatformGraphicsContext*)0);
         root->setTruncatedAt((int)floorf(oldBottom));
-        IntRect dirtyRect(0, (int)floorf(oldTop), root->overflowWidth(), (int)ceilf(oldBottom - oldTop));
+        IntRect dirtyRect(0, (int)floorf(oldTop), root->rightLayoutOverflow(), (int)ceilf(oldBottom - oldTop));
         root->layer()->paint(&context, dirtyRect);
         *newBottom = root->bestTruncatedAt();
         if (*newBottom == 0)
diff --git a/WebCore/page/FrameView.h b/WebCore/page/FrameView.h
index 1bdcfb3..4c900ae 100644
--- a/WebCore/page/FrameView.h
+++ b/WebCore/page/FrameView.h
@@ -25,7 +25,9 @@
 #ifndef FrameView_h
 #define FrameView_h
 
+#include "Frame.h"
 #include "IntSize.h"
+#include "Page.h"
 #include "RenderLayer.h"
 #include "ScrollView.h"
 #include <wtf/Forward.h>
@@ -37,6 +39,7 @@ class Color;
 class Event;
 class Frame;
 class FrameViewPrivate;
+class InspectorTimelineAgent;
 class IntRect;
 class Node;
 class PlatformMouseEvent;
@@ -69,8 +72,6 @@ public:
     void setMarginWidth(int);
     void setMarginHeight(int);
 
-    virtual void setCanHaveScrollbars(bool);
-
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
 
     virtual void setContentsSize(const IntSize&);
@@ -122,8 +123,6 @@ public:
     void setShouldUpdateWhileOffscreen(bool);
 
     void adjustViewSize();
-    void initScrollbars();
-    void updateDefaultScrollbarState();
     
     virtual IntRect windowClipRect(bool clipToContents = true) const;
     IntRect windowClipRectForLayer(const RenderLayer*, bool clipToLayerContents) const;
@@ -132,6 +131,7 @@ public:
 
     virtual void scrollRectIntoViewRecursively(const IntRect&);
     virtual void setScrollPosition(const IntPoint&);
+    void scrollPositionChanged();
 
     String mediaType() const;
     void setMediaType(const String&);
@@ -174,6 +174,7 @@ public:
     static double currentPaintTimeStamp() { return sCurrentPaintTimeStamp; } // returns 0 if not painting
     
     void layoutIfNeededRecursive();
+    void flushDeferredRepaints();
 
     void setIsVisuallyNonEmpty() { m_isVisuallyNonEmpty = true; }
 
@@ -190,6 +191,9 @@ public:
     virtual IntPoint convertFromRenderer(const RenderObject*, const IntPoint&) const;
     virtual IntPoint convertToRenderer(const RenderObject*, const IntPoint&) const;
 
+    bool isFrameViewScrollCorner(RenderScrollbarPart* scrollCorner) const { return m_scrollCorner == scrollCorner; }
+    void invalidateScrollCorner();
+
 private:
     FrameView(Frame*);
 
@@ -232,7 +236,16 @@ private:
 
     bool updateWidgets();
     void scrollToAnchor();
+
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* inspectorTimelineAgent() const;
+#endif
     
+    bool hasCustomScrollbars() const;
+
+    virtual void updateScrollCorner();
+    virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+
     static double sCurrentPaintTimeStamp; // used for detecting decoded resource thrash in the cache
 
     IntSize m_size;
@@ -242,8 +255,6 @@ private:
 
     bool m_doFullRepaint;
     
-    ScrollbarMode m_vmode;
-    ScrollbarMode m_hmode;
     bool m_useSlowRepaints;
     bool m_isOverlapped;
     bool m_contentIsOpaque;
@@ -263,7 +274,6 @@ private:
     bool m_firstLayoutCallbackPending;
 
     bool m_firstLayout;
-    bool m_needToInitScrollbars;
     bool m_isTransparent;
     Color m_baseBackgroundColor;
     IntSize m_lastLayoutSize;
@@ -302,8 +312,18 @@ private:
     bool m_firstVisuallyNonEmptyLayoutCallbackPending;
 
     RefPtr<Node> m_maintainScrollPositionAnchor;
+
+    // Renderer to hold our custom scroll corner.
+    RenderScrollbarPart* m_scrollCorner;
 };
 
+#if ENABLE(INSPECTOR)
+inline InspectorTimelineAgent* FrameView::inspectorTimelineAgent() const
+{
+    return m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // FrameView_h
diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index bf877e6..1ded2af 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -41,8 +41,11 @@
 
 namespace WebCore {
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 static const char* permissionDeniedErrorMessage = "User denied Geolocation";
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 Geolocation::GeoNotifier::GeoNotifier(Geolocation* geolocation, PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
     : m_geolocation(geolocation)
     , m_successCallback(successCallback)
@@ -60,15 +63,30 @@ Geolocation::GeoNotifier::GeoNotifier(Geolocation* geolocation, PassRefPtr<Posit
 
 void Geolocation::GeoNotifier::setFatalError(PassRefPtr<PositionError> error)
 {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     m_fatalError = error;
     m_timer.startOneShot(0);
+=======
+    ASSERT(m_successCallback);
+    // If no options were supplied from JS, we should have created a default set
+    // of options in JSGeolocationCustom.cpp.
+    ASSERT(m_options);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 }
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 void Geolocation::GeoNotifier::setCachedPosition(Geoposition* cachedPosition)
+=======
+bool Geolocation::GeoNotifier::hasZeroTimeout() const
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     // We do not take owenership from the caller, but add our own ref count.
     m_cachedPosition = cachedPosition;
     m_timer.startOneShot(0);
+=======
+    return m_options->hasTimeout() && m_options->timeout() == 0;
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 }
 
 void Geolocation::GeoNotifier::startTimerIfNeeded()
@@ -81,6 +99,7 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 {
     m_timer.stop();
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     if (m_fatalError) {
         if (m_errorCallback)
             m_errorCallback->handleEvent(m_fatalError.get());
@@ -95,8 +114,14 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
         return;
     }
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     if (m_errorCallback) {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         RefPtr<PositionError> error = PositionError::create(PositionError::TIMEOUT, "Timed out");
+=======
+        RefPtr<PositionError> error = PositionError::create(PositionError::TIMEOUT, "Timeout expired");
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
         m_errorCallback->handleEvent(error.get());
     }
     m_geolocation->requestTimedOut(this);
@@ -274,23 +299,55 @@ void Geolocation::disconnectFrame()
 
 void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     RefPtr<GeoNotifier> notifier = makeRequest(successCallback, errorCallback, options);
     ASSERT(notifier);
+=======
+    RefPtr<GeoNotifier> notifier = GeoNotifier::create(this, successCallback, errorCallback, options);
+
+    if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+        notifier->startTimerIfNeeded();
+    else {
+        if (notifier->m_errorCallback) {
+            RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
+            notifier->m_errorCallback->handleEvent(error.get());
+        }
+        return;
+    }
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 
     m_oneShots.add(notifier);
 }
 
 int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     RefPtr<GeoNotifier> notifier = makeRequest(successCallback, errorCallback, options);
     ASSERT(notifier);
+=======
+    RefPtr<GeoNotifier> notifier = GeoNotifier::create(this, successCallback, errorCallback, options);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
+=======
+    if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+        notifier->startTimerIfNeeded();
+    else {
+        if (notifier->m_errorCallback) {
+            RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
+            notifier->m_errorCallback->handleEvent(error.get());
+        }
+        return 0;
+    }
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     static int sIdentifier = 0;
     m_watchers.set(++sIdentifier, notifier);
 
     return sIdentifier;
 }
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 PassRefPtr<Geolocation::GeoNotifier> Geolocation::makeRequest(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
     RefPtr<GeoNotifier> notifier = GeoNotifier::create(this, successCallback, errorCallback, options);
@@ -334,6 +391,8 @@ void Geolocation::fatalErrorOccurred(Geolocation::GeoNotifier* notifier)
         m_service->stopUpdating();
 }
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 void Geolocation::requestTimedOut(GeoNotifier* notifier)
 {
     // If this is a one-shot request, stop it.
@@ -343,6 +402,7 @@ void Geolocation::requestTimedOut(GeoNotifier* notifier)
         m_service->stopUpdating();
 }
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 void Geolocation::requestReturnedCachedPosition(GeoNotifier* notifier)
 {
     // If this is a one-shot request, stop it.
@@ -372,6 +432,8 @@ bool Geolocation::haveSuitableCachedPosition(PositionOptions* options)
     return m_cachedPositionManager->cachedPosition()->timestamp() > currentTimeMillis - options->maximumAge();
 }
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 void Geolocation::clearWatch(int watchId)
 {
     m_watchers.remove(watchId);
@@ -397,9 +459,17 @@ void Geolocation::setIsAllowed(bool allowed)
     // This may be due to either a new position from the service, or a cached
     // position.
     m_allowGeolocation = allowed ? Yes : No;
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
     if (!isAllowed()) {
         RefPtr<WebCore::PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage);
+=======
+    
+    if (isAllowed())
+        makeSuccessCallbacks();
+    else {
+        RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "User disallowed Geolocation");
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
         error->setIsFatal(true);
         handleError(error.get());
         return;
@@ -436,7 +506,10 @@ void Geolocation::sendPosition(Vector<RefPtr<GeoNotifier> >& notifiers, Geoposit
         RefPtr<GeoNotifier> notifier = *it;
         ASSERT(notifier->m_successCallback);
         
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         notifier->m_timer.stop();
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
         notifier->m_successCallback->handleEvent(position);
     }
 }
@@ -475,15 +548,29 @@ void Geolocation::stopTimers()
 void Geolocation::handleError(PositionError* error)
 {
     ASSERT(error);
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
+=======
+    
+    Vector<RefPtr<GeoNotifier> > oneShotsCopy;
+    copyToVector(m_oneShots, oneShotsCopy);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     Vector<RefPtr<GeoNotifier> > oneShotsCopy;
     copyToVector(m_oneShots, oneShotsCopy);
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     Vector<RefPtr<GeoNotifier> > watchersCopy;
     copyValuesToVector(m_watchers, watchersCopy);
 
     // Clear the lists before we make the callbacks, to avoid clearing notifiers
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     // added by calls to Geolocation methods from the callbacks.
+=======
+    // added by calls to Geolocation methods from the callbacks, and to prevent
+    // further callbacks to these notifiers.
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     m_oneShots.clear();
     if (error->isFatal())
         m_watchers.clear();
@@ -515,17 +602,32 @@ void Geolocation::requestPermission()
 
 void Geolocation::geolocationServicePositionChanged(GeolocationService*)
 {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
+=======
+    ASSERT_UNUSED(service, service == m_service);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     ASSERT(m_service->lastPosition());
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     m_cachedPositionManager->setCachedPosition(m_service->lastPosition());
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     // Stop all currently running timers.
     stopTimers();
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     if (!isAllowed()) {
         // requestPermission() will ask the chrome for permission. This may be
         // implemented synchronously or asynchronously. In both cases,
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         // makeSucessCallbacks() will be called if permission is granted, so
+=======
+        // makeSuccessCallbacks() will be called if permission is granted, so
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
         // there's nothing more to do here.
         requestPermission();
         return;
@@ -538,15 +640,32 @@ void Geolocation::makeSuccessCallbacks()
 {
     ASSERT(m_service->lastPosition());
     ASSERT(isAllowed());
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     Vector<RefPtr<GeoNotifier> > oneShotsCopy;
     copyToVector(m_oneShots, oneShotsCopy);
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     Vector<RefPtr<GeoNotifier> > watchersCopy;
     copyValuesToVector(m_watchers, watchersCopy);
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     // Clear the lists before we make the callbacks, to avoid clearing notifiers
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     // added by calls to Geolocation methods from the callbacks.
+=======
+    // added by calls to Geolocation methods from the callbacks, and to prevent
+    // further callbacks to these notifiers.
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     m_oneShots.clear();
 
     sendPosition(oneShotsCopy, m_service->lastPosition());
diff --git a/WebCore/page/Geolocation.h b/WebCore/page/Geolocation.h
index 9b3b43f..5b3d156 100644
--- a/WebCore/page/Geolocation.h
+++ b/WebCore/page/Geolocation.h
@@ -82,8 +82,12 @@ private:
     public:
         static PassRefPtr<GeoNotifier> create(Geolocation* geolocation, PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PassRefPtr<PositionOptions> options) { return adoptRef(new GeoNotifier(geolocation, positionCallback, positionErrorCallback, options)); }
         
+<<<<<<< HEAD:WebCore/page/Geolocation.h
         void setFatalError(PassRefPtr<PositionError> error);
         void setCachedPosition(Geoposition* cachedPosition);
+=======
+        bool hasZeroTimeout() const;
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.h
         void startTimerIfNeeded();
         void timerFired(Timer<GeoNotifier>*);
         
@@ -96,14 +100,22 @@ private:
         RefPtr<Geoposition> m_cachedPosition;
 
     private:
+<<<<<<< HEAD:WebCore/page/Geolocation.h
         GeoNotifier(Geolocation* geolocation, PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
+=======
+        GeoNotifier(Geolocation*, PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.h
     };
 
     bool hasListeners() const { return !m_oneShots.isEmpty() || !m_watchers.isEmpty(); }
 
     void sendError(Vector<RefPtr<GeoNotifier> >&, PositionError*);
     void sendPosition(Vector<RefPtr<GeoNotifier> >&, Geoposition*);
+<<<<<<< HEAD:WebCore/page/Geolocation.h
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.h
     static void stopTimer(Vector<RefPtr<GeoNotifier> >&);
     void stopTimersForOneShots();
     void stopTimersForWatchers();
@@ -119,13 +131,20 @@ private:
     virtual void geolocationServicePositionChanged(GeolocationService*);
     virtual void geolocationServiceErrorOccurred(GeolocationService*);
 
+<<<<<<< HEAD:WebCore/page/Geolocation.h
     // EventListener
     virtual void handleEvent(Event*, bool isWindowEvent);
 
+=======
+<<<<<<< HEAD:WebCore/page/Geolocation.h
+>>>>>>> Merge webkit.org at R49305 : Automatic merge by git.:WebCore/page/Geolocation.h
     void fatalErrorOccurred(GeoNotifier* notifier);
     void requestTimedOut(GeoNotifier* notifier);
     void requestReturnedCachedPosition(GeoNotifier* notifier);
     bool haveSuitableCachedPosition(PositionOptions*);
+=======
+    void requestTimedOut(GeoNotifier*);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.h
 
     typedef HashSet<RefPtr<GeoNotifier> > GeoNotifierSet;
     typedef HashMap<int, RefPtr<GeoNotifier> > GeoNotifierMap;
diff --git a/WebCore/page/HaltablePlugin.h b/WebCore/page/HaltablePlugin.h
new file mode 100644
index 0000000..a5fe0f4
--- /dev/null
+++ b/WebCore/page/HaltablePlugin.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HaltablePlugin_h
+#define HaltablePlugin_h
+
+namespace WebCore {
+
+class Node;
+
+class HaltablePlugin {
+public:
+    virtual ~HaltablePlugin() { }
+
+    virtual void halt() = 0;
+    virtual void restart() = 0;
+    virtual Node* node() const = 0;
+};
+
+} // namespace WebCore
+
+#endif // HaltablePlugin_h
diff --git a/WebCore/page/History.cpp b/WebCore/page/History.cpp
index 2527132..9a27f1c 100644
--- a/WebCore/page/History.cpp
+++ b/WebCore/page/History.cpp
@@ -50,28 +50,30 @@ unsigned History::length() const
 {
     if (!m_frame)
         return 0;
-    return m_frame->loader()->getHistoryLength();
+    if (!m_frame->page())
+        return 0;
+    return m_frame->page()->getHistoryLength();
 }
 
 void History::back()
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(-1);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(-1);
 }
 
 void History::forward()
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(1);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(1);
 }
 
 void History::go(int distance)
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(distance);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(distance);
 }
 
 } // namespace WebCore
diff --git a/WebCore/page/Navigator.cpp b/WebCore/page/Navigator.cpp
index 3603b86..4922860 100644
--- a/WebCore/page/Navigator.cpp
+++ b/WebCore/page/Navigator.cpp
@@ -31,11 +31,13 @@
 #include "Language.h"
 #include "MimeTypeArray.h"
 #include "Page.h"
+#include "PageGroup.h"
 #include "PlatformString.h"
 #include "PluginArray.h"
 #include "PluginData.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "StorageNamespace.h"
 
 namespace WebCore {
 
@@ -150,5 +152,21 @@ Geolocation* Navigator::geolocation() const
         m_geolocation = Geolocation::create(m_frame);
     return m_geolocation.get();
 }
-    
+
+#if ENABLE(DOM_STORAGE)
+void Navigator::getStorageUpdates()
+{
+    if (!m_frame)
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    StorageNamespace* localStorage = page->group().localStorage();
+    if (localStorage)
+        localStorage->unlock();
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/page/Navigator.h b/WebCore/page/Navigator.h
index d50721e..4adebe1 100644
--- a/WebCore/page/Navigator.h
+++ b/WebCore/page/Navigator.h
@@ -55,6 +55,11 @@ namespace WebCore {
         // This is used for GC marking.
         Geolocation* optionalGeolocation() const { return m_geolocation.get(); }
 
+#if ENABLE(DOM_STORAGE)
+        // Relinquishes the storage lock, if one exists.
+        void getStorageUpdates();
+#endif
+
     private:
         Navigator(Frame*);
         Frame* m_frame;
diff --git a/WebCore/page/Navigator.idl b/WebCore/page/Navigator.idl
index 8048ff3..80ef4fb 100644
--- a/WebCore/page/Navigator.idl
+++ b/WebCore/page/Navigator.idl
@@ -42,6 +42,10 @@ module window {
 #if defined(ENABLE_GEOLOCATION) && ENABLE_GEOLOCATION
         readonly attribute Geolocation geolocation;
 #endif
+
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
+        void getStorageUpdates();
+#endif
     };
 
 }
diff --git a/WebCore/page/OriginAccessEntry.cpp b/WebCore/page/OriginAccessEntry.cpp
new file mode 100644
index 0000000..98c280c
--- /dev/null
+++ b/WebCore/page/OriginAccessEntry.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "OriginAccessEntry.h"
+
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+    
+OriginAccessEntry::OriginAccessEntry(const String& protocol, const String& host, SubdomainSetting subdomainSetting)
+    : m_protocol(protocol.lower())
+    , m_host(host.lower())
+    , m_subdomainSettings(subdomainSetting)
+{
+    ASSERT(m_protocol == "http" || m_protocol == "https");
+    ASSERT(subdomainSetting == AllowSubdomains || subdomainSetting == DisallowSubdomains);
+
+    // Assume that any host that ends with a digit is trying to be an IP address.
+    m_hostIsIPAddress = !m_host.isEmpty() && isASCIIDigit(m_host[m_host.length() - 1]);
+}
+
+bool OriginAccessEntry::matchesOrigin(const SecurityOrigin& origin) const
+{
+    ASSERT(origin.host() == origin.host().lower());
+    ASSERT(origin.protocol() == origin.protocol().lower());
+
+    if (m_protocol != origin.protocol())
+        return false;
+    
+    // Special case: Include subdomains and empty host means "all hosts, including ip addresses".
+    if (m_subdomainSettings == AllowSubdomains && m_host.isEmpty())
+        return true;
+    
+    // Exact match.
+    if (m_host == origin.host())
+        return true;
+    
+    // Otherwise we can only match if we're matching subdomains.
+    if (m_subdomainSettings == DisallowSubdomains)
+        return false;
+    
+    // Don't try to do subdomain matching on IP addresses.
+    if (m_hostIsIPAddress)
+        return false;
+    
+    // Match subdomains.
+    if (origin.host().length() > m_host.length() && origin.host()[origin.host().length() - m_host.length() - 1] == '.' && origin.host().endsWith(m_host))
+        return true;
+    
+    return false;
+}
+    
+} // namespace WebCore
diff --git a/WebCore/page/OriginAccessEntry.h b/WebCore/page/OriginAccessEntry.h
new file mode 100644
index 0000000..767d75f
--- /dev/null
+++ b/WebCore/page/OriginAccessEntry.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CrossOriginAccess_h
+#define CrossOriginAccess_h
+
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class SecurityOrigin;
+
+class OriginAccessEntry {
+public:
+    enum SubdomainSetting {
+        AllowSubdomains,
+        DisallowSubdomains
+    };
+
+    // If host is empty string and SubdomainSetting is AllowSubdomains, the entry will match all domains in the specified protocol.
+    OriginAccessEntry(const String& protocol, const String& host, SubdomainSetting);
+    bool matchesOrigin(const SecurityOrigin&) const;
+    
+private:
+    String m_protocol;
+    String m_host;
+    SubdomainSetting m_subdomainSettings;
+    bool m_hostIsIPAddress;
+    
+};
+
+} // namespace WebCore
+
+#endif // CrossOriginAccess_h
diff --git a/WebCore/page/Page.cpp b/WebCore/page/Page.cpp
index a13496b..397cb72 100644
--- a/WebCore/page/Page.cpp
+++ b/WebCore/page/Page.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "Page.h"
 
+#include "Base64.h"
 #include "CSSStyleSelector.h"
 #include "Chrome.h"
 #include "ChromeClient.h"
@@ -28,8 +29,10 @@
 #include "ContextMenuController.h"
 #include "DOMWindow.h"
 #include "DragController.h"
+#include "ExceptionCode.h"
 #include "EditorClient.h"
 #include "EventNames.h"
+#include "Event.h"
 #include "FileSystem.h"
 #include "FocusController.h"
 #include "Frame.h"
@@ -40,11 +43,13 @@
 #include "HTMLElement.h"
 #include "HistoryItem.h"
 #include "InspectorController.h"
+#include "InspectorTimelineAgent.h"
 #include "Logging.h"
 #include "Navigator.h"
 #include "NetworkStateNotifier.h"
 #include "PageGroup.h"
 #include "PluginData.h"
+#include "PluginHalter.h"
 #include "ProgressTracker.h"
 #include "RenderWidget.h"
 #include "RenderTheme.h"
@@ -92,22 +97,29 @@ static void networkStateChanged()
 
     AtomicString eventName = networkStateNotifier().onLine() ? eventNames().onlineEvent : eventNames().offlineEvent;
     for (unsigned i = 0; i < frames.size(); i++)
-        frames[i]->document()->dispatchWindowEvent(eventName, false, false);
+        frames[i]->document()->dispatchWindowEvent(Event::create(eventName, false, false));
 }
 
-Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient)
+Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient, PluginHalterClient* pluginHalterClient)
     : m_chrome(new Chrome(this, chromeClient))
     , m_dragCaretController(new SelectionController(0, true))
+#if ENABLE(DRAG_SUPPORT)
     , m_dragController(new DragController(this, dragClient))
+#endif
     , m_focusController(new FocusController(this))
+#if ENABLE(CONTEXT_MENUS)
     , m_contextMenuController(new ContextMenuController(this, contextMenuClient))
+#endif
+#if ENABLE(INSPECTOR)
     , m_inspectorController(new InspectorController(this, inspectorClient))
+#endif
     , m_settings(new Settings(this))
     , m_progress(new ProgressTracker)
     , m_backForwardList(BackForwardList::create(this))
     , m_theme(RenderTheme::themeForPage(this))
     , m_editorClient(editorClient)
     , m_frameCount(0)
+    , m_openedByDOM(false)
     , m_tabKeyCyclesThroughElements(true)
     , m_defersLoading(false)
     , m_inLowQualityInterpolationMode(false)
@@ -115,7 +127,9 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_areMemoryCacheClientCallsEnabled(true)
     , m_mediaVolume(1)
     , m_javaScriptURLsAreAllowed(true)
+#if ENABLE(INSPECTOR)
     , m_parentInspectorController(0)
+#endif
     , m_didLoadUserStyleSheet(false)
     , m_userStyleSheetModificationTime(0)
     , m_group(0)
@@ -123,7 +137,17 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_customHTMLTokenizerTimeDelay(-1)
     , m_customHTMLTokenizerChunkSize(-1)
     , m_canStartPlugins(true)
+    , m_pluginHalterClient(pluginHalterClient)
 {
+#if !ENABLE(CONTEXT_MENUS)
+    UNUSED_PARAM(contextMenuClient);
+#endif
+#if !ENABLE(DRAG_SUPPORT)
+    UNUSED_PARAM(dragClient);
+#endif
+#if !ENABLE(INSPECTOR)
+    UNUSED_PARAM(inspectorClient);
+#endif
     if (!allPages) {
         allPages = new HashSet<Page*>;
         
@@ -133,6 +157,8 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     ASSERT(!allPages->contains(this));
     allPages->add(this);
 
+    pluginHalterEnabledStateChanged();
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     JavaScriptDebugServer::shared().pageCreated(this);
 #endif
@@ -152,9 +178,11 @@ Page::~Page()
         frame->pageDestroyed();
 
     m_editorClient->pageDestroyed();
+#if ENABLE(INSPECTOR)
     if (m_parentInspectorController)
         m_parentInspectorController->pageDestroyed();
     m_inspectorController->inspectedPageDestroyed();
+#endif
 
     m_backForwardList->close();
 
@@ -174,6 +202,16 @@ void Page::setMainFrame(PassRefPtr<Frame> mainFrame)
     m_mainFrame = mainFrame;
 }
 
+bool Page::openedByDOM() const
+{
+    return m_openedByDOM;
+}
+
+void Page::setOpenedByDOM()
+{
+    m_openedByDOM = true;
+}
+
 BackForwardList* Page::backForwardList()
 {
     return m_backForwardList.get();
@@ -201,6 +239,40 @@ bool Page::goForward()
     return false;
 }
 
+bool Page::canGoBackOrForward(int distance) const
+{
+    if (distance == 0)
+        return true;
+    if (distance > 0 && distance <= m_backForwardList->forwardListCount())
+        return true;
+    if (distance < 0 && -distance <= m_backForwardList->backListCount())
+        return true;
+    return false;
+}
+
+void Page::goBackOrForward(int distance)
+{
+    if (distance == 0)
+        return;
+
+    HistoryItem* item = m_backForwardList->itemAtIndex(distance);
+    if (!item) {
+        if (distance > 0) {
+            int forwardListCount = m_backForwardList->forwardListCount();
+            if (forwardListCount > 0) 
+                item = m_backForwardList->itemAtIndex(forwardListCount);
+        } else {
+            int backListCount = m_backForwardList->backListCount();
+            if (backListCount > 0)
+                item = m_backForwardList->itemAtIndex(-backListCount);
+        }
+    }
+
+    ASSERT(item); // we should not reach this line with an empty back/forward list
+    if (item)
+        goToItem(item, FrameLoadTypeIndexedBackForward);
+}
+
 void Page::goToItem(HistoryItem* item, FrameLoadType type)
 {
     // Abort any current load if we're going to a history item
@@ -220,6 +292,11 @@ void Page::goToItem(HistoryItem* item, FrameLoadType type)
     m_mainFrame->loader()->goToItem(item, type);
 }
 
+int Page::getHistoryLength()
+{
+    return m_backForwardList->backListCount() + 1;
+}
+
 void Page::setGlobalHistoryItem(HistoryItem* item)
 {
     m_globalHistoryItem = item;
@@ -439,26 +516,43 @@ void Page::willMoveOffscreen()
 
 void Page::userStyleSheetLocationChanged()
 {
-#if !FRAME_LOADS_USER_STYLESHEET
-    // FIXME: We should provide a way to load other types of URLs than just
-    // file: (e.g., http:, data:).
-    if (m_settings->userStyleSheetLocation().isLocalFile())
-        m_userStyleSheetPath = m_settings->userStyleSheetLocation().fileSystemPath();
+    // FIXME: Eventually we will move to a model of just being handed the sheet
+    // text instead of loading the URL ourselves.
+    KURL url = m_settings->userStyleSheetLocation();
+    if (url.isLocalFile())
+        m_userStyleSheetPath = url.fileSystemPath();
     else
         m_userStyleSheetPath = String();
 
     m_didLoadUserStyleSheet = false;
     m_userStyleSheet = String();
     m_userStyleSheetModificationTime = 0;
-#endif
+    
+    // Data URLs with base64-encoded UTF-8 style sheets are common. We can process them
+    // synchronously and avoid using a loader. 
+    if (url.protocolIs("data") && url.string().startsWith("data:text/css;charset=utf-8;base64,")) {
+        m_didLoadUserStyleSheet = true;
+        
+        const unsigned prefixLength = 35;
+        Vector<char> encodedData(url.string().length() - prefixLength);
+        for (unsigned i = prefixLength; i < url.string().length(); ++i)
+            encodedData[i - prefixLength] = static_cast<char>(url.string()[i]);
+
+        Vector<char> styleSheetAsUTF8;
+        if (base64Decode(encodedData, styleSheetAsUTF8))
+            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data());
+    }
+    
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        if (frame->document())
+            frame->document()->clearPageUserSheet();
+    }
 }
 
 const String& Page::userStyleSheet() const
 {
-    if (m_userStyleSheetPath.isEmpty()) {
-        ASSERT(m_userStyleSheet.isEmpty());
+    if (m_userStyleSheetPath.isEmpty())
         return m_userStyleSheet;
-    }
 
     time_t modTime;
     if (!getFileModificationTime(m_userStyleSheetPath, modTime)) {
@@ -632,4 +726,39 @@ bool Page::javaScriptURLsAreAllowed() const
     return m_javaScriptURLsAreAllowed;
 }
 
+#if ENABLE(INSPECTOR)
+InspectorTimelineAgent* Page::inspectorTimelineAgent() const
+{
+    return m_inspectorController->timelineAgent();
+}
+#endif
+
+void Page::pluginHalterEnabledStateChanged()
+{
+    if (m_settings->pluginHalterEnabled()) {
+        ASSERT(!m_pluginHalter);
+        m_pluginHalter.set(new PluginHalter(m_pluginHalterClient));
+        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
+    } else
+        m_pluginHalter = 0;
+}
+
+void Page::pluginAllowedRunTimeChanged()
+{
+    if (m_pluginHalter)
+        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
+}
+
+void Page::didStartPlugin(HaltablePlugin* obj)
+{
+    if (m_pluginHalter)
+        m_pluginHalter->didStartPlugin(obj);
+}
+
+void Page::didStopPlugin(HaltablePlugin* obj)
+{
+    if (m_pluginHalter)
+        m_pluginHalter->didStopPlugin(obj);
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/Page.h b/WebCore/page/Page.h
index 9d9af86..cab075e 100644
--- a/WebCore/page/Page.h
+++ b/WebCore/page/Page.h
@@ -54,11 +54,15 @@ namespace WebCore {
     class EditorClient;
     class FocusController;
     class Frame;
+    class HaltablePlugin;
     class InspectorClient;
     class InspectorController;
+    class InspectorTimelineAgent;
     class Node;
     class PageGroup;
     class PluginData;
+    class PluginHalter;
+    class PluginHalterClient;
     class PluginView;
     class ProgressTracker;
     class RenderTheme;
@@ -71,6 +75,9 @@ namespace WebCore {
 #if ENABLE(WML)
     class WMLPageState;
 #endif
+#if ENABLE(NOTIFICATIONS)
+    class NotificationPresenter;
+#endif
 
     enum FindDirection { FindDirectionForward, FindDirectionBackward };
 
@@ -78,7 +85,7 @@ namespace WebCore {
     public:
         static void setNeedsReapplyStyles();
 
-        Page(ChromeClient*, ContextMenuClient*, EditorClient*, DragClient*, InspectorClient*);
+        Page(ChromeClient*, ContextMenuClient*, EditorClient*, DragClient*, InspectorClient*, PluginHalterClient*);
         ~Page();
 
         RenderTheme* theme() const { return m_theme.get(); };
@@ -96,6 +103,9 @@ namespace WebCore {
         void setMainFrame(PassRefPtr<Frame>);
         Frame* mainFrame() const { return m_mainFrame.get(); }
 
+        bool openedByDOM() const;
+        void setOpenedByDOM();
+
         BackForwardList* backForwardList();
 
         // FIXME: The following three methods don't fall under the responsibilities of the Page object
@@ -104,7 +114,10 @@ namespace WebCore {
         // makes more sense when that class exists.
         bool goBack();
         bool goForward();
+        bool canGoBackOrForward(int distance) const;
+        void goBackOrForward(int distance);
         void goToItem(HistoryItem*, FrameLoadType);
+        int getHistoryLength();
 
         HistoryItem* globalHistoryItem() const { return m_globalHistoryItem.get(); }
         void setGlobalHistoryItem(HistoryItem*);
@@ -121,15 +134,23 @@ namespace WebCore {
 
         Chrome* chrome() const { return m_chrome.get(); }
         SelectionController* dragCaretController() const { return m_dragCaretController.get(); }
+#if ENABLE(DRAG_SUPPORT)
         DragController* dragController() const { return m_dragController.get(); }
+#endif
         FocusController* focusController() const { return m_focusController.get(); }
+#if ENABLE(CONTEXT_MENUS)
         ContextMenuController* contextMenuController() const { return m_contextMenuController.get(); }
+#endif
+#if ENABLE(INSPECTOR)
         InspectorController* inspectorController() const { return m_inspectorController.get(); }
+#endif
         Settings* settings() const { return m_settings.get(); }
         ProgressTracker* progress() const { return m_progress.get(); }
 
+#if ENABLE(INSPECTOR)
         void setParentInspectorController(InspectorController* controller) { m_parentInspectorController = controller; }
         InspectorController* parentInspectorController() const { return m_parentInspectorController; }
+#endif
         
         void setTabKeyCyclesThroughElements(bool b) { m_tabKeyCyclesThroughElements = b; }
         bool tabKeyCyclesThroughElements() const { return m_tabKeyCyclesThroughElements; }
@@ -169,6 +190,11 @@ namespace WebCore {
         void userStyleSheetLocationChanged();
         const String& userStyleSheet() const;
 
+        void didStartPlugin(HaltablePlugin*);
+        void didStopPlugin(HaltablePlugin*);
+        void pluginAllowedRunTimeChanged();
+        void pluginHalterEnabledStateChanged();
+
         static void setDebuggerForAllPages(JSC::Debugger*);
         void setDebugger(JSC::Debugger*);
         JSC::Debugger* debugger() const { return m_debugger; }
@@ -207,15 +233,24 @@ namespace WebCore {
         void setJavaScriptURLsAreAllowed(bool);
         bool javaScriptURLsAreAllowed() const;
 
+#if ENABLE(INSPECTOR)
+        InspectorTimelineAgent* inspectorTimelineAgent() const;
+#endif
     private:
         void initGroup();
 
         OwnPtr<Chrome> m_chrome;
         OwnPtr<SelectionController> m_dragCaretController;
+#if ENABLE(DRAG_SUPPORT)
         OwnPtr<DragController> m_dragController;
+#endif
         OwnPtr<FocusController> m_focusController;
+#if ENABLE(CONTEXT_MENUS)
         OwnPtr<ContextMenuController> m_contextMenuController;
+#endif
+#if ENABLE(INSPECTOR)
         OwnPtr<InspectorController> m_inspectorController;
+#endif
         OwnPtr<Settings> m_settings;
         OwnPtr<ProgressTracker> m_progress;
         
@@ -232,6 +267,7 @@ namespace WebCore {
 
         int m_frameCount;
         String m_groupName;
+        bool m_openedByDOM;
 
         bool m_tabKeyCyclesThroughElements;
         bool m_defersLoading;
@@ -243,7 +279,9 @@ namespace WebCore {
 
         bool m_javaScriptURLsAreAllowed;
 
+#if ENABLE(INSPECTOR)
         InspectorController* m_parentInspectorController;
+#endif
 
         String m_userStyleSheetPath;
         mutable String m_userStyleSheet;
@@ -261,6 +299,9 @@ namespace WebCore {
         bool m_canStartPlugins;
         HashSet<PluginView*> m_unstartedPlugins;
 
+        OwnPtr<PluginHalter> m_pluginHalter;
+        PluginHalterClient* m_pluginHalterClient;
+
 #if ENABLE(DOM_STORAGE)
         RefPtr<StorageNamespace> m_sessionStorage;
 #endif
@@ -272,6 +313,10 @@ namespace WebCore {
 #if ENABLE(WML)
         OwnPtr<WMLPageState> m_wmlPageState;
 #endif
+
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* m_notificationPresenter;
+#endif
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/PageGroup.cpp b/WebCore/page/PageGroup.cpp
index 5155be1..cf6ba37 100644
--- a/WebCore/page/PageGroup.cpp
+++ b/WebCore/page/PageGroup.cpp
@@ -28,6 +28,7 @@
 
 #include "ChromeClient.h"
 #include "Document.h"
+#include "Frame.h"
 #include "Page.h"
 #include "Settings.h"
 
@@ -66,6 +67,11 @@ PageGroup::PageGroup(Page* page)
     addPage(page);
 }
 
+PageGroup::~PageGroup()
+{
+    removeAllUserContent();
+}
+
 typedef HashMap<String, PageGroup*> PageGroupMap;
 static PageGroupMap* pageGroups = 0;
 
@@ -185,12 +191,139 @@ StorageNamespace* PageGroup::localStorage()
     if (!m_localStorage) {
         // Need a page in this page group to query the settings for the local storage database path.
         Page* page = *m_pages.begin();
-        ASSERT(page);
-        m_localStorage = StorageNamespace::localStorageNamespace(page->settings()->localStorageDatabasePath());
+        const String& path = page->settings()->localStorageDatabasePath();
+        unsigned quota = page->settings()->localStorageQuota();
+        m_localStorage = StorageNamespace::localStorageNamespace(path, quota);
     }
 
     return m_localStorage.get();
 }
 #endif
 
+void PageGroup::addUserScript(const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
+                              PassOwnPtr<Vector<String> > blacklist, unsigned worldID, UserScriptInjectionTime injectionTime)
+{
+    if (worldID == UINT_MAX)
+        return;
+    OwnPtr<UserScript> userScript(new UserScript(source, url, whitelist, blacklist, worldID, injectionTime));
+    if (!m_userScripts)
+        m_userScripts.set(new UserScriptMap);
+    UserScriptVector*& scriptsInWorld = m_userScripts->add(worldID, 0).first->second;
+    if (!scriptsInWorld)
+        scriptsInWorld = new UserScriptVector;
+    scriptsInWorld->append(userScript.release());
+}
+
+void PageGroup::addUserStyleSheet(const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
+                                  PassOwnPtr<Vector<String> > blacklist, unsigned worldID)
+{
+    if (worldID == UINT_MAX)
+        return;
+    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist, worldID));
+    if (!m_userStyleSheets)
+        m_userStyleSheets.set(new UserStyleSheetMap);
+    UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(worldID, 0).first->second;
+    if (!styleSheetsInWorld)
+        styleSheetsInWorld = new UserStyleSheetVector;
+    styleSheetsInWorld->append(userStyleSheet.release());
+    
+    // Clear our cached sheets and have them just reparse.
+    HashSet<Page*>::const_iterator end = m_pages.end();
+    for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+            frame->document()->clearPageGroupUserSheets();
+    }
+}
+
+void PageGroup::removeUserContentWithURLForWorld(const KURL& url, unsigned worldID)
+{
+    if (m_userScripts) {
+        UserScriptMap::iterator it = m_userScripts->find(worldID);
+        if (it != m_userScripts->end()) {
+            UserScriptVector* scripts = it->second;
+            for (int i = scripts->size() - 1; i >= 0; --i) {
+                if (scripts->at(i)->url() == url)
+                    scripts->remove(i);
+            }
+            
+            if (scripts->isEmpty()) {
+                delete it->second;
+                m_userScripts->remove(it);
+            }
+        }
+    }
+    
+    if (m_userStyleSheets) {
+        UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+        bool sheetsChanged = false;
+        if (it != m_userStyleSheets->end()) {
+            UserStyleSheetVector* stylesheets = it->second;
+            for (int i = stylesheets->size() - 1; i >= 0; --i) {
+                if (stylesheets->at(i)->url() == url) {
+                    stylesheets->remove(i);
+                    sheetsChanged = true;
+                }
+            }
+            
+            if (stylesheets->isEmpty()) {
+                delete it->second;
+                m_userStyleSheets->remove(it);
+            }
+        }
+        
+        // Clear our cached sheets and have them just reparse.
+        if (sheetsChanged) {
+            HashSet<Page*>::const_iterator end = m_pages.end();
+            for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+                for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+                    frame->document()->clearPageGroupUserSheets();
+            }
+        }
+    }
+}
+
+void PageGroup::removeUserContentForWorld(unsigned worldID)
+{
+    if (m_userScripts) {
+        UserScriptMap::iterator it = m_userScripts->find(worldID);
+        if (it != m_userScripts->end()) {
+            delete it->second;
+            m_userScripts->remove(it);
+        }
+    }
+    
+    if (m_userStyleSheets) {
+        bool sheetsChanged = false;
+        UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+        if (it != m_userStyleSheets->end()) {
+            delete it->second;
+            m_userStyleSheets->remove(it);
+            sheetsChanged = true;
+        }
+    
+        if (sheetsChanged) {
+            // Clear our cached sheets and have them just reparse.
+            HashSet<Page*>::const_iterator end = m_pages.end();
+            for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+                for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+                    frame->document()->clearPageGroupUserSheets();
+            }
+        }
+    }
+}
+
+void PageGroup::removeAllUserContent()
+{
+    if (m_userScripts) {
+        deleteAllValues(*m_userScripts);
+        m_userScripts.clear();
+    }
+    
+    
+    if (m_userStyleSheets) {
+        deleteAllValues(*m_userStyleSheets);
+        m_userStyleSheets.clear();
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/PageGroup.h b/WebCore/page/PageGroup.h
index f92c2e6..7ea2967 100644
--- a/WebCore/page/PageGroup.h
+++ b/WebCore/page/PageGroup.h
@@ -30,6 +30,8 @@
 #include <wtf/Noncopyable.h>
 #include "LinkHash.h"
 #include "StringHash.h"
+#include "UserScript.h"
+#include "UserStyleSheet.h"
 
 namespace WebCore {
 
@@ -41,6 +43,7 @@ namespace WebCore {
     public:
         PageGroup(const String& name);
         PageGroup(Page*);
+        ~PageGroup();
 
         static PageGroup* pageGroup(const String& groupName);
         static void closeLocalStorage();
@@ -64,13 +67,26 @@ namespace WebCore {
 
 #if ENABLE(DOM_STORAGE)
         StorageNamespace* localStorage();
+        bool hasLocalStorage() { return m_localStorage; }
 #endif
 
+        void addUserScript(const String& source, const KURL&, 
+                           PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                           unsigned worldID, UserScriptInjectionTime);
+        const UserScriptMap* userScripts() const { return m_userScripts.get(); }
+        
+        void addUserStyleSheet(const String& source, const KURL&,
+                               PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                               unsigned worldID);
+        const UserStyleSheetMap* userStyleSheets() const { return m_userStyleSheets.get(); }
+        
+        void removeUserContentForWorld(unsigned);
+        void removeUserContentWithURLForWorld(const KURL&, unsigned);
+        void removeAllUserContent();
+        
     private:
         void addVisitedLink(LinkHash stringHash);
-#if ENABLE(DOM_STORAGE)
-        bool hasLocalStorage() { return m_localStorage; }
-#endif
+
         String m_name;
 
         HashSet<Page*> m_pages;
@@ -82,6 +98,9 @@ namespace WebCore {
 #if ENABLE(DOM_STORAGE)
         RefPtr<StorageNamespace> m_localStorage;
 #endif
+
+        OwnPtr<UserScriptMap> m_userScripts;
+        OwnPtr<UserStyleSheetMap> m_userStyleSheets;
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/PageGroupLoadDeferrer.cpp b/WebCore/page/PageGroupLoadDeferrer.cpp
index f274de3..122658b 100644
--- a/WebCore/page/PageGroupLoadDeferrer.cpp
+++ b/WebCore/page/PageGroupLoadDeferrer.cpp
@@ -41,10 +41,10 @@ PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
             if (!otherPage->defersLoading())
                 m_deferredFrames.append(otherPage->mainFrame());
 
-#if !PLATFORM(MAC)
+            // This code is not logically part of load deferring, but we do not want JS code executed beneath modal
+            // windows or sheets, which is exactly when PageGroupLoadDeferrer is used.
             for (Frame* frame = otherPage->mainFrame(); frame; frame = frame->tree()->traverseNext())
                 frame->document()->suspendActiveDOMObjects();
-#endif
         }
     }
 
@@ -60,10 +60,8 @@ PageGroupLoadDeferrer::~PageGroupLoadDeferrer()
         if (Page* page = m_deferredFrames[i]->page()) {
             page->setDefersLoading(false);
 
-#if !PLATFORM(MAC)
             for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
                 frame->document()->resumeActiveDOMObjects();
-#endif
         }
     }
 }
diff --git a/WebCore/page/PluginHalter.cpp b/WebCore/page/PluginHalter.cpp
new file mode 100644
index 0000000..8025337
--- /dev/null
+++ b/WebCore/page/PluginHalter.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "PluginHalter.h"
+
+#include "HaltablePlugin.h"
+#include "PluginHalterClient.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/Vector.h>
+
+using namespace std;
+
+namespace WebCore {
+
+PluginHalter::PluginHalter(PluginHalterClient* client)
+    : m_client(client)
+    , m_timer(this, &PluginHalter::timerFired)
+    , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
+{
+    ASSERT_ARG(client, client);
+}
+
+void PluginHalter::didStartPlugin(HaltablePlugin* obj)
+{
+    ASSERT_ARG(obj, obj);
+    ASSERT_ARG(obj, !m_plugins.contains(obj));
+
+    double currentTime = WTF::currentTime();
+
+    m_plugins.add(obj, currentTime);
+
+    if (m_plugins.size() == 1)
+        m_oldestStartTime = currentTime;
+
+    startTimerIfNecessary();
+}
+
+void PluginHalter::didStopPlugin(HaltablePlugin* obj)
+{
+    m_plugins.remove(obj);
+}
+
+void PluginHalter::timerFired(Timer<PluginHalter>*)
+{
+    if (m_plugins.isEmpty())
+        return;
+
+    Vector<HaltablePlugin*> plugins;
+    copyKeysToVector(m_plugins, plugins);
+
+    // Plug-ins older than this are candidates to be halted.
+    double pluginCutOffTime = WTF::currentTime() - m_pluginAllowedRunTime;
+
+    m_oldestStartTime = numeric_limits<double>::max();
+
+    for (size_t i = 0; i < plugins.size(); ++i) {
+        double thisStartTime = m_plugins.get(plugins[i]);
+        if (thisStartTime > pluginCutOffTime) {
+            // This plug-in is too young to be halted. We find the oldest
+            // plug-in that is not old enough to be halted and use it to set
+            // the timer's next fire time.
+            if (thisStartTime < m_oldestStartTime)
+                m_oldestStartTime = thisStartTime;
+            continue;
+        }
+
+        if (m_client->shouldHaltPlugin(plugins[i]->node()))
+            plugins[i]->halt();
+
+        m_plugins.remove(plugins[i]);
+    }
+
+    startTimerIfNecessary();
+}
+
+void PluginHalter::startTimerIfNecessary()
+{
+    if (m_timer.isActive())
+        return;
+
+    if (m_plugins.isEmpty())
+        return;
+
+    double nextFireInterval = static_cast<double>(m_pluginAllowedRunTime) - (currentTime() - m_oldestStartTime);
+    m_timer.startOneShot(nextFireInterval < 0 ? 0 : nextFireInterval);
+}
+
+} // namespace WebCore
diff --git a/WebCore/page/PluginHalter.h b/WebCore/page/PluginHalter.h
new file mode 100644
index 0000000..26f5101
--- /dev/null
+++ b/WebCore/page/PluginHalter.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PluginHalter_h
+#define PluginHalter_h
+
+#include "Timer.h"
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+class HaltablePlugin;
+class PluginHalterClient;
+
+class PluginHalter {
+public:
+    PluginHalter(PluginHalterClient*);
+
+    void didStartPlugin(HaltablePlugin*);
+    void didStopPlugin(HaltablePlugin*);
+
+    void setPluginAllowedRunTime(unsigned runTime) { m_pluginAllowedRunTime = runTime; }
+
+private:
+    void timerFired(Timer<PluginHalter>*);
+    void startTimerIfNecessary();
+
+    PluginHalterClient* m_client;
+    Timer<PluginHalter> m_timer;
+    unsigned m_pluginAllowedRunTime;
+    double m_oldestStartTime;
+    HashMap<HaltablePlugin*, double> m_plugins;
+};
+
+} // namespace WebCore
+
+#endif // PluginHalter_h
diff --git a/WebCore/page/PluginHalterClient.h b/WebCore/page/PluginHalterClient.h
new file mode 100644
index 0000000..7ea460a
--- /dev/null
+++ b/WebCore/page/PluginHalterClient.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PluginHalterClient_h
+#define PluginHalterClient_h
+
+namespace WebCore {
+
+class Node;
+
+class PluginHalterClient {
+public:
+    virtual ~PluginHalterClient() { }
+
+    virtual bool shouldHaltPlugin(Node*) const = 0;
+};
+
+} // namespace WebCore
+
+#endif // PluginHalterClient_h
diff --git a/WebCore/page/PositionCallback.h b/WebCore/page/PositionCallback.h
index f6bf139..30da2c1 100644
--- a/WebCore/page/PositionCallback.h
+++ b/WebCore/page/PositionCallback.h
@@ -36,7 +36,11 @@ namespace WebCore {
     class PositionCallback : public RefCounted<PositionCallback> {
     public:
         virtual ~PositionCallback() { }
+<<<<<<< HEAD:WebCore/page/PositionCallback.h
         virtual void handleEvent(Geoposition* position) = 0;
+=======
+        virtual void handleEvent(Geoposition*) = 0;
+>>>>>>> webkit.org at 49305:WebCore/page/PositionCallback.h
     };
     
 } // namespace WebCore
diff --git a/WebCore/page/PositionError.h b/WebCore/page/PositionError.h
index c309061..5c26fcc 100644
--- a/WebCore/page/PositionError.h
+++ b/WebCore/page/PositionError.h
@@ -46,7 +46,11 @@ public:
     ErrorCode code() const { return m_code; }
     const String& message() const { return m_message; }
     void setIsFatal(bool isFatal) { m_isFatal = isFatal; }
+<<<<<<< HEAD:WebCore/page/PositionError.h
     bool isFatal() { return m_isFatal; }
+=======
+    bool isFatal() const { return m_isFatal; }
+>>>>>>> webkit.org at 49305:WebCore/page/PositionError.h
     
 private:
     PositionError(ErrorCode code, const String& message) 
diff --git a/WebCore/page/PositionOptions.h b/WebCore/page/PositionOptions.h
index 5900998..b1746a8 100644
--- a/WebCore/page/PositionOptions.h
+++ b/WebCore/page/PositionOptions.h
@@ -33,7 +33,11 @@ namespace WebCore {
     
 class PositionOptions : public RefCounted<PositionOptions> {
 public:
+<<<<<<< HEAD:WebCore/page/PositionOptions.h
     static PassRefPtr<PositionOptions> create() { return adoptRef(new PositionOptions); }
+=======
+    static PassRefPtr<PositionOptions> create() { return adoptRef(new PositionOptions()); }
+>>>>>>> webkit.org at 49305:WebCore/page/PositionOptions.h
 
     bool enableHighAccuracy() const { return m_highAccuracy; }
     void setEnableHighAccuracy(bool enable) { m_highAccuracy = enable; }
diff --git a/WebCore/page/PrintContext.cpp b/WebCore/page/PrintContext.cpp
index b855ca5..4d3a839 100644
--- a/WebCore/page/PrintContext.cpp
+++ b/WebCore/page/PrintContext.cpp
@@ -67,7 +67,7 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
     float ratio = printRect.height() / printRect.width();
 
-    float pageWidth  = (float)root->overflowWidth();
+    float pageWidth  = (float)root->rightLayoutOverflow();
     float pageHeight = pageWidth * ratio;
     outPageHeight = pageHeight;   // this is the height of the page adjusted by margins
     pageHeight -= headerHeight + footerHeight;
diff --git a/WebCore/page/SecurityOrigin.cpp b/WebCore/page/SecurityOrigin.cpp
index 14a1b59..338bf9f 100644
--- a/WebCore/page/SecurityOrigin.cpp
+++ b/WebCore/page/SecurityOrigin.cpp
@@ -30,16 +30,23 @@
 #include "SecurityOrigin.h"
 
 #include "CString.h"
-#include "FrameLoader.h"
+#include "Document.h"
 #include "KURL.h"
-#include "PlatformString.h"
-#include "StringHash.h"
-#include <wtf/HashSet.h>
+#include "OriginAccessEntry.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
+static SecurityOrigin::LocalLoadPolicy localLoadPolicy = SecurityOrigin::AllowLocalLoadsForLocalOnly;
+
+typedef Vector<OriginAccessEntry> OriginAccessWhiteList;
+typedef HashMap<String, OriginAccessWhiteList*> OriginAccessMap;
+
+static OriginAccessMap& originAccessMap()
+{
+    DEFINE_STATIC_LOCAL(OriginAccessMap, originAccessMap, ());
+    return originAccessMap;
+}
 
 static URLSchemesMap& localSchemes()
 {
@@ -68,7 +75,7 @@ static URLSchemesMap& noAccessSchemes()
     return noAccessSchemes;
 }
 
-static bool isDefaultPortForProtocol(unsigned short port, const String& protocol)
+bool SecurityOrigin::isDefaultPortForProtocol(unsigned short port, const String& protocol)
 {
     if (protocol.isEmpty())
         return false;
@@ -111,9 +118,9 @@ SecurityOrigin::SecurityOrigin(const KURL& url)
 }
 
 SecurityOrigin::SecurityOrigin(const SecurityOrigin* other)
-    : m_protocol(other->m_protocol.copy())
-    , m_host(other->m_host.copy())
-    , m_domain(other->m_domain.copy())
+    : m_protocol(other->m_protocol.threadsafeCopy())
+    , m_host(other->m_host.threadsafeCopy())
+    , m_domain(other->m_domain.threadsafeCopy())
     , m_port(other->m_port)
     , m_noAccess(other->m_noAccess)
     , m_universalAccess(other->m_universalAccess)
@@ -139,7 +146,7 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createEmpty()
     return create(KURL());
 }
 
-PassRefPtr<SecurityOrigin> SecurityOrigin::copy()
+PassRefPtr<SecurityOrigin> SecurityOrigin::threadsafeCopy()
 {
     return adoptRef(new SecurityOrigin(this));
 }
@@ -203,7 +210,47 @@ bool SecurityOrigin::canRequest(const KURL& url) const
 
     // We call isSameSchemeHostPort here instead of canAccess because we want
     // to ignore document.domain effects.
-    return isSameSchemeHostPort(targetOrigin.get());
+    if (isSameSchemeHostPort(targetOrigin.get()))
+        return true;
+
+    if (OriginAccessWhiteList* list = originAccessMap().get(toString())) {
+        for (size_t i = 0; i < list->size(); ++i) {
+            if (list->at(i).matchesOrigin(*targetOrigin))
+                return true;
+        }
+    }
+
+    return false;
+}
+
+bool SecurityOrigin::taintsCanvas(const KURL& url) const
+{
+    if (canRequest(url))
+        return false;
+
+    // This method exists because we treat data URLs as noAccess, contrary
+    // to the current (9/19/2009) draft of the HTML5 specification.  We still
+    // want to let folks paint data URLs onto untainted canvases, so we special
+    // case data URLs below.  If we change to match HTML5 w.r.t. data URL
+    // security, then we can remove this method in favor of !canRequest.
+    if (url.protocolIs("data"))
+        return false;
+
+    return true;
+}
+
+bool SecurityOrigin::canLoad(const KURL& url, const String& referrer, Document* document)
+{
+    if (!shouldTreatURLAsLocal(url.string()))
+        return true;
+
+    // If we were provided a document, we let its local file policy dictate the result,
+    // otherwise we allow local loads only if the supplied referrer is also local.
+    if (document)
+        return document->securityOrigin()->canLoadLocalResources();
+    if (!referrer.isEmpty())
+        return shouldTreatURLAsLocal(referrer);
+    return false;
 }
 
 void SecurityOrigin::grantLoadLocalResources()
@@ -213,7 +260,7 @@ void SecurityOrigin::grantLoadLocalResources()
     // in a SecurityOrigin is a security hazard because the documents without
     // the privilege can obtain the privilege by injecting script into the
     // documents that have been granted the privilege.
-    ASSERT(FrameLoader::allowSubstituteDataAccessToLocal());
+    ASSERT(allowSubstituteDataAccessToLocal());
     m_canLoadLocalResources = true;
 }
 
@@ -339,13 +386,31 @@ bool SecurityOrigin::isSameSchemeHostPort(const SecurityOrigin* other) const
     return true;
 }
 
-// static
 void SecurityOrigin::registerURLSchemeAsLocal(const String& scheme)
 {
     localSchemes().add(scheme);
 }
 
-// static
+void SecurityOrigin::removeURLSchemeRegisteredAsLocal(const String& scheme)
+{
+    if (scheme == "file")
+        return;
+#if PLATFORM(MAC)
+    if (scheme == "applewebdata")
+        return;
+#endif
+#if PLATFORM(QT)
+    if (scheme == "qrc")
+        return;
+#endif
+    localSchemes().remove(scheme);
+}
+
+const URLSchemesMap&  SecurityOrigin::localURLSchemes()
+{
+    return localSchemes();
+}
+
 bool SecurityOrigin::shouldTreatURLAsLocal(const String& url)
 {
     // This avoids an allocation of another String and the HashSet contains()
@@ -366,7 +431,6 @@ bool SecurityOrigin::shouldTreatURLAsLocal(const String& url)
     return localSchemes().contains(scheme);
 }
 
-// static
 bool SecurityOrigin::shouldTreatURLSchemeAsLocal(const String& scheme)
 {
     // This avoids an allocation of another String and the HashSet contains()
@@ -385,16 +449,69 @@ bool SecurityOrigin::shouldTreatURLSchemeAsLocal(const String& scheme)
     return localSchemes().contains(scheme);
 }
 
-// static
 void SecurityOrigin::registerURLSchemeAsNoAccess(const String& scheme)
 {
     noAccessSchemes().add(scheme);
 }
 
-// static
 bool SecurityOrigin::shouldTreatURLSchemeAsNoAccess(const String& scheme)
 {
     return noAccessSchemes().contains(scheme);
 }
 
+bool SecurityOrigin::shouldHideReferrer(const KURL& url, const String& referrer)
+{
+    bool referrerIsSecureURL = protocolIs(referrer, "https");
+    bool referrerIsWebURL = referrerIsSecureURL || protocolIs(referrer, "http");
+
+    if (!referrerIsWebURL)
+        return true;
+
+    if (!referrerIsSecureURL)
+        return false;
+
+    bool URLIsSecureURL = url.protocolIs("https");
+
+    return !URLIsSecureURL;
+}
+
+void SecurityOrigin::setLocalLoadPolicy(LocalLoadPolicy policy)
+{
+    localLoadPolicy = policy;
+}
+
+bool SecurityOrigin::restrictAccessToLocal()
+{
+    return localLoadPolicy != SecurityOrigin::AllowLocalLoadsForAll;
+}
+
+bool SecurityOrigin::allowSubstituteDataAccessToLocal()
+{
+    return localLoadPolicy != SecurityOrigin::AllowLocalLoadsForLocalOnly;
+}
+
+void SecurityOrigin::whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains)
+{
+    ASSERT(isMainThread());
+    ASSERT(!sourceOrigin.isEmpty());
+    if (sourceOrigin.isEmpty())
+        return;
+
+    String sourceString = sourceOrigin.toString();
+    OriginAccessWhiteList* list = originAccessMap().get(sourceString);
+    if (!list) {
+        list = new OriginAccessWhiteList;
+        originAccessMap().set(sourceString, list);
+    }
+    list->append(OriginAccessEntry(destinationProtocol, destinationDomains, allowDestinationSubdomains ? OriginAccessEntry::AllowSubdomains : OriginAccessEntry::DisallowSubdomains));
+}
+
+void SecurityOrigin::resetOriginAccessWhiteLists()
+{
+    ASSERT(isMainThread());
+    OriginAccessMap& map = originAccessMap();
+    deleteAllValues(map);
+    map.clear();
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/SecurityOrigin.h b/WebCore/page/SecurityOrigin.h
index ab92683..46e6fad 100644
--- a/WebCore/page/SecurityOrigin.h
+++ b/WebCore/page/SecurityOrigin.h
@@ -29,14 +29,19 @@
 #ifndef SecurityOrigin_h
 #define SecurityOrigin_h
 
+#include <wtf/HashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
 #include "PlatformString.h"
+#include "StringHash.h"
 
 namespace WebCore {
 
+    typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
+
+    class Document;
     class KURL;
     
     class SecurityOrigin : public ThreadSafeShared<SecurityOrigin> {
@@ -48,7 +53,7 @@ namespace WebCore {
 
         // Create a deep copy of this SecurityOrigin.  This method is useful
         // when marshalling a SecurityOrigin to another thread.
-        PassRefPtr<SecurityOrigin> copy();
+        PassRefPtr<SecurityOrigin> threadsafeCopy();
 
         // Set the domain property of this security origin to newDomain.  This
         // function does not check whether newDomain is a suffix of the current
@@ -72,6 +77,16 @@ namespace WebCore {
         // XMLHttpRequests.
         bool canRequest(const KURL&) const;
 
+        // Returns true if drawing an image from this URL taints a canvas from
+        // this security origin.  For example, call this function before
+        // drawing an image onto an HTML canvas element with the drawImage API.
+        bool taintsCanvas(const KURL&) const;
+
+        // Returns true for any non-local URL. If document parameter is supplied,
+        // its local load policy dictates, otherwise if referrer is non-empty and
+        // represents a local file, then the local load is allowed.
+        static bool canLoad(const KURL&, const String& referrer, Document* document);
+
         // Returns true if this SecurityOrigin can load local resources, such
         // as images, iframes, and style sheets, and can link to local URLs.
         // For example, call this function before creating an iframe to a
@@ -129,12 +144,30 @@ namespace WebCore {
         bool isSameSchemeHostPort(const SecurityOrigin*) const;
 
         static void registerURLSchemeAsLocal(const String&);
+        static void removeURLSchemeRegisteredAsLocal(const String&);
+        static const URLSchemesMap& localURLSchemes();
         static bool shouldTreatURLAsLocal(const String&);
         static bool shouldTreatURLSchemeAsLocal(const String&);
 
+        static bool shouldHideReferrer(const KURL&, const String& referrer);
+
+        enum LocalLoadPolicy {
+            AllowLocalLoadsForAll,  // No restriction on local loads.
+            AllowLocalLoadsForLocalAndSubstituteData,
+            AllowLocalLoadsForLocalOnly,
+        };
+        static void setLocalLoadPolicy(LocalLoadPolicy);
+        static bool restrictAccessToLocal();
+        static bool allowSubstituteDataAccessToLocal();
+
         static void registerURLSchemeAsNoAccess(const String&);
         static bool shouldTreatURLSchemeAsNoAccess(const String&);
 
+        static void whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains);
+        static void resetOriginAccessWhiteLists();
+
+        static bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
+
     private:
         explicit SecurityOrigin(const KURL&);
         explicit SecurityOrigin(const SecurityOrigin*);
diff --git a/WebCore/page/Settings.cpp b/WebCore/page/Settings.cpp
index 9692707..98d08d2 100644
--- a/WebCore/page/Settings.cpp
+++ b/WebCore/page/Settings.cpp
@@ -48,6 +48,10 @@ static void setNeedsReapplyStylesInAllFrames(Page* page)
 bool Settings::gShouldPaintNativeControls = true;
 #endif
 
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+bool Settings::gShouldUseHighResolutionTimers = true;
+#endif
+
 Settings::Settings(Page* page)
     : m_page(page)
 #ifdef ANDROID_LAYOUT
@@ -69,6 +73,8 @@ Settings::Settings(Page* page)
     , m_blockNetworkImage(false)
 #endif
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
+    , m_localStorageQuota(5 * 1024 * 1024)  // Suggested by the HTML5 spec.
+    , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
@@ -110,7 +116,8 @@ Settings::Settings(Page* page)
     , m_usesEncodingDetector(false)
     , m_allowScriptsToCloseWindows(false)
     , m_editingBehavior(
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+        // (PLATFORM(MAC) is always false in Chromium, hence the extra condition.)
         EditingMacBehavior
 #else
         EditingWindowsBehavior
@@ -121,6 +128,12 @@ Settings::Settings(Page* page)
     , m_downloadableBinaryFontsEnabled(true)
     , m_xssAuditorEnabled(false)
     , m_acceleratedCompositingEnabled(true)
+    , m_experimentalNotificationsEnabled(false)
+    , m_pluginHalterEnabled(false)
+    , m_webGLEnabled(false)
+#if ENABLE(WEB_SOCKETS)
+    , m_experimentalWebSocketsEnabled(false)
+#endif
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -272,6 +285,11 @@ void Settings::setSessionStorageEnabled(bool sessionStorageEnabled)
     m_sessionStorageEnabled = sessionStorageEnabled;
 }
 
+void Settings::setLocalStorageQuota(unsigned localStorageQuota)
+{
+    m_localStorageQuota = localStorageQuota;
+}
+
 void Settings::setPrivateBrowsingEnabled(bool privateBrowsingEnabled)
 {
     m_privateBrowsingEnabled = privateBrowsingEnabled;
@@ -295,7 +313,6 @@ void Settings::setUserStyleSheetLocation(const KURL& userStyleSheetLocation)
     m_userStyleSheetLocation = userStyleSheetLocation;
 
     m_page->userStyleSheetLocationChanged();
-    setNeedsReapplyStylesInAllFrames(m_page);
 }
 
 void Settings::setShouldPrintBackgrounds(bool shouldPrintBackgrounds)
@@ -620,4 +637,44 @@ void Settings::setAcceleratedCompositingEnabled(bool enabled)
     setNeedsReapplyStylesInAllFrames(m_page);
 }
 
+void Settings::setExperimentalNotificationsEnabled(bool enabled)
+{
+    m_experimentalNotificationsEnabled = enabled;
+}
+
+void Settings::setPluginHalterEnabled(bool enabled)
+{
+    if (m_pluginHalterEnabled == enabled)
+        return;
+
+    m_pluginHalterEnabled = enabled;
+
+    m_page->pluginHalterEnabledStateChanged();
+}
+
+void Settings::setPluginAllowedRunTime(unsigned runTime)
+{
+    m_pluginAllowedRunTime = runTime;
+    m_page->pluginAllowedRunTimeChanged();
+}
+
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+void Settings::setShouldUseHighResolutionTimers(bool shouldUseHighResolutionTimers)
+{
+    gShouldUseHighResolutionTimers = shouldUseHighResolutionTimers;
+}
+#endif
+
+void Settings::setWebGLEnabled(bool enabled)
+{
+    m_webGLEnabled = enabled;
+}
+
+#if ENABLE(WEB_SOCKETS)
+void Settings::setExperimentalWebSocketsEnabled(bool enabled)
+{
+    m_experimentalWebSocketsEnabled = enabled;
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/page/Settings.h b/WebCore/page/Settings.h
index 162b21d..344746f 100644
--- a/WebCore/page/Settings.h
+++ b/WebCore/page/Settings.h
@@ -151,6 +151,9 @@ namespace WebCore {
         void setSessionStorageEnabled(bool);
         bool sessionStorageEnabled() const { return m_sessionStorageEnabled; }
 
+        void setLocalStorageQuota(unsigned);
+        unsigned localStorageQuota() const { return m_localStorageQuota; }
+
         void setPrivateBrowsingEnabled(bool);
         bool privateBrowsingEnabled() const { return m_privateBrowsingEnabled; }
 
@@ -295,6 +298,28 @@ namespace WebCore {
         void setAcceleratedCompositingEnabled(bool);
         bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
 
+        void setExperimentalNotificationsEnabled(bool);
+        bool experimentalNotificationsEnabled() const { return m_experimentalNotificationsEnabled; }
+
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+        static void setShouldUseHighResolutionTimers(bool);
+        static bool shouldUseHighResolutionTimers() { return gShouldUseHighResolutionTimers; }
+#endif
+
+        void setPluginHalterEnabled(bool);
+        bool pluginHalterEnabled() const { return m_pluginHalterEnabled; }
+
+        void setPluginAllowedRunTime(unsigned);
+        unsigned pluginAllowedRunTime() const { return m_pluginAllowedRunTime; }
+
+        void setWebGLEnabled(bool);
+        bool webGLEnabled() const { return m_webGLEnabled; }
+
+#if ENABLE(WEB_SOCKETS)
+        void setExperimentalWebSocketsEnabled(bool);
+        bool experimentalWebSocketsEnabled() const { return m_experimentalWebSocketsEnabled; }
+#endif
+
     private:
         Page* m_page;
         
@@ -352,6 +377,8 @@ namespace WebCore {
         bool m_blockNetworkImage : 1;
 #endif
         size_t m_maximumDecodedImageSize;
+        unsigned m_localStorageQuota;
+        unsigned m_pluginAllowedRunTime;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
@@ -396,10 +423,20 @@ namespace WebCore {
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
+        bool m_experimentalNotificationsEnabled : 1;
+        bool m_pluginHalterEnabled : 1;
+        bool m_webGLEnabled : 1;
+
+#if ENABLE(WEB_SOCKETS)
+        bool m_experimentalWebSocketsEnabled : 1;
+#endif
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
 #endif
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+        static bool gShouldUseHighResolutionTimers;
+#endif
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/UserContentURLPattern.cpp b/WebCore/page/UserContentURLPattern.cpp
new file mode 100644
index 0000000..5f0a311
--- /dev/null
+++ b/WebCore/page/UserContentURLPattern.cpp
@@ -0,0 +1,226 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "UserContentURLPattern.h"
+#include "KURL.h"
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+bool UserContentURLPattern::matchesPatterns(const KURL& url, const Vector<String>* whitelist, const Vector<String>* blacklist)
+{
+    // In order for a URL to be a match it has to be present in the whitelist and not present in the blacklist.
+    // If there is no whitelist at all, then all URLs are assumed to be in the whitelist.
+    bool matchesWhitelist = !whitelist || whitelist->isEmpty();
+    if (!matchesWhitelist) {
+        for (unsigned i = 0; i < whitelist->size(); ++i) {
+            UserContentURLPattern contentPattern(whitelist->at(i));
+            if (contentPattern.matches(url)) {
+                matchesWhitelist = true;
+                break;
+            }
+        }
+    }
+
+    bool matchesBlacklist = false;
+    if (blacklist) {
+        for (unsigned i = 0; i < blacklist->size(); ++i) {
+            UserContentURLPattern contentPattern(blacklist->at(i));
+            if (contentPattern.matches(url)) {
+                matchesBlacklist = true;
+                break;
+            }
+        }
+    }
+
+    return matchesWhitelist && !matchesBlacklist;
+}
+
+bool UserContentURLPattern::parse(const String& pattern)
+{
+    DEFINE_STATIC_LOCAL(const String, schemeSeparator, ("://"));
+
+    int schemeEndPos = pattern.find(schemeSeparator);
+    if (schemeEndPos == -1)
+        return false;
+
+    m_scheme = pattern.left(schemeEndPos);
+
+    int hostStartPos = schemeEndPos + schemeSeparator.length();
+    if (hostStartPos >= static_cast<int>(pattern.length()))
+        return false;
+
+    int pathStartPos = 0;
+
+    if (m_scheme == "file")
+        pathStartPos = hostStartPos;
+    else {
+        int hostEndPos = pattern.find("/", hostStartPos);
+        if (hostEndPos == -1)
+            return false;
+    
+        m_host = pattern.substring(hostStartPos, hostEndPos - hostStartPos);
+
+        // The first component can be '*', which means to match all subdomains.
+        Vector<String> hostComponents;
+        m_host.split(".", hostComponents); 
+        if (hostComponents[0] == "*") {
+            m_matchSubdomains = true;
+            m_host = "";
+            for (unsigned i = 1; i < hostComponents.size(); ++i) {
+                m_host = m_host + hostComponents[i];
+                if (i < hostComponents.size() - 1)
+                    m_host = m_host + ".";
+            }
+        }
+        
+        // No other '*' can occur in the host.
+        if (m_host.find("*") != -1)
+            return false;
+
+        pathStartPos = hostEndPos;
+    }
+
+    m_path = pattern.right(pattern.length() - pathStartPos);
+
+    return true;
+}
+
+bool UserContentURLPattern::matches(const KURL& test) const
+{
+    if (m_invalid)
+        return false;
+
+    if (test.protocol() != m_scheme)
+        return false;
+
+    if (!matchesHost(test))
+        return false;
+
+    return matchesPath(test);
+}
+
+bool UserContentURLPattern::matchesHost(const KURL& test) const
+{
+    if (test.host() == m_host)
+        return true;
+
+    if (!m_matchSubdomains)
+        return false;
+
+    // If we're matching subdomains, and we have no host, that means the pattern
+    // was <scheme>://*/<whatever>, so we match anything.
+    if (!m_host.length())
+        return true;
+
+    // Check if the test host is a subdomain of our host.
+    return test.host().endsWith(m_host, false);
+}
+
+struct MatchTester
+{
+    const String m_pattern;
+    unsigned m_patternIndex;
+    
+    const String m_test;
+    unsigned m_testIndex;
+    
+    MatchTester(const String& pattern, const String& test)
+    : m_pattern(pattern)
+    , m_patternIndex(0)
+    , m_test(test)
+    , m_testIndex(0)
+    {
+    }
+    
+    bool testStringFinished() const { return m_testIndex >= m_test.length(); }
+    bool patternStringFinished() const { return m_patternIndex >= m_pattern.length(); }
+
+    void eatWildcard()
+    {
+        while (!patternStringFinished()) {
+            if (m_pattern[m_patternIndex] != '*')
+                return;
+            m_patternIndex++;
+        }
+    }
+    
+    void eatSameChars()
+    {
+        while (!patternStringFinished() && !testStringFinished()) {
+            if (m_pattern[m_patternIndex] == '*')
+                return;
+            if (m_pattern[m_patternIndex] != m_test[m_testIndex])
+                return;
+            m_patternIndex++;
+            m_testIndex++;
+        }
+    }
+
+    bool test()
+    {
+        // Eat all the matching chars.
+        eatSameChars();
+
+        // If the string is finished, then the pattern must be empty too, or contains
+        // only wildcards.
+        if (testStringFinished()) {
+            eatWildcard();
+            if (patternStringFinished())
+                return true;
+            return false;
+        }
+  
+        // Pattern is empty but not string, this is not a match.
+        if (patternStringFinished())
+            return false;
+        
+        // If we don't encounter a *, then we're hosed.
+        if (m_pattern[m_patternIndex] != '*')
+            return false;
+        
+        while (!testStringFinished()) {
+            MatchTester nextMatch(*this);
+            nextMatch.m_patternIndex++;
+            if (nextMatch.test())
+                return true;
+            m_testIndex++;
+        }
+
+        // We reached the end of the string.  Let's see if the pattern contains only
+        // wildcards.
+        eatWildcard();
+        return patternStringFinished();
+    }
+};
+
+bool UserContentURLPattern::matchesPath(const KURL& test) const
+{
+    MatchTester match(m_path, test.path());
+    return match.test();
+}
+
+} // namespace WebCore
diff --git a/WebCore/page/UserContentURLPattern.h b/WebCore/page/UserContentURLPattern.h
new file mode 100644
index 0000000..0b1a248
--- /dev/null
+++ b/WebCore/page/UserContentURLPattern.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserContentURLPattern_h
+#define UserContentURLPattern_h
+
+#include "PlatformString.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class KURL;
+
+class UserContentURLPattern {
+public:
+    UserContentURLPattern(const String& pattern)
+    : m_matchSubdomains(false)
+    {
+        m_invalid = !parse(pattern);
+    }
+
+    bool matches(const KURL&) const;
+
+    const String& scheme() const { return m_scheme; }
+    const String& host() const { return m_host; }
+    const String& path() const { return m_path; }
+
+    bool matchSubdomains() const { return m_matchSubdomains; }
+    
+    static bool matchesPatterns(const KURL&, const Vector<String>* whitelist, const Vector<String>* blacklist);
+
+private:
+    bool parse(const String& pattern);
+
+    bool matchesHost(const KURL&) const;
+    bool matchesPath(const KURL&) const;
+
+    bool m_invalid;
+
+    String m_scheme;
+    String m_host;
+    String m_path;
+
+    bool m_matchSubdomains;
+};
+
+
+} // namespace WebCore
+
+#endif // UserContentURLPattern_h
diff --git a/WebCore/page/UserScript.h b/WebCore/page/UserScript.h
new file mode 100644
index 0000000..dbbb879
--- /dev/null
+++ b/WebCore/page/UserScript.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserScript_h
+#define UserScript_h
+
+#include "KURL.h"
+#include "UserScriptTypes.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class UserScript {
+public:
+    UserScript(const String& source, const KURL& url,
+               PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+               unsigned worldID, UserScriptInjectionTime injectionTime)
+        : m_source(source)
+        , m_url(url)
+        , m_whitelist(whitelist)
+        , m_blacklist(blacklist)
+        , m_worldID(worldID)
+        , m_injectionTime(injectionTime)
+    {
+    }
+
+    const String& source() const { return m_source; }
+    const KURL& url() const { return m_url; }
+    const Vector<String>* whitelist() const { return m_whitelist.get(); }
+    const Vector<String>* blacklist() const { return m_blacklist.get(); }
+    unsigned worldID() const { return m_worldID; }
+    UserScriptInjectionTime injectionTime() const { return m_injectionTime; }
+    
+private:
+    String m_source;
+    KURL m_url;
+    OwnPtr<Vector<String> > m_whitelist;
+    OwnPtr<Vector<String> > m_blacklist;
+    unsigned m_worldID;
+    UserScriptInjectionTime m_injectionTime;
+};
+
+} // namespace WebCore
+ 
+#endif // UserScript_h
diff --git a/WebCore/page/UserScriptTypes.h b/WebCore/page/UserScriptTypes.h
new file mode 100644
index 0000000..ac37662
--- /dev/null
+++ b/WebCore/page/UserScriptTypes.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserScriptTypes_h
+#define UserScriptTypes_h
+
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+enum UserScriptInjectionTime { InjectAtDocumentStart, InjectAtDocumentEnd };
+
+class UserScript;
+
+typedef Vector<OwnPtr<UserScript> > UserScriptVector;
+typedef HashMap<unsigned, UserScriptVector*> UserScriptMap;
+
+} // namespace WebCore
+ 
+#endif // UserScriptTypes_h
diff --git a/WebCore/page/UserStyleSheet.h b/WebCore/page/UserStyleSheet.h
new file mode 100644
index 0000000..56bec40
--- /dev/null
+++ b/WebCore/page/UserStyleSheet.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserStyleSheet_h
+#define UserStyleSheet_h
+
+#include "KURL.h"
+#include "UserStyleSheetTypes.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class UserStyleSheet {
+public:
+    UserStyleSheet(const String& source, const KURL& url,
+                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                   unsigned worldID)
+        : m_source(source)
+        , m_url(url)
+        , m_whitelist(whitelist)
+        , m_blacklist(blacklist)
+        , m_worldID(worldID)
+    {
+    }
+
+    const String& source() const { return m_source; }
+    const KURL& url() const { return m_url; }
+    const Vector<String>* whitelist() const { return m_whitelist.get(); }
+    const Vector<String>* blacklist() const { return m_blacklist.get(); }
+    unsigned worldID() const { return m_worldID; }
+
+private:
+    String m_source;
+    KURL m_url;
+    OwnPtr<Vector<String> > m_whitelist;
+    OwnPtr<Vector<String> > m_blacklist;
+    unsigned m_worldID;
+};
+
+} // namespace WebCore
+ 
+#endif // UserStyleSheet_h
diff --git a/WebCore/page/UserStyleSheetTypes.h b/WebCore/page/UserStyleSheetTypes.h
new file mode 100644
index 0000000..094b2cf
--- /dev/null
+++ b/WebCore/page/UserStyleSheetTypes.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserStyleSheetTypes_h
+#define UserStyleSheetTypes_h
+
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class UserStyleSheet;
+
+typedef Vector<OwnPtr<UserStyleSheet> > UserStyleSheetVector;
+typedef HashMap<unsigned, UserStyleSheetVector*> UserStyleSheetMap;
+
+} // namespace WebCore
+ 
+#endif // UserStyleSheetTypes_h
diff --git a/WebCore/page/XSSAuditor.cpp b/WebCore/page/XSSAuditor.cpp
index 70b691b..92ed896 100644
--- a/WebCore/page/XSSAuditor.cpp
+++ b/WebCore/page/XSSAuditor.cpp
@@ -48,12 +48,38 @@ namespace WebCore {
 
 static bool isNonCanonicalCharacter(UChar c)
 {
+    // We remove all non-ASCII characters, including non-printable ASCII characters.
+    //
     // Note, we don't remove backslashes like PHP stripslashes(), which among other things converts "\\0" to the \0 character.
     // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the 
     // adverse effect that we remove any legitimate zeros from a string.
     //
     // For instance: new String("http://localhost:8000") => new String("http://localhost:8").
-    return (c == '\\' || c == '0' || c < ' ' || c == 127);
+    return (c == '\\' || c == '0' || c < ' ' || c >= 127);
+}
+
+static bool isIllegalURICharacter(UChar c)
+{
+    // The characters described in section 2.4.3 of RFC 2396 <http://www.faqs.org/rfcs/rfc2396.html> in addition to the 
+    // single quote character "'" are considered illegal URI characters. That is, the following characters cannot appear
+    // in a valid URI: ', ", <, >
+    //
+    // If the request does not contain these characters then we can assume that no inline scripts have been injected 
+    // into response page, because it is impossible to write an inline script of the form <script>...</script>
+    // without "<", ">".
+    return (c == '\'' || c == '"' || c == '<' || c == '>');
+}
+
+String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities)
+{
+    if (decodeEntities == m_decodeEntities && encoding == m_encoding && url == m_inputURL)
+        return m_cachedCanonicalizedURL;
+
+    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities));
+    m_inputURL = url;
+    m_encoding = encoding;
+    m_decodeEntities = decodeEntities;
+    return m_cachedCanonicalizedURL;
 }
 
 XSSAuditor::XSSAuditor(Frame* frame)
@@ -76,7 +102,7 @@ bool XSSAuditor::canEvaluate(const String& code) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code, false)) {
+    if (findInRequest(code, false, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -102,7 +128,7 @@ bool XSSAuditor::canCreateInlineEventListener(const String&, const String& code)
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code)) {
+    if (findInRequest(code, true, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -156,22 +182,23 @@ String XSSAuditor::canonicalize(const String& string)
     return result.removeCharacters(&isNonCanonicalCharacter);
 }
 
-String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeHTMLentities)
+String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities)
 {
     String result;
     String url = string;
 
     url.replace('+', ' ');
     result = decodeURLEscapeSequences(url);
-    String decodedResult = encoding.decode(result.utf8().data(), result.length());
+    CString utf8Url = result.utf8();
+    String decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
     if (!decodedResult.isEmpty())
         result = decodedResult;
-    if (decodeHTMLentities)
+    if (decodeEntities)
         result = decodeHTMLEntities(result);
     return result;
 }
 
-String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodableHTMLEntitiesUntouched)
+String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodableEntitiesUntouched)
 {
     SegmentedString source(string);
     SegmentedString sourceShadow;
@@ -186,7 +213,7 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
             continue;
         }
         
-        if (leaveUndecodableHTMLEntitiesUntouched)
+        if (leaveUndecodableEntitiesUntouched)
             sourceShadow = source;
         bool notEnoughCharacters = false;
         unsigned entity = PreloadScanner::consumeEntity(source, notEnoughCharacters);
@@ -196,11 +223,11 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
         if (entity > 0xFFFF) {
             result.append(U16_LEAD(entity));
             result.append(U16_TRAIL(entity));
-        } else if (entity && (!leaveUndecodableHTMLEntitiesUntouched || entity != 0xFFFD)){
+        } else if (entity && (!leaveUndecodableEntitiesUntouched || entity != 0xFFFD)){
             result.append(entity);
         } else {
             result.append('&');
-            if (leaveUndecodableHTMLEntitiesUntouched)
+            if (leaveUndecodableEntitiesUntouched)
                 source = sourceShadow;
         }
     }
@@ -208,31 +235,48 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
     return String::adopt(result);
 }
 
-bool XSSAuditor::findInRequest(const String& string, bool decodeHTMLentities) const
+bool XSSAuditor::findInRequest(const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters) const
 {
     bool result = false;
     Frame* parentFrame = m_frame->tree()->parent();
     if (parentFrame && m_frame->document()->url() == blankURL())
-        result = findInRequest(parentFrame, string, decodeHTMLentities);
+        result = findInRequest(parentFrame, string, decodeEntities, allowRequestIfNoIllegalURICharacters);
     if (!result)
-        result = findInRequest(m_frame, string, decodeHTMLentities);
+        result = findInRequest(m_frame, string, decodeEntities, allowRequestIfNoIllegalURICharacters);
     return result;
 }
 
-bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeHTMLentities) const
+bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters) const
 {
     ASSERT(frame->document());
-    String pageURL = frame->document()->url().string();
 
     if (!frame->document()->decoder()) {
         // Note, JavaScript URLs do not have a charset.
         return false;
     }
 
-    if (protocolIs(pageURL, "data"))
+    if (string.isEmpty())
         return false;
 
-    if (string.isEmpty())
+    FormData* formDataObj = frame->loader()->documentLoader()->originalRequest().httpBody();
+    String pageURL = frame->document()->url().string();
+
+    if (!formDataObj && string.length() >= 2 * pageURL.length()) {
+        // Q: Why do we bother to do this check at all?
+        // A: Canonicalizing large inline scripts can be expensive.  We want to
+        //    bail out before the call to canonicalize below, which could
+        //    result in an unneeded allocation and memcpy.
+        //
+        // Q: Why do we multiply by two here?
+        // A: We attempt to detect reflected XSS even when the server
+        //    transforms the attacker's input with addSlashes.  The best the
+        //    attacker can do get the server to inflate his/her input by a
+        //    factor of two by sending " characters, which the server
+        //    transforms to \".
+        return false;
+    }
+
+    if (frame->document()->url().protocolIs("data"))
         return false;
 
     String canonicalizedString = canonicalize(string);
@@ -241,12 +285,16 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeHT
 
     if (string.length() < pageURL.length()) {
         // The string can actually fit inside the pageURL.
-        String decodedPageURL = canonicalize(decodeURL(pageURL, frame->document()->decoder()->encoding(), decodeHTMLentities));
+        String decodedPageURL = m_cache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), decodeEntities);
+
+        if (allowRequestIfNoIllegalURICharacters && (!formDataObj || formDataObj->isEmpty()) 
+            && decodedPageURL.find(&isIllegalURICharacter, 0) == -1)
+            return false; // Injection is impossible because the request does not contain any illegal URI characters. 
+
         if (decodedPageURL.find(canonicalizedString, 0, false) != -1)
-           return true;  // We've found the smoking gun.
+            return true;  // We've found the smoking gun.
     }
 
-    FormData* formDataObj = frame->loader()->documentLoader()->originalRequest().httpBody();
     if (formDataObj && !formDataObj->isEmpty()) {
         String formData = formDataObj->flattenToString();
         if (string.length() < formData.length()) {
@@ -254,7 +302,7 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeHT
             // the url-encoded POST data because the length of the url-decoded
             // code is less than or equal to the length of the url-encoded
             // string.
-            String decodedFormData = canonicalize(decodeURL(formData, frame->document()->decoder()->encoding(), decodeHTMLentities));
+            String decodedFormData = m_cache.canonicalizeURL(formData, frame->document()->decoder()->encoding(), decodeEntities);
             if (decodedFormData.find(canonicalizedString, 0, false) != -1)
                 return true;  // We found the string in the POST data.
         }
diff --git a/WebCore/page/XSSAuditor.h b/WebCore/page/XSSAuditor.h
index 26f10ab..d3d1ec9 100644
--- a/WebCore/page/XSSAuditor.h
+++ b/WebCore/page/XSSAuditor.h
@@ -99,18 +99,34 @@ namespace WebCore {
         bool canSetBaseElementURL(const String& url) const;
 
     private:
-        static String canonicalize(const String&);
-        
-        static String decodeURL(const String& url, const TextEncoding& encoding = UTF8Encoding(), bool decodeHTMLentities = true);
-        
-        static String decodeHTMLEntities(const String&, bool leaveUndecodableHTMLEntitiesUntouched = true);
+        class CachingURLCanonicalizer
+        {
+        public:
+            CachingURLCanonicalizer() : m_decodeEntities(false) { }
+            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+
+        private:
+            // The parameters we were called with last.
+            String m_inputURL;
+            TextEncoding m_encoding;
+            bool m_decodeEntities;
+
+            // The cached result.
+            String m_cachedCanonicalizedURL;
+        };
 
-        bool findInRequest(const String&, bool decodeHTMLentities = true) const;
+        static String canonicalize(const String&);
+        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+        static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
 
-        bool findInRequest(Frame*, const String&, bool decodeHTMLentities = true) const;
+        bool findInRequest(const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false) const;
+        bool findInRequest(Frame*, const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false) const;
 
         // The frame to audit.
         Frame* m_frame;
+
+        // A state store to help us avoid canonicalizing the same URL repeated.
+        mutable CachingURLCanonicalizer m_cache;
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/animation/AnimationBase.cpp b/WebCore/page/animation/AnimationBase.cpp
index 7503f0a..ec0e284 100644
--- a/WebCore/page/animation/AnimationBase.cpp
+++ b/WebCore/page/animation/AnimationBase.cpp
@@ -302,11 +302,21 @@ public:
     {
         ShadowData* shadowA = (a->*m_getter)();
         ShadowData* shadowB = (b->*m_getter)();
+        
+        while (true) {
+            if (!shadowA && !shadowB)   // end of both lists
+                return true;
+
+            if (!shadowA || !shadowB)   // end of just one of the lists
+                return false;
+
+            if (*shadowA != *shadowB)
+                return false;
+        
+            shadowA = shadowA->next;
+            shadowB = shadowB->next;
+        }
 
-        if ((!shadowA && shadowB) || (shadowA && !shadowB))
-            return false;
-        if (shadowA && shadowB && (*shadowA != *shadowB))
-            return false;
         return true;
     }
 
@@ -316,12 +326,22 @@ public:
         ShadowData* shadowB = (b->*m_getter)();
         ShadowData defaultShadowData(0, 0, 0, 0, Normal, Color::transparent);
 
-        if (!shadowA)
-            shadowA = &defaultShadowData;
-        if (!shadowB)
-            shadowB = &defaultShadowData;
+        ShadowData* newShadowData = 0;
+        
+        while (shadowA || shadowB) {
+            ShadowData* srcShadow = shadowA ? shadowA : &defaultShadowData;
+            ShadowData* dstShadow = shadowB ? shadowB : &defaultShadowData;
+            
+            if (!newShadowData)
+                newShadowData = blendFunc(anim, srcShadow, dstShadow, progress);
+            else
+                newShadowData->next = blendFunc(anim, srcShadow, dstShadow, progress);
 
-        (dst->*m_setter)(blendFunc(anim, shadowA, shadowB, progress), false);
+            shadowA = shadowA ? shadowA->next : 0;
+            shadowB = shadowB ? shadowB->next : 0;
+        }
+        
+        (dst->*m_setter)(newShadowData, false);
     }
 
 private:
@@ -341,6 +361,10 @@ public:
     {
         Color fromColor = (a->*m_getter)();
         Color toColor = (b->*m_getter)();
+
+        if (!fromColor.isValid() && !toColor.isValid())
+            return true;
+
         if (!fromColor.isValid())
             fromColor = a->color();
         if (!toColor.isValid())
@@ -353,6 +377,10 @@ public:
     {
         Color fromColor = (a->*m_getter)();
         Color toColor = (b->*m_getter)();
+
+        if (!fromColor.isValid() && !toColor.isValid())
+            return;
+
         if (!fromColor.isValid())
             fromColor = a->color();
         if (!toColor.isValid())
@@ -365,6 +393,124 @@ private:
     void (RenderStyle::*m_setter)(const Color&);
 };
 
+// Wrapper base class for an animatable property in a FillLayer
+class FillLayerPropertyWrapperBase {
+public:
+    FillLayerPropertyWrapperBase()
+    {
+    }
+
+    virtual ~FillLayerPropertyWrapperBase() { }
+    
+    virtual bool equals(const FillLayer* a, const FillLayer* b) const = 0;
+    virtual void blend(const AnimationBase* anim, FillLayer* dst, const FillLayer* a, const FillLayer* b, double progress) const = 0;
+};
+
+template <typename T>
+class FillLayerPropertyWrapperGetter : public FillLayerPropertyWrapperBase {
+public:
+    FillLayerPropertyWrapperGetter(T (FillLayer::*getter)() const)
+        : m_getter(getter)
+    {
+    }
+
+    virtual bool equals(const FillLayer* a, const FillLayer* b) const
+    {
+       // If the style pointers are the same, don't bother doing the test.
+       // If either is null, return false. If both are null, return true.
+       if ((!a && !b) || a == b)
+           return true;
+       if (!a || !b)
+            return false;
+        return (a->*m_getter)() == (b->*m_getter)();
+    }
+
+protected:
+    T (FillLayer::*m_getter)() const;
+};
+
+template <typename T>
+class FillLayerPropertyWrapper : public FillLayerPropertyWrapperGetter<T> {
+public:
+    FillLayerPropertyWrapper(T (FillLayer::*getter)() const, void (FillLayer::*setter)(T))
+        : FillLayerPropertyWrapperGetter<T>(getter)
+        , m_setter(setter)
+    {
+    }
+    
+    virtual void blend(const AnimationBase* anim, FillLayer* dst, const FillLayer* a, const FillLayer* b, double progress) const
+    {
+        (dst->*m_setter)(blendFunc(anim, (a->*FillLayerPropertyWrapperGetter<T>::m_getter)(), (b->*FillLayerPropertyWrapperGetter<T>::m_getter)(), progress));
+    }
+
+protected:
+    void (FillLayer::*m_setter)(T);
+};
+
+
+class FillLayersPropertyWrapper : public PropertyWrapperBase {
+public:
+    typedef const FillLayer* (RenderStyle::*LayersGetter)() const;
+    typedef FillLayer* (RenderStyle::*LayersAccessor)();
+    
+    FillLayersPropertyWrapper(int prop, LayersGetter getter, LayersAccessor accessor)
+        : PropertyWrapperBase(prop)
+        , m_layersGetter(getter)
+        , m_layersAccessor(accessor)
+    {
+        switch (prop) {
+            case CSSPropertyBackgroundPositionX:
+            case CSSPropertyWebkitMaskPositionX:
+                m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<Length>(&FillLayer::xPosition, &FillLayer::setXPosition);
+                break;
+            case CSSPropertyBackgroundPositionY:
+            case CSSPropertyWebkitMaskPositionY:
+                m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<Length>(&FillLayer::yPosition, &FillLayer::setYPosition);
+                break;
+            case CSSPropertyBackgroundSize:
+            case CSSPropertyWebkitMaskSize:
+                m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<LengthSize>(&FillLayer::sizeLength, &FillLayer::setSizeLength);
+                break;
+        }
+    }
+
+    virtual bool equals(const RenderStyle* a, const RenderStyle* b) const
+    {
+        const FillLayer* fromLayer = (a->*m_layersGetter)();
+        const FillLayer* toLayer = (b->*m_layersGetter)();
+
+        while (fromLayer && toLayer) {
+            if (!m_fillLayerPropertyWrapper->equals(fromLayer, toLayer))
+                return false;
+            
+            fromLayer = fromLayer->next();
+            toLayer = toLayer->next();
+        }
+
+        return true;
+    }
+
+    virtual void blend(const AnimationBase* anim, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress) const
+    {
+        const FillLayer* aLayer = (a->*m_layersGetter)();
+        const FillLayer* bLayer = (b->*m_layersGetter)();
+        FillLayer* dstLayer = (dst->*m_layersAccessor)();
+
+        while (aLayer && bLayer && dstLayer) {
+            m_fillLayerPropertyWrapper->blend(anim, dstLayer, aLayer, bLayer, progress);
+            aLayer = aLayer->next();
+            bLayer = bLayer->next();
+            dstLayer = dstLayer->next();
+        }
+    }
+
+private:
+    FillLayerPropertyWrapperBase* m_fillLayerPropertyWrapper;
+    
+    LayersGetter m_layersGetter;
+    LayersAccessor m_layersAccessor;
+};
+
 class ShorthandPropertyWrapper : public PropertyWrapperBase {
 public:
     ShorthandPropertyWrapper(int property, const CSSPropertyLonghand& longhand)
@@ -442,13 +588,14 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapper<const Color&>(CSSPropertyColor, &RenderStyle::color, &RenderStyle::setColor));
 
         gPropertyWrappers->append(new PropertyWrapper<const Color&>(CSSPropertyBackgroundColor, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor));
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBackgroundPositionX, &RenderStyle::backgroundXPosition, &RenderStyle::setBackgroundXPosition));
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBackgroundPositionY, &RenderStyle::backgroundYPosition, &RenderStyle::setBackgroundYPosition));
-        gPropertyWrappers->append(new PropertyWrapper<LengthSize>(CSSPropertyWebkitBackgroundSize, &RenderStyle::backgroundSize, &RenderStyle::setBackgroundSize));
 
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitMaskPositionX, &RenderStyle::maskXPosition, &RenderStyle::setMaskXPosition));
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitMaskPositionY, &RenderStyle::maskYPosition, &RenderStyle::setMaskYPosition));
-        gPropertyWrappers->append(new PropertyWrapper<LengthSize>(CSSPropertyWebkitMaskSize, &RenderStyle::maskSize, &RenderStyle::setMaskSize));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundPositionX, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundPositionY, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundSize, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskPositionX, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskPositionY, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskSize, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
 
         gPropertyWrappers->append(new PropertyWrapper<int>(CSSPropertyFontSize, &RenderStyle::fontSize, &RenderStyle::setBlendedFontSize));
         gPropertyWrappers->append(new PropertyWrapper<unsigned short>(CSSPropertyWebkitColumnRuleWidth, &RenderStyle::columnRuleWidth, &RenderStyle::setColumnRuleWidth));
@@ -496,7 +643,7 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapperMaybeInvalidColor(CSSPropertyOutlineColor, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor));
 
         // These are for shadows
-        gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyBoxShadow, &RenderStyle::boxShadow, &RenderStyle::setBoxShadow));
+        gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyWebkitBoxShadow, &RenderStyle::boxShadow, &RenderStyle::setBoxShadow));
         gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyTextShadow, &RenderStyle::textShadow, &RenderStyle::setTextShadow));
 
 #if ENABLE(SVG)
@@ -685,7 +832,7 @@ void AnimationBase::setNeedsStyleRecalc(Node* node)
 {
     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
     if (node)
-        node->setNeedsStyleRecalc(AnimationStyleChange);
+        node->setNeedsStyleRecalc(SyntheticStyleChange);
 }
 
 double AnimationBase::duration() const
diff --git a/WebCore/page/animation/AnimationController.cpp b/WebCore/page/animation/AnimationController.cpp
index ed241e1..691932e 100644
--- a/WebCore/page/animation/AnimationController.cpp
+++ b/WebCore/page/animation/AnimationController.cpp
@@ -36,6 +36,8 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "RenderView.h"
+#include "WebKitAnimationEvent.h"
+#include "WebKitTransitionEvent.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/UnusedParam.h>
 
@@ -98,7 +100,7 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
                 if (callSetChanged) {
                     Node* node = it->first->node();
                     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
-                    node->setNeedsStyleRecalc(AnimationStyleChange);
+                    node->setNeedsStyleRecalc(SyntheticStyleChange);
                     calledSetChanged = true;
                 }
                 else
@@ -136,9 +138,9 @@ void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<Animat
     Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
     for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
         if (it->eventType == eventNames().webkitTransitionEndEvent)
-            it->element->dispatchWebKitTransitionEvent(it->eventType, it->name, it->elapsedTime);
+            it->element->dispatchEvent(WebKitTransitionEvent::create(it->eventType, it->name, it->elapsedTime));
         else
-            it->element->dispatchWebKitAnimationEvent(it->eventType, it->name, it->elapsedTime);
+            it->element->dispatchEvent(WebKitAnimationEvent::create(it->eventType, it->name, it->elapsedTime));
     }
     
     m_eventsToDispatch.clear();
@@ -146,7 +148,7 @@ void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<Animat
     // call setChanged on all the elements
     Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
     for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)
-        (*it)->setNeedsStyleRecalc(AnimationStyleChange);
+        (*it)->setNeedsStyleRecalc(SyntheticStyleChange);
     
     m_nodeChangesToDispatch.clear();
     
@@ -244,7 +246,7 @@ bool AnimationControllerPrivate::pauseAnimationAtTime(RenderObject* renderer, co
         return false;
 
     if (compAnim->pauseAnimationAtTime(name, t)) {
-        renderer->node()->setNeedsStyleRecalc(AnimationStyleChange);
+        renderer->node()->setNeedsStyleRecalc(SyntheticStyleChange);
         startUpdateStyleIfNeededDispatcher();
         return true;
     }
@@ -262,7 +264,7 @@ bool AnimationControllerPrivate::pauseTransitionAtTime(RenderObject* renderer, c
         return false;
 
     if (compAnim->pauseTransitionAtTime(cssPropertyID(property), t)) {
-        renderer->node()->setNeedsStyleRecalc(AnimationStyleChange);
+        renderer->node()->setNeedsStyleRecalc(SyntheticStyleChange);
         startUpdateStyleIfNeededDispatcher();
         return true;
     }
@@ -438,7 +440,7 @@ void AnimationController::cancelAnimations(RenderObject* renderer)
     if (m_data->clear(renderer)) {
         Node* node = renderer->node();
         ASSERT(!node || (node->document() && !node->document()->inPageCache()));
-        node->setNeedsStyleRecalc(AnimationStyleChange);
+        node->setNeedsStyleRecalc(SyntheticStyleChange);
     }
 }
 
diff --git a/WebCore/page/chromium/FrameChromium.cpp b/WebCore/page/chromium/FrameChromium.cpp
index 1372cd9..d79ae68 100644
--- a/WebCore/page/chromium/FrameChromium.cpp
+++ b/WebCore/page/chromium/FrameChromium.cpp
@@ -60,7 +60,7 @@ void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float head
     
     float ratio = static_cast<float>(printRect.height()) / static_cast<float>(printRect.width());
  
-    float pageWidth  = static_cast<float>(root->overflowWidth());
+    float pageWidth  = static_cast<float>(root->rightLayoutOverflow());
     float pageHeight = pageWidth * ratio;
     outPageHeight = static_cast<int>(pageHeight);   // this is the height of the page adjusted by margins
     pageHeight -= (headerHeight + footerHeight);
diff --git a/WebCore/page/gtk/EventHandlerGtk.cpp b/WebCore/page/gtk/EventHandlerGtk.cpp
index d12cdcc..7051391 100644
--- a/WebCore/page/gtk/EventHandlerGtk.cpp
+++ b/WebCore/page/gtk/EventHandlerGtk.cpp
@@ -122,4 +122,13 @@ unsigned EventHandler::accessKeyModifiers()
     return PlatformKeyboardEvent::AltKey;
 }
 
+// GTK+ must scroll horizontally if the mouse pointer is on top of the
+// horizontal scrollbar while scrolling with the wheel; we need to
+// add the deltas and ticks here so that this behavior is consistent
+// for styled scrollbars.
+bool EventHandler::shouldTurnVerticalTicksIntoHorizontal(const HitTestResult& result) const
+{
+    return result.scrollbar() && result.scrollbar()->orientation() == HorizontalScrollbar;
+}
+
 }
diff --git a/WebCore/page/haiku/DragControllerHaiku.cpp b/WebCore/page/haiku/DragControllerHaiku.cpp
index 0b95558..ef08ac2 100644
--- a/WebCore/page/haiku/DragControllerHaiku.cpp
+++ b/WebCore/page/haiku/DragControllerHaiku.cpp
@@ -32,10 +32,9 @@
 #include <InterfaceDefs.h>
 
 
-namespace WebCore
-{
+namespace WebCore {
 
-// FIXME: These values are straight out of DragControllerMac, so probably have 
+// FIXME: These values are straight out of DragControllerMac, so probably have
 // little correlation with Haiku standards...
 const int DragController::LinkDragBorderInset = 2;
 const int DragController::MaxOriginalImageArea = 1500 * 1500;
diff --git a/WebCore/page/haiku/EventHandlerHaiku.cpp b/WebCore/page/haiku/EventHandlerHaiku.cpp
index 64b8519..203344e 100644
--- a/WebCore/page/haiku/EventHandlerHaiku.cpp
+++ b/WebCore/page/haiku/EventHandlerHaiku.cpp
@@ -36,14 +36,13 @@
 #include "HitTestResult.h"
 #include "KeyboardEvent.h"
 #include "MouseEventWithHitTestResults.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformScrollBar.h"
 #include "PlatformWheelEvent.h"
 #include "RenderWidget.h"
 
-#include "NotImplemented.h"
-
 #include <interface/View.h>
 
 
@@ -117,13 +116,15 @@ bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults& eve
 
 bool EventHandler::passWheelEventToWidget(PlatformWheelEvent& event, Widget* widget)
 {
-    notImplemented();
-    return false;
+    if (!widget->isFrameView())
+        return false;
+
+    return static_cast<FrameView*>(widget)->frame()->eventHandler()->handleWheelEvent(event);
 }
 
 PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
 {
-    return new ClipboardHaiku(ClipboardWritable, true);
+    return ClipboardHaiku::create(ClipboardWritable, true);
 }
 
 bool EventHandler::passMousePressEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
diff --git a/WebCore/page/mac/DragControllerMac.mm b/WebCore/page/mac/DragControllerMac.mm
index c476df7..8a04809 100644
--- a/WebCore/page/mac/DragControllerMac.mm
+++ b/WebCore/page/mac/DragControllerMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "DragController.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #import "DragData.h"
 #import "Frame.h"
 #import "FrameView.h"
@@ -75,4 +76,6 @@ void DragController::cleanupAfterSystemDrag()
     dragEnded();
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/page/mac/EventHandlerMac.mm b/WebCore/page/mac/EventHandlerMac.mm
index 54bdff9..7da1d36 100644
--- a/WebCore/page/mac/EventHandlerMac.mm
+++ b/WebCore/page/mac/EventHandlerMac.mm
@@ -60,7 +60,9 @@ static inline IMP method_setImplementation(Method m, IMP i)
 
 namespace WebCore {
 
+#if ENABLE(DRAG_SUPPORT)
 const double EventHandler::TextDragDelay = 0.15;
+#endif
 
 static RetainPtr<NSEvent>& currentNSEventSlot()
 {
@@ -110,7 +112,7 @@ bool EventHandler::wheelEvent(NSEvent *event)
 
     m_useLatchedWheelEventNode = wkIsLatchingWheelEvent(event);
     
-    PlatformWheelEvent wheelEvent(event, page->chrome()->platformWindow());
+    PlatformWheelEvent wheelEvent(event, page->chrome()->platformPageClient());
     handleWheelEvent(wheelEvent);
 
     return wheelEvent.isAccepted();
@@ -372,6 +374,7 @@ bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
     return m_activationEventNumber == event.eventNumber();
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&)
 {
     NSView *view = mouseDownViewIfStillGood();
@@ -399,6 +402,7 @@ PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
     [pasteboard declareTypes:[NSArray array] owner:nil];
     return ClipboardMac::create(true, pasteboard, ClipboardWritable, m_frame);
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResults&)
 {
@@ -430,8 +434,10 @@ bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults& eve
             // layout tests.
             if (!m_mouseDownWasInSubframe)
                 return false;
+#if ENABLE(DRAG_SUPPORT)
             if (subframe->page()->dragController()->didInitiateDrag())
                 return false;
+#endif
         case NSMouseMoved:
             // Since we're passing in currentNSEvent() here, we can call
             // handleMouseMoveEvent() directly, since the save/restore of
@@ -706,24 +712,28 @@ PlatformMouseEvent EventHandler::currentPlatformMouseEvent() const
 {
     NSView *windowView = nil;
     if (Page* page = m_frame->page())
-        windowView = page->chrome()->platformWindow();
+        windowView = page->chrome()->platformPageClient();
     return PlatformMouseEvent(currentNSEvent(), windowView);
 }
 
+#if ENABLE(CONTEXT_MENUS)
 bool EventHandler::sendContextMenuEvent(NSEvent *event)
 {
     Page* page = m_frame->page();
     if (!page)
         return false;
-    return sendContextMenuEvent(PlatformMouseEvent(event, page->chrome()->platformWindow()));
+    return sendContextMenuEvent(PlatformMouseEvent(event, page->chrome()->platformPageClient()));
 }
+#endif // ENABLE(CONTEXT_MENUS)
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::eventMayStartDrag(NSEvent *event)
 {
     Page* page = m_frame->page();
     if (!page)
         return false;
-    return eventMayStartDrag(PlatformMouseEvent(event, page->chrome()->platformWindow()));
+    return eventMayStartDrag(PlatformMouseEvent(event, page->chrome()->platformPageClient()));
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 }
diff --git a/WebCore/page/mac/FrameMac.mm b/WebCore/page/mac/FrameMac.mm
index c656624..d9faa8b 100644
--- a/WebCore/page/mac/FrameMac.mm
+++ b/WebCore/page/mac/FrameMac.mm
@@ -28,7 +28,6 @@
 #import "config.h"
 #import "Frame.h"
 
-#import "Base64.h"
 #import "BlockExceptions.h"
 #import "ColorMac.h"
 #import "Cursor.h"
@@ -53,7 +52,6 @@
 #import "RenderTableCell.h"
 #import "Scrollbar.h"
 #import "SimpleFontData.h"
-#import "UserStyleSheetLoader.h"
 #import "WebCoreViewFactory.h"
 #import "visible_units.h"
 
@@ -533,35 +531,4 @@ DragImageRef Frame::dragImageForSelection()
     return selectionImage();
 }
 
-void Frame::setUserStyleSheetLocation(const KURL& url)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-
-    // Data URLs with base64-encoded UTF-8 style sheets are common. We can process them
-    // synchronously and avoid using a loader. 
-    if (url.protocolIs("data") && url.string().startsWith("data:text/css;charset=utf-8;base64,")) {
-        const unsigned prefixLength = 35;
-        Vector<char> encodedData(url.string().length() - prefixLength);
-        for (unsigned i = prefixLength; i < url.string().length(); ++i)
-            encodedData[i - prefixLength] = static_cast<char>(url.string()[i]);
-
-        Vector<char> styleSheetAsUTF8;
-        if (base64Decode(encodedData, styleSheetAsUTF8)) {
-            m_doc->setUserStyleSheet(String::fromUTF8(styleSheetAsUTF8.data()));
-            return;
-        }
-    }
-
-    if (m_doc->docLoader())
-        m_userStyleSheetLoader = new UserStyleSheetLoader(m_doc, url.string());
-}
-
-void Frame::setUserStyleSheet(const String& styleSheet)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    m_doc->setUserStyleSheet(styleSheet);
-}
-
 } // namespace WebCore
diff --git a/WebCore/page/mac/WebCoreViewFactory.h b/WebCore/page/mac/WebCoreViewFactory.h
index d4dc821..249d696 100644
--- a/WebCore/page/mac/WebCoreViewFactory.h
+++ b/WebCore/page/mac/WebCoreViewFactory.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2005, 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,6 +39,7 @@
 - (NSString *)fileButtonNoFileSelectedLabel;
 - (NSString *)copyImageUnknownFileLabel;
 
+#if ENABLE(CONTEXT_MENUS)
 // Context menu item titles
 - (NSString *)contextMenuItemTagOpenLinkInNewWindow;
 - (NSString *)contextMenuItemTagDownloadLinkToDisk;
@@ -97,6 +98,7 @@
 - (NSString *)contextMenuItemTagCapitalize;
 - (NSString *)contextMenuItemTagChangeBack:(NSString *)replacedString;
 - (NSString *)contextMenuItemTagInspectElement;
+#endif // ENABLE(CONTEXT_MENUS)
 
 - (NSString *)searchMenuNoRecentSearchesText;
 - (NSString *)searchMenuRecentSearchesText;
@@ -129,6 +131,7 @@
 - (NSString *)AXHeadingText;
 - (NSString *)AXDefinitionListTermText;
 - (NSString *)AXDefinitionListDefinitionText;
+- (NSString *)AXARIAContentGroupText:(NSString *)ariaType;
 
 - (NSString *)AXButtonActionVerb;
 - (NSString *)AXRadioButtonActionVerb;
@@ -143,6 +146,10 @@
 
 - (NSString *)mediaElementLoadingStateText;
 - (NSString *)mediaElementLiveBroadcastStateText;
+- (NSString*)localizedMediaControlElementString:(NSString*)name;
+- (NSString*)localizedMediaControlElementHelpText:(NSString*)name;
+- (NSString*)localizedMediaTimeDescription:(float)time;
+
 
 @end
 
diff --git a/WebCore/page/qt/FrameQt.cpp b/WebCore/page/qt/FrameQt.cpp
index 388bf66..493e60d 100644
--- a/WebCore/page/qt/FrameQt.cpp
+++ b/WebCore/page/qt/FrameQt.cpp
@@ -24,8 +24,6 @@
 #include "config.h"
 #include "Frame.h"
 
-#include "UserStyleSheetLoader.h"
-
 namespace WebCore {
 
 DragImageRef Frame::dragImageForSelection() 
@@ -33,21 +31,5 @@ DragImageRef Frame::dragImageForSelection()
     return 0;
 }
 
-void Frame::setUserStyleSheetLocation(const KURL& url)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    if (m_doc && m_doc->docLoader())
-        m_userStyleSheetLoader = new UserStyleSheetLoader(m_doc, url.string());
-}
-
-void Frame::setUserStyleSheet(const String& styleSheet)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    if (m_doc)
-        m_doc->setUserStyleSheet(styleSheet);
-}
-
 }
 // vim: ts=4 sw=4 et
diff --git a/WebCore/page/win/FrameWin.cpp b/WebCore/page/win/FrameWin.cpp
index 1e480fb..b15d195 100644
--- a/WebCore/page/win/FrameWin.cpp
+++ b/WebCore/page/win/FrameWin.cpp
@@ -61,7 +61,7 @@ void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float head
     
     float ratio = static_cast<float>(printRect.height()) / static_cast<float>(printRect.width());
  
-    float pageWidth  = static_cast<float>(root->overflowWidth());
+    float pageWidth  = static_cast<float>(root->rightLayoutOverflow());
     float pageHeight = pageWidth * ratio;
     outPageHeight = static_cast<int>(pageHeight);   // this is the height of the page adjusted by margins
     pageHeight -= (headerHeight + footerHeight);
diff --git a/WebCore/page/wince/FrameWince.cpp b/WebCore/page/wince/FrameWince.cpp
index 480a103..5ecb579 100644
--- a/WebCore/page/wince/FrameWince.cpp
+++ b/WebCore/page/wince/FrameWince.cpp
@@ -50,7 +50,6 @@
 #include "runtime_root.h"
 #include "Settings.h"
 #include "TextResourceDecoder.h"
-#include "UserStyleSheetLoader.h"
 
 #include <windows.h>
 
@@ -166,20 +165,4 @@ DragImageRef Frame::dragImageForSelection()
     return 0;
 }
 
-void Frame::setUserStyleSheetLocation(const KURL& url)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    if (m_doc && m_doc->docLoader())
-        m_userStyleSheetLoader = new UserStyleSheetLoader(m_doc, url.string());
-}
-
-void Frame::setUserStyleSheet(const String& styleSheet)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    if (m_doc)
-        m_doc->setUserStyleSheet(styleSheet);
-}
-
 } // namespace WebCore
diff --git a/WebCore/page/wx/EventHandlerWx.cpp b/WebCore/page/wx/EventHandlerWx.cpp
index 65a743c..f4f6914 100644
--- a/WebCore/page/wx/EventHandlerWx.cpp
+++ b/WebCore/page/wx/EventHandlerWx.cpp
@@ -32,6 +32,7 @@
 #include "FrameView.h"
 #include "KeyboardEvent.h"
 #include "MouseEventWithHitTestResults.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformKeyboardEvent.h"
 #include "RenderWidget.h"
@@ -43,17 +44,20 @@ const double EventHandler::TextDragDelay = 0.0;
 
 bool EventHandler::passMousePressEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
 {
-    return passSubframeEventToSubframe(mev, subframe);
+    subframe->eventHandler()->handleMousePressEvent(mev.event());
+    return true;
 }
 
 bool EventHandler::passMouseMoveEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe, WebCore::HitTestResult* hittest)
 {
-    return passSubframeEventToSubframe(mev, subframe);
+    subframe->eventHandler()->handleMouseMoveEvent(mev.event(), hittest);
+    return true;
 }
 
 bool EventHandler::passMouseReleaseEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
 {
-    return passSubframeEventToSubframe(mev, subframe);
+    subframe->eventHandler()->handleMouseReleaseEvent(mev.event());
+    return true;
 }
 
 bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
@@ -70,6 +74,32 @@ bool EventHandler::passWidgetMouseDownEventToWidget(RenderWidget* renderWidget)
     return passMouseDownEventToWidget(renderWidget->widget());
 }
 
+bool EventHandler::passWheelEventToWidget(PlatformWheelEvent& event, Widget* widget)
+{
+    if (!widget || !widget->isFrameView())
+        return false;
+
+    return static_cast<FrameView*>(widget)->frame()->eventHandler()->handleWheelEvent(event);
+}
+
+bool EventHandler::tabsToAllControls(KeyboardEvent* event) const 
+{ 
+    notImplemented(); 
+    return false; 
+}
+
+bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults&, Frame* subframe, HitTestResult*)
+{
+    notImplemented(); 
+    return false; 
+}
+
+bool EventHandler::passMouseDownEventToWidget(Widget*)
+{ 
+    notImplemented();
+    return false; 
+}
+
 void EventHandler::focusDocumentView()
 {
     if (Page* page = m_frame->page())
diff --git a/WebCore/page/wx/FrameWx.cpp b/WebCore/page/wx/FrameWx.cpp
new file mode 100644
index 0000000..b220694
--- /dev/null
+++ b/WebCore/page/wx/FrameWx.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Kevin Ollivier <kevino@theolliviers.com>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Frame.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+DragImageRef Frame::dragImageForSelection()
+{
+    notImplemented();
+    return 0;
+}
+
+}
diff --git a/WebCore/platform/ContextMenu.cpp b/WebCore/platform/ContextMenu.cpp
index cca11b5..ee6aa4e 100644
--- a/WebCore/platform/ContextMenu.cpp
+++ b/WebCore/platform/ContextMenu.cpp
@@ -27,6 +27,8 @@
 #include "config.h"
 #include "ContextMenu.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "ContextMenuController.h"
 #include "ContextMenuClient.h"
 #include "CSSComputedStyleDeclaration.h"
@@ -359,10 +361,10 @@ void ContextMenu::populate()
                 appendItem(StopItem);
                 appendItem(ReloadItem);
 #else
-                if (loader->canGoBackOrForward(-1))
+                if (frame->page() && frame->page()->canGoBackOrForward(-1))
                     appendItem(BackItem);
 
-                if (loader->canGoBackOrForward(1))
+                if (frame->page() && frame->page()->canGoBackOrForward(1))
                     appendItem(ForwardItem);
 
                 // use isLoadingInAPISense rather than isLoading because Stop/Reload are
@@ -514,6 +516,7 @@ void ContextMenu::populate()
     }
 }
 
+#if ENABLE(INSPECTOR)
 void ContextMenu::addInspectElementItem()
 {
     Node* node = m_hitTestResult.innerNonSharedNode();
@@ -535,6 +538,7 @@ void ContextMenu::addInspectElementItem()
     appendItem(*separatorItem());
     appendItem(InspectElementItem);
 }
+#endif // ENABLE(INSPECTOR)
 
 void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
 {
@@ -717,10 +721,10 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
 #endif
 #if PLATFORM(GTK)
         case ContextMenuItemTagGoBack:
-            shouldEnable = frame->loader()->canGoBackOrForward(-1);
+            shouldEnable = frame->page() && frame->page()->canGoBackOrForward(-1);
             break;
         case ContextMenuItemTagGoForward:
-            shouldEnable = frame->loader()->canGoBackOrForward(1);
+            shouldEnable = frame->page() && frame->page()->canGoBackOrForward(1);
             break;
         case ContextMenuItemTagStop:
             shouldEnable = frame->loader()->documentLoader()->isLoadingInAPISense();
@@ -772,7 +776,9 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
         case ContextMenuItemTagTextDirectionMenu:
         case ContextMenuItemTagPDFSinglePageScrolling:
         case ContextMenuItemTagPDFFacingPagesScrolling:
+#if ENABLE(INSPECTOR)
         case ContextMenuItemTagInspectElement:
+#endif
         case ContextMenuItemBaseApplicationTag:
             break;
     }
@@ -781,4 +787,6 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
     item.setEnabled(shouldEnable);
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/WebCore/platform/ContextMenuItem.h b/WebCore/platform/ContextMenuItem.h
index 3a4cdfa..6b9d0a9 100644
--- a/WebCore/platform/ContextMenuItem.h
+++ b/WebCore/platform/ContextMenuItem.h
@@ -46,6 +46,8 @@ typedef struct _GtkMenuItem GtkMenuItem;
 #include <QAction>
 #elif PLATFORM(WX)
 class wxMenuItem;
+#elif PLATFORM(HAIKU)
+class BMenuItem;
 #endif
 
 namespace WebCore {
@@ -119,7 +121,9 @@ namespace WebCore {
         ContextMenuItemTagRightToLeft,
         ContextMenuItemTagPDFSinglePageScrolling,
         ContextMenuItemTagPDFFacingPagesScrolling,
+#if ENABLE(INSPECTOR)
         ContextMenuItemTagInspectElement,
+#endif
         ContextMenuItemTagTextDirectionMenu, // Text Direction sub-menu
         ContextMenuItemTagTextDirectionDefault,
         ContextMenuItemTagTextDirectionLeftToRight,
@@ -204,6 +208,8 @@ namespace WebCore {
         bool checked;
         bool enabled;
     };
+#elif PLATFORM(HAIKU)
+    typedef BMenuItem* PlatformMenuItemDescription;
 #else
     typedef void* PlatformMenuItemDescription;
 #endif
diff --git a/WebCore/platform/Cookie.h b/WebCore/platform/Cookie.h
new file mode 100644
index 0000000..0fe3851
--- /dev/null
+++ b/WebCore/platform/Cookie.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Joseph Pecoraro. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Cookie_h
+#define Cookie_h
+
+#include "PlatformString.h"
+#include "StringHash.h"
+
+namespace WebCore {
+
+    // This struct is currently only used to provide more cookies information
+    // to the Web Inspector.
+
+    struct Cookie {
+        Cookie(const String& name, const String& value, const String& domain,
+                const String& path, double expires, bool httpOnly, bool secure,
+                bool session)
+            : name(name)
+            , value(value)
+            , domain(domain)
+            , path(path)
+            , expires(expires)
+            , httpOnly(httpOnly)
+            , secure(secure)
+            , session(session)
+        {
+        }
+
+        String name;
+        String value;
+        String domain;
+        String path;
+        double expires;
+        bool httpOnly;
+        bool secure;
+        bool session;
+    };
+
+    struct CookieHash {
+        static unsigned hash(Cookie key)
+        { 
+            return StringHash::hash(key.name) + StringHash::hash(key.domain) + StringHash::hash(key.path) + key.secure;
+        }
+
+        static bool equal(Cookie a, Cookie b)
+        {
+            return a.name == b.name && a.domain == b.domain && a.path == b.path && a.secure == b.secure;
+        }
+    };
+}
+
+namespace WTF {
+    template<typename T> struct DefaultHash;
+    template<> struct DefaultHash<WebCore::Cookie> {
+        typedef WebCore::CookieHash Hash;
+    };
+}
+
+#endif
diff --git a/WebCore/platform/CookieJar.h b/WebCore/platform/CookieJar.h
index 6159386..987543e 100644
--- a/WebCore/platform/CookieJar.h
+++ b/WebCore/platform/CookieJar.h
@@ -26,15 +26,21 @@
 #ifndef CookieJar_h
 #define CookieJar_h
 
+#include <wtf/Vector.h>
+
 namespace WebCore {
 
+    class Document;
     class KURL;
     class String;
-    class Document;
+
+    struct Cookie;
 
     String cookies(const Document*, const KURL&);
     void setCookies(Document*, const KURL&, const String&);
     bool cookiesEnabled(const Document*);
+    bool getRawCookies(const Document*, const KURL&, Vector<Cookie>&);
+    void deleteCookie(const Document*, const KURL&, const String&);
 
 }
 
diff --git a/WebCore/platform/CrossThreadCopier.cpp b/WebCore/platform/CrossThreadCopier.cpp
index 9ca626f..d02da6c 100644
--- a/WebCore/platform/CrossThreadCopier.cpp
+++ b/WebCore/platform/CrossThreadCopier.cpp
@@ -41,7 +41,7 @@ namespace WebCore {
 
 CrossThreadCopierBase<false, String>::Type CrossThreadCopierBase<false, String>::copy(const String& str)
 {
-    return str.copy();
+    return str.crossThreadString();
 }
 
 CrossThreadCopierBase<false, ResourceError>::Type CrossThreadCopierBase<false, ResourceError>::copy(const ResourceError& error)
diff --git a/WebCore/platform/CrossThreadCopier.h b/WebCore/platform/CrossThreadCopier.h
index d12d72d..178e056 100644
--- a/WebCore/platform/CrossThreadCopier.h
+++ b/WebCore/platform/CrossThreadCopier.h
@@ -46,6 +46,7 @@ namespace WebCore {
     class String;
     struct CrossThreadResourceResponseData;
     struct CrossThreadResourceRequestData;
+    struct ThreadableLoaderOptions;
 
     template<typename T> struct CrossThreadCopierPassThrough {
         typedef T Type;
@@ -65,6 +66,9 @@ namespace WebCore {
     template<typename T> struct CrossThreadCopierBase<false, T*> : public CrossThreadCopierPassThrough<T*> {
     };
 
+    template<> struct CrossThreadCopierBase<false, ThreadableLoaderOptions> : public CrossThreadCopierPassThrough<ThreadableLoaderOptions> {
+    };
+
     // Custom copy methods.
     template<typename T> struct CrossThreadCopierBase<false, RefPtr<ThreadSafeShared<T> > > {
         typedef PassRefPtr<T> Type;
diff --git a/WebCore/platform/Cursor.h b/WebCore/platform/Cursor.h
index ea75191..2d041d2 100644
--- a/WebCore/platform/Cursor.h
+++ b/WebCore/platform/Cursor.h
@@ -40,6 +40,8 @@ typedef struct _GdkCursor GdkCursor;
 #include <QCursor>
 #elif PLATFORM(CHROMIUM)
 #include "PlatformCursor.h"
+#elif PLATFORM(HAIKU)
+#include <app/Cursor.h>
 #endif
 
 #if PLATFORM(MAC)
@@ -86,6 +88,9 @@ namespace WebCore {
 #elif PLATFORM(CHROMIUM)
     // See PlatformCursor.h
     typedef void* PlatformCursorHandle;
+#elif PLATFORM(HAIKU)
+    typedef BCursor* PlatformCursor;
+    typedef BCursor* PlatformCursorHandle;
 #else
     typedef void* PlatformCursor;
     typedef void* PlatformCursorHandle;
diff --git a/WebCore/platform/DragData.cpp b/WebCore/platform/DragData.cpp
index bf2275a..4518909 100644
--- a/WebCore/platform/DragData.cpp
+++ b/WebCore/platform/DragData.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DragData.h"
 
+#if ENABLE(DRAG_SUPPORT)
 namespace WebCore {
 
 #if !PLATFORM(MAC)
@@ -39,4 +40,6 @@ DragData::DragData(DragDataRef data, const IntPoint& clientPosition, const IntPo
 }
 #endif
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/platform/DragData.h b/WebCore/platform/DragData.h
index a1555e3..116ffdd 100644
--- a/WebCore/platform/DragData.h
+++ b/WebCore/platform/DragData.h
@@ -58,6 +58,9 @@ typedef void* DragDataRef;
 typedef void* DragDataRef;
 #elif PLATFORM(CHROMIUM)
 #include "DragDataRef.h"
+#elif PLATFORM(HAIKU)
+class BMessage;
+typedef class BMessage* DragDataRef;
 #endif
 
 
diff --git a/WebCore/platform/DragImage.cpp b/WebCore/platform/DragImage.cpp
index adf9a57..aff4aba 100644
--- a/WebCore/platform/DragImage.cpp
+++ b/WebCore/platform/DragImage.cpp
@@ -25,6 +25,8 @@
 
 #include "config.h"
 #include "DragImage.h"
+
+#if ENABLE(DRAG_SUPPORT)
 #include "DragController.h"
 
 #include "Frame.h"
@@ -71,4 +73,6 @@ DragImageRef createDragImageForSelection(Frame* frame)
     return image;
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/platform/DragImage.h b/WebCore/platform/DragImage.h
index 4887066..00bd7ed 100644
--- a/WebCore/platform/DragImage.h
+++ b/WebCore/platform/DragImage.h
@@ -48,6 +48,8 @@ class wxDragImage;
 #include "DragImageRef.h"
 #elif PLATFORM(GTK)
 typedef struct _GdkPixbuf GdkPixbuf;
+#elif PLATFORM(HAIKU)
+class BBitmap;
 #endif
 
 //We need to #define YOffset as it needs to be shared with WebKit
@@ -72,8 +74,13 @@ namespace WebCore {
     typedef wxDragImage* DragImageRef;
 #elif PLATFORM(GTK)
     typedef GdkPixbuf* DragImageRef;
+<<<<<<< HEAD:WebCore/platform/DragImage.h
 #elif PLATFORM(ANDROID)
     typedef void* DragImageRef;
+=======
+#elif PLATFORM(HAIKU)
+    typedef BBitmap* DragImageRef;
+>>>>>>> webkit.org at 49305:WebCore/platform/DragImage.h
 #endif
     
     IntSize dragImageSize(DragImageRef);
diff --git a/WebCore/platform/FileSystem.h b/WebCore/platform/FileSystem.h
index e23b6da..958eb73 100644
--- a/WebCore/platform/FileSystem.h
+++ b/WebCore/platform/FileSystem.h
@@ -170,6 +170,10 @@ char* filenameFromString(const String&);
 String filenameForDisplay(const String&);
 #endif
 
+#if PLATFORM(CHROMIUM)
+String pathGetDisplayFileName(const String&);
+#endif
+
 } // namespace WebCore
 
 #endif // FileSystem_h
diff --git a/WebCore/platform/HostWindow.h b/WebCore/platform/HostWindow.h
index 3a024de..80f6bdc 100644
--- a/WebCore/platform/HostWindow.h
+++ b/WebCore/platform/HostWindow.h
@@ -48,12 +48,15 @@ public:
     virtual IntPoint screenToWindow(const IntPoint&) const = 0;
     virtual IntRect windowToScreen(const IntRect&) const = 0;
 
-    // Method for retrieving the native window.
-    virtual PlatformWidget platformWindow() const = 0;
+    // Method for retrieving the native client of the page.
+    virtual PlatformPageClient platformPageClient() const = 0;
     
     // For scrolling a rect into view recursively.  Useful in the cases where a WebView is embedded inside some containing
     // platform-specific ScrollView.
     virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0;
+
+    // To notify WebKit of scrollbar mode changes.
+    virtual void scrollbarsModeDidChange() const = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/KURL.cpp b/WebCore/platform/KURL.cpp
index ec8c55c..ffacc19 100644
--- a/WebCore/platform/KURL.cpp
+++ b/WebCore/platform/KURL.cpp
@@ -302,13 +302,13 @@ void KURL::invalidate()
     m_fragmentEnd = 0;
 }
 
-KURL::KURL(const char* url)
+KURL::KURL(ParsedURLStringTag, const char* url)
 {
     parse(url, 0);
     ASSERT(url == m_string);
 }
 
-KURL::KURL(const String& url)
+KURL::KURL(ParsedURLStringTag, const String& url)
 {
     parse(url);
     ASSERT(url == m_string);
@@ -529,7 +529,7 @@ void KURL::init(const KURL& base, const String& relative, const TextEncoding& en
 KURL KURL::copy() const
 {
     KURL result = *this;
-    result.m_string = result.m_string.copy();
+    result.m_string = result.m_string.crossThreadString();
     return result;
 }
 
@@ -1641,7 +1641,7 @@ String mimeTypeFromDataURL(const String& url)
 
 const KURL& blankURL()
 {
-    DEFINE_STATIC_LOCAL(KURL, staticBlankURL, ("about:blank"));
+    DEFINE_STATIC_LOCAL(KURL, staticBlankURL, (ParsedURLString, "about:blank"));
     return staticBlankURL;
 }
 
diff --git a/WebCore/platform/KURL.h b/WebCore/platform/KURL.h
index 0809f7e..73fadd1 100644
--- a/WebCore/platform/KURL.h
+++ b/WebCore/platform/KURL.h
@@ -55,15 +55,18 @@ namespace WebCore {
 class TextEncoding;
 struct KURLHash;
 
+enum ParsedURLStringTag { ParsedURLString };
+
 class KURL {
 public:
     // Generates a URL which contains a null string.
     KURL() { invalidate(); }
 
-    // The argument is an absolute URL string. The string is assumed to be
-    // an already encoded (ASCII-only) valid absolute URL.
-    explicit KURL(const char*);
-    explicit KURL(const String&);
+    // The argument is an absolute URL string. The string is assumed to be output of KURL::string() called on a valid
+    // KURL object, or indiscernible from such.
+    // It is usually best to avoid repeatedly parsing a string, unless memory saving outweigh the possible slow-downs.
+    KURL(ParsedURLStringTag, const char*);
+    KURL(ParsedURLStringTag, const String&);
 
     // Resolves the relative URL with the given base URL. If provided, the
     // TextEncoding is used to encode non-ASCII characers. The base URL can be
diff --git a/WebCore/platform/KURLGoogle.cpp b/WebCore/platform/KURLGoogle.cpp
index 1cb08c1..b323332 100644
--- a/WebCore/platform/KURLGoogle.cpp
+++ b/WebCore/platform/KURLGoogle.cpp
@@ -331,7 +331,7 @@ const String& KURLGooglePrivate::string() const
 // Creates with NULL-terminated string input representing an absolute URL.
 // WebCore generally calls this only with hardcoded strings, so the input is
 // ASCII. We treat is as UTF-8 just in case.
-KURL::KURL(const char *url)
+KURL::KURL(ParsedURLStringTag, const char *url)
 {
     // FIXME The Mac code checks for beginning with a slash and converting to a
     // file: URL. We will want to add this as well once we can compile on a
@@ -349,7 +349,7 @@ KURL::KURL(const char *url)
 // to a string and then converted back. In this case, the URL is already
 // canonical and in proper escaped form so needs no encoding. We treat it was
 // UTF-8 just in case.
-KURL::KURL(const String& url)
+KURL::KURL(ParsedURLStringTag, const String& url)
 {
     if (!url.isNull())
         m_url.init(KURL(), url, 0);
@@ -728,13 +728,8 @@ String decodeURLEscapeSequences(const String& str)
 // cause security holes. We never call this function for components, and
 // just return the ASCII versions instead.
 //
-// However, this static function is called directly in some cases. It appears
-// that this only happens for javascript: URLs, so this is essentially the
-// JavaScript URL decoder. It assumes UTF-8 encoding.
-//
-// IE doesn't unescape %00, forcing you to use \x00 in JS strings, so we do
-// the same. This also eliminates NULL-related problems should a consumer
-// incorrectly call this function for non-JavaScript.
+// This function is also used to decode javascript: URLs and as a general
+// purpose unescaping function.
 //
 // FIXME These should be merged to the KURL.cpp implementation.
 String decodeURLEscapeSequences(const String& str, const TextEncoding& encoding)
@@ -757,15 +752,9 @@ String decodeURLEscapeSequences(const String& str, const TextEncoding& encoding)
     for (int i = 0; i < inputLength; i++) {
         if (input[i] == '%') {
             unsigned char ch;
-            if (url_canon::DecodeEscaped(input, &i, inputLength, &ch)) {
-                if (!ch) {
-                    // Never unescape NULLs.
-                    unescaped.push_back('%');
-                    unescaped.push_back('0');
-                    unescaped.push_back('0');
-                } else
-                    unescaped.push_back(ch);
-            } else {
+            if (url_canon::DecodeEscaped(input, &i, inputLength, &ch))
+                unescaped.push_back(ch);
+            else {
                 // Invalid escape sequence, copy the percent literal.
                 unescaped.push_back('%');
             }
@@ -936,7 +925,7 @@ unsigned KURL::pathAfterLastSlash() const
 
 const KURL& blankURL()
 {
-    static KURL staticBlankURL("about:blank");
+    static KURL staticBlankURL(ParsedURLString, "about:blank");
     return staticBlankURL;
 }
 
diff --git a/WebCore/platform/KURLHash.h b/WebCore/platform/KURLHash.h
index 4deb078..7448a49 100644
--- a/WebCore/platform/KURLHash.h
+++ b/WebCore/platform/KURLHash.h
@@ -52,7 +52,7 @@ namespace WTF {
 
     template<> struct HashTraits<WebCore::KURL> : GenericHashTraits<WebCore::KURL> {
         static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(WebCore::KURL& slot) { new (&slot) WebCore::KURL(WebCore::String(HashTableDeletedValue)); }
+        static void constructDeletedValue(WebCore::KURL& slot) { new (&slot) WebCore::KURL(WebCore::ParsedURLString, WebCore::String(HashTableDeletedValue)); }
         static bool isDeletedValue(const WebCore::KURL& slot) { return slot.string().isHashTableDeletedValue(); }
     };
 
diff --git a/WebCore/platform/LocalizedStrings.h b/WebCore/platform/LocalizedStrings.h
index 7c586d3..0fa9f71 100644
--- a/WebCore/platform/LocalizedStrings.h
+++ b/WebCore/platform/LocalizedStrings.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,6 +38,7 @@ namespace WebCore {
     String fileButtonChooseFileLabel();
     String fileButtonNoFileSelectedLabel();
     String copyImageUnknownFileLabel();
+#if ENABLE(CONTEXT_MENUS)
     String contextMenuItemTagOpenLinkInNewWindow();
     String contextMenuItemTagDownloadLinkToDisk();
     String contextMenuItemTagCopyLinkToClipboard();
@@ -103,6 +104,7 @@ namespace WebCore {
     String contextMenuItemTagChangeBack(const String& replacedString);
 #endif
     String contextMenuItemTagInspectElement();
+#endif // ENABLE(CONTEXT_MENUS)
 
     String searchMenuNoRecentSearchesText();
     String searchMenuRecentSearchesText();
@@ -115,6 +117,7 @@ namespace WebCore {
     String AXHeadingText();
     String AXDefinitionListTermText();
     String AXDefinitionListDefinitionText();
+    String AXARIAContentGroupText(const String& ariaType);
     
     String AXButtonActionVerb();
     String AXRadioButtonActionVerb();
@@ -135,6 +138,9 @@ namespace WebCore {
 
     String mediaElementLoadingStateText();
     String mediaElementLiveBroadcastStateText();
+    String localizedMediaControlElementString(const String&);
+    String localizedMediaControlElementHelpText(const String&);
+    String localizedMediaTimeDescription(float);
 }
 
 #endif
diff --git a/WebCore/platform/MIMETypeRegistry.cpp b/WebCore/platform/MIMETypeRegistry.cpp
index 1819e1d..32dd3f6 100644
--- a/WebCore/platform/MIMETypeRegistry.cpp
+++ b/WebCore/platform/MIMETypeRegistry.cpp
@@ -94,7 +94,7 @@ static void initializeSupportedImageMIMETypes()
 
 #elif PLATFORM(QT)
     QList<QByteArray> formats = QImageReader::supportedImageFormats();
-    for (size_t i = 0; i < formats.size(); ++i) {
+    for (size_t i = 0; i < static_cast<size_t>(formats.size()); ++i) {
 #if ENABLE(SVG)
         /*
          * Qt has support for SVG, but we want to use KSVG2
@@ -173,7 +173,7 @@ static void initializeSupportedImageMIMETypesForEncoding()
 #endif
 #elif PLATFORM(QT)
     QList<QByteArray> formats = QImageWriter::supportedImageFormats();
-    for (size_t i = 0; i < formats.size(); ++i) {
+    for (int i = 0; i < formats.size(); ++i) {
         String mimeType = MIMETypeRegistry::getMIMETypeForExtension(formats.at(i).constData());
         supportedImageMIMETypesForEncoding->add(mimeType);
     }
diff --git a/WebCore/platform/Pasteboard.h b/WebCore/platform/Pasteboard.h
index 883364a..188b962 100644
--- a/WebCore/platform/Pasteboard.h
+++ b/WebCore/platform/Pasteboard.h
@@ -86,6 +86,7 @@ public:
     
     static Pasteboard* generalPasteboard();
     void writeSelection(Range*, bool canSmartCopyOrDelete, Frame*);
+    void writePlainText(const String&);
     void writeURL(const KURL&, const String&, Frame* = 0);
     void writeImage(Node*, const KURL&, const String& title);
 #if PLATFORM(MAC)
@@ -95,13 +96,14 @@ public:
     bool canSmartReplace();
     PassRefPtr<DocumentFragment> documentFragment(Frame*, PassRefPtr<Range>, bool allowPlainText, bool& chosePlainText);
     String plainText(Frame* = 0);
-#if PLATFORM(QT)
+#if PLATFORM(QT) || PLATFORM(CHROMIUM)
     bool isSelectionMode() const;
     void setSelectionMode(bool selectionMode);
 #endif
 
 #if PLATFORM(GTK)
     void setHelper(PasteboardHelper*);
+    PasteboardHelper* m_helper;
 #endif
 
 private:
@@ -117,11 +119,7 @@ private:
     HWND m_owner;
 #endif
 
-#if PLATFORM(GTK)
-    PasteboardHelper* m_helper;
-#endif
-
-#if PLATFORM(QT)
+#if PLATFORM(QT) || PLATFORM(CHROMIUM)
     bool m_selectionMode;
 #endif
 
diff --git a/WebCore/platform/PlatformKeyboardEvent.h b/WebCore/platform/PlatformKeyboardEvent.h
index 1499ac5..b5c2e95 100644
--- a/WebCore/platform/PlatformKeyboardEvent.h
+++ b/WebCore/platform/PlatformKeyboardEvent.h
@@ -59,6 +59,10 @@ QT_END_NAMESPACE
 class wxKeyEvent;
 #endif
 
+#if PLATFORM(HAIKU)
+class BMessage;
+#endif
+
 namespace WebCore {
 
     class PlatformKeyboardEvent {
@@ -155,6 +159,10 @@ namespace WebCore {
         PlatformKeyboardEvent(wxKeyEvent&);
 #endif
 
+#if PLATFORM(HAIKU)
+        PlatformKeyboardEvent(BMessage*);
+#endif
+
 #if PLATFORM(WIN) || PLATFORM(CHROMIUM)
         bool isSystemKey() const { return m_isSystemKey; }
 #endif
diff --git a/WebCore/platform/PlatformMenuDescription.h b/WebCore/platform/PlatformMenuDescription.h
index ab71710..c986207 100644
--- a/WebCore/platform/PlatformMenuDescription.h
+++ b/WebCore/platform/PlatformMenuDescription.h
@@ -40,6 +40,8 @@ typedef struct HMENU__* HMENU;
 typedef struct _GtkMenu GtkMenu;
 #elif PLATFORM(WX)
 class wxMenu;
+#elif PLATFORM(HAIKU)
+class BMenu;
 #endif
 
 namespace WebCore {
@@ -58,6 +60,8 @@ namespace WebCore {
     typedef void* PlatformMenuDescription;
 #elif PLATFORM(WX)
     typedef wxMenu* PlatformMenuDescription;
+#elif PLATFORM(HAIKU)
+    typedef BMenu* PlatformMenuDescription;
 #else
     typedef void* PlatformMenuDescription;
 #endif
diff --git a/WebCore/platform/PlatformMouseEvent.h b/WebCore/platform/PlatformMouseEvent.h
index 2543d40..99acc63 100644
--- a/WebCore/platform/PlatformMouseEvent.h
+++ b/WebCore/platform/PlatformMouseEvent.h
@@ -36,6 +36,7 @@ typedef struct _GdkEventMotion GdkEventMotion;
 #if PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QInputEvent;
+class QGraphicsSceneMouseEvent;
 QT_END_NAMESPACE
 #endif
 
@@ -50,6 +51,10 @@ typedef long LPARAM;
 class wxMouseEvent;
 #endif
 
+#if PLATFORM(HAIKU)
+class BMessage;
+#endif
+
 namespace WebCore {
     
     // These button numbers match the ones used in the DOM API, 0 through 2, except for NoButton which isn't specified.
@@ -116,6 +121,7 @@ namespace WebCore {
 
 #if PLATFORM(QT)
         PlatformMouseEvent(QInputEvent*, int clickCount);
+        PlatformMouseEvent(QGraphicsSceneMouseEvent*, int clickCount);
 #endif
 
 #if PLATFORM(WIN)
@@ -128,6 +134,10 @@ namespace WebCore {
         PlatformMouseEvent(const wxMouseEvent&, const wxPoint& globalPoint, int clickCount);
 #endif
 
+#if PLATFORM(HAIKU)
+        PlatformMouseEvent(const BMessage*);
+#endif
+
     protected:
         IntPoint m_position;
         IntPoint m_globalPosition;
diff --git a/WebCore/platform/PlatformWheelEvent.h b/WebCore/platform/PlatformWheelEvent.h
index ae8df4e..9a4a0cb 100644
--- a/WebCore/platform/PlatformWheelEvent.h
+++ b/WebCore/platform/PlatformWheelEvent.h
@@ -35,6 +35,7 @@ typedef struct _GdkEventScroll GdkEventScroll;
 #if PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QWheelEvent;
+class QGraphicsSceneWheelEvent;
 QT_END_NAMESPACE
 #endif
 
@@ -49,6 +50,10 @@ class wxMouseEvent;
 class wxPoint;
 #endif
 
+#if PLATFORM(HAIKU)
+class BMessage;
+#endif
+
 namespace WebCore {
 
     class FloatPoint;
@@ -88,6 +93,15 @@ namespace WebCore {
         void accept() { m_isAccepted = true; }
         void ignore() { m_isAccepted = false; }
 
+        void turnVerticalTicksIntoHorizontal()
+        {
+            m_deltaX = m_deltaY;
+            m_deltaY = 0;
+
+            m_wheelTicksX = m_wheelTicksY;
+            m_wheelTicksY = 0;
+        }
+
 #if PLATFORM(GTK)
         PlatformWheelEvent(GdkEventScroll*);
 #endif
@@ -98,6 +112,8 @@ namespace WebCore {
 
 #if PLATFORM(QT)
         PlatformWheelEvent(QWheelEvent*);
+        PlatformWheelEvent(QGraphicsSceneWheelEvent*);
+        void applyDelta(int delta, Qt::Orientation);
 #endif
 
 #if PLATFORM(WIN)
@@ -109,6 +125,10 @@ namespace WebCore {
         PlatformWheelEvent(const wxMouseEvent&, const wxPoint&);
 #endif
 
+#if PLATFORM(HAIKU)
+        PlatformWheelEvent(BMessage*);
+#endif
+
     protected:
         IntPoint m_position;
         IntPoint m_globalPosition;
diff --git a/WebCore/platform/PopupMenu.h b/WebCore/platform/PopupMenu.h
index fc85d60..2315f02 100644
--- a/WebCore/platform/PopupMenu.h
+++ b/WebCore/platform/PopupMenu.h
@@ -59,6 +59,8 @@ class wxMenu;
 #include <wx/event.h>
 #elif PLATFORM(CHROMIUM)
 #include "PopupMenuPrivate.h"
+#elif PLATFORM(HAIKU)
+class BMenu;
 #endif
 
 namespace WebCore {
@@ -92,6 +94,8 @@ public:
 #if PLATFORM(WIN)
     Scrollbar* scrollbar() const { return m_scrollbar.get(); }
 
+    static LPCTSTR popupClassName();
+
     bool up(unsigned lines = 1);
     bool down(unsigned lines = 1);
 
@@ -153,6 +157,10 @@ private:
     void calculatePositionAndSize(const IntRect&, FrameView*);
     void invalidateItem(int index);
 
+    static LRESULT CALLBACK PopupMenuWndProc(HWND, UINT, WPARAM, LPARAM);
+    LRESULT wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
+    static void registerClass();
+
     RefPtr<Scrollbar> m_scrollbar;
     HWND m_popup;
     HDC m_DC;
@@ -164,6 +172,7 @@ private:
     int m_wheelDelta;
     int m_focusedIndex;
     bool m_scrollbarCapturingMouse;
+    bool m_showPopup;
 #elif PLATFORM(GTK)
     IntPoint m_menuPosition;
     GtkMenu* m_popup;
@@ -177,6 +186,8 @@ private:
     void OnMenuItemSelected(wxCommandEvent&);
 #elif PLATFORM(CHROMIUM)
     PopupMenuPrivate p;
+#elif PLATFORM(HAIKU)
+    BMenu* m_menu;
 #endif
 
 };
diff --git a/WebCore/platform/PopupMenuClient.h b/WebCore/platform/PopupMenuClient.h
index 2a9625b..2614fe2 100644
--- a/WebCore/platform/PopupMenuClient.h
+++ b/WebCore/platform/PopupMenuClient.h
@@ -49,7 +49,7 @@ public:
     virtual int clientPaddingRight() const = 0;
     virtual int listSize() const = 0;
     virtual int selectedIndex() const = 0;
-    virtual void hidePopup() = 0;
+    virtual void popupDidHide() = 0;
     virtual bool itemIsSeparator(unsigned listIndex) const = 0;
     virtual bool itemIsLabel(unsigned listIndex) const = 0;
     virtual bool itemIsSelected(unsigned listIndex) const = 0;
diff --git a/WebCore/platform/ScrollView.cpp b/WebCore/platform/ScrollView.cpp
index 54fa998..8c4b115 100644
--- a/WebCore/platform/ScrollView.cpp
+++ b/WebCore/platform/ScrollView.cpp
@@ -83,6 +83,7 @@ void ScrollView::setHasHorizontalScrollbar(bool hasBar)
     if (hasBar && !m_horizontalScrollbar) {
         m_horizontalScrollbar = createScrollbar(HorizontalScrollbar);
         addChild(m_horizontalScrollbar.get());
+        m_horizontalScrollbar->styleChanged();
     } else if (!hasBar && m_horizontalScrollbar) {
         removeChild(m_horizontalScrollbar.get());
         m_horizontalScrollbar = 0;
@@ -94,6 +95,7 @@ void ScrollView::setHasVerticalScrollbar(bool hasBar)
     if (hasBar && !m_verticalScrollbar) {
         m_verticalScrollbar = createScrollbar(VerticalScrollbar);
         addChild(m_verticalScrollbar.get());
+        m_verticalScrollbar->styleChanged();
     } else if (!hasBar && m_verticalScrollbar) {
         removeChild(m_verticalScrollbar.get());
         m_verticalScrollbar = 0;
@@ -105,7 +107,6 @@ PassRefPtr<Scrollbar> ScrollView::createScrollbar(ScrollbarOrientation orientati
 {
     return Scrollbar::createNativeScrollbar(this, orientation, RegularScrollbar);
 }
-#endif
 
 void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode verticalMode)
 {
@@ -118,6 +119,7 @@ void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode v
     else
         updateScrollbars(scrollOffset());
 }
+#endif
 
 void ScrollView::scrollbarModes(ScrollbarMode& horizontalMode, ScrollbarMode& verticalMode) const
 {
@@ -332,6 +334,15 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
     if (m_inUpdateScrollbars || prohibitsScrolling() || platformWidget())
         return;
 
+    // If we came in here with the view already needing a layout, then go ahead and do that
+    // first.  (This will be the common case, e.g., when the page changes due to window resizing for example).
+    // This layout will not re-enter updateScrollbars and does not count towards our max layout pass total.
+    if (!m_scrollbarsSuppressed) {
+        m_inUpdateScrollbars = true;
+        visibleContentsResized();
+        m_inUpdateScrollbars = false;
+    }
+
     bool hasHorizontalScrollbar = m_horizontalScrollbar;
     bool hasVerticalScrollbar = m_verticalScrollbar;
     
@@ -352,13 +363,6 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
         if (hasVerticalScrollbar != newHasVerticalScrollbar)
             setHasVerticalScrollbar(newHasVerticalScrollbar);
     } else {
-        // If we came in here with the view already needing a layout, then go ahead and do that
-        // first.  (This will be the common case, e.g., when the page changes due to window resizing for example).
-        // This layout will not re-enter updateScrollers and does not count towards our max layout pass total.
-        m_inUpdateScrollbars = true;
-        visibleContentsResized();
-        m_inUpdateScrollbars = false;
-
         bool sendContentResizedNotification = false;
         
         IntSize docSize = contentsSize();
@@ -465,8 +469,10 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
             m_verticalScrollbar->setSuppressInvalidation(false);
     }
 
-    if (hasHorizontalScrollbar != (m_horizontalScrollbar != 0) || hasVerticalScrollbar != (m_verticalScrollbar != 0))
+    if (hasHorizontalScrollbar != (m_horizontalScrollbar != 0) || hasVerticalScrollbar != (m_verticalScrollbar != 0)) {
         frameRectsChanged();
+        updateScrollCorner();
+    }
 
     // See if our offset has changed in a situation where we might not have scrollbars.
     // This can happen when editing a body with overflow:hidden and scrolling to reveal selection.
@@ -481,7 +487,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
     m_inUpdateScrollbars = false;
 }
 
-const int panIconSizeLength = 20;
+const int panIconSizeLength = 16;
 
 void ScrollView::scrollContents(const IntSize& scrollDelta)
 {
@@ -626,23 +632,7 @@ void ScrollView::setScrollbarsSuppressed(bool suppressed, bool repaintOnUnsuppre
             m_verticalScrollbar->invalidate();
 
         // Invalidate the scroll corner too on unsuppress.
-        IntRect hCorner;
-        if (m_horizontalScrollbar && width() - m_horizontalScrollbar->width() > 0) {
-            hCorner = IntRect(m_horizontalScrollbar->width(),
-                              height() - m_horizontalScrollbar->height(),
-                              width() - m_horizontalScrollbar->width(),
-                              m_horizontalScrollbar->height());
-            invalidateRect(hCorner);
-        }
-
-        if (m_verticalScrollbar && height() - m_verticalScrollbar->height() > 0) {
-            IntRect vCorner(width() - m_verticalScrollbar->width(),
-                            m_verticalScrollbar->height(),
-                            m_verticalScrollbar->width(),
-                            height() - m_verticalScrollbar->height());
-            if (vCorner != hCorner)
-                invalidateRect(vCorner);
-        }
+        invalidateRect(scrollCornerRect());
     }
 }
 
@@ -722,16 +712,48 @@ void ScrollView::frameRectsChanged()
 
 void ScrollView::repaintContentRectangle(const IntRect& rect, bool now)
 {
-    if (rect.isEmpty())
+    IntRect visibleContent = visibleContentRect();
+    visibleContent.intersect(rect);
+    if (visibleContent.isEmpty())
         return;
 
     if (platformWidget()) {
-        platformRepaintContentRectangle(rect, now);
+        platformRepaintContentRectangle(visibleContent, now);
         return;
     }
 
     if (hostWindow())
-        hostWindow()->repaint(contentsToWindow(rect), true, now);
+        hostWindow()->repaint(contentsToWindow(visibleContent), true, now);
+}
+
+IntRect ScrollView::scrollCornerRect() const
+{
+    IntRect cornerRect;
+    
+    if (m_horizontalScrollbar && width() - m_horizontalScrollbar->width() > 0) {
+        cornerRect.unite(IntRect(m_horizontalScrollbar->width(),
+                                 height() - m_horizontalScrollbar->height(),
+                                 width() - m_horizontalScrollbar->width(),
+                                 m_horizontalScrollbar->height()));
+    }
+
+    if (m_verticalScrollbar && height() - m_verticalScrollbar->height() > 0) {
+        cornerRect.unite(IntRect(width() - m_verticalScrollbar->width(),
+                                 m_verticalScrollbar->height(),
+                                 m_verticalScrollbar->width(),
+                                 height() - m_verticalScrollbar->height()));
+    }
+    
+    return cornerRect;
+}
+
+void ScrollView::updateScrollCorner()
+{
+}
+
+void ScrollView::paintScrollCorner(GraphicsContext* context, const IntRect& cornerRect)
+{
+    ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, cornerRect);
 }
 
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
@@ -773,25 +795,7 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
         if (m_verticalScrollbar)
             m_verticalScrollbar->paint(context, scrollViewDirtyRect);
 
-        IntRect hCorner;
-        if (m_horizontalScrollbar && width() - m_horizontalScrollbar->width() > 0) {
-            hCorner = IntRect(m_horizontalScrollbar->width(),
-                              height() - m_horizontalScrollbar->height(),
-                              width() - m_horizontalScrollbar->width(),
-                              m_horizontalScrollbar->height());
-            if (hCorner.intersects(scrollViewDirtyRect))
-                ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, hCorner);
-        }
-
-        if (m_verticalScrollbar && height() - m_verticalScrollbar->height() > 0) {
-            IntRect vCorner(width() - m_verticalScrollbar->width(),
-                            m_verticalScrollbar->height(),
-                            m_verticalScrollbar->width(),
-                            height() - m_verticalScrollbar->height());
-            if (vCorner != hCorner && vCorner.intersects(scrollViewDirtyRect))
-                ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, vCorner);
-        }
-
+        paintScrollCorner(context, scrollCornerRect());
         context->restore();
     }
 
diff --git a/WebCore/platform/ScrollView.h b/WebCore/platform/ScrollView.h
index 88e2564..ef3d03d 100644
--- a/WebCore/platform/ScrollView.h
+++ b/WebCore/platform/ScrollView.h
@@ -89,7 +89,7 @@ public:
     void scrollbarModes(ScrollbarMode& horizontalMode, ScrollbarMode& verticalMode) const;
     ScrollbarMode horizontalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return horizontal; }
     ScrollbarMode verticalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return vertical; }
-    virtual void setCanHaveScrollbars(bool flag);
+    void setCanHaveScrollbars(bool flag);
     bool canHaveScrollbars() const { return horizontalScrollbarMode() != ScrollbarAlwaysOff || verticalScrollbarMode() != ScrollbarAlwaysOff; }
 
     // Overridden by FrameView to create custom CSS scrollbars if applicable.
@@ -239,6 +239,10 @@ protected:
     void setHasHorizontalScrollbar(bool);
     void setHasVerticalScrollbar(bool);
 
+    IntRect scrollCornerRect() const;
+    virtual void updateScrollCorner();
+    virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+    
 private:
     RefPtr<Scrollbar> m_horizontalScrollbar;
     RefPtr<Scrollbar> m_verticalScrollbar;
diff --git a/WebCore/platform/Scrollbar.cpp b/WebCore/platform/Scrollbar.cpp
index 4574f63..4eb2c4a 100644
--- a/WebCore/platform/Scrollbar.cpp
+++ b/WebCore/platform/Scrollbar.cpp
@@ -392,9 +392,9 @@ void Scrollbar::setFrameRect(const IntRect& rect)
     // Get our window resizer rect and see if we overlap.  Adjust to avoid the overlap
     // if necessary.
     IntRect adjustedRect(rect);
-    if (parent()) {
-        bool overlapsResizer = false;
-        ScrollView* view = parent();
+    bool overlapsResizer = false;
+    ScrollView* view = parent();
+    if (view && !rect.isEmpty() && !view->windowResizerRect().isEmpty()) {
         IntRect resizerRect = view->convertFromContainingWindow(view->windowResizerRect());
         if (rect.intersects(resizerRect)) {
             if (orientation() == HorizontalScrollbar) {
@@ -411,11 +411,11 @@ void Scrollbar::setFrameRect(const IntRect& rect)
                 }
             }
         }
-
-        if (overlapsResizer != m_overlapsResizer) {
-            m_overlapsResizer = overlapsResizer;
+    }
+    if (overlapsResizer != m_overlapsResizer) {
+        m_overlapsResizer = overlapsResizer;
+        if (view)
             view->adjustScrollbarsAvoidingResizerCount(m_overlapsResizer ? 1 : -1);
-        }
     }
 
     Widget::setFrameRect(adjustedRect);
diff --git a/WebCore/platform/StaticConstructors.h b/WebCore/platform/StaticConstructors.h
index 26b44de..5bc792c 100644
--- a/WebCore/platform/StaticConstructors.h
+++ b/WebCore/platform/StaticConstructors.h
@@ -56,6 +56,9 @@
 #if COMPILER(MSVC7)
 #define DEFINE_GLOBAL(type, name) \
     const type name;
+#elif COMPILER(WINSCW)
+#define DEFINE_GLOBAL(type, name, arg...) \
+    const type name;
 #else
 #define DEFINE_GLOBAL(type, name, ...) \
     const type name;
@@ -67,6 +70,9 @@
 #if COMPILER(MSVC7)
 #define DEFINE_GLOBAL(type, name) \
     void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
+#elif COMPILER(WINSCW)
+#define DEFINE_GLOBAL(type, name, arg...) \
+    void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
 #else
 #define DEFINE_GLOBAL(type, name, ...) \
     void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
diff --git a/WebCore/platform/ThemeTypes.h b/WebCore/platform/ThemeTypes.h
index b763675..e132313 100644
--- a/WebCore/platform/ThemeTypes.h
+++ b/WebCore/platform/ThemeTypes.h
@@ -46,12 +46,11 @@ typedef unsigned ControlStates;
 // Must follow CSSValueKeywords.in order
 enum ControlPart {
     NoControlPart, CheckboxPart, RadioPart, PushButtonPart, SquareButtonPart, ButtonPart,
-    ButtonBevelPart, DefaultButtonPart, ListboxPart, ListItemPart, 
+    ButtonBevelPart, DefaultButtonPart, ListButtonPart, ListboxPart, ListItemPart,
     MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
     MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart,
-    MediaSliderPart,
-    MediaSliderThumbPart, MediaControlsBackgroundPart,
-    MediaCurrentTimePart, MediaTimeRemainingPart,
+    MediaSliderPart, MediaSliderThumbPart, MediaVolumeSliderContainerPart, MediaVolumeSliderPart, MediaVolumeSliderThumbPart,
+    MediaControlsBackgroundPart, MediaCurrentTimePart, MediaTimeRemainingPart,
     MenulistPart, MenulistButtonPart, MenulistTextPart, MenulistTextFieldPart,
     SliderHorizontalPart, SliderVerticalPart, SliderThumbHorizontalPart,
     SliderThumbVerticalPart, CaretPart, SearchFieldPart, SearchFieldDecorationPart,
diff --git a/WebCore/platform/ThreadTimers.cpp b/WebCore/platform/ThreadTimers.cpp
index 71a06b0..3ae8207 100644
--- a/WebCore/platform/ThreadTimers.cpp
+++ b/WebCore/platform/ThreadTimers.cpp
@@ -34,6 +34,11 @@
 
 namespace WebCore {
 
+// Fire timers for this length of time, and then quit to let the run loop process user input events.
+// 100ms is about a perceptable delay in UI, so use a half of that as a threshold.
+// This is to prevent UI freeze when there are too many timers or machine performance is low.
+static const double maxDurationOfFiringTimers = 0.050;
+
 // Timers are created, started and fired on the same thread, and each thread has its own ThreadTimers
 // copy to keep the heap and a set of currently firing timers.
 
@@ -79,43 +84,6 @@ void ThreadTimers::updateSharedTimer()
         m_sharedTimer->setFireTime(m_timerHeap.first()->m_nextFireTime);
 }
 
-
-void ThreadTimers::collectFiringTimers(double fireTime, Vector<TimerBase*>& firingTimers)
-{
-    while (!m_timerHeap.isEmpty() && m_timerHeap.first()->m_nextFireTime <= fireTime) {
-        TimerBase* timer = m_timerHeap.first();
-        firingTimers.append(timer);
-        m_timersReadyToFire.add(timer);
-        timer->m_nextFireTime = 0;
-        timer->heapDeleteMin();
-    }
-}
-
-void ThreadTimers::fireTimers(double fireTime, const Vector<TimerBase*>& firingTimers)
-{
-    size_t size = firingTimers.size();
-    for (size_t i = 0; i != size; ++i) {
-        TimerBase* timer = firingTimers[i];
-
-        // If not in the set, this timer has been deleted or re-scheduled in another timer's fired function.
-        // So either we don't want to fire it at all or we will fire it next time the shared timer goes off.
-        // It might even have been deleted; that's OK because we won't do anything else with the pointer.
-        if (!m_timersReadyToFire.contains(timer))
-            continue;
-
-        // Setting the next fire time has a side effect of removing the timer from the firing timers set.
-        double interval = timer->repeatInterval();
-        timer->setNextFireTime(interval ? fireTime + interval : 0);
-
-        // Once the timer has been fired, it may be deleted, so do nothing else with it after this point.
-        timer->fired();
-
-        // Catch the case where the timer asked timers to fire in a nested event loop.
-        if (!m_firingTimers)
-            break;
-    }
-}
-
 void ThreadTimers::sharedTimerFired()
 {
     // Redirect to non-static method.
@@ -130,17 +98,24 @@ void ThreadTimers::sharedTimerFiredInternal()
     m_firingTimers = true;
 
     double fireTime = currentTime();
-    Vector<TimerBase*> firingTimers;
+    double timeToQuit = fireTime + maxDurationOfFiringTimers;
 
-    // m_timersReadyToFire will initially contain the same set as firingTimers, but
-    // as timers fire some mat become re-scheduled or deleted. They get removed from
-    // m_timersReadyToFire so we can avoid firing them.
-    ASSERT(m_timersReadyToFire.isEmpty());
+    while (!m_timerHeap.isEmpty() && m_timerHeap.first()->m_nextFireTime <= fireTime) {
+        TimerBase* timer = m_timerHeap.first();
+        timer->m_nextFireTime = 0;
+        timer->heapDeleteMin();
 
-    collectFiringTimers(fireTime, firingTimers);
-    fireTimers(fireTime, firingTimers);
+        double interval = timer->repeatInterval();
+        timer->setNextFireTime(interval ? fireTime + interval : 0);
+
+        // Once the timer has been fired, it may be deleted, so do nothing else with it after this point.
+        timer->fired();
+
+        // Catch the case where the timer asked timers to fire in a nested event loop, or we are over time limit.
+        if (!m_firingTimers || timeToQuit < currentTime())
+            break;
+    }
 
-    m_timersReadyToFire.clear();
     m_firingTimers = false;
 
     updateSharedTimer();
@@ -150,7 +125,6 @@ void ThreadTimers::fireTimersInNestedEventLoop()
 {
     // Reset the reentrancy guard so the timers can fire again.
     m_firingTimers = false;
-    m_timersReadyToFire.clear();
     updateSharedTimer();
 }
 
diff --git a/WebCore/platform/ThreadTimers.h b/WebCore/platform/ThreadTimers.h
index ea0a366..01b4c71 100644
--- a/WebCore/platform/ThreadTimers.h
+++ b/WebCore/platform/ThreadTimers.h
@@ -45,7 +45,6 @@ namespace WebCore {
         void setSharedTimer(SharedTimer*);
 
         Vector<TimerBase*>& timerHeap() { return m_timerHeap; }
-        HashSet<const TimerBase*>& timersReadyToFire() { return m_timersReadyToFire; }
 
         void updateSharedTimer();
         void fireTimersInNestedEventLoop();
@@ -53,13 +52,10 @@ namespace WebCore {
     private:
         static void sharedTimerFired();
 
-        void fireTimers(double fireTime, const Vector<TimerBase*>&);
-        void collectFiringTimers(double fireTime, Vector<TimerBase*>&);
         void sharedTimerFiredInternal();
         void fireTimersInNestedEventLoopInternal();
 
         Vector<TimerBase*> m_timerHeap;
-        HashSet<const TimerBase*> m_timersReadyToFire; // Temporarily holds a pointer to a stack object. No ownership.
         SharedTimer* m_sharedTimer; // External object, can be a run loop on a worker thread. Normally set/reset by worker thread.
         bool m_firingTimers; // Reentrancy guard.
     };
diff --git a/WebCore/platform/Timer.cpp b/WebCore/platform/Timer.cpp
index bd29fd8..539846c 100644
--- a/WebCore/platform/Timer.cpp
+++ b/WebCore/platform/Timer.cpp
@@ -53,11 +53,6 @@ static Vector<TimerBase*>& timerHeap()
     return threadGlobalData().threadTimers().timerHeap();
 }
 
-static HashSet<const TimerBase*>& timersReadyToFire()
-{
-    return threadGlobalData().threadTimers().timersReadyToFire();
-}
-
 // Class to represent elements in the heap when calling the standard library heap algorithms.
 // Maintains the m_heapIndex value in the timers themselves, which allows us to do efficient
 // modification of the heap.
@@ -205,7 +200,7 @@ bool TimerBase::isActive() const
 {
     ASSERT(m_thread == currentThread());
 
-    return m_nextFireTime || timersReadyToFire().contains(this);
+    return m_nextFireTime;
 }
 
 double TimerBase::nextFireInterval() const
@@ -296,9 +291,6 @@ void TimerBase::setNextFireTime(double newTime)
     ASSERT(m_thread == currentThread());
 
     // Keep heap valid while changing the next-fire time.
-
-    timersReadyToFire().remove(this);
-
     double oldTime = m_nextFireTime;
     if (oldTime != newTime) {
         m_nextFireTime = newTime;
diff --git a/WebCore/platform/TreeShared.h b/WebCore/platform/TreeShared.h
index 1ac1b33..02728ff 100644
--- a/WebCore/platform/TreeShared.h
+++ b/WebCore/platform/TreeShared.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,17 +28,8 @@ namespace WebCore {
 
 template<class T> class TreeShared : public Noncopyable {
 public:
-    TreeShared()
-        : m_refCount(0)
-        , m_parent(0)
-    {
-#ifndef NDEBUG
-        m_deletionHasBegun = false;
-        m_inRemovedLastRefFunction = false;
-#endif
-    }
-    TreeShared(T* parent)
-        : m_refCount(0)
+    TreeShared(int initialRefCount = 1)
+        : m_refCount(initialRefCount)
         , m_parent(0)
     {
 #ifndef NDEBUG
diff --git a/WebCore/platform/Widget.h b/WebCore/platform/Widget.h
index 4534d58..cbbc427 100644
--- a/WebCore/platform/Widget.h
+++ b/WebCore/platform/Widget.h
@@ -70,10 +70,22 @@ class wxWindow;
 typedef wxWindow* PlatformWidget;
 #endif
 
+#if PLATFORM(HAIKU)
+class BView;
+typedef BView* PlatformWidget;
+#endif
+
 #if PLATFORM(CHROMIUM)
 #include "PlatformWidget.h"
 #endif
 
+#if PLATFORM(QT)
+class QWebPageClient;
+typedef QWebPageClient* PlatformPageClient;
+#else
+typedef PlatformWidget PlatformPageClient;
+#endif
+
 #include "IntPoint.h"
 #include "IntRect.h"
 #include "IntSize.h"
diff --git a/WebCore/platform/android/TemporaryLinkStubs.cpp b/WebCore/platform/android/TemporaryLinkStubs.cpp
index 482565b..215c7f5 100644
--- a/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/android/TemporaryLinkStubs.cpp
@@ -174,6 +174,11 @@ void Pasteboard::writeSelection(Range*, bool, Frame*)
     notImplemented();
 }
 
+void Pasteboard::writePlainText(const String&)
+{
+    notImplemented();
+}
+
 void Pasteboard::writeURL(const KURL&, const String&, Frame*)
 {
     notImplemented();
diff --git a/WebCore/platform/chromium/ChromiumBridge.h b/WebCore/platform/chromium/ChromiumBridge.h
index bca8c52..1afcc23 100644
--- a/WebCore/platform/chromium/ChromiumBridge.h
+++ b/WebCore/platform/chromium/ChromiumBridge.h
@@ -67,12 +67,16 @@ namespace WebCore {
     class ChromiumBridge {
     public:
         // Clipboard ----------------------------------------------------------
-        static bool clipboardIsFormatAvailable(PasteboardPrivate::ClipboardFormat);
+        static bool clipboardIsFormatAvailable(PasteboardPrivate::ClipboardFormat, PasteboardPrivate::ClipboardBuffer);
 
-        static String clipboardReadPlainText();
-        static void clipboardReadHTML(String*, KURL*);
+        static String clipboardReadPlainText(PasteboardPrivate::ClipboardBuffer);
+        static void clipboardReadHTML(PasteboardPrivate::ClipboardBuffer, String*, KURL*);
 
+        // Only the clipboardRead functions take a buffer argument because 
+        // Chromium currently uses a different technique to write to alternate
+        // clipboard buffers.
         static void clipboardWriteSelection(const String&, const KURL&, const String&, bool);
+        static void clipboardWritePlainText(const String&);
         static void clipboardWriteURL(const KURL&, const String&);
         static void clipboardWriteImage(const NativeImageSkia*, const KURL&, const String&);
 
@@ -92,6 +96,9 @@ namespace WebCore {
         static String directoryName(const String& path);
         static String pathByAppendingComponent(const String& path, const String& component);
         static bool makeAllDirectories(const String& path);
+        static String getAbsolutePath(const String&);
+        static bool isDirectory(const String&);
+        static KURL filePathToURL(const String&);
 
         // Font ---------------------------------------------------------------
 #if PLATFORM(WIN_OS)
@@ -103,12 +110,16 @@ namespace WebCore {
 
         // Forms --------------------------------------------------------------
         static void notifyFormStateChanged(const Document*);
-        
+
         // HTML5 DB -----------------------------------------------------------
 #if ENABLE(DATABASE)
-        static PlatformFileHandle databaseOpenFile(const String& fileName, int desiredFlags);
-        static bool databaseDeleteFile(const String& fileName);
+        // Returns a handle to the DB file and ooptionally a handle to its containing directory
+        static PlatformFileHandle databaseOpenFile(const String& fileName, int desiredFlags, PlatformFileHandle* dirHandle = 0);
+        // Returns a SQLite code (SQLITE_OK = 0, on success)
+        static int databaseDeleteFile(const String& fileName, bool syncDir = false);
+        // Returns the attributes of the DB file
         static long databaseGetFileAttributes(const String& fileName);
+        // Returns the size of the DB file
         static long long databaseGetFileSize(const String& fileName);
 #endif
 
diff --git a/WebCore/platform/chromium/ChromiumDataObject.h b/WebCore/platform/chromium/ChromiumDataObject.h
index 3e8675e..a227001 100644
--- a/WebCore/platform/chromium/ChromiumDataObject.h
+++ b/WebCore/platform/chromium/ChromiumDataObject.h
@@ -55,7 +55,38 @@ namespace WebCore {
 
         void clear();
         bool hasData() const;
+        
+        KURL mainURL() const { return url; }
+        void setMainURL(const KURL& newURL) { url = newURL; }
 
+        String mainURLTitle() const { return urlTitle; }
+        void setMainURLTitle(const String& newURLTitle) { urlTitle = newURLTitle; }
+
+        String textPlain() const { return plainText; }
+        void setTextPlain(const String& newText) { plainText = newText; }
+
+        String textHTML() const { return textHtml; }
+        void setTextHTML(const String& newText) { textHtml = newText; }
+
+        KURL htmlBaseURL() const { return htmlBaseUrl; }
+        void setHTMLBaseURL(const KURL& newURL) { htmlBaseUrl = newURL; }
+
+        SharedBuffer* content() const { return fileContent.get(); }
+        PassRefPtr<SharedBuffer> releaseContent() { return fileContent.release(); }
+        void setContent(PassRefPtr<SharedBuffer> newContent) { fileContent = newContent; }
+
+        String contentFileExtension() const { return fileExtension; }
+        void setContentFileExtension(const String& newFileExtension) { fileExtension = newFileExtension; }
+
+        String contentFileName() const { return fileContentFilename; }
+        void setContentFileName(const String& newFilename) { fileContentFilename = newFilename; }
+
+        const Vector<String>& fileNames() const { return filenames; }
+        void setFileNames(const Vector<String>& newFilenames) { filenames = newFilenames; }
+        void takeFileNames(Vector<String>& newFilenames) { filenames.swap(newFilenames); }
+
+        // Interim state: All members will become private, do NOT access them directly! 
+        // Rather use the above accessor methods (or devise new ones if necessary).
         KURL url;
         String urlTitle;
 
diff --git a/WebCore/platform/chromium/ClipboardChromium.cpp b/WebCore/platform/chromium/ClipboardChromium.cpp
index 4050294..d330d3b 100644
--- a/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -40,6 +40,7 @@
 #include "MIMETypeRegistry.h"
 #include "markup.h"
 #include "NamedNodeMap.h"
+#include "Pasteboard.h"
 #include "PlatformString.h"
 #include "Range.h"
 #include "RenderImage.h"
@@ -92,6 +93,7 @@ void ClipboardChromium::clearData(const String& type)
         m_dataObject->url = KURL();
         m_dataObject->urlTitle = "";
     }
+
     if (dataType == ClipboardDataTypeText)
         m_dataObject->plainText = "";
 }
@@ -116,7 +118,11 @@ String ClipboardChromium::getData(const String& type, bool& success) const
         if (!isForDragging()) {
             // If this isn't for a drag, it's for a cut/paste event handler.
             // In this case, we need to check the clipboard.
-            text = ChromiumBridge::clipboardReadPlainText();
+            PasteboardPrivate::ClipboardBuffer buffer = 
+                Pasteboard::generalPasteboard()->isSelectionMode() ?
+                PasteboardPrivate::SelectionBuffer : 
+                PasteboardPrivate::StandardBuffer;
+            text = ChromiumBridge::clipboardReadPlainText(buffer);
             success = !text.isEmpty();
         } else if (!m_dataObject->plainText.isEmpty()) {
             success = true;
@@ -142,7 +148,7 @@ bool ClipboardChromium::setData(const String& type, const String& data)
     ClipboardDataType winType = clipboardTypeFromMIMEType(type);
 
     if (winType == ClipboardDataTypeURL) {
-        m_dataObject->url = KURL(data);
+        m_dataObject->url = KURL(ParsedURLString, data);
         return m_dataObject->url.isValid();
     }
 
@@ -150,6 +156,7 @@ bool ClipboardChromium::setData(const String& type, const String& data)
         m_dataObject->plainText = data;
         return true;
     }
+    
     return false;
 }
 
@@ -163,6 +170,9 @@ HashSet<String> ClipboardChromium::types() const
     if (!m_dataObject)
         return results;
 
+    if (!m_dataObject->filenames.isEmpty())
+        results.add("Files");
+
     if (m_dataObject->url.isValid()) {
         results.add("URL");
         results.add("text/uri-list");
@@ -178,8 +188,17 @@ HashSet<String> ClipboardChromium::types() const
 
 PassRefPtr<FileList> ClipboardChromium::files() const
 {
-    notImplemented();
-    return 0;
+    if (policy() != ClipboardReadable)
+        return FileList::create();
+
+    if (!m_dataObject || m_dataObject->filenames.isEmpty())
+        return FileList::create();
+
+    RefPtr<FileList> fileList = FileList::create();
+    for (size_t i = 0; i < m_dataObject->filenames.size(); ++i)
+        fileList->append(File::create(m_dataObject->filenames.at(i)));
+
+    return fileList.release();
 }
 
 void ClipboardChromium::setDragImage(CachedImage* image, Node* node, const IntPoint& loc)
diff --git a/WebCore/platform/chromium/DragDataChromium.cpp b/WebCore/platform/chromium/DragDataChromium.cpp
index eaec025..133ba24 100644
--- a/WebCore/platform/chromium/DragDataChromium.cpp
+++ b/WebCore/platform/chromium/DragDataChromium.cpp
@@ -30,10 +30,12 @@
 #include "config.h"
 #include "DragData.h"
 
+#include "ChromiumBridge.h"
 #include "ChromiumDataObject.h"
 #include "Clipboard.h"
 #include "ClipboardChromium.h"
 #include "DocumentFragment.h"
+#include "FileSystem.h"
 #include "KURL.h"
 #include "markup.h"
 #include "NotImplemented.h"
@@ -56,18 +58,25 @@ PassRefPtr<Clipboard> DragData::createClipboard(ClipboardAccessPolicy policy) co
 
 bool DragData::containsURL() const
 {
-    return m_platformDragData->url.isValid();
+    return !asURL().isEmpty();
 }
 
 String DragData::asURL(String* title) const
 {
-    if (!m_platformDragData->url.isValid())
-        return String();
+    String url;
+    if (m_platformDragData->url.isValid())
+        url = m_platformDragData->url.string();
+    else if (m_platformDragData->filenames.size() == 1) {
+        String fileName = m_platformDragData->filenames[0];
+        fileName = ChromiumBridge::getAbsolutePath(fileName);
+        if (fileExists(fileName) && !ChromiumBridge::isDirectory(fileName))
+            url = ChromiumBridge::filePathToURL(fileName).string();
+    }
  
     // |title| can be NULL
     if (title)
         *title = m_platformDragData->urlTitle;
-    return m_platformDragData->url.string();
+    return url;
 }
 
 bool DragData::containsFiles() const
@@ -112,7 +121,8 @@ bool DragData::containsCompatibleContent() const
     return containsPlainText()
         || containsURL()
         || containsHTML(m_platformDragData)
-        || containsColor();
+        || containsColor()
+        || containsFiles();
 }
 
 PassRefPtr<DocumentFragment> DragData::asFragment(Document* doc) const
diff --git a/WebCore/platform/chromium/FileChooserChromium.cpp b/WebCore/platform/chromium/FileChooserChromium.cpp
index 08d33a3..3d75b42 100644
--- a/WebCore/platform/chromium/FileChooserChromium.cpp
+++ b/WebCore/platform/chromium/FileChooserChromium.cpp
@@ -42,7 +42,7 @@ String FileChooser::basenameForWidth(const Font& font, int width) const
     if (m_filenames.isEmpty())
         string = fileButtonNoFileSelectedLabel();
     else if (m_filenames.size() == 1)
-        string = pathGetFileName(m_filenames[0]);
+        string = pathGetDisplayFileName(m_filenames[0]);
     else
         return StringTruncator::rightTruncate(multipleFileUploadText(m_filenames.size()), width, font, false);
 
diff --git a/WebCore/platform/chromium/FileSystemChromiumLinux.cpp b/WebCore/platform/chromium/FileSystemChromiumLinux.cpp
index e388dee..24f8da5 100644
--- a/WebCore/platform/chromium/FileSystemChromiumLinux.cpp
+++ b/WebCore/platform/chromium/FileSystemChromiumLinux.cpp
@@ -38,4 +38,9 @@ String pathGetFileName(const String& path)
     return path.substring(path.reverseFind('/') + 1);
 }
 
+String pathGetDisplayFileName(const String& path)
+{
+    return pathGetFileName(path);
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/FileSystemChromiumMac.mm b/WebCore/platform/chromium/FileSystemChromiumMac.mm
index 7e880e1..29563de 100644
--- a/WebCore/platform/chromium/FileSystemChromiumMac.mm
+++ b/WebCore/platform/chromium/FileSystemChromiumMac.mm
@@ -38,6 +38,11 @@ namespace WebCore {
 
 String pathGetFileName(const String& path)
 {
+    return [path lastPathComponent];
+}
+
+String pathGetDisplayFileName(const String& path)
+{
     return [[NSFileManager defaultManager] displayNameAtPath:path];
 }
 
diff --git a/WebCore/platform/chromium/FileSystemChromiumWin.cpp b/WebCore/platform/chromium/FileSystemChromiumWin.cpp
index 704c39a..0e605dc 100644
--- a/WebCore/platform/chromium/FileSystemChromiumWin.cpp
+++ b/WebCore/platform/chromium/FileSystemChromiumWin.cpp
@@ -41,4 +41,9 @@ String pathGetFileName(const String& path)
     return String(PathFindFileName(String(path).charactersWithNullTermination()));
 }
 
+String pathGetDisplayFileName(const String& path)
+{
+    return pathGetFileName(path);
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/KeyCodeConversionGtk.cpp b/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
index 4fc7f32..5950de1 100644
--- a/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
+++ b/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
@@ -357,6 +357,31 @@ int windowsKeyCodeForKeyEvent(unsigned keycode)
         // VKEY_NONAME (FC) Reserved for future use
         // VKEY_PA1 (FD) PA1 key
         // VKEY_OEM_CLEAR (FE) Clear key
+    case GDK_F1:
+    case GDK_F2:
+    case GDK_F3:
+    case GDK_F4:
+    case GDK_F5:
+    case GDK_F6:
+    case GDK_F7:
+    case GDK_F8:
+    case GDK_F9:
+    case GDK_F10:
+    case GDK_F11:
+    case GDK_F12:
+    case GDK_F13:
+    case GDK_F14:
+    case GDK_F15:
+    case GDK_F16:
+    case GDK_F17:
+    case GDK_F18:
+    case GDK_F19:
+    case GDK_F20:
+    case GDK_F21:
+    case GDK_F22:
+    case GDK_F23:
+    case GDK_F24:
+        return VKEY_F1 + (keycode - GDK_F1);
     default:
         return 0;
     }
diff --git a/WebCore/platform/chromium/PasteboardChromium.cpp b/WebCore/platform/chromium/PasteboardChromium.cpp
index c5dee82..7702730 100644
--- a/WebCore/platform/chromium/PasteboardChromium.cpp
+++ b/WebCore/platform/chromium/PasteboardChromium.cpp
@@ -59,6 +59,7 @@ Pasteboard* Pasteboard::generalPasteboard()
 }
 
 Pasteboard::Pasteboard()
+    : m_selectionMode(false)
 {
 }
 
@@ -68,6 +69,16 @@ void Pasteboard::clear()
     // previous contents.
 }
 
+bool Pasteboard::isSelectionMode() const
+{
+    return m_selectionMode;
+}
+
+void Pasteboard::setSelectionMode(bool selectionMode)
+{
+    m_selectionMode = selectionMode;
+}
+
 void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
     String html = createMarkup(selectedRange, 0, AnnotateForInterchange);
@@ -85,6 +96,17 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     ChromiumBridge::clipboardWriteSelection(html, url, plainText, canSmartCopyOrDelete);
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+#if PLATFORM(WIN_OS)
+    String plainText(text);
+    replaceNewlinesWithWindowsStyleNewlines(plainText);
+    ChromiumBridge::clipboardWritePlainText(plainText);
+#else
+    ChromiumBridge::clipboardWritePlainText(text);
+#endif
+}
+
 void Pasteboard::writeURL(const KURL& url, const String& titleStr, Frame* frame)
 {
     ASSERT(!url.isEmpty());
@@ -134,23 +156,23 @@ void Pasteboard::writeImage(Node* node, const KURL&, const String& title)
 
 bool Pasteboard::canSmartReplace()
 {
-    return ChromiumBridge::clipboardIsFormatAvailable(
-        PasteboardPrivate::WebSmartPasteFormat);
+    return ChromiumBridge::clipboardIsFormatAvailable(PasteboardPrivate::WebSmartPasteFormat, m_selectionMode ? PasteboardPrivate::SelectionBuffer : PasteboardPrivate::StandardBuffer);
 }
 
 String Pasteboard::plainText(Frame* frame)
 {
-    return ChromiumBridge::clipboardReadPlainText();
+    return ChromiumBridge::clipboardReadPlainText(m_selectionMode ? PasteboardPrivate::SelectionBuffer : PasteboardPrivate::StandardBuffer);
 }
 
 PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefPtr<Range> context, bool allowPlainText, bool& chosePlainText)
 {
     chosePlainText = false;
+    PasteboardPrivate::ClipboardBuffer buffer = m_selectionMode ? PasteboardPrivate::SelectionBuffer : PasteboardPrivate::StandardBuffer;
 
-    if (ChromiumBridge::clipboardIsFormatAvailable(PasteboardPrivate::HTMLFormat)) {
+    if (ChromiumBridge::clipboardIsFormatAvailable(PasteboardPrivate::HTMLFormat, buffer)) {
         String markup;
         KURL srcURL;
-        ChromiumBridge::clipboardReadHTML(&markup, &srcURL);
+        ChromiumBridge::clipboardReadHTML(buffer, &markup, &srcURL);
 
         RefPtr<DocumentFragment> fragment =
             createFragmentFromMarkup(frame->document(), markup, srcURL);
@@ -159,7 +181,7 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
     }
 
     if (allowPlainText) {
-        String markup = ChromiumBridge::clipboardReadPlainText();
+        String markup = ChromiumBridge::clipboardReadPlainText(buffer);
         if (!markup.isEmpty()) {
             chosePlainText = true;
 
diff --git a/WebCore/platform/chromium/PasteboardPrivate.h b/WebCore/platform/chromium/PasteboardPrivate.h
index 26d45a0..95cc697 100644
--- a/WebCore/platform/chromium/PasteboardPrivate.h
+++ b/WebCore/platform/chromium/PasteboardPrivate.h
@@ -41,6 +41,10 @@ namespace WebCore {
             BookmarkFormat,
             WebSmartPasteFormat,
         };
+        enum ClipboardBuffer {
+            StandardBuffer,
+            SelectionBuffer,
+        };
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/PopupMenuChromium.cpp b/WebCore/platform/chromium/PopupMenuChromium.cpp
index 51ed6ce..d6f895d 100644
--- a/WebCore/platform/chromium/PopupMenuChromium.cpp
+++ b/WebCore/platform/chromium/PopupMenuChromium.cpp
@@ -50,6 +50,7 @@
 #include "PopupMenu.h"
 #include "RenderTheme.h"
 #include "ScrollbarTheme.h"
+#include "StringTruncator.h"
 #include "SystemTime.h"
 
 #include <wtf/CurrentTime.h>
@@ -72,10 +73,13 @@ static const TimeStamp kTypeAheadTimeoutMs = 1000;
 // The settings used for the drop down menu.
 // This is the delegate used if none is provided.
 static const PopupContainerSettings dropDownSettings = {
-    true, // focusOnShow
-    true, // setTextOnIndexChange
-    true, // acceptOnAbandon
-    false // loopSelectionNavigation
+    true,   // focusOnShow
+    true,   // setTextOnIndexChange
+    true,   // acceptOnAbandon
+    false,  // loopSelectionNavigation
+    false,  // restrictWidthOfListBox
+    // display item text in its first strong directional character's directionality.
+    PopupContainerSettings::FirstStrongDirectionalCharacterDirection,
 };
 
 // This class uses WebCore code to paint and handle events for a drop-down list
@@ -100,10 +104,7 @@ public:
 
     // PopupListBox methods
 
-    // Shows the popup
-    void showPopup();
-
-    // Hides the popup.  Do not call this directly: use client->hidePopup().
+    // Hides the popup.
     void hidePopup();
 
     // Updates our internal list to match the client.
@@ -373,8 +374,7 @@ void PopupContainer::showExternal(const IntRect& rect, FrameView* v, int index)
 
 void PopupContainer::hidePopup()
 {
-    if (client())
-        client()->popupClosed(this);
+    listBox()->hidePopup();
 }
 
 void PopupContainer::layout()
@@ -601,6 +601,22 @@ bool PopupListBox::isInterestedInEventForKey(int keyCode)
     }
 }
 
+static bool isCharacterTypeEvent(const PlatformKeyboardEvent& event)
+{
+    // Check whether the event is a character-typed event or not.
+    // In Windows, PlatformKeyboardEvent::Char (not RawKeyDown) type event
+    // is considered as character type event. In Mac OS, KeyDown (not
+    // KeyUp) is considered as character type event.
+#if PLATFORM(WIN_OS)
+    if (event.type() == PlatformKeyboardEvent::Char)
+        return true;
+#else
+    if (event.type() == PlatformKeyboardEvent::KeyDown)
+        return true;
+#endif
+    return false;
+}
+
 bool PopupListBox::handleKeyEvent(const PlatformKeyboardEvent& event)
 {
     if (event.type() == PlatformKeyboardEvent::KeyUp)
@@ -615,7 +631,7 @@ bool PopupListBox::handleKeyEvent(const PlatformKeyboardEvent& event)
         return true;
     case VKEY_RETURN:
         if (m_selectedIndex == -1)  {
-            m_popupClient->hidePopup();
+            hidePopup();
             // Don't eat the enter if nothing is selected.
             return false;
         }
@@ -641,7 +657,8 @@ bool PopupListBox::handleKeyEvent(const PlatformKeyboardEvent& event)
         break;
     default:
         if (!event.ctrlKey() && !event.altKey() && !event.metaKey()
-            && isPrintableChar(event.windowsVirtualKeyCode()))
+            && isPrintableChar(event.windowsVirtualKeyCode())
+            && isCharacterTypeEvent(event))
             typeAheadFind(event);
         break;
     }
@@ -690,21 +707,6 @@ static String stripLeadingWhiteSpace(const String& string)
     return string.substring(i, length - i);
 }
 
-static bool isCharacterTypeEvent(const PlatformKeyboardEvent& event) {
-    // Check whether the event is a character-typed event or not. 
-    // In Windows, PlatformKeyboardEvent::Char (not RawKeyDown) type event
-    // is considered as character type event. In Mac OS, KeyDown (not 
-    // KeyUp) is considered as character type event.
-#if PLATFORM(WIN_OS)
-    if (event.type() == PlatformKeyboardEvent::Char)
-        return true;
-#else
-    if (event.type() == PlatformKeyboardEvent::KeyDown)
-        return true;
-#endif
-    return false;
-}
-
 // From HTMLSelectElement.cpp, with modifications
 void PopupListBox::typeAheadFind(const PlatformKeyboardEvent& event)
 {
@@ -714,8 +716,7 @@ void PopupListBox::typeAheadFind(const PlatformKeyboardEvent& event)
     // Reset the time when user types in a character. The time gap between
     // last character and the current character is used to indicate whether
     // user typed in a string or just a character as the search prefix.
-    if (isCharacterTypeEvent(event))
-        m_lastCharTime = now;
+    m_lastCharTime = now;
 
     UChar c = event.windowsVirtualKeyCode();
 
@@ -817,25 +818,44 @@ void PopupListBox::paintRow(GraphicsContext* gc, const IntRect& rect, int rowInd
         return;
     }
     
+    if (!style.isVisible())
+        return;
+
     gc->setFillColor(textColor);
 
-    // Bunch of shit to deal with RTL text...
+    Font itemFont = getRowFont(rowIndex);
+    // FIXME: http://crbug.com/19872 We should get the padding of individual option
+    // elements.  This probably implies changes to PopupMenuClient.
+    bool rightAligned = m_popupClient->menuStyle().textDirection() == RTL;
+    int textX = 0;
+    int maxWidth = 0;
+    if (rightAligned)
+        maxWidth = rowRect.width() - max(0, m_popupClient->clientPaddingRight() - m_popupClient->clientInsetRight());
+    else {
+        textX = max(0, m_popupClient->clientPaddingLeft() - m_popupClient->clientInsetLeft());
+        maxWidth = rowRect.width() - textX;
+    }
+    // Prepare text to be drawn.
     String itemText = m_popupClient->itemText(rowIndex);
+    if (m_settings.restrictWidthOfListBox)  // truncate string to fit in.
+        itemText = StringTruncator::rightTruncate(itemText, maxWidth, itemFont);
     unsigned length = itemText.length();
     const UChar* str = itemText.characters();
-
-    TextRun textRun(str, length, false, 0, 0, itemText.defaultWritingDirection() == WTF::Unicode::RightToLeft);
-
-    // FIXME: http://b/1210481 We should get the padding of individual option
-    // elements.  This probably implies changes to PopupMenuClient.
-
-    // Draw the item text
-    if (style.isVisible()) {
-        Font itemFont = getRowFont(rowIndex);
-        int textX = max(0, m_popupClient->clientPaddingLeft() - m_popupClient->clientInsetLeft());
-        int textY = rowRect.y() + itemFont.ascent() + (rowRect.height() - itemFont.height()) / 2;
-        gc->drawBidiText(itemFont, textRun, IntPoint(textX, textY));
-    }
+    // Prepare the directionality to draw text.
+    bool rtl = false;
+    if (m_settings.itemTextDirectionalityHint == PopupContainerSettings::DOMElementDirection)
+        rtl = style.textDirection() == RTL;
+    else if (m_settings.itemTextDirectionalityHint ==
+             PopupContainerSettings::FirstStrongDirectionalCharacterDirection)
+        rtl = itemText.defaultWritingDirection() == WTF::Unicode::RightToLeft;
+    TextRun textRun(str, length, false, 0, 0, rtl);
+    // If the text is right-to-left, make it right-aligned by adjusting its
+    // beginning position.
+    if (rightAligned)
+        textX += maxWidth - itemFont.width(textRun);
+    // Draw the item text.
+    int textY = rowRect.y() + itemFont.ascent() + (rowRect.height() - itemFont.height()) / 2;
+    gc->drawBidiText(itemFont, textRun, IntPoint(textX, textY));
 }
 
 Font PopupListBox::getRowFont(int rowIndex)
@@ -859,7 +879,7 @@ void PopupListBox::abandon()
 
     m_selectedIndex = m_originalIndex;
 
-    m_popupClient->hidePopup();
+    hidePopup();
 
     if (m_acceptedIndexOnAbandon >= 0) {
         m_popupClient->valueChanged(m_acceptedIndexOnAbandon);
@@ -892,7 +912,7 @@ void PopupListBox::acceptIndex(int index)
     if (index < 0) {
         if (m_popupClient) {
             // Enter pressed with no selection, just close the popup.
-            m_popupClient->hidePopup();
+            hidePopup();
         }
         return;
     }
@@ -901,7 +921,7 @@ void PopupListBox::acceptIndex(int index)
         RefPtr<PopupListBox> keepAlive(this);
 
         // Hide ourselves first since valueChanged may have numerous side-effects.
-        m_popupClient->hidePopup();
+        hidePopup();
 
         // Tell the <select> PopupMenuClient what index was selected.
         m_popupClient->valueChanged(index);
@@ -1047,6 +1067,17 @@ void PopupListBox::adjustSelectedIndex(int delta)
     scrollToRevealSelection();
 }
 
+void PopupListBox::hidePopup()
+{
+    if (parent()) {
+        PopupContainer* container = static_cast<PopupContainer*>(parent());
+        if (container->client())
+            container->client()->popupClosed(container);
+    }
+
+    m_popupClient->popupDidHide();
+}
+
 void PopupListBox::updateFromElement()
 {
     clear();
@@ -1090,10 +1121,11 @@ void PopupListBox::layout()
             baseWidth = max(baseWidth, width);
         }
         // FIXME: http://b/1210481 We should get the padding of individual option elements.
-        paddingWidth = max(paddingWidth, 
+        paddingWidth = max(paddingWidth,
             m_popupClient->clientPaddingLeft() + m_popupClient->clientPaddingRight());
     }
 
+    // Calculate scroll bar width.
     int windowHeight = 0;
 
 #if PLATFORM(DARWIN)
@@ -1124,14 +1156,20 @@ void PopupListBox::layout()
     if (m_visibleRows < numItems())
         scrollbarWidth = ScrollbarTheme::nativeTheme()->scrollbarThickness();
 
-    int windowWidth = baseWidth + scrollbarWidth + paddingWidth;
-    int contentWidth = baseWidth;
-
-    if (windowWidth < m_baseWidth) {
+    int windowWidth;
+    int contentWidth;
+    if (m_settings.restrictWidthOfListBox) {
         windowWidth = m_baseWidth;
         contentWidth = m_baseWidth - scrollbarWidth - paddingWidth;
     } else {
-        m_baseWidth = baseWidth;
+        windowWidth = baseWidth + scrollbarWidth + paddingWidth;
+        contentWidth = baseWidth;
+
+        if (windowWidth < m_baseWidth) {
+            windowWidth = m_baseWidth;
+            contentWidth = m_baseWidth - scrollbarWidth - paddingWidth;
+        } else
+            m_baseWidth = baseWidth;
     }
 
     resize(windowWidth, windowHeight);
diff --git a/WebCore/platform/chromium/PopupMenuChromium.h b/WebCore/platform/chromium/PopupMenuChromium.h
index f394bc2..ee094b3 100644
--- a/WebCore/platform/chromium/PopupMenuChromium.h
+++ b/WebCore/platform/chromium/PopupMenuChromium.h
@@ -52,7 +52,11 @@ namespace WebCore {
         };
 
         PopupItem(const String& label, Type type)
-            : label(label), type(type), yOffset(0) { }
+            : label(label)
+            , type(type)
+            , yOffset(0)
+        {
+        }
         String label;
         Type type;
         int yOffset;  // y offset of this item, relative to the top of the popup.
@@ -83,10 +87,30 @@ namespace WebCore {
         // regardless of this setting.
         bool acceptOnAbandon;
 
-        // Whether the we should move the selection to the first/last item when
+        // Whether we should move the selection to the first/last item when
         // the user presses down/up arrow keys and the last/first item is
         // selected.
         bool loopSelectionNavigation;
+
+        // Whether we should restrict the width of the PopupListBox or not.
+        // Autocomplete popups are restricted, combo-boxes (select tags) aren't.
+        bool restrictWidthOfListBox;
+
+        // A hint on the display directionality of the item text in popup menu.
+        //
+        // We could either display the items in the drop-down using its DOM element's
+        // directionality, or we could display the items in the drop-down using heuristics:
+        // such as in its first strong directionality character's direction.
+        // Please refer to the discussion (especially comment #7 and #10) in
+        // https://bugs.webkit.org/show_bug.cgi?id=27889 for details.
+        enum DirectionalityHint {
+            // Use the DOM element's directionality to display the item text in popup menu.
+            DOMElementDirection,
+            // Use the item text's first strong-directional character's directionality
+            // to display the item text in popup menu.
+            FirstStrongDirectionalCharacterDirection,
+        };
+        DirectionalityHint itemTextDirectionalityHint;
     };
 
     class PopupContainer : public FramelessScrollView {
@@ -121,7 +145,7 @@ namespace WebCore {
         // popups on other platforms.
         void show(const IntRect&, FrameView*, int index);
 
-        // Hide the popup.  Do not call this directly: use client->hidePopup().
+        // Hide the popup.
         void hidePopup();
 
         // Compute size of widget and children.
diff --git a/WebCore/platform/chromium/ThemeChromiumMac.h b/WebCore/platform/chromium/ThemeChromiumMac.h
new file mode 100644
index 0000000..5580d1d
--- /dev/null
+++ b/WebCore/platform/chromium/ThemeChromiumMac.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ThemeChromiumMac_h
+#define ThemeChromiumMac_h
+
+#include "Theme.h"
+
+// This file (and its associated .mm file) is a clone of ThemeMac.h. See
+// the .mm file for details.
+
+namespace WebCore {
+
+class ThemeChromiumMac : public Theme {
+public:
+    ThemeChromiumMac() { }
+    virtual ~ThemeChromiumMac() { }
+    
+    virtual int baselinePositionAdjustment(ControlPart) const;
+
+    virtual FontDescription controlFont(ControlPart, const Font&, float zoomFactor) const;
+    
+    virtual LengthSize controlSize(ControlPart, const Font&, const LengthSize&, float zoomFactor) const;
+    virtual LengthSize minimumControlSize(ControlPart, const Font&, float zoomFactor) const;
+
+    virtual LengthBox controlPadding(ControlPart, const Font&, const LengthBox& zoomedBox, float zoomFactor) const;
+    virtual LengthBox controlBorder(ControlPart, const Font&, const LengthBox& zoomedBox, float zoomFactor) const;
+
+    virtual bool controlRequiresPreWhiteSpace(ControlPart part) const { return part == PushButtonPart; }
+
+    virtual void paint(ControlPart, ControlStates, GraphicsContext*, const IntRect&, float zoomFactor, ScrollView*) const;
+    virtual void inflateControlPaintRect(ControlPart, ControlStates, IntRect&, float zoomFactor) const;
+};
+
+} // namespace WebCore
+
+#endif // ThemeChromiumMac_h
diff --git a/WebCore/platform/chromium/ThemeChromiumMac.mm b/WebCore/platform/chromium/ThemeChromiumMac.mm
new file mode 100644
index 0000000..3c97428
--- /dev/null
+++ b/WebCore/platform/chromium/ThemeChromiumMac.mm
@@ -0,0 +1,569 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+#import "ThemeChromiumMac.h"
+
+#import "BlockExceptions.h"
+#import "GraphicsContext.h"
+#import "LocalCurrentGraphicsContext.h"
+#import "ScrollView.h"
+#import "WebCoreSystemInterface.h"
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
+
+// This file (and its associated .h file) is a clone of ThemeMac.mm.
+// Because the original file is designed to run in-process inside a Cocoa view,
+// we must maintain a fork. Please maintain this file by performing parallel
+// changes to it.
+//
+// The only changes from ThemeMac should be:
+// - The classname change from ThemeMac to ThemeChromiumMac.
+// - The import of FlippedView() and its use as the parent view for cell
+//   rendering.
+// - In updateStates() the code to update the cells' inactive state.
+// - In paintButton() the code to save/restore the window's default button cell.
+//
+// For all other differences, if it was introduced in this file, then the
+// maintainer forgot to include it in the list; otherwise it is an update that
+// should have been applied to this file but was not.
+
+// FIXME: Default buttons really should be more like push buttons and not like buttons.
+
+namespace WebCore {
+
+// Pick up utility function from RenderThemeChromiumMac.
+extern NSView* FlippedView();
+
+enum {
+    topMargin,
+    rightMargin,
+    bottomMargin,
+    leftMargin
+};
+
+Theme* platformTheme()
+{
+    DEFINE_STATIC_LOCAL(ThemeChromiumMac, themeMac, ());
+    return &themeMac;
+}
+
+// Helper functions used by a bunch of different control parts.
+
+static NSControlSize controlSizeForFont(const Font& font)
+{
+    int fontSize = font.pixelSize();
+    if (fontSize >= 16)
+        return NSRegularControlSize;
+    if (fontSize >= 11)
+        return NSSmallControlSize;
+    return NSMiniControlSize;
+}
+
+static LengthSize sizeFromFont(const Font& font, const LengthSize& zoomedSize, float zoomFactor, const IntSize* sizes)
+{
+    IntSize controlSize = sizes[controlSizeForFont(font)];
+    if (zoomFactor != 1.0f)
+        controlSize = IntSize(controlSize.width() * zoomFactor, controlSize.height() * zoomFactor);
+    LengthSize result = zoomedSize;
+    if (zoomedSize.width().isIntrinsicOrAuto() && controlSize.width() > 0)
+        result.setWidth(Length(controlSize.width(), Fixed));
+    if (zoomedSize.height().isIntrinsicOrAuto() && controlSize.height() > 0)
+        result.setHeight(Length(controlSize.height(), Fixed));
+    return result;
+}
+
+static void setControlSize(NSCell* cell, const IntSize* sizes, const IntSize& minZoomedSize, float zoomFactor)
+{
+    NSControlSize size;
+    if (minZoomedSize.width() >= static_cast<int>(sizes[NSRegularControlSize].width() * zoomFactor) &&
+        minZoomedSize.height() >= static_cast<int>(sizes[NSRegularControlSize].height() * zoomFactor))
+        size = NSRegularControlSize;
+    else if (minZoomedSize.width() >= static_cast<int>(sizes[NSSmallControlSize].width() * zoomFactor) &&
+             minZoomedSize.height() >= static_cast<int>(sizes[NSSmallControlSize].height() * zoomFactor))
+        size = NSSmallControlSize;
+    else
+        size = NSMiniControlSize;
+    if (size != [cell controlSize]) // Only update if we have to, since AppKit does work even if the size is the same.
+        [cell setControlSize:size];
+}
+
+static void updateStates(NSCell* cell, ControlStates states)
+{
+    // Hover state is not supported by Aqua.
+    
+    // Pressed state
+    bool oldPressed = [cell isHighlighted];
+    bool pressed = states & PressedState;
+    if (pressed != oldPressed)
+        [cell setHighlighted:pressed];
+    
+    // Enabled state
+    bool oldEnabled = [cell isEnabled];
+    bool enabled = states & EnabledState;
+    if (enabled != oldEnabled)
+        [cell setEnabled:enabled];
+    
+    // Focused state
+    bool oldFocused = [cell showsFirstResponder];
+    bool focused = states & FocusState;
+    if (focused != oldFocused)
+        [cell setShowsFirstResponder:focused];
+
+    // Checked and Indeterminate
+    bool oldIndeterminate = [cell state] == NSMixedState;
+    bool indeterminate = (states & IndeterminateState);
+    bool checked = states & CheckedState;
+    bool oldChecked = [cell state] == NSOnState;
+    if (oldIndeterminate != indeterminate || checked != oldChecked)
+        [cell setState:indeterminate ? NSMixedState : (checked ? NSOnState : NSOffState)];
+        
+    // Window Inactive state
+    NSControlTint oldTint = [cell controlTint];
+    bool windowInactive = (states & WindowInactiveState);
+    NSControlTint tint = windowInactive ? NSClearControlTint : [NSColor currentControlTint];
+    if (tint != oldTint)
+        [cell setControlTint:tint];
+}
+
+static IntRect inflateRect(const IntRect& zoomedRect, const IntSize& zoomedSize, const int* margins, float zoomFactor)
+{
+    // Only do the inflation if the available width/height are too small.  Otherwise try to
+    // fit the glow/check space into the available box's width/height.
+    int widthDelta = zoomedRect.width() - (zoomedSize.width() + margins[leftMargin] * zoomFactor + margins[rightMargin] * zoomFactor);
+    int heightDelta = zoomedRect.height() - (zoomedSize.height() + margins[topMargin] * zoomFactor + margins[bottomMargin] * zoomFactor);
+    IntRect result(zoomedRect);
+    if (widthDelta < 0) {
+        result.setX(result.x() - margins[leftMargin] * zoomFactor);
+        result.setWidth(result.width() - widthDelta);
+    }
+    if (heightDelta < 0) {
+        result.setY(result.y() - margins[topMargin] * zoomFactor);
+        result.setHeight(result.height() - heightDelta);
+    }
+    return result;
+}
+
+// Checkboxes
+
+static const IntSize* checkboxSizes()
+{
+    static const IntSize sizes[3] = { IntSize(14, 14), IntSize(12, 12), IntSize(10, 10) };
+    return sizes;
+}
+
+static const int* checkboxMargins(NSControlSize controlSize)
+{
+    static const int margins[3][4] =
+    {
+        { 3, 4, 4, 2 },
+        { 4, 3, 3, 3 },
+        { 4, 3, 3, 3 },
+    };
+    return margins[controlSize];
+}
+
+static LengthSize checkboxSize(const Font& font, const LengthSize& zoomedSize, float zoomFactor)
+{
+    // If the width and height are both specified, then we have nothing to do.
+    if (!zoomedSize.width().isIntrinsicOrAuto() && !zoomedSize.height().isIntrinsicOrAuto())
+        return zoomedSize;
+
+    // Use the font size to determine the intrinsic width of the control.
+    return sizeFromFont(font, zoomedSize, zoomFactor, checkboxSizes());
+}
+
+static NSButtonCell* checkbox(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+{
+    static NSButtonCell* checkboxCell;
+    if (!checkboxCell) {
+        checkboxCell = [[NSButtonCell alloc] init];
+        [checkboxCell setButtonType:NSSwitchButton];
+        [checkboxCell setTitle:nil];
+        [checkboxCell setAllowsMixedState:YES];
+        [checkboxCell setFocusRingType:NSFocusRingTypeExterior];
+    }
+    
+    // Set the control size based off the rectangle we're painting into.
+    setControlSize(checkboxCell, checkboxSizes(), zoomedRect.size(), zoomFactor);
+
+    // Update the various states we respond to.
+    updateStates(checkboxCell, states);
+    
+    return checkboxCell;
+}
+
+// FIXME: Share more code with radio buttons.
+static void paintCheckbox(ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+
+    // Determine the width and height needed for the control and prepare the cell for painting.
+    NSButtonCell* checkboxCell = checkbox(states, zoomedRect, zoomFactor);
+
+    context->save();
+
+    NSControlSize controlSize = [checkboxCell controlSize];
+    IntSize zoomedSize = checkboxSizes()[controlSize];
+    zoomedSize.setWidth(zoomedSize.width() * zoomFactor);
+    zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+    IntRect inflatedRect = inflateRect(zoomedRect, zoomedSize, checkboxMargins(controlSize), zoomFactor);
+    
+    if (zoomFactor != 1.0f) {
+        inflatedRect.setWidth(inflatedRect.width() / zoomFactor);
+        inflatedRect.setHeight(inflatedRect.height() / zoomFactor);
+        context->translate(inflatedRect.x(), inflatedRect.y());
+        context->scale(FloatSize(zoomFactor, zoomFactor));
+        context->translate(-inflatedRect.x(), -inflatedRect.y());
+    }
+    
+    [checkboxCell drawWithFrame:NSRect(inflatedRect) inView:FlippedView()];
+    [checkboxCell setControlView:nil];
+
+    context->restore();
+    
+    END_BLOCK_OBJC_EXCEPTIONS
+}
+
+// Radio Buttons
+
+static const IntSize* radioSizes()
+{
+    static const IntSize sizes[3] = { IntSize(14, 15), IntSize(12, 13), IntSize(10, 10) };
+    return sizes;
+}
+
+static const int* radioMargins(NSControlSize controlSize)
+{
+    static const int margins[3][4] =
+    {
+        { 2, 2, 4, 2 },
+        { 3, 2, 3, 2 },
+        { 1, 0, 2, 0 },
+    };
+    return margins[controlSize];
+}
+
+static LengthSize radioSize(const Font& font, const LengthSize& zoomedSize, float zoomFactor)
+{
+    // If the width and height are both specified, then we have nothing to do.
+    if (!zoomedSize.width().isIntrinsicOrAuto() && !zoomedSize.height().isIntrinsicOrAuto())
+        return zoomedSize;
+
+    // Use the font size to determine the intrinsic width of the control.
+    return sizeFromFont(font, zoomedSize, zoomFactor, radioSizes());
+}
+
+static NSButtonCell* radio(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+{
+    static NSButtonCell* radioCell;
+    if (!radioCell) {
+        radioCell = [[NSButtonCell alloc] init];
+        [radioCell setButtonType:NSRadioButton];
+        [radioCell setTitle:nil];
+        [radioCell setFocusRingType:NSFocusRingTypeExterior];
+    }
+    
+    // Set the control size based off the rectangle we're painting into.
+    setControlSize(radioCell, radioSizes(), zoomedRect.size(), zoomFactor);
+
+    // Update the various states we respond to.
+    updateStates(radioCell, states);
+    
+    return radioCell;
+}
+
+static void paintRadio(ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
+{
+    // Determine the width and height needed for the control and prepare the cell for painting.
+    NSButtonCell* radioCell = radio(states, zoomedRect, zoomFactor);
+
+    context->save();
+
+    NSControlSize controlSize = [radioCell controlSize];
+    IntSize zoomedSize = radioSizes()[controlSize];
+    zoomedSize.setWidth(zoomedSize.width() * zoomFactor);
+    zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+    IntRect inflatedRect = inflateRect(zoomedRect, zoomedSize, radioMargins(controlSize), zoomFactor);
+    
+    if (zoomFactor != 1.0f) {
+        inflatedRect.setWidth(inflatedRect.width() / zoomFactor);
+        inflatedRect.setHeight(inflatedRect.height() / zoomFactor);
+        context->translate(inflatedRect.x(), inflatedRect.y());
+        context->scale(FloatSize(zoomFactor, zoomFactor));
+        context->translate(-inflatedRect.x(), -inflatedRect.y());
+    }
+    
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+    [radioCell drawWithFrame:NSRect(inflatedRect) inView:FlippedView()];
+    [radioCell setControlView:nil];
+    END_BLOCK_OBJC_EXCEPTIONS
+
+    context->restore();
+}
+
+// Buttons
+
+// Buttons really only constrain height. They respect width.
+static const IntSize* buttonSizes()
+{
+    static const IntSize sizes[3] = { IntSize(0, 21), IntSize(0, 18), IntSize(0, 15) };
+    return sizes;
+}
+
+static const int* buttonMargins(NSControlSize controlSize)
+{
+    static const int margins[3][4] =
+    {
+        { 4, 6, 7, 6 },
+        { 4, 5, 6, 5 },
+        { 0, 1, 1, 1 },
+    };
+    return margins[controlSize];
+}
+
+static NSButtonCell* button(ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+{
+    static NSButtonCell *buttonCell;
+    static bool defaultButton;
+    if (!buttonCell) {
+        buttonCell = [[NSButtonCell alloc] init];
+        [buttonCell setTitle:nil];
+        [buttonCell setButtonType:NSMomentaryPushInButton];
+    }
+
+    // Set the control size based off the rectangle we're painting into.
+    if (part == SquareButtonPart || zoomedRect.height() > buttonSizes()[NSRegularControlSize].height() * zoomFactor) {
+        // Use the square button
+        if ([buttonCell bezelStyle] != NSShadowlessSquareBezelStyle)
+            [buttonCell setBezelStyle:NSShadowlessSquareBezelStyle];
+    } else if ([buttonCell bezelStyle] != NSRoundedBezelStyle)
+        [buttonCell setBezelStyle:NSRoundedBezelStyle];
+
+    setControlSize(buttonCell, buttonSizes(), zoomedRect.size(), zoomFactor);
+
+    if (defaultButton != (states & DefaultState)) {
+        defaultButton = !defaultButton;
+        [buttonCell setKeyEquivalent:(defaultButton ? @"\r" : @"")];
+    }
+
+    // Update the various states we respond to.
+    updateStates(buttonCell, states);
+    
+    return buttonCell;
+}
+
+static void paintButton(ControlPart part, ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+    
+    // Determine the width and height needed for the control and prepare the cell for painting.
+    NSButtonCell *buttonCell = button(part, states, zoomedRect, zoomFactor);
+    LocalCurrentGraphicsContext localContext(context);
+
+    NSControlSize controlSize = [buttonCell controlSize];
+    IntSize zoomedSize = buttonSizes()[controlSize];
+    zoomedSize.setWidth(zoomedRect.width()); // Buttons don't ever constrain width, so the zoomed width can just be honored.
+    zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+    IntRect inflatedRect = zoomedRect;
+    if ([buttonCell bezelStyle] == NSRoundedBezelStyle) {
+        // Center the button within the available space.
+        if (inflatedRect.height() > zoomedSize.height()) {
+            inflatedRect.setY(inflatedRect.y() + (inflatedRect.height() - zoomedSize.height()) / 2);
+            inflatedRect.setHeight(zoomedSize.height());
+        }
+
+        // Now inflate it to account for the shadow.
+        inflatedRect = inflateRect(inflatedRect, zoomedSize, buttonMargins(controlSize), zoomFactor);
+
+        if (zoomFactor != 1.0f) {
+            inflatedRect.setWidth(inflatedRect.width() / zoomFactor);
+            inflatedRect.setHeight(inflatedRect.height() / zoomFactor);
+            context->translate(inflatedRect.x(), inflatedRect.y());
+            context->scale(FloatSize(zoomFactor, zoomFactor));
+            context->translate(-inflatedRect.x(), -inflatedRect.y());
+        }
+    } 
+
+    [buttonCell drawWithFrame:NSRect(inflatedRect) inView:FlippedView()];
+    [buttonCell setControlView:nil];
+
+    END_BLOCK_OBJC_EXCEPTIONS
+}
+
+// Theme overrides
+
+int ThemeChromiumMac::baselinePositionAdjustment(ControlPart part) const
+{
+    if (part == CheckboxPart || part == RadioPart)
+        return -2;
+    return Theme::baselinePositionAdjustment(part);
+}
+
+FontDescription ThemeChromiumMac::controlFont(ControlPart part, const Font& font, float zoomFactor) const
+{
+    switch (part) {
+        case PushButtonPart: {
+            FontDescription fontDescription;
+            fontDescription.setIsAbsoluteSize(true);
+            fontDescription.setGenericFamily(FontDescription::SerifFamily);
+
+            NSFont* nsFont = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:controlSizeForFont(font)]];
+            fontDescription.firstFamily().setFamily([nsFont familyName]);
+            fontDescription.setComputedSize([nsFont pointSize] * zoomFactor);
+            fontDescription.setSpecifiedSize([nsFont pointSize] * zoomFactor);
+            return fontDescription;
+        }
+        default:
+            return Theme::controlFont(part, font, zoomFactor);
+    }
+}
+
+LengthSize ThemeChromiumMac::controlSize(ControlPart part, const Font& font, const LengthSize& zoomedSize, float zoomFactor) const
+{
+    switch (part) {
+        case CheckboxPart:
+            return checkboxSize(font, zoomedSize, zoomFactor);
+        case RadioPart:
+            return radioSize(font, zoomedSize, zoomFactor);
+        case PushButtonPart:
+            // Height is reset to auto so that specified heights can be ignored.
+            return sizeFromFont(font, LengthSize(zoomedSize.width(), Length()), zoomFactor, buttonSizes());
+        default:
+            return zoomedSize;
+    }
+}
+
+LengthSize ThemeChromiumMac::minimumControlSize(ControlPart part, const Font& font, float zoomFactor) const
+{
+    switch (part) {
+        case SquareButtonPart:
+        case DefaultButtonPart:
+        case ButtonPart:
+            return LengthSize(Length(0, Fixed), Length(static_cast<int>(15 * zoomFactor), Fixed));
+        default:
+            return Theme::minimumControlSize(part, font, zoomFactor);
+    }
+}
+
+LengthBox ThemeChromiumMac::controlBorder(ControlPart part, const Font& font, const LengthBox& zoomedBox, float zoomFactor) const
+{
+    switch (part) {
+        case SquareButtonPart:
+        case DefaultButtonPart:
+        case ButtonPart:
+            return LengthBox(0, zoomedBox.right().value(), 0, zoomedBox.left().value());
+        default:
+            return Theme::controlBorder(part, font, zoomedBox, zoomFactor);
+    }
+}
+
+LengthBox ThemeChromiumMac::controlPadding(ControlPart part, const Font& font, const LengthBox& zoomedBox, float zoomFactor) const
+{
+    switch (part) {
+        case PushButtonPart: {
+            // Just use 8px.  AppKit wants to use 11px for mini buttons, but that padding is just too large
+            // for real-world Web sites (creating a huge necessary minimum width for buttons whose space is
+            // by definition constrained, since we select mini only for small cramped environments.
+            // This also guarantees the HTML <button> will match our rendering by default, since we're using a consistent
+            // padding.
+            const int padding = 8 * zoomFactor;
+            return LengthBox(0, padding, 0, padding);
+        }
+        default:
+            return Theme::controlPadding(part, font, zoomedBox, zoomFactor);
+    }
+}
+
+void ThemeChromiumMac::inflateControlPaintRect(ControlPart part, ControlStates states, IntRect& zoomedRect, float zoomFactor) const
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+    switch (part) {
+        case CheckboxPart: {
+            // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
+            // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
+            NSCell *cell = checkbox(states, zoomedRect, zoomFactor);
+            NSControlSize controlSize = [cell controlSize];
+            IntSize zoomedSize = checkboxSizes()[controlSize];
+            zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+            zoomedSize.setWidth(zoomedSize.width() * zoomFactor);
+            zoomedRect = inflateRect(zoomedRect, zoomedSize, checkboxMargins(controlSize), zoomFactor);
+            break;
+        }
+        case RadioPart: {
+            // We inflate the rect as needed to account for padding included in the cell to accommodate the radio button
+            // shadow".  We don't consider this part of the bounds of the control in WebKit.
+            NSCell *cell = radio(states, zoomedRect, zoomFactor);
+            NSControlSize controlSize = [cell controlSize];
+            IntSize zoomedSize = radioSizes()[controlSize];
+            zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+            zoomedSize.setWidth(zoomedSize.width() * zoomFactor);
+            zoomedRect = inflateRect(zoomedRect, zoomedSize, radioMargins(controlSize), zoomFactor);
+            break;
+        }
+        case PushButtonPart:
+        case DefaultButtonPart:
+        case ButtonPart: {
+            NSButtonCell *cell = button(part, states, zoomedRect, zoomFactor);
+            NSControlSize controlSize = [cell controlSize];
+
+            // We inflate the rect as needed to account for the Aqua button's shadow.
+            if ([cell bezelStyle] == NSRoundedBezelStyle) {
+                IntSize zoomedSize = buttonSizes()[controlSize];
+                zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+                zoomedSize.setWidth(zoomedRect.width()); // Buttons don't ever constrain width, so the zoomed width can just be honored.
+                zoomedRect = inflateRect(zoomedRect, zoomedSize, buttonMargins(controlSize), zoomFactor);
+            }
+            break;
+        }
+        default:
+            break;
+    }
+    END_BLOCK_OBJC_EXCEPTIONS
+}
+
+void ThemeChromiumMac::paint(ControlPart part, ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView) const
+{
+    switch (part) {
+        case CheckboxPart:
+            paintCheckbox(states, context, zoomedRect, zoomFactor, scrollView);
+            break;
+        case RadioPart:
+            paintRadio(states, context, zoomedRect, zoomFactor, scrollView);
+            break;
+        case PushButtonPart:
+        case DefaultButtonPart:
+        case ButtonPart:
+        case SquareButtonPart:
+            paintButton(part, states, context, zoomedRect, zoomFactor, scrollView);
+            break;
+        default:
+            break;
+    }
+}
+
+}
diff --git a/WebCore/platform/graphics/BitmapImage.h b/WebCore/platform/graphics/BitmapImage.h
index 807c11b..13641d2 100644
--- a/WebCore/platform/graphics/BitmapImage.h
+++ b/WebCore/platform/graphics/BitmapImage.h
@@ -45,6 +45,10 @@ class NSImage;
 typedef struct HBITMAP__ *HBITMAP;
 #endif
 
+#if PLATFORM(HAIKU)
+class BBitmap;
+#endif
+
 namespace WebCore {
     struct FrameData;
 }
@@ -137,6 +141,7 @@ public:
 #endif
 
 #if PLATFORM(WIN)
+    static PassRefPtr<BitmapImage> create(HBITMAP);
     virtual bool getHBITMAP(HBITMAP);
     virtual bool getHBITMAPOfSize(HBITMAP, LPSIZE);
 #endif
@@ -165,10 +170,16 @@ protected:
     virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator);
 #endif
     virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
-#if PLATFORM(WX) || PLATFORM(WINCE)
+
+#if PLATFORM(WX) || (PLATFORM(WINCE) && !PLATFORM(QT))
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
                              const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
-#endif    
+#endif
+
+#if PLATFORM(HAIKU)
+    virtual BBitmap* getBBitmap() const;
+#endif
+
     size_t currentFrame() const { return m_currentFrame; }
     size_t frameCount();
     NativeImagePtr frameAtIndex(size_t);
diff --git a/WebCore/platform/graphics/Color.h b/WebCore/platform/graphics/Color.h
index 5baa56e..8e51b95 100644
--- a/WebCore/platform/graphics/Color.h
+++ b/WebCore/platform/graphics/Color.h
@@ -47,6 +47,10 @@ typedef struct _GdkColor GdkColor;
 class wxColour;
 #endif
 
+#if PLATFORM(HAIKU)
+struct rgb_color;
+#endif
+
 namespace WebCore {
 
 class String;
@@ -121,6 +125,11 @@ public:
     Color(CGColorRef);
 #endif
 
+#if PLATFORM(HAIKU)
+    Color(const rgb_color&);
+    operator rgb_color() const;
+#endif
+
     static bool parseHexColor(const String& name, RGBA32& rgb);
 
     static const RGBA32 black = 0xFF000000;
diff --git a/WebCore/platform/graphics/FloatPoint.h b/WebCore/platform/graphics/FloatPoint.h
index 0c97c49..06b280b 100644
--- a/WebCore/platform/graphics/FloatPoint.h
+++ b/WebCore/platform/graphics/FloatPoint.h
@@ -36,7 +36,7 @@
 typedef struct CGPoint CGPoint;
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGPoint NSPoint;
 #else
@@ -51,6 +51,10 @@ class QPointF;
 QT_END_NAMESPACE
 #endif
 
+#if PLATFORM(HAIKU)
+class BPoint;
+#endif
+
 #if PLATFORM(SKIA)
 struct SkPoint;
 #endif
@@ -80,7 +84,8 @@ public:
     operator CGPoint() const;
 #endif
 
-#if PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)
+#if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
+        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
     FloatPoint(const NSPoint&);
     operator NSPoint() const;
 #endif
@@ -90,7 +95,16 @@ public:
     operator QPointF() const;
 #endif
 
+<<<<<<< HEAD:WebCore/platform/graphics/FloatPoint.h
 #if (PLATFORM(SKIA) || PLATFORM(SGL))
+=======
+#if PLATFORM(HAIKU)
+    FloatPoint(const BPoint&);
+    operator BPoint() const;
+#endif
+
+#if PLATFORM(SKIA)
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/FloatPoint.h
     operator SkPoint() const;
     FloatPoint(const SkPoint&);
 #endif
diff --git a/WebCore/platform/graphics/FloatRect.h b/WebCore/platform/graphics/FloatRect.h
index e906812..704241a 100644
--- a/WebCore/platform/graphics/FloatRect.h
+++ b/WebCore/platform/graphics/FloatRect.h
@@ -33,7 +33,7 @@
 typedef struct CGRect CGRect;
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGRect NSRect;
 #else
@@ -51,7 +51,15 @@ QT_END_NAMESPACE
 class wxRect2DDouble;
 #endif
 
+<<<<<<< HEAD:WebCore/platform/graphics/FloatRect.h
 #if (PLATFORM(SKIA) || PLATFORM(SGL))
+=======
+#if PLATFORM(HAIKU)
+class BRect;
+#endif
+
+#if PLATFORM(SKIA)
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/FloatRect.h
 struct SkRect;
 #endif
 
@@ -123,7 +131,8 @@ public:
     operator CGRect() const;
 #endif
 
-#if PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)
+#if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
+        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
     FloatRect(const NSRect&);
     operator NSRect() const;
 #endif
@@ -138,7 +147,16 @@ public:
     operator wxRect2DDouble() const;
 #endif
 
+<<<<<<< HEAD:WebCore/platform/graphics/FloatRect.h
 #if (PLATFORM(SKIA) || PLATFORM(SGL))
+=======
+#if PLATFORM(HAIKU)
+    FloatRect(const BRect&);
+    operator BRect() const;
+#endif
+
+#if PLATFORM(SKIA)
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/FloatRect.h
     FloatRect(const SkRect&);
     operator SkRect() const;
 #endif
diff --git a/WebCore/platform/graphics/FloatSize.h b/WebCore/platform/graphics/FloatSize.h
index 6e792b6..5a84fd1 100644
--- a/WebCore/platform/graphics/FloatSize.h
+++ b/WebCore/platform/graphics/FloatSize.h
@@ -34,7 +34,7 @@
 typedef struct CGSize CGSize;
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGSize NSSize;
 #else
@@ -79,7 +79,8 @@ public:
     operator CGSize() const;
 #endif
 
-#if PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)
+#if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
+        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
     explicit FloatSize(const NSSize &); // don't do this implicitly since it's lossy
     operator NSSize() const;
 #endif
diff --git a/WebCore/platform/graphics/FontCache.h b/WebCore/platform/graphics/FontCache.h
index 3c0f2d9..b88305f 100644
--- a/WebCore/platform/graphics/FontCache.h
+++ b/WebCore/platform/graphics/FontCache.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2008 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -63,7 +64,15 @@ public:
     // Also implemented by the platform.
     void platformInit();
 
-#if PLATFORM(WIN)
+#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if defined(IMLANG_FONT_LINK) && (IMLANG_FONT_LINK == 2)
+    IMLangFontLink2* getFontLinkInterface();
+#else
+    IMLangFontLink* getFontLinkInterface();
+#endif
+    static void comInitialize();
+    static void comUninitialize();
+#elif PLATFORM(WIN)
     IMLangFontLink2* getFontLinkInterface();
 #endif
 
diff --git a/WebCore/platform/graphics/FontDescription.h b/WebCore/platform/graphics/FontDescription.h
index c893b8a..fc63db9 100644
--- a/WebCore/platform/graphics/FontDescription.h
+++ b/WebCore/platform/graphics/FontDescription.h
@@ -27,7 +27,9 @@
 
 #include "FontFamily.h"
 #include "FontRenderingMode.h"
+#include "FontSmoothingMode.h"
 #include "FontTraitsMask.h"
+#include "TextRenderingMode.h"
 
 namespace WebCore {
 
@@ -61,6 +63,8 @@ public:
         , m_usePrinterFont(false)
         , m_renderingMode(NormalRenderingMode)
         , m_keywordSize(0)
+        , m_fontSmoothing(AutoSmoothing)
+        , m_textRendering(AutoTextRendering)
     {
     }
 
@@ -80,8 +84,12 @@ public:
     FontWeight bolderWeight() const;
     GenericFamilyType genericFamily() const { return static_cast<GenericFamilyType>(m_genericFamily); }
     bool usePrinterFont() const { return m_usePrinterFont; }
+    // only use fixed default size when there is only one font family, and that family is "monospace"
+    bool useFixedDefaultSize() const { return genericFamily() == MonospaceFamily && !family().next() && family().family() == "-webkit-monospace"; }
     FontRenderingMode renderingMode() const { return static_cast<FontRenderingMode>(m_renderingMode); }
     unsigned keywordSize() const { return m_keywordSize; }
+    FontSmoothingMode fontSmoothing() const { return static_cast<FontSmoothingMode>(m_fontSmoothing); }
+    TextRenderingMode textRenderingMode() const { return static_cast<TextRenderingMode>(m_textRendering); }
 
     FontTraitsMask traitsMask() const;
 
@@ -96,6 +104,8 @@ public:
     void setUsePrinterFont(bool p) { m_usePrinterFont = p; }
     void setRenderingMode(FontRenderingMode mode) { m_renderingMode = mode; }
     void setKeywordSize(unsigned s) { m_keywordSize = s; }
+    void setFontSmoothing(FontSmoothingMode smoothing) { m_fontSmoothing = smoothing; }
+    void setTextRenderingMode(TextRenderingMode rendering) { m_textRendering = rendering; }
 
 private:
     FontFamily m_familyList; // The list of font families to be used.
@@ -117,6 +127,9 @@ private:
     unsigned m_keywordSize : 4; // We cache whether or not a font is currently represented by a CSS keyword (e.g., medium).  If so,
                            // then we can accurately translate across different generic families to adjust for different preference settings
                            // (e.g., 13px monospace vs. 16px everything else).  Sizes are 1-8 (like the HTML size values for <font>).
+
+    unsigned m_fontSmoothing : 2; // FontSmoothingMode
+    unsigned m_textRendering : 2; // TextRenderingMode
 };
 
 inline bool FontDescription::operator==(const FontDescription& other) const
@@ -131,7 +144,9 @@ inline bool FontDescription::operator==(const FontDescription& other) const
         && m_genericFamily == other.m_genericFamily
         && m_usePrinterFont == other.m_usePrinterFont
         && m_renderingMode == other.m_renderingMode
-        && m_keywordSize == other.m_keywordSize;
+        && m_keywordSize == other.m_keywordSize
+        && m_fontSmoothing == other.m_fontSmoothing
+        && m_textRendering == other.m_textRendering;
 }
 
 }
diff --git a/WebCore/platform/graphics/FontFastPath.cpp b/WebCore/platform/graphics/FontFastPath.cpp
index b0e39db..5246593 100644
--- a/WebCore/platform/graphics/FontFastPath.cpp
+++ b/WebCore/platform/graphics/FontFastPath.cpp
@@ -251,6 +251,10 @@ bool Font::canUseGlyphCache(const TextRun& run) const
             return false;
     }
 
+    TextRenderingMode textMode = m_fontDescription.textRenderingMode();
+    if (textMode == OptimizeLegibility || textMode == GeometricPrecision)
+        return false;
+
     return true;
 
 }
diff --git a/WebCore/platform/graphics/FontSmoothingMode.h b/WebCore/platform/graphics/FontSmoothingMode.h
new file mode 100644
index 0000000..7c23394
--- /dev/null
+++ b/WebCore/platform/graphics/FontSmoothingMode.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef FontSmoothingMode_h
+#define FontSmoothingMode_h
+
+namespace WebCore {
+
+    enum FontSmoothingMode { AutoSmoothing, NoSmoothing, Antialiased, SubpixelAntialiased };
+    
+} // namespace WebCore
+
+#endif // FontSmoothingMode_h
diff --git a/WebCore/platform/graphics/GlyphPageTreeNode.cpp b/WebCore/platform/graphics/GlyphPageTreeNode.cpp
index 6419e0c..9f53f0b 100644
--- a/WebCore/platform/graphics/GlyphPageTreeNode.cpp
+++ b/WebCore/platform/graphics/GlyphPageTreeNode.cpp
@@ -202,8 +202,10 @@ void GlyphPageTreeNode::initializePage(const FontData* fontData, unsigned pageNu
                 GlyphPage* pageToFill = m_page.get();
                 for (unsigned i = 0; i < numRanges; i++) {
                     const FontDataRange& range = segmentedFontData->rangeAt(i);
-                    int from = max(0, range.from() - static_cast<int>(start));
-                    int to = 1 + min(range.to() - static_cast<int>(start), static_cast<int>(GlyphPage::size) - 1);
+                    // all this casting is to ensure all the parameters to min and max have the same type,
+                    // to avoid ambiguous template parameter errors on Windows
+                    int from = max(0, static_cast<int>(range.from()) - static_cast<int>(start));
+                    int to = 1 + min(static_cast<int>(range.to()) - static_cast<int>(start), static_cast<int>(GlyphPage::size) - 1);
                     if (from < static_cast<int>(GlyphPage::size) && to > 0) {
                         if (haveGlyphs && !scratchPage) {
                             scratchPage = GlyphPage::create(this);
diff --git a/WebCore/platform/graphics/GraphicsContext.cpp b/WebCore/platform/graphics/GraphicsContext.cpp
index a4e8408..ccdce08 100644
--- a/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/WebCore/platform/graphics/GraphicsContext.cpp
@@ -27,9 +27,9 @@
 #include "GraphicsContext.h"
 
 #include "BidiResolver.h"
+#include "Font.h"
 #include "Generator.h"
 #include "GraphicsContextPrivate.h"
-#include "Font.h"
 
 using namespace std;
 
@@ -89,7 +89,7 @@ void GraphicsContext::save()
         return;
 
     m_common->stack.append(m_common->state);
-    
+
     savePlatformState();
 }
 
@@ -104,7 +104,7 @@ void GraphicsContext::restore()
     }
     m_common->state = m_common->stack.last();
     m_common->stack.removeLast();
-    
+
     restorePlatformState();
 }
 
@@ -305,7 +305,7 @@ bool GraphicsContext::paintingDisabled() const
 }
 
 void GraphicsContext::drawImage(Image* image, const IntPoint& p, CompositeOperator op)
-{        
+{
     drawImage(image, p, IntRect(0, 0, -1, -1), op);
 }
 
@@ -329,7 +329,7 @@ void GraphicsContext::drawText(const Font& font, const TextRun& run, const IntPo
 {
     if (paintingDisabled())
         return;
-    
+
     font.drawText(this, run, point, from, to);
 }
 #endif
@@ -383,7 +383,7 @@ void GraphicsContext::initFocusRing(int width, int offset)
     if (paintingDisabled())
         return;
     clearFocusRing();
-    
+
     m_common->m_focusRingWidth = width;
     m_common->m_focusRingOffset = offset;
 }
@@ -396,12 +396,12 @@ void GraphicsContext::clearFocusRing()
 IntRect GraphicsContext::focusRingBoundingRect()
 {
     IntRect result = IntRect(0, 0, 0, 0);
-    
+
     const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
     for (unsigned i = 0; i < rectCount; i++)
         result.unite(rects[i]);
-        
+
     return result;
 }
 
@@ -436,7 +436,7 @@ void GraphicsContext::drawImage(Image* image, const FloatRect& dest, const Float
     float tsh = src.height();
     float tw = dest.width();
     float th = dest.height();
-        
+
     if (tsw == -1)
         tsw = image->width();
     if (tsh == -1)
@@ -540,10 +540,39 @@ void GraphicsContext::setPlatformTextDrawingMode(int mode)
 }
 #endif
 
-#if !PLATFORM(QT) && !PLATFORM(CAIRO) && !PLATFORM(SKIA)
+#if !PLATFORM(QT) && !PLATFORM(CAIRO) && !PLATFORM(SKIA) && !PLATFORM(HAIKU)
 void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle&)
 {
 }
 #endif
 
+void GraphicsContext::adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, const StrokeStyle& penStyle)
+{
+    // For odd widths, we add in 0.5 to the appropriate x/y so that the float arithmetic
+    // works out.  For example, with a border width of 3, WebKit will pass us (y1+y2)/2, e.g.,
+    // (50+53)/2 = 103/2 = 51 when we want 51.5.  It is always true that an even width gave
+    // us a perfect position, but an odd width gave us a position that is off by exactly 0.5.
+    if (penStyle == DottedStroke || penStyle == DashedStroke) {
+        if (p1.x() == p2.x()) {
+            p1.setY(p1.y() + strokeWidth);
+            p2.setY(p2.y() - strokeWidth);
+        } else {
+            p1.setX(p1.x() + strokeWidth);
+            p2.setX(p2.x() - strokeWidth);
+        }
+    }
+
+    if (static_cast<int>(strokeWidth) % 2) { //odd
+        if (p1.x() == p2.x()) {
+            // We're a vertical line.  Adjust our x.
+            p1.setX(p1.x() + 0.5f);
+            p2.setX(p2.x() + 0.5f);
+        } else {
+            // We're a horizontal line. Adjust our y.
+            p1.setY(p1.y() + 0.5f);
+            p2.setY(p2.y() + 0.5f);
+        }
+    }
+}
+
 }
diff --git a/WebCore/platform/graphics/GraphicsContext.h b/WebCore/platform/graphics/GraphicsContext.h
index 233c14c..b1d1ef9 100644
--- a/WebCore/platform/graphics/GraphicsContext.h
+++ b/WebCore/platform/graphics/GraphicsContext.h
@@ -55,8 +55,8 @@ struct SkPoint;
 class wxGCDC;
 class wxWindowDC;
 
-// wxGraphicsContext allows us to support Path, etc. 
-// but on some platforms, e.g. Linux, it requires fairly 
+// wxGraphicsContext allows us to support Path, etc.
+// but on some platforms, e.g. Linux, it requires fairly
 // new software.
 #if USE(WXGC)
 // On OS X, wxGCDC is just a typedef for wxDC, so use wxDC explicitly to make
@@ -72,6 +72,10 @@ class wxWindowDC;
 #endif
 #elif PLATFORM(SKIA)
 typedef class PlatformContextSkia PlatformGraphicsContext;
+#elif PLATFORM(HAIKU)
+class BView;
+typedef BView PlatformGraphicsContext;
+struct pattern;
 #elif PLATFORM(WINCE)
 typedef struct HDC__ PlatformGraphicsContext;
 #else
@@ -124,7 +128,7 @@ namespace WebCore {
     const int cTextFill = 1;
     const int cTextStroke = 2;
     const int cTextClip = 4;
-    
+
     enum StrokeStyle {
         NoStroke,
         SolidStroke,
@@ -132,12 +136,12 @@ namespace WebCore {
         DashedStroke
     };
 
-// FIXME: This is a place-holder until we decide to add
-// real color space support to WebCore.  At that time, ColorSpace will be a
-// class and instances will be held  off of Colors.   There will be
-// special singleton Gradient and Pattern color spaces to mark when
-// a fill or stroke is using a gradient or pattern instead of a solid color.
-// https://bugs.webkit.org/show_bug.cgi?id=20558
+    // FIXME: This is a place-holder until we decide to add
+    // real color space support to WebCore.  At that time, ColorSpace will be a
+    // class and instances will be held  off of Colors.   There will be
+    // special singleton Gradient and Pattern color spaces to mark when
+    // a fill or stroke is using a gradient or pattern instead of a solid color.
+    // https://bugs.webkit.org/show_bug.cgi?id=20558
     enum ColorSpace {
         SolidColorSpace,
         PatternColorSpace,
@@ -156,11 +160,11 @@ namespace WebCore {
     public:
         GraphicsContext(PlatformGraphicsContext*);
         ~GraphicsContext();
-       
+
 #if !PLATFORM(WINCE) || PLATFORM(QT)
         PlatformGraphicsContext* platformContext() const;
 #endif
-        
+
         float strokeThickness() const;
         void setStrokeThickness(float);
         StrokeStyle strokeStyle() const;
@@ -267,7 +271,7 @@ namespace WebCore {
                        CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
         void drawTiledImage(Image*, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize,
                        CompositeOperator = CompositeSourceOver);
-        void drawTiledImage(Image*, const IntRect& destRect, const IntRect& srcRect, 
+        void drawTiledImage(Image*, const IntRect& destRect, const IntRect& srcRect,
                             Image::TileRule hRule = Image::StretchTile, Image::TileRule vRule = Image::StretchTile,
                             CompositeOperator = CompositeSourceOver);
 
@@ -291,13 +295,13 @@ namespace WebCore {
         void drawHighlightForText(const Font&, const TextRun&, const IntPoint&, int h, const Color& backgroundColor, int from = 0, int to = -1);
 
         FloatRect roundToDevicePixels(const FloatRect&);
-        
+
         void drawLineForText(const IntPoint&, int width, bool printing);
         void drawLineForMisspellingOrBadGrammar(const IntPoint&, int width, bool grammar);
-        
+
         bool paintingDisabled() const;
         void setPaintingDisabled(bool);
-        
+
         bool updatingControlTints() const;
         void setUpdatingControlTints(bool);
 
@@ -336,7 +340,7 @@ namespace WebCore {
         void rotate(float angleInRadians);
         void translate(float x, float y);
         IntPoint origin();
-        
+
         void setURLForRect(const KURL&, const IntRect&);
 
         void concatCTM(const TransformationMatrix&);
@@ -418,6 +422,10 @@ namespace WebCore {
         GdkEventExpose* gdkExposeEvent() const;
 #endif
 
+#if PLATFORM(HAIKU)
+        pattern getHaikuStrokeStyle();
+#endif
+
     private:
         void savePlatformState();
         void restorePlatformState();
@@ -440,6 +448,8 @@ namespace WebCore {
         void setPlatformShadow(const IntSize&, int blur, const Color&);
         void clearPlatformShadow();
 
+        static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, const StrokeStyle&);
+
         int focusRingWidth() const;
         int focusRingOffset() const;
         const Vector<IntRect>& focusRingRects() const;
diff --git a/WebCore/platform/graphics/GraphicsContext3D.h b/WebCore/platform/graphics/GraphicsContext3D.h
new file mode 100644
index 0000000..5223e05
--- /dev/null
+++ b/WebCore/platform/graphics/GraphicsContext3D.h
@@ -0,0 +1,335 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GraphicsContext3D_h
+#define GraphicsContext3D_h
+
+#include "PlatformString.h"
+
+#include <wtf/Noncopyable.h>
+
+#if PLATFORM(MAC)
+#include <OpenGL/OpenGL.h>
+
+typedef void* PlatformGraphicsContext3D;
+const  PlatformGraphicsContext3D NullPlatformGraphicsContext3D = 0;
+typedef GLuint Platform3DObject;
+const Platform3DObject NullPlatform3DObject = 0;
+#else
+typedef void* PlatformGraphicsContext3D;
+const  PlatformGraphicsContext3D NullPlatformGraphicsContext3D = 0;
+typedef int Platform3DObject;
+const Platform3DObject NullPlatform3DObject = 0;
+#endif
+
+namespace WebCore {
+    class CanvasArray;
+    class CanvasBuffer;
+    class CanvasUnsignedByteArray;
+    class CanvasFloatArray;
+    class CanvasFramebuffer;
+    class CanvasIntArray;
+    class CanvasProgram;
+    class CanvasRenderbuffer;
+    class CanvasRenderingContext3D;
+    class CanvasShader;
+    class CanvasTexture;
+    class HTMLCanvasElement;
+    class HTMLImageElement;
+    class HTMLVideoElement;
+    class ImageData;
+    class WebKitCSSMatrix;
+    
+    // FIXME: ideally this would be used on all platforms.
+#if PLATFORM(CHROMIUM)
+    class GraphicsContext3DInternal;
+#endif
+
+    class GraphicsContext3D : Noncopyable {
+    public:
+        enum ShaderType { FRAGMENT_SHADER, VERTEX_SHADER };
+    
+        GraphicsContext3D();
+        virtual ~GraphicsContext3D();
+
+#if PLATFORM(MAC)
+        PlatformGraphicsContext3D platformGraphicsContext3D() const { return m_contextObj; }
+        Platform3DObject platformTexture() const { return m_texture; }
+#elif PLATFORM(CHROMIUM)
+        PlatformGraphicsContext3D platformGraphicsContext3D() const;
+        Platform3DObject platformTexture() const;
+#else
+        PlatformGraphicsContext3D platformGraphicsContext3D() const { return NullPlatformGraphicsContext3D; }
+        Platform3DObject platformTexture() const { return NullPlatform3DObject; }
+#endif
+        void checkError() const;
+        
+        void makeContextCurrent();
+        
+        // Helper to return the size in bytes of OpenGL data types
+        // like GL_FLOAT, GL_INT, etc.
+        int sizeInBytes(int type);
+
+        void activeTexture(unsigned long texture);
+        void attachShader(CanvasProgram* program, CanvasShader* shader);
+        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
+        void bindBuffer(unsigned long target, CanvasBuffer*);
+        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
+        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
+        void bindTexture(unsigned long target, CanvasTexture* texture);
+        void blendColor(double red, double green, double blue, double alpha);
+        void blendEquation(unsigned long mode);
+        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
+        void blendFunc(unsigned long sfactor, unsigned long dfactor);
+        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
+
+        void bufferData(unsigned long target, int size, unsigned long usage);
+        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
+        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
+
+        unsigned long checkFramebufferStatus(unsigned long target);
+        void clear(unsigned long mask);
+        void clearColor(double red, double green, double blue, double alpha);
+        void clearDepth(double depth);
+        void clearStencil(long s);
+        void colorMask(bool red, bool green, bool blue, bool alpha);
+        void compileShader(CanvasShader*);
+        
+        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
+        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
+        
+        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
+        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
+        void cullFace(unsigned long mode);
+        void depthFunc(unsigned long func);
+        void depthMask(bool flag);
+        void depthRange(double zNear, double zFar);
+        void detachShader(CanvasProgram*, CanvasShader*);
+        void disable(unsigned long cap);
+        void disableVertexAttribArray(unsigned long index);
+        void drawArrays(unsigned long mode, long first, long count);
+        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset);
+
+        void enable(unsigned long cap);
+        void enableVertexAttribArray(unsigned long index);
+        void finish();
+        void flush();
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
+        void frontFace(unsigned long mode);
+        void generateMipmap(unsigned long target);
+
+        int  getAttribLocation(CanvasProgram*, const String& name);
+
+        bool getBoolean(unsigned long pname);
+        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
+        int getBufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
+
+        unsigned long getError();
+
+        float getFloat(unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
+        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
+        int getInteger(unsigned long pname);
+        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
+        int getProgrami(CanvasProgram*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
+        String getProgramInfoLog(CanvasProgram*);
+        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
+        int getShaderi(CanvasShader*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
+
+        String getShaderInfoLog(CanvasShader*);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        String getShaderSource(CanvasShader*);
+        String getString(unsigned long name);
+        
+        float getTexParameterf(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
+        int getTexParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
+
+        float getUniformf(CanvasProgram* program, long location);
+        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
+        int getUniformi(CanvasProgram* program, long location);
+        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
+
+        long getUniformLocation(CanvasProgram*, const String& name);
+
+        float getVertexAttribf(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
+        int getVertexAttribi(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
+        
+        long getVertexAttribOffset(unsigned long index, unsigned long pname);
+
+        void hint(unsigned long target, unsigned long mode);
+        bool isBuffer(CanvasBuffer*);
+        bool isEnabled(unsigned long cap);
+        bool isFramebuffer(CanvasFramebuffer*);
+        bool isProgram(CanvasProgram*);
+        bool isRenderbuffer(CanvasRenderbuffer*);
+        bool isShader(CanvasShader*);
+        bool isTexture(CanvasTexture*);
+        void lineWidth(double);
+        void linkProgram(CanvasProgram*);
+        void pixelStorei(unsigned long pname, long param);
+        void polygonOffset(double factor, double units);
+        
+        // TBD
+        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        
+        void releaseShaderCompiler();
+        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
+        void sampleCoverage(double value, bool invert);
+        void scissor(long x, long y, unsigned long width, unsigned long height);
+        void shaderSource(CanvasShader*, const String& string);
+        void stencilFunc(unsigned long func, long ref, unsigned long mask);
+        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
+        void stencilMask(unsigned long mask);
+        void stencilMaskSeparate(unsigned long face, unsigned long mask);
+        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
+        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
+
+        // These next several functions return an error code (0 if no errors) rather than using an ExceptionCode.
+        // Currently they return -1 on any error.
+        int texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                       unsigned width, unsigned height, unsigned border,
+                       unsigned format, unsigned type, CanvasArray* pixels);
+        int texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                       unsigned width, unsigned height, unsigned border,
+                       unsigned format, unsigned type, ImageData* pixels);
+        int texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                       bool flipY, bool premultiplyAlpha);
+        int texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                       bool flipY, bool premultiplyAlpha);
+        int texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                       bool flipY, bool premultiplyAlpha);
+
+        void texParameterf(unsigned target, unsigned pname, float param);
+        void texParameteri(unsigned target, unsigned pname, int param);
+
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height,
+                          unsigned format, unsigned type, CanvasArray* pixels);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height,
+                          unsigned format, unsigned type, ImageData* pixels);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height, HTMLImageElement* image,
+                          bool flipY, bool premultiplyAlpha);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                          bool flipY, bool premultiplyAlpha);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height, HTMLVideoElement* video,
+                          bool flipY, bool premultiplyAlpha);
+
+        void uniform1f(long location, float x);
+        void uniform1fv(long location, float* v, int size);
+        void uniform1i(long location, int x);
+        void uniform1iv(long location, int* v, int size);
+        void uniform2f(long location, float x, float y);
+        void uniform2fv(long location, float* v, int size);
+        void uniform2i(long location, int x, int y);
+        void uniform2iv(long location, int* v, int size);
+        void uniform3f(long location, float x, float y, float z);
+        void uniform3fv(long location, float* v, int size);
+        void uniform3i(long location, int x, int y, int z);
+        void uniform3iv(long location, int* v, int size);
+        void uniform4f(long location, float x, float y, float z, float w);
+        void uniform4fv(long location, float* v, int size);
+        void uniform4i(long location, int x, int y, int z, int w);
+        void uniform4iv(long location, int* v, int size);
+        void uniformMatrix2fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix3fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix4fv(long location, bool transpose, float* value, int size);
+
+        void useProgram(CanvasProgram*);
+        void validateProgram(CanvasProgram*);
+
+        void vertexAttrib1f(unsigned long indx, float x);
+        void vertexAttrib1fv(unsigned long indx, float* values);
+        void vertexAttrib2f(unsigned long indx, float x, float y);
+        void vertexAttrib2fv(unsigned long indx, float* values);
+        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
+        void vertexAttrib3fv(unsigned long indx, float* values);
+        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
+        void vertexAttrib4fv(unsigned long indx, float* values);
+        void vertexAttribPointer(unsigned long indx, int size, int type, bool normalized,
+                                 unsigned long stride, unsigned long offset);
+
+        void viewport(long x, long y, unsigned long width, unsigned long height);
+
+        void reshape(int width, int height);
+        
+        // Helpers for notification about paint events
+        void beginPaint(CanvasRenderingContext3D* context);
+        void endPaint();
+
+        // Support for buffer creation and deletion
+        unsigned createBuffer();
+        unsigned createFramebuffer();
+        unsigned createProgram();
+        unsigned createRenderbuffer();
+        unsigned createShader(ShaderType);
+        unsigned createTexture();
+        
+        void deleteBuffer(unsigned);
+        void deleteFramebuffer(unsigned);
+        void deleteProgram(unsigned);
+        void deleteRenderbuffer(unsigned);
+        void deleteShader(unsigned);
+        void deleteTexture(unsigned);        
+        
+    private:        
+        int m_currentWidth, m_currentHeight;
+        
+#if PLATFORM(MAC)
+        Vector<Vector<float> > m_vertexArray;
+        
+        CGLContextObj m_contextObj;
+        GLuint m_texture;
+        GLuint m_fbo;
+        GLuint m_depthBuffer;
+#endif        
+
+        // FIXME: ideally this would be used on all platforms.
+#if PLATFORM(CHROMIUM)
+        friend class GraphicsContext3DInternal;
+        OwnPtr<GraphicsContext3DInternal> m_internal;
+#endif
+    };
+
+} // namespace WebCore
+
+#endif // GraphicsContext3D_h
+
diff --git a/WebCore/platform/graphics/GraphicsLayer.cpp b/WebCore/platform/graphics/GraphicsLayer.cpp
index 7d43832..b375bd3 100644
--- a/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -69,10 +69,11 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
     , m_usingTiledLayer(false)
     , m_masksToBounds(false)
     , m_drawsContent(false)
-    , m_paintingPhase(GraphicsLayerPaintAllMask)
+    , m_paintingPhase(GraphicsLayerPaintAll)
     , m_geometryOrientation(CompositingCoordinatesTopDown)
     , m_contentsOrientation(CompositingCoordinatesTopDown)
     , m_parent(0)
+    , m_maskLayer(0)
 #ifndef NDEBUG
     , m_repaintCount(0)
 #endif
diff --git a/WebCore/platform/graphics/GraphicsLayer.h b/WebCore/platform/graphics/GraphicsLayer.h
index 4d7668a..2924073 100644
--- a/WebCore/platform/graphics/GraphicsLayer.h
+++ b/WebCore/platform/graphics/GraphicsLayer.h
@@ -33,11 +33,15 @@
 #include "FloatPoint.h"
 #include "FloatPoint3D.h"
 #include "FloatSize.h"
+#if ENABLE(3D_CANVAS)
+#include "GraphicsContext3D.h"
+#endif
 #include "GraphicsLayerClient.h"
 #include "IntRect.h"
 #include "TransformationMatrix.h"
 #include "TransformOperations.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
 #ifdef __OBJC__
@@ -152,7 +156,7 @@ protected:
 class GraphicsLayer {
 public:
 
-    static GraphicsLayer* createGraphicsLayer(GraphicsLayerClient*);
+    static PassOwnPtr<GraphicsLayer> create(GraphicsLayerClient*);
     
     virtual ~GraphicsLayer();
 
@@ -180,6 +184,9 @@ public:
     void removeAllChildren();
     virtual void removeFromParent();
 
+    GraphicsLayer* maskLayer() const { return m_maskLayer; }
+    virtual void setMaskLayer(GraphicsLayer* layer) { m_maskLayer = layer; }
+    
     // Offset is origin of the renderer minus origin of the graphics layer (so either zero or negative).
     IntSize offsetFromRenderer() const { return m_offsetFromRenderer; }
     void setOffsetFromRenderer(const IntSize& offset) { m_offsetFromRenderer = offset; }
@@ -229,8 +236,8 @@ public:
     virtual void setOpacity(float opacity) { m_opacity = opacity; }
 
     // Some GraphicsLayers paint only the foreground or the background content
-    GraphicsLayerPaintingPhase drawingPhase() const { return m_paintingPhase; }
-    void setDrawingPhase(GraphicsLayerPaintingPhase phase) { m_paintingPhase = phase; }
+    GraphicsLayerPaintingPhase paintingPhase() const { return m_paintingPhase; }
+    void setPaintingPhase(GraphicsLayerPaintingPhase phase) { m_paintingPhase = phase; }
 
     virtual void setNeedsDisplay() = 0;
     // mark the given rect (in layer coords) as needing dispay. Never goes deep.
@@ -255,6 +262,10 @@ public:
     virtual void setContentsToVideo(PlatformLayer*) { }
     virtual void setContentsBackgroundColor(const Color&) { }
     
+#if ENABLE(3D_CANVAS)
+    virtual void setContentsToGraphicsContext3D(const GraphicsContext3D*) { }
+    virtual void setGraphicsContext3DNeedsDisplay() { }
+#endif
     // Callback from the underlying graphics system to draw layer contents.
     void paintGraphicsLayerContents(GraphicsContext&, const IntRect& clip);
     
@@ -347,6 +358,8 @@ protected:
     Vector<GraphicsLayer*> m_children;
     GraphicsLayer* m_parent;
 
+    GraphicsLayer* m_maskLayer; // Reference to mask layer. We don't own this.
+
     IntRect m_contentsRect;
 
 #ifndef NDEBUG
diff --git a/WebCore/platform/graphics/GraphicsLayerClient.h b/WebCore/platform/graphics/GraphicsLayerClient.h
index 8c0b7ed..5facc94 100644
--- a/WebCore/platform/graphics/GraphicsLayerClient.h
+++ b/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -37,9 +37,10 @@ class IntRect;
 class FloatPoint;
 
 enum GraphicsLayerPaintingPhase {
-    GraphicsLayerPaintBackgroundMask = (1 << 0),
-    GraphicsLayerPaintForegroundMask = (1 << 1),
-    GraphicsLayerPaintAllMask = (GraphicsLayerPaintBackgroundMask | GraphicsLayerPaintForegroundMask)
+    GraphicsLayerPaintBackground = (1 << 0),
+    GraphicsLayerPaintForeground = (1 << 1),
+    GraphicsLayerPaintMask = (1 << 2),
+    GraphicsLayerPaintAll = (GraphicsLayerPaintBackground | GraphicsLayerPaintForeground | GraphicsLayerPaintMask)
 };
 
 enum AnimatedPropertyID {
diff --git a/WebCore/platform/graphics/ImageBuffer.h b/WebCore/platform/graphics/ImageBuffer.h
index 2a96d3b..9432058 100644
--- a/WebCore/platform/graphics/ImageBuffer.h
+++ b/WebCore/platform/graphics/ImageBuffer.h
@@ -50,6 +50,11 @@ namespace WebCore {
         LinearRGB
     };
 
+    enum Multiply {
+        Premultiplied,
+        Unmultiplied
+    };
+
     class ImageBuffer : public Noncopyable {
     public:
         // Will return a null pointer on allocation failure.
@@ -71,8 +76,11 @@ namespace WebCore {
 
         void clearImage() { m_image.clear(); }
 
-        PassRefPtr<ImageData> getImageData(const IntRect& rect) const;
-        void putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint);
+        PassRefPtr<ImageData> getUnmultipliedImageData(const IntRect&) const;
+        PassRefPtr<ImageData> getPremultipliedImageData(const IntRect&) const;
+
+        void putUnmultipliedImageData(ImageData*, const IntRect& sourceRect, const IntPoint& destPoint);
+        void putPremultipliedImageData(ImageData*, const IntRect& sourceRect, const IntPoint& destPoint);
 
         String toDataURL(const String& mimeType) const;
 #if !PLATFORM(CG)
diff --git a/WebCore/platform/graphics/cairo/ImageSourceCairo.cpp b/WebCore/platform/graphics/ImageSource.cpp
index df62618..bf7ae21 100644
--- a/WebCore/platform/graphics/cairo/ImageSourceCairo.cpp
+++ b/WebCore/platform/graphics/ImageSource.cpp
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp.toker@collabora.co.uk>
+ * Copyright (C) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,64 +29,20 @@
 #include "config.h"
 #include "ImageSource.h"
 
-#if PLATFORM(CAIRO)
+#if PLATFORM(QT)
+#include "ImageDecoderQt.h"
+#else
+#include "ImageDecoder.h"
+#endif
 
-#include "BMPImageDecoder.h"
-#include "GIFImageDecoder.h"
-#include "ICOImageDecoder.h"
-#include "JPEGImageDecoder.h"
-#include "PNGImageDecoder.h"
-#include "XBMImageDecoder.h"
-#include "SharedBuffer.h"
-#include <cairo.h>
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+#ifndef IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS
+#define IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS (1024 * 1024)
+#endif
+#endif
 
 namespace WebCore {
 
-ImageDecoder* createDecoder(const Vector<char>& data)
-{
-    // We need at least 4 bytes to figure out what kind of image we're dealing with.
-    int length = data.size();
-    if (length < 4)
-        return 0;
-
-    const unsigned char* uContents = (const unsigned char*)data.data();
-    const char* contents = data.data();
-
-    // GIFs begin with GIF8(7 or 9).
-    if (strncmp(contents, "GIF8", 4) == 0)
-        return new GIFImageDecoder();
-
-    // Test for PNG.
-    if (uContents[0]==0x89 &&
-        uContents[1]==0x50 &&
-        uContents[2]==0x4E &&
-        uContents[3]==0x47)
-        return new PNGImageDecoder();
-
-    // JPEG
-    if (uContents[0]==0xFF &&
-        uContents[1]==0xD8 &&
-        uContents[2]==0xFF)
-        return new JPEGImageDecoder();
-
-    // BMP
-    if (strncmp(contents, "BM", 2) == 0)
-        return new BMPImageDecoder();
-
-    // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
-    // CURs begin with 2-byte 0 followed by 2-byte 2.
-    if (!memcmp(contents, "\000\000\001\000", 4) ||
-        !memcmp(contents, "\000\000\002\000", 4))
-        return new ICOImageDecoder();
-
-    // XBMs require 8 bytes of info.
-    if (length >= 8 && strncmp(contents, "#define ", 8) == 0)
-        return new XBMImageDecoder();
-
-    // Give up. We don't know what the heck this is.
-    return 0;
-}
-
 ImageSource::ImageSource()
     : m_decoder(0)
 {
@@ -120,53 +78,41 @@ void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
     // This method will examine the data and instantiate an instance of the appropriate decoder plugin.
     // If insufficient bytes are available to determine the image type, no decoder plugin will be
     // made.
-    if (!m_decoder)
-        m_decoder = createDecoder(data->buffer());
-
-    if (!m_decoder)
-        return;
+    if (!m_decoder) {
+        m_decoder = static_cast<NativeImageSourcePtr>(ImageDecoder::create(*data));
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        if (m_decoder)
+            m_decoder->setMaxNumPixels(IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS);
+#endif
+    }
 
-    m_decoder->setData(data, allDataReceived);
+    if (m_decoder)
+        m_decoder->setData(data, allDataReceived);
 }
 
 String ImageSource::filenameExtension() const
 {
-    if (!m_decoder)
-        return String();
-
-    return m_decoder->filenameExtension();
+    return m_decoder ? m_decoder->filenameExtension() : String();
 }
 
 bool ImageSource::isSizeAvailable()
 {
-    if (!m_decoder)
-        return false;
-
-    return m_decoder->isSizeAvailable();
+    return m_decoder && m_decoder->isSizeAvailable();
 }
 
 IntSize ImageSource::size() const
 {
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->size();
+    return m_decoder ? m_decoder->size() : IntSize();
 }
 
 IntSize ImageSource::frameSizeAtIndex(size_t index) const
 {
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->frameSizeAtIndex(index);
+    return m_decoder ? m_decoder->frameSizeAtIndex(index) : IntSize();
 }
 
 int ImageSource::repetitionCount()
 {
-    if (!m_decoder)
-        return cAnimationNone;
-
-    return m_decoder->repetitionCount();
+    return m_decoder ? m_decoder->repetitionCount() : cAnimationNone;
 }
 
 size_t ImageSource::frameCount() const
@@ -176,9 +122,6 @@ size_t ImageSource::frameCount() const
 
 NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
 {
-    if (!initialized())
-        return 0;
-
     if (!m_decoder)
         return 0;
 
@@ -186,23 +129,16 @@ NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
     if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
         return 0;
 
-    // Cairo does not like zero height images.
-    // If we have a zero height image, just pretend we don't have enough data yet.
-    if (!size().height())
+    // Zero-height images can cause problems for some ports.  If we have an
+    // empty image dimension, just bail.
+    if (size().isEmpty())
         return 0;
 
+    // Return the buffer contents as a native image.  For some ports, the data
+    // is already in a native container, and this just increments its refcount.
     return buffer->asNewNativeImage();
 }
 
-bool ImageSource::frameIsCompleteAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return false;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    return buffer && buffer->status() == RGBA32Buffer::FrameComplete;
-}
-
 float ImageSource::frameDurationAtIndex(size_t index)
 {
     if (!m_decoder)
@@ -223,17 +159,23 @@ float ImageSource::frameDurationAtIndex(size_t index)
 
 bool ImageSource::frameHasAlphaAtIndex(size_t index)
 {
-    // When a frame has not finished decoding, always mark it as having alpha,
-    // so we don't get a black background for the undecoded sections.
-    // TODO: A better solution is probably to have the underlying buffer's
-    // hasAlpha() return true in these cases, since it is, in fact, technically
-    // true.
-    if (!frameIsCompleteAtIndex(index))
-        return true;
-
-    return m_decoder->frameBufferAtIndex(index)->hasAlpha();
+    // When a frame has not finished decoding, always mark it as having alpha.
+    // Ports that check the result of this function to determine their
+    // compositing op need this in order to not draw the undecoded portion as
+    // black.
+    // TODO: Perhaps we should ensure that each individual decoder returns true
+    // in this case.
+    return !frameIsCompleteAtIndex(index)
+        || m_decoder->frameBufferAtIndex(index)->hasAlpha();
 }
 
+bool ImageSource::frameIsCompleteAtIndex(size_t index)
+{
+    if (!m_decoder)
+        return false;
+
+    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
+    return buffer && buffer->status() == RGBA32Buffer::FrameComplete;
 }
 
-#endif // PLATFORM(CAIRO)
+}
diff --git a/WebCore/platform/graphics/ImageSource.h b/WebCore/platform/graphics/ImageSource.h
index 173d50b..eabeeab 100644
--- a/WebCore/platform/graphics/ImageSource.h
+++ b/WebCore/platform/graphics/ImageSource.h
@@ -51,6 +51,8 @@ class SkBitmapRef;
 class PrivateAndroidImageSourceRec;
 #elif PLATFORM(SKIA)
 class NativeImageSkia;
+#elif PLATFORM(HAIKU)
+class BBitmap;
 #elif PLATFORM(WINCE)
 #include "SharedBitmap.h"
 #endif
@@ -61,22 +63,14 @@ class IntSize;
 class SharedBuffer;
 class String;
 
-#if PLATFORM(WX)
-class ImageDecoder;
-typedef ImageDecoder* NativeImageSourcePtr;
-typedef const Vector<char>* NativeBytePtr;
-#if USE(WXGC)
-typedef wxGraphicsBitmap* NativeImagePtr;
-#else
-typedef wxBitmap* NativeImagePtr;
-#endif
-#elif PLATFORM(CG)
+#if PLATFORM(CG)
 typedef CGImageSourceRef NativeImageSourcePtr;
 typedef CGImageRef NativeImagePtr;
 #elif PLATFORM(QT)
 class ImageDecoderQt;
 typedef ImageDecoderQt* NativeImageSourcePtr;
 typedef QPixmap* NativeImagePtr;
+<<<<<<< HEAD:WebCore/platform/graphics/ImageSource.h
 #elif PLATFORM(ANDROID)
 #if PLATFORM(SGL)
 class String;
@@ -98,18 +92,27 @@ typedef ImageDecoder* NativeImageSourcePtr;
 typedef NativeImageSkia* NativeImagePtr;
 #endif
 #elif PLATFORM(CAIRO)
+=======
+#else
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/ImageSource.h
 class ImageDecoder;
 typedef ImageDecoder* NativeImageSourcePtr;
+#if PLATFORM(WX)
+#if USE(WXGC)
+typedef wxGraphicsBitmap* NativeImagePtr;
+#else
+typedef wxBitmap* NativeImagePtr;
+#endif
+#elif PLATFORM(CAIRO)
 typedef cairo_surface_t* NativeImagePtr;
 #elif PLATFORM(SKIA)
-class ImageDecoder;
-typedef ImageDecoder* NativeImageSourcePtr;
 typedef NativeImageSkia* NativeImagePtr;
+#elif PLATFORM(HAIKU)
+typedef BBitmap* NativeImagePtr;
 #elif PLATFORM(WINCE)
-class ImageDecoder;
-typedef ImageDecoder* NativeImageSourcePtr;
 typedef RefPtr<SharedBitmap> NativeImagePtr;
 #endif
+#endif
 
 const int cAnimationLoopOnce = -1;
 const int cAnimationNone = -2;
diff --git a/WebCore/platform/graphics/IntPoint.h b/WebCore/platform/graphics/IntPoint.h
index e6d4816..afbfb46 100644
--- a/WebCore/platform/graphics/IntPoint.h
+++ b/WebCore/platform/graphics/IntPoint.h
@@ -55,6 +55,8 @@ class QPoint;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 typedef struct _GdkPoint GdkPoint;
+#elif PLATFORM(HAIKU)
+class BPoint;
 #endif
 
 #if PLATFORM(WX)
@@ -121,6 +123,9 @@ public:
 #elif PLATFORM(GTK)
     IntPoint(const GdkPoint&);
     operator GdkPoint() const;
+#elif PLATFORM(HAIKU)
+    explicit IntPoint(const BPoint&);
+    operator BPoint() const;
 #endif
 
 #if PLATFORM(WX)
diff --git a/WebCore/platform/graphics/IntRect.h b/WebCore/platform/graphics/IntRect.h
index 0b607f5..cd912ff 100644
--- a/WebCore/platform/graphics/IntRect.h
+++ b/WebCore/platform/graphics/IntRect.h
@@ -33,7 +33,7 @@
 typedef struct CGRect CGRect;
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGRect NSRect;
 #else
@@ -49,6 +49,8 @@ class QRect;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 typedef struct _GdkRectangle GdkRectangle;
+#elif PLATFORM(HAIKU)
+class BRect;
 #endif
 
 #if PLATFORM(WX)
@@ -144,6 +146,9 @@ public:
 #elif PLATFORM(GTK)
     IntRect(const GdkRectangle&);
     operator GdkRectangle() const;
+#elif PLATFORM(HAIKU)
+    explicit IntRect(const BRect&);
+    operator BRect() const;
 #endif
 
 #if PLATFORM(CG)
@@ -156,7 +161,8 @@ public:
     operator SkIRect() const;
 #endif
 
-#if PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)
+#if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
+        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
     operator NSRect() const;
 #endif
 
@@ -193,7 +199,8 @@ inline bool operator!=(const IntRect& a, const IntRect& b)
 IntRect enclosingIntRect(const CGRect&);
 #endif
 
-#if PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)
+#if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
+        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 IntRect enclosingIntRect(const NSRect&);
 #endif
 
diff --git a/WebCore/platform/graphics/IntSize.h b/WebCore/platform/graphics/IntSize.h
index dc7a85d..b242784 100644
--- a/WebCore/platform/graphics/IntSize.h
+++ b/WebCore/platform/graphics/IntSize.h
@@ -47,6 +47,12 @@ typedef struct tagSIZE SIZE;
 QT_BEGIN_NAMESPACE
 class QSize;
 QT_END_NAMESPACE
+#elif PLATFORM(HAIKU)
+class BSize;
+#endif
+
+#if PLATFORM(WX)
+class wxSize;
 #endif
 
 namespace WebCore {
@@ -113,6 +119,15 @@ public:
     operator QSize() const;
 #endif
 
+#if PLATFORM(HAIKU)
+    explicit IntSize(const BSize&);
+    operator BSize() const;
+#endif
+
+#if PLATFORM(WX)
+    IntSize(const wxSize&);
+    operator wxSize() const;
+#endif
 
 private:
     int m_width, m_height;
diff --git a/WebCore/platform/graphics/MediaPlayer.cpp b/WebCore/platform/graphics/MediaPlayer.cpp
index 8792640..3898386 100644
--- a/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/WebCore/platform/graphics/MediaPlayer.cpp
@@ -35,10 +35,11 @@
 #include "FrameView.h"
 #include "Frame.h"
 #include "Document.h"
+#include "TimeRanges.h"
 
 #if PLATFORM(MAC)
 #include "MediaPlayerPrivateQTKit.h"
-#elif PLATFORM(WINCE)
+#elif PLATFORM(WINCE) && !PLATFORM(QT)
 #include "MediaPlayerPrivateWince.h"
 #elif PLATFORM(WIN)
 #include "MediaPlayerPrivateQuickTimeWin.h"
@@ -67,11 +68,12 @@ public:
     virtual void play() { }
     virtual void pause() { }    
 
-    virtual bool supportsFullscreen() const { return false; }
+    virtual PlatformMedia platformMedia() const { return NoPlatformMedia; }
 
     virtual IntSize naturalSize() const { return IntSize(0, 0); }
 
     virtual bool hasVideo() const { return false; }
+    virtual bool hasAudio() const { return false; }
 
     virtual void setVisible(bool) { }
 
@@ -93,7 +95,7 @@ public:
     virtual MediaPlayer::ReadyState readyState() const { return MediaPlayer::HaveNothing; }
 
     virtual float maxTimeSeekable() const { return 0; }
-    virtual float maxTimeBuffered() const { return 0; }
+    virtual PassRefPtr<TimeRanges> buffered() const { return TimeRanges::create(); }
 
     virtual int dataRate() const { return 0; }
 
@@ -260,11 +262,19 @@ bool MediaPlayer::canLoadPoster() const
 {
     return m_private->canLoadPoster();
 }
+<<<<<<< HEAD:WebCore/platform/graphics/MediaPlayer.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/MediaPlayer.cpp
 void MediaPlayer::setPoster(const String& url)
 {
     m_private->setPoster(url);
+<<<<<<< HEAD:WebCore/platform/graphics/MediaPlayer.cpp
 }
+=======
+}    
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/MediaPlayer.cpp
 
 void MediaPlayer::cancelLoad()
 {
@@ -275,7 +285,11 @@ void MediaPlayer::prepareToPlay()
 {
     m_private->prepareToPlay();
 }
+<<<<<<< HEAD:WebCore/platform/graphics/MediaPlayer.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/MediaPlayer.cpp
 void MediaPlayer::play()
 {
     m_private->play();
@@ -331,11 +345,16 @@ IntSize MediaPlayer::naturalSize()
     return m_private->naturalSize();
 }
 
-bool MediaPlayer::hasVideo()
+bool MediaPlayer::hasVideo() const
 {
     return m_private->hasVideo();
 }
 
+bool MediaPlayer::hasAudio() const
+{
+    return m_private->hasAudio();
+}
+
 bool MediaPlayer::inMediaDocument()
 {
     Frame* frame = m_frameView ? m_frameView->frame() : 0;
@@ -344,6 +363,11 @@ bool MediaPlayer::inMediaDocument()
     return document && document->isMediaDocument();
 }
 
+PlatformMedia MediaPlayer::platformMedia() const
+{
+    return m_private->platformMedia();
+}
+
 MediaPlayer::NetworkState MediaPlayer::networkState()
 {
     return m_private->networkState();
@@ -397,9 +421,9 @@ void MediaPlayer::setEndTime(float time)
     m_private->setEndTime(time);
 }
 
-float MediaPlayer::maxTimeBuffered()
+PassRefPtr<TimeRanges> MediaPlayer::buffered()
 {
-    return m_private->maxTimeBuffered();
+    return m_private->buffered();
 }
 
 float MediaPlayer::maxTimeSeekable()
diff --git a/WebCore/platform/graphics/MediaPlayer.h b/WebCore/platform/graphics/MediaPlayer.h
index d0220ed..4cc6476 100644
--- a/WebCore/platform/graphics/MediaPlayer.h
+++ b/WebCore/platform/graphics/MediaPlayer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,8 +38,24 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/Noncopyable.h>
 
+#ifdef __OBJC__
+@class QTMovie;
+#else
+class QTMovie;
+#endif
+
 namespace WebCore {
 
+// Structure that will hold every native
+// types supported by the current media player.
+// We have to do that has multiple media players
+// backend can live at runtime.
+typedef struct PlatformMedia {
+    QTMovie* qtMovie;
+} PlatformMedia;
+
+static const PlatformMedia NoPlatformMedia = { 0 };
+
 class ContentType;
 class FrameView;
 class GraphicsContext;
@@ -48,6 +64,7 @@ class IntSize;
 class MediaPlayer;
 class MediaPlayerPrivateInterface;
 class String;
+class TimeRanges;
 
 #if USE(ACCELERATED_COMPOSITING)
 class GraphicsLayer;
@@ -109,8 +126,11 @@ public:
 
     bool supportsFullscreen() const;
     bool supportsSave() const;
+    PlatformMedia platformMedia() const;
+
     IntSize naturalSize();
-    bool hasVideo();
+    bool hasVideo() const;
+    bool hasAudio() const;
     
     void setFrameView(FrameView* frameView) { m_frameView = frameView; }
     FrameView* frameView() { return m_frameView; }
@@ -146,7 +166,7 @@ public:
     bool preservesPitch() const;    
     void setPreservesPitch(bool);
     
-    float maxTimeBuffered();
+    PassRefPtr<TimeRanges> buffered();
     float maxTimeSeekable();
 
     unsigned bytesLoaded();
diff --git a/WebCore/platform/graphics/MediaPlayerPrivate.h b/WebCore/platform/graphics/MediaPlayerPrivate.h
index de7f75c..925e563 100644
--- a/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -44,6 +44,11 @@ public:
     virtual void cancelLoad() = 0;
     
     virtual void prepareToPlay() { }
+<<<<<<< HEAD:WebCore/platform/graphics/MediaPlayerPrivate.h
+=======
+    virtual PlatformMedia platformMedia() const { return NoPlatformMedia; }
+
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/MediaPlayerPrivate.h
     virtual void play() = 0;
     virtual void pause() = 0;    
 
@@ -53,6 +58,7 @@ public:
     virtual IntSize naturalSize() const = 0;
 
     virtual bool hasVideo() const = 0;
+    virtual bool hasAudio() const = 0;
 
     virtual void setVisible(bool) = 0;
 
@@ -77,7 +83,7 @@ public:
     virtual MediaPlayer::ReadyState readyState() const = 0;
 
     virtual float maxTimeSeekable() const = 0;
-    virtual float maxTimeBuffered() const = 0;
+    virtual PassRefPtr<TimeRanges> buffered() const = 0;
 
     virtual int dataRate() const = 0;
 
diff --git a/WebCore/platform/graphics/Path.h b/WebCore/platform/graphics/Path.h
index da324bc..6b617a0 100644
--- a/WebCore/platform/graphics/Path.h
+++ b/WebCore/platform/graphics/Path.h
@@ -52,6 +52,9 @@ typedef WebCore::CairoPath PlatformPath;
 #elif PLATFORM(SKIA)
 class SkPath;
 typedef SkPath PlatformPath;
+#elif PLATFORM(HAIKU)
+class BRegion;
+typedef BRegion PlatformPath;
 #elif PLATFORM(WINCE)
 namespace WebCore {
     class PlatformPath;
diff --git a/WebCore/platform/graphics/Pattern.h b/WebCore/platform/graphics/Pattern.h
index 02ad3ec..2f1192c 100644
--- a/WebCore/platform/graphics/Pattern.h
+++ b/WebCore/platform/graphics/Pattern.h
@@ -53,6 +53,9 @@ typedef wxGraphicsBrush* PlatformPatternPtr;
 class wxBrush;
 typedef wxBrush* PlatformPatternPtr;
 #endif // USE(WXGC)
+#elif PLATFORM(HAIKU)
+#include <interface/GraphicsDefs.h>
+typedef pattern* PlatformPatternPtr;
 #elif PLATFORM(WINCE)
 typedef void* PlatformPatternPtr;
 #endif
diff --git a/WebCore/platform/graphics/SimpleFontData.cpp b/WebCore/platform/graphics/SimpleFontData.cpp
index c879228..2ec8abb 100644
--- a/WebCore/platform/graphics/SimpleFontData.cpp
+++ b/WebCore/platform/graphics/SimpleFontData.cpp
@@ -48,7 +48,9 @@ using namespace std;
 namespace WebCore {
 
 SimpleFontData::SimpleFontData(const FontPlatformData& f, bool customFont, bool loading, SVGFontData* svgFontData)
-    : m_unitsPerEm(defaultUnitsPerEm)
+    : m_maxCharWidth(-1)
+    , m_avgCharWidth(-1)
+    , m_unitsPerEm(defaultUnitsPerEm)
     , m_platformData(f)
     , m_treatAsFixedPitch(false)
 #if ENABLE(SVG_FONTS)
diff --git a/WebCore/platform/graphics/SimpleFontData.h b/WebCore/platform/graphics/SimpleFontData.h
index cb472b0..387a5c7 100644
--- a/WebCore/platform/graphics/SimpleFontData.h
+++ b/WebCore/platform/graphics/SimpleFontData.h
@@ -2,6 +2,7 @@
  * This file is part of the internal font implementation.
  *
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,13 +28,14 @@
 #include "FontPlatformData.h"
 #include "GlyphPageTreeNode.h"
 #include "GlyphWidthMap.h"
+#include "TextRenderingMode.h"
 #include <wtf/OwnPtr.h>
 
 #if USE(ATSUI)
 typedef struct OpaqueATSUStyle* ATSUStyle;
 #endif
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) && !PLATFORM(WINCE)
 #include <usp10.h>
 #endif
 
@@ -45,6 +47,10 @@ typedef struct OpaqueATSUStyle* ATSUStyle;
 #include <QFont>
 #endif
 
+#if PLATFORM(HAIKU)
+#include <Font.h>
+#endif
+
 namespace WebCore {
 
 class FontDescription;
@@ -115,7 +121,7 @@ public:
 
 #if USE(CORE_TEXT)
     CTFontRef getCTFont() const;
-    CFDictionaryRef getCFStringAttributes() const;
+    CFDictionaryRef getCFStringAttributes(TextRenderingMode) const;
 #endif
 
 #if USE(ATSUI)
@@ -134,17 +140,14 @@ public:
 
 #if PLATFORM(WIN)
     bool isSystemFont() const { return m_isSystemFont; }
+#if !PLATFORM(WINCE)    // disable unused members to save space
     SCRIPT_FONTPROPERTIES* scriptFontProperties() const;
     SCRIPT_CACHE* scriptCache() const { return &m_scriptCache; }
-
+#endif
     static void setShouldApplyMacAscentHack(bool);
     static bool shouldApplyMacAscentHack();
 #endif
 
-#if PLATFORM(CAIRO)
-    void setFont(cairo_t*) const;
-#endif
-
 #if PLATFORM(WX)
     wxFont* getWxFont() const { return m_platformData.font(); }
 #endif
@@ -159,7 +162,7 @@ private:
 
     void commonInit();
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) && !PLATFORM(WINCE)
     void initGDIFont();
     void platformCommonDestroy();
     float widthForGDIGlyph(Glyph glyph) const;
@@ -224,9 +227,11 @@ private:
 
 #if PLATFORM(WIN)
     bool m_isSystemFont;
+#if !PLATFORM(WINCE)    // disable unused members to save space
     mutable SCRIPT_CACHE m_scriptCache;
     mutable SCRIPT_FONTPROPERTIES* m_scriptFontProperties;
 #endif
+#endif
 };
     
     
diff --git a/WebCore/platform/graphics/TextRenderingMode.h b/WebCore/platform/graphics/TextRenderingMode.h
new file mode 100644
index 0000000..4f817a4
--- /dev/null
+++ b/WebCore/platform/graphics/TextRenderingMode.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef TextRenderingMode_h
+#define TextRenderingMode_h
+
+namespace WebCore {
+
+    enum TextRenderingMode { AutoTextRendering, OptimizeSpeed, OptimizeLegibility, GeometricPrecision };
+    
+} // namespace WebCore
+
+#endif // TextRenderingMode_h
diff --git a/WebCore/platform/graphics/cairo/FontCairo.cpp b/WebCore/platform/graphics/cairo/FontCairo.cpp
index 0f7ae79..1a951c2 100644
--- a/WebCore/platform/graphics/cairo/FontCairo.cpp
+++ b/WebCore/platform/graphics/cairo/FontCairo.cpp
@@ -46,7 +46,7 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
     cairo_t* cr = context->platformContext();
     cairo_save(cr);
 
-    font->setFont(cr);
+    cairo_set_scaled_font(cr, font->platformData().scaledFont());
 
     GlyphBufferGlyph* glyphs = (GlyphBufferGlyph*)glyphBuffer.glyphs(from);
 
diff --git a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index 5765546..de8afb3 100644
--- a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -31,7 +31,6 @@
 
 #if PLATFORM(CAIRO)
 
-#include "TransformationMatrix.h"
 #include "CairoPath.h"
 #include "FloatRect.h"
 #include "Font.h"
@@ -41,6 +40,7 @@
 #include "Path.h"
 #include "Pattern.h"
 #include "SimpleFontData.h"
+#include "TransformationMatrix.h"
 
 #include <cairo.h>
 #include <math.h>
@@ -53,8 +53,8 @@
 #elif PLATFORM(WIN)
 #include <cairo-win32.h>
 #endif
-#include "GraphicsContextPrivate.h"
 #include "GraphicsContextPlatformPrivateCairo.h"
+#include "GraphicsContextPrivate.h"
 
 #ifndef M_PI
 #define M_PI 3.14159265358979323846
@@ -142,38 +142,6 @@ void GraphicsContext::drawRect(const IntRect& rect)
     cairo_restore(cr);
 }
 
-// FIXME: Now that this is refactored, it should be shared by all contexts.
-static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, StrokeStyle style)
-{
-    // For odd widths, we add in 0.5 to the appropriate x/y so that the float arithmetic
-    // works out.  For example, with a border width of 3, KHTML will pass us (y1+y2)/2, e.g.,
-    // (50+53)/2 = 103/2 = 51 when we want 51.5.  It is always true that an even width gave
-    // us a perfect position, but an odd width gave us a position that is off by exactly 0.5.
-    if (style == DottedStroke || style == DashedStroke) {
-        if (p1.x() == p2.x()) {
-            p1.setY(p1.y() + strokeWidth);
-            p2.setY(p2.y() - strokeWidth);
-        }
-        else {
-            p1.setX(p1.x() + strokeWidth);
-            p2.setX(p2.x() - strokeWidth);
-        }
-    }
-
-    if (static_cast<int>(strokeWidth) % 2) {
-        if (p1.x() == p2.x()) {
-            // We're a vertical line.  Adjust our x.
-            p1.setX(p1.x() + 0.5);
-            p2.setX(p2.x() + 0.5);
-        }
-        else {
-            // We're a horizontal line. Adjust our y.
-            p1.setY(p1.y() + 0.5);
-            p2.setY(p2.y() + 0.5);
-        }
-    }
-}
-
 // This is only used to draw borders.
 void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
 {
@@ -239,20 +207,18 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         if (patWidth == 1)
             patternOffset = 1.0;
         else {
-            bool evenNumberOfSegments = numSegments%2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
                 if (remainder) {
                     patternOffset += patWidth - remainder;
-                    patternOffset += remainder/2;
-                }
-                else
-                    patternOffset = patWidth/2;
-            }
-            else if (!evenNumberOfSegments) {
+                    patternOffset += remainder / 2;
+                } else
+                    patternOffset = patWidth / 2;
+            } else if (!evenNumberOfSegments) {
                 if (remainder)
-                    patternOffset = (patWidth - remainder)/2;
+                    patternOffset = (patWidth - remainder) / 2;
             }
         }
 
@@ -318,7 +284,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
 
     if (w != h)
         cairo_scale(cr, 1., scaleFactor);
-    
+
     cairo_arc_negative(cr, x + hRadius, (y + vRadius) * reverseScaleFactor, hRadius, -fa * M_PI/180, -falen * M_PI/180);
 
     if (w != h)
@@ -326,16 +292,16 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
 
     float width = strokeThickness();
     int patWidth = 0;
-    
+
     switch (strokeStyle()) {
-        case DottedStroke:
-            patWidth = static_cast<int>(width / 2);
-            break;
-        case DashedStroke:
-            patWidth = 3 * static_cast<int>(width / 2);
-            break;
-        default:
-            break;
+    case DottedStroke:
+        patWidth = static_cast<int>(width / 2);
+        break;
+    case DashedStroke:
+        patWidth = 3 * static_cast<int>(width / 2);
+        break;
+    default:
+        break;
     }
 
     setColor(cr, strokeColor());
@@ -349,7 +315,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
             distance = static_cast<int>((M_PI * hRadius) / 2.0);
         else // We are elliptical and will have to estimate the distance
             distance = static_cast<int>((M_PI * sqrtf((hRadius * hRadius + vRadius * vRadius) / 2.0)) / 2.0);
-        
+
         int remainder = distance % patWidth;
         int coverage = distance - remainder;
         int numSegments = coverage / patWidth;
@@ -359,7 +325,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
         if (patWidth == 1)
             patternOffset = 1.0;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -828,15 +794,15 @@ void GraphicsContext::setLineCap(LineCap lineCap)
 
     cairo_line_cap_t cairoCap = CAIRO_LINE_CAP_BUTT;
     switch (lineCap) {
-        case ButtCap:
-            // no-op
-            break;
-        case RoundCap:
-            cairoCap = CAIRO_LINE_CAP_ROUND;
-            break;
-        case SquareCap:
-            cairoCap = CAIRO_LINE_CAP_SQUARE;
-            break;
+    case ButtCap:
+        // no-op
+        break;
+    case RoundCap:
+        cairoCap = CAIRO_LINE_CAP_ROUND;
+        break;
+    case SquareCap:
+        cairoCap = CAIRO_LINE_CAP_SQUARE;
+        break;
     }
     cairo_set_line_cap(m_data->cr, cairoCap);
 }
@@ -853,15 +819,15 @@ void GraphicsContext::setLineJoin(LineJoin lineJoin)
 
     cairo_line_join_t cairoJoin = CAIRO_LINE_JOIN_MITER;
     switch (lineJoin) {
-        case MiterJoin:
-            // no-op
-            break;
-        case RoundJoin:
-            cairoJoin = CAIRO_LINE_JOIN_ROUND;
-            break;
-        case BevelJoin:
-            cairoJoin = CAIRO_LINE_JOIN_BEVEL;
-            break;
+    case MiterJoin:
+        // no-op
+        break;
+    case RoundJoin:
+        cairoJoin = CAIRO_LINE_JOIN_ROUND;
+        break;
+    case BevelJoin:
+        cairoJoin = CAIRO_LINE_JOIN_BEVEL;
+        break;
     }
     cairo_set_line_join(m_data->cr, cairoJoin);
 }
@@ -887,37 +853,37 @@ float GraphicsContext::getAlpha()
 static inline cairo_operator_t toCairoOperator(CompositeOperator op)
 {
     switch (op) {
-        case CompositeClear:
-            return CAIRO_OPERATOR_CLEAR;
-        case CompositeCopy:
-            return CAIRO_OPERATOR_SOURCE;
-        case CompositeSourceOver:
-            return CAIRO_OPERATOR_OVER;
-        case CompositeSourceIn:
-            return CAIRO_OPERATOR_IN;
-        case CompositeSourceOut:
-            return CAIRO_OPERATOR_OUT;
-        case CompositeSourceAtop:
-            return CAIRO_OPERATOR_ATOP;
-        case CompositeDestinationOver:
-            return CAIRO_OPERATOR_DEST_OVER;
-        case CompositeDestinationIn:
-            return CAIRO_OPERATOR_DEST_IN;
-        case CompositeDestinationOut:
-            return CAIRO_OPERATOR_DEST_OUT;
-        case CompositeDestinationAtop:
-            return CAIRO_OPERATOR_DEST_ATOP;
-        case CompositeXOR:
-            return CAIRO_OPERATOR_XOR;
-        case CompositePlusDarker:
-            return CAIRO_OPERATOR_SATURATE;
-        case CompositeHighlight:
-            // There is no Cairo equivalent for CompositeHighlight.
-            return CAIRO_OPERATOR_OVER;
-        case CompositePlusLighter:
-            return CAIRO_OPERATOR_ADD;
-        default:
-            return CAIRO_OPERATOR_SOURCE;
+    case CompositeClear:
+        return CAIRO_OPERATOR_CLEAR;
+    case CompositeCopy:
+        return CAIRO_OPERATOR_SOURCE;
+    case CompositeSourceOver:
+        return CAIRO_OPERATOR_OVER;
+    case CompositeSourceIn:
+        return CAIRO_OPERATOR_IN;
+    case CompositeSourceOut:
+        return CAIRO_OPERATOR_OUT;
+    case CompositeSourceAtop:
+        return CAIRO_OPERATOR_ATOP;
+    case CompositeDestinationOver:
+        return CAIRO_OPERATOR_DEST_OVER;
+    case CompositeDestinationIn:
+        return CAIRO_OPERATOR_DEST_IN;
+    case CompositeDestinationOut:
+        return CAIRO_OPERATOR_DEST_OUT;
+    case CompositeDestinationAtop:
+        return CAIRO_OPERATOR_DEST_ATOP;
+    case CompositeXOR:
+        return CAIRO_OPERATOR_XOR;
+    case CompositePlusDarker:
+        return CAIRO_OPERATOR_SATURATE;
+    case CompositeHighlight:
+        // There is no Cairo equivalent for CompositeHighlight.
+        return CAIRO_OPERATOR_OVER;
+    case CompositePlusLighter:
+        return CAIRO_OPERATOR_ADD;
+    default:
+        return CAIRO_OPERATOR_SOURCE;
     }
 }
 
diff --git a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index c905ee8..0213944 100644
--- a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -138,16 +138,17 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
     }
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
+template <Multiply multiplied>
+PassRefPtr<ImageData> getImageData(const IntRect& rect, const ImageBufferData& data, const IntSize& size)
 {
-    ASSERT(cairo_surface_get_type(m_data.m_surface) == CAIRO_SURFACE_TYPE_IMAGE);
+    ASSERT(cairo_surface_get_type(data.m_surface) == CAIRO_SURFACE_TYPE_IMAGE);
 
     PassRefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
-    unsigned char* dataSrc = cairo_image_surface_get_data(m_data.m_surface);
+    unsigned char* dataSrc = cairo_image_surface_get_data(data.m_surface);
     unsigned char* dataDst = result->data()->data()->data();
 
-    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > m_size.width() || (rect.y() + rect.height()) > m_size.height())
-        memset(dataSrc, 0, result->data()->length());
+    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > size.width() || (rect.y() + rect.height()) > size.height())
+        memset(dataDst, 0, result->data()->length());
 
     int originx = rect.x();
     int destx = 0;
@@ -156,8 +157,8 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originx = 0;
     }
     int endx = rect.x() + rect.width();
-    if (endx > m_size.width())
-        endx = m_size.width();
+    if (endx > size.width())
+        endx = size.width();
     int numColumns = endx - originx;
 
     int originy = rect.y();
@@ -167,11 +168,11 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originy = 0;
     }
     int endy = rect.y() + rect.height();
-    if (endy > m_size.height())
-        endy = m_size.height();
+    if (endy > size.height())
+        endy = size.height();
     int numRows = endy - originy;
 
-    int stride = cairo_image_surface_get_stride(m_data.m_surface);
+    int stride = cairo_image_surface_get_stride(data.m_surface);
     unsigned destBytesPerRow = 4 * rect.width();
 
     unsigned char* destRows = dataDst + desty * destBytesPerRow + destx * 4;
@@ -180,7 +181,11 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
             unsigned* pixel = row + x + originx;
-            Color pixelColor = colorFromPremultipliedARGB(*pixel);
+            Color pixelColor;
+            if (multiplied == Unmultiplied)
+                pixelColor = colorFromPremultipliedARGB(*pixel);
+            else
+                pixelColor = Color(*pixel);
             destRows[basex]     = pixelColor.red();
             destRows[basex + 1] = pixelColor.green();
             destRows[basex + 2] = pixelColor.blue();
@@ -192,11 +197,22 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     return result;
 }
 
-void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
 {
-    ASSERT(cairo_surface_get_type(m_data.m_surface) == CAIRO_SURFACE_TYPE_IMAGE);
+    return getImageData<Unmultiplied>(rect, m_data, m_size);
+}
 
-    unsigned char* dataDst = cairo_image_surface_get_data(m_data.m_surface);
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Premultiplied>(rect, m_data, m_size);
+}
+
+template <Multiply multiplied>
+void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint& destPoint, ImageBufferData& data, const IntSize& size)
+{
+    ASSERT(cairo_surface_get_type(data.m_surface) == CAIRO_SURFACE_TYPE_IMAGE);
+
+    unsigned char* dataDst = cairo_image_surface_get_data(data.m_surface);
 
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -204,28 +220,28 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     int originx = sourceRect.x();
     int destx = destPoint.x() + sourceRect.x();
     ASSERT(destx >= 0);
-    ASSERT(destx < m_size.width());
+    ASSERT(destx < size.width());
     ASSERT(originx >= 0);
     ASSERT(originx <= sourceRect.right());
 
     int endx = destPoint.x() + sourceRect.right();
-    ASSERT(endx <= m_size.width());
+    ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
 
     int originy = sourceRect.y();
     int desty = destPoint.y() + sourceRect.y();
     ASSERT(desty >= 0);
-    ASSERT(desty < m_size.height());
+    ASSERT(desty < size.height());
     ASSERT(originy >= 0);
     ASSERT(originy <= sourceRect.bottom());
 
     int endy = destPoint.y() + sourceRect.bottom();
-    ASSERT(endy <= m_size.height());
+    ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
     unsigned srcBytesPerRow = 4 * source->width();
-    int stride = cairo_image_surface_get_stride(m_data.m_surface);
+    int stride = cairo_image_surface_get_stride(data.m_surface);
 
     unsigned char* srcRows = source->data()->data()->data() + originy * srcBytesPerRow + originx * 4;
     for (int y = 0; y < numRows; ++y) {
@@ -237,12 +253,25 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
                     srcRows[basex + 1],
                     srcRows[basex + 2],
                     srcRows[basex + 3]);
-            *pixel = premultipliedARGBFromColor(pixelColor);
+            if (multiplied == Unmultiplied)
+                *pixel = premultipliedARGBFromColor(pixelColor);
+            else
+                *pixel = pixelColor.rgb();
         }
         srcRows += srcBytesPerRow;
     }
 }
 
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Unmultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Premultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
 static cairo_status_t writeFunction(void* closure, const unsigned char* data, unsigned int length)
 {
     Vector<char>* in = reinterpret_cast<Vector<char>*>(closure);
diff --git a/WebCore/platform/graphics/cg/ColorCG.cpp b/WebCore/platform/graphics/cg/ColorCG.cpp
index 0465c0b..40aacc5 100644
--- a/WebCore/platform/graphics/cg/ColorCG.cpp
+++ b/WebCore/platform/graphics/cg/ColorCG.cpp
@@ -29,6 +29,7 @@
 #if PLATFORM(CG)
 
 #include <wtf/Assertions.h>
+#include <wtf/RetainPtr.h>
 #include <ApplicationServices/ApplicationServices.h>
 
 namespace WebCore {
@@ -75,13 +76,12 @@ CGColorRef createCGColor(const Color& c)
     CMProfileRef prof = NULL;
     CMGetSystemProfile(&prof);
 
-    CGColorSpaceRef rgbSpace = CGColorSpaceCreateWithPlatformColorSpace(prof);
+    RetainPtr<CGColorSpaceRef> rgbSpace(AdoptCF, CGColorSpaceCreateWithPlatformColorSpace(prof));
 
-    if (rgbSpace != NULL)
-    {
-        float components[4] = {c.red() / 255.0f, c.green() / 255.0f, c.blue() / 255.0f, c.alpha() / 255.0f};
-        color = CGColorCreate(rgbSpace, components);
-        CGColorSpaceRelease(rgbSpace);
+    if (rgbSpace) {
+        CGFloat components[4] = { static_cast<CGFloat>(c.red()) / 255, static_cast<CGFloat>(c.green()) / 255,
+                                  static_cast<CGFloat>(c.blue()) / 255, static_cast<CGFloat>(c.alpha()) / 255 };
+        color = CGColorCreate(rgbSpace.get(), components);
     }
 
     CMCloseProfile(prof);
diff --git a/WebCore/platform/graphics/cg/GradientCG.cpp b/WebCore/platform/graphics/cg/GradientCG.cpp
index c189fd5..05a0aad 100644
--- a/WebCore/platform/graphics/cg/GradientCG.cpp
+++ b/WebCore/platform/graphics/cg/GradientCG.cpp
@@ -58,17 +58,14 @@ CGShadingRef Gradient::platformGradient()
     const CGFloat intervalRanges[2] = { 0, 1 };
     const CGFloat colorComponentRanges[4 * 2] = { 0, 1, 0, 1, 0, 1, 0, 1 };
     const CGFunctionCallbacks gradientCallbacks = { 0, gradientCallback, 0 };
-    CGFunctionRef colorFunction = CGFunctionCreate(this, 1, intervalRanges, 4, colorComponentRanges, &gradientCallbacks);
+    RetainPtr<CGFunctionRef> colorFunction(AdoptCF, CGFunctionCreate(this, 1, intervalRanges, 4, colorComponentRanges, &gradientCallbacks));
 
-    CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
+    static CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
 
     if (m_radial)
-        m_gradient = CGShadingCreateRadial(colorSpace, m_p0, m_r0, m_p1, m_r1, colorFunction, true, true);
+        m_gradient = CGShadingCreateRadial(colorSpace, m_p0, m_r0, m_p1, m_r1, colorFunction.get(), true, true);
     else
-        m_gradient = CGShadingCreateAxial(colorSpace, m_p0, m_p1, colorFunction, true, true);
-
-    CGColorSpaceRelease(colorSpace);
-    CGFunctionRelease(colorFunction);
+        m_gradient = CGShadingCreateAxial(colorSpace, m_p0, m_p1, colorFunction.get(), true, true);
 
     return m_gradient;
 }
diff --git a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index ab8eb3c..1b843e4 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -28,14 +28,15 @@
 #include "config.h"
 #include "GraphicsContext.h"
 
-#include "TransformationMatrix.h"
 #include "FloatConversion.h"
-#include "GraphicsContextPrivate.h"
 #include "GraphicsContextPlatformPrivateCG.h"
+#include "GraphicsContextPrivate.h"
 #include "ImageBuffer.h"
 #include "KURL.h"
 #include "Path.h"
 #include "Pattern.h"
+#include "TransformationMatrix.h"
+
 #include <CoreGraphics/CGBitmapContext.h>
 #include <CoreGraphics/CGPDFContext.h>
 #include <wtf/MathExtras.h>
@@ -86,7 +87,7 @@ CGContextRef GraphicsContext::platformContext() const
 {
     ASSERT(!paintingDisabled());
     ASSERT(m_data->m_cgContext);
-    return m_data->m_cgContext;
+    return m_data->m_cgContext.get();
 }
 
 void GraphicsContext::savePlatformState()
@@ -178,19 +179,19 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     
     int patWidth = 0;
     switch (strokeStyle()) {
-        case NoStroke:
-        case SolidStroke:
-            break;
-        case DottedStroke:
-            patWidth = (int)width;
-            break;
-        case DashedStroke:
-            patWidth = 3 * (int)width;
-            break;
+    case NoStroke:
+    case SolidStroke:
+        break;
+    case DottedStroke:
+        patWidth = (int)width;
+        break;
+    case DashedStroke:
+        patWidth = 3 * (int)width;
+        break;
     }
 
     CGContextRef context = platformContext();
-    
+
     if (shouldAntialias())
         CGContextSetShouldAntialias(context, false);
 
@@ -221,7 +222,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         if (patWidth == 1)
             patternOffset = 1.0f;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -235,7 +236,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
                     patternOffset = (patWidth - remainder)/2;
             }
         }
-        
+
         const CGFloat dottedLine[2] = { patWidth, patWidth };
         CGContextSetLineDash(context, patternOffset, dottedLine, 2);
     }
@@ -248,7 +249,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
 
     if (patWidth)
         CGContextRestoreGState(context);
-        
+
     if (shouldAntialias())
         CGContextSetShouldAntialias(context, true);
 }
@@ -263,7 +264,7 @@ void GraphicsContext::drawEllipse(const IntRect& rect)
 
     if (paintingDisabled())
         return;
-        
+
     CGContextRef context = platformContext();
     CGContextBeginPath(context);
     float r = (float)rect.width() / 2;
@@ -275,25 +276,25 @@ void GraphicsContext::drawEllipse(const IntRect& rect)
 
 
 void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSpan)
-{ 
+{
     if (paintingDisabled() || strokeStyle() == NoStroke || strokeThickness() <= 0.0f)
         return;
-    
+
     CGContextRef context = platformContext();
     CGContextSaveGState(context);
     CGContextBeginPath(context);
     CGContextSetShouldAntialias(context, false);
-    
+
     int x = rect.x();
     int y = rect.y();
     float w = (float)rect.width();
     float h = (float)rect.height();
     float scaleFactor = h / w;
     float reverseScaleFactor = w / h;
-    
+
     if (w != h)
         scale(FloatSize(1, scaleFactor));
-    
+
     float hRadius = w / 2;
     float vRadius = h / 2;
     float fa = startAngle;
@@ -304,22 +305,21 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
 
     if (w != h)
         scale(FloatSize(1, reverseScaleFactor));
-    
-    
+
     float width = strokeThickness();
     int patWidth = 0;
-    
+
     switch (strokeStyle()) {
-        case DottedStroke:
-            patWidth = (int)(width / 2);
-            break;
-        case DashedStroke:
-            patWidth = 3 * (int)(width / 2);
-            break;
-        default:
-            break;
+    case DottedStroke:
+        patWidth = (int)(width / 2);
+        break;
+    case DashedStroke:
+        patWidth = 3 * (int)(width / 2);
+        break;
+    default:
+        break;
     }
-    
+
     if (patWidth) {
         // Example: 80 pixels with a width of 30 pixels.
         // Remainder is 20.  The maximum pixels of line we could paint
@@ -329,7 +329,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
             distance = static_cast<int>((piFloat * hRadius) / 2.0f);
         else // We are elliptical and will have to estimate the distance
             distance = static_cast<int>((piFloat * sqrtf((hRadius * hRadius + vRadius * vRadius) / 2.0f)) / 2.0f);
-        
+
         int remainder = distance % patWidth;
         int coverage = distance - remainder;
         int numSegments = coverage / patWidth;
@@ -339,7 +339,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
         if (patWidth == 1)
             patternOffset = 1.0f;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -353,13 +353,13 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
                     patternOffset = (patWidth - remainder) / 2.0f;
             }
         }
-    
+
         const CGFloat dottedLine[2] = { patWidth, patWidth };
         CGContextSetLineDash(context, patternOffset, dottedLine, 2);
     }
 
     CGContextStrokePath(context);
-    
+
     CGContextRestoreGState(context);
 }
 
@@ -375,7 +375,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
 
     if (antialiased != shouldAntialias())
         CGContextSetShouldAntialias(context, antialiased);
-    
+
     CGContextBeginPath(context);
     CGContextMoveToPoint(context, points[0].x(), points[0].y());
     for (size_t i = 1; i < npoints; i++)
@@ -383,7 +383,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     CGContextClosePath(context);
 
     drawPath();
-    
+
     if (antialiased != shouldAntialias())
         CGContextSetShouldAntialias(context, shouldAntialias());
 }
@@ -391,35 +391,31 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
 void GraphicsContext::applyStrokePattern()
 {
     CGContextRef cgContext = platformContext();
-    
-    CGPatternRef platformPattern = m_common->state.strokePattern.get()->createPlatformPattern(getCTM());
+
+    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.strokePattern.get()->createPlatformPattern(getCTM()));
     if (!platformPattern)
         return;
 
-    CGColorSpaceRef patternSpace = CGColorSpaceCreatePattern(0);
-    CGContextSetStrokeColorSpace(cgContext, patternSpace);
-    CGColorSpaceRelease(patternSpace);
+    RetainPtr<CGColorSpaceRef> patternSpace(AdoptCF, CGColorSpaceCreatePattern(0));
+    CGContextSetStrokeColorSpace(cgContext, patternSpace.get());
 
     const CGFloat patternAlpha = 1;
-    CGContextSetStrokePattern(cgContext, platformPattern, &patternAlpha);
-    CGPatternRelease(platformPattern);
+    CGContextSetStrokePattern(cgContext, platformPattern.get(), &patternAlpha);
 }
 
 void GraphicsContext::applyFillPattern()
 {
     CGContextRef cgContext = platformContext();
 
-    CGPatternRef platformPattern = m_common->state.fillPattern.get()->createPlatformPattern(getCTM());
+    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.fillPattern.get()->createPlatformPattern(getCTM()));
     if (!platformPattern)
         return;
 
-    CGColorSpaceRef patternSpace = CGColorSpaceCreatePattern(0);
-    CGContextSetFillColorSpace(cgContext, patternSpace);
-    CGColorSpaceRelease(patternSpace);
+    RetainPtr<CGColorSpaceRef> patternSpace(AdoptCF, CGColorSpaceCreatePattern(0));
+    CGContextSetFillColorSpace(cgContext, patternSpace.get());
 
     const CGFloat patternAlpha = 1;
-    CGContextSetFillPattern(cgContext, platformPattern, &patternAlpha);
-    CGPatternRelease(platformPattern);
+    CGContextSetFillPattern(cgContext, platformPattern.get(), &patternAlpha);
 }
 
 static inline bool calculateDrawingMode(const GraphicsContextState& state, CGPathDrawingMode& mode)
@@ -463,7 +459,7 @@ void GraphicsContext::drawPath()
         strokePath();
         return;
     }
-    
+
     if (state.fillColorSpace == PatternColorSpace)
         applyFillPattern();
     if (state.strokeColorSpace == PatternColorSpace)
@@ -599,7 +595,7 @@ void GraphicsContext::clipOut(const IntRect& rect)
 {
     if (paintingDisabled())
         return;
-        
+
     CGRect rects[2] = { CGContextGetClipBoundingBox(platformContext()), rect };
     CGContextBeginPath(platformContext());
     CGContextAddRects(platformContext(), rects, 2);
@@ -610,7 +606,7 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
 {
     if (paintingDisabled())
         return;
-        
+
     CGContextBeginPath(platformContext());
     CGContextAddRect(platformContext(), CGContextGetClipBoundingBox(platformContext()));
     CGContextAddEllipseInRect(platformContext(), rect);
@@ -639,13 +635,13 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
 
     clip(rect);
     CGContextRef context = platformContext();
-    
+
     // Add outer ellipse
     CGContextAddEllipseInRect(context, CGRectMake(rect.x(), rect.y(), rect.width(), rect.height()));
     // Add inner ellipse.
     CGContextAddEllipseInRect(context, CGRectMake(rect.x() + thickness, rect.y() + thickness,
         rect.width() - (thickness * 2), rect.height() - (thickness * 2)));
-    
+
     CGContextEOClip(context);
 }
 
@@ -653,7 +649,7 @@ void GraphicsContext::clipToImageBuffer(const FloatRect& rect, const ImageBuffer
 {
     if (paintingDisabled())
         return;
-    
+
     CGContextTranslateCTM(platformContext(), rect.x(), rect.y() + rect.height());
     CGContextScaleCTM(platformContext(), 1, -1);
     CGContextClipToMask(platformContext(), FloatRect(FloatPoint(), rect.size()), imageBuffer->image()->getCGImageRef());
@@ -731,12 +727,11 @@ void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Col
     if (!color.isValid())
         CGContextSetShadow(context, CGSizeMake(width, height), blurRadius);
     else {
-        CGColorRef colorCG = createCGColor(color);
+        RetainPtr<CGColorRef> colorCG(AdoptCF, createCGColor(color));
         CGContextSetShadowWithColor(context,
                                     CGSizeMake(width, height),
-                                    blurRadius, 
-                                    colorCG);
-        CGColorRelease(colorCG);
+                                    blurRadius,
+                                    colorCG.get());
     }
 }
 
@@ -799,15 +794,15 @@ void GraphicsContext::setLineCap(LineCap cap)
     if (paintingDisabled())
         return;
     switch (cap) {
-        case ButtCap:
-            CGContextSetLineCap(platformContext(), kCGLineCapButt);
-            break;
-        case RoundCap:
-            CGContextSetLineCap(platformContext(), kCGLineCapRound);
-            break;
-        case SquareCap:
-            CGContextSetLineCap(platformContext(), kCGLineCapSquare);
-            break;
+    case ButtCap:
+        CGContextSetLineCap(platformContext(), kCGLineCapButt);
+        break;
+    case RoundCap:
+        CGContextSetLineCap(platformContext(), kCGLineCapRound);
+        break;
+    case SquareCap:
+        CGContextSetLineCap(platformContext(), kCGLineCapSquare);
+        break;
     }
 }
 
@@ -821,15 +816,15 @@ void GraphicsContext::setLineJoin(LineJoin join)
     if (paintingDisabled())
         return;
     switch (join) {
-        case MiterJoin:
-            CGContextSetLineJoin(platformContext(), kCGLineJoinMiter);
-            break;
-        case RoundJoin:
-            CGContextSetLineJoin(platformContext(), kCGLineJoinRound);
-            break;
-        case BevelJoin:
-            CGContextSetLineJoin(platformContext(), kCGLineJoinBevel);
-            break;
+    case MiterJoin:
+        CGContextSetLineJoin(platformContext(), kCGLineJoinMiter);
+        break;
+    case RoundJoin:
+        CGContextSetLineJoin(platformContext(), kCGLineJoinRound);
+        break;
+    case BevelJoin:
+        CGContextSetLineJoin(platformContext(), kCGLineJoinBevel);
+        break;
     }
 }
 
@@ -858,7 +853,7 @@ void GraphicsContext::clipOut(const Path& path)
 {
     if (paintingDisabled())
         return;
-        
+
     CGContextBeginPath(platformContext());
     CGContextAddRect(platformContext(), CGContextGetClipBoundingBox(platformContext()));
     CGContextAddPath(platformContext(), path.platformPath());
@@ -909,9 +904,9 @@ TransformationMatrix GraphicsContext::getCTM() const
 
 FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
 {
-    // It is not enough just to round to pixels in device space. The rotation part of the 
+    // It is not enough just to round to pixels in device space. The rotation part of the
     // affine transform matrix to device space can mess with this conversion if we have a
-    // rotating image like the hands of the world clock widget. We just need the scale, so 
+    // rotating image like the hands of the world clock widget. We just need the scale, so
     // we get the affine transform matrix and extract the scale.
 
     if (m_data->m_userToDeviceTransformKnownToBeIdentity)
@@ -934,11 +929,11 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
     deviceOrigin.y = roundf(deviceOrigin.y);
     deviceLowerRight.x = roundf(deviceLowerRight.x);
     deviceLowerRight.y = roundf(deviceLowerRight.y);
-    
+
     // Don't let the height or width round to 0 unless either was originally 0
-    if (deviceOrigin.y == deviceLowerRight.y && rect.height() != 0)
+    if (deviceOrigin.y == deviceLowerRight.y && rect.height())
         deviceLowerRight.y += 1;
-    if (deviceOrigin.x == deviceLowerRight.x && rect.width() != 0)
+    if (deviceOrigin.x == deviceLowerRight.x && rect.width())
         deviceLowerRight.x += 1;
 
     FloatPoint roundedOrigin = FloatPoint(deviceOrigin.x / deviceScaleX, deviceOrigin.y / deviceScaleY);
@@ -984,13 +979,13 @@ void GraphicsContext::drawLineForText(const IntPoint& point, int width, bool pri
             }
         }
     }
-    
+
     if (fillColor() != strokeColor())
         setCGFillColor(platformContext(), strokeColor());
     CGContextFillRect(platformContext(), CGRectMake(x, y, lineLength, thickness));
     if (fillColor() != strokeColor())
         setCGFillColor(platformContext(), fillColor());
-        
+
     if (restoreAntialiasMode)
         CGContextSetShouldAntialias(platformContext(), true);
 }
@@ -999,51 +994,50 @@ void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
 {
     if (paintingDisabled())
         return;
-        
-    CFURLRef urlRef = link.createCFURL();
-    if (urlRef) {
-        CGContextRef context = platformContext();
-        
-        // Get the bounding box to handle clipping.
-        CGRect box = CGContextGetClipBoundingBox(context);
-
-        IntRect intBox((int)box.origin.x, (int)box.origin.y, (int)box.size.width, (int)box.size.height);
-        IntRect rect = destRect;
-        rect.intersect(intBox);
-
-        CGPDFContextSetURLForRect(context, urlRef,
-            CGRectApplyAffineTransform(rect, CGContextGetCTM(context)));
-
-        CFRelease(urlRef);
-    }
+
+    RetainPtr<CFURLRef> urlRef(AdoptCF, link.createCFURL());
+    if (!urlRef)
+        return;
+
+    CGContextRef context = platformContext();
+
+    // Get the bounding box to handle clipping.
+    CGRect box = CGContextGetClipBoundingBox(context);
+
+    IntRect intBox((int)box.origin.x, (int)box.origin.y, (int)box.size.width, (int)box.size.height);
+    IntRect rect = destRect;
+    rect.intersect(intBox);
+
+    CGPDFContextSetURLForRect(context, urlRef.get(),
+        CGRectApplyAffineTransform(rect, CGContextGetCTM(context)));
 }
 
 void GraphicsContext::setImageInterpolationQuality(InterpolationQuality mode)
 {
     if (paintingDisabled())
         return;
-    
+
     CGInterpolationQuality quality = kCGInterpolationDefault;
     switch (mode) {
-        case InterpolationDefault:
-            quality = kCGInterpolationDefault;
-            break;
-        case InterpolationNone:
-            quality = kCGInterpolationNone;
-            break;
-        case InterpolationLow:
-            quality = kCGInterpolationLow;
-            break;
-
-        // Fall through to InterpolationHigh if kCGInterpolationMedium is not available
-        case InterpolationMedium:
+    case InterpolationDefault:
+        quality = kCGInterpolationDefault;
+        break;
+    case InterpolationNone:
+        quality = kCGInterpolationNone;
+        break;
+    case InterpolationLow:
+        quality = kCGInterpolationLow;
+        break;
+
+    // Fall through to InterpolationHigh if kCGInterpolationMedium is not available
+    case InterpolationMedium:
 #if HAVE(CG_INTERPOLATION_MEDIUM)
-            quality = kCGInterpolationMedium;
-            break;
+        quality = kCGInterpolationMedium;
+        break;
 #endif
-        case InterpolationHigh:
-            quality = kCGInterpolationHigh;
-            break;
+    case InterpolationHigh:
+        quality = kCGInterpolationHigh;
+        break;
     }
     CGContextSetInterpolationQuality(platformContext(), quality);
 }
@@ -1055,18 +1049,18 @@ InterpolationQuality GraphicsContext::imageInterpolationQuality() const
 
     CGInterpolationQuality quality = CGContextGetInterpolationQuality(platformContext());
     switch (quality) {
-        case kCGInterpolationDefault:
-            return InterpolationDefault;
-        case kCGInterpolationNone:
-            return InterpolationNone;
-        case kCGInterpolationLow:
-            return InterpolationLow;
+    case kCGInterpolationDefault:
+        return InterpolationDefault;
+    case kCGInterpolationNone:
+        return InterpolationNone;
+    case kCGInterpolationLow:
+        return InterpolationLow;
 #if HAVE(CG_INTERPOLATION_MEDIUM)
-        case kCGInterpolationMedium:
-            return InterpolationMedium;
+    case kCGInterpolationMedium:
+        return InterpolationMedium;
 #endif
-        case kCGInterpolationHigh:
-            return InterpolationHigh;
+    case kCGInterpolationHigh:
+        return InterpolationHigh;
     }
     return InterpolationDefault;
 }
@@ -1079,32 +1073,32 @@ void GraphicsContext::setPlatformTextDrawingMode(int mode)
     // Wow, wish CG had used bits here.
     CGContextRef context = platformContext();
     switch (mode) {
-        case cTextInvisible: // Invisible
-            CGContextSetTextDrawingMode(context, kCGTextInvisible);
-            break;
-        case cTextFill: // Fill
-            CGContextSetTextDrawingMode(context, kCGTextFill);
-            break;
-        case cTextStroke: // Stroke
-            CGContextSetTextDrawingMode(context, kCGTextStroke);
-            break;
-        case 3: // Fill | Stroke
-            CGContextSetTextDrawingMode(context, kCGTextFillStroke);
-            break;
-        case cTextClip: // Clip
-            CGContextSetTextDrawingMode(context, kCGTextClip);
-            break;
-        case 5: // Fill | Clip
-            CGContextSetTextDrawingMode(context, kCGTextFillClip);
-            break;
-        case 6: // Stroke | Clip
-            CGContextSetTextDrawingMode(context, kCGTextStrokeClip);
-            break;
-        case 7: // Fill | Stroke | Clip
-            CGContextSetTextDrawingMode(context, kCGTextFillStrokeClip);
-            break;
-        default:
-            break;
+    case cTextInvisible: // Invisible
+        CGContextSetTextDrawingMode(context, kCGTextInvisible);
+        break;
+    case cTextFill: // Fill
+        CGContextSetTextDrawingMode(context, kCGTextFill);
+        break;
+    case cTextStroke: // Stroke
+        CGContextSetTextDrawingMode(context, kCGTextStroke);
+        break;
+    case 3: // Fill | Stroke
+        CGContextSetTextDrawingMode(context, kCGTextFillStroke);
+        break;
+    case cTextClip: // Clip
+        CGContextSetTextDrawingMode(context, kCGTextClip);
+        break;
+    case 5: // Fill | Clip
+        CGContextSetTextDrawingMode(context, kCGTextFillClip);
+        break;
+    case 6: // Stroke | Clip
+        CGContextSetTextDrawingMode(context, kCGTextStrokeClip);
+        break;
+    case 7: // Fill | Stroke | Clip
+        CGContextSetTextDrawingMode(context, kCGTextFillStrokeClip);
+        break;
+    default:
+        break;
     }
 }
 
@@ -1138,54 +1132,54 @@ void GraphicsContext::setPlatformShouldAntialias(bool enable)
 
 #ifndef BUILDING_ON_TIGER // Tiger's setCompositeOperation() is defined in GraphicsContextMac.mm.
 void GraphicsContext::setCompositeOperation(CompositeOperator mode)
-{   
+{
     if (paintingDisabled())
         return;
 
-    CGBlendMode target = kCGBlendModeNormal;   
+    CGBlendMode target = kCGBlendModeNormal;
     switch (mode) {
-        case CompositeClear:
-            target = kCGBlendModeClear;
-            break;
-        case CompositeCopy:
-            target = kCGBlendModeCopy;
-            break;
-        case CompositeSourceOver:
-            //kCGBlendModeNormal
-            break;
-        case CompositeSourceIn:
-            target = kCGBlendModeSourceIn;
-            break;
-        case CompositeSourceOut:
-            target = kCGBlendModeSourceOut;
-            break;
-        case CompositeSourceAtop:
-            target = kCGBlendModeSourceAtop; 
-            break;
-        case CompositeDestinationOver:
-            target = kCGBlendModeDestinationOver;
-            break;
-        case CompositeDestinationIn:
-            target = kCGBlendModeDestinationIn;
-            break;
-        case CompositeDestinationOut:
-            target = kCGBlendModeDestinationOut;
-            break;
-        case CompositeDestinationAtop:
-            target = kCGBlendModeDestinationAtop;
-            break;
-        case CompositeXOR:
-            target = kCGBlendModeXOR;
-            break;
-        case CompositePlusDarker:
-            target = kCGBlendModePlusDarker;
-            break;
-        case CompositeHighlight:
-            // currently unsupported
-            break;
-        case CompositePlusLighter:
-            target = kCGBlendModePlusLighter;
-            break;
+    case CompositeClear:
+        target = kCGBlendModeClear;
+        break;
+    case CompositeCopy:
+        target = kCGBlendModeCopy;
+        break;
+    case CompositeSourceOver:
+        //kCGBlendModeNormal
+        break;
+    case CompositeSourceIn:
+        target = kCGBlendModeSourceIn;
+        break;
+    case CompositeSourceOut:
+        target = kCGBlendModeSourceOut;
+        break;
+    case CompositeSourceAtop:
+        target = kCGBlendModeSourceAtop;
+        break;
+    case CompositeDestinationOver:
+        target = kCGBlendModeDestinationOver;
+        break;
+    case CompositeDestinationIn:
+        target = kCGBlendModeDestinationIn;
+        break;
+    case CompositeDestinationOut:
+        target = kCGBlendModeDestinationOut;
+        break;
+    case CompositeDestinationAtop:
+        target = kCGBlendModeDestinationAtop;
+        break;
+    case CompositeXOR:
+        target = kCGBlendModeXOR;
+        break;
+    case CompositePlusDarker:
+        target = kCGBlendModePlusDarker;
+        break;
+    case CompositeHighlight:
+        // currently unsupported
+        break;
+    case CompositePlusLighter:
+        target = kCGBlendModePlusLighter;
+        break;
     }
     CGContextSetBlendMode(platformContext(), target);
 }
diff --git a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
index f63a8dd..38c5506 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
+++ b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
@@ -38,12 +38,10 @@ public:
 #endif
         , m_userToDeviceTransformKnownToBeIdentity(false)
     {
-        CGContextRetain(m_cgContext);
     }
     
     ~GraphicsContextPlatformPrivate()
     {
-        CGContextRelease(m_cgContext);
     }
 
 #if PLATFORM(MAC) || PLATFORM(CHROMIUM)
@@ -80,7 +78,7 @@ public:
     bool m_shouldIncludeChildWindows;
 #endif
 
-    CGContextRef m_cgContext;
+    RetainPtr<CGContextRef> m_cgContext;
     bool m_userToDeviceTransformKnownToBeIdentity;
 };
 
diff --git a/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index 6db7e88..b1896f8 100644
--- a/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -65,37 +65,37 @@ ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, b
         bytesPerRow *= 4;
     }
 
-    m_data.m_data = tryFastCalloc(size.height(), bytesPerRow);
+    if (!tryFastCalloc(size.height(), bytesPerRow).getValue(m_data.m_data))
+        return;
+
     ASSERT((reinterpret_cast<size_t>(m_data.m_data) & 2) == 0);
 
-    CGColorSpaceRef colorSpace;
+    RetainPtr<CGColorSpaceRef> colorSpace;
     switch(imageColorSpace) {
         case DeviceRGB:
-            colorSpace = CGColorSpaceCreateDeviceRGB();
+            colorSpace.adoptCF(CGColorSpaceCreateDeviceRGB());
             break;
         case GrayScale:
-            colorSpace = CGColorSpaceCreateDeviceGray();
+            colorSpace.adoptCF(CGColorSpaceCreateDeviceGray());
             break;
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER)
         case LinearRGB:
-            colorSpace = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGBLinear);
+            colorSpace.adoptCF(CGColorSpaceCreateWithName(kCGColorSpaceGenericRGBLinear));
             break;
 #endif
         default:
-            colorSpace = CGColorSpaceCreateDeviceRGB();
+            colorSpace.adoptCF(CGColorSpaceCreateDeviceRGB());
             break;
     }
 
-    CGContextRef cgContext = CGBitmapContextCreate(m_data.m_data, size.width(), size.height(), 8, bytesPerRow,
-        colorSpace, (imageColorSpace == GrayScale) ? kCGImageAlphaNone : kCGImageAlphaPremultipliedLast);
-    CGColorSpaceRelease(colorSpace);
+    RetainPtr<CGContextRef> cgContext(AdoptCF, CGBitmapContextCreate(m_data.m_data, size.width(), size.height(), 8, bytesPerRow,
+        colorSpace.get(), (imageColorSpace == GrayScale) ? kCGImageAlphaNone : kCGImageAlphaPremultipliedLast));
     if (!cgContext)
         return;
 
-    m_context.set(new GraphicsContext(cgContext));
+    m_context.set(new GraphicsContext(cgContext.get()));
     m_context->scale(FloatSize(1, -1));
     m_context->translate(0, -size.height());
-    CGContextRelease(cgContext);
     success = true;
 }
 
@@ -122,12 +122,13 @@ Image* ImageBuffer::image() const
     return m_image.get();
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
+template <Multiply multiplied>
+PassRefPtr<ImageData> getImageData(const IntRect& rect, const ImageBufferData& imageData, const IntSize& size)
 {
     PassRefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
     unsigned char* data = result->data()->data()->data();
 
-    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > m_size.width() || (rect.y() + rect.height()) > m_size.height())
+    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > size.width() || (rect.y() + rect.height()) > size.height())
         memset(data, 0, result->data()->length());
 
     int originx = rect.x();
@@ -137,8 +138,8 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originx = 0;
     }
     int endx = rect.x() + rect.width();
-    if (endx > m_size.width())
-        endx = m_size.width();
+    if (endx > size.width())
+        endx = size.width();
     int numColumns = endx - originx;
 
     int originy = rect.y();
@@ -148,20 +149,21 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originy = 0;
     }
     int endy = rect.y() + rect.height();
-    if (endy > m_size.height())
-        endy = m_size.height();
+    if (endy > size.height())
+        endy = size.height();
     int numRows = endy - originy;
 
-    unsigned srcBytesPerRow = 4 * m_size.width();
+    unsigned srcBytesPerRow = 4 * size.width();
     unsigned destBytesPerRow = 4 * rect.width();
 
     // ::create ensures that all ImageBuffers have valid data, so we don't need to check it here.
-    unsigned char* srcRows = reinterpret_cast<unsigned char*>(m_data.m_data) + originy * srcBytesPerRow + originx * 4;
+    unsigned char* srcRows = reinterpret_cast<unsigned char*>(imageData.m_data) + originy * srcBytesPerRow + originx * 4;
     unsigned char* destRows = data + desty * destBytesPerRow + destx * 4;
     for (int y = 0; y < numRows; ++y) {
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
-            if (unsigned char alpha = srcRows[basex + 3]) {
+            unsigned char alpha = srcRows[basex + 3];
+            if (multiplied == Unmultiplied && alpha) {
                 destRows[basex] = (srcRows[basex] * 255) / alpha;
                 destRows[basex + 1] = (srcRows[basex + 1] * 255) / alpha;
                 destRows[basex + 2] = (srcRows[basex + 2] * 255) / alpha;
@@ -175,7 +177,18 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     return result;
 }
 
-void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Unmultiplied>(rect, m_data, m_size);
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Premultiplied>(rect, m_data, m_size);
+}
+
+template <Multiply multiplied>
+void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint& destPoint, ImageBufferData& imageData, const IntSize& size)
 {
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -183,36 +196,36 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     int originx = sourceRect.x();
     int destx = destPoint.x() + sourceRect.x();
     ASSERT(destx >= 0);
-    ASSERT(destx < m_size.width());
+    ASSERT(destx < size.width());
     ASSERT(originx >= 0);
     ASSERT(originx <= sourceRect.right());
 
     int endx = destPoint.x() + sourceRect.right();
-    ASSERT(endx <= m_size.width());
+    ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
 
     int originy = sourceRect.y();
     int desty = destPoint.y() + sourceRect.y();
     ASSERT(desty >= 0);
-    ASSERT(desty < m_size.height());
+    ASSERT(desty < size.height());
     ASSERT(originy >= 0);
     ASSERT(originy <= sourceRect.bottom());
 
     int endy = destPoint.y() + sourceRect.bottom();
-    ASSERT(endy <= m_size.height());
+    ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
     unsigned srcBytesPerRow = 4 * source->width();
-    unsigned destBytesPerRow = 4 * m_size.width();
+    unsigned destBytesPerRow = 4 * size.width();
 
     unsigned char* srcRows = source->data()->data()->data() + originy * srcBytesPerRow + originx * 4;
-    unsigned char* destRows = reinterpret_cast<unsigned char*>(m_data.m_data) + desty * destBytesPerRow + destx * 4;
+    unsigned char* destRows = reinterpret_cast<unsigned char*>(imageData.m_data) + desty * destBytesPerRow + destx * 4;
     for (int y = 0; y < numRows; ++y) {
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
             unsigned char alpha = srcRows[basex + 3];
-            if (alpha != 255) {
+            if (multiplied == Unmultiplied && alpha != 255) {
                 destRows[basex] = (srcRows[basex] * alpha + 254) / 255;
                 destRows[basex + 1] = (srcRows[basex + 1] * alpha + 254) / 255;
                 destRows[basex + 2] = (srcRows[basex + 2] * alpha + 254) / 255;
@@ -225,6 +238,16 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     }
 }
 
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Unmultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Premultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
 static RetainPtr<CFStringRef> utiFromMIMEType(const String& mimeType)
 {
 #if PLATFORM(MAC)
diff --git a/WebCore/platform/graphics/cg/ImageCG.cpp b/WebCore/platform/graphics/cg/ImageCG.cpp
index a5620e8..4da7018 100644
--- a/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -101,30 +101,29 @@ BitmapImage::BitmapImage(CGImageRef cgImage, ImageObserver* observer)
 void BitmapImage::checkForSolidColor()
 {
     m_checkedForSolidColor = true;
-    if (frameCount() > 1)
+    if (frameCount() > 1) {
         m_isSolidColor = false;
-    else {
-        CGImageRef image = frameAtIndex(0);
-        
-        // Currently we only check for solid color in the important special case of a 1x1 image.
-        if (image && CGImageGetWidth(image) == 1 && CGImageGetHeight(image) == 1) {
-            unsigned char pixel[4]; // RGBA
-            CGColorSpaceRef space = CGColorSpaceCreateDeviceRGB();
-            CGContextRef bmap = CGBitmapContextCreate(pixel, 1, 1, 8, sizeof(pixel), space,
-                kCGImageAlphaPremultipliedLast | kCGBitmapByteOrder32Big);
-            if (bmap) {
-                GraphicsContext(bmap).setCompositeOperation(CompositeCopy);
-                CGRect dst = { {0, 0}, {1, 1} };
-                CGContextDrawImage(bmap, dst, image);
-                if (pixel[3] == 0)
-                    m_solidColor = Color(0, 0, 0, 0);
-                else
-                    m_solidColor = Color(pixel[0] * 255 / pixel[3], pixel[1] * 255 / pixel[3], pixel[2] * 255 / pixel[3], pixel[3]);
-                m_isSolidColor = true;
-                CFRelease(bmap);
-            } 
-            CFRelease(space);
-        }
+        return;
+    }
+
+    CGImageRef image = frameAtIndex(0);
+    
+    // Currently we only check for solid color in the important special case of a 1x1 image.
+    if (image && CGImageGetWidth(image) == 1 && CGImageGetHeight(image) == 1) {
+        unsigned char pixel[4]; // RGBA
+        static CGColorSpaceRef space = CGColorSpaceCreateDeviceRGB();
+        RetainPtr<CGContextRef> bmap(AdoptCF, CGBitmapContextCreate(pixel, 1, 1, 8, sizeof(pixel), space,
+            kCGImageAlphaPremultipliedLast | kCGBitmapByteOrder32Big));
+        if (!bmap)
+            return;
+        GraphicsContext(bmap.get()).setCompositeOperation(CompositeCopy);
+        CGRect dst = { {0, 0}, {1, 1} };
+        CGContextDrawImage(bmap.get(), dst, image);
+        if (pixel[3] == 0)
+            m_solidColor = Color(0, 0, 0, 0);
+        else
+            m_solidColor = Color(pixel[0] * 255 / pixel[3], pixel[1] * 255 / pixel[3], pixel[2] * 255 / pixel[3], pixel[3]);
+        m_isSolidColor = true;
     }
 }
 
@@ -252,14 +251,14 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
     CGImageRef tileImage = nativeImageForCurrentFrame();
     float h = CGImageGetHeight(tileImage);
 
-    CGImageRef subImage;
+    RetainPtr<CGImageRef> subImage;
     if (tileRect.size() == size())
         subImage = tileImage;
     else {
         // Copying a sub-image out of a partially-decoded image stops the decoding of the original image. It should never happen
         // because sub-images are only used for border-image, which only renders when the image is fully decoded.
         ASSERT(h == height());
-        subImage = CGImageCreateWithImageInRect(tileImage, tileRect);
+        subImage.adoptCF(CGImageCreateWithImageInRect(tileImage, tileRect));
     }
     
 #ifndef BUILDING_ON_TIGER
@@ -275,7 +274,7 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
 #else
     if (w == size().width() && h == size().height())
 #endif
-        CGContextDrawTiledImage(context, FloatRect(adjustedX, adjustedY, scaledTileWidth, scaledTileHeight), subImage);
+        CGContextDrawTiledImage(context, FloatRect(adjustedX, adjustedY, scaledTileWidth, scaledTileHeight), subImage.get());
     else {
 #endif
 
@@ -288,39 +287,31 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
     matrix = CGAffineTransformConcat(matrix, CGContextGetCTM(context));
     // The top of a partially-decoded image is drawn at the bottom of the tile. Map it to the top.
     matrix = CGAffineTransformTranslate(matrix, 0, size().height() - h);
-    CGPatternRef pattern = CGPatternCreate(subImage, CGRectMake(0, 0, tileRect.width(), tileRect.height()),
-                                           matrix, tileRect.width(), tileRect.height(), 
-                                           kCGPatternTilingConstantSpacing, true, &patternCallbacks);
-    if (pattern == NULL) {
-        if (subImage != tileImage)
-            CGImageRelease(subImage);
+    RetainPtr<CGPatternRef> pattern(AdoptCF, CGPatternCreate(subImage.get(), CGRectMake(0, 0, tileRect.width(), tileRect.height()),
+                                             matrix, tileRect.width(), tileRect.height(), 
+                                             kCGPatternTilingConstantSpacing, true, &patternCallbacks));
+    if (!pattern) {
         ctxt->restore();
         return;
     }
 
-    CGColorSpaceRef patternSpace = CGColorSpaceCreatePattern(NULL);
+    RetainPtr<CGColorSpaceRef> patternSpace(AdoptCF, CGColorSpaceCreatePattern(0));
     
     CGFloat alpha = 1;
-    CGColorRef color = CGColorCreateWithPattern(patternSpace, pattern, &alpha);
-    CGContextSetFillColorSpace(context, patternSpace);
-    CGColorSpaceRelease(patternSpace);
-    CGPatternRelease(pattern);
+    RetainPtr<CGColorRef> color(AdoptCF, CGColorCreateWithPattern(patternSpace.get(), pattern.get(), &alpha));
+    CGContextSetFillColorSpace(context, patternSpace.get());
 
     // FIXME: Really want a public API for this.  It is just CGContextSetBaseCTM(context, CGAffineTransformIdentiy).
     wkSetPatternBaseCTM(context, CGAffineTransformIdentity);
     CGContextSetPatternPhase(context, CGSizeZero);
 
-    CGContextSetFillColorWithColor(context, color);
+    CGContextSetFillColorWithColor(context, color.get());
     CGContextFillRect(context, CGContextGetClipBoundingBox(context));
-    
-    CGColorRelease(color);
-    
+
 #ifndef BUILDING_ON_TIGER
     }
 #endif
 
-    if (subImage != tileImage)
-        CGImageRelease(subImage);
     ctxt->restore();
 
     if (imageObserver())
diff --git a/WebCore/platform/graphics/cg/ImageSourceCG.cpp b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
index b716060..66246fe 100644
--- a/WebCore/platform/graphics/cg/ImageSourceCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
@@ -109,18 +109,16 @@ void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
 #if PLATFORM(MAC)
     // On Mac the NSData inside the SharedBuffer can be secretly appended to without the SharedBuffer's knowledge.  We use SharedBuffer's ability
     // to wrap itself inside CFData to get around this, ensuring that ImageIO is really looking at the SharedBuffer.
-    CFDataRef cfData = data->createCFData();
+    RetainPtr<CFDataRef> cfData(AdoptCF, data->createCFData());
 #else
     // If no NSData is available, then we know SharedBuffer will always just be a vector.  That means no secret changes can occur to it behind the
     // scenes.  We use CFDataCreateWithBytesNoCopy in that case. Ensure that the SharedBuffer lives as long as the CFDataRef.
     data->ref();
     CFAllocatorContext context = {0, data, 0, 0, 0, 0, 0, &sharedBufferDerefCallback, 0};
-    CFAllocatorRef derefAllocator = CFAllocatorCreate(kCFAllocatorDefault, &context);
-    CFDataRef cfData = CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(data->data()), data->size(), derefAllocator);
-    CFRelease(derefAllocator);
+    RetainPtr<CFAllocatorRef> derefAllocator(AdoptCF, CFAllocatorCreate(kCFAllocatorDefault, &context));
+    RetainPtr<CFDataRef> cfData(AdoptCF, CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(data->data()), data->size(), derefAllocator.get()));
 #endif
-    CGImageSourceUpdateData(m_decoder, cfData, allDataReceived);
-    CFRelease(cfData);
+    CGImageSourceUpdateData(m_decoder, cfData.get(), allDataReceived);
 }
 
 String ImageSource::filenameExtension() const
@@ -138,12 +136,11 @@ bool ImageSource::isSizeAvailable()
 
     // Ragnaros yells: TOO SOON! You have awakened me TOO SOON, Executus!
     if (imageSourceStatus >= kCGImageStatusIncomplete) {
-        CFDictionaryRef image0Properties = CGImageSourceCopyPropertiesAtIndex(m_decoder, 0, imageSourceOptions());
+        RetainPtr<CFDictionaryRef> image0Properties(AdoptCF, CGImageSourceCopyPropertiesAtIndex(m_decoder, 0, imageSourceOptions()));
         if (image0Properties) {
-            CFNumberRef widthNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties, kCGImagePropertyPixelWidth);
-            CFNumberRef heightNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties, kCGImagePropertyPixelHeight);
+            CFNumberRef widthNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties.get(), kCGImagePropertyPixelWidth);
+            CFNumberRef heightNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties.get(), kCGImagePropertyPixelHeight);
             result = widthNumber && heightNumber;
-            CFRelease(image0Properties);
         }
     }
     
@@ -153,17 +150,16 @@ bool ImageSource::isSizeAvailable()
 IntSize ImageSource::frameSizeAtIndex(size_t index) const
 {
     IntSize result;
-    CFDictionaryRef properties = CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions());
+    RetainPtr<CFDictionaryRef> properties(AdoptCF, CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions()));
     if (properties) {
         int w = 0, h = 0;
-        CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(properties, kCGImagePropertyPixelWidth);
+        CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyPixelWidth);
         if (num)
             CFNumberGetValue(num, kCFNumberIntType, &w);
-        num = (CFNumberRef)CFDictionaryGetValue(properties, kCGImagePropertyPixelHeight);
+        num = (CFNumberRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyPixelHeight);
         if (num)
             CFNumberGetValue(num, kCFNumberIntType, &h);
         result = IntSize(w, h);
-        CFRelease(properties);
     }
     return result;
 }
@@ -180,17 +176,15 @@ int ImageSource::repetitionCount()
         return result;
 
     // A property with value 0 means loop forever.
-    CFDictionaryRef properties = CGImageSourceCopyProperties(m_decoder, imageSourceOptions());
+    RetainPtr<CFDictionaryRef> properties(AdoptCF, CGImageSourceCopyProperties(m_decoder, imageSourceOptions()));
     if (properties) {
-        CFDictionaryRef gifProperties = (CFDictionaryRef)CFDictionaryGetValue(properties, kCGImagePropertyGIFDictionary);
+        CFDictionaryRef gifProperties = (CFDictionaryRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyGIFDictionary);
         if (gifProperties) {
             CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(gifProperties, kCGImagePropertyGIFLoopCount);
             if (num)
                 CFNumberGetValue(num, kCFNumberIntType, &result);
         } else
             result = cAnimationNone; // Turns out we're not a GIF after all, so we don't animate.
-        
-        CFRelease(properties);
     }
     
     return result;
@@ -206,20 +200,19 @@ CGImageRef ImageSource::createFrameAtIndex(size_t index)
     if (!initialized())
         return 0;
 
-    CGImageRef image = CGImageSourceCreateImageAtIndex(m_decoder, index, imageSourceOptions());
+    RetainPtr<CGImageRef> image(AdoptCF, CGImageSourceCreateImageAtIndex(m_decoder, index, imageSourceOptions()));
     CFStringRef imageUTI = CGImageSourceGetType(m_decoder);
     static const CFStringRef xbmUTI = CFSTR("public.xbitmap-image");
     if (!imageUTI || !CFEqual(imageUTI, xbmUTI))
-        return image;
+        return image.releaseRef();
     
     // If it is an xbm image, mask out all the white areas to render them transparent.
     const CGFloat maskingColors[6] = {255, 255,  255, 255, 255, 255};
-    CGImageRef maskedImage = CGImageCreateWithMaskingColors(image, maskingColors);
+    RetainPtr<CGImageRef> maskedImage(AdoptCF, CGImageCreateWithMaskingColors(image.get(), maskingColors));
     if (!maskedImage)
-        return image;
-        
-    CGImageRelease(image);
-    return maskedImage; 
+        return image.releaseRef();
+
+    return maskedImage.releaseRef();
 }
 
 bool ImageSource::frameIsCompleteAtIndex(size_t index)
@@ -233,15 +226,14 @@ float ImageSource::frameDurationAtIndex(size_t index)
         return 0;
 
     float duration = 0;
-    CFDictionaryRef properties = CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions());
+    RetainPtr<CFDictionaryRef> properties(AdoptCF, CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions()));
     if (properties) {
-        CFDictionaryRef typeProperties = (CFDictionaryRef)CFDictionaryGetValue(properties, kCGImagePropertyGIFDictionary);
+        CFDictionaryRef typeProperties = (CFDictionaryRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyGIFDictionary);
         if (typeProperties) {
             CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(typeProperties, kCGImagePropertyGIFDelayTime);
             if (num)
                 CFNumberGetValue(num, kCFNumberFloatType, &duration);
         }
-        CFRelease(properties);
     }
 
     // Many annoying ads specify a 0 duration to make an image flash as quickly as possible.
diff --git a/WebCore/platform/graphics/cg/PDFDocumentImage.cpp b/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
index 858b18e..2f5c15e 100644
--- a/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
+++ b/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
@@ -68,16 +68,14 @@ bool PDFDocumentImage::dataChanged(bool allDataReceived)
 #if PLATFORM(MAC)
         // On Mac the NSData inside the SharedBuffer can be secretly appended to without the SharedBuffer's knowledge.  We use SharedBuffer's ability
         // to wrap itself inside CFData to get around this, ensuring that ImageIO is really looking at the SharedBuffer.
-        CFDataRef data = this->data()->createCFData();
+        RetainPtr<CFDataRef> data(AdoptCF, this->data()->createCFData());
 #else
         // If no NSData is available, then we know SharedBuffer will always just be a vector.  That means no secret changes can occur to it behind the
         // scenes.  We use CFDataCreateWithBytesNoCopy in that case.
-        CFDataRef data = CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(this->data()->data()), this->data()->size(), kCFAllocatorNull);
+        RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(this->data()->data()), this->data()->size(), kCFAllocatorNull));
 #endif
-        CGDataProviderRef dataProvider = CGDataProviderCreateWithCFData(data);
-        CFRelease(data);
-        m_document = CGPDFDocumentCreateWithProvider(dataProvider);
-        CGDataProviderRelease(dataProvider);
+        RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(data.get()));
+        m_document = CGPDFDocumentCreateWithProvider(dataProvider.get());
         setCurrentPage(0);
     }
     return m_document; // return true if size is available
diff --git a/WebCore/platform/graphics/cg/PathCG.cpp b/WebCore/platform/graphics/cg/PathCG.cpp
index 5812cea..3b05641 100644
--- a/WebCore/platform/graphics/cg/PathCG.cpp
+++ b/WebCore/platform/graphics/cg/PathCG.cpp
@@ -49,9 +49,8 @@ static size_t putBytesNowhere(void*, const void*, size_t count)
 static CGContextRef createScratchContext()
 {
     CGDataConsumerCallbacks callbacks = { putBytesNowhere, 0 };
-    CGDataConsumerRef consumer = CGDataConsumerCreate(0, &callbacks);
-    CGContextRef context = CGPDFContextCreate(consumer, 0, 0);
-    CGDataConsumerRelease(consumer);
+    RetainPtr<CGDataConsumerRef> consumer(AdoptCF, CGDataConsumerCreate(0, &callbacks));
+    CGContextRef context = CGPDFContextCreate(consumer.get(), 0, 0);
 
     CGFloat black[4] = { 0, 0, 0, 1 };
     CGContextSetFillColor(context, black);
@@ -129,9 +128,8 @@ bool Path::contains(const FloatPoint &point, WindRule rule) const
         return false;
 
     // CGPathContainsPoint returns false for non-closed paths, as a work-around, we copy and close the path first.  Radar 4758998 asks for a better CG API to use
-    CGMutablePathRef path = copyCGPathClosingSubpaths(m_path);
-    bool ret = CGPathContainsPoint(path, 0, point, rule == RULE_EVENODD ? true : false);
-    CGPathRelease(path);
+    RetainPtr<CGMutablePathRef> path(AdoptCF, copyCGPathClosingSubpaths(m_path));
+    bool ret = CGPathContainsPoint(path.get(), 0, point, rule == RULE_EVENODD ? true : false);
     return ret;
 }
 
diff --git a/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
index 9252ae0..e8fa860 100644
--- a/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
@@ -261,7 +261,7 @@ static HFONT createFontIndirectAndGetWinName(const String& family, LOGFONT* winf
 // characters. Because it's family names rather than font faces we use
 // as keys, there might be edge cases where one face of a font family
 // has a different repertoire from another face of the same family. 
-typedef HashMap<const wchar_t*, UnicodeSet*> FontCmapCache;
+typedef HashMap<const wchar_t*, icu::UnicodeSet*> FontCmapCache;
 
 static bool fontContainsCharacter(const FontPlatformData* fontData,
                                   const wchar_t* family, UChar32 character)
@@ -277,7 +277,7 @@ static bool fontContainsCharacter(const FontPlatformData* fontData,
     if (!fontCmapCache)
         fontCmapCache = new FontCmapCache;
 
-    HashMap<const wchar_t*, UnicodeSet*>::iterator it = fontCmapCache->find(family);
+    HashMap<const wchar_t*, icu::UnicodeSet*>::iterator it = fontCmapCache->find(family);
     if (it != fontCmapCache->end()) 
         return it->second->contains(character);
     
@@ -308,7 +308,7 @@ static bool fontContainsCharacter(const FontPlatformData* fontData,
     // 1) port back ICU 4.0's faster look-up code for UnicodeSet
     // 2) port Mozilla's CompressedCharMap or gfxSparseBitset
     unsigned i = 0;
-    UnicodeSet* cmap = new UnicodeSet;
+    icu::UnicodeSet* cmap = new icu::UnicodeSet;
     while (i < glyphset->cRanges) {
         WCHAR start = glyphset->ranges[i].wcLow; 
         cmap->add(start, start + glyphset->ranges[i].cGlyphs - 1);
diff --git a/WebCore/platform/graphics/chromium/FontChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
index 3d67992..229188e 100644
--- a/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
@@ -459,14 +459,16 @@ void Font::drawComplexText(GraphicsContext* graphicsContext,
     TransparencyAwareUniscribePainter painter(graphicsContext, this, run, from, to, point);
 
     HDC hdc = painter.hdc();
-    if (!hdc)
+    if (windowsCanHandleTextDrawing(graphicsContext) && !hdc)
         return;
 
     // TODO(maruel): http://b/700464 SetTextColor doesn't support transparency.
     // Enforce non-transparent color.
     color = SkColorSetRGB(SkColorGetR(color), SkColorGetG(color), SkColorGetB(color));
-    SetTextColor(hdc, skia::SkColorToCOLORREF(color));
-    SetBkMode(hdc, TRANSPARENT);
+    if (hdc) {
+        SetTextColor(hdc, skia::SkColorToCOLORREF(color));
+        SetBkMode(hdc, TRANSPARENT);
+    }
 
     // If there is a non-blur shadow and both the fill color and shadow color 
     // are opaque, handle without skia. 
diff --git a/WebCore/platform/graphics/chromium/FontLinux.cpp b/WebCore/platform/graphics/chromium/FontLinux.cpp
index d4e45fb..dca0efb 100644
--- a/WebCore/platform/graphics/chromium/FontLinux.cpp
+++ b/WebCore/platform/graphics/chromium/FontLinux.cpp
@@ -45,6 +45,11 @@
 #include "SkTypeface.h"
 #include "SkUtils.h"
 
+#include <unicode/normlzr.h>
+#include <unicode/uchar.h>
+#include <wtf/OwnArrayPtr.h>
+#include <wtf/OwnPtr.h>
+
 namespace WebCore {
 
 bool Font::canReturnFallbackFontsForComplexText()
@@ -136,27 +141,29 @@ class TextRunWalker {
 public:
     TextRunWalker(const TextRun& run, unsigned startingX, const Font* font)
         : m_font(font)
-        , m_run(run)
         , m_startingX(startingX)
         , m_offsetX(m_startingX)
-        , m_iterateBackwards(run.rtl())
+        , m_run(getTextRun(run))
+        , m_iterateBackwards(m_run.rtl())
     {
+        // Do not use |run| inside this constructor. Use |m_run| instead.
+
         memset(&m_item, 0, sizeof(m_item));
         // We cannot know, ahead of time, how many glyphs a given script run
         // will produce. We take a guess that script runs will not produce more
         // than twice as many glyphs as there are code points and fallback if
         // we find that we are wrong.
-        m_maxGlyphs = run.length() * 2;
+        m_maxGlyphs = m_run.length() * 2;
         createGlyphArrays();
 
-        m_item.log_clusters = new unsigned short[run.length()];
+        m_item.log_clusters = new unsigned short[m_run.length()];
 
         m_item.face = 0;
         m_item.font = allocHarfbuzzFont();
 
-        m_item.string = run.characters();
-        m_item.stringLength = run.length();
-        m_item.item.bidiLevel = run.rtl();
+        m_item.string = m_run.characters();
+        m_item.stringLength = m_run.length();
+        m_item.item.bidiLevel = m_run.rtl();
 
         reset();
     }
@@ -283,6 +290,43 @@ public:
     }
 
 private:
+    const TextRun& getTextRun(const TextRun& originalRun)
+    {
+        // Convert the |originalRun| to NFC normalized form if combining diacritical marks
+        // (U+0300..) are used in the run. This conversion is necessary since most OpenType
+        // fonts (e.g., Arial) don't have substitution rules for the diacritical marks in
+        // their GSUB tables.
+        //
+        // Note that we don't use the icu::Normalizer::isNormalized(UNORM_NFC) API here since
+        // the API returns FALSE (= not normalized) for complex runs that don't require NFC
+        // normalization (e.g., Arabic text). Unless the run contains the diacritical marks,
+        // Harfbuzz will do the same thing for us using the GSUB table.
+        for (unsigned i = 0; i < originalRun.length(); ++i) {
+            UBlockCode block = ::ublock_getCode(originalRun[i]);
+            if (block == UBLOCK_COMBINING_DIACRITICAL_MARKS) {
+                return getNormalizedTextRun(originalRun);
+            }
+        }
+        return originalRun;
+    }
+
+    const TextRun& getNormalizedTextRun(const TextRun& originalRun)
+    {
+        icu::UnicodeString normalizedString;
+        UErrorCode error = U_ZERO_ERROR;
+        icu::Normalizer::normalize(icu::UnicodeString(originalRun.characters(), originalRun.length()), UNORM_NFC, 0 /* no options */, normalizedString, error);
+        if (U_FAILURE(error))
+            return originalRun;
+
+        m_normalizedBuffer.set(new UChar[normalizedString.length() + 1]);
+        normalizedString.extract(m_normalizedBuffer.get(), normalizedString.length() + 1, error);
+        ASSERT(U_SUCCESS(error));
+
+        m_normalizedRun.set(new TextRun(originalRun));
+        m_normalizedRun->setText(m_normalizedBuffer.get(), normalizedString.length());
+        return *m_normalizedRun;
+    }
+
     void setupFontForScriptRun()
     {
         const FontData* fontData = m_font->fontDataAt(0);
@@ -379,7 +423,6 @@ private:
     }
 
     const Font* const m_font;
-    const TextRun& m_run;
     HB_ShaperItem m_item;
     uint16_t* m_glyphs16; // A vector of 16-bit glyph ids.
     SkScalar* m_xPositions; // A vector of x positions for each glyph.
@@ -389,6 +432,10 @@ private:
     unsigned m_pixelWidth; // Width (in px) of the current script run.
     unsigned m_numCodePoints; // Code points in current script run.
     unsigned m_maxGlyphs; // Current size of all the Harfbuzz arrays.
+
+    OwnPtr<TextRun> m_normalizedRun;
+    OwnArrayPtr<UChar> m_normalizedBuffer; // A buffer for normalized run.
+    const TextRun& m_run;
     bool m_iterateBackwards;
 };
 
diff --git a/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
index 9596a4c..4e2a226 100644
--- a/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
@@ -100,11 +100,11 @@ void initializeScriptFontMap(ScriptToFontMap& scriptFontMap)
     // Initialize the locale-dependent mapping.
     // Since Chrome synchronizes the ICU default locale with its UI locale,
     // this ICU locale tells the current UI locale of Chrome.
-    Locale locale = Locale::getDefault();
+    icu::Locale locale = icu::Locale::getDefault();
     const UChar* localeFamily = 0;
-    if (locale == Locale::getJapanese())
+    if (locale == icu::Locale::getJapanese())
         localeFamily = scriptFontMap[USCRIPT_HIRAGANA];
-    else if (locale == Locale::getKorean())
+    else if (locale == icu::Locale::getKorean())
         localeFamily = scriptFontMap[USCRIPT_HANGUL];
     else {
         // Use Simplified Chinese font for all other locales including
diff --git a/WebCore/platform/graphics/chromium/UniscribeHelper.cpp b/WebCore/platform/graphics/chromium/UniscribeHelper.cpp
index 39b0847..10fcdf6 100644
--- a/WebCore/platform/graphics/chromium/UniscribeHelper.cpp
+++ b/WebCore/platform/graphics/chromium/UniscribeHelper.cpp
@@ -375,11 +375,13 @@ void UniscribeHelper::draw(GraphicsContext* graphicsContext,
             // Pass 0 in when there is no justification.
             const int* justify = shaping.m_justify.size() == 0 ? 0 : &shaping.m_justify[fromGlyph];
 
-            if (firstRun) {
-                oldFont = SelectObject(dc, shaping.m_hfont);
-                firstRun = false;
-            } else
-                SelectObject(dc, shaping.m_hfont);
+            if (useWindowsDrawing) {
+                if (firstRun) {
+                    oldFont = SelectObject(dc, shaping.m_hfont);
+                    firstRun = false;
+                } else
+                    SelectObject(dc, shaping.m_hfont);
+            }
 
             // Fonts with different ascents can be used to render different
             // runs.  'Across-runs' y-coordinate correction needs to be
@@ -401,7 +403,7 @@ void UniscribeHelper::draw(GraphicsContext* graphicsContext,
                 } else {
                     SkPoint origin;
                     origin.fX = curX + + innerOffset;
-                    origin.fY = y + m_ascent - shaping.m_ascentOffset;
+                    origin.fY = y + m_ascent;
                     textOutOk = paintSkiaText(graphicsContext,
                                               shaping.m_hfont,
                                               glyphCount,
diff --git a/WebCore/platform/graphics/filters/FEBlend.cpp b/WebCore/platform/graphics/filters/FEBlend.cpp
index 86b702f..2364cc4 100644
--- a/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,7 +25,13 @@
 #if ENABLE(FILTERS)
 #include "FEBlend.h"
 
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "FloatPoint.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+
+typedef unsigned char (*BlendType)(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB);
 
 namespace WebCore {
 
@@ -61,8 +68,77 @@ void FEBlend::setBlendMode(BlendModeType mode)
     m_mode = mode;
 }
 
-void FEBlend::apply(Filter*)
+static unsigned char unknown(unsigned char, unsigned char, unsigned char, unsigned char)
+{
+    return 0;
+}
+
+static unsigned char normal(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char)
+{
+    return (((255 - alphaA) * colorB + colorA * 255) / 255);
+}
+
+static unsigned char multiply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+{
+    return (((255 - alphaA) * colorB + (255 - alphaB + colorB) * colorA) / 255);
+}
+
+static unsigned char screen(unsigned char colorA, unsigned char colorB, unsigned char, unsigned char)
+{
+    return (((colorB + colorA) * 255 - colorA * colorB) / 255);
+}
+
+static unsigned char darken(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+{
+    return ((std::min((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255)) / 255);
+}
+
+static unsigned char lighten(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
 {
+    return ((std::max((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255)) / 255);
+}
+
+void FEBlend::apply(Filter* filter)
+{
+    m_in->apply(filter);
+    m_in2->apply(filter);
+    if (!m_in->resultImage() || !m_in2->resultImage())
+        return;
+
+    if (m_mode == FEBLEND_MODE_UNKNOWN)
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
+
+    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayB(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect)->data());
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
+
+    // Keep synchronized with BlendModeType
+    static const BlendType callEffect[] = {unknown, normal, multiply, screen, darken, lighten};
+
+    ASSERT(srcPixelArrayA->length() == srcPixelArrayB->length());
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArrayA->length(); pixelOffset += 4) {
+        unsigned char alphaA = srcPixelArrayA->get(pixelOffset + 3);
+        unsigned char alphaB = srcPixelArrayB->get(pixelOffset + 3);
+        for (unsigned channel = 0; channel < 3; ++channel) {
+            unsigned char colorA = srcPixelArrayA->get(pixelOffset + channel);
+            unsigned char colorB = srcPixelArrayB->get(pixelOffset + channel);
+
+            unsigned char result = (*callEffect[m_mode])(colorA, colorB, alphaA, alphaB);
+            imageData->data()->set(pixelOffset + channel, result);
+        }
+        unsigned char alphaR = 255 - ((255 - alphaA) * (255 - alphaB)) / 255;
+        imageData->data()->set(pixelOffset + 3, alphaR);
+    }
+
+    resultImage()->putPremultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEBlend::dump()
diff --git a/WebCore/platform/graphics/filters/FEBlend.h b/WebCore/platform/graphics/filters/FEBlend.h
index b09cd72..31c625f 100644
--- a/WebCore/platform/graphics/filters/FEBlend.h
+++ b/WebCore/platform/graphics/filters/FEBlend.h
@@ -41,7 +41,7 @@ namespace WebCore {
     class FEBlend : public FilterEffect {
     public:
         static PassRefPtr<FEBlend> create(FilterEffect*, FilterEffect*, BlendModeType);
-        
+
         FilterEffect* in2() const;
         void setIn2(FilterEffect*);
 
diff --git a/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index fb0a194..1e2e552 100644
--- a/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -166,7 +166,7 @@ void FEColorMatrix::apply(Filter* filter)
     filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
 
     IntRect imageRect(IntPoint(), resultImage()->size());
-    PassRefPtr<ImageData> imageData(resultImage()->getImageData(imageRect));
+    PassRefPtr<ImageData> imageData(resultImage()->getUnmultipliedImageData(imageRect));
     PassRefPtr<CanvasPixelArray> srcPixelArray(imageData->data());
 
     switch (m_type) {
@@ -186,7 +186,7 @@ void FEColorMatrix::apply(Filter* filter)
             break;
     }
 
-    resultImage()->putImageData(imageData.get(), imageRect, IntPoint());
+    resultImage()->putUnmultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEColorMatrix::dump()
diff --git a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 54ac123..43e5edd 100644
--- a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,10 +25,16 @@
 #if ENABLE(FILTERS)
 #include "FEComponentTransfer.h"
 
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include <math.h>
 
 namespace WebCore {
 
+typedef void (*TransferType)(unsigned char*, const ComponentTransferFunction&);
+
 FEComponentTransfer::FEComponentTransfer(FilterEffect* in, const ComponentTransferFunction& redFunc, 
     const ComponentTransferFunction& greenFunc, const ComponentTransferFunction& blueFunc, const ComponentTransferFunction& alphaFunc)
     : FilterEffect()
@@ -85,8 +92,91 @@ void FEComponentTransfer::setAlphaFunction(const ComponentTransferFunction& func
     m_alphaFunc = func;
 }
 
-void FEComponentTransfer::apply(Filter*)
+void identity(unsigned char*, const ComponentTransferFunction&)
+{
+}
+
+void table(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    const Vector<float>& tableValues = transferFunction.tableValues;
+    unsigned n = tableValues.size();
+    if (n < 1)
+        return;            
+    for (unsigned i = 0; i < 256; ++i) {
+        double c = i / 255.0;                
+        unsigned k = static_cast<unsigned>(c * (n - 1));
+        double v1 = tableValues[k];
+        double v2 = tableValues[std::min((k + 1), (n - 1))];
+        double val = 255.0 * (v1 + (c * (n - 1) - k) * (v2 - v1));
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void discrete(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    const Vector<float>& tableValues = transferFunction.tableValues;
+    unsigned n = tableValues.size();
+    if (n < 1)
+        return;
+    for (unsigned i = 0; i < 256; ++i) {
+        unsigned k = static_cast<unsigned>((i * n) / 255.0);
+        k = std::min(k, n - 1);
+        double val = 255 * tableValues[k];
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void linear(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    for (unsigned i = 0; i < 256; ++i) {
+        double val = transferFunction.slope * i + 255 * transferFunction.intercept;
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void gamma(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    for (unsigned i = 0; i < 256; ++i) {
+        double val = 255.0 * (transferFunction.amplitude * pow((i / 255.0), transferFunction.exponent) + transferFunction.offset);
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void FEComponentTransfer::apply(Filter* filter)
 {
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    unsigned char rValues[256], gValues[256], bValues[256], aValues[256];
+    for (unsigned i = 0; i < 256; ++i)
+        rValues[i] = gValues[i] = bValues[i] = aValues[i] = i;
+    unsigned char* tables[] = { rValues, gValues, bValues, aValues };
+    ComponentTransferFunction transferFunction[] = {m_redFunc, m_greenFunc, m_blueFunc, m_alphaFunc};
+    TransferType callEffect[] = {identity, identity, table, discrete, linear, gamma};
+
+    for (unsigned channel = 0; channel < 4; channel++)
+        (*callEffect[transferFunction[channel].type])(tables[channel], transferFunction[channel]);
+
+    IntRect drawingRect = calculateDrawingIntRect(m_in->subRegion());
+    RefPtr<ImageData> imageData(m_in->resultImage()->getUnmultipliedImageData(drawingRect));
+    CanvasPixelArray* srcPixelArray(imageData->data());
+
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArray->length(); pixelOffset += 4) {
+        for (unsigned channel = 0; channel < 4; ++channel) {
+            unsigned char c = srcPixelArray->get(pixelOffset + channel);
+            imageData->data()->set(pixelOffset + channel, tables[channel][c]);
+        }
+    }
+
+    resultImage()->putUnmultipliedImageData(imageData.get(), IntRect(IntPoint(), resultImage()->size()), IntPoint());
 }
 
 void FEComponentTransfer::dump()
diff --git a/WebCore/platform/graphics/filters/FEComposite.cpp b/WebCore/platform/graphics/filters/FEComposite.cpp
index 0706358..1b41165 100644
--- a/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,7 +25,10 @@
 #if ENABLE(FILTERS)
 #include "FEComposite.h"
 
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
 
 namespace WebCore {
 
@@ -97,8 +101,74 @@ void FEComposite::setK4(float k4)
     m_k4 = k4;
 }
 
-void FEComposite::apply(Filter*)
+inline void arithmetic(const RefPtr<CanvasPixelArray>& srcPixelArrayA, CanvasPixelArray*& srcPixelArrayB,
+                       float k1, float k2, float k3, float k4)
 {
+    float scaledK1 = k1 / 255.f;
+    float scaledK4 = k4 * 255.f;
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArrayA->length(); pixelOffset += 4) {
+        for (unsigned channel = 0; channel < 4; ++channel) {
+            unsigned char i1 = srcPixelArrayA->get(pixelOffset + channel);
+            unsigned char i2 = srcPixelArrayB->get(pixelOffset + channel);
+
+            unsigned char result = scaledK1 * i1 * i2 + k2 * i1 + k3 * i2 + scaledK4;
+            if (channel == 3 && i1 == 0 && i2 == 0)
+                result = 0;
+            srcPixelArrayB->set(pixelOffset + channel, result);
+        }
+    }
+}
+
+void FEComposite::apply(Filter* filter)
+{
+    m_in->apply(filter);
+    m_in2->apply(filter);
+    if (!m_in->resultImage() || !m_in2->resultImage())
+        return;
+
+    GraphicsContext* filterContext = getEffectContext();
+    if (!filterContext)
+        return;
+
+    FloatRect srcRect = FloatRect(0.f, 0.f, -1.f, -1.f);
+    switch (m_type) {
+    case FECOMPOSITE_OPERATOR_OVER:
+        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        break;
+    case FECOMPOSITE_OPERATOR_IN:
+        filterContext->save();
+        filterContext->clipToImageBuffer(calculateDrawingRect(m_in2->subRegion()), m_in2->resultImage());
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        filterContext->restore();
+        break;
+    case FECOMPOSITE_OPERATOR_OUT:
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()), srcRect, CompositeDestinationOut);
+        break;
+    case FECOMPOSITE_OPERATOR_ATOP:
+        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()), srcRect, CompositeSourceAtop);
+        break;
+    case FECOMPOSITE_OPERATOR_XOR:
+        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()), srcRect, CompositeXOR);
+        break;
+    case FECOMPOSITE_OPERATOR_ARITHMETIC: {
+        IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+        RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
+
+        IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+        RefPtr<ImageData> imageData(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect));
+        CanvasPixelArray* srcPixelArrayB(imageData->data());
+
+        arithmetic(srcPixelArrayA, srcPixelArrayB, m_k1, m_k2, m_k3, m_k4);
+        resultImage()->putPremultipliedImageData(imageData.get(), IntRect(IntPoint(), resultImage()->size()), IntPoint());
+        }
+        break;
+    default:
+        break;
+    }
 }
 
 void FEComposite::dump()
diff --git a/WebCore/platform/graphics/filters/FilterEffect.cpp b/WebCore/platform/graphics/filters/FilterEffect.cpp
index 41e8a39..5818e50 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -59,6 +59,13 @@ FloatRect FilterEffect::calculateEffectRect(Filter* filter)
     return subRegion();
 }
 
+IntRect FilterEffect::calculateDrawingIntRect(const FloatRect& effectRect)
+{
+    IntPoint location = roundedIntPoint(FloatPoint(subRegion().x() - effectRect.x(),
+                                                   subRegion().y() - effectRect.y()));
+    return IntRect(location, resultImage()->size());
+}
+
 FloatRect FilterEffect::calculateDrawingRect(const FloatRect& srcRect)
 {
     FloatPoint startPoint = FloatPoint(srcRect.x() - subRegion().x(), srcRect.y() - subRegion().y());
diff --git a/WebCore/platform/graphics/filters/FilterEffect.h b/WebCore/platform/graphics/filters/FilterEffect.h
index 8dc6233..e2b8a0e 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/WebCore/platform/graphics/filters/FilterEffect.h
@@ -77,6 +77,7 @@ namespace WebCore {
 
         GraphicsContext* getEffectContext();
         FloatRect calculateDrawingRect(const FloatRect&);
+        IntRect calculateDrawingIntRect(const FloatRect&);
 
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return filter->filterRegion(); }
         virtual FloatRect calculateEffectRect(Filter*);
diff --git a/WebCore/platform/graphics/filters/SourceAlpha.cpp b/WebCore/platform/graphics/filters/SourceAlpha.cpp
index 646a57b..57436be 100644
--- a/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -22,6 +22,7 @@
 #if ENABLE(FILTERS)
 #include "SourceAlpha.h"
 
+#include "Color.h"
 #include "GraphicsContext.h"
 #include "PlatformString.h"
 #include "Filter.h"
@@ -41,8 +42,28 @@ const AtomicString& SourceAlpha::effectName()
     return s_effectName;
 }
 
-void SourceAlpha::apply(Filter*)
+FloatRect SourceAlpha::calculateEffectRect(Filter* filter)
 {
+    FloatRect clippedSourceRect = filter->sourceImageRect();
+    if (filter->sourceImageRect().x() < filter->filterRegion().x())
+        clippedSourceRect.setX(filter->filterRegion().x());
+    if (filter->sourceImageRect().y() < filter->filterRegion().y())
+        clippedSourceRect.setY(filter->filterRegion().y());
+    setSubRegion(clippedSourceRect);
+    return filter->filterRegion();
+}
+
+void SourceAlpha::apply(Filter* filter)
+{
+    GraphicsContext* filterContext = getEffectContext();
+    if (!filterContext)
+        return;
+
+    FloatRect imageRect(FloatPoint(), filter->sourceImage()->image()->size());
+    filterContext->save();
+    filterContext->clipToImageBuffer(imageRect, filter->sourceImage());
+    filterContext->fillRect(imageRect, Color::black);
+    filterContext->restore();
 }
 
 void SourceAlpha::dump()
diff --git a/WebCore/platform/graphics/filters/SourceAlpha.h b/WebCore/platform/graphics/filters/SourceAlpha.h
index 5341562..172d05a 100644
--- a/WebCore/platform/graphics/filters/SourceAlpha.h
+++ b/WebCore/platform/graphics/filters/SourceAlpha.h
@@ -35,7 +35,7 @@ namespace WebCore {
         static const AtomicString& effectName();
 
         virtual bool isSourceInput() { return true; }
-        virtual FloatRect calculateEffectRect(Filter* filter) { return filter->sourceImageRect(); }
+        virtual FloatRect calculateEffectRect(Filter*);
         void apply(Filter*);
         void dump();
     
diff --git a/WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp b/WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp
new file mode 100644
index 0000000..a6c2dfb
--- /dev/null
+++ b/WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp
@@ -0,0 +1,243 @@
+/*
+ *  Copyright (C) 2009 Igalia S.L
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DataSourceGStreamer.h"
+
+#include <gio/gio.h>
+#include <glib.h>
+#include <gst/gst.h>
+#include <gst/pbutils/missing-plugins.h>
+
+static GstStaticPadTemplate src_template = GST_STATIC_PAD_TEMPLATE("src",
+                                                                   GST_PAD_SRC,
+                                                                   GST_PAD_ALWAYS,
+                                                                   GST_STATIC_CAPS_ANY);
+
+GST_DEBUG_CATEGORY_STATIC(webkit_data_src_debug);
+#define GST_CAT_DEFAULT webkit_data_src_debug
+
+static void webkit_data_src_uri_handler_init(gpointer g_iface,
+                                             gpointer iface_data);
+
+static void webkit_data_src_finalize(WebkitDataSrc* src);
+static GstStateChangeReturn webkit_data_src_change_state(GstElement* element,
+                                                         GstStateChange transition);
+
+static const GInterfaceInfo urihandler_info = {
+    webkit_data_src_uri_handler_init,
+    0, 0
+};
+
+
+static void _do_init(GType datasrc_type)
+{
+    GST_DEBUG_CATEGORY_INIT(webkit_data_src_debug, "webkit_data_src", 0, "datasrc element");
+    g_type_add_interface_static(datasrc_type, GST_TYPE_URI_HANDLER,
+                                &urihandler_info);
+}
+
+GST_BOILERPLATE_FULL(WebkitDataSrc, webkit_data_src, GstBin, GST_TYPE_BIN, _do_init);
+
+static void webkit_data_src_base_init(gpointer klass)
+{
+    GstElementClass* element_class = GST_ELEMENT_CLASS(klass);
+
+    gst_element_class_add_pad_template(element_class,
+                                       gst_static_pad_template_get(&src_template));
+    gst_element_class_set_details_simple(element_class, (gchar*) "WebKit data source element",
+                                         (gchar*) "Source",
+                                         (gchar*) "Handles data: uris",
+                                         (gchar*) "Philippe Normand <pnormand@igalia.com>");
+
+}
+
+static void webkit_data_src_class_init(WebkitDataSrcClass* klass)
+{
+    GObjectClass* oklass = G_OBJECT_CLASS(klass);
+    GstElementClass* eklass = GST_ELEMENT_CLASS(klass);
+
+    oklass->finalize = (GObjectFinalizeFunc) webkit_data_src_finalize;
+    eklass->change_state = webkit_data_src_change_state;
+}
+
+
+static gboolean webkit_data_src_reset(WebkitDataSrc* src)
+{
+    GstPad* targetpad;
+
+    if (src->kid) {
+        gst_element_set_state(src->kid, GST_STATE_NULL);
+        gst_bin_remove(GST_BIN(src), src->kid);
+    }
+
+    src->kid = gst_element_factory_make("giostreamsrc", "streamsrc");
+    if (!src->kid) {
+        GST_ERROR_OBJECT(src, "Failed to create giostreamsrc");
+        return FALSE;
+    }
+
+    gst_bin_add(GST_BIN(src), src->kid);
+
+    targetpad = gst_element_get_static_pad(src->kid, "src");
+    gst_ghost_pad_set_target(GST_GHOST_PAD(src->pad), targetpad);
+    gst_object_unref(targetpad);
+
+    return TRUE;
+}
+
+static void webkit_data_src_init(WebkitDataSrc* src,
+                                 WebkitDataSrcClass* g_class)
+{
+    GstPadTemplate* pad_template = gst_static_pad_template_get(&src_template);
+    src->pad = gst_ghost_pad_new_no_target_from_template("src",
+                                                         pad_template);
+
+    gst_element_add_pad(GST_ELEMENT(src), src->pad);
+
+    webkit_data_src_reset(src);
+}
+
+static void webkit_data_src_finalize(WebkitDataSrc* src)
+{
+    g_free(src->uri);
+
+    if (src->kid) {
+        GST_DEBUG_OBJECT(src, "Removing giostreamsrc element");
+        gst_element_set_state(src->kid, GST_STATE_NULL);
+        gst_bin_remove(GST_BIN(src), src->kid);
+        src->kid = 0;
+    }
+
+    GST_CALL_PARENT(G_OBJECT_CLASS, finalize, ((GObject* )(src)));
+}
+
+static GstStateChangeReturn webkit_data_src_change_state(GstElement* element, GstStateChange transition)
+{
+    GstStateChangeReturn ret = GST_STATE_CHANGE_SUCCESS;
+    WebkitDataSrc* src = WEBKIT_DATA_SRC(element);
+
+    switch (transition) {
+    case GST_STATE_CHANGE_NULL_TO_READY:
+        if (!src->kid) {
+            gst_element_post_message(element,
+                                     gst_missing_element_message_new(element, "giostreamsrc"));
+            GST_ELEMENT_ERROR(src, CORE, MISSING_PLUGIN, (0), ("no giostreamsrc"));
+            return GST_STATE_CHANGE_FAILURE;
+        }
+        break;
+    default:
+        break;
+    }
+
+    ret = GST_ELEMENT_CLASS(parent_class)->change_state(element, transition);
+    if (G_UNLIKELY(ret == GST_STATE_CHANGE_FAILURE))
+        return ret;
+
+    // Downwards state change code should be here, after chaining up
+    // to the parent class.
+
+    return ret;
+}
+
+/*** GSTURIHANDLER INTERFACE *************************************************/
+
+static GstURIType webkit_data_src_uri_get_type(void)
+{
+    return GST_URI_SRC;
+}
+
+static gchar** webkit_data_src_uri_get_protocols(void)
+{
+    static gchar* protocols[] = {(gchar*) "data", 0 };
+
+    return protocols;
+}
+
+static const gchar* webkit_data_src_uri_get_uri(GstURIHandler* handler)
+{
+    WebkitDataSrc* src = WEBKIT_DATA_SRC(handler);
+
+    return src->uri;
+}
+
+static gboolean webkit_data_src_uri_set_uri(GstURIHandler* handler, const gchar* uri)
+{
+    WebkitDataSrc* src = WEBKIT_DATA_SRC(handler);
+
+    // URI as defined in RFC2397:
+    // "data:" [ mediatype ] [ ";base64" ] "," data
+    // we parse URIs like this one:
+    // data:audio/3gpp;base64,AA...
+
+    gchar** scheme_and_remains = g_strsplit(uri, ":", 2);
+    gchar** mime_type_and_options = g_strsplit(scheme_and_remains[1], ";", 0);
+    gint options_size = g_strv_length(mime_type_and_options);
+    gchar* data = 0;
+    gchar* mime_type = 0;
+    gint ret = FALSE;
+
+    // we require uris with a specified mime-type and base64-encoded
+    // data. It doesn't make much sense anyway to play plain/text data
+    // with very few allowed characters (as per the RFC).
+
+    if (GST_STATE(src) >= GST_STATE_PAUSED) {
+        GST_ERROR_OBJECT(src, "Element already configured. Reset it and retry");
+    } else if (!options_size)
+        GST_ERROR_OBJECT(src, "A mime-type is needed in %s", uri);
+    else {
+        mime_type = mime_type_and_options[0];
+        data = mime_type_and_options[options_size-1];
+
+        guchar* decoded_data = 0;
+        gsize decoded_size;
+
+        if (!g_str_has_prefix(data, "base64"))
+            GST_ERROR_OBJECT(src, "Data has to be base64-encoded in %s", uri);
+        else {
+            decoded_data = g_base64_decode(data+7, &decoded_size);
+            GInputStream* stream = g_memory_input_stream_new_from_data(decoded_data,
+                                                                       decoded_size,
+                                                                       g_free);
+            g_object_set(src->kid, "stream", stream, 0);
+            g_object_unref(stream);
+
+            if (src->uri) {
+                g_free(src->uri);
+                src->uri = 0;
+            }
+
+            src->uri = g_strdup(uri);
+            ret = TRUE;
+        }
+    }
+
+    g_strfreev(scheme_and_remains);
+    g_strfreev(mime_type_and_options);
+    return ret;
+}
+
+static void webkit_data_src_uri_handler_init(gpointer g_iface, gpointer iface_data)
+{
+    GstURIHandlerInterface* iface = (GstURIHandlerInterface *) g_iface;
+
+    iface->get_type = webkit_data_src_uri_get_type;
+    iface->get_protocols = webkit_data_src_uri_get_protocols;
+    iface->get_uri = webkit_data_src_uri_get_uri;
+    iface->set_uri = webkit_data_src_uri_set_uri;
+}
diff --git a/WebCore/platform/graphics/gtk/DataSourceGStreamer.h b/WebCore/platform/graphics/gtk/DataSourceGStreamer.h
new file mode 100644
index 0000000..3e88f63
--- /dev/null
+++ b/WebCore/platform/graphics/gtk/DataSourceGStreamer.h
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2009 Igalia S.L
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DATA_SOURCE_GSTREAMER_H
+#define DATA_SOURCE_GSTREAMER_H
+
+#include <glib-object.h>
+#include <gst/base/gstbasesrc.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_DATA_SRC            (webkit_data_src_get_type ())
+#define WEBKIT_DATA_SRC(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_DATA_SRC, WebkitDataSrc))
+#define WEBKIT_DATA_SRC_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_DATA_SRC, WebkitDataSrcClass))
+#define WEBKIT_IS_DATA_SRC(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_DATA_SRC))
+#define WEBKIT_IS_DATA_SRC_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_DATA_SRC))
+
+typedef struct _WebkitDataSrc        WebkitDataSrc;
+typedef struct _WebkitDataSrcClass   WebkitDataSrcClass;
+
+
+struct _WebkitDataSrc {
+    GstBin parent;
+
+    /* explicit pointers to stuff used */
+    GstElement* kid;
+    GstPad* pad;
+    gchar* uri;
+};
+
+struct _WebkitDataSrcClass {
+    GstBinClass parent_class;
+};
+
+GType webkit_data_src_get_type(void);
+
+G_END_DECLS
+
+#endif
diff --git a/WebCore/platform/graphics/gtk/FontPlatformData.h b/WebCore/platform/graphics/gtk/FontPlatformData.h
index 2a65f1e..d30b480 100644
--- a/WebCore/platform/graphics/gtk/FontPlatformData.h
+++ b/WebCore/platform/graphics/gtk/FontPlatformData.h
@@ -87,7 +87,7 @@ public:
     bool syntheticBold() const { return m_syntheticBold; }
     bool syntheticOblique() const { return m_syntheticOblique; }
 
-    void setFont(cairo_t*) const;
+    cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
 
     unsigned hash() const
     {
diff --git a/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp b/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp
index f2c5f0c..0b1280e 100644
--- a/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp
+++ b/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp
@@ -224,10 +224,8 @@ FontPlatformData::~FontPlatformData()
         m_fallbacks = 0;
     }
 
-    if (m_scaledFont) {
+    if (m_scaledFont)
         cairo_scaled_font_destroy(m_scaledFont);
-        m_scaledFont = 0;
-    }
 }
 
 bool FontPlatformData::isFixedPitch()
@@ -242,13 +240,6 @@ bool FontPlatformData::isFixedPitch()
     return false;
 }
 
-void FontPlatformData::setFont(cairo_t* cr) const
-{
-    ASSERT(m_scaledFont);
-
-    cairo_set_scaled_font(cr, m_scaledFont);
-}
-
 bool FontPlatformData::operator==(const FontPlatformData& other) const
 {
     if (m_pattern == other.m_pattern)
diff --git a/WebCore/platform/graphics/gtk/FontPlatformDataPango.cpp b/WebCore/platform/graphics/gtk/FontPlatformDataPango.cpp
index 9ea6811..8a1a5f1 100644
--- a/WebCore/platform/graphics/gtk/FontPlatformDataPango.cpp
+++ b/WebCore/platform/graphics/gtk/FontPlatformDataPango.cpp
@@ -214,13 +214,6 @@ bool FontPlatformData::isFixedPitch()
     return pango_font_family_is_monospace(family);
 }
 
-void FontPlatformData::setFont(cairo_t* cr) const
-{
-    ASSERT(m_scaledFont);
-
-    cairo_set_scaled_font(cr, m_scaledFont);
-}
-
 FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
 {
     // Check for self-assignment.
diff --git a/WebCore/platform/graphics/gtk/ImageGtk.cpp b/WebCore/platform/graphics/gtk/ImageGtk.cpp
index 0e92d6c..38da70d 100644
--- a/WebCore/platform/graphics/gtk/ImageGtk.cpp
+++ b/WebCore/platform/graphics/gtk/ImageGtk.cpp
@@ -88,26 +88,67 @@ PassRefPtr<Image> Image::loadPlatformResource(const char* name)
     return img.release();
 }
 
+static inline unsigned char* getCairoSurfacePixel(unsigned char* data, uint x, uint y, uint rowStride)
+{
+    return data + (y * rowStride) + x * 4;
+}
+
+static inline guchar* getGdkPixbufPixel(guchar* data, uint x, uint y, uint rowStride)
+{
+    return data + (y * rowStride) + x * 4;
+}
+
 GdkPixbuf* BitmapImage::getGdkPixbuf()
 {
     int width = cairo_image_surface_get_width(frameAtIndex(currentFrame()));
     int height = cairo_image_surface_get_height(frameAtIndex(currentFrame()));
-
-    int bestDepth = gdk_visual_get_best_depth();
-    GdkColormap* cmap = gdk_colormap_new(gdk_visual_get_best_with_depth(bestDepth), true);
-
-    GdkPixmap* pixmap = gdk_pixmap_new(0, width, height, bestDepth);
-    gdk_drawable_set_colormap(GDK_DRAWABLE(pixmap), cmap);
-    cairo_t* cr = gdk_cairo_create(GDK_DRAWABLE(pixmap));
-    cairo_set_source_surface(cr, frameAtIndex(currentFrame()), 0, 0);
-    cairo_paint(cr);
-    cairo_destroy(cr);
-
-    GdkPixbuf* pixbuf = gdk_pixbuf_get_from_drawable(0, GDK_DRAWABLE(pixmap), 0, 0, 0, 0, 0, width, height);
-    g_object_unref(pixmap);
-    g_object_unref(cmap);
-
-    return pixbuf;
+    unsigned char* surfaceData = cairo_image_surface_get_data(frameAtIndex(currentFrame()));
+    int surfaceRowStride = cairo_image_surface_get_stride(frameAtIndex(currentFrame()));
+
+    GdkPixbuf* dest = gdk_pixbuf_new(GDK_COLORSPACE_RGB, TRUE, 8, width, height);
+    if (!dest)
+        return 0;
+
+    guchar* pixbufData = gdk_pixbuf_get_pixels(dest);
+    int pixbufRowStride = gdk_pixbuf_get_rowstride(dest);
+
+    /* From: http://cairographics.org/manual/cairo-image-surface.html#cairo-format-t
+     * "CAIRO_FORMAT_ARGB32: each pixel is a 32-bit quantity, with alpha in
+     * the upper 8 bits, then red, then green, then blue. The 32-bit
+     * quantities are stored native-endian. Pre-multiplied alpha is used.
+     * (That is, 50% transparent red is 0x80800000, not 0x80ff0000.)"
+     *
+     * See http://developer.gimp.org/api/2.0/gdk-pixbuf/gdk-pixbuf-gdk-pixbuf.html#GdkPixbuf
+     * for information on the structure of GdkPixbufs stored with GDK_COLORSPACE_RGB.
+     *
+     * RGB color channels in CAIRO_FORMAT_ARGB32 are stored based on the
+     * endianness of the machine and are also multiplied by the alpha channel.
+     * To properly transfer the data from the Cairo surface we must divide each
+     * of the RGB channels by the alpha channel and then reorder all channels
+     * if this machine is little-endian.
+     */
+    for (int y = 0; y < height; y++) {
+        for (int x = 0; x < width; x++) {
+            unsigned char* source = getCairoSurfacePixel(surfaceData, x, y, surfaceRowStride);
+            guchar* dest = getGdkPixbufPixel(pixbufData, x, y, pixbufRowStride);
+
+#if G_BYTE_ORDER == G_LITTLE_ENDIAN
+            guchar alpha = source[3];
+            dest[0] = alpha ? ((source[2] * 255) / alpha) : 0;
+            dest[1] = alpha ? ((source[1] * 255) / alpha) : 0;
+            dest[2] = alpha ? ((source[0] * 255) / alpha) : 0;
+            dest[3] = alpha;
+#else
+            guchar alpha = source[0];
+            dest[0] = alpha ? ((source[1] * 255) / alpha) : 0;
+            dest[1] = alpha ? ((source[2] * 255) / alpha) : 0;
+            dest[2] = alpha ? ((source[3] * 255) / alpha) : 0;
+            dest[3] = alpha;
+#endif
+        }
+    }
+
+    return dest;
 }
 
 }
diff --git a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
index 4e4bda9..65c64b4 100644
--- a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 2007, 2009 Apple Inc.  All rights reserved.
  * Copyright (C) 2007 Collabora Ltd.  All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2009 Gustavo Noronha Silva <gns@gnome.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,6 +25,7 @@
 #if ENABLE(VIDEO)
 
 #include "MediaPlayerPrivateGStreamer.h"
+#include "DataSourceGStreamer.h"
 
 #include "CString.h"
 #include "GraphicsContext.h"
@@ -35,6 +37,7 @@
 #include "ScrollView.h"
 #include "VideoSinkGStreamer.h"
 #include "Widget.h"
+#include "TimeRanges.h"
 
 #include <gst/base/gstbasesrc.h>
 #include <gst/gst.h>
@@ -56,13 +59,19 @@ gboolean mediaPlayerPrivateErrorCallback(GstBus* bus, GstMessage* message, gpoin
         GOwnPtr<gchar> debug;
 
         gst_message_parse_error(message, &err.outPtr(), &debug.outPtr());
-        if (err->code == 3) {
-            LOG_VERBOSE(Media, "File not found");
-            MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
-            if (mp)
-                mp->loadingFailed();
-        } else
-            LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
+        LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
+
+        MediaPlayer::NetworkState error = MediaPlayer::Empty;
+        if (err->domain == GST_CORE_ERROR || err->domain == GST_LIBRARY_ERROR)
+            error = MediaPlayer::DecodeError;
+        else if (err->domain == GST_RESOURCE_ERROR)
+            error = MediaPlayer::FormatError;
+        else if (err->domain == GST_STREAM_ERROR)
+            error = MediaPlayer::NetworkError;
+
+        MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
+        if (mp)
+            mp->loadingFailed(error);
     }
     return true;
 }
@@ -112,6 +121,19 @@ void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
         registrar(create, getSupportedTypes, supportsType);
 }
 
+static bool gstInitialized = false;
+
+static void do_gst_init() {
+    // FIXME: We should pass the arguments from the command line
+    if (!gstInitialized) {
+        gst_init(0, 0);
+        gstInitialized = true;
+        gst_element_register(0, "webkitmediasrc", GST_RANK_PRIMARY,
+                             WEBKIT_TYPE_DATA_SRC);
+
+    }
+}
+
 MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     : m_player(player)
     , m_playBin(0)
@@ -119,7 +141,6 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     , m_source(0)
     , m_rate(1.0f)
     , m_endTime(numeric_limits<float>::infinity())
-    , m_isEndReached(false)
     , m_volume(0.5f)
     , m_networkState(MediaPlayer::Empty)
     , m_readyState(MediaPlayer::HaveNothing)
@@ -127,19 +148,22 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     , m_isStreaming(false)
     , m_size(IntSize())
     , m_visible(true)
+    , m_paused(true)
+    , m_seeking(false)
+    , m_errorOccured(false)
 {
-
-    static bool gstInitialized = false;
-    // FIXME: We should pass the arguments from the command line
-    if (!gstInitialized) {
-        gst_init(0, 0);
-        gstInitialized = true;
-    }
+    do_gst_init();
 
     // FIXME: The size shouldn't be fixed here, this is just a quick hack.
     m_surface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, 640, 480);
 }
 
+static gboolean idleUnref(gpointer data)
+{
+    g_object_unref(reinterpret_cast<GObject*>(data));
+    return FALSE;
+}
+
 MediaPlayerPrivate::~MediaPlayerPrivate()
 {
     if (m_surface)
@@ -149,6 +173,18 @@ MediaPlayerPrivate::~MediaPlayerPrivate()
         gst_element_set_state(m_playBin, GST_STATE_NULL);
         gst_object_unref(GST_OBJECT(m_playBin));
     }
+
+    // FIXME: We should find a better way to handle the lifetime of this object; this is
+    // needed because the object is sometimes being destroyed inbetween a call to
+    // webkit_video_sink_render, and the idle it schedules. Adding a ref in
+    // webkit_video_sink_render that would be balanced by the idle is not an option,
+    // because in some cases the destruction of the sink may happen in time for the idle
+    // to be removed from the queue, so it may not run. It would also cause lots of ref
+    // counting churn (render/idle are called many times). This is an ugly race.
+    if (m_videoSink) {
+        g_idle_add(idleUnref, m_videoSink);
+        m_videoSink = 0;
+    }
 }
 
 void MediaPlayerPrivate::load(const String& url)
@@ -170,20 +206,13 @@ void MediaPlayerPrivate::load(const String& url)
 void MediaPlayerPrivate::play()
 {
     LOG_VERBOSE(Media, "Play");
-    // When end reached, rewind for Test video-seek-past-end-playing
-    if (m_isEndReached)
-        seek(0);
-    m_isEndReached = false;
-
     gst_element_set_state(m_playBin, GST_STATE_PLAYING);
-    m_startedPlaying = true;
 }
 
 void MediaPlayerPrivate::pause()
 {
     LOG_VERBOSE(Media, "Pause");
     gst_element_set_state(m_playBin, GST_STATE_PAUSED);
-    m_startedPlaying = false;
 }
 
 float MediaPlayerPrivate::duration() const
@@ -191,17 +220,24 @@ float MediaPlayerPrivate::duration() const
     if (!m_playBin)
         return 0.0;
 
+    if (m_errorOccured)
+        return 0.0;
+
     GstFormat timeFormat = GST_FORMAT_TIME;
     gint64 timeLength = 0;
 
-    // FIXME: We try to get the duration, but we do not trust the
+#if !GST_CHECK_VERSION(0, 10, 23)
+    // We try to get the duration, but we do not trust the
     // return value of the query function only; the problem we are
     // trying to work-around here is that pipelines in stream mode may
     // not be able to figure out the duration, but still return true!
-    // See https://bugs.webkit.org/show_bug.cgi?id=24639.
+    // See https://bugs.webkit.org/show_bug.cgi?id=24639 which has been
+    // fixed in gst-plugins-base 0.10.23
     if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeLength <= 0) {
+#else
+    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength)) {
+#endif
         LOG_VERBOSE(Media, "Time duration query failed.");
-        m_isStreaming = true;
         return numeric_limits<float>::infinity();
     }
 
@@ -215,22 +251,24 @@ float MediaPlayerPrivate::currentTime() const
 {
     if (!m_playBin)
         return 0;
-    // Necessary as sometimes, gstreamer return 0:00 at the EOS
-    if (m_isEndReached)
-        return m_endTime;
 
-    float ret;
+    if (m_errorOccured)
+        return 0;
+
+    float ret = 0.0;
 
     GstQuery* query = gst_query_new_position(GST_FORMAT_TIME);
-    if (gst_element_query(m_playBin, query)) {
-        gint64 position;
-        gst_query_parse_position(query, 0, &position);
-        ret = (float) (position / 1000000000.0);
-        LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
-    } else {
+    if (!gst_element_query(m_playBin, query)) {
         LOG_VERBOSE(Media, "Position query failed...");
-        ret = 0.0;
+        gst_query_unref(query);
+        return ret;
     }
+
+    gint64 position;
+    gst_query_parse_position(query, 0, &position);
+    ret = (float) (position / 1000000000.0);
+    LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
+
     gst_query_unref(query);
 
     return ret;
@@ -246,35 +284,23 @@ void MediaPlayerPrivate::seek(float time)
     if (m_isStreaming)
         return;
 
+    if (m_errorOccured)
+        return;
+
     LOG_VERBOSE(Media, "Seek: %" GST_TIME_FORMAT, GST_TIME_ARGS(sec));
-    // FIXME: What happens when the seeked position is not available?
     if (!gst_element_seek( m_playBin, m_rate,
             GST_FORMAT_TIME,
             (GstSeekFlags)(GST_SEEK_FLAG_FLUSH),
             GST_SEEK_TYPE_SET, sec,
             GST_SEEK_TYPE_NONE, GST_CLOCK_TIME_NONE))
         LOG_VERBOSE(Media, "Seek to %f failed", time);
+    else
+        m_seeking = true;
 }
 
 void MediaPlayerPrivate::setEndTime(float time)
 {
-    if (!m_playBin)
-        return;
-    if (m_isStreaming)
-        return;
-    if (m_endTime != time) {
-        m_endTime = time;
-        GstClockTime start = (GstClockTime)(currentTime() * GST_SECOND);
-        GstClockTime end   = (GstClockTime)(time * GST_SECOND);
-        LOG_VERBOSE(Media, "setEndTime: %" GST_TIME_FORMAT, GST_TIME_ARGS(end));
-        // FIXME: What happens when the seeked position is not available?
-        if (!gst_element_seek(m_playBin, m_rate,
-                GST_FORMAT_TIME,
-                (GstSeekFlags)(GST_SEEK_FLAG_FLUSH | GST_SEEK_FLAG_ACCURATE),
-                GST_SEEK_TYPE_SET, start,
-                GST_SEEK_TYPE_SET, end))
-            LOG_VERBOSE(Media, "Seek to %f failed", time);
-    }
+    notImplemented();
 }
 
 void MediaPlayerPrivate::startEndPointTimerIfNeeded()
@@ -294,12 +320,12 @@ void MediaPlayerPrivate::endPointTimerFired(Timer<MediaPlayerPrivate>*)
 
 bool MediaPlayerPrivate::paused() const
 {
-    return !m_startedPlaying;
+    return m_paused;
 }
 
 bool MediaPlayerPrivate::seeking() const
 {
-    return false;
+    return m_seeking;
 }
 
 // Returns the size of the video
@@ -308,13 +334,28 @@ IntSize MediaPlayerPrivate::naturalSize() const
     if (!hasVideo())
         return IntSize();
 
-    int x = 0, y = 0;
+    // TODO: handle possible clean aperture data. See
+    // https://bugzilla.gnome.org/show_bug.cgi?id=596571
+    // TODO: handle possible transformation matrix. See
+    // https://bugzilla.gnome.org/show_bug.cgi?id=596326
+    int width = 0, height = 0;
     if (GstPad* pad = gst_element_get_static_pad(m_videoSink, "sink")) {
-        gst_video_get_size(GST_PAD(pad), &x, &y);
+        gst_video_get_size(GST_PAD(pad), &width, &height);
+        GstCaps* caps = GST_PAD_CAPS(pad);
+        gfloat pixelAspectRatio;
+        gint pixelAspectRatioNumerator, pixelAspectRatioDenominator;
+
+        if (!gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
+                                                     &pixelAspectRatioDenominator))
+            pixelAspectRatioNumerator = pixelAspectRatioDenominator = 1;
+
+        pixelAspectRatio = (gfloat) pixelAspectRatioNumerator / (gfloat) pixelAspectRatioDenominator;
+        width *= pixelAspectRatio;
+        height /= pixelAspectRatio;
         gst_object_unref(GST_OBJECT(pad));
     }
 
-    return IntSize(x, y);
+    return IntSize(width, height);
 }
 
 bool MediaPlayerPrivate::hasVideo() const
@@ -325,24 +366,31 @@ bool MediaPlayerPrivate::hasVideo() const
     return currentVideo > -1;
 }
 
+bool MediaPlayerPrivate::hasAudio() const
+{
+    gint currentAudio = -1;
+    if (m_playBin)
+        g_object_get(G_OBJECT(m_playBin), "current-audio", &currentAudio, NULL);
+    return currentAudio > -1;
+}
+
 void MediaPlayerPrivate::setVolume(float volume)
 {
     m_volume = volume;
     LOG_VERBOSE(Media, "Volume to %f", volume);
-    setMuted(false);
+
+    if (!m_playBin)
+        return;
+
+    g_object_set(G_OBJECT(m_playBin), "volume", m_volume, NULL);
 }
 
-void MediaPlayerPrivate::setMuted(bool b)
+void MediaPlayerPrivate::setMuted(bool mute)
 {
     if (!m_playBin)
         return;
 
-    if (b) {
-        g_object_get(G_OBJECT(m_playBin), "volume", &m_volume, NULL);
-        g_object_set(G_OBJECT(m_playBin), "volume", (double)0.0, NULL);
-    } else
-        g_object_set(G_OBJECT(m_playBin), "volume", m_volume, NULL);
-
+    g_object_set(G_OBJECT(m_playBin), "mute", mute, NULL);
 }
 
 void MediaPlayerPrivate::setRate(float rate)
@@ -351,17 +399,13 @@ void MediaPlayerPrivate::setRate(float rate)
         gst_element_set_state(m_playBin, GST_STATE_PAUSED);
         return;
     }
+
     if (m_isStreaming)
         return;
 
     m_rate = rate;
     LOG_VERBOSE(Media, "Set Rate to %f", rate);
-    if (!gst_element_seek(m_playBin, rate,
-            GST_FORMAT_TIME,
-            (GstSeekFlags)(GST_SEEK_FLAG_FLUSH | GST_SEEK_FLAG_ACCURATE),
-            GST_SEEK_TYPE_SET, (GstClockTime) (currentTime() * GST_SECOND),
-            GST_SEEK_TYPE_SET, (GstClockTime) (m_endTime * GST_SECOND)))
-        LOG_VERBOSE(Media, "Set Rate to %f failed", rate);
+    seek(currentTime());
 }
 
 int MediaPlayerPrivate::dataRate() const
@@ -380,16 +424,20 @@ MediaPlayer::ReadyState MediaPlayerPrivate::readyState() const
     return m_readyState;
 }
 
-float MediaPlayerPrivate::maxTimeBuffered() const
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 {
-    notImplemented();
-    LOG_VERBOSE(Media, "maxTimeBuffered");
-    // rtsp streams are not buffered
-    return m_isStreaming ? 0 : maxTimeLoaded();
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+    float loaded = maxTimeLoaded();
+    if (!m_errorOccured && !m_isStreaming && loaded > 0)
+        timeRanges->add(0, loaded);
+    return timeRanges.release();
 }
 
 float MediaPlayerPrivate::maxTimeSeekable() const
 {
+    if (m_errorOccured)
+        return 0.0;
+
     // TODO
     LOG_VERBOSE(Media, "maxTimeSeekable");
     if (m_isStreaming)
@@ -400,6 +448,9 @@ float MediaPlayerPrivate::maxTimeSeekable() const
 
 float MediaPlayerPrivate::maxTimeLoaded() const
 {
+    if (m_errorOccured)
+        return 0.0;
+
     // TODO
     LOG_VERBOSE(Media, "maxTimeLoaded");
     notImplemented();
@@ -416,29 +467,30 @@ unsigned MediaPlayerPrivate::bytesLoaded() const
     float maxTime = maxTimeLoaded();
     if (!dur)
         return 0;*/
+
     return 1;//totalBytes() * maxTime / dur;
 }
 
 bool MediaPlayerPrivate::totalBytesKnown() const
 {
-    notImplemented();
     LOG_VERBOSE(Media, "totalBytesKnown");
     return totalBytes() > 0;
 }
 
 unsigned MediaPlayerPrivate::totalBytes() const
 {
-    notImplemented();
     LOG_VERBOSE(Media, "totalBytes");
-    if (!m_playBin)
+    if (!m_source)
         return 0;
 
-    if (!m_source)
+    if (m_errorOccured)
         return 0;
 
-    // Do something with m_source to get the total bytes of the media
+    GstFormat fmt = GST_FORMAT_BYTES;
+    gint64 length = 0;
+    gst_element_query_duration(m_source, &fmt, &length);
 
-    return 100;
+    return length;
 }
 
 void MediaPlayerPrivate::cancelLoad()
@@ -452,17 +504,21 @@ void MediaPlayerPrivate::updateStates()
     // the state of GStreamer, therefore, when in PAUSED state,
     // we are sure we can display the first frame and go to play
 
+    if (!m_playBin)
+        return;
+
+    if (m_errorOccured)
+        return;
+
     MediaPlayer::NetworkState oldNetworkState = m_networkState;
     MediaPlayer::ReadyState oldReadyState = m_readyState;
     GstState state;
     GstState pending;
 
-    if (!m_playBin)
-        return;
-
     GstStateChangeReturn ret = gst_element_get_state(m_playBin,
         &state, &pending, 250 * GST_NSECOND);
 
+    bool shouldUpdateAfterSeek = false;
     switch (ret) {
     case GST_STATE_CHANGE_SUCCESS:
         LOG_VERBOSE(Media, "State: %s, pending: %s",
@@ -474,6 +530,16 @@ void MediaPlayerPrivate::updateStates()
         } else if (state == GST_STATE_PAUSED)
             m_readyState = MediaPlayer::HaveEnoughData;
 
+        if (state == GST_STATE_PLAYING)
+            m_paused = false;
+        else
+            m_paused = true;
+
+        if (m_seeking) {
+            shouldUpdateAfterSeek = true;
+            m_seeking = false;
+        }
+
         m_networkState = MediaPlayer::Loaded;
 
         g_object_get(m_playBin, "source", &m_source, NULL);
@@ -486,11 +552,17 @@ void MediaPlayerPrivate::updateStates()
             gst_element_state_get_name(pending));
         // Change in progress
         return;
-        break;
+    case GST_STATE_CHANGE_FAILURE:
+        LOG_VERBOSE(Media, "Failure: State: %s, pending: %s",
+            gst_element_state_get_name(state),
+            gst_element_state_get_name(pending));
+        // Change failed
+        return;
     case GST_STATE_CHANGE_NO_PREROLL:
         LOG_VERBOSE(Media, "No preroll: State: %s, pending: %s",
             gst_element_state_get_name(state),
             gst_element_state_get_name(pending));
+
         if (state == GST_STATE_READY) {
             m_readyState = MediaPlayer::HaveFutureData;
         } else if (state == GST_STATE_PAUSED)
@@ -506,6 +578,9 @@ void MediaPlayerPrivate::updateStates()
     if (seeking())
         m_readyState = MediaPlayer::HaveNothing;
 
+    if (shouldUpdateAfterSeek)
+        timeChanged();
+
     if (m_networkState != oldNetworkState) {
         LOG_VERBOSE(Media, "Network State Changed from %u to %u",
             oldNetworkState, m_networkState);
@@ -546,15 +621,14 @@ void MediaPlayerPrivate::volumeChanged()
 
 void MediaPlayerPrivate::didEnd()
 {
-    m_isEndReached = true;
-    pause();
     timeChanged();
 }
 
-void MediaPlayerPrivate::loadingFailed()
+void MediaPlayerPrivate::loadingFailed(MediaPlayer::NetworkState error)
 {
-    if (m_networkState != MediaPlayer::NetworkError) {
-        m_networkState = MediaPlayer::NetworkError;
+    m_errorOccured = true;
+    if (m_networkState != error) {
+        m_networkState = error;
         m_player->networkStateChanged();
     }
     if (m_readyState != MediaPlayer::HaveNothing) {
@@ -565,7 +639,18 @@ void MediaPlayerPrivate::loadingFailed()
 
 void MediaPlayerPrivate::setSize(const IntSize& size)
 {
+    // Destroy and re-create the cairo surface only if the size
+    // changed.
+    if (size != m_size) {
+        if (m_surface)
+            cairo_surface_destroy(m_surface);
+        m_surface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, size.width(),
+                                               size.height());
+        g_object_set(m_videoSink, "surface", m_surface, 0);
+    }
+
     m_size = size;
+
 }
 
 void MediaPlayerPrivate::setVisible(bool visible)
@@ -586,11 +671,12 @@ void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
     if (!m_visible)
         return;
 
-    //TODO: m_size vs rect?
     cairo_t* cr = context->platformContext();
 
     cairo_save(cr);
     cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
+
+    // paint the rectangle on the context and draw the surface inside.
     cairo_translate(cr, rect.x(), rect.y());
     cairo_rectangle(cr, 0, 0, rect.width(), rect.height());
     cairo_set_source_surface(cr, m_surface, 0, 0);
@@ -598,24 +684,124 @@ void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
     cairo_restore(cr);
 }
 
+static HashSet<String> mimeTypeCache()
+{
+
+    do_gst_init();
+
+    static HashSet<String> cache;
+    static bool typeListInitialized = false;
+
+    if (!typeListInitialized) {
+        // These subtypes are already beeing supported by WebKit itself
+        HashSet<String> ignoredApplicationSubtypes;
+        ignoredApplicationSubtypes.add(String("javascript"));
+        ignoredApplicationSubtypes.add(String("ecmascript"));
+        ignoredApplicationSubtypes.add(String("x-javascript"));
+        ignoredApplicationSubtypes.add(String("xml"));
+        ignoredApplicationSubtypes.add(String("xhtml+xml"));
+        ignoredApplicationSubtypes.add(String("rss+xml"));
+        ignoredApplicationSubtypes.add(String("atom+xml"));
+        ignoredApplicationSubtypes.add(String("x-ftp-directory"));
+        ignoredApplicationSubtypes.add(String("x-java-applet"));
+        ignoredApplicationSubtypes.add(String("x-java-bean"));
+        ignoredApplicationSubtypes.add(String("x-java-vm"));
+        ignoredApplicationSubtypes.add(String("x-shockwave-flash"));
+
+        GList* factories = gst_type_find_factory_get_list();
+        for (GList* iterator = factories; iterator; iterator = iterator->next) {
+            GstTypeFindFactory* factory = GST_TYPE_FIND_FACTORY(iterator->data);
+            GstCaps* caps = gst_type_find_factory_get_caps(factory);
+
+            // Splitting the capability by comma and taking the first part
+            // as capability can be something like "audio/x-wavpack, framed=(boolean)false"
+            GOwnPtr<gchar> capabilityString(gst_caps_to_string(caps));
+            gchar** capability = g_strsplit(capabilityString.get(), ",", 2);
+            gchar** mimetype = g_strsplit(capability[0], "/", 2);
+
+            // GStreamer plugins can be capable of supporting types which WebKit supports
+            // by default. In that case, we should not consider these types supportable by GStreamer.
+            // Examples of what GStreamer can support but should not be added:
+            // text/plain, text/html, image/jpeg, application/xml
+            if (g_str_equal(mimetype[0], "audio") ||
+                    g_str_equal(mimetype[0], "video") ||
+                    (g_str_equal(mimetype[0], "application") &&
+                        !ignoredApplicationSubtypes.contains(String(mimetype[1])))) {
+                cache.add(String(capability[0]));
+
+                // These formats are supported by GStreamer, but not correctly advertised
+                if (g_str_equal(capability[0], "video/x-h264") ||
+                    g_str_equal(capability[0], "audio/x-m4a")) {
+                    cache.add(String("video/mp4"));
+                    cache.add(String("audio/aac"));
+                }
+
+                if (g_str_equal(capability[0], "video/x-theora"))
+                    cache.add(String("video/ogg"));
+
+                if (g_str_equal(capability[0], "audio/x-wav"))
+                    cache.add(String("audio/wav"));
+
+                if (g_str_equal(capability[0], "audio/mpeg")) {
+                    // This is what we are handling: mpegversion=(int)1, layer=(int)[ 1, 3 ]
+                    gchar** versionAndLayer = g_strsplit(capability[1], ",", 2);
+
+                    if (g_str_has_suffix (versionAndLayer[0], "(int)1")) {
+                        for (int i = 0; versionAndLayer[1][i] != '\0'; i++) {
+                            if (versionAndLayer[1][i] == '1')
+                                cache.add(String("audio/mp1"));
+                            else if (versionAndLayer[1][i] == '2')
+                                cache.add(String("audio/mp2"));
+                            else if (versionAndLayer[1][i] == '3')
+                                cache.add(String("audio/mp3"));
+                        }
+                    }
+
+                    g_strfreev(versionAndLayer);
+                }
+            }
+
+            g_strfreev(capability);
+            g_strfreev(mimetype);
+        }
+
+        gst_plugin_feature_list_free(factories);
+        typeListInitialized = true;
+    }
+
+    return cache;
+}
+
 void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& types)
 {
-    // FIXME: query the engine to see what types are supported
-    notImplemented();
-    types.add(String("video/x-theora+ogg"));
+    types = mimeTypeCache();
 }
 
 MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
 {
-    // FIXME: query the engine to see what types are supported
-    notImplemented();
-    return type == "video/x-theora+ogg" ? (codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported) : MediaPlayer::IsNotSupported;
+    if (type.isNull() || type.isEmpty())
+        return MediaPlayer::IsNotSupported;
+
+    // spec says we should not return "probably" if the codecs string is empty
+    if (mimeTypeCache().contains(type))
+        return codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported;
+    return MediaPlayer::IsNotSupported;
+}
+
+bool MediaPlayerPrivate::hasSingleSecurityOrigin() const
+{
+    return true;
+}
+
+bool MediaPlayerPrivate::supportsFullscreen() const
+{
+    return true;
 }
 
 void MediaPlayerPrivate::createGSTPlayBin(String url)
 {
     ASSERT(!m_playBin);
-    m_playBin = gst_element_factory_make("playbin", "play");
+    m_playBin = gst_element_factory_make("playbin2", "play");
 
     GstBus* bus = gst_pipeline_get_bus(GST_PIPELINE(m_playBin));
     gst_bus_add_signal_watch(bus);
@@ -627,10 +813,12 @@ void MediaPlayerPrivate::createGSTPlayBin(String url)
 
     g_object_set(G_OBJECT(m_playBin), "uri", url.utf8().data(), NULL);
 
-    GstElement* audioSink = gst_element_factory_make("gconfaudiosink", 0);
     m_videoSink = webkit_video_sink_new(m_surface);
 
-    g_object_set(m_playBin, "audio-sink", audioSink, NULL);
+    // This ref is to protect the sink from being destroyed before we stop the idle it
+    // creates internally. See the comment in ~MediaPlayerPrivate.
+    g_object_ref(m_videoSink);
+
     g_object_set(m_playBin, "video-sink", m_videoSink, NULL);
 
     g_signal_connect(m_videoSink, "repaint-requested", G_CALLBACK(mediaPlayerPrivateRepaintCallback), this);
@@ -641,4 +829,3 @@ void MediaPlayerPrivate::createGSTPlayBin(String url)
 }
 
 #endif
-
diff --git a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
index 8842f84..d305759 100644
--- a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
+++ b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
@@ -56,6 +56,7 @@ namespace WebCore {
 
             IntSize naturalSize() const;
             bool hasVideo() const;
+            bool hasAudio() const;
 
             void load(const String &url);
             void cancelLoad();
@@ -80,7 +81,7 @@ namespace WebCore {
             MediaPlayer::NetworkState networkState() const;
             MediaPlayer::ReadyState readyState() const;
 
-            float maxTimeBuffered() const;
+            PassRefPtr<TimeRanges> buffered() const;
             float maxTimeSeekable() const;
             unsigned bytesLoaded() const;
             bool totalBytesKnown() const;
@@ -95,11 +96,15 @@ namespace WebCore {
             void timeChanged();
             void volumeChanged();
             void didEnd();
-            void loadingFailed();
+            void loadingFailed(MediaPlayer::NetworkState);
 
             void repaint();
             void paint(GraphicsContext*, const IntRect&);
 
+            bool hasSingleSecurityOrigin() const;
+
+            bool supportsFullscreen() const;
+
         private:
             MediaPlayerPrivate(MediaPlayer*);
             static MediaPlayerPrivateInterface* create(MediaPlayer* player);
@@ -132,6 +137,10 @@ namespace WebCore {
             IntSize m_size;
             bool m_visible;
             cairo_surface_t* m_surface;
+
+            bool m_paused;
+            bool m_seeking;
+            bool m_errorOccured;
     };
 }
 
diff --git a/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp b/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
index a77c1cf..9a616f4 100644
--- a/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
+++ b/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
@@ -50,9 +50,9 @@ void SimpleFontData::platformInit()
     cairo_font_extents_t font_extents;
     cairo_text_extents_t text_extents;
     cairo_scaled_font_extents(m_platformData.m_scaledFont, &font_extents);
-    m_ascent = static_cast<int>(font_extents.ascent);
-    m_descent = static_cast<int>(font_extents.descent);
-    m_lineSpacing = static_cast<int>(font_extents.height);
+    m_ascent = static_cast<int>(lroundf(font_extents.ascent));
+    m_descent = static_cast<int>(lroundf(font_extents.descent));
+    m_lineSpacing = static_cast<int>(lroundf(font_extents.height));
     // There seems to be some rounding error in cairo (or in how we
     // use cairo) with some fonts, like DejaVu Sans Mono, which makes
     // cairo report a height smaller than ascent + descent, which is
@@ -63,7 +63,7 @@ void SimpleFontData::platformInit()
     cairo_scaled_font_text_extents(m_platformData.m_scaledFont, "x", &text_extents);
     m_xHeight = text_extents.height;
     cairo_scaled_font_text_extents(m_platformData.m_scaledFont, " ", &text_extents);
-    m_spaceWidth =  static_cast<int>(text_extents.x_advance);
+    m_spaceWidth = static_cast<float>(text_extents.x_advance);
     m_lineGap = m_lineSpacing - m_ascent - m_descent;
     m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
 }
@@ -130,10 +130,4 @@ float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
     return w;
 }
 
-void SimpleFontData::setFont(cairo_t* cr) const
-{
-    ASSERT(cr);
-    m_platformData.setFont(cr);
-}
-
 }
diff --git a/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp b/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp
index e57d9e6..975143e 100644
--- a/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp
+++ b/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp
@@ -49,9 +49,9 @@ void SimpleFontData::platformInit()
     cairo_font_extents_t font_extents;
     cairo_text_extents_t text_extents;
     cairo_scaled_font_extents(m_platformData.m_scaledFont, &font_extents);
-    m_ascent = static_cast<int>(font_extents.ascent);
-    m_descent = static_cast<int>(font_extents.descent);
-    m_lineSpacing = static_cast<int>(font_extents.height);
+    m_ascent = static_cast<int>(lroundf(font_extents.ascent));
+    m_descent = static_cast<int>(lroundf(font_extents.descent));
+    m_lineSpacing = static_cast<int>(lroundf(font_extents.height));
     // There seems to be some rounding error in cairo (or in how we
     // use cairo) with some fonts, like DejaVu Sans Mono, which makes
     // cairo report a height smaller than ascent + descent, which is
@@ -62,7 +62,7 @@ void SimpleFontData::platformInit()
     cairo_scaled_font_text_extents(m_platformData.m_scaledFont, "x", &text_extents);
     m_xHeight = text_extents.height;
     cairo_scaled_font_text_extents(m_platformData.m_scaledFont, " ", &text_extents);
-    m_spaceWidth =  static_cast<int>(text_extents.x_advance);
+    m_spaceWidth =  static_cast<float>(text_extents.x_advance);
     m_lineGap = m_lineSpacing - m_ascent - m_descent;
     m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
 }
@@ -133,10 +133,4 @@ float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
     return w;
 }
 
-void SimpleFontData::setFont(cairo_t* cr) const
-{
-    ASSERT(cr);
-    m_platformData.setFont(cr);
-}
-
 }
diff --git a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
index f049998..fb86fe9 100644
--- a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
@@ -33,8 +33,14 @@
 #include <gst/video/video.h>
 
 static GstStaticPadTemplate sinktemplate = GST_STATIC_PAD_TEMPLATE("sink",
-        GST_PAD_SINK, GST_PAD_ALWAYS,
-        GST_STATIC_CAPS(GST_VIDEO_CAPS_RGBx ";" GST_VIDEO_CAPS_BGRx));
+                                                                   GST_PAD_SINK, GST_PAD_ALWAYS,
+// CAIRO_FORMAT_RGB24 used to render the video buffers is little/big endian dependant.
+#if G_BYTE_ORDER == G_LITTLE_ENDIAN
+                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_BGRx)
+#else
+                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_xRGB)
+#endif
+);
 
 GST_DEBUG_CATEGORY_STATIC(webkit_video_sink_debug);
 #define GST_CAT_DEFAULT webkit_video_sink_debug
@@ -102,9 +108,14 @@ webkit_video_sink_init(WebKitVideoSink* sink, WebKitVideoSinkClass* klass)
 static gboolean
 webkit_video_sink_idle_func(gpointer data)
 {
-    WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(data);
+    WebKitVideoSink* sink = reinterpret_cast<WebKitVideoSink*>(data);
     WebKitVideoSinkPrivate* priv = sink->priv;
     GstBuffer* buffer;
+    GstCaps* caps;
+    GstVideoFormat format;
+    gint par_n, par_d;
+    gfloat par;
+    gint bwidth, bheight;
 
     if (!priv->async_queue)
         return FALSE;
@@ -113,19 +124,35 @@ webkit_video_sink_idle_func(gpointer data)
     if (!buffer || G_UNLIKELY(!GST_IS_BUFFER(buffer)))
         return FALSE;
 
+    caps = GST_BUFFER_CAPS(buffer);
+    if (!gst_video_format_parse_caps(caps, &format, &bwidth, &bheight)) {
+        GST_ERROR_OBJECT(sink, "Unknown video format in buffer caps '%s'",
+                         gst_caps_to_string(caps));
+        return FALSE;
+    }
+
+    if (!gst_video_parse_caps_pixel_aspect_ratio(caps, &par_n, &par_d))
+        par_n = par_d = 1;
+
+    par = (gfloat) par_n / (gfloat) par_d;
+
     // TODO: consider priv->rgb_ordering?
-    cairo_surface_t* src = cairo_image_surface_create_for_data(GST_BUFFER_DATA(buffer), CAIRO_FORMAT_RGB24, priv->width, priv->height, (4 * priv->width + 3) & ~3);
+    cairo_surface_t* src = cairo_image_surface_create_for_data(GST_BUFFER_DATA(buffer),
+                                                               CAIRO_FORMAT_RGB24,
+                                                               bwidth, bheight,
+                                                               4 * bwidth);
 
     // TODO: We copy the data twice right now. This could be easily improved.
     cairo_t* cr = cairo_create(priv->surface);
+    cairo_scale(cr, par, 1.0 / par);
     cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
     cairo_set_source_surface(cr, src, 0, 0);
     cairo_surface_destroy(src);
     cairo_rectangle(cr, 0, 0, priv->width, priv->height);
     cairo_fill(cr);
     cairo_destroy(cr);
-
     gst_buffer_unref(buffer);
+    g_async_queue_unref(priv->async_queue);
 
     g_signal_emit(sink, webkit_video_sink_signals[REPAINT_REQUESTED], 0);
 
@@ -138,6 +165,7 @@ webkit_video_sink_render(GstBaseSink* bsink, GstBuffer* buffer)
     WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(bsink);
     WebKitVideoSinkPrivate* priv = sink->priv;
 
+    g_async_queue_ref(priv->async_queue);
     g_async_queue_push(priv->async_queue, gst_buffer_ref(buffer));
     g_idle_add_full(G_PRIORITY_HIGH_IDLE, webkit_video_sink_idle_func, sink, 0);
 
@@ -151,9 +179,7 @@ webkit_video_sink_set_caps(GstBaseSink* bsink, GstCaps* caps)
     WebKitVideoSinkPrivate* priv = sink->priv;
     GstStructure* structure;
     gboolean ret;
-    const GValue* fps;
-    const GValue* par;
-    gint width, height;
+    gint width, height, fps_n, fps_d;
     int red_mask;
 
     GstCaps* intersection = gst_caps_intersect(gst_static_pad_template_get_caps(&sinktemplate), caps);
@@ -167,25 +193,19 @@ webkit_video_sink_set_caps(GstBaseSink* bsink, GstCaps* caps)
 
     ret = gst_structure_get_int(structure, "width", &width);
     ret &= gst_structure_get_int(structure, "height", &height);
-    fps = gst_structure_get_value(structure, "framerate");
-    ret &= (fps != 0);
-
-    par = gst_structure_get_value(structure, "pixel-aspect-ratio");
 
-    if (!ret)
-        return FALSE;
+    /* We dont yet use fps but handy to have */
+    ret &= gst_structure_get_fraction(structure, "framerate",
+                                      &fps_n, &fps_d);
+    g_return_val_if_fail(ret, FALSE);
 
     priv->width = width;
     priv->height = height;
+    priv->fps_n = fps_n;
+    priv->fps_d = fps_d;
 
-    /* We dont yet use fps or pixel aspect into but handy to have */
-    priv->fps_n = gst_value_get_fraction_numerator(fps);
-    priv->fps_d = gst_value_get_fraction_denominator(fps);
-
-    if (par) {
-        priv->par_n = gst_value_get_fraction_numerator(par);
-        priv->par_d = gst_value_get_fraction_denominator(par);
-    } else
+    if (!gst_structure_get_fraction(structure, "pixel-aspect-ratio",
+                                    &priv->par_n, &priv->par_d))
         priv->par_n = priv->par_d = 1;
 
     gst_structure_get_int(structure, "red_mask", &red_mask);
@@ -265,6 +285,8 @@ webkit_video_sink_stop(GstBaseSink* base_sink)
 
     g_async_queue_unlock(priv->async_queue);
 
+    g_idle_remove_by_data(base_sink);
+
     return TRUE;
 }
 
diff --git a/WebCore/platform/graphics/haiku/ColorHaiku.cpp b/WebCore/platform/graphics/haiku/ColorHaiku.cpp
new file mode 100644
index 0000000..a9ac186
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/ColorHaiku.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Color.h"
+
+#include <InterfaceDefs.h>
+
+
+namespace WebCore {
+
+Color::Color(const rgb_color& color)
+    : m_color(makeRGBA(color.red, color.green, color.blue, color.alpha))
+    , m_valid(true)
+{
+}
+
+Color::operator rgb_color() const
+{
+    return make_color(red(), green(), blue(), alpha());
+}
+
+
+Color focusRingColor()
+{
+    return Color(keyboard_navigation_color());
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/FloatPointHaiku.cpp b/WebCore/platform/graphics/haiku/FloatPointHaiku.cpp
new file mode 100644
index 0000000..0f50898
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FloatPointHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FloatPoint.h"
+
+#include <Point.h>
+
+
+namespace WebCore {
+
+FloatPoint::FloatPoint(const BPoint& point)
+    : m_x(point.x)
+    , m_y(point.y)
+{
+}
+
+FloatPoint::operator BPoint() const
+{
+    return BPoint(m_x, m_y);
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/FloatRectHaiku.cpp b/WebCore/platform/graphics/haiku/FloatRectHaiku.cpp
new file mode 100644
index 0000000..67af3af
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FloatRectHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FloatRect.h"
+
+#include <Rect.h>
+
+
+namespace WebCore {
+
+FloatRect::FloatRect(const BRect& rect)
+    : m_location(rect.LeftTop())
+    , m_size(rect.Width(), rect.Height())
+{
+}
+
+FloatRect::operator BRect() const
+{
+    return BRect(BPoint(x(), y()), BSize(width(), height()));
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/FontCacheHaiku.cpp b/WebCore/platform/graphics/haiku/FontCacheHaiku.cpp
new file mode 100644
index 0000000..b99bf42
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FontCacheHaiku.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FontCache.h"
+
+#include "Font.h"
+#include "FontData.h"
+#include "FontPlatformData.h"
+#include "NotImplemented.h"
+#include <String.h>
+
+
+namespace WebCore {
+
+void FontCache::platformInit()
+{
+}
+
+const SimpleFontData* FontCache::getFontDataForCharacters(const Font& font, const UChar* characters, int length)
+{
+    FontPlatformData data(font.fontDescription(), font.family().family());
+    return getCachedFontData(&data);
+}
+
+FontPlatformData* FontCache::getSimilarFontPlatformData(const Font& font)
+{
+    notImplemented();
+    return 0;
+}
+
+FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription& fontDescription)
+{
+    // FIXME: Would be even better to somehow get the user's default font here.
+    // For now we'll pick the default that the user would get without changing any prefs.
+    static AtomicString defaultString("DejaVu Serif");
+    return getCachedFontPlatformData(fontDescription, defaultString);
+}
+
+FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontDescription, const AtomicString& family)
+{
+    return new FontPlatformData(fontDescription, family);
+}
+
+void FontCache::getTraitsInFamily(const AtomicString& familyName, Vector<unsigned>& traitsMasks)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp b/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
new file mode 100644
index 0000000..6008bb1
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2008 Alp Toker <alp@atoker.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "FontCustomPlatformData.h"
+
+#include "SharedBuffer.h"
+#include "FontPlatformData.h"
+
+
+namespace WebCore {
+
+FontCustomPlatformData::~FontCustomPlatformData()
+{
+}
+
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontRenderingMode)
+{
+    return FontPlatformData(size, bold, italic);
+}
+
+FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
+{
+    // FIXME: We need support in Haiku to read fonts from memory to implement this.
+    return 0;
+}
+
+}
diff --git a/WebCore/platform/graphics/haiku/FontCustomPlatformData.h b/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
new file mode 100644
index 0000000..c5a814e
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2008 Alp Toker <alp@atoker.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef FontCustomPlatformData_h
+#define FontCustomPlatformData_h
+
+#include "FontRenderingMode.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+    class FontPlatformData;
+    class SharedBuffer;
+
+    struct FontCustomPlatformData : Noncopyable {
+    public:
+        FontCustomPlatformData() { }
+        ~FontCustomPlatformData();
+
+        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontRenderingMode = NormalRenderingMode);
+    };
+
+    FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer*);
+
+}
+
+#endif
diff --git a/WebCore/platform/graphics/haiku/FontHaiku.cpp b/WebCore/platform/graphics/haiku/FontHaiku.cpp
new file mode 100644
index 0000000..48744d9
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FontHaiku.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Font.h"
+
+#include "FontData.h"
+#include "FontDescription.h"
+#include "FontSelector.h"
+#include "GraphicsContext.h"
+#include "NotImplemented.h"
+#include <Font.h>
+#include <String.h>
+#include <View.h>
+
+
+// FIXME: Temp routine to convert unicode character to UTF8.
+int charUnicodeToUTF8HACK(unsigned short glyph, char* out)
+{
+    int i = 0;
+
+    if (glyph < 0x0080)
+        out[i++] = static_cast<char>(glyph);
+    else if (glyph < 0x0800) {  // 2 bytes
+        out[i++] = 0xc0 | (glyph >> 6);
+        out[i++] = 0x80 | (glyph & 0x3F);
+    } else if (glyph > 0x0800) {  // 3 bytes
+        out[i++] = 0xe0 | (glyph >> 12);
+        out[i++] = 0x80 | ((glyph >> 6) & 0x3F);
+        out[i++] = 0x80 | (glyph & 0x3F);
+    }
+
+    out[i] = '\0';
+    return i;
+}
+
+namespace WebCore {
+
+bool Font::canReturnFallbackFontsForComplexText()
+{
+    return false;
+}
+
+void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* font,
+                      const GlyphBuffer& glyphBuffer, int from, int numGlyphs, const FloatPoint& point) const
+{
+    Color color = graphicsContext->fillColor();
+    BView* view = graphicsContext->platformContext();
+    BFont* m_font = font->platformData().font();
+
+    graphicsContext->setCompositeOperation(CompositeSourceOver);
+    view->SetHighColor(color);
+    view->SetFont(m_font);
+
+    GlyphBufferGlyph* glyphs = const_cast<GlyphBufferGlyph*>(glyphBuffer.glyphs(from));
+    float offset = point.x();
+    for (int i = 0; i < numGlyphs; i++) {
+        char out[4];
+        charUnicodeToUTF8HACK(glyphs[i], out);
+
+        view->DrawString(out, sizeof(out), BPoint(offset, point.y()));
+        offset += glyphBuffer.advanceAt(from + i);
+    }
+}
+
+void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const FloatPoint& point,
+                           int from, int to) const
+{
+    notImplemented();
+}
+
+
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
+{
+    notImplemented();
+    return 0;
+}
+
+FloatRect Font::selectionRectForComplexText(const TextRun&, const IntPoint&, int, int, int) const
+{
+    notImplemented();
+    return FloatRect();
+}
+
+int Font::offsetForPositionForComplexText(const TextRun&, int, bool) const
+{
+    notImplemented();
+    return 0;
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/FontPlatformData.h b/WebCore/platform/graphics/haiku/FontPlatformData.h
new file mode 100644
index 0000000..9feab8e
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FontPlatformData.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#ifndef FontPlatformData_H
+#define FontPlatformData_H
+
+#include "FontDescription.h"
+#include "GlyphBuffer.h"
+#include <interface/Font.h>
+
+namespace WebCore {
+
+    class FontPlatformData {
+    public:
+        FontPlatformData(WTF::HashTableDeletedValueType)
+            : m_font(hashTableDeletedFontValue())
+            { }
+
+        FontPlatformData()
+            : m_font(0)
+            { }
+
+        FontPlatformData(const FontDescription&, const AtomicString& family);
+        FontPlatformData(float size, bool bold, bool oblique);
+        FontPlatformData(const FontPlatformData&);
+
+        ~FontPlatformData();
+
+        BFont* font() const { return m_font; }
+
+        bool isFixedPitch();
+        float size() const { return m_size; }
+        bool bold() const { return m_bold; }
+        bool oblique() const { return m_oblique; }
+
+        unsigned hash() const;
+        bool isHashTableDeletedValue() const;
+
+        bool operator==(const FontPlatformData&) const;
+
+#ifndef NDEBUG
+        String description() const;
+#endif
+
+        BFont* m_font;
+        float m_size;
+        bool m_bold;
+        bool m_oblique;
+
+    private:
+        static BFont* hashTableDeletedFontValue() { return reinterpret_cast<BFont*>(-1); }
+    };
+
+} // namespace WebCore
+
+#endif
+
diff --git a/WebCore/platform/graphics/haiku/GradientHaiku.cpp b/WebCore/platform/graphics/haiku/GradientHaiku.cpp
new file mode 100644
index 0000000..469a17f
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/GradientHaiku.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2008 Kevin Ollivier <kevino@theolliviers.com>  All rights reserved.
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@theolliviers.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Gradient.h"
+
+#include "CSSParser.h"
+#include "NotImplemented.h"
+
+
+namespace WebCore {
+
+void Gradient::platformDestroy()
+{
+    notImplemented();
+}
+
+PlatformGradient Gradient::platformGradient()
+{
+    notImplemented();
+    return 0;
+}
+
+void Gradient::fill(GraphicsContext*, const FloatRect&)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
new file mode 100644
index 0000000..d785ef4
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
@@ -0,0 +1,536 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GraphicsContext.h"
+
+#include "CString.h"
+#include "Color.h"
+#include "Font.h"
+#include "FontData.h"
+#include "NotImplemented.h"
+#include "Path.h"
+#include "Pen.h"
+#include "TransformationMatrix.h"
+#include <GraphicsDefs.h>
+#include <Region.h>
+#include <View.h>
+#include <Window.h>
+#include <stdio.h>
+
+
+namespace WebCore {
+
+class GraphicsContextPlatformPrivate {
+public:
+    GraphicsContextPlatformPrivate(BView* view);
+    ~GraphicsContextPlatformPrivate();
+
+    BView* m_view;
+};
+
+GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate(BView* view)
+    : m_view(view)
+{
+}
+
+GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate()
+{
+}
+
+GraphicsContext::GraphicsContext(PlatformGraphicsContext* context)
+    : m_common(createGraphicsContextPrivate())
+    , m_data(new GraphicsContextPlatformPrivate(context))
+{
+    setPaintingDisabled(!context);
+}
+
+GraphicsContext::~GraphicsContext()
+{
+    destroyGraphicsContextPrivate(m_common);
+    delete m_data;
+}
+
+PlatformGraphicsContext* GraphicsContext::platformContext() const
+{
+    return m_data->m_view;
+}
+
+void GraphicsContext::savePlatformState()
+{
+    m_data->m_view->PushState();
+}
+
+void GraphicsContext::restorePlatformState()
+{
+    m_data->m_view->PopState();
+}
+
+// Draws a filled rectangle with a stroked border.
+void GraphicsContext::drawRect(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->FillRect(rect);
+    if (strokeStyle() != NoStroke)
+        m_data->m_view->StrokeRect(rect, getHaikuStrokeStyle());
+}
+
+// This is only used to draw borders.
+void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
+{
+    if (paintingDisabled())
+        return;
+
+    if (strokeStyle() == NoStroke)
+        return;
+
+    m_data->m_view->StrokeLine(point1, point2, getHaikuStrokeStyle());
+}
+
+// This method is only used to draw the little circles used in lists.
+void GraphicsContext::drawEllipse(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->FillEllipse(rect);
+    if (strokeStyle() != NoStroke)
+        m_data->m_view->StrokeEllipse(rect, getHaikuStrokeStyle());
+}
+
+void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSpan)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->StrokeArc(rect, startAngle, angleSpan, getHaikuStrokeStyle());
+}
+
+void GraphicsContext::strokePath()
+{
+    notImplemented();
+}
+
+void GraphicsContext::drawConvexPolygon(size_t pointsLength, const FloatPoint* points, bool shouldAntialias)
+{
+    if (paintingDisabled())
+        return;
+
+    BPoint bPoints[pointsLength];
+    for (size_t i = 0; i < pointsLength; i++)
+        bPoints[i] = points[i];
+
+    m_data->m_view->FillPolygon(bPoints, pointsLength);
+    if (strokeStyle() != NoStroke)
+        // Stroke with low color
+        m_data->m_view->StrokePolygon(bPoints, pointsLength, true, getHaikuStrokeStyle());
+}
+
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+{
+    if (paintingDisabled())
+        return;
+
+    rgb_color oldColor = m_data->m_view->HighColor();
+    m_data->m_view->SetHighColor(color);
+    m_data->m_view->FillRect(rect);
+    m_data->m_view->SetHighColor(oldColor);
+}
+
+void GraphicsContext::fillRect(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return;
+}
+
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+{
+    if (paintingDisabled() || !color.alpha())
+        return;
+
+    notImplemented();
+    // FIXME: A simple implementation could just use FillRoundRect if all
+    // the sizes are the same, or even if they are not. Otherwise several
+    // FillRect and FillArc calls are needed.
+}
+
+void GraphicsContext::fillPath()
+{
+    notImplemented();
+}
+
+void GraphicsContext::beginPath()
+{
+    notImplemented();
+}
+
+void GraphicsContext::addPath(const Path& path)
+{
+    notImplemented();
+}
+
+void GraphicsContext::clip(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    BRegion region(rect);
+    m_data->m_view->ConstrainClippingRegion(&region);
+}
+
+void GraphicsContext::drawFocusRing(const Color& color)
+{
+    if (paintingDisabled())
+        return;
+
+    const Vector<IntRect>& rects = focusRingRects();
+    unsigned rectCount = rects.size();
+
+    // FIXME: maybe we should implement this with BShape?
+
+    if (rects.size() > 1) {
+        BRegion    region;
+        for (int i = 0; i < rectCount; ++i)
+            region.Include(BRect(rects[i]));
+
+        m_data->m_view->SetHighColor(color);
+        m_data->m_view->StrokeRect(region.Frame(), B_MIXED_COLORS);
+    }
+}
+
+void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool printing)
+{
+    if (paintingDisabled())
+        return;
+
+    IntPoint endPoint = origin + IntSize(width, 0);
+    drawLine(origin, endPoint);
+}
+
+void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint&, int width, bool grammar)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
+{
+    notImplemented();
+    return rect;
+}
+
+void GraphicsContext::beginTransparencyLayer(float opacity)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::endTransparencyLayer()
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::clearRect(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::strokeRect(const FloatRect& rect, float width)
+{
+    if (paintingDisabled())
+        return;
+
+    float oldSize = m_data->m_view->PenSize();
+    m_data->m_view->SetPenSize(width);
+    m_data->m_view->StrokeRect(rect, getHaikuStrokeStyle());
+    m_data->m_view->SetPenSize(oldSize);
+}
+
+void GraphicsContext::setLineCap(LineCap lineCap)
+{
+    if (paintingDisabled())
+        return;
+
+    cap_mode mode = B_BUTT_CAP;
+    switch (lineCap) {
+    case RoundCap:
+        mode = B_ROUND_CAP;
+        break;
+    case SquareCap:
+        mode = B_SQUARE_CAP;
+        break;
+    case ButtCap:
+    default:
+        break;
+    }
+
+    m_data->m_view->SetLineMode(mode, m_data->m_view->LineJoinMode(), m_data->m_view->LineMiterLimit());
+}
+
+void GraphicsContext::setLineJoin(LineJoin lineJoin)
+{
+    if (paintingDisabled())
+        return;
+
+    join_mode mode = B_MITER_JOIN;
+    switch (lineJoin) {
+    case RoundJoin:
+        mode = B_ROUND_JOIN;
+        break;
+    case BevelJoin:
+        mode = B_BEVEL_JOIN;
+        break;
+    case MiterJoin:
+    default:
+        break;
+    }
+
+    m_data->m_view->SetLineMode(m_data->m_view->LineCapMode(), mode, m_data->m_view->LineMiterLimit());
+}
+
+void GraphicsContext::setMiterLimit(float limit)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->SetLineMode(m_data->m_view->LineCapMode(), m_data->m_view->LineJoinMode(), limit);
+}
+
+void GraphicsContext::setAlpha(float opacity)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::setCompositeOperation(CompositeOperator op)
+{
+    if (paintingDisabled())
+        return;
+
+    drawing_mode mode = B_OP_COPY;
+    switch (op) {
+    case CompositeClear:
+    case CompositeCopy:
+        // Use the default above
+        break;
+    case CompositeSourceOver:
+        mode = B_OP_OVER;
+        break;
+    default:
+        printf("GraphicsContext::setCompositeOperation: Unsupported composite operation %s\n",
+                compositeOperatorName(op).utf8().data());
+    }
+    m_data->m_view->SetDrawingMode(mode);
+}
+
+void GraphicsContext::clip(const Path& path)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->ConstrainClippingRegion(path.platformPath());
+}
+
+void GraphicsContext::clipOut(const Path& path)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::clipToImageBuffer(const FloatRect&, const ImageBuffer*)
+{
+    notImplemented();
+}
+
+TransformationMatrix GraphicsContext::getCTM() const
+{
+    notImplemented();
+    return TransformationMatrix();
+}
+
+void GraphicsContext::translate(float x, float y)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+IntPoint GraphicsContext::origin()
+{
+    notImplemented();
+    return IntPoint(0, 0);
+}
+
+void GraphicsContext::rotate(float radians)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::scale(const FloatSize& size)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::clipOut(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::concatCTM(const TransformationMatrix& transform)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::setPlatformShouldAntialias(bool enable)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::setImageInterpolationQuality(InterpolationQuality)
+{
+}
+
+void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
+{
+    notImplemented();
+}
+
+void GraphicsContext::setPlatformFont(const Font& font)
+{
+    m_data->m_view->SetFont(font.primaryFont()->platformData().font());
+}
+
+void GraphicsContext::setPlatformStrokeColor(const Color& color)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->SetHighColor(color);
+}
+
+pattern GraphicsContext::getHaikuStrokeStyle()
+{
+    switch (strokeStyle()) {
+    case SolidStroke:
+        return B_SOLID_HIGH;
+        break;
+    case DottedStroke:
+        return B_MIXED_COLORS;
+        break;
+    case DashedStroke:
+        // FIXME: use a better dashed stroke!
+        notImplemented();
+        return B_MIXED_COLORS;
+        break;
+    default:
+        return B_SOLID_LOW;
+        break;
+    }
+}
+
+void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle& strokeStyle)
+{
+    // FIXME: see getHaikuStrokeStyle.
+    notImplemented();
+}
+
+void GraphicsContext::setPlatformStrokeThickness(float thickness)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->SetPenSize(thickness);
+}
+
+void GraphicsContext::setPlatformFillColor(const Color& color)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->SetHighColor(color);
+}
+
+void GraphicsContext::clearPlatformShadow()
+{
+    notImplemented();
+}
+
+void GraphicsContext::setPlatformShadow(IntSize const&, int, Color const&)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/IconHaiku.cpp b/WebCore/platform/graphics/haiku/IconHaiku.cpp
new file mode 100644
index 0000000..dccac4a
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/IconHaiku.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#include "config.h"
+#include "Icon.h"
+
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+
+
+namespace WebCore {
+
+Icon::~Icon()
+{
+    notImplemented();
+}
+
+PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+{
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
+{
+    notImplemented();
+    return 0;
+}
+
+void Icon::paint(GraphicsContext*, const IntRect&)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/ImageBufferData.h b/WebCore/platform/graphics/haiku/ImageBufferData.h
new file mode 100644
index 0000000..f978c34
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/ImageBufferData.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ImageBufferData_h
+#define ImageBufferData_h
+
+namespace WebCore {
+
+    class IntSize;
+
+    class ImageBufferData {
+    public:
+        ImageBufferData(const IntSize&);
+    };
+
+}  // namespace WebCore
+
+#endif  // ImageBufferData_h
+
diff --git a/WebCore/platform/graphics/haiku/ImageBufferHaiku.cpp b/WebCore/platform/graphics/haiku/ImageBufferHaiku.cpp
new file mode 100644
index 0000000..276c968
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/ImageBufferHaiku.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ImageBuffer.h"
+
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include "NotImplemented.h"
+
+
+namespace WebCore {
+
+ImageBufferData::ImageBufferData(const IntSize&)
+{
+}
+
+ImageBuffer::ImageBuffer(const IntSize&, ImageColorSpace imageColorSpace, bool& success)
+    : m_data(IntSize())
+{
+    notImplemented();
+    success = false;
+}
+
+ImageBuffer::~ImageBuffer()
+{
+}
+
+GraphicsContext* ImageBuffer::context() const
+{
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    notImplemented();
+    return 0;
+}
+
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    notImplemented();
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    notImplemented();
+}
+
+String ImageBuffer::toDataURL(const String&) const
+{
+    notImplemented();
+    return String();
+}
+
+Image* ImageBuffer::image() const
+{
+    notImplemented();
+    return 0;
+}
+
+void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/ImageHaiku.cpp b/WebCore/platform/graphics/haiku/ImageHaiku.cpp
new file mode 100644
index 0000000..323d6ab
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/ImageHaiku.cpp
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2006 Simon Hausmann <hausmann@kde.org>
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ * Copyright (C) 2008 Andrea Anzani <andrea.anzani@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Image.h"
+
+#include "BitmapImage.h"
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+#include <Application.h>
+#include <Bitmap.h>
+#include <View.h>
+
+
+// This function loads resources from WebKit
+Vector<char> loadResourceIntoArray(const char*);
+
+
+namespace WebCore {
+
+bool FrameData::clear(bool clearMetadata)
+{
+    if (clearMetadata)
+        m_haveMetadata = false;
+
+    if (m_frame) {
+        delete m_frame;
+        m_frame = 0;
+        m_duration = 0.0f;
+        m_hasAlpha = true;
+        return true;
+    }
+
+    return false;
+}
+
+WTF::PassRefPtr<Image> Image::loadPlatformResource(const char* name)
+{
+    Vector<char> array = loadResourceIntoArray(name);
+    WTF::PassRefPtr<BitmapImage> image = BitmapImage::create();
+    RefPtr<SharedBuffer> buffer = SharedBuffer::create(array.data(), array.size());
+    image->setData(buffer, true);
+
+    return image;
+}
+
+void BitmapImage::initPlatformData()
+{
+}
+
+void BitmapImage::invalidatePlatformData()
+{
+}
+
+// Drawing Routines
+void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatRect& src, CompositeOperator op)
+{
+    startAnimation();
+
+    BBitmap* image = nativeImageForCurrentFrame();
+    if (!image || !image->IsValid()) // If the image hasn't fully loaded.
+        return;
+
+    if (mayFillWithSolidColor()) {
+        fillWithSolidColor(ctxt, dst, solidColor(), op);
+        return;
+    }
+
+    ctxt->save();
+    ctxt->setCompositeOperation(op);
+
+    BRect srcRect(src);
+    BRect dstRect(dst);
+
+    // Test using example site at
+    // http://www.meyerweb.com/eric/css/edge/complexspiral/demo.html
+    ctxt->platformContext()->SetDrawingMode(B_OP_ALPHA);
+    ctxt->platformContext()->DrawBitmap(image, srcRect & image->Bounds(), dstRect);
+    ctxt->restore();
+}
+
+void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, const TransformationMatrix& patternTransform, const FloatPoint& srcPoint, CompositeOperator op, const FloatRect& dstRect)
+{
+    // FIXME: finish this to support also phased position (srcPoint)
+    startAnimation();
+
+    BBitmap* image = nativeImageForCurrentFrame();
+    if (!image || !image->IsValid()) // If the image hasn't fully loaded.
+        return;
+
+    float currentW = 0;
+    float currentH = 0;
+
+    context->save();
+    context->platformContext()->SetDrawingMode(B_OP_ALPHA);
+    context->clip(enclosingIntRect(dstRect));
+
+    while (currentW < dstRect.width()) {
+        while (currentH < dstRect.height()) {
+            context->platformContext()->DrawBitmap(image, BPoint(dstRect.x() + currentW, dstRect.y() + currentH));
+            currentH += tileRect.height();
+        }
+        currentW += tileRect.width();
+        currentH = 0;
+    }
+    context->restore();
+}
+
+void BitmapImage::checkForSolidColor()
+{
+    // FIXME: need to check the RGBA32 buffer to see if it is 1x1.
+    m_isSolidColor = false;
+    m_checkedForSolidColor = true;
+}
+
+BBitmap* BitmapImage::getBBitmap() const
+{
+    return const_cast<BitmapImage*>(this)->frameAtIndex(0);
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/IntPointHaiku.cpp b/WebCore/platform/graphics/haiku/IntPointHaiku.cpp
new file mode 100644
index 0000000..327e503
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/IntPointHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntPoint.h"
+
+#include <Point.h>
+
+
+namespace WebCore {
+
+IntPoint::IntPoint(const BPoint& point)
+    : m_x(static_cast<int>(point.x))
+    , m_y(static_cast<int>(point.y))
+{
+}
+
+IntPoint::operator BPoint() const
+{
+    return BPoint(m_x, m_y);
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/IntRectHaiku.cpp b/WebCore/platform/graphics/haiku/IntRectHaiku.cpp
new file mode 100644
index 0000000..74a0b9d
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/IntRectHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntRect.h"
+
+#include <Rect.h>
+
+
+namespace WebCore {
+
+IntRect::IntRect(const BRect& rect)
+    : m_location(rect.LeftTop())
+    , m_size(rect.IntegerWidth(), rect.IntegerHeight())
+{
+}
+
+IntRect::operator BRect() const
+{
+    return BRect(BPoint(x(), y()), BSize(width(), height()));
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/IntSizeHaiku.cpp b/WebCore/platform/graphics/haiku/IntSizeHaiku.cpp
new file mode 100644
index 0000000..08c3a9d
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/IntSizeHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntSize.h"
+
+#include <Size.h>
+
+
+namespace WebCore {
+
+IntSize::IntSize(const BSize& size)
+    : m_width(size.IntegerWidth())
+    , m_height(size.IntegerHeight())
+{
+}
+
+IntSize::operator BSize() const
+{
+    return BSize(width(), height());
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/PathHaiku.cpp b/WebCore/platform/graphics/haiku/PathHaiku.cpp
new file mode 100644
index 0000000..d0da025
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/PathHaiku.cpp
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Path.h"
+
+#include "FloatRect.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+#include <Region.h>
+
+
+namespace WebCore {
+
+Path::Path()
+    : m_path(new BRegion())
+{
+}
+
+Path::~Path()
+{
+    delete m_path;
+}
+
+Path::Path(const Path& other)
+    : m_path(new BRegion(*other.platformPath()))
+{
+}
+
+Path& Path::operator=(const Path& other)
+{
+    if (&other != this)
+        m_path = other.platformPath();
+
+    return *this;
+}
+
+bool Path::hasCurrentPoint() const
+{
+    return !isEmpty();
+}
+
+bool Path::contains(const FloatPoint& point, WindRule rule) const
+{
+    return m_path->Contains(point);
+}
+
+void Path::translate(const FloatSize& size)
+{
+    notImplemented();
+}
+
+FloatRect Path::boundingRect() const
+{
+    return m_path->Frame();
+}
+
+void Path::moveTo(const FloatPoint& point)
+{
+    // FIXME: Use OffsetBy?
+    notImplemented();
+}
+
+void Path::addLineTo(const FloatPoint& p)
+{
+    notImplemented();
+}
+
+void Path::addQuadCurveTo(const FloatPoint& cp, const FloatPoint& p)
+{
+    notImplemented();
+}
+
+void Path::addBezierCurveTo(const FloatPoint& cp1, const FloatPoint& cp2, const FloatPoint& p)
+{
+    notImplemented();
+}
+
+void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
+{
+    notImplemented();
+}
+
+void Path::closeSubpath()
+{
+    notImplemented();
+}
+
+void Path::addArc(const FloatPoint& p, float r, float sar, float ear, bool anticlockwise)
+{
+    notImplemented();
+}
+
+void Path::addRect(const FloatRect& r)
+{
+    m_path->Include(r);
+}
+
+void Path::addEllipse(const FloatRect& r)
+{
+    notImplemented();
+}
+
+void Path::clear()
+{
+    m_path->MakeEmpty();
+}
+
+bool Path::isEmpty() const
+{
+    return !m_path->Frame().IsValid();
+}
+
+String Path::debugString() const
+{
+    notImplemented();
+    return String();
+}
+
+void Path::apply(void* info, PathApplierFunction function) const
+{
+    notImplemented();
+}
+
+void Path::transform(const TransformationMatrix& transform)
+{
+    notImplemented();
+}
+
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+{
+    notImplemented();
+    return FloatRect();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp b/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp
new file mode 100644
index 0000000..34941c0
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com> All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SimpleFontData.h"
+
+#include "FloatRect.h"
+#include "FontCache.h"
+#include "FontDescription.h"
+#include "NotImplemented.h"
+#include <Rect.h>
+#include <unicode/uchar.h>
+#include <unicode/unorm.h>
+
+
+namespace WebCore {
+
+void SimpleFontData::platformInit()
+{
+    BFont* font = m_platformData.font();
+    if (!font)
+        return;
+
+    font_height height;
+    font->GetHeight(&height);
+    m_ascent = static_cast<int>(height.ascent);
+    m_descent = static_cast<int>(height.descent);
+    m_lineSpacing = m_ascent + m_descent;
+    m_xHeight = height.ascent * 0.56f; // Hack taken from the win port.
+    m_lineGap = height.leading;
+}
+
+void SimpleFontData::platformCharWidthInit()
+{
+    m_avgCharWidth = 0.f;
+    m_maxCharWidth = 0.f;
+    initCharWidths();
+}
+
+void SimpleFontData::platformDestroy()
+{
+    delete m_smallCapsFontData;
+    m_smallCapsFontData = 0;
+}
+
+SimpleFontData* SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
+{
+    if (!m_smallCapsFontData) {
+        FontDescription desc = FontDescription(fontDescription);
+        desc.setSpecifiedSize(0.70f * fontDescription.computedSize());
+        const FontPlatformData* fontPlatformData = new FontPlatformData(desc, desc.family().family());
+        m_smallCapsFontData = new SimpleFontData(*fontPlatformData);
+    }
+    return m_smallCapsFontData;
+}
+
+bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
+{
+    // FIXME: We will need to implement this to load non-ASCII encoding sites
+    return true;
+}
+
+void SimpleFontData::determinePitch()
+{
+    m_treatAsFixedPitch = m_platformData.font() && m_platformData.font()->IsFixed();
+}
+
+float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
+{
+    const char charArray[1] = { glyph };
+    float escapements[1];
+
+    if (m_platformData.font()) {
+        m_platformData.font()->GetEscapements(charArray, 1, escapements);
+        return escapements[0] * m_platformData.font()->Size();
+    }
+
+    return 0;
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/mac/Canvas3DLayer.h b/WebCore/platform/graphics/mac/Canvas3DLayer.h
new file mode 100644
index 0000000..6c65676
--- /dev/null
+++ b/WebCore/platform/graphics/mac/Canvas3DLayer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Canvas3DLayer_h
+#define Canvas3DLayer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#import "WebLayer.h"
+
+namespace WebCore {
+    class GraphicsLayer;
+}
+
+@interface Canvas3DLayer : CAOpenGLLayer 
+{
+    WebCore::GraphicsLayer* m_layerOwner;
+    CGLContextObj m_contextObj;
+    GLuint m_texture;
+}
+
+-(id)initWithContext:(CGLContextObj)context texture:(GLuint)texture;
+
+@end
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // Canvas3DLayer_h
diff --git a/WebCore/platform/graphics/mac/Canvas3DLayer.mm b/WebCore/platform/graphics/mac/Canvas3DLayer.mm
new file mode 100644
index 0000000..545c58b
--- /dev/null
+++ b/WebCore/platform/graphics/mac/Canvas3DLayer.mm
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+#if ENABLE(3D_CANVAS)
+
+#import "Canvas3DLayer.h"
+
+#import "GraphicsLayer.h"
+#import <QuartzCore/QuartzCore.h>
+#import <OpenGL/OpenGL.h>
+
+using namespace WebCore;
+
+@implementation Canvas3DLayer
+
+-(id)initWithContext:(CGLContextObj)context texture:(GLuint)texture
+{
+    m_contextObj = context;
+    m_texture = texture;
+    self = [super init];
+    return self;
+}
+
+-(CGLPixelFormatObj)copyCGLPixelFormatForDisplayMask:(uint32_t)mask
+{
+    CGLPixelFormatAttribute attribs[] =
+    {
+        (CGLPixelFormatAttribute) kCGLPFAAccelerated,
+        (CGLPixelFormatAttribute) kCGLPFAColorSize, (CGLPixelFormatAttribute) 32,
+        (CGLPixelFormatAttribute) kCGLPFADisplayMask, (CGLPixelFormatAttribute) mask,
+        (CGLPixelFormatAttribute) 0
+    };
+    
+    CGLPixelFormatObj pixelFormatObj;
+    GLint numPixelFormats;
+ 
+    CGLChoosePixelFormat(attribs, &pixelFormatObj, &numPixelFormats);
+    return pixelFormatObj;
+}
+
+-(CGLContextObj)copyCGLContextForPixelFormat:(CGLPixelFormatObj)pixelFormat
+{
+    CGLContextObj contextObj;
+    CGLCreateContext(pixelFormat, m_contextObj, &contextObj);
+    return contextObj;
+}
+
+-(void)drawInCGLContext:(CGLContextObj)glContext pixelFormat:(CGLPixelFormatObj)pixelFormat forLayerTime:(CFTimeInterval)timeInterval displayTime:(const CVTimeStamp *)timeStamp
+{
+    CGRect frame = [self frame];
+        
+    // draw the FBO into the layer
+    glViewport(0, 0, frame.size.width, frame.size.height);
+    glMatrixMode(GL_PROJECTION);
+    glLoadIdentity();
+    glOrtho(-1, 1, -1, 1, -1, 1);
+    glMatrixMode(GL_MODELVIEW);
+    glLoadIdentity();
+
+    glEnable(GL_TEXTURE_2D);
+    glBindTexture(GL_TEXTURE_2D, m_texture);
+    
+    glBegin(GL_TRIANGLE_FAN);
+        glTexCoord2f(0, 0);
+        glVertex2f(-1, -1);
+        glTexCoord2f(1, 0);
+        glVertex2f(1, -1);
+        glTexCoord2f(1, 1);
+        glVertex2f(1, 1);
+        glTexCoord2f(0, 1);
+        glVertex2f(-1, 1);
+    glEnd();
+    
+    glBindTexture(GL_TEXTURE_2D, 0);
+    glDisable(GL_TEXTURE_2D);
+
+    // Call super to finalize the drawing. By default all it does is call glFlush().
+    [super drawInCGLContext:glContext pixelFormat:pixelFormat forLayerTime:timeInterval displayTime:timeStamp];
+}
+
+@end
+
+@implementation Canvas3DLayer(WebLayerAdditions)
+
+-(void)setLayerOwner:(GraphicsLayer*)aLayer
+{
+    m_layerOwner = aLayer;
+}
+
+-(GraphicsLayer*)layerOwner
+{
+    return m_layerOwner;
+}
+
+@end
+
+#endif // ENABLE(3D_CANVAS)
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/mac/CoreTextController.cpp b/WebCore/platform/graphics/mac/CoreTextController.cpp
index 05f29b5..b2682e4 100644
--- a/WebCore/platform/graphics/mac/CoreTextController.cpp
+++ b/WebCore/platform/graphics/mac/CoreTextController.cpp
@@ -365,7 +365,7 @@ void CoreTextController::collectCoreTextRunsForCharacters(const UChar* cp, unsig
 
     RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(NULL, cp, length, kCFAllocatorNull));
 
-    RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(NULL, string.get(), fontData->getCFStringAttributes()));
+    RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(NULL, string.get(), fontData->getCFStringAttributes(m_font.fontDescription().textRenderingMode())));
 
     RetainPtr<CTTypesetterRef> typesetter;
 
diff --git a/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp b/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
index e40bbab..5e72101 100644
--- a/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
@@ -46,11 +46,13 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
     ATSFontContainerRef containerRef = 0;
     ATSFontRef fontRef = 0;
 
+    RetainPtr<CGFontRef> cgFontRef;
+
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
     RetainPtr<CFDataRef> bufferData(AdoptCF, buffer->createCFData());
     RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(bufferData.get()));
     
-    CGFontRef cgFontRef = CGFontCreateWithDataProvider(dataProvider.get());
+    cgFontRef.adoptCF(CGFontCreateWithDataProvider(dataProvider.get()));
     if (!cgFontRef)
         return 0;
 #else
@@ -75,13 +77,11 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
         return 0;
     }
     
-    CGFontRef cgFontRef = CGFontCreateWithPlatformFont(&fontRef);
+    cgFontRef.adoptCF(CGFontCreateWithPlatformFont(&fontRef));
 #ifndef BUILDING_ON_TIGER
     // Workaround for <rdar://problem/5675504>.
-    if (cgFontRef && !CGFontGetNumberOfGlyphs(cgFontRef)) {
-        CFRelease(cgFontRef);
+    if (cgFontRef && !CGFontGetNumberOfGlyphs(cgFontRef.get()))
         cgFontRef = 0;
-    }
 #endif
     if (!cgFontRef) {
         ATSFontDeactivate(containerRef, NULL, kATSOptionFlagsDefault);
@@ -89,7 +89,7 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
     }
 #endif // !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 
-    return new FontCustomPlatformData(containerRef, fontRef, cgFontRef);
+    return new FontCustomPlatformData(containerRef, fontRef, cgFontRef.releaseRef());
 }
 
 }
diff --git a/WebCore/platform/graphics/mac/FontMac.mm b/WebCore/platform/graphics/mac/FontMac.mm
index df9494a..b2b9a5c 100644
--- a/WebCore/platform/graphics/mac/FontMac.mm
+++ b/WebCore/platform/graphics/mac/FontMac.mm
@@ -50,10 +50,33 @@ bool Font::canReturnFallbackFontsForComplexText()
 void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, const GlyphBuffer& glyphBuffer, int from, int numGlyphs, const FloatPoint& point) const
 {
     CGContextRef cgContext = context->platformContext();
+    bool newShouldUseFontSmoothing = shouldUseSmoothing();
+
+    switch(fontDescription().fontSmoothing()) {
+    case Antialiased: {
+        context->setShouldAntialias(true);
+        newShouldUseFontSmoothing = false;
+        break;
+    }
+    case SubpixelAntialiased: {
+        context->setShouldAntialias(true);
+        newShouldUseFontSmoothing = true;
+        break;
+    }
+    case NoSmoothing: {
+        context->setShouldAntialias(false);
+        newShouldUseFontSmoothing = false;
+        break;
+    }
+    case AutoSmoothing: {
+        // For the AutoSmooth case, don't do anything! Keep the default settings.
+        break; 
+    }
+    default: 
+        ASSERT_NOT_REACHED();
+    }
 
     bool originalShouldUseFontSmoothing = wkCGContextGetShouldSmoothFonts(cgContext);
-    bool newShouldUseFontSmoothing = shouldUseSmoothing();
-    
     if (originalShouldUseFontSmoothing != newShouldUseFontSmoothing)
         CGContextSetShouldSmoothFonts(cgContext, newShouldUseFontSmoothing);
     
diff --git a/WebCore/platform/graphics/mac/FontMacATSUI.mm b/WebCore/platform/graphics/mac/FontMacATSUI.mm
index 051abb7..409bda4 100644
--- a/WebCore/platform/graphics/mac/FontMacATSUI.mm
+++ b/WebCore/platform/graphics/mac/FontMacATSUI.mm
@@ -105,12 +105,12 @@ static bool fontHasMirroringInfo(ATSUFontID fontID)
     return false;
 }
 
-static void disableLigatures(const SimpleFontData* fontData)
+static void disableLigatures(const SimpleFontData* fontData, TextRenderingMode textMode)
 {
     // Don't be too aggressive: if the font doesn't contain 'a', then assume that any ligatures it contains are
     // in characters that always go through ATSUI, and therefore allow them. Geeza Pro is an example.
     // See bugzilla 5166.
-    if (fontData->platformData().allowsLigatures())
+    if (textMode == OptimizeLegibility || textMode == GeometricPrecision || fontData->platformData().allowsLigatures())
         return;
 
     ATSUFontFeatureType featureTypes[] = { kLigaturesType };
@@ -120,7 +120,7 @@ static void disableLigatures(const SimpleFontData* fontData)
         LOG_ERROR("ATSUSetFontFeatures failed (%d) -- ligatures remain enabled", status);
 }
 
-static void initializeATSUStyle(const SimpleFontData* fontData)
+static void initializeATSUStyle(const SimpleFontData* fontData, TextRenderingMode textMode)
 {
     if (fontData->m_ATSUStyleInitialized)
         return;
@@ -141,19 +141,28 @@ static void initializeATSUStyle(const SimpleFontData* fontData)
         transform = CGAffineTransformConcat(transform, CGAffineTransformMake(1, 0, -tanf(SYNTHETIC_OBLIQUE_ANGLE * acosf(0) / 90), 1, 0, 0));
     Fixed fontSize = FloatToFixed(fontData->platformData().m_size);
     ByteCount styleSizes[4] = { sizeof(Fixed), sizeof(ATSUFontID), sizeof(CGAffineTransform), sizeof(Fract) };
-    // Turn off automatic kerning until it is supported in the CG code path (bug 6136)
-    Fract kerningInhibitFactor = FloatToFract(1.0);
     
-    ATSUAttributeTag styleTags[4] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag, kATSUKerningInhibitFactorTag };
-    ATSUAttributeValuePtr styleValues[4] = { &fontSize, &fontID, &transform, &kerningInhibitFactor };
-    status = ATSUSetAttributes(fontData->m_ATSUStyle, 4, styleTags, styleSizes, styleValues);
-    if (status != noErr)
-        LOG_ERROR("ATSUSetAttributes failed (%d)", status);
+    bool allowKerning = textMode == OptimizeLegibility || textMode == GeometricPrecision;
+    if (!allowKerning) {
+        // Turn off automatic kerning until it is supported in the CG code path (bug 6136)
+        Fract kerningInhibitFactor = FloatToFract(1.0);
+        ATSUAttributeTag styleTags[4] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag, kATSUKerningInhibitFactorTag };
+        ATSUAttributeValuePtr styleValues[4] = { &fontSize, &fontID, &transform, &kerningInhibitFactor };
+        status = ATSUSetAttributes(fontData->m_ATSUStyle, 4, styleTags, styleSizes, styleValues);
+        if (status != noErr)
+            LOG_ERROR("ATSUSetAttributes failed (%d)", status);
+    } else {
+        ATSUAttributeTag styleTags[3] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag };
+        ATSUAttributeValuePtr styleValues[3] = { &fontSize, &fontID, &transform, };
+        status = ATSUSetAttributes(fontData->m_ATSUStyle, 3, styleTags, styleSizes, styleValues);
+        if (status != noErr)
+            LOG_ERROR("ATSUSetAttributes failed (%d)", status);
+    }
 
     fontData->m_ATSUMirrors = fontHasMirroringInfo(fontID);
 
     // Turn off ligatures such as 'fi' to match the CG code path's behavior, until bug 6135 is fixed.
-    disableLigatures(fontData);
+    disableLigatures(fontData, textMode);
 
     fontData->m_ATSUStyleInitialized = true;
 }
@@ -329,7 +338,7 @@ void ATSULayoutParameters::initialize(const Font* font, const GraphicsContext* g
     OSStatus status;
     ATSULayoutOperationOverrideSpecifier overrideSpecifier;
     
-    initializeATSUStyle(fontData);
+    initializeATSUStyle(fontData, m_font->fontDescription().textRenderingMode());
     
     // FIXME: This is currently missing the following required features that the CoreGraphics code path has:
     // - \n, \t, and nonbreaking space render as a space.
@@ -393,7 +402,7 @@ void ATSULayoutParameters::initialize(const Font* font, const GraphicsContext* g
             const FontData* fallbackFontData = m_font->fontDataForCharacters(m_run.characters() + substituteOffset, substituteLength);
             substituteFontData = fallbackFontData ? fallbackFontData->fontDataForCharacter(m_run[0]) : 0;
             if (substituteFontData) {
-                initializeATSUStyle(substituteFontData);
+                initializeATSUStyle(substituteFontData, m_font->fontDescription().textRenderingMode());
                 if (substituteFontData->m_ATSUStyle)
                     ATSUSetRunStyle(layout, substituteFontData->m_ATSUStyle, substituteOffset, substituteLength);
             } else
@@ -412,7 +421,7 @@ void ATSULayoutParameters::initialize(const Font* font, const GraphicsContext* g
             if (i == substituteOffset || i == substituteOffset + substituteLength) {
                 if (isSmallCap) {
                     isSmallCap = false;
-                    initializeATSUStyle(r->smallCapsFontData(m_font->fontDescription()));
+                    initializeATSUStyle(r->smallCapsFontData(m_font->fontDescription()), m_font->fontDescription().textRenderingMode());
                     ATSUSetRunStyle(layout, r->smallCapsFontData(m_font->fontDescription())->m_ATSUStyle, firstSmallCap, i - firstSmallCap);
                 }
                 if (i == substituteOffset && substituteLength > 0)
@@ -456,7 +465,7 @@ void ATSULayoutParameters::initialize(const Font* font, const GraphicsContext* g
                 } else {
                     if (isSmallCap) {
                         isSmallCap = false;
-                        initializeATSUStyle(smallCapsData);
+                        initializeATSUStyle(smallCapsData, m_font->fontDescription().textRenderingMode());
                         ATSUSetRunStyle(layout, smallCapsData->m_ATSUStyle, firstSmallCap, i - firstSmallCap);
                     }
                     m_fonts[i] = r;
@@ -504,8 +513,8 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint&
         firstGlyphBounds = zeroTrapezoid;
     }
     
-    float beforeWidth = MIN(FixedToFloat(firstGlyphBounds.lowerLeft.x), FixedToFloat(firstGlyphBounds.upperLeft.x));
-    float afterWidth = MAX(FixedToFloat(firstGlyphBounds.lowerRight.x), FixedToFloat(firstGlyphBounds.upperRight.x));
+    float beforeWidth = min(FixedToFloat(firstGlyphBounds.lowerLeft.x), FixedToFloat(firstGlyphBounds.upperLeft.x));
+    float afterWidth = max(FixedToFloat(firstGlyphBounds.lowerRight.x), FixedToFloat(firstGlyphBounds.upperRight.x));
     
     FloatRect rect(point.x() + floorf(beforeWidth), point.y(), roundf(afterWidth) - floorf(beforeWidth), h);
 
@@ -591,8 +600,8 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
     if (actualNumBounds != 1)
         LOG_ERROR("unexpected result from ATSUGetGlyphBounds(): actualNumBounds(%d) != 1", actualNumBounds);
 
-    return MAX(FixedToFloat(firstGlyphBounds.upperRight.x), FixedToFloat(firstGlyphBounds.lowerRight.x)) -
-           MIN(FixedToFloat(firstGlyphBounds.upperLeft.x), FixedToFloat(firstGlyphBounds.lowerLeft.x));
+    return max(FixedToFloat(firstGlyphBounds.upperRight.x), FixedToFloat(firstGlyphBounds.lowerRight.x)) -
+           min(FixedToFloat(firstGlyphBounds.upperLeft.x), FixedToFloat(firstGlyphBounds.lowerLeft.x));
 }
 
 int Font::offsetForPositionForComplexText(const TextRun& run, int x, bool /*includePartialGlyphs*/) const
diff --git a/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
new file mode 100644
index 0000000..cd66445
--- /dev/null
+++ b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
@@ -0,0 +1,1698 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "GraphicsContext3D.h"
+
+#include "CachedImage.h"
+#include "CanvasBuffer.h"
+#include "CanvasFramebuffer.h"
+#include "CanvasArray.h"
+#include "CanvasFloatArray.h"
+#include "CanvasIntArray.h"
+#include "CanvasObject.h"
+#include "CanvasProgram.h"
+#include "CanvasRenderbuffer.h"
+#include "CanvasShader.h"
+#include "CanvasTexture.h"
+#include "CanvasUnsignedByteArray.h"
+#include "CString.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "ImageBuffer.h"
+#include "NotImplemented.h"
+#include "WebKitCSSMatrix.h"
+
+#include <CoreGraphics/CGBitmapContext.h>
+
+namespace WebCore {
+
+GraphicsContext3D::GraphicsContext3D()
+{
+    CGLPixelFormatAttribute attribs[] =
+    {
+        (CGLPixelFormatAttribute) kCGLPFAAccelerated,
+        (CGLPixelFormatAttribute) kCGLPFAColorSize, (CGLPixelFormatAttribute) 32,
+        (CGLPixelFormatAttribute) kCGLPFADepthSize, (CGLPixelFormatAttribute) 32,
+        (CGLPixelFormatAttribute) kCGLPFASupersample,
+        (CGLPixelFormatAttribute) 0
+    };
+    
+    CGLPixelFormatObj pixelFormatObj;
+    GLint numPixelFormats;
+    
+    CGLChoosePixelFormat(attribs, &pixelFormatObj, &numPixelFormats);
+    
+    CGLCreateContext(pixelFormatObj, 0, &m_contextObj);
+    
+    CGLDestroyPixelFormat(pixelFormatObj);
+    
+    // Set the current context to the one given to us.
+    CGLSetCurrentContext(m_contextObj);
+    
+    // create a texture to render into
+    ::glGenTextures(1, &m_texture);
+    ::glBindTexture(GL_TEXTURE_2D, m_texture);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
+    ::glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, 1, 1, 0, GL_RGBA, GL_UNSIGNED_BYTE, 0);
+    ::glBindTexture(GL_TEXTURE_2D, 0);
+    
+    // create an FBO
+    ::glGenFramebuffersEXT(1, &m_fbo);
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
+    
+    ::glGenRenderbuffersEXT(1, &m_depthBuffer);
+    ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_depthBuffer);
+    ::glRenderbufferStorageEXT(GL_RENDERBUFFER_EXT, GL_DEPTH_COMPONENT, 1, 1);
+    ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, 0);
+    
+    ::glFramebufferTexture2DEXT(GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT, GL_TEXTURE_2D, m_texture, 0);
+    ::glFramebufferRenderbufferEXT(GL_FRAMEBUFFER_EXT, GL_DEPTH_ATTACHMENT_EXT, GL_RENDERBUFFER_EXT, m_depthBuffer);
+    
+    ::glClearColor(0, 0, 0, 0);
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+    CGLSetCurrentContext(m_contextObj);
+    ::glDeleteRenderbuffersEXT(1, & m_depthBuffer);
+    ::glDeleteTextures(1, &m_texture);
+    ::glDeleteFramebuffersEXT(1, &m_fbo);
+    CGLSetCurrentContext(0);
+    CGLDestroyContext(m_contextObj);
+}
+
+void GraphicsContext3D::checkError() const
+{
+    // FIXME: This needs to only be done in the debug context. It will probably throw an exception
+    // on error and print the error message to the debug console
+    GLenum error = ::glGetError();
+    if (error != GL_NO_ERROR)
+        notImplemented();
+}
+
+void GraphicsContext3D::makeContextCurrent()
+{
+    CGLSetCurrentContext(m_contextObj);
+}
+
+void GraphicsContext3D::beginPaint(CanvasRenderingContext3D* context)
+{
+    UNUSED_PARAM(context);
+}
+
+void GraphicsContext3D::endPaint()
+{
+}
+
+void GraphicsContext3D::reshape(int width, int height)
+{
+    if (width == m_currentWidth && height == m_currentHeight)
+        return;
+    
+    m_currentWidth = width;
+    m_currentHeight = height;
+    
+    CGLSetCurrentContext(m_contextObj);
+    
+    ::glBindTexture(GL_TEXTURE_2D, m_texture);
+    ::glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, width, height, 0, GL_RGBA, GL_UNSIGNED_BYTE, 0);
+    ::glBindTexture(GL_TEXTURE_2D, 0);
+    
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
+    ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_depthBuffer);
+    ::glRenderbufferStorageEXT(GL_RENDERBUFFER_EXT, GL_DEPTH_COMPONENT, width, height);
+    ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, 0);
+    
+    ::glFramebufferTexture2DEXT(GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT, GL_TEXTURE_2D, m_texture, 0);
+    ::glFramebufferRenderbufferEXT(GL_FRAMEBUFFER_EXT, GL_DEPTH_ATTACHMENT_EXT, GL_RENDERBUFFER_EXT, m_depthBuffer);
+    GLenum status = ::glCheckFramebufferStatusEXT(GL_FRAMEBUFFER_EXT);
+    if (status != GL_FRAMEBUFFER_COMPLETE_EXT) {
+        // FIXME: cleanup
+        notImplemented();
+    }
+
+    ::glViewport(0, 0, m_currentWidth, m_currentHeight);
+    ::glClear(GL_COLOR_BUFFER_BIT);
+    ::glFlush();
+}
+
+static inline void ensureContext(CGLContextObj context)
+{
+    CGLContextObj currentContext = CGLGetCurrentContext();
+    if (currentContext != context)
+        CGLSetCurrentContext(context);
+}
+
+void GraphicsContext3D::activeTexture(unsigned long texture)
+{
+    ensureContext(m_contextObj);
+    ::glActiveTexture(texture);
+}
+
+void GraphicsContext3D::attachShader(CanvasProgram* program, CanvasShader* shader)
+{
+    if (!program || !shader)
+        return;
+    ensureContext(m_contextObj);
+    ::glAttachShader((GLuint) program->object(), (GLuint) shader->object());
+}
+
+void GraphicsContext3D::bindAttribLocation(CanvasProgram* program, unsigned long index, const String& name)
+{
+    if (!program)
+        return;
+    ensureContext(m_contextObj);
+    ::glBindAttribLocation((GLuint) program->object(), index, name.utf8().data());
+}
+
+void GraphicsContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
+{
+    ensureContext(m_contextObj);
+    ::glBindBuffer(target, buffer ? (GLuint) buffer->object() : 0);
+}
+
+
+void GraphicsContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
+{
+    ensureContext(m_contextObj);
+    ::glBindFramebufferEXT(target, buffer ? (GLuint) buffer->object() : m_fbo);
+}
+
+void GraphicsContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
+{
+    ensureContext(m_contextObj);
+    ::glBindBuffer(target, renderbuffer ? (GLuint) renderbuffer->object() : 0);
+}
+
+
+void GraphicsContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
+{
+    ensureContext(m_contextObj);
+    ::glBindTexture(target, texture ? (GLuint) texture->object() : 0);
+}
+
+void GraphicsContext3D::blendColor(double red, double green, double blue, double alpha)
+{
+    ensureContext(m_contextObj);
+    ::glBlendColor(static_cast<float>(red), static_cast<float>(green), static_cast<float>(blue), static_cast<float>(alpha));
+}
+
+void GraphicsContext3D::blendEquation( unsigned long mode )
+{
+    ensureContext(m_contextObj);
+    ::glBlendEquation(mode);
+}
+
+void GraphicsContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
+{
+    ensureContext(m_contextObj);
+    ::glBlendEquationSeparate(modeRGB, modeAlpha);
+}
+
+
+void GraphicsContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
+{
+    ensureContext(m_contextObj);
+    ::glBlendFunc(sfactor, dfactor);
+}       
+
+void GraphicsContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
+{
+    ensureContext(m_contextObj);
+    ::glBlendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+}
+
+void GraphicsContext3D::bufferData(unsigned long target, int size, unsigned long usage)
+{
+    ensureContext(m_contextObj);
+    ::glBufferData(target, size, 0, usage);
+}
+void GraphicsContext3D::bufferData(unsigned long target, CanvasArray* array, unsigned long usage)
+{
+    if (!array || !array->length())
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glBufferData(target, array->sizeInBytes(), array->baseAddress(), usage);
+}
+
+void GraphicsContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* array)
+{
+    if (!array || !array->length())
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glBufferSubData(target, offset, array->sizeInBytes(), array->baseAddress());
+}
+
+unsigned long GraphicsContext3D::checkFramebufferStatus(unsigned long target)
+{
+    ensureContext(m_contextObj);
+    return ::glCheckFramebufferStatusEXT(target);
+}
+
+void GraphicsContext3D::clearColor(double r, double g, double b, double a)
+{
+    ensureContext(m_contextObj);
+    ::glClearColor(static_cast<float>(r), static_cast<float>(g), static_cast<float>(b), static_cast<float>(a));
+}
+
+void GraphicsContext3D::clear(unsigned long mask)
+{
+    ensureContext(m_contextObj);
+    ::glClear(mask);
+}
+
+void GraphicsContext3D::clearDepth(double depth)
+{
+    ensureContext(m_contextObj);
+    ::glClearDepth(depth);
+}
+
+void GraphicsContext3D::clearStencil(long s)
+{
+    ensureContext(m_contextObj);
+    ::glClearStencil(s);
+}
+
+void GraphicsContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
+{
+    ensureContext(m_contextObj);
+    ::glColorMask(red, green, blue, alpha);
+}
+
+void GraphicsContext3D::compileShader(CanvasShader* shader)
+{
+    if (!shader)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glCompileShader((GLuint) shader->object());
+}
+
+void GraphicsContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
+{
+    ensureContext(m_contextObj);
+    ::glCopyTexImage2D(target, level, internalformat, x, y, width, height, border);
+}
+
+void GraphicsContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
+{
+    ensureContext(m_contextObj);
+    ::glCopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+}
+
+void GraphicsContext3D::cullFace(unsigned long mode)
+{
+    ensureContext(m_contextObj);
+    ::glCullFace(mode);
+}
+
+void GraphicsContext3D::depthFunc(unsigned long func)
+{
+    ensureContext(m_contextObj);
+    ::glDepthFunc(func);
+}
+
+void GraphicsContext3D::depthMask(bool flag)
+{
+    ensureContext(m_contextObj);
+    ::glDepthMask(flag);
+}
+
+void GraphicsContext3D::depthRange(double zNear, double zFar)
+{
+    ensureContext(m_contextObj);
+    ::glDepthRange(zNear, zFar);
+}
+
+void GraphicsContext3D::detachShader(CanvasProgram* program, CanvasShader* shader)
+{
+    if (!program || !shader)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glDetachShader((GLuint) program->object(), (GLuint) shader->object());
+}
+
+void GraphicsContext3D::disable(unsigned long cap)
+{
+    ensureContext(m_contextObj);
+    ::glDisable(cap);
+}
+
+void GraphicsContext3D::disableVertexAttribArray(unsigned long index)
+{
+    ensureContext(m_contextObj);
+    ::glDisableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::drawArrays(unsigned long mode, long first, long count)
+{
+    ensureContext(m_contextObj);
+    ::glDrawArrays(mode, first, count);
+}
+
+void GraphicsContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
+{
+    ensureContext(m_contextObj);
+    ::glDrawElements(mode, count, type, reinterpret_cast<void*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3D::enable(unsigned long cap)
+{
+    ensureContext(m_contextObj);
+    ::glEnable(cap);
+}
+
+void GraphicsContext3D::enableVertexAttribArray(unsigned long index)
+{
+    ensureContext(m_contextObj);
+    ::glEnableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::finish()
+{
+    ensureContext(m_contextObj);
+    ::glFinish();
+}
+
+void GraphicsContext3D::flush()
+{
+    ensureContext(m_contextObj);
+    ::glFlush();
+}
+
+void GraphicsContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer* buffer)
+{
+    if (!buffer)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glFramebufferRenderbufferEXT(target, attachment, renderbuffertarget, (GLuint) buffer->object());
+}
+
+void GraphicsContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture* texture, long level)
+{
+    if (!texture)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glFramebufferTexture2DEXT(target, attachment, textarget, (GLuint) texture->object(), level);
+}
+
+void GraphicsContext3D::frontFace(unsigned long mode)
+{
+    ensureContext(m_contextObj);
+    ::glFrontFace(mode);
+}
+
+void GraphicsContext3D::generateMipmap(unsigned long target)
+{
+    ensureContext(m_contextObj);
+    ::glGenerateMipmapEXT(target);
+}
+
+int GraphicsContext3D::getAttribLocation(CanvasProgram* program, const String& name)
+{
+    if (!program)
+        return -1;
+    
+    ensureContext(m_contextObj);
+    return ::glGetAttribLocation((GLuint) program->object(), name.utf8().data());
+}
+
+unsigned long GraphicsContext3D::getError()
+{
+    ensureContext(m_contextObj);
+    return ::glGetError();
+}
+
+String GraphicsContext3D::getString(unsigned long name)
+{
+    ensureContext(m_contextObj);
+    return String((const char*) ::glGetString(name));
+}
+
+void GraphicsContext3D::hint(unsigned long target, unsigned long mode)
+{
+    ensureContext(m_contextObj);
+    ::glHint(target, mode);
+}
+
+bool GraphicsContext3D::isBuffer(CanvasBuffer* buffer)
+{
+    if (!buffer)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsBuffer((GLuint) buffer->object());
+}
+
+bool GraphicsContext3D::isEnabled(unsigned long cap)
+{
+    ensureContext(m_contextObj);
+    return ::glIsEnabled(cap);
+}
+
+bool GraphicsContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsFramebufferEXT((GLuint) framebuffer->object());
+}
+
+bool GraphicsContext3D::isProgram(CanvasProgram* program)
+{
+    if (!program)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsProgram((GLuint) program->object());
+}
+
+bool GraphicsContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsRenderbufferEXT((GLuint) renderbuffer->object());
+}
+
+bool GraphicsContext3D::isShader(CanvasShader* shader)
+{
+    if (!shader)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsShader((GLuint) shader->object());
+}
+
+bool GraphicsContext3D::isTexture(CanvasTexture* texture)
+{
+    if (!texture)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsTexture((GLuint) texture->object());
+}
+
+void GraphicsContext3D::lineWidth(double width)
+{
+    ensureContext(m_contextObj);
+    ::glLineWidth(static_cast<float>(width));
+}
+
+void GraphicsContext3D::linkProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glLinkProgram((GLuint) program->object());
+}
+
+void GraphicsContext3D::pixelStorei(unsigned long pname, long param)
+{
+    ensureContext(m_contextObj);
+    ::glPixelStorei(pname, param);
+}
+
+void GraphicsContext3D::polygonOffset(double factor, double units)
+{
+    ensureContext(m_contextObj);
+    ::glPolygonOffset(static_cast<float>(factor), static_cast<float>(units));
+}
+
+void GraphicsContext3D::releaseShaderCompiler()
+{
+    // FIXME: This is not implemented on desktop OpenGL. We need to have ifdefs for the different GL variants
+    ensureContext(m_contextObj);
+    //::glReleaseShaderCompiler();
+}
+
+void GraphicsContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    ensureContext(m_contextObj);
+    ::glRenderbufferStorageEXT(target, internalformat, width, height);
+}
+
+void GraphicsContext3D::sampleCoverage(double value, bool invert)
+{
+    ensureContext(m_contextObj);
+    ::glSampleCoverage(static_cast<float>(value), invert);
+}
+
+void GraphicsContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
+{
+    ensureContext(m_contextObj);
+    ::glScissor(x, y, width, height);
+}
+
+void GraphicsContext3D::shaderSource(CanvasShader* shader, const String& string)
+{
+    if (!shader)
+        return;
+    
+    ensureContext(m_contextObj);
+    const CString& cs = string.utf8();
+    const char* s = cs.data();
+    
+    int length = string.length();
+    ::glShaderSource((GLuint) shader->object(), 1, &s, &length);
+}
+
+void GraphicsContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
+{
+    ensureContext(m_contextObj);
+    ::glStencilFunc(func, ref, mask);
+}
+
+void GraphicsContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
+{
+    ensureContext(m_contextObj);
+    ::glStencilFuncSeparate(face, func, ref, mask);
+}
+
+void GraphicsContext3D::stencilMask(unsigned long mask)
+{
+    ensureContext(m_contextObj);
+    ::glStencilMask(mask);
+}
+
+void GraphicsContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
+{
+    ensureContext(m_contextObj);
+    ::glStencilMaskSeparate(face, mask);
+}
+
+void GraphicsContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    ensureContext(m_contextObj);
+    ::glStencilOp(fail, zfail, zpass);
+}
+
+void GraphicsContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    ensureContext(m_contextObj);
+    ::glStencilOpSeparate(face, fail, zfail, zpass);
+}
+
+void GraphicsContext3D::texParameterf(unsigned target, unsigned pname, float value)
+{
+    ensureContext(m_contextObj);
+    ::glTexParameterf(target, pname, static_cast<float>(value));
+}
+
+void GraphicsContext3D::texParameteri(unsigned target, unsigned pname, int value)
+{
+    ensureContext(m_contextObj);
+    ::glTexParameteri(target, pname, static_cast<float>(value));
+}
+
+void GraphicsContext3D::uniform1f(long location, float v0)
+{
+    ensureContext(m_contextObj);
+    ::glUniform1f(location, v0);
+}
+
+void GraphicsContext3D::uniform1fv(long location, float* array, int size)
+{
+    ensureContext(m_contextObj);
+    ::glUniform1fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform2f(long location, float v0, float v1)
+{
+    ensureContext(m_contextObj);
+    ::glUniform2f(location, v0, v1);
+}
+
+void GraphicsContext3D::uniform2fv(long location, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 2
+    ensureContext(m_contextObj);
+    ::glUniform2fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform3f(long location, float v0, float v1, float v2)
+{
+    ensureContext(m_contextObj);
+    ::glUniform3f(location, v0, v1, v2);
+}
+
+void GraphicsContext3D::uniform3fv(long location, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 3
+    ensureContext(m_contextObj);
+    ::glUniform3fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform4f(long location, float v0, float v1, float v2, float v3)
+{
+    ensureContext(m_contextObj);
+    ::glUniform4f(location, v0, v1, v2, v3);
+}
+
+void GraphicsContext3D::uniform4fv(long location, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 4
+    ensureContext(m_contextObj);
+    ::glUniform4fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform1i(long location, int v0)
+{
+    ensureContext(m_contextObj);
+    ::glUniform1i(location, v0);
+}
+
+void GraphicsContext3D::uniform1iv(long location, int* array, int size)
+{
+    ensureContext(m_contextObj);
+    ::glUniform1iv(location, size, array);
+}
+
+void GraphicsContext3D::uniform2i(long location, int v0, int v1)
+{
+    ensureContext(m_contextObj);
+    ::glUniform2i(location, v0, v1);
+}
+
+void GraphicsContext3D::uniform2iv(long location, int* array, int size)
+{
+    // FIXME: length needs to be a multiple of 2
+    ensureContext(m_contextObj);
+    ::glUniform2iv(location, size, array);
+}
+
+void GraphicsContext3D::uniform3i(long location, int v0, int v1, int v2)
+{
+    ensureContext(m_contextObj);
+    ::glUniform3i(location, v0, v1, v2);
+}
+
+void GraphicsContext3D::uniform3iv(long location, int* array, int size)
+{
+    // FIXME: length needs to be a multiple of 3
+    ensureContext(m_contextObj);
+    ::glUniform3iv(location, size, array);
+}
+
+void GraphicsContext3D::uniform4i(long location, int v0, int v1, int v2, int v3)
+{
+    ensureContext(m_contextObj);
+    ::glUniform4i(location, v0, v1, v2, v3);
+}
+
+void GraphicsContext3D::uniform4iv(long location, int* array, int size)
+{
+    // FIXME: length needs to be a multiple of 4
+    ensureContext(m_contextObj);
+    ::glUniform4iv(location, size, array);
+}
+
+void GraphicsContext3D::uniformMatrix2fv(long location, bool transpose, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 4
+    ensureContext(m_contextObj);
+    ::glUniformMatrix2fv(location, size, transpose, array);
+}
+
+void GraphicsContext3D::uniformMatrix3fv(long location, bool transpose, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 9
+    ensureContext(m_contextObj);
+    ::glUniformMatrix3fv(location, size, transpose, array);
+}
+
+void GraphicsContext3D::uniformMatrix4fv(long location, bool transpose, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 16
+    ensureContext(m_contextObj);
+    ::glUniformMatrix4fv(location, size, transpose, array);
+}
+
+void GraphicsContext3D::useProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glUseProgram((GLuint) program->object());
+}
+
+void GraphicsContext3D::validateProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glValidateProgram((GLuint) program->object());
+}
+
+void GraphicsContext3D::vertexAttrib1f(unsigned long indx, float v0)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib1f(indx, v0);
+}
+
+void GraphicsContext3D::vertexAttrib1fv(unsigned long indx, float* array)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib1fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib2f(indx, v0, v1);
+}
+
+void GraphicsContext3D::vertexAttrib2fv(unsigned long indx, float* array)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib2fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib3f(indx, v0, v1, v2);
+}
+
+void GraphicsContext3D::vertexAttrib3fv(unsigned long indx, float* array)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib3fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib4f(indx, v0, v1, v2, v3);
+}
+
+void GraphicsContext3D::vertexAttrib4fv(unsigned long indx, float* array)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib4fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttribPointer(unsigned long indx, int size, int type, bool normalized, unsigned long stride, unsigned long offset)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttribPointer(indx, size, type, normalized, stride, reinterpret_cast<void*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3D::viewport(long x, long y, unsigned long width, unsigned long height)
+{
+    ensureContext(m_contextObj);
+    ::glViewport(static_cast<GLint>(x), static_cast<GLint>(y), static_cast<GLsizei>(width), static_cast<GLsizei>(height));
+}
+
+static int sizeForGetParam(unsigned long pname)
+{
+    switch(pname) {
+        case GL_ACTIVE_TEXTURE:                  return 1;
+        case GL_ALIASED_LINE_WIDTH_RANGE:        return 2;
+        case GL_ALIASED_POINT_SIZE_RANGE:        return 2;
+        case GL_ALPHA_BITS:                      return 1;
+        case GL_ARRAY_BUFFER_BINDING:            return 1; // (* actually a CanvasBuffer*)
+        case GL_BLEND:                           return 1;
+        case GL_BLEND_COLOR:                     return 4;
+        case GL_BLEND_DST_ALPHA:                 return 1;
+        case GL_BLEND_DST_RGB:                   return 1;
+        case GL_BLEND_EQUATION_ALPHA:            return 1;
+        case GL_BLEND_EQUATION_RGB:              return 1;
+        case GL_BLEND_SRC_ALPHA:                 return 1;
+        case GL_BLEND_SRC_RGB:                   return 1;
+        case GL_BLUE_BITS:                       return 1;
+        case GL_COLOR_CLEAR_VALUE:               return 4;
+        case GL_COLOR_WRITEMASK:                 return 4;
+        case GL_COMPRESSED_TEXTURE_FORMATS:      return GL_NUM_COMPRESSED_TEXTURE_FORMATS;
+        case GL_CULL_FACE:                       return 1;
+        case GL_CULL_FACE_MODE:                  return 1;
+        case GL_CURRENT_PROGRAM:                 return 1; // (* actually a CanvasProgram*)
+        case GL_DEPTH_BITS:                      return 1;
+        case GL_DEPTH_CLEAR_VALUE:               return 1;
+        case GL_DEPTH_FUNC:                      return 1;
+        case GL_DEPTH_RANGE:                     return 2;
+        case GL_DEPTH_TEST:                      return 1;
+        case GL_DEPTH_WRITEMASK:                 return 1;
+        case GL_DITHER:                          return 1;
+        case GL_ELEMENT_ARRAY_BUFFER_BINDING:    return 1; // (* actually a CanvasBuffer*)
+        case GL_FRAMEBUFFER_BINDING_EXT:         return 1; // (* actually a CanvasFramebuffer*)
+        case GL_FRONT_FACE:                      return 1;
+        case GL_GENERATE_MIPMAP_HINT:            return 1;
+        case GL_GREEN_BITS:                      return 1;
+            //case GL_IMPLEMENTATION_COLOR_READ_FORMAT:return 1;
+            //case GL_IMPLEMENTATION_COLOR_READ_TYPE:  return 1;
+        case GL_LINE_WIDTH:                      return 1;
+        case GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS:return 1;
+        case GL_MAX_CUBE_MAP_TEXTURE_SIZE:       return 1;
+            //case GL_MAX_FRAGMENT_UNIFORM_VECTORS:    return 1;
+        case GL_MAX_RENDERBUFFER_SIZE_EXT:       return 1;
+        case GL_MAX_TEXTURE_IMAGE_UNITS:         return 1;
+        case GL_MAX_TEXTURE_SIZE:                return 1;
+            //case GL_MAX_VARYING_VECTORS:             return 1;
+        case GL_MAX_VERTEX_ATTRIBS:              return 1;
+        case GL_MAX_VERTEX_TEXTURE_IMAGE_UNITS:  return 1;
+            //case GL_MAX_VERTEX_UNIFORM_VECTORS:      return 1;
+        case GL_MAX_VIEWPORT_DIMS:               return 2;
+        case GL_NUM_COMPRESSED_TEXTURE_FORMATS:  return 1;
+            //case GL_NUM_SHADER_BINARY_FORMATS:       return 1;
+        case GL_PACK_ALIGNMENT:                  return 1;
+        case GL_POLYGON_OFFSET_FACTOR:           return 1;
+        case GL_POLYGON_OFFSET_FILL:             return 1;
+        case GL_POLYGON_OFFSET_UNITS:            return 1;
+        case GL_RED_BITS:                        return 1;
+        case GL_RENDERBUFFER_BINDING_EXT:        return 1; // (* actually a CanvasRenderbuffer*)
+        case GL_SAMPLE_BUFFERS:                  return 1;
+        case GL_SAMPLE_COVERAGE_INVERT:          return 1;
+        case GL_SAMPLE_COVERAGE_VALUE:           return 1;
+        case GL_SAMPLES:                         return 1;
+        case GL_SCISSOR_BOX:                     return 4;
+        case GL_SCISSOR_TEST:                    return 1;
+            //case GL_SHADER_BINARY_FORMATS:           return GL_NUM_SHADER_BINARY_FORMATS;
+            //case GL_SHADER_COMPILER:                 return 1;
+        case GL_STENCIL_BACK_FAIL:               return 1;
+        case GL_STENCIL_BACK_FUNC:               return 1;
+        case GL_STENCIL_BACK_PASS_DEPTH_FAIL:    return 1;
+        case GL_STENCIL_BACK_PASS_DEPTH_PASS:    return 1;
+        case GL_STENCIL_BACK_REF:                return 1;
+        case GL_STENCIL_BACK_VALUE_MASK:         return 1;
+        case GL_STENCIL_BACK_WRITEMASK:          return 1;
+        case GL_STENCIL_BITS:                    return 1;
+        case GL_STENCIL_CLEAR_VALUE:             return 1;
+        case GL_STENCIL_FAIL:                    return 1;
+        case GL_STENCIL_FUNC:                    return 1;
+        case GL_STENCIL_PASS_DEPTH_FAIL:         return 1;
+        case GL_STENCIL_PASS_DEPTH_PASS:         return 1;
+        case GL_STENCIL_REF:                     return 1;
+        case GL_STENCIL_TEST:                    return 1;
+        case GL_STENCIL_VALUE_MASK:              return 1;
+        case GL_STENCIL_WRITEMASK:               return 1;
+        case GL_SUBPIXEL_BITS:                   return 1;
+        case GL_TEXTURE_BINDING_2D:              return 1; // (* actually a CanvasTexture*)
+        case GL_TEXTURE_BINDING_CUBE_MAP:        return 1; // (* actually a CanvasTexture*)
+        case GL_UNPACK_ALIGNMENT:                return 1;
+        case GL_VIEWPORT:                        return 4;
+    }
+    
+    return -1;
+}
+
+bool GraphicsContext3D::getBoolean(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    bool isAlloced = false;
+    GLboolean buf[4];
+    GLboolean* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLboolean*) malloc(size * sizeof(GLboolean));
+        isAlloced = true;
+    }
+            
+    ::glGetBooleanv(pname, pbuf);
+    
+    bool value = pbuf[0];
+
+    if (isAlloced)
+        free(pbuf);
+    
+    return value;
+}
+
+PassRefPtr<CanvasUnsignedByteArray> GraphicsContext3D::getBooleanv(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    RefPtr<CanvasUnsignedByteArray> array = CanvasUnsignedByteArray::create(size);
+    bool isAlloced = false;
+    GLboolean buf[4];
+    GLboolean* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLboolean*) malloc(size * sizeof(GLboolean));
+        isAlloced = true;
+    }
+            
+    ::glGetBooleanv(pname, pbuf);
+            
+    for (int i = 0; i < size; ++i)
+        array->set(i, static_cast<unsigned char>(pbuf[i]));
+            
+    if (isAlloced)
+        free(pbuf);
+    
+    return array;
+}
+
+float GraphicsContext3D::getFloat(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    bool isAlloced = false;
+    GLfloat buf[4];
+    GLfloat* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLfloat*) malloc(size * sizeof(GLfloat));
+        isAlloced = true;
+    }
+            
+    ::glGetFloatv(pname, pbuf);
+    
+    float value = pbuf[0];
+
+    if (isAlloced)
+        free(pbuf);
+    
+    return value;
+}
+
+PassRefPtr<CanvasFloatArray> GraphicsContext3D::getFloatv(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(size);
+    bool isAlloced = false;
+    GLfloat buf[4];
+    GLfloat* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLfloat*) malloc(size * sizeof(GLfloat));
+        isAlloced = true;
+    }
+            
+    ::glGetFloatv(pname, pbuf);
+            
+    for (int i = 0; i < size; ++i)
+        array->set(i, static_cast<float>(pbuf[i]));
+            
+    if (isAlloced)
+        free(pbuf);
+    
+    return array;
+}
+
+int GraphicsContext3D::getInteger(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    bool isAlloced = false;
+    GLint buf[4];
+    GLint* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLint*) malloc(size * sizeof(GLint));
+        isAlloced = true;
+    }
+            
+    ::glGetIntegerv(pname, pbuf);
+    
+    int value = pbuf[0];
+
+    if (isAlloced)
+        free(pbuf);
+    
+    return value;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getIntegerv(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(size);
+    bool isAlloced = false;
+    GLint buf[4];
+    GLint* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLint*) malloc(size * sizeof(GLint));
+        isAlloced = true;
+    }
+            
+    ::glGetIntegerv(pname, pbuf);
+            
+    for (int i = 0; i < size; ++i)
+        array->set(i, static_cast<int>(pbuf[i]));
+            
+    if (isAlloced)
+        free(pbuf);
+    
+    return array;
+}
+
+int GraphicsContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetBufferParameteriv(target, pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetBufferParameteriv(target, pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+int GraphicsContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+int GraphicsContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetProgramiv((GLuint) program->object(), pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetProgramiv((GLuint) program->object(), pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+String GraphicsContext3D::getProgramInfoLog(CanvasProgram* program)
+{
+    if (!program)
+        return String();
+    
+    ensureContext(m_contextObj);
+    GLint length;
+    ::glGetProgramiv((GLuint) program->object(), GL_INFO_LOG_LENGTH, &length);
+    
+    GLsizei size;
+    GLchar* info = (GLchar*) malloc(length);
+    ::glGetProgramInfoLog((GLuint) program->object(), length, &size, info);
+    String s(info);
+    free(info);
+    return s;
+}
+
+int GraphicsContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetBufferParameteriv(target, pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetBufferParameteriv(target, pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+int GraphicsContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
+{
+    if (!shader)
+        return 0;
+    
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetShaderiv((GLuint) shader->object(), pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
+{
+    if (!shader)
+        return 0;
+    
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetShaderiv((GLuint) shader->object(), pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+String GraphicsContext3D::getShaderInfoLog(CanvasShader* shader)
+{
+    if (!shader)
+        return String();
+    
+    ensureContext(m_contextObj);
+    GLint length;
+    ::glGetShaderiv((GLuint) shader->object(), GL_INFO_LOG_LENGTH, &length);
+    
+    GLsizei size;
+    GLchar* info = (GLchar*) malloc(length);
+    ::glGetShaderInfoLog((GLuint) shader->object(), length, &size, info);
+    String s(info);
+    free(info);
+    return s;
+}
+
+String GraphicsContext3D::getShaderSource(CanvasShader* shader)
+{
+    if (!shader)
+        return String();
+    
+    ensureContext(m_contextObj);
+    GLint length;
+    ::glGetShaderiv((GLuint) shader->object(), GL_SHADER_SOURCE_LENGTH, &length);
+    
+    GLsizei size;
+    GLchar* info = (GLchar*) malloc(length);
+    ::glGetShaderSource((GLuint) shader->object(), length, &size, info);
+    String s(info);
+    free(info);
+    return s;
+}
+
+
+float GraphicsContext3D::getTexParameterf(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLfloat data;
+    ::glGetTexParameterfv(target, pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasFloatArray> GraphicsContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(1);
+    GLfloat data;
+    ::glGetTexParameterfv(target, pname, &data);
+    array->set(0, static_cast<float>(data));
+    
+    return array;
+}
+
+int GraphicsContext3D::getTexParameteri(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetTexParameteriv(target, pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetTexParameteriv(target, pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+float GraphicsContext3D::getUniformf(CanvasProgram* program, long location)
+{
+    // FIXME: We need to query glGetUniformLocation to determine the size needed
+    UNUSED_PARAM(program);
+    UNUSED_PARAM(location);
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<CanvasFloatArray> GraphicsContext3D::getUniformfv(CanvasProgram* program, long location)
+{
+    // FIXME: We need to query glGetUniformLocation to determine the size needed
+    UNUSED_PARAM(program);
+    UNUSED_PARAM(location);
+    notImplemented();
+    return 0;
+}
+
+int GraphicsContext3D::getUniformi(CanvasProgram* program, long location)
+{
+    // FIXME: We need to query glGetUniformLocation to determine the size needed
+    UNUSED_PARAM(program);
+    UNUSED_PARAM(location);
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getUniformiv(CanvasProgram* program, long location)
+{
+    // FIXME: We need to query glGetUniformLocation to determine the size needed
+    UNUSED_PARAM(program);
+    UNUSED_PARAM(location);
+    notImplemented();
+    return 0;
+}
+
+long GraphicsContext3D::getUniformLocation(CanvasProgram* program, const String& name)
+{
+    if (!program)
+        return -1;
+    
+    ensureContext(m_contextObj);
+    return ::glGetUniformLocation((GLuint) program->object(), name.utf8().data());
+}
+
+static int sizeForGetVertexAttribParam(unsigned long pname)
+{
+    switch(pname) {
+        case GL_VERTEX_ATTRIB_ARRAY_BUFFER_BINDING:     return 1; // (* actually a CanvasBuffer*)
+        case GL_VERTEX_ATTRIB_ARRAY_ENABLED:            return 1;
+        case GL_VERTEX_ATTRIB_ARRAY_SIZE:               return 1;
+        case GL_VERTEX_ATTRIB_ARRAY_STRIDE:             return 1;
+        case GL_VERTEX_ATTRIB_ARRAY_TYPE:               return 1;
+        case GL_VERTEX_ATTRIB_ARRAY_NORMALIZED:         return 1;
+        case GL_CURRENT_VERTEX_ATTRIB:                  return 4;
+    }
+    
+    return -1;
+}
+
+float GraphicsContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLfloat buf[4];
+    ::glGetVertexAttribfv(index, pname, buf);
+    return buf[0];
+}
+
+PassRefPtr<CanvasFloatArray> GraphicsContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
+{
+    int size = sizeForGetVertexAttribParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(size);
+    GLfloat buf[4];
+    ::glGetVertexAttribfv(index, pname, buf);
+            
+    for (int i = 0; i < size; ++i)
+        array->set(i, static_cast<float>(buf[i]));
+    
+    return array;
+}
+
+int GraphicsContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint buf[4];
+    ::glGetVertexAttribiv(index, pname, buf);
+    return buf[0];
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
+{
+    int size = sizeForGetVertexAttribParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(size);
+    GLint buf[4];
+    ::glGetVertexAttribiv(index, pname, buf);
+            
+    for (int i = 0; i < size; ++i)
+        array->set(i, static_cast<int>(buf[i]));
+    
+    return array;
+}
+
+long GraphicsContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    
+    void* pointer;
+    ::glGetVertexAttribPointerv(index, pname, &pointer);
+    return reinterpret_cast<long>(pointer);
+}
+
+// Assumes the texture you want to go into is bound
+static void imageToTexture(Image* image, unsigned target, unsigned level)
+{
+    if (!image)
+        return;
+    
+    CGImageRef textureImage = image->getCGImageRef();
+    if (!textureImage)
+        return;
+    
+    size_t textureWidth = CGImageGetWidth(textureImage);
+    size_t textureHeight = CGImageGetHeight(textureImage);
+    
+    GLubyte* textureData = (GLubyte*) malloc(textureWidth * textureHeight * 4);
+    CGContextRef textureContext = CGBitmapContextCreate(textureData, textureWidth, textureHeight, 8, textureWidth * 4, 
+                                                        CGImageGetColorSpace(textureImage), kCGImageAlphaPremultipliedLast);
+    
+    CGContextDrawImage(textureContext, CGRectMake(0, 0, (CGFloat)textureWidth, (CGFloat)textureHeight), textureImage);
+    CGContextRelease(textureContext);
+    
+    ::glTexImage2D(target, level, GL_RGBA, textureWidth, textureHeight, 0, GL_RGBA, GL_UNSIGNED_BYTE, textureData);
+    free(textureData);
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, CanvasArray* pixels)
+{
+    // FIXME: Need to do bounds checking on the buffer here.
+    ::glTexImage2D(target, level, internalformat, width, height, border, format, type, pixels->baseAddress());
+    return 0;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, ImageData* pixels)
+{
+    // FIXME: need to implement this form
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(internalformat);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(border);
+    UNUSED_PARAM(format);
+    UNUSED_PARAM(type);
+    UNUSED_PARAM(pixels);
+    return -1;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLImageElement* image, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: need to support flipY and premultiplyAlpha
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    
+    if (!image)
+        return -1;
+    
+    ensureContext(m_contextObj);
+    CachedImage* cachedImage = image->cachedImage();
+    if (!cachedImage)
+        return -1;
+    
+    imageToTexture(cachedImage->image(), target, level);
+    return 0;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: need to support flipY and premultiplyAlpha
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    
+    if (!canvas)
+        return -1;
+    
+    ensureContext(m_contextObj);
+    ImageBuffer* buffer = canvas->buffer();
+    if (!buffer)
+        return -1;
+    
+    imageToTexture(buffer->image(), target, level);
+    return 0;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: need to implement this form
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(video);
+
+    // FIXME: need to support flipY and premultiplyAlpha
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, unsigned format, unsigned type, CanvasArray* pixels)
+{
+    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoff);
+    UNUSED_PARAM(yoff);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(format);
+    UNUSED_PARAM(type);
+    UNUSED_PARAM(pixels);
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, unsigned format, unsigned type, ImageData* pixels)
+{
+    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoff);
+    UNUSED_PARAM(yoff);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(format);
+    UNUSED_PARAM(type);
+    UNUSED_PARAM(pixels);
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLImageElement* image, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoff);
+    UNUSED_PARAM(yoff);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(image);
+
+    // FIXME: need to support flipY and premultiplyAlpha    
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLCanvasElement* canvas, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoff);
+    UNUSED_PARAM(yoff);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(canvas);
+
+    // FIXME: need to support flipY and premultiplyAlpha    
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLVideoElement* video, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoff);
+    UNUSED_PARAM(yoff);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(video);
+
+    // FIXME: need to support flipY and premultiplyAlpha    
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    return -1;
+}
+
+unsigned GraphicsContext3D::createBuffer()
+{
+    ensureContext(m_contextObj);
+    GLuint o;
+    glGenBuffers(1, &o);
+    return o;
+}
+
+unsigned GraphicsContext3D::createFramebuffer()
+{
+    ensureContext(m_contextObj);
+    GLuint o;
+    glGenFramebuffersEXT(1, &o);
+    return o;
+}
+
+unsigned GraphicsContext3D::createProgram()
+{
+    ensureContext(m_contextObj);
+    return glCreateProgram();
+}
+
+unsigned GraphicsContext3D::createRenderbuffer()
+{
+    ensureContext(m_contextObj);
+    GLuint o;
+    glGenRenderbuffersEXT(1, &o);
+    return o;
+}
+
+unsigned GraphicsContext3D::createShader(ShaderType type)
+{
+    ensureContext(m_contextObj);
+    return glCreateShader((type == FRAGMENT_SHADER) ? GL_FRAGMENT_SHADER : GL_VERTEX_SHADER);
+}
+
+unsigned GraphicsContext3D::createTexture()
+{
+    ensureContext(m_contextObj);
+    GLuint o;
+    glGenTextures(1, &o);
+    return o;
+}
+
+void GraphicsContext3D::deleteBuffer(unsigned buffer)
+{
+    ensureContext(m_contextObj);
+    glDeleteBuffers(1, &buffer);
+}
+
+void GraphicsContext3D::deleteFramebuffer(unsigned framebuffer)
+{
+    ensureContext(m_contextObj);
+    glDeleteFramebuffersEXT(1, &framebuffer);
+}
+
+void GraphicsContext3D::deleteProgram(unsigned program)
+{
+    ensureContext(m_contextObj);
+    glDeleteProgram(program);
+}
+
+void GraphicsContext3D::deleteRenderbuffer(unsigned renderbuffer)
+{
+    ensureContext(m_contextObj);
+    glDeleteRenderbuffersEXT(1, &renderbuffer);
+}
+
+void GraphicsContext3D::deleteShader(unsigned shader)
+{
+    ensureContext(m_contextObj);
+    glDeleteShader(shader);
+}
+
+void GraphicsContext3D::deleteTexture(unsigned texture)
+{
+    ensureContext(m_contextObj);
+    glDeleteTextures(1, &texture);
+}
+
+int GraphicsContext3D::sizeInBytes(int type)
+{
+    switch (type) {
+        case GL_BYTE:
+            return sizeof(GLbyte);
+        case GL_UNSIGNED_BYTE:
+            return sizeof(GLubyte);
+        case GL_SHORT:
+            return sizeof(GLshort);
+        case GL_UNSIGNED_SHORT:
+            return sizeof(GLushort);
+        case GL_INT:
+            return sizeof(GLint);
+        case GL_UNSIGNED_INT:
+            return sizeof(GLuint);
+        case GL_FLOAT:
+            return sizeof(GLfloat);
+        default:
+            return 0;
+    }
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/platform/graphics/mac/GraphicsContextMac.mm b/WebCore/platform/graphics/mac/GraphicsContextMac.mm
index 2404319..6c9b872 100644
--- a/WebCore/platform/graphics/mac/GraphicsContextMac.mm
+++ b/WebCore/platform/graphics/mac/GraphicsContextMac.mm
@@ -50,27 +50,26 @@ void GraphicsContext::drawFocusRing(const Color& color)
 
     int radius = (focusRingWidth() - 1) / 2;
     int offset = radius + focusRingOffset();
-    CGColorRef colorRef = color.isValid() ? createCGColor(color) : 0;
+    RetainPtr<CGColorRef> colorRef;
+    if (color.isValid())
+        colorRef.adoptCF(createCGColor(color));
 
-    CGMutablePathRef focusRingPath = CGPathCreateMutable();
+    RetainPtr<CGMutablePathRef> focusRingPath(AdoptCF, CGPathCreateMutable());
     const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
     for (unsigned i = 0; i < rectCount; i++)
-        CGPathAddRect(focusRingPath, 0, CGRectInset(rects[i], -offset, -offset));
+        CGPathAddRect(focusRingPath.get(), 0, CGRectInset(rects[i], -offset, -offset));
 
     CGContextRef context = platformContext();
 #ifdef BUILDING_ON_TIGER
     CGContextBeginTransparencyLayer(context, NULL);
 #endif
     CGContextBeginPath(context);
-    CGContextAddPath(context, focusRingPath);
-    wkDrawFocusRing(context, colorRef, radius);
+    CGContextAddPath(context, focusRingPath.get());
+    wkDrawFocusRing(context, colorRef.get(), radius);
 #ifdef BUILDING_ON_TIGER
     CGContextEndTransparencyLayer(context);
 #endif
-    CGColorRelease(colorRef);
-
-    CGPathRelease(focusRingPath);
 }
 
 #ifdef BUILDING_ON_TIGER // Post-Tiger's setCompositeOperation() is defined in GraphicsContextCG.cpp.
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.h b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
index ebdc6ac..d0e1108 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.h
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
@@ -62,6 +62,8 @@ public:
 
     virtual void removeFromParent();
 
+    virtual void setMaskLayer(GraphicsLayer*);
+
     virtual void setPosition(const FloatPoint&);
     virtual void setAnchorPoint(const FloatPoint3D&);
     virtual void setSize(const FloatSize&);
@@ -86,6 +88,10 @@ public:
     virtual void setNeedsDisplay();
     virtual void setNeedsDisplayInRect(const FloatRect&);
 
+#if ENABLE(3D_CANVAS)
+    virtual void setGraphicsContext3DNeedsDisplay();
+#endif
+    
     virtual void setContentsRect(const IntRect&);
     
     virtual void suspendAnimations(double time);
@@ -98,6 +104,9 @@ public:
     
     virtual void setContentsToImage(Image*);
     virtual void setContentsToVideo(PlatformLayer*);
+#if ENABLE(3D_CANVAS)
+    virtual void setContentsToGraphicsContext3D(const GraphicsContext3D*);
+#endif
     
     virtual PlatformLayer* platformLayer() const;
 
@@ -170,8 +179,12 @@ private:
 
     void updateContentsImage();
     void updateContentsVideo();
+#if ENABLE(3D_CANVAS)
+    void updateContentsGraphicsContext3D();
+#endif
     void updateContentsRect();
     void updateGeometryOrientation();
+    void updateMaskLayer();
 
     void updateLayerAnimations();
 
@@ -199,8 +212,12 @@ private:
         DirtyRectsChanged = 1 << 16,
         ContentsImageChanged = 1 << 17,
         ContentsVideoChanged = 1 << 18,
-        ContentsRectChanged = 1 << 19,
-        GeometryOrientationChanged = 1 << 20
+#if ENABLE(3D_CANVAS)
+        ContentsGraphicsContext3DChanged = 1 << 19,
+#endif
+        ContentsRectChanged = 1 << 20,
+        GeometryOrientationChanged = 1 << 21,
+        MaskLayerChanged = 1 << 22
     };
     typedef unsigned LayerChangeFlags;
     void noteLayerPropertyChanged(LayerChangeFlags flags);
@@ -215,6 +232,9 @@ private:
         NoContentsLayer = 0,
         ContentsLayerForImage,
         ContentsLayerForVideo
+#if ENABLE(3D_CANVAS)
+        ,ContentsLayerForGraphicsLayer3D
+#endif
     };
     
     ContentsLayerPurpose m_contentsLayerPurpose;
@@ -260,6 +280,11 @@ private:
     Vector<FloatRect> m_dirtyRects;
     
     LayerChangeFlags m_uncommittedChanges;
+    
+#if ENABLE(3D_CANVAS)
+    PlatformGraphicsContext3D m_platformGraphicsContext3D;
+    Platform3DObject m_platformTexture;
+#endif
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
index e5b9035..e9960f1 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
@@ -31,6 +31,9 @@
 
 #import "Animation.h"
 #import "BlockExceptions.h"
+#if ENABLE(3D_CANVAS)
+#import "Canvas3DLayer.h"
+#endif
 #import "CString.h"
 #import "FloatConversion.h"
 #import "FloatRect.h"
@@ -145,11 +148,11 @@ static NSValue* getTransformFunctionValue(const TransformOperation* transformOp,
         case TransformOperation::ROTATE_Y:
             return [NSNumber numberWithDouble:transformOp ? deg2rad(static_cast<const RotateTransformOperation*>(transformOp)->angle()) : 0];
         case TransformOperation::SCALE_X:
-            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->x() : 0];
+            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->x() : 1];
         case TransformOperation::SCALE_Y:
-            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->y() : 0];
+            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->y() : 1];
         case TransformOperation::SCALE_Z:
-            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->z() : 0];
+            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->z() : 1];
         case TransformOperation::TRANSLATE_X:
             return [NSNumber numberWithDouble:transformOp ? static_cast<const TranslateTransformOperation*>(transformOp)->x(size) : 0];
         case TransformOperation::TRANSLATE_Y:
@@ -157,13 +160,23 @@ static NSValue* getTransformFunctionValue(const TransformOperation* transformOp,
         case TransformOperation::TRANSLATE_Z:
             return [NSNumber numberWithDouble:transformOp ? static_cast<const TranslateTransformOperation*>(transformOp)->z(size) : 0];
         case TransformOperation::SCALE:
+        case TransformOperation::SCALE_3D:
+            return [NSArray arrayWithObjects:
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->x() : 1],
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->y() : 1],
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->z() : 1],
+                        nil];
         case TransformOperation::TRANSLATE:
+        case TransformOperation::TRANSLATE_3D:
+            return [NSArray arrayWithObjects:
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const TranslateTransformOperation*>(transformOp)->x(size) : 0],
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const TranslateTransformOperation*>(transformOp)->y(size) : 0],
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const TranslateTransformOperation*>(transformOp)->z(size) : 0],
+                        nil];
         case TransformOperation::SKEW_X:
         case TransformOperation::SKEW_Y:
         case TransformOperation::SKEW:
         case TransformOperation::MATRIX:
-        case TransformOperation::SCALE_3D:
-        case TransformOperation::TRANSLATE_3D:
         case TransformOperation::ROTATE_3D:
         case TransformOperation::MATRIX_3D:
         case TransformOperation::PERSPECTIVE:
@@ -204,6 +217,12 @@ static NSString* getValueFunctionNameForTransformOperation(TransformOperation::O
             return @"translateY"; // kCAValueFunctionTranslateY;
         case TransformOperation::TRANSLATE_Z:
             return @"translateZ"; // kCAValueFunctionTranslateZ;
+        case TransformOperation::SCALE:
+        case TransformOperation::SCALE_3D:
+            return @"scale"; // kCAValueFunctionScale;
+        case TransformOperation::TRANSLATE:
+        case TransformOperation::TRANSLATE_3D:
+            return @"translate"; // kCAValueFunctionTranslate;
         default:
             return nil;
     }
@@ -331,7 +350,7 @@ static NSDictionary* nullActionsDictionary()
     return actions;
 }
 
-GraphicsLayer* GraphicsLayer::createGraphicsLayer(GraphicsLayerClient* client)
+PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
 {
     return new GraphicsLayerCA(client);
 }
@@ -341,6 +360,10 @@ GraphicsLayerCA::GraphicsLayerCA(GraphicsLayerClient* client)
 , m_contentsLayerPurpose(NoContentsLayer)
 , m_contentsLayerHasBackgroundColor(false)
 , m_uncommittedChanges(NoChange)
+#if ENABLE(3D_CANVAS)
+, m_platformGraphicsContext3D(NullPlatformGraphicsContext3D)
+, m_platformTexture(NullPlatform3DObject)
+#endif
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS
     m_layer.adoptNS([[WebLayer alloc] init]);
@@ -432,6 +455,15 @@ void GraphicsLayerCA::removeFromParent()
     GraphicsLayer::removeFromParent();
 }
 
+void GraphicsLayerCA::setMaskLayer(GraphicsLayer* layer)
+{
+    if (layer == m_maskLayer)
+        return;
+
+    GraphicsLayer::setMaskLayer(layer);
+    noteLayerPropertyChanged(MaskLayerChanged);
+}
+
 void GraphicsLayerCA::setPosition(const FloatPoint& point)
 {
     if (point == m_position)
@@ -672,10 +704,10 @@ void GraphicsLayerCA::setContentsToImage(Image* image)
         CGColorSpaceRef colorSpace = CGImageGetColorSpace(m_pendingContentsImage.get());
 
         static CGColorSpaceRef deviceRGB = CGColorSpaceCreateDeviceRGB();
-        if (CFEqual(colorSpace, deviceRGB)) {
-            // CoreGraphics renders images tagged with DeviceRGB using GenericRGB. When we hand such
+        if (colorSpace && CFEqual(colorSpace, deviceRGB)) {
+            // CoreGraphics renders images tagged with DeviceRGB using the color space of the main display. When we hand such
             // images to CA we need to tag them similarly so CA rendering matches CG rendering.
-            static CGColorSpaceRef genericRGB = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGB);
+            static CGColorSpaceRef genericRGB = CGDisplayCopyColorSpace(kCGDirectMainDisplay);
             m_pendingContentsImage.adoptCF(CGImageCreateCopyWithColorSpace(m_pendingContentsImage.get(), genericRGB));
         }
         m_contentsLayerPurpose = ContentsLayerForImage;
@@ -733,6 +765,9 @@ void GraphicsLayerCA::recursiveCommitChanges()
 {
     commitLayerChanges();
 
+    if (m_maskLayer)
+        static_cast<GraphicsLayerCA*>(m_maskLayer)->commitLayerChanges();
+
     const Vector<GraphicsLayer*>& childLayers = children();
     size_t numChildren = childLayers.size();
     for (size_t i = 0; i < numChildren; ++i) {
@@ -763,7 +798,12 @@ void GraphicsLayerCA::commitLayerChanges()
         
     if (m_uncommittedChanges & ContentsVideoChanged) // Needs to happen before ChildrenChanged
         updateContentsVideo();
-
+    
+#if ENABLE(3D_CANVAS)
+    if (m_uncommittedChanges & ContentsGraphicsContext3DChanged) // Needs to happen before ChildrenChanged
+        updateContentsGraphicsContext3D();
+#endif
+    
     if (m_uncommittedChanges & BackgroundColorChanged)  // Needs to happen before ChildrenChanged, and after updating image or video
         updateLayerBackgroundColor();
 
@@ -812,6 +852,9 @@ void GraphicsLayerCA::commitLayerChanges()
     if (m_uncommittedChanges & GeometryOrientationChanged)
         updateGeometryOrientation();
 
+    if (m_uncommittedChanges & MaskLayerChanged)
+        updateMaskLayer();
+
     m_uncommittedChanges = NoChange;
     END_BLOCK_OBJC_EXCEPTIONS
 }
@@ -821,10 +864,12 @@ void GraphicsLayerCA::updateSublayerList()
     NSMutableArray* newSublayers = nil;
 
     if (m_transformLayer) {
-        // FIXME: add the primary layer in the correct order with negative z-order children.
+        // Add the primary layer first. Even if we have negative z-order children, the primary layer always comes behind.
         newSublayers = [[NSMutableArray alloc] initWithObjects:m_layer.get(), nil];
     } else if (m_contentsLayer) {
         // FIXME: add the contents layer in the correct order with negative z-order children.
+        // This does not cause visible rendering issues because currently contents layers are only used
+        // for replaced elements that don't have children.
         newSublayers = [[NSMutableArray alloc] initWithObjects:m_contentsLayer.get(), nil];
     }
     
@@ -1061,6 +1106,18 @@ void GraphicsLayerCA::updateContentsVideo()
     }
 }
 
+#if ENABLE(3D_CANVAS)
+void GraphicsLayerCA::updateContentsGraphicsContext3D()
+{
+    // Canvas3D layer was set as m_contentsLayer, and will get parented in updateSublayerList().
+    if (m_contentsLayer) {
+        setupContentsLayer(m_contentsLayer.get());
+        [m_contentsLayer.get() setNeedsDisplay];
+        updateContentsRect();
+    }
+}
+#endif
+    
 void GraphicsLayerCA::updateContentsRect()
 {
     if (!m_contentsLayer)
@@ -1094,6 +1151,12 @@ void GraphicsLayerCA::updateGeometryOrientation()
 #endif
 }
 
+void GraphicsLayerCA::updateMaskLayer()
+{
+    CALayer* maskCALayer = m_maskLayer ? m_maskLayer->platformLayer() : 0;
+    [m_layer.get() setMask:maskCALayer];
+}
+
 void GraphicsLayerCA::updateLayerAnimations()
 {
     if (m_transitionPropertiesToRemove.size()) {
@@ -1247,6 +1310,40 @@ void GraphicsLayerCA::pauseAnimationOnLayer(AnimatedPropertyID property, int ind
     [layer addAnimation:pausedAnim forKey:animationName];  // This will replace the running animation.
 }
 
+#if ENABLE(3D_CANVAS)
+void GraphicsLayerCA::setContentsToGraphicsContext3D(const GraphicsContext3D* graphicsContext3D)
+{
+    PlatformGraphicsContext3D context = graphicsContext3D->platformGraphicsContext3D();
+    Platform3DObject texture = graphicsContext3D->platformTexture();
+    
+    if (context == m_platformGraphicsContext3D && texture == m_platformTexture)
+        return;
+        
+    m_platformGraphicsContext3D = context;
+    m_platformTexture = texture;
+    
+    noteLayerPropertyChanged(ChildrenChanged);
+    
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+
+    if (m_platformGraphicsContext3D != NullPlatformGraphicsContext3D && m_platformTexture != NullPlatform3DObject) {
+        // create the inner 3d layer
+        m_contentsLayer.adoptNS([[Canvas3DLayer alloc] initWithContext:static_cast<CGLContextObj>(m_platformGraphicsContext3D) texture:static_cast<GLuint>(m_platformTexture)]);
+#ifndef NDEBUG
+        [m_contentsLayer.get() setName:@"3D Layer"];
+#endif        
+    } else {
+        // remove the inner layer
+        m_contentsLayer = 0;
+    }
+    
+    END_BLOCK_OBJC_EXCEPTIONS
+    
+    noteLayerPropertyChanged(ContentsGraphicsContext3DChanged);
+    m_contentsLayerPurpose = m_contentsLayer ? ContentsLayerForGraphicsLayer3D : NoContentsLayer;
+}
+#endif
+    
 void GraphicsLayerCA::repaintLayerDirtyRects()
 {
     if (!m_dirtyRects.size())
@@ -1765,6 +1862,14 @@ void GraphicsLayerCA::noteLayerPropertyChanged(LayerChangeFlags flags)
     m_uncommittedChanges |= flags;
 }
 
+#if ENABLE(3D_CANVAS)
+void GraphicsLayerCA::setGraphicsContext3DNeedsDisplay()
+{
+    if (m_contentsLayerPurpose == ContentsLayerForGraphicsLayer3D)
+        [m_contentsLayer.get() setNeedsDisplay];
+}
+#endif
+    
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/mac/ImageMac.mm b/WebCore/platform/graphics/mac/ImageMac.mm
index a0d257b..672c3c8 100644
--- a/WebCore/platform/graphics/mac/ImageMac.mm
+++ b/WebCore/platform/graphics/mac/ImageMac.mm
@@ -94,16 +94,15 @@ CFDataRef BitmapImage::getTIFFRepresentation()
     
     RetainPtr<CFMutableDataRef> data(AdoptCF, CFDataCreateMutable(0, 0));
     // FIXME:  Use type kCGImageTypeIdentifierTIFF constant once is becomes available in the API
-    CGImageDestinationRef destination = CGImageDestinationCreateWithData(data.get(), CFSTR("public.tiff"), numValidFrames, 0);
-    
+    RetainPtr<CGImageDestinationRef> destination(AdoptCF, CGImageDestinationCreateWithData(data.get(), CFSTR("public.tiff"), numValidFrames, 0));
+
     if (!destination)
         return 0;
     
     for (unsigned i = 0; i < numValidFrames; ++i)
-        CGImageDestinationAddImage(destination, images[i], 0);
+        CGImageDestinationAddImage(destination.get(), images[i], 0);
 
-    CGImageDestinationFinalize(destination);
-    CFRelease(destination);
+    CGImageDestinationFinalize(destination.get());
 
     m_tiffRep = data;
     return m_tiffRep.get();
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
index 54eea00..0a63626 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
@@ -77,8 +77,12 @@ private:
     static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
     static bool isAvailable();
 
+    PlatformMedia platformMedia() const;
+
     IntSize naturalSize() const;
     bool hasVideo() const;
+    bool hasAudio() const;
+    bool supportsFullscreen() const;
     
     void load(const String& url);
     void cancelLoad();
@@ -104,7 +108,7 @@ private:
     MediaPlayer::NetworkState networkState() const { return m_networkState; }
     MediaPlayer::ReadyState readyState() const { return m_readyState; }
     
-    float maxTimeBuffered() const;
+    PassRefPtr<TimeRanges> buffered() const;
     float maxTimeSeekable() const;
     unsigned bytesLoaded() const;
     bool totalBytesKnown() const;
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
index c1d7fcb..30d0c82 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
@@ -39,6 +39,7 @@
 #import "KURL.h"
 #import "MIMETypeRegistry.h"
 #import "SoftLinking.h"
+#import "TimeRanges.h"
 #import "WebCoreSystemInterface.h"
 #import <QTKit/QTKit.h>
 #import <objc/objc-runtime.h>
@@ -84,6 +85,7 @@ SOFT_LINK_POINTER(QTKit, QTMovieAskUnresolvedDataRefsAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieDataSizeAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieDidEndNotification, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieHasVideoAttribute, NSString *)
+SOFT_LINK_POINTER(QTKit, QTMovieHasAudioAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieIsActiveAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieLoadStateAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieLoadStateDidChangeNotification, NSString *)
@@ -119,6 +121,7 @@ SOFT_LINK_POINTER(QTKit, QTMovieApertureModeAttribute, NSString *)
 #define QTMovieDataSizeAttribute getQTMovieDataSizeAttribute()
 #define QTMovieDidEndNotification getQTMovieDidEndNotification()
 #define QTMovieHasVideoAttribute getQTMovieHasVideoAttribute()
+#define QTMovieHasAudioAttribute getQTMovieHasAudioAttribute()
 #define QTMovieIsActiveAttribute getQTMovieIsActiveAttribute()
 #define QTMovieLoadStateAttribute getQTMovieLoadStateAttribute()
 #define QTMovieLoadStateDidChangeNotification getQTMovieLoadStateDidChangeNotification()
@@ -230,7 +233,7 @@ MediaPlayerPrivate::~MediaPlayerPrivate()
 
 void MediaPlayerPrivate::createQTMovie(const String& url)
 {
-    NSURL *cocoaURL = KURL(url);
+    NSURL *cocoaURL = KURL(ParsedURLString, url);
     NSDictionary *movieAttributes = [NSDictionary dictionaryWithObjectsAndKeys:
                        cocoaURL, QTMovieURLAttribute,
                        [NSNumber numberWithBool:m_player->preservesPitch()], QTMovieRateChangesPreservePitchAttribute,
@@ -562,6 +565,12 @@ void MediaPlayerPrivate::load(const String& url)
     [m_objcObserver.get() setDelayCallbacks:NO];
 }
 
+PlatformMedia MediaPlayerPrivate::platformMedia() const
+{
+    PlatformMedia plaftformMedia = { m_qtMovie.get() };
+    return plaftformMedia;
+}
+
 void MediaPlayerPrivate::play()
 {
     if (!metaDataAvailable())
@@ -719,18 +728,28 @@ bool MediaPlayerPrivate::hasVideo() const
     return [[m_qtMovie.get() attributeForKey:QTMovieHasVideoAttribute] boolValue];
 }
 
+bool MediaPlayerPrivate::hasAudio() const
+{
+    if (!m_qtMovie)
+        return false;
+    return [[m_qtMovie.get() attributeForKey:QTMovieHasAudioAttribute] boolValue];
+}
+
+bool MediaPlayerPrivate::supportsFullscreen() const
+{   
+    return true;
+}
+
 void MediaPlayerPrivate::setVolume(float volume)
 {
-    if (!metaDataAvailable())
-        return;
-    [m_qtMovie.get() setVolume:volume];  
+    if (m_qtMovie)
+        [m_qtMovie.get() setVolume:volume];  
 }
 
 void MediaPlayerPrivate::setRate(float rate)
 {
-    if (!metaDataAvailable())
-        return;
-    [m_qtMovie.get() setRate:rate];
+    if (m_qtMovie)
+        [m_qtMovie.get() setRate:rate];
 }
 
 void MediaPlayerPrivate::setPreservesPitch(bool preservesPitch)
@@ -758,10 +777,13 @@ int MediaPlayerPrivate::dataRate() const
     return wkQTMovieDataRate(m_qtMovie.get()); 
 }
 
-
-float MediaPlayerPrivate::maxTimeBuffered() const
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 {
-    return maxTimeLoaded();
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+    float loaded = maxTimeLoaded();
+    if (loaded > 0)
+        timeRanges->add(0, loaded);
+    return timeRanges.release();
 }
 
 float MediaPlayerPrivate::maxTimeSeekable() const
diff --git a/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index cdde7cf..97a7251 100644
--- a/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -50,6 +50,8 @@
 - (BOOL)_isFakeFixedPitch;
 @end
 
+using namespace std;
+
 namespace WebCore {
   
 const float smallCapsFontSizeMultiplier = 0.7f;
@@ -269,7 +271,7 @@ void SimpleFontData::platformInit()
         // and web pages that foolishly use this metric for width will be laid out
         // poorly if we return an accurate height. Classic case is Times 13 point,
         // which has an "x" that is 7x6 pixels.
-        m_xHeight = MAX(NSMaxX(xBox), NSMaxY(xBox));
+        m_xHeight = max(NSMaxX(xBox), NSMaxY(xBox));
     } else
         m_xHeight = [m_platformData.font() xHeight];
 }
@@ -443,13 +445,13 @@ CTFontRef SimpleFontData::getCTFont() const
     return m_CTFont.get();
 }
 
-CFDictionaryRef SimpleFontData::getCFStringAttributes() const
+CFDictionaryRef SimpleFontData::getCFStringAttributes(TextRenderingMode textMode) const
 {
     if (m_CFStringAttributes)
         return m_CFStringAttributes.get();
 
-    static const float kerningAdjustmentValue = 0;
-    static CFNumberRef kerningAdjustment = CFNumberCreate(kCFAllocatorDefault, kCFNumberFloatType, &kerningAdjustmentValue);
+    bool allowKerning = textMode == OptimizeLegibility || textMode == GeometricPrecision;
+    bool allowLigatures = platformData().allowsLigatures() || allowKerning;
 
     static const int ligaturesNotAllowedValue = 0;
     static CFNumberRef ligaturesNotAllowed = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &ligaturesNotAllowedValue);
@@ -457,10 +459,23 @@ CFDictionaryRef SimpleFontData::getCFStringAttributes() const
     static const int ligaturesAllowedValue = 1;
     static CFNumberRef ligaturesAllowed = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &ligaturesAllowedValue);
 
-    static const void* attributeKeys[] = { kCTFontAttributeName, kCTKernAttributeName, kCTLigatureAttributeName };
-    const void* attributeValues[] = { getCTFont(), kerningAdjustment, platformData().allowsLigatures() ? ligaturesAllowed : ligaturesNotAllowed };
-
-    m_CFStringAttributes.adoptCF(CFDictionaryCreate(NULL, attributeKeys, attributeValues, sizeof(attributeKeys) / sizeof(*attributeKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+    if (!allowKerning) {
+        static const float kerningAdjustmentValue = 0;
+        static CFNumberRef kerningAdjustment = CFNumberCreate(kCFAllocatorDefault, kCFNumberFloatType, &kerningAdjustmentValue);
+        static const void* keysWithKerningDisabled[] = { kCTFontAttributeName, kCTKernAttributeName, kCTLigatureAttributeName };
+        const void* valuesWithKerningDisabled[] = { getCTFont(), kerningAdjustment, allowLigatures
+            ? ligaturesAllowed : ligaturesNotAllowed };
+        m_CFStringAttributes.adoptCF(CFDictionaryCreate(NULL, keysWithKerningDisabled, valuesWithKerningDisabled,
+            sizeof(keysWithKerningDisabled) / sizeof(*keysWithKerningDisabled),
+            &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+    } else {
+        // By omitting the kCTKernAttributeName attribute, we get Core Text's standard kerning.
+        static const void* keysWithKerningEnabled[] = { kCTFontAttributeName, kCTLigatureAttributeName };
+        const void* valuesWithKerningEnabled[] = { getCTFont(), allowLigatures ? ligaturesAllowed : ligaturesNotAllowed };
+        m_CFStringAttributes.adoptCF(CFDictionaryCreate(NULL, keysWithKerningEnabled, valuesWithKerningEnabled,
+            sizeof(keysWithKerningEnabled) / sizeof(*keysWithKerningEnabled),
+            &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+    }
 
     return m_CFStringAttributes.get();
 }
diff --git a/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp b/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
index 895887f..b2e3d92 100644
--- a/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
+++ b/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -339,7 +340,10 @@ bool getEOTHeader(SharedBuffer* fontData, EOTHeader& eotHeader, size_t& overlayD
     return true;
 }
 
-HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
+// code shared by renameFont and renameAndActivateFont
+// adds fontName to the font table in fontData, and writes the new font table to rewrittenFontTable
+// returns the size of the name table (which is used by renameAndActivateFont), or 0 on early abort
+static size_t renameFontInternal(SharedBuffer* fontData, const String& fontName, Vector<char> &rewrittenFontData)
 {
     size_t originalDataSize = fontData->size();
     const sfntHeader* sfnt = reinterpret_cast<const sfntHeader*>(fontData->data());
@@ -357,7 +361,7 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
     // Rounded up to a multiple of 4 to simplify the checksum calculation.
     size_t nameTableSize = ((offsetof(nameTable, nameRecords) + nameRecordCount * sizeof(nameRecord) + fontName.length() * sizeof(UChar)) & ~3) + 4;
 
-    Vector<char> rewrittenFontData(fontData->size() + nameTableSize);
+    rewrittenFontData.resize(fontData->size() + nameTableSize);
     char* data = rewrittenFontData.data();
     memcpy(data, fontData->data(), originalDataSize);
 
@@ -394,8 +398,42 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
     for (unsigned i = 0; i * sizeof(BigEndianULong) < nameTableSize; ++i)
         rewrittenSfnt->tables[t].checkSum = rewrittenSfnt->tables[t].checkSum + reinterpret_cast<BigEndianULong*>(name)[i];
 
+    return nameTableSize;
+}
+
+#if PLATFORM(WINCE)
+// AddFontMemResourceEx does not exist on WinCE, so we must handle the font data manually
+// This function just renames the font and overwrites the old font data with the new
+bool renameFont(SharedBuffer* fontData, const String& fontName)
+{
+    // abort if the data is too small to be a font header with a "tables" entry
+    if (fontData->size() < offsetof(sfntHeader, tables))
+        return false;
+
+    // abort if the data is too small to hold all the tables specified in the header
+    const sfntHeader* header = reinterpret_cast<const sfntHeader*>(fontData->data());
+    if (fontData->size() < offsetof(sfntHeader, tables) + header->numTables * sizeof(TableDirectoryEntry))
+        return false;
+
+    Vector<char> rewrittenFontData;
+    if (!renameFontInternal(fontData, fontName, rewrittenFontData))
+        return false;
+
+    fontData->clear();
+    fontData->append(rewrittenFontData.data(), rewrittenFontData.size());
+    return true;
+}
+#else
+// Rename the font and install the new font data into the system
+HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
+{
+    Vector<char> rewrittenFontData;
+    size_t nameTableSize = renameFontInternal(fontData, fontName, rewrittenFontData);
+    if (!nameTableSize)
+        return 0;
+
     DWORD numFonts = 0;
-    HANDLE fontHandle = AddFontMemResourceEx(data, originalDataSize + nameTableSize, 0, &numFonts);
+    HANDLE fontHandle = AddFontMemResourceEx(rewrittenFontData.data(), fontData->size() + nameTableSize, 0, &numFonts);
 
     if (fontHandle && numFonts != 1) {
         RemoveFontMemResourceEx(fontHandle);
@@ -404,5 +442,6 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
 
     return fontHandle;
 }
+#endif
 
 }
diff --git a/WebCore/platform/graphics/opentype/OpenTypeUtilities.h b/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
index 13dad6f..4c75314 100644
--- a/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
+++ b/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +36,10 @@ struct BigEndianUShort;
 struct EOTPrefix;
 class SharedBuffer;
 
+#if PLATFORM(WINCE)
+typedef unsigned __int8 UInt8;
+#endif
+
 struct EOTHeader {
     EOTHeader();
 
diff --git a/WebCore/platform/graphics/qt/ColorQt.cpp b/WebCore/platform/graphics/qt/ColorQt.cpp
index 5d16740..151766a 100644
--- a/WebCore/platform/graphics/qt/ColorQt.cpp
+++ b/WebCore/platform/graphics/qt/ColorQt.cpp
@@ -40,7 +40,10 @@ Color::Color(const QColor& c)
 
 Color::operator QColor() const
 {
-    return QColor(red(), green(), blue(), alpha());
+    if (m_valid)
+        return QColor(red(), green(), blue(), alpha());
+    else
+        return QColor();
 }
 
 }
diff --git a/WebCore/platform/graphics/qt/FontCacheQt.cpp b/WebCore/platform/graphics/qt/FontCacheQt.cpp
index 5d29389..1113eae 100644
--- a/WebCore/platform/graphics/qt/FontCacheQt.cpp
+++ b/WebCore/platform/graphics/qt/FontCacheQt.cpp
@@ -48,7 +48,7 @@ FontCache::FontCache()
 {
 }
 
-void FontCache::getTraitsInFamily(const AtomicString& familyName, Vector<unsigned>& traitsMasks)
+void FontCache::getTraitsInFamily(const AtomicString&, Vector<unsigned>&)
 {
 }
 
@@ -58,8 +58,8 @@ class FontPlatformDataCacheKey {
 public:
     FontPlatformDataCacheKey(const FontDescription& description)
         : m_familyName()
-        , m_bold(false)
         , m_size(description.computedPixelSize())
+        , m_bold(false)
         , m_italic(description.italic())
         , m_smallCaps(description.smallCaps())
         , m_hash(0)
@@ -177,7 +177,7 @@ typedef HashMap<FontPlatformDataCacheKey, FontPlatformData*, FontPlatformDataCac
 // using Q_GLOBAL_STATIC leads to crash. TODO investigate the way to fix this.
 static FontPlatformDataCache* gFontPlatformDataCache = 0;
 
-FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& description, const AtomicString& family, bool checkingAlternateName)
+FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& description, const AtomicString&, bool)
 {
     if (!gFontPlatformDataCache)
         gFontPlatformDataCache = new FontPlatformDataCache;
diff --git a/WebCore/platform/graphics/qt/FontFallbackListQt.cpp b/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
index c29fd56..8e1e4f6 100644
--- a/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
+++ b/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
@@ -130,7 +130,7 @@ const FontData* FontFallbackList::fontDataForCharacters(const WebCore::Font* fon
     return primaryFontData(font);
 }
 
-void FontFallbackList::setPlatformFont(const WebCore::FontPlatformData& platformData)
+void FontFallbackList::setPlatformFont(const WebCore::FontPlatformData&)
 {
     m_familyIndex = cAllFamiliesScanned;
 }
diff --git a/WebCore/platform/graphics/qt/FontQt.cpp b/WebCore/platform/graphics/qt/FontQt.cpp
index e8eb923..c5960ac 100644
--- a/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/WebCore/platform/graphics/qt/FontQt.cpp
@@ -197,7 +197,7 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
     return w + run.padding();
 }
 
-int Font::offsetForPositionForComplexText(const TextRun& run, int position, bool includePartialGlyphs) const
+int Font::offsetForPositionForComplexText(const TextRun& run, int position, bool) const
 {
     const QString string = fixSpacing(qstring(run));
     QTextLayout layout(string, font());
diff --git a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index e259a4e..fa7b070 100644
--- a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -34,29 +34,29 @@
  */
 
 #include "config.h"
+#include "GraphicsContext.h"
 
 #ifdef Q_WS_WIN
 #include <windows.h>
 #endif
 
-#include "TransformationMatrix.h"
 #include "Color.h"
 #include "FloatConversion.h"
 #include "Font.h"
-#include "GraphicsContext.h"
 #include "GraphicsContextPrivate.h"
 #include "ImageBuffer.h"
+#include "NotImplemented.h"
 #include "Path.h"
 #include "Pattern.h"
 #include "Pen.h"
-#include "NotImplemented.h"
+#include "TransformationMatrix.h"
 
 #include <QBrush>
 #include <QDebug>
 #include <QGradient>
-#include <QPainter>
 #include <QPaintDevice>
 #include <QPaintEngine>
+#include <QPainter>
 #include <QPainterPath>
 #include <QPixmap>
 #include <QPolygonF>
@@ -72,35 +72,35 @@ namespace WebCore {
 static inline QPainter::CompositionMode toQtCompositionMode(CompositeOperator op)
 {
     switch (op) {
-        case CompositeClear:
-            return QPainter::CompositionMode_Clear;
-        case CompositeCopy:
-            return QPainter::CompositionMode_Source;
-        case CompositeSourceOver:
-            return QPainter::CompositionMode_SourceOver;
-        case CompositeSourceIn:
-            return QPainter::CompositionMode_SourceIn;
-        case CompositeSourceOut:
-            return QPainter::CompositionMode_SourceOut;
-        case CompositeSourceAtop:
-            return QPainter::CompositionMode_SourceAtop;
-        case CompositeDestinationOver:
-            return QPainter::CompositionMode_DestinationOver;
-        case CompositeDestinationIn:
-            return QPainter::CompositionMode_DestinationIn;
-        case CompositeDestinationOut:
-            return QPainter::CompositionMode_DestinationOut;
-        case CompositeDestinationAtop:
-            return QPainter::CompositionMode_DestinationAtop;
-        case CompositeXOR:
-            return QPainter::CompositionMode_Xor;
-        case CompositePlusDarker:
-            // there is no exact match, but this is the closest
-            return QPainter::CompositionMode_Darken;
-        case CompositeHighlight:
-            return QPainter::CompositionMode_SourceOver;
-        case CompositePlusLighter:
-            return QPainter::CompositionMode_Plus;
+    case CompositeClear:
+        return QPainter::CompositionMode_Clear;
+    case CompositeCopy:
+        return QPainter::CompositionMode_Source;
+    case CompositeSourceOver:
+        return QPainter::CompositionMode_SourceOver;
+    case CompositeSourceIn:
+        return QPainter::CompositionMode_SourceIn;
+    case CompositeSourceOut:
+        return QPainter::CompositionMode_SourceOut;
+    case CompositeSourceAtop:
+        return QPainter::CompositionMode_SourceAtop;
+    case CompositeDestinationOver:
+        return QPainter::CompositionMode_DestinationOver;
+    case CompositeDestinationIn:
+        return QPainter::CompositionMode_DestinationIn;
+    case CompositeDestinationOut:
+        return QPainter::CompositionMode_DestinationOut;
+    case CompositeDestinationAtop:
+        return QPainter::CompositionMode_DestinationAtop;
+    case CompositeXOR:
+        return QPainter::CompositionMode_Xor;
+    case CompositePlusDarker:
+        // there is no exact match, but this is the closest
+        return QPainter::CompositionMode_Darken;
+    case CompositeHighlight:
+        return QPainter::CompositionMode_SourceOver;
+    case CompositePlusLighter:
+        return QPainter::CompositionMode_Plus;
     }
 
     return QPainter::CompositionMode_SourceOver;
@@ -109,12 +109,12 @@ static inline QPainter::CompositionMode toQtCompositionMode(CompositeOperator op
 static inline Qt::PenCapStyle toQtLineCap(LineCap lc)
 {
     switch (lc) {
-        case ButtCap:
-            return Qt::FlatCap;
-        case RoundCap:
-            return Qt::RoundCap;
-        case SquareCap:
-            return Qt::SquareCap;
+    case ButtCap:
+        return Qt::FlatCap;
+    case RoundCap:
+        return Qt::RoundCap;
+    case SquareCap:
+        return Qt::SquareCap;
     }
 
     return Qt::FlatCap;
@@ -123,12 +123,12 @@ static inline Qt::PenCapStyle toQtLineCap(LineCap lc)
 static inline Qt::PenJoinStyle toQtLineJoin(LineJoin lj)
 {
     switch (lj) {
-        case MiterJoin:
-            return Qt::SvgMiterJoin;
-        case RoundJoin:
-            return Qt::RoundJoin;
-        case BevelJoin:
-            return Qt::BevelJoin;
+    case MiterJoin:
+        return Qt::SvgMiterJoin;
+    case RoundJoin:
+        return Qt::RoundJoin;
+    case BevelJoin:
+        return Qt::BevelJoin;
     }
 
     return Qt::MiterJoin;
@@ -210,8 +210,8 @@ public:
                 return redirect;
 
             return painter;
-        } else
-            return &layers.top()->painter;
+        }
+        return &layers.top()->painter;
     }
 
     bool antiAliasingForRectsAndLines;
@@ -411,46 +411,25 @@ void GraphicsContext::drawRect(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
 
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+        IntRect shadowRect = rect;
+        shadowRect.move(shadowSize.width(), shadowSize.height());
+        shadowRect.inflate(static_cast<int>(p->pen().widthF()));
+        p->fillRect(shadowRect, QColor(shadowColor));
+    }
+
     p->drawRect(rect);
 
     p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
 
-// FIXME: Now that this is refactored, it should be shared by all contexts.
-static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth,
-                                        const StrokeStyle& penStyle)
-{
-    // For odd widths, we add in 0.5 to the appropriate x/y so that the float arithmetic
-    // works out.  For example, with a border width of 3, KHTML will pass us (y1+y2)/2, e.g.,
-    // (50+53)/2 = 103/2 = 51 when we want 51.5.  It is always true that an even width gave
-    // us a perfect position, but an odd width gave us a position that is off by exactly 0.5.
-    if (penStyle == DottedStroke || penStyle == DashedStroke) {
-        if (p1.x() == p2.x()) {
-            p1.setY(p1.y() + strokeWidth);
-            p2.setY(p2.y() - strokeWidth);
-        } else {
-            p1.setX(p1.x() + strokeWidth);
-            p2.setX(p2.x() - strokeWidth);
-        }
-    }
-
-    if (((int) strokeWidth) % 2) {
-        if (p1.x() == p2.x()) {
-            // We're a vertical line.  Adjust our x.
-            p1.setX(p1.x() + 0.5);
-            p2.setX(p2.x() + 0.5);
-        } else {
-            // We're a horizontal line. Adjust our y.
-            p1.setY(p1.y() + 0.5);
-            p2.setY(p2.y() + 0.5);
-        }
-    }
-}
-
 // This is only used to draw borders.
 void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
 {
@@ -468,7 +447,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     FloatPoint p2 = point2;
     bool isVerticalLine = (p1.x() == p2.x());
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
     adjustLineToPixelBoundaries(p1, p2, width, style);
@@ -479,22 +458,22 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     if (textDrawingMode() == cTextFill && getShadow(shadowSize, shadowBlur, shadowColor)) {
         p->save();
         p->translate(shadowSize.width(), shadowSize.height());
-        p->setPen(QColor(shadowColor));
+        p->setPen(shadowColor);
         p->drawLine(p1, p2);
         p->restore();
     }
 
     int patWidth = 0;
     switch (style) {
-        case NoStroke:
-        case SolidStroke:
-            break;
-        case DottedStroke:
-            patWidth = (int)width;
-            break;
-        case DashedStroke:
-            patWidth = 3 * (int)width;
-            break;
+    case NoStroke:
+    case SolidStroke:
+        break;
+    case DottedStroke:
+        patWidth = static_cast<int>(width);
+        break;
+    case DashedStroke:
+        patWidth = 3 * static_cast<int>(width);
+        break;
     }
 
     if (patWidth) {
@@ -523,7 +502,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         if (patWidth == 1)
             patternOffset = 1.0f;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -571,11 +550,25 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
     if (paintingDisabled() || strokeStyle() == NoStroke || strokeThickness() <= 0.0f || !strokeColor().alpha())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, true);
 
-    p->drawArc(rect, startAngle * 16, angleSpan * 16);
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    startAngle *= 16;
+    angleSpan *= 16;
+    if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+        p->save();
+        p->translate(shadowSize.width(), shadowSize.height());
+        QPen pen(p->pen());
+        pen.setColor(shadowColor);
+        p->setPen(pen);
+        p->drawArc(rect, startAngle, angleSpan);
+        p->restore();
+    }
+    p->drawArc(rect, startAngle, angleSpan);
 
     p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
@@ -593,9 +586,25 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     for (size_t i = 0; i < npoints; i++)
         polygon[i] = points[i];
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     p->save();
     p->setRenderHint(QPainter::Antialiasing, shouldAntialias);
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+        p->save();
+        p->translate(shadowSize.width(), shadowSize.height());
+        if (p->brush().style() != Qt::NoBrush)
+            p->setBrush(QBrush(shadowColor));
+        QPen pen(p->pen());
+        if (pen.style() != Qt::NoPen) {
+            pen.setColor(shadowColor);
+            p->setPen(pen);
+        }
+        p->drawConvexPolygon(polygon);
+        p->restore();
+    }
     p->drawConvexPolygon(polygon);
     p->restore();
 }
@@ -605,34 +614,50 @@ QPen GraphicsContext::pen()
     if (paintingDisabled())
         return QPen();
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     return p->pen();
 }
 
+static void inline drawFilledShadowPath(GraphicsContext* context, QPainter* p, const QPainterPath *path)
+{
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
+        p->translate(shadowSize.width(), shadowSize.height());
+        p->fillPath(*path, QBrush(shadowColor));
+        p->translate(-shadowSize.width(), -shadowSize.height());
+    }
+}
+
 void GraphicsContext::fillPath()
 {
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        if (fillColor().alpha())
-            p->fillPath(path, p->brush());
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        p->fillPath(path, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-        break;
-    }
-    case GradientColorSpace:
-        QBrush brush(*m_common->state.fillGradient->platformGradient());
-        brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
-        p->fillPath(path, brush);
-        break;
+    if ((m_common->state.fillColorSpace != SolidColorSpace)
+            || (fillColor().alpha())) {
+        drawFilledShadowPath(this, p, &path);
+        switch (m_common->state.fillColorSpace) {
+        case SolidColorSpace:
+            if (fillColor().alpha())
+                p->fillPath(path, p->brush());
+            break;
+        case PatternColorSpace: {
+            TransformationMatrix affine;
+            p->fillPath(path, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
+            break;
+        }
+        case GradientColorSpace:
+            QBrush brush(*m_common->state.fillGradient->platformGradient());
+            brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
+            p->fillPath(path, brush);
+            break;
+        }
     }
     m_data->currentPath = QPainterPath();
 }
@@ -642,59 +667,88 @@ void GraphicsContext::strokePath()
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
-    QPen pen = p->pen();
+    QPainter* p = m_data->p();
+    QPen pen(p->pen());
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    switch (m_common->state.strokeColorSpace) {
-    case SolidColorSpace:
-        if (strokeColor().alpha())
+    if ((m_common->state.strokeColorSpace != SolidColorSpace)
+            || (strokeColor().alpha())) {
+        IntSize shadowSize;
+        int shadowBlur;
+        Color shadowColor;
+        if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+            QTransform t(p->worldTransform());
+            p->translate(shadowSize.width(), shadowSize.height());
+            QPen shadowPen(pen);
+            shadowPen.setColor(shadowColor);
+            p->strokePath(path, shadowPen);
+            p->setWorldTransform(t);
+        }
+        switch (m_common->state.strokeColorSpace) {
+        case SolidColorSpace:
+            if (strokeColor().alpha())
+                p->strokePath(path, pen);
+            break;
+        case PatternColorSpace: {
+            TransformationMatrix affine;
+            pen.setBrush(QBrush(m_common->state.strokePattern->createPlatformPattern(affine)));
+            p->setPen(pen);
             p->strokePath(path, pen);
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        pen.setBrush(QBrush(m_common->state.strokePattern->createPlatformPattern(affine)));
-        p->setPen(pen);
-        p->strokePath(path, pen);
-        break;
-    }
-    case GradientColorSpace: {
-        QBrush brush(*m_common->state.strokeGradient->platformGradient());
-        brush.setTransform(m_common->state.strokeGradient->gradientSpaceTransform());
-        pen.setBrush(brush);
-        p->setPen(pen);
-        p->strokePath(path, pen);
-        break;
-    }
+            break;
+        }
+        case GradientColorSpace: {
+            QBrush brush(*m_common->state.strokeGradient->platformGradient());
+            brush.setTransform(m_common->state.strokeGradient->gradientSpaceTransform());
+            pen.setBrush(brush);
+            p->setPen(pen);
+            p->strokePath(path, pen);
+            break;
+        }
+        }
     }
     m_data->currentPath = QPainterPath();
 }
 
+static inline void drawBorderlessRectShadow(GraphicsContext* context, QPainter* p, const FloatRect& rect)
+{
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
+        FloatRect shadowRect(rect);
+        shadowRect.move(shadowSize.width(), shadowSize.height());
+        p->fillRect(shadowRect, QColor(shadowColor));
+    }
+}
+
 void GraphicsContext::fillRect(const FloatRect& rect)
 {
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
 
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        if (fillColor().alpha())
-            p->fillRect(rect, p->brush());
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        p->fillRect(rect, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-        break;
-    }
-    case GradientColorSpace:
-        QBrush brush(*m_common->state.fillGradient->platformGradient());
-        brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
-        p->fillRect(rect, brush);
-        break;
+    if ((m_common->state.fillColorSpace != SolidColorSpace)
+            || (fillColor().alpha())) {
+        drawBorderlessRectShadow(this, p, rect);
+        switch (m_common->state.fillColorSpace) {
+        case SolidColorSpace:
+            if (fillColor().alpha())
+                p->fillRect(rect, p->brush());
+            break;
+        case PatternColorSpace: {
+            TransformationMatrix affine;
+            p->fillRect(rect, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
+            break;
+        }
+        case GradientColorSpace:
+            QBrush brush(*m_common->state.fillGradient->platformGradient());
+            brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
+            p->fillRect(rect, brush);
+            break;
+        }
     }
-    m_data->currentPath = QPainterPath();
 }
 
 void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
@@ -702,8 +756,10 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
     if (paintingDisabled())
         return;
 
-    m_data->solidColor.setColor(QColor(c));
-    m_data->p()->fillRect(rect, m_data->solidColor);
+    m_data->solidColor.setColor(c);
+    QPainter* p = m_data->p();
+    drawBorderlessRectShadow(this, p, rect);
+    p->fillRect(rect, m_data->solidColor);
 }
 
 void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
@@ -712,7 +768,9 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
         return;
 
     Path path = Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight);
-    m_data->p()->fillPath(*path.platformPath(), QColor(color));
+    QPainter* p = m_data->p();
+    drawFilledShadowPath(this, p, path.platformPath());
+    p->fillPath(*path.platformPath(), QColor(color));
 }
 
 void GraphicsContext::beginPath()
@@ -750,7 +808,7 @@ void GraphicsContext::clipPath(WindRule clipRule)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPainterPath newPath = m_data->currentPath;
     newPath.setFillRule(clipRule == RULE_EVENODD ? Qt::OddEvenFill : Qt::WindingFill);
     p->setClipPath(newPath);
@@ -769,10 +827,10 @@ void GraphicsContext::drawFocusRing(const Color& color)
     const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
 
-    if (rects.size() == 0)
+    if (!rects.size())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
 
@@ -793,7 +851,7 @@ void GraphicsContext::drawFocusRing(const Color& color)
     QPainterPath newPath = stroker.createStroke(path);
     p->strokePath(newPath, nPen);
 #else
-    for (int i = 0; i < rectCount; ++i)
+    for (unsigned i = 0; i < rectCount; ++i)
         p->drawRect(QRectF(rects[i]));
 #endif
     p->setPen(oldPen);
@@ -802,7 +860,7 @@ void GraphicsContext::drawFocusRing(const Color& color)
     p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
 
-void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool printing)
+void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool)
 {
     if (paintingDisabled())
         return;
@@ -811,8 +869,7 @@ void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool pr
     drawLine(origin, endPoint);
 }
 
-void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint&,
-                                                         int width, bool grammar)
+void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint&, int, bool)
 {
     if (paintingDisabled())
         return;
@@ -829,10 +886,16 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
     return FloatRect(QRectF(result));
 }
 
-void GraphicsContext::setPlatformShadow(const IntSize& pos, int blur, const Color &color)
+void GraphicsContext::setPlatformShadow(const IntSize& size, int, const Color&)
 {
     // Qt doesn't support shadows natively, they are drawn manually in the draw*
     // functions
+
+    if (m_common->state.shadowsIgnoreTransforms) {
+        // Meaning that this graphics context is associated with a CanvasRenderingContext
+        // We flip the height since CG and HTML5 Canvas have opposite Y axis
+        m_common->state.shadowSize = IntSize(size.width(), -size.height());
+    }
 }
 
 void GraphicsContext::clearPlatformShadow()
@@ -848,8 +911,8 @@ void GraphicsContext::beginTransparencyLayer(float opacity)
 
     int x, y, w, h;
     x = y = 0;
-    QPainter *p = m_data->p();
-    const QPaintDevice *device = p->device();
+    QPainter* p = m_data->p();
+    const QPaintDevice* device = p->device();
     w = device->width();
     h = device->height();
 
@@ -871,10 +934,10 @@ void GraphicsContext::endTransparencyLayer()
     if (paintingDisabled())
         return;
 
-    TransparencyLayer *layer = m_data->layers.pop();
+    TransparencyLayer* layer = m_data->layers.pop();
     layer->painter.end();
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     p->save();
     p->resetTransform();
     p->setOpacity(layer->opacity);
@@ -889,7 +952,7 @@ void GraphicsContext::clearRect(const FloatRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPainter::CompositionMode currentCompositionMode = p->compositionMode();
     if (p->paintEngine()->hasFeature(QPaintEngine::PorterDuff))
         p->setCompositionMode(QPainter::CompositionMode_Source);
@@ -916,7 +979,7 @@ void GraphicsContext::setLineCap(LineCap lc)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen nPen = p->pen();
     nPen.setCapStyle(toQtLineCap(lc));
     p->setPen(nPen);
@@ -948,7 +1011,7 @@ void GraphicsContext::setLineJoin(LineJoin lj)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen nPen = p->pen();
     nPen.setJoinStyle(toQtLineJoin(lj));
     p->setPen(nPen);
@@ -959,7 +1022,7 @@ void GraphicsContext::setMiterLimit(float limit)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen nPen = p->pen();
     nPen.setMiterLimit(limit);
     p->setPen(nPen);
@@ -969,7 +1032,7 @@ void GraphicsContext::setAlpha(float opacity)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     p->setOpacity(opacity);
 }
 
@@ -995,15 +1058,19 @@ void GraphicsContext::clipOut(const Path& path)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
+    QPainter* p = m_data->p();
     QPainterPath clippedOut = *path.platformPath();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addPath(clippedOut);
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addPath(clippedOut);
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        newClip.addRect(p->window());
+        newClip.addPath(clippedOut & newClip);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::translate(float x, float y)
@@ -1061,14 +1128,21 @@ void GraphicsContext::clipOut(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
+    QPainter* p = m_data->p();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addRect(QRect(rect));
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addRect(QRect(rect));
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        QRect clipOutRect(rect);
+        QRect window(p->window());
+        clipOutRect &= window;
+        newClip.addRect(window);
+        newClip.addRect(clipOutRect);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
@@ -1076,14 +1150,21 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
+    QPainter* p = m_data->p();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addEllipse(QRect(rect));
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addEllipse(QRect(rect));
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        QRect clipOutRect(rect);
+        QRect window(p->window());
+        clipOutRect &= window;
+        newClip.addRect(window);
+        newClip.addEllipse(clipOutRect);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::clipToImageBuffer(const FloatRect&, const ImageBuffer*)
@@ -1109,7 +1190,7 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect,
 
     path.setFillRule(Qt::OddEvenFill);
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
 
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, true);
@@ -1134,7 +1215,7 @@ void GraphicsContext::concatCTM(const TransformationMatrix& transform)
     }
 }
 
-void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
+void GraphicsContext::setURLForRect(const KURL&, const IntRect&)
 {
     notImplemented();
 }
@@ -1143,7 +1224,7 @@ void GraphicsContext::setPlatformStrokeColor(const Color& color)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen newPen(p->pen());
     newPen.setColor(color);
     p->setPen(newPen);
@@ -1153,7 +1234,7 @@ void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle& strokeStyle)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen newPen(p->pen());
     newPen.setStyle(toQPenStyle(strokeStyle));
     p->setPen(newPen);
@@ -1163,7 +1244,7 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen newPen(p->pen());
     newPen.setWidthF(thickness);
     p->setPen(newPen);
@@ -1184,7 +1265,6 @@ void GraphicsContext::setPlatformShouldAntialias(bool enable)
 }
 
 #ifdef Q_WS_WIN
-#include <windows.h>
 
 HDC GraphicsContext::getWindowsContext(const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
 {
diff --git a/WebCore/platform/graphics/qt/IconQt.cpp b/WebCore/platform/graphics/qt/IconQt.cpp
index 34c3c47..98f4606 100644
--- a/WebCore/platform/graphics/qt/IconQt.cpp
+++ b/WebCore/platform/graphics/qt/IconQt.cpp
@@ -47,7 +47,7 @@ PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
     return i.release();
 }
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
 {
     //FIXME: Implement this
     return 0;
diff --git a/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index 22a5a43..5255428 100644
--- a/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -68,7 +68,7 @@ ImageBufferData::ImageBufferData(const IntSize& size)
     painter->setCompositionMode(QPainter::CompositionMode_SourceOver);
 }
 
-ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, bool& success)
+ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace, bool& success)
     : m_data(size)
     , m_size(size)
 {
@@ -125,12 +125,13 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
         m_data.m_painter->begin(&m_data.m_pixmap);
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
+template <Multiply multiplied>
+PassRefPtr<ImageData> getImageData(const IntRect& rect, const ImageBufferData& imageData, const IntSize& size)
 {
     PassRefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
     unsigned char* data = result->data()->data()->data();
 
-    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > m_size.width() || (rect.y() + rect.height()) > m_size.height())
+    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > size.width() || (rect.y() + rect.height()) > size.height())
         memset(data, 0, result->data()->length());
 
     int originx = rect.x();
@@ -140,8 +141,8 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originx = 0;
     }
     int endx = rect.x() + rect.width();
-    if (endx > m_size.width())
-        endx = m_size.width();
+    if (endx > size.width())
+        endx = size.width();
     int numColumns = endx - originx;
 
     int originy = rect.y();
@@ -151,11 +152,16 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originy = 0;
     }
     int endy = rect.y() + rect.height();
-    if (endy > m_size.height())
-        endy = m_size.height();
+    if (endy > size.height())
+        endy = size.height();
     int numRows = endy - originy;
 
-    QImage image = m_data.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32);
+    QImage image = imageData.m_pixmap.toImage();
+    if (multiplied == Unmultiplied)
+        image = image.convertToFormat(QImage::Format_ARGB32);
+    else
+        image = image.convertToFormat(QImage::Format_ARGB32_Premultiplied);
+
     ASSERT(!image.isNull());
 
     unsigned destBytesPerRow = 4 * rect.width();
@@ -176,7 +182,18 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     return result;
 }
 
-void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Unmultiplied>(rect, m_data, m_size);
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Premultiplied>(rect, m_data, m_size);
+}
+
+template <Multiply multiplied>
+void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint& destPoint, ImageBufferData& data, const IntSize& size)
 {
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -184,49 +201,65 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     int originx = sourceRect.x();
     int destx = destPoint.x() + sourceRect.x();
     ASSERT(destx >= 0);
-    ASSERT(destx < m_size.width());
+    ASSERT(destx < size.width());
     ASSERT(originx >= 0);
     ASSERT(originx <= sourceRect.right());
 
     int endx = destPoint.x() + sourceRect.right();
-    ASSERT(endx <= m_size.width());
+    ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
 
     int originy = sourceRect.y();
     int desty = destPoint.y() + sourceRect.y();
     ASSERT(desty >= 0);
-    ASSERT(desty < m_size.height());
+    ASSERT(desty < size.height());
     ASSERT(originy >= 0);
     ASSERT(originy <= sourceRect.bottom());
 
     int endy = destPoint.y() + sourceRect.bottom();
-    ASSERT(endy <= m_size.height());
+    ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
     unsigned srcBytesPerRow = 4 * source->width();
 
-    bool isPainting = m_data.m_painter->isActive();
+    bool isPainting = data.m_painter->isActive();
     if (isPainting)
-        m_data.m_painter->end();
+        data.m_painter->end();
 
-    QImage image = m_data.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32);
+    QImage image = data.m_pixmap.toImage();
+    if (multiplied == Unmultiplied)
+        image = image.convertToFormat(QImage::Format_ARGB32);
+    else
+        image = image.convertToFormat(QImage::Format_ARGB32_Premultiplied);
 
     unsigned char* srcRows = source->data()->data()->data() + originy * srcBytesPerRow + originx * 4;
     for (int y = 0; y < numRows; ++y) {
         quint32* scanLine = reinterpret_cast<quint32*>(image.scanLine(y + desty));
         for (int x = 0; x < numColumns; x++) {
-            int basex = x * 4;
-            scanLine[x + destx] = reinterpret_cast<quint32*>(srcRows + basex)[0];
+            // ImageData stores the pixels in RGBA while QImage is ARGB
+            quint32 pixel = reinterpret_cast<quint32*>(srcRows + 4 * x)[0];
+            pixel = ((pixel << 16) & 0xff0000) | ((pixel >> 16) & 0xff) | (pixel & 0xff00ff00);
+            scanLine[x + destx] = pixel;
         }
 
         srcRows += srcBytesPerRow;
     }
 
-    m_data.m_pixmap = QPixmap::fromImage(image);
+    data.m_pixmap = QPixmap::fromImage(image);
 
     if (isPainting)
-        m_data.m_painter->begin(&m_data.m_pixmap);
+        data.m_painter->begin(&data.m_pixmap);
+}
+
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Unmultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Premultiplied>(source, sourceRect, destPoint, m_data, m_size);
 }
 
 // We get a mimeType here but QImageWriter does not support mimetypes but
diff --git a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 7bbdcc0..3a27fe3 100644
--- a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -35,150 +35,9 @@
 #include <QtGui/QImageReader>
 #include <qdebug.h>
 
-namespace {
-    const  QImage::Format DesiredFormat = QImage::Format_ARGB32;
-    const  bool debugImageDecoderQt = false;
-}
-
 namespace WebCore {
-ImageDecoderQt::ImageData::ImageData(const QImage& image, ImageState imageState, int duration) :
-    m_image(image), m_imageState(imageState), m_duration(duration)
-{
-}
-
-// Context, maintains IODevice on a data buffer.
-class ImageDecoderQt::ReadContext {
-public:
-
-    enum LoadMode {
-        // Load images incrementally. This is still experimental and
-        // will cause the image plugins to report errors.
-        // Also note that as of Qt 4.2.2, the JPEG loader does not return error codes
-        // on "preliminary end of data".
-        LoadIncrementally,
-            // Load images only if  all data have been received
-            LoadComplete };
-
-    ReadContext(const IncomingData & data, LoadMode loadMode, ImageList &target);
-
-    enum ReadResult { ReadEOF, ReadFailed, ReadPartial, ReadComplete };
-
-    // Append data and read out all images. Returns the result
-    // of the last read operation, so, even if  ReadPartial is returned,
-    // a few images might have been read.
-    ReadResult read(bool allDataReceived);
-
-    QImageReader *reader() { return &m_reader; }
 
-private:
-    enum IncrementalReadResult { IncrementalReadFailed, IncrementalReadPartial, IncrementalReadComplete };
-    // Incrementally read an image
-    IncrementalReadResult readImageLines(ImageData &);
-
-    const LoadMode m_loadMode;
-
-    QByteArray m_data;
-    QBuffer m_buffer;
-    QImageReader m_reader;
-
-    ImageList &m_target;
-
-    // Detected data format of the stream
-    enum QImage::Format m_dataFormat;
-    QSize m_size;
-
-};
-
-ImageDecoderQt::ReadContext::ReadContext(const IncomingData & data, LoadMode loadMode, ImageList &target)
-    : m_loadMode(loadMode)
-    , m_data(data.data(), data.size())
-    , m_buffer(&m_data)
-    , m_reader(&m_buffer)
-    , m_target(target)
-    , m_dataFormat(QImage::Format_Invalid)
-{
-    m_buffer.open(QIODevice::ReadOnly);
-}
-
-
-ImageDecoderQt::ReadContext::ReadResult
-        ImageDecoderQt::ReadContext::read(bool allDataReceived)
-{
-    // Complete mode: Read only all all data received
-    if (m_loadMode == LoadComplete && !allDataReceived)
-        return ReadPartial;
-
-    // Attempt to read out all images
-    while (true) {
-        if (m_target.empty() || m_target.back().m_imageState == ImageComplete) {
-            // Start a new image.
-            if (!m_reader.canRead())
-                return ReadEOF;
-
-            // Attempt to construct an empty image of the matching size and format
-            // for efficient reading
-            QImage newImage = m_dataFormat != QImage::Format_Invalid  ?
-                          QImage(m_size, m_dataFormat) : QImage();
-            m_target.push_back(ImageData(newImage));
-        }
-
-        // read chunks
-        switch (readImageLines(m_target.back())) {
-        case IncrementalReadFailed:
-            m_target.pop_back();
-            return ReadFailed;
-        case IncrementalReadPartial:
-            return ReadPartial;
-        case IncrementalReadComplete:
-            m_target.back().m_imageState = ImageComplete;
-            //store for next
-            m_dataFormat = m_target.back().m_image.format();
-            m_size = m_target.back().m_image.size();
-            const bool supportsAnimation = m_reader.supportsAnimation();
-
-            if (debugImageDecoderQt)
-                qDebug() << "readImage(): #" << m_target.size() << " complete, " << m_size
-                    << " format " << m_dataFormat <<  " supportsAnimation=" <<  supportsAnimation;
-            // No point in readinfg further
-            if (!supportsAnimation)
-                return ReadComplete;
-
-            break;
-        }
-    }
-    return ReadComplete;
-}
-
-
-
-ImageDecoderQt::ReadContext::IncrementalReadResult
-        ImageDecoderQt::ReadContext::readImageLines(ImageData &imageData)
-{
-    // TODO: Implement incremental reading here,
-    // set state to reflect complete header, etc.
-    // For now, we read the whole image.
-
-    const qint64 startPos = m_buffer.pos();
-    // Oops, failed. Rewind.
-    if (!m_reader.read(&imageData.m_image)) {
-        m_buffer.seek(startPos);
-        const bool gotHeader = imageData.m_image.size().width();
-
-        if (debugImageDecoderQt)
-            qDebug() << "readImageLines(): read() failed: " << m_reader.errorString()
-                << " got header=" << gotHeader;
-        // [Experimental] Did we manage to read the header?
-        if (gotHeader) {
-            imageData.m_imageState = ImageHeaderValid;
-            return IncrementalReadPartial;
-        }
-        return IncrementalReadFailed;
-    }
-    imageData.m_duration = m_reader.nextImageDelay();
-    return IncrementalReadComplete;
-}
-
-ImageDecoderQt* ImageDecoderQt::create(const SharedBuffer& data)
+ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
 {
     // We need at least 4 bytes to figure out what kind of image we're dealing with.
     if (data.size() < 4)
@@ -189,149 +48,196 @@ ImageDecoderQt* ImageDecoderQt::create(const SharedBuffer& data)
     if (!buffer.open(QBuffer::ReadOnly))
         return 0;
 
-    QString imageFormat = QString::fromLatin1(QImageReader::imageFormat(&buffer).toLower());
+    QByteArray imageFormat = QImageReader::imageFormat(&buffer);
     if (imageFormat.isEmpty())
         return 0; // Image format not supported
 
     return new ImageDecoderQt(imageFormat);
 }
 
-ImageDecoderQt::ImageDecoderQt(const QString &imageFormat)
-    : m_hasAlphaChannel(false)
-    , m_imageFormat(imageFormat)
+ImageDecoderQt::ImageDecoderQt(const QByteArray& imageFormat)
+    : m_buffer(0)
+    , m_reader(0)
+    , m_repetitionCount(-1)
 {
 }
 
 ImageDecoderQt::~ImageDecoderQt()
 {
+    delete m_reader;
+    delete m_buffer;
 }
 
-bool ImageDecoderQt::hasFirstImageHeader() const
+void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
 {
-    return  !m_imageList.empty() && m_imageList[0].m_imageState >= ImageHeaderValid;
-}
+    if (m_failed)
+        return;
 
-void ImageDecoderQt::reset()
-{
-    m_hasAlphaChannel = false;
-    m_failed = false;
-    m_imageList.clear();
-    m_pixmapCache.clear();
-    m_loopCount = cAnimationNone;
-}
+    // Cache our own new data.
+    ImageDecoder::setData(data, allDataReceived);
 
-void ImageDecoderQt::setData(const IncomingData &data, bool allDataReceived)
-{
-    reset();
-    ReadContext readContext(data, ReadContext::LoadComplete, m_imageList);
-
-    if (debugImageDecoderQt)
-        qDebug() << " setData " << data.size() << " image bytes, complete=" << allDataReceived;
-
-    const  ReadContext::ReadResult readResult =  readContext.read(allDataReceived);
-
-    if (hasFirstImageHeader())
-        m_hasAlphaChannel = m_imageList[0].m_image.hasAlphaChannel();
-
-    if (debugImageDecoderQt)
-        qDebug()  << " read returns " << readResult;
-
-    switch (readResult) {
-    case ReadContext::ReadFailed:
-        m_failed = true;
-        break;
-    case ReadContext::ReadEOF:
-    case ReadContext::ReadPartial:
-    case ReadContext::ReadComplete:
-        // Did we read anything - try to set the size.
-        if (hasFirstImageHeader()) {
-            QSize imgSize = m_imageList[0].m_image.size();
-            setSize(imgSize.width(), imgSize.height());
-
-            if (readContext.reader()->supportsAnimation()) {
-                if (readContext.reader()->loopCount() != -1)
-                    m_loopCount = readContext.reader()->loopCount();
-                else
-                    m_loopCount = 0; //loop forever
-            }
-        }
-        break;
-    }
-}
+    // No progressive loading possible
+    if (!allDataReceived)
+        return;
+
+    // We expect to be only called once with allDataReceived
+    ASSERT(!m_buffer);
+    ASSERT(!m_reader);
 
+    // Attempt to load the data
+    QByteArray imageData = QByteArray::fromRawData(m_data->data(), m_data->size());
+    m_buffer = new QBuffer;
+    m_buffer->setData(imageData);
+    m_buffer->open(QBuffer::ReadOnly);
+    m_reader = new QImageReader(m_buffer);
+
+    if (!m_reader->canRead())
+        failRead();
+}
 
 bool ImageDecoderQt::isSizeAvailable()
 {
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::isSizeAvailable() returns" << ImageDecoder::isSizeAvailable();
+    if (!m_failed && !ImageDecoder::isSizeAvailable() && m_reader)
+        internalDecodeSize();
+
     return ImageDecoder::isSizeAvailable();
 }
 
-size_t ImageDecoderQt::frameCount() const
+size_t ImageDecoderQt::frameCount()
 {
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::frameCount() returns" << m_imageList.size();
-    return m_imageList.size();
+    if (m_frameBufferCache.isEmpty() && m_reader) {
+        if (m_reader->supportsAnimation()) {
+            int imageCount = m_reader->imageCount();
+
+            // Fixup for Qt decoders... imageCount() is wrong
+            // and jumpToNextImage does not work either... so
+            // we will have to parse everything...
+            if (imageCount == 0)
+                forceLoadEverything();
+            else
+                m_frameBufferCache.resize(imageCount);
+        } else {
+            m_frameBufferCache.resize(1);
+        }
+    }
+
+    return m_frameBufferCache.size();
 }
 
 int ImageDecoderQt::repetitionCount() const
 {
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::repetitionCount() returns" << m_loopCount;
-    return m_loopCount;
+    if (m_reader && m_reader->supportsAnimation())
+        m_repetitionCount = qMax(0, m_reader->loopCount());
+
+    return m_repetitionCount;
 }
 
-bool ImageDecoderQt::supportsAlpha() const
+String ImageDecoderQt::filenameExtension() const
 {
-    return m_hasAlphaChannel;
-}
+    return m_format;
+};
 
-int ImageDecoderQt::duration(size_t index) const
+RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t index)
 {
-    if (index >= m_imageList.size())
+    // this information might not have been set
+    int count = m_frameBufferCache.size();
+    if (count == 0) {
+        internalDecodeSize();
+        count = frameCount();
+    }
+
+    if (index >= static_cast<size_t>(count))
         return 0;
-    return  m_imageList[index].m_duration;
+
+    RGBA32Buffer& frame = m_frameBufferCache[index];
+    if (frame.status() != RGBA32Buffer::FrameComplete && m_reader)
+        internalReadImage(index);
+    return &frame;
 }
 
-String ImageDecoderQt::filenameExtension() const
+void ImageDecoderQt::clearFrameBufferCache(size_t index)
 {
-    if (debugImageDecoderQt)
-           qDebug() << " ImageDecoderQt::filenameExtension() returns" << m_imageFormat;
-    return m_imageFormat;
-};
+    // Currently QImageReader will be asked to read everything. This
+    // might change when we read gif images on demand. For now we
+    // can have a rather simple implementation.
+    if (index > m_frameBufferCache.size())
+        return;
 
-RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t index)
+    for (size_t i = 0; i < index; ++index)
+        m_frameBufferCache[index].clear();
+}
+
+void ImageDecoderQt::internalDecodeSize()
 {
-    Q_ASSERT("use imageAtIndex instead");
-    return 0;
+    ASSERT(m_reader);
+
+    QSize size = m_reader->size();
+    setSize(size.width(), size.height());
 }
 
-QPixmap* ImageDecoderQt::imageAtIndex(size_t index) const
+void ImageDecoderQt::internalReadImage(size_t frameIndex)
 {
-    if (debugImageDecoderQt)
-        qDebug() << "ImageDecoderQt::imageAtIndex(" << index << ')';
+    ASSERT(m_reader);
 
-    if (index >= m_imageList.size())
-        return 0;
+    if (m_reader->supportsAnimation())
+        m_reader->jumpToImage(frameIndex);
+    else if (frameIndex != 0)
+        return failRead();
 
-    if (!m_pixmapCache.contains(index)) {
-        m_pixmapCache.insert(index,
-                             QPixmap::fromImage(m_imageList[index].m_image));
+    internalHandleCurrentImage(frameIndex);
 
-        // store null image since the converted pixmap is already in pixmap cache
-        Q_ASSERT(m_imageList[index].m_imageState == ImageComplete);
-        m_imageList[index].m_image = QImage();
-    }
-    return  &m_pixmapCache[index];
+    // Attempt to return some memory
+    for (int i = 0; i < m_frameBufferCache.size(); ++i)
+        if (m_frameBufferCache[i].status() != RGBA32Buffer::FrameComplete)
+            return;
+
+    delete m_reader;
+    delete m_buffer;
+    m_buffer = 0;
+    m_reader = 0;
 }
 
-void ImageDecoderQt::clearFrame(size_t index)
+void ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
 {
-    if (m_imageList.size() < (int)index)
-        m_imageList[index].m_image = QImage();
-    m_pixmapCache.take(index);
+    // Now get the QImage from Qt and place it in the RGBA32Buffer
+    QImage img;
+    if (!m_reader->read(&img))
+        return failRead();
+
+    // now into the RGBA32Buffer - even if the image is not
+    QSize imageSize = img.size();
+    RGBA32Buffer* const buffer = &m_frameBufferCache[frameIndex];
+    buffer->setRect(m_reader->currentImageRect());
+    buffer->setStatus(RGBA32Buffer::FrameComplete);
+    buffer->setDuration(m_reader->nextImageDelay());
+    buffer->setDecodedImage(img);
 }
 
+// We will parse everything and we have no idea how
+// many images we have... We will have to find out the
+// hard way.
+void ImageDecoderQt::forceLoadEverything()
+{
+    int imageCount = 0;
+
+    do {
+        m_frameBufferCache.resize(++imageCount);
+        internalHandleCurrentImage(imageCount - 1);
+    } while(!m_failed);
+
+    // reset the failed state and resize the vector...
+    m_frameBufferCache.resize(imageCount - 1);
+    m_failed = false;
+}
+
+void ImageDecoderQt::failRead()
+{
+    setFailed();
+    delete m_reader;
+    delete m_buffer;
+    m_reader = 0;
+    m_buffer = 0;
+}
 }
 
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/graphics/qt/ImageDecoderQt.h b/WebCore/platform/graphics/qt/ImageDecoderQt.h
index fc52479..7b3b686 100644
--- a/WebCore/platform/graphics/qt/ImageDecoderQt.h
+++ b/WebCore/platform/graphics/qt/ImageDecoderQt.h
@@ -28,10 +28,11 @@
 #define ImageDecoderQt_h
 
 #include "ImageDecoder.h"
-#include <QtGui/QImage>
+#include <QtGui/QImageReader>
 #include <QtGui/QPixmap>
 #include <QtCore/QList>
 #include <QtCore/QHash>
+#include <QtCore/QBuffer>
 
 namespace WebCore {
 
@@ -39,54 +40,35 @@ namespace WebCore {
 class ImageDecoderQt : public ImageDecoder
 {
 public:
-    static ImageDecoderQt* create(const SharedBuffer& data);
+    ImageDecoderQt(const QByteArray& imageFormat);
     ~ImageDecoderQt();
 
-    typedef Vector<char> IncomingData;
-
-    virtual void setData(const IncomingData& data, bool allDataReceived);
+    virtual void setData(SharedBuffer* data, bool allDataReceived);
     virtual bool isSizeAvailable();
-    virtual size_t frameCount() const;
+    virtual size_t frameCount();
     virtual int repetitionCount() const;
     virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
 
-    QPixmap* imageAtIndex(size_t index) const;
-    virtual bool supportsAlpha() const;
-    int duration(size_t index) const;
     virtual String filenameExtension() const;
 
-    void clearFrame(size_t index);
+    virtual void clearFrameBufferCache(size_t clearBeforeFrame);
 
 private:
-    ImageDecoderQt(const QString &imageFormat);
     ImageDecoderQt(const ImageDecoderQt&);
     ImageDecoderQt &operator=(const ImageDecoderQt&);
 
-    class ReadContext;
-    void reset();
-    bool hasFirstImageHeader() const;
-
-    enum ImageState {
-        // Started image reading
-        ImagePartial,
-            // Header (size / alpha) are known
-            ImageHeaderValid,
-            // Image is complete
-            ImageComplete };
-
-    struct ImageData {
-        ImageData(const QImage& image, ImageState imageState = ImagePartial, int duration=0);
-        QImage m_image;
-        ImageState m_imageState;
-        int m_duration;
-    };
-
-    bool m_hasAlphaChannel;
-    typedef QList<ImageData> ImageList;
-    mutable ImageList m_imageList;
-    mutable QHash<int, QPixmap> m_pixmapCache;
-    int m_loopCount;
-    QString m_imageFormat;
+private:
+    void internalDecodeSize();
+    void internalReadImage(size_t);
+    void internalHandleCurrentImage(size_t);
+    void forceLoadEverything();
+    void failRead();
+
+private:
+    String m_format;
+    QBuffer* m_buffer;
+    QImageReader* m_reader;
+    mutable int m_repetitionCount;
 };
 
 
diff --git a/WebCore/platform/graphics/qt/ImageQt.cpp b/WebCore/platform/graphics/qt/ImageQt.cpp
index 5d40e26..da6ddac 100644
--- a/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -76,6 +76,7 @@ bool FrameData::clear(bool clearMetadata)
         m_haveMetadata = false;
 
     if (m_frame) {
+        delete m_frame;
         m_frame = 0;
         return true;
     }
diff --git a/WebCore/platform/graphics/qt/ImageSourceQt.cpp b/WebCore/platform/graphics/qt/ImageSourceQt.cpp
deleted file mode 100644
index 8ae449c..0000000
--- a/WebCore/platform/graphics/qt/ImageSourceQt.cpp
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved. 
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ImageSource.h"
-#include "ImageDecoderQt.h"
-#include "SharedBuffer.h"
-
-#include <QBuffer>
-#include <QImage>
-#include <QImageReader>
-
-namespace WebCore {
-
-ImageSource::ImageSource()
-    : m_decoder(0)
-{
-}
-
-ImageSource::~ImageSource()
-{
-    clear(true);
-}
-
-bool ImageSource::initialized() const
-{
-    return m_decoder;
-}
-
-void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
-{
-    // Make the decoder by sniffing the bytes.
-    // This method will examine the data and instantiate an instance of the appropriate decoder plugin.
-    // If insufficient bytes are available to determine the image type, no decoder plugin will be
-    // made.
-    if (!m_decoder)
-        m_decoder = ImageDecoderQt::create(*data);
-
-    if (!m_decoder)
-        return;
-
-    m_decoder->setData(data->buffer(), allDataReceived);
-}
-
-String ImageSource::filenameExtension() const
-{
-    if (!m_decoder)
-        return String();
-
-    return m_decoder->filenameExtension();
-}
-
-bool ImageSource::isSizeAvailable()
-{
-    if (!m_decoder)
-        return false;
-
-    return m_decoder->isSizeAvailable();
-}
-
-IntSize ImageSource::size() const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->size();
-}
-
-IntSize ImageSource::frameSizeAtIndex(size_t index) const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->frameSizeAtIndex(index);
-}
-
-int ImageSource::repetitionCount()
-{
-    if (!m_decoder)
-        return cAnimationNone;
-
-    return m_decoder->repetitionCount();
-}
-
-size_t ImageSource::frameCount() const
-{
-    if (!m_decoder)
-        return 0;
-
-    return m_decoder->frameCount();
-}
-
-NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    return m_decoder->imageAtIndex(index);
-}
-
-float ImageSource::frameDurationAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    // Many annoying ads specify a 0 duration to make an image flash as quickly
-    // as possible.  We follow WinIE's behavior and use a duration of 100 ms
-    // for any frames that specify a duration of <= 50 ms.  See
-    // <http://bugs.webkit.org/show_bug.cgi?id=14413> or Radar 4051389 for
-    // more.
-    const float duration = m_decoder->duration(index) / 1000.0f;
-    return (duration < 0.051f) ? 0.100f : duration;
-}
-
-bool ImageSource::frameHasAlphaAtIndex(size_t index)
-{
-    if (!m_decoder || !m_decoder->supportsAlpha())
-        return false;
-
-    const QPixmap* source = m_decoder->imageAtIndex(index);
-    if (!source)
-        return false;
-
-    return source->hasAlphaChannel();
-}
-
-bool ImageSource::frameIsCompleteAtIndex(size_t index)
-{
-    return (m_decoder && m_decoder->imageAtIndex(index));
-}
-
-void ImageSource::clear(bool destroyAll, size_t clearBeforeFrame, SharedBuffer* data, bool allDataReceived)
-{
-    if (!destroyAll) {
-        if (m_decoder)
-            m_decoder->clearFrameBufferCache(clearBeforeFrame);
-        return;
-    }
-
-    delete m_decoder;
-    m_decoder = 0;
-    if (data)
-        setData(data, allDataReceived);
-}
-
-}
-
-// vim: ts=4 sw=4 et
diff --git a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
index 76b1494..7078d16 100644
--- a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+++ b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
@@ -27,6 +27,7 @@
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "NotImplemented.h"
+#include "TimeRanges.h"
 #include "Widget.h"
 #include <wtf/HashSet.h>
 
@@ -37,9 +38,9 @@
 #include <QUrl>
 #include <QEvent>
 
-#include <Phonon/AudioOutput>
-#include <Phonon/MediaObject>
-#include <Phonon/VideoWidget>
+#include <audiooutput.h>
+#include <mediaobject.h>
+#include <videowidget.h>
 
 using namespace Phonon;
 
@@ -146,7 +147,7 @@ void MediaPlayerPrivate::getSupportedTypes(HashSet<String>&)
     notImplemented();
 }
 
-MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
+MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String&, const String&)
 {
     // FIXME: do the real thing
     notImplemented();
@@ -160,6 +161,14 @@ bool MediaPlayerPrivate::hasVideo() const
     return hasVideo;
 }
 
+bool MediaPlayerPrivate::hasAudio() const
+{
+    // FIXME: Phonon::MediaObject does not have such a hasAudio() function
+    bool hasAudio = true;
+    LOG(Media, "MediaPlayerPrivatePhonon::hasAudio() -> %s", hasAudio ? "true" : "false");
+    return hasAudio;
+}
+
 void MediaPlayerPrivate::load(const String& url)
 {
     LOG(Media, "MediaPlayerPrivatePhonon::load(\"%s\")", url.utf8().data());
@@ -247,15 +256,15 @@ float MediaPlayerPrivate::currentTime() const
     return currentTime;
 }
 
-void MediaPlayerPrivate::setEndTime(float endTime)
+void MediaPlayerPrivate::setEndTime(float)
 {
     notImplemented();
 }
 
-float MediaPlayerPrivate::maxTimeBuffered() const
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 {
     notImplemented();
-    return 0.0f;
+    return TimeRanges::create();
 }
 
 float MediaPlayerPrivate::maxTimeSeekable() const
diff --git a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
index 9572d61..e1193b6 100644
--- a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
+++ b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
@@ -80,6 +80,7 @@ namespace WebCore {
 
         IntSize naturalSize() const;
         bool hasVideo() const;
+        bool hasAudio() const;
 
         void load(const String &url);
         void cancelLoad();
@@ -104,7 +105,7 @@ namespace WebCore {
         MediaPlayer::NetworkState networkState() const;
         MediaPlayer::ReadyState readyState() const;
 
-        float maxTimeBuffered() const;
+        PassRefPtr<TimeRanges> buffered() const;
         float maxTimeSeekable() const;
         unsigned bytesLoaded() const;
         bool totalBytesKnown() const;
diff --git a/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp b/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
index f823f84..f093d7d 100644
--- a/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
+++ b/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
@@ -33,7 +33,7 @@ void SimpleFontData::determinePitch()
     m_treatAsFixedPitch = m_platformData.font().fixedPitch();
 }
 
-bool SimpleFontData::containsCharacters(const UChar*, int length) const
+bool SimpleFontData::containsCharacters(const UChar*, int) const
 {
     return true;
 }
diff --git a/WebCore/platform/graphics/qt/StillImageQt.h b/WebCore/platform/graphics/qt/StillImageQt.h
index 2b2c1f7..6c417b1 100644
--- a/WebCore/platform/graphics/qt/StillImageQt.h
+++ b/WebCore/platform/graphics/qt/StillImageQt.h
@@ -41,7 +41,7 @@ namespace WebCore {
 
         // FIXME: StillImages are underreporting decoded sizes and will be unable
         // to prune because these functions are not implemented yet.
-        virtual void destroyDecodedData(bool destroyAll = true) { }
+        virtual void destroyDecodedData(bool destroyAll = true) { Q_UNUSED(destroyAll); }
         virtual unsigned decodedSize() const { return 0; }
 
         virtual IntSize size() const;
diff --git a/WebCore/platform/graphics/skia/GradientSkia.cpp b/WebCore/platform/graphics/skia/GradientSkia.cpp
index 3bdddb2..268b17e 100644
--- a/WebCore/platform/graphics/skia/GradientSkia.cpp
+++ b/WebCore/platform/graphics/skia/GradientSkia.cpp
@@ -152,19 +152,21 @@ SkShader* Gradient::platformGradient()
     }
 
     if (m_radial) {
-        // FIXME: CSS radial Gradients allow an offset focal point (the
-        // "start circle"), but skia doesn't seem to support that, so this just
-        // ignores m_p0/m_r0 and draws the gradient centered in the "end
-        // circle" (m_p1/m_r1).
-        // See http://webkit.org/blog/175/introducing-css-gradients/ for a
-        // description of the expected behavior.
-        
-        // The radius we give to Skia must be positive (and non-zero).  If
-        // we're given a zero radius, just ask for a very small radius so
-        // Skia will still return an object.
-        SkScalar radius = m_r1 > 0 ? WebCoreFloatToSkScalar(m_r1) : SK_ScalarMin;
-        m_gradient = SkGradientShader::CreateRadial(m_p1,
-            radius, colors, pos, static_cast<int>(countUsed), tile);
+        // Since the two-point radial gradient is slower than the plain radial,
+        // only use it if we have to.
+        if (m_p0 != m_p1) {
+            // The radii we give to Skia must be positive.  If we're given a 
+            // negative radius, ask for zero instead.
+            SkScalar radius0 = m_r0 >= 0.0f ? WebCoreFloatToSkScalar(m_r0) : 0;
+            SkScalar radius1 = m_r1 >= 0.0f ? WebCoreFloatToSkScalar(m_r1) : 0;
+            m_gradient = SkGradientShader::CreateTwoPointRadial(m_p0, radius0, m_p1, radius1, colors, pos, static_cast<int>(countUsed), tile);
+        } else {
+            // The radius we give to Skia must be positive (and non-zero).  If
+            // we're given a zero radius, just ask for a very small radius so
+            // Skia will still return an object.
+            SkScalar radius = m_r1 > 0 ? WebCoreFloatToSkScalar(m_r1) : SK_ScalarMin;
+            m_gradient = SkGradientShader::CreateRadial(m_p1, radius, colors, pos, static_cast<int>(countUsed), tile);
+        }
     } else {
         SkPoint pts[2] = { m_p0, m_p1 };
         m_gradient = SkGradientShader::CreateLinear(pts, colors, pos,
diff --git a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index bbb42c9..c9f1349 100644
--- a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -31,11 +31,11 @@
 #include "config.h"
 #include "GraphicsContext.h"
 
-#include "GraphicsContextPlatformPrivate.h"
-#include "GraphicsContextPrivate.h"
 #include "Color.h"
 #include "FloatRect.h"
 #include "Gradient.h"
+#include "GraphicsContextPlatformPrivate.h"
+#include "GraphicsContextPrivate.h"
 #include "ImageBuffer.h"
 #include "IntRect.h"
 #include "NativeImageSkia.h"
@@ -46,9 +46,9 @@
 #include "SkBitmap.h"
 #include "SkBlurDrawLooper.h"
 #include "SkCornerPathEffect.h"
-#include "skia/ext/platform_canvas.h"
-#include "SkiaUtils.h"
 #include "SkShader.h"
+#include "SkiaUtils.h"
+#include "skia/ext/platform_canvas.h"
 
 #include <math.h>
 #include <wtf/Assertions.h>
@@ -60,6 +60,23 @@ namespace WebCore {
 
 namespace {
 
+inline int fastMod(int value, int max)
+{
+    int sign = SkExtractSign(value);
+    
+    value = SkApplySign(value, sign);
+    if (value >= max)
+        value %= max;
+    return SkApplySign(value, sign);
+}
+
+inline float square(float n)
+{
+    return n * n;
+}
+
+}  // namespace
+
 // "Seatbelt" functions ------------------------------------------------------
 //
 // These functions check certain graphics primitives for being "safe".
@@ -195,23 +212,6 @@ void addCornerArc(SkPath* path, const SkRect& rect, const IntSize& size, int sta
     path->arcTo(r, SkIntToScalar(startAngle), SkIntToScalar(90), false);
 }
 
-inline int fastMod(int value, int max)
-{
-    int sign = SkExtractSign(value);
-
-    value = SkApplySign(value, sign);
-    if (value >= max)
-        value %= max;
-    return SkApplySign(value, sign);
-}
-
-inline float square(float n)
-{
-    return n * n;
-}
-
-}  // namespace
-
 // -----------------------------------------------------------------------------
 
 // This may be called with a NULL pointer to create a graphics context that has
@@ -293,7 +293,7 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
     path.addOval(r, SkPath::kCW_Direction);
     // only perform the inset if we won't invert r
     if (2 * thickness < rect.width() && 2 * thickness < rect.height()) {
-        r.inset(SkIntToScalar(thickness) ,SkIntToScalar(thickness));
+        r.inset(SkIntToScalar(thickness), SkIntToScalar(thickness));
         path.addOval(r, SkPath::kCCW_Direction);
     }
     platformContext()->canvas()->clipPath(path);
@@ -403,6 +403,9 @@ void GraphicsContext::clipPath(WindRule clipRule)
         return;
 
     SkPath path = platformContext()->currentPathInLocalCoordinates();
+    if (!isPathSkiaSafe(getCTM(), path))
+        return;
+
     path.setFillType(clipRule == RULE_EVENODD ? SkPath::kEvenOdd_FillType : SkPath::kWinding_FillType);
     platformContext()->canvas()->clipPath(path);
 }
@@ -487,7 +490,7 @@ void GraphicsContext::drawFocusRing(const Color& color)
 
     const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
-    if (0 == rectCount)
+    if (!rectCount)
         return;
 
     SkRegion focusRingRegion;
@@ -521,26 +524,28 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         return;
 
     SkPaint paint;
-    SkPoint pts[2] = { (SkPoint)point1, (SkPoint)point2 };
-    if (!isPointSkiaSafe(getCTM(), pts[0]) || !isPointSkiaSafe(getCTM(), pts[1]))
+    if (!isPointSkiaSafe(getCTM(), point1) || !isPointSkiaSafe(getCTM(), point2))
         return;
 
+    FloatPoint p1 = point1;
+    FloatPoint p2 = point2;
+    bool isVerticalLine = (p1.x() == p2.x());
+    int width = roundf(strokeThickness());
+
     // We know these are vertical or horizontal lines, so the length will just
     // be the sum of the displacement component vectors give or take 1 -
     // probably worth the speed up of no square root, which also won't be exact.
-    SkPoint disp = pts[1] - pts[0];
-    int length = SkScalarRound(disp.fX + disp.fY);
+    FloatSize disp = p2 - p1;
+    int length = SkScalarRound(disp.width() + disp.height());
     platformContext()->setupPaintForStroking(&paint, 0, length);
-    int width = roundf(strokeThickness());
-    bool isVerticalLine = pts[0].fX == pts[1].fX;
 
     if (strokeStyle() == DottedStroke || strokeStyle() == DashedStroke) {
         // Do a rect fill of our endpoints.  This ensures we always have the
         // appearance of being a border.  We then draw the actual dotted/dashed line.
 
         SkRect r1, r2;
-        r1.set(pts[0].fX, pts[0].fY, pts[0].fX + width, pts[0].fY + width);
-        r2.set(pts[1].fX, pts[1].fY, pts[1].fX + width, pts[1].fY + width);
+        r1.set(p1.x(), p1.y(), p1.x() + width, p1.y() + width);
+        r2.set(p2.x(), p2.y(), p2.x() + width, p2.y() + width);
 
         if (isVerticalLine) {
             r1.offset(-width / 2, 0);
@@ -553,35 +558,11 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         fillPaint.setColor(paint.getColor());
         platformContext()->canvas()->drawRect(r1, fillPaint);
         platformContext()->canvas()->drawRect(r2, fillPaint);
-
-        // Since we've already rendered the endcaps, adjust the endpoints to
-        // exclude them from the line itself.
-        if (isVerticalLine) {
-            pts[0].fY += width;
-            pts[1].fY -= width;
-        } else {
-            pts[0].fX += width;
-            pts[1].fX -= width;
-        }
     }
 
-    // "Borrowed" this comment and idea from GraphicsContextCG.cpp
-    //
-    // For odd widths, we add in 0.5 to the appropriate x/y so that the float
-    // arithmetic works out.  For example, with a border width of 3, KHTML will
-    // pass us (y1+y2)/2, e.g., (50+53)/2 = 103/2 = 51 when we want 51.5.  It is
-    // always true that an even width gave us a perfect position, but an odd
-    // width gave us a position that is off by exactly 0.5.
+    adjustLineToPixelBoundaries(p1, p2, width, penStyle);
+    SkPoint pts[2] = { (SkPoint)p1, (SkPoint)p2 };
 
-    if (width & 1) {  // Odd.
-        if (isVerticalLine) {
-            pts[0].fX = pts[0].fX + SK_ScalarHalf;
-            pts[1].fX = pts[0].fX;
-        } else {  // Horizontal line
-            pts[0].fY = pts[0].fY + SK_ScalarHalf;
-            pts[1].fY = pts[0].fY;
-        }
-    }
     platformContext()->canvas()->drawPoints(SkCanvas::kLines_PointMode, 2, pts, paint);
 }
 
@@ -844,9 +825,9 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
     deviceLowerRight.setY(roundf(deviceLowerRight.y()));
 
     // Don't let the height or width round to 0 unless either was originally 0
-    if (deviceOrigin.y() == deviceLowerRight.y() && rect.height() != 0)
+    if (deviceOrigin.y() == deviceLowerRight.y() && rect.height())
         deviceLowerRight.move(0, 1);
-    if (deviceOrigin.x() == deviceLowerRight.x() && rect.width() != 0)
+    if (deviceOrigin.x() == deviceLowerRight.x() && rect.width())
         deviceLowerRight.move(1, 0);
 
     FloatPoint roundedOrigin(deviceOrigin.x() / deviceScaleX,
@@ -919,7 +900,7 @@ void GraphicsContext::setLineDash(const DashArray& dashes, float dashOffset)
         return;
     }
 
-    size_t count = (dashLength % 2) == 0 ? dashLength : dashLength * 2;
+    size_t count = !(dashLength % 2) ? dashLength : dashLength * 2;
     SkScalar* intervals = new SkScalar[count];
 
     for (unsigned int i = 0; i < count; i++)
@@ -990,8 +971,8 @@ void GraphicsContext::setPlatformShadow(const IntSize& size,
         return;
 
     // Detect when there's no effective shadow and clear the looper.
-    if (size.width() == 0 && size.height() == 0 && blurInt == 0) {
-        platformContext()->setDrawLooper(NULL);
+    if (!size.width() && !size.height() && !blurInt) {
+        platformContext()->setDrawLooper(0);
         return;
     }
 
diff --git a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index 7935ff1..a5c8926 100644
--- a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -39,6 +39,7 @@
 #include "ImageData.h"
 #include "PlatformContextSkia.h"
 #include "PNGImageEncoder.h"
+#include "SkColorPriv.h"
 #include "SkiaUtils.h"
 
 using namespace std;
@@ -118,16 +119,16 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
     }
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
+template <Multiply multiplied>
+PassRefPtr<ImageData> getImageData(const IntRect& rect, const SkBitmap& bitmap, 
+                                   const IntSize& size)
 {
-    ASSERT(context());
-
     RefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
     unsigned char* data = result->data()->data()->data();
 
     if (rect.x() < 0 || rect.y() < 0 ||
-        (rect.x() + rect.width()) > m_size.width() ||
-        (rect.y() + rect.height()) > m_size.height())
+        (rect.x() + rect.width()) > size.width() ||
+        (rect.y() + rect.height()) > size.height())
         memset(data, 0, result->data()->length());
 
     int originX = rect.x();
@@ -137,8 +138,8 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originX = 0;
     }
     int endX = rect.x() + rect.width();
-    if (endX > m_size.width())
-        endX = m_size.width();
+    if (endX > size.width())
+        endX = size.width();
     int numColumns = endX - originX;
 
     int originY = rect.y();
@@ -148,11 +149,10 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originY = 0;
     }
     int endY = rect.y() + rect.height();
-    if (endY > m_size.height())
-        endY = m_size.height();
+    if (endY > size.height())
+        endY = size.height();
     int numRows = endY - originY;
 
-    const SkBitmap& bitmap = *context()->platformContext()->bitmap();
     ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
     SkAutoLockPixels bitmapLock(bitmap);
 
@@ -162,12 +162,21 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     for (int y = 0; y < numRows; ++y) {
         uint32_t* srcRow = bitmap.getAddr32(originX, originY + y);
         for (int x = 0; x < numColumns; ++x) {
-            SkColor color = SkPMColorToColor(srcRow[x]);
             unsigned char* destPixel = &destRow[x * 4];
-            destPixel[0] = SkColorGetR(color);
-            destPixel[1] = SkColorGetG(color);
-            destPixel[2] = SkColorGetB(color);
-            destPixel[3] = SkColorGetA(color);
+            if (multiplied == Unmultiplied) {
+                SkColor color = SkPMColorToColor(srcRow[x]);
+                destPixel[0] = SkColorGetR(color);
+                destPixel[1] = SkColorGetG(color);
+                destPixel[2] = SkColorGetB(color);
+                destPixel[3] = SkColorGetA(color);
+            } else {
+                // Input and output are both pre-multiplied, we just need to re-arrange the
+                // bytes from the bitmap format to RGBA.
+                destPixel[0] = SkGetPackedR32(srcRow[x]);
+                destPixel[1] = SkGetPackedG32(srcRow[x]);
+                destPixel[2] = SkGetPackedB32(srcRow[x]);
+                destPixel[3] = SkGetPackedA32(srcRow[x]);
+            }
         }
         destRow += destBytesPerRow;
     }
@@ -175,8 +184,19 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     return result;
 }
 
-void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect,
-                               const IntPoint& destPoint)
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Unmultiplied>(rect, *context()->platformContext()->bitmap(), m_size);
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Premultiplied>(rect, *context()->platformContext()->bitmap(), m_size);
+}
+
+template <Multiply multiplied>
+void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint& destPoint, 
+                  const SkBitmap& bitmap, const IntSize& size)
 {
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -184,27 +204,26 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect,
     int originX = sourceRect.x();
     int destX = destPoint.x() + sourceRect.x();
     ASSERT(destX >= 0);
-    ASSERT(destX < m_size.width());
+    ASSERT(destX < size.width());
     ASSERT(originX >= 0);
     ASSERT(originX < sourceRect.right());
 
     int endX = destPoint.x() + sourceRect.right();
-    ASSERT(endX <= m_size.width());
+    ASSERT(endX <= size.width());
 
     int numColumns = endX - destX;
 
     int originY = sourceRect.y();
     int destY = destPoint.y() + sourceRect.y();
     ASSERT(destY >= 0);
-    ASSERT(destY < m_size.height());
+    ASSERT(destY < size.height());
     ASSERT(originY >= 0);
     ASSERT(originY < sourceRect.bottom());
 
     int endY = destPoint.y() + sourceRect.bottom();
-    ASSERT(endY <= m_size.height());
+    ASSERT(endY <= size.height());
     int numRows = endY - destY;
 
-    const SkBitmap& bitmap = *context()->platformContext()->bitmap();
     ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
     SkAutoLockPixels bitmapLock(bitmap);
 
@@ -216,13 +235,27 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect,
         uint32_t* destRow = bitmap.getAddr32(destX, destY + y);
         for (int x = 0; x < numColumns; ++x) {
             const unsigned char* srcPixel = &srcRow[x * 4];
-            destRow[x] = SkPreMultiplyARGB(srcPixel[3], srcPixel[0],
-                                           srcPixel[1], srcPixel[2]);
+            if (multiplied == Unmultiplied)
+                destRow[x] = SkPreMultiplyARGB(srcPixel[3], srcPixel[0],
+                                               srcPixel[1], srcPixel[2]);
+            else
+                destRow[x] = SkPackARGB32(srcPixel[3], srcPixel[0],
+                                          srcPixel[1], srcPixel[2]);
         }
         srcRow += srcBytesPerRow;
     }
 }
 
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Unmultiplied>(source, sourceRect, destPoint, *context()->platformContext()->bitmap(), m_size);
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Premultiplied>(source, sourceRect, destPoint, *context()->platformContext()->bitmap(), m_size);
+}
+
 String ImageBuffer::toDataURL(const String&) const
 {
     // Encode the image into a vector.
diff --git a/WebCore/platform/graphics/skia/ImageSkia.cpp b/WebCore/platform/graphics/skia/ImageSkia.cpp
index 45c3dcd..ecab364 100644
--- a/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -41,6 +41,7 @@
 #include "PlatformContextSkia.h"
 #include "PlatformString.h"
 #include "SkiaUtils.h"
+#include "SkRect.h"
 #include "SkShader.h"
 #include "TransformationMatrix.h"
 
@@ -158,8 +159,8 @@ static void drawResampledBitmap(SkCanvas& canvas, SkPaint& paint, const NativeIm
     // We will always draw in integer sizes, so round the destination rect.
     SkIRect destRectRounded;
     destRect.round(&destRectRounded);
-    SkIRect resizedImageRect;  // Represents the size of the resized image.
-    resizedImageRect.set(0, 0, destRectRounded.width(), destRectRounded.height());
+    SkIRect resizedImageRect =  // Represents the size of the resized image.
+        { 0, 0, destRectRounded.width(), destRectRounded.height() };
 
     if (srcIsFull && bitmap.hasResizedBitmap(destRectRounded.width(), destRectRounded.height())) {
         // Yay, this bitmap frame already has a resized version.
@@ -196,25 +197,19 @@ static void drawResampledBitmap(SkCanvas& canvas, SkPaint& paint, const NativeIm
     } else {
         // We should only resize the exposed part of the bitmap to do the
         // minimal possible work.
-        gfx::Rect destBitmapSubset(destBitmapSubsetSkI.fLeft,
-                                   destBitmapSubsetSkI.fTop,
-                                   destBitmapSubsetSkI.width(),
-                                   destBitmapSubsetSkI.height());
 
         // Resample the needed part of the image.
         SkBitmap resampled = skia::ImageOperations::Resize(subset,
             skia::ImageOperations::RESIZE_LANCZOS3,
             destRectRounded.width(), destRectRounded.height(),
-            destBitmapSubset);
+            destBitmapSubsetSkI);
 
         // Compute where the new bitmap should be drawn. Since our new bitmap
         // may be smaller than the original, we have to shift it over by the
         // same amount that we cut off the top and left.
-        SkRect offsetDestRect = {
-            destBitmapSubset.x() + destRect.fLeft,
-            destBitmapSubset.y() + destRect.fTop,
-            destBitmapSubset.right() + destRect.fLeft,
-            destBitmapSubset.bottom() + destRect.fTop };
+        destBitmapSubsetSkI.offset(destRect.fLeft, destRect.fTop);
+        SkRect offsetDestRect;
+        offsetDestRect.set(destBitmapSubsetSkI);
 
         canvas.drawBitmapRect(resampled, 0, offsetDestRect, &paint);
     }
diff --git a/WebCore/platform/graphics/skia/ImageSourceSkia.cpp b/WebCore/platform/graphics/skia/ImageSourceSkia.cpp
deleted file mode 100644
index 1647b86..0000000
--- a/WebCore/platform/graphics/skia/ImageSourceSkia.cpp
+++ /dev/null
@@ -1,238 +0,0 @@
-/*
- * Copyright (c) 2008, Google Inc. All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-
-#include "config.h"
-#include "ImageSource.h"
-#include "SharedBuffer.h"
-
-#include "GIFImageDecoder.h"
-#include "ICOImageDecoder.h"
-#include "JPEGImageDecoder.h"
-#include "PNGImageDecoder.h"
-#include "BMPImageDecoder.h"
-#include "XBMImageDecoder.h"
-
-#include "SkBitmap.h"
-
-namespace WebCore {
-
-ImageDecoder* createDecoder(const Vector<char>& data)
-{
-    // We need at least 4 bytes to figure out what kind of image we're dealing with.
-    int length = data.size();
-    if (length < 4)
-        return 0;
-
-    const unsigned char* uContents = (const unsigned char*)data.data();
-    const char* contents = data.data();
-
-    // GIFs begin with GIF8(7 or 9).
-    if (strncmp(contents, "GIF8", 4) == 0)
-        return new GIFImageDecoder();
-
-    // Test for PNG.
-    if (uContents[0]==0x89 &&
-        uContents[1]==0x50 &&
-        uContents[2]==0x4E &&
-        uContents[3]==0x47)
-        return new PNGImageDecoder();
-
-    // JPEG
-    if (uContents[0]==0xFF &&
-        uContents[1]==0xD8 &&
-        uContents[2]==0xFF)
-        return new JPEGImageDecoder();
-
-    // BMP
-    if (strncmp(contents, "BM", 2) == 0)
-        return new BMPImageDecoder();
-
-    // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
-    // CURs begin with 2-byte 0 followed by 2-byte 2.
-    if (!memcmp(contents, "\000\000\001\000", 4) ||
-        !memcmp(contents, "\000\000\002\000", 4))
-        return new ICOImageDecoder();
-   
-    // XBMs require 8 bytes of info.
-    if (length >= 8 && strncmp(contents, "#define ", 8) == 0)
-        return new XBMImageDecoder();
-
-    // Give up. We don't know what the heck this is.
-    return 0;
-}
-
-ImageSource::ImageSource()
-    : m_decoder(0)
-{}
-
-ImageSource::~ImageSource()
-{
-    clear(true);
-}
-
-void ImageSource::clear(bool destroyAll, size_t clearBeforeFrame, SharedBuffer* data, bool allDataReceived)
-{
-    if (!destroyAll) {
-        if (m_decoder)
-            m_decoder->clearFrameBufferCache(clearBeforeFrame);
-        return;
-    }
-
-    delete m_decoder;
-    m_decoder = 0;
-    if (data)
-        setData(data, allDataReceived);
-}
-
-bool ImageSource::initialized() const
-{
-    return m_decoder;
-}
-
-void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
-{
-    // Make the decoder by sniffing the bytes.
-    // This method will examine the data and instantiate an instance of the appropriate decoder plugin.
-    // If insufficient bytes are available to determine the image type, no decoder plugin will be
-    // made.
-    if (!m_decoder)
-        m_decoder = createDecoder(data->buffer());
-
-    // CreateDecoder will return NULL if the decoder could not be created. Plus,
-    // we should not send more data to a decoder which has already decided it
-    // has failed.
-    if (!m_decoder || m_decoder->failed())
-        return;
-    m_decoder->setData(data, allDataReceived);
-}
-
-bool ImageSource::isSizeAvailable()
-{
-    if (!m_decoder)
-        return false;
-
-    return m_decoder->isSizeAvailable();
-}
-
-IntSize ImageSource::size() const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->size();
-}
-
-IntSize ImageSource::frameSizeAtIndex(size_t index) const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->frameSizeAtIndex(index);
-}
-
-int ImageSource::repetitionCount()
-{
-    if (!m_decoder)
-        return cAnimationNone;
-
-    return m_decoder->repetitionCount();
-}
-
-size_t ImageSource::frameCount() const
-{
-    if (!m_decoder)
-        return 0;
-    return m_decoder->failed() ? 0 : m_decoder->frameCount();
-}
-
-NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    // Note that the buffer can have NULL bytes even when it is marked as
-    // non-empty. It seems "FrameEmpty" is only set before the frame has been
-    // initialized. If it is decoded and it happens to be empty, it will be
-    // marked as "FrameComplete" but will still have NULL bytes.
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return 0;
-
-    // Copy the bitmap.  The pixel data is refcounted internally by SkBitmap, so
-    // this doesn't cost much.  
-    return buffer->asNewNativeImage();
-}
-
-bool ImageSource::frameIsCompleteAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return false;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    return buffer && buffer->status() == RGBA32Buffer::FrameComplete;
-}
-
-float ImageSource::frameDurationAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return 0;
-
-    // Many annoying ads specify a 0 duration to make an image flash as quickly
-    // as possible.  We follow WinIE's behavior and use a duration of 100 ms
-    // for any frames that specify a duration of <= 50 ms.  See
-    // <http://bugs.webkit.org/show_bug.cgi?id=14413> or Radar 4051389 for
-    // more.
-    const float duration = buffer->duration() / 1000.0f;
-    return (duration < 0.051f) ? 0.100f : duration;
-}
-
-bool ImageSource::frameHasAlphaAtIndex(size_t index)
-{
-    if (!m_decoder || !m_decoder->supportsAlpha())
-        return false;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return false;
-
-    return buffer->hasAlpha();
-}
-
-String ImageSource::filenameExtension() const
-{
-    return m_decoder ? m_decoder->filenameExtension() : String();
-}
-
-}
diff --git a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index e0a292c..1fb62fc 100644
--- a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -46,6 +46,11 @@
 
 #include <wtf/MathExtras.h>
 
+namespace WebCore 
+{
+extern bool isPathSkiaSafe(const SkMatrix& transform, const SkPath& path);
+}
+
 // State -----------------------------------------------------------------------
 
 // Encapsulates the additional painting state information we store for each
@@ -278,6 +283,7 @@ void PlatformContextSkia::drawRect(SkRect rect)
         SkShader* oldFillShader = m_state->m_fillShader;
         oldFillShader->safeRef();
         setFillColor(m_state->m_strokeColor);
+        paint.reset();
         setupPaintForFilling(&paint);
         SkRect topBorder = { rect.fLeft, rect.fTop, rect.fRight, rect.fTop + 1 };
         canvas()->drawRect(topBorder, paint);
@@ -295,7 +301,7 @@ void PlatformContextSkia::drawRect(SkRect rect)
 
 void PlatformContextSkia::setupPaintCommon(SkPaint* paint) const
 {
-#ifdef SK_DEBUGx
+#if defined(SK_DEBUG)
     {
         SkPaint defaultPaint;
         SkASSERT(*paint == defaultPaint);
diff --git a/WebCore/platform/graphics/win/FontCGWin.cpp b/WebCore/platform/graphics/win/FontCGWin.cpp
index 803f5db..e2ed130 100644
--- a/WebCore/platform/graphics/win/FontCGWin.cpp
+++ b/WebCore/platform/graphics/win/FontCGWin.cpp
@@ -297,6 +297,30 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* fo
     CGContextRef cgContext = graphicsContext->platformContext();
     bool shouldUseFontSmoothing = WebCoreShouldUseFontSmoothing();
 
+    switch(fontDescription().fontSmoothing()) {
+    case Antialiased: {
+        graphicsContext->setShouldAntialias(true);
+        shouldUseFontSmoothing = false;
+        break;
+    }
+    case SubpixelAntialiased: {
+        graphicsContext->setShouldAntialias(true);
+        shouldUseFontSmoothing = true;
+        break;
+    }
+    case NoSmoothing: {
+        graphicsContext->setShouldAntialias(false);
+        shouldUseFontSmoothing = false;
+        break;
+    }
+    case AutoSmoothing: {
+        // For the AutoSmooth case, don't do anything! Keep the default settings.
+        break; 
+    }
+    default: 
+        ASSERT_NOT_REACHED();
+    }
+
     if (font->platformData().useGDI()) {
         if (!shouldUseFontSmoothing || (graphicsContext->textDrawingMode() & cTextStroke)) {
             drawGDIGlyphs(graphicsContext, font, glyphBuffer, from, numGlyphs, point);
diff --git a/WebCore/platform/graphics/win/FontCacheWin.cpp b/WebCore/platform/graphics/win/FontCacheWin.cpp
index 887bf79..8663623 100644
--- a/WebCore/platform/graphics/win/FontCacheWin.cpp
+++ b/WebCore/platform/graphics/win/FontCacheWin.cpp
@@ -33,8 +33,9 @@
 #include "SimpleFontData.h"
 #include "StringHash.h"
 #include "UnicodeRange.h"
-#include <windows.h>
 #include <mlang.h>
+#include <windows.h>
+#include <wtf/StdLibExtras.h>
 #if PLATFORM(CG)
 #include <ApplicationServices/ApplicationServices.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
@@ -305,7 +306,17 @@ FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription& fo
     // FIXME: Would be even better to somehow get the user's default font here.  For now we'll pick
     // the default that the user would get without changing any prefs.
     static AtomicString timesStr("Times New Roman");
-    return getCachedFontPlatformData(fontDescription, timesStr);
+    if (FontPlatformData* platformFont = getCachedFontPlatformData(fontDescription, timesStr))
+        return platformFont;
+
+    DEFINE_STATIC_LOCAL(String, defaultGUIFontFamily, ());
+    if (defaultGUIFontFamily.isEmpty()) {
+        HFONT defaultGUIFont = static_cast<HFONT>(GetStockObject(DEFAULT_GUI_FONT));
+        LOGFONT logFont;
+        GetObject(defaultGUIFont, sizeof(logFont), &logFont);
+        defaultGUIFontFamily = String(logFont.lfFaceName, wcsnlen(logFont.lfFaceName, LF_FACESIZE));
+    }
+    return getCachedFontPlatformData(fontDescription, defaultGUIFontFamily);
 }
 
 static LONG toGDIFontWeight(FontWeight fontWeight)
diff --git a/WebCore/platform/graphics/win/FontDatabase.cpp b/WebCore/platform/graphics/win/FontDatabase.cpp
index 1308ff0..d0773ea 100644
--- a/WebCore/platform/graphics/win/FontDatabase.cpp
+++ b/WebCore/platform/graphics/win/FontDatabase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -99,17 +99,12 @@ static RetainPtr<CFPropertyListRef> readFontPlist()
     return plist;
 }
 
-static bool populateFontDatabaseFromPlist()
+static bool populateFontDatabaseFromPlist(CFPropertyListRef plist)
 {
-    RetainPtr<CFPropertyListRef> plist = readFontPlist();
     if (!plist)
         return false;
 
-    RetainPtr<CFDataRef> data(AdoptCF, CFPropertyListCreateXMLData(0, plist.get()));
-    if (!data)
-        return false;
-
-    wkAddFontsFromPlistRepresentation(data.get());
+    wkAddFontsFromPlist(plist);
     return true;
 }
 
@@ -123,15 +118,69 @@ static bool populateFontDatabaseFromFileSystem()
     return true;
 }
 
-static void writeFontDatabaseToPlist()
+static CFStringRef fontFilenamesFromRegistryKey()
+{
+    static CFStringRef key = CFSTR("WebKitFontFilenamesFromRegistry");
+    return key;
+}
+
+static void writeFontDatabaseToPlist(CFPropertyListRef cgFontDBPropertyList, CFPropertyListRef filenamesFromRegistry)
 {
-    RetainPtr<CFDataRef> data(AdoptCF, wkCreateFontsPlistRepresentation());
+    if (!cgFontDBPropertyList)
+        return;
+
+    RetainPtr<CFDataRef> data;
+
+    if (!filenamesFromRegistry || CFGetTypeID(cgFontDBPropertyList) != CFDictionaryGetTypeID())
+        data.adoptCF(CFPropertyListCreateXMLData(kCFAllocatorDefault, cgFontDBPropertyList));
+    else {
+        RetainPtr<CFMutableDictionaryRef> dictionary(AdoptCF, CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 2, static_cast<CFDictionaryRef>(cgFontDBPropertyList)));
+        CFDictionarySetValue(dictionary.get(), fontFilenamesFromRegistryKey(), filenamesFromRegistry);
+        data.adoptCF(CFPropertyListCreateXMLData(kCFAllocatorDefault, dictionary.get()));
+    }
+
     if (!data)
         return;
 
     safeCreateFile(fontsPlistPath(), data.get());
 }
 
+static RetainPtr<CFArrayRef> fontFilenamesFromRegistry()
+{
+    RetainPtr<CFMutableArrayRef> filenames(AdoptCF, CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks));
+
+    HKEY key;
+    if (FAILED(RegOpenKeyEx(HKEY_LOCAL_MACHINE, TEXT("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Fonts"), 0, KEY_READ, &key)))
+        return filenames;
+
+    DWORD valueCount;
+    DWORD maxNameLength;
+    DWORD maxValueLength;
+    if (FAILED(RegQueryInfoKey(key, 0, 0, 0, 0, 0, 0, &valueCount, &maxNameLength, &maxValueLength, 0, 0))) {
+        RegCloseKey(key);
+        return filenames;
+    }
+
+    Vector<TCHAR> name(maxNameLength + 1);
+    Vector<BYTE> value(maxValueLength + 1);
+
+    for (size_t i = 0; i < valueCount; ++i) {
+        DWORD nameLength = name.size();
+        DWORD valueLength = value.size();
+        DWORD type;
+        if (FAILED(RegEnumValue(key, i, name.data(), &nameLength, 0, &type, value.data(), &valueLength)))
+            continue;
+        if (type != REG_SZ)
+            continue;
+
+        RetainPtr<CFDataRef> filename(AdoptCF, CFDataCreate(kCFAllocatorDefault, value.data(), valueLength));
+        CFArrayAppendValue(filenames.get(), filename.get());
+    }
+
+    RegCloseKey(key);
+    return filenames;
+}
+
 void populateFontDatabase()
 {
     static bool initialized;
@@ -139,12 +188,27 @@ void populateFontDatabase()
         return;
     initialized = true;
 
-    if (!systemHasFontsNewerThanFontsPlist())
-        if (populateFontDatabaseFromPlist())
+    RetainPtr<CFPropertyListRef> propertyList = readFontPlist();
+    RetainPtr<CFArrayRef> lastFilenamesFromRegistry;
+    if (propertyList && CFGetTypeID(propertyList.get()) == CFDictionaryGetTypeID()) {
+        CFDictionaryRef dictionary = static_cast<CFDictionaryRef>(propertyList.get());
+        CFArrayRef array = static_cast<CFArrayRef>(CFDictionaryGetValue(dictionary, fontFilenamesFromRegistryKey()));
+        if (array && CFGetTypeID(array) == CFArrayGetTypeID())
+            lastFilenamesFromRegistry = array;
+    }
+    RetainPtr<CFArrayRef> currentFilenamesFromRegistry = fontFilenamesFromRegistry();
+    bool registryChanged = !lastFilenamesFromRegistry || !CFEqual(lastFilenamesFromRegistry.get(), currentFilenamesFromRegistry.get());
+
+    if (!registryChanged && !systemHasFontsNewerThanFontsPlist()) {
+        if (populateFontDatabaseFromPlist(propertyList.get()))
             return;
+    }
 
-    if (populateFontDatabaseFromFileSystem())
-        writeFontDatabaseToPlist();
+    if (populateFontDatabaseFromFileSystem()) {
+        wkAddFontsFromRegistry();
+        RetainPtr<CFPropertyListRef> cgFontDBPropertyList(AdoptCF, wkCreateFontsPlist());
+        writeFontDatabaseToPlist(cgFontDBPropertyList.get(), currentFilenamesFromRegistry.get());
+    }
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/win/FontPlatformData.h b/WebCore/platform/graphics/win/FontPlatformData.h
index 0660d90..5084469 100644
--- a/WebCore/platform/graphics/win/FontPlatformData.h
+++ b/WebCore/platform/graphics/win/FontPlatformData.h
@@ -78,7 +78,6 @@ public:
 #if PLATFORM(CG)
     CGFontRef cgFont() const { return m_cgFont.get(); }
 #elif PLATFORM(CAIRO)
-    void setFont(cairo_t* ft) const;
     cairo_font_face_t* fontFace() const { return m_fontFace; }
     cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
 #endif
diff --git a/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp b/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
index b56a71c..9fce68a 100644
--- a/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
+++ b/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
@@ -96,12 +96,6 @@ FontPlatformData::FontPlatformData(const FontPlatformData& source)
         m_scaledFont = cairo_scaled_font_reference(source.m_scaledFont);
 }
 
-void FontPlatformData::setFont(cairo_t* cr) const
-{
-    ASSERT(m_scaledFont);
-
-    cairo_set_scaled_font(cr, m_scaledFont);
-}
 
 FontPlatformData::~FontPlatformData()
 {
diff --git a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
index 9eaf54b..1923ecc 100644
--- a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
+++ b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
@@ -65,7 +65,7 @@ GraphicsContext::GraphicsContext(HDC hdc, bool hasAlpha)
     : m_common(createGraphicsContextPrivate())
     , m_data(new GraphicsContextPlatformPrivate(CGContextWithHDC(hdc, hasAlpha)))
 {
-    CGContextRelease(m_data->m_cgContext);
+    CGContextRelease(m_data->m_cgContext.get());
     m_data->m_hdc = hdc;
     setPaintingDisabled(!m_data->m_cgContext);
     if (m_data->m_cgContext) {
@@ -98,7 +98,7 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
         CGColorSpaceRelease(deviceRGB);
 
         CGImageRef image = CGBitmapContextCreateImage(bitmapContext);
-        CGContextDrawImage(m_data->m_cgContext, dstRect, image);
+        CGContextDrawImage(m_data->m_cgContext.get(), dstRect, image);
         
         // Delete all our junk.
         CGImageRelease(image);
@@ -121,7 +121,7 @@ void GraphicsContext::drawWindowsBitmap(WindowsBitmap* image, const IntPoint& po
     RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(imageData.get()));
     RetainPtr<CGImageRef> cgImage(AdoptCF, CGImageCreate(image->size().width(), image->size().height(), 8, 32, image->bytesPerRow(), deviceRGB.get(),
                                                          kCGBitmapByteOrder32Little | kCGImageAlphaFirst, dataProvider.get(), 0, true, kCGRenderingIntentDefault));
-    CGContextDrawImage(m_data->m_cgContext, CGRectMake(point.x(), point.y(), image->size().width(), image->size().height()), cgImage.get());   
+    CGContextDrawImage(m_data->m_cgContext.get(), CGRectMake(point.x(), point.y(), image->size().width(), image->size().height()), cgImage.get());   
 }
 
 void GraphicsContext::drawFocusRing(const Color& color)
@@ -243,7 +243,7 @@ void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint& point,
 
 void GraphicsContextPlatformPrivate::flush()
 {
-    CGContextFlush(m_cgContext);
+    CGContextFlush(m_cgContext.get());
 }
 
 }
diff --git a/WebCore/platform/graphics/win/ImageCGWin.cpp b/WebCore/platform/graphics/win/ImageCGWin.cpp
index 8a8e943..285fb71 100644
--- a/WebCore/platform/graphics/win/ImageCGWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCGWin.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "Image.h"
 #include "BitmapImage.h"
+#include "BitmapInfo.h"
 #include "GraphicsContext.h"
 #include <ApplicationServices/ApplicationServices.h>
 
@@ -34,6 +35,30 @@
 
 namespace WebCore {
 
+PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
+{
+    DIBSECTION dibSection;
+    if (!GetObject(hBitmap, sizeof(DIBSECTION), &dibSection))
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBitsPixel == 32);
+    if (dibSection.dsBm.bmBitsPixel != 32)
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBits);
+    if (!dibSection.dsBm.bmBits)
+        return 0;
+
+    RetainPtr<CGColorSpaceRef> deviceRGB(AdoptCF, CGColorSpaceCreateDeviceRGB());
+    RetainPtr<CGContextRef> bitmapContext(AdoptCF, CGBitmapContextCreate(dibSection.dsBm.bmBits, dibSection.dsBm.bmWidth, dibSection.dsBm.bmHeight, 8,
+        dibSection.dsBm.bmWidthBytes, deviceRGB.get(), kCGBitmapByteOrder32Little | kCGImageAlphaPremultipliedFirst));
+
+    // The BitmapImage takes ownership of this.
+    CGImageRef cgImage = CGBitmapContextCreateImage(bitmapContext.get());
+
+    return adoptRef(new BitmapImage(cgImage));
+}
+
 bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 {
     ASSERT(bmp);
diff --git a/WebCore/platform/graphics/win/ImageCairoWin.cpp b/WebCore/platform/graphics/win/ImageCairoWin.cpp
index 591375f..0b27438 100644
--- a/WebCore/platform/graphics/win/ImageCairoWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCairoWin.cpp
@@ -28,12 +28,33 @@
 #include "BitmapImage.h"
 #include "GraphicsContext.h"
 #include <cairo.h>
+#include <cairo-win32.h>
 
 #include <windows.h>
 #include "PlatformString.h"
 
 namespace WebCore {
 
+PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
+{
+    DIBSECTION dibSection;
+    if (!GetObject(hBitmap, sizeof(DIBSECTION), &dibSection))
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBitsPixel == 32);
+    if (dibSection.dsBm.bmBitsPixel != 32)
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBits);
+    if (!dibSection.dsBm.bmBits)
+        return 0;
+
+    cairo_surface_t* image = cairo_win32_surface_create_with_dib (CAIRO_FORMAT_ARGB32, dibSection.dsBm.bmWidth, dibSection.dsBm.bmHeight);
+
+    // The BitmapImage object takes over ownership of the cairo_surface_t*, so no need to destroy here.
+    return adoptRef(new BitmapImage(image));
+}
+
 bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 {
     ASSERT(bmp);
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
index eb7334e..15e1001 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
@@ -33,6 +33,8 @@
 #include "QTMovieWin.h"
 #include "ScrollView.h"
 #include "StringHash.h"
+#include "TimeRanges.h"
+#include "Timer.h"
 #include <wtf/HashSet.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
@@ -86,6 +88,50 @@ MediaPlayerPrivate::~MediaPlayerPrivate()
 {
 }
 
+class TaskTimer : TimerBase {
+public:
+    static void initialize();
+    
+private:
+    static void setTaskTimerDelay(double);
+    static void stopTaskTimer();
+
+    void fired();
+
+    static TaskTimer* s_timer;
+};
+
+TaskTimer* TaskTimer::s_timer = 0;
+
+void TaskTimer::initialize()
+{
+    if (s_timer)
+        return;
+
+    s_timer = new TaskTimer;
+
+    QTMovieWin::setTaskTimerFuncs(setTaskTimerDelay, stopTaskTimer);
+}
+
+void TaskTimer::setTaskTimerDelay(double delayInSeconds)
+{
+    ASSERT(s_timer);
+
+    s_timer->startOneShot(delayInSeconds);
+}
+
+void TaskTimer::stopTaskTimer()
+{
+    ASSERT(s_timer);
+
+    s_timer->stop();
+}
+
+void TaskTimer::fired()
+{
+    QTMovieWin::taskTimerFired();
+}
+
 void MediaPlayerPrivate::load(const String& url)
 {
     if (!QTMovieWin::initializeQuickTime()) {
@@ -95,6 +141,9 @@ void MediaPlayerPrivate::load(const String& url)
         return;
     }
 
+    // Initialize the task timer.
+    TaskTimer::initialize();
+
     if (m_networkState != MediaPlayer::Loading) {
         m_networkState = MediaPlayer::Loading;
         m_player->networkStateChanged();
@@ -241,6 +290,13 @@ bool MediaPlayerPrivate::hasVideo() const
     return m_qtMovie->hasVideo();
 }
 
+bool MediaPlayerPrivate::hasAudio() const
+{
+    if (!m_qtMovie)
+        return false;
+    return m_qtMovie->hasAudio();
+}
+
 void MediaPlayerPrivate::setVolume(float volume)
 {
     if (!m_qtMovie)
@@ -268,10 +324,14 @@ int MediaPlayerPrivate::dataRate() const
     return 0;
 }
 
-float MediaPlayerPrivate::maxTimeBuffered() const
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 {
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+    float loaded = maxTimeLoaded();
     // rtsp streams are not buffered
-    return m_isStreaming ? 0 : maxTimeLoaded();
+    if (!m_isStreaming && loaded > 0)
+        timeRanges->add(0, loaded);
+    return timeRanges.release();
 }
 
 float MediaPlayerPrivate::maxTimeSeekable() const
@@ -575,4 +635,3 @@ bool MediaPlayerPrivate::hasSingleSecurityOrigin() const
 }
 
 #endif
-
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
index f584148..4a3a28e 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
@@ -52,7 +52,8 @@ public:
     
     IntSize naturalSize() const;
     bool hasVideo() const;
-    
+    bool hasAudio() const;
+
     void load(const String& url);
     void cancelLoad();
     
@@ -76,7 +77,7 @@ public:
     MediaPlayer::NetworkState networkState() const { return m_networkState; }
     MediaPlayer::ReadyState readyState() const { return m_readyState; }
     
-    float maxTimeBuffered() const;
+    PassRefPtr<TimeRanges> buffered() const;
     float maxTimeSeekable() const;
     unsigned bytesLoaded() const;
     bool totalBytesKnown() const;
diff --git a/WebCore/platform/graphics/win/QTMovieWin.cpp b/WebCore/platform/graphics/win/QTMovieWin.cpp
index aaa61f1..56f3d0b 100644
--- a/WebCore/platform/graphics/win/QTMovieWin.cpp
+++ b/WebCore/platform/graphics/win/QTMovieWin.cpp
@@ -62,10 +62,13 @@ static HashSet<QTMovieWinPrivate*>* gTaskList;
 static Vector<CFStringRef>* gSupportedTypes = 0;
 static SInt32 quickTimeVersion = 0;
 
+static QTMovieWin::SetTaskTimerDelayFunc gSetTaskTimerDelay = 0;
+static QTMovieWin::StopTaskTimerFunc gStopTaskTimer = 0;
+
 static void updateTaskTimer(int maxInterval = 1000)
 {
     if (!gTaskList->size()) {
-        stopSharedTimer();
+        gStopTaskTimer();
         return;    
     }
     
@@ -73,7 +76,7 @@ static void updateTaskTimer(int maxInterval = 1000)
     QTGetTimeUntilNextTask(&intervalInMS, 1000);
     if (intervalInMS > maxInterval)
         intervalInMS = maxInterval;
-    setSharedTimerFireDelay(static_cast<float>(intervalInMS) / 1000);
+    gSetTaskTimerDelay(static_cast<float>(intervalInMS) / 1000);
 }
 
 class QTMovieWinPrivate : public Noncopyable {
@@ -166,7 +169,7 @@ QTMovieWinPrivate::~QTMovieWinPrivate()
         CFRelease(m_currentURL);
 }
 
-static void taskTimerFired()
+void QTMovieWin::taskTimerFired()
 {
     // The hash content might change during task()
     Vector<QTMovieWinPrivate*> tasks;
@@ -867,6 +870,13 @@ bool QTMovieWin::hasVideo() const
     return (GetMovieIndTrackType(m_private->m_movie, 1, VisualMediaCharacteristic, movieTrackCharacteristic | movieTrackEnabledOnly));
 }
 
+bool QTMovieWin::hasAudio() const
+{
+    if (!m_private->m_movie)
+        return false;
+    return (GetMovieIndTrackType(m_private->m_movie, 1, AudioMediaCharacteristic, movieTrackCharacteristic | movieTrackEnabledOnly));
+}
+
 pascal OSErr movieDrawingCompleteProc(Movie movie, long data)
 {
     UppParam param;
@@ -990,6 +1000,12 @@ void QTMovieWin::getSupportedType(unsigned index, const UChar*& str, unsigned& l
     
 }
 
+void QTMovieWin::setTaskTimerFuncs(SetTaskTimerDelayFunc setTaskTimerDelay, StopTaskTimerFunc stopTaskTimer)
+{
+    gSetTaskTimerDelay = setTaskTimerDelay;
+    gStopTaskTimer = stopTaskTimer;
+}
+
 bool QTMovieWin::initializeQuickTime() 
 {
     static bool initialized = false;
@@ -1009,7 +1025,6 @@ bool QTMovieWin::initializeQuickTime()
             return false;
         }
         EnterMovies();
-        setSharedTimerFiredFunction(taskTimerFired);
         gMovieDrawingCompleteUPP = NewMovieDrawingCompleteUPP(movieDrawingCompleteProc);
         initializationSucceeded = true;
     }
@@ -1020,7 +1035,6 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
 {
     switch (fdwReason) {
         case DLL_PROCESS_ATTACH:
-            setSharedTimerInstanceHandle(hinstDLL);
             return TRUE;
         case DLL_PROCESS_DETACH:
         case DLL_THREAD_ATTACH:
diff --git a/WebCore/platform/graphics/win/QTMovieWin.h b/WebCore/platform/graphics/win/QTMovieWin.h
index f46efd3..d178eb8 100644
--- a/WebCore/platform/graphics/win/QTMovieWin.h
+++ b/WebCore/platform/graphics/win/QTMovieWin.h
@@ -59,6 +59,11 @@ class QTMOVIEWIN_API QTMovieWin {
 public:
     static bool initializeQuickTime();
 
+    typedef void (*SetTaskTimerDelayFunc)(double);
+    typedef void (*StopTaskTimerFunc)();
+    static void setTaskTimerFuncs(SetTaskTimerDelayFunc, StopTaskTimerFunc);
+    static void taskTimerFired();
+
     QTMovieWin(QTMovieWinClient*);
     ~QTMovieWin();
 
@@ -91,6 +96,7 @@ public:
     void setDisabled(bool);
 
     bool hasVideo() const;
+    bool hasAudio() const;
 
     static unsigned countSupportedTypes();
     static void getSupportedType(unsigned index, const UChar*& str, unsigned& len);
diff --git a/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp b/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
index 0343007..26b22af 100644
--- a/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
+++ b/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
@@ -119,10 +119,4 @@ float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
     return width * metricsMultiplier;
 }
 
-void SimpleFontData::setFont(cairo_t* cr) const
-{
-    ASSERT(cr);
-    m_platformData.setFont(cr);
-}
-
 }
diff --git a/WebCore/platform/graphics/wince/ColorWince.cpp b/WebCore/platform/graphics/wince/ColorWince.cpp
new file mode 100644
index 0000000..820b9d2
--- /dev/null
+++ b/WebCore/platform/graphics/wince/ColorWince.cpp
@@ -0,0 +1,38 @@
+/*
+ *  Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Color.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+Color focusRingColor()
+{
+    return Color(0, 0, 0);
+}
+
+void setFocusRingColorChangeFunction(void (*)())
+{
+    notImplemented();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp b/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
index 7c6853c..699ff25 100644
--- a/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
@@ -33,6 +33,11 @@ static CustomFontCache* g_customFontCache = 0;
 
 bool renameFont(SharedBuffer* fontData, const String& fontName);
 
+void setCustomFontCache(CustomFontCache* cache)
+{
+    g_customFontCache = cache;
+}
+
 FontCustomPlatformData::~FontCustomPlatformData()
 {
     if (g_customFontCache && !m_name.isEmpty())
@@ -66,11 +71,12 @@ static String createUniqueFontName()
     return fontName.replace('/', '_');
 }
 
-FontCustomPlatformData* createFontCustomPlatformData(CachedFont* cachedFont)
+FontCustomPlatformData* createFontCustomPlatformData(const SharedBuffer* buffer)
 {
-    if (g_customFontCache && cachedFont->CachedResource::data()) {
+    if (g_customFontCache) {
         String fontName = createUniqueFontName();
-        if (renameFont(cachedFont->CachedResource::data(), fontName) && g_customFontCache->registerFont(fontName, cachedFont))
+        RefPtr<SharedBuffer> localBuffer = SharedBuffer::create(buffer->data(), buffer->size());
+        if (renameFont(localBuffer.get(), fontName) && g_customFontCache->registerFont(fontName, localBuffer.get()))
             return new FontCustomPlatformData(fontName);
     }
     return 0;
diff --git a/WebCore/platform/graphics/wince/FontCustomPlatformData.h b/WebCore/platform/graphics/wince/FontCustomPlatformData.h
index b1f64a0..89d1fdd 100644
--- a/WebCore/platform/graphics/wince/FontCustomPlatformData.h
+++ b/WebCore/platform/graphics/wince/FontCustomPlatformData.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class CustomFontCache {
     public:
-        virtual bool registerFont(const String& fontName, CachedFont*) = 0;
+        virtual bool registerFont(const String& fontName, const SharedBuffer*) = 0;
         virtual void unregisterFont(const String& fontName) = 0;
     };
 
@@ -48,8 +48,8 @@ namespace WebCore {
         String m_name;
     };
 
-    FontCustomPlatformData* createFontCustomPlatformData(CachedFont*);
-
+    FontCustomPlatformData* createFontCustomPlatformData(const SharedBuffer*);
+    void setCustomFontCache(CustomFontCache*);
 }
 
 #endif
diff --git a/WebCore/platform/graphics/wince/GradientWince.cpp b/WebCore/platform/graphics/wince/GradientWince.cpp
new file mode 100644
index 0000000..49fa970
--- /dev/null
+++ b/WebCore/platform/graphics/wince/GradientWince.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Torch Mobile, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+
+#include "config.h"
+#include "Gradient.h"
+
+#include "GraphicsContext.h"
+
+namespace WebCore {
+
+void Gradient::platformDestroy()
+{
+}
+
+static inline bool compareStops(const Gradient::ColorStop& a, const Gradient::ColorStop& b)
+{
+    return a.stop < b.stop;
+}
+
+const Vector<Gradient::ColorStop>& Gradient::getStops() const
+{
+    if (!m_stopsSorted) {
+        if (m_stops.size())
+            std::stable_sort(m_stops.begin(), m_stops.end(), compareStops);
+        m_stopsSorted = true;
+    }
+    return m_stops;
+}
+
+void Gradient::fill(GraphicsContext* c, const FloatRect& r)
+{
+    c->fillRect(r, this);
+}
+
+}
diff --git a/WebCore/platform/graphics/wince/ImageBufferData.h b/WebCore/platform/graphics/wince/ImageBufferData.h
new file mode 100644
index 0000000..01b7d06
--- /dev/null
+++ b/WebCore/platform/graphics/wince/ImageBufferData.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2009 Torch Mobile, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef ImageBufferData_h
+#define ImageBufferData_h
+
+namespace WebCore {
+
+    class IntSize;
+    class ImageBufferData {
+    public:
+        ImageBufferData(const IntSize& size);
+        RefPtr<SharedBitmap> m_bitmap;
+    };
+
+}  // namespace WebCore
+
+#endif  // ImageBufferData_h
diff --git a/WebCore/platform/graphics/wince/ImageBufferWince.cpp b/WebCore/platform/graphics/wince/ImageBufferWince.cpp
new file mode 100644
index 0000000..3417f5f
--- /dev/null
+++ b/WebCore/platform/graphics/wince/ImageBufferWince.cpp
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2009 Torch Mobile, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "ImageBuffer.h"
+
+#include "Base64.h"
+#include "GraphicsContext.h"
+#include "Image.h"
+#include "ImageData.h"
+#include "JPEGEncoder.h"
+#include "PNGEncoder.h"
+#include "SharedBitmap.h"
+
+namespace WebCore {
+
+class BufferedImage: public Image {
+
+public:
+    BufferedImage(const ImageBufferData* data)
+        : m_data(data)
+    {
+    }
+
+    virtual IntSize size() const { return IntSize(m_data->m_bitmap->width(), m_data->m_bitmap->height()); }
+    virtual void destroyDecodedData(bool destroyAll = true) {}
+    virtual unsigned decodedSize() const { return 0; }
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+    virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
+                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+
+    const ImageBufferData* m_data;
+};
+
+void BufferedImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator compositeOp)
+{
+    IntRect intDstRect = enclosingIntRect(dstRect);
+    IntRect intSrcRect(srcRect);
+    m_data->m_bitmap->draw(ctxt, intDstRect, intSrcRect, compositeOp);
+}
+
+void BufferedImage::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRectIn, const TransformationMatrix& patternTransform,
+                             const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect)
+{
+    m_data->m_bitmap->drawPattern(ctxt, tileRectIn, patternTransform, phase, op, destRect, size());
+}
+
+ImageBufferData::ImageBufferData(const IntSize& size)
+: m_bitmap(SharedBitmap::createInstance(false, size.width(), size.height(), false))
+{
+    // http://www.w3.org/TR/2009/WD-html5-20090212/the-canvas-element.html#canvaspixelarray
+    // "When the canvas is initialized it must be set to fully transparent black."
+    m_bitmap->resetPixels(true);
+    m_bitmap->setHasAlpha(true);
+}
+
+ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace colorSpace, bool& success)
+    : m_data(size)
+    , m_size(size)
+{
+    // FIXME: colorSpace is not used
+    UNUSED_PARAM(colorSpace);
+
+    m_context.set(new GraphicsContext(0));
+    m_context->setBitmap(m_data.m_bitmap);
+    success = true;
+}
+
+ImageBuffer::~ImageBuffer()
+{
+}
+
+GraphicsContext* ImageBuffer::context() const
+{
+    return m_context.get();
+}
+
+Image* ImageBuffer::image() const
+{
+    if (!m_image)
+        m_image = adoptRef(new BufferedImage(&m_data));
+
+    return m_image.get();
+}
+
+template <bool premultiplied> PassRefPtr<ImageData>
+static getImageData(const IntRect& rect, const SharedBitmap* bitmap)
+{
+    PassRefPtr<ImageData> imageData = ImageData::create(rect.width(), rect.height());
+
+    const unsigned char* src = static_cast<const unsigned char*>(bitmap->bytes());
+    if (!src)
+        return imageData;
+
+    IntRect sourceRect(0, 0, bitmap->width(), bitmap->height());
+    sourceRect.intersect(rect);
+    if (sourceRect.isEmpty())
+        return imageData;
+
+    unsigned char* dst = imageData->data()->data()->data();
+    memset(dst, 0, imageData->data()->data()->length());
+    src += (sourceRect.y() * bitmap->width() + sourceRect.x()) * 4;
+    dst += ((sourceRect.y() - rect.y()) * imageData->width() + sourceRect.x() - rect.x()) * 4;
+    int bytesToCopy = sourceRect.width() * 4;
+    int srcSkip = (bitmap->width() - sourceRect.width()) * 4;
+    int dstSkip = (imageData->width() - sourceRect.width()) * 4;
+    const unsigned char* dstEnd = dst + sourceRect.height() * imageData->width() * 4;
+    while (dst < dstEnd) {
+        const unsigned char* dstRowEnd = dst + bytesToCopy;
+        while (dst < dstRowEnd) {
+            // Convert ARGB little endian to RGBA big endian
+            int blue = *src++;
+            int green = *src++;
+            int red = *src++;
+            int alpha = *src++;
+            if (premultiplied) {
+                *dst++ = static_cast<unsigned char>((red * alpha + 254) / 255);
+                *dst++ = static_cast<unsigned char>((green * alpha + 254) / 255);
+                *dst++ = static_cast<unsigned char>((blue * alpha + 254) / 255);
+                *dst++ = static_cast<unsigned char>(alpha);
+            } else {
+                *dst++ = static_cast<unsigned char>(red);
+                *dst++ = static_cast<unsigned char>(green);
+                *dst++ = static_cast<unsigned char>(blue);
+                *dst++ = static_cast<unsigned char>(alpha);
+                ++src;
+            }
+        }
+        src += srcSkip;
+        dst += dstSkip;
+    }
+
+    return imageData;
+}
+
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<false>(rect, m_data.m_bitmap.get());
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<true>(rect, m_data.m_bitmap.get());
+}
+
+template <bool premultiplied>
+static void putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint, SharedBitmap* bitmap)
+{
+    unsigned char* dst = (unsigned char*)bitmap->bytes();
+    if (!dst)
+        return;
+
+    IntRect destRect(destPoint, sourceRect.size());
+    destRect.intersect(IntRect(0, 0, bitmap->width(), bitmap->height()));
+
+    if (destRect.isEmpty())
+        return;
+
+    const unsigned char* src = source->data()->data()->data();
+    dst += (destRect.y() * bitmap->width() + destRect.x()) * 4;
+    src += (sourceRect.y() * source->width() + sourceRect.x()) * 4;
+    int bytesToCopy = destRect.width() * 4;
+    int dstSkip = (bitmap->width() - destRect.width()) * 4;
+    int srcSkip = (source->width() - destRect.width()) * 4;
+    const unsigned char* dstEnd = dst + destRect.height() * bitmap->width() * 4;
+    while (dst < dstEnd) {
+        const unsigned char* dstRowEnd = dst + bytesToCopy;
+        while (dst < dstRowEnd) {
+            // Convert RGBA big endian to ARGB little endian
+            int red = *src++;
+            int green = *src++;
+            int blue = *src++;
+            int alpha = *src++;
+            if (premultiplied) {
+                *dst++ = static_cast<unsigned char>(blue * 255 / alpha);
+                *dst++ = static_cast<unsigned char>(green * 255 / alpha);
+                *dst++ = static_cast<unsigned char>(red * 255 / alpha);
+                *dst++ = static_cast<unsigned char>(alpha);
+            } else {
+                *dst++ = static_cast<unsigned char>(blue);
+                *dst++ = static_cast<unsigned char>(green);
+                *dst++ = static_cast<unsigned char>(red);
+                *dst++ = static_cast<unsigned char>(alpha);
+            }
+        }
+        src += srcSkip;
+        dst += dstSkip;
+    }
+}
+
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<false>(source, sourceRect, destPoint, m_data.m_bitmap.get());
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<true>(source, sourceRect, destPoint, m_data.m_bitmap.get());
+}
+
+String ImageBuffer::toDataURL(const String& mimeType) const
+{
+    if (!m_data.m_bitmap->bytes())
+        return "data:,";
+
+    Vector<char> output;
+    const char* header;
+    if (mimeType.lower() == "image/png") {
+        if (!compressBitmapToPng(m_data.m_bitmap.get(), output))
+            return "data:,";
+        header = "data:image/png;base64,";
+    } else {
+        if (!compressBitmapToJpeg(m_data.m_bitmap.get(), output))
+            return "data:,";
+        header = "data:image/jpeg;base64,";
+    }
+
+    Vector<char> base64;
+    base64Encode(output, base64);
+
+    output.clear();
+
+    Vector<char> url;
+    url.append(header, strlen(header));
+    url.append(base64);
+
+    return String(url.data(), url.size());
+}
+
+}
diff --git a/WebCore/platform/graphics/wince/MediaPlayerPrivateWince.h b/WebCore/platform/graphics/wince/MediaPlayerPrivateWince.h
new file mode 100644
index 0000000..2d6c358
--- /dev/null
+++ b/WebCore/platform/graphics/wince/MediaPlayerPrivateWince.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MediaPlayerPrivateWince_h
+#define MediaPlayerPrivateWince_h
+
+#if ENABLE(VIDEO)
+
+#include "MediaPlayerPrivate.h"
+#include "Timer.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+    class GraphicsContext;
+    class IntSize;
+    class IntRect;
+    class String;
+
+    class MediaPlayerPrivate : public MediaPlayerPrivateInterface {
+    public:
+        static void registerMediaEngine(MediaEngineRegistrar);
+
+        ~MediaPlayerPrivate();
+
+        IntSize naturalSize() const;
+        bool hasVideo() const;
+
+        void load(const String& url);
+        void cancelLoad();
+
+        void play();
+        void pause();
+
+        bool paused() const;
+        bool seeking() const;
+
+        float duration() const;
+        float currentTime() const;
+        void seek(float time);
+        void setEndTime(float);
+
+        void setRate(float);
+        void setVolume(float);
+
+        int dataRate() const;
+
+        MediaPlayer::NetworkState networkState() const { return m_networkState; }
+        MediaPlayer::ReadyState readyState() const { return m_readyState; }
+
+        PassRefPtr<TimeRanges> buffered() const;
+        float maxTimeSeekable() const;
+        unsigned bytesLoaded() const;
+        bool totalBytesKnown() const;
+        unsigned totalBytes() const;
+
+        void setVisible(bool);
+        void setSize(const IntSize&);
+
+        void loadStateChanged();
+        void didEnd();
+
+        void paint(GraphicsContext*, const IntRect&);
+
+    private:
+        MediaPlayerPrivate(MediaPlayer*);
+
+        void updateStates();
+        void doSeek();
+        void cancelSeek();
+        void seekTimerFired(Timer<MediaPlayerPrivate>*);
+        float maxTimeLoaded() const;
+        void sawUnsupportedTracks();
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+        void setMediaPlayerProxy(WebMediaPlayerProxy*);
+        void setPoster(const String& url);
+        void deliverNotification(MediaPlayerProxyNotificationType);
+#endif
+
+        // engine support
+        static MediaPlayerPrivateInterface* create(MediaPlayer*);
+        static void getSupportedTypes(HashSet<String>& types);
+        static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+        static bool isAvailable();
+
+        MediaPlayer* m_player;
+        float m_seekTo;
+        float m_endTime;
+        Timer<MediaPlayerPrivate> m_seekTimer;
+        MediaPlayer::NetworkState m_networkState;
+        MediaPlayer::ReadyState m_readyState;
+        unsigned m_enabledTrackCount;
+        unsigned m_totalTrackCount;
+        bool m_hasUnsupportedTracks;
+        bool m_startedPlaying;
+        bool m_isStreaming;
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+        WebMediaPlayerProxy* m_proxy;
+#endif
+    };
+
+}
+
+#endif
+
+#endif
diff --git a/WebCore/platform/graphics/wince/MediaPlayerProxy.cpp b/WebCore/platform/graphics/wince/MediaPlayerProxy.cpp
new file mode 100644
index 0000000..9673d18
--- /dev/null
+++ b/WebCore/platform/graphics/wince/MediaPlayerProxy.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2009 Torch Mobile, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#if ENABLE(VIDEO)
+
+#include "config.h"
+#include "MediaPlayerProxy.h"
+
+#include "c_class.h"
+#include "c_instance.h"
+#include "c_runtime.h"
+#include "DocumentLoader.h"
+#include "HTMLPlugInElement.h"
+#include "HTMLVideoElement.h"
+#include "JSDOMBinding.h"
+#include "JSPluginElementFunctions.h"
+#include "MediaPlayer.h"
+#include "Node.h"
+#include "npruntime_impl.h"
+#include "PlatformString.h"
+#include "PluginView.h"
+#include "RenderPartObject.h"
+#include "RenderWidget.h"
+#include "runtime.h"
+#include <runtime/Identifier.h>
+#include "Widget.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+using namespace Bindings;
+using namespace HTMLNames;
+
+WebMediaPlayerProxy::WebMediaPlayerProxy(MediaPlayer* player)
+    : m_mediaPlayer(player)
+    , m_init(false)
+    , m_hasSentResponseToPlugin(false)
+{
+    if (!m_init)
+        initEngine();
+}
+
+WebMediaPlayerProxy::~WebMediaPlayerProxy()
+{
+    m_instance.release();
+}
+
+ScriptInstance WebMediaPlayerProxy::pluginInstance()
+{
+    if (!m_instance) {
+        RenderObject* r = element()->renderer();
+        if (!r || !r->isWidget())
+            return 0;
+
+        Frame* frame = element()->document()->frame();
+
+        RenderWidget* renderWidget = static_cast<RenderWidget*>(element()->renderer());
+        if (renderWidget && renderWidget->widget())
+            m_instance = frame->script()->createScriptInstanceForWidget(renderWidget->widget());
+    }
+
+    return m_instance;
+}
+
+void WebMediaPlayerProxy::load(const String& url)
+{
+    if (!m_init)
+        initEngine();
+    if (m_init)
+        invokeMethod("play");
+}
+
+void WebMediaPlayerProxy::initEngine()
+{
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_mediaPlayer->mediaPlayerClient());
+    String url = element->initialURL();
+
+    if (url.isEmpty())
+        return;
+
+    Frame* frame = element->document()->frame();
+    Vector<String> paramNames;
+    Vector<String> paramValues;
+    String serviceType;
+
+    // add all attributes set on the embed object
+    if (NamedNodeMap* attributes = element->attributes()) {
+        for (unsigned i = 0; i < attributes->length(); ++i) {
+            Attribute* it = attributes->attributeItem(i);
+            paramNames.append(it->name().localName().string());
+            paramValues.append(it->value().string());
+        }
+    }
+    serviceType = "application/x-mplayer2";
+    frame->loader()->requestObject(static_cast<RenderPartObject*>(element->renderer()), url, nullAtom, serviceType, paramNames, paramValues);
+    m_init = true;
+
+}
+
+HTMLMediaElement* WebMediaPlayerProxy::element()
+{
+    return static_cast<HTMLMediaElement*>(m_mediaPlayer->mediaPlayerClient());
+
+}
+
+void WebMediaPlayerProxy::invokeMethod(const String& methodName)
+{
+    Frame* frame = element()->document()->frame();
+    RootObject *root = frame->script()->bindingRootObject();
+    if (!root)
+        return;
+    ExecState *exec = root->globalObject()->globalExec();
+    Instance* instance = pluginInstance().get();
+    if (!instance)
+        return;
+
+    instance->begin();
+    Class *aClass = instance->getClass();
+    Identifier iden(exec, methodName);
+    MethodList methodList = aClass->methodsNamed(iden, instance);
+    ArgList args;
+    instance->invokeMethod(exec, methodList , args);
+    instance->end();
+}
+
+}
+
+#endif
diff --git a/WebCore/platform/graphics/wince/MediaPlayerProxy.h b/WebCore/platform/graphics/wince/MediaPlayerProxy.h
new file mode 100644
index 0000000..05f9b21
--- /dev/null
+++ b/WebCore/platform/graphics/wince/MediaPlayerProxy.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Torch Mobile, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+
+#ifndef MediaPlayerProxy_h
+#define MediaPlayerProxy_h
+
+#if ENABLE(VIDEO)
+
+#include "ScriptInstance.h"
+
+namespace WebCore {
+
+    class IntRect;
+    class IntSize;
+    class String;
+    class MediaPlayer;
+    class PluginView;
+    class HTMLMediaElement;
+
+    enum MediaPlayerProxyNotificationType {
+        MediaPlayerNotificationPlayPauseButtonPressed,
+        Idle,
+        Loading,
+        Loaded,
+        FormatError,
+        NetworkError,
+        DecodeError
+    };
+
+    class WebMediaPlayerProxy {
+    public:
+        WebMediaPlayerProxy(MediaPlayer* player);
+        ~WebMediaPlayerProxy();
+
+        MediaPlayer* mediaPlayer() {return m_mediaPlayer;}
+        void initEngine();
+        void load(const String& url);
+        HTMLMediaElement* element();
+        void invokeMethod(const String& methodName);
+        ScriptInstance pluginInstance();
+
+    private:
+        MediaPlayer* m_mediaPlayer;
+        bool m_init;
+        WebCore::PluginView* m_pluginView;
+        bool m_hasSentResponseToPlugin;
+        ScriptInstance m_instance;
+    };
+
+}
+#endif // ENABLE(VIDEO)
+
+#endif
diff --git a/WebCore/platform/graphics/wince/PathWince.cpp b/WebCore/platform/graphics/wince/PathWince.cpp
new file mode 100644
index 0000000..7589ccb
--- /dev/null
+++ b/WebCore/platform/graphics/wince/PathWince.cpp
@@ -0,0 +1,163 @@
+/*
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "Path.h"
+
+#include "FloatRect.h"
+#include "NotImplemented.h"
+#include "PlatformPathWince.h"
+#include "PlatformString.h"
+#include "TransformationMatrix.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+Path::Path()
+    : m_path(new PlatformPath())
+{
+}
+
+Path::Path(const Path& other)
+    : m_path(new PlatformPath(*other.m_path))
+{
+}
+
+Path::~Path()
+{
+    delete m_path;
+}
+
+Path& Path::operator=(const Path& other)
+{
+    if (&other != this) {
+        delete m_path;
+        m_path = new PlatformPath(*other.m_path);
+    }
+    return *this;
+}
+
+bool Path::contains(const FloatPoint& point, WindRule rule) const
+{
+    return m_path->contains(point, rule);
+}
+
+void Path::translate(const FloatSize& size)
+{
+    m_path->translate(size);
+}
+
+FloatRect Path::boundingRect() const
+{
+    return m_path->boundingRect();
+}
+
+void Path::moveTo(const FloatPoint& point)
+{
+    m_path->moveTo(point);
+}
+
+void Path::addLineTo(const FloatPoint& point)
+{
+    m_path->addLineTo(point);
+}
+
+void Path::addQuadCurveTo(const FloatPoint& cp, const FloatPoint& p)
+{
+    m_path->addQuadCurveTo(cp, p);
+}
+
+void Path::addBezierCurveTo(const FloatPoint& cp1, const FloatPoint& cp2, const FloatPoint& p)
+{
+    m_path->addBezierCurveTo(cp1, cp2, p);
+}
+
+void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
+{
+    m_path->addArcTo(p1, p2, radius);
+}
+
+void Path::closeSubpath()
+{
+    m_path->closeSubpath();
+}
+
+void Path::addArc(const FloatPoint& p, float r, float sar, float ear, bool anticlockwise)
+{
+    m_path->addEllipse(p, r, r, sar, ear, anticlockwise);
+}
+
+void Path::addRect(const FloatRect& r)
+{
+    m_path->addRect(r);
+}
+
+void Path::addEllipse(const FloatRect& r)
+{
+    m_path->addEllipse(r);
+}
+
+void Path::clear()
+{
+    m_path->clear();
+}
+
+bool Path::isEmpty() const
+{
+    return m_path->isEmpty();
+}
+
+String Path::debugString() const
+{
+    return m_path->debugString();
+}
+
+void Path::apply(void* info, PathApplierFunction function) const
+{
+    m_path->apply(info, function);
+}
+
+void Path::transform(const TransformationMatrix& t)
+{
+    m_path->transform(t);
+}
+
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier *)
+{
+    notImplemented();
+    return FloatRect();
+}
+
+bool Path::strokeContains(StrokeStyleApplier*, const FloatPoint&) const
+{
+    notImplemented();
+    return false;
+}
+
+bool Path::hasCurrentPoint() const
+{
+    // Not sure if this is correct. At the meantime, we do what other ports
+    // do.
+    // See https://bugs.webkit.org/show_bug.cgi?id=27266,
+    // https://bugs.webkit.org/show_bug.cgi?id=27187, and 
+    // http://trac.webkit.org/changeset/45873
+    return !isEmpty();
+}
+
+}
diff --git a/WebCore/platform/graphics/wince/PlatformPathWince.cpp b/WebCore/platform/graphics/wince/PlatformPathWince.cpp
new file mode 100644
index 0000000..66fad50
--- /dev/null
+++ b/WebCore/platform/graphics/wince/PlatformPathWince.cpp
@@ -0,0 +1,810 @@
+/*
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "PlatformPathWince.h"
+
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "Path.h"
+#include "PlatformString.h"
+#include "TransformationMatrix.h"
+#include "WinceGraphicsExtras.h"
+#include <wtf/MathExtras.h>
+#include <wtf/OwnPtr.h>
+
+#include <windows.h>
+
+namespace WebCore {
+
+// Implemented in GraphicsContextWince.cpp
+void getEllipsePointByAngle(double angle, double a, double b, float& x, float& y);
+
+static void quadCurve(int segments, Vector<PathPoint>& pts, const PathPoint* control)
+{
+    const float step = 1.0 / segments;
+    register float tA = 0.0;
+    register float tB = 1.0;
+
+    float c1x = control[0].x();
+    float c1y = control[0].y();
+    float c2x = control[1].x();
+    float c2y = control[1].y();
+    float c3x = control[2].x();
+    float c3y = control[2].y();
+
+    const int offset = pts.size();
+    pts.resize(offset + segments);
+    PathPoint pp;
+    pp.m_x = c1x;
+    pp.m_y = c1y;
+
+    for (int i = 1; i < segments; ++i) {
+        tA += step;
+        tB -= step;
+
+        const float a = tB * tB;
+        const float b = 2.0 * tA * tB;
+        const float c = tA * tA;
+
+        pp.m_x = c1x * a + c2x * b + c3x * c;
+        pp.m_y = c1y * a + c2y * b + c3y * c;
+
+        pts[offset + i - 1] = pp;
+    }
+
+    pp.m_x = c3x;
+    pp.m_y = c3y;
+    pts[offset + segments - 1] = pp;
+}
+
+static inline void bezier(int segments, Vector<PathPoint>& pts, const PathPoint* control)
+{
+    const float step = 1.0 / segments;
+    register float tA = 0.0;
+    register float tB = 1.0;
+
+    float c1x = control[0].x();
+    float c1y = control[0].y();
+    float c2x = control[1].x();
+    float c2y = control[1].y();
+    float c3x = control[2].x();
+    float c3y = control[2].y();
+    float c4x = control[3].x();
+    float c4y = control[3].y();
+
+    const int offset = pts.size();
+    pts.resize(offset + segments);
+    PathPoint pp;
+    pp.m_x = c1x;
+    pp.m_y = c1y;
+
+    for (int i = 1; i < segments; ++i) {
+        tA += step;
+        tB -= step;
+        const float tAsq = tA * tA;
+        const float tBsq = tB * tB;
+
+        const float a = tBsq * tB;
+        const float b = 3.0 * tA * tBsq;
+        const float c = 3.0 * tB * tAsq;
+        const float d = tAsq * tA;
+
+        pp.m_x = c1x * a + c2x * b + c3x * c + c4x * d;
+        pp.m_y = c1y * a + c2y * b + c3y * c + c4y * d;
+
+        pts[offset + i - 1] = pp;
+    }
+
+    pp.m_x = c4x;
+    pp.m_y = c4y;
+    pts[offset + segments - 1] = pp;
+}
+
+static bool containsPoint(const FloatRect& r, const FloatPoint& p)
+{
+    return p.x() >= r.x() && p.y() >= r.y() && p.x() < r.right() && p.y() < r.bottom();
+}
+
+static void normalizeAngle(float& angle)
+{
+    angle = fmod(angle, 2 * piFloat);
+    if (angle < 0)
+        angle += 2 * piFloat;
+    if (angle < 0.00001f)
+        angle = 0;
+}
+
+static void transformArcPoint(float& x, float& y, const FloatPoint& c)
+{
+    x += c.x();
+    y += c.y();
+}
+
+static void inflateRectToContainPoint(FloatRect& r, float x, float y)
+{
+    if (r.isEmpty()) {
+        r.setX(x);
+        r.setY(y);
+        r.setSize(FloatSize(1, 1));
+        return;
+    }
+    if (x < r.x()) {
+        r.setWidth(r.right() - x);
+        r.setX(x);
+    } else {
+        float w = x - r.x() + 1;
+        if (w > r.width())
+            r.setWidth(w);
+    }
+    if (y < r.y()) {
+        r.setHeight(r.bottom() - y);
+        r.setY(y);
+    } else {
+        float h =  y - r.y() + 1;
+        if (h > r.height())
+            r.setHeight(h);
+    }
+}
+
+// return 0-based value: 0 - first Quadrant ( 0 - 90 degree)
+static inline int quadrant(const PathPoint& point, const PathPoint& origin)
+{
+    return point.m_x < origin.m_x ?
+        (point.m_y < origin.m_y ? 2 : 1)
+        : (point.m_y < origin.m_y ? 3 : 0);
+}
+
+static inline bool isQuadrantOnLeft(int q) { return q == 1 || q == 2; }
+static inline bool isQuadrantOnRight(int q) { return q == 0 || q == 3; }
+static inline bool isQuadrantOnTop(int q) { return q == 2 || q == 3; }
+static inline bool isQuadrantOnBottom(int q) { return q == 0 || q == 1; }
+
+static inline int nextQuadrant(int q) { return q == 3 ? 0 : q + 1; }
+static inline int quadrantDiff(int q1, int q2)
+{
+    int d = q1 - q2;
+    while (d < 0)
+        d += 4;
+    return d;
+}
+
+struct PathVector {
+    float m_x;
+    float m_y;
+
+    PathVector() : m_x(0), m_y(0) {}
+    PathVector(float x, float y) : m_x(x), m_y(y) {}
+    double angle() const { return atan2(m_y, m_x); }
+    operator double () const { return angle(); }
+    double length() const { return _hypot(m_x, m_y); }
+};
+
+PathVector operator-(const PathPoint& p1, const PathPoint& p2)
+{
+    return PathVector(p1.m_x - p2.m_x, p1.m_y - p2.m_y);
+}
+
+static void addArcPoint(PathPolygon& poly, const PathPoint& center, const PathPoint& radius, double angle)
+{
+    PathPoint p;
+    getEllipsePointByAngle(angle, radius.m_x, radius.m_y, p.m_x, p.m_y);
+    transformArcPoint(p.m_x, p.m_y, center);
+    if (poly.isEmpty() || poly.last() != p)
+        poly.append(p);
+}
+
+static void addArcPoints(PathPolygon& poly, const PlatformPathElement::ArcTo& data)
+{
+    const PathPoint& startPoint = poly.last();
+    double curAngle = startPoint - data.m_center;
+    double endAngle = data.m_end - data.m_center;
+    double angleStep = 2. / std::max(data.m_radius.m_x, data.m_radius.m_y);
+    if (data.m_clockwise) {
+        if (endAngle <= curAngle || startPoint == data.m_end)
+            endAngle += 2 * piDouble;
+    } else {
+        angleStep = -angleStep;
+        if (endAngle >= curAngle || startPoint == data.m_end)
+            endAngle -= 2 * piDouble;
+    }
+
+    for (curAngle += angleStep; data.m_clockwise ? curAngle < endAngle : curAngle > endAngle; curAngle += angleStep)
+        addArcPoint(poly, data.m_center, data.m_radius, curAngle);
+
+    if (poly.isEmpty() || poly.last() != data.m_end)
+        poly.append(data.m_end);
+}
+
+static void drawPolygons(HDC dc, const Vector<PathPolygon>& polygons, bool fill, const TransformationMatrix* transformation)
+{
+    MemoryAllocationCanFail canFail;
+    for (Vector<PathPolygon>::const_iterator i = polygons.begin(); i != polygons.end(); ++i) {
+        int npoints = i->size();
+        if (!npoints)
+            continue;
+
+        POINT* winPoints = 0;
+        if (fill) {
+            if (npoints > 2)
+                winPoints = new POINT[npoints + 1];
+        } else
+            winPoints = new POINT[npoints];
+
+        if (winPoints) {
+            if (transformation) {
+                for (int i2 = 0; i2 < npoints; ++i2) {
+                    FloatPoint trPoint = transformation->mapPoint(i->at(i2));
+                    winPoints[i2].x = stableRound(trPoint.x());
+                    winPoints[i2].y = stableRound(trPoint.y());
+                }
+            } else {
+                for (int i2 = 0; i2 < npoints; ++i2) {
+                    winPoints[i2].x = stableRound(i->at(i2).x());
+                    winPoints[i2].y = stableRound(i->at(i2).y());
+                }
+            }
+
+            if (fill && winPoints[npoints - 1] != winPoints[0]) {
+                winPoints[npoints].x = winPoints[0].x;
+                winPoints[npoints].y = winPoints[0].y;
+                ++npoints;
+            }
+
+            if (fill)
+                ::Polygon(dc, winPoints, npoints);
+            else
+                ::Polyline(dc, winPoints, npoints);
+            delete[] winPoints;
+        }
+    }
+}
+
+
+int PlatformPathElement::numControlPoints() const
+{
+    switch (m_type) {
+    case PathMoveTo:
+    case PathLineTo:
+        return 1;
+    case PathQuadCurveTo:
+    case PathArcTo:
+        return 2;
+    case PathBezierCurveTo:
+        return 3;
+    default:
+        ASSERT(m_type == PathCloseSubpath);
+        return 0;
+    }
+}
+
+int PlatformPathElement::numPoints() const
+{
+    switch (m_type) {
+    case PathMoveTo:
+    case PathLineTo:
+    case PathArcTo:
+        return 1;
+    case PathQuadCurveTo:
+        return 2;
+    case PathBezierCurveTo:
+        return 3;
+    default:
+        ASSERT(m_type == PathCloseSubpath);
+        return 0;
+    }
+}
+
+void PathPolygon::move(const FloatSize& offset)
+{
+    for (Vector<PathPoint>::iterator i = begin(); i < end(); ++i)
+        i->move(offset);
+}
+
+void PathPolygon::transform(const TransformationMatrix& t)
+{
+    for (Vector<PathPoint>::iterator i = begin(); i < end(); ++i)
+        *i = t.mapPoint(*i);
+}
+
+bool PathPolygon::contains(const FloatPoint& point) const
+{
+    if (size() < 3)
+        return false;
+
+    // Test intersections between the polygon and the vertical line: x = point.x()
+
+    int intersected = 0;
+    const PathPoint* point1 = &last();
+    Vector<PathPoint>::const_iterator last = end();
+    // wasNegative: -1 means unknown, 0 means false, 1 means true.
+    int wasNegative = -1;
+    for (Vector<PathPoint>::const_iterator i = begin(); i != last; ++i) {
+        const PathPoint& point2 = *i;
+        if (point1->x() != point.x()) {
+            if (point2.x() == point.x()) {
+                // We are getting on the vertical line
+                wasNegative = point1->x() < point.x() ? 1 : 0;
+            } else if (point2.x() < point.x() != point1->x() < point.x()) {
+                float y = (point2.y() - point1->y()) / (point2.x() - point1->x()) * (point.x() - point1->x()) + point1->y();
+                if (y >= point.y())
+                    ++intersected;
+            }
+        } else {
+            // We were on the vertical line
+
+            // handle special case
+            if (point1->y() == point.y())
+                return true;
+
+            if (point1->y() > point.y()) {
+                if (point2.x() == point.x()) {
+                    // see if the point is on this segment
+                    if (point2.y() <= point.y())
+                        return true;
+
+                    // We are still on the line
+                } else {
+                    // We are leaving the line now.
+                    // We have to get back to see which side we come from. If we come from
+                    // the same side we are leaving, no intersection should be counted
+                    if (wasNegative < 0) {
+                        Vector<PathPoint>::const_iterator jLast = i;
+                        Vector<PathPoint>::const_iterator j = i;
+                        do {
+                            if (j == begin())
+                                j = last;
+                            else
+                                --j;
+                            if (j->x() != point.x()) {
+                                if (j->x() > point.x())
+                                    wasNegative = 0;
+                                else
+                                    wasNegative = 1;
+                                break;
+                            }
+                        } while (j != jLast);
+
+                        if (wasNegative < 0)
+                            return false;
+                    }
+                    if (wasNegative ? point2.x() > point.x() : point2.x() < point.x())
+                        ++intersected;
+                }
+            } else if (point2.x() == point.x() && point2.y() >= point.y())
+                return true;
+        }
+        point1 = &point2;
+    }
+
+    return intersected & 1;
+}
+
+void PlatformPathElement::move(const FloatSize& offset)
+{
+    int n = numControlPoints();
+    for (int i = 0; i < n; ++i)
+        m_data.m_points[i].move(offset);
+}
+
+void PlatformPathElement::transform(const TransformationMatrix& t)
+{
+    int n = numControlPoints();
+    for (int i = 0; i < n; ++i) {
+        FloatPoint p = t.mapPoint(m_data.m_points[i]);
+        m_data.m_points[i].set(p.x(), p.y());
+    }
+}
+
+void PlatformPathElement::inflateRectToContainMe(FloatRect& r, const FloatPoint& lastPoint) const
+{
+    if (m_type == PathArcTo) {
+        const ArcTo& data = m_data.m_arcToData;
+        PathPoint startPoint;
+        startPoint = lastPoint;
+        PathPoint endPoint = data.m_end;
+        if (!data.m_clockwise)
+            std::swap(startPoint, endPoint);
+
+        int q0 = quadrant(startPoint, data.m_center);
+        int q1 = quadrant(endPoint, data.m_center);
+        bool containsExtremes[4] = { false }; // bottom, left, top, right
+        static const PathPoint extremeVectors[4] = { { 0, 1 }, { -1, 0 }, { 0, -1 }, { 1, 0 } };
+        if (q0 == q1) {
+            if (startPoint.m_x == endPoint.m_x || isQuadrantOnBottom(q0) != startPoint.m_x > endPoint.m_x) {
+                for (int i = 0; i < 4; ++i)
+                    containsExtremes[i] = true;
+            }
+        } else {
+            int extreme = q0;
+            int diff = quadrantDiff(q1, q0);
+            for (int i = 0; i < diff; ++i) {
+                containsExtremes[extreme] = true;
+                extreme = nextQuadrant(extreme);
+            }
+        }
+
+        inflateRectToContainPoint(r, startPoint.m_x, startPoint.m_y);
+        inflateRectToContainPoint(r, endPoint.m_x, endPoint.m_y);
+        for (int i = 0; i < 4; ++i) {
+            if (containsExtremes[i])
+                inflateRectToContainPoint(r, data.m_center.m_x + data.m_radius.m_x * extremeVectors[i].m_x, data.m_center.m_y + data.m_radius.m_y * extremeVectors[i].m_y);
+        }
+    } else {
+        int n = numPoints();
+        for (int i = 0; i < n; ++i)
+            inflateRectToContainPoint(r, m_data.m_points[i].m_x, m_data.m_points[i].m_y);
+    }
+}
+
+PathElementType PlatformPathElement::type() const
+{
+    switch (m_type) {
+    case PathMoveTo:
+        return PathElementMoveToPoint;
+    case PathLineTo:
+        return PathElementAddLineToPoint;
+    case PathArcTo:
+        // FIXME: there's no arcTo type for PathElement
+        return PathElementAddLineToPoint;
+        // return PathElementAddQuadCurveToPoint;
+    case PathQuadCurveTo:
+        return PathElementAddQuadCurveToPoint;
+    case PathBezierCurveTo:
+        return PathElementAddCurveToPoint;
+    default:
+        ASSERT(m_type == PathCloseSubpath);
+        return PathElementCloseSubpath;
+    }
+}
+
+PlatformPath::PlatformPath()
+    : m_penLifted(true)
+{
+    m_currentPoint.clear();
+}
+
+void PlatformPath::ensureSubpath()
+{
+    if (m_penLifted) {
+        m_penLifted = false;
+        m_subpaths.append(PathPolygon());
+        m_subpaths.last().append(m_currentPoint);
+    } else
+        ASSERT(!m_subpaths.isEmpty());
+}
+
+void PlatformPath::addToSubpath(const PlatformPathElement& e)
+{
+    if (e.platformType() == PlatformPathElement::PathMoveTo) {
+        m_penLifted = true;
+        m_currentPoint = e.pointAt(0);
+    } else if (e.platformType() == PlatformPathElement::PathCloseSubpath) {
+        m_penLifted = true;
+        if (!m_subpaths.isEmpty()) {
+            if (m_currentPoint != m_subpaths.last()[0]) {
+                // According to W3C, we have to draw a line from current point to the initial point
+                m_subpaths.last().append(m_subpaths.last()[0]);
+                m_currentPoint = m_subpaths.last()[0];
+            }
+        } else
+            m_currentPoint.clear();
+    } else {
+        ensureSubpath();
+        switch (e.platformType()) {
+        case PlatformPathElement::PathLineTo:
+            m_subpaths.last().append(e.pointAt(0));
+            break;
+        case PlatformPathElement::PathArcTo:
+            addArcPoints(m_subpaths.last(), e.arcTo());
+            break;
+        case PlatformPathElement::PathQuadCurveTo:
+            {
+                PathPoint control[] = {
+                    m_currentPoint,
+                    e.pointAt(0),
+                    e.pointAt(1),
+                };
+                // FIXME: magic number?
+                quadCurve(50, m_subpaths.last(), control);
+            }
+            break;
+        case PlatformPathElement::PathBezierCurveTo:
+            {
+                PathPoint control[] = {
+                    m_currentPoint,
+                    e.pointAt(0),
+                    e.pointAt(1),
+                    e.pointAt(2),
+                };
+                // FIXME: magic number?
+                bezier(100, m_subpaths.last(), control);
+            }
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+        m_currentPoint = m_subpaths.last().last();
+    }
+}
+
+void PlatformPath::append(const PlatformPathElement& e)
+{
+    e.inflateRectToContainMe(m_boundingRect, lastPoint());
+    addToSubpath(e);
+    m_elements.append(e);
+}
+
+void PlatformPath::append(const PlatformPath& p)
+{
+    const PlatformPathElements& e = p.elements();
+    for (PlatformPathElements::const_iterator it(e.begin()); it != e.end(); ++it) {
+        addToSubpath(*it);
+        it->inflateRectToContainMe(m_boundingRect, lastPoint());
+        m_elements.append(*it);
+    }
+}
+
+void PlatformPath::clear()
+{
+    m_elements.clear();
+    m_boundingRect = FloatRect();
+    m_subpaths.clear();
+    m_currentPoint.clear();
+    m_penLifted = true;
+}
+
+void PlatformPath::strokePath(HDC dc, const TransformationMatrix* transformation) const
+{
+    drawPolygons(dc, m_subpaths, false, transformation);
+}
+
+void PlatformPath::fillPath(HDC dc, const TransformationMatrix* transformation) const
+{
+    HGDIOBJ oldPen = SelectObject(dc, GetStockObject(NULL_PEN));
+    drawPolygons(dc, m_subpaths, true, transformation);
+    SelectObject(dc, oldPen);
+}
+
+void PlatformPath::translate(const FloatSize& size)
+{
+    for (PlatformPathElements::iterator it(m_elements.begin()); it != m_elements.end(); ++it)
+        it->move(size);
+
+    m_boundingRect.move(size);
+    for (Vector<PathPolygon>::iterator it = m_subpaths.begin(); it != m_subpaths.end(); ++it)
+        it->move(size);
+}
+
+void PlatformPath::transform(const TransformationMatrix& t)
+{
+    for (PlatformPathElements::iterator it(m_elements.begin()); it != m_elements.end(); ++it)
+        it->transform(t);
+
+    m_boundingRect = t.mapRect(m_boundingRect);
+    for (Vector<PathPolygon>::iterator it = m_subpaths.begin(); it != m_subpaths.end(); ++it)
+        it->transform(t);
+}
+
+bool PlatformPath::contains(const FloatPoint& point, WindRule rule) const
+{
+    // optimization: check the bounding rect first
+    if (!containsPoint(m_boundingRect, point))
+        return false;
+
+    for (Vector<PathPolygon>::const_iterator i = m_subpaths.begin(); i != m_subpaths.end(); ++i) {
+        if (i->contains(point))
+            return true;
+    }
+
+    return false;
+}
+
+void PlatformPath::moveTo(const FloatPoint& point)
+{
+    PlatformPathElement::MoveTo data = { { point.x(), point.y() } };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+void PlatformPath::addLineTo(const FloatPoint& point)
+{
+    PlatformPathElement::LineTo data = { { point.x(), point.y() } };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+void PlatformPath::addQuadCurveTo(const FloatPoint& cp, const FloatPoint& p)
+{
+    PlatformPathElement::QuadCurveTo data = { { cp.x(), cp.y() }, { p.x(), p.y() } };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+void PlatformPath::addBezierCurveTo(const FloatPoint& cp1, const FloatPoint& cp2, const FloatPoint& p)
+{
+    PlatformPathElement::BezierCurveTo data = { { cp1.x(), cp1.y() }, { cp2.x(), cp2.y() }, { p.x(), p.y() } };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+void PlatformPath::addArcTo(const FloatPoint& fp1, const FloatPoint& fp2, float radius)
+{
+    const PathPoint& p0 = m_currentPoint;
+    PathPoint p1;
+    p1 = fp1;
+    PathPoint p2;
+    p2 = fp2;
+    if (!radius || p0 == p1 || p1 == p2) {
+        addLineTo(p1);
+        return;
+    }
+
+    PathVector v01 = p0 - p1;
+    PathVector v21 = p2 - p1;
+
+    // sin(A - B) = sin(A) * cos(B) - sin(B) * cos(A)
+    double cross = v01.m_x * v21.m_y - v01.m_y * v21.m_x;
+
+    if (fabs(cross) < 1E-10) {
+        // on one line
+        addLineTo(p1);
+        return;
+    }
+
+    double d01 = v01.length();
+    double d21 = v21.length();
+    double angle = (piDouble - abs(asin(cross / (d01 * d21)))) * 0.5;
+    double span = radius * tan(angle);
+    double rate = span / d01;
+    PathPoint startPoint;
+    startPoint.m_x = p1.m_x + v01.m_x * rate;
+    startPoint.m_y = p1.m_y + v01.m_y * rate;
+
+    addLineTo(startPoint);
+
+    PathPoint endPoint;
+    rate = span / d21;
+    endPoint.m_x = p1.m_x + v21.m_x * rate;
+    endPoint.m_y = p1.m_y + v21.m_y * rate;
+
+    PathPoint midPoint;
+    midPoint.m_x = (startPoint.m_x + endPoint.m_x) * 0.5;
+    midPoint.m_y = (startPoint.m_y + endPoint.m_y) * 0.5;
+
+    PathVector vm1 = midPoint - p1;
+    double dm1 = vm1.length();
+    double d = _hypot(radius, span);
+
+    PathPoint centerPoint;
+    rate = d / dm1;
+    centerPoint.m_x = p1.m_x + vm1.m_x * rate;
+    centerPoint.m_y = p1.m_y + vm1.m_y * rate;
+
+    PlatformPathElement::ArcTo data = {
+        endPoint,
+        centerPoint,
+        { radius, radius },
+        cross < 0
+    };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+void PlatformPath::closeSubpath()
+{
+    PlatformPathElement pe;
+    append(pe);
+}
+
+// add a circular arc centred at p with radius r from start angle sar (radians) to end angle ear
+void PlatformPath::addEllipse(const FloatPoint& p, float a, float b, float sar, float ear, bool anticlockwise)
+{
+    float startX, startY, endX, endY;
+
+    normalizeAngle(sar);
+    normalizeAngle(ear);
+
+    getEllipsePointByAngle(sar, a, b, startX, startY);
+    getEllipsePointByAngle(ear, a, b, endX, endY);
+
+    transformArcPoint(startX, startY, p);
+    transformArcPoint(endX, endY, p);
+
+    FloatPoint start(startX, startY);
+    moveTo(start);
+
+    PlatformPathElement::ArcTo data = { { endX, endY }, { p.x(), p.y() },  { a, b }, !anticlockwise };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+
+void PlatformPath::addRect(const FloatRect& r)
+{
+    moveTo(r.location());
+
+    float right = r.right() - 1;
+    float bottom = r.bottom() - 1;
+    addLineTo(FloatPoint(right, r.y()));
+    addLineTo(FloatPoint(right, bottom));
+    addLineTo(FloatPoint(r.x(), bottom));
+    addLineTo(r.location());
+}
+
+void PlatformPath::addEllipse(const FloatRect& r)
+{
+    FloatSize radius(r.width() * 0.5, r.height() * 0.5);
+    addEllipse(r.location() + radius, radius.width(), radius.height(), 0, 0, true);
+}
+
+String PlatformPath::debugString() const
+{
+    String ret;
+    for (PlatformPathElements::const_iterator i(m_elements.begin()); i != m_elements.end(); ++i) {
+        switch (i->platformType()) {
+        case PlatformPathElement::PathMoveTo:
+        case PlatformPathElement::PathLineTo:
+            ret += String::format("M %f %f\n", i->pointAt(0).m_x, i->pointAt(0).m_y);
+            break;
+        case PlatformPathElement::PathArcTo:
+            ret += String::format("A %f %f %f %f %f %f %c\n"
+                , i->arcTo().m_end.m_x, i->arcTo().m_end.m_y
+                , i->arcTo().m_center.m_x, i->arcTo().m_center.m_y
+                , i->arcTo().m_radius.m_x, i->arcTo().m_radius.m_y
+                , i->arcTo().m_clockwise? 'Y' : 'N');
+            break;
+        case PlatformPathElement::PathQuadCurveTo:
+            ret += String::format("Q %f %f %f %f\n"
+                , i->pointAt(0).m_x, i->pointAt(0).m_y
+                , i->pointAt(1).m_x, i->pointAt(1).m_y);
+            break;
+        case PlatformPathElement::PathBezierCurveTo:
+            ret += String::format("B %f %f %f %f %f %f\n"
+                , i->pointAt(0).m_x, i->pointAt(0).m_y
+                , i->pointAt(1).m_x, i->pointAt(1).m_y
+                , i->pointAt(2).m_x, i->pointAt(2).m_y);
+            break;
+        default:
+            ASSERT(i->platformType() == PlatformPathElement::PathCloseSubpath);
+            ret += "S\n";
+            break;
+        }
+    }
+
+    return ret;
+}
+
+void PlatformPath::apply(void* info, PathApplierFunction function) const
+{
+    PathElement pelement;
+    FloatPoint points[3];
+    pelement.points = points;
+
+    for (PlatformPathElements::const_iterator it(m_elements.begin()); it != m_elements.end(); ++it) {
+        pelement.type = it->type();
+        int n = it->numPoints();
+        for (int i = 0; i < n; ++i)
+            points[i] = it->pointAt(i);
+        function(info, &pelement);
+    }
+}
+
+} // namespace Webcore
diff --git a/WebCore/platform/graphics/wince/PlatformPathWince.h b/WebCore/platform/graphics/wince/PlatformPathWince.h
new file mode 100644
index 0000000..fca00a7
--- /dev/null
+++ b/WebCore/platform/graphics/wince/PlatformPathWince.h
@@ -0,0 +1,178 @@
+/*
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef PlatformPathWince_h
+#define PlatformPathWince_h
+
+namespace WebCore {
+
+    class GraphicsContext;
+
+    struct PathPoint {
+        float m_x;
+        float m_y;
+        const float& x() const { return m_x; }
+        const float& y() const { return m_y; }
+        void set(float x, float y)
+        {
+            m_x = x;
+            m_y = y;
+        };
+        operator FloatPoint() const { return FloatPoint(m_x, m_y); }
+        void move(const FloatSize& offset)
+        {
+            m_x += offset.width();
+            m_y += offset.height();
+        }
+        PathPoint& operator=(const FloatPoint& p)
+        {
+            m_x = p.x();
+            m_y = p.y();
+            return *this;
+        }
+        void clear() { m_x = m_y = 0; }
+    };
+
+    struct PathPolygon: public Vector<PathPoint> {
+        void move(const FloatSize& offset);
+        void transform(const TransformationMatrix& t);
+        bool contains(const FloatPoint& point) const;
+    };
+
+    class PlatformPathElement {
+    public:
+        enum PlaformPathElementType {
+            PathMoveTo,
+            PathLineTo,
+            PathArcTo,
+            PathQuadCurveTo,
+            PathBezierCurveTo,
+            PathCloseSubpath,
+        };
+
+        struct MoveTo {
+            PathPoint m_end;
+        };
+
+        struct LineTo {
+            PathPoint m_end;
+        };
+
+        struct ArcTo {
+            PathPoint m_end;
+            PathPoint m_center;
+            PathPoint m_radius;
+            bool m_clockwise;
+        };
+
+        struct QuadCurveTo {
+            PathPoint m_point0;
+            PathPoint m_point1;
+        };
+
+        struct BezierCurveTo {
+            PathPoint m_point0;
+            PathPoint m_point1;
+            PathPoint m_point2;
+        };
+
+        PlatformPathElement(): m_type(PathCloseSubpath) { m_data.m_points[0].set(0, 0);    }
+        PlatformPathElement(const MoveTo& data): m_type(PathMoveTo) { m_data.m_moveToData = data; }
+        PlatformPathElement(const LineTo& data): m_type(PathLineTo) { m_data.m_lineToData = data; }
+        PlatformPathElement(const ArcTo& data): m_type(PathArcTo) { m_data.m_arcToData = data; }
+        PlatformPathElement(const QuadCurveTo& data): m_type(PathQuadCurveTo) { m_data.m_quadCurveToData = data; }
+        PlatformPathElement(const BezierCurveTo& data): m_type(PathBezierCurveTo) { m_data.m_bezierCurveToData = data; }
+
+        const MoveTo& moveTo() const { return m_data.m_moveToData; }
+        const LineTo& lineTo() const { return m_data.m_lineToData; }
+        const ArcTo& arcTo() const { return m_data.m_arcToData; }
+        const QuadCurveTo& quadCurveTo() const { return m_data.m_quadCurveToData; }
+        const BezierCurveTo& bezierCurveTo() const { return m_data.m_bezierCurveToData; }
+        const PathPoint& lastPoint() const
+        {
+            int n = numPoints();
+            return n > 1 ? m_data.m_points[n - 1] : m_data.m_points[0];
+        }
+        const PathPoint& pointAt(int index) const { return m_data.m_points[index]; }
+        int numPoints() const;
+        int numControlPoints() const;
+        void move(const FloatSize& offset);
+        void transform(const TransformationMatrix& t);
+        PathElementType type() const;
+        PlaformPathElementType platformType() const { return m_type; }
+        void inflateRectToContainMe(FloatRect& r, const FloatPoint& lastPoint) const;
+
+    private:
+        PlaformPathElementType m_type;
+        union {
+            MoveTo m_moveToData;
+            LineTo m_lineToData;
+            ArcTo m_arcToData;
+            QuadCurveTo m_quadCurveToData;
+            BezierCurveTo m_bezierCurveToData;
+            PathPoint m_points[4];
+        } m_data;
+    };
+
+    typedef Vector<PlatformPathElement> PlatformPathElements;
+
+    class PlatformPath {
+    public:
+        PlatformPath();
+        const PlatformPathElements& elements() const { return m_elements; }
+        void append(const PlatformPathElement& e);
+        void append(const PlatformPath& p);
+        void clear();
+        bool isEmpty() const { return m_elements.isEmpty(); }
+
+        void strokePath(HDC, const TransformationMatrix* tr) const;
+        void fillPath(HDC, const TransformationMatrix* tr) const;
+        FloatPoint lastPoint() const { return m_elements.isEmpty() ? FloatPoint(0, 0) : m_elements.last().lastPoint(); }
+
+        const FloatRect& boundingRect() const { return m_boundingRect; }
+        bool contains(const FloatPoint& point, WindRule rule) const;
+        void translate(const FloatSize& size);
+        void transform(const TransformationMatrix& t);
+
+        void moveTo(const FloatPoint&);
+        void addLineTo(const FloatPoint&);
+        void addQuadCurveTo(const FloatPoint& controlPoint, const FloatPoint& point);
+        void addBezierCurveTo(const FloatPoint& controlPoint1, const FloatPoint& controlPoint2, const FloatPoint&);
+        void addArcTo(const FloatPoint&, const FloatPoint&, float radius);
+        void closeSubpath();
+        void addEllipse(const FloatPoint& p, float a, float b, float sar, float ear, bool anticlockwise);
+        void addRect(const FloatRect& r);
+        void addEllipse(const FloatRect& r);
+        String debugString() const;
+        void apply(void* info, PathApplierFunction function) const;
+
+    private:
+        void ensureSubpath();
+        void addToSubpath(const PlatformPathElement& e);
+
+        PlatformPathElements m_elements;
+        FloatRect m_boundingRect;
+        Vector<PathPolygon> m_subpaths;
+        PathPoint m_currentPoint;
+        bool m_penLifted;
+    };
+
+}
+
+#endif // PlatformPathWince_h
diff --git a/WebCore/platform/graphics/wince/WinceGraphicsExtras.h b/WebCore/platform/graphics/wince/WinceGraphicsExtras.h
new file mode 100644
index 0000000..2a6fae1
--- /dev/null
+++ b/WebCore/platform/graphics/wince/WinceGraphicsExtras.h
@@ -0,0 +1,39 @@
+/*
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WinceGraphicsExtras_h
+#define WinceGraphicsExtras_h
+
+// This file is used to contain small utilities used by WINCE graphics code.
+
+namespace WebCore {
+    // Always round to same direction. 0.5 is rounded to 1,
+    // and -0.5 (0.5 - 1) is rounded to 0 (1 - 1), so that it
+    // is consistent when transformation shifts.
+    static inline int stableRound(double d)
+    {
+        if (d > 0)
+            return static_cast<int>(d + 0.5);
+
+        int i = static_cast<int>(d);
+        return i - d > 0.5 ? i - 1 : i;
+    }
+}
+
+#endif WinceGraphicsExtras_h
diff --git a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
index 59e388e..686fb07 100644
--- a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
+++ b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
@@ -506,4 +506,59 @@ void GraphicsContext::fillRect(const FloatRect& rect)
         return;
 }
 
+void GraphicsContext::setPlatformShadow(IntSize const&,int,Color const&) 
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::clearPlatformShadow() 
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::beginTransparencyLayer(float) 
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::endTransparencyLayer() 
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::clearRect(const FloatRect&) 
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::strokeRect(const FloatRect&, float)
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::setLineCap(LineCap) 
+{
+    notImplemented(); 
+}
+
+void GraphicsContext::setLineJoin(LineJoin)
+{
+    notImplemented();
+}
+
+void GraphicsContext::setMiterLimit(float)
+{
+    notImplemented();
+}
+
+void GraphicsContext::setAlpha(float)
+{
+    notImplemented();
+}
+
+void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness)
+{
+    notImplemented();
+}
+
 }
diff --git a/WebCore/platform/graphics/wx/IconWx.cpp b/WebCore/platform/graphics/wx/IconWx.cpp
new file mode 100644
index 0000000..e82091e
--- /dev/null
+++ b/WebCore/platform/graphics/wx/IconWx.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Icon.h"
+
+#include "GraphicsContext.h"
+#include "PlatformString.h"
+#include "IntRect.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+Icon::~Icon()
+{
+}
+
+PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+{
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
+{
+    notImplemented();
+    return 0;
+}
+
+void Icon::paint(GraphicsContext* ctx, const IntRect& rect)
+{
+    notImplemented();
+}
+
+}
+
diff --git a/WebCore/platform/graphics/wx/ImageBufferWx.cpp b/WebCore/platform/graphics/wx/ImageBufferWx.cpp
index e71dbde..49f3f3b 100644
--- a/WebCore/platform/graphics/wx/ImageBufferWx.cpp
+++ b/WebCore/platform/graphics/wx/ImageBufferWx.cpp
@@ -53,13 +53,24 @@ GraphicsContext* ImageBuffer::context() const
     return 0;
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect&) const
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
 {
     notImplemented();
     return 0;
 }
 
-void ImageBuffer::putImageData(ImageData*, const IntRect&, const IntPoint&)
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    notImplemented();
+    return 0;
+}
+
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    notImplemented();
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
 {
     notImplemented();
 }
diff --git a/WebCore/platform/graphics/wx/ImageSourceWx.cpp b/WebCore/platform/graphics/wx/ImageSourceWx.cpp
deleted file mode 100644
index 06c165d..0000000
--- a/WebCore/platform/graphics/wx/ImageSourceWx.cpp
+++ /dev/null
@@ -1,226 +0,0 @@
-/*
- * Copyright (C) 2006, 2007 Apple Computer, Kevin Ollivier.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "ImageSource.h"
-
-#include "BMPImageDecoder.h"
-#include "GIFImageDecoder.h"
-#include "ICOImageDecoder.h"
-#include "JPEGImageDecoder.h"
-#include "NotImplemented.h"
-#include "PNGImageDecoder.h"
-#include "SharedBuffer.h"
-#include "XBMImageDecoder.h"
-
-#include <wx/defs.h>
-#include <wx/bitmap.h>
-#if USE(WXGC)
-#include <wx/graphics.h>
-#endif
-#include <wx/image.h>
-#include <wx/rawbmp.h>
-
-namespace WebCore {
-
-ImageDecoder* createDecoder(const SharedBuffer& data)
-{
-    // We need at least 4 bytes to figure out what kind of image we're dealing with.
-    int length = data.size();
-    if (length < 4)
-        return 0;
-
-    const unsigned char* uContents = (const unsigned char*)data.data();
-    const char* contents = data.data();
-
-    // GIFs begin with GIF8(7 or 9).
-    if (strncmp(contents, "GIF8", 4) == 0)
-        return new GIFImageDecoder();
-
-    // Test for PNG.
-    if (uContents[0]==0x89 &&
-        uContents[1]==0x50 &&
-        uContents[2]==0x4E &&
-        uContents[3]==0x47)
-        return new PNGImageDecoder();
-
-    // JPEG
-    if (uContents[0]==0xFF &&
-        uContents[1]==0xD8 &&
-        uContents[2]==0xFF)
-        return new JPEGImageDecoder();
-
-    // BMP
-    if (strncmp(contents, "BM", 2) == 0)
-        return new BMPImageDecoder();
-
-    // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
-    // CURs begin with 2-byte 0 followed by 2-byte 2.
-    if (!memcmp(contents, "\000\000\001\000", 4) ||
-        !memcmp(contents, "\000\000\002\000", 4))
-        return new ICOImageDecoder();
-   
-    // XBMs require 8 bytes of info.
-    if (length >= 8 && strncmp(contents, "#define ", 8) == 0)
-        return new XBMImageDecoder();
-
-    // Give up. We don't know what the heck this is.
-    return 0;
-}
-
-ImageSource::ImageSource()
-  : m_decoder(0)
-{}
-
-ImageSource::~ImageSource()
-{
-    clear(true);
-}
-
-bool ImageSource::initialized() const
-{
-    return m_decoder;
-}
-
-void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
-{
-    // Make the decoder by sniffing the bytes.
-    // This method will examine the data and instantiate an instance of the appropriate decoder plugin.
-    // If insufficient bytes are available to determine the image type, no decoder plugin will be
-    // made.
-    if (m_decoder)
-        delete m_decoder;
-    m_decoder = createDecoder(*data);
-    if (!m_decoder)
-        return;
-    m_decoder->setData(data, allDataReceived);
-}
-
-bool ImageSource::isSizeAvailable()
-{
-    if (!m_decoder)
-        return false;
-
-    return m_decoder->isSizeAvailable();
-}
-
-IntSize ImageSource::size() const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->size();
-}
-
-IntSize ImageSource::frameSizeAtIndex(size_t index) const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->frameSizeAtIndex(index);
-}
-
-int ImageSource::repetitionCount()
-{
-    if (!m_decoder)
-        return cAnimationNone;
-
-    return m_decoder->repetitionCount();
-}
-
-String ImageSource::filenameExtension() const
-{
-    notImplemented();
-    return String();
-}
-
-size_t ImageSource::frameCount() const
-{
-    return m_decoder ? m_decoder->frameCount() : 0;
-}
-
-bool ImageSource::frameIsCompleteAtIndex(size_t index)
-{
-    // FIXME: should we be testing the RGBA32Buffer's status as well?
-    return (m_decoder && m_decoder->frameBufferAtIndex(index) != 0);
-}
-
-void ImageSource::clear(bool destroyAll, size_t clearBeforeFrame, SharedBuffer* data, bool allDataReceived)
-{
-    if (!destroyAll) {
-        if (m_decoder)
-            m_decoder->clearFrameBufferCache(clearBeforeFrame);
-        return;
-    }
-
-    delete m_decoder;
-    m_decoder = 0;
-    if (data)
-        setData(data, allDataReceived);
-}
-
-NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return 0;
-    
-    return buffer->asNewNativeImage();
-}
-
-float ImageSource::frameDurationAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return 0;
-
-    float duration = buffer->duration() / 1000.0f;
-
-    // Follow other ports (and WinIE's) behavior to slow annoying ads that
-    // specify a 0 duration.
-    if (duration < 0.051f)
-        return 0.100f;
-    return duration;
-}
-
-bool ImageSource::frameHasAlphaAtIndex(size_t index)
-{
-    if (!m_decoder || !m_decoder->supportsAlpha())
-        return false;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return false;
-
-    return buffer->hasAlpha();
-}
-
-}
diff --git a/WebCore/platform/graphics/wx/ImageWx.cpp b/WebCore/platform/graphics/wx/ImageWx.cpp
index b0a993e..bd129cf 100644
--- a/WebCore/platform/graphics/wx/ImageWx.cpp
+++ b/WebCore/platform/graphics/wx/ImageWx.cpp
@@ -31,6 +31,7 @@
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "ImageObserver.h"
+#include "NotImplemented.h"
 #include "TransformationMatrix.h"
 
 #include <math.h>
@@ -45,9 +46,6 @@
 #include <wx/image.h>
 #include <wx/thread.h>
 
-// This function loads resources from WebKit
-Vector<char> loadResourceIntoArray(const char*);
-
 namespace WebCore {
 
 // this is in GraphicsContextWx.cpp
@@ -72,7 +70,9 @@ bool FrameData::clear(bool clearMetadata)
 
 PassRefPtr<Image> Image::loadPlatformResource(const char *name)
 {
-    Vector<char> arr = loadResourceIntoArray(name);
+    // FIXME: We need to have some 'placeholder' graphics for things like missing
+    // plugins or broken images.
+    Vector<char> arr;
     RefPtr<Image> img = BitmapImage::create();
     RefPtr<SharedBuffer> buffer = SharedBuffer::create(arr.data(), arr.size());
     img->setData(buffer, true);
@@ -261,4 +261,9 @@ void BitmapImage::invalidatePlatformData()
 
 }
 
+void Image::drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, CompositeOperator, const FloatRect& destRect)
+{
+    notImplemented();
+}
+
 }
diff --git a/WebCore/platform/graphics/wx/IntSizeWx.cpp b/WebCore/platform/graphics/wx/IntSizeWx.cpp
new file mode 100644
index 0000000..8c82854
--- /dev/null
+++ b/WebCore/platform/graphics/wx/IntSizeWx.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Kevin Watters. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "IntSize.h"
+
+#include <wx/defs.h>
+#include <wx/gdicmn.h>
+
+namespace WebCore {
+
+IntSize::IntSize(const wxSize& s)
+    : m_width(s.x)
+    , m_height(s.y)
+{
+}
+
+IntSize::operator wxSize() const
+{
+    return wxSize(m_width, m_height);
+}
+
+}
diff --git a/WebCore/platform/gtk/ClipboardGtk.cpp b/WebCore/platform/gtk/ClipboardGtk.cpp
index 8cbf590..450966e 100644
--- a/WebCore/platform/gtk/ClipboardGtk.cpp
+++ b/WebCore/platform/gtk/ClipboardGtk.cpp
@@ -17,11 +17,18 @@
 #include "config.h"
 #include "ClipboardGtk.h"
 
+#include "CachedImage.h"
+#include "CString.h"
+#include "Editor.h"
+#include "Element.h"
 #include "FileList.h"
+#include "Frame.h"
+#include "markup.h"
 #include "NotImplemented.h"
+#include "RenderImage.h"
 #include "StringHash.h"
 
-#include "Editor.h"
+#include <gtk/gtk.h>
 
 namespace WebCore {
 
@@ -33,12 +40,10 @@ PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
 ClipboardGtk::ClipboardGtk(ClipboardAccessPolicy policy, bool forDragging)
     : Clipboard(policy, forDragging)
 {
-    notImplemented();
 }
 
 ClipboardGtk::~ClipboardGtk()
 {
-    notImplemented();
 }
 
 void ClipboardGtk::clearData(const String&)
@@ -110,19 +115,65 @@ DragImageRef ClipboardGtk::createDragImage(IntPoint&) const
     return 0;
 }
 
-void ClipboardGtk::declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*)
+static CachedImage* getCachedImage(Element* element)
 {
-    notImplemented();
+    // Attempt to pull CachedImage from element
+    ASSERT(element);
+    RenderObject* renderer = element->renderer();
+    if (!renderer || !renderer->isImage())
+        return 0;
+
+    RenderImage* image = static_cast<RenderImage*>(renderer);
+    if (image->cachedImage() && !image->cachedImage()->errorOccurred())
+        return image->cachedImage();
+
+    return 0;
 }
 
-void ClipboardGtk::writeURL(const KURL&, const String&, Frame*)
+void ClipboardGtk::declareAndWriteDragImage(Element* element, const KURL& url, const String& label, Frame*)
 {
-    notImplemented();
+    CachedImage* cachedImage = getCachedImage(element);
+    if (!cachedImage || !cachedImage->isLoaded())
+        return;
+
+    GdkPixbuf* pixbuf = cachedImage->image()->getGdkPixbuf();
+    if (!pixbuf)
+        return;
+
+    GtkClipboard* imageClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardImage"));
+    gtk_clipboard_clear(imageClipboard);
+
+    gtk_clipboard_set_image(imageClipboard, pixbuf);
+    g_object_unref(pixbuf);
+
+    writeURL(url, label, 0);
 }
 
-void ClipboardGtk::writeRange(Range*, Frame*)
+void ClipboardGtk::writeURL(const KURL& url, const String& label, Frame*)
 {
-    notImplemented();
+    GtkClipboard* textClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardText"));
+    GtkClipboard* urlClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardUrl"));
+    GtkClipboard* urlLabelClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardUrlLabel"));
+
+    gtk_clipboard_clear(textClipboard);
+    gtk_clipboard_clear(urlClipboard);
+    gtk_clipboard_clear(urlLabelClipboard);
+
+    gtk_clipboard_set_text(textClipboard, url.string().utf8().data(), -1);
+    gtk_clipboard_set_text(urlClipboard, url.string().utf8().data(), -1);
+    gtk_clipboard_set_text(urlLabelClipboard, label.utf8().data(), -1);
+}
+
+void ClipboardGtk::writeRange(Range* range, Frame* frame)
+{
+    GtkClipboard* textClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardText"));
+    GtkClipboard* htmlClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardHtml"));
+
+    gtk_clipboard_clear(textClipboard);
+    gtk_clipboard_clear(htmlClipboard);
+
+    gtk_clipboard_set_text(textClipboard, frame->selectedText().utf8().data(), -1);
+    gtk_clipboard_set_text(htmlClipboard, createMarkup(range, 0, AnnotateForInterchange).utf8().data(), -1);
 }
 
 bool ClipboardGtk::hasData()
diff --git a/WebCore/platform/gtk/ClipboardGtk.h b/WebCore/platform/gtk/ClipboardGtk.h
index 7314ae4..bb21d92 100644
--- a/WebCore/platform/gtk/ClipboardGtk.h
+++ b/WebCore/platform/gtk/ClipboardGtk.h
@@ -24,8 +24,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ClipboardGdk_h
-#define ClipboardGdk_h
+#ifndef ClipboardGtk_h
+#define ClipboardGtk_h
 
 #include "Clipboard.h"
 
diff --git a/WebCore/platform/gtk/CursorGtk.cpp b/WebCore/platform/gtk/CursorGtk.cpp
index 115760e..1c669f3 100644
--- a/WebCore/platform/gtk/CursorGtk.cpp
+++ b/WebCore/platform/gtk/CursorGtk.cpp
@@ -28,6 +28,9 @@
 #include "config.h"
 #include "CursorGtk.h"
 
+#include "Image.h"
+#include "IntPoint.h"
+
 #include <wtf/Assertions.h>
 
 #include <gdk/gdk.h>
@@ -60,15 +63,11 @@ Cursor::Cursor(const Cursor& other)
         gdk_cursor_ref(m_impl);
 }
 
-Cursor::Cursor(Image*, const IntPoint&)
+Cursor::Cursor(Image* image, const IntPoint& hotSpot)
 {
-    // FIXME: We don't support images for cursors yet.
-    // This is just a placeholder to avoid crashes.
-    Cursor other(crossCursor());
-    m_impl = other.m_impl;
-
-    if (m_impl)
-        gdk_cursor_ref(m_impl);
+    GdkPixbuf* pixbuf = image->getGdkPixbuf();
+    m_impl = gdk_cursor_new_from_pixbuf(gdk_display_get_default(), pixbuf, hotSpot.x(), hotSpot.y());
+    g_object_unref(pixbuf);
 }
 
 Cursor::~Cursor()
diff --git a/WebCore/platform/gtk/GeolocationServiceGtk.cpp b/WebCore/platform/gtk/GeolocationServiceGtk.cpp
index fc15833..cf35346 100644
--- a/WebCore/platform/gtk/GeolocationServiceGtk.cpp
+++ b/WebCore/platform/gtk/GeolocationServiceGtk.cpp
@@ -37,11 +37,13 @@ namespace WTF {
 
 namespace WebCore {
 
-GeolocationService* GeolocationService::create(GeolocationServiceClient* client)
+GeolocationService* GeolocationServiceGtk::create(GeolocationServiceClient* client)
 {
     return new GeolocationServiceGtk(client);
 }
 
+GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &GeolocationServiceGtk::create;
+
 GeolocationServiceGtk::GeolocationServiceGtk(GeolocationServiceClient* client)
     : GeolocationService(client)
     , m_geoclueClient(0)
diff --git a/WebCore/platform/gtk/GeolocationServiceGtk.h b/WebCore/platform/gtk/GeolocationServiceGtk.h
index 90699ad..a198dc0 100644
--- a/WebCore/platform/gtk/GeolocationServiceGtk.h
+++ b/WebCore/platform/gtk/GeolocationServiceGtk.h
@@ -31,7 +31,7 @@
 namespace WebCore {
     class GeolocationServiceGtk : public GeolocationService {
     public:
-        GeolocationServiceGtk(GeolocationServiceClient*);
+        static GeolocationService* create(GeolocationServiceClient*);
         ~GeolocationServiceGtk();
 
         virtual bool startUpdating(PositionOptions*);
@@ -44,6 +44,8 @@ namespace WebCore {
         PositionError* lastError() const;
 
     private:
+        GeolocationServiceGtk(GeolocationServiceClient*);
+
         void updateLocationInformation();
         void setError(PositionError::ErrorCode, const char* message);
         void updatePosition();
diff --git a/WebCore/platform/gtk/KeyEventGtk.cpp b/WebCore/platform/gtk/KeyEventGtk.cpp
index 5875547..4186c2f 100644
--- a/WebCore/platform/gtk/KeyEventGtk.cpp
+++ b/WebCore/platform/gtk/KeyEventGtk.cpp
@@ -136,6 +136,8 @@ static String keyIdentifierForGdkKeyCode(guint keyCode)
             // Standard says that DEL becomes U+007F.
         case GDK_Delete:
             return "U+007F";
+        case GDK_BackSpace:
+            return "U+0008";
         case GDK_ISO_Left_Tab:
         case GDK_3270_BackTab:
         case GDK_Tab:
@@ -503,6 +505,8 @@ static String singleCharacterString(guint val)
         case GDK_KP_Enter:
         case GDK_Return:
             return String("\r");
+        case GDK_BackSpace:
+            return String("\x8");
         default:
             gunichar c = gdk_keyval_to_unicode(val);
             glong nwc;
diff --git a/WebCore/platform/gtk/LocalizedStringsGtk.cpp b/WebCore/platform/gtk/LocalizedStringsGtk.cpp
index 2ba4fbb..85e071b 100644
--- a/WebCore/platform/gtk/LocalizedStringsGtk.cpp
+++ b/WebCore/platform/gtk/LocalizedStringsGtk.cpp
@@ -345,6 +345,9 @@ String imageTitle(const String& filename, const IntSize& size)
     return String::fromUTF8(string.get());
 }
 
+
+#if ENABLE(VIDEO)
+
 String mediaElementLoadingStateText()
 {
     return String::fromUTF8(_("Loading..."));
@@ -355,4 +358,113 @@ String mediaElementLiveBroadcastStateText()
     return String::fromUTF8(_("Live Broadcast"));
 }
 
+String localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return String::fromUTF8(_("audio element controller"));
+    if (name == "VideoElement")
+        return String::fromUTF8(_("video element controller"));
+    if (name == "MuteButton")
+        return String::fromUTF8(_("mute"));
+    if (name == "UnMuteButton")
+        return String::fromUTF8(_("unmute"));
+    if (name == "PlayButton")
+        return String::fromUTF8(_("play"));
+    if (name == "PauseButton")
+        return String::fromUTF8(_("pause"));
+    if (name == "Slider")
+        return String::fromUTF8(_("movie time"));
+    if (name == "SliderThumb")
+        return String::fromUTF8(_("timeline slider thumb"));
+    if (name == "RewindButton")
+        return String::fromUTF8(_("back 30 seconds"));
+    if (name == "ReturnToRealtimeButton")
+        return String::fromUTF8(_("return to realtime"));
+    if (name == "CurrentTimeDisplay")
+        return String::fromUTF8(_("elapsed time"));
+    if (name == "TimeRemainingDisplay")
+        return String::fromUTF8(_("remaining time"));
+    if (name == "StatusDisplay")
+        return String::fromUTF8(_("status"));
+    if (name == "FullscreenButton")
+        return String::fromUTF8(_("fullscreen"));
+    if (name == "SeekForwardButton")
+        return String::fromUTF8(_("fast forward"));
+    if (name == "SeekBackButton")
+        return String::fromUTF8(_("fast reverse"));
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return String::fromUTF8(_("audio element playback controls and status display"));
+    if (name == "VideoElement")
+        return String::fromUTF8(_("video element playback controls and status display"));
+    if (name == "MuteButton")
+        return String::fromUTF8(_("mute audio tracks"));
+    if (name == "UnMuteButton")
+        return String::fromUTF8(_("unmute audio tracks"));
+    if (name == "PlayButton")
+        return String::fromUTF8(_("begin playback"));
+    if (name == "PauseButton")
+        return String::fromUTF8(_("pause playback"));
+    if (name == "Slider")
+        return String::fromUTF8(_("movie time scrubber"));
+    if (name == "SliderThumb")
+        return String::fromUTF8(_("movie time scrubber thumb"));
+    if (name == "RewindButton")
+        return String::fromUTF8(_("seek movie back 30 seconds"));
+    if (name == "ReturnToRealtimeButton")
+        return String::fromUTF8(_("return streaming movie to real time"));
+    if (name == "CurrentTimeDisplay")
+        return String::fromUTF8(_("current movie time in seconds"));
+    if (name == "TimeRemainingDisplay")
+        return String::fromUTF8(_("number of seconds of movie remaining"));
+    if (name == "StatusDisplay")
+        return String::fromUTF8(_("current movie status"));
+    if (name == "SeekBackButton")
+        return String::fromUTF8(_("seek quickly back"));
+    if (name == "SeekForwardButton")
+        return String::fromUTF8(_("seek quickly forward"));
+    if (name == "FullscreenButton")
+        return String::fromUTF8(_("Play movie in fullscreen mode"));
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    if (!isfinite(time))
+        return String::fromUTF8(_("indefinite time"));
+
+    int seconds = (int)fabsf(time);
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days) {
+        GOwnPtr<gchar> string(g_strdup_printf("%d days %d hours %d minutes %d seconds", days, hours, minutes, seconds));
+        return String::fromUTF8(string.get());
+    }
+
+    if (hours) {
+        GOwnPtr<gchar> string(g_strdup_printf("%d hours %d minutes %d seconds", hours, minutes, seconds));
+        return String::fromUTF8(string.get());
+    }
+
+    if (minutes) {
+        GOwnPtr<gchar> string(g_strdup_printf("%d minutes %d seconds", minutes, seconds));
+        return String::fromUTF8(string.get());
+    }
+
+    GOwnPtr<gchar> string(g_strdup_printf("%d seconds", seconds));
+    return String::fromUTF8(string.get());
+}
+#endif  // ENABLE(VIDEO)
+
 }
diff --git a/WebCore/platform/gtk/PasteboardGtk.cpp b/WebCore/platform/gtk/PasteboardGtk.cpp
index 9f72923..0ff26f7 100644
--- a/WebCore/platform/gtk/PasteboardGtk.cpp
+++ b/WebCore/platform/gtk/PasteboardGtk.cpp
@@ -35,13 +35,6 @@
 
 namespace WebCore {
 
-/* FIXME: we must get rid of this and use the enum in webkitwebview.h someway */
-typedef enum
-{
-    WEBKIT_WEB_VIEW_TARGET_INFO_HTML = - 1,
-    WEBKIT_WEB_VIEW_TARGET_INFO_TEXT = - 2
-} WebKitWebViewTargetInfo;
-
 class PasteboardSelectionData {
 public:
     PasteboardSelectionData(gchar* text, gchar* markup)
@@ -65,11 +58,11 @@ static void clipboard_get_contents_cb(GtkClipboard *clipboard, GtkSelectionData
                                       guint info, gpointer data) {
     PasteboardSelectionData* clipboardData = reinterpret_cast<PasteboardSelectionData*>(data);
     ASSERT(clipboardData);
-    if ((gint)info == WEBKIT_WEB_VIEW_TARGET_INFO_HTML) {
+    if ((gint)info == Pasteboard::generalPasteboard()->m_helper->getWebViewTargetInfoHtml())
         gtk_selection_data_set(selection_data, selection_data->target, 8,
                                reinterpret_cast<const guchar*>(clipboardData->markup()),
                                g_utf8_strlen(clipboardData->markup(), -1));
-    } else
+    else
         gtk_selection_data_set_text(selection_data, clipboardData->text(), -1);
 }
 
@@ -115,6 +108,13 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     gtk_target_table_free(targets, n_targets);
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    CString utf8 = text.utf8();
+    GtkClipboard* clipboard = gtk_clipboard_get_for_display(gdk_display_get_default(), GDK_SELECTION_CLIPBOARD);
+    gtk_clipboard_set_text(clipboard, utf8.data(), utf8.length());
+}
+
 void Pasteboard::writeURL(const KURL& url, const String&, Frame* frame)
 {
     if (url.isEmpty())
@@ -122,8 +122,9 @@ void Pasteboard::writeURL(const KURL& url, const String&, Frame* frame)
 
     GtkClipboard* clipboard = m_helper->getClipboard(frame);
     GtkClipboard* primary = m_helper->getPrimary(frame);
-    gtk_clipboard_set_text(clipboard, url.string().utf8().data(), url.string().utf8().length());
-    gtk_clipboard_set_text(primary, url.string().utf8().data(), url.string().utf8().length());
+    CString utf8 = url.string().utf8();
+    gtk_clipboard_set_text(clipboard, utf8.data(), utf8.length());
+    gtk_clipboard_set_text(primary, utf8.data(), utf8.length());
 }
 
 void Pasteboard::writeImage(Node* node, const KURL&, const String&)
diff --git a/WebCore/platform/gtk/PasteboardHelper.h b/WebCore/platform/gtk/PasteboardHelper.h
index 9943a2d..8e67127 100644
--- a/WebCore/platform/gtk/PasteboardHelper.h
+++ b/WebCore/platform/gtk/PasteboardHelper.h
@@ -43,6 +43,7 @@ public:
     virtual GtkClipboard* getPrimary(Frame*) const = 0;
     virtual GtkTargetList* getCopyTargetList(Frame*) const = 0;
     virtual GtkTargetList* getPasteTargetList(Frame*) const = 0;
+    virtual gint getWebViewTargetInfoHtml() const = 0;
 };
 
 }
diff --git a/WebCore/platform/gtk/PlatformScreenGtk.cpp b/WebCore/platform/gtk/PlatformScreenGtk.cpp
index 4ba6d43..a6ff954 100644
--- a/WebCore/platform/gtk/PlatformScreenGtk.cpp
+++ b/WebCore/platform/gtk/PlatformScreenGtk.cpp
@@ -49,7 +49,7 @@ static GdkVisual* getVisual(Widget* widget)
     if (!widget)
         return 0;
 
-    GtkWidget* container = GTK_WIDGET(widget->root()->hostWindow()->platformWindow());
+    GtkWidget* container = GTK_WIDGET(widget->root()->hostWindow()->platformPageClient());
 
     if (!container)
         return 0;
@@ -93,7 +93,7 @@ FloatRect screenRect(Widget* widget)
     if (!widget)
         return FloatRect();
 
-    GtkWidget* container = gtk_widget_get_toplevel(GTK_WIDGET(widget->root()->hostWindow()->platformWindow()));
+    GtkWidget* container = gtk_widget_get_toplevel(GTK_WIDGET(widget->root()->hostWindow()->platformPageClient()));
     if (!GTK_WIDGET_TOPLEVEL(container))
         return FloatRect();
 
@@ -114,7 +114,7 @@ FloatRect screenAvailableRect(Widget* widget)
         return FloatRect();
 
 #if PLATFORM(X11)
-    GtkWidget* container = GTK_WIDGET(widget->root()->hostWindow()->platformWindow());
+    GtkWidget* container = GTK_WIDGET(widget->root()->hostWindow()->platformPageClient());
     if (!container)
         return FloatRect();
 
diff --git a/WebCore/platform/gtk/PopupMenuGtk.cpp b/WebCore/platform/gtk/PopupMenuGtk.cpp
index 121d7b0..3f6b02a 100644
--- a/WebCore/platform/gtk/PopupMenuGtk.cpp
+++ b/WebCore/platform/gtk/PopupMenuGtk.cpp
@@ -60,7 +60,7 @@ void PopupMenu::show(const IntRect& rect, FrameView* view, int index)
         gtk_container_foreach(GTK_CONTAINER(m_popup), reinterpret_cast<GtkCallback>(menuRemoveItem), this);
 
     int x, y;
-    gdk_window_get_origin(GTK_WIDGET(view->hostWindow()->platformWindow())->window, &x, &y);
+    gdk_window_get_origin(GTK_WIDGET(view->hostWindow()->platformPageClient())->window, &x, &y);
     m_menuPosition = view->contentsToWindow(rect.location());
     m_menuPosition = IntPoint(m_menuPosition.x() + x, m_menuPosition.y() + y + rect.height());
     m_indexMap.clear();
@@ -137,7 +137,7 @@ void PopupMenu::menuItemActivated(GtkMenuItem* item, PopupMenu* that)
 void PopupMenu::menuUnmapped(GtkWidget*, PopupMenu* that)
 {
     ASSERT(that->client());
-    that->client()->hidePopup();
+    that->client()->popupDidHide();
 }
 
 void PopupMenu::menuPositionFunction(GtkMenu*, gint* x, gint* y, gboolean* pushIn, PopupMenu* that)
diff --git a/WebCore/platform/gtk/ScrollViewGtk.cpp b/WebCore/platform/gtk/ScrollViewGtk.cpp
index 0e811ef..a1ed8c3 100644
--- a/WebCore/platform/gtk/ScrollViewGtk.cpp
+++ b/WebCore/platform/gtk/ScrollViewGtk.cpp
@@ -31,10 +31,14 @@
 #include "config.h"
 #include "ScrollView.h"
 
+#include "ChromeClient.h"
 #include "FloatRect.h"
+#include "Frame.h"
+#include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HostWindow.h"
 #include "IntRect.h"
+#include "Page.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformWheelEvent.h"
 #include "ScrollbarGtk.h"
@@ -103,7 +107,7 @@ void ScrollView::setGtkAdjustments(GtkAdjustment* hadj, GtkAdjustment* vadj)
 void ScrollView::platformAddChild(Widget* child)
 {
     if (!GTK_IS_SOCKET(child->platformWidget()))
-        gtk_container_add(GTK_CONTAINER(hostWindow()->platformWindow()), child->platformWidget());
+        gtk_container_add(GTK_CONTAINER(hostWindow()->platformPageClient()), child->platformWidget());
 }
 
 void ScrollView::platformRemoveChild(Widget* child)
@@ -113,7 +117,7 @@ void ScrollView::platformRemoveChild(Widget* child)
     // HostWindow can be NULL here. If that's the case
     // let's grab the child's parent instead.
     if (hostWindow())
-        parent = GTK_WIDGET(hostWindow()->platformWindow());
+        parent = GTK_WIDGET(hostWindow()->platformPageClient());
     else
         parent = GTK_WIDGET(child->platformWidget()->parent);
 
@@ -129,7 +133,7 @@ IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
                                max(0, height() - (horizontalScrollbar() && !includeScrollbars ? horizontalScrollbar()->height() : 0))));
 
     // Main frame.
-    GtkWidget* measuredWidget = hostWindow()->platformWindow();
+    GtkWidget* measuredWidget = hostWindow()->platformPageClient();
     GtkWidget* parent = gtk_widget_get_parent(measuredWidget);
 
     // We may not be in a widget that displays scrollbars, but we may
@@ -142,4 +146,29 @@ IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
                            measuredWidget->allocation.height));
 }
 
+void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode verticalMode)
+{
+    if (horizontalMode == m_horizontalScrollbarMode && verticalMode == m_verticalScrollbarMode)
+        return;
+
+    m_horizontalScrollbarMode = horizontalMode;
+    m_verticalScrollbarMode = verticalMode;
+
+    // We don't really care about reporting policy changes on frames
+    // that have no adjustments attached to them.
+    if (!m_horizontalAdjustment) {
+        updateScrollbars(scrollOffset());
+        return;
+    }
+
+    if (!isFrameView())
+        return;
+
+    // For frames that do have adjustments attached, we want to report
+    // policy changes, so that they may be applied to the widget to
+    // which the WebView has been added, for instance.
+    if (hostWindow())
+        hostWindow()->scrollbarsModeDidChange();
+}
+
 }
diff --git a/WebCore/platform/gtk/WidgetGtk.cpp b/WebCore/platform/gtk/WidgetGtk.cpp
index 007f2ee..53c10f1 100644
--- a/WebCore/platform/gtk/WidgetGtk.cpp
+++ b/WebCore/platform/gtk/WidgetGtk.cpp
@@ -55,7 +55,7 @@ Widget::~Widget()
 
 void Widget::setFocus()
 {
-    gtk_widget_grab_focus(platformWidget() ? platformWidget() : GTK_WIDGET(root()->hostWindow()->platformWindow()));
+    gtk_widget_grab_focus(platformWidget() ? platformWidget() : GTK_WIDGET(root()->hostWindow()->platformPageClient()));
 }
 
 static GdkDrawable* gdkDrawable(PlatformWidget widget)
@@ -76,7 +76,7 @@ void Widget::setCursor(const Cursor& cursor)
     if (platformCursor == lastSetCursor)
         return;
 
-    gdk_window_set_cursor(gdkDrawable(platformWidget()) ? GDK_WINDOW(gdkDrawable(platformWidget())) : GTK_WIDGET(root()->hostWindow()->platformWindow())->window, platformCursor);
+    gdk_window_set_cursor(gdkDrawable(platformWidget()) ? GDK_WINDOW(gdkDrawable(platformWidget())) : GTK_WIDGET(root()->hostWindow()->platformPageClient())->window, platformCursor);
     lastSetCursor = platformCursor;
 }
 
diff --git a/WebCore/platform/haiku/ClipboardHaiku.cpp b/WebCore/platform/haiku/ClipboardHaiku.cpp
index 845c08c..a62c30c 100644
--- a/WebCore/platform/haiku/ClipboardHaiku.cpp
+++ b/WebCore/platform/haiku/ClipboardHaiku.cpp
@@ -27,8 +27,8 @@
 #include "config.h"
 #include "ClipboardHaiku.h"
 
-#include "IntPoint.h"
 #include "FileList.h"
+#include "IntPoint.h"
 #include "NotImplemented.h"
 #include "PlatformString.h"
 #include "StringHash.h"
@@ -42,7 +42,7 @@
 
 namespace WebCore {
 
-ClipboardHaiku::ClipboardHaiku(ClipboardAccessPolicy policy, bool forDragging) 
+ClipboardHaiku::ClipboardHaiku(ClipboardAccessPolicy policy, bool forDragging)
     : Clipboard(policy, forDragging)
 {
 }
@@ -61,7 +61,7 @@ void ClipboardHaiku::clearData(const String& type)
     }
 }
 
-void ClipboardHaiku::clearAllData() 
+void ClipboardHaiku::clearAllData()
 {
     if (be_clipboard->Lock()) {
         be_clipboard->Clear();
@@ -70,7 +70,7 @@ void ClipboardHaiku::clearAllData()
     }
 }
 
-String ClipboardHaiku::getData(const String& type, bool& success) const 
+String ClipboardHaiku::getData(const String& type, bool& success) const
 {
     BString result;
     success = false;
@@ -88,7 +88,7 @@ String ClipboardHaiku::getData(const String& type, bool& success) const
     return result;
 }
 
-bool ClipboardHaiku::setData(const String& type, const String& data) 
+bool ClipboardHaiku::setData(const String& type, const String& data)
 {
     bool result = false;
 
@@ -110,7 +110,7 @@ bool ClipboardHaiku::setData(const String& type, const String& data)
 }
 
 // Extensions beyond IE's API.
-HashSet<String> ClipboardHaiku::types() const 
+HashSet<String> ClipboardHaiku::types() const
 {
     HashSet<String> result;
 
@@ -138,27 +138,27 @@ PassRefPtr<FileList> ClipboardHaiku::files() const
     return 0;
 }
 
-IntPoint ClipboardHaiku::dragLocation() const 
-{ 
+IntPoint ClipboardHaiku::dragLocation() const
+{
     notImplemented();
     return IntPoint(0, 0);
 }
 
-CachedImage* ClipboardHaiku::dragImage() const 
+CachedImage* ClipboardHaiku::dragImage() const
 {
     notImplemented();
-    return 0; 
+    return 0;
 }
 
-void ClipboardHaiku::setDragImage(CachedImage*, const IntPoint&) 
+void ClipboardHaiku::setDragImage(CachedImage*, const IntPoint&)
 {
     notImplemented();
 }
 
-Node* ClipboardHaiku::dragImageElement() 
+Node* ClipboardHaiku::dragImageElement()
 {
     notImplemented();
-    return 0; 
+    return 0;
 }
 
 void ClipboardHaiku::setDragImageElement(Node*, const IntPoint&)
@@ -167,27 +167,27 @@ void ClipboardHaiku::setDragImageElement(Node*, const IntPoint&)
 }
 
 DragImageRef ClipboardHaiku::createDragImage(IntPoint& dragLocation) const
-{ 
+{
     notImplemented();
     return 0;
 }
 
-void ClipboardHaiku::declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*) 
+void ClipboardHaiku::declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*)
 {
     notImplemented();
 }
 
-void ClipboardHaiku::writeURL(const KURL&, const String&, Frame*) 
+void ClipboardHaiku::writeURL(const KURL&, const String&, Frame*)
 {
     notImplemented();
 }
 
-void ClipboardHaiku::writeRange(Range*, Frame*) 
+void ClipboardHaiku::writeRange(Range*, Frame*)
 {
     notImplemented();
 }
 
-bool ClipboardHaiku::hasData() 
+bool ClipboardHaiku::hasData()
 {
     bool result = false;
 
diff --git a/WebCore/platform/haiku/ContextMenuHaiku.cpp b/WebCore/platform/haiku/ContextMenuHaiku.cpp
index 03b8978..b978433 100644
--- a/WebCore/platform/haiku/ContextMenuHaiku.cpp
+++ b/WebCore/platform/haiku/ContextMenuHaiku.cpp
@@ -27,30 +27,27 @@
 #include "config.h"
 #include "ContextMenu.h"
 
-#include "ContextMenuItem.h"
 #include "ContextMenuController.h"
+#include "ContextMenuItem.h"
+#include "Document.h"
 #include "Frame.h"
 #include "FrameView.h"
-#include "Document.h"
-
-#include <wtf/Assertions.h>
-
 #include <Looper.h>
 #include <Menu.h>
 #include <Message.h>
+#include <wtf/Assertions.h>
 
 
 namespace WebCore {
 
 // FIXME: This class isn't used yet
-class ContextMenuReceiver : public BLooper
-{
+class ContextMenuReceiver : public BLooper {
 public:
     ContextMenuReceiver(ContextMenu* menu)
         : BLooper("context_menu_receiver")
         , m_menu(menu)
+        , m_result(-1)
     {
-        m_result = -1;
     }
 
     void HandleMessage(BMessage* msg)
@@ -80,21 +77,8 @@ private:
 
 ContextMenu::ContextMenu(const HitTestResult& result)
     : m_hitTestResult(result)
-    , m_platformDescription(NULL)
+    , m_platformDescription(new BMenu("context_menu"))
 {
-    /* Get position */
-    if (result.innerNode() && result.innerNode()->document()) {
-        BView* view = result.innerNode()->document()->frame()->view()->platformWidget();
-        int child = 0;
-        while (view->ChildAt(child)) {
-            if (view->ChildAt(child)->Name() == "scroll_view_canvas") {
-                m_point = view->ChildAt(child)->ConvertToScreen(BPoint(result.point().x(), result.point().y()));
-                break;
-            }
-            child++;
-        }
-    }
-    m_platformDescription = new BMenu("context_menu");
 }
 
 ContextMenu::~ContextMenu()
@@ -106,9 +90,9 @@ void ContextMenu::appendItem(ContextMenuItem& item)
 {
     checkOrEnableIfNeeded(item);
 
-    BMenuItem* bItem = item.releasePlatformDescription();
-    if (bItem)
-        m_platformDescription->AddItem(bItem);
+    BMenuItem* menuItem = item.releasePlatformDescription();
+    if (menuItem)
+        m_platformDescription->AddItem(menuItem);
 }
 
 unsigned ContextMenu::itemCount() const
@@ -120,9 +104,9 @@ void ContextMenu::insertItem(unsigned position, ContextMenuItem& item)
 {
     checkOrEnableIfNeeded(item);
 
-    BMenuItem* bItem = item.releasePlatformDescription();
-    if (bItem)
-        m_platformDescription->AddItem(bItem, position);
+    BMenuItem* menuItem = item.releasePlatformDescription();
+    if (menuItem)
+        m_platformDescription->AddItem(menuItem, position);
 }
 
 PlatformMenuDescription ContextMenu::platformDescription() const
diff --git a/WebCore/platform/haiku/CookieJarHaiku.cpp b/WebCore/platform/haiku/CookieJarHaiku.cpp
index 73519d7..831b379 100644
--- a/WebCore/platform/haiku/CookieJarHaiku.cpp
+++ b/WebCore/platform/haiku/CookieJarHaiku.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "StringHash.h"
@@ -41,21 +42,33 @@ namespace WebCore {
 // FIXME: Shouldn't this be saved to and restored from disk too?
 static HashMap<String, String> cookieJar;
 
-void setCookies(const KURL& url, const KURL& /*policyURL*/, const String& value)
+void setCookies(Document*, const KURL& url, const String& value)
 {
     cookieJar.set(url.string(), value);
 }
 
-String cookies(const KURL& url)
+String cookies(const Document*, const KURL& url)
 {
     return cookieJar.get(url.string());
 }
 
-bool cookiesEnabled()
+bool cookiesEnabled(const Document*)
 {
     // FIXME: This should probably be a setting
     return true;
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 } // namespace WebCore
 
diff --git a/WebCore/platform/haiku/DragDataHaiku.cpp b/WebCore/platform/haiku/DragDataHaiku.cpp
index b42b311..4a20147 100644
--- a/WebCore/platform/haiku/DragDataHaiku.cpp
+++ b/WebCore/platform/haiku/DragDataHaiku.cpp
@@ -27,10 +27,9 @@
 #include "config.h"
 #include "DragData.h"
 
+#include "ClipboardHaiku.h"
 #include "Document.h"
 #include "DocumentFragment.h"
-#include "ClipboardHaiku.h"
-
 #include "NotImplemented.h"
 
 
@@ -79,7 +78,7 @@ Color DragData::asColor() const
 
 WTF::PassRefPtr<Clipboard> DragData::createClipboard(ClipboardAccessPolicy policy) const
 {
-    return new ClipboardHaiku(policy, true);
+    return ClipboardHaiku::create(policy, true);
 }
 
 bool DragData::containsCompatibleContent() const
@@ -104,6 +103,6 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Document*) const
     notImplemented();
     return 0;
 }
-    
+
 } // namespace WebCore
 
diff --git a/WebCore/platform/haiku/LocalizedStringsHaiku.cpp b/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
new file mode 100644
index 0000000..a37ffcc
--- /dev/null
+++ b/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
@@ -0,0 +1,346 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LocalizedStrings.h"
+
+#include "PlatformString.h"
+
+
+namespace WebCore {
+String submitButtonDefaultLabel()
+{
+    return "Submit";
+}
+
+String inputElementAltText()
+{
+    return String();
+}
+
+String resetButtonDefaultLabel()
+{
+    return "Reset";
+}
+
+String defaultLanguage()
+{
+    return "en";
+}
+
+String searchableIndexIntroduction()
+{
+    return "Searchable Index";
+}
+
+String fileButtonChooseFileLabel()
+{
+    return "Choose File";
+}
+
+String fileButtonNoFileSelectedLabel()
+{
+    return "No file selected";
+}
+
+String contextMenuItemTagOpenLinkInNewWindow()
+{
+    return "Open in new tab";
+}
+
+String contextMenuItemTagDownloadLinkToDisk()
+{
+    return "Download link to disk";
+}
+
+String contextMenuItemTagCopyLinkToClipboard()
+{
+    return "Copy link to clipboard";
+}
+
+String contextMenuItemTagOpenImageInNewWindow()
+{
+    return "Open image in new window";
+}
+
+String contextMenuItemTagDownloadImageToDisk()
+{
+    return "Download image to disk";
+}
+
+String contextMenuItemTagCopyImageToClipboard()
+{
+    return "Copy image to clipboard";
+}
+
+String contextMenuItemTagOpenFrameInNewWindow()
+{
+    return "Open frame in new window";
+}
+
+String contextMenuItemTagCopy()
+{
+    return "Copy";
+}
+
+String contextMenuItemTagGoBack()
+{
+    return "Go back";
+}
+
+String contextMenuItemTagGoForward()
+{
+    return "Go forward";
+}
+
+String contextMenuItemTagStop()
+{
+    return "Stop";
+}
+
+String contextMenuItemTagReload()
+{
+    return "Reload";
+}
+
+String contextMenuItemTagCut()
+{
+    return "Cut";
+}
+
+String contextMenuItemTagPaste()
+{
+    return "Paste";
+}
+
+String contextMenuItemTagNoGuessesFound()
+{
+    return "No guesses found";
+}
+
+String contextMenuItemTagIgnoreSpelling()
+{
+    return "Ignore spelling";
+}
+
+String contextMenuItemTagLearnSpelling()
+{
+    return "Learn spelling";
+}
+
+String contextMenuItemTagSearchWeb()
+{
+    return "Search web";
+}
+
+String contextMenuItemTagLookUpInDictionary()
+{
+    return "Lookup in dictionary";
+}
+
+String contextMenuItemTagOpenLink()
+{
+    return "Open link";
+}
+
+String contextMenuItemTagIgnoreGrammar()
+{
+    return "Ignore grammar";
+}
+
+String contextMenuItemTagSpellingMenu()
+{
+    return "Spelling menu";
+}
+
+String contextMenuItemTagShowSpellingPanel(bool show)
+{
+    return "Show spelling panel";
+}
+
+String contextMenuItemTagCheckSpelling()
+{
+    return "Check spelling";
+}
+
+String contextMenuItemTagCheckSpellingWhileTyping()
+{
+    return "Check spelling while typing";
+}
+
+String contextMenuItemTagCheckGrammarWithSpelling()
+{
+    return "Check for grammar with spelling";
+}
+
+String contextMenuItemTagFontMenu()
+{
+    return "Font menu";
+}
+
+String contextMenuItemTagBold()
+{
+    return "Bold";
+}
+
+String contextMenuItemTagItalic()
+{
+    return "Italic";
+}
+
+String contextMenuItemTagUnderline()
+{
+    return "Underline";
+}
+
+String contextMenuItemTagOutline()
+{
+    return "Outline";
+}
+
+String contextMenuItemTagWritingDirectionMenu()
+{
+    return "Writing direction menu";
+}
+
+String contextMenuItemTagDefaultDirection()
+{
+    return "Default direction";
+}
+
+String contextMenuItemTagLeftToRight()
+{
+    return "Left to right";
+}
+
+String contextMenuItemTagRightToLeft()
+{
+    return "Right to left";
+}
+
+String contextMenuItemTagInspectElement()
+{
+    return "Inspect";
+}
+
+String searchMenuNoRecentSearchesText()
+{
+    return "No recent text searches";
+}
+
+String searchMenuRecentSearchesText()
+{
+    return "Recent text searches";
+}
+
+String searchMenuClearRecentSearchesText()
+{
+    return "Clear recent text searches";
+}
+
+String unknownFileSizeText()
+{
+    return "Unknown";
+}
+
+String AXWebAreaText()
+{
+    return String();
+}
+
+String AXLinkText()
+{
+    return String();
+}
+
+String AXListMarkerText()
+{
+    return String();
+}
+
+String AXImageMapText()
+{
+    return String();
+}
+
+String AXHeadingText()
+{
+    return String();
+}
+
+String imageTitle(const String& filename, const IntSize& size)
+{
+    return String(filename);
+}
+
+String contextMenuItemTagTextDirectionMenu()
+{
+    return String();
+}
+
+String AXButtonActionVerb()
+{
+    return String();
+}
+
+String AXTextFieldActionVerb()
+{
+    return String();
+}
+
+String AXRadioButtonActionVerb()
+{
+    return String();
+}
+
+String AXCheckedCheckBoxActionVerb()
+{
+    return String();
+}
+
+String AXUncheckedCheckBoxActionVerb()
+{
+    return String();
+}
+
+String AXLinkActionVerb()
+{
+    return String();
+}
+
+String AXDefinitionListTermText()
+{
+    return String();
+}
+
+String AXDefinitionListDefinitionText()
+{
+    return String();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/haiku/LoggingHaiku.cpp b/WebCore/platform/haiku/LoggingHaiku.cpp
new file mode 100644
index 0000000..f09c483
--- /dev/null
+++ b/WebCore/platform/haiku/LoggingHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Logging.h"
+
+
+namespace WebCore {
+
+void InitializeLoggingChannelsIfNecessary()
+{
+    // FIXME: Should read the logging channels from a file.
+    static bool haveInitializedLoggingChannels = false;
+    if (haveInitializedLoggingChannels)
+        return;
+
+    haveInitializedLoggingChannels = true;
+
+    LogEvents.state = WTFLogChannelOn;
+    LogFrames.state = WTFLogChannelOn;
+    LogLoading.state = WTFLogChannelOn;
+    LogPlatformLeaks.state = WTFLogChannelOn;
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/haiku/PasteboardHaiku.cpp b/WebCore/platform/haiku/PasteboardHaiku.cpp
index 67a7f5b..8ad72ca 100644
--- a/WebCore/platform/haiku/PasteboardHaiku.cpp
+++ b/WebCore/platform/haiku/PasteboardHaiku.cpp
@@ -68,6 +68,23 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     clipboard.Unlock();
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    BClipboard clipboard("WebKit");
+    if (!clipboard.Lock())
+        return;
+
+    clipboard.Clear();
+    BMessage* data = clipboard.Data();
+    if (!data)
+        return;
+
+    data->AddString("text/plain", BString(text));
+    clipboard.Commit();
+
+    clipboard.Unlock();
+}
+
 bool Pasteboard::canSmartReplace()
 {
     notImplemented();
diff --git a/WebCore/platform/haiku/RenderThemeHaiku.cpp b/WebCore/platform/haiku/RenderThemeHaiku.cpp
new file mode 100644
index 0000000..4327795
--- /dev/null
+++ b/WebCore/platform/haiku/RenderThemeHaiku.cpp
@@ -0,0 +1,178 @@
+/*
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ *               2006 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#include "config.h"
+#include "RenderThemeHaiku.h"
+
+#include "GraphicsContext.h"
+#include "NotImplemented.h"
+#include <ControlLook.h>
+#include <View.h>
+
+
+namespace WebCore {
+
+PassRefPtr<RenderTheme> RenderThemeHaiku::create()
+{
+    return adoptRef(new RenderThemeHaiku());
+}
+
+PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page*)
+{
+    static RenderTheme* renderTheme = RenderThemeHaiku::create().releaseRef();
+    return renderTheme;
+}
+
+RenderThemeHaiku::RenderThemeHaiku()
+{
+}
+
+RenderThemeHaiku::~RenderThemeHaiku()
+{
+}
+
+static bool supportsFocus(ControlPart appearance)
+{
+    switch (appearance) {
+    case PushButtonPart:
+    case ButtonPart:
+    case TextFieldPart:
+    case TextAreaPart:
+    case SearchFieldPart:
+    case MenulistPart:
+    case RadioPart:
+    case CheckboxPart:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool RenderThemeHaiku::supportsFocusRing(const RenderStyle* style) const
+{
+    return supportsFocus(style->appearance());
+}
+
+Color RenderThemeHaiku::platformActiveSelectionBackgroundColor() const
+{
+    return Color(ui_color(B_CONTROL_HIGHLIGHT_COLOR));
+}
+
+Color RenderThemeHaiku::platformInactiveSelectionBackgroundColor() const
+{
+    return Color(ui_color(B_CONTROL_HIGHLIGHT_COLOR));
+}
+
+Color RenderThemeHaiku::platformActiveSelectionForegroundColor() const
+{
+    return Color(ui_color(B_CONTROL_TEXT_COLOR));
+}
+
+Color RenderThemeHaiku::platformInactiveSelectionForegroundColor() const
+{
+    return Color(ui_color(B_CONTROL_TEXT_COLOR));
+}
+
+Color RenderThemeHaiku::platformTextSearchHighlightColor() const
+{
+    return Color(ui_color(B_MENU_SELECTED_BACKGROUND_COLOR));
+}
+
+void RenderThemeHaiku::systemFont(int propId, FontDescription&) const
+{
+    notImplemented();
+}
+
+bool RenderThemeHaiku::paintCheckbox(RenderObject*, const RenderObject::PaintInfo& info, const IntRect& intRect)
+{
+    if (info.context->paintingDisabled())
+        return false;
+
+    rgb_color base = ui_color(B_PANEL_BACKGROUND_COLOR);
+    BRect rect = intRect;
+    BView* view = info.context->platformContext();
+
+    if (!be_control_look)
+        return false;
+
+    be_control_look->DrawCheckBox(view, rect, rect, base);
+    return true;
+}
+
+void RenderThemeHaiku::setCheckboxSize(RenderStyle* style) const
+{
+    int size = 10;
+
+    // If the width and height are both specified, then we have nothing to do.
+    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
+        return;
+
+    // FIXME: A hard-coded size of 'size' is used. This is wrong but necessary for now.
+    if (style->width().isIntrinsicOrAuto())
+        style->setWidth(Length(size, Fixed));
+
+    if (style->height().isAuto())
+        style->setHeight(Length(size, Fixed));
+}
+
+bool RenderThemeHaiku::paintRadio(RenderObject*, const RenderObject::PaintInfo& info, const IntRect& intRect)
+{
+    if (info.context->paintingDisabled())
+        return false;
+
+    rgb_color base = ui_color(B_PANEL_BACKGROUND_COLOR);
+    BRect rect = intRect;
+    BView* view = info.context->platformContext();
+
+    if (!be_control_look)
+        return false;
+
+    be_control_look->DrawRadioButton(view, rect, rect, base);
+    return true;
+}
+
+void RenderThemeHaiku::setRadioSize(RenderStyle* style) const
+{
+    // This is the same as checkboxes.
+    setCheckboxSize(style);
+}
+
+void RenderThemeHaiku::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Leave some space for the arrow.
+    style->setPaddingRight(Length(22, Fixed));
+    const int minHeight = 20;
+    style->setMinHeight(Length(minHeight, Fixed));
+}
+
+bool RenderThemeHaiku::paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
+{
+    notImplemented();
+    return false;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/haiku/RenderThemeHaiku.h b/WebCore/platform/haiku/RenderThemeHaiku.h
new file mode 100644
index 0000000..7daebc4
--- /dev/null
+++ b/WebCore/platform/haiku/RenderThemeHaiku.h
@@ -0,0 +1,70 @@
+/*
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#ifndef RenderThemeHaiku_h
+#define RenderThemeHaiku_h
+
+#include "RenderTheme.h"
+
+namespace WebCore {
+
+    class RenderThemeHaiku : public RenderTheme {
+    private:
+        RenderThemeHaiku();
+        virtual ~RenderThemeHaiku();
+
+    public:
+        static PassRefPtr<RenderTheme> create();
+
+        // A method asking if the theme's controls actually care about redrawing when hovered.
+        virtual bool supportsHover(const RenderStyle* style) const { return false; }
+
+        // A method asking if the theme is able to draw the focus ring.
+        virtual bool supportsFocusRing(const RenderStyle*) const;
+
+        // The platform selection color.
+        virtual Color platformActiveSelectionBackgroundColor() const;
+        virtual Color platformInactiveSelectionBackgroundColor() const;
+        virtual Color platformActiveSelectionForegroundColor() const;
+        virtual Color platformInactiveSelectionForegroundColor() const;
+
+        virtual Color platformTextSearchHighlightColor() const;
+
+        // System fonts.
+        virtual void systemFont(int propId, FontDescription&) const;
+
+    protected:
+        virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void setCheckboxSize(RenderStyle*) const;
+
+        virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void setRadioSize(RenderStyle*) const;
+
+        virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    };
+
+} // namespace WebCore
+
+#endif // RenderThemeHaiku_h
diff --git a/WebCore/platform/haiku/ScrollbarThemeHaiku.cpp b/WebCore/platform/haiku/ScrollbarThemeHaiku.cpp
new file mode 100644
index 0000000..8adab3d
--- /dev/null
+++ b/WebCore/platform/haiku/ScrollbarThemeHaiku.cpp
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright 2009 Maxime Simon <simon.maxime@gmail.com> All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ScrollbarThemeHaiku.h"
+
+#include "GraphicsContext.h"
+#include "Scrollbar.h"
+#include <ControlLook.h>
+#include <InterfaceDefs.h>
+
+
+int buttonWidth(int scrollbarWidth, int thickness)
+{
+    return scrollbarWidth < 2 * thickness ? scrollbarWidth / 2 : thickness;
+}
+
+namespace WebCore {
+
+ScrollbarTheme* ScrollbarTheme::nativeTheme()
+{
+    static ScrollbarThemeHaiku theme;
+    return &theme;
+}
+
+ScrollbarThemeHaiku::ScrollbarThemeHaiku()
+{
+}
+
+ScrollbarThemeHaiku::~ScrollbarThemeHaiku()
+{
+}
+
+int ScrollbarThemeHaiku::scrollbarThickness(ScrollbarControlSize controlSize)
+{
+    // FIXME: Should we make a distinction between a Small and a Regular Scrollbar?
+    return 16;
+}
+
+bool ScrollbarThemeHaiku::hasButtons(Scrollbar* scrollbar)
+{
+    return scrollbar->enabled();
+}
+
+bool ScrollbarThemeHaiku::hasThumb(Scrollbar* scrollbar)
+{
+    return scrollbar->enabled() && thumbLength(scrollbar) > 0;
+}
+
+IntRect ScrollbarThemeHaiku::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+{
+    if (part == BackButtonEndPart)
+        return IntRect();
+
+    int thickness = scrollbarThickness();
+    IntPoint buttonOrigin(scrollbar->x(), scrollbar->y());
+    IntSize buttonSize = scrollbar->orientation() == HorizontalScrollbar
+        ? IntSize(buttonWidth(scrollbar->width(), thickness), thickness)
+        : IntSize(thickness, buttonWidth(scrollbar->height(), thickness));
+    IntRect buttonRect(buttonOrigin, buttonSize);
+
+    return buttonRect;
+}
+
+IntRect ScrollbarThemeHaiku::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+{
+    if (part == BackButtonStartPart)
+        return IntRect();
+
+    int thickness = scrollbarThickness();
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        int width = buttonWidth(scrollbar->width(), thickness);
+        return IntRect(scrollbar->x() + scrollbar->width() - width, scrollbar->y(), width, thickness);
+    }
+
+    int height = buttonWidth(scrollbar->height(), thickness);
+    return IntRect(scrollbar->x(), scrollbar->y() + scrollbar->height() - height, thickness, height);
+}
+
+IntRect ScrollbarThemeHaiku::trackRect(Scrollbar* scrollbar, bool)
+{
+    int thickness = scrollbarThickness();
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        if (scrollbar->width() < 2 * thickness)
+            return IntRect();
+        return IntRect(scrollbar->x() + thickness, scrollbar->y(), scrollbar->width() - 2 * thickness, thickness);
+    }
+    if (scrollbar->height() < 2 * thickness)
+        return IntRect();
+    return IntRect(scrollbar->x(), scrollbar->y() + thickness, thickness, scrollbar->height() - 2 * thickness);
+}
+
+void ScrollbarThemeHaiku::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
+{
+    if (!be_control_look)
+        return;
+
+    BRect rect = trackRect(scrollbar, false);
+    orientation scrollbarOrientation = scrollbar->orientation() == HorizontalScrollbar ? B_HORIZONTAL : B_VERTICAL;
+
+    be_control_look->DrawScrollBarBackground(context->platformContext(), rect, rect, ui_color(B_PANEL_BACKGROUND_COLOR), 0, scrollbarOrientation);
+}
+
+void ScrollbarThemeHaiku::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+{
+    if (!be_control_look)
+        return;
+
+    BRect drawRect = BRect(rect);
+    BView* view = context->platformContext();
+    rgb_color panelBgColor = ui_color(B_PANEL_BACKGROUND_COLOR);
+    rgb_color buttonBgColor = tint_color(panelBgColor, B_LIGHTEN_1_TINT);
+
+    be_control_look->DrawButtonFrame(view, drawRect, drawRect, buttonBgColor, panelBgColor);
+    be_control_look->DrawButtonBackground(view, drawRect, drawRect, buttonBgColor);
+
+    int arrowDirection;
+    if (scrollbar->orientation() == VerticalScrollbar)
+        arrowDirection = part == BackButtonStartPart ? BControlLook::B_UP_ARROW : BControlLook::B_DOWN_ARROW;
+    else
+        arrowDirection = part == BackButtonStartPart ? BControlLook::B_LEFT_ARROW : BControlLook::B_RIGHT_ARROW;
+
+    be_control_look->DrawArrowShape(view, drawRect, drawRect, ui_color(B_CONTROL_TEXT_COLOR), arrowDirection);
+}
+
+void ScrollbarThemeHaiku::paintThumb(GraphicsContext* context, Scrollbar*, const IntRect& rect)
+{
+    if (!be_control_look)
+        return;
+
+    BRect drawRect = BRect(rect);
+    BView* view = context->platformContext();
+    rgb_color panelBgColor = ui_color(B_PANEL_BACKGROUND_COLOR);
+    rgb_color buttonBgColor = tint_color(panelBgColor, B_LIGHTEN_1_TINT);
+
+    be_control_look->DrawButtonFrame(view, drawRect, drawRect, buttonBgColor, panelBgColor);
+    be_control_look->DrawButtonBackground(view, drawRect, drawRect, buttonBgColor);
+}
+
+}
+
diff --git a/WebCore/platform/haiku/ScrollbarThemeHaiku.h b/WebCore/platform/haiku/ScrollbarThemeHaiku.h
new file mode 100644
index 0000000..18e2cc0
--- /dev/null
+++ b/WebCore/platform/haiku/ScrollbarThemeHaiku.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright 2009 Maxime Simon <simon.maxime@gmail.com> All Rights Reserved
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ScrollbarThemeHaiku_h
+#define ScrollbarThemeHaiku_h
+
+#include "ScrollbarThemeComposite.h"
+
+namespace WebCore {
+    class Scrollbar;
+
+    class ScrollbarThemeHaiku : public ScrollbarThemeComposite {
+        public:
+            ScrollbarThemeHaiku();
+            virtual ~ScrollbarThemeHaiku();
+
+            virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
+
+            virtual bool hasButtons(Scrollbar*);
+            virtual bool hasThumb(Scrollbar*);
+
+            virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting);
+            virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting);
+            virtual IntRect trackRect(Scrollbar*, bool painting);
+
+            virtual void paintScrollbarBackground(GraphicsContext*, Scrollbar*);
+            virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
+            virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+    };
+
+}
+#endif
diff --git a/WebCore/platform/haiku/SharedBufferHaiku.cpp b/WebCore/platform/haiku/SharedBufferHaiku.cpp
new file mode 100644
index 0000000..113cd2e
--- /dev/null
+++ b/WebCore/platform/haiku/SharedBufferHaiku.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SharedBuffer.h"
+
+#include <File.h>
+#include <String.h>
+
+namespace WebCore {
+
+PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String& fileName)
+{
+    if (fileName.isEmpty())
+        return 0;
+
+    BFile file(BString(fileName).String(), B_READ_ONLY);
+    if (file.InitCheck() != B_OK)
+        return 0;
+
+    RefPtr<SharedBuffer> result = SharedBuffer::create();
+
+    off_t size;
+    file.GetSize(&size);
+    result->m_buffer.resize(size);
+    if (result->m_buffer.size() != size)
+        return 0;
+
+    file.Read(result->m_buffer.data(), result->m_buffer.size());
+    return result.release();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/haiku/SharedTimerHaiku.cpp b/WebCore/platform/haiku/SharedTimerHaiku.cpp
new file mode 100644
index 0000000..6265a2a
--- /dev/null
+++ b/WebCore/platform/haiku/SharedTimerHaiku.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SharedTimer.h"
+
+#include <MessageFilter.h>
+#include <MessageRunner.h>
+#include <Looper.h>
+#include <support/Locker.h>
+#include <support/Autolock.h>
+#include <wtf/CurrentTime.h>
+
+#define FIRE_MESSAGE 'fire'
+
+
+namespace WebCore {
+
+class SharedTimerHaiku: public BMessageFilter {
+    friend void setSharedTimerFiredFunction(void (*f)());
+public:
+    static SharedTimerHaiku* instance();
+
+    void start(double);
+    void stop();
+
+protected:
+    virtual filter_result Filter(BMessage*, BHandler**);
+
+private:
+    SharedTimerHaiku();
+    ~SharedTimerHaiku();
+
+    void (*m_timerFunction)();
+    bool m_shouldRun;
+};
+
+SharedTimerHaiku::SharedTimerHaiku()
+    : BMessageFilter(FIRE_MESSAGE)
+    , m_timerFunction(0)
+    , m_shouldRun(false)
+{
+}
+
+SharedTimerHaiku::~SharedTimerHaiku()
+{
+}
+
+SharedTimerHaiku* SharedTimerHaiku::instance()
+{
+    BLooper* looper = BLooper::LooperForThread(find_thread(0));
+    static SharedTimerHaiku* timer;
+
+    if (!timer) {
+        BAutolock lock(looper);
+        timer = new SharedTimerHaiku();
+        looper->AddCommonFilter(timer);
+    }
+
+    return timer;
+}
+
+void SharedTimerHaiku::start(double fireTime)
+{
+    m_shouldRun = true;
+
+    double intervalInSeconds = fireTime - currentTime();
+    bigtime_t intervalInMicroSeconds = intervalInSeconds < 0 ? 0 : intervalInSeconds * 1000000;
+
+    BMessageRunner::StartSending(Looper(), new BMessage(FIRE_MESSAGE), intervalInMicroSeconds, 1);
+}
+
+void SharedTimerHaiku::stop()
+{
+    m_shouldRun = false;
+}
+
+filter_result SharedTimerHaiku::Filter(BMessage*, BHandler**)
+{
+    if (m_shouldRun && m_timerFunction)
+        m_timerFunction();
+
+    return B_SKIP_MESSAGE;
+}
+
+// WebCore functions
+void setSharedTimerFiredFunction(void (*f)())
+{
+    SharedTimerHaiku::instance()->m_timerFunction = f;
+}
+
+void setSharedTimerFireTime(double fireTime)
+{
+    SharedTimerHaiku::instance()->start(fireTime);
+}
+
+void stopSharedTimer()
+{
+    SharedTimerHaiku::instance()->stop();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/haiku/TemporaryLinkStubs.cpp b/WebCore/platform/haiku/TemporaryLinkStubs.cpp
index 48380fc..aa3d538 100644
--- a/WebCore/platform/haiku/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/haiku/TemporaryLinkStubs.cpp
@@ -33,40 +33,11 @@
 
 #include "config.h"
 
-#include "AXObjectCache.h"
-#include "CachedResource.h"
-#include "CookieJar.h"
-#include "Cursor.h"
-#include "DataGridColumnList.h"
-#include "FileSystem.h"
-#include "Font.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "GraphicsContext.h"
-#include "History.h"
-#include "IconLoader.h"
-#include "InspectorController.h"
-#include "IntPoint.h"
 #include "KURL.h"
-#include "Language.h"
-#include "Node.h"
 #include "NotImplemented.h"
-#include "Path.h"
-#include "PlatformMouseEvent.h"
-#include "PlatformScrollBar.h"
-#include "PluginInfoStore.h"
-#include "RenderTheme.h"
-#include "Screen.h"
-#include "Scrollbar.h"
-#include "ScrollbarTheme.h"
-#include "SharedBuffer.h"
-#include "TextBoundaries.h"
-#include "Threading.h"
-#include "Widget.h"
-#include "loader.h"
-#include <runtime/JSValue.h>
-#include <stdio.h>
-#include <stdlib.h>
+#include "PlatformString.h"
+#include "SSLKeyGenerator.h"
+#include "SystemTime.h"
 
 using namespace WebCore;
 
@@ -78,20 +49,14 @@ Vector<char> loadResourceIntoArray(const char*)
 
 namespace WebCore {
 
-bool historyContains(String const&)
+String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String &challengeString, const KURL &url)
 {
-    return false;
+    return String();
 }
 
-Vector<String> supportedKeySizes()
+void getSupportedKeySizes(Vector<String>&)
 {
     notImplemented();
-    return Vector<String>();
-}
-
-String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String &challengeString, const KURL &url)
-{
-    return String();
 }
 
 float userIdleTime()
@@ -105,22 +70,11 @@ void callOnMainThread(void (*)())
     notImplemented();
 }
 
-PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String&)
-{
-    notImplemented();
-    return 0;
-}
-
 String KURL::fileSystemPath() const
 {
     notImplemented();
     return String();
 }
 
-void getSupportedKeySizes(Vector<String>&)
-{
-    notImplemented();
-}
-
 } // namespace WebCore
 
diff --git a/WebCore/platform/image-decoders/ImageDecoder.cpp b/WebCore/platform/image-decoders/ImageDecoder.cpp
new file mode 100644
index 0000000..a16b940
--- /dev/null
+++ b/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -0,0 +1,248 @@
+/*
+ * Copyright (C) 2008-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#include "ImageDecoder.h"
+
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+#include <algorithm>
+#endif
+
+#include "BMPImageDecoder.h"
+#include "GIFImageDecoder.h"
+#include "ICOImageDecoder.h"
+#include "JPEGImageDecoder.h"
+#include "PNGImageDecoder.h"
+#include "SharedBuffer.h"
+#include "XBMImageDecoder.h"
+
+namespace WebCore {
+
+ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
+{
+    // We need at least 4 bytes to figure out what kind of image we're dealing with.
+    int length = data.size();
+    if (length < 4)
+        return 0;
+
+    const unsigned char* uContents = (const unsigned char*)data.data();
+    const char* contents = data.data();
+
+    // GIFs begin with GIF8(7 or 9).
+    if (strncmp(contents, "GIF8", 4) == 0)
+        return new GIFImageDecoder();
+
+    // Test for PNG.
+    if (uContents[0]==0x89 &&
+        uContents[1]==0x50 &&
+        uContents[2]==0x4E &&
+        uContents[3]==0x47)
+        return new PNGImageDecoder();
+
+    // JPEG
+    if (uContents[0]==0xFF &&
+        uContents[1]==0xD8 &&
+        uContents[2]==0xFF)
+        return new JPEGImageDecoder();
+
+    // BMP
+    if (strncmp(contents, "BM", 2) == 0)
+        return new BMPImageDecoder();
+
+    // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
+    // CURs begin with 2-byte 0 followed by 2-byte 2.
+    if (!memcmp(contents, "\000\000\001\000", 4) ||
+        !memcmp(contents, "\000\000\002\000", 4))
+        return new ICOImageDecoder();
+
+    // XBMs require 8 bytes of info.
+    if (length >= 8 && strncmp(contents, "#define ", 8) == 0)
+        return new XBMImageDecoder();
+
+    // Give up. We don't know what the heck this is.
+    return 0;
+}
+
+#if !PLATFORM(SKIA)
+
+RGBA32Buffer::RGBA32Buffer()
+    : m_hasAlpha(false)
+    , m_status(FrameEmpty)
+    , m_duration(0)
+    , m_disposalMethod(DisposeNotSpecified)
+{
+} 
+
+void RGBA32Buffer::clear()
+{
+    m_bytes.clear();
+    m_status = FrameEmpty;
+    // NOTE: Do not reset other members here; clearFrameBufferCache()
+    // calls this to free the bitmap data, but other functions like
+    // initFrameBuffer() and frameComplete() may still need to read
+    // other metadata out of this frame later.
+}
+
+void RGBA32Buffer::zeroFill()
+{
+    m_bytes.fill(0);
+    m_hasAlpha = true;
+}
+
+void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return;
+
+    m_bytes = other.m_bytes;
+    m_size = other.m_size;
+    setHasAlpha(other.m_hasAlpha);
+}
+
+bool RGBA32Buffer::setSize(int newWidth, int newHeight)
+{
+    // NOTE: This has no way to check for allocation failure if the
+    // requested size was too big...
+    m_bytes.resize(newWidth * newHeight);
+    m_size = IntSize(newWidth, newHeight);
+
+    // Zero the image.
+    zeroFill();
+
+    return true;
+}
+
+bool RGBA32Buffer::hasAlpha() const
+{
+    return m_hasAlpha;
+}
+
+void RGBA32Buffer::setHasAlpha(bool alpha)
+{
+    m_hasAlpha = alpha;
+}
+
+void RGBA32Buffer::setStatus(FrameStatus status)
+{
+    m_status = status;
+}
+
+RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return *this;
+
+    copyBitmapData(other);
+    setRect(other.rect());
+    setStatus(other.status());
+    setDuration(other.duration());
+    setDisposalMethod(other.disposalMethod());
+    return *this;
+}
+
+int RGBA32Buffer::width() const
+{
+    return m_size.width();
+}
+
+int RGBA32Buffer::height() const
+{
+    return m_size.height();
+}
+
+#endif
+
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+
+namespace {
+
+enum MatchType {
+    Exact,
+    UpperBound,
+    LowerBound
+};
+
+inline void fillScaledValues(Vector<int>& scaledValues, double scaleRate, int length)
+{
+    double inflateRate = 1. / scaleRate;
+    scaledValues.reserveCapacity(static_cast<int>(length * scaleRate + 0.5));
+    for (int scaledIndex = 0;;) {
+        int index = static_cast<int>(scaledIndex * inflateRate + 0.5);
+        if (index < length) {
+            scaledValues.append(index);
+            ++scaledIndex;
+        } else
+            break;
+    }
+}
+
+template <MatchType type> int getScaledValue(const Vector<int>& scaledValues, int valueToMatch, int searchStart)
+{
+    const int* dataStart = scaledValues.data();
+    const int* dataEnd = dataStart + scaledValues.size();
+    const int* matched = std::lower_bound(dataStart + searchStart, dataEnd, valueToMatch);
+    switch (type) {
+    case Exact:
+        return matched != dataEnd && *matched == valueToMatch ? matched - dataStart : -1;
+    case LowerBound:
+        return matched != dataEnd && *matched == valueToMatch ? matched - dataStart : matched - dataStart - 1;
+    case UpperBound:
+    default:
+        return matched != dataEnd ? matched - dataStart : -1;
+    }
+}
+
+}
+
+void ImageDecoder::prepareScaleDataIfNecessary()
+{
+    int width = m_size.width();
+    int height = m_size.height();
+    int numPixels = height * width;
+    if (m_maxNumPixels <= 0 || numPixels <= m_maxNumPixels) {
+        m_scaled = false;
+        return;
+    }
+
+    m_scaled = true;
+    double scale = sqrt(m_maxNumPixels / (double)numPixels);
+    fillScaledValues(m_scaledColumns, scale, width);
+    fillScaledValues(m_scaledRows, scale, height);
+}
+
+int ImageDecoder::upperBoundScaledX(int origX, int searchStart)
+{
+    return getScaledValue<UpperBound>(m_scaledColumns, origX, searchStart);
+}
+
+int ImageDecoder::lowerBoundScaledX(int origX, int searchStart)
+{
+    return getScaledValue<LowerBound>(m_scaledColumns, origX, searchStart);
+}
+
+int ImageDecoder::scaledY(int origY, int searchStart)
+{
+    return getScaledValue<Exact>(m_scaledRows, origY, searchStart);
+}
+
+#endif // ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+
+}
diff --git a/WebCore/platform/image-decoders/ImageDecoder.h b/WebCore/platform/image-decoders/ImageDecoder.h
index 57f8735..37196fe 100644
--- a/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/WebCore/platform/image-decoders/ImageDecoder.h
@@ -1,5 +1,7 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008-2009 Torch Mobile, Inc.
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,7 +39,8 @@
 #if (PLATFORM(SKIA) || PLATFORM(SGL))
 // TODO(benm): ANDROID: Can we define PLATFORM(SKIA) instead of PLATFORM(SGL) before upstreaming?
 #include "NativeImageSkia.h"
-#include "SkBitmap.h"
+#elif PLATFORM(QT)
+#include <QImage>
 #endif
 
 namespace WebCore {
@@ -55,7 +58,11 @@ namespace WebCore {
             DisposeOverwriteBgcolor,   // Clear frame to transparent
             DisposeOverwritePrevious,  // Clear frame to previous framebuffer contents
         };
+<<<<<<< HEAD:WebCore/platform/image-decoders/ImageDecoder.h
 #if (PLATFORM(SKIA) || PLATFORM(SGL))
+=======
+#if PLATFORM(SKIA) || PLATFORM(QT)
+>>>>>>> webkit.org at 49305:WebCore/platform/image-decoders/ImageDecoder.h
         typedef uint32_t PixelData;
 #else
         typedef unsigned PixelData;
@@ -132,6 +139,11 @@ namespace WebCore {
             setRGBA(getAddr(x, y), r, g, b, a);
         }
 
+#if PLATFORM(QT)
+        void setDecodedImage(const QImage& image);
+        QImage decodedImage() const { return m_image; }
+#endif
+
     private:
         RGBA32Buffer& operator=(const RGBA32Buffer& other);
 
@@ -140,13 +152,18 @@ namespace WebCore {
 
         inline PixelData* getAddr(int x, int y)
         {
+<<<<<<< HEAD:WebCore/platform/image-decoders/ImageDecoder.h
 #if PLATFORM(CAIRO) || PLATFORM(WX)
             return m_bytes.data() + (y * width()) + x;
 #elif (PLATFORM(SKIA) || PLATFORM(SGL))
+=======
+#if PLATFORM(SKIA)
+>>>>>>> webkit.org at 49305:WebCore/platform/image-decoders/ImageDecoder.h
             return m_bitmap.getAddr32(x, y);
+#elif PLATFORM(QT)
+            return reinterpret_cast<QRgb*>(m_image.scanLine(y)) + x;
 #else
-            ASSERT_NOT_REACHED();
-            return 0;
+            return m_bytes.data() + (y * width()) + x;
 #endif
         }
 
@@ -166,13 +183,22 @@ namespace WebCore {
             }
         }
 
-#if PLATFORM(CAIRO) || PLATFORM(WX)
+#if PLATFORM(SKIA)
+        NativeImageSkia m_bitmap;
+#elif PLATFORM(QT)
+        mutable QImage m_image;
+        bool m_hasAlpha;
+        IntSize m_size;
+#else
         Vector<PixelData> m_bytes;
         IntSize m_size;       // The size of the buffer.  This should be the
                               // same as ImageDecoder::m_size.
         bool m_hasAlpha;      // Whether or not any of the pixels in the buffer have transparency.
+<<<<<<< HEAD:WebCore/platform/image-decoders/ImageDecoder.h
 #elif (PLATFORM(SKIA) || PLATFORM(SGL))
         NativeImageSkia m_bitmap;
+=======
+>>>>>>> webkit.org at 49305:WebCore/platform/image-decoders/ImageDecoder.h
 #endif
         IntRect m_rect;       // The rect of the original specified frame within the overall buffer.
                               // This will always just be the entire buffer except for GIF frames
@@ -188,14 +214,27 @@ namespace WebCore {
     // and the base class manages the RGBA32 frame cache.
     class ImageDecoder {
     public:
+        // ENABLE(IMAGE_DECODER_DOWN_SAMPLING) allows image decoders to write directly to
+        // scaled output buffers by down sampling. Call setMaxNumPixels() to specify the
+        // biggest size that decoded images can have. Image decoders will deflate those
+        // images that are bigger than m_maxNumPixels. (Not supported by all image decoders yet)
         ImageDecoder()
             : m_failed(false)
             , m_sizeAvailable(false)
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+            , m_maxNumPixels(-1)
+            , m_scaled(false)
+#endif
         {
         }
 
         virtual ~ImageDecoder() {}
 
+        // Factory function to create an ImageDecoder.  Ports that subclass
+        // ImageDecoder can provide their own implementation of this to avoid
+        // needing to write a dedicated setData() implementation.
+        static ImageDecoder* create(const SharedBuffer& data);
+
         // The the filename extension usually associated with an undecoded image of this type.
         virtual String filenameExtension() const = 0;
 
@@ -272,8 +311,25 @@ namespace WebCore {
         // since in practice only GIFs will ever use this.
         virtual void clearFrameBufferCache(size_t clearBeforeFrame) { }
 
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        void setMaxNumPixels(int m) { m_maxNumPixels = m; }
+#endif
+
     protected:
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        void prepareScaleDataIfNecessary();
+        int upperBoundScaledX(int origX, int searchStart = 0);
+        int lowerBoundScaledX(int origX, int searchStart = 0);
+        int scaledY(int origY, int searchStart = 0);
+#endif
+
         RefPtr<SharedBuffer> m_data; // The encoded data.
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        int m_maxNumPixels;
+        Vector<int> m_scaledColumns;
+        Vector<int> m_scaledRows;
+        bool m_scaled;
+#endif
         Vector<RGBA32Buffer> m_frameBufferCache;
         bool m_failed;
 
diff --git a/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp b/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
index c53eabd..203205d 100644
--- a/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
+++ b/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
@@ -30,53 +30,6 @@
 
 namespace WebCore {
 
-RGBA32Buffer::RGBA32Buffer()
-    : m_hasAlpha(false)
-    , m_status(FrameEmpty)
-    , m_duration(0)
-    , m_disposalMethod(DisposeNotSpecified)
-{
-} 
-
-void RGBA32Buffer::clear()
-{
-    m_bytes.clear();
-    m_status = FrameEmpty;
-    // NOTE: Do not reset other members here; clearFrameBufferCache()
-    // calls this to free the bitmap data, but other functions like
-    // initFrameBuffer() and frameComplete() may still need to read
-    // other metadata out of this frame later.
-}
-
-void RGBA32Buffer::zeroFill()
-{
-    m_bytes.fill(0);
-    m_hasAlpha = true;
-}
-
-void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return;
-
-    m_bytes = other.m_bytes;
-    m_size = other.m_size;
-    setHasAlpha(other.m_hasAlpha);
-}
-
-bool RGBA32Buffer::setSize(int newWidth, int newHeight)
-{
-    // NOTE: This has no way to check for allocation failure if the
-    // requested size was too big...
-    m_bytes.resize(newWidth * newHeight);
-    m_size = IntSize(newWidth, newHeight);
-
-    // Zero the image.
-    zeroFill();
-
-    return true;
-}
-
 NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 {
     return cairo_image_surface_create_for_data(
@@ -85,40 +38,4 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
         width() * sizeof(PixelData));
 }
 
-bool RGBA32Buffer::hasAlpha() const
-{
-    return m_hasAlpha;
-}
-
-void RGBA32Buffer::setHasAlpha(bool alpha)
-{
-    m_hasAlpha = alpha;
-}
-
-void RGBA32Buffer::setStatus(FrameStatus status)
-{
-    m_status = status;
-}
-
-RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return *this;
-
-    copyBitmapData(other);
-    setRect(other.rect());
-    setStatus(other.status());
-    setDuration(other.duration());
-    setDisposalMethod(other.disposalMethod());
-    return *this;
-}
-
-int RGBA32Buffer::width() const {
-    return m_size.width();
-}
-
-int RGBA32Buffer::height() const {
-    return m_size.height();
-}
-
 } // namespace WebCore
diff --git a/WebCore/platform/image-decoders/haiku/ImageDecoderHaiku.cpp b/WebCore/platform/image-decoders/haiku/ImageDecoderHaiku.cpp
index 3542cc2..dc120e3 100644
--- a/WebCore/platform/image-decoders/haiku/ImageDecoderHaiku.cpp
+++ b/WebCore/platform/image-decoders/haiku/ImageDecoderHaiku.cpp
@@ -28,104 +28,14 @@
 
 #include <Bitmap.h>
 
-
 namespace WebCore {
 
-RGBA32Buffer::RGBA32Buffer()
-    : m_hasAlpha(false)
-    , m_status(FrameEmpty)
-    , m_duration(0)
-    , m_disposalMethod(DisposeNotSpecified)
-{
-} 
-
-void RGBA32Buffer::clear()
-{
-    m_bytes.clear();
-    m_status = FrameEmpty;
-    // NOTE: Do not reset other members here; clearFrameBufferCache()
-    // calls this to free the bitmap data, but other functions like
-    // initFrameBuffer() and frameComplete() may still need to read
-    // other metadata out of this frame later.
-}
-
-void RGBA32Buffer::zeroFill()
-{
-    m_bytes.fill(0);
-    m_hasAlpha = true;
-}
-
-void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return;
-
-    m_bytes = other.m_bytes;
-    setHasAlpha(other.m_hasAlpha);
-}
-
-bool RGBA32Buffer::setSize(int newWidth, int newHeight)
-{
-    // NOTE: This has no way to check for allocation failure if the
-    // requested size was too big...
-    m_bytes.resize(newWidth * newHeight);
-    m_size = IntSize(newWidth, newHeight);
-
-    // Zero the image.
-    zeroFill();
-
-    return true;
-}
-
 NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 {
-    const void* bytes = m_bytes.data();
-
     BBitmap* bmp = new BBitmap(BRect(0, 0, width(), height()), B_RGB32);
-    bmp->SetBits(bytes, m_size.width() * m_size.height(), 0, B_RGB32);
-
+    bmp->SetBits(m_bytes.data(), m_size.width() * m_size.height(), 0, B_RGB32);
     return bmp;
 }
 
-bool RGBA32Buffer::hasAlpha() const
-{
-    return m_hasAlpha;
-}
-
-void RGBA32Buffer::setHasAlpha(bool alpha)
-{
-    m_hasAlpha = alpha;
-}
-
-void RGBA32Buffer::setStatus(FrameStatus status)
-{
-    m_status = status;
-}
-
-RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return *this;
-
-    m_bytes = other.m_bytes;
-    m_size = other.m_size;
-    setHasAlpha(other.hasAlpha());
-    setRect(other.rect());
-    setStatus(other.status());
-    setDuration(other.duration());
-    setDisposalMethod(other.disposalMethod());
-    return *this;
-}
-
-int RGBA32Buffer::width() const
-{
-    return m_size.width();
-}
-
-int RGBA32Buffer::height() const
-{
-    return m_size.height();
-}
-
 } // namespace WebCore
 
diff --git a/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp b/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
index e9296ad..a0ec4f7 100644
--- a/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
@@ -51,12 +51,6 @@ ICOImageDecoder::ICOImageDecoder()
 {
 }
 
-ICOImageDecoder::~ICOImageDecoder()
-{
-    deleteAllValues(m_bmpReaders);
-    deleteAllValues(m_pngDecoders);
-}
-
 void ICOImageDecoder::setData(SharedBuffer* data, bool allDataReceived)
 {
     if (failed())
@@ -208,12 +202,12 @@ bool ICOImageDecoder::decodeAtIndex(size_t index)
             // We need to have already sized m_frameBufferCache before this, and
             // we must not resize it again later (see caution in frameCount()).
             ASSERT(m_frameBufferCache.size() == m_dirEntries.size());
-            m_bmpReaders[index] =
-                new BMPImageReader(this, dirEntry.m_imageOffset, 0, true);
+            m_bmpReaders[index].set(
+                new BMPImageReader(this, dirEntry.m_imageOffset, 0, true));
             m_bmpReaders[index]->setData(m_data.get());
             m_bmpReaders[index]->setBuffer(&m_frameBufferCache[index]);
         } else if (imageType == PNG) {
-            m_pngDecoders[index] = new PNGImageDecoder();
+            m_pngDecoders[index].set(new PNGImageDecoder());
             setDataForPNGDecoderAtIndex(index);
         } else {
             // Not enough data to determine image type yet.
@@ -249,18 +243,15 @@ bool ICOImageDecoder::processDirectory()
         ICON = 1,
         CURSOR = 2,
     };
-    if (((fileType != ICON) && (fileType != CURSOR)) || (idCount == 0)) {
+    if (((fileType != ICON) && (fileType != CURSOR)) || (!idCount)) {
         setFailed();
         return false;
     }
 
-    // Enlarge member vectors to hold all the entries.  We must initialize the
-    // BMP and PNG decoding vectors to 0 so that all entries can be safely
-    // deleted in our destructor.  If we don't do this, they'll contain garbage
-    // values, and deleting those will corrupt memory.
+    // Enlarge member vectors to hold all the entries.
     m_dirEntries.resize(idCount);
-    m_bmpReaders.fill(0, idCount);
-    m_pngDecoders.fill(0, idCount);
+    m_bmpReaders.resize(idCount);
+    m_pngDecoders.resize(idCount);
     return true;
 }
 
@@ -303,10 +294,10 @@ ICOImageDecoder::IconDirectoryEntry ICOImageDecoder::readDirectoryEntry()
     // matching uint8_ts) is so we can record dimensions of size 256 (which is
     // what a zero byte really means).
     int width = static_cast<uint8_t>(m_data->data()[m_decodedOffset]);
-    if (width == 0)
+    if (!width)
         width = 256;
     int height = static_cast<uint8_t>(m_data->data()[m_decodedOffset + 1]);
-    if (height == 0)
+    if (!height)
         height = 256;
     IconDirectoryEntry entry;
     entry.m_size = IntSize(width, height);
@@ -318,11 +309,12 @@ ICOImageDecoder::IconDirectoryEntry ICOImageDecoder::readDirectoryEntry()
     // this isn't quite what the bitmap info header says later, as we only use
     // this value to determine which icon entry is best.
     if (!entry.m_bitCount) {
-        uint8_t colorCount = m_data->data()[m_decodedOffset + 2];
-        if (colorCount) {
-            for (--colorCount; colorCount; colorCount >>= 1)
-                ++entry.m_bitCount;
-        }
+        int colorCount =
+            static_cast<uint8_t>(m_data->data()[m_decodedOffset + 2]);
+        if (!colorCount)
+            colorCount = 256;  // Vague in the spec, needed by real-world icons.
+        for (--colorCount; colorCount; colorCount >>= 1)
+            ++entry.m_bitCount;
     }
 
     m_decodedOffset += sizeOfDirEntry;
diff --git a/WebCore/platform/image-decoders/ico/ICOImageDecoder.h b/WebCore/platform/image-decoders/ico/ICOImageDecoder.h
index f8bddf9..6117e06 100644
--- a/WebCore/platform/image-decoders/ico/ICOImageDecoder.h
+++ b/WebCore/platform/image-decoders/ico/ICOImageDecoder.h
@@ -41,7 +41,6 @@ namespace WebCore {
     class ICOImageDecoder : public ImageDecoder {
     public:
         ICOImageDecoder();
-        virtual ~ICOImageDecoder();
 
         // ImageDecoder
         virtual String filenameExtension() const { return "ico"; }
@@ -134,9 +133,9 @@ namespace WebCore {
         IconDirectoryEntries m_dirEntries;
 
         // The image decoders for the various frames.
-        typedef Vector<BMPImageReader*> BMPReaders;
+        typedef Vector<OwnPtr<BMPImageReader> > BMPReaders;
         BMPReaders m_bmpReaders;
-        typedef Vector<PNGImageDecoder*> PNGDecoders;
+        typedef Vector<OwnPtr<PNGImageDecoder> > PNGDecoders;
         PNGDecoders m_pngDecoders;
 
         // Valid only while a BMPImageReader is decoding, this holds the size
diff --git a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index ae09586..410ef60 100644
--- a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -461,11 +461,27 @@ void JPEGImageDecoder::decode(bool sizeOnly)
     }
 }
 
-static void convertCMYKToRGBA(RGBA32Buffer& dest, JSAMPROW src, jpeg_decompress_struct* info)
+static void convertCMYKToRGBA(RGBA32Buffer& dest, int destY, JSAMPROW src, JDIMENSION srcWidth
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+                              , bool scaled, const Vector<int>& scaledColumns
+#endif
+                              )
 {
-    ASSERT(info->out_color_space == JCS_CMYK);
-
-    for (unsigned x = 0; x < info->output_width; ++x) {
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+    if (scaled) {
+        int numColumns = scaledColumns.size();
+        for (int x = 0; x < numColumns; ++x) {
+            JSAMPLE* jsample = src + scaledColumns[x] * 3;
+            unsigned c = jsample[0];
+            unsigned m = jsample[1];
+            unsigned y = jsample[2];
+            unsigned k = jsample[3];
+            dest.setRGBA(x, destY, c * k / 255, m * k / 255, y * k / 255, 0xFF);
+        }
+        return;
+    }
+#endif
+    for (JDIMENSION x = 0; x < srcWidth; ++x) {
         unsigned c = *src++;
         unsigned m = *src++;
         unsigned y = *src++;
@@ -489,23 +505,31 @@ static void convertCMYKToRGBA(RGBA32Buffer& dest, JSAMPROW src, jpeg_decompress_
         // G = 1 - M => 1 - (1 - iM*iK) => iM*iK
         // B = 1 - Y => 1 - (1 - iY*iK) => iY*iK
 
-        // read_scanlines has increased the scanline counter, so we
-        // actually mean the previous one.
-        dest.setRGBA(x, info->output_scanline - 1, c * k / 255, m * k / 255, y * k / 255, 0xFF);
+        dest.setRGBA(x, destY, c * k / 255, m * k / 255, y * k / 255, 0xFF);
     }
 }
 
-static void convertRGBToRGBA(RGBA32Buffer& dest, JSAMPROW src, jpeg_decompress_struct* info)
+static void convertRGBToRGBA(RGBA32Buffer& dest, int destY, JSAMPROW src, JDIMENSION srcWidth
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+                              , bool scaled, const Vector<int>& scaledColumns
+#endif
+                              )
 {
-    ASSERT(info->out_color_space == JCS_RGB);
-
-    for (unsigned x = 0; x < info->output_width; ++x) {
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+    if (scaled) {
+        int numColumns = scaledColumns.size();
+        for (int x = 0; x < numColumns; ++x) {
+            JSAMPLE* jsample = src + scaledColumns[x] * 3;
+            dest.setRGBA(x, destY, jsample[0], jsample[1], jsample[2], 0xFF);
+        }
+        return;
+    }
+#endif
+    for (JDIMENSION x = 0; x < srcWidth; ++x) {
         unsigned r = *src++;
         unsigned g = *src++;
         unsigned b = *src++;
-        // read_scanlines has increased the scanline counter, so we
-        // actually mean the previous one.
-        dest.setRGBA(x, info->output_scanline - 1, r, g, b, 0xFF);
+        dest.setRGBA(x, destY, r, g, b, 0xFF);
     }
 }
 
@@ -517,7 +541,17 @@ bool JPEGImageDecoder::outputScanlines()
     // Initialize the framebuffer if needed.
     RGBA32Buffer& buffer = m_frameBufferCache[0];
     if (buffer.status() == RGBA32Buffer::FrameEmpty) {
-        if (!buffer.setSize(size().width(), size().height())) {
+        int bufferWidth = size().width();
+        int bufferHeight = size().height();
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        // Let's resize our buffer now to the correct width/height.
+        if (m_scaled) {
+            bufferWidth = m_scaledColumns.size();
+            bufferHeight = m_scaledRows.size();
+        }
+#endif
+
+        if (!buffer.setSize(bufferWidth, bufferHeight)) {
             m_failed = true;
             return false;
         }
@@ -532,16 +566,34 @@ bool JPEGImageDecoder::outputScanlines()
     JSAMPARRAY samples = m_reader->samples();
 
     while (info->output_scanline < info->output_height) {
+        // jpeg_read_scanlines will increase the scanline counter, so we
+        // save the scanline before calling it.
+        int sourceY = info->output_scanline;
         /* Request one scanline.  Returns 0 or 1 scanlines. */
         if (jpeg_read_scanlines(info, samples, 1) != 1)
             return false;
 
+        int destY = sourceY;
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        if (m_scaled) {
+            destY = scaledY(sourceY);
+            if (destY < 0)
+                continue;
+        }
         if (info->out_color_space == JCS_RGB)
-            convertRGBToRGBA(buffer, *samples, info);
+            convertRGBToRGBA(buffer, destY, *samples, info->output_width, m_scaled, m_scaledColumns);
         else if (info->out_color_space == JCS_CMYK)
-            convertCMYKToRGBA(buffer, *samples, info);
+            convertCMYKToRGBA(buffer, destY, *samples, info->output_width, m_scaled, m_scaledColumns);
         else
             return false;
+#else
+        if (info->out_color_space == JCS_RGB)
+            convertRGBToRGBA(buffer, destY, *samples, info->output_width);
+        else if (info->out_color_space == JCS_CMYK)
+            convertCMYKToRGBA(buffer, destY, *samples, info->output_width);
+        else
+            return false;
+#endif
     }
 
     return true;
diff --git a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
index 56e007d..4a822d7 100644
--- a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
+++ b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -57,6 +58,16 @@ namespace WebCore {
         bool outputScanlines();
         void jpegComplete();
 
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        bool setSize(int width, int height)
+        {
+            if (!ImageDecoder::setSize(width, height))
+                return false;
+            prepareScaleDataIfNecessary();
+            return true;
+        }
+#endif
+
     private:
         JPEGImageReader* m_reader;
     };
diff --git a/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index d14333f..ad79fc8 100644
--- a/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
  * Portions are Copyright (C) 2001 mozilla.org
  *
@@ -242,6 +243,9 @@ void PNGImageDecoder::headerAvailable()
             longjmp(png->jmpbuf, 1);
             return;
         }
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        prepareScaleDataIfNecessary();
+#endif
     }
 
     int bitDepth, colorType, interlaceType, compressionType, filterType, channels;
@@ -313,7 +317,14 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
     // Initialize the framebuffer if needed.
     RGBA32Buffer& buffer = m_frameBufferCache[0];
     if (buffer.status() == RGBA32Buffer::FrameEmpty) {
-        if (!buffer.setSize(size().width(), size().height())) {
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        int width = m_scaled ? m_scaledColumns.size() : size().width();
+        int height = m_scaled ? m_scaledRows.size() : size().height();
+#else
+        int width = size().width();
+        int height = size().height();
+#endif
+        if (!buffer.setSize(width, height)) {
             static_cast<PNGImageDecoder*>(png_get_progressive_ptr(reader()->pngPtr()))->decodingFailed();
             longjmp(reader()->pngPtr()->jmpbuf, 1);
             return;
@@ -358,7 +369,7 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
     * to pass the current row, and the function will combine the
     * old row and the new row.
     */
-    
+
     png_structp png = reader()->pngPtr();
     bool hasAlpha = reader()->hasAlpha();
     unsigned colorChannels = hasAlpha ? 4 : 3;
@@ -372,8 +383,27 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
         row = rowBuffer;
 
     // Copy the data into our buffer.
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+    if (m_scaled) {
+        int destY = scaledY(rowIndex);
+        if (destY < 0)
+            return;
+        int columns = m_scaledColumns.size();
+        bool sawAlpha = buffer.hasAlpha();
+        for (int x = 0; x < columns; ++x) {
+            png_bytep pixel = row + m_scaledColumns[x] * 4;
+            unsigned alpha = pixel[3];
+            buffer.setRGBA(x, destY, pixel[0], pixel[1], pixel[2], alpha);
+            if (!sawAlpha && alpha < 255) {
+                sawAlpha = true;
+                buffer.setHasAlpha(true);
+            }
+        }
+        return;
+    }
+#endif
     int width = size().width();
-    bool sawAlpha = false;
+    bool sawAlpha = buffer.hasAlpha();
     for (int x = 0; x < width; x++) {
         unsigned red = *row++;
         unsigned green = *row++;
diff --git a/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp b/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
new file mode 100644
index 0000000..da6ab38
--- /dev/null
+++ b/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Google, Inc.
+ * Copyright (C) 2009 Holger Hans Peter Freyther
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ImageDecoder.h"
+
+#include <QPixmap>
+#include <stdio.h>
+
+namespace WebCore {
+
+RGBA32Buffer::RGBA32Buffer()
+    : m_status(FrameEmpty)
+    , m_hasAlpha(false)
+    , m_size()
+    , m_duration(0)
+    , m_disposalMethod(DisposeNotSpecified)
+{
+}
+
+// The image must not have format 8888 pre multiplied...
+void RGBA32Buffer::setDecodedImage(const QImage& image)
+{
+    m_image = image;
+    m_size = image.size();
+    m_hasAlpha = image.hasAlphaChannel();
+}
+
+void RGBA32Buffer::clear()
+{
+    m_image = QImage();
+    m_status = FrameEmpty;
+    // NOTE: Do not reset other members here; clearFrameBufferCache()
+    // calls this to free the bitmap data, but other functions like
+    // initFrameBuffer() and frameComplete() may still need to read
+    // other metadata out of this frame later.
+}
+
+void RGBA32Buffer::zeroFill()
+{
+    m_image.fill(0);
+}
+
+void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return;
+
+    m_image = other.m_image;
+    m_size = other.m_size;
+    m_hasAlpha = other.m_hasAlpha;
+}
+
+bool RGBA32Buffer::setSize(int newWidth, int newHeight)
+{
+    // This function should only be called once, it will leak memory
+    // otherwise.
+    ASSERT(width() == 0 && height() == 0);
+
+    m_size = IntSize(newWidth, newHeight);
+    m_image = QImage(newWidth, newHeight, QImage::Format_ARGB32_Premultiplied);
+    if (m_image.isNull()) {
+        // Allocation failure, maybe the bitmap was too big.
+        setStatus(FrameComplete);
+        return false;
+    }
+
+    // Zero the image.
+    zeroFill();
+
+    return true;
+}
+
+QPixmap* RGBA32Buffer::asNewNativeImage() const
+{
+    QPixmap pix = QPixmap::fromImage(m_image);
+    m_image = QImage();
+
+    return new QPixmap(pix);
+}
+
+bool RGBA32Buffer::hasAlpha() const
+{
+    return m_hasAlpha;
+}
+
+void RGBA32Buffer::setHasAlpha(bool alpha)
+{
+    m_hasAlpha = alpha;
+}
+
+void RGBA32Buffer::setStatus(FrameStatus status)
+{
+    m_status = status;
+}
+
+RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return *this;
+
+    copyBitmapData(other);
+    setRect(other.rect());
+    setStatus(other.status());
+    setDuration(other.duration());
+    setDisposalMethod(other.disposalMethod());
+    return *this;
+}
+
+int RGBA32Buffer::width() const
+{
+    return m_size.width();
+}
+
+int RGBA32Buffer::height() const
+{
+    return m_size.height();
+}
+
+}
diff --git a/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp b/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
index 8e8809e..3cadf1c 100644
--- a/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
+++ b/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
@@ -37,73 +37,21 @@
 
 namespace WebCore {
 
-RGBA32Buffer::RGBA32Buffer()
-    : m_hasAlpha(false)
-    , m_status(FrameEmpty)
-    , m_duration(0)
-    , m_disposalMethod(DisposeNotSpecified)
-{
-} 
-
-void RGBA32Buffer::clear()
-{
-    m_bytes.clear();
-    m_status = FrameEmpty;
-    // NOTE: Do not reset other members here; clearFrameBufferCache()
-    // calls this to free the bitmap data, but other functions like
-    // initFrameBuffer() and frameComplete() may still need to read
-    // other metadata out of this frame later.
-}
-
-void RGBA32Buffer::zeroFill()
-{
-    m_bytes.fill(0);
-    m_hasAlpha = true;
-}
-
-void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return;
-
-    m_bytes = other.m_bytes;
-    m_size = other.m_size;
-    setHasAlpha(other.m_hasAlpha);
-}
-
-bool RGBA32Buffer::setSize(int newWidth, int newHeight)
-{
-    // NOTE: This has no way to check for allocation failure if the
-    // requested size was too big...
-    m_bytes.resize(newWidth * newHeight);
-    m_size = IntSize(newWidth, newHeight);
-
-    // Zero the image.
-    zeroFill();
-
-    return true;
-}
-
 NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 {
-    const unsigned char* bytes = (const unsigned char*)m_bytes.data();
-    
-    typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
-
     wxBitmap* bmp = new wxBitmap(width(), height(), 32);
+    typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
     WxPixelData data(*bmp);
     
+    // NB: It appears that the data is in BGRA format instead of RGBA format.
+    // This code works properly on both ppc and intel, meaning the issue is
+    // likely not an issue of byte order getting mixed up on different archs. 
+    const unsigned char* bytes = (const unsigned char*)m_bytes.data();
     int rowCounter = 0;
     long pixelCounter = 0;
-    
     WxPixelData::Iterator p(data);
-    
     WxPixelData::Iterator rowStart = p; 
-    
-    // NB: It appears that the data is in BGRA format instead of RGBA format.
-    // This code works properly on both ppc and intel, meaning the issue is
-    // likely not an issue of byte order getting mixed up on different archs. 
-    for (long i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
+    for (size_t i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
         p.Red() = bytes[i+2];
         p.Green() = bytes[i+1];
         p.Blue() = bytes[i+0];
@@ -112,12 +60,11 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
         p++;
 
         pixelCounter++;
-        if ( (pixelCounter % width() ) == 0 ) {
+        if ((pixelCounter % width()) == 0) {
             rowCounter++;
             p = rowStart;
             p.MoveTo(data, 0, rowCounter);
         }
-
     }
 #if !wxCHECK_VERSION(2,9,0)
     bmp->UseAlpha();
@@ -125,7 +72,7 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
     ASSERT(bmp->IsOk());
 
 #if USE(WXGC)
-    wxGraphicsBitmap* bitmap =  new wxGraphicsBitmap(wxGraphicsRenderer::GetDefaultRenderer()->CreateBitmap(*bmp));
+    wxGraphicsBitmap* bitmap = new wxGraphicsBitmap(wxGraphicsRenderer::GetDefaultRenderer()->CreateBitmap(*bmp));
     delete bmp;
     return bitmap;
 #else
@@ -133,40 +80,4 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 #endif
 }
 
-bool RGBA32Buffer::hasAlpha() const
-{
-    return m_hasAlpha;
-}
-
-void RGBA32Buffer::setHasAlpha(bool alpha)
-{
-    m_hasAlpha = alpha;
-}
-
-void RGBA32Buffer::setStatus(FrameStatus status)
-{
-    m_status = status;
-}
-
-RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return *this;
-
-    copyBitmapData(other);
-    setRect(other.rect());
-    setStatus(other.status());
-    setDuration(other.duration());
-    setDisposalMethod(other.disposalMethod());
-    return *this;
-}
-
-int RGBA32Buffer::width() const {
-    return m_size.width();
-}
-
-int RGBA32Buffer::height() const {
-    return m_size.height();
-}
-
 } // namespace WebCore
diff --git a/WebCore/platform/mac/ClipboardMac.h b/WebCore/platform/mac/ClipboardMac.h
index 9bdd276..3d3c78e 100644
--- a/WebCore/platform/mac/ClipboardMac.h
+++ b/WebCore/platform/mac/ClipboardMac.h
@@ -67,7 +67,9 @@ public:
     void setDragImageElement(Node *, const IntPoint&);
     
     virtual DragImageRef createDragImage(IntPoint& dragLoc) const;
+#if ENABLE(DRAG_SUPPORT)
     virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*);
+#endif
     virtual void writeRange(Range*, Frame* frame);
     virtual void writeURL(const KURL&, const String&, Frame* frame);
     
diff --git a/WebCore/platform/mac/ClipboardMac.mm b/WebCore/platform/mac/ClipboardMac.mm
index 52bc952..78fb659 100644
--- a/WebCore/platform/mac/ClipboardMac.mm
+++ b/WebCore/platform/mac/ClipboardMac.mm
@@ -63,7 +63,7 @@ bool ClipboardMac::hasData()
     return m_pasteboard && [m_pasteboard.get() types] && [[m_pasteboard.get() types] count] > 0;
 }
     
-static NSString *cocoaTypeFromMIMEType(const String& type)
+static NSString *cocoaTypeFromHTMLClipboardType(const String& type)
 {
     String qType = type.stripWhiteSpace();
 
@@ -82,10 +82,9 @@ static NSString *cocoaTypeFromMIMEType(const String& type)
     
     // Try UTI now
     NSString *mimeType = qType;
-    CFStringRef UTIType = UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, (CFStringRef)mimeType, NULL);
-    if (UTIType) {
-        CFStringRef pbType = UTTypeCopyPreferredTagWithClass(UTIType, kUTTagClassNSPboardType);
-        CFRelease(UTIType);
+    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, (CFStringRef)mimeType, NULL));
+    if (utiType) {
+        CFStringRef pbType = UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassNSPboardType);
         if (pbType)
             return HardAutorelease(pbType);
     }
@@ -94,28 +93,41 @@ static NSString *cocoaTypeFromMIMEType(const String& type)
     return qType;
 }
 
-static String MIMETypeFromCocoaType(NSString *type)
+static String utiTypeFromCocoaType(NSString *type)
+{
+    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, (CFStringRef)type, NULL));
+    if (utiType) {
+        RetainPtr<CFStringRef> mimeType(AdoptCF, UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassMIMEType));
+        if (mimeType)
+            return String(mimeType.get());
+    }
+    return String();
+}
+
+static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSString *cocoaType, NSPasteboard *pasteboard)
 {
     // UTI may not do these right, so make sure we get the right, predictable result
-    if ([type isEqualToString:NSStringPboardType])
-        return "text/plain";
-    if ([type isEqualToString:NSURLPboardType] || [type isEqualToString:NSFilenamesPboardType])
-        return "text/uri-list";
-    
-    // Now try the general UTI mechanism
-    CFStringRef UTIType = UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, (CFStringRef)type, NULL);
-    if (UTIType) {
-        CFStringRef mimeType = UTTypeCopyPreferredTagWithClass(UTIType, kUTTagClassMIMEType);
-        CFRelease(UTIType);
-        if (mimeType) {
-            String result = mimeType;
-            CFRelease(mimeType);
-            return result;
+    if ([cocoaType isEqualToString:NSStringPboardType])
+        resultTypes.add("text/plain");
+    else if ([cocoaType isEqualToString:NSURLPboardType])
+        resultTypes.add("text/uri-list");
+    else if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
+        // If file list is empty, add nothing.
+        // Note that there is a chance that the file list count could have changed since we grabbed the types array.
+        // However, this is not really an issue for us doing a sanity check here.
+        NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
+        if ([fileList count]) {
+            // It is unknown if NSFilenamesPboardType always implies NSURLPboardType in Cocoa,
+            // but NSFilenamesPboardType should imply both 'text/uri-list' and 'Files'
+            resultTypes.add("text/uri-list");
+            resultTypes.add("Files");
         }
+    } else if (String utiType = utiTypeFromCocoaType(cocoaType))
+        resultTypes.add(utiType);
+    else {
+        // No mapping, just pass the whole string though
+        resultTypes.add(cocoaType);
     }
-
-    // No mapping, just pass the whole string though
-    return type;
 }
 
 void ClipboardMac::clearData(const String& type)
@@ -125,7 +137,7 @@ void ClipboardMac::clearData(const String& type)
 
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    NSString *cocoaType = cocoaTypeFromMIMEType(type);
+    NSString *cocoaType = cocoaTypeFromHTMLClipboardType(type);
     if (cocoaType)
         [m_pasteboard.get() setString:@"" forType:cocoaType];
 }
@@ -192,12 +204,12 @@ String ClipboardMac::getData(const String& type, bool& success) const
     if (policy() != ClipboardReadable)
         return String();
 
-    NSString *cocoaType = cocoaTypeFromMIMEType(type);
+    NSString *cocoaType = cocoaTypeFromHTMLClipboardType(type);
     NSString *cocoaValue = nil;
 
     // Grab the value off the pasteboard corresponding to the cocoaType
     if ([cocoaType isEqualToString:NSURLPboardType]) {
-        // "URL" and "text/url-list" both map to NSURLPboardType in cocoaTypeFromMIMEType(), "URL" only wants the first URL
+        // "URL" and "text/url-list" both map to NSURLPboardType in cocoaTypeFromHTMLClipboardType(), "URL" only wants the first URL
         bool onlyFirstURL = (type == "URL");
         NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get(), onlyFirstURL);
         cocoaValue = [absoluteURLs componentsJoinedByString:@"\n"];
@@ -222,7 +234,7 @@ bool ClipboardMac::setData(const String &type, const String &data)
         return false;
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    NSString *cocoaType = cocoaTypeFromMIMEType(type);
+    NSString *cocoaType = cocoaTypeFromHTMLClipboardType(type);
     NSString *cocoaData = data;
 
     if ([cocoaType isEqualToString:NSURLPboardType]) {
@@ -263,15 +275,16 @@ HashSet<String> ClipboardMac::types() const
 
     HashSet<String> result;
     NSUInteger count = [types count];
+    // FIXME: This loop could be split into two stages. One which adds all the HTML5 specified types
+    // and a second which adds all the extra types from the cocoa clipboard (which is Mac-only behavior).
     for (NSUInteger i = 0; i < count; i++) {
         NSString *pbType = [types objectAtIndex:i];
         if ([pbType isEqualToString:@"NeXT plain ascii pasteboard type"])
             continue;   // skip this ancient type that gets auto-supplied by some system conversion
 
-        String str = MIMETypeFromCocoaType(pbType);
-        if (!result.contains(str))
-            result.add(str);
+        addHTMLClipboardTypesForCocoaType(result, pbType, m_pasteboard.get());
     }
+
     return result;
 }
 
@@ -283,7 +296,7 @@ PassRefPtr<FileList> ClipboardMac::files() const
     if (policy() != ClipboardReadable)
         return FileList::create();
 
-    NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get());
+    NSArray *absoluteURLs = absoluteURLsFromPasteboardFilenames(m_pasteboard.get());
     NSUInteger count = [absoluteURLs count];
 
     RefPtr<FileList> fileList = FileList::create();
@@ -355,12 +368,14 @@ void ClipboardMac::writeURL(const KURL& url, const String& title, Frame* frame)
     Pasteboard::writeURL(m_pasteboard.get(), nil, url, title, frame);
 }
     
+#if ENABLE(DRAG_SUPPORT)
 void ClipboardMac::declareAndWriteDragImage(Element* element, const KURL& url, const String& title, Frame* frame)
 {
     ASSERT(frame);
     if (Page* page = frame->page())
         page->dragController()->client()->declareAndWriteDragImage(m_pasteboard.get(), kit(element), url, title, frame);
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 DragImageRef ClipboardMac::createDragImage(IntPoint& loc) const
 {
diff --git a/WebCore/platform/mac/ContextMenuItemMac.mm b/WebCore/platform/mac/ContextMenuItemMac.mm
index c5e2942..48da786 100644
--- a/WebCore/platform/mac/ContextMenuItemMac.mm
+++ b/WebCore/platform/mac/ContextMenuItemMac.mm
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ContextMenuItem.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "ContextMenu.h"
 
 namespace WebCore {
@@ -152,4 +154,6 @@ bool ContextMenuItem::enabled() const
     return [m_platformDescription.get() isEnabled];
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/WebCore/platform/mac/ContextMenuMac.mm b/WebCore/platform/mac/ContextMenuMac.mm
index b56d0b9..8ced8cb 100644
--- a/WebCore/platform/mac/ContextMenuMac.mm
+++ b/WebCore/platform/mac/ContextMenuMac.mm
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ContextMenu.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "ContextMenuController.h"
 
 @interface WebCoreMenuTarget : NSObject {
@@ -151,4 +153,6 @@ NSMutableArray* ContextMenu::releasePlatformDescription()
     return m_platformDescription.releaseRef();
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/WebCore/platform/mac/CookieJar.mm b/WebCore/platform/mac/CookieJar.mm
index d8df601..e1d3e5a 100644
--- a/WebCore/platform/mac/CookieJar.mm
+++ b/WebCore/platform/mac/CookieJar.mm
@@ -27,6 +27,7 @@
 #import "CookieJar.h"
 
 #import "BlockExceptions.h"
+#import "Cookie.h"
 #import "Document.h"
 #import "KURL.h"
 #import <wtf/RetainPtr.h>
@@ -116,4 +117,52 @@ bool cookiesEnabled(const Document*)
     return false;
 }
 
+bool getRawCookies(const Document*, const KURL& url, Vector<Cookie>& rawCookies)
+{
+    rawCookies.clear();
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+
+    NSURL *cookieURL = url;
+    NSArray *cookies = [[NSHTTPCookieStorage sharedHTTPCookieStorage] cookiesForURL:cookieURL];
+
+    NSUInteger count = [cookies count];
+    rawCookies.reserveCapacity(count);
+    for (NSUInteger i = 0; i < count; ++i) {
+        NSHTTPCookie *cookie = (NSHTTPCookie *)[cookies objectAtIndex:i];
+        NSString *name = [cookie name];
+        NSString *value = [cookie value];
+        NSString *domain = [cookie domain];
+        NSString *path = [cookie path];
+        NSTimeInterval expires = [[cookie expiresDate] timeIntervalSince1970] * 1000;
+        bool httpOnly = [cookie isHTTPOnly];
+        bool secure = [cookie isSecure];
+        bool session = [cookie isSessionOnly];
+        rawCookies.uncheckedAppend(Cookie(name, value, domain, path, expires, httpOnly, secure, session));
+    }
+
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return true;
+}
+
+void deleteCookie(const Document*, const KURL& url, const String& cookieName)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+
+    NSURL *cookieURL = url;
+    NSHTTPCookieStorage *cookieStorage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
+    NSArray *cookies = [cookieStorage cookiesForURL:cookieURL];
+    NSString *cookieNameString = (NSString *) cookieName;
+
+    NSUInteger count = [cookies count];
+    for (NSUInteger i = 0; i < count; ++i) {
+        NSHTTPCookie *cookie = (NSHTTPCookie *)[cookies objectAtIndex:i];
+        if ([[cookie name] isEqualToString:cookieNameString]) {
+            [cookieStorage deleteCookie:cookie];
+            break;
+        }
+    }
+
+    END_BLOCK_OBJC_EXCEPTIONS;
+}
+
 }
diff --git a/WebCore/platform/mac/DragDataMac.mm b/WebCore/platform/mac/DragDataMac.mm
index a7b751c..02a6af7 100644
--- a/WebCore/platform/mac/DragDataMac.mm
+++ b/WebCore/platform/mac/DragDataMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "DragData.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #import "ClipboardMac.h"
 #import "ClipboardAccessPolicy.h"
 #import "Document.h"
@@ -127,5 +128,6 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Document*) const
     return core(m_pasteboardHelper->fragmentFromPasteboard([m_platformDragData draggingPasteboard]));
 }
     
-}
+} // namespace WebCore
 
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/platform/mac/DragImageMac.mm b/WebCore/platform/mac/DragImageMac.mm
index 842e6d4..7b51018 100644
--- a/WebCore/platform/mac/DragImageMac.mm
+++ b/WebCore/platform/mac/DragImageMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "DragImage.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #import "CachedImage.h"
 #import "Image.h"
 #import "KURL.h"
@@ -98,4 +99,6 @@ RetainPtr<NSImage> createDragImageIconForCachedImage(CachedImage* image)
     return [[NSWorkspace sharedWorkspace] iconForFileType:extension];
 }
     
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/platform/mac/GeolocationServiceMac.h b/WebCore/platform/mac/GeolocationServiceMac.h
index d0342e7..4beefca 100644
--- a/WebCore/platform/mac/GeolocationServiceMac.h
+++ b/WebCore/platform/mac/GeolocationServiceMac.h
@@ -45,7 +45,7 @@ namespace WebCore {
 
 class GeolocationServiceMac : public GeolocationService {
 public:
-    GeolocationServiceMac(GeolocationServiceClient*);
+    static GeolocationService* create(GeolocationServiceClient*);
     virtual ~GeolocationServiceMac();
     
     virtual bool startUpdating(PositionOptions*);
@@ -61,6 +61,8 @@ public:
     void errorOccurred(PassRefPtr<PositionError>);
 
 private:
+    GeolocationServiceMac(GeolocationServiceClient*);
+
     RetainPtr<CLLocationManager> m_locationManager;
     RetainPtr<WebCoreCoreLocationObserver> m_objcObserver;
     
diff --git a/WebCore/platform/mac/GeolocationServiceMac.mm b/WebCore/platform/mac/GeolocationServiceMac.mm
index 01eca4a..1093e69 100644
--- a/WebCore/platform/mac/GeolocationServiceMac.mm
+++ b/WebCore/platform/mac/GeolocationServiceMac.mm
@@ -65,11 +65,13 @@ using namespace WebCore;
 
 namespace WebCore {
 
-GeolocationService* GeolocationService::create(GeolocationServiceClient* client)
+GeolocationService* GeolocationServiceMac::create(GeolocationServiceClient* client)
 {
     return new GeolocationServiceMac(client);
 }
 
+GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &GeolocationServiceMac::create;
+
 GeolocationServiceMac::GeolocationServiceMac(GeolocationServiceClient* client)
     : GeolocationService(client)
     , m_objcObserver(AdoptNS, [[WebCoreCoreLocationObserver alloc] initWithCallback:this])
diff --git a/WebCore/platform/mac/LocalizedStringsMac.mm b/WebCore/platform/mac/LocalizedStringsMac.mm
index fdd7df5..261347f 100644
--- a/WebCore/platform/mac/LocalizedStringsMac.mm
+++ b/WebCore/platform/mac/LocalizedStringsMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -89,6 +89,7 @@ String copyImageUnknownFileLabel()
     return String();
 }
 
+#if ENABLE(CONTEXT_MENUS)
 String contextMenuItemTagOpenLinkInNewWindow()
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -544,6 +545,7 @@ String contextMenuItemTagInspectElement()
     END_BLOCK_OBJC_EXCEPTIONS;
     return String();
 }
+#endif // ENABLE(CONTEXT_MENUS)
 
 String searchMenuNoRecentSearchesText()
 {
@@ -625,6 +627,14 @@ String AXDefinitionListDefinitionText()
     return String();
 }
     
+String AXARIAContentGroupText(const String& ariaType)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] AXARIAContentGroupText:ariaType];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();        
+}
+    
 String AXButtonActionVerb()
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -713,4 +723,29 @@ String mediaElementLiveBroadcastStateText()
     return String();
 }
 
+String localizedMediaControlElementString(const String& controlName)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] localizedMediaControlElementString:controlName];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& controlName)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] localizedMediaControlElementHelpText:controlName];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] localizedMediaTimeDescription:time];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+
 }
diff --git a/WebCore/platform/mac/PasteboardMac.mm b/WebCore/platform/mac/PasteboardMac.mm
index e21f549..f048791 100644
--- a/WebCore/platform/mac/PasteboardMac.mm
+++ b/WebCore/platform/mac/PasteboardMac.mm
@@ -135,8 +135,8 @@ static NSAttributedString *stripAttachmentCharacters(NSAttributedString *string)
 
 void Pasteboard::writeSelection(NSPasteboard* pasteboard, Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
-    if (WebArchivePboardType == nil)
-        Pasteboard::generalPasteboard(); //Initialises pasteboard types
+    if (!WebArchivePboardType)
+        Pasteboard::generalPasteboard(); // Initialises pasteboard types
     ASSERT(selectedRange);
     
     NSAttributedString *attributedString = [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease];
@@ -203,12 +203,24 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     Pasteboard::writeSelection(m_pasteboard.get(), selectedRange, canSmartCopyOrDelete, frame);
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    if (!WebArchivePboardType)
+        Pasteboard::generalPasteboard(); // Initialises pasteboard types
+
+    NSArray *types = [NSArray arrayWithObject:NSStringPboardType];
+    NSPasteboard *pasteboard = m_pasteboard.get();
+    [pasteboard declareTypes:types owner:nil];
+
+    [pasteboard setString:text forType:NSStringPboardType];
+}
+
 void Pasteboard::writeURL(NSPasteboard* pasteboard, NSArray* types, const KURL& url, const String& titleStr, Frame* frame)
 {
-    if (WebArchivePboardType == nil)
-        Pasteboard::generalPasteboard(); //Initialises pasteboard types
+    if (!WebArchivePboardType)
+        Pasteboard::generalPasteboard(); // Initialises pasteboard types
    
-    if (types == nil) {
+    if (!types) {
         types = writableTypesForURL();
         [pasteboard declareTypes:types owner:nil];
     }
diff --git a/WebCore/platform/mac/PopupMenuMac.mm b/WebCore/platform/mac/PopupMenuMac.mm
index b98235d..dfb0fff 100644
--- a/WebCore/platform/mac/PopupMenuMac.mm
+++ b/WebCore/platform/mac/PopupMenuMac.mm
@@ -105,7 +105,7 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
     int numItems = [m_popup.get() numberOfItems];
     if (numItems <= 0) {
         if (client())
-            client()->hidePopup();
+            client()->popupDidHide();
         return;
     }
     ASSERT(numItems > index);
@@ -162,7 +162,7 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
 
     if (client()) {
         int newIndex = [m_popup.get() indexOfSelectedItem];
-        client()->hidePopup();
+        client()->popupDidHide();
 
         // Adjust newIndex for hidden first item.
         if (!client()->shouldPopOver())
diff --git a/WebCore/platform/mac/ScrollViewMac.mm b/WebCore/platform/mac/ScrollViewMac.mm
index 5ff0ff5..202d49e 100644
--- a/WebCore/platform/mac/ScrollViewMac.mm
+++ b/WebCore/platform/mac/ScrollViewMac.mm
@@ -163,26 +163,12 @@ bool ScrollView::platformScroll(ScrollDirection, ScrollGranularity)
 void ScrollView::platformRepaintContentRectangle(const IntRect& rect, bool now)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
-
     NSView *view = documentView();
-    NSRect visibleRect = visibleContentRect();
-
-    // FIXME: I don't think this intersection is necessary any more now that
-    // selection doesn't call this method directly (but has to go through FrameView's
-    // repaintContentRectangle, which does the intersection test also).  Leaving it in
-    // for now until I'm sure.
-    // Checking for rect visibility is an important optimization for the case of
-    // Select All of a large document. AppKit does not do this check, and so ends
-    // up building a large complicated NSRegion if we don't perform the check.
-    NSRect dirtyRect = NSIntersectionRect(rect, visibleRect);
-    if (!NSIsEmptyRect(dirtyRect)) {
-        [view setNeedsDisplayInRect:dirtyRect];
-        if (now) {
-            [[view window] displayIfNeeded];
-            [[view window] flushWindowIfNeeded];
-        }
+    [view setNeedsDisplayInRect:rect];
+    if (now) {
+        [[view window] displayIfNeeded];
+        [[view window] flushWindowIfNeeded];
     }
-
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
diff --git a/WebCore/platform/mac/ThemeMac.mm b/WebCore/platform/mac/ThemeMac.mm
index e7e12ac..fd2f944 100644
--- a/WebCore/platform/mac/ThemeMac.mm
+++ b/WebCore/platform/mac/ThemeMac.mm
@@ -311,6 +311,14 @@ static const IntSize* buttonSizes()
     return sizes;
 }
 
+#if ENABLE(DATALIST)
+static const IntSize* listButtonSizes()
+{
+    static const IntSize sizes[3] = { IntSize(21, 21), IntSize(19, 18), IntSize(17, 16) };
+    return sizes;
+}
+#endif
+
 static const int* buttonMargins(NSControlSize controlSize)
 {
     static const int margins[3][4] =
@@ -333,6 +341,13 @@ static NSButtonCell* button(ControlPart part, ControlStates states, const IntRec
     }
 
     // Set the control size based off the rectangle we're painting into.
+    const IntSize* sizes = buttonSizes();
+#if ENABLE(DATALIST)
+    if (part == ListButtonPart) {
+        [buttonCell setBezelStyle:NSRoundedDisclosureBezelStyle];
+        sizes = listButtonSizes();
+    } else
+#endif
     if (part == SquareButtonPart || zoomedRect.height() > buttonSizes()[NSRegularControlSize].height() * zoomFactor) {
         // Use the square button
         if ([buttonCell bezelStyle] != NSShadowlessSquareBezelStyle)
@@ -362,7 +377,11 @@ static void paintButton(ControlPart part, ControlStates states, GraphicsContext*
     LocalCurrentGraphicsContext localContext(context);
 
     NSControlSize controlSize = [buttonCell controlSize];
+#if ENABLE(DATALIST)
+    IntSize zoomedSize = (part == ListButtonPart ? listButtonSizes() : buttonSizes())[controlSize];
+#else
     IntSize zoomedSize = buttonSizes()[controlSize];
+#endif
     zoomedSize.setWidth(zoomedRect.width()); // Buttons don't ever constrain width, so the zoomed width can just be honored.
     zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
     IntRect inflatedRect = zoomedRect;
@@ -442,6 +461,10 @@ LengthSize ThemeMac::controlSize(ControlPart part, const Font& font, const Lengt
         case PushButtonPart:
             // Height is reset to auto so that specified heights can be ignored.
             return sizeFromFont(font, LengthSize(zoomedSize.width(), Length()), zoomFactor, buttonSizes());
+#if ENABLE(DATALIST)
+        case ListButtonPart:
+            return sizeFromFont(font, LengthSize(zoomedSize.width(), Length()), zoomFactor, listButtonSizes());
+#endif
         default:
             return zoomedSize;
     }
@@ -453,6 +476,7 @@ LengthSize ThemeMac::minimumControlSize(ControlPart part, const Font& font, floa
         case SquareButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
+        case ListButtonPart:
             return LengthSize(Length(0, Fixed), Length(static_cast<int>(15 * zoomFactor), Fixed));
         default:
             return Theme::minimumControlSize(part, font, zoomFactor);
@@ -465,6 +489,7 @@ LengthBox ThemeMac::controlBorder(ControlPart part, const Font& font, const Leng
         case SquareButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
+        case ListButtonPart:
             return LengthBox(0, zoomedBox.right().value(), 0, zoomedBox.left().value());
         default:
             return Theme::controlBorder(part, font, zoomedBox, zoomFactor);
@@ -548,6 +573,7 @@ void ThemeMac::paint(ControlPart part, ControlStates states, GraphicsContext* co
         case DefaultButtonPart:
         case ButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
             paintButton(part, states, context, zoomedRect, zoomFactor, scrollView);
             break;
         default:
diff --git a/WebCore/platform/mac/WebCoreNSStringExtras.mm b/WebCore/platform/mac/WebCoreNSStringExtras.mm
index b7087f1..d6c3f0c 100644
--- a/WebCore/platform/mac/WebCoreNSStringExtras.mm
+++ b/WebCore/platform/mac/WebCoreNSStringExtras.mm
@@ -29,6 +29,8 @@
 #import "config.h"
 #import "WebCoreNSStringExtras.h"
 
+#import <wtf/RetainPtr.h>
+
 BOOL stringIsCaseInsensitiveEqualToString(NSString *first, NSString *second)
 {
     return [first compare:second options:(NSCaseInsensitiveSearch|NSLiteralSearch)] == NSOrderedSame;
@@ -69,50 +71,41 @@ NSString *filenameByFixingIllegalCharacters(NSString *string)
 CFStringEncoding stringEncodingForResource(Handle resource)
 {
     short resRef = HomeResFile(resource);
-    if (ResError() != noErr) {
+    if (ResError() != noErr)
         return NSMacOSRomanStringEncoding;
-    }
     
     // Get the FSRef for the current resource file
     FSRef fref;
     OSStatus error = FSGetForkCBInfo(resRef, 0, NULL, NULL, NULL, &fref, NULL);
-    if (error != noErr) {
+    if (error != noErr)
         return NSMacOSRomanStringEncoding;
-    }
     
-    CFURLRef URL = CFURLCreateFromFSRef(NULL, &fref);
-    if (URL == NULL) {
+    RetainPtr<CFURLRef> url(AdoptCF, CFURLCreateFromFSRef(NULL, &fref));
+    if (!url)
         return NSMacOSRomanStringEncoding;
-    }
-    
-    NSString *path = [(NSURL *)URL path];
-    CFRelease(URL);
-    
+
+    NSString *path = [(NSURL *)url.get() path];
+
     // Get the lproj directory name
     path = [path stringByDeletingLastPathComponent];
-    if (!stringIsCaseInsensitiveEqualToString([path pathExtension], @"lproj")) {
+    if (!stringIsCaseInsensitiveEqualToString([path pathExtension], @"lproj"))
         return NSMacOSRomanStringEncoding;
-    }
     
     NSString *directoryName = [[path stringByDeletingPathExtension] lastPathComponent];
-    CFStringRef locale = CFLocaleCreateCanonicalLocaleIdentifierFromString(NULL, (CFStringRef)directoryName);
-    if (locale == NULL) {
+    RetainPtr<CFStringRef> locale(AdoptCF, CFLocaleCreateCanonicalLocaleIdentifierFromString(NULL, (CFStringRef)directoryName));
+    if (!locale)
         return NSMacOSRomanStringEncoding;
-    }
-            
+
     LangCode lang;
     RegionCode region;
-    error = LocaleStringToLangAndRegionCodes([(NSString *)locale UTF8String], &lang, &region);
-    CFRelease(locale);
-    if (error != noErr) {
+    error = LocaleStringToLangAndRegionCodes([(NSString *)locale.get() UTF8String], &lang, &region);
+    if (error != noErr)
         return NSMacOSRomanStringEncoding;
-    }
-    
+
     TextEncoding encoding;
     error = UpgradeScriptInfoToTextEncoding(kTextScriptDontCare, lang, region, NULL, &encoding);
-    if (error != noErr) {
+    if (error != noErr)
         return NSMacOSRomanStringEncoding;
-    }
     
     return encoding;
 }
diff --git a/WebCore/platform/network/Credential.cpp b/WebCore/platform/network/Credential.cpp
index 4743959..caca785 100644
--- a/WebCore/platform/network/Credential.cpp
+++ b/WebCore/platform/network/Credential.cpp
@@ -43,6 +43,11 @@ Credential::Credential(const String& user, const String& password, CredentialPer
     , m_persistence(persistence)
 {
 }
+
+bool Credential::isEmpty()
+{
+    return m_user.isEmpty() && m_password.isEmpty();
+}
     
 const String& Credential::user() const
 { 
diff --git a/WebCore/platform/network/Credential.h b/WebCore/platform/network/Credential.h
index 4d80490..ca4a45a 100644
--- a/WebCore/platform/network/Credential.h
+++ b/WebCore/platform/network/Credential.h
@@ -41,6 +41,8 @@ public:
     Credential();
     Credential(const String& user, const String& password, CredentialPersistence);
     
+    bool isEmpty();
+    
     const String& user() const;
     const String& password() const;
     bool hasPassword() const;
diff --git a/WebCore/platform/network/CredentialStorage.cpp b/WebCore/platform/network/CredentialStorage.cpp
new file mode 100644
index 0000000..407ed5b
--- /dev/null
+++ b/WebCore/platform/network/CredentialStorage.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CredentialStorage.h"
+
+#include "CString.h"
+#include "Credential.h"
+#include "KURL.h"
+#include "ProtectionSpaceHash.h"
+#include "StringHash.h"
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+typedef HashMap<ProtectionSpace, Credential> ProtectionSpaceToCredentialMap;
+static ProtectionSpaceToCredentialMap& protectionSpaceToCredentialMap()
+{
+    DEFINE_STATIC_LOCAL(ProtectionSpaceToCredentialMap, map, ());
+    return map;
+}
+
+typedef HashMap<String, HashMap<String, Credential> > OriginToDefaultBasicCredentialMap;
+static OriginToDefaultBasicCredentialMap& originToDefaultBasicCredentialMap()
+{
+    DEFINE_STATIC_LOCAL(OriginToDefaultBasicCredentialMap, map, ());
+    return map;
+}
+    
+static String originStringFromURL(const KURL& url)
+{
+    if (url.port())
+        return url.protocol() + "://" + url.host() + String::format(":%i/", url.port());
+    
+    return url.protocol() + "://" + url.host() + "/";
+}
+
+void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
+{
+    ASSERT(url.protocolInHTTPFamily());
+    ASSERT(url.isValid());
+
+    protectionSpaceToCredentialMap().set(protectionSpace, credential);
+    
+    ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
+    if (url.protocolInHTTPFamily() && (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault)) {
+        String origin = originStringFromURL(url);
+        
+        HashMap<String, Credential> pathToCredentialMap;
+        pair<HashMap<String, HashMap<String, Credential> >::iterator, bool> result = originToDefaultBasicCredentialMap().add(origin, pathToCredentialMap);
+        
+        // Remove the last path component that is not a directory to determine the subpath for which this credential applies.
+        // We keep a leading slash, but remove a trailing one.
+        String path = url.path();
+        ASSERT(path.length() > 0);
+        ASSERT(path[0] == '/');
+        if (path.length() > 1) {
+            int index = path.reverseFind('/');
+            path = path.substring(0, index ? index : 1);
+        }
+        ASSERT(path.length() == 1 || path[path.length() - 1] != '/');
+        
+        result.first->second.set(path, credential);
+    }
+}
+
+Credential CredentialStorage::get(const ProtectionSpace& protectionSpace)
+{
+    return protectionSpaceToCredentialMap().get(protectionSpace);
+}
+
+Credential CredentialStorage::getDefaultAuthenticationCredential(const KURL& url)
+{
+    ASSERT(url.protocolInHTTPFamily());
+    String origin = originStringFromURL(url);
+    const HashMap<String, Credential>& pathToCredentialMap(originToDefaultBasicCredentialMap().get(origin));
+    if (pathToCredentialMap.isEmpty())
+        return Credential();
+    
+    // Check to see if there is a stored credential for the subpath ancestry of this url.
+    String path = url.path();
+    Credential credential = pathToCredentialMap.get(path);
+    while (credential.isEmpty() && !path.isNull()) {
+        int index = path.reverseFind('/');
+        if (index == 0) {
+            credential = pathToCredentialMap.get("/");
+            break;
+        } else if (index == -1) {
+            // This case should never happen, as all HTTP URL paths should start with a leading /
+            ASSERT_NOT_REACHED();
+            credential = pathToCredentialMap.get(path);
+            break;
+        } else {
+            path = path.substring(0, index);
+            credential = pathToCredentialMap.get(path);
+        }
+    }
+    return credential;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/CredentialStorage.h b/WebCore/platform/network/CredentialStorage.h
new file mode 100644
index 0000000..737efa6
--- /dev/null
+++ b/WebCore/platform/network/CredentialStorage.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef SessionCredentialStorage_h
+#define SessionCredentialStorage_h
+
+namespace WebCore {
+
+class Credential;
+class KURL;
+class ProtectionSpace;
+
+class CredentialStorage {
+public:
+    static void set(const Credential&, const ProtectionSpace&, const KURL&);
+    static Credential get(const ProtectionSpace&);
+    static Credential getDefaultAuthenticationCredential(const KURL&);
+};
+
+} // namespace WebCore
+
+#endif // SessionCredentialStorage_h
diff --git a/WebCore/platform/network/HTTPHeaderMap.cpp b/WebCore/platform/network/HTTPHeaderMap.cpp
index ff470a0..07c66e8 100644
--- a/WebCore/platform/network/HTTPHeaderMap.cpp
+++ b/WebCore/platform/network/HTTPHeaderMap.cpp
@@ -45,7 +45,7 @@ auto_ptr<CrossThreadHTTPHeaderMapData> HTTPHeaderMap::copyData() const
 
     HTTPHeaderMap::const_iterator end_it = end();
     for (HTTPHeaderMap::const_iterator it = begin(); it != end_it; ++it) {
-        data->append(make_pair(it->first.string().copy(), it->second.copy()));
+        data->append(make_pair(it->first.string().crossThreadString(), it->second.crossThreadString()));
     }
     return data;
 }
diff --git a/WebCore/platform/network/ProtectionSpace.cpp b/WebCore/platform/network/ProtectionSpace.cpp
index bd73558..d04bcbe 100644
--- a/WebCore/platform/network/ProtectionSpace.cpp
+++ b/WebCore/platform/network/ProtectionSpace.cpp
@@ -37,7 +37,11 @@ namespace WebCore {
 // combined with the semantics of the String(NSString*) constructor
 ProtectionSpace::ProtectionSpace()
     : m_host("")
+    , m_port(0)
+    , m_serverType(ProtectionSpaceServerHTTP)
     , m_realm("")
+    , m_authenticationScheme(ProtectionSpaceAuthenticationSchemeDefault)
+    , m_isHashTableDeletedValue(false)
 {
 }
  
@@ -49,6 +53,7 @@ ProtectionSpace::ProtectionSpace(const String& host, int port, ProtectionSpaceSe
     , m_serverType(serverType)
     , m_realm(realm.length() ? realm : "")
     , m_authenticationScheme(authenticationScheme)
+    , m_isHashTableDeletedValue(false)
 {    
 }
     
diff --git a/WebCore/platform/network/ProtectionSpace.h b/WebCore/platform/network/ProtectionSpace.h
index 9a73cff..126b499 100644
--- a/WebCore/platform/network/ProtectionSpace.h
+++ b/WebCore/platform/network/ProtectionSpace.h
@@ -54,6 +54,10 @@ class ProtectionSpace {
 public:
     ProtectionSpace();
     ProtectionSpace(const String& host, int port, ProtectionSpaceServerType, const String& realm, ProtectionSpaceAuthenticationScheme);
+
+    // Hash table deleted values, which are only constructed and never copied or destroyed.
+    ProtectionSpace(WTF::HashTableDeletedValueType) : m_isHashTableDeletedValue(true) { }
+    bool isHashTableDeletedValue() const { return m_isHashTableDeletedValue; }
     
     const String& host() const;
     int port() const;
@@ -70,10 +74,12 @@ private:
     ProtectionSpaceServerType m_serverType;
     String m_realm;
     ProtectionSpaceAuthenticationScheme m_authenticationScheme;
+    bool m_isHashTableDeletedValue;
 };
 
 bool operator==(const ProtectionSpace& a, const ProtectionSpace& b);
 inline bool operator!=(const ProtectionSpace& a, const ProtectionSpace& b) { return !(a == b); }
     
-}
-#endif
+} // namespace WebCore
+
+#endif // ProtectionSpace_h
diff --git a/WebCore/platform/network/ProtectionSpaceHash.h b/WebCore/platform/network/ProtectionSpaceHash.h
new file mode 100644
index 0000000..6f68b5b
--- /dev/null
+++ b/WebCore/platform/network/ProtectionSpaceHash.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ProtectionSpaceHash_h
+#define ProtectionSpaceHash_h
+
+#include "ProtectionSpace.h"
+
+namespace WebCore {
+
+struct ProtectionSpaceHash {
+    static unsigned hash(const ProtectionSpace& protectionSpace)
+    { 
+        unsigned hashCodes[5] = {
+            protectionSpace.host().impl() ? protectionSpace.host().impl()->hash() : 0, 
+            protectionSpace.port(), 
+            protectionSpace.serverType(),
+            protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0,
+            protectionSpace.authenticationScheme()
+        };
+
+        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));    
+    }
+    
+    static bool equal(const ProtectionSpace& a, const ProtectionSpace& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = false;
+};
+
+} // namespace WebCore
+
+namespace WTF {
+
+    // WebCore::ProtectionSpaceHash is the default hash for ProtectionSpace
+    template<> struct HashTraits<WebCore::ProtectionSpace> : GenericHashTraits<WebCore::ProtectionSpace> {
+        static const bool emptyValueIsZero = true;
+        static void constructDeletedValue(WebCore::ProtectionSpace& slot) { new (&slot) WebCore::ProtectionSpace(HashTableDeletedValue); }
+        static bool isDeletedValue(const WebCore::ProtectionSpace& slot) { return slot.isHashTableDeletedValue(); }
+    };
+
+    template<typename T> struct DefaultHash;
+    template<> struct DefaultHash<WebCore::ProtectionSpace> {
+        typedef WebCore::ProtectionSpaceHash Hash;
+    };
+
+} // namespace WTF
+
+
+#endif // ProtectionSpaceHash_h
diff --git a/WebCore/platform/network/ResourceErrorBase.cpp b/WebCore/platform/network/ResourceErrorBase.cpp
index 370650f..97435ba 100644
--- a/WebCore/platform/network/ResourceErrorBase.cpp
+++ b/WebCore/platform/network/ResourceErrorBase.cpp
@@ -34,10 +34,10 @@ ResourceError ResourceErrorBase::copy() const
     lazyInit();
 
     ResourceError errorCopy;
-    errorCopy.m_domain = m_domain.copy();
+    errorCopy.m_domain = m_domain.crossThreadString();
     errorCopy.m_errorCode = m_errorCode;
-    errorCopy.m_failingURL = m_failingURL.copy();
-    errorCopy.m_localizedDescription = m_localizedDescription.copy();
+    errorCopy.m_failingURL = m_failingURL.crossThreadString();
+    errorCopy.m_localizedDescription = m_localizedDescription.crossThreadString();
     errorCopy.m_isNull = m_isNull;
     errorCopy.m_isCancellation = m_isCancellation;
     return errorCopy;
diff --git a/WebCore/platform/network/ResourceHandleInternal.h b/WebCore/platform/network/ResourceHandleInternal.h
index 7951109..31d740a 100644
--- a/WebCore/platform/network/ResourceHandleInternal.h
+++ b/WebCore/platform/network/ResourceHandleInternal.h
@@ -159,6 +159,8 @@ namespace WebCore {
         String m_user;
         String m_pass;
         
+        Credential m_initialCredential;
+        
         int status;
 
         bool m_defersLoading;
diff --git a/WebCore/platform/network/ResourceRequestBase.cpp b/WebCore/platform/network/ResourceRequestBase.cpp
index f9ecb6b..a568cc7 100644
--- a/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/WebCore/platform/network/ResourceRequestBase.cpp
@@ -62,7 +62,7 @@ auto_ptr<ResourceRequest> ResourceRequestBase::adopt(auto_ptr<CrossThreadResourc
         request->setResponseContentDispositionEncodingFallbackArray(encoding1, encoding2, encoding3);
     }
     request->setHTTPBody(data->m_httpBody);
-    request->setAllowHTTPCookies(data->m_allowHTTPCookies);
+    request->setAllowCookies(data->m_allowCookies);
     return request;
 }
 
@@ -73,17 +73,17 @@ auto_ptr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
     data->m_cachePolicy = cachePolicy();
     data->m_timeoutInterval = timeoutInterval();
     data->m_firstPartyForCookies = firstPartyForCookies().copy();
-    data->m_httpMethod = httpMethod().copy();
+    data->m_httpMethod = httpMethod().crossThreadString();
     data->m_httpHeaders.adopt(httpHeaderFields().copyData());
 
     data->m_responseContentDispositionEncodingFallbackArray.reserveInitialCapacity(m_responseContentDispositionEncodingFallbackArray.size());
     size_t encodingArraySize = m_responseContentDispositionEncodingFallbackArray.size();
     for (size_t index = 0; index < encodingArraySize; ++index) {
-        data->m_responseContentDispositionEncodingFallbackArray.append(m_responseContentDispositionEncodingFallbackArray[index].copy());
+        data->m_responseContentDispositionEncodingFallbackArray.append(m_responseContentDispositionEncodingFallbackArray[index].crossThreadString());
     }
     if (m_httpBody)
         data->m_httpBody = m_httpBody->deepCopy();
-    data->m_allowHTTPCookies = m_allowHTTPCookies;
+    data->m_allowCookies = m_allowCookies;
     return data;
 }
 
@@ -251,18 +251,18 @@ void ResourceRequestBase::setHTTPBody(PassRefPtr<FormData> httpBody)
         m_platformRequestUpdated = false;
 } 
 
-bool ResourceRequestBase::allowHTTPCookies() const 
+bool ResourceRequestBase::allowCookies() const
 {
     updateResourceRequest(); 
     
-    return m_allowHTTPCookies; 
+    return m_allowCookies;
 }
 
-void ResourceRequestBase::setAllowHTTPCookies(bool allowHTTPCookies)
+void ResourceRequestBase::setAllowCookies(bool allowCookies)
 {
     updateResourceRequest(); 
     
-    m_allowHTTPCookies = allowHTTPCookies; 
+    m_allowCookies = allowCookies;
     
     if (url().protocolInHTTPFamily())
         m_platformRequestUpdated = false;
@@ -274,6 +274,9 @@ void ResourceRequestBase::addHTTPHeaderField(const AtomicString& name, const Str
     pair<HTTPHeaderMap::iterator, bool> result = m_httpHeaderFields.add(name, value); 
     if (!result.second)
         result.first->second += "," + value;
+
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
 }
 
 void ResourceRequestBase::addHTTPHeaderFields(const HTTPHeaderMap& headerFields)
@@ -300,7 +303,7 @@ bool equalIgnoringHeaderFields(const ResourceRequestBase& a, const ResourceReque
     if (a.httpMethod() != b.httpMethod())
         return false;
     
-    if (a.allowHTTPCookies() != b.allowHTTPCookies())
+    if (a.allowCookies() != b.allowCookies())
         return false;
     
     FormData* formDataA = a.httpBody();
@@ -355,7 +358,11 @@ void ResourceRequestBase::updateResourceRequest() const
     m_resourceRequestUpdated = true;
 }
 
+<<<<<<< HEAD:WebCore/platform/network/ResourceRequestBase.cpp
 #if !PLATFORM(MAC) && !USE(CFNETWORK) && !PLATFORM(ANDROID)
+=======
+#if !PLATFORM(MAC) && !USE(CFNETWORK) && !USE(SOUP)
+>>>>>>> webkit.org at 49305:WebCore/platform/network/ResourceRequestBase.cpp
 unsigned initializeMaximumHTTPConnectionCountPerHost()
 {
     // This is used by the loader to control the number of issued parallel load requests. 
diff --git a/WebCore/platform/network/ResourceRequestBase.h b/WebCore/platform/network/ResourceRequestBase.h
index 2d87d6e..348e6b3 100644
--- a/WebCore/platform/network/ResourceRequestBase.h
+++ b/WebCore/platform/network/ResourceRequestBase.h
@@ -105,8 +105,8 @@ namespace WebCore {
         FormData* httpBody() const;
         void setHTTPBody(PassRefPtr<FormData> httpBody);
         
-        bool allowHTTPCookies() const;
-        void setAllowHTTPCookies(bool allowHTTPCookies);
+        bool allowCookies() const;
+        void setAllowCookies(bool allowCookies);
 
         bool isConditional() const;
 
@@ -129,7 +129,7 @@ namespace WebCore {
             , m_cachePolicy(policy)
             , m_timeoutInterval(unspecifiedTimeoutInterval)
             , m_httpMethod("GET")
-            , m_allowHTTPCookies(true)
+            , m_allowCookies(true)
             , m_resourceRequestUpdated(true)
             , m_platformRequestUpdated(false)
             , m_reportUploadProgress(false)
@@ -148,7 +148,7 @@ namespace WebCore {
         HTTPHeaderMap m_httpHeaderFields;
         Vector<String> m_responseContentDispositionEncodingFallbackArray;
         RefPtr<FormData> m_httpBody;
-        bool m_allowHTTPCookies;
+        bool m_allowCookies;
         mutable bool m_resourceRequestUpdated;
         mutable bool m_platformRequestUpdated;
         bool m_reportUploadProgress;
@@ -173,7 +173,7 @@ namespace WebCore {
         OwnPtr<CrossThreadHTTPHeaderMapData> m_httpHeaders;
         Vector<String> m_responseContentDispositionEncodingFallbackArray;
         RefPtr<FormData> m_httpBody;
-        bool m_allowHTTPCookies;
+        bool m_allowCookies;
     };
     
     unsigned initializeMaximumHTTPConnectionCountPerHost();
diff --git a/WebCore/platform/network/ResourceResponseBase.cpp b/WebCore/platform/network/ResourceResponseBase.cpp
index 7f8a4e2..fd44225 100644
--- a/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/WebCore/platform/network/ResourceResponseBase.cpp
@@ -108,12 +108,12 @@ auto_ptr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() const
 {
     auto_ptr<CrossThreadResourceResponseData> data(new CrossThreadResourceResponseData());
     data->m_url = url().copy();
-    data->m_mimeType = mimeType().copy();
+    data->m_mimeType = mimeType().crossThreadString();
     data->m_expectedContentLength = expectedContentLength();
-    data->m_textEncodingName = textEncodingName().copy();
-    data->m_suggestedFilename = suggestedFilename().copy();
+    data->m_textEncodingName = textEncodingName().crossThreadString();
+    data->m_suggestedFilename = suggestedFilename().crossThreadString();
     data->m_httpStatusCode = httpStatusCode();
-    data->m_httpStatusText = httpStatusText().copy();
+    data->m_httpStatusText = httpStatusText().crossThreadString();
     data->m_httpHeaders.adopt(httpHeaderFields().copyData());
     data->m_lastModifiedDate = lastModifiedDate();
     return data;
diff --git a/WebCore/platform/network/SocketStreamErrorBase.cpp b/WebCore/platform/network/SocketStreamErrorBase.cpp
new file mode 100644
index 0000000..72fb44c
--- /dev/null
+++ b/WebCore/platform/network/SocketStreamErrorBase.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamError.h"
+
+namespace WebCore {
+
+SocketStreamError SocketStreamErrorBase::copy() const
+{
+    SocketStreamError errorCopy;
+    errorCopy.m_errorCode = m_errorCode;
+    return errorCopy;
+}
+
+bool SocketStreamErrorBase::compare(const SocketStreamError& a, const SocketStreamError& b)
+{
+    return a.errorCode() == b.errorCode();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/bindings/v8/V8ObjectEventListener.h b/WebCore/platform/network/SocketStreamErrorBase.h
index 3c5ae10..b7ca35b 100644
--- a/WebCore/bindings/v8/V8ObjectEventListener.h
+++ b/WebCore/platform/network/SocketStreamErrorBase.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,32 +29,44 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8ObjectEventListener_h
-#define V8ObjectEventListener_h
-
-#include "V8CustomEventListener.h"
-#include <v8.h>
-#include <wtf/PassRefPtr.h>
+#ifndef SocketStreamErrorBase_h
+#define SocketStreamErrorBase_h
 
 namespace WebCore {
 
-    class Frame;
+    class SocketStreamError;
 
-    // V8ObjectEventListener is a special listener wrapper for objects not in the DOM.  It keeps the JS listener as a weak pointer.
-    class V8ObjectEventListener : public V8EventListener {
+    class SocketStreamErrorBase {
     public:
-        static PassRefPtr<V8ObjectEventListener> create(Frame* frame, v8::Local<v8::Object> listener, bool isInline)
+        // Makes a deep copy.  Useful for when you need to use a SocketStreamError on another thread.
+        SocketStreamError copy() const;
+
+        bool isNull() const { return m_isNull; }
+
+        int errorCode() const { return m_errorCode; }
+
+        static bool compare(const SocketStreamError&, const SocketStreamError&);
+
+    protected:
+        SocketStreamErrorBase()
+            : m_errorCode(0)
+            , m_isNull(true)
         {
-            return adoptRef(new V8ObjectEventListener(frame, listener, isInline));
         }
 
-        virtual bool isObjectListener() const { return true; }
+        explicit SocketStreamErrorBase(int errorCode)
+            : m_errorCode(errorCode)
+            , m_isNull(false)
+        {
+        }
 
-    private:
-        V8ObjectEventListener(Frame*, v8::Local<v8::Object> listener, bool isInline);
-        virtual ~V8ObjectEventListener();
+        int m_errorCode;
+        bool m_isNull;
     };
 
-} // namespace WebCore
+    inline bool operator==(const SocketStreamError& a, const SocketStreamError& b) { return SocketStreamErrorBase::compare(a, b); }
+    inline bool operator!=(const SocketStreamError& a, const SocketStreamError& b) { return !(a == b); }
+
+}  // namespace WebCore
 
-#endif // V8ObjectEventListener_h
+#endif  // SocketStreamErrorBase_h
diff --git a/WebCore/platform/network/SocketStreamHandleBase.cpp b/WebCore/platform/network/SocketStreamHandleBase.cpp
new file mode 100644
index 0000000..875c248
--- /dev/null
+++ b/WebCore/platform/network/SocketStreamHandleBase.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandleBase.h"
+
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+const unsigned int bufferSize = 100 * 1024 * 1024;
+
+SocketStreamHandleBase::SocketStreamHandleBase(const KURL& url, SocketStreamHandleClient* client)
+    : m_url(url)
+    , m_client(client)
+    , m_state(Connecting)
+{
+}
+
+SocketStreamHandleBase::SocketStreamState SocketStreamHandleBase::state() const
+{
+    return m_state;
+}
+
+bool SocketStreamHandleBase::send(const char* data, int length)
+{
+    if (m_state == Connecting)
+        return false;
+    if (!m_buffer.isEmpty()) {
+        if (m_buffer.size() + length > bufferSize) {
+            // FIXME: report error to indicate that buffer has no more space.
+            return false;
+        }
+        m_buffer.append(data, length);
+        return true;
+    }
+    int bytesWritten = 0;
+    if (m_state == Open)
+        bytesWritten = platformSend(data, length);
+    if (bytesWritten <= 0)
+        return false;
+    if (m_buffer.size() + length - bytesWritten > bufferSize) {
+        // FIXME: report error to indicate that buffer has no more space.
+        return false;
+    }
+    if (bytesWritten < length)
+        m_buffer.append(data + bytesWritten, length - bytesWritten);
+    return true;
+}
+
+void SocketStreamHandleBase::close()
+{
+    platformClose();
+    m_state = Closed;
+}
+
+void SocketStreamHandleBase::setClient(SocketStreamHandleClient* client)
+{
+    ASSERT(!client || (!m_client && m_state == Connecting));
+    m_client = client;
+}
+
+bool SocketStreamHandleBase::sendPendingData()
+{
+    if (m_state != Open)
+        return false;
+    if (m_buffer.isEmpty())
+        return false;
+    int bytesWritten = platformSend(m_buffer.data(), m_buffer.size());
+    if (bytesWritten <= 0)
+        return false;
+    Vector<char> remainingData;
+    ASSERT(m_buffer.size() - bytesWritten <= bufferSize);
+    remainingData.append(m_buffer.data() + bytesWritten, m_buffer.size() - bytesWritten);
+    m_buffer.swap(remainingData);
+    return true;
+}
+
+}  // namespace WebCore
diff --git a/WebCore/platform/network/SocketStreamHandleBase.h b/WebCore/platform/network/SocketStreamHandleBase.h
new file mode 100644
index 0000000..fc011dd
--- /dev/null
+++ b/WebCore/platform/network/SocketStreamHandleBase.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandleBase_h
+#define SocketStreamHandleBase_h
+
+#include "KURL.h"
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class SocketStreamHandle;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandleBase {
+    public:
+        enum SocketStreamState { Connecting, Open, Closed };
+        virtual ~SocketStreamHandleBase() { }
+        SocketStreamState state() const;
+
+        bool send(const char* data, int length);
+        void close();
+        int bufferedAmount() const { return m_buffer.size(); }
+
+        SocketStreamHandleClient* client() const { return m_client; }
+        void setClient(SocketStreamHandleClient*);
+
+    protected:
+        SocketStreamHandleBase(const KURL&, SocketStreamHandleClient*);
+
+        bool sendPendingData();
+        virtual int platformSend(const char* data, int length) = 0;
+        virtual void platformClose() = 0;
+
+        KURL m_url;
+        SocketStreamHandleClient* m_client;
+        Vector<char> m_buffer;
+        SocketStreamState m_state;
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandleBase_h
diff --git a/WebCore/platform/network/SocketStreamHandleClient.h b/WebCore/platform/network/SocketStreamHandleClient.h
new file mode 100644
index 0000000..04c744e
--- /dev/null
+++ b/WebCore/platform/network/SocketStreamHandleClient.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandleClient_h
+#define SocketStreamHandleClient_h
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class KURL;
+    class SocketStreamError;
+    class SocketStreamHandle;
+
+    class SocketStreamHandleClient {
+    public:
+        virtual ~SocketStreamHandleClient() { }
+
+        virtual void willOpenStream(SocketStreamHandle*, const KURL&) { }
+        virtual void willSendData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
+
+        virtual void didOpen(SocketStreamHandle*) { }
+        virtual void didClose(SocketStreamHandle*) { }
+        virtual void didReceiveData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
+
+        virtual void didFail(SocketStreamHandle*, const SocketStreamError&) { }
+
+        virtual void didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
+        virtual void didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
+        virtual void receivedCancellation(SocketStreamHandle*, const AuthenticationChallenge&) { }
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandleClient_h
diff --git a/WebCore/platform/network/cf/AuthenticationCF.cpp b/WebCore/platform/network/cf/AuthenticationCF.cpp
index 51d60a4..bb05a39 100644
--- a/WebCore/platform/network/cf/AuthenticationCF.cpp
+++ b/WebCore/platform/network/cf/AuthenticationCF.cpp
@@ -37,8 +37,6 @@
 
 namespace WebCore {
 
-CFMutableDictionaryRef WebCoreCredentialStorage::m_storage;
-
 AuthenticationChallenge::AuthenticationChallenge(const ProtectionSpace& protectionSpace,
                                                  const Credential& proposedCredential,
                                                  unsigned previousFailureCount,
diff --git a/WebCore/platform/network/cf/AuthenticationCF.h b/WebCore/platform/network/cf/AuthenticationCF.h
index d3fc014..55f3e5f 100644
--- a/WebCore/platform/network/cf/AuthenticationCF.h
+++ b/WebCore/platform/network/cf/AuthenticationCF.h
@@ -43,26 +43,6 @@ CFURLProtectionSpaceRef createCF(const ProtectionSpace&);
 Credential core(CFURLCredentialRef);
 ProtectionSpace core(CFURLProtectionSpaceRef);
 
-class WebCoreCredentialStorage {
-public:
-    static void set(CFURLProtectionSpaceRef protectionSpace, CFURLCredentialRef credential)
-    {
-        if (!m_storage)
-            m_storage = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
-        CFDictionarySetValue(m_storage, protectionSpace, credential);
-    }
-
-    static CFURLCredentialRef get(CFURLProtectionSpaceRef protectionSpace)
-    {
-        if (!m_storage)
-            return 0;
-        return (CFURLCredentialRef)CFDictionaryGetValue(m_storage, protectionSpace);
-    }
-
-private:
-    static CFMutableDictionaryRef m_storage;
-};
-
 }
 
 #endif
diff --git a/WebCore/platform/network/cf/DNSCFNet.cpp b/WebCore/platform/network/cf/DNSCFNet.cpp
index bf21ab1..381dff2 100644
--- a/WebCore/platform/network/cf/DNSCFNet.cpp
+++ b/WebCore/platform/network/cf/DNSCFNet.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Collin Jackson  <collinj@webkit.org>
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,13 +27,128 @@
 #include "config.h"
 #include "DNS.h"
 
-#include "NotImplemented.h"
+#include "StringHash.h"
+#include "Timer.h"
+#include <wtf/RetainPtr.h>
+#include <wtf/StdLibExtras.h>
+
+#if PLATFORM(WIN)
+#include "ResourceHandle.h" // for loaderRunLoop()
+#endif
+
+#ifdef BUILDING_ON_TIGER
+// This function is available on Tiger, but not declared in the CFRunLoop.h header on Tiger.
+extern "C" CFRunLoopRef CFRunLoopGetMain();
+#endif
 
 namespace WebCore {
 
-void prefetchDNS(const String&)
+// When resolve queue is empty, we fire async resolution requests immediately (which is important if the prefetch is triggered by hovering).
+// But during page parsing, we should coalesce identical requests to avoid stressing out CFHost.
+const int namesToResolveImmediately = 4;
+
+// Coalesce prefetch requests for this long before sending them out.
+const double coalesceDelay = 1.0;
+
+// For a page has links to many outside sites, it is likely that the system DNS resolver won't be able to cache them all anyway, and we don't want
+// to negatively affect other appications' performance, by pushing their cached entries out, too.
+// If we end up with lots of names to prefetch, some will be dropped.
+const int maxRequestsToSend = 64;
+
+class DNSResolveQueue : public TimerBase {
+public:
+    static DNSResolveQueue& shared();
+    void add(const String&);
+    void decrementRequestCount();
+
+private:
+    DNSResolveQueue();
+
+    void resolve(const String&);
+    virtual void fired();
+    HashSet<String> m_names;
+    int m_requestsInFlight;
+};
+
+DNSResolveQueue::DNSResolveQueue()
+    : m_requestsInFlight(0)
+{
+}
+
+DNSResolveQueue& DNSResolveQueue::shared()
+{
+    DEFINE_STATIC_LOCAL(DNSResolveQueue, names, ());
+    return names;
+}
+
+void DNSResolveQueue::add(const String& name)
+{
+    // If there are no names queued, and few enough are in flight, resolve immediately (the mouse may be over a link).
+    if (!m_names.size()) {
+        if (atomicIncrement(&m_requestsInFlight) <= namesToResolveImmediately) {
+            resolve(name);
+            return;
+        }
+        atomicDecrement(&m_requestsInFlight);
+    }
+    m_names.add(name);
+    if (!isActive())
+        startOneShot(coalesceDelay);
+}
+
+void DNSResolveQueue::decrementRequestCount()
+{
+    atomicDecrement(&m_requestsInFlight);
+}
+
+void DNSResolveQueue::fired()
+{
+    int requestsAllowed = maxRequestsToSend - m_requestsInFlight;
+
+    for (HashSet<String>::iterator iter = m_names.begin(); iter != m_names.end() && requestsAllowed > 0; ++iter, --requestsAllowed) {
+        atomicIncrement(&m_requestsInFlight);
+        resolve(*iter);
+    }
+
+    // It's better to skip some names than to clog the queue.
+    m_names.clear();
+}
+
+static void clientCallback(CFHostRef theHost, CFHostInfoType, const CFStreamError*, void*)
+{
+    DNSResolveQueue::shared().decrementRequestCount(); // It's ok to call shared() from a secondary thread, the static variable has already been initialized by now.
+    CFRelease(theHost);
+}
+
+void DNSResolveQueue::resolve(const String& hostname)
+{
+    ASSERT(isMainThread());
+
+    RetainPtr<CFStringRef> hostnameCF(AdoptCF, hostname.createCFString());
+    RetainPtr<CFHostRef> host(AdoptCF, CFHostCreateWithName(0, hostnameCF.get()));
+    if (!host) {
+        atomicDecrement(&m_requestsInFlight);
+        return;
+    }
+    CFHostClientContext context = { 0, 0, 0, 0, 0 };
+    Boolean result = CFHostSetClient(host.get(), clientCallback, &context);
+    ASSERT_UNUSED(result, result);
+#if !PLATFORM(WIN)
+    CFHostScheduleWithRunLoop(host.get(), CFRunLoopGetMain(), kCFRunLoopCommonModes);
+#else
+    // On Windows, we run a separate thread with CFRunLoop, which is where clientCallback will be called.
+    CFHostScheduleWithRunLoop(host.get(), ResourceHandle::loaderRunLoop(), kCFRunLoopDefaultMode);
+#endif
+    CFHostStartInfoResolution(host.get(), kCFHostAddresses, 0);
+    host.releaseRef(); // The host will be released from clientCallback().
+}
+
+void prefetchDNS(const String& hostname)
 {
-    notImplemented();
+    ASSERT(isMainThread());
+    if (hostname.isEmpty())
+        return;
+    DNSResolveQueue::shared().add(hostname);
 }
 
 }
diff --git a/WebCore/platform/network/cf/ResourceErrorCF.cpp b/WebCore/platform/network/cf/ResourceErrorCF.cpp
index 8e82cd5..dacc68b 100644
--- a/WebCore/platform/network/cf/ResourceErrorCF.cpp
+++ b/WebCore/platform/network/cf/ResourceErrorCF.cpp
@@ -129,7 +129,7 @@ ResourceError::operator CFErrorRef() const
         if (!m_failingURL.isEmpty()) {
             RetainPtr<CFStringRef> failingURLString(AdoptCF, m_failingURL.createCFString());
             CFDictionarySetValue(userInfo.get(), failingURLStringKey, failingURLString.get());
-            RetainPtr<CFURLRef> url(AdoptCF, KURL(m_failingURL).createCFURL());
+            RetainPtr<CFURLRef> url(AdoptCF, KURL(ParsedURLString, m_failingURL).createCFURL());
             CFDictionarySetValue(userInfo.get(), failingURLKey, url.get());
         }
 
diff --git a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index e348f83..ea5fcc6 100644
--- a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -31,9 +31,12 @@
 
 #include "AuthenticationCF.h"
 #include "AuthenticationChallenge.h"
-#include "CookieStorageWin.h"
+#include "Base64.h"
 #include "CString.h"
+#include "CookieStorageWin.h"
+#include "CredentialStorage.h"
 #include "DocLoader.h"
+#include "FormDataStreamCFNet.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "Logging.h"
@@ -79,6 +82,8 @@ private:
     RetainPtr<CFURLRef> m_url;
     RetainPtr<CFStringRef> m_user;
     RetainPtr<CFStringRef> m_pass;
+    // Store the preemptively used initial credential so that if we get an authentication challenge, we won't use the same one again.
+    Credential m_initialCredential;
     bool m_allowStoredCredentials;
     ResourceResponse& m_response;
     RetainPtr<CFMutableDataRef> m_data;
@@ -105,6 +110,16 @@ static void setDefaultMIMEType(CFURLResponseRef response)
     CFURLResponseSetMIMEType(response, defaultMIMETypeString);
 }
 
+static String encodeBasicAuthorization(const String& user, const String& password)
+{
+    CString unencodedString = (user + ":" + password).utf8();
+    Vector<char> unencoded(unencodedString.length());
+    std::copy(unencodedString.data(), unencodedString.data() + unencodedString.length(), unencoded.begin());
+    Vector<char> encoded;
+    base64Encode(unencoded, encoded);
+    return String(encoded.data(), encoded.size());
+}
+
 CFURLRequestRef willSendRequest(CFURLConnectionRef conn, CFURLRequestRef cfRequest, CFURLResponseRef cfRedirectResponse, const void* clientInfo)
 {
     ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
@@ -125,6 +140,16 @@ CFURLRequestRef willSendRequest(CFURLConnectionRef conn, CFURLRequestRef cfReque
             if (CFStringCompareWithOptions(originalMethod.get(), newMethod.get(), CFRangeMake(0, CFStringGetLength(originalMethod.get())), kCFCompareCaseInsensitive)) {
                 RetainPtr<CFMutableURLRequestRef> mutableRequest(AdoptCF, CFURLRequestCreateMutableCopy(0, cfRequest));
                 CFURLRequestSetHTTPRequestMethod(mutableRequest.get(), originalMethod.get());
+
+                FormData* body = handle->request().httpBody();
+                if (!equalIgnoringCase(handle->request().httpMethod(), "GET") && body && !body->isEmpty())
+                    WebCore::setHTTPBody(mutableRequest.get(), body);
+
+                String originalContentType = handle->request().httpContentType();
+                RetainPtr<CFStringRef> originalContentTypeCF(AdoptCF, originalContentType.createCFString());
+                if (!originalContentType.isEmpty())
+                    CFURLRequestSetHTTPHeaderFieldValue(mutableRequest.get(), CFSTR("Content-Type"), originalContentTypeCF.get());
+
                 request = mutableRequest.get();
             }
         }
@@ -374,6 +399,16 @@ bool ResourceHandle::start(Frame* frame)
         d->m_request.setURL(urlWithCredentials);
     }
 
+    // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
+    // try and reuse the credential preemptively, as allowed by RFC 2617.
+    if (!client() || client()->shouldUseCredentialStorage(this) && d->m_request.url().protocolInHTTPFamily())
+        d->m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(d->m_request.url());
+        
+    if (!d->m_initialCredential.isEmpty()) {
+        String authHeader = "Basic " + encodeBasicAuthorization(d->m_initialCredential.user(), d->m_initialCredential.password());
+        d->m_request.addHTTPHeaderField("Authorization", authHeader);
+    }
+
     RetainPtr<CFURLRequestRef> request(AdoptCF, makeFinalRequest(d->m_request, d->m_shouldContentSniff));
 
     CFURLConnectionClient_V3 client = { 3, this, 0, 0, 0, WebCore::willSendRequest, didReceiveResponse, didReceiveData, NULL, didFinishLoading, didFail, willCacheResponse, didReceiveChallenge, didSendBodyData, shouldUseCredentialStorageCallback, 0};
@@ -441,7 +476,12 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
         RetainPtr<CFStringRef> pass(AdoptCF, d->m_pass.createCFString());
         RetainPtr<CFURLCredentialRef> credential(AdoptCF,
             CFURLCredentialCreate(kCFAllocatorDefault, user.get(), pass.get(), 0, kCFURLCredentialPersistenceNone));
-        WebCoreCredentialStorage::set(CFURLAuthChallengeGetProtectionSpace(challenge.cfURLAuthChallengeRef()), credential.get());
+        
+        KURL urlToStore;
+        if (challenge.failureResponse().httpStatusCode() == 401)
+            urlToStore = d->m_request.url();
+        CredentialStorage::set(core(credential.get()), challenge.protectionSpace(), urlToStore);
+        
         CFURLConnectionUseCredential(d->m_connection.get(), credential.get(), challenge.cfURLAuthChallengeRef());
         d->m_user = String();
         d->m_pass = String();
@@ -450,10 +490,11 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
     }
 
     if (!challenge.previousFailureCount() && (!client() || client()->shouldUseCredentialStorage(this))) {
-        CFURLCredentialRef credential = WebCoreCredentialStorage::get(CFURLAuthChallengeGetProtectionSpace(challenge.cfURLAuthChallengeRef()));
-        if (credential) {
-            ASSERT(CFURLCredentialGetPersistence(credential) == kCFURLCredentialPersistenceNone);
-            CFURLConnectionUseCredential(d->m_connection.get(), credential, challenge.cfURLAuthChallengeRef());
+        Credential credential = CredentialStorage::get(challenge.protectionSpace());
+        if (!credential.isEmpty() && credential != d->m_initialCredential) {
+            ASSERT(credential.persistence() == CredentialPersistenceNone);
+            RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
+            CFURLConnectionUseCredential(d->m_connection.get(), cfCredential.get(), challenge.cfURLAuthChallengeRef());
             return;
         }
     }
@@ -478,7 +519,12 @@ void ResourceHandle::receivedCredential(const AuthenticationChallenge& challenge
         // to ignore it for a particular request (short of removing it altogether).
         Credential webCredential(credential.user(), credential.password(), CredentialPersistenceNone);
         RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(webCredential));
-        WebCoreCredentialStorage::set(CFURLAuthChallengeGetProtectionSpace(challenge.cfURLAuthChallengeRef()), cfCredential.get());
+        
+        KURL urlToStore;
+        if (challenge.failureResponse().httpStatusCode() == 401)
+            urlToStore = d->m_request.url();      
+        CredentialStorage::set(webCredential, challenge.protectionSpace(), urlToStore);
+
         CFURLConnectionUseCredential(d->m_connection.get(), cfCredential.get(), challenge.cfURLAuthChallengeRef());
     } else {
         RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
@@ -659,19 +705,28 @@ void WebCoreSynchronousLoader::didReceiveChallenge(CFURLConnectionRef conn, CFUR
     WebCoreSynchronousLoader* loader = static_cast<WebCoreSynchronousLoader*>(const_cast<void*>(clientInfo));
 
     if (loader->m_user && loader->m_pass) {
-        RetainPtr<CFURLCredentialRef> credential(AdoptCF,
-            CFURLCredentialCreate(kCFAllocatorDefault, loader->m_user.get(), loader->m_pass.get(), 0, kCFURLCredentialPersistenceNone));
-        WebCoreCredentialStorage::set(CFURLAuthChallengeGetProtectionSpace(challenge), credential.get());
-        CFURLConnectionUseCredential(conn, credential.get(), challenge);
+        Credential credential(loader->m_user.get(), loader->m_pass.get(), CredentialPersistenceNone);
+        RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
+        
+        CFURLResponseRef urlResponse = (CFURLResponseRef)CFURLAuthChallengeGetFailureResponse(challenge);
+        CFHTTPMessageRef httpResponse = urlResponse ? CFURLResponseGetHTTPResponse(urlResponse) : 0;
+        KURL urlToStore;
+        if (httpResponse && CFHTTPMessageGetResponseStatusCode(httpResponse) == 401)
+            urlToStore = loader->m_url.get();
+            
+        CredentialStorage::set(credential, core(CFURLAuthChallengeGetProtectionSpace(challenge)), urlToStore);
+        
+        CFURLConnectionUseCredential(conn, cfCredential.get(), challenge);
         loader->m_user = 0;
         loader->m_pass = 0;
         return;
     }
     if (!CFURLAuthChallengeGetPreviousFailureCount(challenge) && loader->m_allowStoredCredentials) {
-        CFURLCredentialRef credential = WebCoreCredentialStorage::get(CFURLAuthChallengeGetProtectionSpace(challenge));
-        if (credential) {
-            ASSERT(CFURLCredentialGetPersistence(credential) == kCFURLCredentialPersistenceNone);
-            CFURLConnectionUseCredential(conn, credential, challenge);
+        Credential credential = CredentialStorage::get(core(CFURLAuthChallengeGetProtectionSpace(challenge)));
+        if (!credential.isEmpty() && credential != loader->m_initialCredential) {
+            ASSERT(credential.persistence() == CredentialPersistenceNone);
+            RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
+            CFURLConnectionUseCredential(conn, cfCredential.get(), challenge);
             return;
         }
     }
@@ -696,8 +751,10 @@ RetainPtr<CFDataRef> WebCoreSynchronousLoader::load(const ResourceRequest& reque
 
     KURL url = request.url();
 
-    loader.m_user.adoptCF(url.user().createCFString());
-    loader.m_pass.adoptCF(url.pass().createCFString());
+    if (url.user().length())
+        loader.m_user.adoptCF(url.user().createCFString());
+    if (url.pass().length())
+        loader.m_pass.adoptCF(url.pass().createCFString());
     loader.m_allowStoredCredentials = (storedCredentials == AllowStoredCredentials);
 
     // Take user/pass out of the URL.
@@ -707,8 +764,20 @@ RetainPtr<CFDataRef> WebCoreSynchronousLoader::load(const ResourceRequest& reque
         ResourceRequest requestWithoutCredentials(request);
         requestWithoutCredentials.removeCredentials();
         cfRequest.adoptCF(makeFinalRequest(requestWithoutCredentials, ResourceHandle::shouldContentSniffURL(requestWithoutCredentials.url())));
-    } else
-        cfRequest.adoptCF(makeFinalRequest(request, ResourceHandle::shouldContentSniffURL(request.url())));
+    } else {
+        // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
+        // try and reuse the credential preemptively, as allowed by RFC 2617.
+        ResourceRequest requestWithInitialCredential(request);
+        if (loader.m_allowStoredCredentials && url.protocolInHTTPFamily())
+            loader.m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(url);
+
+        if (!loader.m_initialCredential.isEmpty()) {
+            String authHeader = "Basic " + encodeBasicAuthorization(loader.m_initialCredential.user(), loader.m_initialCredential.password());
+            requestWithInitialCredential.addHTTPHeaderField("Authorization", authHeader);
+        }
+
+        cfRequest.adoptCF(makeFinalRequest(requestWithInitialCredential, ResourceHandle::shouldContentSniffURL(requestWithInitialCredential.url())));
+    }
 
     CFURLConnectionClient_V3 client = { 3, &loader, 0, 0, 0, willSendRequest, didReceiveResponse, didReceiveData, 0, didFinishLoading, didFail, 0, didReceiveChallenge, 0, shouldUseCredentialStorage, 0 };
     RetainPtr<CFURLConnectionRef> connection(AdoptCF, CFURLConnectionCreate(kCFAllocatorDefault, cfRequest.get(), reinterpret_cast<CFURLConnectionClient*>(&client)));
diff --git a/WebCore/platform/network/cf/ResourceRequest.h b/WebCore/platform/network/cf/ResourceRequest.h
index a4e9749..8ead412 100644
--- a/WebCore/platform/network/cf/ResourceRequest.h
+++ b/WebCore/platform/network/cf/ResourceRequest.h
@@ -37,7 +37,7 @@ namespace WebCore {
     struct ResourceRequest : ResourceRequestBase {
 
         ResourceRequest(const String& url) 
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/WebCore/platform/network/cf/ResourceRequestCFNet.cpp b/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
index 7355401..bba3d3e 100644
--- a/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
@@ -112,7 +112,7 @@ void ResourceRequest::doUpdatePlatformRequest()
 
     addHeadersFromHashMap(cfRequest, httpHeaderFields());
     WebCore::setHTTPBody(cfRequest, httpBody());
-    CFURLRequestSetShouldHandleHTTPCookies(cfRequest, allowHTTPCookies());
+    CFURLRequestSetShouldHandleHTTPCookies(cfRequest, allowCookies());
 
     unsigned fallbackCount = m_responseContentDispositionEncodingFallbackArray.size();
     RetainPtr<CFMutableArrayRef> encodingFallbacks(AdoptCF, CFArrayCreateMutable(kCFAllocatorDefault, fallbackCount, 0));
@@ -146,7 +146,7 @@ void ResourceRequest::doUpdateResourceRequest()
         m_httpMethod = method;
         CFRelease(method);
     }
-    m_allowHTTPCookies = CFURLRequestShouldHandleHTTPCookies(m_cfRequest.get());
+    m_allowCookies = CFURLRequestShouldHandleHTTPCookies(m_cfRequest.get());
 
     if (CFDictionaryRef headers = CFURLRequestCopyAllHTTPHeaderFields(m_cfRequest.get())) {
         CFIndex headerCount = CFDictionaryGetCount(headers);
diff --git a/WebCore/platform/network/cf/SocketStreamError.h b/WebCore/platform/network/cf/SocketStreamError.h
new file mode 100644
index 0000000..f9641ad
--- /dev/null
+++ b/WebCore/platform/network/cf/SocketStreamError.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamError_h
+#define SocketStreamError_h
+
+#include "SocketStreamErrorBase.h"
+
+namespace WebCore {
+
+    class SocketStreamError : public SocketStreamErrorBase {
+    public:
+        SocketStreamError() { }
+        explicit SocketStreamError(int errorCode)
+            : SocketStreamErrorBase(errorCode)
+        {
+        }
+
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamError_h
diff --git a/WebCore/platform/network/cf/SocketStreamHandle.h b/WebCore/platform/network/cf/SocketStreamHandle.h
new file mode 100644
index 0000000..64139e5
--- /dev/null
+++ b/WebCore/platform/network/cf/SocketStreamHandle.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandle_h
+#define SocketStreamHandle_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class Credential;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    public:
+        static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
+
+        virtual ~SocketStreamHandle();
+
+    protected:
+        virtual int platformSend(const char* data, int length);
+        virtual void platformClose();
+
+    private:
+        SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+
+        // No authentication for streams per se, but proxy may ask for credentials.
+        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
+        void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        void receivedCancellation(const AuthenticationChallenge&);
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandle_h
diff --git a/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp b/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
new file mode 100644
index 0000000..6aa33fc
--- /dev/null
+++ b/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandle.h"
+
+#include "KURL.h"
+#include "Logging.h"
+#include "NotImplemented.h"
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
+    : SocketStreamHandleBase(url, client)
+{
+    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
+    notImplemented();
+}
+
+SocketStreamHandle::~SocketStreamHandle()
+{
+    LOG(Network, "SocketStreamHandle %p delete", this);
+    setClient(0);
+    notImplemented();
+}
+
+int SocketStreamHandle::platformSend(const char*, int)
+{
+    LOG(Network, "SocketStreamHandle %p platformSend", this);
+    notImplemented();
+    return 0;
+}
+
+void SocketStreamHandle::platformClose()
+{
+    LOG(Network, "SocketStreamHandle %p platformClose", this);
+    notImplemented();
+}
+
+void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/platform/network/chromium/CookieJarChromium.cpp b/WebCore/platform/network/chromium/CookieJarChromium.cpp
index 65be451..7862cc3 100644
--- a/WebCore/platform/network/chromium/CookieJarChromium.cpp
+++ b/WebCore/platform/network/chromium/CookieJarChromium.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "ChromiumBridge.h"
 #include "Document.h"
 
@@ -52,4 +53,16 @@ bool cookiesEnabled(const Document*)
     return true;
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/network/chromium/ResourceRequest.h b/WebCore/platform/network/chromium/ResourceRequest.h
index aa76de4..48ff1e7 100644
--- a/WebCore/platform/network/chromium/ResourceRequest.h
+++ b/WebCore/platform/network/chromium/ResourceRequest.h
@@ -46,10 +46,10 @@ namespace WebCore {
         };
 
         ResourceRequest(const String& url) 
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
-            , m_appCacheContextID(0)
+            , m_appCacheHostID(0)
             , m_targetType(TargetIsSubResource)
         {
         }
@@ -58,7 +58,7 @@ namespace WebCore {
             : ResourceRequestBase(url, UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
-            , m_appCacheContextID(0)
+            , m_appCacheHostID(0)
             , m_targetType(TargetIsSubResource)
             , m_securityInfo(securityInfo)
         {
@@ -68,7 +68,7 @@ namespace WebCore {
             : ResourceRequestBase(url, UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
-            , m_appCacheContextID(0)
+            , m_appCacheHostID(0)
             , m_targetType(TargetIsSubResource)
         {
         }
@@ -77,7 +77,7 @@ namespace WebCore {
             : ResourceRequestBase(url, policy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
-            , m_appCacheContextID(0)
+            , m_appCacheHostID(0)
             , m_targetType(TargetIsSubResource)
         {
             setHTTPReferrer(referrer);
@@ -87,7 +87,7 @@ namespace WebCore {
             : ResourceRequestBase(KURL(), UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
-            , m_appCacheContextID(0)
+            , m_appCacheHostID(0)
             , m_targetType(TargetIsSubResource)
         {
         }
@@ -107,9 +107,9 @@ namespace WebCore {
         int requestorProcessID() const { return m_requestorProcessID; }
         void setRequestorProcessID(int requestorProcessID) { m_requestorProcessID = requestorProcessID; }
 
-        // Allows the request to be matched up with its app cache context.
-        int appCacheContextID() const { return m_appCacheContextID; }
-        void setAppCacheContextID(int id) { m_appCacheContextID = id; }
+        // Allows the request to be matched up with its app cache host.
+        int appCacheHostID() const { return m_appCacheHostID; }
+        void setAppCacheHostID(int id) { m_appCacheHostID = id; }
 
         // Opaque buffer that describes the security state (including SSL
         // connection state) for the resource that should be reported when the
@@ -128,7 +128,7 @@ namespace WebCore {
 
         int m_requestorID;
         int m_requestorProcessID;
-        int m_appCacheContextID;
+        int m_appCacheHostID;
         TargetType m_targetType;
         CString m_securityInfo;
     };
diff --git a/WebCore/platform/network/chromium/ResourceResponse.h b/WebCore/platform/network/chromium/ResourceResponse.h
index 6c928c0..0c2b5d9 100644
--- a/WebCore/platform/network/chromium/ResourceResponse.h
+++ b/WebCore/platform/network/chromium/ResourceResponse.h
@@ -60,12 +60,18 @@ namespace WebCore {
             m_isContentFiltered = isContentFiltered;
         }
 
-        long long getAppCacheID() const { return m_appCacheID; }
+        long long appCacheID() const { return m_appCacheID; }
         void setAppCacheID(long long id)
         {
             m_appCacheID = id;
         }
 
+        const KURL& appCacheManifestURL() const { return m_appCacheManifestURL; }
+        void setAppCacheManifestURL(const KURL& url)
+        {
+            m_appCacheManifestURL = url;
+        }
+
     private:
         friend class ResourceResponseBase;
 
@@ -86,6 +92,10 @@ namespace WebCore {
         // The id of the appcache this response was retrieved from, or zero if
         // the response was not retrieved from an appcache.
         long long m_appCacheID;
+
+        // The manifest url of the appcache this response was retrieved from, if any.
+        // Note: only valid for main resource responses.
+        KURL m_appCacheManifestURL;
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/chromium/SocketStreamError.h b/WebCore/platform/network/chromium/SocketStreamError.h
new file mode 100644
index 0000000..540496b
--- /dev/null
+++ b/WebCore/platform/network/chromium/SocketStreamError.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamError_h
+#define SocketStreamError_h
+
+#include "SocketStreamErrorBase.h"
+
+namespace WebCore {
+
+class SocketStreamError : public SocketStreamErrorBase {
+public:
+    SocketStreamError() { }
+    explicit SocketStreamError(int errorCode)
+            : SocketStreamErrorBase(errorCode) { }
+};
+
+}  // namespace WebCore
+
+#endif  // SocketStreamError_h
diff --git a/WebCore/platform/network/chromium/SocketStreamHandle.h b/WebCore/platform/network/chromium/SocketStreamHandle.h
new file mode 100644
index 0000000..5a905cb
--- /dev/null
+++ b/WebCore/platform/network/chromium/SocketStreamHandle.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandle_h
+#define SocketStreamHandle_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class Credential;
+    class SocketStreamHandleClient;
+    class SocketStreamHandleInternal;
+
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    public:
+        static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
+
+        virtual ~SocketStreamHandle();
+
+    protected:
+        virtual int platformSend(const char* data, int length);
+        virtual void platformClose();
+
+    private:
+        SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+
+        // No authentication for streams per se, but proxy may ask for credentials.
+        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
+        void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        void receivedCancellation(const AuthenticationChallenge&);
+
+        friend class SocketStreamHandleInternal;
+        OwnPtr<SocketStreamHandleInternal> m_internal;
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandle_h
diff --git a/WebCore/platform/network/curl/CookieJarCurl.cpp b/WebCore/platform/network/curl/CookieJarCurl.cpp
index 5ac0f9c..3bad4e4 100644
--- a/WebCore/platform/network/curl/CookieJarCurl.cpp
+++ b/WebCore/platform/network/curl/CookieJarCurl.cpp
@@ -17,6 +17,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "Document.h"
 #include "KURL.h"
 #include "PlatformString.h"
@@ -43,4 +44,16 @@ bool cookiesEnabled(const Document* /*document*/)
     return true;
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 }
diff --git a/WebCore/platform/network/curl/ResourceHandleCurl.cpp b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
index a6f5dca..5469ec9 100644
--- a/WebCore/platform/network/curl/ResourceHandleCurl.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
@@ -103,7 +103,13 @@ ResourceHandle::~ResourceHandle()
 
 bool ResourceHandle::start(Frame* frame)
 {
-    ASSERT(frame);
+    // The frame could be null if the ResourceHandle is not associated to any
+    // Frame, e.g. if we are downloading a file.
+    // If the frame is not null but the page is null this must be an attempted
+    // load from an onUnload handler, so let's just block it.
+    if (frame && !frame->page())
+        return false;
+
     ResourceHandleManager::sharedInstance()->add(this);
     return true;
 }
diff --git a/WebCore/platform/network/curl/ResourceHandleManager.cpp b/WebCore/platform/network/curl/ResourceHandleManager.cpp
index 2aa286a..14c6f31 100644
--- a/WebCore/platform/network/curl/ResourceHandleManager.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleManager.cpp
@@ -5,6 +5,8 @@
  * Copyright (C) 2007 Holger Hans Peter Freyther
  * Copyright (C) 2008 Collabora Ltd.
  * Copyright (C) 2008 Nuanti Ltd.
+ * Copyright (C) 2009 Appcelerator Inc.
+ * Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -44,6 +46,7 @@
 
 #include <errno.h>
 #include <stdio.h>
+#include <wtf/Threading.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -54,16 +57,72 @@ const int maxRunningJobs = 5;
 
 static const bool ignoreSSLErrors = getenv("WEBKIT_IGNORE_SSL_ERRORS");
 
+static CString certificatePath()
+{
+#if PLATFORM(CF)
+    CFBundleRef webKitBundle = CFBundleGetBundleWithIdentifier(CFSTR("com.apple.WebKit"));
+    if (webKitBundle) {
+        RetainPtr<CFURLRef> certURLRef(AdoptCF, CFBundleCopyResourceURL(webKitBundle, CFSTR("cacert"), CFSTR("pem"), CFSTR("certificates")));
+        if (certURLRef) {
+            char path[MAX_PATH];
+            CFURLGetFileSystemRepresentation(certURLRef.get(), false, reinterpret_cast<UInt8*>(path), MAX_PATH);
+            return path;
+        }
+    }
+#endif
+    char* envPath = getenv("CURL_CA_BUNDLE_PATH");
+    if (envPath)
+       return envPath;
+
+    return CString();
+}
+
+static Mutex* sharedResourceMutex(curl_lock_data data) {
+    DEFINE_STATIC_LOCAL(Mutex, cookieMutex, ());
+    DEFINE_STATIC_LOCAL(Mutex, dnsMutex, ());
+    DEFINE_STATIC_LOCAL(Mutex, shareMutex, ());
+
+    switch (data) {
+        case CURL_LOCK_DATA_COOKIE:
+            return &cookieMutex;
+        case CURL_LOCK_DATA_DNS:
+            return &dnsMutex;
+        case CURL_LOCK_DATA_SHARE:
+            return &shareMutex;
+        default:
+            ASSERT_NOT_REACHED();
+            return NULL;
+    }
+}
+
+// libcurl does not implement its own thread synchronization primitives.
+// these two functions provide mutexes for cookies, and for the global DNS
+// cache.
+static void curl_lock_callback(CURL* handle, curl_lock_data data, curl_lock_access access, void* userPtr)
+{
+    if (Mutex* mutex = sharedResourceMutex(data))
+        mutex->lock();
+}
+
+static void curl_unlock_callback(CURL* handle, curl_lock_data data, void* userPtr)
+{
+    if (Mutex* mutex = sharedResourceMutex(data))
+        mutex->unlock();
+}
+
 ResourceHandleManager::ResourceHandleManager()
     : m_downloadTimer(this, &ResourceHandleManager::downloadTimerCallback)
     , m_cookieJarFileName(0)
     , m_runningJobs(0)
+    , m_certificatePath (certificatePath())
 {
     curl_global_init(CURL_GLOBAL_ALL);
     m_curlMultiHandle = curl_multi_init();
     m_curlShareHandle = curl_share_init();
     curl_share_setopt(m_curlShareHandle, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
     curl_share_setopt(m_curlShareHandle, CURLSHOPT_SHARE, CURL_LOCK_DATA_DNS);
+    curl_share_setopt(m_curlShareHandle, CURLSHOPT_LOCKFUNC, curl_lock_callback);
+    curl_share_setopt(m_curlShareHandle, CURLSHOPT_UNLOCKFUNC, curl_unlock_callback);
 }
 
 ResourceHandleManager::~ResourceHandleManager()
@@ -88,6 +147,23 @@ ResourceHandleManager* ResourceHandleManager::sharedInstance()
     return sharedInstance;
 }
 
+static void handleLocalReceiveResponse (CURL* handle, ResourceHandle* job, ResourceHandleInternal* d)
+{
+    // since the code in headerCallback will not have run for local files
+    // the code to set the URL and fire didReceiveResponse is never run,
+    // which means the ResourceLoader's response does not contain the URL.
+    // Run the code here for local files to resolve the issue.
+    // TODO: See if there is a better approach for handling this.
+     const char* hdr;
+     CURLcode err = curl_easy_getinfo(handle, CURLINFO_EFFECTIVE_URL, &hdr);
+     ASSERT(CURLE_OK == err);
+     d->m_response.setURL(KURL(ParsedURLString, hdr));
+     if (d->client())
+         d->client()->didReceiveResponse(job, d->m_response);
+     d->m_response.setResponseFired(true);
+}
+
+
 // called with data after all headers have been processed via headerCallback
 static size_t writeCallback(void* ptr, size_t size, size_t nmemb, void* data)
 {
@@ -112,18 +188,10 @@ static size_t writeCallback(void* ptr, size_t size, size_t nmemb, void* data)
     if (CURLE_OK == err && httpCode >= 300 && httpCode < 400)
         return totalSize;
 
-    // since the code in headerCallback will not have run for local files
-    // the code to set the URL and fire didReceiveResponse is never run,
-    // which means the ResourceLoader's response does not contain the URL.
-    // Run the code here for local files to resolve the issue.
-    // TODO: See if there is a better approach for handling this.
     if (!d->m_response.responseFired()) {
-        const char* hdr;
-        err = curl_easy_getinfo(h, CURLINFO_EFFECTIVE_URL, &hdr);
-        d->m_response.setURL(KURL(hdr));
-        if (d->client())
-            d->client()->didReceiveResponse(job, d->m_response);
-        d->m_response.setResponseFired(true);
+        handleLocalReceiveResponse(h, job, d);
+        if (d->m_cancelled)
+            return 0;
     }
 
     if (d->client())
@@ -174,7 +242,7 @@ static size_t headerCallback(char* ptr, size_t size, size_t nmemb, void* data)
 
         const char* hdr;
         err = curl_easy_getinfo(h, CURLINFO_EFFECTIVE_URL, &hdr);
-        d->m_response.setURL(KURL(hdr));
+        d->m_response.setURL(KURL(ParsedURLString, hdr));
 
         long httpCode = 0;
         err = curl_easy_getinfo(h, CURLINFO_RESPONSE_CODE, &httpCode);
@@ -222,6 +290,7 @@ size_t readCallback(void* ptr, size_t size, size_t nmemb, void* data)
 {
     ResourceHandle* job = static_cast<ResourceHandle*>(data);
     ResourceHandleInternal* d = job->getInternal();
+
     if (d->m_cancelled)
         return 0;
 
@@ -311,6 +380,14 @@ void ResourceHandleManager::downloadTimerCallback(Timer<ResourceHandleManager>*
             continue;
 
         if (CURLE_OK == msg->data.result) {
+            if (!d->m_response.responseFired()) {
+                handleLocalReceiveResponse(d->m_handle, job, d);
+                if (d->m_cancelled) {
+                    removeFromCurl(job);
+                    continue;
+                }
+            }
+
             if (d->client())
                 d->client()->didFinishLoading(job);
         } else {
@@ -629,6 +706,10 @@ void ResourceHandleManager::initializeHandle(ResourceHandle* job)
     // and/or reporting SSL errors to the user.
     if (ignoreSSLErrors)
         curl_easy_setopt(d->m_handle, CURLOPT_SSL_VERIFYPEER, false);
+
+    if (!m_certificatePath.isNull())
+       curl_easy_setopt(d->m_handle, CURLOPT_CAINFO, m_certificatePath.data());
+
     // enable gzip and deflate through Accept-Encoding:
     curl_easy_setopt(d->m_handle, CURLOPT_ENCODING, "");
 
diff --git a/WebCore/platform/network/curl/ResourceHandleManager.h b/WebCore/platform/network/curl/ResourceHandleManager.h
index d38e577..89b27d7 100644
--- a/WebCore/platform/network/curl/ResourceHandleManager.h
+++ b/WebCore/platform/network/curl/ResourceHandleManager.h
@@ -29,6 +29,7 @@
 #define ResourceHandleManager_h
 
 #include "Frame.h"
+#include "CString.h"
 #include "Timer.h"
 #include "ResourceHandleClient.h"
 
@@ -71,6 +72,7 @@ private:
     char* m_cookieJarFileName;
     char m_curlErrorBuffer[CURL_ERROR_SIZE];
     Vector<ResourceHandle*> m_resourceHandleList;
+    const CString m_certificatePath;
     int m_runningJobs;
 };
 
diff --git a/WebCore/platform/network/curl/ResourceRequest.h b/WebCore/platform/network/curl/ResourceRequest.h
index b3032aa..3fa2795 100644
--- a/WebCore/platform/network/curl/ResourceRequest.h
+++ b/WebCore/platform/network/curl/ResourceRequest.h
@@ -36,7 +36,7 @@ namespace WebCore {
     struct ResourceRequest : ResourceRequestBase {
 
         ResourceRequest(const String& url)
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/WebCore/platform/network/curl/SocketStreamError.h b/WebCore/platform/network/curl/SocketStreamError.h
new file mode 100644
index 0000000..f9641ad
--- /dev/null
+++ b/WebCore/platform/network/curl/SocketStreamError.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamError_h
+#define SocketStreamError_h
+
+#include "SocketStreamErrorBase.h"
+
+namespace WebCore {
+
+    class SocketStreamError : public SocketStreamErrorBase {
+    public:
+        SocketStreamError() { }
+        explicit SocketStreamError(int errorCode)
+            : SocketStreamErrorBase(errorCode)
+        {
+        }
+
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamError_h
diff --git a/WebCore/platform/network/curl/SocketStreamHandle.h b/WebCore/platform/network/curl/SocketStreamHandle.h
new file mode 100644
index 0000000..64139e5
--- /dev/null
+++ b/WebCore/platform/network/curl/SocketStreamHandle.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandle_h
+#define SocketStreamHandle_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class Credential;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    public:
+        static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
+
+        virtual ~SocketStreamHandle();
+
+    protected:
+        virtual int platformSend(const char* data, int length);
+        virtual void platformClose();
+
+    private:
+        SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+
+        // No authentication for streams per se, but proxy may ask for credentials.
+        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
+        void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        void receivedCancellation(const AuthenticationChallenge&);
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandle_h
diff --git a/WebCore/platform/network/curl/SocketStreamHandleCurl.cpp b/WebCore/platform/network/curl/SocketStreamHandleCurl.cpp
new file mode 100644
index 0000000..891e96e
--- /dev/null
+++ b/WebCore/platform/network/curl/SocketStreamHandleCurl.cpp
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2009 Brent Fulgham.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandle.h"
+
+#include "KURL.h"
+#include "Logging.h"
+#include "NotImplemented.h"
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
+    : SocketStreamHandleBase(url, client)
+{
+    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
+    notImplemented();
+}
+
+SocketStreamHandle::~SocketStreamHandle()
+{
+    LOG(Network, "SocketStreamHandle %p delete", this);
+    setClient(0);
+    notImplemented();
+}
+
+int SocketStreamHandle::platformSend(const char*, int)
+{
+    LOG(Network, "SocketStreamHandle %p platformSend", this);
+    notImplemented();
+    return 0;
+}
+
+void SocketStreamHandle::platformClose()
+{
+    LOG(Network, "SocketStreamHandle %p platformClose", this);
+    notImplemented();
+}
+
+void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/platform/network/mac/AuthenticationMac.h b/WebCore/platform/network/mac/AuthenticationMac.h
index 7fb6bee..f55ac24 100644
--- a/WebCore/platform/network/mac/AuthenticationMac.h
+++ b/WebCore/platform/network/mac/AuthenticationMac.h
@@ -45,24 +45,6 @@ AuthenticationChallenge core(NSURLAuthenticationChallenge *);
 ProtectionSpace core(NSURLProtectionSpace *);
 Credential core(NSURLCredential *);
 
-class WebCoreCredentialStorage {
-public:
-    static void set(NSURLCredential *credential, NSURLProtectionSpace *protectionSpace)
-    {
-        if (!m_storage)
-            m_storage = [[NSMutableDictionary alloc] init];
-        [m_storage setObject:credential forKey:protectionSpace];
-    }
-
-    static NSURLCredential *get(NSURLProtectionSpace *protectionSpace)
-    {
-        return static_cast<NSURLCredential *>([m_storage objectForKey:protectionSpace]);
-    }
-
-private:
-    static NSMutableDictionary* m_storage;
-};
-
 }
 #endif
 
diff --git a/WebCore/platform/network/mac/AuthenticationMac.mm b/WebCore/platform/network/mac/AuthenticationMac.mm
index 961a79d..355931d 100644
--- a/WebCore/platform/network/mac/AuthenticationMac.mm
+++ b/WebCore/platform/network/mac/AuthenticationMac.mm
@@ -36,9 +36,6 @@
 
 namespace WebCore {
 
-
-NSMutableDictionary* WebCoreCredentialStorage::m_storage;
-
 AuthenticationChallenge::AuthenticationChallenge(const ProtectionSpace& protectionSpace,
                                                  const Credential& proposedCredential,
                                                  unsigned previousFailureCount,
diff --git a/WebCore/platform/network/mac/FormDataStreamMac.mm b/WebCore/platform/network/mac/FormDataStreamMac.mm
index a8d6887..8aa9a6d 100644
--- a/WebCore/platform/network/mac/FormDataStreamMac.mm
+++ b/WebCore/platform/network/mac/FormDataStreamMac.mm
@@ -161,11 +161,9 @@ static void advanceCurrentStream(FormStreamFields *form)
         form->currentData = data;
     } else {
         const String& path = nextInput.m_shouldGenerateFile ? nextInput.m_generatedFilename : nextInput.m_filename;
-        CFStringRef filename = path.createCFString();
-        CFURLRef fileURL = CFURLCreateWithFileSystemPath(0, filename, kCFURLPOSIXPathStyle, FALSE);
-        CFRelease(filename);
-        form->currentStream = CFReadStreamCreateWithFile(0, fileURL);
-        CFRelease(fileURL);
+        RetainPtr<CFStringRef> filename(AdoptCF, path.createCFString());
+        RetainPtr<CFURLRef> fileURL(AdoptCF, CFURLCreateWithFileSystemPath(0, filename.get(), kCFURLPOSIXPathStyle, FALSE));
+        form->currentStream = CFReadStreamCreateWithFile(0, fileURL.get());
     }
     form->remainingElements.removeLast();
 
@@ -375,11 +373,10 @@ void setHTTPBody(NSMutableURLRequest *request, PassRefPtr<FormData> formData)
     // Pass the length along with the formData so it does not have to be recomputed.
     FormContext formContext = { formData.releaseRef(), length };
 
-    CFReadStreamRef stream = wkCreateCustomCFReadStream(formCreate, formFinalize,
+    RetainPtr<CFReadStreamRef> stream(AdoptCF, wkCreateCustomCFReadStream(formCreate, formFinalize,
         formOpen, formRead, formCanRead, formClose, formSchedule, formUnschedule,
-        &formContext);
-    [request setHTTPBodyStream:(NSInputStream *)stream];
-    CFRelease(stream);
+        &formContext));
+    [request setHTTPBodyStream:(NSInputStream *)stream.get()];
 }
 
 FormData* httpBodyFromStream(NSInputStream* stream)
diff --git a/WebCore/platform/network/mac/ResourceErrorMac.mm b/WebCore/platform/network/mac/ResourceErrorMac.mm
index 94c2124..efd738f 100644
--- a/WebCore/platform/network/mac/ResourceErrorMac.mm
+++ b/WebCore/platform/network/mac/ResourceErrorMac.mm
@@ -76,7 +76,7 @@ ResourceError::operator NSError*() const
             [userInfo.get() setValue:m_localizedDescription forKey:NSLocalizedDescriptionKey];
 
         if (!m_failingURL.isEmpty()) {
-            NSURL *cocoaURL = KURL(m_failingURL);
+            NSURL *cocoaURL = KURL(ParsedURLString, m_failingURL);
             [userInfo.get() setValue:m_failingURL forKey:@"NSErrorFailingURLStringKey"];
             [userInfo.get() setValue:cocoaURL forKey:@"NSErrorFailingURLKey"];
         }
diff --git a/WebCore/platform/network/mac/ResourceHandleMac.mm b/WebCore/platform/network/mac/ResourceHandleMac.mm
index db76d1a..ec60079 100644
--- a/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006-2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,7 +28,10 @@
 
 #import "AuthenticationChallenge.h"
 #import "AuthenticationMac.h"
+#import "Base64.h"
 #import "BlockExceptions.h"
+#import "CString.h"
+#import "CredentialStorage.h"
 #import "DocLoader.h"
 #import "FormDataStreamMac.h"
 #import "Frame.h"
@@ -64,10 +67,6 @@ using namespace WebCore;
 - (NSData *)_bufferedData;
 @end
 
-@interface NSURLResponse (Details)
-- (void)_setMIMEType:(NSString *)type;
-@end
-
 @interface NSURLRequest (Details)
 - (id)_propertyForKey:(NSString *)key;
 @end
@@ -78,6 +77,8 @@ using namespace WebCore;
     NSURL *m_url;
     NSString *m_user;
     NSString *m_pass;
+    // Store the preemptively used initial credential so that if we get an authentication challenge, we won't use the same one again.
+    Credential m_initialCredential;
     BOOL m_allowStoredCredentials;
     NSURLResponse *m_response;
     NSMutableData *m_data;
@@ -118,6 +119,16 @@ public:
     }
 };
 
+static String encodeBasicAuthorization(const String& user, const String& password)
+{
+    CString unencodedString = (user + ":" + password).utf8();
+    Vector<char> unencoded(unencodedString.length());
+    std::copy(unencodedString.data(), unencodedString.data() + unencodedString.length(), unencoded.begin());
+    Vector<char> encoded;
+    base64Encode(unencoded, encoded);
+    return String(encoded.data(), encoded.size());
+}
+
 ResourceHandleInternal::~ResourceHandleInternal()
 {
 }
@@ -171,6 +182,16 @@ bool ResourceHandle::start(Frame* frame)
         urlWithCredentials.setPass(d->m_pass);
         d->m_request.setURL(urlWithCredentials);
     }
+    
+    // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
+    // try and reuse the credential preemptively, as allowed by RFC 2617.
+    if (!client() || client()->shouldUseCredentialStorage(this) && d->m_request.url().protocolInHTTPFamily())
+        d->m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(d->m_request.url());
+        
+    if (!d->m_initialCredential.isEmpty()) {
+        String authHeader = "Basic " + encodeBasicAuthorization(d->m_initialCredential.user(), d->m_initialCredential.password());
+        d->m_request.addHTTPHeaderField("Authorization", authHeader);
+    }
 
     if (!ResourceHandle::didSendBodyDataDelegateExists())
         associateStreamWithResourceHandle([d->m_request.nsURLRequest() HTTPBodyStream], this);
@@ -249,6 +270,10 @@ void ResourceHandle::cancel()
 {
     LOG(Network, "Handle %p cancel connection %p", this, d->m_connection.get());
 
+    // Leaks were seen on HTTP tests without this; can be removed once <rdar://problem/6886937> is fixed.
+    if (d->m_currentMacChallenge)
+        [[d->m_currentMacChallenge sender] cancelAuthenticationChallenge:d->m_currentMacChallenge];
+
     if (!ResourceHandle::didSendBodyDataDelegateExists())
         disassociateStreamWithResourceHandle([d->m_request.nsURLRequest() HTTPBodyStream]);
     [d->m_connection.get() cancel];
@@ -458,9 +483,10 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
     }
 
     if (!challenge.previousFailureCount() && (!client() || client()->shouldUseCredentialStorage(this))) {
-        NSURLCredential *credential = WebCoreCredentialStorage::get([mac(challenge) protectionSpace]);
-        if (credential) {
-            [challenge.sender() useCredential:credential forAuthenticationChallenge:mac(challenge)];
+        Credential credential = CredentialStorage::get(challenge.protectionSpace());
+        if (!credential.isEmpty() && credential != d->m_initialCredential) {
+            ASSERT(credential.persistence() == CredentialPersistenceNone);
+            [challenge.sender() useCredential:mac(credential) forAuthenticationChallenge:mac(challenge)];
             return;
         }
     }
@@ -495,7 +521,11 @@ void ResourceHandle::receivedCredential(const AuthenticationChallenge& challenge
     if (credential.persistence() == CredentialPersistenceNone) {
         // NSURLCredentialPersistenceNone doesn't work on Tiger, so we have to use session persistence.
         Credential webCredential(credential.user(), credential.password(), CredentialPersistenceForSession);
-        WebCoreCredentialStorage::set(mac(webCredential), [d->m_currentMacChallenge protectionSpace]);
+        KURL urlToStore;
+        if (challenge.failureResponse().httpStatusCode() == 401)
+            urlToStore = d->m_request.url();
+        CredentialStorage::set(webCredential, core([d->m_currentMacChallenge protectionSpace]), urlToStore);
+        
         [[d->m_currentMacChallenge sender] useCredential:mac(webCredential) forAuthenticationChallenge:d->m_currentMacChallenge];
     } else
 #else
@@ -504,7 +534,10 @@ void ResourceHandle::receivedCredential(const AuthenticationChallenge& challenge
         // to ignore it for a particular request (short of removing it altogether).
         // <rdar://problem/6867598> gallery.me.com is temporarily whitelisted, so that QuickTime plug-in could see the credentials.
         Credential webCredential(credential.user(), credential.password(), CredentialPersistenceNone);
-        WebCoreCredentialStorage::set(mac(webCredential), [d->m_currentMacChallenge protectionSpace]);
+        KURL urlToStore;
+        if (challenge.failureResponse().httpStatusCode() == 401)
+            urlToStore = d->m_request.url();
+        CredentialStorage::set(webCredential, core([d->m_currentMacChallenge protectionSpace]), urlToStore);
         [[d->m_currentMacChallenge sender] useCredential:mac(webCredential) forAuthenticationChallenge:d->m_currentMacChallenge];
     } else
 #endif
@@ -572,6 +605,15 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
         if (!equalIgnoringCase(originalMethod, String([newRequest HTTPMethod]))) {
             NSMutableURLRequest *mutableRequest = [newRequest mutableCopy];
             [mutableRequest setHTTPMethod:originalMethod];
+    
+            FormData* body = m_handle->request().httpBody();
+            if (!equalIgnoringCase(originalMethod, "GET") && body && !body->isEmpty())
+                WebCore::setHTTPBody(mutableRequest, body);
+
+            String originalContentType = m_handle->request().httpContentType();
+            if (!originalContentType.isEmpty())
+                [mutableRequest setValue:originalContentType forHTTPHeaderField:@"Content-Type"];
+
             newRequest = [mutableRequest autorelease];
         }
     }
@@ -635,13 +677,13 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
 {
     UNUSED_PARAM(connection);
 
-    LOG(Network, "Handle %p delegate connection:%p didReceiveResponse:%p (HTTP status %d, MIMEType '%s', reported MIMEType '%s')", m_handle, connection, r, [r respondsToSelector:@selector(statusCode)] ? [(id)r statusCode] : 0, [[r MIMEType] UTF8String], [[r _webcore_reportedMIMEType] UTF8String]);
+    LOG(Network, "Handle %p delegate connection:%p didReceiveResponse:%p (HTTP status %d, reported MIMEType '%s')", m_handle, connection, r, [r respondsToSelector:@selector(statusCode)] ? [(id)r statusCode] : 0, [[r MIMEType] UTF8String]);
 
     if (!m_handle || !m_handle->client())
         return;
     CallbackGuard guard;
 
-    swizzleMIMETypeMethodIfNecessary();
+    [r adjustMIMETypeIfNecessary];
 
     if ([m_handle->request().nsURLRequest() _propertyForKey:@"ForceHTMLMIMEType"])
         [r _setMIMEType:@"text/html"];
@@ -851,9 +893,11 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     [super dealloc];
 }
 
-- (NSURLRequest *)connection:(NSURLConnection *)unusedConnection willSendRequest:(NSURLRequest *)newRequest redirectResponse:(NSURLResponse *)redirectResponse
+- (NSURLRequest *)connection:(NSURLConnection *)connection willSendRequest:(NSURLRequest *)newRequest redirectResponse:(NSURLResponse *)redirectResponse
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connection:%p willSendRequest:%@ redirectResponse:%p", connection, [newRequest description], redirectResponse);
 
     // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
     if (m_url && !protocolHostAndPortAreEqual(m_url, [newRequest URL])) {
@@ -882,23 +926,31 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     return newRequest;
 }
 
-- (BOOL)connectionShouldUseCredentialStorage:(NSURLConnection *)unusedConnection
+- (BOOL)connectionShouldUseCredentialStorage:(NSURLConnection *)connection
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connectionShouldUseCredentialStorage:%p", connection);
 
     // FIXME: We should ask FrameLoaderClient whether using credential storage is globally forbidden.
     return m_allowStoredCredentials;
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connection:%p didReceiveAuthenticationChallenge:%p", connection, challenge);
 
     if (m_user && m_pass) {
         NSURLCredential *credential = [[NSURLCredential alloc] initWithUser:m_user
                                                                    password:m_pass
                                                                 persistence:NSURLCredentialPersistenceNone];
-        WebCoreCredentialStorage::set(credential, [challenge protectionSpace]);
+        KURL urlToStore;
+        if ([[challenge failureResponse] isKindOfClass:[NSHTTPURLResponse class]] && [(NSHTTPURLResponse*)[challenge failureResponse] statusCode] == 401)
+            urlToStore = m_url;
+        CredentialStorage::set(core(credential), core([challenge protectionSpace]), urlToStore);
+        
         [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
         [credential release];
         [m_user release];
@@ -908,10 +960,10 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
         return;
     }
     if ([challenge previousFailureCount] == 0 && m_allowStoredCredentials) {
-        NSURLCredential *credential = WebCoreCredentialStorage::get([challenge protectionSpace]);
-        ASSERT([credential persistence] == NSURLCredentialPersistenceNone);
-        if (credential) {
-            [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
+        Credential credential = CredentialStorage::get(core([challenge protectionSpace]));
+        if (!credential.isEmpty() && credential != m_initialCredential) {
+            ASSERT(credential.persistence() == CredentialPersistenceNone);
+            [[challenge sender] useCredential:mac(credential) forAuthenticationChallenge:challenge];
             return;
         }
     }
@@ -919,9 +971,11 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     [[challenge sender] continueWithoutCredentialForAuthenticationChallenge:challenge];
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didReceiveResponse:(NSURLResponse *)response
+- (void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)response
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connection:%p didReceiveResponse:%p (HTTP status %d, reported MIMEType '%s')", connection, response, [response respondsToSelector:@selector(statusCode)] ? [(id)response statusCode] : 0, [[response MIMEType] UTF8String]);
 
     NSURLResponse *r = [response copy];
     
@@ -929,9 +983,11 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     m_response = r;
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didReceiveData:(NSData *)data
+- (void)connection:(NSURLConnection *)connection didReceiveData:(NSData *)data
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connection:%p didReceiveData:%p", connection, data);
 
     if (!m_data)
         m_data = [[NSMutableData alloc] init];
@@ -939,16 +995,20 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     [m_data appendData:data];
 }
 
-- (void)connectionDidFinishLoading:(NSURLConnection *)unusedConnection
+- (void)connectionDidFinishLoading:(NSURLConnection *)connection
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connectionDidFinishLoading:%p", connection);
 
     m_isDone = YES;
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didFailWithError:(NSError *)error
+- (void)connection:(NSURLConnection *)connection didFailWithError:(NSError *)error
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connection:%p didFailWithError:%@", connection, error);
 
     ASSERT(!m_error);
     
@@ -973,23 +1033,36 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
 
 + (NSData *)loadRequest:(NSURLRequest *)request allowStoredCredentials:(BOOL)allowStoredCredentials returningResponse:(NSURLResponse **)response error:(NSError **)error
 {
+    LOG(Network, "WebCoreSynchronousLoader loadRequest:%@ allowStoredCredentials:%u", request, allowStoredCredentials);
+
     WebCoreSynchronousLoader *delegate = [[WebCoreSynchronousLoader alloc] init];
 
-    NSURL *url = [request URL];
-    delegate->m_user = [[url user] copy];
-    delegate->m_pass = [[url password] copy];
+    KURL url([request URL]);
+    delegate->m_user = [nsStringNilIfEmpty(url.user()) retain];
+    delegate->m_pass = [nsStringNilIfEmpty(url.pass()) retain];
     delegate->m_allowStoredCredentials = allowStoredCredentials;
 
     NSURLConnection *connection;
 
     // Take user/pass out of the URL.
     // Credentials for ftp can only be passed in URL, the connection:didReceiveAuthenticationChallenge: delegate call won't be made.
-    if ((delegate->m_user || delegate->m_pass) && KURL(url).protocolInHTTPFamily()) {
+    if ((delegate->m_user || delegate->m_pass) && url.protocolInHTTPFamily()) {
         ResourceRequest requestWithoutCredentials = request;
         requestWithoutCredentials.removeCredentials();
         connection = [[NSURLConnection alloc] initWithRequest:requestWithoutCredentials.nsURLRequest() delegate:delegate startImmediately:NO];
-    } else
-        connection = [[NSURLConnection alloc] initWithRequest:request delegate:delegate startImmediately:NO];
+    } else {
+        // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
+        // try and reuse the credential preemptively, as allowed by RFC 2617.
+        ResourceRequest requestWithInitialCredentials = request;
+        if (allowStoredCredentials && url.protocolInHTTPFamily())
+            delegate->m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(url);
+            
+        if (!delegate->m_initialCredential.isEmpty()) {
+            String authHeader = "Basic " + encodeBasicAuthorization(delegate->m_initialCredential.user(), delegate->m_initialCredential.password());
+            requestWithInitialCredentials.addHTTPHeaderField("Authorization", authHeader);
+        }
+        connection = [[NSURLConnection alloc] initWithRequest:requestWithInitialCredentials.nsURLRequest() delegate:delegate startImmediately:NO];
+    }
 
     [connection scheduleInRunLoop:[NSRunLoop currentRunLoop] forMode:WebCoreSynchronousLoaderRunLoopMode];
     [connection start];
@@ -1005,7 +1078,9 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     
     [connection release];
     [delegate release];
-    
+
+    LOG(Network, "WebCoreSynchronousLoader done");
+
     return data;
 }
 
diff --git a/WebCore/platform/network/mac/ResourceRequest.h b/WebCore/platform/network/mac/ResourceRequest.h
index 5bcb33e..b09e72d 100644
--- a/WebCore/platform/network/mac/ResourceRequest.h
+++ b/WebCore/platform/network/mac/ResourceRequest.h
@@ -41,7 +41,7 @@ namespace WebCore {
     class ResourceRequest : public ResourceRequestBase {
     public:
         ResourceRequest(const String& url) 
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/WebCore/platform/network/mac/ResourceRequestMac.mm b/WebCore/platform/network/mac/ResourceRequestMac.mm
index 6bb36a0..c4355b2 100644
--- a/WebCore/platform/network/mac/ResourceRequestMac.mm
+++ b/WebCore/platform/network/mac/ResourceRequestMac.mm
@@ -61,7 +61,7 @@ void ResourceRequest::doUpdateResourceRequest()
     
     if (NSString* method = [m_nsRequest.get() HTTPMethod])
         m_httpMethod = method;
-    m_allowHTTPCookies = [m_nsRequest.get() HTTPShouldHandleCookies];
+    m_allowCookies = [m_nsRequest.get() HTTPShouldHandleCookies];
     
     NSDictionary *headers = [m_nsRequest.get() allHTTPHeaderFields];
     NSEnumerator *e = [headers keyEnumerator];
@@ -113,7 +113,7 @@ void ResourceRequest::doUpdatePlatformRequest()
     [nsRequest setMainDocumentURL:firstPartyForCookies()];
     if (!httpMethod().isEmpty())
         [nsRequest setHTTPMethod:httpMethod()];
-    [nsRequest setHTTPShouldHandleCookies:allowHTTPCookies()];
+    [nsRequest setHTTPShouldHandleCookies:allowCookies()];
     
     HTTPHeaderMap::const_iterator end = httpHeaderFields().end();
     for (HTTPHeaderMap::const_iterator it = httpHeaderFields().begin(); it != end; ++it)
diff --git a/WebCore/platform/network/mac/WebCoreURLResponse.h b/WebCore/platform/network/mac/WebCoreURLResponse.h
index 0a9a7c4..8d43a21 100644
--- a/WebCore/platform/network/mac/WebCoreURLResponse.h
+++ b/WebCore/platform/network/mac/WebCoreURLResponse.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,7 +27,9 @@
  */
 
 @interface NSURLResponse (WebCoreURLResponse)
--(NSString *)_webcore_reportedMIMEType;
+-(void)adjustMIMETypeIfNecessary;
 @end
 
-void swizzleMIMETypeMethodIfNecessary();
+@interface NSURLResponse (Details)
+- (void)_setMIMEType:(NSString *)type;
+@end
diff --git a/WebCore/platform/network/mac/WebCoreURLResponse.mm b/WebCore/platform/network/mac/WebCoreURLResponse.mm
index f025769..9be4714 100644
--- a/WebCore/platform/network/mac/WebCoreURLResponse.mm
+++ b/WebCore/platform/network/mac/WebCoreURLResponse.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -327,23 +327,6 @@ static NSDictionary *createExtensionToMIMETypeMap()
     ];
 }
 
-static IMP oldNSURLResponseMIMETypeIMP = 0;
-static NSString *webNSURLResponseMIMEType(id, SEL);
-
-void swizzleMIMETypeMethodIfNecessary()
-{
-    if (!oldNSURLResponseMIMETypeIMP) {
-        Method nsURLResponseMIMETypeMethod = class_getInstanceMethod([NSURLResponse class], @selector(MIMEType));
-        ASSERT(nsURLResponseMIMETypeMethod);
-#ifdef BUILDING_ON_TIGER
-        oldNSURLResponseMIMETypeIMP = nsURLResponseMIMETypeMethod->method_imp;
-        nsURLResponseMIMETypeMethod->method_imp = (IMP)webNSURLResponseMIMEType;
-#else
-        oldNSURLResponseMIMETypeIMP = method_setImplementation(nsURLResponseMIMETypeMethod, (IMP)webNSURLResponseMIMEType);
-#endif
-    }
-}
-
 static NSString *mimeTypeFromUTITree(CFStringRef uti)
 {
     // Check if this UTI has a MIME type.
@@ -379,10 +362,12 @@ static NSString *mimeTypeFromUTITree(CFStringRef uti)
     return nil;
 }
 
-static NSString *webNSURLResponseMIMEType(id self, SEL _cmd)
+@implementation NSURLResponse (WebCoreURLResponse)
+
+-(void)adjustMIMETypeIfNecessary
 {
-    ASSERT(oldNSURLResponseMIMETypeIMP);
-    NSString *result = oldNSURLResponseMIMETypeIMP(self, _cmd);
+    NSString *result = [self MIMEType];
+    NSString *originalResult = result;
 
 #ifdef BUILDING_ON_TIGER
     // When content sniffing is disabled, Tiger's CFNetwork automatically returns application/octet-stream for certain
@@ -418,7 +403,7 @@ static NSString *webNSURLResponseMIMEType(id self, SEL _cmd)
 #ifndef BUILDING_ON_TIGER
     // <rdar://problem/5321972> Plain text document from HTTP server detected as application/octet-stream
     // Make the best guess when deciding between "generic binary" and "generic text" using a table of known binary MIME types.
-    if ([result isEqualToString:@"application/octet-stream"] && [self respondsToSelector:@selector(allHeaderFields)] && [[[self allHeaderFields] objectForKey:@"Content-Type"] hasPrefix:@"text/plain"]) {
+    if ([result isEqualToString:@"application/octet-stream"] && [self respondsToSelector:@selector(allHeaderFields)] && [[[self performSelector:@selector(allHeaderFields)] objectForKey:@"Content-Type"] hasPrefix:@"text/plain"]) {
         static NSSet *binaryExtensions = createBinaryExtensionsSet();
         if (![binaryExtensions containsObject:[[[self suggestedFilename] pathExtension] lowercaseString]])
             result = @"text/plain";
@@ -432,15 +417,8 @@ static NSString *webNSURLResponseMIMEType(id self, SEL _cmd)
         result = @"application/xml";
 #endif
 
-    return result;
-}
-
-@implementation NSURLResponse (WebCoreURLResponse)
-
--(NSString *)_webcore_reportedMIMEType
-{
-    swizzleMIMETypeMethodIfNecessary();
-    return oldNSURLResponseMIMETypeIMP(self, @selector(_webcore_realMIMEType));
+    if (result != originalResult)
+        [self _setMIMEType:result];
 }
 
 @end
diff --git a/WebKit/qt/Api/qwebplugindatabase_p.h b/WebCore/platform/network/qt/DnsPrefetchHelper.cpp
index 714458f..e687976 100644
--- a/WebKit/qt/Api/qwebplugindatabase_p.h
+++ b/WebCore/platform/network/qt/DnsPrefetchHelper.cpp
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -17,30 +17,19 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef QWEBPLUGINDATABASE_P_H
-#define QWEBPLUGINDATABASE_P_H
+#include "config.h"
+#include "DnsPrefetchHelper.h"
 
-#include "qwebkitglobal.h"
-
-#include <wtf/RefPtr.h>
+#include "CString.h"
 
 namespace WebCore {
-    class PluginPackage;
-    class PluginDatabase;
-};
-
-class QWebPluginInfoPrivate {
-public:
-    QWebPluginInfoPrivate(RefPtr<WebCore::PluginPackage> pluginPackage);
-
-    RefPtr<WebCore::PluginPackage> plugin;
-};
-
-class QWebPluginDatabasePrivate {
-public:
-    QWebPluginDatabasePrivate(WebCore::PluginDatabase* pluginDatabase);
-
-    WebCore::PluginDatabase* database;
-};
-
-#endif // QWEBPLUGINDATABASE_P_H
+// this is called on mouse over a href and on page loading
+void prefetchDNS(const String& hostname)
+{
+    if (QWebSettings::globalSettings()->testAttribute(QWebSettings::DnsPrefetchEnabled)) {
+        static DnsPrefetchHelper dnsPrefetchHelper;
+        dnsPrefetchHelper.lookup(QString(hostname));
+    }
+}
+
+}
diff --git a/WebCore/platform/network/qt/DnsPrefetchHelper.h b/WebCore/platform/network/qt/DnsPrefetchHelper.h
new file mode 100644
index 0000000..0d98fcb
--- /dev/null
+++ b/WebCore/platform/network/qt/DnsPrefetchHelper.h
@@ -0,0 +1,75 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#ifndef DNSPREFETCHHELPER_H
+#define DNSPREFETCHHELPER_H
+
+#include <QObject>
+#include <QCache>
+#include <QHostInfo>
+#include <QSet>
+#include <QString>
+#include <QTime>
+#include "qwebsettings.h"
+
+namespace WebCore {
+
+    class DnsPrefetchHelper : public QObject {
+        Q_OBJECT
+    public:
+        DnsPrefetchHelper() : QObject(), currentLookups(0) {};
+
+    public slots:
+        void lookup(QString hostname)
+        {
+            if (hostname.isEmpty())
+                return; // this actually happens
+            if (currentLookups >= 10)
+                return; // do not launch more than 10 lookups at the same time
+
+            QTime* entryTime = lookupCache.object(hostname);
+            if (entryTime && entryTime->elapsed() > 300*1000) {
+                // delete knowledge about lookup if it is already 300 seconds old
+                lookupCache.remove(hostname);
+            } else if (!entryTime) {
+                // not in cache yet, can look it up
+                QTime *tmpTime = new QTime();
+                *tmpTime = QTime::currentTime();
+                lookupCache.insert(hostname, tmpTime);
+                currentLookups++;
+                QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
+            }
+        }
+
+        void lookedUp(const QHostInfo&)
+        {
+            // we do not cache the result, we throw it away.
+            // we currently rely on the OS to cache the results. If it does not do that
+            // then at least the ISP nameserver did it.
+            currentLookups--;
+        }
+
+    protected:
+        QCache<QString, QTime> lookupCache; // 100 entries
+        int currentLookups;
+    };
+
+
+}
+
+#endif // DNSPREFETCHHELPER_H
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 898e5f4..7a3703d 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -131,10 +131,11 @@ void FormDataIODevice::slotFinished()
 
 QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode loadMode)
     : QObject(0)
-    , m_resourceHandle(handle)
     , m_reply(0)
+    , m_resourceHandle(handle)
     , m_redirected(false)
     , m_responseSent(false)
+    , m_responseDataSent(false)
     , m_loadMode(loadMode)
     , m_shouldStart(true)
     , m_shouldFinish(false)
@@ -204,6 +205,19 @@ QNetworkReply* QNetworkReplyHandler::release()
     return reply;
 }
 
+static bool ignoreHttpError(QNetworkReply* reply, bool receivedData)
+{
+    int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
+
+    if (httpStatusCode == 401 || httpStatusCode == 407)
+        return true;
+
+    if (receivedData && (httpStatusCode >= 400 && httpStatusCode < 600))
+        return true;
+
+    return false;
+}
+
 void QNetworkReplyHandler::finish()
 {
     m_shouldFinish = (m_loadMode != LoadNormal);
@@ -220,23 +234,27 @@ void QNetworkReplyHandler::finish()
         m_reply = 0;
         return;
     }
+
     QNetworkReply* oldReply = m_reply;
+
     if (m_redirected) {
         resetState();
         start();
-    } else if (m_reply->error() != QNetworkReply::NoError
-               // a web page that returns 401/403/404 can still have content
-               && m_reply->error() != QNetworkReply::ContentOperationNotPermittedError
-               && m_reply->error() != QNetworkReply::ContentNotFoundError
-               && m_reply->error() != QNetworkReply::AuthenticationRequiredError
-               && m_reply->error() != QNetworkReply::ProxyAuthenticationRequiredError) {
-        QUrl url = m_reply->url();
-        ResourceError error(url.host(), m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt(),
-                            url.toString(), m_reply->errorString());
-        client->didFail(m_resourceHandle, error);
-    } else {
+    } else if (!m_reply->error() || ignoreHttpError(m_reply, m_responseDataSent)) {
         client->didFinishLoading(m_resourceHandle);
+    } else {
+        QUrl url = m_reply->url();
+        int httpStatusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
+
+        if (httpStatusCode) {
+            ResourceError error("HTTP", httpStatusCode, url.toString(), m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toString());
+            client->didFail(m_resourceHandle, error);
+        } else {
+            ResourceError error("QtNetwork", m_reply->error(), url.toString(), m_reply->errorString());
+            client->didFail(m_resourceHandle, error);
+        }
     }
+
     oldReply->deleteLater();
     if (oldReply == m_reply)
         m_reply = 0;
@@ -248,6 +266,9 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     if (m_shouldSendResponse)
         return;
 
+    if (m_reply->error())
+        return;
+
     if (m_responseSent || !m_resourceHandle)
         return;
     m_responseSent = true;
@@ -271,41 +292,34 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     }
 
     KURL url(m_reply->url());
-    String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromAscii(m_reply->rawHeader("Content-Disposition")));
-
-    if (suggestedFilename.isEmpty())
-        suggestedFilename = url.lastPathComponent();
-
     ResourceResponse response(url, mimeType,
                               m_reply->header(QNetworkRequest::ContentLengthHeader).toLongLong(),
-                              encoding,
-                              suggestedFilename);
+                              encoding, String());
 
-    const bool isLocalFileReply = (m_reply->url().scheme() == QLatin1String("file"));
-    int statusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-    if (!isLocalFileReply) {
-        response.setHTTPStatusCode(statusCode);
-        response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
+    if (url.isLocalFile()) {
+        client->didReceiveResponse(m_resourceHandle, response);
+        return;
     }
-    else if (m_reply->error() == QNetworkReply::ContentNotFoundError)
-        response.setHTTPStatusCode(404);
 
+    // The status code is equal to 0 for protocols not in the HTTP family.
+    int statusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
-    /* Fill in the other fields
-     * For local file requests remove the content length and the last-modified
-     * headers as required by fast/dom/xmlhttprequest-get.xhtml
-     */
-    foreach (QByteArray headerName, m_reply->rawHeaderList()) {
+    if (url.protocolInHTTPFamily()) {
+        String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromAscii(m_reply->rawHeader("Content-Disposition")));
 
-        if (isLocalFileReply
-            && (headerName == "Content-Length" || headerName == "Last-Modified"))
-            continue;
+        if (!suggestedFilename.isEmpty())
+            response.setSuggestedFilename(suggestedFilename);
+        else
+            response.setSuggestedFilename(url.lastPathComponent());
 
-        response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
-    }
+        response.setHTTPStatusCode(statusCode);
+        response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
 
-    if (isLocalFileReply)
-        response.setHTTPHeaderField(QString::fromAscii("Cache-Control"), QString::fromAscii("no-cache"));
+        // Add remaining headers.
+        foreach (const QByteArray& headerName, m_reply->rawHeaderList()) {
+            response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
+        }
+    }
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
@@ -321,9 +335,13 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
         client->willSendRequest(m_resourceHandle, newRequest, response);
         m_redirected = true;
         m_request = newRequest.toNetworkRequest();
-    } else {
-        client->didReceiveResponse(m_resourceHandle, response);
+
+        ResourceHandleInternal* d = m_resourceHandle->getInternal();
+        emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
+        return;
     }
+
+    client->didReceiveResponse(m_resourceHandle, response);
 }
 
 void QNetworkReplyHandler::forwardData()
@@ -347,8 +365,10 @@ void QNetworkReplyHandler::forwardData()
     if (!client)
         return;
 
-    if (!data.isEmpty())
+    if (!data.isEmpty()) {
+        m_responseDataSent = true;
         client->didReceiveData(m_resourceHandle, data.constData(), data.length(), data.length() /*FixMe*/);
+    }
 }
 
 void QNetworkReplyHandler::start()
@@ -359,6 +379,8 @@ void QNetworkReplyHandler::start()
 
     QNetworkAccessManager* manager = d->m_frame->page()->networkAccessManager();
 
+    emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
+
     const QUrl url = m_request.url();
     const QString scheme = url.scheme();
     // Post requests on files and data don't really make sense, but for
@@ -421,6 +443,7 @@ void QNetworkReplyHandler::resetState()
 {
     m_redirected = false;
     m_responseSent = false;
+    m_responseDataSent = false;
     m_shouldStart = true;
     m_shouldFinish = false;
     m_shouldSendResponse = false;
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.h b/WebCore/platform/network/qt/QNetworkReplyHandler.h
index f88ce8a..545119e 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -73,6 +73,7 @@ private:
     ResourceHandle* m_resourceHandle;
     bool m_redirected;
     bool m_responseSent;
+    bool m_responseDataSent;
     LoadMode m_loadMode;
     QNetworkAccessManager::Operation m_method;
     QNetworkRequest m_request;
diff --git a/WebCore/platform/network/qt/ResourceRequest.h b/WebCore/platform/network/qt/ResourceRequest.h
index af76f61..93dacf3 100644
--- a/WebCore/platform/network/qt/ResourceRequest.h
+++ b/WebCore/platform/network/qt/ResourceRequest.h
@@ -38,7 +38,7 @@ namespace WebCore {
     struct ResourceRequest : ResourceRequestBase {
 
         ResourceRequest(const String& url) 
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/WebCore/platform/network/qt/SocketStreamError.h b/WebCore/platform/network/qt/SocketStreamError.h
new file mode 100644
index 0000000..f9641ad
--- /dev/null
+++ b/WebCore/platform/network/qt/SocketStreamError.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamError_h
+#define SocketStreamError_h
+
+#include "SocketStreamErrorBase.h"
+
+namespace WebCore {
+
+    class SocketStreamError : public SocketStreamErrorBase {
+    public:
+        SocketStreamError() { }
+        explicit SocketStreamError(int errorCode)
+            : SocketStreamErrorBase(errorCode)
+        {
+        }
+
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamError_h
diff --git a/WebCore/platform/network/qt/SocketStreamHandle.h b/WebCore/platform/network/qt/SocketStreamHandle.h
new file mode 100644
index 0000000..64139e5
--- /dev/null
+++ b/WebCore/platform/network/qt/SocketStreamHandle.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandle_h
+#define SocketStreamHandle_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class Credential;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    public:
+        static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
+
+        virtual ~SocketStreamHandle();
+
+    protected:
+        virtual int platformSend(const char* data, int length);
+        virtual void platformClose();
+
+    private:
+        SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+
+        // No authentication for streams per se, but proxy may ask for credentials.
+        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
+        void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        void receivedCancellation(const AuthenticationChallenge&);
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandle_h
diff --git a/WebCore/platform/network/qt/SocketStreamHandleSoup.cpp b/WebCore/platform/network/qt/SocketStreamHandleSoup.cpp
new file mode 100644
index 0000000..6aa33fc
--- /dev/null
+++ b/WebCore/platform/network/qt/SocketStreamHandleSoup.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandle.h"
+
+#include "KURL.h"
+#include "Logging.h"
+#include "NotImplemented.h"
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
+    : SocketStreamHandleBase(url, client)
+{
+    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
+    notImplemented();
+}
+
+SocketStreamHandle::~SocketStreamHandle()
+{
+    LOG(Network, "SocketStreamHandle %p delete", this);
+    setClient(0);
+    notImplemented();
+}
+
+int SocketStreamHandle::platformSend(const char*, int)
+{
+    LOG(Network, "SocketStreamHandle %p platformSend", this);
+    notImplemented();
+    return 0;
+}
+
+void SocketStreamHandle::platformClose()
+{
+    LOG(Network, "SocketStreamHandle %p platformClose", this);
+    notImplemented();
+}
+
+void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/platform/network/soup/CookieJarSoup.cpp b/WebCore/platform/network/soup/CookieJarSoup.cpp
index 705fdf2..3eb578a 100644
--- a/WebCore/platform/network/soup/CookieJarSoup.cpp
+++ b/WebCore/platform/network/soup/CookieJarSoup.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "CookieJarSoup.h"
 
+#include "Cookie.h"
 #include "CString.h"
 #include "Document.h"
 #include "KURL.h"
@@ -86,4 +87,16 @@ bool cookiesEnabled(const Document* /*document*/)
     return defaultCookieJar();
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 }
diff --git a/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 4a22d8a..2177bd2 100644
--- a/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -118,7 +118,7 @@ void WebCoreSynchronousLoader::run()
         g_main_loop_run(m_mainLoop);
 }
 
-static void cleanupGioOperation(ResourceHandleInternal* handle);
+static void cleanupGioOperation(ResourceHandle* handle, bool isDestroying);
 static bool startData(ResourceHandle* handle, String urlString);
 static bool startGio(ResourceHandle* handle, KURL url);
 
@@ -129,8 +129,6 @@ ResourceHandleInternal::~ResourceHandleInternal()
         m_msg = 0;
     }
 
-    cleanupGioOperation(this);
-
     if (m_idleHandler) {
         g_source_remove(m_idleHandler);
         m_idleHandler = 0;
@@ -142,6 +140,21 @@ ResourceHandle::~ResourceHandle()
     if (d->m_msg)
         g_signal_handlers_disconnect_matched(d->m_msg, G_SIGNAL_MATCH_DATA,
                                              0, 0, 0, 0, this);
+
+    cleanupGioOperation(this, true);
+}
+
+// All other kinds of redirections, except for the *304* status code
+// (SOUP_STATUS_NOT_MODIFIED) which needs to be fed into WebCore, will be
+// handled by soup directly.
+static gboolean statusWillBeHandledBySoup(guint statusCode)
+{
+    if (SOUP_STATUS_IS_TRANSPORT_ERROR(statusCode)
+        || (SOUP_STATUS_IS_REDIRECTION(statusCode) && (statusCode != SOUP_STATUS_NOT_MODIFIED))
+        || (statusCode == SOUP_STATUS_UNAUTHORIZED))
+        return true;
+
+    return false;
 }
 
 static void fillResponseFromMessage(SoupMessage* msg, ResourceResponse* response)
@@ -185,6 +198,7 @@ static void restartedCallback(SoupMessage* msg, gpointer data)
     ResourceRequest request = handle->request();
     ResourceResponse response;
     request.setURL(newURL);
+    request.setHTTPMethod(msg->method);
     fillResponseFromMessage(msg, &response);
     if (d->client())
         d->client()->willSendRequest(handle, request, response);
@@ -204,22 +218,25 @@ static void gotHeadersCallback(SoupMessage* msg, gpointer data)
     // we got, when we finish downloading.
     soup_message_body_set_accumulate(msg->response_body, FALSE);
 
-    if (msg->status_code == SOUP_STATUS_NOT_MODIFIED) {
-        RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
-        if (!handle)
-            return;
-        ResourceHandleInternal* d = handle->getInternal();
-        if (d->m_cancelled)
-            return;
-        ResourceHandleClient* client = handle->client();
-        if (!client)
-            return;
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
 
-        fillResponseFromMessage(msg, &d->m_response);
-        client->didReceiveResponse(handle.get(), d->m_response);
-    }
+    // The content-sniffed callback will handle the response if WebCore
+    // require us to sniff.
+    if(!handle || statusWillBeHandledBySoup(msg->status_code) || handle->shouldContentSniff())
+        return;
+
+    ResourceHandleInternal* d = handle->getInternal();
+    if (d->m_cancelled)
+        return;
+    ResourceHandleClient* client = handle->client();
+    if (!client)
+        return;
+
+    fillResponseFromMessage(msg, &d->m_response);
+    client->didReceiveResponse(handle.get(), d->m_response);
 }
 
+// This callback will not be called if the content sniffer is disabled in startHttp.
 static void contentSniffedCallback(SoupMessage* msg, const char* sniffedType, GHashTable *params, gpointer data)
 {
     if (sniffedType) {
@@ -229,13 +246,7 @@ static void contentSniffedCallback(SoupMessage* msg, const char* sniffedType, GH
             soup_message_headers_set_content_type(msg->response_headers, sniffedType, params);
     }
 
-    // The 304 status code (SOUP_STATUS_NOT_MODIFIED) needs to be fed
-    // into WebCore, as opposed to other kinds of redirections, which
-    // are handled by soup directly, so we special-case it here and in
-    // gotChunk.
-    if (SOUP_STATUS_IS_TRANSPORT_ERROR(msg->status_code)
-        || (SOUP_STATUS_IS_REDIRECTION(msg->status_code) && (msg->status_code != SOUP_STATUS_NOT_MODIFIED))
-        || (msg->status_code == SOUP_STATUS_UNAUTHORIZED))
+    if (statusWillBeHandledBySoup(msg->status_code))
         return;
 
     RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
@@ -254,9 +265,7 @@ static void contentSniffedCallback(SoupMessage* msg, const char* sniffedType, GH
 
 static void gotChunkCallback(SoupMessage* msg, SoupBuffer* chunk, gpointer data)
 {
-    if (SOUP_STATUS_IS_TRANSPORT_ERROR(msg->status_code)
-        || (SOUP_STATUS_IS_REDIRECTION(msg->status_code) && (msg->status_code != SOUP_STATUS_NOT_MODIFIED))
-        || (msg->status_code == SOUP_STATUS_UNAUTHORIZED))
+    if (statusWillBeHandledBySoup(msg->status_code))
         return;
 
     RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
@@ -276,7 +285,7 @@ static void gotChunkCallback(SoupMessage* msg, SoupBuffer* chunk, gpointer data)
 // Doesn't get called for redirects.
 static void finishedCallback(SoupSession *session, SoupMessage* msg, gpointer data)
 {
-    RefPtr<ResourceHandle>handle = adoptRef(static_cast<ResourceHandle*>(data));
+    RefPtr<ResourceHandle> handle = adoptRef(static_cast<ResourceHandle*>(data));
     // TODO: maybe we should run this code even if there's no client?
     if (!handle)
         return;
@@ -410,6 +419,13 @@ static SoupSession* createSoupSession()
     return soup_session_async_new();
 }
 
+// Values taken from http://stevesouders.com/ua/index.php following
+// the rule "Do What Every Other Modern Browser Is Doing". They seem
+// to significantly improve page loading time compared to soup's
+// default values.
+#define MAX_CONNECTIONS          60
+#define MAX_CONNECTIONS_PER_HOST 6
+
 static void ensureSessionIsInitialized(SoupSession* session)
 {
     if (g_object_get_data(G_OBJECT(session), "webkit-init"))
@@ -427,27 +443,34 @@ static void ensureSessionIsInitialized(SoupSession* session)
         g_object_unref(logger);
     }
 
+    g_object_set(session,
+                 SOUP_SESSION_MAX_CONNS, MAX_CONNECTIONS,
+                 SOUP_SESSION_MAX_CONNS_PER_HOST, MAX_CONNECTIONS_PER_HOST,
+                 NULL);
+
     g_object_set_data(G_OBJECT(session), "webkit-init", reinterpret_cast<void*>(0xdeadbeef));
 }
 
-static bool startHttp(ResourceHandle* handle, String urlString)
+static bool startHttp(ResourceHandle* handle)
 {
     ASSERT(handle);
- 
+
     SoupSession* session = handle->defaultSession();
     ensureSessionIsInitialized(session);
 
     ResourceHandleInternal* d = handle->getInternal();
 
-    d->m_msg = handle->request().toSoupMessage();
-    if (!d->m_msg) {
-        ResourceError resourceError(g_quark_to_string(SOUP_HTTP_ERROR),
-                                    SOUP_STATUS_MALFORMED,
-                                    urlString,
-                                    handle->request().httpMethod());
-        d->client()->didFail(handle, resourceError);
+    ResourceRequest request(handle->request());
+    KURL url(request.url());
+    url.removeFragmentIdentifier();
+    request.setURL(url);
+
+    d->m_msg = request.toSoupMessage();
+    if (!d->m_msg)
         return false;
-    }
+
+    if(!handle->shouldContentSniff())
+        soup_message_disable_feature(d->m_msg, SOUP_TYPE_CONTENT_SNIFFER);
 
     g_signal_connect(d->m_msg, "restarted", G_CALLBACK(restartedCallback), handle);
     g_signal_connect(d->m_msg, "got-headers", G_CALLBACK(gotHeadersCallback), handle);
@@ -491,14 +514,7 @@ static bool startHttp(ResourceHandle* handle, String urlString)
                     g_free(fileName);
 
                     if (error) {
-                        ResourceError resourceError(g_quark_to_string(SOUP_HTTP_ERROR),
-                                                    d->m_msg->status_code,
-                                                    urlString,
-                                                    String::fromUTF8(error->message));
                         g_error_free(error);
-
-                        d->client()->didFail(handle, resourceError);
-
                         g_signal_handlers_disconnect_matched(d->m_msg, G_SIGNAL_MATCH_DATA,
                                                              0, 0, 0, 0, handle);
                         g_object_unref(d->m_msg);
@@ -562,12 +578,16 @@ bool ResourceHandle::start(Frame* frame)
     if (equalIgnoringCase(protocol, "data"))
         return startData(this, urlString);
 
-    if (equalIgnoringCase(protocol, "http") || equalIgnoringCase(protocol, "https"))
-        return startHttp(this, urlString);
+    if (equalIgnoringCase(protocol, "http") || equalIgnoringCase(protocol, "https")) {
+        if (startHttp(this))
+            return true;
+    }
 
-    if (equalIgnoringCase(protocol, "file") || equalIgnoringCase(protocol, "ftp") || equalIgnoringCase(protocol, "ftps"))
+    if (equalIgnoringCase(protocol, "file") || equalIgnoringCase(protocol, "ftp") || equalIgnoringCase(protocol, "ftps")) {
         // FIXME: should we be doing any other protocols here?
-        return startGio(this, url);
+        if (startGio(this, url))
+            return true;
+    }
 
     // Error must not be reported immediately
     this->scheduleFailure(InvalidURLFailure);
@@ -625,8 +645,10 @@ void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, S
 
 // GIO-based loader
 
-static void cleanupGioOperation(ResourceHandleInternal* d)
+static void cleanupGioOperation(ResourceHandle* handle, bool isDestroying = false)
 {
+    ResourceHandleInternal* d = handle->getInternal();
+
     if (d->m_gfile) {
         g_object_set_data(G_OBJECT(d->m_gfile), "webkit-resource", 0);
         g_object_unref(d->m_gfile);
@@ -648,11 +670,14 @@ static void cleanupGioOperation(ResourceHandleInternal* d)
         g_free(d->m_buffer);
         d->m_buffer = 0;
     }
+
+    if (!isDestroying)
+        handle->deref();
 }
 
 static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
 {
-    ResourceHandle* handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
 
@@ -660,13 +685,12 @@ static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
     ResourceHandleClient* client = handle->client();
 
     g_input_stream_close_finish(d->m_inputStream, res, 0);
-    cleanupGioOperation(d);
-    client->didFinishLoading(handle);
+    cleanupGioOperation(handle.get());
+    client->didFinishLoading(handle.get());
 }
 
 static void readCallback(GObject* source, GAsyncResult* res, gpointer)
 {
-    // didReceiveData may cancel the load, which may release the last reference.
     RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
@@ -675,7 +699,7 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
     ResourceHandleClient* client = handle->client();
 
     if (d->m_cancelled || !client) {
-        cleanupGioOperation(d);
+        cleanupGioOperation(handle.get());
         return;
     }
 
@@ -690,7 +714,7 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
                                     error ? String::fromUTF8(error->message) : String());
         g_free(uri);
         g_error_free(error);
-        cleanupGioOperation(d);
+        cleanupGioOperation(handle.get());
         client->didFail(handle.get(), resourceError);
         return;
     }
@@ -704,8 +728,9 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
     d->m_total += bytesRead;
     client->didReceiveData(handle.get(), d->m_buffer, bytesRead, d->m_total);
 
+    // didReceiveData may cancel the load, which may release the last reference.
     if (d->m_cancelled) {
-        cleanupGioOperation(d);
+        cleanupGioOperation(handle.get());
         return;
     }
 
@@ -716,7 +741,7 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
 
 static void openCallback(GObject* source, GAsyncResult* res, gpointer)
 {
-    ResourceHandle* handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
 
@@ -724,7 +749,7 @@ static void openCallback(GObject* source, GAsyncResult* res, gpointer)
     ResourceHandleClient* client = handle->client();
 
     if (d->m_cancelled || !client) {
-        cleanupGioOperation(d);
+        cleanupGioOperation(handle.get());
         return;
     }
 
@@ -738,8 +763,8 @@ static void openCallback(GObject* source, GAsyncResult* res, gpointer)
                                     error ? String::fromUTF8(error->message) : String());
         g_free(uri);
         g_error_free(error);
-        cleanupGioOperation(d);
-        client->didFail(handle, resourceError);
+        cleanupGioOperation(handle.get());
+        client->didFail(handle.get(), resourceError);
         return;
     }
 
@@ -747,7 +772,8 @@ static void openCallback(GObject* source, GAsyncResult* res, gpointer)
     d->m_bufferSize = 8192;
     d->m_buffer = static_cast<char*>(g_malloc(d->m_bufferSize));
     d->m_total = 0;
-    g_object_set_data(G_OBJECT(d->m_inputStream), "webkit-resource", handle);
+
+    g_object_set_data(G_OBJECT(d->m_inputStream), "webkit-resource", handle.get());
     g_input_stream_read_async(d->m_inputStream, d->m_buffer, d->m_bufferSize,
                               G_PRIORITY_DEFAULT, d->m_cancellable,
                               readCallback, 0);
@@ -755,7 +781,7 @@ static void openCallback(GObject* source, GAsyncResult* res, gpointer)
 
 static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
 {
-    ResourceHandle* handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
 
@@ -763,7 +789,7 @@ static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
     ResourceHandleClient* client = handle->client();
 
     if (d->m_cancelled) {
-        cleanupGioOperation(d);
+        cleanupGioOperation(handle.get());
         return;
     }
 
@@ -790,8 +816,8 @@ static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
                                     error ? String::fromUTF8(error->message) : String());
         g_free(uri);
         g_error_free(error);
-        cleanupGioOperation(d);
-        client->didFail(handle, resourceError);
+        cleanupGioOperation(handle.get());
+        client->didFail(handle.get(), resourceError);
         return;
     }
 
@@ -804,8 +830,8 @@ static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
                                     uri,
                                     String());
         g_free(uri);
-        cleanupGioOperation(d);
-        client->didFail(handle, resourceError);
+        cleanupGioOperation(handle.get());
+        client->didFail(handle.get(), resourceError);
         return;
     }
 
@@ -816,7 +842,12 @@ static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
     g_file_info_get_modification_time(info, &tv);
     response.setLastModifiedDate(tv.tv_sec);
 
-    client->didReceiveResponse(handle, response);
+    client->didReceiveResponse(handle.get(), response);
+
+    if (d->m_cancelled) {
+        cleanupGioOperation(handle.get());
+        return;
+    }
 
     g_file_read_async(d->m_gfile, G_PRIORITY_DEFAULT, d->m_cancellable,
                       openCallback, 0);
@@ -827,13 +858,8 @@ static bool startGio(ResourceHandle* handle, KURL url)
 
     ResourceHandleInternal* d = handle->getInternal();
 
-    if (handle->request().httpMethod() != "GET" && handle->request().httpMethod() != "POST") {
-        ResourceError error(g_quark_to_string(SOUP_HTTP_ERROR),
-                            SOUP_STATUS_METHOD_NOT_ALLOWED,
-                            url.string(), handle->request().httpMethod());
-        d->client()->didFail(handle, error);
+    if (handle->request().httpMethod() != "GET" && handle->request().httpMethod() != "POST")
         return false;
-    }
 
     // GIO doesn't know how to handle refs and queries, so remove them
     // TODO: use KURL.fileSystemPath after KURLGtk and FileSystemGtk are
@@ -852,6 +878,10 @@ static bool startGio(ResourceHandle* handle, KURL url)
 #endif
         d->m_gfile = g_file_new_for_uri(url.string().utf8().data());
     g_object_set_data(G_OBJECT(d->m_gfile), "webkit-resource", handle);
+
+    // balanced by a deref() in cleanupGioOperation, which should always run
+    handle->ref();
+
     d->m_cancellable = g_cancellable_new();
     g_file_query_info_async(d->m_gfile,
                             G_FILE_ATTRIBUTE_STANDARD_TYPE ","
diff --git a/WebCore/platform/network/soup/ResourceRequest.h b/WebCore/platform/network/soup/ResourceRequest.h
index 82b4eb9..42b7baa 100644
--- a/WebCore/platform/network/soup/ResourceRequest.h
+++ b/WebCore/platform/network/soup/ResourceRequest.h
@@ -36,7 +36,7 @@ namespace WebCore {
     struct ResourceRequest : ResourceRequestBase {
 
         ResourceRequest(const String& url)
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/WebCore/platform/network/soup/ResourceRequestSoup.cpp b/WebCore/platform/network/soup/ResourceRequestSoup.cpp
index f2011bb..0d4e0f9 100644
--- a/WebCore/platform/network/soup/ResourceRequestSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceRequestSoup.cpp
@@ -66,11 +66,20 @@ void ResourceRequest::updateFromSoupMessage(SoupMessage* soupMessage)
     while (soup_message_headers_iter_next(&headersIter, &headerName, &headerValue))
         m_httpHeaderFields.set(String::fromUTF8(headerName), String::fromUTF8(headerValue));
 
-    m_httpBody = FormData::create(soupMessage->request_body->data, soupMessage->request_body->length);
+    if (soupMessage->request_body->data)
+        m_httpBody = FormData::create(soupMessage->request_body->data, soupMessage->request_body->length);
 
-    // FIXME: m_allowHTTPCookies and m_firstPartyForCookies should
+    // FIXME: m_allowCookies and m_firstPartyForCookies should
     // probably be handled here and on doUpdatePlatformRequest
     // somehow.
 }
 
+unsigned initializeMaximumHTTPConnectionCountPerHost()
+{
+    // Soup has its own queue control; it wants to have all requests
+    // given to it, so that it is able to look ahead, and schedule
+    // them in a good way.
+    return 10000;
+}
+
 }
diff --git a/WebCore/platform/network/soup/ResourceResponse.h b/WebCore/platform/network/soup/ResourceResponse.h
index b8cb586..5fa31a0 100644
--- a/WebCore/platform/network/soup/ResourceResponse.h
+++ b/WebCore/platform/network/soup/ResourceResponse.h
@@ -28,6 +28,8 @@
 
 #include "ResourceResponseBase.h"
 
+#include <libsoup/soup.h>
+
 namespace WebCore {
 
 class ResourceResponse : public ResourceResponseBase {
@@ -42,6 +44,8 @@ public:
     {
     }
 
+    SoupMessage* toSoupMessage() const;
+
 private:
     friend class ResourceResponseBase;
 
diff --git a/WebCore/platform/network/soup/ResourceResponseSoup.cpp b/WebCore/platform/network/soup/ResourceResponseSoup.cpp
new file mode 100644
index 0000000..293577f
--- /dev/null
+++ b/WebCore/platform/network/soup/ResourceResponseSoup.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Gustavo Noronha Silva
+ * Copyright (C) 2009 Collabora Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "ResourceResponse.h"
+
+#include "CString.h"
+#include "PlatformString.h"
+
+using namespace std;
+
+namespace WebCore {
+
+SoupMessage* ResourceResponse::toSoupMessage() const
+{
+    // This GET here is just because SoupMessage wants it, we dn't really know.
+    SoupMessage* soupMessage = soup_message_new("GET", url().string().utf8().data());
+    if (!soupMessage)
+        return 0;
+
+    soupMessage->status_code = httpStatusCode();
+
+    HTTPHeaderMap headers = httpHeaderFields();
+    SoupMessageHeaders* soupHeaders = soupMessage->response_headers;
+    if (!headers.isEmpty()) {
+        HTTPHeaderMap::const_iterator end = headers.end();
+        for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it)
+            soup_message_headers_append(soupHeaders, it->first.string().utf8().data(), it->second.utf8().data());
+    }
+
+    // Body data is not in the message.
+    return soupMessage;
+}
+
+}
diff --git a/WebCore/platform/network/soup/SocketStreamError.h b/WebCore/platform/network/soup/SocketStreamError.h
new file mode 100644
index 0000000..f9641ad
--- /dev/null
+++ b/WebCore/platform/network/soup/SocketStreamError.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamError_h
+#define SocketStreamError_h
+
+#include "SocketStreamErrorBase.h"
+
+namespace WebCore {
+
+    class SocketStreamError : public SocketStreamErrorBase {
+    public:
+        SocketStreamError() { }
+        explicit SocketStreamError(int errorCode)
+            : SocketStreamErrorBase(errorCode)
+        {
+        }
+
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamError_h
diff --git a/WebCore/platform/network/soup/SocketStreamHandle.h b/WebCore/platform/network/soup/SocketStreamHandle.h
new file mode 100644
index 0000000..64139e5
--- /dev/null
+++ b/WebCore/platform/network/soup/SocketStreamHandle.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandle_h
+#define SocketStreamHandle_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class Credential;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    public:
+        static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
+
+        virtual ~SocketStreamHandle();
+
+    protected:
+        virtual int platformSend(const char* data, int length);
+        virtual void platformClose();
+
+    private:
+        SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+
+        // No authentication for streams per se, but proxy may ask for credentials.
+        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
+        void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        void receivedCancellation(const AuthenticationChallenge&);
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandle_h
diff --git a/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp b/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
new file mode 100644
index 0000000..6aa33fc
--- /dev/null
+++ b/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandle.h"
+
+#include "KURL.h"
+#include "Logging.h"
+#include "NotImplemented.h"
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
+    : SocketStreamHandleBase(url, client)
+{
+    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
+    notImplemented();
+}
+
+SocketStreamHandle::~SocketStreamHandle()
+{
+    LOG(Network, "SocketStreamHandle %p delete", this);
+    setClient(0);
+    notImplemented();
+}
+
+int SocketStreamHandle::platformSend(const char*, int)
+{
+    LOG(Network, "SocketStreamHandle %p platformSend", this);
+    notImplemented();
+    return 0;
+}
+
+void SocketStreamHandle::platformClose()
+{
+    LOG(Network, "SocketStreamHandle %p platformClose", this);
+    notImplemented();
+}
+
+void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/platform/network/win/CookieJarCFNetWin.cpp b/WebCore/platform/network/win/CookieJarCFNetWin.cpp
index af9e3f3..33b795a 100644
--- a/WebCore/platform/network/win/CookieJarCFNetWin.cpp
+++ b/WebCore/platform/network/win/CookieJarCFNetWin.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "CookieStorageWin.h"
 #include "Document.h"
 #include "KURL.h"
@@ -113,4 +114,60 @@ bool cookiesEnabled(const Document* /*document*/)
     return policy == CFHTTPCookieStorageAcceptPolicyOnlyFromMainDocumentDomain || policy == CFHTTPCookieStorageAcceptPolicyAlways;
 }
 
+bool getRawCookies(const Document*, const KURL& url, Vector<Cookie>& rawCookies)
+{
+    rawCookies.clear();
+    CFHTTPCookieStorageRef cookieStorage = currentCookieStorage();
+    if (!cookieStorage)
+        return false;
+
+    RetainPtr<CFURLRef> urlCF(AdoptCF, url.createCFURL());
+
+    bool sendSecureCookies = url.protocolIs("https");
+    RetainPtr<CFArrayRef> cookiesCF(AdoptCF, CFHTTPCookieStorageCopyCookiesForURL(cookieStorage, urlCF.get(), sendSecureCookies));
+
+    CFIndex count = CFArrayGetCount(cookiesCF.get());
+    rawCookies.reserveCapacity(count);
+
+    for (CFIndex i = 0; i < count; i++) {
+       CFHTTPCookieRef cookie = (CFHTTPCookieRef)CFArrayGetValueAtIndex(cookiesCF.get(), i);
+       String name = CFHTTPCookieGetName(cookie);
+       String value = CFHTTPCookieGetValue(cookie);
+       String domain = CFHTTPCookieGetDomain(cookie);
+       String path = CFHTTPCookieGetPath(cookie);
+
+       double expires = (CFDateGetAbsoluteTime(CFHTTPCookieGetExpiratonDate(cookie)) + kCFAbsoluteTimeIntervalSince1970) * 1000;
+
+       bool httpOnly = CFHTTPCookieIsHTTPOnly(cookie);
+       bool secure = CFHTTPCookieIsSecure(cookie);
+       bool session = false;    // FIXME: Need API for if a cookie is a session cookie.
+
+       rawCookies.uncheckedAppend(Cookie(name, value, domain, path, expires, httpOnly, secure, session));
+    }
+
+    return true;
+}
+
+void deleteCookie(const Document*, const KURL& url, const String& name)
+{
+    CFHTTPCookieStorageRef cookieStorage = currentCookieStorage();
+    if (!cookieStorage)
+        return;
+
+    RetainPtr<CFURLRef> urlCF(AdoptCF, url.createCFURL());
+
+    bool sendSecureCookies = url.protocolIs("https");
+    RetainPtr<CFArrayRef> cookiesCF(AdoptCF, CFHTTPCookieStorageCopyCookiesForURL(cookieStorage, urlCF.get(), sendSecureCookies));
+
+    CFIndex count = CFArrayGetCount(cookiesCF.get());
+    for (CFIndex i = 0; i < count; i++) {
+        CFHTTPCookieRef cookie = (CFHTTPCookieRef)CFArrayGetValueAtIndex(cookiesCF.get(), i);
+        String cookieName = CFHTTPCookieGetName(cookie);
+        if (cookieName == name) {
+            CFHTTPCookieStorageDeleteCookie(cookieStorage, cookie);
+            break;
+        }
+    }
+}
+
 }
diff --git a/WebCore/platform/network/win/CookieJarWin.cpp b/WebCore/platform/network/win/CookieJarWin.cpp
index 41d12d9..6576e07 100644
--- a/WebCore/platform/network/win/CookieJarWin.cpp
+++ b/WebCore/platform/network/win/CookieJarWin.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "Document.h"
@@ -35,7 +36,6 @@
 
 namespace WebCore {
 
-
 void setCookies(Document* /*document*/, const KURL& url, const String& value)
 {
     // FIXME: Deal with document->firstPartyForCookies().
@@ -64,4 +64,16 @@ bool cookiesEnabled(const Document* /*document*/)
     return true;
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 }
diff --git a/WebCore/platform/qt/ClipboardQt.cpp b/WebCore/platform/qt/ClipboardQt.cpp
index 666ad18..9d2c452 100644
--- a/WebCore/platform/qt/ClipboardQt.cpp
+++ b/WebCore/platform/qt/ClipboardQt.cpp
@@ -239,8 +239,6 @@ static CachedImage* getCachedImage(Element* element)
 void ClipboardQt::declareAndWriteDragImage(Element* element, const KURL& url, const String& title, Frame* frame)
 {
     ASSERT(frame);
-    Q_UNUSED(url);
-    Q_UNUSED(title);
 
     //WebCore::writeURL(m_writableDataObject.get(), url, title, true, false);
     if (!m_writableData)
@@ -262,8 +260,10 @@ void ClipboardQt::declareAndWriteDragImage(Element* element, const KURL& url, co
         return;
 
     QList<QUrl> urls;
+    urls.append(url);
     urls.append(fullURL);
 
+    m_writableData->setText(title);
     m_writableData->setUrls(urls);
 #ifndef QT_NO_CLIPBOARD
     if (!isForDragging())
diff --git a/WebCore/platform/qt/ContextMenuQt.cpp b/WebCore/platform/qt/ContextMenuQt.cpp
index 063a46b..9b1a054 100644
--- a/WebCore/platform/qt/ContextMenuQt.cpp
+++ b/WebCore/platform/qt/ContextMenuQt.cpp
@@ -61,7 +61,7 @@ void ContextMenu::insertItem(unsigned position, ContextMenuItem& item)
     m_items.insert(position, item);
 }
 
-void ContextMenu::setPlatformDescription(PlatformMenuDescription menu)
+void ContextMenu::setPlatformDescription(PlatformMenuDescription)
 {
     // doesn't make sense
 }
diff --git a/WebCore/platform/qt/CookieJarQt.cpp b/WebCore/platform/qt/CookieJarQt.cpp
index 40d9309..a27a06e 100644
--- a/WebCore/platform/qt/CookieJarQt.cpp
+++ b/WebCore/platform/qt/CookieJarQt.cpp
@@ -28,6 +28,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "Document.h"
 #include "KURL.h"
 #include "PlatformString.h"
@@ -47,6 +48,8 @@ namespace WebCore {
 #if QT_VERSION >= 0x040400
 static QNetworkCookieJar *cookieJar(const Document *document)
 {
+    if (!document)
+        return 0;
     Frame *frame = document->frame();
     if (!frame)
         return 0;
@@ -128,6 +131,18 @@ bool cookiesEnabled(const Document* document)
 #endif
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/DragDataQt.cpp b/WebCore/platform/qt/DragDataQt.cpp
index 7b1eff8..b0611e6 100644
--- a/WebCore/platform/qt/DragDataQt.cpp
+++ b/WebCore/platform/qt/DragDataQt.cpp
@@ -119,7 +119,7 @@ bool DragData::containsURL() const
     return m_platformDragData->hasUrls();
 }
 
-String DragData::asURL(String* title) const
+String DragData::asURL(String*) const
 {
     if (!m_platformDragData)
         return String();
@@ -128,7 +128,7 @@ String DragData::asURL(String* title) const
     if (urls.isEmpty())
         return String();
 
-    return urls.first().toString();
+    return encodeWithURLEscapeSequences(urls.first().toString());
 }
 
 PassRefPtr<DocumentFragment> DragData::asFragment(Document* doc) const
diff --git a/WebCore/platform/qt/FileSystemQt.cpp b/WebCore/platform/qt/FileSystemQt.cpp
index 28d3ca7..4093fad 100644
--- a/WebCore/platform/qt/FileSystemQt.cpp
+++ b/WebCore/platform/qt/FileSystemQt.cpp
@@ -81,7 +81,7 @@ bool makeAllDirectories(const String& path)
 
 String pathByAppendingComponent(const String& path, const String& component)
 {
-    return QDir(path).filePath(component);
+    return QDir::toNativeSeparators(QDir(path).filePath(component));
 }
 
 String homeDirectoryPath()
@@ -117,7 +117,9 @@ Vector<String> listDirectory(const String& path, const String& filter)
 
 CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
 {
-    QFile *temp = new QTemporaryFile(QLatin1String(prefix));
+    QTemporaryFile* tempFile = new QTemporaryFile(QLatin1String(prefix));
+    tempFile->setAutoRemove(false);
+    QFile* temp = tempFile;
     if (temp->open(QIODevice::ReadWrite)) {
         handle = temp;
         return String(temp->fileName()).utf8();
diff --git a/WebCore/platform/qt/Localizations.cpp b/WebCore/platform/qt/Localizations.cpp
index d1853fc..77cac57 100644
--- a/WebCore/platform/qt/Localizations.cpp
+++ b/WebCore/platform/qt/Localizations.cpp
@@ -362,5 +362,111 @@ String mediaElementLiveBroadcastStateText()
     return QCoreApplication::translate("QWebPage", "Live Broadcast", "Media controller status message when watching a live broadcast");
 }
 
+#if ENABLE(VIDEO)
+
+String localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return QCoreApplication::translate("QWebPage", "Audio Element", "Media controller element");
+    if (name == "VideoElement")
+        return QCoreApplication::translate("QWebPage", "Video Element", "Media controller element");
+    if (name == "MuteButton")
+        return QCoreApplication::translate("QWebPage", "Mute Button", "Media controller element");
+    if (name == "UnMuteButton")
+        return QCoreApplication::translate("QWebPage", "Unmute Button", "Media controller element");
+    if (name == "PlayButton")
+        return QCoreApplication::translate("QWebPage", "Play Button", "Media controller element");
+    if (name == "PauseButton")
+        return QCoreApplication::translate("QWebPage", "Pause Button", "Media controller element");
+    if (name == "Slider")
+        return QCoreApplication::translate("QWebPage", "Slider", "Media controller element");
+    if (name == "SliderThumb")
+        return QCoreApplication::translate("QWebPage", "Slider Thumb", "Media controller element");
+    if (name == "RewindButton")
+        return QCoreApplication::translate("QWebPage", "Rewind Button", "Media controller element");
+    if (name == "ReturnToRealtimeButton")
+        return QCoreApplication::translate("QWebPage", "Return to Real-time Button", "Media controller element");
+    if (name == "CurrentTimeDisplay")
+        return QCoreApplication::translate("QWebPage", "Elapsed Time", "Media controller element");
+    if (name == "TimeRemainingDisplay")
+        return QCoreApplication::translate("QWebPage", "Remaining Time", "Media controller element");
+    if (name == "StatusDisplay")
+        return QCoreApplication::translate("QWebPage", "Status Display", "Media controller element");
+    if (name == "FullscreenButton")
+        return QCoreApplication::translate("QWebPage", "Fullscreen Button", "Media controller element");
+    if (name == "SeekForwardButton")
+        return QCoreApplication::translate("QWebPage", "Seek Forward Button", "Media controller element");
+    if (name == "SeekBackButton")
+        return QCoreApplication::translate("QWebPage", "Seek Back Button", "Media controller element");
+
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return QCoreApplication::translate("QWebPage", "Audio element playback controls and status display", "Media controller element");
+    if (name == "VideoElement")
+        return QCoreApplication::translate("QWebPage", "Video element playback controls and status display", "Media controller element");
+    if (name == "MuteButton")
+        return QCoreApplication::translate("QWebPage", "Mute audio tracks", "Media controller element");
+    if (name == "UnMuteButton")
+        return QCoreApplication::translate("QWebPage", "Unmute audio tracks", "Media controller element");
+    if (name == "PlayButton")
+        return QCoreApplication::translate("QWebPage", "Begin playback", "Media controller element");
+    if (name == "PauseButton")
+        return QCoreApplication::translate("QWebPage", "Pause playback", "Media controller element");
+    if (name == "Slider")
+        return QCoreApplication::translate("QWebPage", "Movie time scrubber", "Media controller element");
+    if (name == "SliderThumb")
+        return QCoreApplication::translate("QWebPage", "Movie time scrubber thumb", "Media controller element");
+    if (name == "RewindButton")
+        return QCoreApplication::translate("QWebPage", "Rewind movie", "Media controller element");
+    if (name == "ReturnToRealtimeButton")
+        return QCoreApplication::translate("QWebPage", "Return streaming movie to real-time", "Media controller element");
+    if (name == "CurrentTimeDisplay")
+        return QCoreApplication::translate("QWebPage", "Current movie time", "Media controller element");
+    if (name == "TimeRemainingDisplay")
+        return QCoreApplication::translate("QWebPage", "Remaining movie time", "Media controller element");
+    if (name == "StatusDisplay")
+        return QCoreApplication::translate("QWebPage", "Current movie status", "Media controller element");
+    if (name == "FullscreenButton")
+        return QCoreApplication::translate("QWebPage", "Play movie in full-screen mode", "Media controller element");
+    if (name == "SeekForwardButton")
+        return QCoreApplication::translate("QWebPage", "Seek quickly back", "Media controller element");
+    if (name == "SeekBackButton")
+        return QCoreApplication::translate("QWebPage", "Seek quickly forward", "Media controller element");
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    if (!isfinite(time))
+        return QCoreApplication::translate("QWebPage", "Indefinite time", "Media time description");
+
+    int seconds = (int)fabsf(time);
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days) {
+        return QCoreApplication::translate("QWebPage", "%1 days %2 hours %3 minutes %4 seconds", "Media time description").arg(days).arg(hours).arg(minutes).arg(seconds);
+    }
+
+    if (hours) {
+        return QCoreApplication::translate("QWebPage", "%1 hours %2 minutes %3 seconds", "Media time description").arg(hours).arg(minutes).arg(seconds);
+    }
+
+    if (minutes) {
+        return QCoreApplication::translate("QWebPage", "%1 minutes %2 seconds", "Media time description").arg(minutes).arg(seconds);
+    }
+
+    return QCoreApplication::translate("QWebPage", "%1 seconds", "Media time description").arg(seconds);
+}
+#endif  // ENABLE(VIDEO)
+
 }
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/PasteboardQt.cpp b/WebCore/platform/qt/PasteboardQt.cpp
index 969de62..209a573 100644
--- a/WebCore/platform/qt/PasteboardQt.cpp
+++ b/WebCore/platform/qt/PasteboardQt.cpp
@@ -119,6 +119,18 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
     return 0;
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+#ifndef QT_NO_CLIPBOARD
+    QMimeData* md = new QMimeData;
+    QString qtext = text;
+    qtext.replace(QChar(0xa0), QLatin1Char(' '));
+    md->setText(qtext);
+    QApplication::clipboard()->setMimeData(md, m_selectionMode ?
+            QClipboard::Selection : QClipboard::Clipboard);
+#endif
+}
+
 void Pasteboard::writeURL(const KURL& _url, const String&, Frame*)
 {
     ASSERT(!_url.isEmpty());
diff --git a/WebCore/platform/qt/PlatformKeyboardEventQt.cpp b/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
index 935882a..37ea681 100644
--- a/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
+++ b/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
@@ -217,7 +217,7 @@ static int windowsKeyCodeForKeyEvent(unsigned int keycode, bool isKeypad = false
         case Qt::Key_F9:
             return VK_F9;
         case Qt::Key_F10:
-            return VK_F11;
+            return VK_F10;
         case Qt::Key_F11:
             return VK_F11;
         case Qt::Key_F12:
diff --git a/WebCore/platform/qt/PlatformMouseEventQt.cpp b/WebCore/platform/qt/PlatformMouseEventQt.cpp
index 6c1d82d..e486e68 100644
--- a/WebCore/platform/qt/PlatformMouseEventQt.cpp
+++ b/WebCore/platform/qt/PlatformMouseEventQt.cpp
@@ -31,9 +31,46 @@
 #include <wtf/CurrentTime.h>
 
 #include <QMouseEvent>
+#include <QGraphicsSceneMouseEvent>
 
 namespace WebCore {
 
+PlatformMouseEvent::PlatformMouseEvent(QGraphicsSceneMouseEvent* event, int clickCount)
+{
+    m_timestamp = WTF::currentTime();
+
+    switch (event->type()) {
+    case QEvent::GraphicsSceneMouseDoubleClick:
+    case QEvent::GraphicsSceneMousePress:
+        m_eventType = MouseEventPressed;
+        break;
+    case QEvent::GraphicsSceneMouseRelease:
+        m_eventType = MouseEventReleased;
+        break;
+    case QEvent::GraphicsSceneMouseMove:
+    default:
+        m_eventType = MouseEventMoved;
+    }
+
+    m_position = IntPoint(event->pos().toPoint());
+    m_globalPosition = IntPoint(event->screenPos());
+
+    if (event->button() == Qt::LeftButton || (event->buttons() & Qt::LeftButton))
+        m_button = LeftButton;
+    else if (event->button() == Qt::RightButton || (event->buttons() & Qt::RightButton))
+        m_button = RightButton;
+    else if (event->button() == Qt::MidButton || (event->buttons() & Qt::MidButton))
+        m_button = MiddleButton;
+    else
+        m_button = NoButton;
+
+    m_clickCount = clickCount;
+    m_shiftKey =  (event->modifiers() & Qt::ShiftModifier) != 0;
+    m_ctrlKey = (event->modifiers() & Qt::ControlModifier) != 0;
+    m_altKey =  (event->modifiers() & Qt::AltModifier) != 0;
+    m_metaKey = (event->modifiers() & Qt::MetaModifier) != 0;
+}
+
 PlatformMouseEvent::PlatformMouseEvent(QInputEvent* event, int clickCount)
 {
     m_timestamp = WTF::currentTime();
diff --git a/WebCore/platform/qt/PlatformScreenQt.cpp b/WebCore/platform/qt/PlatformScreenQt.cpp
index 5dc0963..7ba8350 100644
--- a/WebCore/platform/qt/PlatformScreenQt.cpp
+++ b/WebCore/platform/qt/PlatformScreenQt.cpp
@@ -36,42 +36,54 @@
 #include "FrameView.h"
 #include "HostWindow.h"
 #include "Widget.h"
+#include "QWebPageClient.h"
 #include <QApplication>
 #include <QDesktopWidget>
 
 namespace WebCore {
 
+static int screenNumber(Widget* w)
+{
+    if (!w)
+        return 0;
+
+    QWebPageClient* client = w->root()->hostWindow()->platformPageClient();
+    return client ? client->screenNumber() : 0;
+}
+
 int screenDepth(Widget* w)
 {
-    QDesktopWidget* d = QApplication::desktop();
-    QWidget *view = w ? w->root()->hostWindow()->platformWindow() : 0;
-    int screenNumber = view ? d->screenNumber(view) : 0;
-    return d->screen(screenNumber)->depth();
+    return QApplication::desktop()->screen(screenNumber(w))->depth();
 }
 
 int screenDepthPerComponent(Widget* w)
 {
-    QWidget *view = w ? w->root()->hostWindow()->platformWindow() : 0;
-    return view ? view->depth() : QApplication::desktop()->screen(0)->depth();
+    if (w) {
+        QWebPageClient* client = w->root()->hostWindow()->platformPageClient();
+
+        if (client) {
+            QWidget* view = QWidget::find(client->winId());
+            if (view)
+                return view->depth();
+        }
+    }
+    return QApplication::desktop()->screen(0)->depth();
 }
 
 bool screenIsMonochrome(Widget* w)
 {
-    QDesktopWidget* d = QApplication::desktop();
-    QWidget *view = w ? w->root()->hostWindow()->platformWindow(): 0;
-    int screenNumber = view ? d->screenNumber(view) : 0;
-    return d->screen(screenNumber)->numColors() < 2;
+    return QApplication::desktop()->screen(screenNumber(w))->numColors() < 2;
 }
 
 FloatRect screenRect(Widget* w)
 {
-    QRect r = QApplication::desktop()->screenGeometry(w ? w->root()->hostWindow()->platformWindow(): 0);
+    QRect r = QApplication::desktop()->screenGeometry(screenNumber(w));
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
 FloatRect screenAvailableRect(Widget* w)
 {
-    QRect r = QApplication::desktop()->availableGeometry(w ? w->root()->hostWindow()->platformWindow(): 0);
+    QRect r = QApplication::desktop()->availableGeometry(screenNumber(w));
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
diff --git a/WebCore/platform/qt/PopupMenuQt.cpp b/WebCore/platform/qt/PopupMenuQt.cpp
index 11dfe41..b44f2ec 100644
--- a/WebCore/platform/qt/PopupMenuQt.cpp
+++ b/WebCore/platform/qt/PopupMenuQt.cpp
@@ -30,6 +30,7 @@
 #include "FrameView.h"
 #include "HostWindow.h"
 #include "PopupMenuClient.h"
+#include "QWebPageClient.h"
 #include "QWebPopup.h"
 
 #include <QAction>
@@ -59,7 +60,7 @@ void PopupMenu::clear()
     m_popup->clear();
 }
 
-void PopupMenu::populate(const IntRect& r)
+void PopupMenu::populate(const IntRect&)
 {
     clear();
     Q_ASSERT(client());
@@ -85,13 +86,13 @@ void PopupMenu::populate(const IntRect& r)
 
 void PopupMenu::show(const IntRect& r, FrameView* v, int index)
 {
-    QWidget* window = v->hostWindow()->platformWindow();
+    QWebPageClient* client = v->hostWindow()->platformPageClient();
     populate(r);
     QRect rect = r;
     rect.moveTopLeft(v->contentsToWindow(r.topLeft()));
     rect.setHeight(m_popup->sizeHint().height());
 
-    m_popup->setParent(window);
+    m_popup->setParent(QWidget::find(client->winId()));
     m_popup->setGeometry(rect);
     m_popup->setCurrentIndex(index);
     m_popup->exec();
diff --git a/WebCore/platform/qt/QWebPageClient.h b/WebCore/platform/qt/QWebPageClient.h
new file mode 100644
index 0000000..09f7886
--- /dev/null
+++ b/WebCore/platform/qt/QWebPageClient.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef QWebPageClient_h
+#define QWebPageClient_h
+
+#include <QRect>
+
+class QWebPageClient {
+public:
+    virtual void scroll(int dx, int dy, const QRect&) = 0;
+    virtual void update(const QRect&) = 0;
+
+    inline void resetCursor()
+    {
+#ifndef QT_NO_CURSOR
+        if (!cursor().bitmap() && cursor().shape() == m_lastCursor.shape())
+            return;
+        updateCursor(m_lastCursor);
+#endif
+    }
+
+    inline void setCursor(const QCursor& cursor)
+    {
+#ifndef QT_NO_CURSOR
+        m_lastCursor = cursor;
+        if (!cursor.bitmap() && cursor.shape() == this->cursor().shape())
+            return;
+        updateCursor(cursor);
+#endif
+    }
+
+    virtual int screenNumber() const = 0;
+    virtual WId winId() const = 0;
+
+    virtual QObject* pluginParent() const = 0;
+
+protected:
+#ifndef QT_NO_CURSOR
+    virtual QCursor cursor() const = 0;
+    virtual void updateCursor(const QCursor& cursor) = 0;
+#endif
+
+private:
+#ifndef QT_NO_CURSOR
+    QCursor m_lastCursor;
+#endif
+};
+
+#endif
diff --git a/WebCore/platform/qt/QWebPopup.cpp b/WebCore/platform/qt/QWebPopup.cpp
index f437c27..d077079 100644
--- a/WebCore/platform/qt/QWebPopup.cpp
+++ b/WebCore/platform/qt/QWebPopup.cpp
@@ -71,7 +71,7 @@ void QWebPopup::hidePopup()
         return;
 
     m_popupVisible = false;
-    m_client->hidePopup();
+    m_client->popupDidHide();
 }
 
 void QWebPopup::activeChanged(int index)
diff --git a/WebCore/platform/qt/RenderThemeQt.cpp b/WebCore/platform/qt/RenderThemeQt.cpp
index 3fe67b2..b61d356 100644
--- a/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/WebCore/platform/qt/RenderThemeQt.cpp
@@ -44,6 +44,7 @@
 #include "Page.h"
 #include "RenderBox.h"
 #include "RenderTheme.h"
+#include "UserAgentStyleSheets.h"
 #include "qwebpage.h"
 
 #include <QApplication>
@@ -172,7 +173,7 @@ bool RenderThemeQt::supportsHover(const RenderStyle*) const
     return true;
 }
 
-bool RenderThemeQt::supportsFocusRing(const RenderStyle* style) const
+bool RenderThemeQt::supportsFocusRing(const RenderStyle*) const
 {
     return true; // Qt provides this through the style
 }
@@ -274,7 +275,7 @@ Color RenderThemeQt::platformInactiveSelectionForegroundColor() const
     return pal.brush(QPalette::Inactive, QPalette::HighlightedText).color();
 }
 
-void RenderThemeQt::systemFont(int propId, FontDescription& fontDescription) const
+void RenderThemeQt::systemFont(int, FontDescription&) const
 {
     // no-op
 }
@@ -387,7 +388,7 @@ bool RenderThemeQt::paintRadio(RenderObject* o, const RenderObject::PaintInfo& i
     return paintButton(o, i, r);
 }
 
-void RenderThemeQt::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeQt::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element*) const
 {
     // Ditch the border.
     style->resetBorder();
@@ -572,7 +573,7 @@ bool RenderThemeQt::paintMenuList(RenderObject* o, const RenderObject::PaintInfo
     QStyleOptionComboBox opt;
     if (p.widget)
         opt.initFrom(p.widget);
-    ControlPart appearance = applyTheme(opt, o);
+    applyTheme(opt, o);
 
     const QPoint topLeft = r.topLeft();
     p.painter->translate(topLeft);
@@ -584,8 +585,7 @@ bool RenderThemeQt::paintMenuList(RenderObject* o, const RenderObject::PaintInfo
     return false;
 }
 
-void RenderThemeQt::adjustMenuListButtonStyle(CSSStyleSelector* selector, RenderStyle* style,
-                                              Element* e) const
+void RenderThemeQt::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     // WORKAROUND because html.css specifies -webkit-border-radius for <select> so we override it here
     // see also http://bugs.webkit.org/show_bug.cgi?id=18399
@@ -772,13 +772,7 @@ ControlPart RenderThemeQt::applyTheme(QStyleOption& option, RenderObject* o) con
 
 String RenderThemeQt::extraMediaControlsStyleSheet()
 {
-    QFile platformStyleSheet(QLatin1String(":/webcore/css/mediaControls-extras.css"));
-    if (platformStyleSheet.open(QFile::ReadOnly)) {
-        QByteArray sheetData = platformStyleSheet.readAll();
-        return QString::fromUtf8(sheetData.constData(), sheetData.length());
-    }
-
-    return String();
+    return String(mediaControlsQtUserAgentStyleSheet, sizeof(mediaControlsQtUserAgentStyleSheet));
 }
 
 // Helper class to transform the painter's world matrix to the object's content area, scaled to 0,0,100,100
@@ -887,13 +881,13 @@ bool RenderThemeQt::paintMediaPlayButton(RenderObject* o, const RenderObject::Pa
     return false;
 }
 
-bool RenderThemeQt::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeQt::paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
 {
     // We don't want to paint this at the moment.
     return false;
 }
 
-bool RenderThemeQt::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeQt::paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
 {
     // We don't want to paint this at the moment.
     return false;
diff --git a/WebCore/platform/qt/ScrollViewQt.cpp b/WebCore/platform/qt/ScrollViewQt.cpp
index 48885d3..ccbd751 100644
--- a/WebCore/platform/qt/ScrollViewQt.cpp
+++ b/WebCore/platform/qt/ScrollViewQt.cpp
@@ -53,7 +53,7 @@ void ScrollView::adjustWidgetsPreventingBlittingCount(int delta)
         parent()->adjustWidgetsPreventingBlittingCount(delta);
 }
 
-void ScrollView::platformAddChild(Widget* child)
+void ScrollView::platformAddChild(Widget*)
 {
     adjustWidgetsPreventingBlittingCount(1);
 }
diff --git a/WebCore/platform/qt/SearchPopupMenuQt.cpp b/WebCore/platform/qt/SearchPopupMenuQt.cpp
index 7822b2c..187a5de 100644
--- a/WebCore/platform/qt/SearchPopupMenuQt.cpp
+++ b/WebCore/platform/qt/SearchPopupMenuQt.cpp
@@ -29,11 +29,11 @@ SearchPopupMenu::SearchPopupMenu(PopupMenuClient* client)
 {
 }
 
-void SearchPopupMenu::saveRecentSearches(const AtomicString& name, const Vector<String>& searchItems)
+void SearchPopupMenu::saveRecentSearches(const AtomicString&, const Vector<String>&)
 {
 }
 
-void SearchPopupMenu::loadRecentSearches(const AtomicString& name, Vector<String>& searchItems)
+void SearchPopupMenu::loadRecentSearches(const AtomicString&, Vector<String>&)
 {
 }
 
diff --git a/WebCore/platform/qt/TemporaryLinkStubs.cpp b/WebCore/platform/qt/TemporaryLinkStubs.cpp
index 8ef598f..814f961 100644
--- a/WebCore/platform/qt/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/qt/TemporaryLinkStubs.cpp
@@ -100,7 +100,7 @@ void getSupportedKeySizes(Vector<String>&)
     notImplemented();
 }
 
-String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String &challengeString, const KURL &url)
+String signedPublicKeyAndChallengeString(unsigned, const String&, const KURL&)
 {
     return String();
 }
@@ -114,11 +114,6 @@ float userIdleTime()
 }
 #endif
 
-void prefetchDNS(const String& hostname)
-{
-    notImplemented();
-}
-
 }
 
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/WheelEventQt.cpp b/WebCore/platform/qt/WheelEventQt.cpp
index 9534f20..66118e1 100644
--- a/WebCore/platform/qt/WheelEventQt.cpp
+++ b/WebCore/platform/qt/WheelEventQt.cpp
@@ -25,9 +25,48 @@
 
 #include <qapplication.h>
 #include <QWheelEvent>
+#include <QGraphicsSceneWheelEvent>
 
 namespace WebCore {
 
+void PlatformWheelEvent::applyDelta(int delta, Qt::Orientation orientation)
+{
+    if (orientation == Qt::Horizontal) {
+        m_deltaX = (delta / 120);
+        m_deltaY = 0;
+    } else {
+        m_deltaX = 0;
+        m_deltaY = (delta / 120);
+    }
+
+    m_wheelTicksX = m_deltaX;
+    m_wheelTicksY = m_deltaY;
+
+    // Use the same single scroll step as QTextEdit
+    // (in QTextEditPrivate::init [h,v]bar->setSingleStep)
+    static const float cDefaultQtScrollStep = 20.f;
+    m_deltaX *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+    m_deltaY *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+}
+
+PlatformWheelEvent::PlatformWheelEvent(QGraphicsSceneWheelEvent* e)
+#ifdef QT_NO_WHEELEVENT
+{
+    Q_UNUSED(e);
+}
+#else
+    : m_position(e->pos().toPoint())
+    , m_globalPosition(e->screenPos())
+    , m_granularity(ScrollByPixelWheelEvent)
+    , m_isAccepted(false)
+    , m_shiftKey(e->modifiers() & Qt::ShiftModifier)
+    , m_ctrlKey(e->modifiers() & Qt::ControlModifier)
+    , m_altKey(e->modifiers() & Qt::AltModifier)
+    , m_metaKey(e->modifiers() & Qt::MetaModifier)
+{
+    applyDelta(e->delta(), e->orientation());
+}
+#endif // QT_NO_WHEELEVENT
 
 PlatformWheelEvent::PlatformWheelEvent(QWheelEvent* e)
 #ifdef QT_NO_WHEELEVENT
@@ -44,21 +83,7 @@ PlatformWheelEvent::PlatformWheelEvent(QWheelEvent* e)
     , m_altKey(e->modifiers() & Qt::AltModifier)
     , m_metaKey(e->modifiers() & Qt::MetaModifier)
 {
-    if (e->orientation() == Qt::Horizontal) {
-        m_deltaX = (e->delta() / 120);
-        m_deltaY = 0;
-    } else {
-        m_deltaX = 0;
-        m_deltaY = (e->delta() / 120);
-    }
-    m_wheelTicksX = m_deltaX;
-    m_wheelTicksY = m_deltaY;
-
-    // use the same single scroll step as QTextEdit (in
-    // QTextEditPrivate::init [h,v]bar->setSingleStep )
-    static const float cDefaultQtScrollStep = 20.f;
-    m_deltaX *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
-    m_deltaY *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+    applyDelta(e->delta(), e->orientation());
 }
 #endif // QT_NO_WHEELEVENT
 
diff --git a/WebCore/platform/qt/WidgetQt.cpp b/WebCore/platform/qt/WidgetQt.cpp
index 0fb6c37..e9c99a4 100644
--- a/WebCore/platform/qt/WidgetQt.cpp
+++ b/WebCore/platform/qt/WidgetQt.cpp
@@ -30,6 +30,7 @@
  */
 
 #include "config.h"
+#include "Widget.h"
 
 #include "Cursor.h"
 #include "Font.h"
@@ -37,8 +38,8 @@
 #include "HostWindow.h"
 #include "IntRect.h"
 #include "ScrollView.h"
-#include "Widget.h"
 #include "NotImplemented.h"
+#include "QWebPageClient.h"
 
 #include "qwebframe.h"
 #include "qwebframe_p.h"
@@ -81,15 +82,10 @@ void Widget::setFocus()
 void Widget::setCursor(const Cursor& cursor)
 {
 #ifndef QT_NO_CURSOR
-    QWidget* widget = root()->hostWindow()->platformWindow();
-
-    if (!widget)
-        return;
-
-    if (!cursor.impl().bitmap() && widget->cursor().shape() == cursor.impl().shape())
-        return;
+    QWebPageClient* pageClient = root()->hostWindow()->platformPageClient();
 
-    QCoreApplication::postEvent(widget, new SetCursorEvent(cursor.impl()));
+    if (pageClient)
+        pageClient->setCursor(cursor.impl());
 #endif
 }
 
@@ -105,7 +101,7 @@ void Widget::hide()
         platformWidget()->hide();
 }
 
-void Widget::paint(GraphicsContext *, const IntRect &rect)
+void Widget::paint(GraphicsContext*, const IntRect&)
 {
 }
 
diff --git a/WebCore/platform/sql/SQLValue.cpp b/WebCore/platform/sql/SQLValue.cpp
index 7e178f9..0ad643e 100644
--- a/WebCore/platform/sql/SQLValue.cpp
+++ b/WebCore/platform/sql/SQLValue.cpp
@@ -32,10 +32,10 @@
 namespace WebCore {
 
 SQLValue::SQLValue(const SQLValue& val)
+    : m_type(val.m_type)
+    , m_number(val.m_number)
+    , m_string(val.m_string.threadsafeCopy())
 {
-    m_number = val.m_number;
-    m_string = val.m_string.copy();
-    m_type = val.m_type;
 }
 
 String SQLValue::string() const
@@ -43,7 +43,7 @@ String SQLValue::string() const
     ASSERT(m_type == StringValue);
 
     // Must return a copy since ref-shared Strings are not thread safe
-    return m_string.copy();
+    return m_string.threadsafeCopy();
 }
 
 double SQLValue::number() const
diff --git a/WebCore/platform/sql/SQLValue.h b/WebCore/platform/sql/SQLValue.h
index 7d85051..0f854fc 100644
--- a/WebCore/platform/sql/SQLValue.h
+++ b/WebCore/platform/sql/SQLValue.h
@@ -38,9 +38,9 @@ namespace WebCore {
     public:
         enum Type { NullValue, NumberValue, StringValue };
 
-        SQLValue() : m_type(NullValue) { }
+        SQLValue() : m_type(NullValue), m_number(0.0) { }
         SQLValue(double number) : m_type(NumberValue), m_number(number) { }
-        SQLValue(const String& s) : m_type(StringValue), m_string(s) { }
+        SQLValue(const String& s) : m_type(StringValue), m_number(0.0), m_string(s) { }
         SQLValue(const SQLValue&);
 
         Type type() const { return m_type; }
diff --git a/WebCore/platform/sql/SQLiteTransaction.cpp b/WebCore/platform/sql/SQLiteTransaction.cpp
index 0a236be..a4b2ac8 100644
--- a/WebCore/platform/sql/SQLiteTransaction.cpp
+++ b/WebCore/platform/sql/SQLiteTransaction.cpp
@@ -30,9 +30,10 @@
 
 namespace WebCore {
 
-SQLiteTransaction::SQLiteTransaction(SQLiteDatabase& db)
+SQLiteTransaction::SQLiteTransaction(SQLiteDatabase& db, bool readOnly)
     : m_db(db)
     , m_inProgress(false)
+    , m_readOnly(readOnly)
 {
 }
 
@@ -46,7 +47,17 @@ void SQLiteTransaction::begin()
 {
     if (!m_inProgress) {
         ASSERT(!m_db.m_transactionInProgress);
-        m_inProgress = m_db.executeCommand("BEGIN;");
+        // Call BEGIN IMMEDIATE for a write transaction to acquire
+        // a RESERVED lock on the DB file. Otherwise, another write
+        // transaction (on another connection) could make changes
+        // to the same DB file before this transaction gets to execute
+        // any statements. If that happens, this transaction will fail.
+        // http://www.sqlite.org/lang_transaction.html
+        // http://www.sqlite.org/lockingv3.html#locking
+        if (m_readOnly)
+            m_inProgress = m_db.executeCommand("BEGIN;");
+        else
+            m_inProgress = m_db.executeCommand("BEGIN IMMEDIATE;");
         m_db.m_transactionInProgress = m_inProgress;
     }
 }
diff --git a/WebCore/platform/sql/SQLiteTransaction.h b/WebCore/platform/sql/SQLiteTransaction.h
index cf5a180..557d81c 100644
--- a/WebCore/platform/sql/SQLiteTransaction.h
+++ b/WebCore/platform/sql/SQLiteTransaction.h
@@ -35,7 +35,7 @@ class SQLiteDatabase;
 class SQLiteTransaction : public Noncopyable
 {
 public:
-    SQLiteTransaction(SQLiteDatabase& db);
+    SQLiteTransaction(SQLiteDatabase& db, bool readOnly = false);
     ~SQLiteTransaction();
     
     void begin();
@@ -47,10 +47,9 @@ public:
 private:
     SQLiteDatabase& m_db;
     bool m_inProgress;
-
+    bool m_readOnly;
 };
 
 } // namespace WebCore
 
 #endif // SQLiteTransation_H
-
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
index dc79fd0..3cf961f 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
@@ -55,10 +55,10 @@ int SQLiteFileSystem::openDatabase(const String& fileName, sqlite3** database)
         return sqlite3_open16(path.charactersWithNullTermination(), database);
     }
 
-    // open databases using Chromium's VFS
+    // open databases using the default VFS
+    // in renderers, it should be Chromium's VFS; in the browser process it should be SQLite's default VFS
     return sqlite3_open_v2(fileName.utf8().data(), database,
-                           SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_FULLMUTEX,
-                           "chromium_vfs");
+                           SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_FULLMUTEX, 0);
 }
 
 String SQLiteFileSystem::getFileNameForNewDatabase(
@@ -99,9 +99,7 @@ bool SQLiteFileSystem::deleteEmptyDatabaseDirectory(const String&)
 
 bool SQLiteFileSystem::deleteDatabaseFile(const String& fileName)
 {
-    // return true if and only if the error code returned by
-    // ChromiumBridge::deleteDatabase() is 0
-    return (!ChromiumBridge::databaseDeleteFile(fileName));
+    return (ChromiumBridge::databaseDeleteFile(fileName) == SQLITE_OK);
 }
 
 long long SQLiteFileSystem::getDatabaseFileSize(const String& fileName)
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
new file mode 100644
index 0000000..2960a5f
--- /dev/null
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SQLiteFileSystem.h"
+
+#include "ChromiumBridge.h"
+#include <sqlite3.h>
+
+#include <fcntl.h>
+#include <string.h>
+#include <unistd.h>
+
+using namespace WebCore;
+
+// Defined in Chromium's codebase in third_party/sqlite/src/os_unix.c
+extern "C" {
+void initUnixFile(sqlite3_file* file);
+int fillInUnixFile(sqlite3_vfs* vfs, int fd, int dirfd, sqlite3_file* file, const char* fileName, int noLock);
+}
+
+// Chromium's Posix implementation of SQLite VFS
+namespace {
+
+// Opens a file.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// fileName - the name of the file.
+// id - the structure that will manipulate the newly opened file.
+// desiredFlags - the desired open mode flags.
+// usedFlags - the actual open mode flags that were used.
+int chromiumOpen(sqlite3_vfs* vfs, const char* fileName,
+                 sqlite3_file* id, int desiredFlags, int* usedFlags)
+{
+    initUnixFile(id);
+    int dirfd = -1;
+    int fd = ChromiumBridge::databaseOpenFile(fileName, desiredFlags, &dirfd);
+    if (fd < 0) {
+        if (desiredFlags & SQLITE_OPEN_READWRITE) {
+            int newFlags = (desiredFlags & ~(SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE)) | SQLITE_OPEN_READONLY;
+            return chromiumOpen(vfs, fileName, id, newFlags, usedFlags);
+        } else
+            return SQLITE_CANTOPEN;
+    }
+    if (usedFlags)
+        *usedFlags = desiredFlags;
+
+    fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+    if (dirfd >= 0)
+        fcntl(dirfd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+
+    // The mask 0x00007F00 gives us the 7 bits that determine the type of the file SQLite is trying to open.
+    int fileType = desiredFlags & 0x00007F00;
+    int noLock = (fileType != SQLITE_OPEN_MAIN_DB);
+    return fillInUnixFile(vfs, fd, dirfd, id, fileName, noLock);
+}
+
+// Deletes the given file.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// fileName - the name of the file.
+// syncDir - determines if the directory to which this file belongs
+//           should be synched after the file is deleted.
+int chromiumDelete(sqlite3_vfs*, const char* fileName, int syncDir)
+{
+    return ChromiumBridge::databaseDeleteFile(fileName, syncDir);
+}
+
+// Check the existance and status of the given file.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// fileName - the name of the file.
+// flag - the type of test to make on this file.
+// res - the result.
+int chromiumAccess(sqlite3_vfs*, const char* fileName, int flag, int* res)
+{
+    int attr = static_cast<int>(ChromiumBridge::databaseGetFileAttributes(fileName));
+    if (attr < 0) {
+        *res = 0;
+        return SQLITE_OK;
+    }
+
+    switch (flag) {
+    case SQLITE_ACCESS_EXISTS:
+        *res = 1;   // if the file doesn't exist, attr < 0
+        break;
+    case SQLITE_ACCESS_READWRITE:
+        *res = (attr & W_OK) && (attr & R_OK);
+        break;
+    case SQLITE_ACCESS_READ:
+        *res = (attr & R_OK);
+        break;
+    default:
+        return SQLITE_ERROR;
+    }
+
+    return SQLITE_OK;
+}
+
+// Turns a relative pathname into a full pathname.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// relativePath - the relative path.
+// bufSize - the size of the output buffer in bytes.
+// absolutePath - the output buffer where the absolute path will be stored.
+int chromiumFullPathname(sqlite3_vfs* vfs, const char* relativePath,
+                         int, char* absolutePath)
+{
+    // The renderer process doesn't need to know the absolute path of the file
+    sqlite3_snprintf(vfs->mxPathname, absolutePath, "%s", relativePath);
+    return SQLITE_OK;
+}
+
+#ifndef SQLITE_OMIT_LOAD_EXTENSION
+// Returns NULL, thus disallowing loading libraries in the renderer process.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// fileName - the name of the shared library file.
+void* chromiumDlOpen(sqlite3_vfs*, const char*)
+{
+    return 0;
+}
+#else
+#define chromiumDlOpen 0
+#endif // SQLITE_OMIT_LOAD_EXTENSION
+
+} // namespace
+
+namespace WebCore {
+
+void SQLiteFileSystem::registerSQLiteVFS()
+{
+    // FIXME: Make sure there aren't any unintended consequences when VFS code is called in the browser process.
+    if (!ChromiumBridge::sandboxEnabled()) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    sqlite3_vfs* unix_vfs = sqlite3_vfs_find("unix");
+    static sqlite3_vfs chromium_vfs = {
+        1,
+        unix_vfs->szOsFile,
+        unix_vfs->mxPathname,
+        0,
+        "chromium_vfs",
+        unix_vfs->pAppData,
+        chromiumOpen,
+        chromiumDelete,
+        chromiumAccess,
+        chromiumFullPathname,
+        chromiumDlOpen,
+        unix_vfs->xDlError,
+        unix_vfs->xDlSym,
+        unix_vfs->xDlClose,
+        unix_vfs->xRandomness,
+        unix_vfs->xSleep,
+        unix_vfs->xCurrentTime,
+        unix_vfs->xGetLastError
+    };
+    sqlite3_vfs_register(&chromium_vfs, 1);
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
index b357d4a..153793b 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
@@ -35,6 +35,8 @@
 #include <sqlite3.h>
 #include <windows.h>
 
+using namespace WebCore;
+
 // Defined in Chromium's codebase in third_party/sqlite/src/os_win.c
 extern "C" {
 int chromium_sqlite3_initialize_win_sqlite3_file(sqlite3_file* file, HANDLE handle);
@@ -53,7 +55,7 @@ namespace {
 int chromiumOpen(sqlite3_vfs*, const char* fileName,
                  sqlite3_file* id, int desiredFlags, int* usedFlags)
 {
-    HANDLE h = WebCore::ChromiumBridge::databaseOpenFile(fileName, desiredFlags);
+    HANDLE h = ChromiumBridge::databaseOpenFile(fileName, desiredFlags);
     if (h == INVALID_HANDLE_VALUE) {
         if (desiredFlags & SQLITE_OPEN_READWRITE) {
             int newFlags = (desiredFlags | SQLITE_OPEN_READONLY) & ~SQLITE_OPEN_READWRITE;
@@ -80,10 +82,7 @@ int chromiumOpen(sqlite3_vfs*, const char* fileName,
 //           should be synched after the file is deleted.
 int chromiumDelete(sqlite3_vfs*, const char* fileName, int)
 {
-    bool deleted = WebCore::ChromiumBridge::databaseDeleteFile(fileName);
-    DWORD rc = WebCore::ChromiumBridge::databaseGetFileAttributes(fileName);
-    return ((rc == INVALID_FILE_ATTRIBUTES) && deleted ?
-            SQLITE_OK : SQLITE_IOERR_DELETE);
+    return ChromiumBridge::databaseDeleteFile(fileName);
 }
 
 // Check the existance and status of the given file.
@@ -94,7 +93,7 @@ int chromiumDelete(sqlite3_vfs*, const char* fileName, int)
 // res - the result.
 int chromiumAccess(sqlite3_vfs*, const char* fileName, int flag, int* res)
 {
-    DWORD attr = WebCore::ChromiumBridge::databaseGetFileAttributes(fileName);
+    DWORD attr = ChromiumBridge::databaseGetFileAttributes(fileName);
     switch (flag) {
     case SQLITE_ACCESS_READ:
     case SQLITE_ACCESS_EXISTS:
@@ -156,7 +155,7 @@ void SQLiteFileSystem::registerSQLiteVFS()
         win32_vfs->mxPathname,
         0,
         "chromium_vfs",
-        0,
+        win32_vfs->pAppData,
         chromiumOpen,
         chromiumDelete,
         chromiumAccess,
diff --git a/WebCore/platform/text/CString.cpp b/WebCore/platform/text/CString.cpp
index 90990f8..25f5fa1 100644
--- a/WebCore/platform/text/CString.cpp
+++ b/WebCore/platform/text/CString.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/WebCore/platform/text/CString.h b/WebCore/platform/text/CString.h
index f084ddf..b9030d6 100644
--- a/WebCore/platform/text/CString.h
+++ b/WebCore/platform/text/CString.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/WebCore/platform/text/PlatformString.h b/WebCore/platform/text/PlatformString.h
index 6d5384f..8d19c17 100644
--- a/WebCore/platform/text/PlatformString.h
+++ b/WebCore/platform/text/PlatformString.h
@@ -56,6 +56,10 @@ QT_END_NAMESPACE
 class wxString;
 #endif
 
+#if PLATFORM(HAIKU)
+class BString;
+#endif
+
 namespace WebCore {
 
 class CString;
@@ -189,16 +193,13 @@ public:
 
     bool percentage(int& percentage) const;
 
-    // Makes a deep copy. Helpful only if you need to use a String on another thread.
+    // Returns a StringImpl suitable for use on another thread.
+    String crossThreadString() const;
+    // Makes a deep copy. Helpful only if you need to use a String on another thread
+    // (use crossThreadString if the method call doesn't need to be threadsafe).
     // Since the underlying StringImpl objects are immutable, there's no other reason
     // to ever prefer copy() over plain old assignment.
-    String copy() const;
-
-    // Makes a deep copy like copy() but only for a substring.
-    // (This ensures that you always get something suitable for a thread while subtring
-    // may not.  For example, in the empty string case, StringImpl::substring returns
-    // empty() which is not safe for another thread.)
-    String substringCopy(unsigned pos, unsigned len  = UINT_MAX) const;
+    String threadsafeCopy() const;
 
     bool isNull() const { return !m_impl; }
     bool isEmpty() const;
@@ -229,6 +230,11 @@ public:
     operator wxString() const;
 #endif
 
+#if PLATFORM(HAIKU)
+    String(const BString&);
+    operator BString() const;
+#endif
+
 #ifndef NDEBUG
     Vector<char> ascii() const;
 #endif
@@ -245,6 +251,14 @@ public:
     // Determines the writing direction using the Unicode Bidi Algorithm rules P2 and P3.
     WTF::Unicode::Direction defaultWritingDirection() const { return m_impl ? m_impl->defaultWritingDirection() : WTF::Unicode::LeftToRight; }
 
+    // Counts the number of grapheme clusters. A surrogate pair or a sequence
+    // of a non-combining character and following combining characters is
+    // counted as 1 grapheme cluster.
+    unsigned numGraphemeClusters() const;
+    // Returns the number of characters which will be less than or equal to
+    // the specified grapheme cluster length.
+    unsigned numCharactersInGraphemeClusters(unsigned) const;
+
 private:
     RefPtr<StringImpl> m_impl;
 };
diff --git a/WebCore/platform/text/RegularExpression.cpp b/WebCore/platform/text/RegularExpression.cpp
index 6329b3b..9b063c9 100644
--- a/WebCore/platform/text/RegularExpression.cpp
+++ b/WebCore/platform/text/RegularExpression.cpp
@@ -32,7 +32,7 @@
 
 namespace WebCore {
 
-class RegularExpression::Private : public RefCounted<Private> {
+class RegularExpression::Private : public RefCounted<RegularExpression::Private> {
 public:
     static PassRefPtr<Private> create(const String& pattern, TextCaseSensitivity);
     ~Private();
diff --git a/WebCore/platform/text/String.cpp b/WebCore/platform/text/String.cpp
index 2730939..bef2674 100644
--- a/WebCore/platform/text/String.cpp
+++ b/WebCore/platform/text/String.cpp
@@ -25,6 +25,7 @@
 #include "CString.h"
 #include "FloatConversion.h"
 #include "StringBuffer.h"
+#include "TextBreakIterator.h"
 #include "TextEncoding.h"
 #include <wtf/dtoa.h>
 #include <limits>
@@ -262,13 +263,6 @@ String String::substring(unsigned pos, unsigned len) const
     return m_impl->substring(pos, len);
 }
 
-String String::substringCopy(unsigned pos, unsigned len) const
-{
-    if (!m_impl) 
-        return String();
-    return m_impl->substringCopy(pos, len);
-}
-
 String String::lower() const
 {
     if (!m_impl)
@@ -589,11 +583,18 @@ float String::toFloat(bool* ok) const
     return m_impl->toFloat(ok);
 }
 
-String String::copy() const
+String String::threadsafeCopy() const
+{
+    if (!m_impl)
+        return String();
+    return m_impl->threadsafeCopy();
+}
+
+String String::crossThreadString() const
 {
     if (!m_impl)
         return String();
-    return m_impl->copy();
+    return m_impl->crossThreadString();
 }
 
 bool String::isEmpty() const
@@ -921,6 +922,31 @@ PassRefPtr<SharedBuffer> utf8Buffer(const String& string)
     return SharedBuffer::adoptVector(buffer);
 }
 
+unsigned String::numGraphemeClusters() const
+{
+    TextBreakIterator* it = characterBreakIterator(characters(), length());
+    if (!it)
+        return length();
+
+    unsigned num = 0;
+    while (textBreakNext(it) != TextBreakDone)
+        ++num;
+    return num;
+}
+
+unsigned String::numCharactersInGraphemeClusters(unsigned numGraphemeClusters) const
+{
+    TextBreakIterator* it = characterBreakIterator(characters(), length());
+    if (!it)
+        return min(length(), numGraphemeClusters);
+
+    for (unsigned i = 0; i < numGraphemeClusters; ++i) {
+        if (textBreakNext(it) == TextBreakDone)
+            return length();
+    }
+    return textBreakCurrent(it);
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/WebCore/platform/text/StringImpl.cpp b/WebCore/platform/text/StringImpl.cpp
index 8b749c7..c3ab4be 100644
--- a/WebCore/platform/text/StringImpl.cpp
+++ b/WebCore/platform/text/StringImpl.cpp
@@ -57,7 +57,7 @@ static inline void deleteUCharVector(const UChar* p)
 }
 
 // Some of the factory methods create buffers using fastMalloc.
-// We must ensure that ll allocations of StringImpl are allocated using
+// We must ensure that all allocations of StringImpl are allocated using
 // fastMalloc so that we don't have mis-matched frees. We accomplish 
 // this by overriding the new and delete operators.
 void* StringImpl::operator new(size_t size, void* address)
@@ -79,10 +79,9 @@ void StringImpl::operator delete(void* address)
 
 // This constructor is used only to create the empty string.
 StringImpl::StringImpl()
-    : m_length(0)
-    , m_data(0)
+    : m_data(0)
+    , m_length(0)
     , m_hash(0)
-    , m_bufferIsInternal(false)
 {
     // Ensure that the hash is computed so that AtomicStringHash can call existingHash()
     // with impunity. The empty string is special because it is never entered into
@@ -90,52 +89,10 @@ StringImpl::StringImpl()
     hash();
 }
 
-// This is one of the most common constructors, but it's also used for the copy()
-// operation. Because of that, it's the one constructor that doesn't assert the
-// length is non-zero, since we support copying the empty string.
-inline StringImpl::StringImpl(const UChar* characters, unsigned length)
-    : m_length(length)
-    , m_hash(0)
-    , m_bufferIsInternal(false)
-{
-    UChar* data = newUCharVector(length);
-    memcpy(data, characters, length * sizeof(UChar));
-    m_data = data;
-}
-
-inline StringImpl::StringImpl(const StringImpl& str, WithTerminatingNullCharacter)
-    : m_length(str.m_length)
-    , m_hash(str.m_hash)
-    , m_bufferIsInternal(false)
-{
-    m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
-    UChar* data = newUCharVector(str.m_length + 1);
-    memcpy(data, str.m_data, str.m_length * sizeof(UChar));
-    data[str.m_length] = 0;
-    m_data = data;
-}
-
-inline StringImpl::StringImpl(const char* characters, unsigned length)
-    : m_length(length)
-    , m_hash(0)
-    , m_bufferIsInternal(false)
-{
-    ASSERT(characters);
-    ASSERT(length);
-
-    UChar* data = newUCharVector(length);
-    for (unsigned i = 0; i != length; ++i) {
-        unsigned char c = characters[i];
-        data[i] = c;
-    }
-    m_data = data;
-}
-
 inline StringImpl::StringImpl(UChar* characters, unsigned length, AdoptBuffer)
-    : m_length(length)
-    , m_data(characters)
+    : m_data(characters)
+    , m_length(length)
     , m_hash(0)
-    , m_bufferIsInternal(false)
 {
     ASSERT(characters);
     ASSERT(length);
@@ -143,9 +100,9 @@ inline StringImpl::StringImpl(UChar* characters, unsigned length, AdoptBuffer)
 
 // This constructor is only for use by AtomicString.
 StringImpl::StringImpl(const UChar* characters, unsigned length, unsigned hash)
-    : m_length(length)
+    : m_data(0)
+    , m_length(length)
     , m_hash(hash)
-    , m_bufferIsInternal(false)
 {
     ASSERT(hash);
     ASSERT(characters);
@@ -159,9 +116,9 @@ StringImpl::StringImpl(const UChar* characters, unsigned length, unsigned hash)
 
 // This constructor is only for use by AtomicString.
 StringImpl::StringImpl(const char* characters, unsigned length, unsigned hash)
-    : m_length(length)
+    : m_data(0)
+    , m_length(length)
     , m_hash(hash)
-    , m_bufferIsInternal(false)
 {
     ASSERT(hash);
     ASSERT(characters);
@@ -180,7 +137,7 @@ StringImpl::~StringImpl()
 {
     if (inTable())
         AtomicString::remove(this);
-    if (!m_bufferIsInternal) {
+    if (!bufferIsInternal()) {
         SharedUChar* sharedBuffer = m_sharedBufferAndFlags.get();
         if (sharedBuffer)
             sharedBuffer->deref();
@@ -218,15 +175,6 @@ PassRefPtr<StringImpl> StringImpl::substring(unsigned start, unsigned length)
     return create(m_data + start, length);
 }
 
-PassRefPtr<StringImpl> StringImpl::substringCopy(unsigned start, unsigned length)
-{
-    start = min(start, m_length);
-    length = min(length, m_length - start);
-    if (!length)
-        return adoptRef(new StringImpl);
-    return create(m_data + start, length);
-}
-
 UChar32 StringImpl::characterStartingAt(unsigned i)
 {
     if (U16_IS_SINGLE(m_data[i]))
@@ -1007,10 +955,9 @@ PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*&
     // struct as well as the data which it contains. This removes one 
     // heap allocation from this call.
     size_t size = sizeof(StringImpl) + length * sizeof(UChar);
-    char* buffer = static_cast<char*>(fastMalloc(size));
-    data = reinterpret_cast<UChar*>(buffer + sizeof(StringImpl));
-    StringImpl* string = new (buffer) StringImpl(data, length, AdoptBuffer());
-    string->m_bufferIsInternal = true;
+    StringImpl* string = static_cast<StringImpl*>(fastMalloc(size));
+    data = reinterpret_cast<UChar*>(string + 1);
+    string = new (string) StringImpl(data, length, AdoptBuffer());
     return adoptRef(string);
 }
 
@@ -1071,18 +1018,43 @@ JSC::UString StringImpl::ustring()
 
 PassRefPtr<StringImpl> StringImpl::createWithTerminatingNullCharacter(const StringImpl& string)
 {
-    return adoptRef(new StringImpl(string, WithTerminatingNullCharacter()));
+    // Use createUninitialized instead of 'new StringImpl' so that the string and its buffer
+    // get allocated in a single malloc block.
+    UChar* data;
+    int length = string.m_length;
+    RefPtr<StringImpl> terminatedString = createUninitialized(length + 1, data);
+    memcpy(data, string.m_data, length * sizeof(UChar));
+    data[length] = 0;
+    terminatedString->m_length--;
+    terminatedString->m_hash = string.m_hash;
+    terminatedString->m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
+    return terminatedString.release();
 }
 
-PassRefPtr<StringImpl> StringImpl::copy()
+PassRefPtr<StringImpl> StringImpl::threadsafeCopy() const
 {
-    // Using the constructor directly to make sure that per-thread empty string instance isn't returned.
-    return adoptRef(new StringImpl(m_data, m_length));
+    // Special-case empty strings to make sure that per-thread empty string instance isn't returned.
+    if (m_length == 0)
+        return adoptRef(new StringImpl);
+    return create(m_data, m_length);
+}
+
+PassRefPtr<StringImpl> StringImpl::crossThreadString()
+{
+    SharedUChar* shared = sharedBuffer();
+    if (shared) {
+        RefPtr<StringImpl> impl = adoptRef(new StringImpl(const_cast<UChar*>(m_data), m_length, AdoptBuffer()));
+        impl->m_sharedBufferAndFlags.set(shared->crossThreadCopy().releaseRef());
+        return impl.release();
+    }
+
+    // If no shared buffer is available, create a copy.
+    return threadsafeCopy();
 }
 
 StringImpl::SharedUChar* StringImpl::sharedBuffer()
 {
-    if (m_length < minLengthToShare || m_bufferIsInternal)
+    if (m_length < minLengthToShare || bufferIsInternal())
         return 0;
 
     if (!m_sharedBufferAndFlags.get())
diff --git a/WebCore/platform/text/StringImpl.h b/WebCore/platform/text/StringImpl.h
index 8b4e82d..f3256cc 100644
--- a/WebCore/platform/text/StringImpl.h
+++ b/WebCore/platform/text/StringImpl.h
@@ -67,15 +67,10 @@ class StringImpl : public RefCounted<StringImpl> {
 private:
     friend class ThreadGlobalData;
     StringImpl();
-    StringImpl(const UChar*, unsigned length);
-    StringImpl(const char*, unsigned length);
 
     struct AdoptBuffer { };
     StringImpl(UChar*, unsigned length, AdoptBuffer);
 
-    struct WithTerminatingNullCharacter { };
-    StringImpl(const StringImpl&, WithTerminatingNullCharacter);
-
     // For AtomicString.
     StringImpl(const UChar*, unsigned length, unsigned hash);
     StringImpl(const char*, unsigned length, unsigned hash);
@@ -114,15 +109,12 @@ public:
     static unsigned computeHash(const UChar*, unsigned len);
     static unsigned computeHash(const char*);
     
-    // Makes a deep copy. Helpful only if you need to use a String on another thread.
+    // Returns a StringImpl suitable for use on another thread.
+    PassRefPtr<StringImpl> crossThreadString();
+    // Makes a deep copy. Helpful only if you need to use a String on another thread
+    // (use crossThreadString if the method call doesn't need to be threadsafe).
     // Since StringImpl objects are immutable, there's no other reason to make a copy.
-    PassRefPtr<StringImpl> copy();
-
-    // Makes a deep copy like copy() but only for a substring.
-    // (This ensures that you always get something suitable for a thread while subtring
-    // may not.  For example, in the empty string case, substring returns empty() which
-    // is not safe for another thread.)
-    PassRefPtr<StringImpl> substringCopy(unsigned pos, unsigned len  = UINT_MAX);
+    PassRefPtr<StringImpl> threadsafeCopy() const;
 
     PassRefPtr<StringImpl> substring(unsigned pos, unsigned len = UINT_MAX);
 
@@ -166,7 +158,7 @@ public:
     int reverseFind(UChar, int index);
     int reverseFind(StringImpl*, int index, bool caseSensitive = true);
     
-    bool startsWith(StringImpl* m_data, bool caseSensitive = true) { return reverseFind(m_data, 0, caseSensitive) == 0; }
+    bool startsWith(StringImpl* str, bool caseSensitive = true) { return reverseFind(str, 0, caseSensitive) == 0; }
     bool endsWith(StringImpl*, bool caseSensitive = true);
 
     PassRefPtr<StringImpl> replace(UChar, UChar);
@@ -196,21 +188,22 @@ private:
     void* operator new(size_t size, void* address);
 
     static PassRefPtr<StringImpl> createStrippingNullCharactersSlowCase(const UChar*, unsigned length);
+    
+    // The StringImpl struct and its data may be allocated within a single heap block.
+    // In this case, the m_data pointer is an "internal buffer", and does not need to be deallocated.
+    bool bufferIsInternal() { return m_data == reinterpret_cast<const UChar*>(this + 1); }
 
     enum StringImplFlags {
         HasTerminatingNullCharacter,
         InTable,
     };
 
-    unsigned m_length;
     const UChar* m_data;
+    unsigned m_length;
     mutable unsigned m_hash;
     PtrAndFlags<SharedUChar, StringImplFlags> m_sharedBufferAndFlags;
-
-    // In some cases, we allocate the StringImpl struct and its data
-    // within a single heap buffer. In this case, the m_data pointer
-    // is an "internal buffer", and does not need to be deallocated.
-    bool m_bufferIsInternal;
+    // There is a fictitious variable-length UChar array at the end, which is used
+    // as the internal buffer by the createUninitialized and create methods.
 };
 
 bool equal(StringImpl*, StringImpl*);
diff --git a/WebCore/platform/text/TextEncoding.cpp b/WebCore/platform/text/TextEncoding.cpp
index b76f739..c5c8cfd 100644
--- a/WebCore/platform/text/TextEncoding.cpp
+++ b/WebCore/platform/text/TextEncoding.cpp
@@ -264,6 +264,7 @@ const TextEncoding& UTF32LittleEndianEncoding()
 const TextEncoding& UTF8Encoding()
 {
     static TextEncoding globalUTF8Encoding("UTF-8");
+    ASSERT(globalUTF8Encoding.isValid());
     return globalUTF8Encoding;
 }
 
diff --git a/WebCore/platform/text/TextEncodingRegistry.cpp b/WebCore/platform/text/TextEncodingRegistry.cpp
index 5ab1c87..5d82511 100644
--- a/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -48,7 +48,7 @@
 #if PLATFORM(QT)
 #include "qt/TextCodecQt.h"
 #endif
-#if PLATFORM(WINCE)
+#if PLATFORM(WINCE) && !PLATFORM(QT)
 #include "TextCodecWince.h"
 #endif
 
@@ -194,7 +194,7 @@ static void buildBaseTextCodecMaps()
     TextCodecICU::registerBaseCodecs(addToTextCodecMap);
 #endif
 
-#if PLATFORM(WINCE)
+#if PLATFORM(WINCE) && !PLATFORM(QT)
     TextCodecWince::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerBaseCodecs(addToTextCodecMap);
 #endif
@@ -217,7 +217,7 @@ static void extendTextCodecMaps()
     TextCodecMac::registerCodecs(addToTextCodecMap);
 #endif
 
-#if PLATFORM(WINCE)
+#if PLATFORM(WINCE) && !PLATFORM(QT)
     TextCodecWince::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerExtendedCodecs(addToTextCodecMap);
 #endif
diff --git a/WebCore/platform/text/UnicodeRange.h b/WebCore/platform/text/UnicodeRange.h
index 7ecf03f..2278a0e 100644
--- a/WebCore/platform/text/UnicodeRange.h
+++ b/WebCore/platform/text/UnicodeRange.h
@@ -35,6 +35,10 @@
 #ifndef UnicodeRange_H
 #define UnicodeRange_H
 
+#if PLATFORM(HAIKU)
+#include "stdint.h"
+#endif
+
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
diff --git a/WebCore/platform/text/cf/StringCF.cpp b/WebCore/platform/text/cf/StringCF.cpp
index 5e12ba9..b770d0e 100644
--- a/WebCore/platform/text/cf/StringCF.cpp
+++ b/WebCore/platform/text/cf/StringCF.cpp
@@ -45,7 +45,7 @@ String::String(CFStringRef str)
 CFStringRef String::createCFString() const
 {
     if (!m_impl)
-        return CFSTR("");
+        return static_cast<CFStringRef>(CFRetain(CFSTR("")));
 
     return m_impl->createCFString();
 }
diff --git a/WebCore/platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp b/WebCore/platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp
index 2c732d6..8bb8c70 100644
--- a/WebCore/platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp
+++ b/WebCore/platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp
@@ -26,6 +26,12 @@
 
 namespace WebCore {
 
+const char* currentSearchLocaleID()
+{
+    notImplemented();
+    return "";
+}
+
 const char* currentTextBreakLocaleID()
 {
     notImplemented();
diff --git a/WebCore/platform/text/mac/TextCodecMac.cpp b/WebCore/platform/text/mac/TextCodecMac.cpp
index 93b9da2..a1750c9 100644
--- a/WebCore/platform/text/mac/TextCodecMac.cpp
+++ b/WebCore/platform/text/mac/TextCodecMac.cpp
@@ -36,7 +36,7 @@
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Threading.h>
 
-using std::min;
+using namespace std;
 
 namespace WebCore {
 
@@ -141,7 +141,7 @@ OSStatus TextCodecMac::decode(const unsigned char* inputBuffer, int inputBufferL
         // First, fill the partial character buffer with as many bytes as are available.
         ASSERT(m_numBufferedBytes < sizeof(m_bufferedBytes));
         const int spaceInBuffer = sizeof(m_bufferedBytes) - m_numBufferedBytes;
-        const int bytesToPutInBuffer = MIN(spaceInBuffer, inputBufferLength);
+        const int bytesToPutInBuffer = min(spaceInBuffer, inputBufferLength);
         ASSERT(bytesToPutInBuffer != 0);
         memcpy(m_bufferedBytes + m_numBufferedBytes, inputBuffer, bytesToPutInBuffer);
 
@@ -283,28 +283,28 @@ CString TextCodecMac::encode(const UChar* characters, size_t length, Unencodable
     // Encoding will change the yen sign back into a backslash.
     String copy(characters, length);
     copy.replace('\\', m_backslashAsCurrencySymbol);
-    CFStringRef cfs = copy.createCFString();
+    RetainPtr<CFStringRef> cfs(AdoptCF, copy.createCFString());
 
     CFIndex startPos = 0;
-    CFIndex charactersLeft = CFStringGetLength(cfs);
+    CFIndex charactersLeft = CFStringGetLength(cfs.get());
     Vector<char> result;
     size_t size = 0;
     UInt8 lossByte = handling == QuestionMarksForUnencodables ? '?' : 0;
     while (charactersLeft > 0) {
         CFRange range = CFRangeMake(startPos, charactersLeft);
         CFIndex bufferLength;
-        CFStringGetBytes(cfs, range, m_encoding, lossByte, false, NULL, 0x7FFFFFFF, &bufferLength);
+        CFStringGetBytes(cfs.get(), range, m_encoding, lossByte, false, NULL, 0x7FFFFFFF, &bufferLength);
 
         result.grow(size + bufferLength);
         unsigned char* buffer = reinterpret_cast<unsigned char*>(result.data() + size);
-        CFIndex charactersConverted = CFStringGetBytes(cfs, range, m_encoding, lossByte, false, buffer, bufferLength, &bufferLength);
+        CFIndex charactersConverted = CFStringGetBytes(cfs.get(), range, m_encoding, lossByte, false, buffer, bufferLength, &bufferLength);
         size += bufferLength;
 
         if (charactersConverted != charactersLeft) {
-            unsigned badChar = CFStringGetCharacterAtIndex(cfs, startPos + charactersConverted);
+            unsigned badChar = CFStringGetCharacterAtIndex(cfs.get(), startPos + charactersConverted);
             ++charactersConverted;
             if ((badChar & 0xFC00) == 0xD800 && charactersConverted != charactersLeft) { // is high surrogate
-                UniChar low = CFStringGetCharacterAtIndex(cfs, startPos + charactersConverted);
+                UniChar low = CFStringGetCharacterAtIndex(cfs.get(), startPos + charactersConverted);
                 if ((low & 0xFC00) == 0xDC00) { // is low surrogate
                     badChar <<= 10;
                     badChar += low;
@@ -322,7 +322,6 @@ CString TextCodecMac::encode(const UChar* characters, size_t length, Unencodable
         startPos += charactersConverted;
         charactersLeft -= charactersConverted;
     }
-    CFRelease(cfs);
     return CString(result.data(), size);
 }
 
diff --git a/WebCore/platform/text/qt/TextCodecQt.cpp b/WebCore/platform/text/qt/TextCodecQt.cpp
index c6c02cf..b3f75cc 100644
--- a/WebCore/platform/text/qt/TextCodecQt.cpp
+++ b/WebCore/platform/text/qt/TextCodecQt.cpp
@@ -94,7 +94,26 @@ TextCodecQt::~TextCodecQt()
 
 String TextCodecQt::decode(const char* bytes, size_t length, bool flush, bool /*stopOnError*/, bool& sawError)
 {
-    QString unicode = m_codec->toUnicode(bytes, length, &m_state);
+    // We chop input buffer to smaller buffers to avoid excessive memory consumption
+    // when the input buffer is big.  This helps reduce peak memory consumption in
+    // mobile devices where system RAM is limited.
+#if PLATFORM(SYMBIAN)
+    static const int MaxInputChunkSize = 32 * 1024;
+#else
+    static const int MaxInputChunkSize = 1024 * 1024;
+#endif
+    const char* buf = bytes;
+    const char* end = buf + length;
+    String unicode(""); // a non-null string is expected
+
+    while (buf < end) {
+        int size = end - buf;
+        size = qMin(size, MaxInputChunkSize);
+        QString decoded = m_codec->toUnicode(buf, size, &m_state);
+        unicode.append(decoded);
+        buf += size;
+    }
+
     sawError = m_state.invalidChars != 0;
 
     if (flush) {
diff --git a/WebCore/platform/win/ClipboardWin.cpp b/WebCore/platform/win/ClipboardWin.cpp
index 65741e4..b2e8e3e 100644
--- a/WebCore/platform/win/ClipboardWin.cpp
+++ b/WebCore/platform/win/ClipboardWin.cpp
@@ -117,56 +117,49 @@ static inline void pathRemoveBadFSCharacters(PWSTR psz, size_t length)
 
 static String filesystemPathFromUrlOrTitle(const String& url, const String& title, TCHAR* extension, bool isLink)
 {
+    static const size_t fsPathMaxLengthExcludingNullTerminator = MAX_PATH - 1;
     bool usedURL = false;
-    WCHAR fsPathBuffer[MAX_PATH + 1];
+    WCHAR fsPathBuffer[MAX_PATH];
     fsPathBuffer[0] = 0;
     int extensionLen = extension ? lstrlen(extension) : 0;
+    int fsPathMaxLengthExcludingExtension = fsPathMaxLengthExcludingNullTerminator - extensionLen;
 
     if (!title.isEmpty()) {
-        size_t len = min<size_t>(title.length(), MAX_PATH - extensionLen);
+        size_t len = min<size_t>(title.length(), fsPathMaxLengthExcludingExtension);
         CopyMemory(fsPathBuffer, title.characters(), len * sizeof(UChar));
         fsPathBuffer[len] = 0;
         pathRemoveBadFSCharacters(fsPathBuffer, len);
     }
 
     if (!lstrlen(fsPathBuffer)) {
-        DWORD len = MAX_PATH;
-        String nullTermURL = url;
+        KURL kurl(ParsedURLString, url);
         usedURL = true;
-        if (UrlIsFileUrl((LPCWSTR)nullTermURL.charactersWithNullTermination()) 
-            && SUCCEEDED(PathCreateFromUrl((LPCWSTR)nullTermURL.charactersWithNullTermination(), fsPathBuffer, &len, 0))) {
-            // When linking to a file URL we can trivially find the file name
-            PWSTR fn = PathFindFileName(fsPathBuffer);
-            if (fn && fn != fsPathBuffer)
-                lstrcpyn(fsPathBuffer, fn, lstrlen(fn) + 1);
+        // The filename for any content based drag or file url should be the last element of 
+        // the path.  If we can't find it, or we're coming up with the name for a link
+        // we just use the entire url.
+        DWORD len = fsPathMaxLengthExcludingExtension;
+        String lastComponent = kurl.lastPathComponent();
+        if (kurl.isLocalFile() || (!isLink && !lastComponent.isEmpty())) {
+            len = min<DWORD>(fsPathMaxLengthExcludingExtension, lastComponent.length());
+            CopyMemory(fsPathBuffer, lastComponent.characters(), len * sizeof(UChar));
         } else {
-            // The filename for any content based drag should be the last element of 
-            // the path.  If we can't find it, or we're coming up with the name for a link
-            // we just use the entire url.
-            KURL kurl(url);
-            String lastComponent;
-            if (!isLink && !(lastComponent = kurl.lastPathComponent()).isEmpty()) {
-                len = min<DWORD>(MAX_PATH, lastComponent.length());
-                CopyMemory(fsPathBuffer, lastComponent.characters(), len * sizeof(UChar));
-            } else {
-                len = min<DWORD>(MAX_PATH, nullTermURL.length());
-                CopyMemory(fsPathBuffer, nullTermURL.characters(), len * sizeof(UChar));
-            }
-            fsPathBuffer[len] = 0;
-            pathRemoveBadFSCharacters(fsPathBuffer, len);
+            len = min<DWORD>(fsPathMaxLengthExcludingExtension, url.length());
+            CopyMemory(fsPathBuffer, url.characters(), len * sizeof(UChar));
         }
+        fsPathBuffer[len] = 0;
+        pathRemoveBadFSCharacters(fsPathBuffer, len);
     }
 
     if (!extension)
-        return String((UChar*)fsPathBuffer);
+        return String(static_cast<UChar*>(fsPathBuffer));
 
     if (!isLink && usedURL) {
         PathRenameExtension(fsPathBuffer, extension);
-        return String((UChar*)fsPathBuffer);
+        return String(static_cast<UChar*>(fsPathBuffer));
     }
 
-    String result((UChar*)fsPathBuffer);
-    result += String((UChar*)extension);
+    String result(static_cast<UChar*>(fsPathBuffer));
+    result += String(static_cast<UChar*>(extension));
     return result;
 }
 
@@ -522,7 +515,7 @@ bool ClipboardWin::setData(const String& type, const String& data)
     ClipboardDataType winType = clipboardTypeFromMIMEType(type);
 
     if (winType == ClipboardDataTypeURL)
-        return WebCore::writeURL(m_writableDataObject.get(), KURL(data), String(), false, true);
+        return WebCore::writeURL(m_writableDataObject.get(), KURL(ParsedURLString, data), String(), false, true);
 
     if (winType == ClipboardDataTypeText) {
         STGMEDIUM medium = {0};
diff --git a/WebCore/platform/win/CursorWin.cpp b/WebCore/platform/win/CursorWin.cpp
index 2bfe7a8..5afb1ae9 100644
--- a/WebCore/platform/win/CursorWin.cpp
+++ b/WebCore/platform/win/CursorWin.cpp
@@ -279,7 +279,7 @@ const Cursor& rowResizeCursor()
 
 const Cursor& middlePanningCursor()
 {
-    static const Cursor c = loadCursorByName("panIcon", 7, 7);
+    static const Cursor c = loadCursorByName("panIcon", 8, 8);
     return c;
 }
 
diff --git a/WebCore/platform/win/PasteboardWin.cpp b/WebCore/platform/win/PasteboardWin.cpp
index 188630f..d09769a 100644
--- a/WebCore/platform/win/PasteboardWin.cpp
+++ b/WebCore/platform/win/PasteboardWin.cpp
@@ -111,7 +111,7 @@ void Pasteboard::clear()
 void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
     clear();
-    
+
     // Put CF_HTML format on the pasteboard 
     if (::OpenClipboard(m_owner)) {
         ExceptionCode ec = 0;
@@ -145,6 +145,21 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     }
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    clear();
+
+    // Put plain string on the pasteboard. CF_UNICODETEXT covers CF_TEXT as well
+    String str = text;
+    replaceNewlinesWithWindowsStyleNewlines(str);
+    if (::OpenClipboard(m_owner)) {
+        HGLOBAL cbData = createGlobalData(str);
+        if (!::SetClipboardData(CF_UNICODETEXT, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+}
+
 void Pasteboard::writeURL(const KURL& url, const String& titleStr, Frame* frame)
 {
     ASSERT(!url.isEmpty());
diff --git a/WebCore/platform/win/PlatformScreenWin.cpp b/WebCore/platform/win/PlatformScreenWin.cpp
index 7ac4706..6e0f861 100644
--- a/WebCore/platform/win/PlatformScreenWin.cpp
+++ b/WebCore/platform/win/PlatformScreenWin.cpp
@@ -39,7 +39,7 @@ namespace WebCore {
 // Returns info for the default monitor if widget is NULL
 static MONITORINFOEX monitorInfoForWidget(Widget* widget)
 {
-    HWND window = widget ? widget->root()->hostWindow()->platformWindow() : 0;
+    HWND window = widget ? widget->root()->hostWindow()->platformPageClient() : 0;
     HMONITOR monitor = MonitorFromWindow(window, MONITOR_DEFAULTTOPRIMARY);
 
     MONITORINFOEX monitorInfo;
diff --git a/WebCore/platform/win/PopupMenuWin.cpp b/WebCore/platform/win/PopupMenuWin.cpp
index e53053f..1d9eb71 100644
--- a/WebCore/platform/win/PopupMenuWin.cpp
+++ b/WebCore/platform/win/PopupMenuWin.cpp
@@ -40,6 +40,7 @@
 #include "SimpleFontData.h"
 #include <tchar.h>
 #include <windows.h>
+#include <windowsx.h>
 #if PLATFORM(WINCE)
 #include <ResDefCE.h>
 #define MAKEPOINTS(l) (*((POINTS FAR *)&(l)))
@@ -60,8 +61,13 @@ const int optionSpacingMiddle = 1;
 const int popupWindowBorderWidth = 1;
 
 static LPCTSTR kPopupWindowClassName = _T("PopupWindowClass");
-static ATOM registerPopup();
-static LRESULT CALLBACK PopupWndProc(HWND, UINT, WPARAM, LPARAM);
+
+// This is used from within our custom message pump when we want to send a
+// message to the web view and not have our message stolen and sent to
+// the popup window.
+static const UINT WM_HOST_WINDOW_FIRST = WM_USER;
+static const UINT WM_HOST_WINDOW_CHAR = WM_USER + WM_CHAR; 
+static const UINT WM_HOST_WINDOW_MOUSEMOVE = WM_USER + WM_MOUSEMOVE;
 
 // FIXME: Remove this as soon as practical.
 static inline bool isASCIIPrintable(unsigned c)
@@ -69,6 +75,15 @@ static inline bool isASCIIPrintable(unsigned c)
     return c >= 0x20 && c <= 0x7E;
 }
 
+static void translatePoint(LPARAM& lParam, HWND from, HWND to)
+{
+    POINT pt;
+    pt.x = (short)GET_X_LPARAM(lParam);
+    pt.y = (short)GET_Y_LPARAM(lParam);    
+    ::MapWindowPoints(from, to, &pt, 1);
+    lParam = MAKELPARAM(pt.x, pt.y);
+}
+
 PopupMenu::PopupMenu(PopupMenuClient* client)
     : m_popupClient(client)
     , m_scrollbar(0)
@@ -81,6 +96,7 @@ PopupMenu::PopupMenu(PopupMenuClient* client)
     , m_wheelDelta(0)
     , m_focusedIndex(0)
     , m_scrollbarCapturingMouse(false)
+    , m_showPopup(false)
 {
 }
 
@@ -92,44 +108,46 @@ PopupMenu::~PopupMenu()
         ::DeleteDC(m_DC);
     if (m_popup)
         ::DestroyWindow(m_popup);
+    if (m_scrollbar)
+        m_scrollbar->setParent(0);
+}
+
+LPCTSTR PopupMenu::popupClassName()
+{
+    return kPopupWindowClassName;
 }
 
-void PopupMenu::show(const IntRect& r, FrameView* v, int index)
+void PopupMenu::show(const IntRect& r, FrameView* view, int index)
 {
-    calculatePositionAndSize(r, v);
+    calculatePositionAndSize(r, view);
     if (clientRect().isEmpty())
         return;
 
+    HWND hostWindow = view->hostWindow()->platformPageClient();
+
+    if (!m_scrollbar && visibleItems() < client()->listSize()) {
+        // We need a scroll bar
+        m_scrollbar = client()->createScrollbar(this, VerticalScrollbar, SmallScrollbar);
+        m_scrollbar->styleChanged();
+    }
+
     if (!m_popup) {
-        registerPopup();
+        registerClass();
 
         DWORD exStyle = WS_EX_LTRREADING;
 
-        // Even though we already know our size and location at this point, we pass (0,0,0,0) as our size/location here.
-        // We need to wait until after the call to ::SetWindowLongPtr to set our size so that in our WM_SIZE handler we can get access to the PopupMenu object
         m_popup = ::CreateWindowEx(exStyle, kPopupWindowClassName, _T("PopupMenu"),
             WS_POPUP | WS_BORDER,
-            0, 0, 0, 0,
-            v->hostWindow()->platformWindow(), 0, 0, 0);
+            m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(),
+            hostWindow, 0, Page::instanceHandle(), this);
 
         if (!m_popup)
             return;
-
-#if PLATFORM(WINCE)
-        ::SetWindowLong(m_popup, 0, (LONG)this);
-#else
-        ::SetWindowLongPtr(m_popup, 0, (LONG_PTR)this);
-#endif
+    } else {
+        // We need to reposition the popup window.
+        ::MoveWindow(m_popup, m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(), false);
     }
 
-    if (!m_scrollbar)
-        if (visibleItems() < client()->listSize()) {
-            // We need a scroll bar
-            m_scrollbar = client()->createScrollbar(this, VerticalScrollbar, SmallScrollbar);
-        }
-
-    ::SetWindowPos(m_popup, HWND_TOP, m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(), 0);
-
     // Determine whether we should animate our popups
     // Note: Must use 'BOOL' and 'FALSE' instead of 'bool' and 'false' to avoid stack corruption with SystemParametersInfo
     BOOL shouldAnimate = FALSE;
@@ -138,30 +156,127 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
 
     if (shouldAnimate) {
         RECT viewRect = {0};
-        ::GetWindowRect(v->hostWindow()->platformWindow(), &viewRect);
+        ::GetWindowRect(hostWindow, &viewRect);
 
         if (!::IsRectEmpty(&viewRect)) {
             // Popups should slide into view away from the <select> box
             // NOTE: This may have to change for Vista
-            DWORD slideDirection = (m_windowRect.y() < viewRect.top + v->contentsToWindow(r.location()).y()) ? AW_VER_NEGATIVE : AW_VER_POSITIVE;
+            DWORD slideDirection = (m_windowRect.y() < viewRect.top + view->contentsToWindow(r.location()).y()) ? AW_VER_NEGATIVE : AW_VER_POSITIVE;
 
-            ::AnimateWindow(m_popup, defaultAnimationDuration, AW_SLIDE | slideDirection | AW_ACTIVATE);
+            ::AnimateWindow(m_popup, defaultAnimationDuration, AW_SLIDE | slideDirection);
         }
     } else
 #endif
-        ::ShowWindow(m_popup, SW_SHOWNORMAL);
-    ::SetCapture(m_popup);
+        ::ShowWindow(m_popup, SW_SHOWNOACTIVATE);
 
     if (client()) {
         int index = client()->selectedIndex();
         if (index >= 0)
             setFocusedIndex(index);
     }
+
+    m_showPopup = true;
+
+    // Protect the popup menu in case its owner is destroyed while we're running the message pump.
+    RefPtr<PopupMenu> protect(this);
+
+    ::SetCapture(hostWindow);
+
+    MSG msg;
+    HWND activeWindow;
+
+    while (::GetMessage(&msg, 0, 0, 0)) {
+        switch (msg.message) {
+            case WM_HOST_WINDOW_MOUSEMOVE:
+            case WM_HOST_WINDOW_CHAR: 
+                if (msg.hwnd == m_popup) {
+                    // This message should be sent to the host window.
+                    msg.hwnd = hostWindow;
+                    msg.message -= WM_HOST_WINDOW_FIRST;
+                }
+                break;
+
+            // Steal mouse messages.
+            case WM_NCMOUSEMOVE:
+            case WM_NCLBUTTONDOWN:
+            case WM_NCLBUTTONUP:
+            case WM_NCLBUTTONDBLCLK:
+            case WM_NCRBUTTONDOWN:
+            case WM_NCRBUTTONUP:
+            case WM_NCRBUTTONDBLCLK:
+            case WM_NCMBUTTONDOWN:
+            case WM_NCMBUTTONUP:
+            case WM_NCMBUTTONDBLCLK:
+            case WM_MOUSEWHEEL:
+                msg.hwnd = m_popup;
+                break;
+
+            // These mouse messages use client coordinates so we need to convert them.
+            case WM_MOUSEMOVE:
+            case WM_LBUTTONDOWN:
+            case WM_LBUTTONUP:
+            case WM_LBUTTONDBLCLK:
+            case WM_RBUTTONDOWN:
+            case WM_RBUTTONUP:
+            case WM_RBUTTONDBLCLK:
+            case WM_MBUTTONDOWN:
+            case WM_MBUTTONUP:
+            case WM_MBUTTONDBLCLK: {
+                // Translate the coordinate.
+                translatePoint(msg.lParam, msg.hwnd, m_popup);
+
+                msg.hwnd = m_popup;
+                break;
+            }
+
+            // Steal all keyboard messages.
+            case WM_KEYDOWN:
+            case WM_KEYUP:
+            case WM_CHAR:
+            case WM_DEADCHAR:
+            case WM_SYSKEYUP:
+            case WM_SYSCHAR:
+            case WM_SYSDEADCHAR:
+                msg.hwnd = m_popup;
+                break;
+        }
+
+        ::TranslateMessage(&msg);
+        ::DispatchMessage(&msg);
+
+        if (!m_popupClient)
+            break;
+
+        if (!m_showPopup)
+            break;
+        activeWindow = ::GetActiveWindow();
+        if (activeWindow != hostWindow && !::IsChild(activeWindow, hostWindow))
+            break;
+        if (::GetCapture() != hostWindow)
+            break;
+    }
+
+    if (::GetCapture() == hostWindow)
+        ::ReleaseCapture();
+
+    // We're done, hide the popup if necessary.
+    hide();
 }
 
 void PopupMenu::hide()
 {
+    if (!m_showPopup)
+        return;
+
+    m_showPopup = false;
+
     ::ShowWindow(m_popup, SW_HIDE);
+
+    if (client())
+        client()->popupDidHide();
+
+    // Post a WM_NULL message to wake up the message pump if necessary.
+    ::PostMessage(m_popup, WM_NULL, 0, 0);
 }
 
 const int endOfLinePadding = 2;
@@ -174,7 +289,7 @@ void PopupMenu::calculatePositionAndSize(const IntRect& r, FrameView* v)
 
     // Then, translate to screen coordinates
     POINT location(rScreenCoords.location());
-    if (!::ClientToScreen(v->hostWindow()->platformWindow(), &location))
+    if (!::ClientToScreen(v->hostWindow()->platformPageClient(), &location))
         return;
 
     rScreenCoords.setLocation(location);
@@ -591,12 +706,12 @@ void PopupMenu::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rec
     ::InvalidateRect(m_popup, &r, false);
 }
 
-static ATOM registerPopup()
+void PopupMenu::registerClass()
 {
     static bool haveRegisteredWindowClass = false;
 
     if (haveRegisteredWindowClass)
-        return true;
+        return;
 
 #if PLATFORM(WINCE)
     WNDCLASS wcex;
@@ -607,7 +722,7 @@ static ATOM registerPopup()
     wcex.style          = CS_DROPSHADOW;
 #endif
 
-    wcex.lpfnWndProc    = PopupWndProc;
+    wcex.lpfnWndProc    = PopupMenuWndProc;
     wcex.cbClsExtra     = 0;
     wcex.cbWndExtra     = sizeof(PopupMenu*); // For the PopupMenu pointer
     wcex.hInstance      = Page::instanceHandle();
@@ -620,228 +735,262 @@ static ATOM registerPopup()
     haveRegisteredWindowClass = true;
 
 #if PLATFORM(WINCE)
-    return ::RegisterClass(&wcex);
+    RegisterClass(&wcex);
 #else
-    return ::RegisterClassEx(&wcex);
+    RegisterClassEx(&wcex);
 #endif
 }
 
-const int smoothScrollAnimationDuration = 5000;
-static LRESULT CALLBACK PopupWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+
+LRESULT CALLBACK PopupMenu::PopupMenuWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
 {
-    LRESULT lResult = 0;
 #if PLATFORM(WINCE)
     LONG longPtr = GetWindowLong(hWnd, 0);
 #else
     LONG_PTR longPtr = GetWindowLongPtr(hWnd, 0);
 #endif
-    PopupMenu* popup = reinterpret_cast<PopupMenu*>(longPtr);
+    
+    if (PopupMenu* popup = reinterpret_cast<PopupMenu*>(longPtr))
+        return popup->wndProc(hWnd, message, wParam, lParam);
+    
+    if (message == WM_CREATE) {
+        LPCREATESTRUCT createStruct = reinterpret_cast<LPCREATESTRUCT>(lParam);
+
+        // Associate the PopupMenu with the window.
+#if PLATFORM(WINCE)
+        ::SetWindowLong(hWnd, 0, (LONG)createStruct->lpCreateParams);
+#else
+        ::SetWindowLongPtr(hWnd, 0, (LONG_PTR)createStruct->lpCreateParams);
+#endif
+        return 0;
+    }
+
+    return ::DefWindowProc(hWnd, message, wParam, lParam);
+}
+
+const int smoothScrollAnimationDuration = 5000;
+
+LRESULT PopupMenu::wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+{
+    LRESULT lResult = 0;
 
     switch (message) {
-        case WM_SIZE:
-            if (popup && popup->scrollbar()) {
-                IntSize size(LOWORD(lParam), HIWORD(lParam));
-                popup->scrollbar()->setFrameRect(IntRect(size.width() - popup->scrollbar()->width(), 0, popup->scrollbar()->width(), size.height()));
-
-                int visibleItems = popup->visibleItems();
-                popup->scrollbar()->setEnabled(visibleItems < popup->client()->listSize());
-                popup->scrollbar()->setSteps(1, max(1, visibleItems - 1));
-                popup->scrollbar()->setProportion(visibleItems, popup->client()->listSize());
-            }
-            break;
-        case WM_ACTIVATE:
-            if (popup && popup->client() && wParam == WA_INACTIVE)
-                popup->client()->hidePopup();
-            break;
-        case WM_KILLFOCUS:
-            if (popup && popup->client() && (HWND)wParam != popup->popupHandle())
-                // Focus is going elsewhere, so hide
-                popup->client()->hidePopup();
+        case WM_MOUSEACTIVATE:
+            return MA_NOACTIVATE;
+
+        case WM_SIZE: {
+            if (!scrollbar())
+                break;
+
+            IntSize size(LOWORD(lParam), HIWORD(lParam));
+            scrollbar()->setFrameRect(IntRect(size.width() - scrollbar()->width(), 0, scrollbar()->width(), size.height()));
+
+            int visibleItems = this->visibleItems();
+            scrollbar()->setEnabled(visibleItems < client()->listSize());
+            scrollbar()->setSteps(1, max(1, visibleItems - 1));
+            scrollbar()->setProportion(visibleItems, client()->listSize());
+
             break;
+        }
         case WM_KEYDOWN:
-            if (popup && popup->client()) {
-                lResult = 0;
-                switch (LOWORD(wParam)) {
-                    case VK_DOWN:
-                    case VK_RIGHT:
-                        popup->down();
-                        break;
-                    case VK_UP:
-                    case VK_LEFT:
-                        popup->up();
-                        break;
-                    case VK_HOME:
-                        popup->focusFirst();
-                        break;
-                    case VK_END:
-                        popup->focusLast();
-                        break;
-                    case VK_PRIOR:
-                        if (popup->focusedIndex() != popup->scrollOffset()) {
-                            // Set the selection to the first visible item
-                            int firstVisibleItem = popup->scrollOffset();
-                            popup->up(popup->focusedIndex() - firstVisibleItem);
-                        } else
-                            // The first visible item is selected, so move the selection back one page
-                            popup->up(popup->visibleItems());
-                        break;
-                    case VK_NEXT:
-                        if (popup) {
-                            int lastVisibleItem = popup->scrollOffset() + popup->visibleItems() - 1;
-                            if (popup->focusedIndex() != lastVisibleItem) {
-                                // Set the selection to the last visible item
-                                popup->down(lastVisibleItem - popup->focusedIndex());
-                            } else
-                                // The last visible item is selected, so move the selection forward one page
-                                popup->down(popup->visibleItems());
-                        }
-                        break;
-                    case VK_TAB:
-                        ::SendMessage(popup->client()->hostWindow()->platformWindow(), message, wParam, lParam);
-                        popup->client()->hidePopup();
-                        break;
-                    case VK_ESCAPE:
-                        popup->client()->hidePopup();
-                        break;
-                    default:
-                        if (isASCIIPrintable(wParam))
-                            // Send the keydown to the WebView so it can be used for type-to-select.
-                            ::PostMessage(popup->client()->hostWindow()->platformWindow(), message, wParam, lParam);
-                        else
-                            lResult = 1;
-                        break;
+            if (!client())
+                break;
+
+            lResult = 0;
+            switch (LOWORD(wParam)) {
+                case VK_DOWN:
+                case VK_RIGHT:
+                    down();
+                    break;
+                case VK_UP:
+                case VK_LEFT:
+                    up();
+                    break;
+                case VK_HOME:
+                    focusFirst();
+                    break;
+                case VK_END:
+                    focusLast();
+                    break;
+                case VK_PRIOR:
+                    if (focusedIndex() != scrollOffset()) {
+                        // Set the selection to the first visible item
+                        int firstVisibleItem = scrollOffset();
+                        up(focusedIndex() - firstVisibleItem);
+                    } else {
+                        // The first visible item is selected, so move the selection back one page
+                        up(visibleItems());
+                    }
+                    break;
+                case VK_NEXT: {
+                    int lastVisibleItem = scrollOffset() + visibleItems() - 1;
+                    if (focusedIndex() != lastVisibleItem) {
+                        // Set the selection to the last visible item
+                        down(lastVisibleItem - focusedIndex());
+                    } else {
+                        // The last visible item is selected, so move the selection forward one page
+                        down(visibleItems());
+                    }
+                    break;
                 }
+                case VK_TAB:
+                    ::SendMessage(client()->hostWindow()->platformPageClient(), message, wParam, lParam);
+                    hide();
+                    break;
+                case VK_ESCAPE:
+                    hide();
+                    break;
+                default:
+                    if (isASCIIPrintable(wParam))
+                        // Send the keydown to the WebView so it can be used for type-to-select.
+                        // Since we know that the virtual key is ASCII printable, it's OK to convert this to
+                        // a WM_CHAR message. (We don't want to call TranslateMessage because that will post a
+                        // WM_CHAR message that will be stolen and redirected to the popup HWND.
+                        ::PostMessage(m_popup, WM_HOST_WINDOW_CHAR, wParam, lParam);
+                    else
+                        lResult = 1;
+                    break;
             }
             break;
-        case WM_CHAR:
-            if (popup && popup->client()) {
-                lResult = 0;
-                int index;
-                switch (wParam) {
-                    case 0x0D:   // Enter/Return
-                        popup->client()->hidePopup();
-                        index = popup->focusedIndex();
-                        ASSERT(index >= 0);
-                        popup->client()->valueChanged(index);
-                        break;
-                    case 0x1B:   // Escape
-                        popup->client()->hidePopup();
-                        break;
-                    case 0x09:   // TAB
-                    case 0x08:   // Backspace
-                    case 0x0A:   // Linefeed
-                    default:     // Character
-                        lResult = 1;
-                        break;
-                }
+        case WM_CHAR: {
+            if (!client())
+                break;
+
+            lResult = 0;
+            int index;
+            switch (wParam) {
+                case 0x0D:   // Enter/Return
+                    hide();
+                    index = focusedIndex();
+                    ASSERT(index >= 0);
+                    client()->valueChanged(index);
+                    break;
+                case 0x1B:   // Escape
+                    hide();
+                    break;
+                case 0x09:   // TAB
+                case 0x08:   // Backspace
+                case 0x0A:   // Linefeed
+                default:     // Character
+                    lResult = 1;
+                    break;
             }
             break;
-        case WM_MOUSEMOVE:
-            if (popup) {
-                IntPoint mousePoint(MAKEPOINTS(lParam));
-                if (popup->scrollbar()) {
-                    IntRect scrollBarRect = popup->scrollbar()->frameRect();
-                    if (popup->scrollbarCapturingMouse() || scrollBarRect.contains(mousePoint)) {
-                        // Put the point into coordinates relative to the scroll bar
-                        mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
-                        PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
-                        popup->scrollbar()->mouseMoved(event);
-                        break;
-                    }
+        }
+        case WM_MOUSEMOVE: {
+            IntPoint mousePoint(MAKEPOINTS(lParam));
+            if (scrollbar()) {
+                IntRect scrollBarRect = scrollbar()->frameRect();
+                if (scrollbarCapturingMouse() || scrollBarRect.contains(mousePoint)) {
+                    // Put the point into coordinates relative to the scroll bar
+                    mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
+                    PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
+                    scrollbar()->mouseMoved(event);
+                    break;
                 }
+            }
 
-                BOOL shouldHotTrack = FALSE;
+            BOOL shouldHotTrack = FALSE;
 #if !PLATFORM(WINCE)
-                ::SystemParametersInfo(SPI_GETHOTTRACKING, 0, &shouldHotTrack, 0);
+            ::SystemParametersInfo(SPI_GETHOTTRACKING, 0, &shouldHotTrack, 0);
 #endif
 
-                RECT bounds;
-                GetClientRect(popup->popupHandle(), &bounds);
-                if ((shouldHotTrack || wParam & MK_LBUTTON) && ::PtInRect(&bounds, mousePoint))
-                    popup->setFocusedIndex(popup->listIndexAtPoint(mousePoint), true);
+            RECT bounds;
+            GetClientRect(popupHandle(), &bounds);
+            if (!::PtInRect(&bounds, mousePoint) && !(wParam & MK_LBUTTON) && client()) {
+                // When the mouse is not inside the popup menu and the left button isn't down, just
+                // repost the message to the web view.
 
-                // Release capture if the left button isn't down, and the mousePoint is outside the popup window.
-                // This way, the WebView will get future mouse events in the rest of the window.
-                if (!(wParam & MK_LBUTTON) && !::PtInRect(&bounds, mousePoint)) {
-                    ::ReleaseCapture();
-                    break;
-                }
+                // Translate the coordinate.
+                translatePoint(lParam, m_popup, client()->hostWindow()->platformPageClient());
+
+                ::PostMessage(m_popup, WM_HOST_WINDOW_MOUSEMOVE, wParam, lParam);
+                break;
             }
+
+            if ((shouldHotTrack || wParam & MK_LBUTTON) && ::PtInRect(&bounds, mousePoint))
+                setFocusedIndex(listIndexAtPoint(mousePoint), true);
+
             break;
-        case WM_LBUTTONDOWN:
-            if (popup) {
-                ::SetCapture(popup->popupHandle());
-                IntPoint mousePoint(MAKEPOINTS(lParam));
-                if (popup->scrollbar()) {
-                    IntRect scrollBarRect = popup->scrollbar()->frameRect();
-                    if (scrollBarRect.contains(mousePoint)) {
-                        // Put the point into coordinates relative to the scroll bar
-                        mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
-                        PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
-                        popup->scrollbar()->mouseDown(event);
-                        popup->setScrollbarCapturingMouse(true);
-                        break;
-                    }
+        }
+        case WM_LBUTTONDOWN: {
+            IntPoint mousePoint(MAKEPOINTS(lParam));
+            if (scrollbar()) {
+                IntRect scrollBarRect = scrollbar()->frameRect();
+                if (scrollBarRect.contains(mousePoint)) {
+                    // Put the point into coordinates relative to the scroll bar
+                    mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
+                    PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
+                    scrollbar()->mouseDown(event);
+                    setScrollbarCapturingMouse(true);
+                    break;
                 }
-
-                popup->setFocusedIndex(popup->listIndexAtPoint(mousePoint), true);
             }
+
+            // If the mouse is inside the window, update the focused index. Otherwise, 
+            // hide the popup.
+            RECT bounds;
+            GetClientRect(m_popup, &bounds);
+            if (::PtInRect(&bounds, mousePoint))
+                setFocusedIndex(listIndexAtPoint(mousePoint), true);
+            else
+                hide();
             break;
-        case WM_LBUTTONUP:
-            if (popup) {
-                IntPoint mousePoint(MAKEPOINTS(lParam));
-                if (popup->scrollbar()) {
-                    ::ReleaseCapture();
-                    IntRect scrollBarRect = popup->scrollbar()->frameRect();
-                    if (popup->scrollbarCapturingMouse() || scrollBarRect.contains(mousePoint)) {
-                        popup->setScrollbarCapturingMouse(false);
-                        // Put the point into coordinates relative to the scroll bar
-                        mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
-                        PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
-                        popup->scrollbar()->mouseUp();
-                        // FIXME: This is a hack to work around Scrollbar not invalidating correctly when it doesn't have a parent widget
-                        RECT r = scrollBarRect;
-                        ::InvalidateRect(popup->popupHandle(), &r, TRUE);
-                        break;
-                    }
-                }
-                // Only release capture and hide the popup if the mouse is inside the popup window.
-                RECT bounds;
-                GetClientRect(popup->popupHandle(), &bounds);
-                if (popup->client() && ::PtInRect(&bounds, mousePoint)) {
-                    ::ReleaseCapture();
-                    popup->client()->hidePopup();
-                    int index = popup->focusedIndex();
-                    if (index >= 0)
-                        popup->client()->valueChanged(index);
+        }
+        case WM_LBUTTONUP: {
+            IntPoint mousePoint(MAKEPOINTS(lParam));
+            if (scrollbar()) {
+                IntRect scrollBarRect = scrollbar()->frameRect();
+                if (scrollbarCapturingMouse() || scrollBarRect.contains(mousePoint)) {
+                    setScrollbarCapturingMouse(false);
+                    // Put the point into coordinates relative to the scroll bar
+                    mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
+                    PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
+                    scrollbar()->mouseUp();
+                    // FIXME: This is a hack to work around Scrollbar not invalidating correctly when it doesn't have a parent widget
+                    RECT r = scrollBarRect;
+                    ::InvalidateRect(popupHandle(), &r, TRUE);
+                    break;
                 }
             }
+            // Only hide the popup if the mouse is inside the popup window.
+            RECT bounds;
+            GetClientRect(popupHandle(), &bounds);
+            if (client() && ::PtInRect(&bounds, mousePoint)) {
+                hide();
+                int index = focusedIndex();
+                if (index >= 0)
+                    client()->valueChanged(index);
+            }
             break;
-        case WM_MOUSEWHEEL:
-            if (popup && popup->scrollbar()) {
-                int i = 0;
-                for (popup->incrementWheelDelta(GET_WHEEL_DELTA_WPARAM(wParam)); abs(popup->wheelDelta()) >= WHEEL_DELTA; popup->reduceWheelDelta(WHEEL_DELTA))
-                    if (popup->wheelDelta() > 0)
-                        ++i;
-                    else
-                        --i;
+        }
+
+        case WM_MOUSEWHEEL: {
+            if (!scrollbar())
+                break;
 
-                popup->scrollbar()->scroll(i > 0 ? ScrollUp : ScrollDown, ScrollByLine, abs(i));
+            int i = 0;
+            for (incrementWheelDelta(GET_WHEEL_DELTA_WPARAM(wParam)); abs(wheelDelta()) >= WHEEL_DELTA; reduceWheelDelta(WHEEL_DELTA)) {
+                if (wheelDelta() > 0)
+                    ++i;
+                else
+                    --i;
             }
+            scrollbar()->scroll(i > 0 ? ScrollUp : ScrollDown, ScrollByLine, abs(i));
             break;
-        case WM_PAINT:
-            if (popup) {
-                PAINTSTRUCT paintInfo;
-                ::BeginPaint(popup->popupHandle(), &paintInfo);
-                popup->paint(paintInfo.rcPaint, paintInfo.hdc);
-                ::EndPaint(popup->popupHandle(), &paintInfo);
-                lResult = 0;
-            }
+        }
+
+        case WM_PAINT: {
+            PAINTSTRUCT paintInfo;
+            ::BeginPaint(popupHandle(), &paintInfo);
+            paint(paintInfo.rcPaint, paintInfo.hdc);
+            ::EndPaint(popupHandle(), &paintInfo);
+            lResult = 0;
             break;
+        }
 #if !PLATFORM(WINCE)
         case WM_PRINTCLIENT:
-            if (popup)
-                popup->paint(popup->clientRect(), (HDC)wParam);
+            paint(clientRect(), (HDC)wParam);
             break;
 #endif
         default:
diff --git a/WebCore/platform/win/SharedBufferWin.cpp b/WebCore/platform/win/SharedBufferWin.cpp
index ce93402..1839c99 100644
--- a/WebCore/platform/win/SharedBufferWin.cpp
+++ b/WebCore/platform/win/SharedBufferWin.cpp
@@ -38,8 +38,8 @@ PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String& fi
 
     String nullifiedPath = filePath;
     FILE* fileDescriptor = 0;
-    if (_wfopen_s(&fileDescriptor, nullifiedPath.charactersWithNullTermination(), TEXT("r+b")) || !fileDescriptor) {
-        LOG_ERROR("Failed to open file %s to create shared buffer", filePath.ascii().data());
+    if (_wfopen_s(&fileDescriptor, nullifiedPath.charactersWithNullTermination(), TEXT("rb")) || !fileDescriptor) {
+        LOG_ERROR("Failed to open file %s to create shared buffer, errno(%i)", filePath.ascii().data(), errno);
         return 0;
     }
 
diff --git a/WebCore/platform/win/SharedTimerWin.cpp b/WebCore/platform/win/SharedTimerWin.cpp
index da27a53..bc634f9 100644
--- a/WebCore/platform/win/SharedTimerWin.cpp
+++ b/WebCore/platform/win/SharedTimerWin.cpp
@@ -27,6 +27,7 @@
 #include "SharedTimer.h"
 
 #include "Page.h"
+#include "Settings.h"
 #include "Widget.h"
 #include <wtf/Assertions.h>
 #include <wtf/CurrentTime.h>
@@ -160,35 +161,38 @@ void setSharedTimerFireTime(double fireTime)
             intervalInMS = (unsigned)interval;
     }
 
-    if (interval < highResolutionThresholdMsec) {
-        if (!highResTimerActive) {
-            highResTimerActive = true;
-            timeBeginPeriod(timerResolution);
-        }
-        SetTimer(timerWindowHandle, endHighResTimerID, stopHighResTimerInMsec, 0);
-    }
-
     initializeOffScreenTimerWindow();
     bool timerSet = false;
-    DWORD queueStatus = LOWORD(GetQueueStatus(QS_PAINT | QS_MOUSEBUTTON | QS_KEY | QS_RAWINPUT));
-
-    // Win32 has a tri-level queue with application messages > user input > WM_PAINT/WM_TIMER.
-
-    // If the queue doesn't contains input events, we use a higher priorty timer event posting mechanism.
-    if (!(queueStatus & (QS_MOUSEBUTTON | QS_KEY | QS_RAWINPUT))) {
-        if (intervalInMS < USER_TIMER_MINIMUM && !processingCustomTimerMessage && !(queueStatus & QS_PAINT)) {
-            // Call PostMessage immediately if the timer is already expired, unless a paint is pending.
-            // (we prioritize paints over timers)
-            if (InterlockedIncrement(&pendingTimers) == 1)
-                PostMessage(timerWindowHandle, timerFiredMessage, 0, 0);
-            timerSet = true;
-        } else {
-            // Otherwise, delay the PostMessage via a CreateTimerQueueTimer
-            if (!timerQueue)
-                timerQueue = CreateTimerQueue();
-            if (timer)
-                DeleteTimerQueueTimer(timerQueue, timer, 0);
-            timerSet = CreateTimerQueueTimer(&timer, timerQueue, queueTimerProc, 0, intervalInMS, 0, WT_EXECUTEINTIMERTHREAD | WT_EXECUTEONLYONCE);
+
+    if (Settings::shouldUseHighResolutionTimers()) {
+        if (interval < highResolutionThresholdMsec) {
+            if (!highResTimerActive) {
+                highResTimerActive = true;
+                timeBeginPeriod(timerResolution);
+            }
+            SetTimer(timerWindowHandle, endHighResTimerID, stopHighResTimerInMsec, 0);
+        }
+
+        DWORD queueStatus = LOWORD(GetQueueStatus(QS_PAINT | QS_MOUSEBUTTON | QS_KEY | QS_RAWINPUT));
+
+        // Win32 has a tri-level queue with application messages > user input > WM_PAINT/WM_TIMER.
+
+        // If the queue doesn't contains input events, we use a higher priorty timer event posting mechanism.
+        if (!(queueStatus & (QS_MOUSEBUTTON | QS_KEY | QS_RAWINPUT))) {
+            if (intervalInMS < USER_TIMER_MINIMUM && !processingCustomTimerMessage && !(queueStatus & QS_PAINT)) {
+                // Call PostMessage immediately if the timer is already expired, unless a paint is pending.
+                // (we prioritize paints over timers)
+                if (InterlockedIncrement(&pendingTimers) == 1)
+                    PostMessage(timerWindowHandle, timerFiredMessage, 0, 0);
+                timerSet = true;
+            } else {
+                // Otherwise, delay the PostMessage via a CreateTimerQueueTimer
+                if (!timerQueue)
+                    timerQueue = CreateTimerQueue();
+                if (timer)
+                    DeleteTimerQueueTimer(timerQueue, timer, 0);
+                timerSet = CreateTimerQueueTimer(&timer, timerQueue, queueTimerProc, 0, intervalInMS, 0, WT_EXECUTEINTIMERTHREAD | WT_EXECUTEONLYONCE);
+            }
         }
     }
 
diff --git a/WebCore/platform/wince/CursorWince.cpp b/WebCore/platform/wince/CursorWince.cpp
new file mode 100644
index 0000000..e35f1f9
--- /dev/null
+++ b/WebCore/platform/wince/CursorWince.cpp
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2008-2009 Torch Mobile Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "Cursor.h"
+
+namespace WebCore {
+
+struct AllCursors {
+    AllCursors()
+    {
+        for (int i = 0; i < NumCursorTypes; ++i)
+            m_cursors[i] = (CursorType) i;
+    }
+    Cursor m_cursors[NumCursorTypes];
+};
+
+static const Cursor& getCursor(CursorType type)
+{
+    static AllCursors allCursors;
+    return allCursors.m_cursors[type];
+}
+
+Cursor::Cursor(const Cursor& other)
+: m_impl(other.m_impl)
+{
+}
+
+Cursor::Cursor(Image* img, const IntPoint& hotspot)
+: m_impl(CursorNone)
+{
+}
+
+Cursor::~Cursor()
+{
+}
+
+Cursor& Cursor::operator=(const Cursor& other)
+{
+    m_impl = other.m_impl;
+    return *this;
+}
+
+Cursor::Cursor(PlatformCursor c)
+: m_impl(c)
+{
+}
+
+const Cursor& noneCursor() { return getCursor(CursorNone); }
+const Cursor& pointerCursor() { return getCursor(CursorPointer); }
+const Cursor& crossCursor()  { return getCursor(CursorCross); }
+const Cursor& handCursor() { return getCursor(CursorHand); }
+const Cursor& iBeamCursor() { return getCursor(CursorBeam); }
+const Cursor& waitCursor() { return getCursor(CursorWait); }
+const Cursor& helpCursor() { return getCursor(CursorHelp); }
+const Cursor& moveCursor()  { return getCursor(CursorMove); }
+const Cursor& eastResizeCursor() { return getCursor(CursorEastResize); }
+const Cursor& northResizeCursor() { return getCursor(CursorNorthResize); }
+const Cursor& northEastResizeCursor() { return getCursor(CursorNorthEastResize); }
+const Cursor& northWestResizeCursor() { return getCursor(CursorNorthWestResize); }
+const Cursor& southResizeCursor() { return getCursor(CursorSouthResize); }
+const Cursor& southEastResizeCursor() { return getCursor(CursorSouthEastResize); }
+const Cursor& southWestResizeCursor() { return getCursor(CursorSouthWestResize); }
+const Cursor& westResizeCursor() { return getCursor(CursorWestResize); }
+const Cursor& northSouthResizeCursor() { return getCursor(CursorNorthSouthResize); }
+const Cursor& eastWestResizeCursor() { return getCursor(CursorEastWestResize); }
+const Cursor& northEastSouthWestResizeCursor() { return getCursor(CursorNorthEastSouthWestResize); }
+const Cursor& northWestSouthEastResizeCursor() { return getCursor(CursorNorthWestSouthEastResize); }
+const Cursor& columnResizeCursor() { return getCursor(CursorColumnResize); }
+const Cursor& rowResizeCursor() { return getCursor(CursorRowResize); }
+const Cursor& verticalTextCursor() { return getCursor(CursorVerticalText); }
+const Cursor& cellCursor() { return getCursor(CursorCell); }
+const Cursor& contextMenuCursor() { return getCursor(CursorContextMenu); }
+const Cursor& noDropCursor() { return getCursor(CursorNoDrop); }
+const Cursor& notAllowedCursor() { return getCursor(CursorNotAllowed); }
+const Cursor& progressCursor() { return getCursor(CursorProgress); }
+const Cursor& aliasCursor() { return getCursor(CursorAlias); }
+const Cursor& zoomInCursor() { return getCursor(CursorZoomIn); }
+const Cursor& zoomOutCursor() { return getCursor(CursorZoomOut); }
+const Cursor& copyCursor() { return getCursor(CursorCopy); }
+const Cursor& middlePanningCursor() { return crossCursor(); }
+const Cursor& eastPanningCursor() { return crossCursor(); }
+const Cursor& northPanningCursor() { return crossCursor(); }
+const Cursor& northEastPanningCursor() { return crossCursor(); }
+const Cursor& northWestPanningCursor() { return crossCursor(); }
+const Cursor& southPanningCursor() { return crossCursor(); }
+const Cursor& southEastPanningCursor() { return crossCursor(); }
+const Cursor& southWestPanningCursor() { return crossCursor(); }
+const Cursor& westPanningCursor() { return crossCursor(); }
+const Cursor& grabbingCursor() { return moveCursor(); }
+const Cursor& grabCursor() { return moveCursor(); }
+
+}
diff --git a/WebCore/platform/wince/DragDataWince.cpp b/WebCore/platform/wince/DragDataWince.cpp
new file mode 100644
index 0000000..881d7d4
--- /dev/null
+++ b/WebCore/platform/wince/DragDataWince.cpp
@@ -0,0 +1,90 @@
+/*
+ *  Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "DragData.h"
+
+#include "Clipboard.h"
+#include "DocumentFragment.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+PassRefPtr<Clipboard> DragData::createClipboard(ClipboardAccessPolicy policy) const
+{
+    return 0;
+}
+
+bool DragData::containsURL() const
+{
+    return false;
+}
+
+String DragData::asURL(String* title) const
+{
+    return String();
+}
+
+bool DragData::containsFiles() const
+{
+    return false;
+}
+
+void DragData::asFilenames(Vector<String>&) const
+{
+}
+
+bool DragData::containsPlainText() const
+{
+    return false;
+}
+
+String DragData::asPlainText() const
+{
+    return String();
+}
+
+bool DragData::containsColor() const
+{
+    return false;
+}
+
+bool DragData::canSmartReplace() const
+{
+    return false;
+}
+
+bool DragData::containsCompatibleContent() const
+{
+    return false;
+}
+
+PassRefPtr<DocumentFragment> DragData::asFragment(Document* doc) const
+{
+     return 0;
+}
+
+Color DragData::asColor() const
+{
+    return Color();
+}
+
+}
+
diff --git a/WebCore/platform/wince/DragImageWince.cpp b/WebCore/platform/wince/DragImageWince.cpp
new file mode 100644
index 0000000..4d60f80
--- /dev/null
+++ b/WebCore/platform/wince/DragImageWince.cpp
@@ -0,0 +1,63 @@
+/*
+ *  Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "DragImage.h"
+
+#include "CachedImage.h"
+#include "GraphicsContext.h"
+#include "Image.h"
+
+#include <windows.h>
+
+namespace WebCore {
+
+IntSize dragImageSize(DragImageRef)
+{
+    return IntSize(0, 0);
+}
+
+void deleteDragImage(DragImageRef image)
+{
+    if (image)
+        ::DeleteObject(image);
+}
+
+DragImageRef scaleDragImage(DragImageRef, FloatSize)
+{
+    return 0;
+}
+
+DragImageRef dissolveDragImageToFraction(DragImageRef image, float)
+{
+    return image;
+}
+
+DragImageRef createDragImageFromImage(Image*)
+{
+    return 0;
+}
+
+DragImageRef createDragImageIconForCachedImage(CachedImage*)
+{
+    return 0;
+}
+
+}
diff --git a/WebCore/platform/wince/EditorWince.cpp b/WebCore/platform/wince/EditorWince.cpp
new file mode 100644
index 0000000..02af780
--- /dev/null
+++ b/WebCore/platform/wince/EditorWince.cpp
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#include "Editor.h"
+
+#include "ClipboardWince.h"
+#include "Document.h"
+#include "EditorClient.h"
+#include "Element.h"
+#include "HtmlEditing.h"
+#include "TextIterator.h"
+#include "visible_units.h"
+
+#include <windows.h>
+#define _SYS_GUID_OPERATORS_
+
+namespace WebCore {
+
+PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
+{
+    return adoptRef(new ClipboardWince(policy, false));
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/wince/FileChooserWince.cpp b/WebCore/platform/wince/FileChooserWince.cpp
new file mode 100644
index 0000000..07c99b1
--- /dev/null
+++ b/WebCore/platform/wince/FileChooserWince.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FileChooser.h"
+
+#include "Chrome.h"
+#include "ChromeClient.h"
+#include "Document.h"
+#include "Frame.h"
+#include "Icon.h"
+#include "LocalizedStrings.h"
+#include "Page.h"
+#include "StringTruncator.h"
+
+namespace WebCore {
+
+String pathGetFileName(const String& path);
+
+String FileChooser::basenameForWidth(const Font& font, int width) const
+{
+    if (width <= 0)
+        return String();
+
+    String string;
+    if (m_filenames.isEmpty())
+        string = fileButtonNoFileSelectedLabel();
+    else if (m_filenames.size() == 1) {
+        String tmpFilename = m_filenames[0];
+        string = pathGetFileName(tmpFilename);
+    } else
+        return StringTruncator::rightTruncate(String::number(m_filenames.size()) + " files", width, font, false);
+
+    return StringTruncator::centerTruncate(string, width, font, false);
+}
+
+}
diff --git a/WebCore/platform/wince/FileSystemWince.cpp b/WebCore/platform/wince/FileSystemWince.cpp
new file mode 100644
index 0000000..2bb4dd5
--- /dev/null
+++ b/WebCore/platform/wince/FileSystemWince.cpp
@@ -0,0 +1,283 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Collabora, Ltd. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FileSystem.h"
+
+#include "CString.h"
+#include "PlatformString.h"
+
+#include <windows.h>
+#include <wincrypt.h>
+
+namespace WebCore {
+
+static bool getFileInfo(const String& path, BY_HANDLE_FILE_INFORMATION& fileInfo)
+{
+    String filename = path;
+    HANDLE hFile = CreateFile(filename.charactersWithNullTermination(), GENERIC_READ, FILE_SHARE_READ, 0
+        , OPEN_EXISTING, FILE_FLAG_NO_BUFFERING, 0);
+
+    if (hFile == INVALID_HANDLE_VALUE)
+        return false;
+
+    bool rtn = GetFileInformationByHandle(hFile, &fileInfo) ? true : false;
+
+    CloseHandle(hFile);
+    return rtn;
+}
+
+bool getFileSize(const String& path, long long& result)
+{
+    BY_HANDLE_FILE_INFORMATION fileInformation;
+    if (!getFileInfo(path, fileInformation))
+        return false;
+
+    ULARGE_INTEGER fileSize;
+    fileSize.LowPart = fileInformation.nFileSizeLow;
+    fileSize.HighPart = fileInformation.nFileSizeHigh;
+
+    result = fileSize.QuadPart;
+
+    return true;
+}
+
+bool getFileModificationTime(const String& path, time_t& result)
+{
+    BY_HANDLE_FILE_INFORMATION fileInformation;
+    if (!getFileInfo(path, fileInformation))
+        return false;
+
+    ULARGE_INTEGER t;
+    memcpy(&t, &fileInformation.ftLastWriteTime, sizeof(t));
+    
+    result = t.QuadPart * 0.0000001 - 11644473600.0;
+
+    return true;
+}
+
+bool fileExists(const String& path) 
+{
+    String filename = path;
+    HANDLE hFile = CreateFile(filename.charactersWithNullTermination(), 0, FILE_SHARE_READ | FILE_SHARE_WRITE
+        , 0, OPEN_EXISTING, FILE_FLAG_NO_BUFFERING, 0);
+
+    CloseHandle(hFile);
+
+    return hFile != INVALID_HANDLE_VALUE;
+}
+
+bool deleteFile(const String& path)
+{
+    String filename = path;
+    return !!DeleteFileW(filename.charactersWithNullTermination());
+}
+
+
+bool deleteEmptyDirectory(const String& path)
+{
+    String filename = path;
+    return !!RemoveDirectoryW(filename.charactersWithNullTermination());
+}
+
+String pathByAppendingComponent(const String& path, const String& component)
+{
+    if (component.isEmpty())
+        return path;
+
+    Vector<UChar, MAX_PATH> buffer;
+
+    buffer.append(path.characters(), path.length());
+
+    if (buffer.last() != L'\\' && buffer.last() != L'/'
+        && component[0] != L'\\' && component[0] != L'/')
+        buffer.append(L'\\');
+
+    buffer.append(component.characters(), component.length());
+
+    return String(buffer.data(), buffer.size());
+}
+
+CString fileSystemRepresentation(const String&)
+{
+    return "";
+}
+
+bool makeAllDirectories(const String& path)
+{
+    int lastDivPos = max(path.reverseFind('/'), path.reverseFind('\\'));
+    int endPos = path.length();
+    if (lastDivPos == path.length() - 1) {
+        endPos -= 1;
+        lastDivPos = max(path.reverseFind('/', lastDivPos), path.reverseFind('\\', lastDivPos));
+    }
+
+    if (lastDivPos > 0) {
+        if (!makeAllDirectories(path.substring(0, lastDivPos)))
+            return false;
+    }
+
+    String folder(path.substring(0, endPos));
+    CreateDirectory(folder.charactersWithNullTermination(), 0);
+
+    DWORD fileAttr = GetFileAttributes(folder.charactersWithNullTermination());
+    return fileAttr != 0xFFFFFFFF && (fileAttr & FILE_ATTRIBUTE_DIRECTORY);
+}
+
+String homeDirectoryPath()
+{
+    notImplemented();
+    return "";
+}
+
+String pathGetFileName(const String& path)
+{
+    return path.substring(max(path.reverseFind('/'), path.reverseFind('\\')) + 1);
+}
+
+String directoryName(const String& path)
+{
+    notImplemented();
+    return String();
+}
+
+CString openTemporaryFile(const char*, PlatformFileHandle& handle)
+{
+    handle = INVALID_HANDLE_VALUE;
+
+    wchar_t tempPath[MAX_PATH];
+    int tempPathLength = ::GetTempPath(_countof(tempPath), tempPath);
+    if (tempPathLength <= 0 || tempPathLength > _countof(tempPath))
+        return CString();
+
+    HCRYPTPROV hCryptProv = 0;
+    if (!CryptAcquireContext(&hCryptProv, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
+        return CString();
+
+    String proposedPath;
+    while (1) {
+
+        wchar_t tempFile[] = L"XXXXXXXX.tmp"; // Use 8.3 style name (more characters aren't helpful due to 8.3 short file names)
+        const int randomPartLength = 8;
+        if (!CryptGenRandom(hCryptProv, randomPartLength * 2, reinterpret_cast<BYTE*>(tempFile)))
+            break;
+
+        // Limit to valid filesystem characters, also excluding others that could be problematic, like punctuation.
+        // don't include both upper and lowercase since Windows file systems are typically not case sensitive.
+        const char validChars[] = "0123456789abcdefghijklmnopqrstuvwxyz";
+        for (int i = 0; i < randomPartLength; ++i)
+            tempFile[i] = validChars[tempFile[i] % (sizeof(validChars) - 1)];
+
+        ASSERT(wcslen(tempFile) * 2 == sizeof(tempFile) - 2);
+
+        proposedPath = pathByAppendingComponent(String(tempPath), String(tempFile));
+
+        // use CREATE_NEW to avoid overwriting an existing file with the same name
+        handle = CreateFile(proposedPath.charactersWithNullTermination(), GENERIC_READ | GENERIC_WRITE, 0, 0, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, 0);
+        if (!isHandleValid(handle) && GetLastError() == ERROR_ALREADY_EXISTS)
+            continue;
+
+        break;
+    }
+
+    CryptReleaseContext(hCryptProv, 0);
+
+    if (!isHandleValid(handle))
+        return CString();
+
+    return proposedPath.latin1();
+}
+
+void closeFile(PlatformFileHandle& handle)
+{
+    if (isHandleValid(handle)) {
+        ::CloseHandle(handle);
+        handle = invalidPlatformFileHandle;
+    }
+}
+
+int writeToFile(PlatformFileHandle handle, const char* data, int length)
+{
+    if (!isHandleValid(handle))
+        return -1;
+
+    DWORD bytesWritten;
+    bool success = WriteFile(handle, data, length, &bytesWritten, 0);
+
+    if (!success)
+        return -1;
+    return static_cast<int>(bytesWritten);
+}
+
+bool unloadModule(PlatformModule module)
+{
+    return ::FreeLibrary(module);
+}
+
+String localUserSpecificStorageDirectory()
+{
+    return String(L"\\");
+}
+
+String roamingUserSpecificStorageDirectory()
+{
+    return String(L"\\");
+}
+
+Vector<String> listDirectory(const String& path, const String& filter)
+{
+    Vector<String> entries;
+
+    Vector<UChar, 256> pattern;
+    pattern.append(path.characters(), path.length());
+    if (pattern.last() != L'/' && pattern.last() != L'\\')
+        pattern.append(L'\\');
+
+    String root(pattern.data(), pattern.size());
+    pattern.append(filter.characters(), filter.length());
+    pattern.append(0);
+
+    WIN32_FIND_DATA findData;
+    HANDLE hFind = FindFirstFile(pattern.data(), &findData);
+    if (INVALID_HANDLE_VALUE != hFind) {
+        do {
+            // FIXEME: should we also add the folders? This function
+            // is so far only called by PluginDatabase.cpp to list
+            // all plugins in a folder, where it's not supposed to list sub-folders.
+            if (!(findData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY))
+                entries.append(root + findData.cFileName);
+        } while (FindNextFile(hFind, &findData));
+        FindClose(hFind);
+    }
+
+    return entries;
+}
+
+}
diff --git a/WebCore/platform/wince/KURLWince.cpp b/WebCore/platform/wince/KURLWince.cpp
new file mode 100644
index 0000000..5ca1e4b
--- /dev/null
+++ b/WebCore/platform/wince/KURLWince.cpp
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "KURL.h"
+
+namespace WebCore {
+
+String KURL::fileSystemPath() const
+{
+    return path();
+}
+
+}
diff --git a/WebCore/platform/wince/KeygenWince.cpp b/WebCore/platform/wince/KeygenWince.cpp
new file mode 100644
index 0000000..b0f4d63
--- /dev/null
+++ b/WebCore/platform/wince/KeygenWince.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2008-2009 Torch Mobile Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "SSLKeyGenerator.h"
+
+#include "Base64.h"
+#include "CString.h"
+
+#include <windows.h>
+#include <wincrypt.h>
+
+namespace WebCore {
+
+void WebCore::getSupportedKeySizes(Vector<String>& v)
+{
+    v.append("High Grade");
+    v.append("Medium Grade");
+}
+
+String WebCore::signedPublicKeyAndChallengeString(unsigned index, const String& challenge, const KURL& url)
+{
+    String keyString;
+
+    HCRYPTPROV hContext = 0;
+    HCRYPTKEY hKey = 0;
+    PCERT_PUBLIC_KEY_INFO pPubInfo = 0;
+
+    // Try to delete it if it exists already
+    CryptAcquireContext(&hContext, _T("keygen_container"), MS_ENHANCED_PROV, PROV_RSA_FULL, CRYPT_DELETEKEYSET);
+
+    do {
+        if (!CryptAcquireContext(&hContext, _T("keygen_container"), MS_ENHANCED_PROV, PROV_RSA_FULL, CRYPT_NEWKEYSET))
+            break;
+
+        DWORD dwPubInfoLength = 0;
+        if (!CryptGenKey(hContext, AT_KEYEXCHANGE, 0, &hKey) || !CryptExportPublicKeyInfo(hContext, AT_KEYEXCHANGE, X509_ASN_ENCODING, 0, &dwPubInfoLength))
+            break;
+
+        // Use malloc instead of new, because malloc guarantees to return a pointer aligned for all data types.
+        pPubInfo = reinterpret_cast<PCERT_PUBLIC_KEY_INFO>(fastMalloc(dwPubInfoLength));
+
+        if (!CryptExportPublicKeyInfo(hContext, AT_KEYEXCHANGE, X509_ASN_ENCODING, pPubInfo, &dwPubInfoLength))
+            break;
+
+        CERT_KEYGEN_REQUEST_INFO requestInfo = { 0 };
+        requestInfo.dwVersion = CERT_KEYGEN_REQUEST_V1;
+        requestInfo.pwszChallengeString = L"";
+        requestInfo.SubjectPublicKeyInfo = *pPubInfo;
+
+        String localChallenge = challenge;
+
+        // Windows API won't write to our buffer, although it's not declared with const.
+        requestInfo.pwszChallengeString = const_cast<wchar_t*>(localChallenge.charactersWithNullTermination());
+
+        CRYPT_ALGORITHM_IDENTIFIER signAlgo = { 0 };
+        signAlgo.pszObjId = szOID_RSA_SHA1RSA;
+
+        DWORD dwEncodedLength;
+        if (!CryptSignAndEncodeCertificate(hContext, AT_KEYEXCHANGE, X509_ASN_ENCODING, X509_KEYGEN_REQUEST_TO_BE_SIGNED, &requestInfo, &signAlgo, 0, 0, &dwEncodedLength))
+            break;
+
+        Vector<char> binary(dwEncodedLength);
+        if (!CryptSignAndEncodeCertificate(hContext, AT_KEYEXCHANGE, X509_ASN_ENCODING, X509_KEYGEN_REQUEST_TO_BE_SIGNED, &requestInfo, &signAlgo, 0, reinterpret_cast<LPBYTE>(binary.data()), &dwEncodedLength))
+            break;
+
+        Vector<char> base64;
+        base64Encode(binary, base64);
+        keyString = String(base64.data(), base64.size());
+
+    } while(0);
+
+    if (pPubInfo)
+        fastFree(pPubInfo);
+       
+    if (hKey)
+        CryptDestroyKey(hKey);
+
+    if (hContext)
+        CryptReleaseContext(hContext, 0);
+
+    return keyString;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/wince/MIMETypeRegistryWince.cpp b/WebCore/platform/wince/MIMETypeRegistryWince.cpp
new file mode 100644
index 0000000..2ecde48
--- /dev/null
+++ b/WebCore/platform/wince/MIMETypeRegistryWince.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MIMETypeRegistry.h"
+
+#include <windows.h>
+#include <winreg.h>
+
+namespace WebCore {
+
+static String mimeTypeForExtension(const String& extension)
+{
+    String ext = "." + extension;
+    WCHAR contentTypeStr[256];
+    DWORD contentTypeStrLen = sizeof(contentTypeStr);
+    DWORD valueType;
+
+    HKEY key;
+    String result;
+    if (ERROR_SUCCESS != RegOpenKeyEx(HKEY_CLASSES_ROOT, ext.charactersWithNullTermination(), 0, 0, &key))
+        return result;
+
+    if (ERROR_SUCCESS == RegQueryValueEx(key, L"Content Type", 0, &valueType, (LPBYTE)contentTypeStr, &contentTypeStrLen) && valueType == REG_SZ)
+        result = String(contentTypeStr, contentTypeStrLen / sizeof(contentTypeStr[0]) - 1);
+
+    RegCloseKey(key);
+
+    return result;
+}
+
+static HashMap<String, String> mimetypeMap;
+
+static void initMIMETypeEntensionMap()
+{
+    if (mimetypeMap.isEmpty()) {
+        //fill with initial values
+        mimetypeMap.add("txt", "text/plain");
+        mimetypeMap.add("pdf", "application/pdf");
+        mimetypeMap.add("ps", "application/postscript");
+        mimetypeMap.add("html", "text/html");
+        mimetypeMap.add("htm", "text/html");
+        mimetypeMap.add("xml", "text/xml");
+        mimetypeMap.add("xsl", "text/xsl");
+        mimetypeMap.add("js", "application/x-javascript");
+        mimetypeMap.add("xhtml", "application/xhtml+xml");
+        mimetypeMap.add("rss", "application/rss+xml");
+        mimetypeMap.add("webarchive", "application/x-webarchive");
+        mimetypeMap.add("svg", "image/svg+xml");
+        mimetypeMap.add("svgz", "image/svg+xml");
+        mimetypeMap.add("jpg", "image/jpeg");
+        mimetypeMap.add("jpeg", "image/jpeg");
+        mimetypeMap.add("png", "image/png");
+        mimetypeMap.add("tif", "image/tiff");
+        mimetypeMap.add("tiff", "image/tiff");
+        mimetypeMap.add("ico", "image/ico");
+        mimetypeMap.add("cur", "image/ico");
+        mimetypeMap.add("bmp", "image/bmp");
+        mimetypeMap.add("css", "text/css");
+        // FIXME: Custom font works only when MIME is "text/plain"
+        mimetypeMap.add("ttf", "text/plain"); // "font/ttf"
+        mimetypeMap.add("otf", "text/plain"); // "font/otf"
+#if ENABLE(WML)
+        mimetypeMap.add("wml", "text/vnd.wap.wml");
+#endif
+#if ENABLE(WBXML)
+        mimetypeMap.add("wbxml", "application/vnd.wap.wmlc");
+#endif
+    }
+}
+
+String MIMETypeRegistry::getPreferredExtensionForMIMEType(const String& type)
+{
+    if (type.isEmpty())
+        return String();
+
+    // Avoid conflicts with "ttf" and "otf"
+    if (equalIgnoringCase(type, "text/plain"))
+        return "txt";
+
+    initMIMETypeEntensionMap();
+
+    for (HashMap<String, String>::iterator i = mimetypeMap.begin(); i != mimetypeMap.end(); ++i) {
+        if (equalIgnoringCase(i->second, type))
+            return i->first;
+    }
+
+#if ENABLE(XHTMLMP)
+    if (equalIgnoringCase("application/vnd.wap.xhtml+xml", type))
+        return String("xml");
+#endif
+
+    return String();
+}
+
+String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
+{
+    if (ext.isEmpty())
+        return String();
+
+    initMIMETypeEntensionMap();
+
+    String result = mimetypeMap.get(ext.lower());
+    if (result.isEmpty()) {
+        result = mimeTypeForExtension(ext);
+        if (!result.isEmpty())
+            mimetypeMap.add(ext, result);
+    }
+    return result.isEmpty() ? "unknown/unknown" : result;
+}
+
+}
diff --git a/WebCore/platform/wince/PasteboardWince.cpp b/WebCore/platform/wince/PasteboardWince.cpp
new file mode 100644
index 0000000..16f4968
--- /dev/null
+++ b/WebCore/platform/wince/PasteboardWince.cpp
@@ -0,0 +1,330 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#include "config.h"
+#include "Pasteboard.h"
+
+#include "CString.h"
+#include "ClipboardUtilitiesWin.h"
+#include "Document.h"
+#include "DocumentFragment.h"
+#include "Element.h"
+#include "Frame.h"
+#include "HitTestResult.h"
+#include "Image.h"
+#include "KURL.h"
+#include "Page.h"
+#include "Range.h"
+#include "RenderImage.h"
+#include "TextEncoding.h"
+#include "markup.h"
+
+namespace WebCore {
+
+static UINT HTMLClipboardFormat = 0;
+static UINT BookmarkClipboardFormat = 0;
+static UINT WebSmartPasteFormat = 0;
+
+extern HDC hScreenDC;
+
+static LRESULT CALLBACK PasteboardOwnerWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+{
+    LRESULT lresult = 0;
+    LONG longPtr = GetWindowLong(hWnd, 0);
+
+    switch (message) {
+    case WM_RENDERFORMAT:
+        // This message comes when SetClipboardData was sent a null data handle
+        // and now it's come time to put the data on the clipboard.
+        break;
+    case WM_RENDERALLFORMATS:
+        // This message comes when SetClipboardData was sent a null data handle
+        // and now this application is about to quit, so it must put data on
+        // the clipboard before it exits.
+        break;
+    case WM_DESTROY:
+        break;
+    default:
+        lresult = DefWindowProc(hWnd, message, wParam, lParam);
+        break;
+    }
+    return lresult;
+}
+
+Pasteboard* Pasteboard::generalPasteboard()
+{
+    static Pasteboard* pasteboard = new Pasteboard;
+    return pasteboard;
+}
+
+Pasteboard::Pasteboard()
+{
+    // make a dummy HWND to be the Windows clipboard's owner
+    WNDCLASS wc = {0};
+    memset(&wc, 0, sizeof(wc));
+    wc.lpfnWndProc    = PasteboardOwnerWndProc;
+    wc.hInstance      = Page::instanceHandle();
+    wc.lpszClassName  = L"PasteboardOwnerWindowClass";
+    ::RegisterClass(&wc);
+
+    m_owner = ::CreateWindow(L"PasteboardOwnerWindowClass", L"PasteboardOwnerWindow", 0, 0, 0, 0, 0,
+        HWND_MESSAGE, 0, 0, 0);
+
+    HTMLClipboardFormat = ::RegisterClipboardFormat(L"HTML Format");
+    BookmarkClipboardFormat = ::RegisterClipboardFormat(L"UniformResourceLocatorW");
+    WebSmartPasteFormat = ::RegisterClipboardFormat(L"WebKit Smart Paste Format");
+}
+
+void Pasteboard::clear()
+{
+    if (::OpenClipboard(m_owner)) {
+        ::EmptyClipboard();
+        ::CloseClipboard();
+    }
+}
+
+void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
+{
+    clear();
+
+    // Put CF_HTML format on the pasteboard
+    if (::OpenClipboard(m_owner)) {
+        ExceptionCode ec = 0;
+        Vector<char> data;
+        markupToCF_HTML(createMarkup(selectedRange, 0, AnnotateForInterchange), selectedRange->startContainer(ec)->document()->url(), data);
+        HGLOBAL cbData = createGlobalData(data);
+        if (!::SetClipboardData(HTMLClipboardFormat, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+
+    // Put plain string on the pasteboard. CF_UNICODETEXT covers CF_TEXT as well
+    String str = frame->selectedText();
+    replaceNewlinesWithWindowsStyleNewlines(str);
+    replaceNBSPWithSpace(str);
+    if (::OpenClipboard(m_owner)) {
+        HGLOBAL cbData = createGlobalData(str);
+        if (!::SetClipboardData(CF_UNICODETEXT, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+
+    // enable smart-replacing later on by putting dummy data on the pasteboard
+    if (canSmartCopyOrDelete) {
+        if (::OpenClipboard(m_owner)) {
+            ::SetClipboardData(WebSmartPasteFormat, 0);
+            ::CloseClipboard();
+        }
+    }
+}
+
+void Pasteboard::writePlainText(const String& text)
+{
+    clear();
+
+    // Put plain string on the pasteboard. CF_UNICODETEXT covers CF_TEXT as well
+    String str = text;
+    replaceNewlinesWithWindowsStyleNewlines(str);
+    if (::OpenClipboard(m_owner)) {
+        HGLOBAL cbData = createGlobalData(str);
+        if (!::SetClipboardData(CF_UNICODETEXT, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+}
+
+void Pasteboard::writeURL(const KURL& url, const String& titleStr, Frame* frame)
+{
+    ASSERT(!url.isEmpty());
+
+    clear();
+
+    String title(titleStr);
+    if (title.isEmpty()) {
+        title = url.lastPathComponent();
+        if (title.isEmpty())
+            title = url.host();
+    }
+
+    // write to clipboard in format com.apple.safari.bookmarkdata to be able to paste into the bookmarks view with appropriate title
+    if (::OpenClipboard(m_owner)) {
+        HGLOBAL cbData = createGlobalData(url, title);
+        if (!::SetClipboardData(BookmarkClipboardFormat, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+
+    // write to clipboard in format CF_HTML to be able to paste into contenteditable areas as a link
+    if (::OpenClipboard(m_owner)) {
+        Vector<char> data;
+        markupToCF_HTML(urlToMarkup(url, title), "", data);
+        HGLOBAL cbData = createGlobalData(data);
+        if (!::SetClipboardData(HTMLClipboardFormat, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+
+    // bare-bones CF_UNICODETEXT support
+    if (::OpenClipboard(m_owner)) {
+        HGLOBAL cbData = createGlobalData(url.string());
+        if (!::SetClipboardData(CF_UNICODETEXT, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+}
+
+void Pasteboard::writeImage(Node* node, const KURL&, const String&)
+{
+    ASSERT(node && node->renderer() && node->renderer()->isImage());
+    RenderImage* renderer = static_cast<RenderImage*>(node->renderer());
+    CachedImage* cachedImage = static_cast<CachedImage*>(renderer->cachedImage());
+    ASSERT(cachedImage);
+    Image* image = cachedImage->image();
+    ASSERT(image);
+
+    clear();
+
+    RefPtr<SharedBitmap> sourceBmp = image->nativeImageForCurrentFrame();
+    if (!sourceBmp)
+        return;
+
+    IntRect rect(0, 0, sourceBmp->width(), sourceBmp->height());
+    BitmapInfo bmpInfo;
+    void* pixels;
+    HBITMAP resultBitmap = sourceBmp->clipBitmap(rect, true, bmpInfo, pixels);
+    if (!resultBitmap)
+        return;
+
+    if (::OpenClipboard(m_owner)) {
+        ::SetClipboardData(CF_BITMAP, resultBitmap);
+        ::CloseClipboard();
+    } else
+        DeleteObject(resultBitmap);
+}
+
+bool Pasteboard::canSmartReplace()
+{
+    return ::IsClipboardFormatAvailable(WebSmartPasteFormat);
+}
+
+String Pasteboard::plainText(Frame* frame)
+{
+    if (::IsClipboardFormatAvailable(CF_UNICODETEXT) && ::OpenClipboard(m_owner)) {
+        HANDLE cbData = ::GetClipboardData(CF_UNICODETEXT);
+        if (cbData) {
+            UChar* buffer = (UChar*)GlobalLock(cbData);
+            String fromClipboard(buffer);
+            GlobalUnlock(cbData);
+            CloseClipboard();
+            return fromClipboard;
+        } else
+            CloseClipboard();
+    }
+
+    if (::IsClipboardFormatAvailable(CF_TEXT) && ::OpenClipboard(m_owner)) {
+        HANDLE cbData = ::GetClipboardData(CF_TEXT);
+        if (cbData) {
+            char* buffer = (char*)GlobalLock(cbData);
+            String fromClipboard(buffer);
+            GlobalUnlock(cbData);
+            CloseClipboard();
+            return fromClipboard;
+        } else
+            CloseClipboard();
+    }
+
+    return String();
+}
+
+PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefPtr<Range> context, bool allowPlainText, bool& chosePlainText)
+{
+    chosePlainText = false;
+
+    if (::IsClipboardFormatAvailable(HTMLClipboardFormat) && ::OpenClipboard(m_owner)) {
+        // get data off of clipboard
+        HANDLE cbData = ::GetClipboardData(HTMLClipboardFormat);
+        if (cbData) {
+            SIZE_T dataSize = ::GlobalSize(cbData);
+            String cf_html(UTF8Encoding().decode((char*)GlobalLock(cbData), dataSize));
+            GlobalUnlock(cbData);
+            CloseClipboard();
+
+            PassRefPtr<DocumentFragment> fragment = fragmentFromCF_HTML(frame->document(), cf_html);
+            if (fragment)
+                return fragment;
+        } else
+            CloseClipboard();
+    }
+
+    if (allowPlainText && IsClipboardFormatAvailable(CF_UNICODETEXT)) {
+        chosePlainText = true;
+        if (OpenClipboard(m_owner)) {
+            HANDLE cbData = GetClipboardData(CF_UNICODETEXT);
+            if (cbData) {
+                UChar* buffer = (UChar*)GlobalLock(cbData);
+                String str(buffer);
+                GlobalUnlock(cbData);
+                CloseClipboard();
+                RefPtr<DocumentFragment> fragment = createFragmentFromText(context.get(), str);
+                if (fragment)
+                    return fragment.release();
+            } else
+                CloseClipboard();
+        }
+    }
+
+    if (allowPlainText && ::IsClipboardFormatAvailable(CF_TEXT)) {
+        chosePlainText = true;
+        if (::OpenClipboard(m_owner)) {
+            HANDLE cbData = ::GetClipboardData(CF_TEXT);
+            if (cbData) {
+                char* buffer = (char*)GlobalLock(cbData);
+                String str(buffer);
+                GlobalUnlock(cbData);
+                CloseClipboard();
+                RefPtr<DocumentFragment> fragment = createFragmentFromText(context.get(), str);
+                if (fragment)
+                    return fragment.release();
+            } else
+                CloseClipboard();
+        }
+    }
+
+    return 0;
+}
+
+bool Pasteboard::hasData()
+{
+    return hasDataInFormat(CF_UNICODETEXT) || hasDataInFormat(CF_TEXT);
+}
+
+bool Pasteboard::hasDataInFormat(unsigned int format)
+{
+    return ::IsClipboardFormatAvailable(format);
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/wince/SearchPopupMenuWince.cpp b/WebCore/platform/wince/SearchPopupMenuWince.cpp
new file mode 100644
index 0000000..ca11292
--- /dev/null
+++ b/WebCore/platform/wince/SearchPopupMenuWince.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "SearchPopupMenu.h"
+
+#include "AtomicString.h"
+
+namespace WebCore {
+
+SearchPopupMenu::SearchPopupMenu(PopupMenuClient* client)
+: PopupMenu(client)
+{
+}
+
+bool SearchPopupMenu::enabled()
+{
+    return false;
+}
+
+void SearchPopupMenu::saveRecentSearches(const AtomicString& name, const Vector<String>& searchItems)
+{
+    if (name.isEmpty())
+        return;
+
+    notImplemented();
+}
+
+void SearchPopupMenu::loadRecentSearches(const AtomicString& name, Vector<String>& searchItems)
+{
+    if (name.isEmpty())
+        return;
+
+    notImplemented();
+}
+
+}
diff --git a/WebCore/platform/wince/SharedTimerWince.cpp b/WebCore/platform/wince/SharedTimerWince.cpp
new file mode 100644
index 0000000..ca2f104
--- /dev/null
+++ b/WebCore/platform/wince/SharedTimerWince.cpp
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SharedTimer.h"
+
+#include "Page.h"
+#include "SystemTime.h"
+#include "Widget.h"
+#include <wtf/Assertions.h>
+#include <wtf/CurrentTime.h>
+#include <windows.h>
+
+namespace JSC {
+extern void* g_stackBase;
+}
+
+namespace WebCore {
+
+enum {
+    TimerIdNone = 0,
+    TimerIdAuto,
+    TimerIdManual,
+};
+static UINT timerID = TimerIdNone;
+
+static void (*sharedTimerFiredFunction)();
+
+static HWND timerWindowHandle = 0;
+const LPCWSTR kTimerWindowClassName = L"TimerWindowClass";
+
+LRESULT CALLBACK TimerWindowWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+{
+    int dummy;
+    JSC::g_stackBase = &dummy;
+
+    if (message == WM_TIMER) {
+        if (timerID != TimerIdNone)
+            sharedTimerFiredFunction();
+    } else if (message == WM_USER)    {
+        if (timerID = TimerIdManual) {
+            sharedTimerFiredFunction();
+            PostMessage(hWnd, WM_USER, 0, 0);
+        }
+    } else {
+        JSC::g_stackBase = 0;
+        return DefWindowProc(hWnd, message, wParam, lParam);
+    }
+    JSC::g_stackBase = 0;
+    return 0;
+}
+
+static void initializeOffScreenTimerWindow()
+{
+    if (timerWindowHandle)
+        return;
+
+    WNDCLASS wcex = {0};
+    wcex.lpfnWndProc    = TimerWindowWndProc;
+    wcex.hInstance      = Page::instanceHandle();
+    wcex.lpszClassName  = kTimerWindowClassName;
+    RegisterClass(&wcex);
+
+    timerWindowHandle = CreateWindow(kTimerWindowClassName, 0, 0,
+       CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, HWND_MESSAGE, 0, Page::instanceHandle(), 0);
+}
+
+void setSharedTimerFiredFunction(void (*f)())
+{
+    sharedTimerFiredFunction = f;
+}
+
+#define USER_TIMER_MAXIMUM  0x7FFFFFFF
+#define USER_TIMER_MINIMUM  0x0000000A
+
+void setSharedTimerFireTime(double fireTime)
+{
+    ASSERT(sharedTimerFiredFunction);
+
+    double interval = (fireTime - currentTime()) * 1000.;
+    unsigned intervalInMS = interval < USER_TIMER_MINIMUM
+        ? USER_TIMER_MINIMUM
+        : interval > USER_TIMER_MAXIMUM
+        ? USER_TIMER_MAXIMUM
+        : static_cast<unsigned>(interval);
+
+    if (timerID == TimerIdAuto) {
+        KillTimer(timerWindowHandle, TimerIdAuto);
+        timerID = TimerIdNone;
+    }
+
+    initializeOffScreenTimerWindow();
+    if (SetTimer(timerWindowHandle, TimerIdAuto, intervalInMS, 0))
+        timerID = TimerIdAuto;
+    else if (timerID != TimerIdManual)
+        PostMessage(timerWindowHandle, WM_USER, 0, 0);
+}
+
+void stopSharedTimer()
+{
+    if (timerID == TimerIdAuto)
+        KillTimer(timerWindowHandle, TimerIdAuto);
+
+    timerID = TimerIdNone;
+}
+
+}
diff --git a/WebCore/platform/wince/SystemTimeWince.cpp b/WebCore/platform/wince/SystemTimeWince.cpp
new file mode 100644
index 0000000..70b705b
--- /dev/null
+++ b/WebCore/platform/wince/SystemTimeWince.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SystemTime.h"
+
+#include <windows.h>
+
+namespace WebCore {
+
+float userIdleTime()
+{
+    return FLT_MAX;
+}
+
+}
diff --git a/WebCore/platform/wx/CursorWx.cpp b/WebCore/platform/wx/CursorWx.cpp
index 7175b01..ed7f86b 100644
--- a/WebCore/platform/wx/CursorWx.cpp
+++ b/WebCore/platform/wx/CursorWx.cpp
@@ -298,4 +298,10 @@ const Cursor& grabbingCursor()
     return pointerCursor();
 }
 
+const Cursor& moveCursor()
+{
+    static Cursor c = new wxCursor(wxCURSOR_SIZING);
+    return c;
+}
+
 }
diff --git a/WebCore/platform/wx/FileChooserWx.cpp b/WebCore/platform/wx/FileChooserWx.cpp
new file mode 100644
index 0000000..34065f3
--- /dev/null
+++ b/WebCore/platform/wx/FileChooserWx.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FileChooser.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+String FileChooser::basenameForWidth(const Font&, int width) const
+{
+    notImplemented();
+    return String();
+}
+
+}
+
diff --git a/WebCore/platform/wx/FileSystemWx.cpp b/WebCore/platform/wx/FileSystemWx.cpp
index 7de425e..109278f 100644
--- a/WebCore/platform/wx/FileSystemWx.cpp
+++ b/WebCore/platform/wx/FileSystemWx.cpp
@@ -40,50 +40,50 @@ namespace WebCore {
 
 bool fileExists(const String& path)
 {
-    notImplemented();
-    return true;
+    return wxFileName::FileExists(path);
 }
 
 bool deleteFile(const String& path)
 {
-    notImplemented();
-    return false;
+    return wxRemoveFile(path);
 }
 
 bool deleteEmptyDirectory(const String& path)
 {
-    notImplemented();
-    return false;
+    return wxFileName::Rmdir(path);
 }
 
 bool getFileSize(const String& path, long long& resultSize)
 {
-    notImplemented();
+    wxULongLong size = wxFileName::GetSize(path);
+    if (wxInvalidSize != size) {
+        // TODO: why is FileSystem::getFileSize signed?
+        resultSize = (long long)size.GetValue();
+        return true;
+    }
+
     return false;
 }
 
-bool getFileModificationTime(const String&, time_t&)
+bool getFileModificationTime(const String& path, time_t& t)
 {
-    notImplemented();
-    return false;
+    t = wxFileName(path).GetModificationTime().GetTicks();
+    return true;
 }
 
 bool makeAllDirectories(const String& path)
 {
-    notImplemented();
-    return false;
+    return wxFileName::Mkdir(path, 0777, wxPATH_MKDIR_FULL);
 }
 
 String pathByAppendingComponent(const String& path, const String& component)
 {
-    notImplemented();
-    return String();
+    return wxFileName(path, component).GetFullPath();
 }
 
 String homeDirectoryPath()
 {
-    notImplemented();
-    return String();
+    return wxFileName::GetHomeDir();
 }
 
 String pathGetFileName(const String& path)
@@ -93,8 +93,7 @@ String pathGetFileName(const String& path)
 
 String directoryName(const String& path)
 {
-    notImplemented();
-    return String();
+    return wxFileName(path).GetPath();
 }
 
 CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
diff --git a/WebCore/platform/wx/KURLWx.cpp b/WebCore/platform/wx/KURLWx.cpp
new file mode 100644
index 0000000..a2be103
--- /dev/null
+++ b/WebCore/platform/wx/KURLWx.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "KURL.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+String KURL::fileSystemPath() const
+{
+    notImplemented();
+    return String();
+}
+
+}
+
diff --git a/WebCore/platform/wx/PasteboardWx.cpp b/WebCore/platform/wx/PasteboardWx.cpp
index 67697de..207c63c 100644
--- a/WebCore/platform/wx/PasteboardWx.cpp
+++ b/WebCore/platform/wx/PasteboardWx.cpp
@@ -52,13 +52,20 @@ Pasteboard* Pasteboard::generalPasteboard()
 
 void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
-    if (wxTheClipboard->Open())
-    {
+    if (wxTheClipboard->Open()) {
         wxTheClipboard->SetData( new wxTextDataObject(frame->selectedText()) );
         wxTheClipboard->Close();
     }
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    if (wxTheClipboard->Open()) {
+        wxTheClipboard->SetData( new wxTextDataObject(text) );
+        wxTheClipboard->Close();
+    }
+}
+
 bool Pasteboard::canSmartReplace()
 {
     notImplemented();
@@ -92,8 +99,7 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
 
 void Pasteboard::writeURL(const KURL& url, const String&, Frame*)
 {
-    if (wxTheClipboard->Open())
-    {
+    if (wxTheClipboard->Open()) {
         wxTheClipboard->SetData( new wxTextDataObject( url.string() ) );
         wxTheClipboard->Close();
     }
diff --git a/WebCore/platform/wx/PopupMenuWx.cpp b/WebCore/platform/wx/PopupMenuWx.cpp
index 660282c..9b0deba 100644
--- a/WebCore/platform/wx/PopupMenuWx.cpp
+++ b/WebCore/platform/wx/PopupMenuWx.cpp
@@ -88,7 +88,7 @@ void PopupMenu::OnMenuItemSelected(wxCommandEvent& event)
 {
     if (client()) {
         client()->valueChanged(event.GetId() - s_menuStartId);
-        client()->hidePopup();
+        client()->popupDidHide();
     }
     // TODO: Do we need to call Disconnect here? Do we have a ref to the native window still?
 }
diff --git a/WebCore/platform/wx/RenderThemeWx.cpp b/WebCore/platform/wx/RenderThemeWx.cpp
index f2ced9e..c66ff87 100644
--- a/WebCore/platform/wx/RenderThemeWx.cpp
+++ b/WebCore/platform/wx/RenderThemeWx.cpp
@@ -29,6 +29,7 @@
 #include "Document.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "HostWindow.h"
 #include "NotImplemented.h"
 #include "RenderView.h"
 
@@ -138,6 +139,15 @@ PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
     return rt;
 }
 
+wxWindow* nativeWindowForRenderObject(RenderObject* o)
+{
+    FrameView* frameView = o->view()->frameView();
+    ASSERT(frameView);
+    ASSERT(frameView->hostWindow());
+    return frameView->hostWindow()->platformPageClient();
+}
+
+
 bool RenderThemeWx::isControlStyled(const RenderStyle* style, const BorderData& border,
                                      const FillLayer& background, const Color& backgroundColor) const
 {
@@ -251,10 +261,23 @@ void RenderThemeWx::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* s
 
 bool RenderThemeWx::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    wxWindow* window = o->view()->frameView()->platformWidget();
+    wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
     int flags = 0;
     
+    IntRect rect = r; 
+
+#if USE(WXGC)
+    double xtrans = 0;
+    double ytrans = 0;
+    
+    wxGCDC* gcdc = static_cast<wxGCDC*>(dc);
+    wxGraphicsContext* gc = gcdc->GetGraphicsContext();
+    gc->GetTransform().TransformPoint(&xtrans, &ytrans);
+    rect.setX(r.x() + (int)xtrans);
+    rect.setY(r.y() + (int)ytrans);
+#endif
+
     if (!isEnabled(o))
         flags |= wxCONTROL_DISABLED;
 
@@ -266,20 +289,22 @@ bool RenderThemeWx::paintButton(RenderObject* o, const RenderObject::PaintInfo&
         flags |= wxCONTROL_PRESSED;
     
     if (part == PushButtonPart || part == ButtonPart)
-        wxRendererNative::Get().DrawPushButton(window, *dc, r, flags);
+        wxRendererNative::Get().DrawPushButton(window, *dc, rect, flags);
     else if(part == RadioPart) {
         if (isChecked(o))
             flags |= wxCONTROL_CHECKED;
-#if wxCHECK_VERSION(2,9,0)
-        wxRendererNative::Get().DrawRadioButton(window, *dc, r, flags);
+#if wxCHECK_VERSION(2,9,1)
+        wxRendererNative::Get().DrawRadioBitmap(window, *dc, r, flags);
+#elif wxCHECK_VERSION(2,9,0)
+        wxRendererNative::Get().DrawRadioButton(window, *dc, rect, flags);
 #else
-        wxRenderer_DrawRadioButton(window, *dc, r, flags);
+        wxRenderer_DrawRadioButton(window, *dc, rect, flags);
 #endif
     }
     else if(part == CheckboxPart) {
         if (isChecked(o))
             flags |= wxCONTROL_CHECKED;
-        wxRendererNative::Get().DrawCheckBox(window, *dc, r, flags);
+        wxRendererNative::Get().DrawCheckBox(window, *dc, rect, flags);
     }
     return false;
 }
@@ -291,7 +316,7 @@ void RenderThemeWx::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle* style,
 
 bool RenderThemeWx::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    wxWindow* window = o->view()->frameView()->platformWidget();
+    wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
 #if wxCHECK_VERSION(2,9,0)
     wxRendererNative::Get().DrawTextCtrl(window, *dc, r, 0);
@@ -313,7 +338,7 @@ void RenderThemeWx::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* style, E
     
 bool RenderThemeWx::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    wxWindow* window = o->view()->frameView()->platformWidget();
+    wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
     
     int flags = 0;      
@@ -342,7 +367,7 @@ void RenderThemeWx::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, E
     
 bool RenderThemeWx::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    wxWindow* window = o->view()->frameView()->platformWidget();
+    wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
     
     int flags = 0;      
diff --git a/WebCore/platform/wx/SSLKeyGeneratorWx.cpp b/WebCore/platform/wx/SSLKeyGeneratorWx.cpp
new file mode 100644
index 0000000..7d076e7
--- /dev/null
+++ b/WebCore/platform/wx/SSLKeyGeneratorWx.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SSLKeyGenerator.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+void getSupportedKeySizes(Vector<String>&)
+{
+    notImplemented();
+}
+
+String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String &challengeString, const KURL &url)
+{
+    return String();
+}
+
+}
+
diff --git a/WebCore/platform/wx/ScrollbarThemeWx.cpp b/WebCore/platform/wx/ScrollbarThemeWx.cpp
new file mode 100644
index 0000000..6904f41
--- /dev/null
+++ b/WebCore/platform/wx/ScrollbarThemeWx.cpp
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ScrollbarThemeWx.h"
+
+#include "HostWindow.h"
+#include "NotImplemented.h"
+#include "Scrollbar.h"
+#include "ScrollbarClient.h"
+#include "scrollbar_render.h"
+#include "ScrollbarThemeComposite.h"
+#include "ScrollView.h"
+
+#include <wx/defs.h>
+#include <wx/dcgraph.h>
+#include <wx/settings.h>
+
+const int cMacButtonOverlap = 4;
+
+namespace WebCore {
+
+ScrollbarTheme* ScrollbarTheme::nativeTheme()
+{
+    static ScrollbarThemeWx theme;
+    return &theme;
+}
+
+ScrollbarThemeWx::~ScrollbarThemeWx()
+{
+}
+
+int ScrollbarThemeWx::scrollbarThickness(ScrollbarControlSize size)
+{
+    int thickness = wxSystemSettings::GetMetric(wxSYS_VSCROLL_X);
+    
+    // fallback for when a platform doesn't define this metric
+    if (thickness <= 0)
+        thickness = 20;
+    
+    return thickness;
+}
+
+bool ScrollbarThemeWx::hasThumb(Scrollbar* scrollbar)
+{
+    // This method is just called as a paint-time optimization to see if
+    // painting the thumb can be skipped.  We don't have to be exact here.
+    return thumbLength(scrollbar) > 0;
+}
+
+IntSize ScrollbarThemeWx::buttonSize(Scrollbar*) 
+{
+#ifdef __WXMAC__
+    return IntSize(20,20);
+#else
+    return IntSize(16,16);
+#endif
+}
+
+
+IntRect ScrollbarThemeWx::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+{
+    // FIXME: Handling this case is needed when there are two sets of arrow buttons
+    // on Mac, one at the top and one at the bottom.
+    if (part == BackButtonEndPart)
+        return IntRect();
+
+    IntSize size = buttonSize(scrollbar);
+    int x = scrollbar->x();
+    int y = scrollbar->y();
+    
+#if __WXMAC__
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        x += scrollbar->width() - (size.width() * 2) + cMacButtonOverlap;
+    else
+        y += scrollbar->height() - (size.height() * 2) + cMacButtonOverlap;
+#endif
+    
+    return IntRect(x, y, size.width(), size.height());
+}
+
+IntRect ScrollbarThemeWx::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+{
+    // FIXME: Handling this case is needed when there are two sets of arrow buttons
+    // on Mac, one at the top and one at the bottom.
+    if (part == ForwardButtonStartPart)
+        return IntRect();
+
+    IntSize size = buttonSize(scrollbar);
+    int x, y;
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        x = scrollbar->x() + scrollbar->width() - size.width();
+        y = scrollbar->y();
+    } else {
+        x = scrollbar->x();
+        y = scrollbar->y() + scrollbar->height() - size.height();
+    }
+    return IntRect(x, y, size.width(), size.height());
+}
+
+IntRect ScrollbarThemeWx::trackRect(Scrollbar* scrollbar, bool)
+{
+    IntSize bs = buttonSize(scrollbar);
+    int trackStart = 0;
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        trackStart = bs.width();
+    else
+        trackStart = bs.height();
+        
+#if __WXMAC__
+    trackStart = 0;
+#endif
+    
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        if (scrollbar->width() < 2 * thickness)
+            return IntRect();
+        return IntRect(scrollbar->x() + trackStart, scrollbar->y(), scrollbar->width() - 2 * bs.width(), thickness);
+    }
+    if (scrollbar->height() < 2 * thickness)
+        return IntRect();
+    return IntRect(scrollbar->x(), scrollbar->y() + trackStart, thickness, scrollbar->height() - 2 * bs.height());
+}
+
+void ScrollbarThemeWx::paintScrollCorner(ScrollView* view, GraphicsContext* context, const IntRect& cornerRect)
+{
+    // ScrollbarThemeComposite::paintScrollCorner incorrectly assumes that the
+    // ScrollView is a FrameView (see FramelessScrollView), so we cannot let
+    // that code run.  For FrameView's this is correct since we don't do custom
+    // scrollbar corner rendering, which ScrollbarThemeComposite supports.
+    ScrollbarTheme::paintScrollCorner(view, context, cornerRect);
+}
+
+bool ScrollbarThemeWx::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& rect)
+{
+    wxOrientation orientation = (scrollbar->orientation() == HorizontalScrollbar) ? wxHORIZONTAL : wxVERTICAL;
+    int flags = 0;
+    if (scrollbar->client()->isActive())
+        flags |= wxCONTROL_FOCUSED;
+    
+    if (!scrollbar->enabled())
+        flags |= wxCONTROL_DISABLED;
+    
+    wxDC* dc = static_cast<wxDC*>(context->platformContext());
+    
+    context->save();
+    ScrollView* root = scrollbar->root();
+    ASSERT(root);
+    if (!root)
+        return false;
+    
+    wxWindow* webview = root->hostWindow()->platformPageClient(); 
+    
+    wxRenderer_DrawScrollbar(webview, *dc, scrollbar->frameRect(), orientation, scrollbar->currentPos(), static_cast<wxScrollbarPart>(scrollbar->pressedPart()),    
+                     static_cast<wxScrollbarPart>(scrollbar->hoveredPart()), scrollbar->maximum(), scrollbar->pageStep(), flags);
+
+    context->restore();
+    return true;
+}
+
+}
+
diff --git a/WebCore/platform/wx/ScrollbarThemeWx.h b/WebCore/platform/wx/ScrollbarThemeWx.h
new file mode 100644
index 0000000..2b3bff0
--- /dev/null
+++ b/WebCore/platform/wx/ScrollbarThemeWx.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ScrollbarThemeWx_h
+#define ScrollbarThemeWx_h
+
+#include "ScrollbarTheme.h"
+#include "ScrollbarThemeComposite.h"
+
+namespace WebCore {
+
+class ScrollbarThemeWx : public ScrollbarThemeComposite {
+public:
+    virtual ~ScrollbarThemeWx();
+    virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
+    virtual bool paint(Scrollbar*, GraphicsContext*, const IntRect&);
+
+    virtual void paintScrollCorner(ScrollView*, GraphicsContext*, const IntRect& cornerRect);
+    
+protected:
+    virtual bool hasButtons(Scrollbar*) { return true; }
+    virtual bool hasThumb(Scrollbar*);
+
+    virtual IntSize buttonSize(Scrollbar*);
+
+    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+};
+
+}
+#endif
diff --git a/WebCore/platform/wx/SearchPopupMenuWx.cpp b/WebCore/platform/wx/SearchPopupMenuWx.cpp
new file mode 100644
index 0000000..dbbe339
--- /dev/null
+++ b/WebCore/platform/wx/SearchPopupMenuWx.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SearchPopupMenu.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+SearchPopupMenu::SearchPopupMenu(PopupMenuClient* client)
+    : PopupMenu(client)
+{
+    notImplemented();
+}
+
+void SearchPopupMenu::saveRecentSearches(const AtomicString& name, const Vector<String>& searchItems)
+{
+    notImplemented();
+}
+
+void SearchPopupMenu::loadRecentSearches(const AtomicString& name, Vector<String>& searchItems)
+{
+    notImplemented();
+}
+
+bool SearchPopupMenu::enabled()
+{
+    return true;
+}
+
+}
+
diff --git a/WebCore/platform/wx/SharedBufferWx.cpp b/WebCore/platform/wx/SharedBufferWx.cpp
new file mode 100644
index 0000000..a9203ba
--- /dev/null
+++ b/WebCore/platform/wx/SharedBufferWx.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SharedBuffer.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String&)
+{
+    notImplemented();
+    return 0;
+}
+
+}
+
diff --git a/WebCore/platform/wx/SystemTimeWx.cpp b/WebCore/platform/wx/SystemTimeWx.cpp
new file mode 100644
index 0000000..f607cba
--- /dev/null
+++ b/WebCore/platform/wx/SystemTimeWx.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SystemTime.h"
+
+#include <float.h>
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+float userIdleTime()
+{
+    notImplemented();
+    // return an arbitrarily high userIdleTime so that releasing pages from the page cache isn't postponed
+    return FLT_MAX;
+}
+
+}
+
diff --git a/WebCore/platform/wx/TemporaryLinkStubs.cpp b/WebCore/platform/wx/TemporaryLinkStubs.cpp
index 2403527..5aa6e2c 100644
--- a/WebCore/platform/wx/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/wx/TemporaryLinkStubs.cpp
@@ -1,3 +1,4 @@
+<<<<<<< HEAD:WebCore/platform/wx/TemporaryLinkStubs.cpp
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2008 Collabora, Ltd.  All rights reserved.
@@ -178,3 +179,5 @@ PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String&) {
 void prefetchDNS(const String& hostname) { notImplemented(); }
 
 }
+=======
+>>>>>>> webkit.org at 49305:WebCore/platform/wx/TemporaryLinkStubs.cpp
diff --git a/WebCore/platform/wx/TextBreakIteratorInternalICUWx.cpp b/WebCore/platform/wx/TextBreakIteratorInternalICUWx.cpp
new file mode 100644
index 0000000..f840e13
--- /dev/null
+++ b/WebCore/platform/wx/TextBreakIteratorInternalICUWx.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TextBreakIteratorInternalICU.h"
+
+namespace WebCore {
+
+const char* currentSearchLocaleID()
+{
+    return "";
+}
+
+const char* currentTextBreakLocaleID()
+{
+    return "en_us";
+}
+
+}
+
diff --git a/WebCore/platform/wx/WidgetWx.cpp b/WebCore/platform/wx/WidgetWx.cpp
index bb4fd2a..a384914 100644
--- a/WebCore/platform/wx/WidgetWx.cpp
+++ b/WebCore/platform/wx/WidgetWx.cpp
@@ -28,6 +28,7 @@
 #include "Cursor.h"
 #include "GraphicsContext.h"
 #include "IntRect.h"
+#include "NotImplemented.h"
 
 #include <wx/defs.h>
 #include <wx/scrolwin.h>
@@ -96,4 +97,9 @@ void Widget::paint(GraphicsContext*,const IntRect& r)
         widget->Update();
 }
 
+void Widget::setIsSelected(bool)
+{
+    notImplemented();
+}
+
 }
diff --git a/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp b/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp
new file mode 100644
index 0000000..f74b076
--- /dev/null
+++ b/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "scrollbar_render.h"
+
+#include <wx/defs.h>
+#include <wx/dc.h>
+#include <wx/dcgraph.h>
+#include <wx/renderer.h>
+#include <wx/settings.h>
+#include <wx/window.h>
+
+#include <gtk/gtk.h>
+
+#if wxCHECK_VERSION(2, 9, 0)
+    #include <wx/gtk/dc.h>
+#else
+    #include "wx/gtk/win_gtk.h"
+#endif
+
+int wxStyleForPart(wxScrollbarPart part, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, int flags)
+{
+    int style = 0;
+    if (flags == wxCONTROL_DISABLED)
+        style = wxCONTROL_DISABLED;
+    else if (part == focusPart)
+        style = wxCONTROL_PRESSED;
+    else if (part == hoverPart)
+        style = wxCONTROL_CURRENT;
+
+    return style;
+}
+
+GtkWidget* GetButtonWidget()
+{
+    static GtkWidget *s_button = NULL;
+    static GtkWidget *s_window = NULL;
+
+    if ( !s_button )
+    {
+        s_window = gtk_window_new( GTK_WINDOW_POPUP );
+        gtk_widget_realize( s_window );
+        s_button = gtk_button_new();
+        gtk_container_add( GTK_CONTAINER(s_window), s_button );
+        gtk_widget_realize( s_button );
+    }
+
+    return s_button;
+}
+
+
+GdkWindow* wxGetGdkWindowForDC(wxWindow* win, wxDC& dc)
+{
+    GdkWindow* gdk_window = NULL;
+#if wxCHECK_VERSION(2, 9, 0)
+    if ( dc.IsKindOf( CLASSINFO(wxGCDC) ) )
+        gdk_window = win->GTKGetDrawingWindow();
+    else
+    {
+        wxGTKDCImpl *impl = wxDynamicCast(dc.GetImpl(), wxGTKDCImpl);
+        if ( impl )
+            gdk_window = impl->GetGDKWindow();
+    }
+#else // wx < 2.9
+    // The way to get a GdkWindow* from a wxWindow is to use 
+    // GTK_PIZZA(win->m_wxwindow)->bin_window, but this approach
+    // won't work when drawing to a wxMemoryDC as it has its own
+    // GdkWindow* for its bitmap. wxWindowDC's GetGDKWindow() was
+    // designed to create a solution for all DCs, but we can't
+    // implement it with wxGCDC since it doesn't retain its wxWindow. 
+    // So, to work around this, we use GetGDKWindow whenever possible
+    // and use bin_window for wxGCDC. 
+#if wxUSE_GRAPHICS_CONTEXT
+    if ( dc.IsKindOf( CLASSINFO(wxGCDC) ) )
+        gdk_window = GTK_PIZZA(win->m_wxwindow)->bin_window;    
+    else
+#endif
+       gdk_window = dc.GetGDKWindow();
+    wxASSERT_MSG( gdk_window,
+                  wxT("cannot use wxRendererNative on wxDC of this type") );
+#endif // wx 2.9/2.8
+    
+    return gdk_window;
+}
+
+void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc, const wxRect& rect, wxOrientation orient, 
+                        int current, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, int max, int step, int flags)
+{
+    bool horiz = orient == wxHORIZONTAL;
+    wxColour scrollbar_colour = wxSystemSettings::GetColour(wxSYS_COLOUR_SCROLLBAR);
+    dc.SetBrush(wxBrush(scrollbar_colour));
+    dc.SetPen(wxPen(wxSystemSettings::GetColour(wxSYS_COLOUR_BTNSHADOW)));
+    dc.DrawRectangle(rect.x, rect.y, rect.width, rect.height);
+
+    wxRendererNative& renderer = wxRendererNative::Get();
+    int x = rect.x;
+    int y = rect.y;
+
+    int buttonLength = 16;
+
+    renderer.DrawPushButton(window, dc, wxRect(x,y,buttonLength,buttonLength), wxStyleForPart(wxSCROLLPART_BACKBTNSTART, focusPart, hoverPart, flags));
+
+    GtkWidget* button = GetButtonWidget();
+    GdkWindow* gdk_window = wxGetGdkWindowForDC(window, dc);
+
+    GtkArrowType arrowType = GTK_ARROW_UP;
+    if (horiz)
+        arrowType = GTK_ARROW_LEFT;
+
+    gtk_paint_arrow( button->style, gdk_window, GTK_STATE_NORMAL, GTK_SHADOW_OUT, NULL, button, "arrow", arrowType, false, x + 4, y + 4, 8, 8);
+
+    wxRect buttonRect = rect;
+    int physicalLength = horiz ? rect.width : rect.height;
+    physicalLength -= buttonLength*2;
+    int thumbStart = 0;
+    int thumbLength = 0;
+    calcThumbStartAndLength(physicalLength, max + step, current, step, &thumbStart, &thumbLength);
+
+    if (horiz) {
+        buttonRect.x = thumbStart + buttonLength;
+        buttonRect.width = thumbLength;
+    } else {
+        buttonRect.y = thumbStart + buttonLength;
+        buttonRect.height = thumbLength;
+    }
+
+    renderer.DrawPushButton(window, dc, buttonRect, wxStyleForPart(wxSCROLLPART_THUMB, focusPart, hoverPart, flags));
+
+    if (horiz)
+        x += rect.width - buttonLength;
+    else
+        y += rect.height - buttonLength;
+
+    renderer.DrawPushButton(window, dc, wxRect(x,y,buttonLength,buttonLength), wxStyleForPart(wxSCROLLPART_FWDBTNEND, focusPart, hoverPart, flags));
+    
+    if (horiz)
+        arrowType = GTK_ARROW_RIGHT;
+    else
+        arrowType = GTK_ARROW_DOWN;
+
+    gtk_paint_arrow( button->style, gdk_window, GTK_STATE_NORMAL, GTK_SHADOW_OUT, NULL, button, "arrow", arrowType, false, x + 4, y + 4, 8, 8);
+}
diff --git a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
index e5c60d6..c4c4d48 100644
--- a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
+++ b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
@@ -63,7 +63,7 @@ void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData*
     CGFontRef cgFont;
 
 #ifdef wxOSX_USE_CORE_TEXT && wxOSX_USE_CORE_TEXT
-    cgFont = CTFontCopyGraphicsFont((CTFontRef)font->OSXGetCTFont(), NULL);
+    cgFont = CTFontCopyGraphicsFont((CTFontRef)wxfont->OSXGetCTFont(), NULL);
 #else
     ATSFontRef fontRef;
     
diff --git a/WebCore/platform/wx/wxcode/mac/carbon/scrollbar_render.cpp b/WebCore/platform/wx/wxcode/mac/carbon/scrollbar_render.cpp
new file mode 100644
index 0000000..5169601
--- /dev/null
+++ b/WebCore/platform/wx/wxcode/mac/carbon/scrollbar_render.cpp
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#include "config.h"
+
+#include "scrollbar_render.h"
+
+#include <wx/defs.h>
+#include <wx/dc.h>
+#include <wx/dcgraph.h>
+#include <wx/renderer.h>
+
+#include <Carbon/Carbon.h>
+
+static int wxScrollbarPartToHIPressedState(wxScrollbarPart part)
+{
+    switch (part) {
+        case wxSCROLLPART_BACKBTNSTART:
+            return kThemeTopOutsideArrowPressed;
+        case wxSCROLLPART_BACKBTNEND:
+            return kThemeTopOutsideArrowPressed; // This does not make much sense.  For some reason the outside constant is required.
+        case wxSCROLLPART_FWDBTNSTART:
+            return kThemeTopInsideArrowPressed;
+        case wxSCROLLPART_FWDBTNEND:
+            return kThemeBottomOutsideArrowPressed;
+        case wxSCROLLPART_THUMB:
+            return kThemeThumbPressed;
+        default:
+            return 0;
+    }
+}
+
+void wxRenderer_DrawScrollbar(wxWindow* WXUNUSED(window), wxDC& dc,
+                             const wxRect& rect, wxOrientation orient, int current,
+                             wxScrollbarPart focusPart, wxScrollbarPart hoverPart, int max, int step, int flags)
+{
+    const wxCoord x = rect.x;
+    const wxCoord y = rect.y;
+    const wxCoord w = rect.width;
+    const wxCoord h = rect.height;
+
+    dc.SetBrush( *wxWHITE_BRUSH );
+    dc.SetPen( *wxTRANSPARENT_PEN );
+    dc.DrawRectangle(rect);
+    
+    dc.SetBrush( *wxTRANSPARENT_BRUSH );
+
+    HIRect hiRect = CGRectMake( x, y, w, h );
+
+    CGContextRef cgContext = NULL;
+    wxGraphicsContext* gc = NULL;
+#if wxCHECK_VERSION(2,9,0)
+    wxGCDCImpl *impl = dynamic_cast<wxGCDCImpl*> (dc.GetImpl());
+    if (impl)
+        gc = impl->GetGraphicsContext();
+#else
+    gc = dc.GetGraphicsContext();
+#endif
+    if (gc)
+        cgContext = (CGContextRef) gc->GetNativeContext();
+    
+    if (cgContext)
+    {
+        HIThemeTrackDrawInfo trackInfo;
+        trackInfo.version = 0;
+        trackInfo.kind = kThemeMediumScrollBar;
+        trackInfo.bounds = hiRect;
+        trackInfo.min = 0;
+        trackInfo.max = max;
+        trackInfo.value = current;
+        trackInfo.trackInfo.scrollbar.viewsize = step;
+        trackInfo.attributes = 0;
+        if (orient == wxHORIZONTAL)
+            trackInfo.attributes |= kThemeTrackHorizontal;
+        trackInfo.enableState = (flags & wxCONTROL_FOCUSED) ? kThemeTrackActive : kThemeTrackInactive;
+        trackInfo.trackInfo.scrollbar.pressState = wxScrollbarPartToHIPressedState(focusPart);
+        trackInfo.attributes |= kThemeTrackShowThumb;
+        
+        if (flags & wxCONTROL_DISABLED)
+            trackInfo.enableState = kThemeTrackDisabled;
+        
+        HIThemeDrawTrack(&trackInfo, 0, cgContext, kHIThemeOrientationNormal);
+    }
+}
diff --git a/WebCore/platform/wx/wxcode/scrollbar_render.h b/WebCore/platform/wx/wxcode/scrollbar_render.h
new file mode 100644
index 0000000..7a0ba1c
--- /dev/null
+++ b/WebCore/platform/wx/wxcode/scrollbar_render.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef scrollbar_render_h
+#define scrollbar_render_h
+
+#include <wx/defs.h>
+#include <wx/dc.h>
+#include <wx/renderer.h>
+
+enum wxScrollbarPart {
+    wxSCROLLPART_NONE = 0,
+    wxSCROLLPART_BACKBTNSTART = 1,
+    wxSCROLLPART_FWDBTNSTART = 1 << 1,
+    wxSCROLLPART_BACKTRACK = 1 << 2,
+    wxSCROLLPART_THUMB = 1 << 3,
+    wxSCROLLPART_FWDTRACK = 1 << 4,
+    wxSCROLLPART_BACKBTNEND = 1 << 5,
+    wxSCROLLPART_FWDBTNEND = 1 << 6,
+    wxSCROLLPART_SCROLLBARBG = 1 << 7,
+    wxSCROLLPART_TRACKBG = 1 << 8,
+    wxSCROLLPART_ALL = 0xffffffff,
+};
+
+void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc, 
+                                       const wxRect& rect, 
+                                       wxOrientation orientation, 
+                                       int current, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, 
+                                       int max, int step, int flags=0);
+
+inline void calcThumbStartAndLength(int physicalLength, int virtualLength, int current, 
+                                int step, int *thumbStart, int *thumbLength)
+{
+        float proportion = (float)physicalLength / virtualLength;
+        float scale = (float)virtualLength / physicalLength;
+        int thumbSize = proportion * physicalLength;
+        int currentPos = current / scale;
+        
+        if (thumbStart)
+            *thumbStart = currentPos;
+        
+        if (thumbLength)
+            *thumbLength = thumbSize;
+}
+#endif
diff --git a/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp b/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp
index d2513d7..72fcc54 100644
--- a/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp
+++ b/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp
@@ -79,13 +79,24 @@ void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData*
 
     // get the native HDC handle to draw using native APIs
     HDC hdc = 0;
+    float y = point.y() - font->ascent();
+    float x = point.x();
+
 #if USE(WXGC)
+    // when going from GdiPlus -> Gdi, any GdiPlus transformations are lost
+    // so we need to alter the coordinates to reflect their transformed point.
+    double xtrans = 0;
+    double ytrans = 0;
+    
     wxGraphicsContext* gc = dc->GetGraphicsContext();
+    gc->GetTransform().TransformPoint(&xtrans, &ytrans);
     Gdiplus::Graphics* g;
     if (gc) {
         g = (Gdiplus::Graphics*)gc->GetNativeContext();
         hdc = g->GetHDC();
     }
+    x += (int)xtrans;
+    y += (int)ytrans;    
 #else
     hdc = static_cast<HDC>(dc->GetHDC());
 #endif
@@ -95,9 +106,6 @@ void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData*
     const GlyphBufferGlyph*   glyphs   = glyphBuffer.glyphs(from);
     const GlyphBufferAdvance* advances = glyphBuffer.advances(from);
 
-    float y = point.y() - font->ascent();
-    float x = point.x();
-
     int* spacing = new int[numGlyphs - from];
     for (unsigned i = 0; i < numGlyphs; ++i)
         spacing[i] = advances[i].width();
diff --git a/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp b/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp
new file mode 100644
index 0000000..4d6bbc0
--- /dev/null
+++ b/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "scrollbar_render.h"
+
+#include <wx/defs.h>
+
+#include <wx/dc.h>
+#include <wx/renderer.h>
+#include <wx/window.h>
+
+#include <wx/msw/private.h>
+#include <wx/msw/uxtheme.h>
+
+// constants
+#define SP_BUTTON          1
+#define SP_THUMBHOR        2
+#define SP_THUMBVERT       3
+#define SP_TRACKENDHOR      4
+#define SP_TRACKENDVERT     7
+#define SP_GRIPPERHOR       8
+#define SP_GRIPPERVERT      9
+
+#define TS_NORMAL           1
+#define TS_HOVER            2
+#define TS_ACTIVE           3
+#define TS_DISABLED         4
+
+#define TS_UP_BUTTON       0
+#define TS_DOWN_BUTTON     4
+#define TS_LEFT_BUTTON     8
+#define TS_RIGHT_BUTTON    12
+
+#if wxUSE_GRAPHICS_CONTEXT
+// TODO remove this dependency (gdiplus needs the macros)
+// we need to undef because the macros are being defined in WebCorePrefix.h
+// but GdiPlus.h is not accepting them
+#undef max
+#define max(a,b)            (((a) > (b)) ? (a) : (b))
+
+#undef min
+#define min(a,b)            (((a) < (b)) ? (a) : (b))
+
+#include <wx/dcgraph.h>
+#include "gdiplus.h"
+using namespace Gdiplus;
+#endif // wxUSE_GRAPHICS_CONTEXT
+
+class GraphicsHDC
+{
+public:
+    GraphicsHDC(wxDC* dc)
+    {
+#if wxUSE_GRAPHICS_CONTEXT
+        m_graphics = NULL;
+        wxGCDC* gcdc = wxDynamicCast(dc, wxGCDC);
+        if (gcdc) {
+            m_graphics = (Graphics*)gcdc->GetGraphicsContext()->GetNativeContext();
+            m_hdc = m_graphics->GetHDC();
+        }
+        else
+#endif
+            m_hdc = GetHdcOf(*dc);
+    }
+
+    ~GraphicsHDC()
+    {
+#if wxUSE_GRAPHICS_CONTEXT
+        if (m_graphics)
+            m_graphics->ReleaseHDC(m_hdc);
+#endif
+    }
+
+    operator HDC() const { return m_hdc; }
+
+private:
+    HDC         m_hdc;
+#if wxUSE_GRAPHICS_CONTEXT
+    Graphics*   m_graphics;
+#endif
+};
+
+int getTSStateForPart(wxScrollbarPart part, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, int flags = 0)
+{
+    int xpState = TS_NORMAL;
+    if (flags & wxCONTROL_DISABLED)
+        xpState = TS_DISABLED;
+    else if (part == focusPart)
+        xpState = TS_ACTIVE;
+    else if (part == hoverPart)
+        xpState = TS_HOVER;
+        
+    return xpState;
+}
+
+void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc,
+                             const wxRect& rect, wxOrientation orient, int current, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, int max, int step, int flags)
+{
+    wxUxThemeEngine *engine = wxUxThemeEngine::Get();
+    HTHEME hTheme = (HTHEME)engine->OpenThemeData(0, L"SCROLLBAR");
+
+    bool horiz = orient == wxHORIZONTAL;
+    int part = 0;
+    if (horiz)
+        part = SP_TRACKENDHOR;
+    else
+        part = SP_TRACKENDVERT;
+
+    int xpState = TS_NORMAL;
+    RECT r;
+    wxCopyRectToRECT(rect, r);
+
+    // Unlike Mac, on MSW you draw the scrollbar piece by piece.
+    // so we draw the track first, then the buttons
+    if (hTheme)
+    {
+        engine->DrawThemeBackground(hTheme, GraphicsHDC(&dc), part, xpState, &r, 0);
+
+        int buttonSize = 16;
+            
+        part = SP_BUTTON;
+        xpState = getTSStateForPart(wxSCROLLPART_BACKBTNSTART, focusPart, hoverPart, flags);
+        xpState += horiz ? TS_LEFT_BUTTON : TS_UP_BUTTON;
+        RECT buttonRect = r;
+        buttonRect.bottom = buttonRect.top + buttonSize;
+        buttonRect.right = buttonRect.left + buttonSize;
+        engine->DrawThemeBackground(hTheme, GraphicsHDC(&dc), part, xpState, &buttonRect, 0);
+
+        xpState = getTSStateForPart(wxSCROLLPART_FWDBTNEND, focusPart, hoverPart, flags);
+        xpState += horiz ? TS_RIGHT_BUTTON : TS_DOWN_BUTTON;
+        buttonRect = r;
+        buttonRect.top = buttonRect.bottom - buttonSize;
+        buttonRect.left = buttonRect.right - buttonSize;
+        engine->DrawThemeBackground(hTheme, GraphicsHDC(&dc), part, xpState, &buttonRect, 0);
+
+        part = horiz ? SP_THUMBHOR : SP_THUMBVERT;
+
+        int physicalLength = horiz ? rect.width : rect.height;
+        physicalLength -= buttonSize*2;
+        int thumbStart = 0;
+        int thumbLength = 0;
+        calcThumbStartAndLength(physicalLength, max + step, 
+                            current, step, &thumbStart, &thumbLength);
+        buttonRect = r;
+        if (horiz) {
+            buttonRect.left = thumbStart + buttonSize;
+            buttonRect.right = buttonRect.left + thumbLength;
+        } else {
+            buttonRect.top = thumbStart + buttonSize;
+            buttonRect.bottom = buttonRect.top + thumbLength;
+        }
+
+        xpState = getTSStateForPart(wxSCROLLPART_THUMB, focusPart, hoverPart, flags);
+        engine->DrawThemeBackground(hTheme, GraphicsHDC(&dc), part, xpState, &buttonRect, 0);
+        
+        // draw the gripper
+        int thickness = ::GetSystemMetrics(SM_CXVSCROLL) / 2;
+        
+        buttonRect.left += ((buttonRect.right - buttonRect.left) - thickness) / 2;
+        buttonRect.top += ((buttonRect.bottom - buttonRect.top) - thickness) / 2;
+        buttonRect.right = buttonRect.left + thickness;
+        buttonRect.bottom = buttonRect.top + thickness;
+        
+        if (horiz)
+            part = SP_GRIPPERHOR;
+        else
+            part = SP_GRIPPERVERT;
+        
+        engine->DrawThemeBackground(hTheme, GraphicsHDC(&dc), part, xpState, &buttonRect, 0);
+    }
+}
diff --git a/WebCore/plugins/PluginDatabase.cpp b/WebCore/plugins/PluginDatabase.cpp
index 414f1ba..f7304df 100644
--- a/WebCore/plugins/PluginDatabase.cpp
+++ b/WebCore/plugins/PluginDatabase.cpp
@@ -29,6 +29,7 @@
 
 #include "Frame.h"
 #include "KURL.h"
+#include "PluginDatabaseClient.h"
 #include "PluginPackage.h"
 #include <stdlib.h>
 
@@ -41,6 +42,11 @@ namespace WebCore {
 
 typedef HashMap<String, RefPtr<PluginPackage> > PluginPackageByNameMap;
 
+PluginDatabase::PluginDatabase()
+    : m_client(0)
+{
+}
+
 PluginDatabase* PluginDatabase::installedPlugins(bool populate)
 {
     static PluginDatabase* plugins = 0;
@@ -116,9 +122,11 @@ bool PluginDatabase::refresh()
             remove(oldPackage.get());
         }
 
-        RefPtr<PluginPackage> package = PluginPackage::createPackage(*it, lastModified);
-        if (package && add(package.release()))
-            pluginSetChanged = true;
+        if (!m_client || m_client->shouldLoadPluginAtPath(*it)) {
+            RefPtr<PluginPackage> package = PluginPackage::createPackage(*it, lastModified);
+            if (package && (!m_client || m_client->shouldLoadPluginPackage(package.get())) && add(package.release()))
+                pluginSetChanged = true;
+        }
     }
 
     // Cache all the paths we found with their timestamps for next time.
@@ -352,6 +360,8 @@ Vector<String> PluginDatabase::defaultPluginDirectories()
     paths.append("/usr/lib/netscape/plugins-libc6");
     paths.append("/usr/lib64/netscape/plugins");
     paths.append("/usr/lib64/mozilla/plugins");
+    paths.append("/usr/lib/nsbrowser/plugins");
+    paths.append("/usr/lib64/nsbrowser/plugins");
 
     String mozHome(getenv("MOZILLA_HOME"));
     mozHome.append("/plugins");
diff --git a/WebCore/plugins/PluginDatabase.h b/WebCore/plugins/PluginDatabase.h
index 14a6fb3..fe74682 100644
--- a/WebCore/plugins/PluginDatabase.h
+++ b/WebCore/plugins/PluginDatabase.h
@@ -46,12 +46,15 @@ namespace WebCore {
     class Frame;
     class IntSize;
     class KURL;
+    class PluginDatabaseClient;
     class PluginPackage;
 
     typedef HashSet<RefPtr<PluginPackage>, PluginPackageHash> PluginSet;
 
     class PluginDatabase {
     public:
+        PluginDatabase();
+
         // The first call to installedPlugins creates the plugin database
         // and by default populates it with the plugins installed on the system.
         // For testing purposes, it is possible to not populate the database
@@ -78,6 +81,11 @@ namespace WebCore {
             m_pluginDirectories = directories;
         }
 
+        void setClient(PluginDatabaseClient* client)
+        {
+            m_client = client;
+        }
+
         static Vector<String> defaultPluginDirectories();
         Vector<String> pluginDirectories() const { return m_pluginDirectories; }
 
@@ -103,6 +111,7 @@ namespace WebCore {
         friend class ::android::WebSettings;
 #endif
         HashMap<String, RefPtr<PluginPackage> > m_preferredPlugins;
+        PluginDatabaseClient* m_client;
     };
 
 } // namespace WebCore
diff --git a/WebCore/plugins/PluginDatabaseClient.h b/WebCore/plugins/PluginDatabaseClient.h
new file mode 100644
index 0000000..b19ab83
--- /dev/null
+++ b/WebCore/plugins/PluginDatabaseClient.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2007 Marius Renn <damarvy@gmail.com> All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef PluginDatabaseClient_h
+#define PluginDatabaseClient_h
+
+namespace WebCore {
+
+    class PluginPackage;
+    class String;
+
+    class PluginDatabaseClient {
+    public:
+        virtual ~PluginDatabaseClient() { }
+        virtual bool shouldLoadPluginAtPath(const String&) = 0;
+        virtual bool shouldLoadPluginPackage(const PluginPackage*) = 0;
+    };
+
+} // namespace WebCore
+
+#endif // PluginDatabaseClient_h
diff --git a/WebCore/plugins/PluginPackage.cpp b/WebCore/plugins/PluginPackage.cpp
index 7e8885d..258cbb7 100644
--- a/WebCore/plugins/PluginPackage.cpp
+++ b/WebCore/plugins/PluginPackage.cpp
@@ -189,6 +189,7 @@ void PluginPackage::determineQuirks(const String& mimeType)
 #if PLATFORM(QT)
             m_quirks.add(PluginQuirkRequiresGtkToolKit);
 #endif
+            m_quirks.add(PluginQuirkRequiresDefaultScreenDepth);
         } else {
             // Flash 9 and older requests windowless plugins if we return a mozilla user agent
             m_quirks.add(PluginQuirkWantsMozillaUserAgent);
diff --git a/WebCore/plugins/PluginQuirkSet.h b/WebCore/plugins/PluginQuirkSet.h
index b652c6e..de29baf 100644
--- a/WebCore/plugins/PluginQuirkSet.h
+++ b/WebCore/plugins/PluginQuirkSet.h
@@ -46,6 +46,7 @@ namespace WebCore {
         PluginQuirkDontSetNullWindowHandleOnDestroy = 1 << 10,
         PluginQuirkDontAllowMultipleInstances = 1 << 11,
         PluginQuirkRequiresGtkToolKit = 1 << 12,
+        PluginQuirkRequiresDefaultScreenDepth = 1 << 13
     };
 
     class PluginQuirkSet {
diff --git a/WebCore/plugins/PluginView.cpp b/WebCore/plugins/PluginView.cpp
index eeb4af4..02fcbce 100644
--- a/WebCore/plugins/PluginView.cpp
+++ b/WebCore/plugins/PluginView.cpp
@@ -51,6 +51,7 @@
 #include "PluginPackage.h"
 #include "ScriptController.h"
 #include "ScriptValue.h"
+#include "SecurityOrigin.h"
 #include "PluginDatabase.h"
 #include "PluginDebug.h"
 #include "PluginMainThreadScheduler.h"
@@ -143,8 +144,8 @@ void PluginView::setFrameRect(const IntRect& rect)
     // On Windows, always call plugin to change geometry.
     setNPWindowRect(rect);
 #elif XP_UNIX
-    // On Unix, only call plugin if it's full-page.
-    if (m_mode == NP_FULL)
+    // On Unix, multiple calls to setNPWindow() in windowed mode causes Flash to crash
+    if (m_mode == NP_FULL || !m_isWindowed)
         setNPWindowRect(rect);
 #endif
 }
@@ -163,10 +164,63 @@ void PluginView::handleEvent(Event* event)
         handleMouseEvent(static_cast<MouseEvent*>(event));
     else if (event->isKeyboardEvent())
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
+<<<<<<< HEAD:WebCore/plugins/PluginView.cpp
 #if defined(ANDROID_PLUGINS)
     else if (event->isTouchEvent())
         handleTouchEvent(static_cast<TouchEvent*>(event));
+=======
+#if defined(Q_WS_X11)
+    else if (event->type() == eventNames().DOMFocusOutEvent)
+        handleFocusOutEvent();
+    else if (event->type() == eventNames().DOMFocusInEvent)
+        handleFocusInEvent();
+>>>>>>> webkit.org at 49305:WebCore/plugins/PluginView.cpp
 #endif
+<<<<<<< HEAD:WebCore/plugins/PluginView.cpp
+=======
+}
+
+void PluginView::init()
+{
+    if (m_haveInitialized)
+        return;
+
+    m_haveInitialized = true;
+
+    if (!m_plugin) {
+        ASSERT(m_status == PluginStatusCanNotFindPlugin);
+        return;
+    }
+
+    LOG(Plugins, "PluginView::init(): Initializing plug-in '%s'", m_plugin->name().utf8().data());
+
+    if (!m_plugin->load()) {
+        m_plugin = 0;
+        m_status = PluginStatusCanNotLoadPlugin;
+        return;
+    }
+
+    if (!startOrAddToUnstartedList()) {
+        m_status = PluginStatusCanNotLoadPlugin;
+        return;
+    }
+
+    m_status = PluginStatusLoadedSuccessfully;
+}
+
+bool PluginView::startOrAddToUnstartedList()
+{
+    if (!m_parentFrame->page())
+        return false;
+
+    if (!m_parentFrame->page()->canStartPlugins()) {
+        m_parentFrame->page()->addUnstartedPlugin(this);
+        m_isWaitingToStart = true;
+        return true;
+    }
+
+    return start();
+>>>>>>> webkit.org at 49305:WebCore/plugins/PluginView.cpp
 }
 
 
@@ -212,16 +266,58 @@ bool PluginView::start()
 
     m_status = PluginStatusLoadedSuccessfully;
 
-    platformStart();
+    if (!platformStart())
+        m_status = PluginStatusCanNotLoadPlugin;
+
+    if (m_status != PluginStatusLoadedSuccessfully)
+        return false;
+
+    if (parentFrame()->page())
+        parentFrame()->page()->didStartPlugin(this);
 
     return true;
 }
 
+PluginView::~PluginView()
+{
+    LOG(Plugins, "PluginView::~PluginView()");
+
+    removeFromUnstartedListIfNecessary();
+
+    stop();
+
+    deleteAllValues(m_requests);
+
+    freeStringArray(m_paramNames, m_paramCount);
+    freeStringArray(m_paramValues, m_paramCount);
+
+    platformDestroy();
+
+    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
+
+    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
+        m_plugin->unload();
+}
+
+void PluginView::removeFromUnstartedListIfNecessary()
+{
+    if (!m_isWaitingToStart)
+        return;
+
+    if (!m_parentFrame->page())
+        return;
+
+    m_parentFrame->page()->removeUnstartedPlugin(this);
+}
+
 void PluginView::stop()
 {
     if (!m_isStarted)
         return;
 
+    if (parentFrame()->page())
+        parentFrame()->page()->didStopPlugin(this);
+
     LOG(Plugins, "PluginView::stop(): Stopping plug-in '%s'", m_plugin->name().utf8().data());
 
     HashSet<RefPtr<PluginStream> > streams = m_streams;
@@ -236,7 +332,13 @@ void PluginView::stop()
     m_isStarted = false;
 #if USE(JSC)
     JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+<<<<<<< HEAD:WebCore/plugins/PluginView.cpp
 #endif
+=======
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+#if !PLATFORM(WX) // FIXME: Revisit this when implementing plugins for wx
+>>>>>>> webkit.org at 49305:WebCore/plugins/PluginView.cpp
 #ifdef XP_WIN
     // Unsubclass the window
     if (m_isWindowed) {
@@ -253,6 +355,8 @@ void PluginView::stop()
 #endif
     }
 #endif // XP_WIN
+#endif // !PLATFORM(WX)
+#endif // ENABLE(NETSCAPE_PLUGIN_API)
 
 #if !defined(XP_MACOSX)
     // Clear the window
@@ -332,33 +436,11 @@ static bool getString(ScriptController* proxy, JSValue result, String& string)
 }
 #endif
 
-bool PluginView::startOrAddToUnstartedList()
-{
-    if (!m_parentFrame->page())
-        return false;
-
-    if (!m_parentFrame->page()->canStartPlugins()) {
-        m_parentFrame->page()->addUnstartedPlugin(this);
-        m_isWaitingToStart = true;
-        return true;
-    }
-
-    return start();
-}
-
-void PluginView::removeFromUnstartedListIfNecessary()
+void PluginView::performRequest(PluginRequest* request)
 {
-    if (!m_isWaitingToStart)
-        return;
-
-    if (!m_parentFrame->page())
+    if (!m_isStarted)
         return;
 
-    m_parentFrame->page()->removeUnstartedPlugin(this);
-}
-
-void PluginView::performRequest(PluginRequest* request)
-{
     // don't let a plugin start any loads if it is no longer part of a document that is being 
     // displayed unless the loads are in the same frame as the plugin.
     const String& targetFrameName = request->frameLoadRequest().frameName();
@@ -473,9 +555,8 @@ NPError PluginView::load(const FrameLoadRequest& frameLoadRequest, bool sendNoti
         // For security reasons, only allow JS requests to be made on the frame that contains the plug-in.
         if (!targetFrameName.isNull() && m_parentFrame->tree()->find(targetFrameName) != m_parentFrame)
             return NPERR_INVALID_PARAM;
-    } else if (!FrameLoader::canLoad(url, String(), m_parentFrame->document())) {
+    } else if (!SecurityOrigin::canLoad(url, String(), m_parentFrame->document()))
             return NPERR_GENERIC_ERROR;
-    }
 
     PluginRequest* request = new PluginRequest(frameLoadRequest, sendNotification, notifyData, arePopupsAllowed());
     scheduleRequest(request);
@@ -794,7 +875,7 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_isTransparent(false)
     , m_haveInitialized(false)
     , m_isWaitingToStart(false)
-#if PLATFORM(GTK) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11)
     , m_needsXEmbed(false)
 #endif
 #if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
@@ -811,6 +892,13 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_drawingModel(NPDrawingModel(-1))
     , m_eventModel(NPEventModel(-1))
 #endif
+#if defined(Q_WS_X11)
+    , m_hasPendingGeometryChange(false)
+    , m_drawable(0)
+    , m_visual(0)
+    , m_colormap(0)
+    , m_pluginDisplay(0)
+#endif
     , m_loadManually(loadManually)
     , m_manualStream(0)
     , m_isJavaScriptPaused(false)
@@ -1211,7 +1299,12 @@ static const char* MozillaUserAgent = "Mozilla/5.0 ("
 #elif defined(XP_WIN)
         "Windows; U; Windows NT 5.1;"
 #elif defined(XP_UNIX)
-        "X11; U; Linux i686;"
+// The Gtk port uses X11 plugins in Mac.
+#if PLATFORM(DARWIN) && PLATFORM(GTK)
+    "X11; U; Intel Mac OS X;"
+#else
+    "X11; U; Linux i686;"
+#endif
 #endif
         " en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0";
 
@@ -1233,4 +1326,10 @@ const char* PluginView::userAgentStatic()
 }
 #endif
 
+
+Node* PluginView::node() const
+{
+    return m_element;
+}
+
 } // namespace WebCore
diff --git a/WebCore/plugins/PluginView.h b/WebCore/plugins/PluginView.h
index f88bfdf..0fd0d4f 100644
--- a/WebCore/plugins/PluginView.h
+++ b/WebCore/plugins/PluginView.h
@@ -30,6 +30,7 @@
 
 #include "CString.h"
 #include "FrameLoadRequest.h"
+#include "HaltablePlugin.h"
 #include "IntRect.h"
 #include "KURL.h"
 #include "PlatformString.h"
@@ -120,7 +121,7 @@ namespace WebCore {
         virtual void didFail(const ResourceError&) = 0;
     };
 
-    class PluginView : public Widget, private PluginStreamClient, public PluginManualLoader {
+    class PluginView : public Widget, private PluginStreamClient, public PluginManualLoader, private HaltablePlugin {
     public:
         static PassRefPtr<PluginView> create(Frame* parentFrame, const IntSize&, Element*, const KURL&, const Vector<String>& paramNames, const Vector<String>& paramValues, const String& mimeType, bool loadManually);
         virtual ~PluginView();
@@ -216,6 +217,11 @@ namespace WebCore {
         void didFinishLoading();
         void didFail(const ResourceError&);
 
+        // HaltablePlugin
+        virtual void halt();
+        virtual void restart();
+        virtual Node* node() const;
+
         static bool isCallingPlugin();
 
 #ifdef ANDROID_PLUGINS
@@ -232,8 +238,9 @@ namespace WebCore {
         bool startOrAddToUnstartedList();
         void removeFromUnstartedListIfNecessary();
         void init();
-        void platformStart();
+        bool platformStart();
         void stop();
+        void platformDestroy();
         static void setCurrentPluginView(PluginView*);
         NPError load(const FrameLoadRequest&, bool sendNotification, void* notifyData);
         NPError handlePost(const char* url, const char* target, uint32 len, const char* buf, bool file, void* notifyData, bool sendNotification, bool allowHeaders);
@@ -276,6 +283,10 @@ namespace WebCore {
 
         void handleKeyboardEvent(KeyboardEvent*);
         void handleMouseEvent(MouseEvent*);
+#if defined(Q_WS_X11)
+        void handleFocusInEvent();
+        void handleFocusOutEvent();
+#endif
 
 #ifdef ANDROID_PLUGINS
         void handleTouchEvent(TouchEvent*);
@@ -310,7 +321,7 @@ namespace WebCore {
         bool m_haveInitialized;
         bool m_isWaitingToStart;
 
-#if PLATFORM(GTK) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11)
         bool m_needsXEmbed;
 #endif
 
@@ -340,12 +351,13 @@ public:
         PlatformPluginWidget platformPluginWidget() const { return m_window; } // MANUAL MERGE FIXME
 #else
 public:
+        void setPlatformPluginWidget(PlatformPluginWidget widget) { setPlatformWidget(widget); }
         PlatformPluginWidget platformPluginWidget() const { return platformWidget(); }
 #endif
 
 private:
 
-#if PLATFORM(GTK) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11)
         void setNPWindowIfNeeded();
 #elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
@@ -360,6 +372,12 @@ private:
 
 #if defined(Q_WS_X11)
         bool m_hasPendingGeometryChange;
+        Pixmap m_drawable;
+        Visual* m_visual;
+        Colormap m_colormap;
+        Display* m_pluginDisplay;
+
+        void initXEvent(XEvent* event);
 #endif
 
         IntRect m_clipRect; // The clip rect to apply to a windowed plug-in
diff --git a/WebCore/plugins/PluginViewNone.cpp b/WebCore/plugins/PluginViewNone.cpp
index be79567..d4601d4 100644
--- a/WebCore/plugins/PluginViewNone.cpp
+++ b/WebCore/plugins/PluginViewNone.cpp
@@ -114,12 +114,14 @@ void PluginView::forceRedraw()
     notImplemented();
 }
 
-PluginView::~PluginView()
+bool PluginView::platformStart()
 {
     notImplemented();
+
+    return true;
 }
 
-void PluginView::init()
+void PluginView::platformDestroy()
 {
     notImplemented();
 }
@@ -134,9 +136,12 @@ void PluginView::updatePluginWidget()
     notImplemented();
 }
 
-void PluginView::platformStart()
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
 {
-    notImplemented();
 }
 
 } // namespace WebCore
diff --git a/WebCore/plugins/gtk/PluginViewGtk.cpp b/WebCore/plugins/gtk/PluginViewGtk.cpp
index 4dd2b32..bc3a622 100644
--- a/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -59,11 +59,10 @@
 #include <gdkconfig.h>
 #include <gtk/gtk.h>
 
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
 #include "gtk2xtbin.h"
 #include <gdk/gdkx.h>
-#endif
-#ifdef GDK_WINDOWING_WIN32
+#elif defined(GDK_WINDOWING_WIN32)
 #include "PluginMessageThrottlerWin.h"
 #include <gdk/gdkwin32.h>
 #endif
@@ -228,7 +227,7 @@ void PluginView::setNPWindowIfNeeded()
 
     GtkAllocation allocation = { m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height() };
     gtk_widget_size_allocate(platformPluginWidget(), &allocation);
-#if PLATFORM(X11)
+#if PLATFORM(XP_UNIX)
     if (!m_needsXEmbed) {
         gtk_xtbin_set_position(GTK_XTBIN(platformPluginWidget()), m_windowRect.x(), m_windowRect.y());
         gtk_xtbin_resize(platformPluginWidget(), m_windowRect.width(), m_windowRect.height());
@@ -293,7 +292,7 @@ NPError PluginView::getValueStatic(NPNVariable variable, void* value)
 
     switch (variable) {
     case NPNVToolkit:
-#if PLATFORM(GTK)
+#if defined(XP_UNIX)
         *static_cast<uint32*>(value) = 2;
 #else
         *static_cast<uint32*>(value) = 0;
@@ -301,7 +300,7 @@ NPError PluginView::getValueStatic(NPNVariable variable, void* value)
         return NPERR_NO_ERROR;
 
     case NPNVSupportsXEmbedBool:
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
         *static_cast<NPBool*>(value) = true;
 #else
         *static_cast<NPBool*>(value) = false;
@@ -323,7 +322,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
     switch (variable) {
     case NPNVxDisplay:
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
         if (m_needsXEmbed)
             *(void **)value = (void *)GDK_DISPLAY();
         else
@@ -333,7 +332,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
         return NPERR_GENERIC_ERROR;
 #endif
 
-#if PLATFORM(X11)
+#if PLATFORM(XP_UNIX)
     case NPNVxtAppContext:
         if (!m_needsXEmbed) {
             *(void **)value = XtDisplayToApplicationContext (GTK_XTBIN(platformPluginWidget())->xtclient.xtdisplay);
@@ -381,13 +380,13 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 #endif
 
         case NPNVnetscapeWindow: {
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
             void* w = reinterpret_cast<void*>(value);
-            *((XID *)w) = GDK_WINDOW_XWINDOW(m_parentFrame->view()->hostWindow()->platformWindow()->window);
+            *((XID *)w) = GDK_WINDOW_XWINDOW(m_parentFrame->view()->hostWindow()->platformPageClient()->window);
 #endif
 #ifdef GDK_WINDOWING_WIN32
             HGDIOBJ* w = reinterpret_cast<HGDIOBJ*>(value);
-            *w = GDK_WINDOW_HWND(m_parentFrame->view()->hostWindow()->platformWindow()->window);
+            *w = GDK_WINDOW_HWND(m_parentFrame->view()->hostWindow()->platformPageClient()->window);
 #endif
             return NPERR_NO_ERROR;
         }
@@ -429,22 +428,7 @@ void PluginView::forceRedraw()
     if (m_isWindowed)
         gtk_widget_queue_draw(platformPluginWidget());
     else
-        gtk_widget_queue_draw(m_parentFrame->view()->hostWindow()->platformWindow());
-}
-
-PluginView::~PluginView()
-{
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
-        m_plugin->unload();
+        gtk_widget_queue_draw(m_parentFrame->view()->hostWindow()->platformPageClient());
 }
 
 static gboolean
@@ -453,27 +437,10 @@ plug_removed_cb(GtkSocket *socket, gpointer)
     return TRUE;
 }
 
-void PluginView::init()
+bool PluginView::platformStart()
 {
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
-
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
-        return;
-    }
-
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    if (!start()) {
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
     if (m_plugin->pluginFuncs()->getvalue) {
         PluginView::setCurrentPluginView(this);
@@ -484,22 +451,22 @@ void PluginView::init()
         PluginView::setCurrentPluginView(0);
     }
 
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
     if (m_needsXEmbed) {
         setPlatformWidget(gtk_socket_new());
-        gtk_container_add(GTK_CONTAINER(m_parentFrame->view()->hostWindow()->platformWindow()), platformPluginWidget());
+        gtk_container_add(GTK_CONTAINER(m_parentFrame->view()->hostWindow()->platformPageClient()), platformPluginWidget());
         g_signal_connect(platformPluginWidget(), "plug_removed", G_CALLBACK(plug_removed_cb), NULL);
     } else if (m_isWindowed)
-        setPlatformWidget(gtk_xtbin_new(m_parentFrame->view()->hostWindow()->platformWindow()->window, 0));
+        setPlatformWidget(gtk_xtbin_new(m_parentFrame->view()->hostWindow()->platformPageClient()->window, 0));
 #else
     setPlatformWidget(gtk_socket_new());
-    gtk_container_add(GTK_CONTAINER(m_parentFrame->view()->hostWindow()->platformWindow()), platformPluginWidget());
+    gtk_container_add(GTK_CONTAINER(m_parentFrame->view()->hostWindow()->platformPageClient()), platformPluginWidget());
 #endif
     show();
 
     if (m_isWindowed) {
         m_npWindow.type = NPWindowTypeWindow;
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
         NPSetWindowCallbackStruct *ws = new NPSetWindowCallbackStruct();
 
         ws->type = 0;
@@ -533,10 +500,18 @@ void PluginView::init()
     if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall)))
         updatePluginWidget(); // was: setNPWindowIfNeeded(), but this doesn't produce 0x0 rects at first go
 
-    m_status = PluginStatusLoadedSuccessfully;
+    return true;
+}
+
+void PluginView::platformDestroy()
+{
+}
+
+void PluginView::halt()
+{
 }
 
-void PluginView::platformStart()
+void PluginView::restart()
 {
 }
 
diff --git a/WebCore/plugins/mac/PluginPackageMac.cpp b/WebCore/plugins/mac/PluginPackageMac.cpp
index bf6a81b..d242fb8 100644
--- a/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -246,9 +246,6 @@ bool PluginPackage::fetchInfo()
 
 bool PluginPackage::isPluginBlacklisted()
 {
-    if (name() == "Silverlight Plug-In" || name().startsWith("QuickTime Plug-in"))
-        return true;
-
     return false;
 }
 
diff --git a/WebCore/plugins/mac/PluginViewMac.cpp b/WebCore/plugins/mac/PluginViewMac.cpp
index 26f9eba..0ab91d1 100644
--- a/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/WebCore/plugins/mac/PluginViewMac.cpp
@@ -75,6 +75,7 @@ using JSC::UString;
 #if PLATFORM(QT)
 #include <QWidget>
 #include <QKeyEvent>
+#include "QWebPageClient.h"
 QT_BEGIN_NAMESPACE
 #if QT_VERSION < 0x040500
 extern Q_GUI_EXPORT WindowPtr qt_mac_window_for(const QWidget* w);
@@ -125,30 +126,10 @@ static inline IntPoint topLevelOffsetFor(PlatformWidget widget)
 
 // --------------- Lifetime management -----------------
 
-void PluginView::init()
+bool PluginView::platformStart()
 {
-    LOG(Plugins, "PluginView::init(): Initializing plug-in '%s'", m_plugin->name().utf8().data());
-
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
-
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
-        return;
-    }
-
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    if (!start()) {
-        m_status = PluginStatusCanNotLoadPlugin;
-        stop(); // Make sure we unregister the plugin
-        return;
-    }
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
     if (m_drawingModel == NPDrawingModel(-1)) {
         // We default to QuickDraw, even though we don't support it,
@@ -180,8 +161,7 @@ void PluginView::init()
         m_status = PluginStatusCanNotLoadPlugin;
         LOG(Plugins, "Plug-in '%s' uses unsupported event model %s",
                 m_plugin->name().utf8().data(), prettyNameForEventModel(m_eventModel));
-        stop();
-        return;
+        return false;
     }
 
     if (getValueStatic(NPNVariable(NPNVsupportsQuickDrawBool + m_drawingModel), &drawingModelSupported) != NPERR_NO_ERROR
@@ -189,38 +169,30 @@ void PluginView::init()
         m_status = PluginStatusCanNotLoadPlugin;
         LOG(Plugins, "Plug-in '%s' uses unsupported drawing model %s",
                 m_plugin->name().utf8().data(), prettyNameForDrawingModel(m_drawingModel));
-        stop();
-        return;
+        return false;
     }
 
-    setPlatformPluginWidget(m_parentFrame->view()->hostWindow()->platformWindow());
+#if PLATFORM(QT)
+    if (QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient()) {
+        if (QWidget* window = QWidget::find(client->winId())) {
+            setPlatformPluginWidget(window);
+        }
+    }
+#endif
 
     show();
 
-    m_status = PluginStatusLoadedSuccessfully;
-
     // TODO: Implement null timer throttling depending on plugin activation
     m_nullEventTimer.set(new Timer<PluginView>(this, &PluginView::nullEventTimerFired));
     m_nullEventTimer->startRepeating(0.02);
+
+    return true;
 }
 
-PluginView::~PluginView()
+void PluginView::platformDestroy()
 {
-    LOG(Plugins, "PluginView::~PluginView()");
-
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
-        m_plugin->unload();
-
-    m_window = 0;
+    if (platformPluginWidget())
+        setPlatformPluginWidget(0);
 }
 
 // Used before the plugin view has been initialized properly, and as a
@@ -456,6 +428,14 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
 
     setNPWindowIfNeeded();
 
+    CGContextRef cgContext = m_npCgContext.context;
+    if (!cgContext)
+        return;
+
+    CGContextSaveGState(cgContext);
+    IntPoint offset = frameRect().location();
+    CGContextTranslateCTM(cgContext, offset.x(), offset.y());
+
     EventRecord event;
     event.what = updateEvt;
     event.message = (long unsigned int)m_npCgContext.window;
@@ -464,15 +444,10 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     event.where.v = 0;
     event.modifiers = GetCurrentKeyModifiers();
 
-    CGContextRef cg = m_npCgContext.context;
-    CGContextSaveGState(cg);
-    IntPoint offset = frameRect().location();
-    CGContextTranslateCTM(cg, offset.x(), offset.y());
-
     if (!dispatchNPEvent(event))
         LOG(Events, "PluginView::paint(): Paint event not accepted");
 
-    CGContextRestoreGState(cg);
+    CGContextRestoreGState(cgContext);
 }
 
 void PluginView::invalidateRect(const IntRect& rect)
@@ -717,10 +692,13 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const c
     return NPERR_NO_ERROR;
 }
 
-void PluginView::platformStart()
+void PluginView::halt()
 {
 }
 
+void PluginView::restart()
+{
+}
 
 } // namespace WebCore
 
diff --git a/WebCore/plugins/qt/PluginPackageQt.cpp b/WebCore/plugins/qt/PluginPackageQt.cpp
index b9c1656..8119924 100644
--- a/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -63,7 +63,7 @@ bool PluginPackage::fetchInfo()
     String s = gm();
     Vector<String> types;
     s.split(UChar(';'), false, types);
-    for (int i = 0; i < types.size(); ++i) {
+    for (unsigned i = 0; i < types.size(); ++i) {
         Vector<String> mime;
         types[i].split(UChar(':'), true, mime);
         if (mime.size() > 0) {
@@ -80,6 +80,16 @@ bool PluginPackage::fetchInfo()
     return true;
 }
 
+static NPError staticPluginQuirkRequiresGtkToolKit_NPN_GetValue(NPP instance, NPNVariable variable, void* value)
+{
+    if (variable == NPNVToolkit) {
+        *static_cast<uint32*>(value) = 2;
+        return NPERR_NO_ERROR;
+    }
+
+    return NPN_GetValue(instance, variable, value);
+}
+
 bool PluginPackage::load()
 {
     if (m_isLoaded) {
@@ -111,6 +121,12 @@ bool PluginPackage::load()
 
     initializeBrowserFuncs();
 
+    if (m_path.contains("npwrapper.")) {
+        // nspluginwrapper relies on the toolkit value to know if glib is available
+        // It does so in NP_Initialize with a null instance, therefore it is done this way:
+        m_browserFuncs.getvalue = staticPluginQuirkRequiresGtkToolKit_NPN_GetValue;
+    }
+
 #if defined(XP_UNIX)
     npErr = NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
 #else
diff --git a/WebCore/plugins/qt/PluginViewQt.cpp b/WebCore/plugins/qt/PluginViewQt.cpp
index a02a8fd..27639e1 100644
--- a/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/WebCore/plugins/qt/PluginViewQt.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +31,8 @@
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
+#include "FloatPoint.h"
+#include "FocusController.h"
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameLoader.h"
@@ -56,12 +59,21 @@
 #include "npruntime_impl.h"
 #include "runtime.h"
 #include "runtime_root.h"
+#include "QWebPageClient.h"
+#include <QApplication>
+#include <QDesktopWidget>
 #include <QKeyEvent>
+#include <QPainter>
 #include <QWidget>
 #include <QX11Info>
 #include <runtime/JSLock.h>
 #include <runtime/JSValue.h>
 #include <X11/X.h>
+#ifndef QT_NO_XRENDER
+#define Bool int
+#define Status int
+#include <X11/extensions/Xrender.h>
+#endif
 
 using JSC::ExecState;
 using JSC::Interpreter;
@@ -79,7 +91,7 @@ using namespace HTMLNames;
 
 void PluginView::updatePluginWidget()
 {
-    if (!parent() || !m_isWindowed || !platformPluginWidget())
+    if (!parent())
         return;
 
     ASSERT(parent()->isFrameView());
@@ -95,6 +107,15 @@ void PluginView::updatePluginWidget()
     if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
         return;
 
+    if (m_drawable)
+        XFreePixmap(QX11Info::display(), m_drawable);
+
+    if (!m_isWindowed) {
+        m_drawable = XCreatePixmap(QX11Info::display(), QX11Info::appRootWindow(), m_windowRect.width(), m_windowRect.height(), 
+                                   ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth);
+        QApplication::syncX(); // make sure that the server knows about the Drawable
+    }
+
     // do not call setNPWindowIfNeeded immediately, will be called on paint()
     m_hasPendingGeometryChange = true;
 
@@ -149,8 +170,67 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     if (context->paintingDisabled())
         return;
 
-    if (m_isWindowed && platformPluginWidget())
-        setNPWindowIfNeeded();
+    setNPWindowIfNeeded();
+
+    if (m_isWindowed || !m_drawable)
+        return;
+
+    const bool syncX = m_pluginDisplay && m_pluginDisplay != QX11Info::display();
+
+    QPainter* painter = context->platformContext();
+
+    QPixmap qtDrawable = QPixmap::fromX11Pixmap(m_drawable, QPixmap::ExplicitlyShared);
+    const int drawableDepth = ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth;
+    ASSERT(drawableDepth == qtDrawable.depth());
+
+    if (m_isTransparent && drawableDepth != 32) {
+        // Attempt content propagation for drawable with no alpha by copying over from the backing store
+        QPoint offset;
+        QPaintDevice* backingStoreDevice =  QPainter::redirected(painter->device(), &offset);
+        offset = -offset; // negating the offset gives us the offset of the view within the backing store pixmap
+
+        const bool hasValidBackingStore = backingStoreDevice && backingStoreDevice->devType() == QInternal::Pixmap;
+        QPixmap* backingStorePixmap = static_cast<QPixmap*>(backingStoreDevice);
+
+        // We cannot grab contents from the backing store when painting on QGraphicsView items
+        // (because backing store contents are already transformed). What we really mean to do 
+        // here is to check if we are painting on QWebView, but let's be a little permissive :)
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        const bool backingStoreHasUntransformedContents = qobject_cast<QWidget*>(client->pluginParent());
+
+        if (hasValidBackingStore && backingStorePixmap->depth() == drawableDepth 
+            && backingStoreHasUntransformedContents) {
+            GC gc = XDefaultGC(QX11Info::display(), QX11Info::appScreen());
+            XCopyArea(QX11Info::display(), backingStorePixmap->handle(), m_drawable, gc,
+                offset.x() + m_windowRect.x() + m_clipRect.x(), offset.y() + m_windowRect.y() + m_clipRect.y(),
+                m_clipRect.width(), m_clipRect.height(), m_clipRect.x(), m_clipRect.y());
+        } else { // no backing store, clean the pixmap because the plugin thinks its transparent
+            QPainter painter(&qtDrawable);
+            painter.fillRect(m_clipRect, Qt::white);
+        }
+
+        if (syncX)
+            QApplication::syncX();
+    }
+
+    XEvent xevent;
+    memset(&xevent, 0, sizeof(XEvent));
+    XGraphicsExposeEvent& exposeEvent = xevent.xgraphicsexpose;
+    exposeEvent.type = GraphicsExpose;
+    exposeEvent.display = QX11Info::display();
+    exposeEvent.drawable = m_drawable;
+    exposeEvent.x = m_clipRect.x();
+    exposeEvent.y = m_clipRect.y();
+    exposeEvent.width = m_clipRect.x() + m_clipRect.width(); // flash bug? it thinks width is the right
+    exposeEvent.height = m_clipRect.y() + m_clipRect.height(); // flash bug? it thinks height is the bottom
+
+    dispatchNPEvent(xevent);
+
+    if (syncX)
+        XSync(m_pluginDisplay, False); // sync changes by plugin
+
+    painter->drawPixmap(frameRect().x() + m_clipRect.x(), frameRect().y() + m_clipRect.y(), qtDrawable,
+        m_clipRect.x(), m_clipRect.y(), m_clipRect.width(), m_clipRect.height());
 }
 
 // TODO: Unify across ports.
@@ -163,42 +243,52 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
     JSC::JSLock::DropAllLocks dropAllLocks(false);
 
     setCallingPlugin(true);
-    bool accepted = m_plugin->pluginFuncs();
+    bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
     setCallingPlugin(false);
 
     return accepted;
 }
 
-void setSharedXEventFields(XEvent& xEvent, QWidget* hostWindow)
+void setSharedXEventFields(XEvent* xEvent, QWidget* hostWindow)
 {
-    xEvent.xany.serial = 0; // we are unaware of the last request processed by X Server
-    xEvent.xany.send_event = false;
-    xEvent.xany.display = hostWindow->x11Info().display();
-    // NOTE: event.xany.window doesn't always respond to the .window property of other XEvent's
+    xEvent->xany.serial = 0; // we are unaware of the last request processed by X Server
+    xEvent->xany.send_event = false;
+    xEvent->xany.display = hostWindow->x11Info().display();
+    // NOTE: event->xany.window doesn't always respond to the .window property of other XEvent's
     // but does in the case of KeyPress, KeyRelease, ButtonPress, ButtonRelease, and MotionNotify
     // events; thus, this is right:
-    xEvent.xany.window = hostWindow->window()->handle();
+    xEvent->xany.window = hostWindow->window()->handle();
 }
 
-void setXKeyEventSpecificFields(XEvent& xEvent, KeyboardEvent* event)
+void PluginView::initXEvent(XEvent* xEvent)
+{
+    memset(xEvent, 0, sizeof(XEvent));
+
+    QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+    QWidget* window = QWidget::find(client->winId());
+    setSharedXEventFields(xEvent, window);
+}
+
+void setXKeyEventSpecificFields(XEvent* xEvent, KeyboardEvent* event)
 {
     QKeyEvent* qKeyEvent = event->keyEvent()->qtEvent();
 
-    xEvent.xkey.root = QX11Info::appRootWindow();
-    xEvent.xkey.subwindow = 0; // we have no child window
-    xEvent.xkey.time = event->timeStamp();
-    xEvent.xkey.state = qKeyEvent->nativeModifiers();
-    xEvent.xkey.keycode = qKeyEvent->nativeScanCode();
-    xEvent.xkey.same_screen = true;
+    xEvent->type = (event->type() == eventNames().keydownEvent) ? 2 : 3; // ints as Qt unsets KeyPress and KeyRelease
+    xEvent->xkey.root = QX11Info::appRootWindow();
+    xEvent->xkey.subwindow = 0; // we have no child window
+    xEvent->xkey.time = event->timeStamp();
+    xEvent->xkey.state = qKeyEvent->nativeModifiers();
+    xEvent->xkey.keycode = qKeyEvent->nativeScanCode();
+    xEvent->xkey.same_screen = true;
 
     // NOTE: As the XEvents sent to the plug-in are synthesized and there is not a native window
     // corresponding to the plug-in rectangle, some of the members of the XEvent structures are not
     // set to their normal Xserver values. e.g. Key events don't have a position.
     // source: https://developer.mozilla.org/en/NPEvent
-    xEvent.xkey.x = 0;
-    xEvent.xkey.y = 0;
-    xEvent.xkey.x_root = 0;
-    xEvent.xkey.y_root = 0;
+    xEvent->xkey.x = 0;
+    xEvent->xkey.y = 0;
+    xEvent->xkey.x_root = 0;
+    xEvent->xkey.y_root = 0;
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent* event)
@@ -206,23 +296,147 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
     if (m_isWindowed)
         return;
 
-    if (event->type() != "keydown" && event->type() != "keyup")
+    if (event->type() != eventNames().keydownEvent && event->type() != eventNames().keyupEvent)
         return;
 
-    XEvent npEvent; // On UNIX NPEvent is a typedef for XEvent.
-
-    npEvent.type = (event->type() == "keydown") ? 2 : 3; // ints as Qt unsets KeyPress and KeyRelease
-    setSharedXEventFields(npEvent, m_parentFrame->view()->hostWindow()->platformWindow());
-    setXKeyEventSpecificFields(npEvent, event);
+    XEvent npEvent;
+    initXEvent(&npEvent);
+    setXKeyEventSpecificFields(&npEvent, event);
 
     if (!dispatchNPEvent(npEvent))
         event->setDefaultHandled();
 }
 
+static unsigned int inputEventState(MouseEvent* event)
+{
+    unsigned int state = 0;
+    if (event->ctrlKey())
+        state |= ControlMask;
+    if (event->shiftKey())
+        state |= ShiftMask;
+    if (event->altKey())
+        state |= Mod1Mask;
+    if (event->metaKey())
+        state |= Mod4Mask;
+    return state;
+}
+
+static void setXButtonEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XButtonEvent& xbutton = xEvent->xbutton;
+    xbutton.type = event->type() == eventNames().mousedownEvent ? ButtonPress : ButtonRelease;
+    xbutton.root = QX11Info::appRootWindow();
+    xbutton.subwindow = 0;
+    xbutton.time = event->timeStamp();
+    xbutton.x = postZoomPos.x();
+    xbutton.y = postZoomPos.y();
+    xbutton.x_root = event->screenX();
+    xbutton.y_root = event->screenY();
+    xbutton.state = inputEventState(event);
+    switch (event->button()) {
+    case MiddleButton:
+        xbutton.button = Button2;
+        break;
+    case RightButton:
+        xbutton.button = Button3;
+        break;
+    case LeftButton:
+    default:
+        xbutton.button = Button1;
+        break;
+    }
+    xbutton.same_screen = true;
+}
+
+static void setXMotionEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XMotionEvent& xmotion = xEvent->xmotion;
+    xmotion.type = MotionNotify;
+    xmotion.root = QX11Info::appRootWindow();
+    xmotion.subwindow = 0;
+    xmotion.time = event->timeStamp();
+    xmotion.x = postZoomPos.x();
+    xmotion.y = postZoomPos.y();
+    xmotion.x_root = event->screenX();
+    xmotion.y_root = event->screenY();
+    xmotion.state = inputEventState(event);
+    xmotion.is_hint = NotifyNormal;
+    xmotion.same_screen = true;
+}
+
+static void setXCrossingEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XCrossingEvent& xcrossing = xEvent->xcrossing;
+    xcrossing.type = event->type() == eventNames().mouseoverEvent ? EnterNotify : LeaveNotify;
+    xcrossing.root = QX11Info::appRootWindow();
+    xcrossing.subwindow = 0;
+    xcrossing.time = event->timeStamp();
+    xcrossing.x = postZoomPos.y();
+    xcrossing.y = postZoomPos.x();
+    xcrossing.x_root = event->screenX();
+    xcrossing.y_root = event->screenY();
+    xcrossing.state = inputEventState(event);
+    xcrossing.mode = NotifyNormal;
+    xcrossing.detail = NotifyDetailNone;
+    xcrossing.same_screen = true;
+    xcrossing.focus = false;
+}
+
 void PluginView::handleMouseEvent(MouseEvent* event)
 {
     if (m_isWindowed)
         return;
+
+    if (event->type() == eventNames().mousedownEvent) {
+        // Give focus to the plugin on click
+        if (Page* page = m_parentFrame->page())
+            page->focusController()->setActive(true);
+
+        focusPluginElement();
+    }
+
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    IntPoint postZoomPos = roundedIntPoint(m_element->renderer()->absoluteToLocal(event->absoluteLocation()));
+
+    if (event->type() == eventNames().mousedownEvent || event->type() == eventNames().mouseupEvent)
+        setXButtonEventSpecificFields(&npEvent, event, postZoomPos);
+    else if (event->type() == eventNames().mousemoveEvent)
+        setXMotionEventSpecificFields(&npEvent, event, postZoomPos);
+    else if (event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mouseoverEvent)
+        setXCrossingEventSpecificFields(&npEvent, event, postZoomPos);
+    else
+        return;
+
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
+}
+
+void PluginView::handleFocusInEvent()
+{
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    XFocusChangeEvent& event = npEvent.xfocus;
+    event.type = 9; /* int as Qt unsets FocusIn */
+    event.mode = NotifyNormal;
+    event.detail = NotifyDetailNone;
+
+    dispatchNPEvent(npEvent);
+}
+
+void PluginView::handleFocusOutEvent()
+{
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    XFocusChangeEvent& event = npEvent.xfocus;
+    event.type = 10; /* int as Qt unsets FocusOut */
+    event.mode = NotifyNormal;
+    event.detail = NotifyDetailNone;
+
+    dispatchNPEvent(npEvent);
 }
 
 void PluginView::setParent(ScrollView* parent)
@@ -235,7 +449,8 @@ void PluginView::setParent(ScrollView* parent)
 
 void PluginView::setNPWindowRect(const IntRect&)
 {
-    // Ignored as we don't want to move immediately.
+    if (!m_isWindowed)
+        setNPWindowIfNeeded();
 }
 
 void PluginView::setNPWindowIfNeeded()
@@ -251,28 +466,38 @@ void PluginView::setNPWindowIfNeeded()
         return;
     m_hasPendingGeometryChange = false;
 
-    ASSERT(platformPluginWidget());
-    platformPluginWidget()->setGeometry(m_windowRect);
-    // if setMask is set with an empty QRegion, no clipping will
-    // be performed, so in that case we hide the plugin view
-    platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
-    platformPluginWidget()->setMask(QRegion(m_clipRect));
+    if (m_isWindowed) {
+        ASSERT(platformPluginWidget());
+        platformPluginWidget()->setGeometry(m_windowRect);
+        // if setMask is set with an empty QRegion, no clipping will
+        // be performed, so in that case we hide the plugin view
+        platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
+        platformPluginWidget()->setMask(QRegion(m_clipRect));
+
+        m_npWindow.x = m_windowRect.x();
+        m_npWindow.y = m_windowRect.y();
+
+        m_npWindow.clipRect.left = m_clipRect.x();
+        m_npWindow.clipRect.top = m_clipRect.y();
+        m_npWindow.clipRect.right = m_clipRect.width();
+        m_npWindow.clipRect.bottom = m_clipRect.height();
+    } else {
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+
+        m_npWindow.clipRect.left = 0;
+        m_npWindow.clipRect.top = 0;
+        m_npWindow.clipRect.right = 0;
+        m_npWindow.clipRect.bottom = 0;
+    }
 
     // FLASH WORKAROUND: Only set initially. Multiple calls to
-    // setNPWindow() cause the plugin to crash.
-    if (m_npWindow.width == -1 || m_npWindow.height == -1) {
+    // setNPWindow() cause the plugin to crash in windowed mode.
+    if (!m_isWindowed || m_npWindow.width == -1 || m_npWindow.height == -1) {
         m_npWindow.width = m_windowRect.width();
         m_npWindow.height = m_windowRect.height();
     }
 
-    m_npWindow.x = m_windowRect.x();
-    m_npWindow.y = m_windowRect.y();
-
-    m_npWindow.clipRect.left = m_clipRect.x();
-    m_npWindow.clipRect.top = m_clipRect.y();
-    m_npWindow.clipRect.right = m_clipRect.width();
-    m_npWindow.clipRect.bottom = m_clipRect.height();
-
     PluginView::setCurrentPluginView(this);
     JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
     setCallingPlugin(true);
@@ -337,6 +562,10 @@ NPError PluginView::getValueStatic(NPNVariable variable, void* value)
         *static_cast<NPBool*>(value) = true;
         return NPERR_NO_ERROR;
 
+    case NPNVSupportsWindowless:
+        *static_cast<NPBool*>(value) = true;
+        return NPERR_NO_ERROR;
+
     default:
         return NPERR_GENERIC_ERROR;
     }
@@ -350,8 +579,11 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
     case NPNVxDisplay:
         if (platformPluginWidget())
             *(void **)value = platformPluginWidget()->x11Info().display();
-        else
-            *(void **)value = m_parentFrame->view()->hostWindow()->platformWindow()->x11Info().display();
+        else {
+            QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+            QWidget* window = QWidget::find(client->winId());
+            *(void **)value = window->x11Info().display();
+        }
         return NPERR_NO_ERROR;
 
     case NPNVxtAppContext:
@@ -396,7 +628,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
     case NPNVnetscapeWindow: {
         void* w = reinterpret_cast<void*>(value);
-        *((XID *)w) = m_parentFrame->view()->hostWindow()->platformWindow()->winId();
+        *((XID *)w) = m_parentFrame->view()->hostWindow()->platformPageClient()->winId();
         return NPERR_NO_ERROR;
     }
 
@@ -413,7 +645,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
-    if (platformWidget()) {
+    if (m_isWindowed) {
         platformWidget()->update(rect);
         return;
     }
@@ -423,59 +655,94 @@ void PluginView::invalidateRect(const IntRect& rect)
 
 void PluginView::invalidateRect(NPRect* rect)
 {
-    notImplemented();
+    if (!rect) {
+        invalidate();
+        return;
+    }
+    IntRect r(rect->left, rect->top, rect->right + rect->left, rect->bottom + rect->top);
+    invalidateWindowlessPluginRect(r);
 }
 
 void PluginView::invalidateRegion(NPRegion region)
 {
-    notImplemented();
+    invalidate();
 }
 
 void PluginView::forceRedraw()
 {
-    notImplemented();
+    invalidate();
 }
 
-PluginView::~PluginView()
+static Display *getPluginDisplay()
 {
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
-        m_plugin->unload();
-
-    delete platformPluginWidget();
+    // The plugin toolkit might run using a different X connection. At the moment, we only
+    // support gdk based plugins (like flash) that use a different X connection.
+    // The code below has the same effect as this one:
+    // Display *gdkDisplay = gdk_x11_display_get_xdisplay(gdk_display_get_default());
+    QLibrary library("libgdk-x11-2.0");
+    if (!library.load())
+        return 0;
+
+    typedef void *(*gdk_display_get_default_ptr)();
+    gdk_display_get_default_ptr gdk_display_get_default = (gdk_display_get_default_ptr)library.resolve("gdk_display_get_default");
+    if (!gdk_display_get_default)
+        return 0;
+
+    typedef void *(*gdk_x11_display_get_xdisplay_ptr)(void *);
+    gdk_x11_display_get_xdisplay_ptr gdk_x11_display_get_xdisplay = (gdk_x11_display_get_xdisplay_ptr)library.resolve("gdk_x11_display_get_xdisplay");
+    if (!gdk_x11_display_get_xdisplay)
+        return 0;
+
+    return (Display*)gdk_x11_display_get_xdisplay(gdk_display_get_default());
 }
 
-void PluginView::init()
+static void getVisualAndColormap(int depth, Visual **visual, Colormap *colormap)
 {
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
+    *visual = 0;
+    *colormap = 0;
 
-    m_hasPendingGeometryChange = false;
+#ifndef QT_NO_XRENDER
+    static const bool useXRender = qgetenv("QT_X11_NO_XRENDER").isNull(); // Should also check for XRender >= 0.5
+#else
+    static const bool useXRender = false;
+#endif
 
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
+    if (!useXRender && depth == 32)
         return;
-    }
 
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
+    int nvi;
+    XVisualInfo templ;
+    templ.screen  = QX11Info::appScreen();
+    templ.depth   = depth;
+    templ.c_class = TrueColor;
+    XVisualInfo* xvi = XGetVisualInfo(QX11Info::display(), VisualScreenMask | VisualDepthMask | VisualClassMask, &templ, &nvi);
 
-    if (!start()) {
-        m_status = PluginStatusCanNotLoadPlugin;
+    if (!xvi)
         return;
-    }
+
+#ifndef QT_NO_XRENDER
+    if (depth == 32) {
+        for (int idx = 0; idx < nvi; ++idx) {
+            XRenderPictFormat* format = XRenderFindVisualFormat(QX11Info::display(), xvi[idx].visual);
+            if (format->type == PictTypeDirect && format->direct.alphaMask) {
+                 *visual = xvi[idx].visual;
+                 break;
+            }
+         }
+    } else
+#endif // QT_NO_XRENDER
+        *visual = xvi[0].visual;
+
+    XFree(xvi);
+
+    if (*visual)
+        *colormap = XCreateColormap(QX11Info::display(), QX11Info::appRootWindow(), *visual, AllocNone);
+}
+
+bool PluginView::platformStart()
+{
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
     if (m_plugin->pluginFuncs()->getvalue) {
         PluginView::setCurrentPluginView(this);
@@ -486,41 +753,92 @@ void PluginView::init()
         PluginView::setCurrentPluginView(0);
     }
 
-    if (m_needsXEmbed) {
-        setPlatformWidget(new PluginContainerQt(this, m_parentFrame->view()->hostWindow()->platformWindow()));
+    if (m_isWindowed) {
+        if (m_needsXEmbed) {
+            QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+            setPlatformWidget(new PluginContainerQt(this, QWidget::find(client->winId())));
+            // sync our XEmbed container window creation before sending the xid to plugins.
+            QApplication::syncX();
+        } else {
+            notImplemented();
+            m_status = PluginStatusCanNotLoadPlugin;
+            return false;
+        }
     } else {
-        notImplemented();
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
+        setPlatformWidget(0);
+        m_pluginDisplay = getPluginDisplay();
     }
-    show();
 
-    NPSetWindowCallbackStruct *wsi = new NPSetWindowCallbackStruct();
+    show();
 
+    NPSetWindowCallbackStruct* wsi = new NPSetWindowCallbackStruct();
     wsi->type = 0;
 
-    wsi->display = platformPluginWidget()->x11Info().display();
-    wsi->visual = (Visual*)platformPluginWidget()->x11Info().visual();
-    wsi->depth = platformPluginWidget()->x11Info().depth();
-    wsi->colormap = platformPluginWidget()->x11Info().colormap();
-    m_npWindow.ws_info = wsi;
+    if (m_isWindowed) {
+        const QX11Info* x11Info = &platformPluginWidget()->x11Info();
+
+        wsi->display = x11Info->display();
+        wsi->visual = (Visual*)x11Info->visual();
+        wsi->depth = x11Info->depth();
+        wsi->colormap = x11Info->colormap();
+
+        m_npWindow.type = NPWindowTypeWindow;
+        m_npWindow.window = (void*)platformPluginWidget()->winId();
+        m_npWindow.width = -1;
+        m_npWindow.height = -1;
+    } else {
+        const QX11Info* x11Info = &QApplication::desktop()->x11Info();
+
+        if (x11Info->depth() == 32 || !m_plugin->quirks().contains(PluginQuirkRequiresDefaultScreenDepth)) {
+            getVisualAndColormap(32, &m_visual, &m_colormap);
+            wsi->depth = 32;
+        }
+
+        if (!m_visual) {
+            getVisualAndColormap(x11Info->depth(), &m_visual, &m_colormap);
+            wsi->depth = x11Info->depth();
+        }
+
+        wsi->display = x11Info->display();
+        wsi->visual = m_visual;
+        wsi->colormap = m_colormap;
 
-    m_npWindow.type = NPWindowTypeWindow;
-    m_npWindow.window = (void*)platformPluginWidget()->winId();
-    m_npWindow.width = -1;
-    m_npWindow.height = -1;
+        m_npWindow.type = NPWindowTypeDrawable;
+        m_npWindow.window = 0; // Not used?
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+        m_npWindow.width = -1;
+        m_npWindow.height = -1;
+    }
+
+    m_npWindow.ws_info = wsi;
 
     if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall))) {
         updatePluginWidget();
         setNPWindowIfNeeded();
     }
 
-    m_status = PluginStatusLoadedSuccessfully;
+    return true;
 }
 
-void PluginView::platformStart()
+void PluginView::platformDestroy()
+{
+    if (platformPluginWidget())
+        delete platformPluginWidget();
+
+    if (m_drawable)
+        XFreePixmap(QX11Info::display(), m_drawable);
+
+    if (m_colormap)
+        XFreeColormap(QX11Info::display(), m_colormap);
+}
+
+void PluginView::halt()
 {
 }
 
+void PluginView::restart()
+{
+}
 
 } // namespace WebCore
diff --git a/WebCore/plugins/win/PaintHooks.asm b/WebCore/plugins/win/PaintHooks.asm
new file mode 100644
index 0000000..1508813
--- /dev/null
+++ b/WebCore/plugins/win/PaintHooks.asm
@@ -0,0 +1,50 @@
+;/*
+;    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+;
+;    This library is free software; you can redistribute it and/or
+;    modify it under the terms of the GNU Library General Public
+;    License as published by the Free Software Foundation; either
+;    version 2 of the License, or (at your option) any later version.
+;
+;    This library is distributed in the hope that it will be useful,
+;    but WITHOUT ANY WARRANTY; without even the implied warranty of
+;    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;    Library General Public License for more details.
+;
+;    You should have received a copy of the GNU Library General Public License
+;    along with this library; see the file COPYING.LIB.  If not, write to
+;    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+;    Boston, MA 02110-1301, USA.
+;*/
+
+;HDC __stdcall _HBeginPaint(HWND hWnd, LPPAINTSTRUCT lpPaint);
+
+PUBLIC  _HBeginPaint
+
+_TEXT   SEGMENT
+
+_HBeginPaint PROC
+     mov  r10,rcx
+     mov  eax,1017h
+     syscall
+     ret
+_HBeginPaint ENDP
+
+_TEXT   ENDS
+
+;BOOL __stdcall _HEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint);
+
+PUBLIC  _HEndPaint
+
+_TEXT   SEGMENT
+
+_HEndPaint PROC
+    mov  r10,rcx
+    mov  eax,1019h
+    syscall
+    ret
+_HEndPaint ENDP
+
+_TEXT   ENDS
+
+END
diff --git a/WebCore/plugins/win/PluginViewWin.cpp b/WebCore/plugins/win/PluginViewWin.cpp
index 0da4402..ccbf6f8 100644
--- a/WebCore/plugins/win/PluginViewWin.cpp
+++ b/WebCore/plugins/win/PluginViewWin.cpp
@@ -29,6 +29,7 @@
 
 #include "PluginView.h"
 
+#include "BitmapImage.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -52,6 +53,7 @@
 #include "PluginMessageThrottlerWin.h"
 #include "PluginPackage.h"
 #include "PluginMainThreadScheduler.h"
+#include "RenderWidget.h"
 #include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include "PluginDatabase.h"
@@ -74,17 +76,17 @@
 #endif
 
 #if PLATFORM(QT)
-#include <QWidget.h>
+#include "QWebPageClient.h"
 #endif
 
-static inline HWND windowHandleForPlatformWidget(PlatformWidget widget)
+static inline HWND windowHandleForPageClient(PlatformPageClient client)
 {
 #if PLATFORM(QT)
-    if (!widget)
+    if (!client)
         return 0;
-    return widget->winId();
+    return client->winId();
 #else
-    return widget;
+    return client;
 #endif
 }
 
@@ -115,6 +117,14 @@ static BYTE* beginPaint;
 static unsigned endPaintSysCall;
 static BYTE* endPaint;
 
+typedef HDC (WINAPI *PtrBeginPaint)(HWND, PAINTSTRUCT*);
+typedef BOOL (WINAPI *PtrEndPaint)(HWND, const PAINTSTRUCT*);
+
+#if PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
+extern "C" HDC __stdcall _HBeginPaint(HWND hWnd, LPPAINTSTRUCT lpPaint);
+extern "C" BOOL __stdcall _HEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint);
+#endif
+
 HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
 {
     PluginView* pluginView = reinterpret_cast<PluginView*>(GetProp(hWnd, kWebPluginViewProperty));
@@ -137,12 +147,14 @@ HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
          : "memory"
         );
     return result;
-#else
+#elif defined(_M_IX86)
     // Call through to the original BeginPaint.
     __asm   mov     eax, beginPaintSysCall
     __asm   push    lpPaint
     __asm   push    hWnd
     __asm   call    beginPaint
+#else
+    return _HBeginPaint(hWnd, lpPaint);
 #endif
 }
 
@@ -164,12 +176,14 @@ BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
          : "a" (endPaintSysCall), "g" (lpPaint), "g" (hWnd), "m" (*endPaint)
         );
     return result;
-#else
+#elif defined (_M_IX86)
     // Call through to the original EndPaint.
     __asm   mov     eax, endPaintSysCall
     __asm   push    lpPaint
     __asm   push    hWnd
     __asm   call    endPaint
+#else
+    return _HEndPaint(hWnd, lpPaint);
 #endif
 }
 
@@ -182,6 +196,7 @@ static void hook(const char* module, const char* proc, unsigned& sysCallID, BYTE
 
     pProc = reinterpret_cast<BYTE*>(reinterpret_cast<ptrdiff_t>(GetProcAddress(hMod, proc)));
 
+#if COMPILER(GCC) || defined(_M_IX86)
     if (pProc[0] != 0xB8)
         return;
 
@@ -197,6 +212,35 @@ static void hook(const char* module, const char* proc, unsigned& sysCallID, BYTE
     *reinterpret_cast<unsigned*>(pProc + 1) = reinterpret_cast<intptr_t>(pNewProc) - reinterpret_cast<intptr_t>(pProc + 5);
 
     pProc += 5;
+#else
+    /* Disassembly of BeginPaint()
+    00000000779FC5B0 4C 8B D1         mov         r10,rcx
+    00000000779FC5B3 B8 17 10 00 00   mov         eax,1017h
+    00000000779FC5B8 0F 05            syscall
+    00000000779FC5BA C3               ret
+    00000000779FC5BB 90               nop
+    00000000779FC5BC 90               nop
+    00000000779FC5BD 90               nop
+    00000000779FC5BE 90               nop
+    00000000779FC5BF 90               nop
+    00000000779FC5C0 90               nop
+    00000000779FC5C1 90               nop
+    00000000779FC5C2 90               nop
+    00000000779FC5C3 90               nop
+    */
+    // Check for the signature as in the above disassembly
+    DWORD guard = 0xB8D18B4C;
+    if (*reinterpret_cast<DWORD*>(pProc) != guard)
+        return;
+
+    DWORD flOldProtect;
+    VirtualProtect(pProc, 12, PAGE_EXECUTE_READWRITE, & flOldProtect);
+    pProc[0] = 0x48;    // mov rax, this
+    pProc[1] = 0xb8;
+    *(__int64*)(pProc+2) = (__int64)pNewProc;
+    pProc[10] = 0xff;   // jmp rax
+    pProc[11] = 0xe0;
+#endif
 }
 
 static void setUpOffscreenPaintingHooks(HDC (WINAPI*hookedBeginPaint)(HWND, PAINTSTRUCT*), BOOL (WINAPI*hookedEndPaint)(HWND, const PAINTSTRUCT*))
@@ -838,7 +882,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
         case NPNVnetscapeWindow: {
             HWND* w = reinterpret_cast<HWND*>(value);
 
-            *w = windowHandleForPlatformWidget(parent() ? parent()->hostWindow()->platformWindow() : 0);
+            *w = windowHandleForPageClient(parent() ? parent()->hostWindow()->platformPageClient() : 0);
 
             return NPERR_NO_ERROR;
         }
@@ -910,55 +954,10 @@ void PluginView::forceRedraw()
     if (m_isWindowed)
         ::UpdateWindow(platformPluginWidget());
     else
-        ::UpdateWindow(windowHandleForPlatformWidget(parent() ? parent()->hostWindow()->platformWindow() : 0));
-}
-
-PluginView::~PluginView()
-{
-    removeFromUnstartedListIfNecessary();
-
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    if (platformPluginWidget())
-        DestroyWindow(platformPluginWidget());
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin))
-        m_plugin->unload();
+        ::UpdateWindow(windowHandleForPageClient(parent() ? parent()->hostWindow()->platformPageClient() : 0));
 }
 
-void PluginView::init()
-{
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
-
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
-        return;
-    }
-
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    if (!startOrAddToUnstartedList()) {
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    m_status = PluginStatusLoadedSuccessfully;
-}
-
-void PluginView::platformStart()
+bool PluginView::platformStart()
 {
     ASSERT(m_isStarted);
     ASSERT(m_status == PluginStatusLoadedSuccessfully);
@@ -973,7 +972,7 @@ void PluginView::platformStart()
         if (isSelfVisible())
             flags |= WS_VISIBLE;
 
-        HWND parentWindowHandle = windowHandleForPlatformWidget(m_parentFrame->view()->hostWindow()->platformWindow());
+        HWND parentWindowHandle = windowHandleForPageClient(m_parentFrame->view()->hostWindow()->platformPageClient());
         HWND window = ::CreateWindowEx(0, kWebPluginViewdowClassName, 0, flags,
                                        0, 0, 0, 0, parentWindowHandle, 0, Page::instanceHandle(), 0);
 
@@ -1005,6 +1004,40 @@ void PluginView::platformStart()
 
     if (!m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall))
         setNPWindowRect(frameRect());
+
+    return true;
+}
+
+void PluginView::platformDestroy()
+{
+    if (!platformPluginWidget())
+        return;
+
+    DestroyWindow(platformPluginWidget());
+    setPlatformPluginWidget(0);
+}
+
+void PluginView::halt()
+{
+#if !PLATFORM(QT)
+    // Show a screenshot of the plug-in.
+    OwnPtr<HBITMAP> nodeImage(m_parentFrame->nodeImage(m_element));
+    toRenderWidget(m_element->renderer())->showSubstituteImage(BitmapImage::create(nodeImage.get()));
+#endif
+
+    stop();
+    platformDestroy();
+}
+
+void PluginView::restart()
+{
+    ASSERT(!m_isStarted);
+
+    // Clear any substitute image.
+    toRenderWidget(m_element->renderer())->showSubstituteImage(0);
+
+    m_haveUpdatedPluginWidget = false;
+    start();
 }
 
 } // namespace WebCore
diff --git a/WebCore/rendering/CounterNode.cpp b/WebCore/rendering/CounterNode.cpp
index c30ca9a..f546abb 100644
--- a/WebCore/rendering/CounterNode.cpp
+++ b/WebCore/rendering/CounterNode.cpp
@@ -63,11 +63,17 @@ void CounterNode::recount()
     for (CounterNode* c = this; c; c = c->m_nextSibling) {
         int oldCount = c->m_countInParent;
         int newCount = c->computeCountInParent();
-        c->m_countInParent = newCount;
         if (oldCount == newCount)
             break;
-        if (c->m_renderer->isCounter())
-            c->m_renderer->setNeedsLayoutAndPrefWidthsRecalc();
+        c->m_countInParent = newCount;
+        // m_renderer contains the parent of the render node
+        // corresponding to a CounterNode. Let's find the counter
+        // child and make this re-layout.
+        for (RenderObject* o = c->m_renderer->firstChild(); o; o = o->nextSibling())
+            if (!o->documentBeingDestroyed() && o->isCounter()) {
+                o->setNeedsLayoutAndPrefWidthsRecalc();
+                break;
+            }
     }
 }
 
@@ -167,13 +173,13 @@ static void showTreeAndMark(const CounterNode* node)
 
     for (const CounterNode* c = root; c; c = nextInPreOrder(c)) {
         if (c == node)
-            fprintf(stderr, "*");                        
+            fprintf(stderr, "*");
         for (const CounterNode* d = c; d && d != root; d = d->parent())
             fprintf(stderr, "\t");
         if (c->isReset())
-            fprintf(stderr, "reset: %d\n", c->value());
+            fprintf(stderr, "reset: %d %d\n", c->value(), c->countInParent());
         else
-            fprintf(stderr, "increment: %d\n", c->value());
+            fprintf(stderr, "increment: %d %d\n", c->value(), c->countInParent());
     }
 }
 
diff --git a/WebCore/rendering/FixedTableLayout.cpp b/WebCore/rendering/FixedTableLayout.cpp
index ee3e75a..4852708 100644
--- a/WebCore/rendering/FixedTableLayout.cpp
+++ b/WebCore/rendering/FixedTableLayout.cpp
@@ -188,6 +188,11 @@ int FixedTableLayout::calcWidthArray(int)
     return usedWidth;
 }
 
+// Use a very large value (in effect infinite). But not too large!
+// numeric_limits<int>::max() will too easily overflow widths.
+// Keep this in synch with BLOCK_MAX_WIDTH in RenderBlock.cpp
+#define TABLE_MAX_WIDTH 15000
+
 void FixedTableLayout::calcPrefWidths(int& minWidth, int& maxWidth)
 {
     // FIXME: This entire calculation is incorrect for both minwidth and maxwidth.
@@ -206,6 +211,24 @@ void FixedTableLayout::calcPrefWidths(int& minWidth, int& maxWidth)
 
     minWidth = max(mw, tableWidth);
     maxWidth = minWidth;
+
+    // This quirk is very similar to one that exists in RenderBlock::calcBlockPrefWidths().
+    // Here's the example for this one:
+    /*
+        <table style="width:100%; background-color:red"><tr><td>
+            <table style="background-color:blue"><tr><td>
+                <table style="width:100%; background-color:green; table-layout:fixed"><tr><td>
+                    Content
+                </td></tr></table>
+            </td></tr></table>
+        </td></tr></table>
+    */ 
+    // In this example, the two inner tables should be as large as the outer table. 
+    // We can achieve this effect by making the maxwidth of fixed tables with percentage
+    // widths be infinite.
+    if (m_table->style()->htmlHacks() && m_table->style()->width().isPercent() 
+        && maxWidth < TABLE_MAX_WIDTH)
+        maxWidth = TABLE_MAX_WIDTH;
 }
 
 void FixedTableLayout::layout()
diff --git a/WebCore/rendering/HitTestResult.cpp b/WebCore/rendering/HitTestResult.cpp
index b7de46b..0aaddc9 100644
--- a/WebCore/rendering/HitTestResult.cpp
+++ b/WebCore/rendering/HitTestResult.cpp
@@ -209,7 +209,7 @@ String HitTestResult::altDisplayString() const
     
     if (m_innerNonSharedNode->hasTagName(imgTag)) {
         HTMLImageElement* image = static_cast<HTMLImageElement*>(m_innerNonSharedNode.get());
-        return displayString(image->alt(), m_innerNonSharedNode.get());
+        return displayString(image->getAttribute(altAttr), m_innerNonSharedNode.get());
     }
     
     if (m_innerNonSharedNode->hasTagName(inputTag)) {
diff --git a/WebCore/rendering/InlineBox.cpp b/WebCore/rendering/InlineBox.cpp
index bbf11b3..2575fb7 100644
--- a/WebCore/rendering/InlineBox.cpp
+++ b/WebCore/rendering/InlineBox.cpp
@@ -98,18 +98,11 @@ int InlineBox::height() const
         return toRenderBox(m_renderer)->height();
 
     ASSERT(isInlineFlowBox());
-    const InlineFlowBox* flowBox = static_cast<const InlineFlowBox*>(this);
     RenderBoxModelObject* flowObject = boxModelObject();
     const Font& font = renderer()->style(m_firstLine)->font();
     int result = font.height();
-    bool strictMode = renderer()->document()->inStrictMode();
     if (parent())
         result += flowObject->borderTop() + flowObject->paddingTop() + flowObject->borderBottom() + flowObject->paddingBottom();
-    if (strictMode || flowBox->hasTextChildren() || flowObject->hasHorizontalBordersOrPadding())
-        return result;
-    int bottom = root()->bottomOverflow();
-    if (y() + result > bottom)
-        result = bottom - y();
     return result;
 }
 
diff --git a/WebCore/rendering/InlineBox.h b/WebCore/rendering/InlineBox.h
index c03758d..e165f0c 100644
--- a/WebCore/rendering/InlineBox.h
+++ b/WebCore/rendering/InlineBox.h
@@ -208,11 +208,6 @@ public:
     inline int baselinePosition(bool isRootLineBox) const { return renderer()->baselinePosition(m_firstLine, isRootLineBox); }
     inline int lineHeight(bool isRootLineBox) const { return renderer()->lineHeight(m_firstLine, isRootLineBox); }
 
-    virtual int topOverflow() const { return y(); }
-    virtual int bottomOverflow() const { return y() + height(); }
-    virtual int leftOverflow() const { return x(); }
-    virtual int rightOverflow() const { return x() + width(); }
-
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
     virtual unsigned caretMaxRenderedOffset() const;
diff --git a/WebCore/rendering/InlineFlowBox.cpp b/WebCore/rendering/InlineFlowBox.cpp
index 543c190..143d3d8 100644
--- a/WebCore/rendering/InlineFlowBox.cpp
+++ b/WebCore/rendering/InlineFlowBox.cpp
@@ -29,6 +29,7 @@
 #include "RootInlineBox.h"
 #include "RenderBlock.h"
 #include "RenderInline.h"
+#include "RenderLayer.h"
 #include "RenderListMarker.h"
 #include "RenderTableCell.h"
 #include "RootInlineBox.h"
@@ -167,6 +168,8 @@ void InlineFlowBox::adjustPosition(int dx, int dy)
     InlineRunBox::adjustPosition(dx, dy);
     for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
         child->adjustPosition(dx, dy);
+    if (m_overflow)
+        m_overflow->move(dx, dy);
 }
 
 RenderLineBoxList* InlineFlowBox::rendererLineBoxes() const
@@ -248,16 +251,21 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
     }
 }
 
-int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& rightPosition, bool& needsWordSpacing)
+int InlineFlowBox::placeBoxesHorizontally(int xPos, bool& needsWordSpacing)
 {
     // Set our x position.
     setX(xPos);
 
+    int leftLayoutOverflow = xPos;
+    int rightLayoutOverflow = xPos;
+    int leftVisualOverflow = xPos;
+    int rightVisualOverflow = xPos;
+
     int boxShadowLeft;
     int boxShadowRight;
     renderer()->style(m_firstLine)->getBoxShadowHorizontalExtent(boxShadowLeft, boxShadowRight);
 
-    leftPosition = min(xPos + boxShadowLeft, leftPosition);
+    leftVisualOverflow = min(xPos + boxShadowLeft, leftVisualOverflow);
 
     int startX = xPos;
     xPos += borderLeft() + paddingLeft();
@@ -275,23 +283,24 @@ int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& righ
             
             int strokeOverflow = static_cast<int>(ceilf(rt->style()->textStrokeWidth() / 2.0f));
             
-            // If letter-spacing is negative, we should factor that into right overflow. (Even in RTL, letter-spacing is
+            // If letter-spacing is negative, we should factor that into right layout overflow. (Even in RTL, letter-spacing is
             // applied to the right, so this is not an issue with left overflow.
             int letterSpacing = min(0, (int)rt->style(m_firstLine)->font().letterSpacing());
-            
+            rightLayoutOverflow = max(xPos + text->width() - letterSpacing, rightLayoutOverflow);
+
             int leftGlyphOverflow = -strokeOverflow;
             int rightGlyphOverflow = strokeOverflow - letterSpacing;
             
-            int visualOverflowLeft = leftGlyphOverflow;
-            int visualOverflowRight = rightGlyphOverflow;
+            int childOverflowLeft = leftGlyphOverflow;
+            int childOverflowRight = rightGlyphOverflow;
             for (ShadowData* shadow = rt->style()->textShadow(); shadow; shadow = shadow->next) {
-                visualOverflowLeft = min(visualOverflowLeft, shadow->x - shadow->blur + leftGlyphOverflow);
-                visualOverflowRight = max(visualOverflowRight, shadow->x + shadow->blur + rightGlyphOverflow);
+                childOverflowLeft = min(childOverflowLeft, shadow->x - shadow->blur + leftGlyphOverflow);
+                childOverflowRight = max(childOverflowRight, shadow->x + shadow->blur + rightGlyphOverflow);
             }
             
-            leftPosition = min(xPos + visualOverflowLeft, leftPosition);
-            rightPosition = max(xPos + text->width() + visualOverflowRight, rightPosition);
-            m_maxHorizontalVisualOverflow = max(max(visualOverflowRight, -visualOverflowLeft), (int)m_maxHorizontalVisualOverflow);
+            leftVisualOverflow = min(xPos + childOverflowLeft, leftVisualOverflow);
+            rightVisualOverflow = max(xPos + text->width() + childOverflowRight, rightVisualOverflow);
+            
             xPos += text->width();
         } else {
             if (curr->renderer()->isPositioned()) {
@@ -307,13 +316,26 @@ int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& righ
             if (curr->renderer()->isRenderInline()) {
                 InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
                 xPos += flow->marginLeft();
-                xPos = flow->placeBoxesHorizontally(xPos, leftPosition, rightPosition, needsWordSpacing);
+                xPos = flow->placeBoxesHorizontally(xPos, needsWordSpacing);
                 xPos += flow->marginRight();
+                leftLayoutOverflow = min(leftLayoutOverflow, flow->leftLayoutOverflow());
+                rightLayoutOverflow = max(rightLayoutOverflow, flow->rightLayoutOverflow());
+                leftVisualOverflow = min(leftVisualOverflow, flow->leftVisualOverflow());
+                rightVisualOverflow = max(rightVisualOverflow, flow->rightVisualOverflow());
             } else if (!curr->renderer()->isListMarker() || toRenderListMarker(curr->renderer())->isInside()) {
                 xPos += curr->boxModelObject()->marginLeft();
                 curr->setX(xPos);
-                leftPosition = min(xPos + toRenderBox(curr->renderer())->overflowLeft(false), leftPosition);
-                rightPosition = max(xPos + toRenderBox(curr->renderer())->overflowWidth(false), rightPosition);
+                 
+                RenderBox* box = toRenderBox(curr->renderer());
+                int childLeftOverflow = box->hasOverflowClip() ? 0 : box->leftLayoutOverflow();
+                int childRightOverflow = box->hasOverflowClip() ? curr->width() : box->rightLayoutOverflow();
+                
+                leftLayoutOverflow = min(xPos + childLeftOverflow, leftLayoutOverflow);
+                rightLayoutOverflow = max(xPos + childRightOverflow, rightLayoutOverflow);
+
+                leftVisualOverflow = min(xPos + box->leftVisualOverflow(), leftVisualOverflow);
+                rightVisualOverflow = max(xPos + box->rightVisualOverflow(), rightVisualOverflow);
+               
                 xPos += curr->width() + curr->boxModelObject()->marginRight();
             }
         }
@@ -321,45 +343,13 @@ int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& righ
 
     xPos += borderRight() + paddingRight();
     setWidth(xPos - startX);
-    rightPosition = max(x() + width() + boxShadowRight, rightPosition);
+    rightVisualOverflow = max(x() + width() + boxShadowRight, rightVisualOverflow);
+    rightLayoutOverflow = max(x() + width(), rightLayoutOverflow);
 
+    setHorizontalOverflowPositions(leftLayoutOverflow, rightLayoutOverflow, leftVisualOverflow, rightVisualOverflow);
     return xPos;
 }
 
-int InlineFlowBox::verticallyAlignBoxes(int heightOfBlock)
-{
-    int maxPositionTop = 0;
-    int maxPositionBottom = 0;
-    int maxAscent = 0;
-    int maxDescent = 0;
-
-    // Figure out if we're in strict mode.  Note that we can't simply use !style()->htmlHacks(),
-    // because that would match almost strict mode as well.
-    RenderObject* curr = renderer();
-    while (curr && !curr->node())
-        curr = curr->container();
-    bool strictMode = (curr && curr->document()->inStrictMode());
-    
-    computeLogicalBoxHeights(maxPositionTop, maxPositionBottom, maxAscent, maxDescent, strictMode);
-
-    if (maxAscent + maxDescent < max(maxPositionTop, maxPositionBottom))
-        adjustMaxAscentAndDescent(maxAscent, maxDescent, maxPositionTop, maxPositionBottom);
-
-    int maxHeight = maxAscent + maxDescent;
-    int topPosition = heightOfBlock;
-    int bottomPosition = heightOfBlock;
-    int selectionTop = heightOfBlock;
-    int selectionBottom = heightOfBlock;
-    placeBoxesVertically(heightOfBlock, maxHeight, maxAscent, strictMode, topPosition, bottomPosition, selectionTop, selectionBottom);
-
-    setVerticalOverflowPositions(topPosition, bottomPosition);
-    setVerticalSelectionPositions(selectionTop, selectionBottom);
-    
-    heightOfBlock += maxHeight;
-    
-    return heightOfBlock;
-}
-
 void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
                                               int maxPositionTop, int maxPositionBottom)
 {
@@ -479,11 +469,10 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
     }
 }
 
-void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent, bool strictMode,
-                                         int& topPosition, int& bottomPosition, int& selectionTop, int& selectionBottom)
+void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent, bool strictMode, int& selectionTop, int& selectionBottom)
 {
     if (isRootInlineBox())
-        setY(yPos + max(0, maxAscent - baselinePosition(true))); // Place our root box.
+        setY(yPos + maxAscent - baselinePosition(true)); // Place our root box.
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isPositioned())
@@ -493,7 +482,7 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
         // line-height).
         bool isInlineFlow = curr->isInlineFlowBox();
         if (isInlineFlow)
-            static_cast<InlineFlowBox*>(curr)->placeBoxesVertically(yPos, maxHeight, maxAscent, strictMode, topPosition, bottomPosition, selectionTop, selectionBottom);
+            static_cast<InlineFlowBox*>(curr)->placeBoxesVertically(yPos, maxHeight, maxAscent, strictMode, selectionTop, selectionBottom);
 
         bool childAffectsTopBottomPos = true;
         if (curr->y() == PositionTop)
@@ -504,43 +493,18 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
             if ((isInlineFlow && !static_cast<InlineFlowBox*>(curr)->hasTextChildren()) && !curr->boxModelObject()->hasHorizontalBordersOrPadding() && !strictMode)
                 childAffectsTopBottomPos = false;
             int posAdjust = maxAscent - curr->baselinePosition(false);
-            if (!childAffectsTopBottomPos)
-                posAdjust = max(0, posAdjust);
             curr->setY(curr->y() + yPos + posAdjust);
         }
         
-        // FIXME: By only considering overflow as part of the root line box, we can't get an accurate picture regarding what the line
-        // actually needs to paint.  A line box that is part of a self-painting layer technically shouldn't contribute to the overflow
-        // of the line, but in order to not do this and paint accurately, we have to track the overflow somewhere else (either by storing overflow
-        // in each InlineFlowBox up the chain or in the layer itself).  Relative positioned objects on a line will cause scrollbars
-        // to appear when they shouldn't until we fix this issue.
         int newY = curr->y();
-        int overflowTop = 0;
-        int overflowBottom = 0;
         if (curr->isText() || curr->isInlineFlowBox()) {
             const Font& font = curr->renderer()->style(m_firstLine)->font();
             newY += curr->baselinePosition(false) - font.ascent();
-
-            curr->renderer()->style(m_firstLine)->getBoxShadowVerticalExtent(overflowTop, overflowBottom);
-
-            for (ShadowData* textShadow = curr->renderer()->style(m_firstLine)->textShadow(); textShadow; textShadow = textShadow->next) {
-                overflowTop = min(overflowTop, textShadow->y - textShadow->blur);
-                overflowBottom = max(overflowBottom, textShadow->y + textShadow->blur);
-            }
-
-            if (curr->renderer()->hasReflection()) {
-                RenderBox* box = toRenderBox(curr->renderer());
-                overflowTop = min(overflowTop, box->reflectionBox().y());
-                overflowBottom = max(overflowBottom, box->reflectionBox().bottom());
-            }
-
             if (curr->isInlineFlowBox())
                 newY -= curr->boxModelObject()->borderTop() + curr->boxModelObject()->paddingTop();
         } else if (!curr->renderer()->isBR()) {
             RenderBox* box = toRenderBox(curr->renderer());
             newY += box->marginTop();
-            overflowTop = box->overflowTop(false);
-            overflowBottom = box->overflowHeight(false) - box->height();
         }
 
         curr->setY(newY);
@@ -549,8 +513,6 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
             int boxHeight = curr->height();
             selectionTop = min(selectionTop, newY);
             selectionBottom = max(selectionBottom, newY + boxHeight);
-            topPosition = min(topPosition, newY + overflowTop);
-            bottomPosition = max(bottomPosition, newY + boxHeight + overflowBottom);
         }
     }
 
@@ -564,8 +526,88 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
     }
 }
 
+void InlineFlowBox::computeVerticalOverflow(int lineTop, int lineBottom, bool strictMode)
+{
+    int boxHeight = height();
+
+    // Any spillage outside of the line top and bottom is not considered overflow.  We just ignore this, since it only happens
+    // from the "your ascent/descent don't affect the line" quirk.
+    // FIXME: Technically this means there can be repaint errors in the case where a line box has a shadow or background that spills
+    // outside of the block. We should consider making any line box that has anything to render just stop respecting the quirk or making
+    // boxes that render something set visual overflow.
+    int topOverflow = max(y(), lineTop);
+    int bottomOverflow = min(y() + boxHeight, lineBottom);
+    
+    int topLayoutOverflow = topOverflow;
+    int bottomLayoutOverflow = bottomOverflow;
+    
+    int topVisualOverflow = topOverflow;
+    int bottomVisualOverflow = bottomOverflow;
+  
+    // box-shadow on root line boxes is applying to the block and not to the lines.
+    if (parent()) {
+        int boxShadowTop;
+        int boxShadowBottom;
+        renderer()->style(m_firstLine)->getBoxShadowVerticalExtent(boxShadowTop, boxShadowBottom);
+        
+        topVisualOverflow = min(y() + boxShadowTop, topVisualOverflow);
+        bottomVisualOverflow = max(y() + boxHeight + boxShadowBottom, bottomVisualOverflow);
+    }
+
+    for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
+        if (curr->renderer()->isPositioned())
+            continue; // Positioned placeholders don't affect calculations.
+        
+        if (curr->renderer()->isText()) {
+            InlineTextBox* text = static_cast<InlineTextBox*>(curr);
+            RenderText* rt = toRenderText(text->renderer());
+            if (rt->isBR())
+                continue;
+
+            int strokeOverflow = static_cast<int>(ceilf(rt->style()->textStrokeWidth() / 2.0f));
+            
+            int topGlyphOverflow = -strokeOverflow;
+            int bottomGlyphOverflow = strokeOverflow;
+            
+            int childOverflowTop = topGlyphOverflow;
+            int childOverflowBottom = bottomGlyphOverflow;
+            for (ShadowData* shadow = rt->style()->textShadow(); shadow; shadow = shadow->next) {
+                childOverflowTop = min(childOverflowTop, shadow->y - shadow->blur + topGlyphOverflow);
+                childOverflowBottom = max(childOverflowBottom, shadow->y + shadow->blur + bottomGlyphOverflow);
+            }
+            
+            topVisualOverflow = min(curr->y() + childOverflowTop, topVisualOverflow);
+            bottomVisualOverflow = max(curr->y() + text->height() + childOverflowBottom, bottomVisualOverflow);
+        } else  if (curr->renderer()->isRenderInline()) {
+            InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
+            flow->computeVerticalOverflow(lineTop, lineBottom, strictMode);
+            topLayoutOverflow = min(topLayoutOverflow, flow->topLayoutOverflow());
+            bottomLayoutOverflow = max(bottomLayoutOverflow, flow->bottomLayoutOverflow());
+            topVisualOverflow = min(topVisualOverflow, flow->topVisualOverflow());
+            bottomVisualOverflow = max(bottomVisualOverflow, flow->bottomVisualOverflow());
+        } else if (!curr->boxModelObject()->hasSelfPaintingLayer()){
+            // Only include overflow from replaced inlines if they do not paint themselves.
+            RenderBox* box = toRenderBox(curr->renderer());
+            int boxY = curr->y();
+            int childTopOverflow = box->hasOverflowClip() ? 0 : box->topLayoutOverflow();
+            int childBottomOverflow = box->hasOverflowClip() ? curr->height() : box->bottomLayoutOverflow();
+            topLayoutOverflow = min(boxY + childTopOverflow, topLayoutOverflow);
+            bottomLayoutOverflow = max(boxY + childBottomOverflow, bottomLayoutOverflow);
+            topVisualOverflow = min(boxY + box->topVisualOverflow(), topVisualOverflow);
+            bottomVisualOverflow = max(boxY + box->bottomVisualOverflow(), bottomVisualOverflow);
+        }
+    }
+    
+    setVerticalOverflowPositions(topLayoutOverflow, bottomLayoutOverflow, topVisualOverflow, bottomVisualOverflow, boxHeight);
+}
+
 bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty)
 {
+    IntRect overflowRect(visibleOverflowRect());
+    overflowRect.move(tx, ty);
+    if (!overflowRect.contains(x, y))
+        return false;
+
     // Check children first.
     for (InlineBox* curr = lastChild(); curr; curr = curr->prevOnLine()) {
         if ((curr->renderer()->isText() || !curr->boxModelObject()->hasSelfPaintingLayer()) && curr->nodeAtPoint(request, result, x, y, tx, ty)) {
@@ -586,23 +628,14 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 
 void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 {
-    int xPos = tx + m_x - renderer()->maximalOutlineSize(paintInfo.phase);
-    int w = width() + 2 * renderer()->maximalOutlineSize(paintInfo.phase);
-    int shadowLeft;
-    int shadowRight;
-
-    renderer()->style(m_firstLine)->getBoxShadowHorizontalExtent(shadowLeft, shadowRight);
-
-    for (ShadowData* textShadow = renderer()->style(m_firstLine)->textShadow(); textShadow; textShadow = textShadow->next) {
-        shadowLeft = min(textShadow->x - textShadow->blur, shadowLeft);
-        shadowRight = max(textShadow->x + textShadow->blur, shadowRight);
-    }
-
-    xPos += shadowLeft;
-    w += -shadowLeft + shadowRight;
-    bool intersectsDamageRect = xPos < paintInfo.rect.right() && xPos + w > paintInfo.rect.x();
+    IntRect overflowRect(visibleOverflowRect());
+    overflowRect.inflate(renderer()->maximalOutlineSize(paintInfo.phase));
+    overflowRect.move(tx, ty);
+    
+    if (!paintInfo.rect.intersects(overflowRect))
+        return;
 
-    if (intersectsDamageRect && paintInfo.phase != PaintPhaseChildOutlines) {
+    if (paintInfo.phase != PaintPhaseChildOutlines) {
         if (paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) {
             // Add ourselves to the paint info struct's list of inlines that need to paint their
             // outlines.
@@ -645,7 +678,7 @@ void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     }
 
     // 4. Paint our strike-through
-    if (intersectsDamageRect && (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection))
+    if (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection)
         paintTextDecorations(paintInfo, tx, ty, true);
 }
 
@@ -774,18 +807,23 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
     int w = width();
     int h = height();
 
-    // Figure out if we need to push a transparency layer to render our mask.
-    bool pushTransparencyLayer = false;
     const NinePieceImage& maskNinePieceImage = renderer()->style()->maskBoxImage();
     StyleImage* maskBoxImage = renderer()->style()->maskBoxImage().image();
-    if ((maskBoxImage && renderer()->style()->maskLayers()->hasImage()) || renderer()->style()->maskLayers()->next())
-        pushTransparencyLayer = true;
-    
-    CompositeOperator compositeOp = CompositeDestinationIn;
-    if (pushTransparencyLayer) {
-        paintInfo.context->setCompositeOperation(CompositeDestinationIn);
-        paintInfo.context->beginTransparencyLayer(1.0f);
-        compositeOp = CompositeSourceOver;
+
+    // Figure out if we need to push a transparency layer to render our mask.
+    bool pushTransparencyLayer = false;
+    bool compositedMask = renderer()->hasLayer() && boxModelObject()->layer()->hasCompositedMask();
+    CompositeOperator compositeOp = CompositeSourceOver;
+    if (!compositedMask) {
+        if ((maskBoxImage && renderer()->style()->maskLayers()->hasImage()) || renderer()->style()->maskLayers()->next())
+            pushTransparencyLayer = true;
+        
+        compositeOp = CompositeDestinationIn;
+        if (pushTransparencyLayer) {
+            paintInfo.context->setCompositeOperation(CompositeDestinationIn);
+            paintInfo.context->beginTransparencyLayer(1.0f);
+            compositeOp = CompositeSourceOver;
+        }
     }
 
     paintFillLayers(paintInfo, Color(), renderer()->style()->maskLayers(), tx, ty, w, h, compositeOp);
diff --git a/WebCore/rendering/InlineFlowBox.h b/WebCore/rendering/InlineFlowBox.h
index 809fd54..23b5cc9 100644
--- a/WebCore/rendering/InlineFlowBox.h
+++ b/WebCore/rendering/InlineFlowBox.h
@@ -22,6 +22,7 @@
 #define InlineFlowBox_h
 
 #include "InlineRunBox.h"
+#include "RenderOverflow.h"
 
 namespace WebCore {
 
@@ -35,10 +36,8 @@ public:
         : InlineRunBox(obj)
         , m_firstChild(0)
         , m_lastChild(0)
-        , m_maxHorizontalVisualOverflow(0)
         , m_includeLeftEdge(false)
         , m_includeRightEdge(false)
-        , m_hasTextChildren(true)
 #ifndef NDEBUG
         , m_hasBadChildList(false)
 #endif
@@ -121,18 +120,13 @@ public:
     void determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject);
     int getFlowSpacingWidth();
     bool onEndChain(RenderObject* endObject);
-    virtual int placeBoxesHorizontally(int x, int& leftPosition, int& rightPosition, bool& needsWordSpacing);
-    virtual int verticallyAlignBoxes(int heightOfBlock);
+    virtual int placeBoxesHorizontally(int x, bool& needsWordSpacing);
     void computeLogicalBoxHeights(int& maxPositionTop, int& maxPositionBottom,
                                   int& maxAscent, int& maxDescent, bool strictMode);
     void adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
                                    int maxPositionTop, int maxPositionBottom);
-    void placeBoxesVertically(int y, int maxHeight, int maxAscent, bool strictMode,
-                              int& topPosition, int& bottomPosition, int& selectionTop, int& selectionBottom);
-    
-    virtual void setVerticalOverflowPositions(int /*top*/, int /*bottom*/) { }
-    virtual void setVerticalSelectionPositions(int /*top*/, int /*bottom*/) { }
-    short maxHorizontalVisualOverflow() const { return m_maxHorizontalVisualOverflow; }
+    void placeBoxesVertically(int y, int maxHeight, int maxAscent, bool strictMode, int& lineTop, int& lineBottom);
+    void computeVerticalOverflow(int lineTop, int lineBottom, bool strictMode);
 
     void removeChild(InlineBox* child);
 
@@ -146,12 +140,35 @@ public:
     void checkConsistency() const;
     void setHasBadChildList();
 
+    int topVisibleOverflow() const { return std::min(topLayoutOverflow(), topVisualOverflow()); }
+    int bottomVisibleOverflow() const { return std::max(bottomLayoutOverflow(), bottomVisualOverflow()); }
+    int leftVisibleOverflow() const { return std::min(leftLayoutOverflow(), leftVisualOverflow()); }
+    int rightVisibleOverflow() const { return std::max(rightLayoutOverflow(), rightVisualOverflow()); }
+    IntRect visibleOverflowRect() const { return m_overflow ? m_overflow->visibleOverflowRect() : IntRect(m_x, m_y, m_width, height());  }
+
+    int topLayoutOverflow() const { return m_overflow ? m_overflow->topLayoutOverflow() : m_y; }
+    int bottomLayoutOverflow() const { return m_overflow ? m_overflow->bottomLayoutOverflow() : m_y + height(); }
+    int leftLayoutOverflow() const { return m_overflow ? m_overflow->leftLayoutOverflow() : m_x; }
+    int rightLayoutOverflow() const { return m_overflow ? m_overflow->rightLayoutOverflow() : m_x + m_width; }
+    IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : IntRect(m_x, m_y, m_width, height()); }
+
+    int topVisualOverflow() const { return m_overflow ? m_overflow->topVisualOverflow() : m_y; }
+    int bottomVisualOverflow() const { return m_overflow ? m_overflow->bottomVisualOverflow() : m_y + height(); }
+    int leftVisualOverflow() const { return m_overflow ? m_overflow->leftVisualOverflow() : m_x; }
+    int rightVisualOverflow() const { return m_overflow ? m_overflow->rightVisualOverflow() : m_x + m_width; }
+    IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : IntRect(m_x, m_y, m_width, height()); }
+
+    void setHorizontalOverflowPositions(int leftLayoutOverflow, int rightLayoutOverflow, int leftVisualOverflow, int rightVisualOverflow);
+    void setVerticalOverflowPositions(int topLayoutOverflow, int bottomLayoutOverflow, int topVisualOverflow, int bottomVisualOverflow, int boxHeight);
+
+protected:
+    OwnPtr<RenderOverflow> m_overflow;
+
 private:
     virtual bool isInlineFlowBox() const { return true; }
 
     InlineBox* m_firstChild;
     InlineBox* m_lastChild;
-    short m_maxHorizontalVisualOverflow;
     
     bool m_includeLeftEdge : 1;
     bool m_includeRightEdge : 1;
@@ -162,6 +179,34 @@ private:
 #endif
 };
 
+inline void InlineFlowBox::setHorizontalOverflowPositions(int leftLayoutOverflow, int rightLayoutOverflow, int leftVisualOverflow, int rightVisualOverflow) 
+{ 
+    if (!m_overflow) {
+        if (leftLayoutOverflow == m_x && rightLayoutOverflow == m_x + m_width && leftVisualOverflow == m_x && rightVisualOverflow == m_x + m_width)
+            return;
+        m_overflow.set(new RenderOverflow(IntRect(m_x, m_y, m_width, m_renderer->style(m_firstLine)->font().height())));    
+    }
+
+    m_overflow->setLeftLayoutOverflow(leftLayoutOverflow);
+    m_overflow->setRightLayoutOverflow(rightLayoutOverflow);
+    m_overflow->setLeftVisualOverflow(leftVisualOverflow); 
+    m_overflow->setRightVisualOverflow(rightVisualOverflow);  
+}
+
+inline void InlineFlowBox::setVerticalOverflowPositions(int topLayoutOverflow, int bottomLayoutOverflow, int topVisualOverflow, int bottomVisualOverflow, int boxHeight)
+{
+    if (!m_overflow) {
+        if (topLayoutOverflow == m_y && bottomLayoutOverflow == m_y + boxHeight && topVisualOverflow == m_y && bottomVisualOverflow == m_y + boxHeight)
+            return;
+        m_overflow.set(new RenderOverflow(IntRect(m_x, m_y, m_width, boxHeight)));
+    }
+
+    m_overflow->setTopLayoutOverflow(topLayoutOverflow);
+    m_overflow->setBottomLayoutOverflow(bottomLayoutOverflow);
+    m_overflow->setTopVisualOverflow(topVisualOverflow); 
+    m_overflow->setBottomVisualOverflow(bottomVisualOverflow);  
+}
+
 #ifdef NDEBUG
 inline void InlineFlowBox::checkConsistency() const
 {
diff --git a/WebCore/rendering/InlineTextBox.cpp b/WebCore/rendering/InlineTextBox.cpp
index 619fb95..751340d 100644
--- a/WebCore/rendering/InlineTextBox.cpp
+++ b/WebCore/rendering/InlineTextBox.cpp
@@ -312,8 +312,12 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 
     ASSERT(paintInfo.phase != PaintPhaseSelfOutline && paintInfo.phase != PaintPhaseChildOutlines);
 
-    int xPos = tx + m_x - parent()->maxHorizontalVisualOverflow();
-    int w = width() + 2 * parent()->maxHorizontalVisualOverflow();
+    // FIXME: Technically we're potentially incorporating other visual overflow that had nothing to do with us.
+    // Would it be simpler to just check our own shadow and stroke overflow by hand here?
+    int leftOverflow = parent()->x() - parent()->leftVisualOverflow();
+    int rightOverflow = parent()->rightVisualOverflow() - (parent()->x() + parent()->width());
+    int xPos = tx + m_x - leftOverflow;
+    int w = width() + leftOverflow + rightOverflow;
     if (xPos >= paintInfo.rect.right() || xPos + w <= paintInfo.rect.x())
         return;
 
diff --git a/WebCore/rendering/MediaControlElements.cpp b/WebCore/rendering/MediaControlElements.cpp
index 352f270..73b9a3a 100644
--- a/WebCore/rendering/MediaControlElements.cpp
+++ b/WebCore/rendering/MediaControlElements.cpp
@@ -32,28 +32,37 @@
 
 #include "MediaControlElements.h"
 
-#include "LocalizedStrings.h"
 #include "EventNames.h"
 #include "FloatConversion.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "LocalizedStrings.h"
 #include "MouseEvent.h"
 #include "RenderMedia.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
-#include "CString.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-// FIXME: These constants may need to be tweaked to better match the seeking in the QT plugin
+HTMLMediaElement* toParentMediaElement(RenderObject* o)
+{
+    Node* node = o->node();
+    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
+        return 0;
+
+    return static_cast<HTMLMediaElement*>(mediaNode);
+}
+
+// FIXME: These constants may need to be tweaked to better match the seeking in the QuickTime plug-in.
 static const float cSeekRepeatDelay = 0.1f;
 static const float cStepTime = 0.07f;
 static const float cSeekTime = 0.2f;
 
-MediaControlShadowRootElement::MediaControlShadowRootElement(Document* doc, HTMLMediaElement* mediaElement) 
-    : HTMLDivElement(divTag, doc)
+MediaControlShadowRootElement::MediaControlShadowRootElement(Document* document, HTMLMediaElement* mediaElement)
+    : HTMLDivElement(divTag, document)
     , m_mediaElement(mediaElement) 
 {
     RefPtr<RenderStyle> rootStyle = RenderStyle::create();
@@ -76,14 +85,36 @@ void MediaControlShadowRootElement::updateStyle()
 }
 
 // ----------------------------
-    
 
-MediaControlElement::MediaControlElement(Document* doc, PseudoId pseudo, HTMLMediaElement* mediaElement) 
-    : HTMLDivElement(divTag, doc)
+MediaControlElement::MediaControlElement(Document* document, PseudoId pseudo, HTMLMediaElement* mediaElement)
+    : HTMLDivElement(divTag, document)
     , m_mediaElement(mediaElement)
     , m_pseudoStyleId(pseudo)
 {
     setInDocument(true);
+    switch (pseudo) {
+    case MEDIA_CONTROLS_CURRENT_TIME_DISPLAY:
+        m_displayType = MediaCurrentTimeDisplay;
+        break;
+    case MEDIA_CONTROLS_TIME_REMAINING_DISPLAY:
+        m_displayType = MediaTimeRemainingDisplay;
+        break;
+    case MEDIA_CONTROLS_TIMELINE_CONTAINER:
+        m_displayType = MediaTimelineContainer;
+        break;
+    case MEDIA_CONTROLS_STATUS_DISPLAY:
+        m_displayType = MediaStatusDisplay;
+        break;
+    case MEDIA_CONTROLS_PANEL:
+        m_displayType = MediaControlsPanel;
+        break;
+    case MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER:
+        m_displayType = MediaVolumeSliderContainer;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
 }
 
 void MediaControlElement::attachToParent(Element* parent)
@@ -114,7 +145,10 @@ PassRefPtr<RenderStyle> MediaControlElement::styleForElement()
 
 bool MediaControlElement::rendererIsNeeded(RenderStyle* style)
 {
-    return HTMLDivElement::rendererIsNeeded(style) && parent() && parent()->renderer();
+    ASSERT(document()->page());
+
+    return HTMLDivElement::rendererIsNeeded(style) && parent() && parent()->renderer()
+        && (!style->hasAppearance() || document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement));
 }
     
 void MediaControlElement::attach()
@@ -165,8 +199,8 @@ void MediaControlElement::updateStyle()
 
 // ----------------------------
 
-MediaControlTimelineContainerElement::MediaControlTimelineContainerElement(Document* doc, HTMLMediaElement* element)
-: MediaControlElement(doc, MEDIA_CONTROLS_TIMELINE_CONTAINER, element)
+MediaControlTimelineContainerElement::MediaControlTimelineContainerElement(Document* document, HTMLMediaElement* element)
+    : MediaControlElement(document, MEDIA_CONTROLS_TIMELINE_CONTAINER, element)
 {
 }
 
@@ -185,12 +219,54 @@ bool MediaControlTimelineContainerElement::rendererIsNeeded(RenderStyle* style)
     return !isnan(duration) && !isinf(duration);
 }
 
-    
 // ----------------------------
 
-MediaControlStatusDisplayElement::MediaControlStatusDisplayElement(Document* doc, HTMLMediaElement* element)
-: MediaControlElement(doc, MEDIA_CONTROLS_STATUS_DISPLAY, element)
-, m_stateBeingDisplayed(Nothing)
+MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement(Document* doc, HTMLMediaElement* element)
+    : MediaControlElement(doc, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, element)
+    , m_isVisible(false)
+    , m_x(0)
+    , m_y(0)
+{
+}
+
+PassRefPtr<RenderStyle> MediaControlVolumeSliderContainerElement::styleForElement()
+{
+    RefPtr<RenderStyle> style = MediaControlElement::styleForElement();
+    style->setPosition(AbsolutePosition);
+    style->setLeft(Length(m_x, Fixed));
+    style->setTop(Length(m_y, Fixed));
+    style->setDisplay(m_isVisible ? BLOCK : NONE);
+    return style;
+}
+
+void MediaControlVolumeSliderContainerElement::setVisible(bool visible)
+{
+    if (visible == m_isVisible)
+        return;
+    m_isVisible = visible;
+}
+
+void MediaControlVolumeSliderContainerElement::setPosition(int x, int y)
+{
+    if (x == m_x && y == m_y)
+        return;
+    m_x = x;
+    m_y = y;
+}
+
+bool MediaControlVolumeSliderContainerElement::hitTest(const IntPoint& absPoint)
+{
+    if (renderer() && renderer()->style()->hasAppearance())
+        return renderer()->theme()->hitTestMediaControlPart(renderer(), absPoint);
+
+    return false;
+}
+
+// ----------------------------
+
+MediaControlStatusDisplayElement::MediaControlStatusDisplayElement(Document* document, HTMLMediaElement* element)
+    : MediaControlElement(document, MEDIA_CONTROLS_STATUS_DISPLAY, element)
+    , m_stateBeingDisplayed(Nothing)
 {
 }
 
@@ -235,14 +311,46 @@ bool MediaControlStatusDisplayElement::rendererIsNeeded(RenderStyle* style)
 
 // ----------------------------
     
-MediaControlInputElement::MediaControlInputElement(Document* doc, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement, MediaControlElementType displayType) 
-    : HTMLInputElement(inputTag, doc)
+MediaControlInputElement::MediaControlInputElement(Document* document, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement)
+    : HTMLInputElement(inputTag, document)
     , m_mediaElement(mediaElement)
     , m_pseudoStyleId(pseudo)
-    , m_displayType(displayType)
 {
     setInputType(type);
     setInDocument(true);
+
+    switch (pseudo) {
+    case MEDIA_CONTROLS_MUTE_BUTTON:
+        m_displayType = MediaMuteButton;
+        break;
+    case MEDIA_CONTROLS_PLAY_BUTTON:
+        m_displayType = MediaPlayButton;
+        break;
+    case MEDIA_CONTROLS_SEEK_FORWARD_BUTTON:
+        m_displayType = MediaSeekForwardButton;
+        break;
+    case MEDIA_CONTROLS_SEEK_BACK_BUTTON:
+        m_displayType = MediaSeekBackButton;
+        break;
+    case MEDIA_CONTROLS_FULLSCREEN_BUTTON:
+        m_displayType = MediaFullscreenButton;
+        break;
+    case MEDIA_CONTROLS_TIMELINE:
+        m_displayType = MediaSlider;
+        break;
+    case MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON:
+        m_displayType = MediaReturnToRealtimeButton;
+        break;
+    case MEDIA_CONTROLS_REWIND_BUTTON:
+        m_displayType = MediaRewindButton;
+        break;
+    case MEDIA_CONTROLS_VOLUME_SLIDER:
+        m_displayType = MediaVolumeSlider;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
 }
 
 void MediaControlInputElement::attachToParent(Element* parent)
@@ -265,7 +373,10 @@ PassRefPtr<RenderStyle> MediaControlInputElement::styleForElement()
 
 bool MediaControlInputElement::rendererIsNeeded(RenderStyle* style)
 {
-    return HTMLInputElement::rendererIsNeeded(style) && parent() && parent()->renderer();
+    ASSERT(document()->page());
+
+    return HTMLInputElement::rendererIsNeeded(style) && parent() && parent()->renderer()
+        && (!style->hasAppearance() || document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement));
 }
 
 void MediaControlInputElement::attach()
@@ -324,14 +435,14 @@ void MediaControlInputElement::setDisplayType(MediaControlElementType displayTyp
         return;
 
     m_displayType = displayType;
-    if (RenderObject* o = renderer())
-        o->repaint();
+    if (RenderObject* object = renderer())
+        object->repaint();
 }
 
 // ----------------------------
 
-MediaControlMuteButtonElement::MediaControlMuteButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_MUTE_BUTTON, "button", element, element->muted() ? MediaUnMuteButton : MediaMuteButton)
+MediaControlMuteButtonElement::MediaControlMuteButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_MUTE_BUTTON, "button", element)
 {
 }
 
@@ -351,8 +462,8 @@ void MediaControlMuteButtonElement::updateDisplayType()
 
 // ----------------------------
 
-MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_PLAY_BUTTON, "button", element, element->canPlay() ? MediaPlayButton : MediaPauseButton)
+MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_PLAY_BUTTON, "button", element)
 {
 }
 
@@ -372,9 +483,9 @@ void MediaControlPlayButtonElement::updateDisplayType()
 
 // ----------------------------
 
-MediaControlSeekButtonElement::MediaControlSeekButtonElement(Document* doc, HTMLMediaElement* element, bool forward)
-    : MediaControlInputElement(doc, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON,
-                               "button", element, forward ? MediaSeekForwardButton : MediaSeekBackButton)
+MediaControlSeekButtonElement::MediaControlSeekButtonElement(Document* document, HTMLMediaElement* element, bool forward)
+    : MediaControlInputElement(document, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON,
+                               "button", element)
     , m_forward(forward)
     , m_seeking(false)
     , m_capturing(false)
@@ -432,8 +543,8 @@ void MediaControlSeekButtonElement::detach()
 
 // ----------------------------
 
-MediaControlRewindButtonElement::MediaControlRewindButtonElement(Document* doc, HTMLMediaElement* element)
-: MediaControlInputElement(doc, MEDIA_CONTROLS_REWIND_BUTTON, "button", element, MediaRewindButton)
+MediaControlRewindButtonElement::MediaControlRewindButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_REWIND_BUTTON, "button", element)
 {
 }
 
@@ -446,16 +557,11 @@ void MediaControlRewindButtonElement::defaultEventHandler(Event* event)
     HTMLInputElement::defaultEventHandler(event);
 }
 
-bool MediaControlRewindButtonElement::rendererIsNeeded(RenderStyle* style)
-{
-    return MediaControlInputElement::rendererIsNeeded(style) && m_mediaElement->movieLoadType() != MediaPlayer::LiveStream;
-}
-
 
 // ----------------------------
 
-MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement(Document* doc, HTMLMediaElement* element)
-: MediaControlInputElement(doc, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, "button", element, MediaReturnToRealtimeButton)
+MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, "button", element)
 {
 }
 
@@ -468,22 +574,18 @@ void MediaControlReturnToRealtimeButtonElement::defaultEventHandler(Event* event
     HTMLInputElement::defaultEventHandler(event);
 }
 
-bool MediaControlReturnToRealtimeButtonElement::rendererIsNeeded(RenderStyle* style)
-{
-    return MediaControlInputElement::rendererIsNeeded(style) && m_mediaElement->movieLoadType() == MediaPlayer::LiveStream;
-}
 
 // ----------------------------
 
 MediaControlTimelineElement::MediaControlTimelineElement(Document* document, HTMLMediaElement* element)
-    : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element, MediaTimelineContainer)
-{ 
+    : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element)
+{
 }
 
 void MediaControlTimelineElement::defaultEventHandler(Event* event)
 {
-    // Left button is 0. Accepts only if mouse event is from left button.
-    if (!event->isMouseEvent() || static_cast<MouseEvent*>(event)->button())
+    // Left button is 0. Rejects mouse events not from left button.
+    if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
         return;
 
     if (event->type() == eventNames().mousedownEvent)
@@ -520,29 +622,51 @@ void MediaControlTimelineElement::update(bool updateDuration)
 
 // ----------------------------
 
-MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element, MediaFullscreenButton)
+MediaControlVolumeSliderElement::MediaControlVolumeSliderElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_VOLUME_SLIDER, "range", element)
 {
 }
 
-void MediaControlFullscreenButtonElement::defaultEventHandler(Event* event)
+void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
 {
-    if (event->type() == eventNames().clickEvent) {
-        event->setDefaultHandled();
+    // Left button is 0. Rejects mouse events not from left button.
+    if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
+        return;
+
+    MediaControlInputElement::defaultEventHandler(event);
+
+    if (event->type() == eventNames().mouseoverEvent || event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mousemoveEvent)
+        return;
+
+    float volume = narrowPrecisionToFloat(value().toDouble());
+    if (volume != m_mediaElement->volume()) {
+        ExceptionCode ec = 0;
+        m_mediaElement->setVolume(volume, ec);
+        ASSERT(!ec);
     }
-    HTMLInputElement::defaultEventHandler(event);
 }
 
-bool MediaControlFullscreenButtonElement::rendererIsNeeded(RenderStyle* style)
+// ----------------------------
+
+MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element)
 {
-    return MediaControlInputElement::rendererIsNeeded(style) && m_mediaElement->supportsFullscreen();
 }
 
+void MediaControlFullscreenButtonElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().clickEvent) {
+        m_mediaElement->enterFullscreen();
+        event->setDefaultHandled();
+    }
+    HTMLInputElement::defaultEventHandler(event);
+}
 
 // ----------------------------
 
-MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* doc, PseudoId pseudo, HTMLMediaElement* element)
-    : MediaControlElement(doc, pseudo, element)
+MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* document, PseudoId pseudo, HTMLMediaElement* element)
+    : MediaControlElement(document, pseudo, element)
+    , m_currentValue(0)
     , m_isVisible(true)
 {
 }
@@ -572,6 +696,32 @@ void MediaControlTimeDisplayElement::setVisible(bool visible)
     renderer()->setStyle(style.get());
 }
 
+String MediaControlTimeDisplayElement::formatTime(float time)
+{
+    if (!isfinite(time))
+        time = 0;
+    int seconds = (int)fabsf(time);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+    if (hours) {
+        if (hours > 9)
+            return String::format("%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
+
+        return String::format("%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
+    }
+
+    return String::format("%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds);
+}
+
+void MediaControlTimeDisplayElement::setCurrentValue(float time)
+{
+    m_currentValue = time;
+
+    ExceptionCode ec;
+    setInnerText(formatTime(m_currentValue), ec);
+}
+
 
 } //namespace WebCore
 #endif // enable(video)
diff --git a/WebCore/rendering/MediaControlElements.h b/WebCore/rendering/MediaControlElements.h
index d5fa5d2..e562bb5 100644
--- a/WebCore/rendering/MediaControlElements.h
+++ b/WebCore/rendering/MediaControlElements.h
@@ -57,12 +57,17 @@ enum MediaControlElementType {
     MediaUnMuteButton,
     MediaPauseButton,
     MediaTimelineContainer,
-    MediaCurrentTimeDisplay, 
+    MediaCurrentTimeDisplay,
     MediaTimeRemainingDisplay,
     MediaStatusDisplay,
-    MediaControlsPanel
+    MediaControlsPanel,
+    MediaVolumeSliderContainer,
+    MediaVolumeSlider,
+    MediaVolumeSliderThumb
 };
 
+HTMLMediaElement* toParentMediaElement(RenderObject*);
+
 class MediaControlShadowRootElement : public HTMLDivElement {
 public:
     MediaControlShadowRootElement(Document*, HTMLMediaElement*);
@@ -89,9 +94,15 @@ public:
     void update();
     virtual void updateStyle();
 
+    MediaControlElementType displayType() const { return m_displayType; }
+
+    HTMLMediaElement* mediaElement() const { return m_mediaElement; }
+    virtual bool isMediaControlElement() const { return true; }
+
 protected:
     HTMLMediaElement* m_mediaElement;   
     PseudoId m_pseudoStyleId;
+    MediaControlElementType m_displayType;  // some elements can show multiple types (e.g. play/pause)
 };
 
 // ----------------------------
@@ -104,6 +115,22 @@ public:
 
 // ----------------------------
 
+class MediaControlVolumeSliderContainerElement : public MediaControlElement {
+public:
+    MediaControlVolumeSliderContainerElement(Document*, HTMLMediaElement*);
+    virtual PassRefPtr<RenderStyle> styleForElement();
+    void setVisible(bool);
+    bool isVisible() { return m_isVisible; }
+    void setPosition(int x, int y);
+    bool hitTest(const IntPoint& absPoint);
+
+private:
+    bool m_isVisible;
+    int m_x, m_y;
+};
+
+// ----------------------------
+
 class MediaControlStatusDisplayElement : public MediaControlElement {
 public:
     MediaControlStatusDisplayElement(Document*, HTMLMediaElement*);
@@ -118,7 +145,7 @@ private:
 
 class MediaControlInputElement : public HTMLInputElement {
 public:
-    MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*, MediaControlElementType);
+    MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*);
     virtual void attach();
     virtual bool rendererIsNeeded(RenderStyle*);
 
@@ -130,13 +157,16 @@ public:
     bool hitTest(const IntPoint& absPoint);
     MediaControlElementType displayType() const { return m_displayType; }
 
+    HTMLMediaElement* mediaElement() const { return m_mediaElement; }
+    virtual bool isMediaControlElement() const { return true; }
+
 protected:
     virtual void updateDisplayType() { }
     void setDisplayType(MediaControlElementType);
 
     HTMLMediaElement* m_mediaElement;   
     PseudoId m_pseudoStyleId;
-    MediaControlElementType m_displayType;  // some elements can show multiple types (e.g. play/pause)
+    MediaControlElementType m_displayType;
 };
 
 // ----------------------------
@@ -179,7 +209,6 @@ class MediaControlRewindButtonElement : public MediaControlInputElement {
 public:
     MediaControlRewindButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
-    virtual bool rendererIsNeeded(RenderStyle*);
 };
 
 // ----------------------------
@@ -188,7 +217,6 @@ class MediaControlReturnToRealtimeButtonElement : public MediaControlInputElemen
 public:
     MediaControlReturnToRealtimeButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
-    virtual bool rendererIsNeeded(RenderStyle*);
 };    
 
 // ----------------------------
@@ -202,11 +230,18 @@ public:
 
 // ----------------------------
 
+class MediaControlVolumeSliderElement : public MediaControlInputElement {
+public:
+    MediaControlVolumeSliderElement(Document*, HTMLMediaElement*);
+    virtual void defaultEventHandler(Event*);
+};
+
+// ----------------------------
+
 class MediaControlFullscreenButtonElement : public MediaControlInputElement {
 public:
     MediaControlFullscreenButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
-    virtual bool rendererIsNeeded(RenderStyle*);
 };
 
 // ----------------------------
@@ -217,7 +252,13 @@ public:
     void setVisible(bool);
     virtual PassRefPtr<RenderStyle> styleForElement();
 
+    void setCurrentValue(float);
+    float currentValue() const { return m_currentValue; }
+
 private:
+    String formatTime(float time);
+
+    float m_currentValue;
     bool m_isVisible;
 };
 
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index e10c331..c6d18d2 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -33,6 +33,7 @@
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "InlineTextBox.h"
+#include "RenderFlexibleBox.h"
 #include "RenderImage.h"
 #include "RenderInline.h"
 #include "RenderMarquee.h"
@@ -118,8 +119,6 @@ RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, int top, int bottom)
 
     m_posMargin = m_canCollapseTopWithChildren ? block->maxTopMargin(true) : 0;
     m_negMargin = m_canCollapseTopWithChildren ? block->maxTopMargin(false) : 0;
-
-    m_selfCollapsingBlockClearedFloat = false;
     
     m_topQuirk = m_bottomQuirk = m_determinedTopQuirk = false;
 }
@@ -132,10 +131,6 @@ RenderBlock::RenderBlock(Node* node)
       , m_positionedObjects(0)
       , m_inlineContinuation(0)
       , m_maxMargin(0)
-      , m_overflowHeight(0)
-      , m_overflowWidth(0)
-      , m_overflowLeft(0)
-      , m_overflowTop(0)
       , m_lineHeight(-1)
 {
     setChildrenInline(true);
@@ -554,103 +549,6 @@ void RenderBlock::removeChild(RenderObject* oldChild)
     }
 }
 
-int RenderBlock::overflowHeight(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowVerticalExtent(shadowTop, shadowBottom);
-
-        int inflatedHeight = height() + shadowBottom;
-        if (hasReflection())
-            inflatedHeight = max(inflatedHeight, reflectionBox().bottom());
-        return inflatedHeight;
-    }
-    return m_overflowHeight;
-}
-
-int RenderBlock::overflowWidth(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowLeft;
-        int shadowRight;
-        style()->getBoxShadowHorizontalExtent(shadowLeft, shadowRight);
-
-        int inflatedWidth = width() + shadowRight;
-        if (hasReflection())
-            inflatedWidth = max(inflatedWidth, reflectionBox().right());
-        return inflatedWidth;
-    }
-    return m_overflowWidth;
-}
-
-int RenderBlock::overflowLeft(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowLeft;
-        int shadowRight;
-        style()->getBoxShadowHorizontalExtent(shadowLeft, shadowRight);
-
-        int left = shadowLeft;
-        if (hasReflection())
-            left = min(left, reflectionBox().x());
-        return left;
-    }
-    return m_overflowLeft;
-}
-
-int RenderBlock::overflowTop(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowVerticalExtent(shadowTop, shadowBottom);
-
-        int top = shadowTop;
-        if (hasReflection())
-            top = min(top, reflectionBox().y());
-        return top;
-    }
-    return m_overflowTop;
-}
-
-IntRect RenderBlock::overflowRect(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        IntRect box = borderBoxRect();
-
-        int shadowLeft;
-        int shadowRight;
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
-
-        box.move(shadowLeft, shadowTop);
-        box.setWidth(box.width() - shadowLeft + shadowRight);
-        box.setHeight(box.height() - shadowTop + shadowBottom);
-
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            int reflectTop = min(box.y(), reflection.y());
-            int reflectBottom = max(box.bottom(), reflection.bottom());
-            box.setHeight(reflectBottom - reflectTop);
-            box.setY(reflectTop);
-            
-            int reflectLeft = min(box.x(), reflection.x());
-            int reflectRight = max(box.right(), reflection.right());
-            box.setWidth(reflectRight - reflectLeft);
-            box.setX(reflectLeft);
-        }
-        return box;
-    }
-
-    if (!includeInterior && hasOverflowClip())
-        return borderBoxRect();
-    int l = overflowLeft(includeInterior);
-    int t = overflowTop(includeInterior);
-    return IntRect(l, t, overflowWidth(includeInterior) - l, max(overflowHeight(includeInterior), height()) - t);
-}
-
 bool RenderBlock::isSelfCollapsingBlock() const
 {
     // We are not self-collapsing if we
@@ -744,13 +642,9 @@ void RenderBlock::layout()
     layoutBlock(false);
     
     // It's safe to check for control clip here, since controls can never be table cells.
-    if (hasControlClip()) {
-        // Because of the lightweight clip, there can never be any overflow from children.
-        m_overflowWidth = width();
-        m_overflowHeight = height();
-        m_overflowLeft = 0;
-        m_overflowTop = 0;
-    }
+    // If we have a lightweight clip, there can never be any overflow from children.
+    if (hasControlClip() && m_overflow)
+        clearLayoutOverflow();
 }
 
 void RenderBlock::layoutBlock(bool relayoutChildren)
@@ -776,8 +670,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     calcWidth();
     calcColumnWidth();
 
-    m_overflowWidth = width();
-    m_overflowLeft = 0;
+    m_overflow.clear();
 
     if (oldWidth != width() || oldColumnWidth != desiredColumnWidth())
         relayoutChildren = true;
@@ -795,8 +688,6 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     int previousHeight = height();
     setHeight(0);
 
-    m_overflowHeight = 0;
-
     // We use four values, maxTopPos, maxTopNeg, maxBottomPos, and maxBottomNeg, to track
     // our current maximal positive and negative margins.  These values are used when we
     // are collapsed with adjacent blocks, so for example, if you have block A and B
@@ -861,50 +752,35 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
                 }
             }
         }
+        
         // We have to rebalance columns to the new height.
         layoutColumns(singleColumnBottom);
-
-        // If the block got expanded in size, then increase our overflowheight to match.
-        if (m_overflowHeight > height())
-            m_overflowHeight -= toAdd;
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
     }
+
     if (previousHeight != height())
         relayoutChildren = true;
 
-    if ((isCell || isInline() || isFloatingOrPositioned() || isRoot()) && !hasOverflowClip() && !hasControlClip())
-        addVisualOverflow(floatRect());
+    // It's weird that we're treating float information as normal flow overflow, but we do this because floatRect() isn't
+    // able to be propagated up the render tree yet.  Overflow information is however.  This check is designed to catch anyone
+    // who wasn't going to propagate float information up to the parent and yet could potentially be painted by its ancestor.
+    if (isRoot() || expandsToEncloseOverhangingFloats())
+        addOverflowFromFloats();
 
-    layoutPositionedObjects(relayoutChildren || isRoot());
+    // Add overflow from children (unless we're multi-column, since in that case all our child overflow is clipped anyway).
+    if (!hasColumns()) {
+        if (childrenInline())
+            addOverflowFromInlineChildren();
+        else
+            addOverflowFromBlockChildren();
+    }
 
-    positionListMarker();
+    // Add visual overflow from box-shadow and reflections.
+    addShadowOverflow();
 
-    // Always ensure our overflow width/height are at least as large as our width/height.
-    m_overflowWidth = max(m_overflowWidth, width());
-    m_overflowHeight = max(m_overflowHeight, height());
-
-    if (!hasOverflowClip()) {
-        int shadowLeft;
-        int shadowRight;
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
-
-        m_overflowLeft = min(m_overflowLeft, shadowLeft);
-        m_overflowWidth = max(m_overflowWidth, width() + shadowRight);
-        m_overflowTop = min(m_overflowTop, shadowTop);
-        m_overflowHeight = max(m_overflowHeight, height() + shadowBottom);
-
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            m_overflowLeft = min(m_overflowLeft, reflection.x());
-            m_overflowWidth = max(m_overflowWidth, reflection.right());
-            m_overflowTop = min(m_overflowTop, reflection.y());
-            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
-        }
-    }
+    layoutPositionedObjects(relayoutChildren || isRoot());
 
+    positionListMarker();
+    
     statePusher.pop();
 
     // Update our scroll information if we're overflow:auto/scroll/hidden now that we know if
@@ -914,7 +790,9 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     // Repaint with our new bounds if they are different from our old bounds.
     bool didFullRepaint = repainter.repaintAfterLayout();
     if (!didFullRepaint && repaintTop != repaintBottom && (style()->visibility() == VISIBLE || enclosingLayer()->hasVisibleContent())) {
-        IntRect repaintRect(m_overflowLeft, repaintTop, m_overflowWidth - m_overflowLeft, repaintBottom - repaintTop);
+        int repaintLeft = min(leftVisualOverflow(), leftLayoutOverflow());
+        int repaintRight = max(rightVisualOverflow(), rightLayoutOverflow());
+        IntRect repaintRect(repaintLeft, repaintTop, repaintRight - repaintLeft, repaintBottom - repaintTop);
 
         // FIXME: Deal with multiple column repainting.  We have to split the repaint
         // rect up into multiple rects if it spans columns.
@@ -943,6 +821,28 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     setNeedsLayout(false);
 }
 
+void RenderBlock::addOverflowFromBlockChildren()
+{
+    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+        if (!child->isFloatingOrPositioned())
+            addOverflowFromChild(child);
+    }
+}
+
+void RenderBlock::addOverflowFromFloats()
+{
+    IntRect result;
+    if (!m_floatingObjects)
+        return;
+    FloatingObject* r;
+    DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
+    for (; (r = it.current()); ++it) {
+        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer())
+            addOverflowFromChild(r->m_renderer, IntSize(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop()));
+    }
+    return;
+}
+
 bool RenderBlock::expandsToEncloseOverhangingFloats() const
 {
     return isInlineBlockOrInlineTable() || isFloatingOrPositioned() || hasOverflowClip() || (parent() && parent()->isFlexibleBox()) || hasColumns() || isTableCell() || isFieldset();
@@ -1032,7 +932,10 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
     // See if we have a run-in element with inline children.  If the
     // children aren't inline, then just treat the run-in as a normal
     // block.
-    if (!child->isRunIn() || !child->childrenInline() && !child->isReplaced())
+    if (!child->isRunIn() || !child->childrenInline())
+        return false;
+    // FIXME: We don't handle non-block elements with run-in for now.
+    if (!child->isRenderBlock())
         return false;
 
     // Get the next non-positioned/non-floating RenderBlock.
@@ -1166,8 +1069,6 @@ int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
 
         if (marginInfo.margin())
             marginInfo.setBottomQuirk(child->isBottomMarginQuirk() || style()->marginBottomCollapse() == MDISCARD);
-
-        marginInfo.setSelfCollapsingBlockClearedFloat(false);
     }
     
     return ypos;
@@ -1183,16 +1084,26 @@ int RenderBlock::clearFloatsIfNeeded(RenderBox* child, MarginInfo& marginInfo, i
         // For self-collapsing blocks that clear, they can still collapse their
         // margins with following siblings.  Reset the current margins to represent
         // the self-collapsing block's margins only.
-        marginInfo.setPosMargin(max(child->maxTopMargin(true), child->maxBottomMargin(true)));
-        marginInfo.setNegMargin(max(child->maxTopMargin(false), child->maxBottomMargin(false)));
+        // CSS2.1 states:
+        // "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin.
+        // Therefore if we are at the bottom of the block, let's go ahead and reset margins to only include the
+        // self-collapsing block's bottom margin.
+        bool atBottomOfBlock = true;
+        for (RenderBox* curr = child->nextSiblingBox(); curr && atBottomOfBlock; curr = curr->nextSiblingBox()) {
+            if (!curr->isFloatingOrPositioned())
+                atBottomOfBlock = false;
+        }
+        if (atBottomOfBlock) {
+            marginInfo.setPosMargin(child->maxBottomMargin(true));
+            marginInfo.setNegMargin(child->maxBottomMargin(false));
+        } else {
+            marginInfo.setPosMargin(max(child->maxTopMargin(true), child->maxBottomMargin(true)));
+            marginInfo.setNegMargin(max(child->maxTopMargin(false), child->maxBottomMargin(false)));
+        }
         
-        // Adjust our height such that we are ready to be collapsed with subsequent siblings.
+        // Adjust our height such that we are ready to be collapsed with subsequent siblings (or the bottom
+        // of the parent block).
         setHeight(child->y() - max(0, marginInfo.margin()));
-        
-        // Set a flag that we cleared a float so that we know both to increase the height of the block
-        // to compensate for the clear and to avoid collapsing our margins with the parent block's
-        // bottom margin.
-        marginInfo.setSelfCollapsingBlockClearedFloat(true);
     } else
         // Increase our height by the amount we had to clear.
         setHeight(height() + heightIncrease);
@@ -1296,17 +1207,7 @@ void RenderBlock::setCollapsedBottomMargin(const MarginInfo& marginInfo)
 
 void RenderBlock::handleBottomOfBlock(int top, int bottom, MarginInfo& marginInfo)
 {
-    // If our last flow was a self-collapsing block that cleared a float, then we don't
-    // collapse it with the bottom of the block.
-    if (!marginInfo.selfCollapsingBlockClearedFloat())
-        marginInfo.setAtBottomOfBlock(true);
-    else {
-        // We have to special case the negative margin situation (where the collapsed
-        // margin of the self-collapsing block is negative), since there's no need
-        // to make an adjustment in that case.
-        if (marginInfo.margin() < 0)
-            marginInfo.clearMargin();
-    }
+    marginInfo.setAtBottomOfBlock(true);
 
     // If we can't collapse with children then go ahead and add in the bottom margin.
     if (!marginInfo.canCollapseWithBottom() && !marginInfo.canCollapseWithTop()
@@ -1320,9 +1221,6 @@ void RenderBlock::handleBottomOfBlock(int top, int bottom, MarginInfo& marginInf
     // If this happens, ensure that the computed height is increased to the minimal height.
     setHeight(max(height(), top + bottom));
 
-    // Always make sure our overflow height is at least our height.
-    m_overflowHeight = max(height(), m_overflowHeight);
-
     // Update our bottom collapsed margin info.
     setCollapsedBottomMargin(marginInfo);
 }
@@ -1350,8 +1248,7 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
     int top = borderTop() + paddingTop();
     int bottom = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
 
-    m_overflowHeight = top;
-    setHeight(m_overflowHeight);
+    setHeight(top);
 
     // The margin struct caches all our current margin collapsing state.  The compact struct caches state when we encounter compacts,
     MarginInfo marginInfo(this, top, bottom);
@@ -1372,9 +1269,6 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         if (legend == child)
             continue; // Skip the legend, since it has already been positioned up in the fieldset's border.
 
-        int oldTopPosMargin = maxTopPosMargin();
-        int oldTopNegMargin = maxTopNegMargin();
-
         // Make sure we layout children if they need it.
         // FIXME: Technically percentage height objects only need a relayout if their percentage isn't going to be turned into
         // an auto value.  Add a method to determine this, so that we can avoid the relayout.
@@ -1390,127 +1284,127 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         if (handleSpecialChild(child, marginInfo))
             continue;
 
-        // The child is a normal flow object.  Compute its vertical margins now.
-        child->calcVerticalMargins();
+        // Lay out the child.
+        layoutBlockChild(child, marginInfo, previousFloatBottom, maxFloatBottom);
+    }
+    
+    // Now do the handling of the bottom of the block, adding in our bottom border/padding and
+    // determining the correct collapsed bottom margin information.
+    handleBottomOfBlock(top, bottom, marginInfo);
+}
 
-        // Do not allow a collapse if the margin top collapse style is set to SEPARATE.
-        if (child->style()->marginTopCollapse() == MSEPARATE) {
-            marginInfo.setAtTopOfBlock(false);
-            marginInfo.clearMargin();
-        }
+void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int& previousFloatBottom, int& maxFloatBottom)
+{
+    int oldTopPosMargin = maxTopPosMargin();
+    int oldTopNegMargin = maxTopNegMargin();
 
-        // Try to guess our correct y position.  In most cases this guess will
-        // be correct.  Only if we're wrong (when we compute the real y position)
-        // will we have to potentially relayout.
-        int yPosEstimate = estimateVerticalPosition(child, marginInfo);
+    // The child is a normal flow object.  Compute its vertical margins now.
+    child->calcVerticalMargins();
 
-        // Cache our old rect so that we can dirty the proper repaint rects if the child moves.
-        IntRect oldRect(child->x(), child->y() , child->width(), child->height());
+    // Do not allow a collapse if the margin top collapse style is set to SEPARATE.
+    if (child->style()->marginTopCollapse() == MSEPARATE) {
+        marginInfo.setAtTopOfBlock(false);
+        marginInfo.clearMargin();
+    }
+
+    // Try to guess our correct y position.  In most cases this guess will
+    // be correct.  Only if we're wrong (when we compute the real y position)
+    // will we have to potentially relayout.
+    int yPosEstimate = estimateVerticalPosition(child, marginInfo);
+
+    // Cache our old rect so that we can dirty the proper repaint rects if the child moves.
+    IntRect oldRect(child->x(), child->y() , child->width(), child->height());
 #ifndef NDEBUG
-        IntSize oldLayoutDelta = view()->layoutDelta();
+    IntSize oldLayoutDelta = view()->layoutDelta();
 #endif
-        // Go ahead and position the child as though it didn't collapse with the top.
-        view()->addLayoutDelta(IntSize(0, child->y() - yPosEstimate));
-        child->setLocation(child->x(), yPosEstimate);
-
-        bool markDescendantsWithFloats = false;
-        if (yPosEstimate != oldRect.y() && !child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+    // Go ahead and position the child as though it didn't collapse with the top.
+    view()->addLayoutDelta(IntSize(0, child->y() - yPosEstimate));
+    child->setLocation(child->x(), yPosEstimate);
+
+    bool markDescendantsWithFloats = false;
+    if (yPosEstimate != oldRect.y() && !child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+        markDescendantsWithFloats = true;
+    else if (!child->avoidsFloats() || child->shrinkToAvoidFloats()) {
+        // If an element might be affected by the presence of floats, then always mark it for
+        // layout.
+        int fb = max(previousFloatBottom, floatBottom());
+        if (fb > yPosEstimate)
             markDescendantsWithFloats = true;
-        else if (!child->avoidsFloats() || child->shrinkToAvoidFloats()) {
-            // If an element might be affected by the presence of floats, then always mark it for
-            // layout.
-            int fb = max(previousFloatBottom, floatBottom());
-            if (fb > yPosEstimate)
-                markDescendantsWithFloats = true;
-        }
+    }
 
-        if (child->isRenderBlock()) {
-            if (markDescendantsWithFloats)
-                toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
+    if (child->isRenderBlock()) {
+        if (markDescendantsWithFloats)
+            toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
 
-            previousFloatBottom = max(previousFloatBottom, oldRect.y() + toRenderBlock(child)->floatBottom());
-        }
+        previousFloatBottom = max(previousFloatBottom, oldRect.y() + toRenderBlock(child)->floatBottom());
+    }
 
-        bool childHadLayout = child->m_everHadLayout;
-        bool childNeededLayout = child->needsLayout();
-        if (childNeededLayout)
-            child->layout();
+    bool childHadLayout = child->m_everHadLayout;
+    bool childNeededLayout = child->needsLayout();
+    if (childNeededLayout)
+        child->layout();
 
-        // Now determine the correct ypos based off examination of collapsing margin
-        // values.
-        int yBeforeClear = collapseMargins(child, marginInfo);
+    // Now determine the correct ypos based off examination of collapsing margin
+    // values.
+    int yBeforeClear = collapseMargins(child, marginInfo);
 
-        // Now check for clear.
-        int yAfterClear = clearFloatsIfNeeded(child, marginInfo, oldTopPosMargin, oldTopNegMargin, yBeforeClear);
-        
-        view()->addLayoutDelta(IntSize(0, yPosEstimate - yAfterClear));
-        child->setLocation(child->x(), yAfterClear);
+    // Now check for clear.
+    int yAfterClear = clearFloatsIfNeeded(child, marginInfo, oldTopPosMargin, oldTopNegMargin, yBeforeClear);
     
-        // Now we have a final y position.  See if it really does end up being different from our estimate.
-        if (yAfterClear != yPosEstimate) {
-            if (child->shrinkToAvoidFloats()) {
-                // The child's width depends on the line width.
-                // When the child shifts to clear an item, its width can
-                // change (because it has more available line width).
-                // So go ahead and mark the item as dirty.
-                child->setChildNeedsLayout(true, false);
-            }
-            if (!child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
-                toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
-            // Our guess was wrong. Make the child lay itself out again.
-            child->layoutIfNeeded();
+    view()->addLayoutDelta(IntSize(0, yPosEstimate - yAfterClear));
+    child->setLocation(child->x(), yAfterClear);
+
+    // Now we have a final y position.  See if it really does end up being different from our estimate.
+    if (yAfterClear != yPosEstimate) {
+        if (child->shrinkToAvoidFloats()) {
+            // The child's width depends on the line width.
+            // When the child shifts to clear an item, its width can
+            // change (because it has more available line width).
+            // So go ahead and mark the item as dirty.
+            child->setChildNeedsLayout(true, false);
         }
+        if (!child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+            toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
+        // Our guess was wrong. Make the child lay itself out again.
+        child->layoutIfNeeded();
+    }
 
-        // We are no longer at the top of the block if we encounter a non-empty child.  
-        // This has to be done after checking for clear, so that margins can be reset if a clear occurred.
-        if (marginInfo.atTopOfBlock() && !child->isSelfCollapsingBlock())
-            marginInfo.setAtTopOfBlock(false);
-
-        // Now place the child in the correct horizontal position
-        determineHorizontalPosition(child);
+    // We are no longer at the top of the block if we encounter a non-empty child.  
+    // This has to be done after checking for clear, so that margins can be reset if a clear occurred.
+    if (marginInfo.atTopOfBlock() && !child->isSelfCollapsingBlock())
+        marginInfo.setAtTopOfBlock(false);
 
-        // Update our height now that the child has been placed in the correct position.
-        setHeight(height() + child->height());
-        if (child->style()->marginBottomCollapse() == MSEPARATE) {
-            setHeight(height() + child->marginBottom());
-            marginInfo.clearMargin();
-        }
-        // If the child has overhanging floats that intrude into following siblings (or possibly out
-        // of this block), then the parent gets notified of the floats now.
-        if (child->isBlockFlow() && toRenderBlock(child)->containsFloats())
-            maxFloatBottom = max(maxFloatBottom, addOverhangingFloats(toRenderBlock(child), -child->x(), -child->y(), !childNeededLayout));
-
-        // Update our visual overflow in case the child spills out the block, but only if we were going to paint
-        // the child block ourselves.
-        if (!child->hasSelfPaintingLayer()) {
-            m_overflowTop = min(m_overflowTop, child->y() + child->overflowTop(false));
-            m_overflowHeight = max(m_overflowHeight, height() + child->overflowHeight(false) - child->height());
-            m_overflowWidth = max(child->x() + child->overflowWidth(false), m_overflowWidth);
-            m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
-        }
+    // Now place the child in the correct horizontal position
+    determineHorizontalPosition(child);
 
-        IntSize childOffset(child->x() - oldRect.x(), child->y() - oldRect.y());
-        if (childOffset.width() || childOffset.height()) {
-            view()->addLayoutDelta(childOffset);
+    // Update our height now that the child has been placed in the correct position.
+    setHeight(height() + child->height());
+    if (child->style()->marginBottomCollapse() == MSEPARATE) {
+        setHeight(height() + child->marginBottom());
+        marginInfo.clearMargin();
+    }
+    // If the child has overhanging floats that intrude into following siblings (or possibly out
+    // of this block), then the parent gets notified of the floats now.
+    if (child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+        maxFloatBottom = max(maxFloatBottom, addOverhangingFloats(toRenderBlock(child), -child->x(), -child->y(), !childNeededLayout));
 
-            // If the child moved, we have to repaint it as well as any floating/positioned
-            // descendants.  An exception is if we need a layout.  In this case, we know we're going to
-            // repaint ourselves (and the child) anyway.
-            if (childHadLayout && !selfNeedsLayout() && child->checkForRepaintDuringLayout())
-                child->repaintDuringLayoutIfMoved(oldRect);
-        }
+    IntSize childOffset(child->x() - oldRect.x(), child->y() - oldRect.y());
+    if (childOffset.width() || childOffset.height()) {
+        view()->addLayoutDelta(childOffset);
 
-        if (!childHadLayout && child->checkForRepaintDuringLayout()) {
-            child->repaint();
-            child->repaintOverhangingFloats(true);
-        }
+        // If the child moved, we have to repaint it as well as any floating/positioned
+        // descendants.  An exception is if we need a layout.  In this case, we know we're going to
+        // repaint ourselves (and the child) anyway.
+        if (childHadLayout && !selfNeedsLayout() && child->checkForRepaintDuringLayout())
+            child->repaintDuringLayoutIfMoved(oldRect);
+    }
 
-        ASSERT(oldLayoutDelta == view()->layoutDelta());
+    if (!childHadLayout && child->checkForRepaintDuringLayout()) {
+        child->repaint();
+        child->repaintOverhangingFloats(true);
     }
 
-    // Now do the handling of the bottom of the block, adding in our bottom border/padding and
-    // determining the correct collapsed bottom margin information.
-    handleBottomOfBlock(top, bottom, marginInfo);
+    ASSERT(oldLayoutDelta == view()->layoutDelta());
 }
 
 bool RenderBlock::layoutOnlyPositionedObjects()
@@ -1623,7 +1517,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
     // FIXME: Could eliminate the isRoot() check if we fix background painting so that the RenderView
     // paints the root's background.
     if (!isRoot()) {
-        IntRect overflowBox = overflowRect(false);
+        IntRect overflowBox = visibleOverflowRect();
         overflowBox.inflate(maximalOutlineSize(paintInfo.phase));
         overflowBox.move(tx, ty);
         if (!overflowBox.intersects(paintInfo.rect))
@@ -2160,9 +2054,9 @@ GapRects RenderBlock::fillInlineSelectionGaps(RenderBlock* rootBlock, int blockX
 
     if (lastSelectedLine && selectionState() != SelectionEnd && selectionState() != SelectionBoth) {
         // Go ahead and update our lastY to be the bottom of the last selected line.
-        lastTop = (ty - blockY) + lastSelectedLine->bottomOverflow();
-        lastLeft = leftSelectionOffset(rootBlock, lastSelectedLine->bottomOverflow());
-        lastRight = rightSelectionOffset(rootBlock, lastSelectedLine->bottomOverflow());
+        lastTop = (ty - blockY) + lastSelectedLine->selectionBottom();
+        lastLeft = leftSelectionOffset(rootBlock, lastSelectedLine->selectionBottom());
+        lastRight = rightSelectionOffset(rootBlock, lastSelectedLine->selectionBottom());
     }
     return result;
 }
@@ -2713,13 +2607,13 @@ RenderBlock::floatBottom() const
 IntRect RenderBlock::floatRect() const
 {
     IntRect result;
-    if (!m_floatingObjects || hasOverflowClip())
+    if (!m_floatingObjects || hasOverflowClip() || hasColumns())
         return result;
     FloatingObject* r;
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
     for (; (r = it.current()); ++it) {
         if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
-            IntRect childRect = r->m_renderer->overflowRect(false);
+            IntRect childRect = r->m_renderer->visibleOverflowRect();
             childRect.move(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop());
             result.unite(childRect);
         }
@@ -2730,10 +2624,11 @@ IntRect RenderBlock::floatRect() const
 
 int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
 {
+    int bottom = includeSelf && width() > 0 ? height() : 0;
+
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && width() > 0 ? overflowHeight(false) : 0;
+        return bottom;
     
-    int bottom = includeSelf && width() > 0 ? height() : 0;
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2757,7 +2652,7 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
     int relativeOffset = includeSelf && isRelPositioned() ? relativePositionOffsetY() : 0;
 
     if (includeSelf)
-        bottom = max(bottom, m_overflowHeight + relativeOffset);
+        bottom = max(bottom, bottomLayoutOverflow() + relativeOffset);
         
     if (m_positionedObjects) {
         RenderBox* r;
@@ -2799,8 +2694,8 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
     if (!includeSelf) {
         bottom = max(bottom, borderTop() + paddingTop() + paddingBottom() + relativeOffset);
         if (childrenInline()) {
-            if (lastLineBox()) {
-                int childBottomEdge = lastLineBox()->y() + lastLineBox()->height();
+            if (lastRootBox()) {
+                int childBottomEdge = lastRootBox()->selectionBottom();
                 bottom = max(bottom, childBottomEdge + paddingBottom() + relativeOffset);
             }
         } else {
@@ -2820,11 +2715,11 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
 
 int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && height() > 0 ? overflowWidth(false) : 0;
-
     int right = includeSelf && height() > 0 ? width() : 0;
 
+    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
+        return right;
+
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2847,7 +2742,7 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
     int relativeOffset = includeSelf && isRelPositioned() ? relativePositionOffsetX() : 0;
 
     if (includeSelf)
-        right = max(right, m_overflowWidth + relativeOffset);
+        right = max(right, rightLayoutOverflow() + relativeOffset);
 
     if (m_positionedObjects) {
         RenderBox* r;
@@ -2914,10 +2809,11 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
 
 int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
+    int left = includeSelf && height() > 0 ? 0 : width();
+    
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && height() > 0 ? overflowLeft(false) : width();
+        return left;
 
-    int left = includeSelf && height() > 0 ? 0 : width();
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2940,7 +2836,7 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
     int relativeOffset = includeSelf && isRelPositioned() ? relativePositionOffsetX() : 0;
 
     if (includeSelf)
-        left = min(left, m_overflowLeft + relativeOffset);
+        left = min(left, leftLayoutOverflow() + relativeOffset);
 
     if (m_positionedObjects) {
         RenderBox* r;
@@ -3134,9 +3030,8 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
 
     int lowestFloatBottom = 0;
 
-    // Floats that will remain the child's responsiblity to paint should factor into its
-    // visual overflow.
-    IntRect floatsOverflowRect;
+    // Floats that will remain the child's responsibility to paint should factor into its
+    // overflow.
     DeprecatedPtrListIterator<FloatingObject> it(*child->m_floatingObjects);
     for (FloatingObject* r; (r = it.current()); ++it) {
         int bottom = child->y() + r->m_bottom;
@@ -3177,13 +3072,9 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
             // it should paint.
             r->m_shouldPaint = true;
 
-        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
-            IntRect floatOverflowRect = r->m_renderer->overflowRect(false);
-            floatOverflowRect.move(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop());
-            floatsOverflowRect.unite(floatOverflowRect);
-        }
+        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer())
+            child->addOverflowFromChild(r->m_renderer, IntSize(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop()));
     }
-    child->addVisualOverflow(floatsOverflowRect);
     return lowestFloatBottom;
 }
 
@@ -3298,26 +3189,20 @@ int RenderBlock::getClearDelta(RenderBox* child, int yPos)
     // We also clear floats if we are too big to sit on the same line as a float (and wish to avoid floats by default).
     // FIXME: Note that the remaining space checks aren't quite accurate, since you should be able to clear only some floats (the minimum # needed
     // to fit) and not all (we should be using nextFloatBottomBelow and looping).
-    // Do not allow tables to wrap in quirks or even in almost strict mode 
-    // (ebay on the PLT, finance.yahoo.com in the real world, versiontracker.com forces even almost strict mode not to work)
     int result = clearSet ? max(0, bottom - yPos) : 0;
-    if (!result && child->avoidsFloats() && child->style()->width().isFixed() && 
-        child->minPrefWidth() > lineWidth(yPos, false) && child->minPrefWidth() <= availableWidth() && 
-        document()->inStrictMode())   
-        result = max(0, floatBottom() - yPos);
+    if (!result && child->avoidsFloats()) {
+        int oldYPos = child->y();
+        int oldWidth = child->width();
+        child->setY(yPos);
+        child->calcWidth();
+        if (child->width() > lineWidth(yPos, false) && child->minPrefWidth() <= availableWidth())
+            result = max(0, floatBottom() - yPos);
+        child->setY(oldYPos);
+        child->setWidth(oldWidth);
+    }
     return result;
 }
 
-void RenderBlock::addVisualOverflow(const IntRect& r)
-{
-    if (r.isEmpty())
-        return;
-    m_overflowLeft = min(m_overflowLeft, r.x());
-    m_overflowWidth = max(m_overflowWidth, r.right());
-    m_overflowTop = min(m_overflowTop, r.y());
-    m_overflowHeight = max(m_overflowHeight, r.bottom());
-}
-
 bool RenderBlock::isPointInOverflowControl(HitTestResult& result, int _x, int _y, int _tx, int _ty)
 {
     if (!scrollsOverflow())
@@ -3333,7 +3218,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
 
     if (!isRenderView()) {
         // Check if we need to do anything at all.
-        IntRect overflowBox = overflowRect(false);
+        IntRect overflowBox = visibleOverflowRect();
         overflowBox.move(tx, ty);
         if (!overflowBox.contains(_x, _y))
             return false;
@@ -3542,9 +3427,9 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
         if (root->nextRootBox()) {
             // FIXME: We would prefer to make the break point halfway between the bottom
             // of the previous root box and the top of the next root box.
-            bottom = root->nextRootBox()->topOverflow();
+            bottom = root->nextRootBox()->lineTop();
         } else
-            bottom = root->bottomOverflow() + verticalLineClickFudgeFactor;
+            bottom = root->lineBottom() + verticalLineClickFudgeFactor;
 
         // check if this root line box is located at this y coordinate
         if (pointInContents.y() < bottom) {
@@ -3563,7 +3448,7 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
     }
 
     if (closestBox) {
-        if (!useWindowsBehavior && pointInContents.y() < firstRootBoxWithChildren->topOverflow() - verticalLineClickFudgeFactor) {
+        if (!useWindowsBehavior && pointInContents.y() < firstRootBoxWithChildren->lineTop() - verticalLineClickFudgeFactor) {
             // y coordinate is above first root line box, so return the start of the first
             return VisiblePosition(positionForBox(firstRootBoxWithChildren->firstLeafChild(), true), DOWNSTREAM);
         }
@@ -3699,7 +3584,7 @@ void RenderBlock::calcColumnWidth()
 
 void RenderBlock::setDesiredColumnCountAndWidth(int count, int width)
 {
-    if (count == 1) {
+    if (count == 1 && style()->hasAutoColumnWidth()) {
         if (hasColumns()) {
             delete gColumnInfoMap->take(this);
             setHasColumns(false);
@@ -3836,14 +3721,16 @@ int RenderBlock::layoutColumns(int endOfContent)
             colCount++;
     }
 
-    m_overflowWidth = max(width(), currX - colGap);
-    m_overflowLeft = min(0, currX + desiredColumnWidth + colGap);
-
-    m_overflowHeight = maxColBottom;
+    int overflowRight = max(width(), currX - colGap);
+    int overflowLeft = min(0, currX + desiredColumnWidth + colGap);
+    int overflowHeight = maxColBottom;
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
         
     if (computeIntrinsicHeight)
-        setHeight(m_overflowHeight + toAdd);
+        setHeight(maxColBottom + toAdd);
+
+    m_overflow.clear();
+    addLayoutOverflow(IntRect(overflowLeft, 0, overflowRight - overflowLeft, overflowHeight));
 
     v->setPrintRect(IntRect());
     v->setTruncatedAt(0);
@@ -4767,7 +4654,7 @@ static int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom,
         if (block->childrenInline()) {
             for (RootInlineBox* box = block->firstRootBox(); box; box = box->nextRootBox()) {
                 if (++count == l)
-                    return box->bottomOverflow() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
+                    return box->lineBottom() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
             }
         }
         else {
@@ -5098,8 +4985,11 @@ void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, in
         graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
 
     if (!hasOverflowClip() && !hasControlClip()) {
-        for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-            graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height()));
+        for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
+            int top = max(curr->lineTop(), curr->y());
+            int bottom = min(curr->lineBottom(), curr->y() + curr->height());
+            graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + top, curr->width(), bottom - top));
+        }
 
         for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
             if (!curr->isText() && !curr->isListMarker() && curr->isBox()) {
@@ -5121,13 +5011,20 @@ void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, in
                                                 ty - y() + inlineContinuation()->containingBlock()->y());
 }
 
-RenderBlock* RenderBlock::createAnonymousBlock() const
+RenderBlock* RenderBlock::createAnonymousBlock(bool isFlexibleBox) const
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
-    newStyle->setDisplay(BLOCK);
 
-    RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
+    RenderBlock* newBox = 0;
+    if (isFlexibleBox) {
+        newStyle->setDisplay(BOX);
+        newBox = new (renderArena()) RenderFlexibleBox(document() /* anonymous box */);
+    } else {
+        newStyle->setDisplay(BLOCK);
+        newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
+    }
+
     newBox->setStyle(newStyle.release());
     return newBox;
 }
diff --git a/WebCore/rendering/RenderBlock.h b/WebCore/rendering/RenderBlock.h
index 839be16..e23ebda 100644
--- a/WebCore/rendering/RenderBlock.h
+++ b/WebCore/rendering/RenderBlock.h
@@ -67,17 +67,6 @@ public:
 
     void deleteLineBoxTree();
 
-    // The height (and width) of a block when you include overflow spillage out of the bottom
-    // of the block (e.g., a <div style="height:25px"> that has a 100px tall image inside
-    // it would have an overflow height of borderTop() + paddingTop() + 100px.
-    virtual int overflowHeight(bool includeInterior = true) const;
-    virtual int overflowWidth(bool includeInterior = true) const;
-    virtual int overflowLeft(bool includeInterior = true) const;
-    virtual int overflowTop(bool includeInterior = true) const;
-    virtual IntRect overflowRect(bool includeInterior = true) const;
-
-    void addVisualOverflow(const IntRect&);
-
     virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject*);
 
@@ -104,6 +93,7 @@ public:
     IntRect floatRect() const;
 
     int lineWidth(int y, bool firstLine) const;
+    
     virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
@@ -147,15 +137,12 @@ public:
 
     // This function is a convenience helper for creating an anonymous block that inherits its
     // style from this RenderBlock.
-    RenderBlock* createAnonymousBlock() const;
+    RenderBlock* createAnonymousBlock(bool isFlexibleBox = false) const;
 
     Vector<IntRect>* columnRects() const;
     int columnGap() const;
 
 protected:
-    virtual void setOverflowHeight(int h) { m_overflowHeight = h; }
-    virtual void setOverflowWidth(int w) { m_overflowWidth = w; }
-
     int maxTopPosMargin() const { return m_maxMargin ? m_maxMargin->m_topPos : MaxMargin::topPosDefault(this); }
     int maxTopNegMargin() const { return m_maxMargin ? m_maxMargin->m_topNeg : MaxMargin::topNegDefault(this); }
     int maxBottomPosMargin() const { return m_maxMargin ? m_maxMargin->m_bottomPos : MaxMargin::bottomPosDefault(this); }
@@ -207,7 +194,7 @@ protected:
 
     virtual bool hasLineIfEmpty() const;
     bool layoutOnlyPositionedObjects();
-    
+
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
@@ -275,11 +262,14 @@ private:
     InlineFlowBox* createLineBoxes(RenderObject*, bool firstLine);
     void computeHorizontalPositionsForLine(RootInlineBox*, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd);
     void computeVerticalPositionsForLine(RootInlineBox*, BidiRun*);
-    void checkLinesForOverflow();
     void deleteEllipsisLineBoxes();
     void checkLinesForTextOverflow();
+    void addOverflowFromInlineChildren();
     // End of functions defined in RenderBlockLineLayout.cpp.
 
+    void addOverflowFromBlockChildren();
+    void addOverflowFromFloats();
+
     void paintFloats(PaintInfo&, int tx, int ty, bool preservePhase = false);
     void paintContents(PaintInfo&, int tx, int ty);
     void paintColumnContents(PaintInfo&, int tx, int ty, bool paintFloats = false);
@@ -432,10 +422,6 @@ private:
         // This flag is set when we know we're examining bottom margins and we know we're at the bottom of the block.
         bool m_atBottomOfBlock : 1;
 
-        // If our last normal flow child was a self-collapsing block that cleared a float,
-        // we track it in this variable.
-        bool m_selfCollapsingBlockClearedFloat : 1;
-
         // These variables are used to detect quirky margins that we need to collapse away (in table cells
         // and in the body element).
         bool m_topQuirk : 1;
@@ -452,7 +438,6 @@ private:
         void setAtTopOfBlock(bool b) { m_atTopOfBlock = b; }
         void setAtBottomOfBlock(bool b) { m_atBottomOfBlock = b; }
         void clearMargin() { m_posMargin = m_negMargin = 0; }
-        void setSelfCollapsingBlockClearedFloat(bool b) { m_selfCollapsingBlockClearedFloat = b; }
         void setTopQuirk(bool b) { m_topQuirk = b; }
         void setBottomQuirk(bool b) { m_bottomQuirk = b; }
         void setDeterminedTopQuirk(bool b) { m_determinedTopQuirk = b; }
@@ -468,7 +453,6 @@ private:
         bool canCollapseWithBottom() const { return m_atBottomOfBlock && m_canCollapseBottomWithChildren; }
         bool canCollapseTopWithChildren() const { return m_canCollapseTopWithChildren; }
         bool canCollapseBottomWithChildren() const { return m_canCollapseBottomWithChildren; }
-        bool selfCollapsingBlockClearedFloat() const { return m_selfCollapsingBlockClearedFloat; }
         bool quirkContainer() const { return m_quirkContainer; }
         bool determinedTopQuirk() const { return m_determinedTopQuirk; }
         bool topQuirk() const { return m_topQuirk; }
@@ -478,6 +462,7 @@ private:
         int margin() const { return m_posMargin - m_negMargin; }
     };
 
+    void layoutBlockChild(RenderBox* child, MarginInfo&, int& previousFloatBottom, int& maxFloatBottom);
     void adjustPositionedBlock(RenderBox* child, const MarginInfo&);
     void adjustFloatingBlock(const MarginInfo&);
     bool handleSpecialChild(RenderBox* child, const MarginInfo&);
@@ -528,14 +513,6 @@ private:
     RenderObjectChildList m_children;
     RenderLineBoxList m_lineBoxes;   // All of the root line boxes created for this block flow.  For example, <div>Hello<br>world.</div> will have two total lines for the <div>.
 
-protected:
-    // How much content overflows out of our block vertically or horizontally.
-    int m_overflowHeight;
-    int m_overflowWidth;
-    int m_overflowLeft;
-    int m_overflowTop;
-
-private:
     mutable int m_lineHeight;
 };
 
diff --git a/WebCore/rendering/RenderBlockLineLayout.cpp b/WebCore/rendering/RenderBlockLineLayout.cpp
index 3950372..538225d 100644
--- a/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -770,11 +770,8 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, bool
 
     // The widths of all runs are now known.  We can now place every inline box (and
     // compute accurate widths for the inline flow boxes).
-    int leftPosition = x;
-    int rightPosition = x;
     needsWordSpacing = false;
-    lineBox->placeBoxesHorizontally(x, leftPosition, rightPosition, needsWordSpacing);
-    lineBox->setHorizontalOverflowPositions(leftPosition, rightPosition);
+    lineBox->placeBoxesHorizontally(x, needsWordSpacing);
 }
 
 void RenderBlock::computeVerticalPositionsForLine(RootInlineBox* lineBox, BidiRun* firstRun)
@@ -782,11 +779,6 @@ void RenderBlock::computeVerticalPositionsForLine(RootInlineBox* lineBox, BidiRu
     setHeight(lineBox->verticallyAlignBoxes(height()));
     lineBox->setBlockHeight(height());
 
-    // See if the line spilled out.  If so set overflow height accordingly.
-    int bottomOfLine = lineBox->bottomOverflow();
-    if (bottomOfLine > height() && bottomOfLine > m_overflowHeight)
-        m_overflowHeight = bottomOfLine;
-
     // Now make sure we place replaced render objects correctly.
     for (BidiRun* r = firstRun; r; r = r->next()) {
         ASSERT(r->m_box);
@@ -831,7 +823,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
 {
     bool useRepaintBounds = false;
     
-    m_overflowHeight = 0;
+    m_overflow.clear();
         
     setHeight(borderTop() + paddingTop());
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
@@ -1022,8 +1014,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
             RenderArena* arena = renderArena();
             RootInlineBox* box = startLine;
             while (box) {
-                repaintTop = min(repaintTop, box->topOverflow());
-                repaintBottom = max(repaintBottom, box->bottomOverflow());
+                repaintTop = min(repaintTop, box->topVisibleOverflow());
+                repaintBottom = max(repaintBottom, box->bottomVisibleOverflow());
                 RootInlineBox* next = box->nextRootBox();
                 box->deleteLine(arena);
                 box = next;
@@ -1159,8 +1151,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 if (lineBox) {
                     lineBox->setLineBreakInfo(end.obj, end.pos, resolver.status());
                     if (useRepaintBounds) {
-                        repaintTop = min(repaintTop, lineBox->topOverflow());
-                        repaintBottom = max(repaintBottom, lineBox->bottomOverflow());
+                        repaintTop = min(repaintTop, lineBox->topVisibleOverflow());
+                        repaintBottom = max(repaintBottom, lineBox->bottomVisibleOverflow());
                     }
                 }
 
@@ -1199,8 +1191,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 for (RootInlineBox* line = endLine; line; line = line->nextRootBox()) {
                     line->attachLine();
                     if (delta) {
-                        repaintTop = min(repaintTop, line->topOverflow() + min(delta, 0));
-                        repaintBottom = max(repaintBottom, line->bottomOverflow() + max(delta, 0));
+                        repaintTop = min(repaintTop, line->topVisibleOverflow() + min(delta, 0));
+                        repaintBottom = max(repaintBottom, line->bottomVisibleOverflow() + max(delta, 0));
                         line->adjustPosition(0, delta);
                     }
                     if (Vector<RenderBox*>* cleanLineFloats = line->floatsPtr()) {
@@ -1216,12 +1208,12 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 setHeight(lastRootBox()->blockHeight());
             } else {
                 // Delete all the remaining lines.
-                InlineRunBox* line = endLine;
+                RootInlineBox* line = endLine;
                 RenderArena* arena = renderArena();
                 while (line) {
-                    repaintTop = min(repaintTop, line->topOverflow());
-                    repaintBottom = max(repaintBottom, line->bottomOverflow());
-                    InlineRunBox* next = line->nextLineBox();
+                    repaintTop = min(repaintTop, line->topVisibleOverflow());
+                    repaintBottom = max(repaintBottom, line->bottomVisibleOverflow());
+                    RootInlineBox* next = line->nextRootBox();
                     line->deleteLine(arena);
                     line = next;
                 }
@@ -1259,12 +1251,6 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
     // Now add in the bottom border/padding.
     setHeight(height() + toAdd);
 
-    // Always make sure this is at least our height.
-    m_overflowHeight = max(height(), m_overflowHeight);
-
-    // See if any lines spill out of the block.  If so, we need to update our overflow width.
-    checkLinesForOverflow();
-
     if (!firstLineBox() && hasLineIfEmpty())
         setHeight(height() + lineHeight(true, true));
 
@@ -1491,8 +1477,8 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
             RootInlineBox* boxToDelete = endLine;
             RenderArena* arena = renderArena();
             while (boxToDelete && boxToDelete != result) {
-                repaintTop = min(repaintTop, boxToDelete->topOverflow());
-                repaintBottom = max(repaintBottom, boxToDelete->bottomOverflow());
+                repaintTop = min(repaintTop, boxToDelete->topVisibleOverflow());
+                repaintBottom = max(repaintBottom, boxToDelete->bottomVisibleOverflow());
                 RootInlineBox* next = boxToDelete->nextRootBox();
                 boxToDelete->deleteLine(arena);
                 boxToDelete = next;
@@ -2312,14 +2298,12 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     return lBreak;
 }
 
-void RenderBlock::checkLinesForOverflow()
+void RenderBlock::addOverflowFromInlineChildren()
 {
-    m_overflowWidth = width();
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
-        m_overflowLeft = min(curr->leftOverflow(), m_overflowLeft);
-        m_overflowTop = min(curr->topOverflow(), m_overflowTop);
-        m_overflowWidth = max(curr->rightOverflow(), m_overflowWidth);
-        m_overflowHeight = max(curr->bottomOverflow(), m_overflowHeight);
+        addLayoutOverflow(curr->layoutOverflowRect());
+        if (!hasOverflowClip())
+            addVisualOverflow(curr->visualOverflowRect());
     }
 }
 
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index 4c2bff0..efd88a7 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -406,16 +406,28 @@ int RenderBox::horizontalScrollbarHeight() const
     return includeHorizontalScrollbarSize() ? layer()->horizontalScrollbarHeight() : 0;
 }
 
-bool RenderBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+bool RenderBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier, Node** stopNode)
 {
     RenderLayer* l = layer();
-    if (l && l->scroll(direction, granularity, multiplier))
+    if (l && l->scroll(direction, granularity, multiplier)) {
+        if (stopNode)
+            *stopNode = node();
         return true;
+    }
+
+    if (stopNode && *stopNode && *stopNode == node())
+        return true;
+
     RenderBlock* b = containingBlock();
     if (b && !b->isRenderView())
-        return b->scroll(direction, granularity, multiplier);
+        return b->scroll(direction, granularity, multiplier, stopNode);
     return false;
 }
+
+bool RenderBox::canBeScrolledAndHasScrollableArea() const
+{
+   return canBeProgramaticallyScrolled(false) && (scrollHeight() != clientHeight() || scrollWidth() != clientWidth());
+}
     
 bool RenderBox::canBeProgramaticallyScrolled(bool) const
 {
@@ -653,31 +665,36 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int tx, int ty, int
 {
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
-    StyleImage* maskBoxImage = style()->maskBoxImage().image();
-    if (maskBoxImage && style()->maskLayers()->hasImage()) {
-        pushTransparencyLayer = true;
-    } else {
-        // We have to use an extra image buffer to hold the mask. Multiple mask images need
-        // to composite together using source-over so that they can then combine into a single unified mask that
-        // can be composited with the content using destination-in.  SVG images need to be able to set compositing modes
-        // as they draw images contained inside their sub-document, so we paint all our images into a separate buffer
-        // and composite that buffer as the mask.
-        // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
-        // before pushing the transparency layer.
-        for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
-            if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
-                pushTransparencyLayer = true;
-                // We found one image that can be used in rendering, exit the loop
-                break;
+    bool compositedMask = hasLayer() && layer()->hasCompositedMask();
+    CompositeOperator compositeOp = CompositeSourceOver;
+
+    if (!compositedMask) {
+        StyleImage* maskBoxImage = style()->maskBoxImage().image();
+        if (maskBoxImage && style()->maskLayers()->hasImage()) {
+            pushTransparencyLayer = true;
+        } else {
+            // We have to use an extra image buffer to hold the mask. Multiple mask images need
+            // to composite together using source-over so that they can then combine into a single unified mask that
+            // can be composited with the content using destination-in.  SVG images need to be able to set compositing modes
+            // as they draw images contained inside their sub-document, so we paint all our images into a separate buffer
+            // and composite that buffer as the mask.
+            // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
+            // before pushing the transparency layer.
+            for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
+                if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
+                    pushTransparencyLayer = true;
+                    // We found one image that can be used in rendering, exit the loop
+                    break;
+                }
             }
         }
-    }
-    
-    CompositeOperator compositeOp = CompositeDestinationIn;
-    if (pushTransparencyLayer) {
-        paintInfo.context->setCompositeOperation(CompositeDestinationIn);
-        paintInfo.context->beginTransparencyLayer(1.0f);
-        compositeOp = CompositeSourceOver;
+        
+        compositeOp = CompositeDestinationIn;
+        if (pushTransparencyLayer) {
+            paintInfo.context->setCompositeOperation(CompositeDestinationIn);
+            paintInfo.context->beginTransparencyLayer(1.0f);
+            compositeOp = CompositeSourceOver;
+        }
     }
 
     paintFillLayers(paintInfo, Color(), style()->maskLayers(), tx, ty, w, h, compositeOp);
@@ -930,7 +947,8 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
     if (style()->position() == FixedPosition)
         fixed = true;
 
-    RenderObject* o = container();
+    bool containerSkipped;
+    RenderObject* o = container(repaintContainer, &containerSkipped);
     if (!o)
         return;
 
@@ -948,6 +966,14 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
     } else
         transformState.move(containerOffset.width(), containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
 
+    if (containerSkipped) {
+        // There can't be a transform between repaintContainer and o, because transforms create containers, so it should be safe
+        // to just subtract the delta between the repaintContainer and o.
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
+        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+        return;
+    }
+    
     o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
 }
 
@@ -1068,7 +1094,7 @@ IntRect RenderBox::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintCo
     if (style()->visibility() != VISIBLE && !enclosingLayer()->hasVisibleContent())
         return IntRect();
 
-    IntRect r = overflowRect(false);
+    IntRect r = visibleOverflowRect();
 
     RenderView* v = view();
     if (v) {
@@ -1120,7 +1146,8 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, In
     if (repaintContainer == this)
         return;
 
-    RenderObject* o = container();
+    bool containerSkipped;
+    RenderObject* o = container(repaintContainer, &containerSkipped);
     if (!o)
         return;
 
@@ -1177,6 +1204,13 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, In
             return;
     } else
         rect.setLocation(topLeft);
+
+    if (containerSkipped) {
+        // If the repaintContainer is below o, then we need to map the rect into repaintContainer's coordinates.
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
+        rect.move(-containerOffset);
+        return;
+    }
     
     o->computeRectForRepaint(repaintContainer, rect, fixed);
 }
@@ -1520,7 +1554,7 @@ int RenderBox::calcHeightUsing(const Length& h)
 int RenderBox::calcPercentageHeight(const Length& height)
 {
     int result = -1;
-    bool includeBorderPadding = isTable();
+    bool skippedAutoHeightContainingBlock = false;
     RenderBlock* cb = containingBlock();
     if (style()->htmlHacks()) {
         // In quirks mode, blocks with auto height are skipped, and we keep looking for an enclosing
@@ -1528,6 +1562,7 @@ int RenderBox::calcPercentageHeight(const Length& height)
         // specification, which states that percentage heights just revert to auto if the containing
         // block has an auto height.
         while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isPositioned() && cb->style()->height().isAuto()) {
+            skippedAutoHeightContainingBlock = true;
             cb = cb->containingBlock();
             cb->addPercentHeightDescendant(this);
         }
@@ -1537,25 +1572,29 @@ int RenderBox::calcPercentageHeight(const Length& height)
     // explicitly specified that can be used for any percentage computations.
     bool isPositionedWithSpecifiedHeight = cb->isPositioned() && (!cb->style()->height().isAuto() || (!cb->style()->top().isAuto() && !cb->style()->bottom().isAuto()));
 
+    bool includeBorderPadding = isTable();
+
     // Table cells violate what the CSS spec says to do with heights.  Basically we
     // don't care if the cell specified a height or not.  We just always make ourselves
     // be a percentage of the cell's current content height.
     if (cb->isTableCell()) {
-        result = cb->overrideSize();
-        if (result == -1) {
-            // Normally we would let the cell size intrinsically, but scrolling overflow has to be
-            // treated differently, since WinIE lets scrolled overflow regions shrink as needed.
-            // While we can't get all cases right, we can at least detect when the cell has a specified
-            // height or when the table has a specified height.  In these cases we want to initially have
-            // no size and allow the flexing of the table or the cell to its specified height to cause us
-            // to grow to fill the space.  This could end up being wrong in some cases, but it is
-            // preferable to the alternative (sizing intrinsically and making the row end up too big).
-            RenderTableCell* cell = toRenderTableCell(cb);
-            if (scrollsOverflowY() && (!cell->style()->height().isAuto() || !cell->table()->style()->height().isAuto()))
-                return 0;
-            return -1;
+        if (!skippedAutoHeightContainingBlock) {
+            result = cb->overrideSize();
+            if (result == -1) {
+                // Normally we would let the cell size intrinsically, but scrolling overflow has to be
+                // treated differently, since WinIE lets scrolled overflow regions shrink as needed.
+                // While we can't get all cases right, we can at least detect when the cell has a specified
+                // height or when the table has a specified height.  In these cases we want to initially have
+                // no size and allow the flexing of the table or the cell to its specified height to cause us
+                // to grow to fill the space.  This could end up being wrong in some cases, but it is
+                // preferable to the alternative (sizing intrinsically and making the row end up too big).
+                RenderTableCell* cell = toRenderTableCell(cb);
+                if (scrollsOverflowY() && (!cell->style()->height().isAuto() || !cell->table()->style()->height().isAuto()))
+                    return 0;
+                return -1;
+            }
+            includeBorderPadding = true;
         }
-        includeBorderPadding = true;
     }
     // Otherwise we only use our percentage height if our containing block had a specified
     // height.
@@ -2485,7 +2524,7 @@ void RenderBox::calcAbsoluteHorizontalReplaced()
     // positioned, inline containing block because right now, it is using the xPos
     // of the first line box when really it should use the last line box.  When
     // this is fixed elsewhere, this block should be removed.
-    if (containerBlock->isInline() && containerBlock->style()->direction() == RTL) {
+    if (containerBlock->isRenderInline() && containerBlock->style()->direction() == RTL) {
         const RenderInline* flow = toRenderInline(containerBlock);
         InlineFlowBox* firstLine = flow->firstLineBox();
         InlineFlowBox* lastLine = flow->lastLineBox();
@@ -2646,9 +2685,9 @@ IntRect RenderBox::localCaretRect(InlineBox* box, int caretOffset, int* extraWid
 
     if (box) {
         RootInlineBox* rootBox = box->root();
-        int top = rootBox->topOverflow();
+        int top = rootBox->lineTop();
         rect.setY(top);
-        rect.setHeight(rootBox->bottomOverflow() - top);
+        rect.setHeight(rootBox->lineBottom() - top);
     }
 
     // If height of box is smaller than font height, use the latter one,
@@ -2701,11 +2740,6 @@ int RenderBox::leftmostPosition(bool /*includeOverflowInterior*/, bool includeSe
     return left;
 }
 
-bool RenderBox::isAfterContent(RenderObject* child) const
-{
-    return (child && child->style()->styleType() == AFTER && (!child->isText() || child->isBR()));
-}
-
 VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
 {
     // no children...return this render object's element, if there is one, and offset 0
@@ -2813,6 +2847,81 @@ bool RenderBox::avoidsFloats() const
     return isReplaced() || hasOverflowClip() || isHR();
 }
 
+void RenderBox::addShadowOverflow()
+{
+    int shadowLeft;
+    int shadowRight;
+    int shadowTop;
+    int shadowBottom;
+    style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
+    IntRect borderBox = borderBoxRect();
+    int overflowLeft = borderBox.x() + shadowLeft;
+    int overflowRight = borderBox.right() + shadowRight;
+    int overflowTop = borderBox.y() + shadowTop;
+    int overflowBottom = borderBox.bottom() + shadowBottom;
+    addVisualOverflow(IntRect(overflowLeft, overflowTop, overflowRight - overflowLeft, overflowBottom - overflowTop));
+}
+
+void RenderBox::addOverflowFromChild(RenderBox* child, const IntSize& delta)
+{
+    // Update our overflow in case the child spills out the block, but only if we were going to paint
+    // the child block ourselves.
+    if (child->hasSelfPaintingLayer())
+        return;
+
+    // Only propagate layout overflow from the child if the child isn't clipping its overflow.  If it is, then
+    // its overflow is internal to it, and we don't care about it.
+    IntRect childLayoutOverflowRect = child->hasOverflowClip() ? child->borderBoxRect() : child->layoutOverflowRect();
+    childLayoutOverflowRect.move(delta);
+    addLayoutOverflow(childLayoutOverflowRect);
+            
+    // Add in visual overflow from the child.  Even if the child clips its overflow, it may still
+    // have visual overflow of its own set from box shadows or reflections.  It is unnecessary to propagate this
+    // overflow if we are clipping our own overflow.
+    if (hasOverflowClip())
+        return;
+    IntRect childVisualOverflowRect = child->visualOverflowRect();
+    childVisualOverflowRect.move(delta);
+    addVisualOverflow(childVisualOverflowRect);
+}
+
+void RenderBox::addLayoutOverflow(const IntRect& rect)
+{
+    IntRect borderBox = borderBoxRect();
+    if (borderBox.contains(rect))
+        return;
+        
+    if (!m_overflow)
+        m_overflow.set(new RenderOverflow(borderBox));
+    
+    m_overflow->addLayoutOverflow(rect);
+}
+
+void RenderBox::addVisualOverflow(const IntRect& rect)
+{
+    IntRect borderBox = borderBoxRect();
+    if (borderBox.contains(rect))
+        return;
+        
+    if (!m_overflow)
+        m_overflow.set(new RenderOverflow(borderBox));
+    
+    m_overflow->addVisualOverflow(rect);
+}
+
+void RenderBox::clearLayoutOverflow()
+{
+    if (!m_overflow)
+        return;
+    
+    if (visualOverflowRect() == borderBoxRect()) {
+        m_overflow.clear();
+        return;
+    }
+    
+    m_overflow->resetLayoutOverflow(borderBoxRect());
+}
+
 #if ENABLE(SVG)
 
 TransformationMatrix RenderBox::localTransform() const
diff --git a/WebCore/rendering/RenderBox.h b/WebCore/rendering/RenderBox.h
index cb2297b..897d9b3 100644
--- a/WebCore/rendering/RenderBox.h
+++ b/WebCore/rendering/RenderBox.h
@@ -24,6 +24,7 @@
 #define RenderBox_h
 
 #include "RenderBoxModelObject.h"
+#include "RenderOverflow.h"
 #include "ScrollTypes.h"
 
 namespace WebCore {
@@ -80,16 +81,31 @@ public:
     RenderBox* nextSiblingBox() const;
     RenderBox* parentBox() const;
 
-    // The height of a block when you include normal flow overflow spillage out of the bottom
-    // of the block (e.g., a <div style="height:25px"> that has a 100px tall image inside
-    // it would have an overflow height of borderTop() + paddingTop() + 100px.
-    virtual int overflowHeight(bool /*includeInterior*/ = true) const { return height(); }
-    virtual int overflowWidth(bool /*includeInterior*/ = true) const { return width(); }
-    virtual void setOverflowHeight(int) { }
-    virtual void setOverflowWidth(int) { }
-    virtual int overflowLeft(bool /*includeInterior*/ = true) const { return 0; }
-    virtual int overflowTop(bool /*includeInterior*/ = true) const { return 0; }
-    virtual IntRect overflowRect(bool /*includeInterior*/ = true) const { return borderBoxRect(); }
+    IntRect visibleOverflowRect() const { return hasOverflowClip() ? visualOverflowRect() : (m_overflow ? m_overflow->visibleOverflowRect() : borderBoxRect()); }
+    int topVisibleOverflow() const { return hasOverflowClip() ? topVisualOverflow() : std::min(topLayoutOverflow(), topVisualOverflow()); }
+    int bottomVisibleOverflow() const { return hasOverflowClip() ? bottomVisualOverflow() : std::max(bottomLayoutOverflow(), bottomVisualOverflow()); }
+    int leftVisibleOverflow() const { return hasOverflowClip() ? leftVisualOverflow() : std::min(leftLayoutOverflow(), leftVisualOverflow()); }
+    int rightVisibleOverflow() const { return hasOverflowClip() ? rightVisualOverflow() :  std::max(rightLayoutOverflow(), rightVisualOverflow()); }
+    
+    IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : borderBoxRect(); }
+    int topLayoutOverflow() const { return m_overflow? m_overflow->topLayoutOverflow() : 0; }
+    int bottomLayoutOverflow() const { return m_overflow ? m_overflow->bottomLayoutOverflow() : height(); }
+    int leftLayoutOverflow() const { return m_overflow ? m_overflow->leftLayoutOverflow() : 0; }
+    int rightLayoutOverflow() const { return m_overflow ? m_overflow->rightLayoutOverflow() : width(); }
+    
+    IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : borderBoxRect(); }
+    int topVisualOverflow() const { return m_overflow? m_overflow->topVisualOverflow() : 0; }
+    int bottomVisualOverflow() const { return m_overflow ? m_overflow->bottomVisualOverflow() : height(); }
+    int leftVisualOverflow() const { return m_overflow ? m_overflow->leftVisualOverflow() : 0; }
+    int rightVisualOverflow() const { return m_overflow ? m_overflow->rightVisualOverflow() : width(); }
+
+    void addLayoutOverflow(const IntRect&);
+    void addVisualOverflow(const IntRect&);
+    
+    void addShadowOverflow();
+    void addOverflowFromChild(RenderBox* child) { addOverflowFromChild(child, IntSize(child->x(), child->y())); }
+    void addOverflowFromChild(RenderBox* child, const IntSize& delta);
+    void clearLayoutOverflow();
 
     int contentWidth() const { return clientWidth() - paddingLeft() - paddingRight(); }
     int contentHeight() const { return clientHeight() - paddingTop() - paddingBottom(); }
@@ -229,7 +245,8 @@ public:
 
     virtual int verticalScrollbarWidth() const;
     int horizontalScrollbarHeight() const;
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
+    bool canBeScrolledAndHasScrollableArea() const;
     virtual bool canBeProgramaticallyScrolled(bool) const;
     virtual void autoscroll();
     virtual void stopAutoscroll() { }
@@ -333,9 +350,6 @@ private:
     // These include tables, positioned objects, floats and flexible boxes.
     virtual void calcPrefWidths() { setPrefWidthsDirty(false); }
 
-protected:
-    bool isAfterContent(RenderObject* child) const;
-
 private:
     // The width/height of the contents + borders + padding.  The x/y location is relative to our container (which is not always our parent).
     IntRect m_frameRect;
@@ -360,6 +374,9 @@ protected:
     // For inline replaced elements, the inline box that owns us.
     InlineBox* m_inlineBoxWrapper;
 
+    // Our overflow information.
+    OwnPtr<RenderOverflow> m_overflow;
+
 private:
     // Used to store state between styleWillChange and styleDidChange
     static bool s_hadOverflowClip;
diff --git a/WebCore/rendering/RenderBoxModelObject.cpp b/WebCore/rendering/RenderBoxModelObject.cpp
index 2b05170..23dad2d 100644
--- a/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/WebCore/rendering/RenderBoxModelObject.cpp
@@ -316,10 +316,14 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
 
     bool clippedToBorderRadius = false;
     if (style()->hasBorderRadius() && (includeLeftEdge || includeRightEdge)) {
+        IntRect borderRect(tx, ty, w, h);
+
+        if (borderRect.isEmpty())
+            return;
+
         context->save();
 
         IntSize topLeft, topRight, bottomLeft, bottomRight;
-        IntRect borderRect(tx, ty, w, h);
         style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
 
         context->addRoundedRectClip(borderRect, includeLeftEdge ? topLeft : IntSize(),
@@ -489,153 +493,130 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         context->restore();
 }
 
-IntSize RenderBoxModelObject::calculateBackgroundSize(const FillLayer* bgLayer, int scaledWidth, int scaledHeight) const
+IntSize RenderBoxModelObject::calculateFillTileSize(const FillLayer* fillLayer, IntSize positioningAreaSize) const
 {
-    StyleImage* bg = bgLayer->image();
-    bg->setImageContainerSize(IntSize(scaledWidth, scaledHeight)); // Use the box established by background-origin.
-
-    if (bgLayer->isSizeSet()) {
-        int w = scaledWidth;
-        int h = scaledHeight;
-        Length bgWidth = bgLayer->size().width();
-        Length bgHeight = bgLayer->size().height();
-
-        if (bgWidth.isFixed())
-            w = bgWidth.value();
-        else if (bgWidth.isPercent())
-            w = bgWidth.calcValue(scaledWidth);
-        
-        if (bgHeight.isFixed())
-            h = bgHeight.value();
-        else if (bgHeight.isPercent())
-            h = bgHeight.calcValue(scaledHeight);
-        
-        // If one of the values is auto we have to use the appropriate
-        // scale to maintain our aspect ratio.
-        if (bgWidth.isAuto() && !bgHeight.isAuto())
-            w = bg->imageSize(this, style()->effectiveZoom()).width() * h / bg->imageSize(this, style()->effectiveZoom()).height();        
-        else if (!bgWidth.isAuto() && bgHeight.isAuto())
-            h = bg->imageSize(this, style()->effectiveZoom()).height() * w / bg->imageSize(this, style()->effectiveZoom()).width();
-        else if (bgWidth.isAuto() && bgHeight.isAuto()) {
-            // If both width and height are auto, we just want to use the image's
-            // intrinsic size.
-            w = bg->imageSize(this, style()->effectiveZoom()).width();
-            h = bg->imageSize(this, style()->effectiveZoom()).height();
+    StyleImage* image = fillLayer->image();
+    image->setImageContainerSize(positioningAreaSize); // Use the box established by background-origin.
+
+    EFillSizeType type = fillLayer->size().type;
+
+    switch (type) {
+        case SizeLength: {
+            int w = positioningAreaSize.width();
+            int h = positioningAreaSize.height();
+            Length layerWidth = fillLayer->size().size.width();
+            Length layerHeight = fillLayer->size().size.height();
+
+            if (layerWidth.isFixed())
+                w = layerWidth.value();
+            else if (layerWidth.isPercent())
+                w = layerWidth.calcValue(positioningAreaSize.width());
+            
+            if (layerHeight.isFixed())
+                h = layerHeight.value();
+            else if (layerHeight.isPercent())
+                h = layerHeight.calcValue(positioningAreaSize.height());
+            
+            // If one of the values is auto we have to use the appropriate
+            // scale to maintain our aspect ratio.
+            if (layerWidth.isAuto() && !layerHeight.isAuto())
+                w = image->imageSize(this, style()->effectiveZoom()).width() * h / image->imageSize(this, style()->effectiveZoom()).height();        
+            else if (!layerWidth.isAuto() && layerHeight.isAuto())
+                h = image->imageSize(this, style()->effectiveZoom()).height() * w / image->imageSize(this, style()->effectiveZoom()).width();
+            else if (layerWidth.isAuto() && layerHeight.isAuto()) {
+                // If both width and height are auto, we just want to use the image's
+                // intrinsic size.
+                w = image->imageSize(this, style()->effectiveZoom()).width();
+                h = image->imageSize(this, style()->effectiveZoom()).height();
+            }
+            
+            return IntSize(max(1, w), max(1, h));
         }
-        
-        return IntSize(max(1, w), max(1, h));
-    } else
-        return bg->imageSize(this, style()->effectiveZoom());
+        case Contain:
+        case Cover: {
+            IntSize imageIntrinsicSize = image->imageSize(this, 1);
+            float horizontalScaleFactor = static_cast<float>(positioningAreaSize.width()) / imageIntrinsicSize.width();
+            float verticalScaleFactor = static_cast<float>(positioningAreaSize.height()) / imageIntrinsicSize.height();
+            float scaleFactor = type == Contain ? min(horizontalScaleFactor, verticalScaleFactor) : max(horizontalScaleFactor, verticalScaleFactor);
+
+            return IntSize(max<int>(1, imageIntrinsicSize.width() * scaleFactor), max<int>(1, imageIntrinsicSize.height() * scaleFactor));
+        }
+        case SizeNone:
+            break;
+    }
+    return image->imageSize(this, style()->effectiveZoom());
 }
 
-void RenderBoxModelObject::calculateBackgroundImageGeometry(const FillLayer* bgLayer, int tx, int ty, int w, int h, 
+void RenderBoxModelObject::calculateBackgroundImageGeometry(const FillLayer* fillLayer, int tx, int ty, int w, int h, 
                                                             IntRect& destRect, IntPoint& phase, IntSize& tileSize)
 {
-    int pw;
-    int ph;
     int left = 0;
-    int right = 0;
     int top = 0;
-    int bottom = 0;
-    int cx;
-    int cy;
-    int rw = 0;
-    int rh = 0;
-
-    // CSS2 chapter 14.2.1
-    bool fixedAttachment = bgLayer->attachment() == FixedBackgroundAttachment;
+    IntSize positioningAreaSize;
+
+    // Determine the background positioning area and set destRect to the background painting area.
+    // destRect will be adjusted later if the background is non-repeating.
+    bool fixedAttachment = fillLayer->attachment() == FixedBackgroundAttachment;
     if (!fixedAttachment) {
-        // Scroll and Local
-        if (bgLayer->origin() != BorderFillBox) {
+        destRect = IntRect(tx, ty, w, h);
+
+        int right = 0;
+        int bottom = 0;
+        // Scroll and Local.
+        if (fillLayer->origin() != BorderFillBox) {
             left = borderLeft();
             right = borderRight();
             top = borderTop();
             bottom = borderBottom();
-            if (bgLayer->origin() == ContentFillBox) {
+            if (fillLayer->origin() == ContentFillBox) {
                 left += paddingLeft();
                 right += paddingRight();
                 top += paddingTop();
                 bottom += paddingBottom();
             }
         }
-        
+
         // The background of the box generated by the root element covers the entire canvas including
-        // its margins.  Since those were added in already, we have to factor them out when computing the
-        // box used by background-origin/size/position.
+        // its margins. Since those were added in already, we have to factor them out when computing
+        // the background positioning area.
         if (isRoot()) {
-            rw = toRenderBox(this)->width() - left - right;
-            rh = toRenderBox(this)->height() - top - bottom; 
+            positioningAreaSize = IntSize(toRenderBox(this)->width() - left - right, toRenderBox(this)->height() - top - bottom);
             left += marginLeft();
-            right += marginRight();
             top += marginTop();
-            bottom += marginBottom();
-        }
-        cx = tx;
-        cy = ty;
-        pw = w - left - right;
-        ph = h - top - bottom;
+        } else
+            positioningAreaSize = IntSize(w - left - right, h - top - bottom);
     } else {
-        // Fixed background attachment.
-        IntRect vr = viewRect();
-        cx = vr.x();
-        cy = vr.y();
-        pw = vr.width();
-        ph = vr.height();
+        destRect = viewRect();
+        positioningAreaSize = destRect.size();
     }
 
-    int sx = 0;
-    int sy = 0;
-    int cw;
-    int ch;
+    tileSize = calculateFillTileSize(fillLayer, positioningAreaSize);
 
-    IntSize scaledImageSize;
-    if (isRoot() && !fixedAttachment)
-        scaledImageSize = calculateBackgroundSize(bgLayer, rw, rh);
-    else
-        scaledImageSize = calculateBackgroundSize(bgLayer, pw, ph);
-        
-    int scaledImageWidth = scaledImageSize.width();
-    int scaledImageHeight = scaledImageSize.height();
+    EFillRepeat backgroundRepeatX = fillLayer->repeatX();
+    EFillRepeat backgroundRepeatY = fillLayer->repeatY();
 
-    EFillRepeat backgroundRepeat = bgLayer->repeat();
-    
-    int xPosition;
-    if (isRoot() && !fixedAttachment)
-        xPosition = bgLayer->xPosition().calcMinValue(rw - scaledImageWidth, true);
-    else
-        xPosition = bgLayer->xPosition().calcMinValue(pw - scaledImageWidth, true);
-    if (backgroundRepeat == RepeatFill || backgroundRepeat == RepeatXFill) {
-        cw = pw + left + right;
-        sx = scaledImageWidth ? scaledImageWidth - (xPosition + left) % scaledImageWidth : 0;
-    } else {
-        cx += max(xPosition + left, 0);
-        sx = -min(xPosition + left, 0);
-        cw = scaledImageWidth + min(xPosition + left, 0);
-    }
-    
-    int yPosition;
-    if (isRoot() && !fixedAttachment)
-        yPosition = bgLayer->yPosition().calcMinValue(rh - scaledImageHeight, true);
-    else 
-        yPosition = bgLayer->yPosition().calcMinValue(ph - scaledImageHeight, true);
-    if (backgroundRepeat == RepeatFill || backgroundRepeat == RepeatYFill) {
-        ch = ph + top + bottom;
-        sy = scaledImageHeight ? scaledImageHeight - (yPosition + top) % scaledImageHeight : 0;
-    } else {
-        cy += max(yPosition + top, 0);
-        sy = -min(yPosition + top, 0);
-        ch = scaledImageHeight + min(yPosition + top, 0);
+    int xPosition = fillLayer->xPosition().calcMinValue(positioningAreaSize.width() - tileSize.width(), true);
+    if (backgroundRepeatX == RepeatFill)
+        phase.setX(tileSize.width() ? tileSize.width() - (xPosition + left) % tileSize.width() : 0);
+    else {
+        destRect.move(max(xPosition + left, 0), 0);
+        phase.setX(-min(xPosition + left, 0));
+        destRect.setWidth(tileSize.width() + min(xPosition + left, 0));
     }
 
-    if (fixedAttachment) {
-        sx += max(tx - cx, 0);
-        sy += max(ty - cy, 0);
+    int yPosition = fillLayer->yPosition().calcMinValue(positioningAreaSize.height() - tileSize.height(), true);
+    if (backgroundRepeatY == RepeatFill)
+        phase.setY(tileSize.height() ? tileSize.height() - (yPosition + top) % tileSize.height() : 0);
+    else {
+        destRect.move(0, max(yPosition + top, 0));
+        phase.setY(-min(yPosition + top, 0));
+        destRect.setHeight(tileSize.height() + min(yPosition + top, 0));
     }
 
-    destRect = IntRect(cx, cy, cw, ch);
+    if (fixedAttachment)
+        phase.move(max(tx - destRect.x(), 0), max(ty - destRect.y(), 0));
+
     destRect.intersect(IntRect(tx, ty, w, h));
-    phase = IntPoint(sx, sy);
-    tileSize = IntSize(scaledImageWidth, scaledImageHeight);
 }
 
 int RenderBoxModelObject::verticalPosition(bool firstLine) const
diff --git a/WebCore/rendering/RenderBoxModelObject.h b/WebCore/rendering/RenderBoxModelObject.h
index baa5ecb..c9a4a0a 100644
--- a/WebCore/rendering/RenderBoxModelObject.h
+++ b/WebCore/rendering/RenderBoxModelObject.h
@@ -100,10 +100,12 @@ public:
 
 protected:
     void calculateBackgroundImageGeometry(const FillLayer*, int tx, int ty, int w, int h, IntRect& destRect, IntPoint& phase, IntSize& tileSize);
-    IntSize calculateBackgroundSize(const FillLayer*, int scaledWidth, int scaledHeight) const;
 
 private:
     virtual bool isBoxModelObject() const { return true; }
+
+    IntSize calculateFillTileSize(const FillLayer*, IntSize scaledSize) const;
+
     friend class RenderView;
 
     RenderLayer* m_layer;
diff --git a/WebCore/rendering/RenderButton.cpp b/WebCore/rendering/RenderButton.cpp
index 6d36a0f..f3ae558 100644
--- a/WebCore/rendering/RenderButton.cpp
+++ b/WebCore/rendering/RenderButton.cpp
@@ -52,7 +52,8 @@ void RenderButton::addChild(RenderObject* newChild, RenderObject* beforeChild)
     if (!m_inner) {
         // Create an anonymous block.
         ASSERT(!firstChild());
-        m_inner = createAnonymousBlock();
+        bool isFlexibleBox = style()->display() == BOX || style()->display() == INLINE_BOX;
+        m_inner = createAnonymousBlock(isFlexibleBox);
         setupInnerStyle(m_inner->style());
         RenderFlexibleBox::addChild(m_inner);
     }
@@ -108,6 +109,7 @@ void RenderButton::setupInnerStyle(RenderStyle* innerStyle)
     // RenderBlock::createAnonymousBlock creates a new RenderStyle, so this is
     // safe to modify.
     innerStyle->setBoxFlex(1.0f);
+    innerStyle->setBoxOrient(style()->boxOrient());
 
     innerStyle->setPaddingTop(Length(theme()->buttonInternalPaddingTop(), Fixed));
     innerStyle->setPaddingRight(Length(theme()->buttonInternalPaddingRight(), Fixed));
diff --git a/WebCore/rendering/RenderCounter.cpp b/WebCore/rendering/RenderCounter.cpp
index 67e5cba..17c6dad 100644
--- a/WebCore/rendering/RenderCounter.cpp
+++ b/WebCore/rendering/RenderCounter.cpp
@@ -143,13 +143,19 @@ static bool findPlaceForCounter(RenderObject* object, const AtomicString& counte
     RenderObject* resetCandidate = isReset ? object->parent() : previousSiblingOrParent(object);
     RenderObject* prevCounterCandidate = object;
     CounterNode* candidateCounter = 0;
+    // When a reset counter is chosen as candidateCounter, we'll
+    // decide the new node should be a child of the reset node or a
+    // sibling or the reset node. This flag controls it.
+    bool createChildForReset = true;
     while ((prevCounterCandidate = prevCounterCandidate->previousInPreOrder())) {
         CounterNode* c = counter(prevCounterCandidate, counterName, false);
         if (prevCounterCandidate == resetCandidate) {
-            if (!candidateCounter)
+            if (!candidateCounter) {
                 candidateCounter = c;
+                createChildForReset = true;
+            }
             if (candidateCounter) {
-                if (candidateCounter->isReset()) {
+                if (createChildForReset && candidateCounter->isReset()) {
                     parent = candidateCounter;
                     previousSibling = 0;
                 } else {
@@ -160,10 +166,19 @@ static bool findPlaceForCounter(RenderObject* object, const AtomicString& counte
             }
             resetCandidate = previousSiblingOrParent(resetCandidate);
         } else if (c) {
-            if (c->isReset())
-                candidateCounter = 0;
-            else if (!candidateCounter)
+            if (c->isReset()) {
+                if (c->parent()) {
+                    // The new node may be the next sibling of this reset node.
+                    createChildForReset = false;
+                    candidateCounter = c;
+                } else {
+                    createChildForReset = true;
+                    candidateCounter = 0;
+                }
+            } else if (!candidateCounter) {
+                createChildForReset = true;
                 candidateCounter = c;
+            }
         }
     }
 
diff --git a/WebCore/rendering/RenderFieldset.cpp b/WebCore/rendering/RenderFieldset.cpp
index 437991a..8618d11 100644
--- a/WebCore/rendering/RenderFieldset.cpp
+++ b/WebCore/rendering/RenderFieldset.cpp
@@ -108,10 +108,11 @@ RenderBox* RenderFieldset::findLegend() const
 {
     for (RenderObject* legend = firstChild(); legend; legend = legend->nextSibling()) {
         if (!legend->isFloatingOrPositioned() && legend->node() &&
-            legend->node()->hasTagName(legendTag)
+            (legend->node()->hasTagName(legendTag)
 #if ENABLE(WML)
             || legend->node()->hasTagName(WMLNames::insertedLegendTag)
 #endif
+            )
            )
             return toRenderBox(legend);
     }
diff --git a/WebCore/rendering/RenderFlexibleBox.cpp b/WebCore/rendering/RenderFlexibleBox.cpp
index 84c94e4..531477e 100644
--- a/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/WebCore/rendering/RenderFlexibleBox.cpp
@@ -225,7 +225,8 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
 
     calcWidth();
     calcHeight();
-    m_overflowWidth = width();
+    
+    m_overflow.clear();
 
     if (previousWidth != width() || previousHeight != height() ||
         (parent()->isFlexibleBox() && parent()->style()->boxOrient() == HORIZONTAL &&
@@ -241,7 +242,10 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
 #endif
     setHeight(0);
 
+<<<<<<< HEAD:WebCore/rendering/RenderFlexibleBox.cpp
     m_overflowHeight = 0;
+=======
+>>>>>>> webkit.org at 49305:WebCore/rendering/RenderFlexibleBox.cpp
     m_flexingChildren = m_stretchingChildren = false;
 
     initMaxMarginValues();
@@ -259,15 +263,8 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     else
         layoutVerticalBox(relayoutChildren);
 
-    int oldHeight = height();
     calcHeight();
-    if (oldHeight != height()) {
-        // If the block got expanded in size, then increase our overflowheight to match.
-        if (m_overflowHeight > height())
-            m_overflowHeight -= (borderBottom() + paddingBottom() + horizontalScrollbarHeight());
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
-    }
+
     if (previousHeight != height())
         relayoutChildren = true;
 
@@ -290,31 +287,14 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
         setMaxTopMargins(pos, neg);
         setMaxBottomMargins(0, 0);
     }
+    
+    // Add in the overflow from children.
+    FlexBoxIterator iterator(this);
+    for (RenderBox* child = iterator.first(); child; child = iterator.next())
+        addOverflowFromChild(child);
 
-    // Always ensure our overflow width is at least as large as our width.
-    if (m_overflowWidth < width())
-        m_overflowWidth = width();
-
-    if (!hasOverflowClip()) {
-        int shadowLeft;
-        int shadowRight;
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
-
-        m_overflowLeft = min(m_overflowLeft, shadowLeft);
-        m_overflowWidth = max(m_overflowWidth, width() + shadowRight);
-        m_overflowTop = min(m_overflowTop, shadowTop);
-        m_overflowHeight = max(m_overflowHeight, height() + shadowBottom);
-
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            m_overflowTop = min(m_overflowTop, reflection.y());
-            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
-            m_overflowLeft = min(m_overflowLeft, reflection.x());
-            m_overflowHeight = max(m_overflowWidth, reflection.right());
-        }
-    }
+    // Add visual overflow from box-shadow and reflections.
+    addShadowOverflow();
 
     statePusher.pop();
 
@@ -363,7 +343,7 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     int oldHeight = 0;
 
     int remainingSpace = 0;
-    m_overflowHeight = height();
+
 
     FlexBoxIterator iterator(this);
     unsigned int highestFlexGroup = 0;
@@ -380,7 +360,7 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     do {
         // Reset our height.
         setHeight(yPos);
-        m_overflowHeight = height();
+
         xPos = borderLeft() + paddingLeft();
                 
         // Our first pass is done without flexing.  We simply lay the children
@@ -431,10 +411,6 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             setHeight(height() + lineHeight(true, true));
         
         setHeight(height() + toAdd);
-
-        // Always make sure our overflowheight is at least our height.
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
         
         oldHeight = height();
         calcHeight();
@@ -493,12 +469,6 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             }
 
             placeChild(child, xPos, childY);
-
-            if (child->isRenderBlock())
-                toRenderBlock(child)->addVisualOverflow(toRenderBlock(child)->floatRect());
-
-            m_overflowHeight = max(m_overflowHeight, childY + child->overflowHeight(false));
-            m_overflowTop = min(m_overflowTop, child->y() + child->overflowTop(false));
             
             xPos += child->width() + child->marginRight();
     
@@ -662,22 +632,6 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
         }
     }
     
-    child = iterator.first();
-    while (child && child->isPositioned()) {
-        child = iterator.next();
-    }
-    
-    if (child) {
-        m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
-
-        RenderBox* lastChild = child;
-        while ((child = iterator.next())) {
-            if (!child->isPositioned())
-                lastChild = child;
-        }
-        m_overflowWidth = max(lastChild->x() + lastChild->overflowWidth(false), m_overflowWidth);
-    }
-    
     // So that the calcHeight in layoutBlock() knows to relayout positioned objects because of
     // a height change, we revert our height back to the intrinsic height before returning.
     if (heightSpecified)
@@ -820,7 +774,6 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
     do {
         setHeight(borderTop() + paddingTop());
         int minHeight = height() + toAdd;
-        m_overflowHeight = height();
 
         child = iterator.first();
         while (child) {
@@ -828,8 +781,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             if (!haveLineClamp && (relayoutChildren || (child->isReplaced() && (child->style()->width().isPercent() || child->style()->height().isPercent()))))
                 child->setChildNeedsLayout(true, false);
     
-            if (child->isPositioned())
-            {
+            if (child->isPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 if (child->style()->hasStaticX()) {
                     if (style()->direction() == LTR)
@@ -876,14 +828,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             // Place the child.
             placeChild(child, childX, height());
             setHeight(height() + child->height() + child->marginBottom());
-    
-            if (child->isRenderBlock())
-                toRenderBlock(child)->addVisualOverflow(toRenderBlock(child)->floatRect());
 
-            // See if this child has made our overflow need to grow.
-            m_overflowWidth = max(child->x() + child->overflowWidth(false), m_overflowWidth);
-            m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
-            
             child = iterator.next();
         }
 
@@ -899,10 +844,6 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
         if (height() < minHeight)
             setHeight(minHeight);
 
-        // Always make sure our overflowheight is at least our height.
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
-
         // Now we have to calc our height, so we know how much space we have remaining.
         oldHeight = height();
         calcHeight();
@@ -1060,22 +1001,6 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             }
         }
     }
-    
-    child = iterator.first();
-    while (child && child->isPositioned()) {
-        child = iterator.next();
-    }
-    
-    if (child) {
-        m_overflowTop = min(child->y() + child->overflowTop(false), m_overflowTop);
-
-        RenderBox* lastChild = child;
-        while ((child = iterator.next())) {
-            if (!child->isPositioned())
-                lastChild = child;
-        }
-        m_overflowHeight = max(lastChild->y() + lastChild->overflowHeight(false), m_overflowHeight);
-    }
 
     // So that the calcHeight in layoutBlock() knows to relayout positioned objects because of
     // a height change, we revert our height back to the intrinsic height before returning.
@@ -1161,6 +1086,8 @@ const char *RenderFlexibleBox::renderName() const
         return "RenderFlexibleBox (floating)";
     if (isPositioned())
         return "RenderFlexibleBox (positioned)";
+    if (isAnonymous())
+        return "RenderFlexibleBox (generated)";
     if (isRelPositioned())
         return "RenderFlexibleBox (relative positioned)";
     return "RenderFlexibleBox";
diff --git a/WebCore/rendering/RenderForeignObject.h b/WebCore/rendering/RenderForeignObject.h
index 8fdb816..e014f22 100644
--- a/WebCore/rendering/RenderForeignObject.h
+++ b/WebCore/rendering/RenderForeignObject.h
@@ -49,6 +49,7 @@ public:
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual bool isSVGForeignObject() const { return true; }
 
  private:
     TransformationMatrix translationForAttributes() const;
diff --git a/WebCore/rendering/RenderHTMLCanvas.cpp b/WebCore/rendering/RenderHTMLCanvas.cpp
index 1fc07f0..8c17a0e 100644
--- a/WebCore/rendering/RenderHTMLCanvas.cpp
+++ b/WebCore/rendering/RenderHTMLCanvas.cpp
@@ -43,6 +43,19 @@ RenderHTMLCanvas::RenderHTMLCanvas(HTMLCanvasElement* element)
     view()->frameView()->setIsVisuallyNonEmpty();
 }
 
+bool RenderHTMLCanvas::requiresLayer() const
+{
+    if (RenderReplaced::requiresLayer())
+        return true;
+    
+#if ENABLE(3D_CANVAS)
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(node());
+    return canvas && canvas->is3D();
+#else
+    return false;
+#endif
+}
+
 void RenderHTMLCanvas::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
 {
     IntRect rect = contentBoxRect();
@@ -55,10 +68,13 @@ void RenderHTMLCanvas::canvasSizeChanged()
     IntSize canvasSize = static_cast<HTMLCanvasElement*>(node())->size();
     IntSize zoomedSize(canvasSize.width() * style()->effectiveZoom(), canvasSize.height() * style()->effectiveZoom());
 
-    if (canvasSize == intrinsicSize())
+    if (zoomedSize == intrinsicSize())
         return;
 
-    setIntrinsicSize(canvasSize);
+    setIntrinsicSize(zoomedSize);
+
+    if (!parent())
+        return;
 
     if (!prefWidthsDirty())
         setPrefWidthsDirty(true);
diff --git a/WebCore/rendering/RenderHTMLCanvas.h b/WebCore/rendering/RenderHTMLCanvas.h
index e82cf9a..473dad5 100644
--- a/WebCore/rendering/RenderHTMLCanvas.h
+++ b/WebCore/rendering/RenderHTMLCanvas.h
@@ -36,6 +36,9 @@ class RenderHTMLCanvas : public RenderReplaced {
 public:
     RenderHTMLCanvas(HTMLCanvasElement*);
 
+    virtual bool isCanvas() const { return true; }
+    virtual bool requiresLayer() const;
+
     void canvasSizeChanged();
     
 private:
diff --git a/WebCore/rendering/RenderImage.cpp b/WebCore/rendering/RenderImage.cpp
index 91200bc..ec2a4d3 100644
--- a/WebCore/rendering/RenderImage.cpp
+++ b/WebCore/rendering/RenderImage.cpp
@@ -446,7 +446,7 @@ int RenderImage::minimumReplacedHeight() const
 HTMLMapElement* RenderImage::imageMap()
 {
     HTMLImageElement* i = node() && node()->hasTagName(imgTag) ? static_cast<HTMLImageElement*>(node()) : 0;
-    return i ? i->document()->getImageMap(i->useMap()) : 0;
+    return i ? i->document()->getImageMap(i->getAttribute(usemapAttr)) : 0;
 }
 
 bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
diff --git a/WebCore/rendering/RenderInline.cpp b/WebCore/rendering/RenderInline.cpp
index 53962d2..05d29d0 100644
--- a/WebCore/rendering/RenderInline.cpp
+++ b/WebCore/rendering/RenderInline.cpp
@@ -131,18 +131,6 @@ void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     }
 }
 
-static inline bool isAfterContent(RenderObject* child)
-{
-    if (!child)
-        return false;
-    if (child->style()->styleType() != AFTER)
-        return false;
-    // Text nodes don't have their own styles, so ignore the style on a text node.
-    if (child->isText() && !child->isBR())
-        return false;
-    return true;
-}
-
 void RenderInline::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     if (continuation())
@@ -556,6 +544,23 @@ IntRect RenderInline::linesBoundingBox() const
     return result;
 }
 
+IntRect RenderInline::linesVisibleOverflowBoundingBox() const
+{
+    if (!firstLineBox() || !lastLineBox())
+        return IntRect();
+
+    // Return the width of the minimal left side and the maximal right side.
+    int leftSide = numeric_limits<int>::max();
+    int rightSide = numeric_limits<int>::min();
+    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextFlowBox()) {
+        leftSide = min(leftSide, curr->leftVisibleOverflow());
+        rightSide = max(rightSide, curr->rightVisibleOverflow());
+    }
+
+    return IntRect(leftSide, firstLineBox()->topVisibleOverflow(), rightSide - leftSide,
+        lastLineBox()->bottomVisibleOverflow() - firstLineBox()->topVisibleOverflow());
+}
+
 IntRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     // Only run-ins are allowed in here during layout.
@@ -565,7 +570,7 @@ IntRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repain
         return IntRect();
 
     // Find our leftmost position.
-    IntRect boundingBox(linesBoundingBox());
+    IntRect boundingBox(linesVisibleOverflowBoundingBox());
     int left = boundingBox.x();
     int top = boundingBox.y();
 
@@ -647,7 +652,8 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
     if (repaintContainer == this)
         return;
 
-    RenderObject* o = container();
+    bool containerSkipped;
+    RenderObject* o = container(repaintContainer, &containerSkipped);
     if (!o)
         return;
 
@@ -688,6 +694,13 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
             return;
     } else
         rect.setLocation(topLeft);
+
+    if (containerSkipped) {
+        // If the repaintContainer is below o, then we need to map the rect into repaintContainer's coordinates.
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
+        rect.move(-containerOffset);
+        return;
+    }
     
     o->computeRectForRepaint(repaintContainer, rect, fixed);
 }
@@ -830,8 +843,12 @@ void RenderInline::imageChanged(WrappedImagePtr, const IntRect*)
 
 void RenderInline::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
 {
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-        graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height()));
+    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
+        RootInlineBox* root = curr->root();
+        int top = max(root->lineTop(), curr->y());
+        int bottom = min(root->lineBottom(), curr->y() + curr->height());
+        graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + top, curr->width(), bottom - top));
+    }
 
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
         if (!curr->isText() && !curr->isListMarker()) {
@@ -883,9 +900,12 @@ void RenderInline::paintOutline(GraphicsContext* graphicsContext, int tx, int ty
     Vector<IntRect> rects;
 
     rects.append(IntRect());
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-        rects.append(IntRect(curr->x(), curr->y(), curr->width(), curr->height()));
-
+    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
+        RootInlineBox* root = curr->root();
+        int top = max(root->lineTop(), curr->y());
+        int bottom = min(root->lineBottom(), curr->y() + curr->height());
+        rects.append(IntRect(curr->x(), top, curr->width(), bottom - top));
+    }
     rects.append(IntRect());
 
     for (unsigned i = 1; i < rects.size() - 1; i++)
diff --git a/WebCore/rendering/RenderInline.h b/WebCore/rendering/RenderInline.h
index 14d76ca..8e0064e 100644
--- a/WebCore/rendering/RenderInline.h
+++ b/WebCore/rendering/RenderInline.h
@@ -45,6 +45,7 @@ public:
     virtual void absoluteQuads(Vector<FloatQuad>&);
 
     IntRect linesBoundingBox() const;
+    IntRect linesVisibleOverflowBoundingBox() const;
 
     InlineFlowBox* createAndAppendInlineFlowBox();
 
diff --git a/WebCore/rendering/RenderLayer.cpp b/WebCore/rendering/RenderLayer.cpp
index ab78f40..7a8b428 100644
--- a/WebCore/rendering/RenderLayer.cpp
+++ b/WebCore/rendering/RenderLayer.cpp
@@ -207,12 +207,8 @@ RenderLayer::~RenderLayer()
     // Make sure we have no lingering clip rects.
     ASSERT(!m_clipRects);
     
-    if (m_reflection) {
-        if (!m_reflection->documentBeingDestroyed())
-            m_reflection->removeLayers(this);
-        m_reflection->setParent(0);
-        m_reflection->destroy();
-    }
+    if (m_reflection)
+        removeReflection();
     
     if (m_scrollCorner)
         m_scrollCorner->destroy();
@@ -584,10 +580,10 @@ void RenderLayer::updateLayerPosition()
         setHeight(box->height());
 
         if (!box->hasOverflowClip()) {
-            if (box->overflowWidth() > box->width())
-                setWidth(box->overflowWidth());
-            if (box->overflowHeight() > box->height())
-                setHeight(box->overflowHeight());
+            if (box->rightLayoutOverflow() > box->width())
+                setWidth(box->rightLayoutOverflow());
+            if (box->bottomLayoutOverflow() > box->height())
+                setHeight(box->bottomLayoutOverflow());
         }
     }
 }
@@ -642,37 +638,44 @@ RenderLayer* RenderLayer::stackingContext() const
     return layer;
 }
 
+static inline bool isPositionedContainer(RenderLayer* layer)
+{
+    RenderObject* o = layer->renderer();
+    return o->isRenderView() || o->isPositioned() || o->isRelPositioned() || layer->hasTransform();
+}
+
 RenderLayer* RenderLayer::enclosingPositionedAncestor() const
 {
     RenderLayer* curr = parent();
-    for ( ; curr && !curr->renderer()->isRenderView() && !curr->renderer()->isPositioned() && !curr->renderer()->isRelPositioned() && !curr->hasTransform();
-         curr = curr->parent()) { }
+    while (curr && !isPositionedContainer(curr))
+        curr = curr->parent();
+
     return curr;
 }
 
 RenderLayer* RenderLayer::enclosingTransformedAncestor() const
 {
     RenderLayer* curr = parent();
-    for ( ; curr && !curr->renderer()->isRenderView() && !curr->transform(); curr = curr->parent())
-        { }
+    while (curr && !curr->renderer()->isRenderView() && !curr->transform())
+        curr = curr->parent();
+
     return curr;
 }
 
+static inline const RenderLayer* compositingContainer(const RenderLayer* layer)
+{
+    return layer->isNormalFlowOnly() ? layer->parent() : layer->stackingContext();
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 RenderLayer* RenderLayer::enclosingCompositingLayer(bool includeSelf) const
 {
     if (includeSelf && isComposited())
         return const_cast<RenderLayer*>(this);
 
-    // Compositing layers are parented according to stacking order and overflow list,
-    // so we have to check whether the parent is a stacking context, or whether 
-    // the child is overflow-only.
-    bool inNormalFlowList = isNormalFlowOnly();
-    for (RenderLayer* curr = parent(); curr; curr = curr->parent()) {
-        if (curr->isComposited() && (inNormalFlowList || curr->isStackingContext()))
-            return curr;
-        
-        inNormalFlowList = curr->isNormalFlowOnly();
+    for (const RenderLayer* curr = compositingContainer(this); curr; curr = compositingContainer(curr)) {
+        if (curr->isComposited())
+            return const_cast<RenderLayer*>(curr);
     }
          
     return 0;
@@ -760,6 +763,19 @@ static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransfor
         }
     }
 
+    // If we have a reflection, then we need to account for that when we push the clip.  Reflect our entire
+    // current transparencyClipBox to catch all child layers.
+    // FIXME: Accelerated compositing will eventually want to do something smart here to avoid incorporating this
+    // size into the parent layer.
+    if (l->renderer()->hasReflection()) {
+        int deltaX = 0;
+        int deltaY = 0;
+        l->convertToLayerCoords(rootLayer, deltaX, deltaY);
+        clipRect.move(-deltaX, -deltaY);
+        clipRect.unite(l->renderBox()->reflectedRect(clipRect));
+        clipRect.move(deltaX, deltaY);
+    }
+
     // Now map the clipRect via the enclosing transform
     return enclosingTransform.mapRect(clipRect);
 }
@@ -946,12 +962,44 @@ RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, int& xPos, i
     }
  
     RenderLayer* parentLayer;
-    if (renderer()->style()->position() == AbsolutePosition)
-        parentLayer = enclosingPositionedAncestor();
-    else
+    if (renderer()->style()->position() == AbsolutePosition) {
+        // Do what enclosingPositionedAncestor() does, but check for ancestorLayer along the way
+        parentLayer = parent();
+        bool foundAncestorFirst = false;
+        while (parentLayer) {
+            if (isPositionedContainer(parentLayer))
+                break;
+
+            if (parentLayer == ancestorLayer) {
+                foundAncestorFirst = true;
+                break;
+            }
+
+            parentLayer = parentLayer->parent();
+        }
+
+        if (foundAncestorFirst) {
+            // Found ancestorLayer before the abs. positioned container, so compute offset of both relative
+            // to enclosingPositionedAncestor and subtract.
+            RenderLayer* positionedAncestor = parentLayer->enclosingPositionedAncestor();
+
+            int thisX = 0;
+            int thisY = 0;
+            convertToLayerCoords(positionedAncestor, thisX, thisY);
+            
+            int ancestorX = 0;
+            int ancestorY = 0;
+            ancestorLayer->convertToLayerCoords(positionedAncestor, ancestorX, ancestorY);
+        
+            xPos += (thisX - ancestorX);
+            yPos += (thisY - ancestorY);
+            return;
+        }
+    } else
         parentLayer = parent();
     
-    if (!parentLayer) return;
+    if (!parentLayer)
+        return;
     
     parentLayer->convertToLayerCoords(ancestorLayer, xPos, yPos);
 
@@ -959,12 +1007,22 @@ RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, int& xPos, i
     yPos += y();
 }
 
+static inline int adjustedScrollDelta(int beginningDelta) {
+    // This implemention matches Firefox's.
+    // http://mxr.mozilla.org/firefox/source/toolkit/content/widgets/browser.xml#856.
+    const int speedReducer = 12;
+
+    int adjustedDelta = beginningDelta / speedReducer;
+    if (adjustedDelta > 1)
+        adjustedDelta = static_cast<int>(adjustedDelta * sqrt(static_cast<double>(adjustedDelta))) - 1;
+    else if (adjustedDelta < -1)
+        adjustedDelta = static_cast<int>(adjustedDelta * sqrt(static_cast<double>(-adjustedDelta))) + 1;
+
+    return adjustedDelta;
+}
+
 void RenderLayer::panScrollFromPoint(const IntPoint& sourcePoint) 
 {
-    // We want to reduce the speed if we're close from the original point to improve the handleability of the scroll
-    const int shortDistanceLimit = 100;  // We delimit a 200 pixels long square enclosing the original point
-    const int speedReducer = 2;          // Within this square we divide the scrolling speed by 2
-    
     Frame* frame = renderer()->document()->frame();
     if (!frame)
         return;
@@ -981,22 +1039,19 @@ void RenderLayer::panScrollFromPoint(const IntPoint& sourcePoint)
     int xDelta = currentMousePosition.x() - sourcePoint.x();
     int yDelta = currentMousePosition.y() - sourcePoint.y();
 
-    if (abs(xDelta) < ScrollView::noPanScrollRadius) // at the center we let the space for the icon
+    if (abs(xDelta) <= ScrollView::noPanScrollRadius) // at the center we let the space for the icon
         xDelta = 0;
-    if (abs(yDelta) < ScrollView::noPanScrollRadius)
+    if (abs(yDelta) <= ScrollView::noPanScrollRadius)
         yDelta = 0;
 
-    // Let's attenuate the speed for the short distances
-    if (abs(xDelta) < shortDistanceLimit)
-        xDelta /= speedReducer;
-    if (abs(yDelta) < shortDistanceLimit)
-        yDelta /= speedReducer;
-
-    scrollByRecursively(xDelta, yDelta);
+    scrollByRecursively(adjustedScrollDelta(xDelta), adjustedScrollDelta(yDelta));
 }
 
 void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
 {
+    if (!xDelta && !yDelta)
+        return;
+
     bool restrictedByLineClamp = false;
     if (renderer()->parent())
         restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
@@ -1006,17 +1061,30 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
         int newOffsetY = scrollYOffset() + yDelta;
         scrollToOffset(newOffsetX, newOffsetY);
 
-        // If this layer can't do the scroll we ask its parent
+        // If this layer can't do the scroll we ask the next layer up that can scroll to try
         int leftToScrollX = newOffsetX - scrollXOffset();
         int leftToScrollY = newOffsetY - scrollYOffset();
         if ((leftToScrollX || leftToScrollY) && renderer()->parent()) {
-            renderer()->parent()->enclosingLayer()->scrollByRecursively(leftToScrollX, leftToScrollY);
+            RenderObject* nextRenderer = renderer()->parent();
+            while (nextRenderer) {
+                if (nextRenderer->isBox() && toRenderBox(nextRenderer)->canBeScrolledAndHasScrollableArea()) {
+                    nextRenderer->enclosingLayer()->scrollByRecursively(leftToScrollX, leftToScrollY);
+                    break;
+                }
+                nextRenderer = nextRenderer->parent();
+            }
+
             Frame* frame = renderer()->document()->frame();
             if (frame)
                 frame->eventHandler()->updateAutoscrollRenderer();
         }
-    } else if (renderer()->view()->frameView())
+    } else if (renderer()->view()->frameView()) {
+        // If we are here, we were called on a renderer that can be programatically scrolled, but doesn't
+        // have an overflow clip. Which means that it is a document node that can be scrolled.
         renderer()->view()->frameView()->scrollBy(IntSize(xDelta, yDelta));
+        // FIXME: If we didn't scroll the whole way, do we want to try looking at the frames ownerElement? 
+        // https://bugs.webkit.org/show_bug.cgi?id=28237
+    }
 }
 
 
@@ -1275,7 +1343,9 @@ void RenderLayer::autoscroll()
     if (!frameView)
         return;
 
+#if ENABLE(DRAG_SUPPORT)
     frame->eventHandler()->updateSelectionForMouseDrag();
+#endif
 
     IntPoint currentDocumentPosition = frameView->windowToContents(frame->eventHandler()->currentMousePosition());
     scrollRectToVisible(IntRect(currentDocumentPosition, IntSize(1, 1)), false, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignToEdgeIfNeeded);
@@ -2056,9 +2126,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         // Make sure the parent's clip rects have been calculated.
         IntRect clipRect = paintDirtyRect;
         if (parent()) {
-            ClipRects parentRects;
-            parentClipRects(rootLayer, parentRects, paintFlags & PaintLayerTemporaryClipRects);
-            clipRect = parentRects.overflowClipRect();
+            clipRect = backgroundClipRect(rootLayer, paintFlags & PaintLayerTemporaryClipRects);
             clipRect.intersect(paintDirtyRect);
         }
         
@@ -2368,9 +2436,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
     if (transform() && !appliedTransform) {
         // Make sure the parent's clip rects have been calculated.
         if (parent()) {
-            ClipRects parentRects;
-            parentClipRects(rootLayer, parentRects, useTemporaryClipRects);
-            IntRect clipRect = parentRects.overflowClipRect();
+            IntRect clipRect = backgroundClipRect(rootLayer, useTemporaryClipRects);
             // Go ahead and test the enclosing clip now.
             if (!clipRect.contains(hitTestPoint))
                 return 0;
@@ -2668,10 +2734,10 @@ void RenderLayer::parentClipRects(const RenderLayer* rootLayer, ClipRects& clipR
     clipRects = *parent()->clipRects();
 }
 
-void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& paintDirtyRect, IntRect& layerBounds,
-                                 IntRect& backgroundRect, IntRect& foregroundRect, IntRect& outlineRect, bool temporaryClipRects) const
+IntRect RenderLayer::backgroundClipRect(const RenderLayer* rootLayer, bool temporaryClipRects) const
 {
-    if (rootLayer != this && parent()) {
+    IntRect backgroundRect;
+    if (parent()) {
         ClipRects parentRects;
         parentClipRects(rootLayer, parentRects, temporaryClipRects);
         backgroundRect = renderer()->style()->position() == FixedPosition ? parentRects.fixedClipRect() :
@@ -2681,7 +2747,15 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& pa
         ASSERT(view);
         if (view && parentRects.fixed() && rootLayer->renderer() == view)
             backgroundRect.move(view->frameView()->scrollX(), view->frameView()->scrollY());
+    }
+    return backgroundRect;
+}
 
+void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& paintDirtyRect, IntRect& layerBounds,
+                                 IntRect& backgroundRect, IntRect& foregroundRect, IntRect& outlineRect, bool temporaryClipRects) const
+{
+    if (rootLayer != this && parent()) {
+        backgroundRect = backgroundClipRect(rootLayer, temporaryClipRects);
         backgroundRect.intersect(paintDirtyRect);
     } else
         backgroundRect = paintDirtyRect;
@@ -2771,7 +2845,7 @@ IntRect RenderLayer::localBoundingBox() const
 {
     // There are three special cases we need to consider.
     // (1) Inline Flows.  For inline flows we will create a bounding box that fully encompasses all of the lines occupied by the
-    // inline.  In other words, if some <span> wraps to three lines, we'll create a bounding box that fully encloses the root
+    // inline.  In other words, if some <span> wraps to three lines, we'll create a bounding box that fully encloses the
     // line boxes of all three lines (including overflow on those lines).
     // (2) Left/Top Overflow.  The width/height of layers already includes right/bottom overflow.  However, in the case of left/top
     // overflow, we have to create a bounding box that will extend to include this overflow.
@@ -2785,8 +2859,8 @@ IntRect RenderLayer::localBoundingBox() const
         InlineFlowBox* firstBox = inlineFlow->firstLineBox();
         if (!firstBox)
             return result;
-        int top = firstBox->root()->topOverflow();
-        int bottom = inlineFlow->lastLineBox()->root()->bottomOverflow();
+        int top = firstBox->topVisibleOverflow();
+        int bottom = inlineFlow->lastLineBox()->bottomVisibleOverflow();
         int left = firstBox->x();
         for (InlineRunBox* curr = firstBox->nextLineBox(); curr; curr = curr->nextLineBox())
             left = min(left, curr->x());
@@ -2797,7 +2871,7 @@ IntRect RenderLayer::localBoundingBox() const
             if (child->isTableCell()) {
                 IntRect bbox = toRenderBox(child)->borderBoxRect();
                 result.unite(bbox);
-                IntRect overflowRect = renderBox()->overflowRect(false);
+                IntRect overflowRect = renderBox()->visibleOverflowRect();
                 if (bbox != overflowRect)
                     result.unite(overflowRect);
             }
@@ -2810,7 +2884,7 @@ IntRect RenderLayer::localBoundingBox() const
         else {
             IntRect bbox = box->borderBoxRect();
             result = bbox;
-            IntRect overflowRect = box->overflowRect(false);
+            IntRect overflowRect = box->visibleOverflowRect();
             if (bbox != overflowRect)
                 result.unite(overflowRect);
         }
@@ -2873,6 +2947,11 @@ void RenderLayer::clearBacking()
 {
     m_backing.clear();
 }
+
+bool RenderLayer::hasCompositedMask() const
+{
+    return m_backing && m_backing->hasMaskLayer();
+}
 #endif
 
 void RenderLayer::setParent(RenderLayer* parent)
@@ -3183,10 +3262,9 @@ void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle*)
         m_marquee = 0;
     }
     
-    if (!hasReflection() && m_reflection) {
-        m_reflection->destroy();
-        m_reflection = 0;
-    } else if (hasReflection()) {
+    if (!hasReflection() && m_reflection)
+        removeReflection();
+    else if (hasReflection()) {
         if (!m_reflection)
             createReflection();
         updateReflectionStyle();
@@ -3260,6 +3338,16 @@ void RenderLayer::createReflection()
     m_reflection->setParent(renderer()); // We create a 1-way connection.
 }
 
+void RenderLayer::removeReflection()
+{
+    if (!m_reflection->documentBeingDestroyed())
+        m_reflection->removeLayers(this);
+
+    m_reflection->setParent(0);
+    m_reflection->destroy();
+    m_reflection = 0;
+}
+
 void RenderLayer::updateReflectionStyle()
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
diff --git a/WebCore/rendering/RenderLayer.h b/WebCore/rendering/RenderLayer.h
index 1772c66..9d2212b 100644
--- a/WebCore/rendering/RenderLayer.h
+++ b/WebCore/rendering/RenderLayer.h
@@ -415,11 +415,13 @@ public:
 
 #if USE(ACCELERATED_COMPOSITING)
     bool isComposited() const { return m_backing != 0; }
+    bool hasCompositedMask() const;
     RenderLayerBacking* backing() const { return m_backing.get(); }
     RenderLayerBacking* ensureBacking();
     void clearBacking();
 #else
     bool isComposited() const { return false; }
+    bool hasCompositedMask() const { return false; }
 #endif
 
     bool paintsWithTransparency() const
@@ -507,11 +509,14 @@ private:
     Node* enclosingElement() const;
 
     void createReflection();
+    void removeReflection();
+
     void updateReflectionStyle();
     bool paintingInsideReflection() const { return m_paintingInsideReflection; }
     void setPaintingInsideReflection(bool b) { m_paintingInsideReflection = b; }
     
     void parentClipRects(const RenderLayer* rootLayer, ClipRects&, bool temporaryClipRects = false) const;
+    IntRect backgroundClipRect(const RenderLayer* rootLayer, bool temporaryClipRects) const;
 
     RenderLayer* enclosingTransformedAncestor() const;
 
diff --git a/WebCore/rendering/RenderLayerBacking.cpp b/WebCore/rendering/RenderLayerBacking.cpp
index e98c458..941817c 100644
--- a/WebCore/rendering/RenderLayerBacking.cpp
+++ b/WebCore/rendering/RenderLayerBacking.cpp
@@ -28,11 +28,13 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "AnimationController.h"
+#include "CanvasRenderingContext3D.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
+#include "HTMLCanvasElement.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "RenderBox.h"
@@ -47,17 +49,16 @@ using namespace std;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static bool hasBorderOutlineOrShadow(const RenderStyle*);
 static bool hasBoxDecorations(const RenderStyle*);
 static bool hasBoxDecorationsWithBackgroundImage(const RenderStyle*);
 
 RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
     : m_owningLayer(layer)
-    , m_ancestorClippingLayer(0)
-    , m_graphicsLayer(0)
-    , m_foregroundLayer(0)
-    , m_clippingLayer(0)
     , m_hasDirectlyCompositedContent(false)
+    , m_artificiallyInflatedBounds(false)
 {
     createGraphicsLayer();
 }
@@ -66,12 +67,13 @@ RenderLayerBacking::~RenderLayerBacking()
 {
     updateClippingLayers(false, false);
     updateForegroundLayer(false);
+    updateMaskLayer(false);
     destroyGraphicsLayer();
 }
 
 void RenderLayerBacking::createGraphicsLayer()
 {
-    m_graphicsLayer = GraphicsLayer::createGraphicsLayer(this);
+    m_graphicsLayer = GraphicsLayer::create(this);
     
 #ifndef NDEBUG
     if (renderer()->node()) {
@@ -79,7 +81,7 @@ void RenderLayerBacking::createGraphicsLayer()
             m_graphicsLayer->setName("Document Node");
         else {
             if (renderer()->node()->isHTMLElement() && renderer()->node()->hasID())
-                m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->id());
+                m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->getAttribute(idAttr));
             else
                 m_graphicsLayer->setName(renderer()->renderName());
         }
@@ -96,14 +98,10 @@ void RenderLayerBacking::destroyGraphicsLayer()
     if (m_graphicsLayer)
         m_graphicsLayer->removeFromParent();
 
-    delete m_graphicsLayer;
     m_graphicsLayer = 0;
-
-    delete m_foregroundLayer;
     m_foregroundLayer = 0;
-
-    delete m_clippingLayer;
     m_clippingLayer = 0;
+    m_maskLayer = 0;
 }
 
 void RenderLayerBacking::updateLayerOpacity()
@@ -126,6 +124,30 @@ void RenderLayerBacking::updateLayerTransform()
     m_graphicsLayer->setTransform(t);
 }
 
+static bool hasNonZeroTransformOrigin(const RenderObject* renderer)
+{
+    RenderStyle* style = renderer->style();
+    return (style->transformOriginX().type() == Fixed && style->transformOriginX().value())
+        || (style->transformOriginY().type() == Fixed && style->transformOriginY().value());
+}
+
+void RenderLayerBacking::updateCompositedBounds()
+{
+    IntRect layerBounds = compositor()->calculateCompositedBounds(m_owningLayer, m_owningLayer);
+
+    // If the element has a transform-origin that has fixed lengths, and the renderer has zero size,
+    // then we need to ensure that the compositing layer has non-zero size so that we can apply
+    // the transform-origin via the GraphicsLayer anchorPoint (which is expressed as a fractional value).
+    if (layerBounds.isEmpty() && hasNonZeroTransformOrigin(renderer())) {
+        layerBounds.setWidth(1);
+        layerBounds.setHeight(1);
+        m_artificiallyInflatedBounds = true;
+    } else
+        m_artificiallyInflatedBounds = false;
+
+    setCompositedBounds(layerBounds);
+}
+
 void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth)
 {
     RenderLayerCompositor* layerCompositor = compositor();
@@ -137,7 +159,7 @@ void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth)
         //
         // The solution is to update compositing children of this layer here,
         // via updateCompositingChildrenGeometry().
-        setCompositedBounds(layerCompositor->calculateCompositedBounds(m_owningLayer, m_owningLayer));
+        updateCompositedBounds();
         layerCompositor->updateCompositingDescendantGeometry(m_owningLayer, m_owningLayer, updateDepth);
         
         if (!m_owningLayer->parent()) {
@@ -158,6 +180,9 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     if (updateClippingLayers(compositor->clippedByAncestor(m_owningLayer), compositor->clipsCompositingDescendants(m_owningLayer)))
         layerConfigChanged = true;
 
+    if (updateMaskLayer(m_owningLayer->renderer()->hasMask()))
+        m_graphicsLayer->setMaskLayer(m_maskLayer.get());
+
     m_hasDirectlyCompositedContent = false;
     if (canUseDirectCompositing()) {
         if (renderer()->isImage()) {
@@ -165,6 +190,16 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
             m_hasDirectlyCompositedContent = true;
             m_graphicsLayer->setDrawsContent(false);
         }
+#if ENABLE(3D_CANVAS)    
+        else if (renderer()->isCanvas()) {
+            HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
+            if (canvas->is3D()) {
+                CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(canvas->renderingContext());
+                if (context->graphicsContext3D()->platformGraphicsContext3D())
+                    m_graphicsLayer->setContentsToGraphicsContext3D(context->graphicsContext3D());
+            }
+        }
+#endif
 
         if (rendererHasBackground())
             m_graphicsLayer->setBackgroundColor(rendererBackgroundColor());
@@ -222,10 +257,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         // Call calculateRects to get the backgroundRect which is what is used to clip the contents of this
         // layer. Note that we call it with temporaryClipRects = true because normally when computing clip rects
         // for a compositing layer, rootLayer is the layer itself.
-        ClipRects parentRects;
-        m_owningLayer->parentClipRects(compAncestor, parentRects, true);
-        IntRect parentClipRect = parentRects.overflowClipRect();
-        
+        IntRect parentClipRect = m_owningLayer->backgroundClipRect(compAncestor, true);
         m_ancestorClippingLayer->setPosition(FloatPoint() + (parentClipRect.location() - graphicsLayerParentLocation));
         m_ancestorClippingLayer->setSize(parentClipRect.size());
 
@@ -251,13 +283,19 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     // If we have a layer that clips children, position it.
+    IntRect clippingBox;
     if (m_clippingLayer) {
-        IntRect clippingBox = toRenderBox(renderer())->overflowClipRect(0, 0);
+        clippingBox = toRenderBox(renderer())->overflowClipRect(0, 0);
         m_clippingLayer->setPosition(FloatPoint() + (clippingBox.location() - localCompositingBounds.location()));
         m_clippingLayer->setSize(clippingBox.size());
         m_clippingLayer->setOffsetFromRenderer(clippingBox.location() - IntPoint());
     }
     
+    if (m_maskLayer) {
+        m_maskLayer->setSize(m_graphicsLayer->size());
+        m_maskLayer->setPosition(FloatPoint());
+    }
+    
     if (m_owningLayer->hasTransform()) {
         const IntRect borderBox = toRenderBox(renderer())->borderBoxRect();
 
@@ -293,15 +331,25 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     if (m_foregroundLayer) {
-        // The contents layer is always coincidental with the graphicsLayer for now.
-        m_foregroundLayer->setPosition(IntPoint(0, 0));
-        m_foregroundLayer->setSize(newSize);
-        m_foregroundLayer->setOffsetFromRenderer(m_graphicsLayer->offsetFromRenderer());
+        FloatPoint foregroundPosition;
+        FloatSize foregroundSize = newSize;
+        IntSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
+        // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
+        // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
+        if (m_clippingLayer) {
+            foregroundPosition = FloatPoint() + (localCompositingBounds.location() - clippingBox.location());
+            foregroundSize = FloatSize(clippingBox.size());
+            foregroundOffset = clippingBox.location() - IntPoint();
+        }
+
+        m_foregroundLayer->setPosition(foregroundPosition);
+        m_foregroundLayer->setSize(foregroundSize);
+        m_foregroundLayer->setOffsetFromRenderer(foregroundOffset);
     }
 
     m_graphicsLayer->setContentsRect(contentsBox());
     if (!m_hasDirectlyCompositedContent)
-        m_graphicsLayer->setDrawsContent(!isSimpleContainerCompositingLayer() && !paintingGoesToWindow());
+        m_graphicsLayer->setDrawsContent(!isSimpleContainerCompositingLayer() && !paintingGoesToWindow() && !m_artificiallyInflatedBounds);
 }
 
 void RenderLayerBacking::updateInternalHierarchy()
@@ -311,12 +359,12 @@ void RenderLayerBacking::updateInternalHierarchy()
     if (m_ancestorClippingLayer) {
         m_ancestorClippingLayer->removeAllChildren();
         m_graphicsLayer->removeFromParent();
-        m_ancestorClippingLayer->addChild(m_graphicsLayer);
+        m_ancestorClippingLayer->addChild(m_graphicsLayer.get());
     }
 
     if (m_clippingLayer) {
         m_clippingLayer->removeFromParent();
-        m_graphicsLayer->addChild(m_clippingLayer);
+        m_graphicsLayer->addChild(m_clippingLayer.get());
     }
 }
 
@@ -327,7 +375,7 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
 
     if (needsAncestorClip) {
         if (!m_ancestorClippingLayer) {
-            m_ancestorClippingLayer = GraphicsLayer::createGraphicsLayer(this);
+            m_ancestorClippingLayer = GraphicsLayer::create(this);
 #ifndef NDEBUG
             m_ancestorClippingLayer->setName("Ancestor clipping Layer");
 #endif
@@ -336,14 +384,13 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
         }
     } else if (m_ancestorClippingLayer) {
         m_ancestorClippingLayer->removeFromParent();
-        delete m_ancestorClippingLayer;
         m_ancestorClippingLayer = 0;
         layersChanged = true;
     }
     
     if (needsDescendantClip) {
         if (!m_clippingLayer) {
-            m_clippingLayer = GraphicsLayer::createGraphicsLayer(0);
+            m_clippingLayer = GraphicsLayer::create(0);
 #ifndef NDEBUG
             m_clippingLayer->setName("Child clipping Layer");
 #endif
@@ -352,7 +399,6 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
         }
     } else if (m_clippingLayer) {
         m_clippingLayer->removeFromParent();
-        delete m_clippingLayer;
         m_clippingLayer = 0;
         layersChanged = true;
     }
@@ -368,25 +414,61 @@ bool RenderLayerBacking::updateForegroundLayer(bool needsForegroundLayer)
     bool layerChanged = false;
     if (needsForegroundLayer) {
         if (!m_foregroundLayer) {
-            m_foregroundLayer = GraphicsLayer::createGraphicsLayer(this);
+            m_foregroundLayer = GraphicsLayer::create(this);
 #ifndef NDEBUG
-            m_foregroundLayer->setName("Contents");
+            m_foregroundLayer->setName("Foreground");
 #endif
             m_foregroundLayer->setDrawsContent(true);
-            m_foregroundLayer->setDrawingPhase(GraphicsLayerPaintForegroundMask);
-            m_graphicsLayer->setDrawingPhase(GraphicsLayerPaintBackgroundMask);
+            m_foregroundLayer->setPaintingPhase(GraphicsLayerPaintForeground);
             layerChanged = true;
         }
     } else if (m_foregroundLayer) {
         m_foregroundLayer->removeFromParent();
-        delete m_foregroundLayer;
         m_foregroundLayer = 0;
-        m_graphicsLayer->setDrawingPhase(GraphicsLayerPaintAllMask);
         layerChanged = true;
     }
+
+    if (layerChanged)
+        m_graphicsLayer->setPaintingPhase(paintingPhaseForPrimaryLayer());
+
+    return layerChanged;
+}
+
+bool RenderLayerBacking::updateMaskLayer(bool needsMaskLayer)
+{
+    bool layerChanged = false;
+    if (needsMaskLayer) {
+        if (!m_maskLayer) {
+            m_maskLayer = GraphicsLayer::create(this);
+#ifndef NDEBUG
+            m_maskLayer->setName("Mask");
+#endif
+            m_maskLayer->setDrawsContent(true);
+            m_maskLayer->setPaintingPhase(GraphicsLayerPaintMask);
+            layerChanged = true;
+        }
+    } else if (m_maskLayer) {
+        m_maskLayer = 0;
+        layerChanged = true;
+    }
+
+    if (layerChanged)
+        m_graphicsLayer->setPaintingPhase(paintingPhaseForPrimaryLayer());
+
     return layerChanged;
 }
 
+GraphicsLayerPaintingPhase RenderLayerBacking::paintingPhaseForPrimaryLayer() const
+{
+    unsigned phase = GraphicsLayerPaintBackground;
+    if (!m_foregroundLayer)
+        phase |= GraphicsLayerPaintForeground;
+    if (!m_maskLayer)
+        phase |= GraphicsLayerPaintMask;
+
+    return static_cast<GraphicsLayerPaintingPhase>(phase);
+}
+
 float RenderLayerBacking::compositingOpacity(float rendererOpacity) const
 {
     float finalOpacity = rendererOpacity;
@@ -500,7 +582,7 @@ bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
         
         // Now look at the body's renderer.
         HTMLElement* body = renderObject->document()->body();
-        RenderObject* bodyObject = (body && body->hasLocalName(HTMLNames::bodyTag)) ? body->renderer() : 0;
+        RenderObject* bodyObject = (body && body->hasLocalName(bodyTag)) ? body->renderer() : 0;
         if (!bodyObject)
             return false;
         
@@ -582,6 +664,14 @@ bool RenderLayerBacking::canUseDirectCompositing() const
 {
     RenderObject* renderObject = renderer();
     
+    // Canvas3D is always direct composited
+#if ENABLE(3D_CANVAS)    
+    if (renderer()->isCanvas()) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
+        return canvas->is3D();
+    }
+#endif
+
     // Reject anything that isn't an image
     if (!renderObject->isImage() && !renderObject->isVideo())
         return false;
@@ -600,8 +690,19 @@ bool RenderLayerBacking::canUseDirectCompositing() const
     
 void RenderLayerBacking::rendererContentChanged()
 {
-    if (canUseDirectCompositing() && renderer()->isImage())
-        updateImageContents();
+    if (canUseDirectCompositing()) {
+        if (renderer()->isImage())
+            updateImageContents();
+        else {
+#if ENABLE(3D_CANVAS)    
+            if (renderer()->isCanvas()) {
+                HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
+                if (canvas->is3D())
+                    m_graphicsLayer->setGraphicsContext3DNeedsDisplay();
+            }
+#endif
+        }
+    }
 }
 
 void RenderLayerBacking::updateImageContents()
@@ -705,13 +806,16 @@ void RenderLayerBacking::setContentsNeedDisplay()
     
     if (m_foregroundLayer && m_foregroundLayer->drawsContent())
         m_foregroundLayer->setNeedsDisplay();
+
+    if (m_maskLayer && m_maskLayer->drawsContent())
+        m_maskLayer->setNeedsDisplay();
 }
 
 // r is in the coordinate space of the layer's render object
 void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
 {
     if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
-        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer, FloatPoint(r.x(), r.y()));
+        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer.get(), FloatPoint(r.x(), r.y()));
         FloatRect dirtyRect(dirtyOrigin, r.size());
         FloatRect bounds(FloatPoint(), m_graphicsLayer->size());
         if (bounds.intersects(dirtyRect))
@@ -722,6 +826,11 @@ void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
         // FIXME: do incremental repaint
         m_foregroundLayer->setNeedsDisplay();
     }
+
+    if (m_maskLayer && m_maskLayer->drawsContent()) {
+        // FIXME: do incremental repaint
+        m_maskLayer->setNeedsDisplay();
+    }
 }
 
 static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
@@ -779,7 +888,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 
     bool shouldPaint = m_owningLayer->hasVisibleContent() && m_owningLayer->isSelfPaintingLayer();
 
-    if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackgroundMask)) {
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackground)) {
         // If this is the root then we need to send in a bigger bounding box
         // because we'll be painting the background as well (see RenderBox::paintRootBoxDecorations()).
         IntRect paintBox = clipRectToApply;
@@ -823,7 +932,10 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         restoreClip(context, paintDirtyRect, damageRect);
     }
                 
-    if (shouldPaint && (paintingPhase & GraphicsLayerPaintForegroundMask)) {
+    bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+    bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintForeground)) {
         // Now walk the sorted list of children with negative z-indices. Only RenderLayers without compositing layers will paint.
         // FIXME: should these be painted as background?
         Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
@@ -832,9 +944,6 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
                 it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
         }
 
-        bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-        bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-
         // Set up the clip used when painting our children.
         setClip(context, paintDirtyRect, clipRectToApply);
         RenderObject::PaintInfo paintInfo(context, clipRectToApply, 
@@ -877,7 +986,9 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
             for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it)
                 it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
         }
-        
+    }
+    
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintMask)) {
         if (renderer()->hasMask() && !selectionOnly && !damageRect.isEmpty()) {
             setClip(context, paintDirtyRect, damageRect);
 
@@ -894,7 +1005,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 }
 
 // Up-call from compositing layer drawing callback.
-void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase drawingPhase, const IntRect& clip)
+void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
     // We have to use the same root as for hit testing, because both methods
     // can compute and cache clipRects.
@@ -912,7 +1023,7 @@ void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& co
     IntRect dirtyRect = enclosingBBox;
     dirtyRect.intersect(clipRect);
 
-    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, drawingPhase, renderer());
+    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, paintingPhase, renderer());
 }
 
 bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes)
@@ -970,7 +1081,8 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
             KeyframeValueList opacityVector(AnimatedPropertyOpacity);
             opacityVector.insert(new FloatAnimationValue(0, compositingOpacity(fromStyle->opacity())));
             opacityVector.insert(new FloatAnimationValue(1, compositingOpacity(toStyle->opacity())));
-            if (m_graphicsLayer->addAnimation(opacityVector, toRenderBox(renderer())->borderBoxRect().size(), opacityAnim, String(), beginTime))
+            // The boxSize param is only used for transform animations (which can only run on RenderBoxes), so we pass an empty size here.
+            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, String(), beginTime))
                 didAnimate = true;
         }
     }
diff --git a/WebCore/rendering/RenderLayerBacking.h b/WebCore/rendering/RenderLayerBacking.h
index b027685..e12aa58 100644
--- a/WebCore/rendering/RenderLayerBacking.h
+++ b/WebCore/rendering/RenderLayerBacking.h
@@ -63,21 +63,23 @@ public:
     // Update contents and clipping structure.
     void updateInternalHierarchy(); // make private
     
-    GraphicsLayer* graphicsLayer() const { return m_graphicsLayer; }
+    GraphicsLayer* graphicsLayer() const { return m_graphicsLayer.get(); }
 
     // Layer to clip children
     bool hasClippingLayer() const { return m_clippingLayer != 0; }
-    GraphicsLayer* clippingLayer() const { return m_clippingLayer; }
+    GraphicsLayer* clippingLayer() const { return m_clippingLayer.get(); }
 
     // Layer to get clipped by ancestor
     bool hasAncestorClippingLayer() const { return m_ancestorClippingLayer != 0; }
-    GraphicsLayer* ancestorClippingLayer() const { return m_ancestorClippingLayer; }
+    GraphicsLayer* ancestorClippingLayer() const { return m_ancestorClippingLayer.get(); }
 
     bool hasContentsLayer() const { return m_foregroundLayer != 0; }
-    GraphicsLayer* foregroundLayer() const { return m_foregroundLayer; }
+    GraphicsLayer* foregroundLayer() const { return m_foregroundLayer.get(); }
     
-    GraphicsLayer* parentForSublayers() const { return m_clippingLayer ? m_clippingLayer : m_graphicsLayer; }
-    GraphicsLayer* childForSuperlayers() const { return m_ancestorClippingLayer ? m_ancestorClippingLayer : m_graphicsLayer; }
+    bool hasMaskLayer() const { return m_maskLayer != 0; }
+
+    GraphicsLayer* parentForSublayers() const { return m_clippingLayer ? m_clippingLayer.get() : m_graphicsLayer.get(); }
+    GraphicsLayer* childForSuperlayers() const { return m_ancestorClippingLayer ? m_ancestorClippingLayer.get() : m_graphicsLayer.get(); }
 
     // RenderLayers with backing normally short-circuit paintLayer() because
     // their content is rendered via callbacks from GraphicsLayer. However, the document
@@ -106,6 +108,7 @@ public:
 
     IntRect compositedBounds() const;
     void setCompositedBounds(const IntRect&);
+    void updateCompositedBounds();
 
     FloatPoint graphicsLayerToContentsCoordinates(const GraphicsLayer*, const FloatPoint&);
     FloatPoint contentsToGraphicsLayerCoordinates(const GraphicsLayer*, const FloatPoint&);
@@ -127,7 +130,10 @@ private:
 
     bool updateClippingLayers(bool needsAncestorClip, bool needsDescendantClip);
     bool updateForegroundLayer(bool needsForegroundLayer);
+    bool updateMaskLayer(bool needsMaskLayer);
 
+    GraphicsLayerPaintingPhase paintingPhaseForPrimaryLayer() const;
+    
     IntSize contentOffsetInCompostingLayer() const;
     // Result is transform origin in pixels.
     FloatPoint3D computeTransformOrigin(const IntRect& borderBox) const;
@@ -162,14 +168,16 @@ private:
 private:
     RenderLayer* m_owningLayer;
 
-    GraphicsLayer* m_ancestorClippingLayer; // only used if we are clipped by an ancestor which is not a stacking context
-    GraphicsLayer* m_graphicsLayer;
-    GraphicsLayer* m_foregroundLayer;       // only used in cases where we need to draw the foreground separately
-    GraphicsLayer* m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
+    OwnPtr<GraphicsLayer> m_ancestorClippingLayer; // only used if we are clipped by an ancestor which is not a stacking context
+    OwnPtr<GraphicsLayer> m_graphicsLayer;
+    OwnPtr<GraphicsLayer> m_foregroundLayer;       // only used in cases where we need to draw the foreground separately
+    OwnPtr<GraphicsLayer> m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
+    OwnPtr<GraphicsLayer> m_maskLayer;             // only used if we have a mask
 
     IntRect m_compositedBounds;
 
     bool m_hasDirectlyCompositedContent;
+    bool m_artificiallyInflatedBounds;      // bounds had to be made non-zero to make transform-origin work
 };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderLayerCompositor.cpp b/WebCore/rendering/RenderLayerCompositor.cpp
index fb15800..5201287 100644
--- a/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/WebCore/rendering/RenderLayerCompositor.cpp
@@ -34,8 +34,8 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsLayer.h"
-#include "HitTestRequest.h"
 #include "HitTestResult.h"
+#include "HTMLCanvasElement.h"
 #include "Page.h"
 #include "RenderLayerBacking.h"
 #include "RenderVideo.h"
@@ -92,7 +92,6 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
 RenderLayerCompositor::~RenderLayerCompositor()
 {
     ASSERT(!m_rootLayerAttached);
-    delete m_rootPlatformLayer;
 }
 
 void RenderLayerCompositor::enableCompositingMode(bool enable /* = true */)
@@ -287,6 +286,13 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
         return boundingBoxRect;
     }
 
+    if (RenderLayer* reflection = layer->reflectionLayer()) {
+        if (!reflection->isComposited()) {
+            IntRect childUnionBounds = calculateCompositedBounds(reflection, layer);
+            unionBounds.unite(childUnionBounds);
+        }
+    }
+    
     ASSERT(layer->isStackingContext() || (!layer->m_posZOrderList || layer->m_posZOrderList->size() == 0));
 
     if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
@@ -425,11 +431,11 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
     bool haveComputedBounds = false;
     IntRect absBounds;
-    if (overlapMap && mustOverlapCompositedLayers) {
+    if (overlapMap && !overlapMap->isEmpty()) {
         // If we're testing for overlap, we only need to composite if we overlap something that is already composited.
         absBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
         haveComputedBounds = true;
-        mustOverlapCompositedLayers &= overlapsCompositedLayers(*overlapMap, absBounds);
+        mustOverlapCompositedLayers = overlapsCompositedLayers(*overlapMap, absBounds);
     }
     
     layer->setMustOverlapCompositedLayers(mustOverlapCompositedLayers);
@@ -503,8 +509,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // If we have a software transform, and we have layers under us, we need to also
     // be composited. Also, if we have opacity < 1, then we need to be a layer so that
     // the child layers are opaque, then rendered with opacity on this layer.
-    if (childState.m_subtreeIsCompositing &&
-        (layer->renderer()->hasTransform() || layer->renderer()->style()->opacity() < 1)) {
+    if (childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
         layer->setMustOverlapCompositedLayers(true);
         if (overlapMap)
             addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
@@ -530,6 +535,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
 void RenderLayerCompositor::setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer)
 {
+    ASSERT(!parentLayer || childLayer->ancestorCompositingLayer() == parentLayer);
     ASSERT(childLayer->isComposited());
 
     // It's possible to be called with a parent that isn't yet composited when we're doing
@@ -573,7 +579,7 @@ bool RenderLayerCompositor::canAccelerateVideoRendering(RenderVideo* o) const
 {
     // FIXME: ideally we need to look at all ancestors for mask or video. But for now,
     // just bail on the obvious cases.
-    if (o->hasMask() || o->hasReflection() || !m_hasAcceleratedCompositing)
+    if (o->hasReflection() || !m_hasAcceleratedCompositing)
         return false;
 
     return o->supportsAcceleratedRendering();
@@ -589,8 +595,7 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     if (layerBacking) {
         // The compositing state of all our children has been updated already, so now
         // we can compute and cache the composited bounds for this layer.
-        layerBacking->setCompositedBounds(calculateCompositedBounds(layer, layer));
-
+        layerBacking->updateCompositedBounds();
         layerBacking->updateGraphicsLayerConfiguration();
         layerBacking->updateGraphicsLayerGeometry();
 
@@ -632,10 +637,10 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
         }
 
         if (updateHierarchy && layerBacking && layerBacking->foregroundLayer()) {
-            // we only have a contents layer if we have an m_layer
             layerBacking->foregroundLayer()->removeFromParent();
-
-            GraphicsLayer* hostingLayer = layerBacking->clippingLayer() ? layerBacking->clippingLayer() : layerBacking->graphicsLayer();
+            
+            // The foreground layer has to be correctly sorted with child layers, so needs to become a child of the clipping layer.
+            GraphicsLayer* hostingLayer = layerBacking->parentForSublayers();
             hostingLayer->addChild(layerBacking->foregroundLayer());
         }
     }
@@ -670,7 +675,7 @@ void RenderLayerCompositor::updateCompositingDescendantGeometry(RenderLayer* com
 {
     if (layer != compositingAncestor) {
         if (RenderLayerBacking* layerBacking = layer->backing()) {
-            layerBacking->setCompositedBounds(calculateCompositedBounds(layer, layer));
+            layerBacking->updateCompositedBounds();
             layerBacking->updateGraphicsLayerGeometry();
             if (updateDepth == RenderLayerBacking::CompositingChildren)
                 return;
@@ -759,7 +764,7 @@ RenderLayer* RenderLayerCompositor::rootRenderLayer() const
 
 GraphicsLayer* RenderLayerCompositor::rootPlatformLayer() const
 {
-    return m_rootPlatformLayer;
+    return m_rootPlatformLayer.get();
 }
 
 void RenderLayerCompositor::didMoveOnscreen()
@@ -772,7 +777,7 @@ void RenderLayerCompositor::didMoveOnscreen()
     if (!page)
         return;
 
-    page->chrome()->client()->attachRootGraphicsLayer(frame, m_rootPlatformLayer);
+    page->chrome()->client()->attachRootGraphicsLayer(frame, m_rootPlatformLayer.get());
     m_rootLayerAttached = true;
 }
 
@@ -793,7 +798,7 @@ void RenderLayerCompositor::willMoveOffscreen()
 void RenderLayerCompositor::updateRootLayerPosition()
 {
     if (m_rootPlatformLayer)
-        m_rootPlatformLayer->setSize(FloatSize(m_renderView->overflowWidth(), m_renderView->overflowHeight()));
+        m_rootPlatformLayer->setSize(FloatSize(m_renderView->rightLayoutOverflow(), m_renderView->bottomLayoutOverflow()));
 }
 
 void RenderLayerCompositor::didStartAcceleratedAnimation()
@@ -821,11 +826,12 @@ bool RenderLayerCompositor::needsToBeComposited(const RenderLayer* layer) const
 // Use needsToBeComposited() to determine if a RL actually needs a compositing layer.
 // static
 bool RenderLayerCompositor::requiresCompositingLayer(const RenderLayer* layer) const
-{
+{    
     // The root layer always has a compositing layer, but it may not have backing.
     return (inCompositingMode() && layer->isRootLayer()) ||
              requiresCompositingForTransform(layer->renderer()) ||
              requiresCompositingForVideo(layer->renderer()) ||
+             requiresCompositingForCanvas(layer->renderer()) ||
              layer->renderer()->style()->backfaceVisibility() == BackfaceVisibilityHidden ||
              clipsCompositingDescendants(layer) ||
              requiresCompositingForAnimation(layer->renderer());
@@ -862,10 +868,8 @@ bool RenderLayerCompositor::clippedByAncestor(RenderLayer* layer) const
     if (!computeClipRoot || computeClipRoot == layer)
         return false;
 
-    ClipRects parentRects;
-    layer->parentClipRects(computeClipRoot, parentRects, true);
-
-    return parentRects.overflowClipRect() != ClipRects::infiniteRect();
+    IntRect backgroundRect = layer->backgroundClipRect(computeClipRoot, true);
+    return backgroundRect != ClipRects::infiniteRect();
 }
 
 // Return true if the given layer is a stacking context and has compositing child
@@ -897,6 +901,19 @@ bool RenderLayerCompositor::requiresCompositingForVideo(RenderObject* renderer)
     return false;
 }
 
+bool RenderLayerCompositor::requiresCompositingForCanvas(RenderObject* renderer) const
+{
+#if ENABLE(3D_CANVAS)    
+    if (renderer->isCanvas()) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer->node());
+        return canvas->is3D();
+    }
+#else
+    UNUSED_PARAM(renderer);
+#endif
+    return false;
+}
+
 bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* renderer) const
 {
     if (AnimationController* animController = renderer->animation()) {
@@ -906,6 +923,11 @@ bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* render
     return false;
 }
 
+bool RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing(RenderObject* renderer) const
+{
+    return renderer->hasTransform() || renderer->isTransparent() || renderer->hasMask();
+}
+
 // If an element has negative z-index children, those children render in front of the 
 // layer background, so we need an extra 'contents' layer for the foreground of the layer
 // object.
@@ -919,8 +941,8 @@ void RenderLayerCompositor::ensureRootPlatformLayer()
     if (m_rootPlatformLayer)
         return;
 
-    m_rootPlatformLayer = GraphicsLayer::createGraphicsLayer(0);
-    m_rootPlatformLayer->setSize(FloatSize(m_renderView->overflowWidth(), m_renderView->overflowHeight()));
+    m_rootPlatformLayer = GraphicsLayer::create(0);
+    m_rootPlatformLayer->setSize(FloatSize(m_renderView->rightLayoutOverflow(), m_renderView->bottomLayoutOverflow()));
     m_rootPlatformLayer->setPosition(FloatPoint(0, 0));
     // The root layer does flipping if we need it on this platform.
     m_rootPlatformLayer->setGeometryOrientation(GraphicsLayer::compositingCoordinatesOrientation());
@@ -937,7 +959,6 @@ void RenderLayerCompositor::destroyRootPlatformLayer()
         return;
 
     willMoveOffscreen();
-    delete m_rootPlatformLayer;
     m_rootPlatformLayer = 0;
 }
 
diff --git a/WebCore/rendering/RenderLayerCompositor.h b/WebCore/rendering/RenderLayerCompositor.h
index 02929dc..a809a70 100644
--- a/WebCore/rendering/RenderLayerCompositor.h
+++ b/WebCore/rendering/RenderLayerCompositor.h
@@ -164,10 +164,12 @@ private:
     bool requiresCompositingForAnimation(RenderObject*) const;
     bool requiresCompositingForTransform(RenderObject*) const;
     bool requiresCompositingForVideo(RenderObject*) const;
+    bool requiresCompositingForCanvas(RenderObject*) const;
+    bool requiresCompositingWhenDescendantsAreCompositing(RenderObject*) const;
 
 private:
     RenderView* m_renderView;
-    GraphicsLayer* m_rootPlatformLayer;
+    OwnPtr<GraphicsLayer> m_rootPlatformLayer;
     bool m_hasAcceleratedCompositing;
     bool m_compositingConsultsOverlap;
     bool m_compositing;
diff --git a/WebCore/rendering/RenderLineBoxList.cpp b/WebCore/rendering/RenderLineBoxList.cpp
index 00566b8..76a2e2f 100644
--- a/WebCore/rendering/RenderLineBoxList.cpp
+++ b/WebCore/rendering/RenderLineBoxList.cpp
@@ -162,8 +162,8 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
     // intersect.  This is a quick short-circuit that we can take to avoid walking any lines.
     // FIXME: This check is flawed in the following extremely obscure way:
     // if some line in the middle has a huge overflow, it might actually extend below the last line.
-    int yPos = firstLineBox()->root()->topOverflow() - renderer->maximalOutlineSize(paintInfo.phase);
-    int h = renderer->maximalOutlineSize(paintInfo.phase) + lastLineBox()->root()->bottomOverflow() - yPos;
+    int yPos = firstLineBox()->topVisibleOverflow() - renderer->maximalOutlineSize(paintInfo.phase);
+    int h = renderer->maximalOutlineSize(paintInfo.phase) + lastLineBox()->bottomVisibleOverflow() - yPos;
     yPos += ty;
     if (yPos >= paintInfo.rect.bottom() || yPos + h <= paintInfo.rect.y())
         return;
@@ -184,19 +184,19 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
             // The whole way objects break across pages needs to be redone.
             // Try to avoid splitting a line vertically, but only if it's less than the height
             // of the entire page.
-            if (curr->root()->bottomOverflow() - curr->root()->topOverflow() <= v->printRect().height()) {
-                if (ty + curr->root()->bottomOverflow() > v->printRect().bottom()) {
-                    if (ty + curr->root()->topOverflow() < v->truncatedAt())
-                        v->setBestTruncatedAt(ty + curr->root()->topOverflow(), renderer);
+            if (curr->bottomVisibleOverflow() - curr->topVisibleOverflow() <= v->printRect().height()) {
+                if (ty + curr->bottomVisibleOverflow() > v->printRect().bottom()) {
+                    if (ty + curr->topVisibleOverflow() < v->truncatedAt())
+                        v->setBestTruncatedAt(ty + curr->root()->topVisibleOverflow(), renderer);
                     // If we were able to truncate, don't paint.
-                    if (ty + curr->root()->topOverflow() >= v->truncatedAt())
+                    if (ty + curr->topVisibleOverflow() >= v->truncatedAt())
                         break;
                 }
             }
         }
 
-        int top = min(curr->root()->topOverflow(), curr->root()->selectionTop()) - renderer->maximalOutlineSize(info.phase);
-        int bottom = curr->root()->bottomOverflow() + renderer->maximalOutlineSize(info.phase);
+        int top = min(curr->topVisibleOverflow(), curr->root()->selectionTop()) - renderer->maximalOutlineSize(info.phase);
+        int bottom = curr->bottomVisibleOverflow() + renderer->maximalOutlineSize(info.phase);
         h = bottom - top;
         yPos = ty + top;
         if (yPos < info.rect.bottom() && yPos + h > info.rect.y())
@@ -229,14 +229,14 @@ bool RenderLineBoxList::hitTest(RenderBoxModelObject* renderer, const HitTestReq
     // contain the point.  This is a quick short-circuit that we can take to avoid walking any lines.
     // FIXME: This check is flawed in the following extremely obscure way:
     // if some line in the middle has a huge overflow, it might actually extend below the last line.
-    if ((y >= ty + lastLineBox()->root()->bottomOverflow()) || (y < ty + firstLineBox()->root()->topOverflow()))
+    if ((y >= ty + lastLineBox()->root()->bottomVisibleOverflow()) || (y < ty + firstLineBox()->root()->topVisibleOverflow()))
         return false;
 
     // See if our root lines contain the point.  If so, then we hit test
     // them further.  Note that boxes can easily overlap, so we can't make any assumptions
     // based off positions of our first line box or our last line box.
     for (InlineFlowBox* curr = lastLineBox(); curr; curr = curr->prevFlowBox()) {
-        if (y >= ty + curr->root()->topOverflow() && y < ty + curr->root()->bottomOverflow()) {
+        if (y >= ty + curr->root()->topVisibleOverflow() && y < ty + curr->root()->bottomVisibleOverflow()) {
             bool inside = curr->nodeAtPoint(request, result, x, y, tx, ty);
             if (inside) {
                 renderer->updateHitTestResult(result, IntPoint(x - tx, y - ty));
diff --git a/WebCore/rendering/RenderListBox.cpp b/WebCore/rendering/RenderListBox.cpp
index e6c28f7..0edfdef 100644
--- a/WebCore/rendering/RenderListBox.cpp
+++ b/WebCore/rendering/RenderListBox.cpp
@@ -508,7 +508,7 @@ bool RenderListBox::listIndexIsVisible(int index)
     return index >= m_indexOffset && index < m_indexOffset + numVisibleItems();
 }
 
-bool RenderListBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+bool RenderListBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier, Node**)
 {
     return m_vBar && m_vBar->scroll(direction, granularity, multiplier);
 }
@@ -527,8 +527,7 @@ void RenderListBox::valueChanged(Scrollbar*)
     if (newOffset != m_indexOffset) {
         m_indexOffset = newOffset;
         repaint();
-        // Fire the scroll DOM event.
-        node()->dispatchEvent(eventNames().scrollEvent, false, false);
+        node()->dispatchEvent(Event::create(eventNames().scrollEvent, false, false));
     }
 }
 
diff --git a/WebCore/rendering/RenderListBox.h b/WebCore/rendering/RenderListBox.h
index e5454e5..aafb87e 100644
--- a/WebCore/rendering/RenderListBox.h
+++ b/WebCore/rendering/RenderListBox.h
@@ -68,7 +68,7 @@ private:
 
     virtual bool isPointInOverflowControl(HitTestResult&, int x, int y, int tx, int ty);
 
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
 
     virtual void calcPrefWidths();
     virtual int baselinePosition(bool firstLine, bool isRootLineBox) const;
diff --git a/WebCore/rendering/RenderListItem.cpp b/WebCore/rendering/RenderListItem.cpp
index 374ef66..e487c60 100644
--- a/WebCore/rendering/RenderListItem.cpp
+++ b/WebCore/rendering/RenderListItem.cpp
@@ -247,21 +247,30 @@ void RenderListItem::positionListMarker()
         int markerXPos;
         RootInlineBox* root = m_marker->inlineBoxWrapper()->root();
 
+        // FIXME: Inline flows in the line box hierarchy that have self-painting layers should act as cutoff points
+        // and really shouldn't keep propagating overflow up.  This won't really break anything other than repainting
+        // not being as tight as it could be though.
         if (style()->direction() == LTR) {
             int leftLineOffset = leftRelOffset(yOffset, leftOffset(yOffset, false), false);
             markerXPos = leftLineOffset - xOffset - paddingLeft() - borderLeft() + m_marker->marginLeft();
             m_marker->inlineBoxWrapper()->adjustPosition(markerXPos - markerOldX, 0);
-            if (markerXPos < root->leftOverflow()) {
-                root->setHorizontalOverflowPositions(markerXPos, root->rightOverflow());
-                adjustOverflow = true;
+            for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
+                if (markerXPos < box->leftLayoutOverflow()) {
+                    box->setHorizontalOverflowPositions(markerXPos, box->rightLayoutOverflow(), box->leftVisualOverflow(), box->rightVisualOverflow());
+                    if (box == root)
+                        adjustOverflow = true;
+                }
             }
         } else {
             int rightLineOffset = rightRelOffset(yOffset, rightOffset(yOffset, false), false);
             markerXPos = rightLineOffset - xOffset + paddingRight() + borderRight() + m_marker->marginLeft();
             m_marker->inlineBoxWrapper()->adjustPosition(markerXPos - markerOldX, 0);
-            if (markerXPos + m_marker->width() > root->rightOverflow()) {
-                root->setHorizontalOverflowPositions(root->leftOverflow(), markerXPos + m_marker->width());
-                adjustOverflow = true;
+            for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
+                if (markerXPos + m_marker->width() > box->rightLayoutOverflow()) {
+                    box->setHorizontalOverflowPositions(box->leftLayoutOverflow(), markerXPos + m_marker->width(), box->leftVisualOverflow(), box->rightVisualOverflow());
+                    if (box == root)
+                        adjustOverflow = true;
+                }
             }
         }
 
@@ -271,9 +280,9 @@ void RenderListItem::positionListMarker()
             do {
                 o = o->parentBox();
                 if (o->isRenderBlock())
-                    toRenderBlock(o)->addVisualOverflow(markerRect);
+                    toRenderBlock(o)->addLayoutOverflow(markerRect);
                 markerRect.move(-o->x(), -o->y());
-            } while (o != this);
+            } while (o != this && !o->hasSelfPaintingLayer());
         }
     }
 }
diff --git a/WebCore/rendering/RenderListItem.h b/WebCore/rendering/RenderListItem.h
index 21544f9..c4c41dc 100644
--- a/WebCore/rendering/RenderListItem.h
+++ b/WebCore/rendering/RenderListItem.h
@@ -44,6 +44,8 @@ public:
     void setNotInList(bool notInList) { m_notInList = notInList; }
     bool notInList() const { return m_notInList; }
 
+    const String& markerText() const;
+
 private:
     virtual const char* renderName() const { return "RenderListItem"; }
 
@@ -59,8 +61,6 @@ private:
 
     virtual void positionListMarker();
 
-    const String& markerText() const;
-
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     void updateMarkerLocation();
diff --git a/WebCore/rendering/RenderMarquee.cpp b/WebCore/rendering/RenderMarquee.cpp
index 31a8305..bb917f8 100644
--- a/WebCore/rendering/RenderMarquee.cpp
+++ b/WebCore/rendering/RenderMarquee.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
@@ -152,7 +153,11 @@ int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge
 
 void RenderMarquee::start()
 {
-    if (m_timer.isActive() || m_layer->renderer()->style()->marqueeIncrement().isZero())
+    if (m_timer.isActive() || m_layer->renderer()->style()->marqueeIncrement().isZero()
+#if ENABLE(WCSS) && ENABLE(XHTMLMP)
+        || (m_layer->renderer()->document()->isXHTMLMPDocument() && !m_layer->renderer()->style()->marqueeLoopCount())
+#endif
+       )
         return;
 
     // We may end up propagating a scroll event. It is important that we suspend events until 
diff --git a/WebCore/rendering/RenderMedia.cpp b/WebCore/rendering/RenderMedia.cpp
index b87e99d..1da2628 100644
--- a/WebCore/rendering/RenderMedia.cpp
+++ b/WebCore/rendering/RenderMedia.cpp
@@ -33,6 +33,7 @@
 #include "HTMLNames.h"
 #include "MediaControlElements.h"
 #include "MouseEvent.h"
+#include "RenderTheme.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
@@ -132,6 +133,10 @@ void RenderMedia::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
             m_currentTimeDisplay->updateStyle();
         if (m_timeRemainingDisplay)
             m_timeRemainingDisplay->updateStyle();
+        if (m_volumeSliderContainer)
+            m_volumeSliderContainer->updateStyle();
+        if (m_volumeSlider)
+            m_volumeSlider->updateStyle();
     }
 }
 
@@ -240,6 +245,22 @@ void RenderMedia::createTimeline()
     m_timeline->attachToParent(m_timelineContainer.get());
 }
 
+void RenderMedia::createVolumeSliderContainer()
+{
+    ASSERT(!m_volumeSliderContainer);
+    m_volumeSliderContainer = new MediaControlVolumeSliderContainerElement(document(), mediaElement());
+    m_volumeSliderContainer->attachToParent(m_panel.get());
+}
+
+void RenderMedia::createVolumeSlider()
+{
+    ASSERT(!m_volumeSlider);
+    m_volumeSlider = new MediaControlVolumeSliderElement(document(), mediaElement());
+    m_volumeSlider->setAttribute(precisionAttr, "float");
+    m_volumeSlider->setAttribute(maxAttr, "1");
+    m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
+}
+
 void RenderMedia::createCurrentTimeDisplay()
 {
     ASSERT(!m_currentTimeDisplay);
@@ -285,6 +306,8 @@ void RenderMedia::updateControls()
             m_currentTimeDisplay = 0;
             m_timeRemainingDisplay = 0;
             m_fullscreenButton = 0;
+            m_volumeSliderContainer = 0;
+            m_volumeSlider = 0;
             m_controlsShadowRoot = 0;
         }
         m_opacityAnimationTo = 1.0f;
@@ -298,19 +321,22 @@ void RenderMedia::updateControls()
         createPanel();
         if (m_panel) {
             createRewindButton();
-            createMuteButton();
             createPlayButton();
             createReturnToRealtimeButton();
             createStatusDisplay();
             createTimelineContainer();
-            createSeekBackButton();
-            createSeekForwardButton();
-            createFullscreenButton();
             if (m_timelineContainer) {
                 createCurrentTimeDisplay();
                 createTimeline();
                 createTimeRemainingDisplay();
             }
+            createSeekBackButton();
+            createSeekForwardButton();
+            createFullscreenButton();
+            createMuteButton();
+            createVolumeSliderContainer();
+            if (m_volumeSliderContainer)
+                createVolumeSlider();
             m_panel->attach();
         }
     }
@@ -336,6 +362,8 @@ void RenderMedia::updateControls()
         m_playButton->update();
     if (m_timelineContainer)
         m_timelineContainer->update();
+    if (m_volumeSliderContainer)
+        m_volumeSliderContainer->update();
     if (m_timeline)
         m_timeline->update();
     if (m_currentTimeDisplay)
@@ -354,6 +382,8 @@ void RenderMedia::updateControls()
         m_statusDisplay->update();
     if (m_fullscreenButton)
         m_fullscreenButton->update();
+    if (m_volumeSlider)
+        m_volumeSlider->update();
 
     updateTimeDisplay();
     updateControlVisibility();
@@ -366,24 +396,6 @@ void RenderMedia::timeUpdateTimerFired(Timer<RenderMedia>*)
     updateTimeDisplay();
 }
     
-String RenderMedia::formatTime(float time)
-{
-    if (!isfinite(time))
-        time = 0;
-    int seconds = (int)fabsf(time); 
-    int hours = seconds / (60 * 60);
-    int minutes = (seconds / 60) % 60;
-    seconds %= 60;
-    if (hours) {
-        if (hours > 9)
-            return String::format("%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
-        else
-            return String::format("%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
-    }
-    else
-        return String::format("%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds);
-}
-
 void RenderMedia::updateTimeDisplay()
 {
     if (!m_currentTimeDisplay || !m_currentTimeDisplay->renderer() || m_currentTimeDisplay->renderer()->style()->display() == NONE || style()->visibility() != VISIBLE)
@@ -391,12 +403,8 @@ void RenderMedia::updateTimeDisplay()
     float now = mediaElement()->currentTime();
     float duration = mediaElement()->duration();
 
-    String timeString = formatTime(now);
-    ExceptionCode ec;
-    m_currentTimeDisplay->setInnerText(timeString, ec);
-    
-    timeString = formatTime(now - duration);
-    m_timeRemainingDisplay->setInnerText(timeString, ec);
+    m_currentTimeDisplay->setCurrentValue(now);
+    m_timeRemainingDisplay->setCurrentValue(now - duration);
 }
 
 void RenderMedia::updateControlVisibility() 
@@ -463,13 +471,53 @@ void RenderMedia::opacityAnimationTimerFired(Timer<RenderMedia>*)
     changeOpacity(m_panel.get(), opacity);
 }
 
+void RenderMedia::updateVolumeSliderContainer(bool visible)
+{
+    if (!mediaElement()->hasAudio() || !m_volumeSliderContainer || !m_volumeSlider)
+        return;
+
+    if (visible && !m_volumeSliderContainer->isVisible()) {
+        if (!m_muteButton || !m_muteButton->renderer() || !m_muteButton->renderBox())
+            return;
+
+        RefPtr<RenderStyle> s = m_volumeSliderContainer->styleForElement();
+        int height = s->height().isPercent() ? 0 : s->height().value();
+        int x = m_muteButton->renderBox()->offsetLeft();
+        int y = m_muteButton->renderBox()->offsetTop() - height;
+        FloatPoint absPoint = m_muteButton->renderer()->localToAbsolute(FloatPoint(x, y), true, true);
+        if (absPoint.y() < 0)
+            y = m_muteButton->renderBox()->offsetTop() + m_muteButton->renderBox()->height();
+        m_volumeSliderContainer->setVisible(true);
+        m_volumeSliderContainer->setPosition(x, y);
+        m_volumeSliderContainer->update();
+        m_volumeSlider->update();
+    } else if (!visible && m_volumeSliderContainer->isVisible()) {
+        m_volumeSliderContainer->setVisible(false);
+        m_volumeSliderContainer->updateStyle();
+    }
+}
+
 void RenderMedia::forwardEvent(Event* event)
 {
     if (event->isMouseEvent() && m_controlsShadowRoot) {
         MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
         IntPoint point(mouseEvent->absoluteLocation());
-        if (m_muteButton && m_muteButton->hitTest(point))
+        bool showVolumeSlider = false;
+        if (m_muteButton && m_muteButton->hitTest(point)) {
             m_muteButton->defaultEventHandler(event);
+            if (event->type() != eventNames().mouseoutEvent)
+                showVolumeSlider = true;
+        }
+
+        if (m_volumeSliderContainer && m_volumeSliderContainer->hitTest(point))
+            showVolumeSlider = true;
+
+        if (m_volumeSlider && m_volumeSlider->hitTest(point)) {
+            m_volumeSlider->defaultEventHandler(event);
+            showVolumeSlider = true;
+        }
+
+        updateVolumeSliderContainer(showVolumeSlider);
 
         if (m_playButton && m_playButton->hitTest(point))
             m_playButton->defaultEventHandler(event);
diff --git a/WebCore/rendering/RenderMedia.h b/WebCore/rendering/RenderMedia.h
index 5697bda..602cd26 100644
--- a/WebCore/rendering/RenderMedia.h
+++ b/WebCore/rendering/RenderMedia.h
@@ -41,10 +41,12 @@ class MediaControlSeekButtonElement;
 class MediaControlRewindButtonElement;
 class MediaControlReturnToRealtimeButtonElement;
 class MediaControlTimelineElement;
+class MediaControlVolumeSliderElement;
 class MediaControlFullscreenButtonElement;
 class MediaControlTimeDisplayElement;
 class MediaControlStatusDisplayElement;
 class MediaControlTimelineContainerElement;
+class MediaControlVolumeSliderContainerElement;
 class MediaControlElement;
 class MediaPlayer;
 
@@ -60,8 +62,6 @@ public:
     HTMLMediaElement* mediaElement() const;
     MediaPlayer* player() const;
 
-    static String formatTime(float time);
-
     bool shouldShowTimeDisplayControls() const;
 
     void updateFromElement();
@@ -99,6 +99,8 @@ private:
     void createStatusDisplay();
     void createTimelineContainer();
     void createTimeline();
+    void createVolumeSliderContainer();
+    void createVolumeSlider();
     void createCurrentTimeDisplay();
     void createTimeRemainingDisplay();
     void createFullscreenButton();
@@ -109,6 +111,8 @@ private:
     void changeOpacity(HTMLElement*, float opacity);
     void opacityAnimationTimerFired(Timer<RenderMedia>*);
 
+    void updateVolumeSliderContainer(bool visible);
+
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     RefPtr<HTMLElement> m_controlsShadowRoot;
@@ -120,8 +124,10 @@ private:
     RefPtr<MediaControlRewindButtonElement> m_rewindButton;
     RefPtr<MediaControlReturnToRealtimeButtonElement> m_returnToRealtimeButton;
     RefPtr<MediaControlTimelineElement> m_timeline;
+    RefPtr<MediaControlVolumeSliderElement> m_volumeSlider;
     RefPtr<MediaControlFullscreenButtonElement> m_fullscreenButton;
     RefPtr<MediaControlTimelineContainerElement> m_timelineContainer;
+    RefPtr<MediaControlVolumeSliderContainerElement> m_volumeSliderContainer;
     RefPtr<MediaControlTimeDisplayElement> m_currentTimeDisplay;
     RefPtr<MediaControlTimeDisplayElement> m_timeRemainingDisplay;
     RefPtr<MediaControlStatusDisplayElement> m_statusDisplay;
diff --git a/WebCore/rendering/RenderMediaControls.cpp b/WebCore/rendering/RenderMediaControls.cpp
index 06d901a..4303aaa 100644
--- a/WebCore/rendering/RenderMediaControls.cpp
+++ b/WebCore/rendering/RenderMediaControls.cpp
@@ -82,16 +82,6 @@ void RenderMediaControls::adjustMediaSliderThumbSize(RenderObject* o)
     o->style()->setHeight(Length(static_cast<int>(mediaSliderThumbHeight * zoomLevel), Fixed));
 }
 
-static HTMLMediaElement* parentMediaElement(RenderObject* o)
-{
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
-        return 0;
-
-    return static_cast<HTMLMediaElement*>(mediaNode);
-}
-
 bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
@@ -110,8 +100,8 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
         case MediaPauseButton:
         case MediaPlayButton:
             if (MediaControlPlayButtonElement* btn = static_cast<MediaControlPlayButtonElement*>(o->node())) {
-                bool currentlyPlaying = btn->displayType() == MediaPlayButton;
-                paintThemePart(currentlyPlaying ? SafariTheme::MediaPauseButtonPart : SafariTheme::MediaPlayButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+                bool canPlay = btn->displayType() == MediaPlayButton;
+                paintThemePart(canPlay ? SafariTheme::MediaPlayButtonPart : SafariTheme::MediaPauseButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             }
             break;
         case MediaSeekBackButton:
@@ -121,13 +111,25 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
             paintThemePart(SafariTheme::MediaSeekForwardButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             break;
         case MediaSlider: {
-            if (HTMLMediaElement* mediaElement = parentMediaElement(o))
+            if (HTMLMediaElement* mediaElement = toParentMediaElement(o))
                 STPaintProgressIndicator(SafariTheme::MediaType, paintInfo.context->platformContext(), r, NSRegularControlSize, 0, mediaElement->percentLoaded());
             break;
         }
         case MediaSliderThumb:
             paintThemePart(SafariTheme::MediaSliderThumbPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             break;
+        case MediaVolumeSliderContainer:
+            // FIXME: Implement volume slider.
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaVolumeSlider:
+            // FIXME: Implement volume slider.
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaVolumeSliderThumb:
+            // FIXME: Implement volume slider.
+            ASSERT_NOT_REACHED();
+            break;
         case MediaTimelineContainer:
             ASSERT_NOT_REACHED();
             break;
@@ -147,4 +149,3 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
 #endif  // #if ENABLE(VIDEO)
 
 } // namespace WebCore
-
diff --git a/WebCore/rendering/RenderMediaControlsChromium.cpp b/WebCore/rendering/RenderMediaControlsChromium.cpp
new file mode 100644
index 0000000..bba2fa2
--- /dev/null
+++ b/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -0,0 +1,289 @@
+/*
+ * Copyright (C) 2009 Apple Inc.
+ * Copyright (C) 2009 Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderMediaControlsChromium.h"
+
+#include "Gradient.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+
+namespace WebCore {
+
+#if ENABLE(VIDEO)
+
+typedef WTF::HashMap<const char*, Image*> MediaControlImageMap;
+static MediaControlImageMap* gMediaControlImageMap = 0;
+
+static Image* platformResource(const char* name)
+{
+    if (!gMediaControlImageMap)
+        gMediaControlImageMap = new MediaControlImageMap();
+    if (Image* image = gMediaControlImageMap->get(name))
+        return image;
+    if (Image* image = Image::loadPlatformResource(name).releaseRef()) {
+        gMediaControlImageMap->set(name, image);
+        return image;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
+{
+    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
+    IntRect imageRect = image->rect();
+    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
+    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
+
+    context->drawImage(image, imageRect);
+    return true;
+}
+
+static bool paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+      return false;
+
+    static Image* soundFull = platformResource("mediaSoundFull");
+    static Image* soundNone = platformResource("mediaSoundNone");
+    static Image* soundDisabled = platformResource("mediaSoundDisabled");
+
+    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
+        return paintMediaButton(paintInfo.context, rect, soundDisabled);
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+}
+
+static bool paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaPlay = platformResource("mediaPlay");
+    static Image* mediaPause = platformResource("mediaPause");
+    static Image* mediaPlayDisabled = platformResource("mediaPlayDisabled");
+
+    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
+        return paintMediaButton(paintInfo.context, rect, mediaPlayDisabled);
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+}
+
+static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    RenderStyle* style = object->style();
+    GraphicsContext* context = paintInfo.context;
+
+    // Draw the border of the time bar.
+    // FIXME: this should be a rounded rect but need to fix GraphicsContextSkia first.
+    // https://bugs.webkit.org/show_bug.cgi?id=30143
+    context->save();
+    context->setStrokeStyle(SolidStroke);
+    context->setStrokeColor(style->borderLeftColor());
+    context->setStrokeThickness(style->borderLeftWidth());
+    context->setFillColor(style->backgroundColor());
+    context->drawRect(rect);
+    context->restore();
+
+    // Draw the buffered ranges.
+    // FIXME: Draw multiple ranges if there are multiple buffered ranges.
+    // FIXME: percentLoaded() doesn't always hit 1.0 so we're using round().
+    IntRect bufferedRect = rect;
+    bufferedRect.inflate(-style->borderLeftWidth());
+    bufferedRect.setWidth(round((bufferedRect.width() * mediaElement->percentLoaded())));
+
+    // Don't bother drawing an empty area.
+    if (!bufferedRect.isEmpty()) {
+        IntPoint sliderTopLeft = bufferedRect.location();
+        IntPoint sliderTopRight = sliderTopLeft;
+        sliderTopRight.move(0, bufferedRect.height());
+
+        RefPtr<Gradient> gradient = Gradient::create(sliderTopLeft, sliderTopRight);
+        Color startColor = object->style()->color();
+        gradient->addColorStop(0.0, startColor);
+        gradient->addColorStop(1.0, Color(startColor.red() / 2, startColor.green() / 2, startColor.blue() / 2, startColor.alpha()));
+
+        context->save();
+        context->setStrokeStyle(NoStroke);
+        context->setFillGradient(gradient);
+        context->drawRect(bufferedRect);
+        context->restore();
+    }
+
+    return true;
+}
+
+static bool paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    if (!object->parent()->isSlider())
+        return false;
+
+    static Image* mediaSliderThumb = platformResource("mediaSliderThumb");
+    return paintMediaButton(paintInfo.context, rect, mediaSliderThumb);
+}
+
+static bool paintMediaVolumeSlider(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    GraphicsContext* context = paintInfo.context;
+    Color originalColor = context->strokeColor();
+    if (originalColor != Color::white)
+        context->setStrokeColor(Color::white);
+
+    int x = rect.x() + rect.width() / 2;
+    context->drawLine(IntPoint(x, rect.y()),  IntPoint(x, rect.y() + rect.height()));
+
+    if (originalColor != Color::white)
+        context->setStrokeColor(originalColor);
+    return true;
+}
+
+static bool paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    if (!object->parent()->isSlider())
+        return false;
+
+    static Image* mediaVolumeSliderThumb = platformResource("mediaVolumeSliderThumb");
+    return paintMediaButton(paintInfo.context, rect, mediaVolumeSliderThumb);
+}
+
+static bool paintMediaTimelineContainer(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    if (!rect.isEmpty()) {
+        GraphicsContext* context = paintInfo.context;
+        Color originalColor = context->strokeColor();
+        float originalThickness = context->strokeThickness();
+        StrokeStyle originalStyle = context->strokeStyle();
+
+        context->setStrokeStyle(SolidStroke);
+
+        // Draw the left border using CSS defined width and color.
+        context->setStrokeThickness(object->style()->borderLeftWidth());
+        context->setStrokeColor(object->style()->borderLeftColor().rgb());
+        context->drawLine(IntPoint(rect.x() + 1, rect.y()),
+                          IntPoint(rect.x() + 1, rect.y() + rect.height()));
+
+        // Draw the right border using CSS defined width and color.
+        context->setStrokeThickness(object->style()->borderRightWidth());
+        context->setStrokeColor(object->style()->borderRightColor().rgb());
+        context->drawLine(IntPoint(rect.x() + rect.width() - 1, rect.y()),
+                          IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height()));
+
+        context->setStrokeColor(originalColor);
+        context->setStrokeThickness(originalThickness);
+        context->setStrokeStyle(originalStyle);
+    }
+    return true;
+}
+
+bool RenderMediaControlsChromium::shouldRenderMediaControlPart(ControlPart part, Element* e)
+{
+    UNUSED_PARAM(e);
+
+    switch (part) {
+    case MediaMuteButtonPart:
+    case MediaPlayButtonPart:
+    case MediaSliderPart:
+    case MediaSliderThumbPart:
+    case MediaVolumeSliderContainerPart:
+    case MediaVolumeSliderPart:
+    case MediaVolumeSliderThumbPart:
+    case MediaControlsBackgroundPart:
+    case MediaCurrentTimePart:
+    case MediaTimeRemainingPart:
+        return true;
+    }
+    return false;
+}
+
+bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType part, RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    switch (part) {
+    case MediaMuteButton:
+    case MediaUnMuteButton:
+        return paintMediaMuteButton(object, paintInfo, rect);
+    case MediaPauseButton:
+    case MediaPlayButton:
+        return paintMediaPlayButton(object, paintInfo, rect);
+    case MediaSlider:
+        return paintMediaSlider(object, paintInfo, rect);
+    case MediaSliderThumb:
+        return paintMediaSliderThumb(object, paintInfo, rect);
+    case MediaVolumeSlider:
+        return paintMediaVolumeSlider(object, paintInfo, rect);
+    case MediaVolumeSliderThumb:
+        return paintMediaVolumeSliderThumb(object, paintInfo, rect);
+    case MediaTimelineContainer:
+        return paintMediaTimelineContainer(object, paintInfo, rect);
+    case MediaFullscreenButton:
+    case MediaSeekBackButton:
+    case MediaSeekForwardButton:
+    case MediaVolumeSliderContainer:
+    case MediaCurrentTimeDisplay:
+    case MediaTimeRemainingDisplay:
+    case MediaControlsPanel:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+    return false;
+}
+
+void RenderMediaControlsChromium::adjustMediaSliderThumbSize(RenderObject* object)
+{
+    static Image* mediaSliderThumb = platformResource("mediaSliderThumb");
+    static Image* mediaVolumeSliderThumb = platformResource("mediaVolumeSliderThumb");
+
+    Image* thumbImage = 0;
+    if (object->style()->appearance() == MediaSliderThumbPart)
+        thumbImage = mediaSliderThumb;
+    else if (object->style()->appearance() == MediaVolumeSliderThumbPart)
+        thumbImage = mediaVolumeSliderThumb;
+
+    if (thumbImage) {
+        object->style()->setWidth(Length(thumbImage->width(), Fixed));
+        object->style()->setHeight(Length(thumbImage->height(), Fixed));
+    }
+}
+
+#endif  // #if ENABLE(VIDEO)
+
+} // namespace WebCore
diff --git a/WebCore/rendering/RenderMediaControlsChromium.h b/WebCore/rendering/RenderMediaControlsChromium.h
new file mode 100644
index 0000000..d6d986c
--- /dev/null
+++ b/WebCore/rendering/RenderMediaControlsChromium.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc.
+ * Copyright (C) 2009 Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderMediaControlsChromium_h
+#define RenderMediaControlsChromium_h
+
+#include "RenderObject.h"
+#include "MediaControlElements.h"
+
+namespace WebCore {
+
+class HTMLMediaElement;
+class RenderMediaControlsChromium {
+public:
+    static bool shouldRenderMediaControlPart(ControlPart, Element*);
+    static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    static void adjustMediaSliderThumbSize(RenderObject*);
+};
+
+} // namespace WebCore
+
+#endif // RenderMediaControlsChromium_h
diff --git a/WebCore/rendering/RenderMenuList.cpp b/WebCore/rendering/RenderMenuList.cpp
index 9d2e7e0..cbbc7cb 100644
--- a/WebCore/rendering/RenderMenuList.cpp
+++ b/WebCore/rendering/RenderMenuList.cpp
@@ -292,7 +292,6 @@ void RenderMenuList::hidePopup()
 {
     if (m_popup)
         m_popup->hide();
-    m_popupIsVisible = false;
 }
 
 void RenderMenuList::valueChanged(unsigned listIndex, bool fireOnChange)
@@ -428,6 +427,11 @@ int RenderMenuList::selectedIndex() const
     return select->optionToListIndex(select->selectedIndex());
 }
 
+void RenderMenuList::popupDidHide()
+{
+    m_popupIsVisible = false;
+}
+
 bool RenderMenuList::itemIsSeparator(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
diff --git a/WebCore/rendering/RenderMenuList.h b/WebCore/rendering/RenderMenuList.h
index 5c18e9e..2d617c1 100644
--- a/WebCore/rendering/RenderMenuList.h
+++ b/WebCore/rendering/RenderMenuList.h
@@ -82,6 +82,7 @@ private:
     virtual int clientPaddingRight() const;
     virtual int listSize() const;
     virtual int selectedIndex() const;
+    virtual void popupDidHide();
     virtual bool itemIsSeparator(unsigned listIndex) const;
     virtual bool itemIsLabel(unsigned listIndex) const;
     virtual bool itemIsSelected(unsigned listIndex) const;
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index 5137338..d83e4d0 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -46,6 +47,7 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "TransformState.h"
+#include "htmlediting.h"
 #include <algorithm>
 #ifdef ANDROID_LAYOUT
 #include "Settings.h"
@@ -145,6 +147,12 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
             o = new (arena) RenderTableCell(node);
             break;
         case TABLE_CAPTION:
+#if ENABLE(WCSS)
+        // As per the section 17.1 of the spec WAP-239-WCSS-20011026-a.pdf, 
+        // the marquee box inherits and extends the characteristics of the 
+        // principal block box ([CSS2] section 9.2.1).
+        case WAP_MARQUEE:
+#endif
             o = new (arena) RenderBlock(node);
             break;
         case BOX:
@@ -200,7 +208,6 @@ RenderObject::RenderObject(Node* node)
     , m_selectionState(SelectionNone)
     , m_hasColumns(false)
     , m_cellWidthChanged(false)
-    , m_replacedHasOverflow(false)
 {
 #ifndef NDEBUG
     renderObjectCounter.increment();
@@ -621,6 +628,11 @@ RenderBlock* RenderObject::containingBlock() const
             // inline directly.
             if (o->style()->position() == RelativePosition && o->isInline() && !o->isReplaced())
                 return o->containingBlock();
+#if ENABLE(SVG)
+            if (o->isSVGForeignObject()) //foreignObject is the containing block for contents inside it
+                break;
+#endif
+
             o = o->parent();
         }
     } else {
@@ -653,10 +665,10 @@ static bool mustRepaintFillLayers(const RenderObject* renderer, const FillLayer*
     if (!layer->xPosition().isZero() || !layer->yPosition().isZero())
         return true;
 
-    if (layer->isSizeSet()) {
-        if (layer->size().width().isPercent() || layer->size().height().isPercent())
+    if (layer->size().type == SizeLength) {
+        if (layer->size().size.width().isPercent() || layer->size().size.height().isPercent())
             return true;
-    } else if (img->usesImageContainerSize())
+    } else if (layer->size().type == Contain || layer->size().type == Cover || img->usesImageContainerSize())
         return true;
 
     return false;
@@ -1365,6 +1377,7 @@ Color RenderObject::selectionForegroundColor() const
     return color;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 Node* RenderObject::draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& dhtmlWillDrag) const
 {
     if (!dhtmlOK && !uaOK)
@@ -1399,6 +1412,7 @@ Node* RenderObject::draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& d
     }
     return 0;
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 void RenderObject::selectionStartEnd(int& spos, int& epos) const
 {
@@ -1612,15 +1626,20 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle*)
 
 void RenderObject::updateFillImages(const FillLayer* oldLayers, const FillLayer* newLayers)
 {
-    // FIXME: This will be slow when a large number of images is used.  Fix by using a dict.
-    for (const FillLayer* currOld = oldLayers; currOld; currOld = currOld->next()) {
-        if (currOld->image() && (!newLayers || !newLayers->containsImage(currOld->image())))
-            currOld->image()->removeClient(this);
-    }
+    // Optimize the common case
+    if (oldLayers && !oldLayers->next() && newLayers && !newLayers->next() && (oldLayers->image() == newLayers->image()))
+        return;
+    
+    // Go through the new layers and addClients first, to avoid removing all clients of an image.
     for (const FillLayer* currNew = newLayers; currNew; currNew = currNew->next()) {
-        if (currNew->image() && (!oldLayers || !oldLayers->containsImage(currNew->image())))
+        if (currNew->image())
             currNew->image()->addClient(this);
     }
+
+    for (const FillLayer* currOld = oldLayers; currOld; currOld = currOld->next()) {
+        if (currOld->image())
+            currOld->image()->removeClient(this);
+    }
 }
 
 void RenderObject::updateImage(StyleImage* oldImage, StyleImage* newImage)
@@ -1739,6 +1758,23 @@ IntSize RenderObject::offsetFromContainer(RenderObject* o) const
     return offset;
 }
 
+IntSize RenderObject::offsetFromAncestorContainer(RenderObject* container) const
+{
+    IntSize offset;
+    const RenderObject* currContainer = this;
+    do {
+        RenderObject* nextContainer = currContainer->container();
+        ASSERT(nextContainer);  // This means we reached the top without finding container.
+        if (!nextContainer)
+            break;
+        ASSERT(!currContainer->hasTransform());
+        offset += currContainer->offsetFromContainer(nextContainer);
+        currContainer = nextContainer;
+    } while (currContainer != container);
+
+    return offset;
+}
+
 IntRect RenderObject::localCaretRect(InlineBox*, int, int* extraWidthToEndOfLine)
 {
     if (extraWidthToEndOfLine)
@@ -1772,8 +1808,11 @@ bool RenderObject::hasOutlineAnnotation() const
     return node() && node()->isLink() && document()->printing();
 }
 
-RenderObject* RenderObject::container() const
+RenderObject* RenderObject::container(RenderBoxModelObject* repaintContainer, bool* repaintContainerSkipped) const
 {
+    if (repaintContainerSkipped)
+        *repaintContainerSkipped = false;
+
     // This method is extremely similar to containingBlock(), but with a few notable
     // exceptions.
     // (1) It can be used on orphaned subtrees, i.e., it can be called safely even when
@@ -1798,14 +1837,20 @@ RenderObject* RenderObject::container() const
         // we'll just return 0).
         // FIXME: The definition of view() has changed to not crawl up the render tree.  It might
         // be safe now to use it.
-        while (o && o->parent() && !(o->hasTransform() && o->isRenderBlock()))
+        while (o && o->parent() && !(o->hasTransform() && o->isRenderBlock())) {
+            if (repaintContainerSkipped && o == repaintContainer)
+                *repaintContainerSkipped = true;
             o = o->parent();
+        }
     } else if (pos == AbsolutePosition) {
         // Same goes here.  We technically just want our containing block, but
         // we may not have one if we're part of an uninstalled subtree.  We'll
         // climb as high as we can though.
-        while (o && o->style()->position() == StaticPosition && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock()))
+        while (o && o->style()->position() == StaticPosition && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock())) {
+            if (repaintContainerSkipped && o == repaintContainer)
+                *repaintContainerSkipped = true;
             o = o->parent();
+        }
     }
 
     return o;
@@ -1825,7 +1870,12 @@ void RenderObject::destroy()
         children->destroyLeftoverChildren();
 
     // If this renderer is being autoscrolled, stop the autoscroll timer
-    if (document()->frame()->eventHandler()->autoscrollRenderer() == this)
+    
+    // FIXME: RenderObject::destroy should not get called with a renderar whose document
+    // has a null frame, so we assert this. However, we don't want release builds to crash which is why we
+    // check that the frame is not null.
+    ASSERT(document()->frame());
+    if (document()->frame() && document()->frame()->eventHandler()->autoscrollRenderer() == this)
         document()->frame()->eventHandler()->stopAutoscrollTimer(true);
 
     if (m_hasCounterNodeMap)
diff --git a/WebCore/rendering/RenderObject.h b/WebCore/rendering/RenderObject.h
index 911169d..e358c98 100644
--- a/WebCore/rendering/RenderObject.h
+++ b/WebCore/rendering/RenderObject.h
@@ -278,6 +278,7 @@ public:
     virtual bool isTextField() const { return false; }
     virtual bool isVideo() const { return false; }
     virtual bool isWidget() const { return false; }
+    virtual bool isCanvas() const { return false; }
 
     bool isRoot() const { return document()->documentElement() == m_node; }
     bool isBody() const;
@@ -285,6 +286,9 @@ public:
 
     bool isHTMLMarquee() const;
 
+    inline bool isAfterContent() const;
+    static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
+
     bool childrenInline() const { return m_childrenInline; }
     void setChildrenInline(bool b = true) { m_childrenInline = b; }
     bool hasColumns() const { return m_hasColumns; }
@@ -301,6 +305,7 @@ public:
     virtual bool isRenderPath() const { return false; }
     virtual bool isSVGText() const { return false; }
     virtual bool isSVGImage() const { return false; }
+    virtual bool isSVGForeignObject() const { return false; }
 
     // Per SVG 1.1 objectBoundingBox ignores clipping, masking, filter effects, opacity and stroke-width.
     // This is used for all computation of objectBoundingBox relative units and by SVGLocateable::getBBox().
@@ -398,11 +403,11 @@ public:
     bool hasOutlineAnnotation() const;
     bool hasOutline() const { return style()->hasOutline() || hasOutlineAnnotation(); }
 
-   /**
-     * returns the object containing this one. can be different from parent for
-     * positioned elements
-     */
-    RenderObject* container() const;
+    // Returns the object containing this one. Can be different from parent for positioned elements.
+    // If repaintContainer and repaintContainerSkipped are not null, on return *repaintContainerSkipped
+    // is true if the renderer returned is an ancestor of repaintContainer.
+    RenderObject* container(RenderBoxModelObject* repaintContainer = 0, bool* repaintContainerSkipped = 0) const;
+
     virtual RenderObject* hoverAncestor() const { return parent(); }
 
     // IE Extension that can be called on any RenderObject.  See the implementation for the details.
@@ -536,6 +541,8 @@ public:
 
     // Return the offset from the container() renderer (excluding transforms)
     virtual IntSize offsetFromContainer(RenderObject*) const;
+    // Return the offset from an object up the container() chain. Asserts that none of the intermediate objects have transforms.
+    IntSize offsetFromAncestorContainer(RenderObject*) const;
     
     virtual void absoluteRects(Vector<IntRect>&, int, int) { }
     // FIXME: useTransforms should go away eventually
@@ -658,7 +665,9 @@ public:
     // Whether or not a given block needs to paint selection gaps.
     virtual bool shouldPaintSelectionGaps() const { return false; }
 
+#if ENABLE(DRAG_SUPPORT)
     Node* draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& dhtmlWillDrag) const;
+#endif
 
     /**
      * Returns the local coordinates of the caret within this render object.
@@ -734,9 +743,6 @@ public:
         return outlineBoundsForRepaint(0);
     }
 
-    bool replacedHasOverflow() const { return m_replacedHasOverflow; }
-    void setReplacedHasOverflow(bool b = true) { m_replacedHasOverflow = b; }
-    
 protected:
     // Overrides should call the superclass at the end
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
@@ -845,9 +851,6 @@ private:
     // from RenderTableCell
     bool m_cellWidthChanged : 1;
 
-    // from RenderReplaced
-    bool m_replacedHasOverflow : 1;
-
 private:
     // Store state between styleWillChange and styleDidChange
     static bool s_affectsParentBlock;
@@ -858,6 +861,16 @@ inline bool RenderObject::documentBeingDestroyed() const
     return !document()->renderer();
 }
 
+inline bool RenderObject::isAfterContent() const
+{
+    if (style()->styleType() != AFTER)
+        return false;
+    // Text nodes don't have their own styles, so ignore the style on a text node.
+    if (isText() && !isBR())
+        return false;
+    return true;
+}
+
 inline void RenderObject::setNeedsLayout(bool b, bool markParents)
 {
     bool alreadyNeededLayout = m_needsLayout;
@@ -974,6 +987,42 @@ inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRenderi
 #endif
 }
 
+inline int adjustForAbsoluteZoom(int value, RenderObject* renderer)
+{
+    float zoomFactor = renderer->style()->effectiveZoom();
+    if (zoomFactor == 1)
+        return value;
+    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
+    if (zoomFactor > 1)
+        value++;
+    return static_cast<int>(value / zoomFactor);
+}
+
+inline void adjustIntRectForAbsoluteZoom(IntRect& rect, RenderObject* renderer)
+{
+    rect.setX(adjustForAbsoluteZoom(rect.x(), renderer));
+    rect.setY(adjustForAbsoluteZoom(rect.y(), renderer));
+    rect.setWidth(adjustForAbsoluteZoom(rect.width(), renderer));
+    rect.setHeight(adjustForAbsoluteZoom(rect.height(), renderer));
+}
+
+inline FloatPoint adjustFloatPointForAbsoluteZoom(const FloatPoint& point, RenderObject* renderer)
+{
+    // The result here is in floats, so we don't need the truncation hack from the integer version above.
+    float zoomFactor = renderer->style()->effectiveZoom();
+    if (zoomFactor == 1)
+        return point;
+    return FloatPoint(point.x() / zoomFactor, point.y() / zoomFactor);
+}
+
+inline void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* renderer)
+{
+    quad.setP1(adjustFloatPointForAbsoluteZoom(quad.p1(), renderer));
+    quad.setP2(adjustFloatPointForAbsoluteZoom(quad.p2(), renderer));
+    quad.setP3(adjustFloatPointForAbsoluteZoom(quad.p3(), renderer));
+    quad.setP4(adjustFloatPointForAbsoluteZoom(quad.p4(), renderer));
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/WebCore/rendering/RenderOverflow.h b/WebCore/rendering/RenderOverflow.h
new file mode 100644
index 0000000..ed8976a
--- /dev/null
+++ b/WebCore/rendering/RenderOverflow.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderOverflow_h
+#define RenderOverflow_h
+
+#include "IntRect.h"
+
+namespace WebCore
+{
+// RenderOverflow is a class for tracking content that spills out of a box.  This class is used by RenderBox and
+// InlineFlowBox.
+//
+// There are two types of overflow: layout overflow (which is expected to be reachable via scrolling mechanisms) and
+// visual overflow (which is not expected to be reachable via scrolling mechanisms).
+//
+// Layout overflow examples include other boxes that spill out of our box,  For example, in the inline case a tall image
+// could spill out of a line box. 
+    
+// Examples of visual overflow are shadows, text stroke (and eventually outline and border-image).
+
+// This object is allocated only when some of these fields have non-default values in the owning box.
+class RenderOverflow {
+public:
+    RenderOverflow(const IntRect& defaultRect = IntRect()) 
+        : m_topLayoutOverflow(defaultRect.y())
+        , m_bottomLayoutOverflow(defaultRect.bottom())
+        , m_leftLayoutOverflow(defaultRect.x())
+        , m_rightLayoutOverflow(defaultRect.right())
+        , m_topVisualOverflow(defaultRect.y())
+        , m_bottomVisualOverflow(defaultRect.bottom())
+        , m_leftVisualOverflow(defaultRect.x())
+        , m_rightVisualOverflow(defaultRect.right())
+    {
+    }
+   
+    int topLayoutOverflow() const { return m_topLayoutOverflow; }
+    int bottomLayoutOverflow() const { return m_bottomLayoutOverflow; }
+    int leftLayoutOverflow() const { return m_leftLayoutOverflow; }
+    int rightLayoutOverflow() const { return m_rightLayoutOverflow; }
+    IntRect layoutOverflowRect() const;
+
+    int topVisualOverflow() const { return m_topVisualOverflow; }
+    int bottomVisualOverflow() const { return m_bottomVisualOverflow; }
+    int leftVisualOverflow() const { return m_leftVisualOverflow; }
+    int rightVisualOverflow() const { return m_rightVisualOverflow; }
+    IntRect visualOverflowRect() const;
+
+    IntRect visibleOverflowRect() const;
+
+    void setTopLayoutOverflow(int overflow) { m_topLayoutOverflow = overflow; }
+    void setBottomLayoutOverflow(int overflow) { m_bottomLayoutOverflow = overflow; }
+    void setLeftLayoutOverflow(int overflow) { m_leftLayoutOverflow = overflow; }
+    void setRightLayoutOverflow(int overflow) { m_rightLayoutOverflow = overflow; }
+    
+    void setTopVisualOverflow(int overflow) { m_topVisualOverflow = overflow; }
+    void setBottomVisualOverflow(int overflow) { m_bottomVisualOverflow = overflow; }
+    void setLeftVisualOverflow(int overflow) { m_leftVisualOverflow = overflow; }
+    void setRightVisualOverflow(int overflow) { m_rightVisualOverflow = overflow; }
+    
+    void move(int dx, int dy);
+    
+    void addLayoutOverflow(const IntRect&);
+    void addVisualOverflow(const IntRect&);
+
+    void resetLayoutOverflow(const IntRect& defaultRect);
+
+private:
+    int m_topLayoutOverflow;
+    int m_bottomLayoutOverflow;
+    int m_leftLayoutOverflow;
+    int m_rightLayoutOverflow;
+
+    int m_topVisualOverflow;
+    int m_bottomVisualOverflow;
+    int m_leftVisualOverflow;
+    int m_rightVisualOverflow;
+};
+
+inline IntRect RenderOverflow::layoutOverflowRect() const
+{
+    return IntRect(m_leftLayoutOverflow, m_topLayoutOverflow, m_rightLayoutOverflow - m_leftLayoutOverflow, m_bottomLayoutOverflow - m_topLayoutOverflow);
+}
+
+inline IntRect RenderOverflow::visualOverflowRect() const
+{
+    return IntRect(m_leftVisualOverflow, m_topVisualOverflow, m_rightVisualOverflow - m_leftVisualOverflow, m_bottomVisualOverflow - m_topVisualOverflow);
+}
+
+inline IntRect RenderOverflow::visibleOverflowRect() const
+{
+    IntRect combinedRect(layoutOverflowRect());
+    combinedRect.unite(visualOverflowRect());
+    return combinedRect;
+}
+
+inline void RenderOverflow::move(int dx, int dy)
+{
+    m_topLayoutOverflow += dy;
+    m_bottomLayoutOverflow += dy;
+    m_leftLayoutOverflow += dx;
+    m_rightLayoutOverflow += dx;
+    
+    m_topVisualOverflow += dy;
+    m_bottomVisualOverflow += dy;
+    m_leftVisualOverflow += dx;
+    m_rightVisualOverflow += dx;
+}
+
+inline void RenderOverflow::addLayoutOverflow(const IntRect& rect)
+{
+    m_topLayoutOverflow = std::min(rect.y(), m_topLayoutOverflow);
+    m_bottomLayoutOverflow = std::max(rect.bottom(), m_bottomLayoutOverflow);
+    m_leftLayoutOverflow = std::min(rect.x(), m_leftLayoutOverflow);
+    m_rightLayoutOverflow = std::max(rect.right(), m_rightLayoutOverflow);
+}
+
+inline void RenderOverflow::addVisualOverflow(const IntRect& rect)
+{
+    m_topVisualOverflow = std::min(rect.y(), m_topVisualOverflow);
+    m_bottomVisualOverflow = std::max(rect.bottom(), m_bottomVisualOverflow);
+    m_leftVisualOverflow = std::min(rect.x(), m_leftVisualOverflow);
+    m_rightVisualOverflow = std::max(rect.right(), m_rightVisualOverflow);
+}
+
+inline void RenderOverflow::resetLayoutOverflow(const IntRect& rect)
+{
+    m_topLayoutOverflow = rect.y();
+    m_bottomLayoutOverflow = rect.bottom();
+    m_leftLayoutOverflow = rect.x();
+    m_rightLayoutOverflow = rect.right();
+}
+
+} // namespace WebCore
+
+#endif // RenderOverflow_h
diff --git a/WebCore/rendering/RenderPartObject.cpp b/WebCore/rendering/RenderPartObject.cpp
index 72298c6..cba341b 100644
--- a/WebCore/rendering/RenderPartObject.cpp
+++ b/WebCore/rendering/RenderPartObject.cpp
@@ -33,8 +33,8 @@
 #include "HTMLParamElement.h"
 #include "MIMETypeRegistry.h"
 #include "Page.h"
-#include "PluginData.h"
 #include "RenderView.h"
+#include "RenderWidgetProtector.h"
 #include "Text.h"
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
@@ -90,25 +90,12 @@ static ClassIdToTypeMap* createClassIdToTypeMap()
     map->add("clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA", "audio/x-pn-realaudio-plugin");
     map->add("clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B", "video/quicktime");
     map->add("clsid:166B1BCA-3F9C-11CF-8075-444553540000", "application/x-director");
-#if ENABLE(ACTIVEX_TYPE_CONVERSION_WMPLAYER)
     map->add("clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6", "application/x-mplayer2");
     map->add("clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95", "application/x-mplayer2");
-#endif
     return map;
 }
 
-static const String& activeXType()
-{
-    DEFINE_STATIC_LOCAL(String, activeXType, ("application/x-oleobject"));
-    return activeXType;
-}
-
-static inline bool havePlugin(const PluginData* pluginData, const String& type)
-{
-    return pluginData && !type.isEmpty() && pluginData->supportsMimeType(type);
-}
-
-static String serviceTypeForClassId(const String& classId, const PluginData* pluginData)
+static String serviceTypeForClassId(const String& classId)
 {
     // Return early if classId is empty (since we won't do anything below).
     // Furthermore, if classId is null, calling get() below will crash.
@@ -116,30 +103,7 @@ static String serviceTypeForClassId(const String& classId, const PluginData* plu
         return String();
 
     static ClassIdToTypeMap* map = createClassIdToTypeMap();
-    String type = map->get(classId);
-
-    // If we do have a plug-in that supports generic ActiveX content and don't have a plug-in
-    // for the MIME type we came up with, ignore the MIME type we came up with and just use
-    // the ActiveX type.
-    if (havePlugin(pluginData, activeXType()) && !havePlugin(pluginData, type))
-        return activeXType();
-
-    return type;
-}
-
-static inline bool shouldUseEmbedDescendant(HTMLObjectElement* objectElement, const PluginData* pluginData)
-{
-#if PLATFORM(MAC)
-    UNUSED_PARAM(objectElement);
-    UNUSED_PARAM(pluginData);
-    // On Mac, we always want to use the embed descendant.
-    return true;
-#else
-    // If we have both an <object> and <embed>, we always want to use the <embed> except when we have
-    // an ActiveX plug-in and plan to use it.
-    return !(havePlugin(pluginData, activeXType())
-        && serviceTypeForClassId(objectElement->classId(), pluginData) == activeXType());
-#endif
+    return map->get(classId);
 }
 
 static void mapDataParamToSrc(Vector<String>* paramNames, Vector<String>* paramValues)
@@ -168,6 +132,12 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
     Vector<String> paramValues;
     Frame* frame = frameView()->frame();
 
+    // The calls to FrameLoader::requestObject within this function can result in a plug-in being initialized.
+    // This can run cause arbitrary JavaScript to run and may result in this RenderObject being detached from
+    // the render tree and destroyed, causing a crash like <rdar://problem/6954546>.  By extending our lifetime
+    // artifically to ensure that we remain alive for the duration of plug-in initialization.
+    RenderWidgetProtector protector(this);
+
     if (node()->hasTagName(objectTag)) {
         HTMLObjectElement* o = static_cast<HTMLObjectElement*>(node());
 
@@ -177,17 +147,14 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         // Check for a child EMBED tag.
         HTMLEmbedElement* embed = 0;
-        const PluginData* pluginData = frame->page()->pluginData();
-        if (shouldUseEmbedDescendant(o, pluginData)) {
-            for (Node* child = o->firstChild(); child; ) {
-                if (child->hasTagName(embedTag)) {
-                    embed = static_cast<HTMLEmbedElement*>(child);
-                    break;
-                } else if (child->hasTagName(objectTag))
-                    child = child->nextSibling();         // Don't descend into nested OBJECT tags
-                else
-                    child = child->traverseNextNode(o);   // Otherwise descend (EMBEDs may be inside COMMENT tags)
-            }
+        for (Node* child = o->firstChild(); child; ) {
+            if (child->hasTagName(embedTag)) {
+                embed = static_cast<HTMLEmbedElement*>(child);
+                break;
+            } else if (child->hasTagName(objectTag))
+                child = child->nextSibling();         // Don't descend into nested OBJECT tags
+            else
+                child = child->traverseNextNode(o);   // Otherwise descend (EMBEDs may be inside COMMENT tags)
         }
 
         // Use the attributes from the EMBED tag instead of the OBJECT tag including WIDTH and HEIGHT.
@@ -260,7 +227,7 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         // If we still don't have a type, try to map from a specific CLASSID to a type.
         if (serviceType.isEmpty())
-            serviceType = serviceTypeForClassId(o->classId(), pluginData);
+            serviceType = serviceTypeForClassId(o->classId());
 
         if (!isURLAllowed(document(), url))
             return;
@@ -282,7 +249,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
                 return;
         }
 
-        bool success = frame->loader()->requestObject(this, url, AtomicString(o->name()), serviceType, paramNames, paramValues);
+        bool success = o->dispatchBeforeLoadEvent(url) &&
+                       frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
         if (!success && m_hasFallbackContent)
             o->renderFallbackContent();
     } else if (node()->hasTagName(embedTag)) {
@@ -316,7 +284,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         }
 
-        frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
+        if (o->dispatchBeforeLoadEvent(url))
+            frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
     }
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)        
     else if (node()->hasTagName(videoTag) || node()->hasTagName(audioTag)) {
@@ -339,7 +308,9 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
         }
 
         serviceType = "application/x-media-element-proxy-plugin";
-        frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
+        
+        if (o->dispatchBeforeLoadEvent(url))
+            frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
     }
 #endif
 }
@@ -425,12 +396,18 @@ void RenderPartObject::layout()
 #else
     calcWidth();
     calcHeight();
+<<<<<<< HEAD:WebCore/rendering/RenderPartObject.cpp
 #endif
 
     adjustOverflowForBoxShadowAndReflect();
+=======
+>>>>>>> webkit.org at 49305:WebCore/rendering/RenderPartObject.cpp
 
     RenderPart::layout();
 
+    m_overflow.clear();
+    addShadowOverflow();
+
     if (!widget() && frameView())
         frameView()->addWidgetToUpdate(this);
 
diff --git a/WebCore/rendering/RenderReplaced.cpp b/WebCore/rendering/RenderReplaced.cpp
index 692a66e..27d2e72 100644
--- a/WebCore/rendering/RenderReplaced.cpp
+++ b/WebCore/rendering/RenderReplaced.cpp
@@ -34,9 +34,6 @@ using namespace std;
 
 namespace WebCore {
 
-typedef WTF::HashMap<const RenderReplaced*, IntRect> OverflowRectMap;
-static OverflowRectMap* gOverflowRectMap = 0;
-
 const int cDefaultWidth = 300;
 const int cDefaultHeight = 150;
 
@@ -56,8 +53,6 @@ RenderReplaced::RenderReplaced(Node* node, const IntSize& intrinsicSize)
 
 RenderReplaced::~RenderReplaced()
 {
-    if (replacedHasOverflow())
-        gOverflowRectMap->remove(this);
 }
 
 void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
@@ -66,7 +61,7 @@ void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* old
 
     bool hadStyle = (oldStyle != 0);
     float oldZoom = hadStyle ? oldStyle->effectiveZoom() : RenderStyle::initialZoom();
-    if (hadStyle && style() && style()->effectiveZoom() != oldZoom)
+    if (style() && style()->effectiveZoom() != oldZoom)
         intrinsicSizeChanged();
 }
 
@@ -77,10 +72,12 @@ void RenderReplaced::layout()
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
     
     setHeight(minimumReplacedHeight());
-    
+
     calcWidth();
     calcHeight();
-    adjustOverflowForBoxShadowAndReflect();
+
+    m_overflow.clear();
+    addShadowOverflow();
     
     repainter.repaintAfterLayout();    
 
@@ -127,21 +124,29 @@ void RenderReplaced::paint(PaintInfo& paintInfo, int tx, int ty)
         drawSelectionTint = false;
     }
 
+    bool completelyClippedOut = false;
     if (style()->hasBorderRadius()) {
-        // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
-        paintInfo.context->save();
-        
-        IntSize topLeft, topRight, bottomLeft, bottomRight;
         IntRect borderRect = IntRect(tx, ty, width(), height());
-        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
 
-        paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+        if (borderRect.isEmpty())
+            completelyClippedOut = true;
+        else {
+            // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
+            paintInfo.context->save();
+            
+            IntSize topLeft, topRight, bottomLeft, bottomRight;
+            style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+            paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+        }
     }
 
-    paintReplaced(paintInfo, tx, ty);
+    if (!completelyClippedOut) {
+        paintReplaced(paintInfo, tx, ty);
 
-    if (style()->hasBorderRadius())
-        paintInfo.context->restore();
+        if (style()->hasBorderRadius())
+            paintInfo.context->restore();
+    }
         
     // The selection tint never gets clipped by border-radius rounding, since we want it to run right up to the edges of
     // surrounding content.
@@ -169,8 +174,8 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, int& tx, int& ty)
     int currentTY = ty + y();
 
     // Early exit if the element touches the edges.
-    int top = currentTY + overflowTop();
-    int bottom = currentTY + overflowHeight();
+    int top = currentTY + topVisibleOverflow();
+    int bottom = currentTY + bottomVisibleOverflow();
     if (isSelected() && m_inlineBoxWrapper) {
         int selTop = ty + m_inlineBoxWrapper->root()->selectionTop();
         int selBottom = ty + selTop + m_inlineBoxWrapper->root()->selectionHeight();
@@ -179,7 +184,7 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, int& tx, int& ty)
     }
     
     int os = 2 * maximalOutlineSize(paintInfo.phase);
-    if (currentTX + overflowLeft() >= paintInfo.rect.right() + os || currentTX + overflowWidth() <= paintInfo.rect.x() - os)
+    if (currentTX + leftVisibleOverflow() >= paintInfo.rect.right() + os || currentTX + rightVisibleOverflow() <= paintInfo.rect.x() - os)
         return false;
     if (top >= paintInfo.rect.bottom() + os || bottom <= paintInfo.rect.y() - os)
         return false;
@@ -231,8 +236,8 @@ VisiblePosition RenderReplaced::positionForPoint(const IntPoint& point)
 
     RootInlineBox* root = box->root();
 
-    int top = root->topOverflow();
-    int bottom = root->nextRootBox() ? root->nextRootBox()->topOverflow() : root->bottomOverflow();
+    int top = root->lineTop();
+    int bottom = root->nextRootBox() ? root->nextRootBox()->lineTop() : root->lineBottom();
 
     if (point.y() + y() < top)
         return createVisiblePosition(caretMinOffset(), DOWNSTREAM); // coordinates are above
@@ -327,82 +332,6 @@ void RenderReplaced::setIntrinsicSize(const IntSize& size)
     m_intrinsicSize = size;
 }
 
-void RenderReplaced::adjustOverflowForBoxShadowAndReflect()
-{
-    IntRect overflow;
-    for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-        if (boxShadow->style == Inset)
-            continue;
-        IntRect shadow = borderBoxRect();
-        shadow.move(boxShadow->x, boxShadow->y);
-        shadow.inflate(boxShadow->blur + boxShadow->spread);
-        overflow.unite(shadow);
-    }
-
-    // Now that we have an overflow rect including shadow, let's make sure that
-    // the reflection (which can also include the shadow) is also included.
-    if (hasReflection()) {
-        if (overflow.isEmpty())
-            overflow = borderBoxRect();
-        overflow.unite(reflectedRect(overflow));
-    }
-
-    if (!overflow.isEmpty()) {
-        if (!gOverflowRectMap)
-            gOverflowRectMap = new OverflowRectMap();
-        overflow.unite(borderBoxRect());
-        gOverflowRectMap->set(this, overflow);
-        setReplacedHasOverflow(true);
-    } else if (replacedHasOverflow()) {
-        gOverflowRectMap->remove(this);
-        setReplacedHasOverflow(false);
-    }
-}
-
-int RenderReplaced::overflowHeight(bool) const
-{
-    if (replacedHasOverflow()) {
-        IntRect *r = &gOverflowRectMap->find(this)->second;
-        return r->height() + r->y();
-    }
-
-    return height();
-}
-
-int RenderReplaced::overflowWidth(bool) const
-{
-    if (replacedHasOverflow()) {
-        IntRect *r = &gOverflowRectMap->find(this)->second;
-        return r->width() + r->x();
-    }
-
-    return width();
-}
-
-int RenderReplaced::overflowLeft(bool) const
-{
-    if (replacedHasOverflow())
-        return gOverflowRectMap->get(this).x();
-
-    return 0;
-}
-
-int RenderReplaced::overflowTop(bool) const
-{
-    if (replacedHasOverflow())
-        return gOverflowRectMap->get(this).y();
-
-    return 0;
-}
-
-IntRect RenderReplaced::overflowRect(bool) const
-{
-    if (replacedHasOverflow())
-        return gOverflowRectMap->find(this)->second;
-
-    return borderBoxRect();
-}
-
 IntRect RenderReplaced::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     if (style()->visibility() != VISIBLE && !enclosingLayer()->hasVisibleContent())
@@ -410,7 +339,7 @@ IntRect RenderReplaced::clippedOverflowRectForRepaint(RenderBoxModelObject* repa
 
     // The selectionRect can project outside of the overflowRect, so take their union
     // for repainting to avoid selection painting glitches.
-    IntRect r = unionRect(localSelectionRect(false), overflowRect(false));
+    IntRect r = unionRect(localSelectionRect(false), visibleOverflowRect());
 
     RenderView* v = view();
     if (v) {
diff --git a/WebCore/rendering/RenderReplaced.h b/WebCore/rendering/RenderReplaced.h
index 70ad4f2..0ba6b8a 100644
--- a/WebCore/rendering/RenderReplaced.h
+++ b/WebCore/rendering/RenderReplaced.h
@@ -65,12 +65,6 @@ private:
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual void paintReplaced(PaintInfo&, int /*tx*/, int /*ty*/) { }
 
-    virtual int overflowHeight(bool includeInterior = true) const;
-    virtual int overflowWidth(bool includeInterior = true) const;
-    virtual int overflowLeft(bool includeInterior = true) const;
-    virtual int overflowTop(bool includeInterior = true) const;
-    virtual IntRect overflowRect(bool includeInterior = true) const;
-
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
 
     virtual unsigned caretMaxRenderedOffset() const;
diff --git a/WebCore/rendering/RenderScrollbar.cpp b/WebCore/rendering/RenderScrollbar.cpp
index b3c5369..63fce8d 100644
--- a/WebCore/rendering/RenderScrollbar.cpp
+++ b/WebCore/rendering/RenderScrollbar.cpp
@@ -40,6 +40,16 @@ RenderScrollbar::RenderScrollbar(ScrollbarClient* client, ScrollbarOrientation o
     : Scrollbar(client, orientation, RegularScrollbar, RenderScrollbarTheme::renderScrollbarTheme())
     , m_owner(renderer)
 {
+    // FIXME: We need to do this because RenderScrollbar::styleChanged is called as soon as the scrollbar is created.
+    
+    // Update the scrollbar size.
+    updateScrollbarPart(ScrollbarBGPart);
+    RenderScrollbarPart* part = m_parts.get(ScrollbarBGPart);
+    if (!part)
+        return;
+
+    part->layout();
+    setFrameRect(IntRect(0, 0, part->width(), part->height()));
 }
 
 RenderScrollbar::~RenderScrollbar()
diff --git a/WebCore/rendering/RenderScrollbarPart.cpp b/WebCore/rendering/RenderScrollbarPart.cpp
index 0f29aeb..c83248a 100644
--- a/WebCore/rendering/RenderScrollbarPart.cpp
+++ b/WebCore/rendering/RenderScrollbarPart.cpp
@@ -27,6 +27,7 @@
 #include "RenderScrollbarPart.h"
 #include "RenderScrollbar.h"
 #include "RenderScrollbarTheme.h"
+#include "RenderView.h"
 
 using namespace std;
 
@@ -51,9 +52,6 @@ void RenderScrollbarPart::layout()
     else
         layoutVerticalPart();
 
-    m_overflowWidth = max(width(), m_overflowWidth);
-    m_overflowHeight = max(height(), m_overflowHeight);
-    
     setNeedsLayout(false);
 }
 
@@ -143,8 +141,16 @@ void RenderScrollbarPart::imageChanged(WrappedImagePtr image, const IntRect* rec
 {
     if (m_scrollbar && m_part != NoPart)
         m_scrollbar->theme()->invalidatePart(m_scrollbar, m_part);
-    else
+    else {
+        if (FrameView* frameView = view()->frameView()) {
+            if (frameView->isFrameViewScrollCorner(this)) {
+                frameView->invalidateScrollCorner();
+                return;
+            }
+        }
+        
         RenderBlock::imageChanged(image, rect);
+    }
 }
 
 void RenderScrollbarPart::paintIntoRect(GraphicsContext* graphicsContext, int tx, int ty, const IntRect& rect)
@@ -153,8 +159,6 @@ void RenderScrollbarPart::paintIntoRect(GraphicsContext* graphicsContext, int tx
     setLocation(rect.x() - tx, rect.y() - ty);
     setWidth(rect.width());
     setHeight(rect.height());
-    setOverflowWidth(max(rect.width(), overflowWidth()));
-    setOverflowHeight(max(rect.height(), overflowHeight()));
 
     if (graphicsContext->paintingDisabled())
         return;
diff --git a/WebCore/rendering/RenderSlider.cpp b/WebCore/rendering/RenderSlider.cpp
index 8a19d97..c8b60fd 100644
--- a/WebCore/rendering/RenderSlider.cpp
+++ b/WebCore/rendering/RenderSlider.cpp
@@ -54,7 +54,7 @@ static const int defaultTrackLength = 129;
 struct SliderRange {
     bool isIntegral;
     double minimum;
-    double maximum;
+    double maximum;  // maximum must be >= minimum.
 
     explicit SliderRange(HTMLInputElement*);
     double clampValue(double value);
@@ -84,12 +84,8 @@ SliderRange::SliderRange(HTMLInputElement* element)
 
     isIntegral = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
 
-    // FIXME: This treats maximum strings that can't be parsed as 0, but perhaps 100 would be more appropriate.
-    const AtomicString& maxString = element->getAttribute(maxAttr);
-    maximum = maxString.isNull() ? 100.0 : maxString.toDouble();
-
-    // If the maximum is smaller, use it as the minimum.
-    minimum = min(element->getAttribute(minAttr).toDouble(), maximum);
+    maximum = element->rangeMaximum();
+    minimum = element->rangeMinimum();
 }
 
 double SliderRange::clampValue(double value)
@@ -100,12 +96,14 @@ double SliderRange::clampValue(double value)
 
 double SliderRange::valueFromElement(HTMLInputElement* element, bool* wasClamped)
 {
-    String valueString = element->value();
-    double oldValue = valueString.isNull() ? (minimum + maximum) / 2 : valueString.toDouble();
+    double oldValue;
+    bool parseSuccess = HTMLInputElement::formStringToDouble(element->value(), &oldValue);
+    if (!parseSuccess)
+        oldValue = (minimum + maximum) / 2;
     double newValue = clampValue(oldValue);
 
     if (wasClamped)
-        *wasClamped = valueString.isNull() || newValue != oldValue;
+        *wasClamped = !parseSuccess || newValue != oldValue;
 
     return newValue;
 }
@@ -285,6 +283,8 @@ PassRefPtr<RenderStyle> RenderSlider::createThumbStyle(const RenderStyle* parent
         style->setAppearance(SliderThumbHorizontalPart);
     else if (parentStyle->appearance() == MediaSliderPart)
         style->setAppearance(MediaSliderThumbPart);
+    else if (parentStyle->appearance() == MediaVolumeSliderPart)
+        style->setAppearance(MediaVolumeSliderThumbPart);
 
     return style.release();
 }
@@ -302,7 +302,7 @@ IntRect RenderSlider::thumbRect()
 
     double fraction = sliderPosition(static_cast<HTMLInputElement*>(node()));
     IntRect contentRect = contentBoxRect();
-    if (style()->appearance() == SliderVerticalPart) {
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart) {
         thumbRect.setX(contentRect.x() + (contentRect.width() - thumbRect.width()) / 2);
         thumbRect.setY(contentRect.y() + static_cast<int>(nextafter((contentRect.height() - thumbRect.height()) + 1, 0) * (1 - fraction)));
     } else {
@@ -340,8 +340,6 @@ void RenderSlider::layout()
     calcWidth();
     calcHeight();
 
-    IntRect overflowRect(IntPoint(), size());
-
     if (thumb) {
         if (oldSize != size())
             thumb->setChildNeedsLayout(true, false);
@@ -358,18 +356,9 @@ void RenderSlider::layout()
             thumb->repaintDuringLayoutIfMoved(oldThumbRect);
 
         statePusher.pop();
-
-        IntRect thumbOverflowRect = thumb->overflowRect();
-        thumbOverflowRect.move(thumb->x(), thumb->y());
-        overflowRect.unite(thumbOverflowRect);
     }
 
-    // FIXME: m_overflowWidth and m_overflowHeight should be renamed
-    // m_overflowRight and m_overflowBottom.
-    m_overflowLeft = overflowRect.x();
-    m_overflowTop = overflowRect.y();
-    m_overflowWidth = overflowRect.right();
-    m_overflowHeight = overflowRect.bottom();
+    addOverflowFromChild(thumb);
 
     repainter.repaintAfterLayout();    
 
@@ -406,7 +395,7 @@ bool RenderSlider::mouseEventIsInThumb(MouseEvent* evt)
         return false;
 
 #if ENABLE(VIDEO)
-    if (style()->appearance() == MediaSliderPart) {
+    if (style()->appearance() == MediaSliderPart || style()->appearance() == MediaVolumeSliderPart) {
         MediaControlInputElement *sliderThumb = static_cast<MediaControlInputElement*>(m_thumb->renderer()->node());
         return sliderThumb->hitTest(evt->absoluteLocation());
     }
@@ -438,7 +427,7 @@ void RenderSlider::setValueForPosition(int position)
     // Calculate the new value based on the position, and send it to the element.
     SliderRange range(element);
     double fraction = static_cast<double>(position) / trackSize();
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         fraction = 1 - fraction;
     double value = range.clampValue(range.valueFromProportion(fraction));
     element->setValueFromRenderer(String::number(value));
@@ -459,7 +448,7 @@ int RenderSlider::positionForOffset(const IntPoint& p)
         return 0;
 
     int position;
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         position = p.y() - m_thumb->renderBox()->height() / 2;
     else
         position = p.x() - m_thumb->renderBox()->width() / 2;
@@ -472,7 +461,7 @@ int RenderSlider::currentPosition()
     ASSERT(m_thumb);
     ASSERT(m_thumb->renderer());
 
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         return toRenderBox(m_thumb->renderer())->y() - contentBoxRect().y();
     return toRenderBox(m_thumb->renderer())->x() - contentBoxRect().x();
 }
@@ -482,7 +471,7 @@ int RenderSlider::trackSize()
     ASSERT(m_thumb);
     ASSERT(m_thumb->renderer());
 
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         return contentHeight() - m_thumb->renderBox()->height();
     return contentWidth() - m_thumb->renderBox()->width();
 }
diff --git a/WebCore/rendering/RenderTable.cpp b/WebCore/rendering/RenderTable.cpp
index 7599999..0acaa43 100644
--- a/WebCore/rendering/RenderTable.cpp
+++ b/WebCore/rendering/RenderTable.cpp
@@ -265,8 +265,8 @@ void RenderTable::layout()
     LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()));
 
     setHeight(0);
-    m_overflowHeight = 0;
-    m_overflowTop = 0;
+    m_overflow.clear();
+
     initMaxMarginValues();
     
 #ifdef ANDROID_LAYOUT
@@ -354,9 +354,6 @@ void RenderTable::layout()
     if (m_caption)
         m_caption->layoutIfNeeded();
 
-    m_overflowWidth = width() + (collapsing ? outerBorderRight() - borderRight() : 0);
-    m_overflowLeft = collapsing ? borderLeft() - outerBorderLeft() : 0;
-
     // If any table section moved vertically, we will just repaint everything from that
     // section down (it is quite unlikely that any of the following sections
     // did not shift).
@@ -372,10 +369,6 @@ void RenderTable::layout()
             m_caption->repaintDuringLayoutIfMoved(captionRect);
 
         setHeight(height() + m_caption->height() + m_caption->marginTop() + m_caption->marginBottom());
-        m_overflowLeft = min(m_overflowLeft, m_caption->x() + m_caption->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, m_caption->x() + m_caption->overflowWidth(false));
-        m_overflowTop = min(m_overflowTop, m_caption->y() + m_caption->overflowTop(false));
-        m_overflowHeight = max(m_overflowHeight, m_caption->y() + m_caption->overflowHeight(false));
 
         if (height() != oldTableTop) {
             sectionMoved = true;
@@ -421,15 +414,11 @@ void RenderTable::layout()
     while (section) {
         if (!sectionMoved && section->y() != height()) {
             sectionMoved = true;
-            movedSectionTop = min(height(), section->y()) + section->overflowTop(false);
+            movedSectionTop = min(height(), section->y()) + section->topVisibleOverflow();
         }
         section->setLocation(bl, height());
 
         setHeight(height() + section->height());
-        m_overflowLeft = min(m_overflowLeft, section->x() + section->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, section->x() + section->overflowWidth(false));
-        m_overflowTop = min(m_overflowTop, section->y() + section->overflowTop(false));
-        m_overflowHeight = max(m_overflowHeight, section->y() + section->overflowHeight(false));
         section = sectionBelow(section);
     }
 
@@ -443,37 +432,34 @@ void RenderTable::layout()
             m_caption->repaintDuringLayoutIfMoved(captionRect);
 
         setHeight(height() + m_caption->height() + m_caption->marginTop() + m_caption->marginBottom());
-        m_overflowLeft = min(m_overflowLeft, m_caption->x() + m_caption->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, m_caption->x() + m_caption->overflowWidth(false));
     }
 
     if (isPositioned())
         calcHeight();
 
-    m_overflowHeight = max(m_overflowHeight, height());
-
     // table can be containing block of positioned elements.
     // FIXME: Only pass true if width or height changed.
     layoutPositionedObjects(true);
 
-    if (!hasOverflowClip()) {
-        int shadowLeft;
-        int shadowRight;
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
-
-        m_overflowLeft = min(m_overflowLeft, shadowLeft);
-        m_overflowWidth = max(m_overflowWidth, width() + shadowRight);
-        m_overflowTop = min(m_overflowTop, shadowTop);
-        m_overflowHeight = max(m_overflowHeight, height() + shadowBottom);
-
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            m_overflowTop = min(m_overflowTop, reflection.y());
-            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
-            m_overflowLeft = min(m_overflowLeft, reflection.x());
-            m_overflowHeight = max(m_overflowWidth, reflection.right());
+    // Add overflow from borders.
+    int rightBorderOverflow = width() + (collapsing ? outerBorderRight() - borderRight() : 0);
+    int leftBorderOverflow = collapsing ? borderLeft() - outerBorderLeft() : 0;
+    int bottomBorderOverflow = height() + (collapsing ? outerBorderBottom() - borderBottom() : 0);
+    int topBorderOverflow = collapsing ? borderTop() - outerBorderTop() : 0;
+    addLayoutOverflow(IntRect(leftBorderOverflow, topBorderOverflow, rightBorderOverflow - leftBorderOverflow, bottomBorderOverflow - topBorderOverflow));
+    
+    // Add visual overflow from box-shadow and reflections.
+    addShadowOverflow();
+    
+    // Add overflow from our caption.
+    if (m_caption)
+        addOverflowFromChild(m_caption);
+
+    // Add overflow from our sections.
+    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
+        if (child->isTableSection()) {
+            RenderTableSection* section = toRenderTableSection(child);
+            addOverflowFromChild(section);
         }
     }
 
@@ -482,7 +468,7 @@ void RenderTable::layout()
     bool didFullRepaint = repainter.repaintAfterLayout();
     // Repaint with our new bounds if they are different from our old bounds.
     if (!didFullRepaint && sectionMoved)
-        repaintRectangle(IntRect(m_overflowLeft, movedSectionTop, m_overflowWidth - m_overflowLeft, m_overflowHeight - movedSectionTop));
+        repaintRectangle(IntRect(leftVisibleOverflow(), movedSectionTop, rightVisibleOverflow() - leftVisibleOverflow(), bottomVisibleOverflow() - movedSectionTop));
     
     setNeedsLayout(false);
 }
@@ -503,9 +489,9 @@ void RenderTable::paint(PaintInfo& paintInfo, int tx, int ty)
     PaintPhase paintPhase = paintInfo.phase;
 
     int os = 2 * maximalOutlineSize(paintPhase);
-    if (ty + overflowTop(false) >= paintInfo.rect.bottom() + os || ty + overflowHeight(false) <= paintInfo.rect.y() - os)
+    if (ty + topVisibleOverflow() >= paintInfo.rect.bottom() + os || ty + bottomVisibleOverflow() <= paintInfo.rect.y() - os)
         return;
-    if (tx + overflowLeft(false) >= paintInfo.rect.right() + os || tx + overflowWidth(false) <= paintInfo.rect.x() - os)
+    if (tx + leftVisibleOverflow() >= paintInfo.rect.right() + os || tx + rightVisibleOverflow() <= paintInfo.rect.x() - os)
         return;
 
     bool pushedClip = pushContentsClip(paintInfo, tx, ty);    
diff --git a/WebCore/rendering/RenderTableCell.cpp b/WebCore/rendering/RenderTableCell.cpp
index 8b7a068..8e0b613 100644
--- a/WebCore/rendering/RenderTableCell.cpp
+++ b/WebCore/rendering/RenderTableCell.cpp
@@ -207,9 +207,9 @@ IntRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
             right = max(right, below->borderHalfRight(true));
         }
     }
-    left = max(left, -overflowLeft(false));
-    top = max(top, -overflowTop(false));
-    IntRect r(-left, - top, left + max(width() + right, overflowWidth(false)), top + max(height() + bottom, overflowHeight(false)));
+    left = max(left, -leftVisibleOverflow());
+    top = max(top, -topVisibleOverflow());
+    IntRect r(-left, - top, left + max(width() + right, rightVisibleOverflow()), top + max(height() + bottom, bottomVisibleOverflow()));
 
     if (RenderView* v = view()) {
         // FIXME: layoutDelta needs to be applied in parts before/after transforms and
diff --git a/WebCore/rendering/RenderTableSection.cpp b/WebCore/rendering/RenderTableSection.cpp
index 5d47357..1e087f6 100644
--- a/WebCore/rendering/RenderTableSection.cpp
+++ b/WebCore/rendering/RenderTableSection.cpp
@@ -55,10 +55,6 @@ RenderTableSection::RenderTableSection(Node* node)
     , m_outerBorderRight(0)
     , m_outerBorderTop(0)
     , m_outerBorderBottom(0)
-    , m_overflowLeft(0)
-    , m_overflowWidth(0)
-    , m_overflowTop(0)
-    , m_overflowHeight(0)
     , m_needsCellRecalc(false)
     , m_hasOverflowingCell(false)
 {
@@ -501,10 +497,7 @@ int RenderTableSection::layoutRows(int toAdd)
     
     // Set the width of our section now.  The rows will also be this width.
     setWidth(table()->contentWidth());
-    m_overflowLeft = 0;
-    m_overflowWidth = width();
-    m_overflowTop = 0;
-    m_overflowHeight = 0;
+    m_overflow.clear();
     m_hasOverflowingCell = false;
 
     if (toAdd && totalRows && (m_rowPos[totalRows] || !nextSibling())) {
@@ -705,12 +698,6 @@ int RenderTableSection::layoutRows(int toAdd)
             } else
                 cell->setLocation(table()->columnPositions()[c] + hspacing, m_rowPos[rindx]);
 
-            m_overflowLeft = min(m_overflowLeft, cell->x() + cell->overflowLeft(false));
-            m_overflowWidth = max(m_overflowWidth, cell->x() + cell->overflowWidth(false));
-            m_overflowTop = min(m_overflowTop, cell->y() + cell->overflowTop(false));
-            m_overflowHeight = max(m_overflowHeight, cell->y() + cell->overflowHeight(false));
-            m_hasOverflowingCell |= cell->overflowLeft(false) || cell->overflowWidth(false) > cell->width() || cell->overflowTop(false) || cell->overflowHeight(false) > cell->height();
-
             // If the cell moved, we have to repaint it as well as any floating/positioned
             // descendants.  An exception is if we need a layout.  In this case, we know we're going to
             // repaint ourselves (and the cell) anyway.
@@ -725,10 +712,23 @@ int RenderTableSection::layoutRows(int toAdd)
 
     ASSERT(!needsLayout());
 
+    setHeight(m_rowPos[totalRows]);
+
+    // Now that our height has been determined, add in overflow from cells.
+    for (int r = 0; r < totalRows; r++) {
+        for (int c = 0; c < nEffCols; c++) {
+            RenderTableCell* cell = cellAt(r, c).cell;
+            if (!cell)
+                continue;
+            if (r < totalRows - 1 && cell == cellAt(r + 1, c).cell)
+                continue;
+            addOverflowFromChild(cell);
+        }
+    }
+    m_hasOverflowingCell = m_overflow;
+    
     statePusher.pop();
 
-    setHeight(m_rowPos[totalRows]);
-    m_overflowHeight = max(m_overflowHeight, height());
     return height();
 }
 
diff --git a/WebCore/rendering/RenderTableSection.h b/WebCore/rendering/RenderTableSection.h
index c0098bc..9f6d5ea 100644
--- a/WebCore/rendering/RenderTableSection.h
+++ b/WebCore/rendering/RenderTableSection.h
@@ -73,11 +73,6 @@ public:
     void appendColumn(int pos);
     void splitColumn(int pos, int newSize);
 
-    virtual int overflowWidth(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? width() : m_overflowWidth; }
-    virtual int overflowLeft(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? 0 : m_overflowLeft; }
-    virtual int overflowHeight(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? height() : m_overflowHeight; }
-    virtual int overflowTop(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? 0 : m_overflowTop; }
-
     int calcOuterBorderTop() const;
     int calcOuterBorderBottom() const;
     int calcOuterBorderLeft(bool rtl) const;
@@ -152,10 +147,6 @@ private:
     int m_outerBorderRight;
     int m_outerBorderTop;
     int m_outerBorderBottom;
-    int m_overflowLeft;
-    int m_overflowWidth;
-    int m_overflowTop;
-    int m_overflowHeight;
 
     bool m_needsCellRecalc;
     bool m_hasOverflowingCell;
diff --git a/WebCore/rendering/RenderText.cpp b/WebCore/rendering/RenderText.cpp
index ada3961..40c3d75 100644
--- a/WebCore/rendering/RenderText.cpp
+++ b/WebCore/rendering/RenderText.cpp
@@ -207,7 +207,7 @@ void RenderText::deleteTextBoxes()
 PassRefPtr<StringImpl> RenderText::originalText() const
 {
     Node* e = node();
-    return e ? static_cast<Text*>(e)->string() : 0;
+    return e ? static_cast<Text*>(e)->dataImpl() : 0;
 }
 
 void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
@@ -328,13 +328,13 @@ VisiblePosition RenderText::positionForPoint(const IntPoint& point)
     int offset;
 
     // FIXME: We should be able to roll these special cases into the general cases in the loop below.
-    if (firstTextBox() && point.y() <  firstTextBox()->root()->bottomOverflow() && point.x() < firstTextBox()->m_x) {
+    if (firstTextBox() && point.y() <  firstTextBox()->root()->lineBottom() && point.x() < firstTextBox()->m_x) {
         // at the y coordinate of the first line or above
         // and the x coordinate is to the left of the first text box left edge
         offset = firstTextBox()->offsetForPosition(point.x());
         return createVisiblePosition(offset + firstTextBox()->start(), DOWNSTREAM);
     }
-    if (lastTextBox() && point.y() >= lastTextBox()->root()->topOverflow() && point.x() >= lastTextBox()->m_x + lastTextBox()->m_width) {
+    if (lastTextBox() && point.y() >= lastTextBox()->root()->lineTop() && point.x() >= lastTextBox()->m_x + lastTextBox()->m_width) {
         // at the y coordinate of the last line or below
         // and the x coordinate is to the right of the last text box right edge
         offset = lastTextBox()->offsetForPosition(point.x());
@@ -343,8 +343,8 @@ VisiblePosition RenderText::positionForPoint(const IntPoint& point)
 
     InlineTextBox* lastBoxAbove = 0;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
-        if (point.y() >= box->root()->topOverflow()) {
-            int bottom = box->root()->nextRootBox() ? box->root()->nextRootBox()->topOverflow() : box->root()->bottomOverflow();
+        if (point.y() >= box->root()->lineTop()) {
+            int bottom = box->root()->nextRootBox() ? box->root()->nextRootBox()->lineTop() : box->root()->lineBottom();
             if (point.y() < bottom) {
                 offset = box->offsetForPosition(point.x());
 
@@ -387,8 +387,8 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
 
     InlineTextBox* box = static_cast<InlineTextBox*>(inlineBox);
 
-    int height = box->root()->bottomOverflow() - box->root()->topOverflow();
-    int top = box->root()->topOverflow();
+    int height = box->root()->lineBottom() - box->root()->lineTop();
+    int top = box->root()->lineTop();
 
     int left = box->positionForOffset(caretOffset);
 
diff --git a/WebCore/rendering/RenderTextControl.cpp b/WebCore/rendering/RenderTextControl.cpp
index 70b6518..bcb2455 100644
--- a/WebCore/rendering/RenderTextControl.cpp
+++ b/WebCore/rendering/RenderTextControl.cpp
@@ -67,8 +67,9 @@ static Color disabledTextColor(const Color& textColor, const Color& backgroundCo
     return disabledColor;
 }
 
-RenderTextControl::RenderTextControl(Node* node)
+RenderTextControl::RenderTextControl(Node* node, bool placeholderVisible)
     : RenderBlock(node)
+    , m_placeholderVisible(placeholderVisible)
     , m_edited(false)
     , m_userEdited(false)
 {
@@ -92,14 +93,22 @@ void RenderTextControl::styleDidChange(StyleDifference diff, const RenderStyle*
         // Reset them now to avoid getting a spurious layout hint.
         textBlockRenderer->style()->setHeight(Length());
         textBlockRenderer->style()->setWidth(Length());
-        textBlockRenderer->setStyle(textBlockStyle);
+        setInnerTextStyle(textBlockStyle);
+    }
+
+    setReplaced(isInline());
+}
+
+void RenderTextControl::setInnerTextStyle(PassRefPtr<RenderStyle> style)
+{
+    if (m_innerText) {
+        RefPtr<RenderStyle> textStyle = style;
+        m_innerText->renderer()->setStyle(textStyle);
         for (Node* n = m_innerText->firstChild(); n; n = n->traverseNextNode(m_innerText.get())) {
             if (n->renderer())
-                n->renderer()->setStyle(textBlockStyle);
+                n->renderer()->setStyle(textStyle);
         }
     }
-
-    setReplaced(isInline());
 }
 
 static inline bool updateUserModifyProperty(Node* node, RenderStyle* style)
@@ -173,7 +182,7 @@ void RenderTextControl::setInnerTextValue(const String& innerTextValue)
                 frame->editor()->clearUndoRedoOperations();
                 
                 if (AXObjectCache::accessibilityEnabled())
-                    document()->axObjectCache()->postNotification(this, "AXValueChanged", false);
+                    document()->axObjectCache()->postNotification(this, AXObjectCache::AXValueChanged, false);
             }
         }
 
@@ -507,7 +516,7 @@ void RenderTextControl::selectionChanged(bool userTriggered)
 
     if (Frame* frame = document()->frame()) {
         if (frame->selection()->isRange() && userTriggered)
-            node()->dispatchEvent(eventNames().selectEvent, true, false);
+            node()->dispatchEvent(Event::create(eventNames().selectEvent, true, false));
     }
 }
 
@@ -521,4 +530,18 @@ HTMLElement* RenderTextControl::innerTextElement() const
     return m_innerText.get();
 }
 
+void RenderTextControl::updatePlaceholderVisibility(bool placeholderShouldBeVisible, bool placeholderValueChanged)
+{
+    bool oldPlaceholderVisible = m_placeholderVisible;
+    m_placeholderVisible = placeholderShouldBeVisible;
+    if (oldPlaceholderVisible != m_placeholderVisible || placeholderValueChanged) {
+        // Sets the inner text style to the normal style or :placeholder style.
+        setInnerTextStyle(createInnerTextStyle(textBaseStyle()));
+
+        // updateFromElement() of the subclasses updates the text content
+        // to the element's value(), placeholder(), or the empty string.
+        updateFromElement();
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderTextControl.h b/WebCore/rendering/RenderTextControl.h
index c0fc343..cdd8716 100644
--- a/WebCore/rendering/RenderTextControl.h
+++ b/WebCore/rendering/RenderTextControl.h
@@ -56,8 +56,10 @@ public:
     VisiblePosition visiblePositionForIndex(int index);
     int indexForVisiblePosition(const VisiblePosition&);
 
+    void updatePlaceholderVisibility(bool, bool);
+
 protected:
-    RenderTextControl(Node*);
+    RenderTextControl(Node*, bool);
 
     int scrollbarThickness() const;
     void adjustInnerTextStyle(const RenderStyle* startStyle, RenderStyle* textBlockStyle) const;
@@ -76,6 +78,7 @@ protected:
     virtual void adjustControlHeightBasedOnLineHeight(int lineHeight) = 0;
     virtual void cacheSelection(int start, int end) = 0;
     virtual PassRefPtr<RenderStyle> createInnerTextStyle(const RenderStyle* startStyle) const = 0;
+    virtual RenderStyle* textBaseStyle() const = 0;
 
     virtual void updateFromElement();
     virtual void calcHeight();
@@ -83,6 +86,8 @@ protected:
     friend class TextIterator;
     HTMLElement* innerTextElement() const;
 
+    bool m_placeholderVisible;
+
 private:
     virtual const char* renderName() const { return "RenderTextControl"; }
     virtual bool isTextControl() const { return true; }
@@ -92,6 +97,7 @@ private:
     virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
     virtual bool canHaveChildren() const { return false; }
     virtual bool avoidsFloats() const { return true; }
+    void setInnerTextStyle(PassRefPtr<RenderStyle>);
     
     virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
diff --git a/WebCore/rendering/RenderTextControlMultiLine.cpp b/WebCore/rendering/RenderTextControlMultiLine.cpp
index ac790e2..f1f60ab 100644
--- a/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -22,18 +22,23 @@
 #include "config.h"
 #include "RenderTextControlMultiLine.h"
 
+#include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "HitTestResult.h"
+#include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
+<<<<<<< HEAD:WebCore/rendering/RenderTextControlMultiLine.cpp
 #ifdef ANDROID_LAYOUT
 #include "Settings.h"
 #endif
+=======
+#include "HitTestResult.h"
+>>>>>>> webkit.org at 49305:WebCore/rendering/RenderTextControlMultiLine.cpp
 
 namespace WebCore {
 
-RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node)
-    : RenderTextControl(node)
+RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node, bool placeholderVisible)
+    : RenderTextControl(node, placeholderVisible)
 {
 }
 
@@ -46,16 +51,17 @@ RenderTextControlMultiLine::~RenderTextControlMultiLine()
 void RenderTextControlMultiLine::subtreeHasChanged()
 {
     RenderTextControl::subtreeHasChanged();
-    static_cast<Element*>(node())->setFormControlValueMatchesRenderer(false);
+    HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(node());
+    textArea->setFormControlValueMatchesRenderer(false);
+    textArea->updateValidity();
 
     if (!node()->focused())
         return;
 
-    // Fire the "input" DOM event
-    node()->dispatchEvent(eventNames().inputEvent, true, false);
+    node()->dispatchEvent(Event::create(eventNames().inputEvent, true, false));
 
     if (Frame* frame = document()->frame())
-        frame->textDidChangeInTextArea(static_cast<Element*>(node()));
+        frame->textDidChangeInTextArea(textArea);
 }
 
 bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
@@ -63,7 +69,10 @@ bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitT
     if (!RenderTextControl::nodeAtPoint(request, result, x, y, tx, ty, hitTestAction))
         return false;
 
-    if (result.innerNode() == node() || result.innerNode() == innerTextElement())
+    bool resultIsTextValueOrPlaceholder
+        = !m_placeholderVisible && result.innerNode() == innerTextElement()
+        || m_placeholderVisible && result.innerNode()->isDescendantOf(innerTextElement());
+    if (result.innerNode() == node() || resultIsTextValueOrPlaceholder)
         hitInnerTextElement(result, x, y, tx, ty);
 
     return true;
@@ -95,7 +104,11 @@ void RenderTextControlMultiLine::updateFromElement()
     createSubtreeIfNeeded(0);
     RenderTextControl::updateFromElement();
 
-    setInnerTextValue(static_cast<HTMLTextAreaElement*>(node())->value());
+    HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(node());
+    if (m_placeholderVisible)
+        setInnerTextValue(textArea->getAttribute(HTMLNames::placeholderAttr));
+    else
+        setInnerTextValue(textArea->value());
 }
 
 void RenderTextControlMultiLine::cacheSelection(int start, int end)
@@ -105,8 +118,15 @@ void RenderTextControlMultiLine::cacheSelection(int start, int end)
 
 PassRefPtr<RenderStyle> RenderTextControlMultiLine::createInnerTextStyle(const RenderStyle* startStyle) const
 {
-    RefPtr<RenderStyle> textBlockStyle = RenderStyle::create();
-    textBlockStyle->inheritFrom(startStyle);
+    RefPtr<RenderStyle> textBlockStyle;
+    if (m_placeholderVisible) {
+        if (RenderStyle* pseudoStyle = getCachedPseudoStyle(INPUT_PLACEHOLDER))
+            textBlockStyle = RenderStyle::clone(pseudoStyle);
+    }
+    if (!textBlockStyle) {
+        textBlockStyle = RenderStyle::create();
+        textBlockStyle->inheritFrom(startStyle);
+    }
 
     adjustInnerTextStyle(startStyle, textBlockStyle.get());
     textBlockStyle->setDisplay(BLOCK);
@@ -114,4 +134,9 @@ PassRefPtr<RenderStyle> RenderTextControlMultiLine::createInnerTextStyle(const R
     return textBlockStyle.release();
 }
 
+RenderStyle* RenderTextControlMultiLine::textBaseStyle() const
+{
+    return style();
+}
+
 }
diff --git a/WebCore/rendering/RenderTextControlMultiLine.h b/WebCore/rendering/RenderTextControlMultiLine.h
index 7296653..3371a8f 100644
--- a/WebCore/rendering/RenderTextControlMultiLine.h
+++ b/WebCore/rendering/RenderTextControlMultiLine.h
@@ -28,7 +28,7 @@ namespace WebCore {
 
 class RenderTextControlMultiLine : public RenderTextControl {
 public:
-    RenderTextControlMultiLine(Node*);
+    RenderTextControlMultiLine(Node*, bool);
     virtual ~RenderTextControlMultiLine();
 
     void forwardEvent(Event*);
@@ -47,6 +47,7 @@ private:
     virtual void updateFromElement();
     virtual void cacheSelection(int start, int end);
 
+    virtual RenderStyle* textBaseStyle() const;
     virtual PassRefPtr<RenderStyle> createInnerTextStyle(const RenderStyle* startStyle) const;
 };
 
diff --git a/WebCore/rendering/RenderTextControlSingleLine.cpp b/WebCore/rendering/RenderTextControlSingleLine.cpp
index b448eb7..dd1c24c 100644
--- a/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -48,9 +48,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-RenderTextControlSingleLine::RenderTextControlSingleLine(Node* node)
-    : RenderTextControl(node)
-    , m_placeholderVisible(false)
+RenderTextControlSingleLine::RenderTextControlSingleLine(Node* node, bool placeholderVisible)
+    : RenderTextControl(node, placeholderVisible)
     , m_searchPopupIsVisible(false)
     , m_shouldDrawCapsLockIndicator(false)
     , m_searchEventTimer(this, &RenderTextControlSingleLine::searchEventTimerFired)
@@ -69,25 +68,9 @@ RenderTextControlSingleLine::~RenderTextControlSingleLine()
         m_innerBlock->detach();
 }
 
-bool RenderTextControlSingleLine::placeholderShouldBeVisible() const
+RenderStyle* RenderTextControlSingleLine::textBaseStyle() const
 {
-    return inputElement()->placeholderShouldBeVisible();
-}
-
-void RenderTextControlSingleLine::updatePlaceholderVisibility()
-{
-    RenderStyle* parentStyle = m_innerBlock ? m_innerBlock->renderer()->style() : style();
-
-    RefPtr<RenderStyle> textBlockStyle = createInnerTextStyle(parentStyle);
-    HTMLElement* innerText = innerTextElement();
-    innerText->renderer()->setStyle(textBlockStyle);
-
-    for (Node* n = innerText->firstChild(); n; n = n->traverseNextNode(innerText)) {
-        if (RenderObject* renderer = n->renderer())
-            renderer->setStyle(textBlockStyle);
-    }
-
-    updateFromElement();
+    return m_innerBlock ? m_innerBlock->renderer()->style() : style();
 }
 
 void RenderTextControlSingleLine::addSearchResult()
@@ -163,8 +146,6 @@ void RenderTextControlSingleLine::hidePopup()
     ASSERT(node()->isHTMLElement());
     if (m_searchPopup)
         m_searchPopup->hide();
-
-    m_searchPopupIsVisible = false;
 }
 
 void RenderTextControlSingleLine::subtreeHasChanged()
@@ -173,7 +154,11 @@ void RenderTextControlSingleLine::subtreeHasChanged()
     RenderTextControl::subtreeHasChanged();
 
     InputElement* input = inputElement();
-    input->setValueFromRenderer(input->constrainValue(text()));
+    // We don't need to call sanitizeUserInputValue() function here because
+    // InputElement::handleBeforeTextInsertedEvent() has already called
+    // sanitizeUserInputValue().
+    // sanitizeValue() is needed because IME input doesn't dispatch BeforeTextInsertedEvent.
+    input->setValueFromRenderer(input->sanitizeValue(text()));
 
     if (m_cancelButton)
         updateCancelButtonVisibility();
@@ -480,17 +465,14 @@ void RenderTextControlSingleLine::updateFromElement()
     createSubtreeIfNeeded();
     RenderTextControl::updateFromElement();
 
-    bool placeholderVisibilityShouldChange = m_placeholderVisible != placeholderShouldBeVisible();
-    m_placeholderVisible = placeholderShouldBeVisible();
-
     if (m_cancelButton)
         updateCancelButtonVisibility();
 
     if (m_placeholderVisible) {
         ExceptionCode ec = 0;
-        innerTextElement()->setInnerText(inputElement()->placeholder(), ec);
+        innerTextElement()->setInnerText(static_cast<Element*>(node())->getAttribute(placeholderAttr), ec);
         ASSERT(!ec);
-    } else if (!static_cast<Element*>(node())->formControlValueMatchesRenderer() || placeholderVisibilityShouldChange)
+    } else
         setInnerTextValue(inputElement()->value());
 
     if (m_searchPopupIsVisible)
@@ -505,7 +487,7 @@ void RenderTextControlSingleLine::cacheSelection(int start, int end)
 PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerTextStyle(const RenderStyle* startStyle) const
 {
     RefPtr<RenderStyle> textBlockStyle;
-    if (placeholderShouldBeVisible()) {
+    if (m_placeholderVisible) {
         if (RenderStyle* pseudoStyle = getCachedPseudoStyle(INPUT_PLACEHOLDER))
             textBlockStyle = RenderStyle::clone(pseudoStyle);
     } 
@@ -535,7 +517,7 @@ PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerTextStyle(const
     // After this, updateFromElement will immediately update the text displayed.
     // When the placeholder is no longer visible, updatePlaceholderVisiblity will reset the style, 
     // and the text security mode will be set back to the computed value correctly.
-    if (placeholderShouldBeVisible())
+    if (m_placeholderVisible)
         textBlockStyle->setTextSecurity(TSNONE);
 
     return textBlockStyle.release();
@@ -753,6 +735,11 @@ int RenderTextControlSingleLine::selectedIndex() const
     return -1;
 }
 
+void RenderTextControlSingleLine::popupDidHide()
+{
+    m_searchPopupIsVisible = false;
+}
+
 bool RenderTextControlSingleLine::itemIsSeparator(unsigned listIndex) const
 {
     // The separator will be the second to last item in our list.
@@ -832,12 +819,12 @@ void RenderTextControlSingleLine::setScrollTop(int newTop)
         innerTextElement()->setScrollTop(newTop);
 }
 
-bool RenderTextControlSingleLine::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+bool RenderTextControlSingleLine::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier, Node** stopNode)
 {
     RenderLayer* layer = innerTextElement()->renderBox()->layer();
     if (layer && layer->scroll(direction, granularity, multiplier))
         return true;
-    return RenderBlock::scroll(direction, granularity, multiplier);
+    return RenderBlock::scroll(direction, granularity, multiplier, stopNode);
 }
 
 PassRefPtr<Scrollbar> RenderTextControlSingleLine::createScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, ScrollbarControlSize controlSize)
diff --git a/WebCore/rendering/RenderTextControlSingleLine.h b/WebCore/rendering/RenderTextControlSingleLine.h
index da9838f..e30ff0d 100644
--- a/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/WebCore/rendering/RenderTextControlSingleLine.h
@@ -36,19 +36,18 @@ class TextControlInnerElement;
 
 class RenderTextControlSingleLine : public RenderTextControl, private PopupMenuClient {
 public:
-    RenderTextControlSingleLine(Node*);
+    RenderTextControlSingleLine(Node*, bool);
     virtual ~RenderTextControlSingleLine();
 
     bool placeholderIsVisible() const { return m_placeholderVisible; }
     bool placeholderShouldBeVisible() const;
-    void updatePlaceholderVisibility();
 
     void addSearchResult();
     void stopSearchEventTimer();
 
     bool popupIsVisible() const { return m_searchPopupIsVisible; }
     void showPopup();
-    virtual void hidePopup(); // PopupMenuClient method
+    void hidePopup();
 
     void forwardEvent(Event*);
 
@@ -73,7 +72,7 @@ private:
     virtual int scrollHeight() const;
     virtual void setScrollLeft(int);
     virtual void setScrollTop(int);
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
 
     int textBlockWidth() const;
     virtual int preferredContentWidth(float charWidth) const;
@@ -84,6 +83,7 @@ private:
     virtual void cacheSelection(int start, int end);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    virtual RenderStyle* textBaseStyle() const;
     virtual PassRefPtr<RenderStyle> createInnerTextStyle(const RenderStyle* startStyle) const;
     PassRefPtr<RenderStyle> createInnerBlockStyle(const RenderStyle* startStyle) const;
     PassRefPtr<RenderStyle> createResultsButtonStyle(const RenderStyle* startStyle) const;
@@ -109,6 +109,7 @@ private:
     virtual int clientPaddingRight() const;
     virtual int listSize() const;
     virtual int selectedIndex() const;
+    virtual void popupDidHide();
     virtual bool itemIsSeparator(unsigned listIndex) const;
     virtual bool itemIsLabel(unsigned listIndex) const;
     virtual bool itemIsSelected(unsigned listIndex) const;
@@ -121,7 +122,6 @@ private:
 
     InputElement* inputElement() const;
 
-    bool m_placeholderVisible;
     bool m_searchPopupIsVisible;
     bool m_shouldDrawCapsLockIndicator;
 
diff --git a/WebCore/rendering/RenderTextFragment.cpp b/WebCore/rendering/RenderTextFragment.cpp
index 7da9e5a..9ff1106 100644
--- a/WebCore/rendering/RenderTextFragment.cpp
+++ b/WebCore/rendering/RenderTextFragment.cpp
@@ -47,7 +47,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
 PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 {
     Node* e = node();
-    RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->string() : contentString());
+    RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
     if (result && (start() > 0 || start() < result->length()))
         result = result->substring(start(), end());
     return result.release();
@@ -76,7 +76,7 @@ UChar RenderTextFragment::previousCharacter()
 {
     if (start()) {
         Node* e = node();
-        StringImpl*  original = (e ? static_cast<Text*>(e)->string() : contentString());
+        StringImpl*  original = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
         if (original)
             return (*original)[start() - 1];
     }
diff --git a/WebCore/rendering/RenderTheme.cpp b/WebCore/rendering/RenderTheme.cpp
index 63e7d45..238279a 100644
--- a/WebCore/rendering/RenderTheme.cpp
+++ b/WebCore/rendering/RenderTheme.cpp
@@ -30,6 +30,7 @@
 #include "GraphicsContext.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "MediaControlElements.h"
 #include "Page.h"
 #include "RenderStyle.h"
 #include "RenderView.h"
@@ -84,6 +85,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
     
 #if USE(NEW_THEME)
     switch (part) {
+        case ListButtonPart:
         case CheckboxPart:
         case RadioPart:
         case PushButtonPart:
@@ -170,6 +172,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
             return adjustRadioStyle(selector, style, e);
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return adjustButtonStyle(selector, style, e);
@@ -187,6 +190,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
         case MenulistButtonPart:
             return adjustMenuListButtonStyle(selector, style, e);
         case MediaSliderPart:
+        case MediaVolumeSliderPart:
         case SliderHorizontalPart:
         case SliderVerticalPart:
             return adjustSliderTrackStyle(selector, style, e);
@@ -229,6 +233,7 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             m_theme->paint(part, controlStatesForRenderer(o), const_cast<GraphicsContext*>(paintInfo.context), r, o->style()->effectiveZoom(), o->view()->frameView());
@@ -247,6 +252,7 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             return paintRadio(o, paintInfo, r);
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return paintButton(o, paintInfo, r);
@@ -282,6 +288,14 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             if (o->parent()->isSlider())
                 return paintMediaSliderThumb(o, paintInfo, r);
             break;
+        case MediaVolumeSliderContainerPart:
+            return paintMediaVolumeSliderContainer(o, paintInfo, r);
+        case MediaVolumeSliderPart:
+            return paintMediaVolumeSliderTrack(o, paintInfo, r);
+        case MediaVolumeSliderThumbPart:
+            if (o->parent()->isSlider())
+                return paintMediaVolumeSliderThumb(o, paintInfo, r);
+            break;
         case MediaTimeRemainingPart:
             return paintMediaTimeRemaining(o, paintInfo, r);
         case MediaCurrentTimePart:
@@ -329,6 +343,7 @@ bool RenderTheme::paintBorderOnly(RenderObject* o, const RenderObject::PaintInfo
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
         case MenulistPart:
@@ -363,6 +378,7 @@ bool RenderTheme::paintDecorations(RenderObject* o, const RenderObject::PaintInf
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
         case MenulistPart:
@@ -391,6 +407,23 @@ bool RenderTheme::hitTestMediaControlPart(RenderObject* o, const IntPoint& absPo
     FloatPoint localPoint = o->absoluteToLocal(absPoint, false, true);  // respect transforms
     return toRenderBox(o)->borderBoxRect().contains(roundedIntPoint(localPoint));
 }
+
+bool RenderTheme::shouldRenderMediaControlPart(ControlPart part, Element* e)
+{
+    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(e);
+    switch (part) {
+    case MediaMuteButtonPart:
+        return mediaElement->hasAudio();
+    case MediaRewindButtonPart:
+        return mediaElement->movieLoadType() != MediaPlayer::LiveStream;
+    case MediaReturnToRealtimeButtonPart:
+        return mediaElement->movieLoadType() == MediaPlayer::LiveStream;
+    case MediaFullscreenButtonPart:
+        return mediaElement->supportsFullscreen();
+    default:
+        return true;
+    }
+}
 #endif
 
 Color RenderTheme::activeSelectionBackgroundColor() const
diff --git a/WebCore/rendering/RenderTheme.h b/WebCore/rendering/RenderTheme.h
index 4f37015..68e2eba 100644
--- a/WebCore/rendering/RenderTheme.h
+++ b/WebCore/rendering/RenderTheme.h
@@ -172,6 +172,7 @@ public:
 #if ENABLE(VIDEO)
     // Media controls
     virtual bool hitTestMediaControlPart(RenderObject*, const IntPoint& absPoint);
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
 #endif
 
 protected:
@@ -247,6 +248,9 @@ protected:
     virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderContainer(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.cpp b/WebCore/rendering/RenderThemeChromiumLinux.cpp
index c4020d3..9048ce3 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.cpp
+++ b/WebCore/rendering/RenderThemeChromiumLinux.cpp
@@ -45,6 +45,7 @@ PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
 
 RenderThemeChromiumLinux::RenderThemeChromiumLinux()
 {
+    m_caretBlinkInterval = RenderTheme::caretBlinkInterval();
 }
 
 RenderThemeChromiumLinux::~RenderThemeChromiumLinux()
@@ -91,9 +92,34 @@ Color RenderThemeChromiumLinux::inactiveListBoxSelectionForegroundColor() const
     return Color(0x32, 0x32, 0x32);
 }
 
+void RenderThemeChromiumLinux::adjustSliderThumbSize(RenderObject* o) const
+{
+    // These sizes match the sizes in Chromium Win.
+    const int sliderThumbAlongAxis = 11;
+    const int sliderThumbAcrossAxis = 21;
+    if (o->style()->appearance() == SliderThumbHorizontalPart) {
+        o->style()->setWidth(Length(sliderThumbAlongAxis, Fixed));
+        o->style()->setHeight(Length(sliderThumbAcrossAxis, Fixed));
+    } else if (o->style()->appearance() == SliderThumbVerticalPart) {
+        o->style()->setWidth(Length(sliderThumbAcrossAxis, Fixed));
+        o->style()->setHeight(Length(sliderThumbAlongAxis, Fixed));
+    } else
+        RenderThemeChromiumSkia::adjustSliderThumbSize(o);
+}
+
 bool RenderThemeChromiumLinux::supportsControlTints() const
 {
     return true;
 }
 
+void RenderThemeChromiumLinux::setCaretBlinkInterval(double interval)
+{
+    m_caretBlinkInterval = interval;
+}
+
+double RenderThemeChromiumLinux::caretBlinkIntervalInternal() const
+{
+    return m_caretBlinkInterval;
+}
+
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.h b/WebCore/rendering/RenderThemeChromiumLinux.h
index e75ddd5..e137ad5 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.h
+++ b/WebCore/rendering/RenderThemeChromiumLinux.h
@@ -49,12 +49,19 @@ namespace WebCore {
         virtual Color inactiveListBoxSelectionBackgroundColor() const;
         virtual Color inactiveListBoxSelectionForegroundColor() const;
 
+        virtual void adjustSliderThumbSize(RenderObject*) const;
+
+        void setCaretBlinkInterval(double interval);
+        virtual double caretBlinkIntervalInternal() const;
+
     private:
         RenderThemeChromiumLinux();
         virtual ~RenderThemeChromiumLinux();
 
         // A general method asking if any control tinting is supported at all.
         virtual bool supportsControlTints() const;
+
+        double m_caretBlinkInterval;
     };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeChromiumMac.h b/WebCore/rendering/RenderThemeChromiumMac.h
index ffb2548..61b5e8f 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/WebCore/rendering/RenderThemeChromiumMac.h
@@ -3,7 +3,6 @@
  *
  * Copyright (C) 2005 Apple Computer, Inc.
  * Copyright (C) 2008, 2009 Google, Inc.
- * Copyright (C) 2009 Kenneth Rohde Christiansen
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,7 +25,6 @@
 #define RenderThemeChromiumMac_h
 
 #import "RenderTheme.h"
-#import <AppKit/AppKit.h>
 #import <wtf/HashMap.h>
 #import <wtf/RetainPtr.h>
 
@@ -36,185 +34,166 @@
 class WebCoreRenderThemeNotificationObserver;
 #endif
 
+// This file (and its associated .mm file) is a clone of RenderThemeMac.h. See
+// the .mm file for details.
+
 namespace WebCore {
 
-    class RenderStyle;
+class RenderStyle;
+
+class RenderThemeChromiumMac : public RenderTheme {
+public:
+    static PassRefPtr<RenderTheme> create();
+
+    // A method asking if the control changes its tint when the window has focus or not.
+    virtual bool controlSupportsTints(const RenderObject*) const;
+
+    // A general method asking if any control tinting is supported at all.
+    virtual bool supportsControlTints() const { return true; }
+
+    virtual void adjustRepaintRect(const RenderObject*, IntRect&);
+
+    virtual bool isControlStyled(const RenderStyle*, const BorderData&,
+                                 const FillLayer&, const Color& backgroundColor) const;
+
+    virtual Color platformActiveSelectionBackgroundColor() const;
+    virtual Color platformInactiveSelectionBackgroundColor() const;
+    virtual Color platformActiveListBoxSelectionBackgroundColor() const;
+    virtual Color platformActiveListBoxSelectionForegroundColor() const;
+    virtual Color platformInactiveListBoxSelectionBackgroundColor() const;
+    virtual Color platformInactiveListBoxSelectionForegroundColor() const;
+    virtual Color platformFocusRingColor() const;
 
-    class RenderThemeChromiumMac : public RenderTheme {
-    public:
-        static PassRefPtr<RenderTheme> create();
+    virtual ScrollbarControlSize scrollbarControlSizeForPart(ControlPart) { return SmallScrollbar; }
+    
+    virtual void platformColorsDidChange();
+
+    // System fonts.
+    virtual void systemFont(int cssValueId, FontDescription&) const;
+
+    virtual int minimumMenuListSize(RenderStyle*) const;
+
+    virtual void adjustSliderThumbSize(RenderObject*) const;
+    
+    virtual int popupInternalPaddingLeft(RenderStyle*) const;
+    virtual int popupInternalPaddingRight(RenderStyle*) const;
+    virtual int popupInternalPaddingTop(RenderStyle*) const;
+    virtual int popupInternalPaddingBottom(RenderStyle*) const;
+    
+    virtual bool paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
-        // A method to obtain the baseline position for a "leaf" control.  This will only be used if a baseline
-        // position cannot be determined by examining child content. Checkboxes and radio buttons are examples of
-        // controls that need to do this.
-        virtual int baselinePosition(const RenderObject*) const;
+    virtual Color systemColor(int cssValueId) const;
 
-        // A method asking if the control changes its tint when the window has focus or not.
-        virtual bool controlSupportsTints(const RenderObject*) const;
+protected:
+    virtual bool supportsSelectionForegroundColors() const { return false; }
 
-        // A general method asking if any control tinting is supported at all.
-        virtual bool supportsControlTints() const { return true; }
+    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual void adjustRepaintRect(const RenderObject*, IntRect&);
+    virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual bool isControlStyled(const RenderStyle*, const BorderData&,
-                                     const FillLayer&, const Color& backgroundColor) const;
+    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual Color platformActiveSelectionBackgroundColor() const;
-        virtual Color platformInactiveSelectionBackgroundColor() const;
-        virtual Color platformActiveListBoxSelectionBackgroundColor() const;
+    virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual Color platformFocusRingColor() const;
-        
-        virtual void platformColorsDidChange();
+    virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        // System fonts.
-        virtual void systemFont(int cssValueId, FontDescription&) const;
+    virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual int minimumMenuListSize(RenderStyle*) const;
+    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual void adjustSliderThumbSize(RenderObject*) const;
-        
-        virtual int popupInternalPaddingLeft(RenderStyle*) const;
-        virtual int popupInternalPaddingRight(RenderStyle*) const;
-        virtual int popupInternalPaddingTop(RenderStyle*) const;
-        virtual int popupInternalPaddingBottom(RenderStyle*) const;
-        
-        virtual ScrollbarControlSize scrollbarControlSizeForPart(ControlPart) { return SmallScrollbar; }
+    virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+    virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+    virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+    virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+#if ENABLE(VIDEO)
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+    // Media controls
+    virtual String extraMediaControlsStyleSheet();
+#endif
+
+private:
+    RenderThemeChromiumMac();
+    virtual ~RenderThemeChromiumMac();
+
+    IntRect inflateRect(const IntRect&, const IntSize&, const int* margins, float zoomLevel = 1.0f) const;
+
+    FloatRect convertToPaintingRect(const RenderObject* inputRenderer, const RenderObject* partRenderer, const FloatRect& inputRect, const IntRect& r) const;
     
-        virtual bool paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    // Get the control size based off the font.  Used by some of the controls (like buttons).
+    NSControlSize controlSizeForFont(RenderStyle*) const;
+    NSControlSize controlSizeForSystemFont(RenderStyle*) const;
+    void setControlSize(NSCell*, const IntSize* sizes, const IntSize& minSize, float zoomLevel = 1.0f);
+    void setSizeFromFont(RenderStyle*, const IntSize* sizes) const;
+    IntSize sizeForFont(RenderStyle*, const IntSize* sizes) const;
+    IntSize sizeForSystemFont(RenderStyle*, const IntSize* sizes) const;
+    void setFontFromControlSize(CSSStyleSelector*, RenderStyle*, NSControlSize) const;
+
+    void updateActiveState(NSCell*, const RenderObject*);
+    void updateCheckedState(NSCell*, const RenderObject*);
+    void updateEnabledState(NSCell*, const RenderObject*);
+    void updateFocusedState(NSCell*, const RenderObject*);
+    void updatePressedState(NSCell*, const RenderObject*);
+
+    // Helpers for adjusting appearance and for painting
+
+    void setPopupButtonCellState(const RenderObject*, const IntRect&);
+    const IntSize* popupButtonSizes() const;
+    const int* popupButtonMargins() const;
+    const int* popupButtonPadding(NSControlSize) const;
+    void paintMenuListButtonGradients(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    const IntSize* menuListSizes() const;
+
+    const IntSize* searchFieldSizes() const;
+    const IntSize* cancelButtonSizes() const;
+    const IntSize* resultsButtonSizes() const;
+    void setSearchCellState(RenderObject*, const IntRect&);
+    void setSearchFieldSize(RenderStyle*) const;
+    
+    NSPopUpButtonCell* popupButton() const;
+    NSSearchFieldCell* search() const;
+    NSMenu* searchMenuTemplate() const;
+    NSSliderCell* sliderThumbHorizontal() const;
+    NSSliderCell* sliderThumbVertical() const;
+
+private:
+    mutable RetainPtr<NSPopUpButtonCell> m_popupButton;
+    mutable RetainPtr<NSSearchFieldCell> m_search;
+    mutable RetainPtr<NSMenu> m_searchMenuTemplate;
+    mutable RetainPtr<NSSliderCell> m_sliderThumbHorizontal;
+    mutable RetainPtr<NSSliderCell> m_sliderThumbVertical;
 
-        virtual Color systemColor(int cssValueId) const;
+    bool m_isSliderThumbHorizontalPressed;
+    bool m_isSliderThumbVerticalPressed;
 
-    protected:
-        virtual bool supportsSelectionForegroundColors() const { return false; }
+    mutable HashMap<int, RGBA32> m_systemColorCache;
 
-        // Methods for each appearance value.
-        virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void setCheckboxSize(RenderStyle*) const;
-
-        virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void setRadioSize(RenderStyle*) const;
-
-        virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, WebCore::Element*) const;
-        virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void setButtonSize(RenderStyle*) const;
-
-        virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-        virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-        virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-        virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-        virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-    private:
-        RenderThemeChromiumMac();
-        virtual ~RenderThemeChromiumMac();
-
-        IntRect inflateRect(const IntRect&, const IntSize&, const int* margins, float zoomLevel = 1.0f) const;
-
-        // Get the control size based off the font.  Used by some of the controls (like buttons).
-        NSControlSize controlSizeForFont(RenderStyle*) const;
-        NSControlSize controlSizeForSystemFont(RenderStyle*) const;
-        void setControlSize(NSCell*, const IntSize* sizes, const IntSize& minSize, float zoomLevel = 1.0f);
-        void setSizeFromFont(RenderStyle*, const IntSize* sizes) const;
-        IntSize sizeForFont(RenderStyle*, const IntSize* sizes) const;
-        IntSize sizeForSystemFont(RenderStyle*, const IntSize* sizes) const;
-        void setFontFromControlSize(CSSStyleSelector*, RenderStyle*, NSControlSize) const;
-
-        void updateCheckedState(NSCell*, const RenderObject*);
-        void updateEnabledState(NSCell*, const RenderObject*);
-        void updateFocusedState(NSCell*, const RenderObject*);
-        void updatePressedState(NSCell*, const RenderObject*);
-
-        // Helpers for adjusting appearance and for painting
-        const IntSize* checkboxSizes() const;
-        const int* checkboxMargins() const;
-        void setCheckboxCellState(const RenderObject*, const IntRect&);
-
-        const IntSize* radioSizes() const;
-        const int* radioMargins() const;
-        void setRadioCellState(const RenderObject*, const IntRect&);
-
-        void setButtonPaddingFromControlSize(RenderStyle*, NSControlSize) const;
-        const IntSize* buttonSizes() const;
-        const int* buttonMargins() const;
-        void setButtonCellState(const RenderObject*, const IntRect&);
-
-        void setPopupButtonCellState(const RenderObject*, const IntRect&);
-        const IntSize* popupButtonSizes() const;
-        const int* popupButtonMargins() const;
-        const int* popupButtonPadding(NSControlSize) const;
-        void paintMenuListButtonGradients(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        const IntSize* menuListSizes() const;
-
-        const IntSize* searchFieldSizes() const;
-        const IntSize* cancelButtonSizes() const;
-        const IntSize* resultsButtonSizes() const;
-        void setSearchCellState(RenderObject*, const IntRect&);
-        void setSearchFieldSize(RenderStyle*) const;
-        
-        NSButtonCell* checkbox() const;
-        NSButtonCell* radio() const;
-        NSButtonCell* button() const;
-        NSPopUpButtonCell* popupButton() const;
-        NSSearchFieldCell* search() const;
-        NSMenu* searchMenuTemplate() const;
-        NSSliderCell* sliderThumbHorizontal() const;
-        NSSliderCell* sliderThumbVertical() const;
-
-    private:
-        mutable RetainPtr<NSButtonCell> m_checkbox;
-        mutable RetainPtr<NSButtonCell> m_radio;
-        mutable RetainPtr<NSButtonCell> m_button;
-        mutable RetainPtr<NSPopUpButtonCell> m_popupButton;
-        mutable RetainPtr<NSSearchFieldCell> m_search;
-        mutable RetainPtr<NSMenu> m_searchMenuTemplate;
-        mutable RetainPtr<NSSliderCell> m_sliderThumbHorizontal;
-        mutable RetainPtr<NSSliderCell> m_sliderThumbVertical;
-
-        bool m_isSliderThumbHorizontalPressed;
-        bool m_isSliderThumbVerticalPressed;
-
-        mutable HashMap<int, RGBA32> m_systemColorCache;
-
-        RetainPtr<WebCoreRenderThemeNotificationObserver> m_notificationObserver;
-    };
+    RetainPtr<WebCoreRenderThemeNotificationObserver> m_notificationObserver;
+    bool paintMediaButtonInternal(GraphicsContext*, const IntRect&, Image*);
+};
 
 } // namespace WebCore
 
-#endif
+#endif // RenderThemeChromiumMac_h
diff --git a/WebCore/rendering/RenderThemeChromiumMac.mm b/WebCore/rendering/RenderThemeChromiumMac.mm
index 23201c9..bcfcd57 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -1,7 +1,6 @@
 /*
- * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Google, Inc.
- * Copyright (C) 2009 Kenneth Rohde Christiansen
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,25 +18,16 @@
  * Boston, MA 02110-1301, USA.
  */
 
-// FIXME: we still need to figure out if passing a null view to the cell
-// drawing routines will work. I expect not, and if that's the case we'll have
-// to figure out something else. For now, at least leave the lines commented
-// in, but the procurement of the view if 0'd.
-
 #import "config.h"
 #import "RenderThemeChromiumMac.h"
 
-#import <Carbon/Carbon.h>
-#import <Cocoa/Cocoa.h>
-#import <math.h>
-
 #import "BitmapImage.h"
 #import "ChromiumBridge.h"
 #import "ColorMac.h"
 #import "CSSStyleSelector.h"
 #import "CSSValueKeywords.h"
+#import "Document.h"
 #import "Element.h"
-#import "FoundationExtras.h"
 #import "FrameView.h"
 #import "GraphicsContext.h"
 #import "HTMLInputElement.h"
@@ -47,11 +37,18 @@
 #import "LocalCurrentGraphicsContext.h"
 #import "MediaControlElements.h"
 #import "RenderMedia.h"
+#import "RenderMediaControlsChromium.h"
 #import "RenderSlider.h"
 #import "RenderView.h"
 #import "SharedBuffer.h"
+#import "UserAgentStyleSheets.h"
 #import "WebCoreSystemInterface.h"
+#import "UserAgentStyleSheets.h"
+#import <Carbon/Carbon.h>
+#import <Cocoa/Cocoa.h>
 #import <wtf/RetainPtr.h>
+#import <wtf/StdLibExtras.h>
+#import <math.h>
 
 #ifdef BUILDING_ON_TIGER
 typedef int NSInteger;
@@ -60,6 +57,25 @@ typedef unsigned NSUInteger;
 
 using std::min;
 
+// This file (and its associated .h file) is a clone of RenderThemeMac.mm.
+// Because the original file is designed to run in-process inside a Cocoa view,
+// we must maintain a fork. Please maintain this file by performing parallel
+// changes to it.
+//
+// The only changes from RenderThemeMac should be:
+// - The classname change from RenderThemeMac to RenderThemeChromiumMac.
+// - The introduction of RTCMFlippedView and FlippedView() and its use as the
+//   parent view for cell rendering.
+// - In platformFocusRingColor(), the use of ChromiumBridge to determine if
+//   we're in layout test mode.
+// - updateActiveState() and its use to update the cells' visual appearance.
+// - All the paintMedia*() functions and extraMediaControlsStyleSheet()
+//   are forked from RenderThemeChromiumSkia instead of RenderThemeMac.
+//
+// For all other differences, if it was introduced in this file, then the
+// maintainer forgot to include it in the list; otherwise it is an update that
+// should have been applied to this file but was not.
+
 // The methods in this file are specific to the Mac OS X platform.
 
 // FIXME: The platform-independent code in this class should be factored out and merged with RenderThemeSafari. 
@@ -84,48 +100,66 @@ using std::min;
     return self;
 }
 
-- (void)systemColorsDidChange:(NSNotification *)notification
+- (void)systemColorsDidChange:(NSNotification *)unusedNotification
 {
-    ASSERT([[notification name] isEqualToString:NSSystemColorsDidChangeNotification]);
+    ASSERT_UNUSED(unusedNotification, [[unusedNotification name] isEqualToString:NSSystemColorsDidChangeNotification]);
     _theme->platformColorsDidChange();
 }
 
 @end
 
+@interface RTCMFlippedView : NSView
+{}
+
+- (BOOL)isFlipped;
+- (NSText *)currentEditor;
+
+@end
+
+@implementation RTCMFlippedView
+
+- (BOOL)isFlipped {
+    return [[NSGraphicsContext currentContext] isFlipped];
+}
+
+- (NSText *)currentEditor {
+    return nil;
+}
+
+@end
+
 namespace WebCore {
 
 using namespace HTMLNames;
 
 enum {
-    TopMargin,
-    RightMargin,
-    BottomMargin,
-    LeftMargin
+    topMargin,
+    rightMargin,
+    bottomMargin,
+    leftMargin
 };
 
 enum {
-    TopPadding,
-    RightPadding,
-    BottomPadding,
-    LeftPadding
+    topPadding,
+    rightPadding,
+    bottomPadding,
+    leftPadding
 };
 
-// In our Mac port, we don't define PLATFORM(MAC) and thus don't pick up the
-// |operator NSRect()| on WebCore::IntRect and FloatRect. This substitues for
-// that missing conversion operator.
-NSRect IntRectToNSRect(const IntRect & rect)
+// In Snow Leopard, many cells only check to see if the view they're passed is
+// flipped, and if a nil view is passed, neglect to check if the current
+// graphics context is flipped. Thus we pass a sham view to them, one whose
+// flipped state just reflects the state of the context.
+NSView* FlippedView()
 {
-    return NSMakeRect(rect.x(), rect.y(), rect.width(), rect.height());
+    static NSView* view = [[RTCMFlippedView alloc] init];
+    return view;
 }
 
-NSRect FloatRectToNSRect(const FloatRect & rect)
+PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page*)
 {
-    return NSMakeRect(rect.x(), rect.y(), rect.width(), rect.height());
-}
-
-IntRect NSRectToIntRect(const NSRect & rect)
-{
-    return IntRect(rect.origin.x, rect.origin.y, rect.size.width, rect.size.height);
+    static RenderTheme* rt = RenderThemeChromiumMac::create().releaseRef();
+    return rt;
 }
 
 PassRefPtr<RenderTheme> RenderThemeChromiumMac::create()
@@ -133,12 +167,6 @@ PassRefPtr<RenderTheme> RenderThemeChromiumMac::create()
     return adoptRef(new RenderThemeChromiumMac);
 }
 
-PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
-{
-    static RenderTheme* rt = RenderThemeChromiumMac::create().releaseRef();
-    return rt;
-}
-
 RenderThemeChromiumMac::RenderThemeChromiumMac()
     : m_isSliderThumbHorizontalPressed(false)
     , m_isSliderThumbVerticalPressed(false)
@@ -173,6 +201,16 @@ Color RenderThemeChromiumMac::platformActiveListBoxSelectionBackgroundColor() co
     return Color(static_cast<int>(255.0 * [color redComponent]), static_cast<int>(255.0 * [color greenComponent]), static_cast<int>(255.0 * [color blueComponent]));
 }
 
+Color RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor() const
+{
+    return Color::white;
+}
+
+Color RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor() const
+{
+    return Color::black;
+}
+
 Color RenderThemeChromiumMac::platformFocusRingColor() const
 {
     if (ChromiumBridge::layoutTestMode())
@@ -181,6 +219,11 @@ Color RenderThemeChromiumMac::platformFocusRingColor() const
     return systemColor(CSSValueWebkitFocusRingColor);
 }
 
+Color RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor() const
+{
+    return platformInactiveSelectionBackgroundColor();
+}
+
 static FontWeight toFontWeight(NSInteger appKitFontWeight)
 {
     ASSERT(appKitFontWeight > 0 && appKitFontWeight < 15);
@@ -210,51 +253,51 @@ static FontWeight toFontWeight(NSInteger appKitFontWeight)
 
 void RenderThemeChromiumMac::systemFont(int cssValueId, FontDescription& fontDescription) const
 {
-    static FontDescription systemFont;
-    static FontDescription smallSystemFont;
-    static FontDescription menuFont;
-    static FontDescription labelFont;
-    static FontDescription miniControlFont;
-    static FontDescription smallControlFont;
-    static FontDescription controlFont;
+    DEFINE_STATIC_LOCAL(FontDescription, systemFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, smallSystemFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, menuFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, labelFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, miniControlFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, smallControlFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, controlFont, ());
 
     FontDescription* cachedDesc;
     NSFont* font = nil;
     switch (cssValueId) {
-    case CSSValueSmallCaption:
-        cachedDesc = &smallSystemFont;
-        if (!smallSystemFont.isAbsoluteSize())
-            font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
-        break;
-    case CSSValueMenu:
-        cachedDesc = &menuFont;
-        if (!menuFont.isAbsoluteSize())
-            font = [NSFont menuFontOfSize:[NSFont systemFontSize]];
-        break;
-    case CSSValueStatusBar:
-        cachedDesc = &labelFont;
-        if (!labelFont.isAbsoluteSize())
-            font = [NSFont labelFontOfSize:[NSFont labelFontSize]];
-        break;
-    case CSSValueWebkitMiniControl:
-        cachedDesc = &miniControlFont;
-        if (!miniControlFont.isAbsoluteSize())
-            font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSMiniControlSize]];
-        break;
-    case CSSValueWebkitSmallControl:
-        cachedDesc = &smallControlFont;
-        if (!smallControlFont.isAbsoluteSize())
-            font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSSmallControlSize]];
-        break;
-    case CSSValueWebkitControl:
-        cachedDesc = &controlFont;
-        if (!controlFont.isAbsoluteSize())
-            font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSRegularControlSize]];
-        break;
-    default:
-        cachedDesc = &systemFont;
-        if (!systemFont.isAbsoluteSize())
-            font = [NSFont systemFontOfSize:[NSFont systemFontSize]];
+        case CSSValueSmallCaption:
+            cachedDesc = &smallSystemFont;
+            if (!smallSystemFont.isAbsoluteSize())
+                font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
+            break;
+        case CSSValueMenu:
+            cachedDesc = &menuFont;
+            if (!menuFont.isAbsoluteSize())
+                font = [NSFont menuFontOfSize:[NSFont systemFontSize]];
+            break;
+        case CSSValueStatusBar:
+            cachedDesc = &labelFont;
+            if (!labelFont.isAbsoluteSize())
+                font = [NSFont labelFontOfSize:[NSFont labelFontSize]];
+            break;
+        case CSSValueWebkitMiniControl:
+            cachedDesc = &miniControlFont;
+            if (!miniControlFont.isAbsoluteSize())
+                font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSMiniControlSize]];
+            break;
+        case CSSValueWebkitSmallControl:
+            cachedDesc = &smallControlFont;
+            if (!smallControlFont.isAbsoluteSize())
+                font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSSmallControlSize]];
+            break;
+        case CSSValueWebkitControl:
+            cachedDesc = &controlFont;
+            if (!controlFont.isAbsoluteSize())
+                font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSRegularControlSize]];
+            break;
+        default:
+            cachedDesc = &systemFont;
+            if (!systemFont.isAbsoluteSize())
+                font = [NSFont systemFontOfSize:[NSFont systemFontSize]];
     }
 
     if (font) {
@@ -271,7 +314,7 @@ void RenderThemeChromiumMac::systemFont(int cssValueId, FontDescription& fontDes
 
 static RGBA32 convertNSColorToColor(NSColor *color)
 {
-    NSColor *colorInColorSpace = [color colorUsingColorSpaceName:NSCalibratedRGBColorSpace];
+    NSColor *colorInColorSpace = [color colorUsingColorSpaceName:NSDeviceRGBColorSpace];
     if (colorInColorSpace) {
         static const double scaleFactor = nextafter(256.0, 0.0);
         return makeRGB(static_cast<int>(scaleFactor * [colorInColorSpace redComponent]),
@@ -291,7 +334,7 @@ static RGBA32 convertNSColorToColor(NSColor *color)
                                                                         samplesPerPixel:4
                                                                                hasAlpha:YES
                                                                                isPlanar:NO
-                                                                         colorSpaceName:NSCalibratedRGBColorSpace
+                                                                         colorSpaceName:NSDeviceRGBColorSpace
                                                                             bytesPerRow:4
                                                                            bitsPerPixel:32];
 
@@ -318,7 +361,7 @@ static RGBA32 menuBackgroundColor()
                                                                         samplesPerPixel:4
                                                                                hasAlpha:YES
                                                                                isPlanar:NO
-                                                                         colorSpaceName:NSCalibratedRGBColorSpace
+                                                                         colorSpaceName:NSDeviceRGBColorSpace
                                                                             bytesPerRow:4
                                                                            bitsPerPixel:32];
 
@@ -350,101 +393,101 @@ Color RenderThemeChromiumMac::systemColor(int cssValueId) const
     
     Color color;
     switch (cssValueId) {
-    case CSSValueActiveborder:
-        color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
-        break;
-    case CSSValueActivecaption:
-        color = convertNSColorToColor([NSColor windowFrameTextColor]);
-        break;
-    case CSSValueAppworkspace:
-        color = convertNSColorToColor([NSColor headerColor]);
-        break;
-    case CSSValueBackground:
-        // Use theme independent default
-        break;
-    case CSSValueButtonface:
-        // We use this value instead of NSColor's controlColor to avoid website incompatibilities.
-        // We may want to change this to use the NSColor in future.
-        color = 0xFFC0C0C0;
-        break;
-    case CSSValueButtonhighlight:
-        color = convertNSColorToColor([NSColor controlHighlightColor]);
-        break;
-    case CSSValueButtonshadow:
-        color = convertNSColorToColor([NSColor controlShadowColor]);
-        break;
-    case CSSValueButtontext:
-        color = convertNSColorToColor([NSColor controlTextColor]);
-        break;
-    case CSSValueCaptiontext:
-        color = convertNSColorToColor([NSColor textColor]);
-        break;
-    case CSSValueGraytext:
-        color = convertNSColorToColor([NSColor disabledControlTextColor]);
-        break;
-    case CSSValueHighlight:
-        color = convertNSColorToColor([NSColor selectedTextBackgroundColor]);
-        break;
-    case CSSValueHighlighttext:
-        color = convertNSColorToColor([NSColor selectedTextColor]);
-        break;
-    case CSSValueInactiveborder:
-        color = convertNSColorToColor([NSColor controlBackgroundColor]);
-        break;
-    case CSSValueInactivecaption:
-        color = convertNSColorToColor([NSColor controlBackgroundColor]);
-        break;
-    case CSSValueInactivecaptiontext:
-        color = convertNSColorToColor([NSColor textColor]);
-        break;
-    case CSSValueInfobackground:
-        // There is no corresponding NSColor for this so we use a hard coded value.
-        color = 0xFFFBFCC5;
-        break;
-    case CSSValueInfotext:
-        color = convertNSColorToColor([NSColor textColor]);
-        break;
-    case CSSValueMenu:
-        color = menuBackgroundColor();
-        break;
-    case CSSValueMenutext:
-        color = convertNSColorToColor([NSColor selectedMenuItemTextColor]);
-        break;
-    case CSSValueScrollbar:
-        color = convertNSColorToColor([NSColor scrollBarColor]);
-        break;
-    case CSSValueText:
-        color = convertNSColorToColor([NSColor textColor]);
-        break;
-    case CSSValueThreeddarkshadow:
-        color = convertNSColorToColor([NSColor controlDarkShadowColor]);
-        break;
-    case CSSValueThreedshadow:
-        color = convertNSColorToColor([NSColor shadowColor]);
-        break;
-    case CSSValueThreedface:
-        // We use this value instead of NSColor's controlColor to avoid website incompatibilities.
-        // We may want to change this to use the NSColor in future.
-        color = 0xFFC0C0C0;
-        break;
-    case CSSValueThreedhighlight:
-        color = convertNSColorToColor([NSColor highlightColor]);
-        break;
-    case CSSValueThreedlightshadow:
-        color = convertNSColorToColor([NSColor controlLightHighlightColor]);
-        break;
-    case CSSValueWebkitFocusRingColor:
-        color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
-        break;
-    case CSSValueWindow:
-        color = convertNSColorToColor([NSColor windowBackgroundColor]);
-        break;
-    case CSSValueWindowframe:
-        color = convertNSColorToColor([NSColor windowFrameColor]);
-        break;
-    case CSSValueWindowtext:
-        color = convertNSColorToColor([NSColor windowFrameTextColor]);
-        break;
+        case CSSValueActiveborder:
+            color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
+            break;
+        case CSSValueActivecaption:
+            color = convertNSColorToColor([NSColor windowFrameTextColor]);
+            break;
+        case CSSValueAppworkspace:
+            color = convertNSColorToColor([NSColor headerColor]);
+            break;
+        case CSSValueBackground:
+            // Use theme independent default
+            break;
+        case CSSValueButtonface:
+            // We use this value instead of NSColor's controlColor to avoid website incompatibilities.
+            // We may want to change this to use the NSColor in future.
+            color = 0xFFC0C0C0;
+            break;
+        case CSSValueButtonhighlight:
+            color = convertNSColorToColor([NSColor controlHighlightColor]);
+            break;
+        case CSSValueButtonshadow:
+            color = convertNSColorToColor([NSColor controlShadowColor]);
+            break;
+        case CSSValueButtontext:
+            color = convertNSColorToColor([NSColor controlTextColor]);
+            break;
+        case CSSValueCaptiontext:
+            color = convertNSColorToColor([NSColor textColor]);
+            break;
+        case CSSValueGraytext:
+            color = convertNSColorToColor([NSColor disabledControlTextColor]);
+            break;
+        case CSSValueHighlight:
+            color = convertNSColorToColor([NSColor selectedTextBackgroundColor]);
+            break;
+        case CSSValueHighlighttext:
+            color = convertNSColorToColor([NSColor selectedTextColor]);
+            break;
+        case CSSValueInactiveborder:
+            color = convertNSColorToColor([NSColor controlBackgroundColor]);
+            break;
+        case CSSValueInactivecaption:
+            color = convertNSColorToColor([NSColor controlBackgroundColor]);
+            break;
+        case CSSValueInactivecaptiontext:
+            color = convertNSColorToColor([NSColor textColor]);
+            break;
+        case CSSValueInfobackground:
+            // There is no corresponding NSColor for this so we use a hard coded value.
+            color = 0xFFFBFCC5;
+            break;
+        case CSSValueInfotext:
+            color = convertNSColorToColor([NSColor textColor]);
+            break;
+        case CSSValueMenu:
+            color = menuBackgroundColor();
+            break;
+        case CSSValueMenutext:
+            color = convertNSColorToColor([NSColor selectedMenuItemTextColor]);
+            break;
+        case CSSValueScrollbar:
+            color = convertNSColorToColor([NSColor scrollBarColor]);
+            break;
+        case CSSValueText:
+            color = convertNSColorToColor([NSColor textColor]);
+            break;
+        case CSSValueThreeddarkshadow:
+            color = convertNSColorToColor([NSColor controlDarkShadowColor]);
+            break;
+        case CSSValueThreedshadow:
+            color = convertNSColorToColor([NSColor shadowColor]);
+            break;
+        case CSSValueThreedface:
+            // We use this value instead of NSColor's controlColor to avoid website incompatibilities.
+            // We may want to change this to use the NSColor in future.
+            color = 0xFFC0C0C0;
+            break;
+        case CSSValueThreedhighlight:
+            color = convertNSColorToColor([NSColor highlightColor]);
+            break;
+        case CSSValueThreedlightshadow:
+            color = convertNSColorToColor([NSColor controlLightHighlightColor]);
+            break;
+        case CSSValueWebkitFocusRingColor:
+            color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
+            break;
+        case CSSValueWindow:
+            color = convertNSColorToColor([NSColor windowBackgroundColor]);
+            break;
+        case CSSValueWindowframe:
+            color = convertNSColorToColor([NSColor windowFrameColor]);
+            break;
+        case CSSValueWindowtext:
+            color = convertNSColorToColor([NSColor windowFrameTextColor]);
+            break;
     }
 
     if (!color.isValid())
@@ -457,7 +500,7 @@ Color RenderThemeChromiumMac::systemColor(int cssValueId) const
 }
 
 bool RenderThemeChromiumMac::isControlStyled(const RenderStyle* style, const BorderData& border,
-                                             const FillLayer& background, const Color& backgroundColor) const
+                                     const FillLayer& background, const Color& backgroundColor) const
 {
     if (style->appearance() == TextFieldPart || style->appearance() == TextAreaPart || style->appearance() == ListboxPart)
         return style->border() != border;
@@ -472,62 +515,32 @@ bool RenderThemeChromiumMac::isControlStyled(const RenderStyle* style, const Bor
     return RenderTheme::isControlStyled(style, border, background, backgroundColor);
 }
 
-// FIXME: Use the code from the old upstream version, before it was converted to the new theme API in r37731.
 void RenderThemeChromiumMac::adjustRepaintRect(const RenderObject* o, IntRect& r)
 {
-    float zoomLevel = o->style()->effectiveZoom();
-
-    switch (o->style()->appearance()) {
-    case CheckboxPart: {
-        // Since we query the prototype cell, we need to update its state to match.
-        setCheckboxCellState(o, r);
-
-        // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
-        // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
-        IntSize size = checkboxSizes()[[checkbox() controlSize]];
-        size.setHeight(size.height() * zoomLevel);
-        size.setWidth(size.width() * zoomLevel);
-        r = inflateRect(r, size, checkboxMargins(), zoomLevel);
-        break;
+    ControlPart part = o->style()->appearance();
+    
+#if USE(NEW_THEME)
+    switch (part) {
+        case CheckboxPart:
+        case RadioPart:
+        case PushButtonPart:
+        case SquareButtonPart:
+        case DefaultButtonPart:
+        case ButtonPart:
+            return RenderTheme::adjustRepaintRect(o, r);
+        default:
+            break;
     }
-    case RadioPart: {
-        // Since we query the prototype cell, we need to update its state to match.
-        setRadioCellState(o, r);
+#endif
 
-        // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
-        // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
-        IntSize size = radioSizes()[[radio() controlSize]];
-        size.setHeight(size.height() * zoomLevel);
-        size.setWidth(size.width() * zoomLevel);
-        r = inflateRect(r, size, radioMargins(), zoomLevel);
-        break;
-    }
-    case PushButtonPart:
-    case DefaultButtonPart:
-    case ButtonPart: {
-        // Since we query the prototype cell, we need to update its state to match.
-        setButtonCellState(o, r);
-
-        // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
-        // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
-        if ([button() bezelStyle] == NSRoundedBezelStyle) {
-            IntSize size = buttonSizes()[[button() controlSize]];
-            size.setHeight(size.height() * zoomLevel);
-            size.setWidth(r.width());
-            r = inflateRect(r, size, buttonMargins(), zoomLevel);
-        }
-        break;
-    }
-    case MenulistPart: {
+    float zoomLevel = o->style()->effectiveZoom();
+
+    if (part == MenulistPart) {
         setPopupButtonCellState(o, r);
         IntSize size = popupButtonSizes()[[popupButton() controlSize]];
         size.setHeight(size.height() * zoomLevel);
         size.setWidth(r.width());
         r = inflateRect(r, size, popupButtonMargins(), zoomLevel);
-        break;
-    }
-    default:
-        break;
     }
 }
 
@@ -535,20 +548,61 @@ IntRect RenderThemeChromiumMac::inflateRect(const IntRect& r, const IntSize& siz
 {
     // Only do the inflation if the available width/height are too small.  Otherwise try to
     // fit the glow/check space into the available box's width/height.
-    int widthDelta = r.width() - (size.width() + margins[LeftMargin] * zoomLevel + margins[RightMargin] * zoomLevel);
-    int heightDelta = r.height() - (size.height() + margins[TopMargin] * zoomLevel + margins[BottomMargin] * zoomLevel);
+    int widthDelta = r.width() - (size.width() + margins[leftMargin] * zoomLevel + margins[rightMargin] * zoomLevel);
+    int heightDelta = r.height() - (size.height() + margins[topMargin] * zoomLevel + margins[bottomMargin] * zoomLevel);
     IntRect result(r);
     if (widthDelta < 0) {
-        result.setX(result.x() - margins[LeftMargin] * zoomLevel);
+        result.setX(result.x() - margins[leftMargin] * zoomLevel);
         result.setWidth(result.width() - widthDelta);
     }
     if (heightDelta < 0) {
-        result.setY(result.y() - margins[TopMargin] * zoomLevel);
+        result.setY(result.y() - margins[topMargin] * zoomLevel);
         result.setHeight(result.height() - heightDelta);
     }
     return result;
 }
 
+FloatRect RenderThemeChromiumMac::convertToPaintingRect(const RenderObject* inputRenderer, const RenderObject* partRenderer, const FloatRect& inputRect, const IntRect& r) const
+{
+    FloatRect partRect(inputRect);
+    
+    // Compute an offset between the part renderer and the input renderer
+    FloatSize offsetFromInputRenderer;
+    const RenderObject* renderer = partRenderer;
+    while (renderer && renderer != inputRenderer) {
+        RenderObject* containingRenderer = renderer->container();
+        offsetFromInputRenderer -= renderer->offsetFromContainer(containingRenderer);
+        renderer = containingRenderer;
+    }
+    // If the input renderer was not a container, something went wrong
+    ASSERT(renderer == inputRenderer);
+    // Move the rect into partRenderer's coords
+    partRect.move(offsetFromInputRenderer);
+    // Account for the local drawing offset (tx, ty)
+    partRect.move(r.x(), r.y());
+
+    return partRect;
+}
+
+// Updates the control tint (a.k.a. active state) of |cell| (from |o|).
+// In the Chromium port, the renderer runs as a background process and controls'
+// NSCell(s) lack a parent NSView. Therefore controls don't have their tint
+// color updated correctly when the application is activated/deactivated.
+// FocusController's setActive() is called when the application is
+// activated/deactivated, which causes a repaint at which time this code is
+// called.
+// This function should be called before drawing any NSCell-derived controls,
+// unless you're sure it isn't needed.
+void RenderThemeChromiumMac::updateActiveState(NSCell* cell, const RenderObject* o)
+{
+    NSControlTint oldTint = [cell controlTint];
+    NSControlTint tint = isActive(o) ? [NSColor currentControlTint] :
+                                       NSClearControlTint;
+
+    if (tint != oldTint)
+        [cell setControlTint:tint];
+}
+
 void RenderThemeChromiumMac::updateCheckedState(NSCell* cell, const RenderObject* o)
 {
     bool oldIndeterminate = [cell state] == NSMixedState;
@@ -589,19 +643,6 @@ void RenderThemeChromiumMac::updatePressedState(NSCell* cell, const RenderObject
         [cell setHighlighted:pressed];
 }
 
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-int RenderThemeChromiumMac::baselinePosition(const RenderObject* o) const
-{
-    if (!o->isBox())
-        return 0;
-
-    if (o->style()->appearance() == CheckboxPart || o->style()->appearance() == RadioPart) {
-        const RenderBox* box = toRenderBox(o);
-        return box->marginTop() + box->height() - 2 * o->style()->effectiveZoom(); // The baseline is 2px up from the bottom of the checkbox/radio in AppKit.
-    }
-    return RenderTheme::baselinePosition(o);
-}
-
 bool RenderThemeChromiumMac::controlSupportsTints(const RenderObject* o) const
 {
     // An alternate way to implement this would be to get the appropriate cell object
@@ -673,7 +714,7 @@ void RenderThemeChromiumMac::setSizeFromFont(RenderStyle* style, const IntSize*
         style->setHeight(Length(size.height(), Fixed));
 }
 
-void RenderThemeChromiumMac::setFontFromControlSize(CSSStyleSelector* selector, RenderStyle* style, NSControlSize controlSize) const
+void RenderThemeChromiumMac::setFontFromControlSize(CSSStyleSelector*, RenderStyle* style, NSControlSize controlSize) const
 {
     FontDescription fontDescription;
     fontDescription.setIsAbsoluteSize(true);
@@ -701,349 +742,10 @@ NSControlSize RenderThemeChromiumMac::controlSizeForSystemFont(RenderStyle* styl
     return NSMiniControlSize;
 }
 
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-bool RenderThemeChromiumMac::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
-{
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
-    // Determine the width and height needed for the control and prepare the cell for painting.
-    setCheckboxCellState(o, r);
-
-    paintInfo.context->save();
-
-    float zoomLevel = o->style()->effectiveZoom();
-
-    // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
-    // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
-    NSButtonCell* checkbox = this->checkbox();
-    IntSize size = checkboxSizes()[[checkbox controlSize]];
-    size.setWidth(size.width() * zoomLevel);
-    size.setHeight(size.height() * zoomLevel);
-    IntRect inflatedRect = inflateRect(r, size, checkboxMargins(), zoomLevel);
-    
-    if (zoomLevel != 1.0f) {
-        inflatedRect.setWidth(inflatedRect.width() / zoomLevel);
-        inflatedRect.setHeight(inflatedRect.height() / zoomLevel);
-        paintInfo.context->translate(inflatedRect.x(), inflatedRect.y());
-        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
-        paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
-    }
-    
-    [checkbox drawWithFrame:NSRect(IntRectToNSRect(inflatedRect)) inView:nil];
-    [checkbox setControlView:nil];
-
-    paintInfo.context->restore();
-
-    return false;
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const IntSize* RenderThemeChromiumMac::checkboxSizes() const
-{
-    static const IntSize sizes[3] = { IntSize(14, 14), IntSize(12, 12), IntSize(10, 10) };
-    return sizes;
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const int* RenderThemeChromiumMac::checkboxMargins() const
-{
-    static const int margins[3][4] =
-    {
-        { 3, 4, 4, 2 },
-        { 4, 3, 3, 3 },
-        { 4, 3, 3, 3 },
-    };
-    return margins[[checkbox() controlSize]];
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setCheckboxCellState(const RenderObject* o, const IntRect& r)
-{
-    NSButtonCell* checkbox = this->checkbox();
-
-    // Set the control size based off the rectangle we're painting into.
-    setControlSize(checkbox, checkboxSizes(), r.size(), o->style()->effectiveZoom());
-
-    // Update the various states we respond to.
-    updateCheckedState(checkbox, o);
-    updateEnabledState(checkbox, o);
-    updatePressedState(checkbox, o);
-    updateFocusedState(checkbox, o);
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setCheckboxSize(RenderStyle* style) const
-{
-    // If the width and height are both specified, then we have nothing to do.
-    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
-        return;
-
-    // Use the font size to determine the intrinsic width of the control.
-    setSizeFromFont(style, checkboxSizes());
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-bool RenderThemeChromiumMac::paintRadio(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
-{
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
-    // Determine the width and height needed for the control and prepare the cell for painting.
-    setRadioCellState(o, r);
-
-    paintInfo.context->save();
-
-    float zoomLevel = o->style()->effectiveZoom();
-
-    // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
-    // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
-    NSButtonCell* radio = this->radio();
-    IntSize size = radioSizes()[[radio controlSize]];
-    size.setWidth(size.width() * zoomLevel);
-    size.setHeight(size.height() * zoomLevel);
-    IntRect inflatedRect = inflateRect(r, size, radioMargins(), zoomLevel);
-    
-    if (zoomLevel != 1.0f) {
-        inflatedRect.setWidth(inflatedRect.width() / zoomLevel);
-        inflatedRect.setHeight(inflatedRect.height() / zoomLevel);
-        paintInfo.context->translate(inflatedRect.x(), inflatedRect.y());
-        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
-        paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
-    }
-
-    [radio drawWithFrame:NSRect(IntRectToNSRect(inflatedRect)) inView:nil];
-    [radio setControlView:nil];
-
-    paintInfo.context->restore();
-
-    return false;
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const IntSize* RenderThemeChromiumMac::radioSizes() const
-{
-    static const IntSize sizes[3] = { IntSize(14, 15), IntSize(12, 13), IntSize(10, 10) };
-    return sizes;
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const int* RenderThemeChromiumMac::radioMargins() const
-{
-    static const int margins[3][4] =
-    {
-        { 2, 2, 4, 2 },
-        { 3, 2, 3, 2 },
-        { 1, 0, 2, 0 },
-    };
-    return margins[[radio() controlSize]];
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setRadioCellState(const RenderObject* o, const IntRect& r)
-{
-    NSButtonCell* radio = this->radio();
-
-    // Set the control size based off the rectangle we're painting into.
-    setControlSize(radio, radioSizes(), r.size(), o->style()->effectiveZoom());
-
-    // Update the various states we respond to.
-    updateCheckedState(radio, o);
-    updateEnabledState(radio, o);
-    updatePressedState(radio, o);
-    updateFocusedState(radio, o);
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setRadioSize(RenderStyle* style) const
-{
-    // If the width and height are both specified, then we have nothing to do.
-    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
-        return;
-
-    // Use the font size to determine the intrinsic width of the control.
-    setSizeFromFont(style, radioSizes());
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setButtonPaddingFromControlSize(RenderStyle* style, NSControlSize size) const
-{
-    // Just use 8px.  AppKit wants to use 11px for mini buttons, but that padding is just too large
-    // for real-world Web sites (creating a huge necessary minimum width for buttons whose space is
-    // by definition constrained, since we select mini only for small cramped environments.
-    // This also guarantees the HTML4 <button> will match our rendering by default, since we're using a consistent
-    // padding.
-    const int padding = 8 * style->effectiveZoom();
-    style->setPaddingLeft(Length(padding, Fixed));
-    style->setPaddingRight(Length(padding, Fixed));
-    style->setPaddingTop(Length(0, Fixed));
-    style->setPaddingBottom(Length(0, Fixed));
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
-{
-    // There are three appearance constants for buttons.
-    // (1) Push-button is the constant for the default Aqua system button.  Push buttons will not scale vertically and will not allow
-    // custom fonts or colors.  <input>s use this constant.  This button will allow custom colors and font weights/variants but won't
-    // scale vertically.
-    // (2) square-button is the constant for the square button.  This button will allow custom fonts and colors and will scale vertically.
-    // (3) Button is the constant that means "pick the best button as appropriate."  <button>s use this constant.  This button will
-    // also scale vertically and allow custom fonts and colors.  It will attempt to use Aqua if possible and will make this determination
-    // solely on the rectangle of the control.
-
-    // Determine our control size based off our font.
-    NSControlSize controlSize = controlSizeForFont(style);
-
-    if (style->appearance() == PushButtonPart) {
-        // Ditch the border.
-        style->resetBorder();
-
-        // Height is locked to auto.
-        style->setHeight(Length(Auto));
-
-        // White-space is locked to pre
-        style->setWhiteSpace(PRE);
-
-        // Set the button's vertical size.
-        setButtonSize(style);
-
-        // Add in the padding that we'd like to use.
-        setButtonPaddingFromControlSize(style, controlSize);
-
-        // Our font is locked to the appropriate system font size for the control.  To clarify, we first use the CSS-specified font to figure out
-        // a reasonable control size, but once that control size is determined, we throw that font away and use the appropriate
-        // system font for the control size instead.
-        setFontFromControlSize(selector, style, controlSize);
-    } else {
-        // Set a min-height so that we can't get smaller than the mini button.
-        style->setMinHeight(Length(static_cast<int>(15 * style->effectiveZoom()), Fixed));
-
-        // Reset the top and bottom borders.
-        style->resetBorderTop();
-        style->resetBorderBottom();
-    }
-
-    style->setBoxShadow(0);
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const IntSize* RenderThemeChromiumMac::buttonSizes() const
-{
-    static const IntSize sizes[3] = { IntSize(0, 21), IntSize(0, 18), IntSize(0, 15) };
-    return sizes;
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const int* RenderThemeChromiumMac::buttonMargins() const
-{
-    static const int margins[3][4] =
-    {
-        { 4, 6, 7, 6 },
-        { 4, 5, 6, 5 },
-        { 0, 1, 1, 1 },
-    };
-    return margins[[button() controlSize]];
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setButtonSize(RenderStyle* style) const
-{
-    // If the width and height are both specified, then we have nothing to do.
-    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
-        return;
-
-    // Use the font size to determine the intrinsic width of the control.
-    setSizeFromFont(style, buttonSizes());
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setButtonCellState(const RenderObject* o, const IntRect& r)
-{
-    NSButtonCell* button = this->button();
-
-    // Set the control size based off the rectangle we're painting into.
-    if (o->style()->appearance() == SquareButtonPart ||
-        r.height() > buttonSizes()[NSRegularControlSize].height() * o->style()->effectiveZoom()) {
-        // Use the square button
-        if ([button bezelStyle] != NSShadowlessSquareBezelStyle)
-            [button setBezelStyle:NSShadowlessSquareBezelStyle];
-    } else if ([button bezelStyle] != NSRoundedBezelStyle)
-        [button setBezelStyle:NSRoundedBezelStyle];
-
-    setControlSize(button, buttonSizes(), r.size(), o->style()->effectiveZoom());
-
-    NSWindow *window = [nil window];
-    BOOL isDefaultButton = (isDefault(o) && [window isKeyWindow]);
-    [button setKeyEquivalent:(isDefaultButton ? @"\r" : @"")];
-
-    // Update the various states we respond to.
-    updateCheckedState(button, o);
-    updateEnabledState(button, o);
-    updatePressedState(button, o);
-    updateFocusedState(button, o);
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-bool RenderThemeChromiumMac::paintButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
-{
-    NSButtonCell* button = this->button();
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
-    // Determine the width and height needed for the control and prepare the cell for painting.
-    setButtonCellState(o, r);
-
-    paintInfo.context->save();
-
-    // We inflate the rect as needed to account for padding included in the cell to accommodate the button
-    // shadow.  We don't consider this part of the bounds of the control in WebKit.
-    float zoomLevel = o->style()->effectiveZoom();
-    IntSize size = buttonSizes()[[button controlSize]];
-    size.setWidth(r.width());
-    size.setHeight(size.height() * zoomLevel);
-    IntRect inflatedRect = r;
-    if ([button bezelStyle] == NSRoundedBezelStyle) {
-        // Center the button within the available space.
-        if (inflatedRect.height() > size.height()) {
-            inflatedRect.setY(inflatedRect.y() + (inflatedRect.height() - size.height()) / 2);
-            inflatedRect.setHeight(size.height());
-        }
-
-        // Now inflate it to account for the shadow.
-        inflatedRect = inflateRect(inflatedRect, size, buttonMargins(), zoomLevel);
-
-        if (zoomLevel != 1.0f) {
-            inflatedRect.setWidth(inflatedRect.width() / zoomLevel);
-            inflatedRect.setHeight(inflatedRect.height() / zoomLevel);
-            paintInfo.context->translate(inflatedRect.x(), inflatedRect.y());
-            paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
-            paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
-        }
-    } 
-
-    NSView *view = nil;
-    NSWindow *window = [view window];
-    NSButtonCell *previousDefaultButtonCell = [window defaultButtonCell];
-
-    if (isDefault(o) && [window isKeyWindow]) {
-        [window setDefaultButtonCell:button];
-        wkAdvanceDefaultButtonPulseAnimation(button);
-    } else if ([previousDefaultButtonCell isEqual:button])
-        [window setDefaultButtonCell:nil];
-
-    [button drawWithFrame:NSRect(IntRectToNSRect(inflatedRect)) inView:view];
-    [button setControlView:nil];
-
-    if (![previousDefaultButtonCell isEqual:button])
-        [window setDefaultButtonCell:previousDefaultButtonCell];
-
-    paintInfo.context->restore();
-
-    return false;
-}
-
 bool RenderThemeChromiumMac::paintTextField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawBezeledTextFieldCell(IntRectToNSRect(r), isEnabled(o) && !isReadOnlyControl(o));
+    wkDrawBezeledTextFieldCell(r, isEnabled(o) && !isReadOnlyControl(o));
     return false;
 }
 
@@ -1051,7 +753,7 @@ void RenderThemeChromiumMac::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle
 {
 }
 
-bool RenderThemeChromiumMac::paintCapsLockIndicator(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     if (paintInfo.context->paintingDisabled())
         return true;
@@ -1065,7 +767,7 @@ bool RenderThemeChromiumMac::paintCapsLockIndicator(RenderObject* o, const Rende
 bool RenderThemeChromiumMac::paintTextArea(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawBezeledTextArea(IntRectToNSRect(r), isEnabled(o) && !isReadOnlyControl(o));
+    wkDrawBezeledTextArea(r, isEnabled(o) && !isReadOnlyControl(o));
     return false;
 }
 
@@ -1103,8 +805,6 @@ const int* RenderThemeChromiumMac::popupButtonPadding(NSControlSize size) const
 
 bool RenderThemeChromiumMac::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
     setPopupButtonCellState(o, r);
 
     NSPopUpButtonCell* popupButton = this->popupButton();
@@ -1134,7 +834,7 @@ bool RenderThemeChromiumMac::paintMenuList(RenderObject* o, const RenderObject::
         paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
     }
 
-    [popupButton drawWithFrame:IntRectToNSRect(inflatedRect) inView:nil];
+    [popupButton drawWithFrame:inflatedRect inView:FlippedView()];
     [popupButton setControlView:nil];
 
     paintInfo.context->restore();
@@ -1142,19 +842,19 @@ bool RenderThemeChromiumMac::paintMenuList(RenderObject* o, const RenderObject::
     return false;
 }
 
-static const float baseFontSize = 11.0f;
-static const float baseArrowHeight = 4.0f;
-static const float baseArrowWidth = 5.0f;
-static const float baseSpaceBetweenArrows = 2.0f;
-static const int arrowPaddingLeft = 6;
-static const int arrowPaddingRight = 6;
-static const int paddingBeforeSeparator = 4;
-static const int baseBorderRadius = 5;
-static const int styledPopupPaddingLeft = 8;
-static const int styledPopupPaddingTop = 1;
-static const int styledPopupPaddingBottom = 2;
+const float baseFontSize = 11.0f;
+const float baseArrowHeight = 4.0f;
+const float baseArrowWidth = 5.0f;
+const float baseSpaceBetweenArrows = 2.0f;
+const int arrowPaddingLeft = 6;
+const int arrowPaddingRight = 6;
+const int paddingBeforeSeparator = 4;
+const int baseBorderRadius = 5;
+const int styledPopupPaddingLeft = 8;
+const int styledPopupPaddingTop = 1;
+const int styledPopupPaddingBottom = 2;
 
-static void TopGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+static void TopGradientInterpolate(void*, const CGFloat* inData, CGFloat* outData)
 {
     static float dark[4] = { 1.0f, 1.0f, 1.0f, 0.4f };
     static float light[4] = { 1.0f, 1.0f, 1.0f, 0.15f };
@@ -1164,7 +864,7 @@ static void TopGradientInterpolate(void* info, const CGFloat* inData, CGFloat* o
         outData[i] = (1.0f - a) * dark[i] + a * light[i];
 }
 
-static void BottomGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+static void BottomGradientInterpolate(void*, const CGFloat* inData, CGFloat* outData)
 {
     static float dark[4] = { 1.0f, 1.0f, 1.0f, 0.0f };
     static float light[4] = { 1.0f, 1.0f, 1.0f, 0.3f };
@@ -1174,7 +874,7 @@ static void BottomGradientInterpolate(void* info, const CGFloat* inData, CGFloat
         outData[i] = (1.0f - a) * dark[i] + a * light[i];
 }
 
-static void MainGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+static void MainGradientInterpolate(void*, const CGFloat* inData, CGFloat* outData)
 {
     static float dark[4] = { 0.0f, 0.0f, 0.0f, 0.15f };
     static float light[4] = { 0.0f, 0.0f, 0.0f, 0.0f };
@@ -1184,7 +884,7 @@ static void MainGradientInterpolate(void* info, const CGFloat* inData, CGFloat*
         outData[i] = (1.0f - a) * dark[i] + a * light[i];
 }
 
-static void TrackGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+static void TrackGradientInterpolate(void*, const CGFloat* inData, CGFloat* outData)
 {
     static float dark[4] = { 0.0f, 0.0f, 0.0f, 0.678f };
     static float light[4] = { 0.0f, 0.0f, 0.0f, 0.13f };
@@ -1196,11 +896,21 @@ static void TrackGradientInterpolate(void* info, const CGFloat* inData, CGFloat*
 
 void RenderThemeChromiumMac::paintMenuListButtonGradients(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    if (r.isEmpty())
+        return;
+
     CGContextRef context = paintInfo.context->platformContext();
 
     paintInfo.context->save();
 
-    int radius = o->style()->borderTopLeftRadius().width();
+    IntSize topLeftRadius;
+    IntSize topRightRadius;
+    IntSize bottomLeftRadius;
+    IntSize bottomRightRadius;
+
+    o->style()->getBorderRadiiForRect(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+    int radius = topLeftRadius.width();
 
     RetainPtr<CGColorSpaceRef> cspace(AdoptCF, CGColorSpaceCreateDeviceRGB());
 
@@ -1223,33 +933,27 @@ void RenderThemeChromiumMac::paintMenuListButtonGradients(RenderObject* o, const
     RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(r.right(),  r.y()), CGPointMake(r.right() - radius, r.y()), mainFunction.get(), false, false));
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, mainShading.get());
     paintInfo.context->restore();
 
     paintInfo.context->save();
     CGContextClipToRect(context, topGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient),
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        IntSize(), IntSize());
+    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient), topLeftRadius, topRightRadius, IntSize(), IntSize());
     CGContextDrawShading(context, topShading.get());
     paintInfo.context->restore();
 
-    paintInfo.context->save();
-    CGContextClipToRect(context, bottomGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient),
-        IntSize(), IntSize(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
-    CGContextDrawShading(context, bottomShading.get());
-    paintInfo.context->restore();
+    if (!bottomGradient.isEmpty()) {
+        paintInfo.context->save();
+        CGContextClipToRect(context, bottomGradient);
+        paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient), IntSize(), IntSize(), bottomLeftRadius, bottomRightRadius);
+        CGContextDrawShading(context, bottomShading.get());
+        paintInfo.context->restore();
+    }
 
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, leftShading.get());
     CGContextDrawShading(context, rightShading.get());
     paintInfo.context->restore();
@@ -1259,8 +963,6 @@ void RenderThemeChromiumMac::paintMenuListButtonGradients(RenderObject* o, const
 
 bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    paintInfo.context->save();
-
     IntRect bounds = IntRect(r.x() + o->style()->borderLeftWidth(),
                              r.y() + o->style()->borderTopWidth(),
                              r.width() - o->style()->borderLeftWidth() - o->style()->borderRightWidth(),
@@ -1279,6 +981,8 @@ bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderOb
     if (bounds.width() < arrowWidth + arrowPaddingLeft * o->style()->effectiveZoom())
         return false;
     
+    paintInfo.context->save();
+
     paintInfo.context->setFillColor(o->style()->color());
     paintInfo.context->setStrokeStyle(NoStroke);
 
@@ -1357,7 +1061,7 @@ void RenderThemeChromiumMac::adjustMenuListStyle(CSSStyleSelector* selector, Ren
 int RenderThemeChromiumMac::popupInternalPaddingLeft(RenderStyle* style) const
 {
     if (style->appearance() == MenulistPart)
-        return popupButtonPadding(controlSizeForFont(style))[LeftPadding] * style->effectiveZoom();
+        return popupButtonPadding(controlSizeForFont(style))[leftPadding] * style->effectiveZoom();
     if (style->appearance() == MenulistButtonPart)
         return styledPopupPaddingLeft * style->effectiveZoom();
     return 0;
@@ -1366,7 +1070,7 @@ int RenderThemeChromiumMac::popupInternalPaddingLeft(RenderStyle* style) const
 int RenderThemeChromiumMac::popupInternalPaddingRight(RenderStyle* style) const
 {
     if (style->appearance() == MenulistPart)
-        return popupButtonPadding(controlSizeForFont(style))[RightPadding] * style->effectiveZoom();
+        return popupButtonPadding(controlSizeForFont(style))[rightPadding] * style->effectiveZoom();
     if (style->appearance() == MenulistButtonPart) {
         float fontScale = style->fontSize() / baseFontSize;
         float arrowWidth = baseArrowWidth * fontScale;
@@ -1378,7 +1082,7 @@ int RenderThemeChromiumMac::popupInternalPaddingRight(RenderStyle* style) const
 int RenderThemeChromiumMac::popupInternalPaddingTop(RenderStyle* style) const
 {
     if (style->appearance() == MenulistPart)
-        return popupButtonPadding(controlSizeForFont(style))[TopPadding] * style->effectiveZoom();
+        return popupButtonPadding(controlSizeForFont(style))[topPadding] * style->effectiveZoom();
     if (style->appearance() == MenulistButtonPart)
         return styledPopupPaddingTop * style->effectiveZoom();
     return 0;
@@ -1387,13 +1091,13 @@ int RenderThemeChromiumMac::popupInternalPaddingTop(RenderStyle* style) const
 int RenderThemeChromiumMac::popupInternalPaddingBottom(RenderStyle* style) const
 {
     if (style->appearance() == MenulistPart)
-        return popupButtonPadding(controlSizeForFont(style))[BottomPadding] * style->effectiveZoom();
+        return popupButtonPadding(controlSizeForFont(style))[bottomPadding] * style->effectiveZoom();
     if (style->appearance() == MenulistButtonPart)
         return styledPopupPaddingBottom * style->effectiveZoom();
     return 0;
 }
 
-void RenderThemeChromiumMac::adjustMenuListButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     float fontScale = style->fontSize() / baseFontSize;
 
@@ -1414,6 +1118,7 @@ void RenderThemeChromiumMac::setPopupButtonCellState(const RenderObject* o, cons
     setControlSize(popupButton, popupButtonSizes(), r.size(), o->style()->effectiveZoom());
 
     // Update the various states we respond to.
+    updateActiveState(popupButton, o);
     updateCheckedState(popupButton, o);
     updateEnabledState(popupButton, o);
     updatePressedState(popupButton, o);
@@ -1431,16 +1136,16 @@ int RenderThemeChromiumMac::minimumMenuListSize(RenderStyle* style) const
     return sizeForSystemFont(style, menuListSizes()).width();
 }
 
-static const int trackWidth = 5;
-static const int trackRadius = 2;
-
-void RenderThemeChromiumMac::adjustSliderTrackStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     style->setBoxShadow(0);
 }
 
 bool RenderThemeChromiumMac::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    static const int trackWidth = 5;
+    static const int trackRadius = 2;
+  
     IntRect bounds = r;
     float zoomLevel = o->style()->effectiveZoom();
     float zoomedTrackWidth = trackWidth * zoomLevel;
@@ -1478,12 +1183,12 @@ bool RenderThemeChromiumMac::paintSliderTrack(RenderObject* o, const RenderObjec
     return false;
 }
 
-void RenderThemeChromiumMac::adjustSliderThumbStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     style->setBoxShadow(0);
 }
 
-static const float verticalSliderHeightPadding = 0.1f;
+const float verticalSliderHeightPadding = 0.1f;
 
 bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
@@ -1496,6 +1201,7 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     LocalCurrentGraphicsContext localContext(paintInfo.context);
 
     // Update the various states we respond to.
+    updateActiveState(sliderThumbCell, o);
     updateEnabledState(sliderThumbCell, o->parent());
     updateFocusedState(sliderThumbCell, o->parent());
 
@@ -1537,7 +1243,7 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
         paintInfo.context->translate(-unzoomedRect.x(), -unzoomedRect.y());
     }
 
-    [sliderThumbCell drawWithFrame:FloatRectToNSRect(unzoomedRect) inView:nil];
+    [sliderThumbCell drawWithFrame:unzoomedRect inView:FlippedView()];
     [sliderThumbCell setControlView:nil];
 
     paintInfo.context->restore();
@@ -1545,21 +1251,20 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     return false;
 }
 
-const int sliderThumbWidth = 15;
-const int sliderThumbHeight = 15;
-const int mediaSliderThumbWidth = 13;
-const int mediaSliderThumbHeight = 14;
-
 void RenderThemeChromiumMac::adjustSliderThumbSize(RenderObject* o) const
 {
+    static const int sliderThumbWidth = 15;
+    static const int sliderThumbHeight = 15;
+
     float zoomLevel = o->style()->effectiveZoom();
     if (o->style()->appearance() == SliderThumbHorizontalPart || o->style()->appearance() == SliderThumbVerticalPart) {
         o->style()->setWidth(Length(static_cast<int>(sliderThumbWidth * zoomLevel), Fixed));
         o->style()->setHeight(Length(static_cast<int>(sliderThumbHeight * zoomLevel), Fixed));
-    } else if (o->style()->appearance() == MediaSliderThumbPart) {
-        o->style()->setWidth(Length(mediaSliderThumbWidth, Fixed));
-        o->style()->setHeight(Length(mediaSliderThumbHeight, Fixed));
     }
+
+#if ENABLE(VIDEO)
+    RenderMediaControlsChromium::adjustMediaSliderThumbSize(o);
+#endif
 }
 
 bool RenderThemeChromiumMac::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
@@ -1586,7 +1291,7 @@ bool RenderThemeChromiumMac::paintSearchField(RenderObject* o, const RenderObjec
     // Set the search button to nil before drawing.  Then reset it so we can draw it later.
     [search setSearchButtonCell:nil];
 
-    [search drawWithFrame:NSRect(IntRectToNSRect(unzoomedRect)) inView:nil];
+    [search drawWithFrame:NSRect(unzoomedRect) inView:FlippedView()];
 #ifdef BUILDING_ON_TIGER
     if ([search showsFirstResponder])
         wkDrawTextFieldCellFocusRing(search, NSRect(unzoomedRect));
@@ -1600,13 +1305,14 @@ bool RenderThemeChromiumMac::paintSearchField(RenderObject* o, const RenderObjec
     return false;
 }
 
-void RenderThemeChromiumMac::setSearchCellState(RenderObject* o, const IntRect& r)
+void RenderThemeChromiumMac::setSearchCellState(RenderObject* o, const IntRect&)
 {
     NSSearchFieldCell* search = this->search();
 
     [search setControlSize:controlSizeForFont(o->style())];
 
     // Update the various states we respond to.
+    updateActiveState(search, o);
     updateEnabledState(search, o);
     updateFocusedState(search, o);
 }
@@ -1627,7 +1333,7 @@ void RenderThemeChromiumMac::setSearchFieldSize(RenderStyle* style) const
     setSizeFromFont(style, searchFieldSizes());
 }
 
-void RenderThemeChromiumMac::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderStyle* style, Element*) const
 {
     // Override border.
     style->resetBorder();
@@ -1660,22 +1366,25 @@ void RenderThemeChromiumMac::adjustSearchFieldStyle(CSSStyleSelector* selector,
 
 bool RenderThemeChromiumMac::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
     Node* input = o->node()->shadowAncestorNode();
+    if (!input->renderer()->isBox())
+        return false;
+
     setSearchCellState(input->renderer(), r);
 
     NSSearchFieldCell* search = this->search();
 
+    updateActiveState([search cancelButtonCell], o);
     updatePressedState([search cancelButtonCell], o);
 
     paintInfo.context->save();
 
     float zoomLevel = o->style()->effectiveZoom();
 
-    NSRect bounds = [search cancelButtonRectForBounds:NSRect(IntRectToNSRect(input->renderer()->absoluteBoundingBoxRect()))];
-    
-    IntRect unzoomedRect(NSRectToIntRect(bounds));
+    FloatRect localBounds = [search cancelButtonRectForBounds:NSRect(input->renderBox()->borderBoxRect())];
+    localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
+
+    FloatRect unzoomedRect(localBounds);
     if (zoomLevel != 1.0f) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
         unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
@@ -1684,7 +1393,7 @@ bool RenderThemeChromiumMac::paintSearchFieldCancelButton(RenderObject* o, const
         paintInfo.context->translate(-unzoomedRect.x(), -unzoomedRect.y());
     }
 
-    [[search cancelButtonCell] drawWithFrame:IntRectToNSRect(unzoomedRect) inView:nil];
+    [[search cancelButtonCell] drawWithFrame:unzoomedRect inView:FlippedView()];
     [[search cancelButtonCell] setControlView:nil];
 
     paintInfo.context->restore();
@@ -1697,7 +1406,7 @@ const IntSize* RenderThemeChromiumMac::cancelButtonSizes() const
     return sizes;
 }
 
-void RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     IntSize size = sizeForSystemFont(style, cancelButtonSizes());
     style->setWidth(Length(size.width(), Fixed));
@@ -1711,8 +1420,8 @@ const IntSize* RenderThemeChromiumMac::resultsButtonSizes() const
     return sizes;
 }
 
-static const int emptyResultsOffset = 9;
-void RenderThemeChromiumMac::adjustSearchFieldDecorationStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+const int emptyResultsOffset = 9;
+void RenderThemeChromiumMac::adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     IntSize size = sizeForSystemFont(style, resultsButtonSizes());
     style->setWidth(Length(size.width() - emptyResultsOffset, Fixed));
@@ -1720,12 +1429,12 @@ void RenderThemeChromiumMac::adjustSearchFieldDecorationStyle(CSSStyleSelector*
     style->setBoxShadow(0);
 }
 
-bool RenderThemeChromiumMac::paintSearchFieldDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
 {
     return false;
 }
 
-void RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     IntSize size = sizeForSystemFont(style, resultsButtonSizes());
     style->setWidth(Length(size.width(), Fixed));
@@ -1735,24 +1444,29 @@ void RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle(CSSStyleSel
 
 bool RenderThemeChromiumMac::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
     Node* input = o->node()->shadowAncestorNode();
+    if (!input->renderer()->isBox())
+        return false;
+
     setSearchCellState(input->renderer(), r);
 
     NSSearchFieldCell* search = this->search();
 
+    updateActiveState([search searchButtonCell], o);
+
     if ([search searchMenuTemplate] != nil)
         [search setSearchMenuTemplate:nil];
 
-    NSRect bounds = [search searchButtonRectForBounds:NSRect(IntRectToNSRect(input->renderer()->absoluteBoundingBoxRect()))];
-    [[search searchButtonCell] drawWithFrame:bounds inView:nil];
+    FloatRect localBounds = [search searchButtonRectForBounds:NSRect(input->renderBox()->borderBoxRect())];
+    localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
+
+    [[search searchButtonCell] drawWithFrame:localBounds inView:FlippedView()];
     [[search searchButtonCell] setControlView:nil];
     return false;
 }
 
-static const int resultsArrowWidth = 5;
-void RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+const int resultsArrowWidth = 5;
+void RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     IntSize size = sizeForSystemFont(style, resultsButtonSizes());
     style->setWidth(Length(size.width() + resultsArrowWidth, Fixed));
@@ -1762,13 +1476,16 @@ void RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle(CSSStyleSelecto
 
 bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
     Node* input = o->node()->shadowAncestorNode();
+    if (!input->renderer()->isBox())
+        return false;
+
     setSearchCellState(input->renderer(), r);
 
     NSSearchFieldCell* search = this->search();
 
+    updateActiveState([search searchButtonCell], o);
+
     if (![search searchMenuTemplate])
         [search setSearchMenuTemplate:searchMenuTemplate()];
 
@@ -1776,9 +1493,10 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
 
     float zoomLevel = o->style()->effectiveZoom();
 
-    NSRect bounds = [search searchButtonRectForBounds:NSRect(IntRectToNSRect(input->renderer()->absoluteBoundingBoxRect()))];
+    FloatRect localBounds = [search searchButtonRectForBounds:NSRect(input->renderBox()->borderBoxRect())];
+    localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
     
-    IntRect unzoomedRect(NSRectToIntRect(bounds));
+    IntRect unzoomedRect(localBounds);
     if (zoomLevel != 1.0f) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
         unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
@@ -1787,7 +1505,7 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
         paintInfo.context->translate(-unzoomedRect.x(), -unzoomedRect.y());
     }
 
-    [[search searchButtonCell] drawWithFrame:IntRectToNSRect(unzoomedRect) inView:nil];
+    [[search searchButtonCell] drawWithFrame:unzoomedRect inView:FlippedView()];
     [[search searchButtonCell] setControlView:nil];
     
     paintInfo.context->restore();
@@ -1796,179 +1514,53 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
 }
 
 #if ENABLE(VIDEO)
-// FIXME: This enum is lifted from RenderThemeMac.mm  We need to decide which theme to use for the default controls, or decide to avoid wkDrawMediaUIPart and render our own.
-typedef enum {
-    MediaControllerThemeClassic   = 1,
-    MediaControllerThemeQT        = 2
-} MediaControllerThemeStyle;
-
-enum WKMediaControllerThemeState {
-    MediaUIPartDisabledFlag = 1 << 0,
-    MediaUIPartPressedFlag = 1 << 1,
-    MediaUIPartDrawEndCapsFlag = 1 << 3,
-};
-#endif
-
-bool RenderThemeChromiumMac::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::shouldRenderMediaControlPart(ControlPart part, Element* e)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    if (!node)
-        return false;
-
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaFullscreenButton, MediaControllerThemeClassic,  paintInfo.context->platformContext(), r, 
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
 }
 
-bool RenderThemeChromiumMac::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-    
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(mediaElement->muted() ? MediaUnMuteButton : MediaMuteButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r,
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(mediaElement->canPlay() ? MediaPlayButton : MediaPauseButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r,
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaMuteButton, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    if (!node)
-        return false;
-
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaSeekBackButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r,
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSlider, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    if (!node)
-        return false;
-
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaSeekForwardButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r,
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSlider, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-
-    float timeLoaded = 0;
-    float currentTime = 0;
-    float duration = 0;
-    if (MediaPlayer* player = mediaElement->player()) {
-        duration = player->duration();
-        timeLoaded = player->maxTimeBuffered();
-        currentTime = player->currentTime();
-    }
-
-    bool shouldDrawEndCaps = !toRenderMedia(mediaElement->renderer())->shouldShowTimeDisplayControls();
-    wkDrawMediaSliderTrack(MediaControllerThemeClassic, paintInfo.context->platformContext(), r, timeLoaded, currentTime, duration, shouldDrawEndCaps ? MediaUIPartDrawEndCapsFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSliderThumb, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    if (!node)
-        return false;
-
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaSliderThumb, MediaControllerThemeClassic, paintInfo.context->platformContext(), r,
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSliderThumb, object, paintInfo, rect);
 }
 
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-NSButtonCell* RenderThemeChromiumMac::checkbox() const
+bool RenderThemeChromiumMac::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    if (!m_checkbox) {
-        m_checkbox.adoptNS([[NSButtonCell alloc] init]);
-        [m_checkbox.get() setButtonType:NSSwitchButton];
-        [m_checkbox.get() setTitle:nil];
-        [m_checkbox.get() setAllowsMixedState:YES];
-        [m_checkbox.get() setFocusRingType:NSFocusRingTypeExterior];
-    }
-    
-    return m_checkbox.get();
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
 }
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-NSButtonCell* RenderThemeChromiumMac::radio() const
-{
-    if (!m_radio) {
-        m_radio.adoptNS([[NSButtonCell alloc] init]);
-        [m_radio.get() setButtonType:NSRadioButton];
-        [m_radio.get() setTitle:nil];
-        [m_radio.get() setFocusRingType:NSFocusRingTypeExterior];
-    }
     
-    return m_radio.get();
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-NSButtonCell* RenderThemeChromiumMac::button() const
+String RenderThemeChromiumMac::extraMediaControlsStyleSheet()
 {
-    if (!m_button) {
-        m_button.adoptNS([[NSButtonCell alloc] init]);
-        [m_button.get() setTitle:nil];
-        [m_button.get() setButtonType:NSMomentaryPushInButton];
-    }
-    
-    return m_button.get();
+    return String(mediaControlsChromiumUserAgentStyleSheet, sizeof(mediaControlsChromiumUserAgentStyleSheet));
 }
 
+#endif
+
 NSPopUpButtonCell* RenderThemeChromiumMac::popupButton() const
 {
     if (!m_popupButton) {
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.cpp b/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 79804ac..3a39423 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -33,8 +33,11 @@
 #include "MediaControlElements.h"
 #include "PlatformContextSkia.h"
 #include "RenderBox.h"
+#include "RenderMediaControlsChromium.h"
 #include "RenderObject.h"
+#include "RenderSlider.h"
 #include "ScrollbarTheme.h"
+#include "TimeRanges.h"
 #include "TransformationMatrix.h"
 #include "UserAgentStyleSheets.h"
 
@@ -70,19 +73,29 @@ static void setSizeIfAuto(RenderStyle* style, const IntSize& size)
         style->setHeight(Length(size.height(), Fixed));
 }
 
-#if ENABLE(VIDEO)
-// Attempt to retrieve a HTMLMediaElement from a Node. Returns NULL if one cannot be found.
-static HTMLMediaElement* mediaElementParent(Node* node)
+static void drawVertLine(SkCanvas* canvas, int x, int y1, int y2, const SkPaint& paint)
 {
-    if (!node)
-        return 0;
-    Node* mediaNode = node->shadowAncestorNode();
-    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
-        return 0;
+    SkIRect skrect;
+    skrect.set(x, y1, x + 1, y2 + 1);
+    canvas->drawIRect(skrect, paint);
+}
 
-    return static_cast<HTMLMediaElement*>(mediaNode);
+static void drawHorizLine(SkCanvas* canvas, int x1, int x2, int y, const SkPaint& paint)
+{
+    SkIRect skrect;
+    skrect.set(x1, y, x2 + 1, y + 1);
+    canvas->drawIRect(skrect, paint);
+}
+
+static void drawBox(SkCanvas* canvas, const IntRect& rect, const SkPaint& paint)
+{
+    const int right = rect.x() + rect.width() - 1;
+    const int bottom = rect.y() + rect.height() - 1;
+    drawHorizLine(canvas, rect.x(), right, rect.y(), paint);
+    drawVertLine(canvas, right, rect.y(), bottom, paint);
+    drawHorizLine(canvas, rect.x(), right, bottom, paint);
+    drawVertLine(canvas, rect.x(), rect.y(), bottom, paint);
 }
-#endif
 
 // We aim to match IE here.
 // -IE uses a font based on the encoding as the default font for form controls.
@@ -302,7 +315,7 @@ static void paintButtonLike(RenderTheme* theme, RenderObject* o, const RenderObj
     canvas->drawLine(rect.x() + 1, bottom - 1, right - 1, bottom - 1, paint);
     canvas->drawLine(rect.x(), rect.y() + 1, rect.x(), bottom - 1, paint);
 
-    paint.setARGB(0xff, 0, 0, 0);
+    paint.setColor(SK_ColorBLACK);
     SkPoint p[2];
     const int lightEnd = theme->isPressed(o) ? 1 : 0;
     const int darkEnd = !lightEnd;
@@ -460,42 +473,10 @@ bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* o, con
     return false;
 }
 
-bool RenderThemeChromiumSkia::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
-{
-    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
-    IntRect imageRect = image->rect();
-    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
-    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
-
-    context->drawImage(image, imageRect);
-    return true;
-}
-
 bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    if (!rect.isEmpty())
-    {
-        SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
-        SkPaint paint;
-
-        // Draws the left border, it is always 1px wide.
-        paint.setColor(object->style()->borderLeftColor().rgb());
-        canvas->drawLine(rect.x() + 1, rect.y(),
-                         rect.x() + 1, rect.y() + rect.height(),
-                         paint);
-
-        // Draws the right border, it is always 1px wide.
-        paint.setColor(object->style()->borderRightColor().rgb());
-        canvas->drawLine(rect.x() + rect.width() - 1, rect.y(),
-                         rect.x() + rect.width() - 1, rect.y() + rect.height(),
-                         paint);
-    }
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -507,62 +488,7 @@ bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object,
 bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
-    SkRect backgroundRect;
-    backgroundRect.set(rect.x(), rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
-
-    SkPaint paint;
-    paint.setAntiAlias(true);
-
-    // Draw the border of the time bar. The border only has one single color,
-    // width and radius. So use the property of the left border.
-    SkColor borderColor = object->style()->borderLeftColor().rgb();
-    int borderWidth = object->style()->borderLeftWidth();
-    IntSize borderRadius = object->style()->borderTopLeftRadius();
-    paint.setStyle(SkPaint::kStroke_Style);
-    paint.setStrokeWidth(borderWidth);
-    paint.setColor(borderColor);
-    canvas->drawRoundRect(backgroundRect, borderRadius.width(), borderRadius.height(), paint);
-
-    // Draw the background of the time bar.
-    SkColor backgroundColor = object->style()->backgroundColor().rgb();
-    paint.setStyle(SkPaint::kFill_Style);
-    paint.setColor(backgroundColor);
-    canvas->drawRoundRect(backgroundRect, borderRadius.width(), borderRadius.height(), paint);
-
-    if (backgroundRect.width() >= 3 && backgroundRect.height() >= 3)
-    {
-        // Draw the buffered ranges.
-        // FIXME: Draw multiple ranges if there are multiple buffered ranges.
-        SkRect bufferedRect;
-        bufferedRect.set(backgroundRect.fLeft + 2, backgroundRect.fTop + 2,
-                         backgroundRect.fRight - 1, backgroundRect.fBottom - 1);
-        int width = static_cast<int>(bufferedRect.width() * mediaElement->percentLoaded());
-        bufferedRect.fRight = bufferedRect.fLeft + width;
-
-        SkPoint points[2] = { { 0, bufferedRect.fTop }, { 0, bufferedRect.fBottom } };
-        SkColor startColor = object->style()->color().rgb();
-        SkColor endColor = SkColorSetRGB(SkColorGetR(startColor) / 2,
-                                         SkColorGetG(startColor) / 2,
-                                         SkColorGetB(startColor) / 2);
-        SkColor colors[2] = { startColor, endColor };
-        SkShader* gradient = SkGradientShader::CreateLinear(points, colors, 0,
-                                                            sizeof(points) / sizeof(points[0]),
-                                                            SkShader::kMirror_TileMode, 0);
-
-        paint.reset();
-        paint.setShader(gradient);
-        paint.setAntiAlias(true);
-        // Check for round rect with zero width or height, otherwise Skia will assert
-        if (bufferedRect.width() > 0 && bufferedRect.height() > 0)
-            canvas->drawRoundRect(bufferedRect, borderRadius.width(), borderRadius.height(), paint);
-        gradient->unref();
-    }
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSlider, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -571,14 +497,22 @@ bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const
 #endif
 }
 
-void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const {
+bool RenderThemeChromiumSkia::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
 #if ENABLE(VIDEO)
-    if (object->style()->appearance() == MediaSliderThumbPart) {
-        static Image* mediaSliderThumb = Image::loadPlatformResource("mediaSliderThumb").releaseRef();
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSlider, object, paintInfo, rect);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
 
-        object->style()->setWidth(Length(mediaSliderThumb->width(), Fixed));
-        object->style()->setHeight(Length(mediaSliderThumb->height(), Fixed));
-    }
+void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const
+{
+#if ENABLE(VIDEO)
+    RenderMediaControlsChromium::adjustMediaSliderThumbSize(object);
 #else
     UNUSED_PARAM(object);
 #endif
@@ -587,12 +521,19 @@ void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const
 bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    if (!object->parent()->isSlider())
-        return false;
-
-    static Image* mediaSliderThumb = Image::loadPlatformResource("mediaSliderThumb").releaseRef();
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSliderThumb, object, paintInfo, rect);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
 
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaSliderThumb);
+bool RenderThemeChromiumSkia::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSliderThumb, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -604,14 +545,7 @@ bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const
 bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
-    static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -623,14 +557,7 @@ bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const R
 bool RenderThemeChromiumSkia::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
-    static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaMuteButton, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -654,7 +581,7 @@ bool RenderThemeChromiumSkia::paintMenuList(RenderObject* o, const RenderObject:
     paintButtonLike(this, o, i, rect);
 
     SkPaint paint;
-    paint.setARGB(0xff, 0, 0, 0);
+    paint.setColor(SK_ColorBLACK);
     paint.setAntiAlias(true);
     paint.setStyle(SkPaint::kFill_Style);
 
@@ -679,6 +606,69 @@ bool RenderThemeChromiumSkia::paintMenuListButton(RenderObject* o, const RenderO
     return paintMenuList(o, i, rect);
 }
 
+bool RenderThemeChromiumSkia::paintSliderTrack(RenderObject*, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    // Just paint a grey box for now (matches the color of a scrollbar background.
+    SkCanvas* const canvas = i.context->platformContext()->canvas();
+    int verticalCenter = rect.y() + rect.height() / 2;
+    int top = std::max(rect.y(), verticalCenter - 2);
+    int bottom = std::min(rect.y() + rect.height(), verticalCenter + 2);
+
+    SkPaint paint;
+    const SkColor grey = SkColorSetARGB(0xff, 0xe3, 0xdd, 0xd8);
+    paint.setColor(grey);
+
+    SkRect skrect;
+    skrect.set(rect.x(), top, rect.x() + rect.width(), bottom);
+    canvas->drawRect(skrect, paint);
+
+    return false;
+}
+
+bool RenderThemeChromiumSkia::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    // Make a thumb similar to the scrollbar thumb.
+    const bool hovered = isHovered(o) || toRenderSlider(o->parent())->inDragMode();
+    const int midx = rect.x() + rect.width() / 2;
+    const int midy = rect.y() + rect.height() / 2;
+    const bool vertical = (o->style()->appearance() == SliderThumbVerticalPart);
+    SkCanvas* const canvas = i.context->platformContext()->canvas();
+
+    const SkColor thumbLightGrey = SkColorSetARGB(0xff, 0xf4, 0xf2, 0xef);
+    const SkColor thumbDarkGrey = SkColorSetARGB(0xff, 0xea, 0xe5, 0xe0);
+    SkPaint paint;
+    paint.setColor(hovered ? SK_ColorWHITE : thumbLightGrey);
+
+    SkIRect skrect;
+    if (vertical)
+        skrect.set(rect.x(), rect.y(), midx + 1, rect.bottom());
+    else
+        skrect.set(rect.x(), rect.y(), rect.right(), midy + 1);
+
+    canvas->drawIRect(skrect, paint);
+
+    paint.setColor(hovered ? thumbLightGrey : thumbDarkGrey);
+
+    if (vertical)
+        skrect.set(midx + 1, rect.y(), rect.right(), rect.bottom());
+    else
+        skrect.set(rect.x(), midy + 1, rect.right(), rect.bottom());
+
+    canvas->drawIRect(skrect, paint);
+
+    const SkColor borderDarkGrey = SkColorSetARGB(0xff, 0x9d, 0x96, 0x8e);
+    paint.setColor(borderDarkGrey);
+    drawBox(canvas, rect, paint);
+
+    if (rect.height() > 10 && rect.width() > 10) {
+        drawHorizLine(canvas, midx - 2, midx + 2, midy, paint);
+        drawHorizLine(canvas, midx - 2, midx + 2, midy - 3, paint);
+        drawHorizLine(canvas, midx - 2, midx + 2, midy + 3, paint);
+    }
+
+    return false;
+}
+
 int RenderThemeChromiumSkia::popupInternalPaddingLeft(RenderStyle* style) const
 {
     return menuListInternalPadding(style, LeftPadding);
@@ -719,6 +709,13 @@ int RenderThemeChromiumSkia::buttonInternalPaddingBottom() const
     return 1;
 }
 
+#if ENABLE(VIDEO)
+bool RenderThemeChromiumSkia::shouldRenderMediaControlPart(ControlPart part, Element* e)
+{
+    return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
+}
+#endif
+
 // static
 void RenderThemeChromiumSkia::setDefaultFontSize(int fontSize)
 {
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.h b/WebCore/rendering/RenderThemeChromiumSkia.h
index 7544c22..98e3a35 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -91,8 +91,10 @@ namespace WebCore {
 
         virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual void adjustSliderThumbSize(RenderObject*) const;
         virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
@@ -110,6 +112,9 @@ namespace WebCore {
         virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
         virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
+        virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
         // These methods define the padding for the MenuList's inner block.
         virtual int popupInternalPaddingLeft(RenderStyle*) const;
         virtual int popupInternalPaddingRight(RenderStyle*) const;
@@ -121,6 +126,11 @@ namespace WebCore {
         virtual int buttonInternalPaddingTop() const;
         virtual int buttonInternalPaddingBottom() const;
 
+#if ENABLE(VIDEO)
+        // Media controls
+        virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+#endif
+
         // Provide a way to pass the default font size from the Settings object
         // to the render theme.  FIXME: http://b/1129186 A cleaner way would be
         // to remove the default font size from this object and have callers
diff --git a/WebCore/rendering/RenderThemeChromiumWin.cpp b/WebCore/rendering/RenderThemeChromiumWin.cpp
index 35d1580..20503f3 100644
--- a/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -311,6 +311,52 @@ void RenderThemeChromiumWin::systemFont(int propId, FontDescription& fontDescrip
     fontDescription = *cachedDesc;
 }
 
+// Map a CSSValue* system color to an index understood by GetSysColor().
+static int cssValueIdToSysColorIndex(int cssValueId)
+{
+    switch (cssValueId) {
+    case CSSValueActiveborder: return COLOR_ACTIVEBORDER;
+    case CSSValueActivecaption: return COLOR_ACTIVECAPTION;
+    case CSSValueAppworkspace: return COLOR_APPWORKSPACE;
+    case CSSValueBackground: return COLOR_BACKGROUND;
+    case CSSValueButtonface: return COLOR_BTNFACE;
+    case CSSValueButtonhighlight: return COLOR_BTNHIGHLIGHT;
+    case CSSValueButtonshadow: return COLOR_BTNSHADOW;
+    case CSSValueButtontext: return COLOR_BTNTEXT;
+    case CSSValueCaptiontext: return COLOR_CAPTIONTEXT;
+    case CSSValueGraytext: return COLOR_GRAYTEXT;
+    case CSSValueHighlight: return COLOR_HIGHLIGHT;
+    case CSSValueHighlighttext: return COLOR_HIGHLIGHTTEXT;
+    case CSSValueInactiveborder: return COLOR_INACTIVEBORDER;
+    case CSSValueInactivecaption: return COLOR_INACTIVECAPTION;
+    case CSSValueInactivecaptiontext: return COLOR_INACTIVECAPTIONTEXT;
+    case CSSValueInfobackground: return COLOR_INFOBK;
+    case CSSValueInfotext: return COLOR_INFOTEXT;
+    case CSSValueMenu: return COLOR_MENU;
+    case CSSValueMenutext: return COLOR_MENUTEXT;
+    case CSSValueScrollbar: return COLOR_SCROLLBAR;
+    case CSSValueThreeddarkshadow: return COLOR_3DDKSHADOW;
+    case CSSValueThreedface: return COLOR_3DFACE;
+    case CSSValueThreedhighlight: return COLOR_3DHIGHLIGHT;
+    case CSSValueThreedlightshadow: return COLOR_3DLIGHT;
+    case CSSValueThreedshadow: return COLOR_3DSHADOW;
+    case CSSValueWindow: return COLOR_WINDOW;
+    case CSSValueWindowframe: return COLOR_WINDOWFRAME;
+    case CSSValueWindowtext: return COLOR_WINDOWTEXT;
+    default: return -1; // Unsupported CSSValue
+    }
+}
+
+Color RenderThemeChromiumWin::systemColor(int cssValueId) const
+{
+    int sysColorIndex = cssValueIdToSysColorIndex(cssValueId);
+    if (ChromiumBridge::layoutTestMode() || (sysColorIndex == -1))
+        return RenderTheme::systemColor(cssValueId);
+
+    COLORREF color = GetSysColor(sysColorIndex);
+    return Color(GetRValue(color), GetGValue(color), GetBValue(color));
+}
+
 void RenderThemeChromiumWin::adjustSliderThumbSize(RenderObject* o) const
 {
     // These sizes match what WinXP draws for various menus.
@@ -475,14 +521,36 @@ unsigned RenderThemeChromiumWin::determineSliderThumbState(RenderObject* o)
 unsigned RenderThemeChromiumWin::determineClassicState(RenderObject* o)
 {
     unsigned result = 0;
-    if (!isEnabled(o))
-        result = DFCS_INACTIVE;
-    else if (isPressed(o)) // Active supersedes hover
-        result = DFCS_PUSHED;
-    else if (isHovered(o))
-        result = DFCS_HOT;
-    if (isChecked(o))
-        result |= DFCS_CHECKED;
+
+    ControlPart part = o->style()->appearance();
+
+    // Sliders are always in the normal state.
+    if (part == SliderHorizontalPart || part == SliderVerticalPart)
+        return result;
+
+    // So are readonly text fields.
+    if (isReadOnlyControl(o) && (part == TextFieldPart || part == TextAreaPart || part == SearchFieldPart))
+        return result;   
+
+    if (part == SliderThumbHorizontalPart || part == SliderThumbVerticalPart) {
+        if (!isEnabled(o->parent()))
+            result = DFCS_INACTIVE;
+        else if (toRenderSlider(o->parent())->inDragMode()) // Active supersedes hover
+            result = DFCS_PUSHED;
+        else if (isHovered(o))
+            result = DFCS_HOT;
+    } else {
+        if (!isEnabled(o))
+            result = DFCS_INACTIVE;
+        else if (isPressed(o)) // Active supersedes hover
+            result = DFCS_PUSHED;
+        else if (supportsFocus(part) && isFocused(o)) // So does focused
+            result = 0;
+        else if (isHovered(o))
+            result = DFCS_HOT;
+        if (isChecked(o))
+            result |= DFCS_CHECKED;
+    }
     return result;
 }
 
@@ -524,6 +592,7 @@ ThemeData RenderThemeChromiumWin::getThemeData(RenderObject* o)
         break;
     case ListboxPart:
     case MenulistPart:
+    case MenulistButtonPart:
     case SearchFieldPart:
     case TextFieldPart:
     case TextAreaPart:
diff --git a/WebCore/rendering/RenderThemeChromiumWin.h b/WebCore/rendering/RenderThemeChromiumWin.h
index 5e98c9b..3b86980 100644
--- a/WebCore/rendering/RenderThemeChromiumWin.h
+++ b/WebCore/rendering/RenderThemeChromiumWin.h
@@ -59,6 +59,7 @@ namespace WebCore {
 
         // System fonts.
         virtual void systemFont(int propId, FontDescription&) const;
+        virtual Color systemColor(int cssValueId) const;

 
         virtual void adjustSliderThumbSize(RenderObject*) const;
 
diff --git a/WebCore/rendering/RenderThemeMac.h b/WebCore/rendering/RenderThemeMac.h
index 85f141f..1d68c63 100644
--- a/WebCore/rendering/RenderThemeMac.h
+++ b/WebCore/rendering/RenderThemeMac.h
@@ -132,6 +132,8 @@ protected:
 
     // Media controls
     virtual String extraMediaControlsStyleSheet();
+
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
 #endif
 
 private:
diff --git a/WebCore/rendering/RenderThemeMac.mm b/WebCore/rendering/RenderThemeMac.mm
index 6315f9f..03e39a0 100644
--- a/WebCore/rendering/RenderThemeMac.mm
+++ b/WebCore/rendering/RenderThemeMac.mm
@@ -38,6 +38,7 @@
 #import "RenderSlider.h"
 #import "RenderView.h"
 #import "SharedBuffer.h"
+#import "TimeRanges.h"
 #import "WebCoreSystemInterface.h"
 #import "UserAgentStyleSheets.h"
 #import <Carbon/Carbon.h>
@@ -472,6 +473,7 @@ void RenderThemeMac::adjustRepaintRect(const RenderObject* o, IntRect& r)
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return RenderTheme::adjustRepaintRect(o, r);
@@ -824,11 +826,21 @@ static void TrackGradientInterpolate(void*, const CGFloat* inData, CGFloat* outD
 
 void RenderThemeMac::paintMenuListButtonGradients(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    if (r.isEmpty())
+        return;
+
     CGContextRef context = paintInfo.context->platformContext();
 
     paintInfo.context->save();
 
-    int radius = o->style()->borderTopLeftRadius().width();
+    IntSize topLeftRadius;
+    IntSize topRightRadius;
+    IntSize bottomLeftRadius;
+    IntSize bottomRightRadius;
+
+    o->style()->getBorderRadiiForRect(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+    int radius = topLeftRadius.width();
 
     RetainPtr<CGColorSpaceRef> cspace(AdoptCF, CGColorSpaceCreateDeviceRGB());
 
@@ -851,33 +863,27 @@ void RenderThemeMac::paintMenuListButtonGradients(RenderObject* o, const RenderO
     RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(r.right(),  r.y()), CGPointMake(r.right() - radius, r.y()), mainFunction.get(), false, false));
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, mainShading.get());
     paintInfo.context->restore();
 
     paintInfo.context->save();
     CGContextClipToRect(context, topGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient),
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        IntSize(), IntSize());
+    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient), topLeftRadius, topRightRadius, IntSize(), IntSize());
     CGContextDrawShading(context, topShading.get());
     paintInfo.context->restore();
 
-    paintInfo.context->save();
-    CGContextClipToRect(context, bottomGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient),
-        IntSize(), IntSize(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
-    CGContextDrawShading(context, bottomShading.get());
-    paintInfo.context->restore();
+    if (!bottomGradient.isEmpty()) {
+        paintInfo.context->save();
+        CGContextClipToRect(context, bottomGradient);
+        paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient), IntSize(), IntSize(), bottomLeftRadius, bottomRightRadius);
+        CGContextDrawShading(context, bottomShading.get());
+        paintInfo.context->restore();
+    }
 
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, leftShading.get());
     CGContextDrawShading(context, rightShading.get());
     paintInfo.context->restore();
@@ -887,8 +893,6 @@ void RenderThemeMac::paintMenuListButtonGradients(RenderObject* o, const RenderO
 
 bool RenderThemeMac::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    paintInfo.context->save();
-
     IntRect bounds = IntRect(r.x() + o->style()->borderLeftWidth(),
                              r.y() + o->style()->borderTopWidth(),
                              r.width() - o->style()->borderLeftWidth() - o->style()->borderRightWidth(),
@@ -907,6 +911,8 @@ bool RenderThemeMac::paintMenuListButton(RenderObject* o, const RenderObject::Pa
     if (bounds.width() < arrowWidth + arrowPaddingLeft * o->style()->effectiveZoom())
         return false;
     
+    paintInfo.context->save();
+
     paintInfo.context->setFillColor(o->style()->color());
     paintInfo.context->setStrokeStyle(NoStroke);
 
@@ -1416,7 +1422,7 @@ bool RenderThemeMac::paintSearchFieldResultsButton(RenderObject* o, const Render
 #if ENABLE(VIDEO)
 typedef enum {
     MediaControllerThemeClassic   = 1,
-    MediaControllerThemeQT        = 2
+    MediaControllerThemeQuickTime = 2
 } MediaControllerThemeStyle;
 
 static int mediaControllerTheme()
@@ -1450,7 +1456,7 @@ static int mediaControllerTheme()
         return controllerTheme;
 #endif
 
-    controllerTheme = MediaControllerThemeQT;
+    controllerTheme = MediaControllerThemeQuickTime;
     return controllerTheme;
 }
 #endif
@@ -1473,10 +1479,10 @@ void RenderThemeMac::adjustSliderThumbSize(RenderObject* o) const
         int width = mediaSliderThumbWidth;
         int height = mediaSliderThumbHeight;
         
-        if (mediaControllerTheme() == MediaControllerThemeQT) {
+        if (mediaControllerTheme() == MediaControllerThemeQuickTime) {
             CGSize  size;
             
-            wkMeasureMediaUIPart(MediaSliderThumb, MediaControllerThemeQT, NULL, &size);
+            wkMeasureMediaUIPart(MediaSliderThumb, MediaControllerThemeQuickTime, NULL, &size);
             width = size.width;
             height = size.height;
         }
@@ -1500,7 +1506,9 @@ static unsigned getMediaUIPartStateFlags(Node* node)
 {
     unsigned flags = 0;
 
-    if (node->active())
+    if (node->disabled())
+        flags |= MediaUIPartDisabledFlag;
+    else if (node->active())
         flags |= MediaUIPartPressedFlag;
     return flags;
 }
@@ -1510,7 +1518,7 @@ static FloatRect getUnzoomedRectAndAdjustCurrentContext(RenderObject* o, const R
 {
     float zoomLevel = o->style()->effectiveZoom();
     FloatRect unzoomedRect(originalRect);
-    if (zoomLevel != 1.0f && mediaControllerTheme() == MediaControllerThemeQT) {
+    if (zoomLevel != 1.0f && mediaControllerTheme() == MediaControllerThemeQuickTime) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
         unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
         paintInfo.context->translate(unzoomedRect.x(), unzoomedRect.y());
@@ -1539,7 +1547,7 @@ bool RenderThemeMac::paintMediaMuteButton(RenderObject* o, const RenderObject::P
     if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
         return false;
 
-    if (MediaControlPlayButtonElement* btn = static_cast<MediaControlPlayButtonElement*>(node)) {
+    if (MediaControlMuteButtonElement* btn = static_cast<MediaControlMuteButtonElement*>(node)) {
         LocalCurrentGraphicsContext localContext(paintInfo.context);
         wkDrawMediaUIPart(btn->displayType(), mediaControllerTheme(), paintInfo.context->platformContext(), r, getMediaUIPartStateFlags(node));
 
@@ -1594,14 +1602,13 @@ bool RenderThemeMac::paintMediaSliderTrack(RenderObject* o, const RenderObject::
     if (!mediaElement)
         return false;
 
-    float timeLoaded = 0;
-    float currentTime = 0;
-    float duration = 0;
-    if (MediaPlayer* player = mediaElement->player()) {
-        duration = player->duration();
-        timeLoaded = player->maxTimeBuffered();
-        currentTime = player->currentTime();
-    }
+    RefPtr<TimeRanges> timeRanges = mediaElement->buffered();
+    ExceptionCode ignoredException;
+    float timeLoaded = timeRanges->length() ? timeRanges->end(0, ignoredException) : 0;
+    float currentTime = mediaElement->currentTime();
+    float duration = mediaElement->duration();
+    if (isnan(duration))
+        duration = 0;
  
     paintInfo.context->save();
     FloatRect unzoomedRect = getUnzoomedRectAndAdjustCurrentContext(o, paintInfo, r);
@@ -1685,12 +1692,21 @@ bool RenderThemeMac::paintMediaTimeRemaining(RenderObject* o, const RenderObject
 
 String RenderThemeMac::extraMediaControlsStyleSheet()
 {
-    if (mediaControllerTheme() == MediaControllerThemeQT) 
-        return String(mediaControlsQTUserAgentStyleSheet, sizeof(mediaControlsQTUserAgentStyleSheet));
+    if (mediaControllerTheme() == MediaControllerThemeQuickTime)
+        return String(mediaControlsQuickTimeUserAgentStyleSheet, sizeof(mediaControlsQuickTimeUserAgentStyleSheet));
     else
         return String();
 }
-#endif
+
+bool RenderThemeMac::shouldRenderMediaControlPart(ControlPart part, Element* e)
+{
+    if (part == MediaFullscreenButtonPart)
+        return mediaControllerTheme() == MediaControllerThemeQuickTime;
+
+    return RenderTheme::shouldRenderMediaControlPart(part, e);
+}
+
+#endif // ENABLE(VIDEO)
 
 NSPopUpButtonCell* RenderThemeMac::popupButton() const
 {
diff --git a/WebCore/rendering/RenderThemeSafari.cpp b/WebCore/rendering/RenderThemeSafari.cpp
index 23998d4..8e53088 100644
--- a/WebCore/rendering/RenderThemeSafari.cpp
+++ b/WebCore/rendering/RenderThemeSafari.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc.
  * Copyright (C) 2009 Kenneth Rohde Christiansen
  *
  * This library is free software; you can redistribute it and/or
@@ -744,11 +744,21 @@ static void TrackGradientInterpolate(void* info, const CGFloat* inData, CGFloat*
 
 void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    if (r.isEmpty())
+        return;
+
     CGContextRef context = paintInfo.context->platformContext();
 
     paintInfo.context->save();
 
-    int radius = o->style()->borderTopLeftRadius().width();
+    IntSize topLeftRadius;
+    IntSize topRightRadius;
+    IntSize bottomLeftRadius;
+    IntSize bottomRightRadius;
+
+    o->style()->getBorderRadiiForRect(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+    int radius = topLeftRadius.width();
 
     RetainPtr<CGColorSpaceRef> cspace(AdoptCF, CGColorSpaceCreateDeviceRGB());
 
@@ -771,33 +781,27 @@ void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const Rend
     RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(r.right(),  r.y()), CGPointMake(r.right() - radius, r.y()), mainFunction.get(), false, false));
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, mainShading.get());
     paintInfo.context->restore();
 
     paintInfo.context->save();
     CGContextClipToRect(context, topGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient),
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        IntSize(), IntSize());
+    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient), topLeftRadius, topRightRadius, IntSize(), IntSize());
     CGContextDrawShading(context, topShading.get());
     paintInfo.context->restore();
 
-    paintInfo.context->save();
-    CGContextClipToRect(context, bottomGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient),
-        IntSize(), IntSize(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
-    CGContextDrawShading(context, bottomShading.get());
-    paintInfo.context->restore();
+    if (!bottomGradient.isEmpty()) {
+        paintInfo.context->save();
+        CGContextClipToRect(context, bottomGradient);
+        paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient), IntSize(), IntSize(), bottomLeftRadius, bottomRightRadius);
+        CGContextDrawShading(context, bottomShading.get());
+        paintInfo.context->restore();
+    }
 
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, leftShading.get());
     CGContextDrawShading(context, rightShading.get());
     paintInfo.context->restore();
@@ -807,8 +811,6 @@ void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const Rend
 
 bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    paintInfo.context->save();
-
     IntRect bounds = IntRect(r.x() + o->style()->borderLeftWidth(),
                              r.y() + o->style()->borderTopWidth(),
                              r.width() - o->style()->borderLeftWidth() - o->style()->borderRightWidth(),
@@ -826,6 +828,8 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject:
     if (bounds.width() < arrowWidth + arrowPaddingLeft)
         return false;
 
+    paintInfo.context->save();
+
     paintInfo.context->setFillColor(o->style()->color());
     paintInfo.context->setStrokeColor(NoStroke);
 
diff --git a/WebCore/rendering/RenderView.cpp b/WebCore/rendering/RenderView.cpp
index 584e38a..c4a666f 100644
--- a/WebCore/rendering/RenderView.cpp
+++ b/WebCore/rendering/RenderView.cpp
@@ -133,12 +133,10 @@ void RenderView::layout()
     if (needsLayout())
         RenderBlock::layout();
 
-    // Reset overflowWidth and overflowHeight, since they act as a lower bound for docWidth() and docHeight().
-    setOverflowWidth(width());
-    setOverflowHeight(height());
-    
-    setOverflowWidth(docWidth());
-    setOverflowHeight(docHeight());
+    // Reset overflow and then replace it with docWidth and docHeight.
+    m_overflow.clear();
+    addLayoutOverflow(IntRect(0, 0, docWidth(), docHeight()));
+
 
     ASSERT(layoutDelta() == IntSize());
     ASSERT(m_layoutStateDisableCount == 0);
@@ -472,6 +470,8 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         return;
     }
 
+    m_frameView->beginDeferredRepaints();
+
     // Have any of the old selected objects changed compared to the new selection?
     for (SelectedObjectMap::iterator i = oldSelectedObjects.begin(); i != oldObjectsEnd; ++i) {
         RenderObject* obj = i->first;
@@ -523,6 +523,8 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         newInfo->repaint();
         delete newInfo;
     }
+
+    m_frameView->endDeferredRepaints();
 }
 
 void RenderView::clearSelection()
diff --git a/WebCore/rendering/RenderWidget.cpp b/WebCore/rendering/RenderWidget.cpp
index 36f4fed..5a5c9f1 100644
--- a/WebCore/rendering/RenderWidget.cpp
+++ b/WebCore/rendering/RenderWidget.cpp
@@ -28,6 +28,7 @@
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
 #include "RenderView.h"
+#include "RenderWidgetProtector.h"
 
 using namespace std;
 
@@ -60,6 +61,15 @@ void RenderWidget::destroy()
     // So the code below includes copied and pasted contents of
     // both RenderBox::destroy() and RenderObject::destroy().
     // Fix originally made for <rdar://problem/4228818>.
+
+    // <rdar://problem/6937089> suggests that node() can be null by the time we call renderArena()
+    // in the end of this function. One way this might happen is if this function was invoked twice
+    // in a row, so bail out and turn a crash into an assertion failure in debug builds and a leak
+    // in release builds.
+    ASSERT(node());
+    if (!node())
+        return;
+
     animation()->cancelAnimations(this);
 
     if (RenderView* v = view())
@@ -90,6 +100,14 @@ void RenderWidget::destroy()
         destroyLayer();
     }
 
+    // <rdar://problem/6937089> suggests that node() can be null here. One way this might happen is
+    // if this function was re-entered (and therefore the null check at the beginning did not fail),
+    // so bail out and turn a crash into an assertion failure in debug builds and a leak in release
+    // builds.
+    ASSERT(node());
+    if (!node())
+        return;
+
     // Grab the arena from node()->document()->renderArena() before clearing the node pointer.
     // Clear the node before deref-ing, as this may be deleted when deref is called.
     RenderArena* arena = renderArena();
@@ -106,10 +124,9 @@ RenderWidget::~RenderWidget()
 void RenderWidget::setWidgetGeometry(const IntRect& frame)
 {
     if (node() && m_widget->frameRect() != frame) {
-        RenderArena* arena = ref();
-        RefPtr<Node> protectedElement(node());
+        RenderWidgetProtector protector(this);
+        RefPtr<Node> protectedNode(node());
         m_widget->setFrameRect(frame);
-        deref(arena);
     }
 }
 
@@ -158,6 +175,12 @@ void RenderWidget::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     }
 }
 
+void RenderWidget::showSubstituteImage(PassRefPtr<Image> prpImage)
+{
+    m_substituteImage = prpImage;
+    repaint();
+}
+
 void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     if (!shouldPaint(paintInfo, tx, ty))
@@ -183,11 +206,15 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 #endif
 
     if (style()->hasBorderRadius()) {
+        IntRect borderRect = IntRect(tx, ty, width(), height());
+
+        if (borderRect.isEmpty())
+            return;
+
         // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
         paintInfo.context->save();
         
         IntSize topLeft, topRight, bottomLeft, bottomRight;
-        IntRect borderRect = IntRect(tx, ty, width(), height());
         style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
 
         paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
@@ -201,7 +228,10 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 
         // Tell the widget to paint now.  This is the only time the widget is allowed
         // to paint itself.  That way it will composite properly with z-indexed layers.
-        m_widget->paint(paintInfo.context, paintInfo.rect);
+        if (m_substituteImage)
+            paintInfo.context->drawImage(m_substituteImage.get(), m_widget->frameRect());
+        else
+            m_widget->paint(paintInfo.context, paintInfo.rect);
 
         if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget.get())->useSlowRepaints()) {
             ASSERT(!paintInfo.overlapTestRequests->contains(this));
@@ -248,11 +278,9 @@ void RenderWidget::updateWidgetPosition()
     IntRect oldBounds(m_widget->frameRect());
     bool boundsChanged = newBounds != oldBounds;
     if (boundsChanged) {
-        RenderArena* arena = ref();
-        node()->ref();
+        RenderWidgetProtector protector(this);
+        RefPtr<Node> protectedNode(node());
         m_widget->setFrameRect(newBounds);
-        node()->deref();
-        deref(arena);
     }
     
 #ifndef FLATTEN_IFRAME
diff --git a/WebCore/rendering/RenderWidget.h b/WebCore/rendering/RenderWidget.h
index bb68143..78537fd 100644
--- a/WebCore/rendering/RenderWidget.h
+++ b/WebCore/rendering/RenderWidget.h
@@ -40,6 +40,8 @@ public:
 
     void updateWidgetPosition();
 
+    void showSubstituteImage(PassRefPtr<Image>);
+
 protected:
     RenderWidget(Node*);
 
@@ -61,10 +63,12 @@ private:
 
     void setWidgetGeometry(const IntRect&);
 
+    friend class RenderWidgetProtector;
     RenderArena* ref() { ++m_refCount; return renderArena(); }
     void deref(RenderArena*);
 
     RefPtr<Widget> m_widget;
+    RefPtr<Image> m_substituteImage;
     FrameView* m_frameView;
     int m_refCount;
 };
diff --git a/WebCore/rendering/RenderWidgetProtector.h b/WebCore/rendering/RenderWidgetProtector.h
new file mode 100644
index 0000000..788304c
--- /dev/null
+++ b/WebCore/rendering/RenderWidgetProtector.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderWidgetProtector_h
+#define RenderWidgetProtector_h
+
+#include "RenderWidget.h"
+
+namespace WebCore {
+
+class RenderWidgetProtector : private Noncopyable {
+public:
+    RenderWidgetProtector(RenderWidget* object)
+        : m_object(object)
+        , m_arena(object->ref())
+    {
+    }
+
+    ~RenderWidgetProtector()
+    {
+        m_object->deref(m_arena);
+    }
+
+private:
+    RenderWidget* m_object;
+    RenderArena* m_arena;
+};
+
+}
+
+#endif // RenderWidgetProtector_h
diff --git a/WebCore/rendering/RootInlineBox.cpp b/WebCore/rendering/RootInlineBox.cpp
index e8f04da..c8e072e 100644
--- a/WebCore/rendering/RootInlineBox.cpp
+++ b/WebCore/rendering/RootInlineBox.cpp
@@ -38,28 +38,8 @@ namespace WebCore {
 typedef WTF::HashMap<const RootInlineBox*, EllipsisBox*> EllipsisBoxMap;
 static EllipsisBoxMap* gEllipsisBoxMap = 0;
 
-void* RootInlineBox::Overflow::operator new(size_t sz, RenderArena* renderArena) throw()
-{
-    return renderArena->allocate(sz);
-}
-
-void RootInlineBox::Overflow::operator delete(void* ptr, size_t sz)
-{
-    // Stash size where destroy can find it.
-    *(size_t *)ptr = sz;
-}
-
-void RootInlineBox::Overflow::destroy(RenderArena* renderArena)
-{
-    delete this;
-    // Recover the size left there for us by operator delete and free the memory.
-    renderArena->free(*(size_t *)this, this);
-}
-
 void RootInlineBox::destroy(RenderArena* arena)
 {
-    if (m_overflow)
-        m_overflow->destroy(arena);
     detachEllipsisBox(arena);
     InlineFlowBox::destroy(arena);
 }
@@ -155,8 +135,8 @@ void RootInlineBox::addHighlightOverflow()
     // Highlight acts as a selection inflation.
     FloatRect rootRect(0, selectionTop(), width(), selectionHeight());
     IntRect inflatedRect = enclosingIntRect(page->chrome()->client()->customHighlightRect(renderer()->node(), renderer()->style()->highlight(), rootRect));
-    setHorizontalOverflowPositions(min(leftOverflow(), inflatedRect.x()), max(rightOverflow(), inflatedRect.right()));
-    setVerticalOverflowPositions(min(topOverflow(), inflatedRect.y()), max(bottomOverflow(), inflatedRect.bottom()));
+    setHorizontalOverflowPositions(leftLayoutOverflow(), rightLayoutOverflow(), min(leftVisualOverflow(), inflatedRect.x()), max(rightVisualOverflow(), inflatedRect.right()));
+    setVerticalOverflowPositions(topLayoutOverflow(), bottomLayoutOverflow(), min(topVisualOverflow(), inflatedRect.y()), max(bottomVisualOverflow(), inflatedRect.bottom()), height());
 }
 
 void RootInlineBox::paintCustomHighlight(RenderObject::PaintInfo& paintInfo, int tx, int ty, const AtomicString& highlightType)
@@ -205,12 +185,8 @@ bool RootInlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 void RootInlineBox::adjustPosition(int dx, int dy)
 {
     InlineFlowBox::adjustPosition(dx, dy);
-    if (m_overflow) {
-        m_overflow->m_topOverflow += dy;
-        m_overflow->m_bottomOverflow += dy;
-        m_overflow->m_selectionTop += dy;
-        m_overflow->m_selectionBottom += dy;
-    }
+    m_lineTop += dy;
+    m_lineBottom += dy;
     m_blockHeight += dy;
 }
 
@@ -225,6 +201,37 @@ void RootInlineBox::childRemoved(InlineBox* box)
     }
 }
 
+int RootInlineBox::verticallyAlignBoxes(int heightOfBlock)
+{
+    int maxPositionTop = 0;
+    int maxPositionBottom = 0;
+    int maxAscent = 0;
+    int maxDescent = 0;
+
+    // Figure out if we're in strict mode.  Note that we can't simply use !style()->htmlHacks(),
+    // because that would match almost strict mode as well.
+    RenderObject* curr = renderer();
+    while (curr && !curr->node())
+        curr = curr->container();
+    bool strictMode = (curr && curr->document()->inStrictMode());
+
+    computeLogicalBoxHeights(maxPositionTop, maxPositionBottom, maxAscent, maxDescent, strictMode);
+
+    if (maxAscent + maxDescent < max(maxPositionTop, maxPositionBottom))
+        adjustMaxAscentAndDescent(maxAscent, maxDescent, maxPositionTop, maxPositionBottom);
+
+    int maxHeight = maxAscent + maxDescent;
+    int lineTop = heightOfBlock;
+    int lineBottom = heightOfBlock;
+    placeBoxesVertically(heightOfBlock, maxHeight, maxAscent, strictMode, lineTop, lineBottom);
+    computeVerticalOverflow(lineTop, lineBottom, strictMode);
+    setLineTopBottomPositions(lineTop, lineBottom);
+    
+    heightOfBlock += maxHeight;
+    
+    return heightOfBlock;
+}
+
 GapRects RootInlineBox::fillLineSelectionGap(int selTop, int selHeight, RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,
                                              const RenderObject::PaintInfo* paintInfo)
 {
@@ -321,9 +328,9 @@ InlineBox* RootInlineBox::lastSelectedBox()
     return 0;
 }
 
-int RootInlineBox::selectionTop()
+int RootInlineBox::selectionTop() const
 {
-    int selectionTop = m_overflow ? m_overflow->m_selectionTop : m_y;
+    int selectionTop = m_lineTop;
     if (!prevRootBox())
         return selectionTop;
 
@@ -407,18 +414,6 @@ EllipsisBox* RootInlineBox::ellipsisBox() const
     return gEllipsisBoxMap->get(this);
 }
 
-void RootInlineBox::setVerticalOverflowPositions(int top, int bottom) 
-{ 
-    if (!m_overflow) {
-        const Font& font = renderer()->style(m_firstLine)->font();
-        if (top == m_y && bottom == m_y + font.height())
-            return;
-        m_overflow = new (renderer()->renderArena()) Overflow(this);
-    }
-    m_overflow->m_topOverflow = top; 
-    m_overflow->m_bottomOverflow = bottom; 
-}
-
 void RootInlineBox::removeLineBoxFromRenderObject()
 {
     block()->lineBoxes()->removeLineBox(this);
diff --git a/WebCore/rendering/RootInlineBox.h b/WebCore/rendering/RootInlineBox.h
index 171be9d..b0b0e15 100644
--- a/WebCore/rendering/RootInlineBox.h
+++ b/WebCore/rendering/RootInlineBox.h
@@ -38,31 +38,33 @@ class RootInlineBox : public InlineFlowBox {
 public:
     RootInlineBox(RenderObject* obj)
         : InlineFlowBox(obj)
-        , m_overflow(0)
         , m_lineBreakObj(0)
         , m_lineBreakPos(0)
+        , m_lineTop(0)
+        , m_lineBottom(0)
     {
     }
 
+    virtual void destroy(RenderArena*);
+
     virtual bool isRootInlineBox() const { return true; }
 
-    virtual void destroy(RenderArena*);
     void detachEllipsisBox(RenderArena*);
 
-    RootInlineBox* nextRootBox() { return static_cast<RootInlineBox*>(m_nextLine); }
-    RootInlineBox* prevRootBox() { return static_cast<RootInlineBox*>(m_prevLine); }
+    RootInlineBox* nextRootBox() const { return static_cast<RootInlineBox*>(m_nextLine); }
+    RootInlineBox* prevRootBox() const { return static_cast<RootInlineBox*>(m_prevLine); }
 
     virtual void adjustPosition(int dx, int dy);
 
-    virtual int topOverflow() const { return m_overflow ? m_overflow->m_topOverflow : m_y; }
-    virtual int bottomOverflow() const { return m_overflow ? m_overflow->m_bottomOverflow : m_y + m_renderer->style(m_firstLine)->font().height(); }
-    virtual int leftOverflow() const { return m_overflow ? m_overflow->m_leftOverflow : m_x; }
-    virtual int rightOverflow() const { return m_overflow ? m_overflow->m_rightOverflow : m_x + m_width; }
+    int lineTop() const { return m_lineTop; }
+    int lineBottom() const { return m_lineBottom; }
 
-    virtual void setVerticalOverflowPositions(int top, int bottom);
-    void setHorizontalOverflowPositions(int left, int right);
+    int selectionTop() const;
+    int selectionBottom() const { return lineBottom(); }
+    int selectionHeight() const { return max(0, selectionBottom() - selectionTop()); }
 
-    virtual void setVerticalSelectionPositions(int top, int bottom);
+    virtual int verticallyAlignBoxes(int heightOfBlock);
+    void setLineTopBottomPositions(int top, int bottom);
 
     virtual RenderLineBoxList* rendererLineBoxes() const;
 
@@ -116,68 +118,36 @@ public:
 
     RenderBlock* block() const;
 
-    int selectionTop();
-    int selectionBottom() { return m_overflow ? m_overflow->m_selectionBottom : m_y + height(); }
-    int selectionHeight() { return max(0, selectionBottom() - selectionTop()); }
-
     InlineBox* closestLeafChildForXPos(int x, bool onlyEditableLeaves = false);
 
     Vector<RenderBox*>& floats()
     {
         ASSERT(!isDirty());
-        if (!m_overflow)
-            m_overflow = new (m_renderer->renderArena()) Overflow(this);
-        return m_overflow->floats;
+        if (!m_floats)
+            m_floats.set(new Vector<RenderBox*>());
+        return *m_floats;
     }
 
-    Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_overflow ? &m_overflow->floats : 0; }
+    Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_floats.get(); }
 
     virtual void extractLineBoxFromRenderObject();
     virtual void attachLineBoxToRenderObject();
     virtual void removeLineBoxFromRenderObject();
 
 protected:
-    // Normally we are only as tall as the style on our block dictates, but we might have content
-    // that spills out above the height of our font (e.g, a tall image), or something that extends further
-    // below our line (e.g., a child whose font has a huge descent).
-        
-    // Allocated only when some of these fields have non-default values
-    struct Overflow {
-        Overflow(RootInlineBox* box) 
-            : m_topOverflow(box->m_y)
-            , m_bottomOverflow(box->m_y + box->height())
-            , m_leftOverflow(box->m_x)
-            , m_rightOverflow(box->m_x + box->m_width)
-            , m_selectionTop(box->m_y)
-            , m_selectionBottom(box->m_y + box->height())
-        {
-        }
-
-        void destroy(RenderArena*);
-        void* operator new(size_t, RenderArena*) throw();
-        void operator delete(void*, size_t);
-        
-        int m_topOverflow;
-        int m_bottomOverflow;
-        int m_leftOverflow;
-        int m_rightOverflow;
-        int m_selectionTop;
-        int m_selectionBottom;
-        // Floats hanging off the line are pushed into this vector during layout. It is only
-        // good for as long as the line has not been marked dirty.
-        Vector<RenderBox*> floats;
-    private:
-        void* operator new(size_t) throw();
-    };
-    
-    Overflow* m_overflow;
-
     // Where this line ended.  The exact object and the position within that object are stored so that
     // we can create an InlineIterator beginning just after the end of this line.
     RenderObject* m_lineBreakObj;
     unsigned m_lineBreakPos;
     RefPtr<BidiContext> m_lineBreakContext;
 
+    int m_lineTop;
+    int m_lineBottom;
+
+    // Floats hanging off the line are pushed into this vector during layout. It is only
+    // good for as long as the line has not been marked dirty.
+    OwnPtr<Vector<RenderBox*> > m_floats;
+
     // The height of the block at the end of this line.  This is where the next line starts.
     int m_blockHeight;
 
@@ -186,27 +156,10 @@ protected:
     WTF::Unicode::Direction m_lineBreakBidiStatusLast : 5;
 };
 
-inline void RootInlineBox::setHorizontalOverflowPositions(int left, int right) 
-{ 
-    if (!m_overflow) {
-        if (left == m_x && right == m_x + m_width)
-            return;
-        m_overflow = new (m_renderer->renderArena()) Overflow(this);       
-    }
-    m_overflow->m_leftOverflow = left; 
-    m_overflow->m_rightOverflow = right; 
-}
-
-inline void RootInlineBox::setVerticalSelectionPositions(int top, int bottom) 
+inline void RootInlineBox::setLineTopBottomPositions(int top, int bottom) 
 { 
-    if (!m_overflow) {
-        const Font& font = m_renderer->style(m_firstLine)->font();
-        if (top == m_y && bottom == m_y + font.height())
-            return;
-        m_overflow = new (m_renderer->renderArena()) Overflow(this);
-    }
-    m_overflow->m_selectionTop = top; 
-    m_overflow->m_selectionBottom = bottom; 
+    m_lineTop = top; 
+    m_lineBottom = bottom; 
 }
 
 } // namespace WebCore
diff --git a/WebCore/rendering/SVGRootInlineBox.cpp b/WebCore/rendering/SVGRootInlineBox.cpp
index 8319e7c..5829742 100644
--- a/WebCore/rendering/SVGRootInlineBox.cpp
+++ b/WebCore/rendering/SVGRootInlineBox.cpp
@@ -1087,8 +1087,8 @@ void SVGRootInlineBox::layoutInlineBoxes(InlineFlowBox* start, Vector<SVGChar>::
         start->setWidth(highX - lowX);
         static_cast<SVGRootInlineBox*>(start)->setHeight(highY - lowY);
 
-        start->setVerticalOverflowPositions(top, bottom);
-        start->setVerticalSelectionPositions(top, bottom);
+        start->computeVerticalOverflow(top, bottom, true);
+        static_cast<SVGRootInlineBox*>(start)->setLineTopBottomPositions(top, bottom);
     }
 }
 
diff --git a/WebCore/rendering/style/FillLayer.cpp b/WebCore/rendering/style/FillLayer.cpp
index 9c491aa..ec910c9 100644
--- a/WebCore/rendering/style/FillLayer.cpp
+++ b/WebCore/rendering/style/FillLayer.cpp
@@ -31,18 +31,20 @@ FillLayer::FillLayer(EFillLayerType type)
     , m_attachment(FillLayer::initialFillAttachment(type))
     , m_clip(FillLayer::initialFillClip(type))
     , m_origin(FillLayer::initialFillOrigin(type))
-    , m_repeat(FillLayer::initialFillRepeat(type))
+    , m_repeatX(FillLayer::initialFillRepeatX(type))
+    , m_repeatY(FillLayer::initialFillRepeatY(type))
     , m_composite(FillLayer::initialFillComposite(type))
-    , m_size(FillLayer::initialFillSize(type))
+    , m_sizeType(SizeNone)
+    , m_sizeLength(FillLayer::initialFillSizeLength(type))
     , m_imageSet(false)
     , m_attachmentSet(false)
     , m_clipSet(false)
     , m_originSet(false)
-    , m_repeatSet(false)
+    , m_repeatXSet(false)
+    , m_repeatYSet(false)
     , m_xPosSet(false)
     , m_yPosSet(false)
     , m_compositeSet(type == MaskFillLayer)
-    , m_sizeSet(false)
     , m_type(type)
     , m_next(0)
 {
@@ -55,18 +57,20 @@ FillLayer::FillLayer(const FillLayer& o)
     , m_attachment(o.m_attachment)
     , m_clip(o.m_clip)
     , m_origin(o.m_origin)
-    , m_repeat(o.m_repeat)
+    , m_repeatX(o.m_repeatX)
+    , m_repeatY(o.m_repeatY)
     , m_composite(o.m_composite)
-    , m_size(o.m_size)
+    , m_sizeType(o.m_sizeType)
+    , m_sizeLength(o.m_sizeLength)
     , m_imageSet(o.m_imageSet)
     , m_attachmentSet(o.m_attachmentSet)
     , m_clipSet(o.m_clipSet)
     , m_originSet(o.m_originSet)
-    , m_repeatSet(o.m_repeatSet)
+    , m_repeatXSet(o.m_repeatXSet)
+    , m_repeatYSet(o.m_repeatYSet)
     , m_xPosSet(o.m_xPosSet)
     , m_yPosSet(o.m_yPosSet)
     , m_compositeSet(o.m_compositeSet)
-    , m_sizeSet(o.m_sizeSet)
     , m_type(o.m_type)
     , m_next(o.m_next ? new FillLayer(*o.m_next) : 0)
 {
@@ -91,18 +95,20 @@ FillLayer& FillLayer::operator=(const FillLayer& o)
     m_clip = o.m_clip;
     m_composite = o.m_composite;
     m_origin = o.m_origin;
-    m_repeat = o.m_repeat;
-    m_size = o.m_size;
+    m_repeatX = o.m_repeatX;
+    m_repeatY = o.m_repeatY;
+    m_sizeType = o.m_sizeType;
+    m_sizeLength = o.m_sizeLength;
 
     m_imageSet = o.m_imageSet;
     m_attachmentSet = o.m_attachmentSet;
     m_clipSet = o.m_clipSet;
     m_compositeSet = o.m_compositeSet;
     m_originSet = o.m_originSet;
-    m_repeatSet = o.m_repeatSet;
+    m_repeatXSet = o.m_repeatXSet;
+    m_repeatYSet = o.m_repeatYSet;
     m_xPosSet = o.m_xPosSet;
     m_yPosSet = o.m_yPosSet;
-    m_sizeSet = o.m_sizeSet;
     
     m_type = o.m_type;
 
@@ -115,9 +121,9 @@ bool FillLayer::operator==(const FillLayer& o) const
     // to propagate patterns into layers.  All layer comparisons happen after values have all been filled in anyway.
     return StyleImage::imagesEquivalent(m_image.get(), o.m_image.get()) && m_xPosition == o.m_xPosition && m_yPosition == o.m_yPosition &&
            m_attachment == o.m_attachment && m_clip == o.m_clip && 
-           m_composite == o.m_composite && m_origin == o.m_origin && m_repeat == o.m_repeat &&
-           m_size == o.m_size && m_type == o.m_type &&
-           ((m_next && o.m_next) ? *m_next == *o.m_next : m_next == o.m_next);
+           m_composite == o.m_composite && m_origin == o.m_origin && m_repeatX == o.m_repeatX &&
+           m_repeatY == o.m_repeatY && m_sizeType == o.m_sizeType && m_sizeLength == o.m_sizeLength && 
+           m_type == o.m_type && ((m_next && o.m_next) ? *m_next == *o.m_next : m_next == o.m_next);
 }
 
 void FillLayer::fillUnsetProperties()
@@ -200,11 +206,22 @@ void FillLayer::fillUnsetProperties()
         }
     }
 
-    for (curr = this; curr && curr->isRepeatSet(); curr = curr->next()) { }
+    for (curr = this; curr && curr->isRepeatXSet(); curr = curr->next()) { }
     if (curr && curr != this) {
         // We need to fill in the remaining values with the pattern specified.
         for (FillLayer* pattern = this; curr; curr = curr->next()) {
-            curr->m_repeat = pattern->m_repeat;
+            curr->m_repeatX = pattern->m_repeatX;
+            pattern = pattern->next();
+            if (pattern == curr || !pattern)
+                pattern = this;
+        }
+    }
+
+    for (curr = this; curr && curr->isRepeatYSet(); curr = curr->next()) { }
+    if (curr && curr != this) {
+        // We need to fill in the remaining values with the pattern specified.
+        for (FillLayer* pattern = this; curr; curr = curr->next()) {
+            curr->m_repeatY = pattern->m_repeatY;
             pattern = pattern->next();
             if (pattern == curr || !pattern)
                 pattern = this;
@@ -215,7 +232,8 @@ void FillLayer::fillUnsetProperties()
     if (curr && curr != this) {
         // We need to fill in the remaining values with the pattern specified.
         for (FillLayer* pattern = this; curr; curr = curr->next()) {
-            curr->m_size = pattern->m_size;
+            curr->m_sizeType = pattern->m_sizeType;
+            curr->m_sizeLength = pattern->m_sizeLength;
             pattern = pattern->next();
             if (pattern == curr || !pattern)
                 pattern = this;
@@ -232,7 +250,8 @@ void FillLayer::cullEmptyLayers()
             !next->isXPositionSet() && !next->isYPositionSet() &&
             !next->isAttachmentSet() && !next->isClipSet() &&
             !next->isCompositeSet() && !next->isOriginSet() &&
-            !next->isRepeatSet() && !next->isSizeSet()) {
+            !next->isRepeatXSet() && !next->isRepeatYSet()
+            && !next->isSizeSet()) {
             delete next;
             p->m_next = 0;
             break;
diff --git a/WebCore/rendering/style/FillLayer.h b/WebCore/rendering/style/FillLayer.h
index c3944ad..fb928b6 100644
--- a/WebCore/rendering/style/FillLayer.h
+++ b/WebCore/rendering/style/FillLayer.h
@@ -34,6 +34,31 @@
 
 namespace WebCore {
 
+struct FillSize {
+    FillSize()
+        : type(SizeLength)
+    {
+    }
+
+    FillSize(EFillSizeType t, LengthSize l)
+        : type(t)
+        , size(l)
+    {
+    }
+
+    bool operator==(const FillSize& o) const
+    {
+        return type == o.type && size == o.size;
+    }
+    bool operator!=(const FillSize& o) const
+    {
+        return !(*this == o);
+    }
+
+    EFillSizeType type;
+    LengthSize size;
+};
+
 struct FillLayer {
 public:
     FillLayer(EFillLayerType);
@@ -45,9 +70,11 @@ public:
     EFillAttachment attachment() const { return static_cast<EFillAttachment>(m_attachment); }
     EFillBox clip() const { return static_cast<EFillBox>(m_clip); }
     EFillBox origin() const { return static_cast<EFillBox>(m_origin); }
-    EFillRepeat repeat() const { return static_cast<EFillRepeat>(m_repeat); }
+    EFillRepeat repeatX() const { return static_cast<EFillRepeat>(m_repeatX); }
+    EFillRepeat repeatY() const { return static_cast<EFillRepeat>(m_repeatY); }
     CompositeOperator composite() const { return static_cast<CompositeOperator>(m_composite); }
-    LengthSize size() const { return m_size; }
+    LengthSize sizeLength() const { return m_sizeLength; }
+    FillSize size() const { return FillSize(static_cast<EFillSizeType>(m_sizeType), m_sizeLength); }
 
     const FillLayer* next() const { return m_next; }
     FillLayer* next() { return m_next; }
@@ -58,19 +85,23 @@ public:
     bool isAttachmentSet() const { return m_attachmentSet; }
     bool isClipSet() const { return m_clipSet; }
     bool isOriginSet() const { return m_originSet; }
-    bool isRepeatSet() const { return m_repeatSet; }
+    bool isRepeatXSet() const { return m_repeatXSet; }
+    bool isRepeatYSet() const { return m_repeatYSet; }
     bool isCompositeSet() const { return m_compositeSet; }
-    bool isSizeSet() const { return m_sizeSet; }
+    bool isSizeSet() const { return m_sizeType != SizeNone; }
     
     void setImage(StyleImage* i) { m_image = i; m_imageSet = true; }
-    void setXPosition(const Length& l) { m_xPosition = l; m_xPosSet = true; }
-    void setYPosition(const Length& l) { m_yPosition = l; m_yPosSet = true; }
+    void setXPosition(Length l) { m_xPosition = l; m_xPosSet = true; }
+    void setYPosition(Length l) { m_yPosition = l; m_yPosSet = true; }
     void setAttachment(EFillAttachment attachment) { m_attachment = attachment; m_attachmentSet = true; }
     void setClip(EFillBox b) { m_clip = b; m_clipSet = true; }
     void setOrigin(EFillBox b) { m_origin = b; m_originSet = true; }
-    void setRepeat(EFillRepeat r) { m_repeat = r; m_repeatSet = true; }
+    void setRepeatX(EFillRepeat r) { m_repeatX = r; m_repeatXSet = true; }
+    void setRepeatY(EFillRepeat r) { m_repeatY = r; m_repeatYSet = true; }
     void setComposite(CompositeOperator c) { m_composite = c; m_compositeSet = true; }
-    void setSize(const LengthSize& b) { m_size = b; m_sizeSet = true; }
+    void setSizeType(EFillSizeType b) { m_sizeType = b; }
+    void setSizeLength(LengthSize l) { m_sizeLength = l; }
+    void setSize(FillSize f) { m_sizeType = f.type; m_sizeLength = f.size; }
     
     void clearImage() { m_imageSet = false; }
     void clearXPosition() { m_xPosSet = false; }
@@ -78,9 +109,10 @@ public:
     void clearAttachment() { m_attachmentSet = false; }
     void clearClip() { m_clipSet = false; }
     void clearOrigin() { m_originSet = false; }
-    void clearRepeat() { m_repeatSet = false; }
+    void clearRepeatX() { m_repeatXSet = false; }
+    void clearRepeatY() { m_repeatYSet = false; }
     void clearComposite() { m_compositeSet = false; }
-    void clearSize() { m_sizeSet = false; }
+    void clearSize() { m_sizeType = SizeNone; }
 
     void setNext(FillLayer* n) { if (m_next != n) { delete m_next; m_next = n; } }
 
@@ -117,9 +149,12 @@ public:
     static EFillAttachment initialFillAttachment(EFillLayerType) { return ScrollBackgroundAttachment; }
     static EFillBox initialFillClip(EFillLayerType) { return BorderFillBox; }
     static EFillBox initialFillOrigin(EFillLayerType type) { return type == BackgroundFillLayer ? PaddingFillBox : BorderFillBox; }
-    static EFillRepeat initialFillRepeat(EFillLayerType) { return RepeatFill; }
+    static EFillRepeat initialFillRepeatX(EFillLayerType) { return RepeatFill; }
+    static EFillRepeat initialFillRepeatY(EFillLayerType) { return RepeatFill; }
     static CompositeOperator initialFillComposite(EFillLayerType) { return CompositeSourceOver; }
-    static LengthSize initialFillSize(EFillLayerType) { return LengthSize(); }
+    static EFillSizeType initialFillSizeType(EFillLayerType) { return SizeLength; }
+    static LengthSize initialFillSizeLength(EFillLayerType) { return LengthSize(); }
+    static FillSize initialFillSize(EFillLayerType) { return FillSize(); }
     static Length initialFillXPosition(EFillLayerType) { return Length(0.0, Percent); }
     static Length initialFillYPosition(EFillLayerType) { return Length(0.0, Percent); }
     static StyleImage* initialFillImage(EFillLayerType) { return 0; }
@@ -136,20 +171,22 @@ public:
     unsigned m_attachment : 2; // EFillAttachment
     unsigned m_clip : 2; // EFillBox
     unsigned m_origin : 2; // EFillBox
-    unsigned m_repeat : 2; // EFillRepeat
+    unsigned m_repeatX : 3; // EFillRepeat
+    unsigned m_repeatY : 3; // EFillRepeat
     unsigned m_composite : 4; // CompositeOperator
-
-    LengthSize m_size;
+    unsigned m_sizeType : 2; // EFillSizeType
+    
+    LengthSize m_sizeLength;
 
     bool m_imageSet : 1;
     bool m_attachmentSet : 1;
     bool m_clipSet : 1;
     bool m_originSet : 1;
-    bool m_repeatSet : 1;
+    bool m_repeatXSet : 1;
+    bool m_repeatYSet : 1;
     bool m_xPosSet : 1;
     bool m_yPosSet : 1;
     bool m_compositeSet : 1;
-    bool m_sizeSet : 1;
     
     unsigned m_type : 1; // EFillLayerType
 
diff --git a/WebCore/rendering/style/RenderStyle.cpp b/WebCore/rendering/style/RenderStyle.cpp
index 0e258c8..a861fea 100644
--- a/WebCore/rendering/style/RenderStyle.cpp
+++ b/WebCore/rendering/style/RenderStyle.cpp
@@ -324,6 +324,7 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             *rareNonInheritedData->flexibleBox.get() != *other->rareNonInheritedData->flexibleBox.get())
             return StyleDifferenceLayout;
 
+        // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
         if (!rareNonInheritedData->shadowDataEquivalent(*other->rareNonInheritedData.get()))
             return StyleDifferenceLayout;
 
@@ -453,6 +454,12 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     if (inherited->m_effectiveZoom != other->inherited->m_effectiveZoom)
         return StyleDifferenceLayout;
 
+    if (rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1 ||
+        rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1) {
+        // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
+        return StyleDifferenceLayout;
+    }
+
     // Make sure these left/top/right/bottom checks stay below all layout checks and above
     // all visible checks.
     if (position() != StaticPosition) {
diff --git a/WebCore/rendering/style/RenderStyle.h b/WebCore/rendering/style/RenderStyle.h
index 720bc8d..f1591de 100644
--- a/WebCore/rendering/style/RenderStyle.h
+++ b/WebCore/rendering/style/RenderStyle.h
@@ -521,26 +521,29 @@ public:
 
     const Color& backgroundColor() const { return background->m_color; }
     StyleImage* backgroundImage() const { return background->m_background.m_image.get(); }
-    EFillRepeat backgroundRepeat() const { return static_cast<EFillRepeat>(background->m_background.m_repeat); }
+    EFillRepeat backgroundRepeatX() const { return static_cast<EFillRepeat>(background->m_background.m_repeatX); }
+    EFillRepeat backgroundRepeatY() const { return static_cast<EFillRepeat>(background->m_background.m_repeatY); }
     CompositeOperator backgroundComposite() const { return static_cast<CompositeOperator>(background->m_background.m_composite); }
     EFillAttachment backgroundAttachment() const { return static_cast<EFillAttachment>(background->m_background.m_attachment); }
     EFillBox backgroundClip() const { return static_cast<EFillBox>(background->m_background.m_clip); }
     EFillBox backgroundOrigin() const { return static_cast<EFillBox>(background->m_background.m_origin); }
     Length backgroundXPosition() const { return background->m_background.m_xPosition; }
     Length backgroundYPosition() const { return background->m_background.m_yPosition; }
-    LengthSize backgroundSize() const { return background->m_background.m_size; }
+    EFillSizeType backgroundSizeType() const { return static_cast<EFillSizeType>(background->m_background.m_sizeType); }
+    LengthSize backgroundSizeLength() const { return background->m_background.m_sizeLength; }
     FillLayer* accessBackgroundLayers() { return &(background.access()->m_background); }
     const FillLayer* backgroundLayers() const { return &(background->m_background); }
 
     StyleImage* maskImage() const { return rareNonInheritedData->m_mask.m_image.get(); }
-    EFillRepeat maskRepeat() const { return static_cast<EFillRepeat>(rareNonInheritedData->m_mask.m_repeat); }
+    EFillRepeat maskRepeatX() const { return static_cast<EFillRepeat>(rareNonInheritedData->m_mask.m_repeatX); }
+    EFillRepeat maskRepeatY() const { return static_cast<EFillRepeat>(rareNonInheritedData->m_mask.m_repeatY); }
     CompositeOperator maskComposite() const { return static_cast<CompositeOperator>(rareNonInheritedData->m_mask.m_composite); }
     EFillAttachment maskAttachment() const { return static_cast<EFillAttachment>(rareNonInheritedData->m_mask.m_attachment); }
     EFillBox maskClip() const { return static_cast<EFillBox>(rareNonInheritedData->m_mask.m_clip); }
     EFillBox maskOrigin() const { return static_cast<EFillBox>(rareNonInheritedData->m_mask.m_origin); }
     Length maskXPosition() const { return rareNonInheritedData->m_mask.m_xPosition; }
     Length maskYPosition() const { return rareNonInheritedData->m_mask.m_yPosition; }
-    LengthSize maskSize() const { return rareNonInheritedData->m_mask.m_size; }
+    LengthSize maskSize() const { return rareNonInheritedData->m_mask.m_sizeLength; }
     FillLayer* accessMaskLayers() { return &(rareNonInheritedData.access()->m_mask); }
     const FillLayer* maskLayers() const { return &(rareNonInheritedData->m_mask); }
     const NinePieceImage& maskBoxImage() const { return rareNonInheritedData->m_maskBoxImage; }
@@ -755,7 +758,8 @@ public:
 
     void setBackgroundXPosition(Length l) { SET_VAR(background, m_background.m_xPosition, l) }
     void setBackgroundYPosition(Length l) { SET_VAR(background, m_background.m_yPosition, l) }
-    void setBackgroundSize(LengthSize l) { SET_VAR(background, m_background.m_size, l) }
+    void setBackgroundSize(EFillSizeType b) { SET_VAR(background, m_background.m_sizeType, b) }
+    void setBackgroundSizeLength(LengthSize l) { SET_VAR(background, m_background.m_sizeLength, l) }
     
     void setBorderImage(const NinePieceImage& b) { SET_VAR(surround, border.image, b) }
 
@@ -868,7 +872,7 @@ public:
     void setMaskBoxImage(const NinePieceImage& b) { SET_VAR(rareNonInheritedData, m_maskBoxImage, b) }
     void setMaskXPosition(Length l) { SET_VAR(rareNonInheritedData, m_mask.m_xPosition, l) }
     void setMaskYPosition(Length l) { SET_VAR(rareNonInheritedData, m_mask.m_yPosition, l) }
-    void setMaskSize(LengthSize l) { SET_VAR(rareNonInheritedData, m_mask.m_size, l) }
+    void setMaskSize(LengthSize l) { SET_VAR(rareNonInheritedData, m_mask.m_sizeLength, l) }
 
     void setBorderCollapse(bool collapse) { inherited_flags._border_collapse = collapse; }
     void setHorizontalBorderSpacing(short v) { SET_VAR(inherited, horizontal_border_spacing, v) }
diff --git a/WebCore/rendering/style/RenderStyleConstants.h b/WebCore/rendering/style/RenderStyleConstants.h
index c491816..3010947 100644
--- a/WebCore/rendering/style/RenderStyleConstants.h
+++ b/WebCore/rendering/style/RenderStyleConstants.h
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -68,10 +69,10 @@ enum PseudoId {
     NOPSEUDO, FIRST_LINE, FIRST_LETTER, BEFORE, AFTER, SELECTION, FIRST_LINE_INHERITED, SCROLLBAR, FILE_UPLOAD_BUTTON, INPUT_PLACEHOLDER,
     SLIDER_THUMB, SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON, MEDIA_CONTROLS_PANEL,
     MEDIA_CONTROLS_PLAY_BUTTON, MEDIA_CONTROLS_MUTE_BUTTON, MEDIA_CONTROLS_TIMELINE, MEDIA_CONTROLS_TIMELINE_CONTAINER,
-    MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON, 
-    MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON,
-    MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, MEDIA_CONTROLS_STATUS_DISPLAY,
-    SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
+    MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON,
+    MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON,
+    MEDIA_CONTROLS_STATUS_DISPLAY, SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
+    INPUT_LIST_BUTTON,
 
     FIRST_INTERNAL_PSEUDOID = FILE_UPLOAD_BUTTON
 };
@@ -131,13 +132,16 @@ enum EFillBox {
 };
 
 enum EFillRepeat {
-    RepeatFill, RepeatXFill, RepeatYFill, NoRepeatFill
+    RepeatFill, NoRepeatFill, RoundFill, SpaceFill
 };
 
 enum EFillLayerType {
     BackgroundFillLayer, MaskFillLayer
 };
 
+// CSS3 Background Values
+enum EFillSizeType { Contain, Cover, SizeLength, SizeNone };
+
 // CSS3 Marquee Properties
 
 enum EMarqueeBehavior { MNONE, MSCROLL, MSLIDE, MALTERNATE };
@@ -298,7 +302,11 @@ enum EDisplay {
     TABLE, INLINE_TABLE, TABLE_ROW_GROUP,
     TABLE_HEADER_GROUP, TABLE_FOOTER_GROUP, TABLE_ROW,
     TABLE_COLUMN_GROUP, TABLE_COLUMN, TABLE_CELL,
-    TABLE_CAPTION, BOX, INLINE_BOX, NONE
+    TABLE_CAPTION, BOX, INLINE_BOX, 
+#if ENABLE(WCSS)
+    WAP_MARQUEE,
+#endif
+    NONE
 };
 
 enum EPointerEvents {
diff --git a/WebCore/rendering/style/SVGRenderStyle.h b/WebCore/rendering/style/SVGRenderStyle.h
index 0e9dae4..e50d349 100644
--- a/WebCore/rendering/style/SVGRenderStyle.h
+++ b/WebCore/rendering/style/SVGRenderStyle.h
@@ -65,7 +65,6 @@ namespace WebCore {
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(LineJoin, JoinStyle, joinStyle, MiterJoin)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EShapeRendering, ShapeRendering, shapeRendering, SR_AUTO)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(ETextAnchor, TextAnchor, textAnchor, TA_START)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(ETextRendering, TextRendering, textRendering, TR_AUTO)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EWritingMode, WritingMode, writingMode, WM_LRTB)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationHorizontal, glyphOrientationHorizontal, GO_0DEG)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationVertical, glyphOrientationVertical, GO_AUTO)
@@ -113,7 +112,6 @@ namespace WebCore {
                 return (_colorRendering == other._colorRendering) &&
                        (_imageRendering == other._imageRendering) &&
                        (_shapeRendering == other._shapeRendering) &&
-                       (_textRendering == other._textRendering) &&
                        (_clipRule == other._clipRule) &&
                        (_fillRule == other._fillRule) &&
                        (_capStyle == other._capStyle) &&
@@ -134,7 +132,6 @@ namespace WebCore {
             unsigned _colorRendering : 2; // EColorRendering
             unsigned _imageRendering : 2; // EImageRendering 
             unsigned _shapeRendering : 2; // EShapeRendering 
-            unsigned _textRendering : 2; // ETextRendering
             unsigned _clipRule : 1; // WindRule
             unsigned _fillRule : 1; // WindRule
             unsigned _capStyle : 2; // LineCap
@@ -190,7 +187,6 @@ namespace WebCore {
             svg_inherited_flags._fillRule = initialFillRule();
             svg_inherited_flags._imageRendering = initialImageRendering();
             svg_inherited_flags._shapeRendering = initialShapeRendering();
-            svg_inherited_flags._textRendering = initialTextRendering();
             svg_inherited_flags._textAnchor = initialTextAnchor();
             svg_inherited_flags._capStyle = initialCapStyle();
             svg_inherited_flags._joinStyle = initialJoinStyle();
diff --git a/WebCore/rendering/style/SVGRenderStyleDefs.h b/WebCore/rendering/style/SVGRenderStyleDefs.h
index b7bf026..c0f5d4e 100644
--- a/WebCore/rendering/style/SVGRenderStyleDefs.h
+++ b/WebCore/rendering/style/SVGRenderStyleDefs.h
@@ -95,10 +95,6 @@ namespace WebCore {
         SR_AUTO, SR_OPTIMIZESPEED, SR_CRISPEDGES, SR_GEOMETRICPRECISION
     };
 
-    enum ETextRendering {
-        TR_AUTO, TR_OPTIMIZESPEED, TR_OPTIMIZELEGIBILITY, TR_GEOMETRICPRECISION
-    };
-
     enum EWritingMode {
         WM_LRTB, WM_LR, WM_RLTB, WM_RL, WM_TBRL, WM_TB
     };
diff --git a/WebCore/storage/ChangeVersionWrapper.cpp b/WebCore/storage/ChangeVersionWrapper.cpp
index a2be615..17a9407 100644
--- a/WebCore/storage/ChangeVersionWrapper.cpp
+++ b/WebCore/storage/ChangeVersionWrapper.cpp
@@ -34,29 +34,29 @@
 namespace WebCore {
 
 ChangeVersionWrapper::ChangeVersionWrapper(const String& oldVersion, const String& newVersion)
-    : m_oldVersion(oldVersion.copy())
-    , m_newVersion(newVersion.copy())
+    : m_oldVersion(oldVersion.crossThreadString())
+    , m_newVersion(newVersion.crossThreadString())
 {
 }
 
 bool ChangeVersionWrapper::performPreflight(SQLTransaction* transaction)
 {
     ASSERT(transaction && transaction->database());
-    
+
     String actualVersion;
-    
+
     if (!transaction->database()->getVersionFromDatabase(actualVersion)) {
         LOG_ERROR("Unable to retrieve actual current version from database");
         m_sqlError = SQLError::create(0, "unable to verify current version of database");
         return false;
     }
-    
+
     if (actualVersion != m_oldVersion) {
         LOG_ERROR("Old version doesn't match actual version");
         m_sqlError = SQLError::create(2, "current version of the database and `oldVersion` argument do not match");
         return false;
     }
-    
+
     return true;
 }
 
@@ -71,10 +71,10 @@ bool ChangeVersionWrapper::performPostflight(SQLTransaction* transaction)
     }
 
     transaction->database()->setExpectedVersion(m_newVersion);
-    
+
     return true;
 }
-    
+
 } // namespace WebCore
 
 #endif // ENABLE(DATABASE)
diff --git a/WebCore/storage/Database.cpp b/WebCore/storage/Database.cpp
index 8118e76..8b0b432 100644
--- a/WebCore/storage/Database.cpp
+++ b/WebCore/storage/Database.cpp
@@ -50,6 +50,8 @@
 #include "SQLiteFileSystem.h"
 #include "SQLiteStatement.h"
 #include "SQLResultSet.h"
+#include "SQLTransactionClient.h"
+#include "SQLTransactionCoordinator.h"
 #include <wtf/MainThread.h>
 #endif
 
@@ -102,7 +104,11 @@ static inline void updateGuidVersionMap(int guid, String newVersion)
     // FIXME: This is a quite-awkward restriction to have to program with.
 
     // Map null string to empty string (see comment above).
+<<<<<<< HEAD:WebCore/storage/Database.cpp
     guidToVersionMap().set(guid, newVersion.isEmpty() ? String() : newVersion.copy());
+=======
+    guidToVersionMap().set(guid, newVersion.isEmpty() ? String() : newVersion.threadsafeCopy());
+>>>>>>> Merge webkit.org at R49305 : Automatic merge by git.:WebCore/storage/Database.cpp
 }
 
 typedef HashMap<int, HashSet<Database*>*> GuidDatabaseMap;
@@ -127,20 +133,22 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
         LOG(StorageAPI, "Database %s for origin %s not allowed to be established", name.ascii().data(), document->securityOrigin()->toString().ascii().data());
         return 0;
     }
-    
+
     RefPtr<Database> database = adoptRef(new Database(document, name, expectedVersion));
 
     if (!database->openAndVerifyVersion(e)) {
        LOG(StorageAPI, "Failed to open and verify version (expected %s) of database %s", expectedVersion.ascii().data(), database->databaseDebugName().ascii().data());
        return 0;
     }
-    
+
     DatabaseTracker::tracker().setDatabaseDetails(document->securityOrigin(), name, displayName, estimatedSize);
 
     document->setHasOpenDatabases();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = document->frame()->page())
         page->inspectorController()->didOpenDatabase(database.get(), document->securityOrigin()->host(), name, expectedVersion);
+#endif
 
     return database;
 }
@@ -148,7 +156,7 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
 Database::Database(Document* document, const String& name, const String& expectedVersion)
     : m_transactionInProgress(false)
     , m_document(document)
-    , m_name(name.copy())
+    , m_name(name.crossThreadString())
     , m_guid(0)
     , m_expectedVersion(expectedVersion)
     , m_deleted(false)
@@ -163,11 +171,14 @@ Database::Database(Document* document, const String& name, const String& expecte
 
 #if USE(JSC)
     JSC::initializeThreading();
+<<<<<<< HEAD:WebCore/storage/Database.cpp
     // Database code violates the normal JSCore contract by calling jsUnprotect from a secondary thread, and thus needs additional locking.
     JSDOMWindow::commonJSGlobalData()->heap.setGCProtectNeedsLocking();
 #elif USE(V8)
     // TODO(benm): do we need the extra locking in V8 too? (See JSC comment above)
     V8::initializeThreading();
+=======
+>>>>>>> webkit.org at 49305:WebCore/storage/Database.cpp
 #endif
 
     m_guid = guidForOriginAndName(m_securityOrigin->toString(), name);
@@ -248,7 +259,7 @@ bool Database::getVersionFromDatabase(String& version)
 
     m_databaseAuthorizer->disable();
 
-    bool result = retrieveTextResultFromDatabase(m_sqliteDatabase, getVersionQuery.copy(), version);
+    bool result = retrieveTextResultFromDatabase(m_sqliteDatabase, getVersionQuery.threadsafeCopy(), version);
     if (!result)
         LOG_ERROR("Failed to retrieve version from database %s", databaseDebugName().ascii().data());
 
@@ -286,7 +297,7 @@ bool Database::setVersionInDatabase(const String& version)
 
     m_databaseAuthorizer->disable();
 
-    bool result = setTextValueInDatabase(m_sqliteDatabase, setVersionQuery.copy(), version);
+    bool result = setTextValueInDatabase(m_sqliteDatabase, setVersionQuery.threadsafeCopy(), version);
     if (!result)
         LOG_ERROR("Failed to set version %s in database (%s)", version.ascii().data(), setVersionQuery.ascii().data());
 
@@ -301,7 +312,7 @@ bool Database::versionMatchesExpected() const
         MutexLocker locker(guidMutex());
         return m_expectedVersion == guidToVersionMap().get(m_guid);
     }
-    
+
     return true;
 }
 
@@ -357,8 +368,8 @@ void Database::stop()
     // FIXME: The net effect of the following code is to remove all pending transactions and statements, but allow the current statement
     // to run to completion.  In the future we can use the sqlite3_progress_handler or sqlite3_interrupt interfaces to cancel the current
     // statement in response to close(), as well.
-    
-    // This method is meant to be used as an analog to cancelling a loader, and is used when a document is shut down as the result of 
+
+    // This method is meant to be used as an analog to cancelling a loader, and is used when a document is shut down as the result of
     // a page load or closing the page
     m_stopped = true;
 
@@ -378,10 +389,10 @@ unsigned long long Database::maximumSize() const
 {
     // The maximum size for this database is the full quota for this origin, minus the current usage within this origin,
     // except for the current usage of this database
-    
+
     OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
     Locker<OriginQuotaManager> locker(manager);
-    
+
     return DatabaseTracker::tracker().quotaForOrigin(m_securityOrigin.get()) - manager.diskUsage(m_securityOrigin.get()) + databaseSize();
 }
 
@@ -464,14 +475,6 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
     m_sqliteDatabase.setAuthorizer(m_databaseAuthorizer);
     m_sqliteDatabase.setBusyTimeout(maxSqliteBusyWaitTime);
 
-    if (!m_sqliteDatabase.tableExists(databaseInfoTableName())) {
-        if (!m_sqliteDatabase.executeCommand("CREATE TABLE " + databaseInfoTableName() + " (key TEXT NOT NULL ON CONFLICT FAIL UNIQUE ON CONFLICT REPLACE,value TEXT NOT NULL ON CONFLICT FAIL);")) {
-            LOG_ERROR("Unable to create table %s in database %s", databaseInfoTableName().ascii().data(), databaseDebugName().ascii().data());
-            e = INVALID_STATE_ERR;
-            return false;
-        }
-    }
-
     String currentVersion;
     {
         MutexLocker locker(guidMutex());
@@ -483,6 +486,15 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
             LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
         } else {
             LOG(StorageAPI, "No cached version for guid %i", m_guid);
+
+            if (!m_sqliteDatabase.tableExists(databaseInfoTableName())) {
+                if (!m_sqliteDatabase.executeCommand("CREATE TABLE " + databaseInfoTableName() + " (key TEXT NOT NULL ON CONFLICT FAIL UNIQUE ON CONFLICT REPLACE,value TEXT NOT NULL ON CONFLICT FAIL);")) {
+                    LOG_ERROR("Unable to create table %s in database %s", databaseInfoTableName().ascii().data(), databaseDebugName().ascii().data());
+                    e = INVALID_STATE_ERR;
+                    return false;
+                }
+            }
+
             if (!getVersionFromDatabase(currentVersion)) {
                 LOG_ERROR("Failed to get current version from database %s", databaseDebugName().ascii().data());
                 e = INVALID_STATE_ERR;
@@ -523,7 +535,7 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
     return true;
 }
 
-void Database::changeVersion(const String& oldVersion, const String& newVersion, 
+void Database::changeVersion(const String& oldVersion, const String& newVersion,
                              PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
                              PassRefPtr<VoidCallback> successCallback)
 {
@@ -534,9 +546,9 @@ void Database::changeVersion(const String& oldVersion, const String& newVersion,
 }
 
 void Database::transaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
-                           PassRefPtr<VoidCallback> successCallback)
+                           PassRefPtr<VoidCallback> successCallback, bool readOnly)
 {
-    m_transactionQueue.append(SQLTransaction::create(this, callback, errorCallback, successCallback, 0));
+    m_transactionQueue.append(SQLTransaction::create(this, callback, errorCallback, successCallback, 0, readOnly));
     MutexLocker locker(m_transactionInProgressMutex);
     if (!m_transactionInProgress)
         scheduleTransaction();
@@ -555,13 +567,17 @@ void Database::scheduleTransaction()
         m_transactionInProgress = false;
 }
 
-void Database::scheduleTransactionStep(SQLTransaction* transaction)
+void Database::scheduleTransactionStep(SQLTransaction* transaction, bool immediately)
 {
-    if (m_document->databaseThread()) {
-        RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
-        LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
+    if (!m_document->databaseThread())
+        return;
+
+    RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
+    LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
+    if (immediately)
+        m_document->databaseThread()->scheduleImmediateTask(task.release());
+    else
         m_document->databaseThread()->scheduleTask(task.release());
-    }
 }
 
 void Database::scheduleTransactionCallback(SQLTransaction* transaction)
@@ -599,12 +615,22 @@ Vector<String> Database::performGetTableNames()
     return tableNames;
 }
 
+SQLTransactionClient* Database::transactionClient() const
+{
+    return m_document->databaseThread()->transactionClient();
+}
+
+SQLTransactionCoordinator* Database::transactionCoordinator() const
+{
+    return m_document->databaseThread()->transactionCoordinator();
+}
+
 String Database::version() const
 {
     if (m_deleted)
         return String();
     MutexLocker locker(guidMutex());
-    return guidToVersionMap().get(m_guid).copy();
+    return guidToVersionMap().get(m_guid).threadsafeCopy();
 }
 
 void Database::deliverPendingCallback(void* context)
@@ -629,7 +655,11 @@ Vector<String> Database::tableNames()
 
 void Database::setExpectedVersion(const String& version)
 {
+<<<<<<< HEAD:WebCore/storage/Database.cpp
     m_expectedVersion = version.copy();
+=======
+    m_expectedVersion = version.threadsafeCopy();
+>>>>>>> Merge webkit.org at R49305 : Automatic merge by git.:WebCore/storage/Database.cpp
     // Update the in memory database version map.
     MutexLocker locker(guidMutex());
     updateGuidVersionMap(m_guid, version);
@@ -637,13 +667,13 @@ void Database::setExpectedVersion(const String& version)
 
 PassRefPtr<SecurityOrigin> Database::securityOriginCopy() const
 {
-    return m_securityOrigin->copy();
+    return m_securityOrigin->threadsafeCopy();
 }
 
 String Database::stringIdentifier() const
 {
     // Return a deep copy for ref counting thread safety
-    return m_name.copy();
+    return m_name.threadsafeCopy();
 }
 
 #endif
diff --git a/WebCore/storage/Database.h b/WebCore/storage/Database.h
index 0bdb37b..b850686 100644
--- a/WebCore/storage/Database.h
+++ b/WebCore/storage/Database.h
@@ -41,7 +41,6 @@
 
 #include <wtf/Forward.h>
 #include <wtf/HashSet.h>
-#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Deque.h>
@@ -57,9 +56,11 @@ class DatabaseThread;
 class Document;
 class SQLResultSet;
 class SQLTransactionCallback;
+class SQLTransactionClient;
+class SQLTransactionCoordinator;
 class SQLTransactionErrorCallback;
 class SQLValue;
-    
+
 typedef int ExceptionCode;
 
 class Database : public ThreadSafeShared<Database> {
@@ -72,12 +73,12 @@ public:
 // Direct support for the DOM API
     static PassRefPtr<Database> openDatabase(Document* document, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize, ExceptionCode&);
     String version() const;
-    void changeVersion(const String& oldVersion, const String& newVersion, 
+    void changeVersion(const String& oldVersion, const String& newVersion,
                        PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
                        PassRefPtr<VoidCallback> successCallback);
     void transaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
-                     PassRefPtr<VoidCallback> successCallback);
-    
+                     PassRefPtr<VoidCallback> successCallback, bool readOnly);
+
 // Internal engine support
     static const String& databaseInfoTableName();
 
@@ -90,7 +91,7 @@ public:
     Document* document() const { return m_document.get(); }
     PassRefPtr<SecurityOrigin> securityOriginCopy() const;
     String stringIdentifier() const;
-    
+
     bool getVersionFromDatabase(String&);
     bool setVersionInDatabase(const String&);
     void setExpectedVersion(const String&);
@@ -101,7 +102,7 @@ public:
 
     void close();
     bool opened() const { return m_opened; }
-    
+
     void stop();
     bool stopped() const { return m_stopped; }
 
@@ -116,6 +117,9 @@ public:
 
     Vector<String> performGetTableNames();
 
+    SQLTransactionClient* transactionClient() const;
+    SQLTransactionCoordinator* transactionCoordinator() const;
+
 private:
     Database(Document* document, const String& name, const String& expectedVersion);
 
@@ -123,8 +127,8 @@ private:
 
     void scheduleTransaction();
     void scheduleTransactionCallback(SQLTransaction*);
-    void scheduleTransactionStep(SQLTransaction* transaction);
-    
+    void scheduleTransactionStep(SQLTransaction* transaction, bool immediately = false);
+
     MessageQueue<RefPtr<SQLTransaction> > m_transactionQueue;
     Mutex m_transactionInProgressMutex;
     bool m_transactionInProgress;
@@ -139,7 +143,7 @@ private:
     String m_filename;
 
     bool m_deleted;
-    
+
     bool m_stopped;
 
     bool m_opened;
diff --git a/WebCore/storage/Database.idl b/WebCore/storage/Database.idl
index 1e4b316..6ca9c95 100644
--- a/WebCore/storage/Database.idl
+++ b/WebCore/storage/Database.idl
@@ -34,6 +34,7 @@ module storage {
         readonly attribute DOMString version;
         [Custom] void changeVersion(in DOMString oldVersion, in DOMString newVersion, in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
         [Custom] void transaction(in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
+        [Custom] void readTransaction(in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
     };
 
 }
diff --git a/WebCore/storage/DatabaseAuthorizer.cpp b/WebCore/storage/DatabaseAuthorizer.cpp
index 2d182ce..93f9106 100644
--- a/WebCore/storage/DatabaseAuthorizer.cpp
+++ b/WebCore/storage/DatabaseAuthorizer.cpp
@@ -58,6 +58,12 @@ int DatabaseAuthorizer::createTable(const String& tableName)
 
 int DatabaseAuthorizer::createTempTable(const String& tableName)
 {
+    // SQLITE_CREATE_TEMP_TABLE results in a UPDATE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_CREATE_TEMP_TABLE in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -71,6 +77,12 @@ int DatabaseAuthorizer::dropTable(const String& tableName)
 
 int DatabaseAuthorizer::dropTempTable(const String& tableName)
 {
+    // SQLITE_DROP_TEMP_TABLE results in a DELETE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_DROP_TEMP_TABLE in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -94,6 +106,12 @@ int DatabaseAuthorizer::createIndex(const String&, const String& tableName)
 
 int DatabaseAuthorizer::createTempIndex(const String&, const String& tableName)
 {
+    // SQLITE_CREATE_TEMP_INDEX should result in a UPDATE or INSERT operation,
+    // which is not allowed in read-only transactions or private browsing,
+    // so we might as well disallow SQLITE_CREATE_TEMP_INDEX in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -107,6 +125,12 @@ int DatabaseAuthorizer::dropIndex(const String&, const String& tableName)
 
 int DatabaseAuthorizer::dropTempIndex(const String&, const String& tableName)
 {
+    // SQLITE_DROP_TEMP_INDEX should result in a DELETE operation, which is
+    // not allowed in read-only transactions or private browsing, so we might
+    // as well disallow SQLITE_DROP_TEMP_INDEX in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -121,6 +145,12 @@ int DatabaseAuthorizer::createTrigger(const String&, const String& tableName)
 
 int DatabaseAuthorizer::createTempTrigger(const String&, const String& tableName)
 {
+    // SQLITE_CREATE_TEMP_TRIGGER results in a INSERT operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_CREATE_TEMP_TRIGGER in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -134,9 +164,41 @@ int DatabaseAuthorizer::dropTrigger(const String&, const String& tableName)
 
 int DatabaseAuthorizer::dropTempTrigger(const String&, const String& tableName)
 {
+    // SQLITE_DROP_TEMP_TRIGGER results in a DELETE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_DROP_TEMP_TRIGGER in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
+int DatabaseAuthorizer::createView(const String&)
+{
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
+int DatabaseAuthorizer::createTempView(const String&)
+{
+    // SQLITE_CREATE_TEMP_VIEW results in a UPDATE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_CREATE_TEMP_VIEW in these cases
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
+int DatabaseAuthorizer::dropView(const String&)
+{
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
+int DatabaseAuthorizer::dropTempView(const String&)
+{
+    // SQLITE_DROP_TEMP_VIEW results in a DELETE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_DROP_TEMP_VIEW in these cases
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
 int DatabaseAuthorizer::createVTable(const String&, const String&)
 {
     if (m_readOnly && m_securityEnabled)
@@ -191,6 +253,11 @@ int DatabaseAuthorizer::allowRead(const String& tableName, const String&)
     return denyBasedOnTableName(tableName);
 }
 
+int DatabaseAuthorizer::allowReindex(const String&)
+{
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
 int DatabaseAuthorizer::allowAnalyze(const String& tableName)
 {
     return denyBasedOnTableName(tableName);
diff --git a/WebCore/storage/DatabaseAuthorizer.h b/WebCore/storage/DatabaseAuthorizer.h
index e53ea50..248b659 100644
--- a/WebCore/storage/DatabaseAuthorizer.h
+++ b/WebCore/storage/DatabaseAuthorizer.h
@@ -59,10 +59,10 @@ public:
     int dropTrigger(const String& triggerName, const String& tableName);
     int dropTempTrigger(const String& triggerName, const String& tableName);
 
-    int createView(const String& /*viewName*/) { return SQLAuthAllow; }
-    int createTempView(const String& /*viewName*/) { return SQLAuthAllow; }
-    int dropView(const String& /*viewName*/) { return SQLAuthAllow; }
-    int dropTempView(const String& /*viewName*/) { return SQLAuthAllow; }
+    int createView(const String& viewName);
+    int createTempView(const String& viewName);
+    int dropView(const String& viewName);
+    int dropTempView(const String& viewName);
 
     int createVTable(const String& tableName, const String& moduleName);
     int dropVTable(const String& tableName, const String& moduleName);
@@ -75,7 +75,7 @@ public:
     int allowSelect() { return SQLAuthAllow; }
     int allowRead(const String& tableName, const String& columnName);
 
-    int allowReindex(const String& /*indexName*/) { return SQLAuthAllow; }
+    int allowReindex(const String& indexName);
     int allowAnalyze(const String& tableName);
     int allowFunction(const String& functionName);
     int allowPragma(const String& pragmaName, const String& firstArgument);
diff --git a/WebCore/storage/DatabaseDetails.h b/WebCore/storage/DatabaseDetails.h
index a4d85fd..9b0f506 100644
--- a/WebCore/storage/DatabaseDetails.h
+++ b/WebCore/storage/DatabaseDetails.h
@@ -60,7 +60,7 @@ private:
     String m_name;
     String m_displayName;
     unsigned long long m_expectedUsage;
-    unsigned long long m_currentUsage; 
+    unsigned long long m_currentUsage;
 
 };
 
diff --git a/WebCore/storage/DatabaseThread.cpp b/WebCore/storage/DatabaseThread.cpp
index b6c9b5d..9e3afdd 100644
--- a/WebCore/storage/DatabaseThread.cpp
+++ b/WebCore/storage/DatabaseThread.cpp
@@ -35,11 +35,15 @@
 #include "Database.h"
 #include "DatabaseTask.h"
 #include "Logging.h"
+#include "SQLTransactionClient.h"
+#include "SQLTransactionCoordinator.h"
 
 namespace WebCore {
 
 DatabaseThread::DatabaseThread()
     : m_threadID(0)
+    , m_transactionClient(new SQLTransactionClient())
+    , m_transactionCoordinator(new SQLTransactionCoordinator())
 {
     m_selfRef = this;
 }
@@ -97,6 +101,9 @@ void* DatabaseThread::databaseThread()
         pool.cycle();
     }
 
+    // Clean up the list of all pending transactions on this database thread
+    m_transactionCoordinator->shutdown();
+
     LOG(StorageAPI, "About to detach thread %i and clear the ref to DatabaseThread %p, which currently has %i ref(s)", m_threadID, this, refCount());
 
     // Close the databases that we ran transactions on. This ensures that if any transactions are still open, they are rolled back and we don't leave the database in an
@@ -119,7 +126,7 @@ void* DatabaseThread::databaseThread()
     return 0;
 }
 
-void DatabaseThread::recordDatabaseOpen(Database* database) 
+void DatabaseThread::recordDatabaseOpen(Database* database)
 {
     ASSERT(currentThread() == m_threadID);
     ASSERT(database);
@@ -127,7 +134,7 @@ void DatabaseThread::recordDatabaseOpen(Database* database)
     m_openDatabaseSet.add(database);
 }
 
-void DatabaseThread::recordDatabaseClosed(Database* database) 
+void DatabaseThread::recordDatabaseClosed(Database* database)
 {
     ASSERT(currentThread() == m_threadID);
     ASSERT(database);
diff --git a/WebCore/storage/DatabaseThread.h b/WebCore/storage/DatabaseThread.h
index 5aab5fd..83b1baf 100644
--- a/WebCore/storage/DatabaseThread.h
+++ b/WebCore/storage/DatabaseThread.h
@@ -33,6 +33,7 @@
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
@@ -42,6 +43,8 @@ namespace WebCore {
 class Database;
 class DatabaseTask;
 class Document;
+class SQLTransactionClient;
+class SQLTransactionCoordinator;
 
 class DatabaseThread : public ThreadSafeShared<DatabaseThread> {
 public:
@@ -60,6 +63,9 @@ public:
     void recordDatabaseClosed(Database*);
     ThreadIdentifier getThreadID() { return m_threadID; }
 
+    SQLTransactionClient* transactionClient() { return m_transactionClient.get(); }
+    SQLTransactionCoordinator* transactionCoordinator() { return m_transactionCoordinator.get(); }
+
 private:
     DatabaseThread();
 
@@ -75,6 +81,9 @@ private:
     // This set keeps track of the open databases that have been used on this thread.
     typedef HashSet<RefPtr<Database> > DatabaseSet;
     DatabaseSet m_openDatabaseSet;
+
+    OwnPtr<SQLTransactionClient> m_transactionClient;
+    OwnPtr<SQLTransactionCoordinator> m_transactionCoordinator;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/DatabaseTracker.cpp b/WebCore/storage/DatabaseTracker.cpp
index e7c9485..265cd0d 100644
--- a/WebCore/storage/DatabaseTracker.cpp
+++ b/WebCore/storage/DatabaseTracker.cpp
@@ -131,7 +131,7 @@ bool DatabaseTracker::canEstablishDatabase(Document* document, const String& nam
     // Since we're imminently opening a database within this Document's origin, make sure this origin is being tracked by the QuotaTracker
     // by fetching it's current usage now
     unsigned long long usage = usageForOrigin(origin);
-    
+
     // If a database already exists, ignore the passed-in estimated size and say it's OK.
     if (hasEntryForDatabase(origin, name))
         return true;
@@ -197,11 +197,11 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
 
     String originIdentifier = origin->databaseIdentifier();
     String originPath = this->originPath(origin);
-    
+
     // Make sure the path for this SecurityOrigin exists
     if (createIfNotExists && !SQLiteFileSystem::ensureDatabaseDirectoryExists(originPath))
         return String();
-    
+
     // See if we have a path for this database yet
     openTrackerDatabase(false);
     if (!m_database.isOpen())
@@ -220,14 +220,14 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
         return SQLiteFileSystem::appendDatabaseFileNameToPath(originPath, statement.getColumnText(0));
     if (!createIfNotExists)
         return String();
-        
+
     if (result != SQLResultDone) {
         LOG_ERROR("Failed to retrieve filename from Database Tracker for origin %s, name %s", origin->databaseIdentifier().ascii().data(), name.ascii().data());
         return String();
     }
     statement.finalize();
-    
-    String fileName = SQLiteFileSystem::getFileNameForNewDatabase(originPath, origin->databaseIdentifier(), name, &m_database);
+
+    String fileName = SQLiteFileSystem::getFileNameForNewDatabase(originPath, name, origin->databaseIdentifier(), &m_database);
     if (!addDatabase(origin, name, fileName))
         return String();
 
@@ -239,7 +239,7 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
         if (originQuotaManager().tracksOrigin(origin))
             originQuotaManager().addDatabase(origin, name, fullFilePath);
     }
-    
+
     return fullFilePath;
 }
 
@@ -321,19 +321,19 @@ DatabaseDetails DatabaseTracker::detailsForNameAndOrigin(const String& name, Sec
     SQLiteStatement statement(m_database, "SELECT displayName, estimatedSize FROM Databases WHERE origin=? AND name=?");
     if (statement.prepare() != SQLResultOk)
         return DatabaseDetails();
-   
+
     statement.bindText(1, originIdentifier);
     statement.bindText(2, name);
-    
+
     int result = statement.step();
     if (result == SQLResultDone)
         return DatabaseDetails();
-    
+
     if (result != SQLResultRow) {
         LOG_ERROR("Error retrieving details for database %s in origin %s from tracker database", name.ascii().data(), originIdentifier.ascii().data());
         return DatabaseDetails();
     }
-    
+
     return DatabaseDetails(name, statement.getColumnText(0), statement.getColumnInt64(1), usageForDatabase(name, origin));
 }
 
@@ -343,17 +343,17 @@ void DatabaseTracker::setDatabaseDetails(SecurityOrigin* origin, const String& n
 
     String originIdentifier = origin->databaseIdentifier();
     int64_t guid = 0;
-    
+
     openTrackerDatabase(true);
     if (!m_database.isOpen())
         return;
     SQLiteStatement statement(m_database, "SELECT guid FROM Databases WHERE origin=? AND name=?");
     if (statement.prepare() != SQLResultOk)
         return;
-        
+
     statement.bindText(1, originIdentifier);
     statement.bindText(2, name);
-    
+
     int result = statement.step();
     if (result == SQLResultRow)
         guid = statement.getColumnInt64(0);
@@ -371,20 +371,20 @@ void DatabaseTracker::setDatabaseDetails(SecurityOrigin* origin, const String& n
         }
         return;
     }
-    
+
     SQLiteStatement updateStatement(m_database, "UPDATE Databases SET displayName=?, estimatedSize=? WHERE guid=?");
     if (updateStatement.prepare() != SQLResultOk)
         return;
-    
+
     updateStatement.bindText(1, displayName);
     updateStatement.bindInt64(2, estimatedSize);
     updateStatement.bindInt64(3, guid);
-    
+
     if (updateStatement.step() != SQLResultDone) {
         LOG_ERROR("Failed to update details for database %s in origin %s", name.ascii().data(), originIdentifier.ascii().data());
-        return;  
+        return;
     }
-    
+
     if (m_client)
         m_client->dispatchDidModifyDatabase(origin, name);
 }
@@ -395,7 +395,7 @@ unsigned long long DatabaseTracker::usageForDatabase(const String& name, Securit
     String path = fullPathForDatabase(origin, name, false);
     if (path.isEmpty())
         return 0;
-        
+
     return SQLiteFileSystem::getDatabaseFileSize(path);
 }
 
@@ -481,16 +481,16 @@ unsigned long long DatabaseTracker::usageForOrigin(SecurityOrigin* origin)
     // Use the OriginQuotaManager mechanism to calculate the usage
     if (originQuotaManager().tracksOrigin(origin))
         return originQuotaManager().diskUsage(origin);
-    
+
     // If the OriginQuotaManager doesn't track this origin already, prime it to do so
     originQuotaManager().trackOrigin(origin);
-    
+
     Vector<String> names;
     databaseNamesForOrigin(origin, names);
 
     for (unsigned i = 0; i < names.size(); ++i)
         originQuotaManager().addDatabase(origin, names[i], fullPathForDatabase(origin, names[i], false));
-    
+
     if (!originQuotaManager().tracksOrigin(origin))
         return 0;
     return originQuotaManager().diskUsage(origin);
@@ -529,7 +529,7 @@ void DatabaseTracker::setQuota(SecurityOrigin* origin, unsigned long long quota)
                     LOG_ERROR("Unable to establish origin %s in the tracker", origin->databaseIdentifier().ascii().data());
             }
         } else {
-            SQLiteStatement statement(m_database, "UPDATE Origins SET quota=? WHERE origin=?");        
+            SQLiteStatement statement(m_database, "UPDATE Origins SET quota=? WHERE origin=?");
             bool error = statement.prepare() != SQLResultOk;
             if (!error) {
                 statement.bindInt64(1, quota);
@@ -556,7 +556,7 @@ bool DatabaseTracker::addDatabase(SecurityOrigin* origin, const String& name, co
     openTrackerDatabase(true);
     if (!m_database.isOpen())
         return false;
-        
+
     // New database should never be added until the origin has been established
     ASSERT(hasEntryForOrigin(origin));
 
@@ -573,10 +573,10 @@ bool DatabaseTracker::addDatabase(SecurityOrigin* origin, const String& name, co
         LOG_ERROR("Failed to add database %s to origin %s: %s\n", name.ascii().data(), origin->databaseIdentifier().ascii().data(), m_database.lastErrorMsg());
         return false;
     }
-    
+
     if (m_client)
         m_client->dispatchDidModifyOrigin(origin);
-    
+
     return true;
 }
 
@@ -603,27 +603,27 @@ void DatabaseTracker::deleteOrigin(SecurityOrigin* origin)
         LOG_ERROR("Unable to retrieve list of database names for origin %s", origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     for (unsigned i = 0; i < databaseNames.size(); ++i) {
         if (!deleteDatabaseFile(origin, databaseNames[i])) {
+            // Even if the file can't be deleted, we want to try and delete the rest, don't return early here.
             LOG_ERROR("Unable to delete file for database %s in origin %s", databaseNames[i].ascii().data(), origin->databaseIdentifier().ascii().data());
-            return;
         }
     }
-    
+
     SQLiteStatement statement(m_database, "DELETE FROM Databases WHERE origin=?");
     if (statement.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to prepare deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
         return;
     }
-        
+
     statement.bindText(1, origin->databaseIdentifier());
-    
+
     if (!statement.executeCommand()) {
         LOG_ERROR("Unable to execute deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     SQLiteStatement originStatement(m_database, "DELETE FROM Origins WHERE origin=?");
     if (originStatement.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to prepare deletion of origin %s from tracker", origin->databaseIdentifier().ascii().data());
@@ -631,7 +631,7 @@ void DatabaseTracker::deleteOrigin(SecurityOrigin* origin)
     }
 
     originStatement.bindText(1, origin->databaseIdentifier());
-    
+
     if (!originStatement.executeCommand()) {
         LOG_ERROR("Unable to execute deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
         return;
@@ -674,26 +674,26 @@ void DatabaseTracker::deleteDatabase(SecurityOrigin* origin, const String& name)
         LOG_ERROR("Unable to delete file for database %s in origin %s", name.ascii().data(), origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     SQLiteStatement statement(m_database, "DELETE FROM Databases WHERE origin=? AND name=?");
     if (statement.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to prepare deletion of database %s from origin %s from tracker", name.ascii().data(), origin->databaseIdentifier().ascii().data());
         return;
     }
-        
+
     statement.bindText(1, origin->databaseIdentifier());
     statement.bindText(2, name);
-    
+
     if (!statement.executeCommand()) {
         LOG_ERROR("Unable to execute deletion of database %s from origin %s from tracker", name.ascii().data(), origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     {
         Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
         originQuotaManager().removeDatabase(origin, name);
     }
-    
+
     if (m_client) {
         m_client->dispatchDidModifyOrigin(origin);
         m_client->dispatchDidModifyDatabase(origin, name);
@@ -762,7 +762,7 @@ void DatabaseTracker::scheduleNotifyDatabaseChanged(SecurityOrigin* origin, cons
 {
     MutexLocker locker(notificationMutex());
 
-    notificationQueue().append(pair<SecurityOrigin*, String>(origin, name.copy()));
+    notificationQueue().append(pair<SecurityOrigin*, String>(origin, name.crossThreadString()));
     scheduleForNotification();
 }
 
diff --git a/WebCore/storage/DatabaseTracker.h b/WebCore/storage/DatabaseTracker.h
index dc50965..2f6e06d 100644
--- a/WebCore/storage/DatabaseTracker.h
+++ b/WebCore/storage/DatabaseTracker.h
@@ -70,18 +70,18 @@ public:
     unsigned long long usageForOrigin(SecurityOrigin*);
     unsigned long long quotaForOrigin(SecurityOrigin*);
     void setQuota(SecurityOrigin*, unsigned long long);
-    
+
     void deleteAllDatabases();
     void deleteOrigin(SecurityOrigin*);
     void deleteDatabase(SecurityOrigin*, const String& name);
 
     void setClient(DatabaseTrackerClient*);
-    
+
     // From a secondary thread, must be thread safe with its data
     void scheduleNotifyDatabaseChanged(SecurityOrigin*, const String& name);
-    
+
     OriginQuotaManager& originQuotaManager();
-    
+
     static DatabaseTracker& tracker();
 
     bool hasEntryForOrigin(SecurityOrigin*);
@@ -93,12 +93,12 @@ private:
     void openTrackerDatabase(bool createIfDoesNotExist);
 
     String originPath(SecurityOrigin*) const;
-    
+
     bool hasEntryForDatabase(SecurityOrigin*, const String& databaseIdentifier);
-    
+
     bool addDatabase(SecurityOrigin*, const String& name, const String& path);
     void populateOrigins();
-    
+
     bool deleteDatabaseFile(SecurityOrigin*, const String& name);
 
     SQLiteDatabase m_database;
@@ -117,7 +117,7 @@ private:
     OwnPtr<OriginQuotaManager> m_quotaManager;
 
     String m_databaseDirectoryPath;
-    
+
     DatabaseTrackerClient* m_client;
 
     std::pair<SecurityOrigin*, DatabaseDetails>* m_proposedDatabase;
diff --git a/WebCore/storage/LocalStorageTask.cpp b/WebCore/storage/LocalStorageTask.cpp
index f5d4890..12cc083 100644
--- a/WebCore/storage/LocalStorageTask.cpp
+++ b/WebCore/storage/LocalStorageTask.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -33,16 +33,18 @@
 
 namespace WebCore {
 
-LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<StorageAreaSync> area)
+LocalStorageTask::LocalStorageTask(Type type, StorageAreaSync* area)
     : m_type(type)
     , m_area(area)
+    , m_thread(0)
 {
     ASSERT(m_area);
     ASSERT(m_type == AreaImport || m_type == AreaSync);
 }
 
-LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<LocalStorageThread> thread)
+LocalStorageTask::LocalStorageTask(Type type, LocalStorageThread* thread)
     : m_type(type)
+    , m_area(0)
     , m_thread(thread)
 {
     ASSERT(m_thread);
@@ -57,11 +59,9 @@ void LocalStorageTask::performTask()
 {
     switch (m_type) {
         case AreaImport:
-            ASSERT(m_area);
             m_area->performImport();
             break;
         case AreaSync:
-            ASSERT(m_area);
             m_area->performSync();
             break;
         case TerminateThread:
@@ -73,4 +73,3 @@ void LocalStorageTask::performTask()
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/LocalStorageTask.h b/WebCore/storage/LocalStorageTask.h
index b12a26b..f03d851 100644
--- a/WebCore/storage/LocalStorageTask.h
+++ b/WebCore/storage/LocalStorageTask.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef LocalStorageTask_h
@@ -44,19 +44,19 @@ namespace WebCore {
 
         ~LocalStorageTask();
 
-        static PassRefPtr<LocalStorageTask> createImport(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
-        static PassRefPtr<LocalStorageTask> createSync(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
-        static PassRefPtr<LocalStorageTask> createTerminate(PassRefPtr<LocalStorageThread> thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
+        static PassRefPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
+        static PassRefPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
+        static PassRefPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
 
         void performTask();
 
     private:
-        LocalStorageTask(Type, PassRefPtr<StorageAreaSync>);
-        LocalStorageTask(Type, PassRefPtr<LocalStorageThread>);
+        LocalStorageTask(Type, StorageAreaSync*);
+        LocalStorageTask(Type, LocalStorageThread*);
 
         Type m_type;
-        RefPtr<StorageAreaSync> m_area;
-        RefPtr<LocalStorageThread> m_thread;
+        StorageAreaSync* m_area;
+        LocalStorageThread* m_thread;
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/LocalStorageThread.cpp b/WebCore/storage/LocalStorageThread.cpp
index 2da5934..78640a9 100644
--- a/WebCore/storage/LocalStorageThread.cpp
+++ b/WebCore/storage/LocalStorageThread.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -86,13 +86,13 @@ void* LocalStorageThread::localStorageThread()
     return 0;
 }
 
-void LocalStorageThread::scheduleImport(PassRefPtr<StorageAreaSync> area)
+void LocalStorageThread::scheduleImport(StorageAreaSync* area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createImport(area));
 }
 
-void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
+void LocalStorageThread::scheduleSync(StorageAreaSync* area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createSync(area));
@@ -101,7 +101,7 @@ void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
 void LocalStorageThread::terminate()
 {
     ASSERT(isMainThread());
-    
+
     // Ideally we'd never be killing a thread that wasn't live, so ASSERT it.
     // But if we do in a release build, make sure to not wait on a condition that will never get signalled
     ASSERT(!m_queue.killed() && m_threadID);
@@ -109,9 +109,9 @@ void LocalStorageThread::terminate()
         return;
 
     MutexLocker locker(m_terminateLock);
-    
+
     m_queue.append(LocalStorageTask::createTerminate(this));
-    
+
     m_terminateCondition.wait(m_terminateLock);
 }
 
@@ -120,7 +120,7 @@ void LocalStorageThread::performTerminate()
     ASSERT(!isMainThread());
 
     m_queue.kill();
-        
+
     MutexLocker locker(m_terminateLock);
     m_terminateCondition.signal();
 }
@@ -128,4 +128,3 @@ void LocalStorageThread::performTerminate()
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/LocalStorageThread.h b/WebCore/storage/LocalStorageThread.h
index 3d58427..e9e2b58 100644
--- a/WebCore/storage/LocalStorageThread.h
+++ b/WebCore/storage/LocalStorageThread.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef LocalStorageThread_h
@@ -45,8 +45,8 @@ namespace WebCore {
 
         bool start();
 
-        void scheduleImport(PassRefPtr<StorageAreaSync>);
-        void scheduleSync(PassRefPtr<StorageAreaSync>);
+        void scheduleImport(StorageAreaSync*);
+        void scheduleSync(StorageAreaSync*);
 
         // Called from the main thread to synchronously shut down this thread
         void terminate();
@@ -64,7 +64,7 @@ namespace WebCore {
         RefPtr<LocalStorageThread> m_selfRef;
 
         MessageQueue<RefPtr<LocalStorageTask> > m_queue;
-        
+
         Mutex m_terminateLock;
         ThreadCondition m_terminateCondition;
     };
diff --git a/WebCore/storage/OriginQuotaManager.cpp b/WebCore/storage/OriginQuotaManager.cpp
index 2b98ab7..20bb34d 100644
--- a/WebCore/storage/OriginQuotaManager.cpp
+++ b/WebCore/storage/OriginQuotaManager.cpp
@@ -75,25 +75,25 @@ bool OriginQuotaManager::tracksOrigin(SecurityOrigin* origin) const
 void OriginQuotaManager::addDatabase(SecurityOrigin* origin, const String& databaseIdentifier, const String& fullPath)
 {
     ASSERT(m_usageRecordGuardLocked);
-    
+
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
-    
-    usageRecord->addDatabase(databaseIdentifier.copy(), fullPath.copy());
+
+    usageRecord->addDatabase(databaseIdentifier.threadsafeCopy(), fullPath.threadsafeCopy());
 }
 
 void OriginQuotaManager::removeDatabase(SecurityOrigin* origin, const String& databaseIdentifier)
 {
     ASSERT(m_usageRecordGuardLocked);
-    
-    if (OriginUsageRecord* usageRecord = m_usageMap.get(origin))    
+
+    if (OriginUsageRecord* usageRecord = m_usageMap.get(origin))
         usageRecord->removeDatabase(databaseIdentifier);
 }
 
 void OriginQuotaManager::removeOrigin(SecurityOrigin* origin)
 {
     ASSERT(m_usageRecordGuardLocked);
-    
+
     if (OriginUsageRecord* usageRecord = m_usageMap.get(origin)) {
         m_usageMap.remove(origin);
         delete usageRecord;
@@ -107,21 +107,20 @@ void OriginQuotaManager::markDatabase(Database* database)
     RefPtr<SecurityOrigin> origin = database->securityOriginCopy();
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
-    
+
     usageRecord->markDatabase(database->stringIdentifier());
 }
 
 unsigned long long OriginQuotaManager::diskUsage(SecurityOrigin* origin) const
 {
     ASSERT(m_usageRecordGuardLocked);
-    
+
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
-    
+
     return usageRecord->diskUsage();
 }
 
-
 }
 
 #endif // ENABLE(DATABASE)
diff --git a/WebCore/storage/OriginUsageRecord.cpp b/WebCore/storage/OriginUsageRecord.cpp
index 5f4957f..684df53 100644
--- a/WebCore/storage/OriginUsageRecord.cpp
+++ b/WebCore/storage/OriginUsageRecord.cpp
@@ -44,10 +44,10 @@ void OriginUsageRecord::addDatabase(const String& identifier, const String& full
     ASSERT(!m_databaseMap.contains(identifier));
     ASSERT_ARG(identifier, identifier.impl()->refCount() == 1);
     ASSERT_ARG(fullPath, fullPath.impl()->refCount() == 1);
-    
+
     m_databaseMap.set(identifier, DatabaseEntry(fullPath));
     m_unknownSet.add(identifier);
-     
+
     m_cachedDiskUsageIsValid = false;
 }
 
@@ -81,13 +81,13 @@ unsigned long long OriginUsageRecord::diskUsage()
     for (; iUnknown != endUnknown; ++iUnknown) {
         const String& path = m_databaseMap.get(*iUnknown).filename;
         ASSERT(!path.isEmpty());
-                
+
         // When we can't determine the file size, we'll just have to assume the file is missing/inaccessible.
         long long size = SQLiteFileSystem::getDatabaseFileSize(path);
         m_databaseMap.set(*iUnknown, DatabaseEntry(path, size));
     }
     m_unknownSet.clear();
-    
+
     // Recalculate the cached usage value.
     m_cachedDiskUsage = 0;
     HashMap<String, DatabaseEntry>::iterator iDatabase = m_databaseMap.begin();
@@ -98,7 +98,7 @@ unsigned long long OriginUsageRecord::diskUsage()
     m_cachedDiskUsageIsValid = true;
     return m_cachedDiskUsage;
 }
-    
+
 }
 
 #endif
diff --git a/WebCore/storage/OriginUsageRecord.h b/WebCore/storage/OriginUsageRecord.h
index 3442ae1..609a793 100644
--- a/WebCore/storage/OriginUsageRecord.h
+++ b/WebCore/storage/OriginUsageRecord.h
@@ -68,4 +68,4 @@ private:
 
 #endif
 
-#endif 
+#endif
diff --git a/WebCore/storage/SQLError.h b/WebCore/storage/SQLError.h
index b6ebb5c..4414e6b 100644
--- a/WebCore/storage/SQLError.h
+++ b/WebCore/storage/SQLError.h
@@ -41,10 +41,10 @@ public:
     static PassRefPtr<SQLError> create(unsigned code, const String& message) { return adoptRef(new SQLError(code, message)); }
 
     unsigned code() const { return m_code; }
-    String message() const { return m_message.copy(); }
-    
+    String message() const { return m_message.threadsafeCopy(); }
+
 private:
-    SQLError(unsigned code, const String& message) : m_code(code), m_message(message.copy()) { }
+    SQLError(unsigned code, const String& message) : m_code(code), m_message(message.threadsafeCopy()) { }
     unsigned m_code;
     String m_message;
 };
diff --git a/WebCore/storage/SQLResultSetRowList.h b/WebCore/storage/SQLResultSetRowList.h
index 96a6aa1..92b5ec0 100644
--- a/WebCore/storage/SQLResultSetRowList.h
+++ b/WebCore/storage/SQLResultSetRowList.h
@@ -39,7 +39,7 @@ namespace WebCore {
 class SQLResultSetRowList : public RefCounted<SQLResultSetRowList> {
 public:
     static PassRefPtr<SQLResultSetRowList> create() { return adoptRef(new SQLResultSetRowList); }
-    
+
     const Vector<String>& columnNames() const { return m_columns; }
     const Vector<SQLValue>& values() const { return m_result; }
 
@@ -50,7 +50,7 @@ public:
 
 private:
     SQLResultSetRowList() { }
-    
+
     Vector<String> m_columns;
     Vector<SQLValue> m_result;
 };
diff --git a/WebCore/storage/SQLStatement.cpp b/WebCore/storage/SQLStatement.cpp
index 38ca75d..b4eb9ef 100644
--- a/WebCore/storage/SQLStatement.cpp
+++ b/WebCore/storage/SQLStatement.cpp
@@ -50,31 +50,31 @@ PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vec
 }
 
 SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly)
-    : m_statement(statement.copy())
+    : m_statement(statement.crossThreadString())
     , m_arguments(arguments)
     , m_statementCallback(callback)
     , m_statementErrorCallback(errorCallback)
     , m_readOnly(readOnly)
 {
 }
-   
+
 bool SQLStatement::execute(Database* db)
 {
     ASSERT(!m_resultSet);
-        
+
     // If we're re-running this statement after a quota violation, we need to clear that error now
     clearFailureDueToQuota();
 
-    // This transaction might have been marked bad while it was being set up on the main thread, 
+    // This transaction might have been marked bad while it was being set up on the main thread,
     // so if there is still an error, return false.
     if (m_error)
         return false;
-        
+
     if (m_readOnly)
         db->setAuthorizerReadOnly();
-    
+
     SQLiteDatabase* database = &db->m_sqliteDatabase;
-    
+
     SQLiteStatement statement(*database, m_statement);
     int result = statement.prepare();
 
@@ -98,7 +98,7 @@ bool SQLStatement::execute(Database* db)
             setFailureDueToQuota();
             return false;
         }
-        
+
         if (result != SQLResultOk) {
             LOG(StorageAPI, "Failed to bind value index %i to statement for query '%s'", i + 1, m_statement.ascii().data());
             m_error = SQLError::create(1, database->lastErrorMsg());
@@ -165,9 +165,9 @@ void SQLStatement::setVersionMismatchedError()
 bool SQLStatement::performCallback(SQLTransaction* transaction)
 {
     ASSERT(transaction);
-    
+
     bool callbackError = false;
-    
+
     // Call the appropriate statement callback and track if it resulted in an error,
     // because then we need to jump to the transaction error callback.
     if (m_error) {
@@ -195,9 +195,9 @@ void SQLStatement::clearFailureDueToQuota()
         m_error = 0;
 }
 
-bool SQLStatement::lastExecutionFailedDueToQuota() const 
-{ 
-    return m_error && m_error->code() == 4; 
+bool SQLStatement::lastExecutionFailedDueToQuota() const
+{
+    return m_error && m_error->code() == 4;
 }
 
 } // namespace WebCore
diff --git a/WebCore/storage/SQLStatement.h b/WebCore/storage/SQLStatement.h
index 831aecc..f01f7bf 100644
--- a/WebCore/storage/SQLStatement.h
+++ b/WebCore/storage/SQLStatement.h
@@ -52,10 +52,10 @@ class String;
 class SQLStatement : public ThreadSafeShared<SQLStatement> {
 public:
     static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, bool readOnly);
-    
+
     bool execute(Database*);
     bool lastExecutionFailedDueToQuota() const;
-    
+
     bool hasStatementCallback() const { return m_statementCallback; }
     bool hasStatementErrorCallback() const { return m_statementErrorCallback; }
 
@@ -63,22 +63,22 @@ public:
     void setVersionMismatchedError();
 
     bool performCallback(SQLTransaction*);
-    
+
     SQLError* sqlError() const { return m_error.get(); }
 private:
     SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly);
 
     void setFailureDueToQuota();
     void clearFailureDueToQuota();
-    
+
     String m_statement;
     Vector<SQLValue> m_arguments;
     RefPtr<SQLStatementCallback> m_statementCallback;
     RefPtr<SQLStatementErrorCallback> m_statementErrorCallback;
-    
+
     RefPtr<SQLError> m_error;
     RefPtr<SQLResultSet> m_resultSet;
-    
+
     bool m_readOnly;
 };
 
diff --git a/WebCore/storage/SQLStatementCallback.h b/WebCore/storage/SQLStatementCallback.h
index 14d19bb..31f5c0c 100644
--- a/WebCore/storage/SQLStatementCallback.h
+++ b/WebCore/storage/SQLStatementCallback.h
@@ -36,7 +36,7 @@ namespace WebCore {
 
 class SQLTransaction;
 class SQLResultSet;
-    
+
 class SQLStatementCallback : public ThreadSafeShared<SQLStatementCallback> {
 public:
     virtual ~SQLStatementCallback() { }
diff --git a/WebCore/storage/SQLStatementErrorCallback.h b/WebCore/storage/SQLStatementErrorCallback.h
index ef0c328..29127ce 100644
--- a/WebCore/storage/SQLStatementErrorCallback.h
+++ b/WebCore/storage/SQLStatementErrorCallback.h
@@ -37,7 +37,7 @@ namespace WebCore {
 
 class SQLTransaction;
 class SQLError;
-    
+
 class SQLStatementErrorCallback : public ThreadSafeShared<SQLStatementErrorCallback> {
 public:
     virtual ~SQLStatementErrorCallback() { }
diff --git a/WebCore/storage/SQLTransaction.cpp b/WebCore/storage/SQLTransaction.cpp
index 3331e6e..149b384 100644
--- a/WebCore/storage/SQLTransaction.cpp
+++ b/WebCore/storage/SQLTransaction.cpp
@@ -35,11 +35,9 @@
 #include "Database.h"
 #include "DatabaseAuthorizer.h"
 #include "DatabaseDetails.h"
-#include "DatabaseTracker.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Logging.h"
-#include "OriginQuotaManager.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
@@ -50,24 +48,26 @@
 #include "SQLStatement.h"
 #include "SQLStatementCallback.h"
 #include "SQLStatementErrorCallback.h"
+#include "SQLTransactionClient.h"
+#include "SQLTransactionCoordinator.h"
 #include "SQLValue.h"
 
-// There's no way of knowing exactly how much more space will be required when a statement hits the quota limit.  
+// There's no way of knowing exactly how much more space will be required when a statement hits the quota limit.
 // For now, we'll arbitrarily choose currentQuota + 1mb.
 // In the future we decide to track if a size increase wasn't enough, and ask for larger-and-larger increases until its enough.
 static const int DefaultQuotaSizeIncrease = 1048576;
 
 namespace WebCore {
 
-PassRefPtr<SQLTransaction> SQLTransaction::create(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, 
-                                           PassRefPtr<VoidCallback> successCallback, PassRefPtr<SQLTransactionWrapper> wrapper)
+PassRefPtr<SQLTransaction> SQLTransaction::create(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
+                                                  PassRefPtr<VoidCallback> successCallback, PassRefPtr<SQLTransactionWrapper> wrapper, bool readOnly)
 {
-    return adoptRef(new SQLTransaction(db, callback, errorCallback, successCallback, wrapper));
+    return adoptRef(new SQLTransaction(db, callback, errorCallback, successCallback, wrapper, readOnly));
 }
 
-SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, PassRefPtr<VoidCallback> successCallback, 
-                               PassRefPtr<SQLTransactionWrapper> wrapper)
-    : m_nextStep(&SQLTransaction::openTransactionAndPreflight)
+SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, PassRefPtr<VoidCallback> successCallback,
+                               PassRefPtr<SQLTransactionWrapper> wrapper, bool readOnly)
+    : m_nextStep(&SQLTransaction::acquireLock)
     , m_executeSqlAllowed(false)
     , m_database(db)
     , m_wrapper(wrapper)
@@ -76,6 +76,8 @@ SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback>
     , m_errorCallback(errorCallback)
     , m_shouldRetryCurrentStatement(false)
     , m_modifiedDatabase(false)
+    , m_lockAcquired(false)
+    , m_readOnly(readOnly)
 {
     ASSERT(m_database);
 }
@@ -91,11 +93,13 @@ void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValu
         return;
     }
 
-    bool readOnlyMode = false;
-    Page* page = m_database->document()->page();
-    if (!page || page->settings()->privateBrowsingEnabled())
-        readOnlyMode = true;
-    
+    bool readOnlyMode = m_readOnly;
+    if (!readOnlyMode) {
+        Page* page = m_database->document()->page();
+        if (!page || page->settings()->privateBrowsingEnabled())
+            readOnlyMode = true;
+    }
+
     RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement, arguments, callback, callbackError, readOnlyMode);
 
     if (m_database->deleted())
@@ -116,7 +120,9 @@ void SQLTransaction::enqueueStatement(PassRefPtr<SQLStatement> statement)
 #ifndef NDEBUG
 const char* SQLTransaction::debugStepName(SQLTransaction::TransactionStepMethod step)
 {
-    if (step == &SQLTransaction::openTransactionAndPreflight)
+    if (step == &SQLTransaction::acquireLock)
+        return "acquireLock";
+    else if (step == &SQLTransaction::openTransactionAndPreflight)
         return "openTransactionAndPreflight";
     else if (step == &SQLTransaction::runStatements)
         return "runStatements";
@@ -145,18 +151,21 @@ void SQLTransaction::checkAndHandleClosedDatabase()
 {
     if (!m_database->stopped())
         return;
-        
+
     // If the database was stopped, don't do anything and cancel queued work
     LOG(StorageAPI, "Database was stopped - cancelling work for this transaction");
     MutexLocker locker(m_statementMutex);
     m_statementQueue.clear();
     m_nextStep = 0;
-    
+
     // The current SQLite transaction should be stopped, as well
     if (m_sqliteTransaction) {
         m_sqliteTransaction->stop();
         m_sqliteTransaction.clear();
     }
+
+    if (m_lockAcquired)
+        m_database->transactionCoordinator()->releaseLock(this);
 }
 
 
@@ -164,14 +173,15 @@ bool SQLTransaction::performNextStep()
 {
     LOG(StorageAPI, "Step %s\n", debugStepName(m_nextStep));
 
-    ASSERT(m_nextStep == &SQLTransaction::openTransactionAndPreflight ||
+    ASSERT(m_nextStep == &SQLTransaction::acquireLock ||
+           m_nextStep == &SQLTransaction::openTransactionAndPreflight ||
            m_nextStep == &SQLTransaction::runStatements ||
            m_nextStep == &SQLTransaction::postflightAndCommit ||
            m_nextStep == &SQLTransaction::cleanupAfterSuccessCallback ||
            m_nextStep == &SQLTransaction::cleanupAfterTransactionErrorCallback);
-    
+
     checkAndHandleClosedDatabase();
-    
+
     if (m_nextStep)
         (this->*m_nextStep)();
 
@@ -190,14 +200,28 @@ void SQLTransaction::performPendingCallback()
            m_nextStep == &SQLTransaction::deliverSuccessCallback);
 
     checkAndHandleClosedDatabase();
-    
+
     if (m_nextStep)
         (this->*m_nextStep)();
 }
 
+void SQLTransaction::acquireLock()
+{
+    m_database->transactionCoordinator()->acquireLock(this);
+}
+
+void SQLTransaction::lockAcquired()
+{
+    m_lockAcquired = true;
+    m_nextStep = &SQLTransaction::openTransactionAndPreflight;
+    LOG(StorageAPI, "Scheduling openTransactionAndPreflight immediately for transaction %p\n", this);
+    m_database->scheduleTransactionStep(this, true);
+}
+
 void SQLTransaction::openTransactionAndPreflight()
 {
     ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
+    ASSERT(m_lockAcquired);
 
     LOG(StorageAPI, "Opening and preflighting transaction %p", this);
 
@@ -208,16 +232,17 @@ void SQLTransaction::openTransactionAndPreflight()
         return;
     }
 
-    // Set the maximum usage for this transaction
-    m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
-    
+    // Set the maximum usage for this transaction if this transactions is not read-only
+    if (!m_readOnly)
+        m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
+
     ASSERT(!m_sqliteTransaction);
-    m_sqliteTransaction.set(new SQLiteTransaction(m_database->m_sqliteDatabase));
-    
+    m_sqliteTransaction.set(new SQLiteTransaction(m_database->m_sqliteDatabase, m_readOnly));
+
     m_database->m_databaseAuthorizer->disable();
     m_sqliteTransaction->begin();
-    m_database->m_databaseAuthorizer->enable();    
-    
+    m_database->m_databaseAuthorizer->enable();
+
     // Transaction Steps 1+2 - Open a transaction to the database, jumping to the error callback if that fails
     if (!m_sqliteTransaction->inProgress()) {
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
@@ -226,7 +251,7 @@ void SQLTransaction::openTransactionAndPreflight()
         handleTransactionError(false);
         return;
     }
-    
+
     // Transaction Steps 3 - Peform preflight steps, jumping to the error callback if they fail
     if (m_wrapper && !m_wrapper->performPreflight(this)) {
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
@@ -238,7 +263,7 @@ void SQLTransaction::openTransactionAndPreflight()
         handleTransactionError(false);
         return;
     }
-    
+
     // Transaction Step 4 - Invoke the transaction callback with the new SQLTransaction object
     m_nextStep = &SQLTransaction::deliverTransactionCallback;
     LOG(StorageAPI, "Scheduling deliverTransactionCallback for transaction %p\n", this);
@@ -273,6 +298,8 @@ void SQLTransaction::scheduleToRunStatements()
 
 void SQLTransaction::runStatements()
 {
+    ASSERT(m_lockAcquired);
+
     // If there is a series of statements queued up that are all successful and have no associated
     // SQLStatementCallback objects, then we can burn through the queue
     do {
@@ -280,8 +307,11 @@ void SQLTransaction::runStatements()
             m_shouldRetryCurrentStatement = false;
             // FIXME - Another place that needs fixing up after <rdar://problem/5628468> is addressed.
             // See ::openTransactionAndPreflight() for discussion
-            
-            // Reset the maximum size here, as it was increased to allow us to retry this statement
+
+            // Reset the maximum size here, as it was increased to allow us to retry this statement.
+            // m_shouldRetryCurrentStatement is set to true only when a statement exceeds
+            // the quota, which can happen only in a read-write transaction. Therefore, there
+            // is no need to check here if the transaction is read-write.
             m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
         } else {
             // If the current statement has already been run, failed due to quota constraints, and we're not retrying it,
@@ -290,14 +320,14 @@ void SQLTransaction::runStatements()
                 handleCurrentStatementError();
                 break;
             }
-            
+
             // Otherwise, advance to the next statement
             getNextStatement();
         }
     } while (runCurrentStatement());
-    
+
     // If runCurrentStatement() returned false, that means either there was no current statement to run,
-    // or the current statement requires a callback to complete.  In the later case, it also scheduled 
+    // or the current statement requires a callback to complete.  In the later case, it also scheduled
     // the callback or performed any other additional work so we can return
     if (!m_currentStatement)
         postflightAndCommit();
@@ -306,7 +336,7 @@ void SQLTransaction::runStatements()
 void SQLTransaction::getNextStatement()
 {
     m_currentStatement = 0;
-    
+
     MutexLocker locker(m_statementMutex);
     if (!m_statementQueue.isEmpty()) {
         m_currentStatement = m_statementQueue.first();
@@ -318,20 +348,17 @@ bool SQLTransaction::runCurrentStatement()
 {
     if (!m_currentStatement)
         return false;
-        
+
     m_database->m_databaseAuthorizer->reset();
-    
+
     if (m_currentStatement->execute(m_database.get())) {
         if (m_database->m_databaseAuthorizer->lastActionChangedDatabase()) {
             // Flag this transaction as having changed the database for later delegate notification
             m_modifiedDatabase = true;
             // Also dirty the size of this database file for calculating quota usage
-            OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
-            Locker<OriginQuotaManager> locker(manager);
-            
-            manager.markDatabase(m_database.get());
+            m_database->transactionClient()->didExecuteStatement(this);
         }
-            
+
         if (m_currentStatement->hasStatementCallback()) {
             m_nextStep = &SQLTransaction::deliverStatementCallback;
             LOG(StorageAPI, "Scheduling deliverStatementCallback for transaction %p\n", this);
@@ -340,16 +367,16 @@ bool SQLTransaction::runCurrentStatement()
         }
         return true;
     }
-    
+
     if (m_currentStatement->lastExecutionFailedDueToQuota()) {
         m_nextStep = &SQLTransaction::deliverQuotaIncreaseCallback;
         LOG(StorageAPI, "Scheduling deliverQuotaIncreaseCallback for transaction %p\n", this);
         m_database->scheduleTransactionCallback(this);
         return false;
     }
-    
+
     handleCurrentStatementError();
-    
+
     return false;
 }
 
@@ -372,7 +399,7 @@ void SQLTransaction::handleCurrentStatementError()
 void SQLTransaction::deliverStatementCallback()
 {
     ASSERT(m_currentStatement);
-    
+
     // Transaction Step 6.6 and 6.3(error) - If the statement callback went wrong, jump to the transaction error callback
     // Otherwise, continue to loop through the statement queue
     m_executeSqlAllowed = true;
@@ -390,27 +417,18 @@ void SQLTransaction::deliverQuotaIncreaseCallback()
 {
     ASSERT(m_currentStatement);
     ASSERT(!m_shouldRetryCurrentStatement);
-    
-    Page* page = m_database->document()->page();
-    ASSERT(page);
-    
-    RefPtr<SecurityOrigin> origin = m_database->securityOriginCopy();
-    
-    unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
-    page->chrome()->client()->exceededDatabaseQuota(m_database->document()->frame(), m_database->stringIdentifier());
-    unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
-    
-    // If the new quota ended up being larger than the old quota, we will retry the statement.
-    if (newQuota > currentQuota)
-        m_shouldRetryCurrentStatement = true;
-        
+
+    m_shouldRetryCurrentStatement = m_database->transactionClient()->didExceedQuota(this);
+
     m_nextStep = &SQLTransaction::runStatements;
     LOG(StorageAPI, "Scheduling runStatements for transaction %p\n", this);
     m_database->scheduleTransactionStep(this);
 }
 
 void SQLTransaction::postflightAndCommit()
-{    
+{
+    ASSERT(m_lockAcquired);
+
     // Transaction Step 7 - Peform postflight steps, jumping to the error callback if they fail
     if (m_wrapper && !m_wrapper->performPostflight(this)) {
         m_transactionError = m_wrapper->sqlError();
@@ -419,10 +437,10 @@ void SQLTransaction::postflightAndCommit()
         handleTransactionError(false);
         return;
     }
-    
+
     // Transacton Step 8+9 - Commit the transaction, jumping to the error callback if that fails
     ASSERT(m_sqliteTransaction);
-    
+
     m_database->m_databaseAuthorizer->disable();
     m_sqliteTransaction->commit();
     m_database->m_databaseAuthorizer->enable();
@@ -433,21 +451,21 @@ void SQLTransaction::postflightAndCommit()
         handleTransactionError(false);
         return;
     }
-    
+
     // The commit was successful, notify the delegates if the transaction modified this database
     if (m_modifiedDatabase)
-        DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(m_database->m_securityOrigin.get(), m_database->m_name);
-    
+        m_database->transactionClient()->didCommitTransaction(this);
+
     // Now release our unneeded callbacks, to break reference cycles.
     m_callback = 0;
     m_errorCallback = 0;
-    
+
     // Transaction Step 10 - Deliver success callback, if there is one
     if (m_successCallback) {
         m_nextStep = &SQLTransaction::deliverSuccessCallback;
         LOG(StorageAPI, "Scheduling deliverSuccessCallback for transaction %p\n", this);
         m_database->scheduleTransactionCallback(this);
-    } else 
+    } else
         cleanupAfterSuccessCallback();
 }
 
@@ -456,7 +474,7 @@ void SQLTransaction::deliverSuccessCallback()
     // Transaction Step 10 - Deliver success callback
     ASSERT(m_successCallback);
     m_successCallback->handleEvent();
-    
+
     // Release the last callback to break reference cycle
     m_successCallback = 0;
 
@@ -469,11 +487,16 @@ void SQLTransaction::deliverSuccessCallback()
 
 void SQLTransaction::cleanupAfterSuccessCallback()
 {
+    ASSERT(m_lockAcquired);
+
     // Transaction Step 11 - End transaction steps
     // There is no next step
     LOG(StorageAPI, "Transaction %p is complete\n", this);
     ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
     m_nextStep = 0;
+
+    // Release the lock on this database
+    m_database->transactionCoordinator()->releaseLock(this);
 }
 
 void SQLTransaction::handleTransactionError(bool inCallback)
@@ -488,7 +511,7 @@ void SQLTransaction::handleTransactionError(bool inCallback)
         }
         return;
     }
-    
+
     // No error callback, so fast-forward to:
     // Transaction Step 12 - Rollback the transaction.
     if (inCallback) {
@@ -503,7 +526,7 @@ void SQLTransaction::handleTransactionError(bool inCallback)
 void SQLTransaction::deliverTransactionErrorCallback()
 {
     ASSERT(m_transactionError);
-    
+
     // Transaction Step 12 - If exists, invoke error callback with the last
     // error to have occurred in this transaction.
     if (m_errorCallback)
@@ -516,22 +539,24 @@ void SQLTransaction::deliverTransactionErrorCallback()
 
 void SQLTransaction::cleanupAfterTransactionErrorCallback()
 {
+    ASSERT(m_lockAcquired);
+
     m_database->m_databaseAuthorizer->disable();
     if (m_sqliteTransaction) {
         // Transaction Step 12 - Rollback the transaction.
         m_sqliteTransaction->rollback();
-        
+
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
         m_sqliteTransaction.clear();
     }
     m_database->m_databaseAuthorizer->enable();
-    
+
     // Transaction Step 12 - Any still-pending statements in the transaction are discarded.
     {
         MutexLocker locker(m_statementMutex);
         m_statementQueue.clear();
     }
-    
+
     // Transaction is complete!  There is no next step
     LOG(StorageAPI, "Transaction %p is complete with an error\n", this);
     ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
@@ -540,6 +565,9 @@ void SQLTransaction::cleanupAfterTransactionErrorCallback()
     // Now release our callbacks, to break reference cycles.
     m_callback = 0;
     m_errorCallback = 0;
+
+    // Now release the lock on this database
+    m_database->transactionCoordinator()->releaseLock(this);
 }
 
 } // namespace WebCore
diff --git a/WebCore/storage/SQLTransaction.h b/WebCore/storage/SQLTransaction.h
index e77c183..6d6a8d7 100644
--- a/WebCore/storage/SQLTransaction.h
+++ b/WebCore/storage/SQLTransaction.h
@@ -60,34 +60,39 @@ public:
     virtual ~SQLTransactionWrapper() { }
     virtual bool performPreflight(SQLTransaction*) = 0;
     virtual bool performPostflight(SQLTransaction*) = 0;
-    
+
     virtual SQLError* sqlError() const = 0;
 };
 
 class SQLTransaction : public ThreadSafeShared<SQLTransaction> {
 public:
-    static PassRefPtr<SQLTransaction> create(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>, PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>);
+    static PassRefPtr<SQLTransaction> create(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
+                                             PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>, bool readOnly = false);
 
     ~SQLTransaction();
-    
-    void executeSQL(const String& sqlStatement, const Vector<SQLValue>& arguments, 
+
+    void executeSQL(const String& sqlStatement, const Vector<SQLValue>& arguments,
                     PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> callbackError, ExceptionCode& e);
-                                        
+
+    void lockAcquired();
     bool performNextStep();
     void performPendingCallback();
-    
+
     Database* database() { return m_database.get(); }
+    bool isReadOnly() { return m_readOnly; }
 
 private:
-    SQLTransaction(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>, PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>);
+    SQLTransaction(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
+                   PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>, bool readOnly);
 
     typedef void (SQLTransaction::*TransactionStepMethod)();
     TransactionStepMethod m_nextStep;
-    
+
     void enqueueStatement(PassRefPtr<SQLStatement>);
-    
+
     void checkAndHandleClosedDatabase();
-    
+
+    void acquireLock();
     void openTransactionAndPreflight();
     void deliverTransactionCallback();
     void scheduleToRunStatements();
@@ -109,9 +114,9 @@ private:
 #endif
 
     RefPtr<SQLStatement> m_currentStatement;
-    
+
     bool m_executeSqlAllowed;
-    
+
     RefPtr<Database> m_database;
     RefPtr<SQLTransactionWrapper> m_wrapper;
     RefPtr<SQLTransactionCallback> m_callback;
@@ -120,13 +125,15 @@ private:
     RefPtr<SQLError> m_transactionError;
     bool m_shouldRetryCurrentStatement;
     bool m_modifiedDatabase;
-    
+    bool m_lockAcquired;
+    bool m_readOnly;
+
     Mutex m_statementMutex;
     Deque<RefPtr<SQLStatement> > m_statementQueue;
 
     OwnPtr<SQLiteTransaction> m_sqliteTransaction;
 };
-    
+
 } // namespace WebCore
 
 #endif
diff --git a/WebCore/storage/SQLTransactionCallback.h b/WebCore/storage/SQLTransactionCallback.h
index a4cd940..de3e85dc 100644
--- a/WebCore/storage/SQLTransactionCallback.h
+++ b/WebCore/storage/SQLTransactionCallback.h
@@ -37,7 +37,7 @@ namespace WebCore {
 
 class SQLTransaction;
 class SQLError;
-    
+
 class SQLTransactionCallback : public ThreadSafeShared<SQLTransactionCallback> {
 public:
     virtual ~SQLTransactionCallback() { }
diff --git a/WebCore/storage/SQLTransactionClient.cpp b/WebCore/storage/SQLTransactionClient.cpp
new file mode 100644
index 0000000..e72f5ed
--- /dev/null
+++ b/WebCore/storage/SQLTransactionClient.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SQLTransactionClient.h"
+
+#include "ChromeClient.h"
+#include "Database.h"
+#include "DatabaseThread.h"
+#include "DatabaseTracker.h"
+#include "Document.h"
+#include "OriginQuotaManager.h"
+#include "Page.h"
+#include "SQLTransaction.h"
+
+namespace WebCore {
+
+void SQLTransactionClient::didCommitTransaction(SQLTransaction* transaction)
+{
+    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+    Database* database = transaction->database();
+    DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(
+        database->document()->securityOrigin(), database->stringIdentifier());
+}
+
+void SQLTransactionClient::didExecuteStatement(SQLTransaction* transaction)
+{
+    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+    OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
+    Locker<OriginQuotaManager> locker(manager);
+    manager.markDatabase(transaction->database());
+}
+
+bool SQLTransactionClient::didExceedQuota(SQLTransaction* transaction)
+{
+    ASSERT(isMainThread());
+    Database* database = transaction->database();
+    Page* page = database->document()->page();
+    ASSERT(page);
+
+    RefPtr<SecurityOrigin> origin = database->securityOriginCopy();
+
+    unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
+    page->chrome()->client()->exceededDatabaseQuota(database->document()->frame(), database->stringIdentifier());
+    unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
+    return (newQuota > currentQuota);
+}
+
+}
diff --git a/WebCore/storage/SQLTransactionClient.h b/WebCore/storage/SQLTransactionClient.h
new file mode 100644
index 0000000..941c163
--- /dev/null
+++ b/WebCore/storage/SQLTransactionClient.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SQLTransactionClient_h
+#define SQLTransactionClient_h
+
+namespace WebCore {
+
+    class SQLTransaction;
+
+    // A client to the SQLTransaction class. Allows SQLTransaction to notify interested
+    // parties that certain things have happened in a transaction.
+    class SQLTransactionClient {
+    public:
+        void didCommitTransaction(SQLTransaction*);
+        void didExecuteStatement(SQLTransaction*);
+        bool didExceedQuota(SQLTransaction*);
+    };
+}
+
+#endif // SQLTransactionClient_h
diff --git a/WebCore/storage/SQLTransactionCoordinator.cpp b/WebCore/storage/SQLTransactionCoordinator.cpp
new file mode 100644
index 0000000..30b0c4a
--- /dev/null
+++ b/WebCore/storage/SQLTransactionCoordinator.cpp
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SQLTransactionCoordinator.h"
+
+#include "CString.h"
+#include "Database.h"
+#include "SQLTransaction.h"
+#include <wtf/Deque.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+static String getDatabaseIdentifier(SQLTransaction* transaction)
+{
+    Database* database = transaction->database();
+    ASSERT(database);
+    return database->stringIdentifier();
+}
+
+void SQLTransactionCoordinator::processPendingTransactions(CoordinationInfo& info)
+{
+    if (info.activeWriteTransaction || info.pendingTransactions.isEmpty())
+        return;
+
+    RefPtr<SQLTransaction> firstPendingTransaction = info.pendingTransactions.first();
+    if (firstPendingTransaction->isReadOnly()) {
+        do {
+            firstPendingTransaction = info.pendingTransactions.first();
+            info.pendingTransactions.removeFirst();
+            info.activeReadTransactions.add(firstPendingTransaction);
+            firstPendingTransaction->lockAcquired();
+        } while (!info.pendingTransactions.isEmpty() && info.pendingTransactions.first()->isReadOnly());
+    } else if (info.activeReadTransactions.isEmpty()) {
+        info.pendingTransactions.removeFirst();
+        info.activeWriteTransaction = firstPendingTransaction;
+        firstPendingTransaction->lockAcquired();
+    }
+}
+
+void SQLTransactionCoordinator::acquireLock(SQLTransaction* transaction)
+{
+    String dbIdentifier = getDatabaseIdentifier(transaction);
+
+    CoordinationInfoMap::iterator coordinationInfoIterator = m_coordinationInfoMap.find(dbIdentifier);
+    if (coordinationInfoIterator == m_coordinationInfoMap.end()) {
+        // No pending transactions for this DB
+        coordinationInfoIterator = m_coordinationInfoMap.add(dbIdentifier, CoordinationInfo()).first;
+    }
+
+    CoordinationInfo& info = coordinationInfoIterator->second;
+    info.pendingTransactions.append(transaction);
+    processPendingTransactions(info);
+}
+
+void SQLTransactionCoordinator::releaseLock(SQLTransaction* transaction)
+{
+    if (m_coordinationInfoMap.isEmpty())
+        return;
+
+    String dbIdentifier = getDatabaseIdentifier(transaction);
+
+    CoordinationInfoMap::iterator coordinationInfoIterator = m_coordinationInfoMap.find(dbIdentifier);
+    ASSERT(coordinationInfoIterator != m_coordinationInfoMap.end());
+    CoordinationInfo& info = coordinationInfoIterator->second;
+
+    if (transaction->isReadOnly()) {
+        ASSERT(info.activeReadTransactions.contains(transaction));
+        info.activeReadTransactions.remove(transaction);
+    } else {
+        ASSERT(info.activeWriteTransaction == transaction);
+        info.activeWriteTransaction = 0;
+    }
+
+    processPendingTransactions(info);
+}
+
+void SQLTransactionCoordinator::shutdown()
+{
+    // Clean up all pending transactions for all databases
+    m_coordinationInfoMap.clear();
+}
+
+}
diff --git a/WebCore/storage/SQLTransactionCoordinator.h b/WebCore/storage/SQLTransactionCoordinator.h
new file mode 100644
index 0000000..20cc863
--- /dev/null
+++ b/WebCore/storage/SQLTransactionCoordinator.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SQLTransactionCoordinator_h
+#define SQLTransactionCoordinator_h
+
+#include "CString.h"
+#include "StringHash.h"
+#include <wtf/Deque.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class SQLTransaction;
+
+    class SQLTransactionCoordinator {
+    public:
+        void acquireLock(SQLTransaction*);
+        void releaseLock(SQLTransaction*);
+        void shutdown();
+    private:
+        typedef Deque<RefPtr<SQLTransaction> > TransactionsQueue;
+        struct CoordinationInfo {
+            TransactionsQueue pendingTransactions;
+            HashSet<RefPtr<SQLTransaction> > activeReadTransactions;
+            RefPtr<SQLTransaction> activeWriteTransaction;
+        };
+        // Maps database names to information about pending transactions
+        typedef HashMap<String, CoordinationInfo> CoordinationInfoMap;
+        CoordinationInfoMap m_coordinationInfoMap;
+
+        void processPendingTransactions(CoordinationInfo& info);
+    };
+}
+
+#endif // SQLTransactionCoordinator_h
diff --git a/WebCore/storage/SQLTransactionErrorCallback.h b/WebCore/storage/SQLTransactionErrorCallback.h
index 9dd3fd3..de99212 100644
--- a/WebCore/storage/SQLTransactionErrorCallback.h
+++ b/WebCore/storage/SQLTransactionErrorCallback.h
@@ -34,19 +34,17 @@
 #include <wtf/Threading.h>
 
 namespace WebCore {
-    
+
     class SQLError;
-    
+
     class SQLTransactionErrorCallback : public ThreadSafeShared<SQLTransactionErrorCallback> {
     public:
         virtual ~SQLTransactionErrorCallback() { }
         virtual void handleEvent(SQLError*) = 0;
     };
-    
+
 }
 
 #endif
 
 #endif // SQLTransactionErrorCallback_h
-
-
diff --git a/WebCore/storage/Storage.cpp b/WebCore/storage/Storage.cpp
index d5fc065..0a8eed7 100644
--- a/WebCore/storage/Storage.cpp
+++ b/WebCore/storage/Storage.cpp
@@ -20,9 +20,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
- 
+
 #include "config.h"
 #include "Storage.h"
 
@@ -111,4 +111,3 @@ bool Storage::contains(const String& key) const
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/Storage.h b/WebCore/storage/Storage.h
index d68e9bc..06cc97b 100644
--- a/WebCore/storage/Storage.h
+++ b/WebCore/storage/Storage.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef Storage_h
@@ -53,11 +53,12 @@ namespace WebCore {
 
         bool contains(const String& key) const;
 
+        Frame* frame() { return m_frame; }
         void disconnectFrame() { m_frame = 0; }
 
     private:
         Storage(Frame*, PassRefPtr<StorageArea>);
-            
+
         Frame* m_frame;
         RefPtr<StorageArea> m_storageArea;
     };
diff --git a/WebCore/storage/StorageArea.h b/WebCore/storage/StorageArea.h
index f74405a..a64d44a 100644
--- a/WebCore/storage/StorageArea.h
+++ b/WebCore/storage/StorageArea.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageArea_h
@@ -31,7 +31,7 @@
 #include "PlatformString.h"
 
 #include <wtf/PassRefPtr.h>
-#include <wtf/Threading.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -42,7 +42,7 @@ namespace WebCore {
     enum StorageType { LocalStorage, SessionStorage };
 
     // This interface is required for Chromium since these actions need to be proxied between processes.
-    class StorageArea : public ThreadSafeShared<StorageArea> {
+    class StorageArea : public RefCounted<StorageArea> {
     public:
         virtual ~StorageArea() { }
 
diff --git a/WebCore/storage/StorageAreaImpl.cpp b/WebCore/storage/StorageAreaImpl.cpp
index f53edd3..612cb5f 100644
--- a/WebCore/storage/StorageAreaImpl.cpp
+++ b/WebCore/storage/StorageAreaImpl.cpp
@@ -28,16 +28,11 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "DOMWindow.h"
-#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
-#include "Page.h"
-#include "PageGroup.h"
-#include "SecurityOrigin.h"
 #include "Settings.h"
-#include "StorageEvent.h"
 #include "StorageAreaSync.h"
+#include "StorageEventDispatcher.h"
 #include "StorageMap.h"
 #include "StorageSyncManager.h"
 
@@ -45,17 +40,24 @@ namespace WebCore {
 
 StorageAreaImpl::~StorageAreaImpl()
 {
+    ASSERT(isMainThread());
 }
 
-StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager)
+PassRefPtr<StorageAreaImpl> StorageAreaImpl::create(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager, unsigned quota)
+{
+    return adoptRef(new StorageAreaImpl(storageType, origin, syncManager, quota));
+}
+
+StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager, unsigned quota)
     : m_storageType(storageType)
     , m_securityOrigin(origin)
-    , m_storageMap(StorageMap::create())
+    , m_storageMap(StorageMap::create(quota))
     , m_storageSyncManager(syncManager)
 #ifndef NDEBUG
     , m_isShutdown(false)
 #endif
 {
+    ASSERT(isMainThread());
     ASSERT(m_securityOrigin);
     ASSERT(m_storageMap);
 
@@ -82,6 +84,7 @@ StorageAreaImpl::StorageAreaImpl(StorageAreaImpl* area)
     , m_isShutdown(area->m_isShutdown)
 #endif
 {
+    ASSERT(isMainThread());
     ASSERT(m_securityOrigin);
     ASSERT(m_storageMap);
     ASSERT(!m_isShutdown);
@@ -132,15 +135,14 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
         return;
     }
 
-    // FIXME: For LocalStorage where a disk quota will be enforced, here is where we need to do quota checking.
-    //        If we decide to enforce a memory quota for SessionStorage, this is where we'd do that, also.
-    // if (<over quota>) {
-    //     ec = QUOTA_EXCEEDED_ERR;
-    //     return;
-    // }
-
     String oldValue;
-    RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue);
+    bool quotaException;
+    RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue, quotaException);
+
+    if (quotaException) {
+        ec = QUOTA_EXCEEDED_ERR;
+        return;
+    }
 
     if (newMap)
         m_storageMap = newMap.release();
@@ -149,7 +151,7 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
     if (oldValue != value) {
         if (m_storageAreaSync)
             m_storageAreaSync->scheduleItemForSync(key, value);
-        dispatchStorageEvent(key, oldValue, value, frame);
+        StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
     }
 }
 
@@ -170,7 +172,7 @@ void StorageAreaImpl::removeItem(const String& key, Frame* frame)
     if (!oldValue.isNull()) {
         if (m_storageAreaSync)
             m_storageAreaSync->scheduleItemForSync(key, String());
-        dispatchStorageEvent(key, oldValue, String(), frame);
+        StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
     }
 }
 
@@ -182,11 +184,12 @@ void StorageAreaImpl::clear(Frame* frame)
     if (privateBrowsingEnabled(frame))
         return;
 
-    m_storageMap = StorageMap::create();
+    unsigned quota = m_storageMap->quota();
+    m_storageMap = StorageMap::create(quota);
 
     if (m_storageAreaSync)
         m_storageAreaSync->scheduleClear();
-    dispatchStorageEvent(String(), String(), String(), frame);
+    StorageEventDispatcher::dispatch(String(), String(), String(), m_storageType, m_securityOrigin.get(), frame);
 }
 
 bool StorageAreaImpl::contains(const String& key) const
@@ -224,46 +227,6 @@ void StorageAreaImpl::blockUntilImportComplete() const
         m_storageAreaSync->blockUntilImportComplete();
 }
 
-void StorageAreaImpl::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-#if PLATFORM(CHROMIUM)
-    // FIXME: Events are currently broken in Chromium.
-    return;
-#endif
-
-    Page* page = sourceFrame->page();
-    if (!page)
-        return;
-
-    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
-    // of any given page in the group or mutate the page group itself.
-    Vector<RefPtr<Frame> > frames;
-    if (m_storageType == SessionStorage) {
-        // Send events only to our page.
-        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (frame->document()->securityOrigin()->equal(securityOrigin()))
-                frames.append(frame);
-        }
-
-        for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
-    } else {
-        // Send events to every page.
-        const HashSet<Page*>& pages = page->group().pages();
-        HashSet<Page*>::const_iterator end = pages.end();
-        for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
-            for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-                if (frame->document()->securityOrigin()->equal(securityOrigin()))
-                    frames.append(frame);
-            }
-        }
-
-        for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
-    }
-}
-
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/StorageAreaImpl.h b/WebCore/storage/StorageAreaImpl.h
index ef93d98..fe21a45 100644
--- a/WebCore/storage/StorageAreaImpl.h
+++ b/WebCore/storage/StorageAreaImpl.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageAreaImpl_h
@@ -30,6 +30,7 @@
 
 #include "StorageArea.h"
 
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -40,7 +41,7 @@ namespace WebCore {
 
     class StorageAreaImpl : public StorageArea {
     public:
-        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>);
+        static PassRefPtr<StorageAreaImpl> create(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
         virtual ~StorageAreaImpl();
 
         // The HTML5 DOM Storage API (and contains)
@@ -60,12 +61,11 @@ namespace WebCore {
         SecurityOrigin* securityOrigin();
 
     private:
+        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
         StorageAreaImpl(StorageAreaImpl*);
 
         void blockUntilImportComplete() const;
 
-        void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-
         StorageType m_storageType;
         RefPtr<SecurityOrigin> m_securityOrigin;
         RefPtr<StorageMap> m_storageMap;
diff --git a/WebCore/storage/StorageAreaSync.cpp b/WebCore/storage/StorageAreaSync.cpp
index 01d2a65..ad41e28 100644
--- a/WebCore/storage/StorageAreaSync.cpp
+++ b/WebCore/storage/StorageAreaSync.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -57,6 +57,7 @@ StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManag
     , m_syncScheduled(false)
     , m_importComplete(false)
 {
+    ASSERT(isMainThread());
     ASSERT(m_storageArea);
     ASSERT(m_syncManager);
 
@@ -68,6 +69,7 @@ StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManag
 
 StorageAreaSync::~StorageAreaSync()
 {
+    ASSERT(isMainThread());
     ASSERT(!m_syncTimer.isActive());
 }
 
@@ -76,7 +78,7 @@ void StorageAreaSync::scheduleFinalSync()
     ASSERT(isMainThread());
     // FIXME: We do this to avoid races, but it'd be better to make things safe without blocking.
     blockUntilImportComplete();
-    
+
     if (m_syncTimer.isActive())
         m_syncTimer.stop();
     else {
@@ -127,7 +129,7 @@ void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
 
     HashMap<String, String>::iterator it = m_changedItems.begin();
     HashMap<String, String>::iterator end = m_changedItems.end();
-    
+
     {
         MutexLocker locker(m_syncLock);
 
@@ -138,7 +140,7 @@ void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
         }
 
         for (; it != end; ++it)
-            m_itemsPendingSync.set(it->first.copy(), it->second.copy());
+            m_itemsPendingSync.set(it->first.crossThreadString(), it->second.crossThreadString());
 
         if (!m_syncScheduled) {
             m_syncScheduled = true;
@@ -182,14 +184,14 @@ void StorageAreaSync::performImport()
         markImported();
         return;
     }
-    
+
     SQLiteStatement query(m_database, "SELECT key, value FROM ItemTable");
     if (query.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to select items from ItemTable for local storage");
         markImported();
         return;
     }
-    
+
     HashMap<String, String> itemMap;
 
     int result = query.step();
@@ -205,13 +207,13 @@ void StorageAreaSync::performImport()
     }
 
     MutexLocker locker(m_importLock);
-    
+
     HashMap<String, String>::iterator it = itemMap.begin();
     HashMap<String, String>::iterator end = itemMap.end();
-    
+
     for (; it != end; ++it)
         m_storageArea->importItem(it->first, it->second);
-    
+
     // Break the (ref count) cycle.
     m_storageArea = 0;
     m_importComplete = true;
@@ -265,7 +267,7 @@ void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items
             LOG_ERROR("Failed to prepare clear statement - cannot write to local storage database");
             return;
         }
-        
+
         int result = clear.step();
         if (result != SQLResultDone) {
             LOG_ERROR("Failed to clear all items in the local storage database - %i", result);
@@ -289,11 +291,11 @@ void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items
 
     for (HashMap<String, String>::const_iterator it = items.begin(); it != end; ++it) {
         // Based on the null-ness of the second argument, decide whether this is an insert or a delete.
-        SQLiteStatement& query = it->second.isNull() ? remove : insert;        
+        SQLiteStatement& query = it->second.isNull() ? remove : insert;
 
         query.bindText(1, it->first);
 
-        // If the second argument is non-null, we're doing an insert, so bind it as the value. 
+        // If the second argument is non-null, we're doing an insert, so bind it as the value.
         if (!it->second.isNull())
             query.bindText(2, it->second);
 
@@ -335,4 +337,3 @@ void StorageAreaSync::performSync()
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/StorageAreaSync.h b/WebCore/storage/StorageAreaSync.h
index e436bef..9d6436f 100644
--- a/WebCore/storage/StorageAreaSync.h
+++ b/WebCore/storage/StorageAreaSync.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageAreaSync_h
@@ -39,7 +39,7 @@ namespace WebCore {
     class Frame;
     class StorageAreaImpl;
     class StorageSyncManager;
-    
+
     class StorageAreaSync : public RefCounted<StorageAreaSync> {
     public:
         static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
@@ -50,16 +50,16 @@ namespace WebCore {
 
         void scheduleItemForSync(const String& key, const String& value);
         void scheduleClear();
-        
+
     private:
         StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
 
         void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
 
-        Timer<StorageAreaSync> m_syncTimer;        
+        Timer<StorageAreaSync> m_syncTimer;
         HashMap<String, String> m_changedItems;
         bool m_itemsCleared;
-        
+
         bool m_finalSyncScheduled;
 
         RefPtr<StorageAreaImpl> m_storageArea;
diff --git a/WebCore/storage/StorageEvent.cpp b/WebCore/storage/StorageEvent.cpp
index 2e620d5..f3b3b70 100644
--- a/WebCore/storage/StorageEvent.cpp
+++ b/WebCore/storage/StorageEvent.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -76,4 +76,3 @@ void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bo
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/StorageEvent.h b/WebCore/storage/StorageEvent.h
index 703fb5a..7e2bcff 100644
--- a/WebCore/storage/StorageEvent.h
+++ b/WebCore/storage/StorageEvent.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageEvent_h
@@ -55,16 +55,16 @@ namespace WebCore {
 
         virtual bool isStorageEvent() const { return true; }
 
-    private:    
+    private:
         StorageEvent();
         StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
-        
+
         String m_key;
         String m_oldValue;
         String m_newValue;
         String m_uri;
         RefPtr<DOMWindow> m_source;
-        RefPtr<Storage> m_storageArea;        
+        RefPtr<Storage> m_storageArea;
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageEventDispatcher.cpp b/WebCore/storage/StorageEventDispatcher.cpp
new file mode 100644
index 0000000..496ff6d
--- /dev/null
+++ b/WebCore/storage/StorageEventDispatcher.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageEventDispatcher.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "DOMWindow.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "SecurityOrigin.h"
+#include "StorageEvent.h"
+
+namespace WebCore {
+
+void StorageEventDispatcher::dispatch(const String& key, const String& oldValue, const String& newValue, StorageType storageType, SecurityOrigin* securityOrigin, Frame* sourceFrame)
+{
+    Page* page = sourceFrame->page();
+    if (!page)
+        return;
+
+    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
+    // of any given page in the group or mutate the page group itself.
+    Vector<RefPtr<Frame> > frames;
+    if (storageType == SessionStorage) {
+        // Send events only to our page.
+        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (frame->document()->securityOrigin()->equal(securityOrigin))
+                frames.append(frame);
+        }
+
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
+    } else {
+        // Send events to every page.
+        const HashSet<Page*>& pages = page->group().pages();
+        HashSet<Page*>::const_iterator end = pages.end();
+        for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+            for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+                if (frame->document()->securityOrigin()->equal(securityOrigin))
+                    frames.append(frame);
+            }
+        }
+
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
+    }
+}
+
+}
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/WebCore/loader/UserStyleSheetLoader.h b/WebCore/storage/StorageEventDispatcher.h
index 6e7a1ba..f4a98ef 100644
--- a/WebCore/loader/UserStyleSheetLoader.h
+++ b/WebCore/storage/StorageEventDispatcher.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,32 +27,28 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef UserStyleSheetLoader_h
-#define UserStyleSheetLoader_h
+#ifndef StorageEventDispatcher_h
+#define StorageEventDispatcher_h
 
-#include "CachedResourceClient.h"
-#include "CachedResourceHandle.h"
+#if ENABLE(DOM_STORAGE)
 
-#include "Document.h"
+#include "PlatformString.h"
+#include "StorageArea.h"
 
 namespace WebCore {
-    class CachedCSSStyleSheet;
-    class String;
 
-    // This class is deprecated and should not be used in any new code. User
-    // stylesheet loading should instead happen through Page.
-    class UserStyleSheetLoader : CachedResourceClient {
+    // This is in its own class since Chromium must override it.
+    class StorageEventDispatcher {
     public:
-        UserStyleSheetLoader(PassRefPtr<Document>, const String& url);
-        ~UserStyleSheetLoader();
+        static void dispatch(const String& key, const String& oldValue, const String& newValue, StorageType, SecurityOrigin*, Frame* sourceFrame);
 
     private:
-        virtual void setCSSStyleSheet(const String& URL, const String& charset, const CachedCSSStyleSheet* sheet);
-
-        RefPtr<Document> m_document;
-        CachedResourceHandle<CachedCSSStyleSheet> m_cachedSheet;
+        // Do not instantiate.
+        StorageEventDispatcher();
     };
 
 } // namespace WebCore
 
-#endif // UserStyleSheetLoader_h
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // StorageEventDispatcher_h
diff --git a/WebCore/storage/StorageMap.cpp b/WebCore/storage/StorageMap.cpp
index 32eb350..5498d9e 100644
--- a/WebCore/storage/StorageMap.cpp
+++ b/WebCore/storage/StorageMap.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -30,20 +30,22 @@
 
 namespace WebCore {
 
-PassRefPtr<StorageMap> StorageMap::create()
+PassRefPtr<StorageMap> StorageMap::create(unsigned quota)
 {
-    return adoptRef(new StorageMap);
+    return adoptRef(new StorageMap(quota));
 }
-    
-StorageMap::StorageMap()
+
+StorageMap::StorageMap(unsigned quota)
     : m_iterator(m_map.end())
     , m_iteratorIndex(UINT_MAX)
+    , m_quotaSize(quota)  // quota measured in bytes
+    , m_currentLength(0)
 {
 }
 
 PassRefPtr<StorageMap> StorageMap::copy()
 {
-    RefPtr<StorageMap> newMap = create();
+    RefPtr<StorageMap> newMap = create(m_quotaSize);
     newMap->m_map = m_map;
     return newMap.release();
 }
@@ -54,22 +56,22 @@ void StorageMap::invalidateIterator()
     m_iteratorIndex = UINT_MAX;
 }
 
-void StorageMap::setIteratorToIndex(unsigned index) const
+void StorageMap::setIteratorToIndex(unsigned index)
 {
     // FIXME: Once we have bidirectional iterators for HashMap we can be more intelligent about this.
-    // The requested index will be closest to begin(), our current iterator, or end(), and we 
+    // The requested index will be closest to begin(), our current iterator, or end(), and we
     // can take the shortest route.
     // Until that mechanism is available, we'll always increment our iterator from begin() or current.
-    
+
     if (m_iteratorIndex == index)
         return;
-    
+
     if (index < m_iteratorIndex) {
         m_iteratorIndex = 0;
         m_iterator = m_map.begin();
         ASSERT(m_iterator != m_map.end());
     }
-    
+
     while (m_iteratorIndex < index) {
         ++m_iteratorIndex;
         ++m_iterator;
@@ -82,11 +84,11 @@ unsigned StorageMap::length() const
     return m_map.size();
 }
 
-String StorageMap::key(unsigned index) const
+String StorageMap::key(unsigned index)
 {
     if (index >= length())
         return String();
-    
+
     setIteratorToIndex(index);
     return m_iterator->first;
 }
@@ -96,27 +98,34 @@ String StorageMap::getItem(const String& key) const
     return m_map.get(key);
 }
 
-PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& value, String& oldValue)
+PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& value, String& oldValue, bool& quotaException)
 {
     ASSERT(!value.isNull());
-    
+    quotaException = false;
+
     // Implement copy-on-write semantics here.  We're guaranteed that the only refs of StorageMaps belong to Storage objects
     // so if more than one Storage object refs this map, copy it before mutating it.
     if (refCount() > 1) {
         RefPtr<StorageMap> newStorageMap = copy();
-        newStorageMap->setItem(key, value, oldValue);
+        newStorageMap->setItem(key, value, oldValue, quotaException);
         return newStorageMap.release();
     }
 
-    pair<HashMap<String, String>::iterator, bool> addResult = m_map.add(key, value);
+    // Quota tracking.  If the quota is enabled and this would go over it, bail.
+    oldValue = m_map.get(key);
+    unsigned newLength = m_currentLength + value.length() - oldValue.length();
+    bool overQuota = newLength > m_quotaSize / sizeof(UChar);
+    bool overflow = (newLength > m_currentLength) != (value.length() > oldValue.length());
+    ASSERT(!overflow);  // If we're debugging, make a fuss.  But it's still worth checking this in the following if statement.
+    if (m_quotaSize != noQuota && (overflow || overQuota)) {
+        quotaException = true;
+        return 0;
+    }
+    m_currentLength = newLength;
 
-    if (addResult.second) {
-        // There was no "oldValue" so null it out.
-        oldValue = String();
-    } else {
-        oldValue = addResult.first->second;
+    pair<HashMap<String, String>::iterator, bool> addResult = m_map.add(key, value);
+    if (!addResult.second)
         addResult.first->second = value;
-    }
 
     invalidateIterator();
 
@@ -137,6 +146,10 @@ PassRefPtr<StorageMap> StorageMap::removeItem(const String& key, String& oldValu
     if (!oldValue.isNull())
         invalidateIterator();
 
+    // Update quota.
+    ASSERT(m_currentLength - oldValue.length() <= m_currentLength);
+    m_currentLength -= oldValue.length();
+
     return 0;
 }
 
@@ -145,17 +158,20 @@ bool StorageMap::contains(const String& key) const
     return m_map.contains(key);
 }
 
-void StorageMap::importItem(const String& key, const String& value) const
+void StorageMap::importItem(const String& key, const String& value)
 {
     // Be sure to copy the keys/values as items imported on a background thread are destined
     // to cross a thread boundary
-    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.copy(), String());
+    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.threadsafeCopy(), String());
 
     if (result.second)
-        result.first->second = value.copy();
+        result.first->second = value.threadsafeCopy();
+
+    // Update quota.
+    ASSERT(m_currentLength + value.length() >= m_currentLength);
+    m_currentLength += value.length();
 }
 
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/StorageMap.h b/WebCore/storage/StorageMap.h
index 95b4047..fa5f46c 100644
--- a/WebCore/storage/StorageMap.h
+++ b/WebCore/storage/StorageMap.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageMap_h
@@ -39,27 +39,35 @@ namespace WebCore {
 
     class StorageMap : public RefCounted<StorageMap> {
     public:
-        static PassRefPtr<StorageMap> create();
+        // Quota size mesured in bytes.
+        static PassRefPtr<StorageMap> create(unsigned quotaSize);
 
         unsigned length() const;
-        String key(unsigned index) const;
+        String key(unsigned index);
         String getItem(const String&) const;
-        PassRefPtr<StorageMap> setItem(const String& key, const String& value, String& oldValue);
+        PassRefPtr<StorageMap> setItem(const String& key, const String& value, String& oldValue, bool& quota_exception);
         PassRefPtr<StorageMap> removeItem(const String&, String& oldValue);
 
         bool contains(const String& key) const;
 
-        void importItem(const String& key, const String& value) const;
+        void importItem(const String& key, const String& value);
+
+        unsigned quota() const { return m_quotaSize; }
+
+        static const unsigned noQuota = UINT_MAX;
 
     private:
-        StorageMap();
+        StorageMap(unsigned quota);
         PassRefPtr<StorageMap> copy();
         void invalidateIterator();
-        void setIteratorToIndex(unsigned) const;
+        void setIteratorToIndex(unsigned);
+
+        HashMap<String, String> m_map;
+        HashMap<String, String>::iterator m_iterator;
+        unsigned m_iteratorIndex;
 
-        mutable HashMap<String, String> m_map;
-        mutable HashMap<String, String>::iterator m_iterator;
-        mutable unsigned m_iteratorIndex;
+        unsigned m_quotaSize;  // Measured in bytes.
+        unsigned m_currentLength;  // Measured in UChars.
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageNamespace.cpp b/WebCore/storage/StorageNamespace.cpp
index 6fcae63..6b8caeb 100644
--- a/WebCore/storage/StorageNamespace.cpp
+++ b/WebCore/storage/StorageNamespace.cpp
@@ -36,9 +36,9 @@
 
 namespace WebCore {
 
-PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path)
+PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path, unsigned quota)
 {
-    return StorageNamespaceImpl::localStorageNamespace(path);
+    return StorageNamespaceImpl::localStorageNamespace(path, quota);
 }
 
 PassRefPtr<StorageNamespace> StorageNamespace::sessionStorageNamespace()
diff --git a/WebCore/storage/StorageNamespace.h b/WebCore/storage/StorageNamespace.h
index edbe339..0ac5f86 100644
--- a/WebCore/storage/StorageNamespace.h
+++ b/WebCore/storage/StorageNamespace.h
@@ -41,13 +41,14 @@ namespace WebCore {
     // This interface is required for Chromium since these actions need to be proxied between processes.
     class StorageNamespace : public RefCounted<StorageNamespace> {
     public:
-        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path);
+        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path, unsigned quota);
         static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         virtual ~StorageNamespace() { }
-        virtual PassRefPtr<StorageArea> storageArea(SecurityOrigin*) = 0;
+        virtual PassRefPtr<StorageArea> storageArea(PassRefPtr<SecurityOrigin>) = 0;
         virtual PassRefPtr<StorageNamespace> copy() = 0;
         virtual void close() = 0;
+        virtual void unlock() = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageNamespaceImpl.cpp b/WebCore/storage/StorageNamespaceImpl.cpp
index b4caaeb..19ff6b4 100644
--- a/WebCore/storage/StorageNamespaceImpl.cpp
+++ b/WebCore/storage/StorageNamespaceImpl.cpp
@@ -31,6 +31,7 @@
 #include "SecurityOriginHash.h"
 #include "StringHash.h"
 #include "StorageAreaImpl.h"
+#include "StorageMap.h"
 #include "StorageSyncManager.h"
 #include <wtf/StdLibExtras.h>
 
@@ -44,12 +45,12 @@ static LocalStorageNamespaceMap& localStorageNamespaceMap()
     return localStorageNamespaceMap;
 }
 
-PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const String& path)
+PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const String& path, unsigned quota)
 {
     const String lookupPath = path.isNull() ? String("") : path;
     LocalStorageNamespaceMap::iterator it = localStorageNamespaceMap().find(lookupPath);
     if (it == localStorageNamespaceMap().end()) {
-        RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespaceImpl(LocalStorage, lookupPath));
+        RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespaceImpl(LocalStorage, lookupPath, quota));
         localStorageNamespaceMap().set(lookupPath, storageNamespace.get());
         return storageNamespace.release();
     }
@@ -59,13 +60,14 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const S
 
 PassRefPtr<StorageNamespace> StorageNamespaceImpl::sessionStorageNamespace()
 {
-    return adoptRef(new StorageNamespaceImpl(SessionStorage, String()));
+    return adoptRef(new StorageNamespaceImpl(SessionStorage, String(), StorageMap::noQuota));
 }
 
-StorageNamespaceImpl::StorageNamespaceImpl(StorageType storageType, const String& path)
+StorageNamespaceImpl::StorageNamespaceImpl(StorageType storageType, const String& path, unsigned quota)
     : m_storageType(storageType)
-    , m_path(path.copy())  // Copy makes it safe for our other thread to access the path.
+    , m_path(path.crossThreadString())
     , m_syncManager(0)
+    , m_quota(quota)
     , m_isShutdown(false)
 {
     if (m_storageType == LocalStorage && !m_path.isEmpty())
@@ -80,7 +82,7 @@ StorageNamespaceImpl::~StorageNamespaceImpl()
         ASSERT(localStorageNamespaceMap().get(m_path) == this);
         localStorageNamespaceMap().remove(m_path);
     }
-    
+
     if (!m_isShutdown)
         close();
 }
@@ -91,7 +93,7 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::copy()
     ASSERT(!m_isShutdown);
     ASSERT(m_storageType == SessionStorage);
 
-    StorageNamespaceImpl* newNamespace = new StorageNamespaceImpl(m_storageType, m_path);
+    StorageNamespaceImpl* newNamespace = new StorageNamespaceImpl(m_storageType, m_path, m_quota);
 
     StorageAreaMap::iterator end = m_storageAreaMap.end();
     for (StorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i)
@@ -99,17 +101,18 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::copy()
     return adoptRef(newNamespace);
 }
 
-PassRefPtr<StorageArea> StorageNamespaceImpl::storageArea(SecurityOrigin* origin)
+PassRefPtr<StorageArea> StorageNamespaceImpl::storageArea(PassRefPtr<SecurityOrigin> prpOrigin)
 {
     ASSERT(isMainThread());
     ASSERT(!m_isShutdown);
 
+    RefPtr<SecurityOrigin> origin = prpOrigin;
     RefPtr<StorageAreaImpl> storageArea;
     if (storageArea = m_storageAreaMap.get(origin))
         return storageArea.release();
 
-    storageArea = adoptRef(new StorageAreaImpl(m_storageType, origin, m_syncManager));
-    m_storageAreaMap.set(origin, storageArea);
+    storageArea = StorageAreaImpl::create(m_storageType, origin, m_syncManager, m_quota);
+    m_storageAreaMap.set(origin.release(), storageArea);
     return storageArea.release();
 }
 
@@ -117,7 +120,7 @@ void StorageNamespaceImpl::close()
 {
     ASSERT(isMainThread());
     ASSERT(!m_isShutdown);
-    
+
     // If we're session storage, we shouldn't need to do any work here.
     if (m_storageType == SessionStorage) {
         ASSERT(!m_syncManager);
@@ -127,13 +130,18 @@ void StorageNamespaceImpl::close()
     StorageAreaMap::iterator end = m_storageAreaMap.end();
     for (StorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
         it->second->close();
-    
+
     if (m_syncManager)
         m_syncManager->close();
 
     m_isShutdown = true;
 }
 
+void StorageNamespaceImpl::unlock()
+{
+    // Because there's a single event loop per-process, this is a no-op.
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/WebCore/storage/StorageNamespaceImpl.h b/WebCore/storage/StorageNamespaceImpl.h
index 0b15e43..b81b55a 100644
--- a/WebCore/storage/StorageNamespaceImpl.h
+++ b/WebCore/storage/StorageNamespaceImpl.h
@@ -42,16 +42,17 @@ namespace WebCore {
 
     class StorageNamespaceImpl : public StorageNamespace {
     public:
-        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path);
+        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path, unsigned quota);
         static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         virtual ~StorageNamespaceImpl();
-        virtual PassRefPtr<StorageArea> storageArea(SecurityOrigin*);
+        virtual PassRefPtr<StorageArea> storageArea(PassRefPtr<SecurityOrigin>);
         virtual PassRefPtr<StorageNamespace> copy();
         virtual void close();
+        virtual void unlock();
 
     private:
-        StorageNamespaceImpl(StorageType, const String& path);
+        StorageNamespaceImpl(StorageType, const String& path, unsigned quota);
 
         typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<StorageAreaImpl>, SecurityOriginHash> StorageAreaMap;
         StorageAreaMap m_storageAreaMap;
@@ -62,6 +63,7 @@ namespace WebCore {
         String m_path;
         RefPtr<StorageSyncManager> m_syncManager;
 
+        unsigned m_quota;  // The default quota for each new storage area.
         bool m_isShutdown;
     };
 
diff --git a/WebCore/storage/StorageSyncManager.cpp b/WebCore/storage/StorageSyncManager.cpp
index a935242..f9276dd 100644
--- a/WebCore/storage/StorageSyncManager.cpp
+++ b/WebCore/storage/StorageSyncManager.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -48,8 +48,9 @@ PassRefPtr<StorageSyncManager> StorageSyncManager::create(const String& path)
 }
 
 StorageSyncManager::StorageSyncManager(const String& path)
-    : m_path(path.copy())
+    : m_path(path.crossThreadString())
 {
+    ASSERT(isMainThread());
     ASSERT(!m_path.isEmpty());
     m_thread = LocalStorageThread::create();
     m_thread->start();
@@ -57,6 +58,7 @@ StorageSyncManager::StorageSyncManager(const String& path)
 
 StorageSyncManager::~StorageSyncManager()
 {
+    ASSERT(isMainThread());
 }
 
 String StorageSyncManager::fullDatabaseFilename(SecurityOrigin* origin)
@@ -85,7 +87,7 @@ bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
 
     if (m_thread)
-        m_thread->scheduleImport(area);
+        m_thread->scheduleImport(area.get());
 
     return m_thread;
 }
@@ -95,10 +97,9 @@ void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
 
     if (m_thread)
-        m_thread->scheduleSync(area);
+        m_thread->scheduleSync(area.get());
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/StorageSyncManager.h b/WebCore/storage/StorageSyncManager.h
index 4c5e821..fe35e3d 100644
--- a/WebCore/storage/StorageSyncManager.h
+++ b/WebCore/storage/StorageSyncManager.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageSyncManager_h
@@ -31,8 +31,8 @@
 #include "PlatformString.h"
 
 #include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
-#include <wtf/Threading.h>
 
 namespace WebCore {
 
@@ -40,7 +40,7 @@ namespace WebCore {
     class SecurityOrigin;
     class StorageAreaSync;
 
-    class StorageSyncManager : public ThreadSafeShared<StorageSyncManager> {
+    class StorageSyncManager : public RefCounted<StorageSyncManager> {
     public:
         static PassRefPtr<StorageSyncManager> create(const String& path);
         ~StorageSyncManager();
diff --git a/WebCore/svg/ElementTimeControl.h b/WebCore/svg/ElementTimeControl.h
index 4c185b9..4800cb1 100644
--- a/WebCore/svg/ElementTimeControl.h
+++ b/WebCore/svg/ElementTimeControl.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,10 +36,10 @@ namespace WebCore {
     class ElementTimeControl {
     public:
         virtual ~ElementTimeControl() {}
-        virtual bool beginElement(ExceptionCode&) = 0;
-        virtual bool beginElementAt(float offset, ExceptionCode&) = 0;
-        virtual bool endElement(ExceptionCode&) = 0;
-        virtual bool endElementAt(float offset, ExceptionCode&) = 0;
+        virtual void beginElement() = 0;
+        virtual void beginElementAt(float offset) = 0;
+        virtual void endElement() = 0;
+        virtual void endElementAt(float offset) = 0;
     };
         
 }
diff --git a/WebCore/svg/ElementTimeControl.idl b/WebCore/svg/ElementTimeControl.idl
index 569fefa..e8ca615 100644
--- a/WebCore/svg/ElementTimeControl.idl
+++ b/WebCore/svg/ElementTimeControl.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,14 +27,10 @@
 module svg {
 
     interface [Conditional=SVG, ObjCProtocol] ElementTimeControl { 
-        boolean beginElement()
-                      raises(DOMException);
-        boolean beginElementAt(in float offset)
-                      raises(DOMException);
-        boolean endElement()
-                      raises(DOMException);
-        boolean endElementAt(in float offset)
-                      raises(DOMException);
+        void beginElement();
+        void beginElementAt(in float offset);
+        void endElement();
+        void endElementAt(in float offset);
     };
 
 }
diff --git a/WebCore/svg/SVGAElement.cpp b/WebCore/svg/SVGAElement.cpp
index 9919702..639e3e0 100644
--- a/WebCore/svg/SVGAElement.cpp
+++ b/WebCore/svg/SVGAElement.cpp
@@ -53,6 +53,7 @@ SVGAElement::SVGAElement(const QualifiedName& tagName, Document *doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_target(this, SVGNames::targetAttr)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
@@ -165,20 +166,15 @@ bool SVGAElement::supportsFocus() const
 {
     if (isContentEditable())
         return SVGStyledTransformableElement::supportsFocus();
-    return isFocusable() || (document() && !document()->haveStylesheetsLoaded());
+    return true;
 }
 
 bool SVGAElement::isFocusable() const
 {
-    if (isContentEditable())
-        return SVGStyledTransformableElement::isFocusable();
-    
-    // FIXME: Even if we are not visible, we might have a child that is visible.
-    // Dave wants to fix that some day with a "has visible content" flag or the like.
-    if (!renderer() || !(renderer()->style()->visibility() == VISIBLE))
+    if (renderer() && renderer()->absoluteClippedOverflowRect().isEmpty())
         return false;
     
-    return !renderer()->absoluteClippedOverflowRect().isEmpty();
+    return SVGElement::isFocusable();
 }
 
 bool SVGAElement::isMouseFocusable() const
diff --git a/WebCore/svg/SVGAElement.h b/WebCore/svg/SVGAElement.h
index 8890ca4..77cec67 100644
--- a/WebCore/svg/SVGAElement.h
+++ b/WebCore/svg/SVGAElement.h
@@ -65,6 +65,9 @@ namespace WebCore {
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGNames::aTagString, SVGNames::targetAttrString, String, Target, target)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGAllInOne.cpp b/WebCore/svg/SVGAllInOne.cpp
index 2e34ee3..6ca4539 100644
--- a/WebCore/svg/SVGAllInOne.cpp
+++ b/WebCore/svg/SVGAllInOne.cpp
@@ -41,7 +41,6 @@
 #include "SVGColor.cpp"
 #include "SVGComponentTransferFunctionElement.cpp"
 #include "SVGCursorElement.cpp"
-#include "SVGDefinitionSrcElement.cpp"
 #include "SVGDefsElement.cpp"
 #include "SVGDescElement.cpp"
 #include "SVGDocument.cpp"
diff --git a/WebCore/svg/SVGAltGlyphElement.cpp b/WebCore/svg/SVGAltGlyphElement.cpp
index d9da3f6..f13edf5 100644
--- a/WebCore/svg/SVGAltGlyphElement.cpp
+++ b/WebCore/svg/SVGAltGlyphElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 
 SVGAltGlyphElement::SVGAltGlyphElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGAltGlyphElement.h b/WebCore/svg/SVGAltGlyphElement.h
index 91c99e3..7c67a71 100644
--- a/WebCore/svg/SVGAltGlyphElement.h
+++ b/WebCore/svg/SVGAltGlyphElement.h
@@ -49,6 +49,10 @@ namespace WebCore {
 
     protected:
         virtual const SVGElement* contextElement() const { return this; }
+
+    private:    
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAltGlyphElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGAnimationElement.cpp b/WebCore/svg/SVGAnimationElement.cpp
index b817ad8..cf945f8 100644
--- a/WebCore/svg/SVGAnimationElement.cpp
+++ b/WebCore/svg/SVGAnimationElement.cpp
@@ -3,6 +3,7 @@
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
     This file is part of the KDE project
 
@@ -156,29 +157,24 @@ float SVGAnimationElement::getSimpleDuration(ExceptionCode&) const
     return narrowPrecisionToFloat(simpleDuration().value());
 }    
     
-bool SVGAnimationElement::beginElement(ExceptionCode& ec)
+void SVGAnimationElement::beginElement()
 {
-    return beginElementAt(0, ec);
+    beginElementAt(0);
 }
 
-bool SVGAnimationElement::beginElementAt(float offset, ExceptionCode&)
+void SVGAnimationElement::beginElementAt(float offset)
 {
     addBeginTime(elapsed() + offset);
-    return true;
 }
 
-bool SVGAnimationElement::endElement(ExceptionCode& ec)
+void SVGAnimationElement::endElement()
 {
-    return endElementAt(0, ec);
+    endElementAt(0);
 }
 
-bool SVGAnimationElement::endElementAt(float offset, ExceptionCode&)
+void SVGAnimationElement::endElementAt(float offset)
 {
-    if (offset < 0)
-        return false;
-    
     addEndTime(elapsed() + offset);
-    return true;
 }
 
 SVGAnimationElement::AnimationMode SVGAnimationElement::animationMode() const
diff --git a/WebCore/svg/SVGAnimationElement.h b/WebCore/svg/SVGAnimationElement.h
index d43ed57..1835a8d 100644
--- a/WebCore/svg/SVGAnimationElement.h
+++ b/WebCore/svg/SVGAnimationElement.h
@@ -3,6 +3,7 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2008 Cameron McCormack <cam@mcc.id.au>
 
     This file is part of the KDE project
 
@@ -57,10 +58,10 @@ namespace WebCore {
         float getSimpleDuration(ExceptionCode&) const;
         
         // ElementTimeControl
-        virtual bool beginElement(ExceptionCode&);
-        virtual bool beginElementAt(float offset, ExceptionCode&);
-        virtual bool endElement(ExceptionCode&);
-        virtual bool endElementAt(float offset, ExceptionCode&);
+        virtual void beginElement();
+        virtual void beginElementAt(float offset);
+        virtual void endElement();
+        virtual void endElementAt(float offset);
         
         static bool attributeIsCSS(const String& attributeName);
 
diff --git a/WebCore/svg/SVGColor.cpp b/WebCore/svg/SVGColor.cpp
index f939ef0..d819ebf 100644
--- a/WebCore/svg/SVGColor.cpp
+++ b/WebCore/svg/SVGColor.cpp
@@ -62,9 +62,9 @@ unsigned short SVGColor::colorType() const
     return m_colorType;
 }
 
-RGBColor* SVGColor::rgbColor() const
+PassRefPtr<RGBColor> SVGColor::rgbColor() const
 {
-    return RGBColor::create(m_color.rgb()).releaseRef();
+    return RGBColor::create(m_color.rgb());
 }
 
 void SVGColor::setRGBColor(const String& rgbColor, ExceptionCode& ec)
diff --git a/WebCore/svg/SVGColor.h b/WebCore/svg/SVGColor.h
index 5dfb694..406166b 100644
--- a/WebCore/svg/SVGColor.h
+++ b/WebCore/svg/SVGColor.h
@@ -57,8 +57,8 @@ namespace WebCore {
         // 'SVGColor' functions
         unsigned short colorType() const;
 
-        RGBColor* rgbColor() const;
-        
+        PassRefPtr<RGBColor> rgbColor() const;
+
         static Color colorFromRGBColorString(const String&);
 
         void setRGBColor(const String& rgbColor) { ExceptionCode ignored = 0; setRGBColor(rgbColor, ignored); }
diff --git a/WebCore/svg/SVGComponentTransferFunctionElement.h b/WebCore/svg/SVGComponentTransferFunctionElement.h
index 82d57b4..a26c953 100644
--- a/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
+#include "SVGNames.h"
 #include "SVGNumberList.h"
 #include "FEComponentTransfer.h"
 
diff --git a/WebCore/svg/SVGCursorElement.cpp b/WebCore/svg/SVGCursorElement.cpp
index 12e9e5d..5b408f8 100644
--- a/WebCore/svg/SVGCursorElement.cpp
+++ b/WebCore/svg/SVGCursorElement.cpp
@@ -40,6 +40,7 @@ SVGCursorElement::SVGCursorElement(const QualifiedName& tagName, Document* doc)
     , SVGURIReference()
     , m_x(this, SVGNames::xAttr, LengthModeWidth)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGCursorElement.h b/WebCore/svg/SVGCursorElement.h
index ddafb76..71963b6 100644
--- a/WebCore/svg/SVGCursorElement.h
+++ b/WebCore/svg/SVGCursorElement.h
@@ -57,6 +57,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::yAttrString, SVGLength, Y, y)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         HashSet<SVGElement*> m_clients;
     };
 
diff --git a/WebCore/svg/SVGDefinitionSrcElement.cpp b/WebCore/svg/SVGDefinitionSrcElement.cpp
deleted file mode 100644
index 1419ec0..0000000
--- a/WebCore/svg/SVGDefinitionSrcElement.cpp
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
-   Copyright (C) 2007 Eric Seidel <eric@webkit.org>
-
-   This library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Library General Public
-   License as published by the Free Software Foundation; either
-   version 2 of the License, or (at your option) any later version.
-
-   This library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Library General Public License for more details.
-
-   You should have received a copy of the GNU Library General Public License
-   along with this library; see the file COPYING.LIB.  If not, write to
-   the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG_FONTS)
-#include "SVGDefinitionSrcElement.h"
-
-#include "SVGFontFaceElement.h"
-#include "SVGNames.h"
-
-namespace WebCore {
-    
-SVGDefinitionSrcElement::SVGDefinitionSrcElement(const QualifiedName& tagName, Document* doc)
-    : SVGElement(tagName, doc)
-{
-}
-
-void SVGDefinitionSrcElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
-{
-    SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-    if (parentNode() && parentNode()->hasTagName(SVGNames::font_faceTag))
-        static_cast<SVGFontFaceElement*>(parentNode())->rebuildFontFace();
-}
-
-}
-
-#endif // ENABLE(SVG_FONTS)
-
diff --git a/WebCore/svg/SVGDefinitionSrcElement.h b/WebCore/svg/SVGDefinitionSrcElement.h
deleted file mode 100644
index aaefd05..0000000
--- a/WebCore/svg/SVGDefinitionSrcElement.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
-   Copyright (C) 2007 Eric Seidel <eric@webkit.org>
-
-   This library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Library General Public
-   License as published by the Free Software Foundation; either
-   version 2 of the License, or (at your option) any later version.
-
-   This library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Library General Public License for more details.
-
-   You should have received a copy of the GNU Library General Public License
-   along with this library; see the file COPYING.LIB.  If not, write to
-   the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.
- */
-
-#ifndef SVGDefinitionSrcElement_h
-#define SVGDefinitionSrcElement_h
-
-#if ENABLE(SVG_FONTS)
-#include "SVGElement.h"
-
-namespace WebCore {
-    class SVGDefinitionSrcElement : public SVGElement {
-    public:
-        SVGDefinitionSrcElement(const QualifiedName&, Document*);
-    
-        virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG_FONTS)
-#endif
-
-// vim:ts=4:noet
diff --git a/WebCore/svg/SVGDocument.h b/WebCore/svg/SVGDocument.h
index 02e3649..c7006f9 100644
--- a/WebCore/svg/SVGDocument.h
+++ b/WebCore/svg/SVGDocument.h
@@ -35,13 +35,11 @@ namespace WebCore {
     public:
         static PassRefPtr<SVGDocument> create(Frame* frame)
         {
-            return new SVGDocument(frame);
+            return adoptRef(new SVGDocument(frame));
         }
 
         virtual ~SVGDocument();
         
-        virtual bool isSVGDocument() const { return true; }
-
         SVGSVGElement* rootElement() const;
         
         void dispatchZoomEvent(float prevScale, float newScale);
@@ -52,11 +50,13 @@ namespace WebCore {
         void startPan(const FloatPoint& start);
         void updatePan(const FloatPoint& pos) const;
 
-        virtual bool childShouldCreateRenderer(Node*) const;
-
     private:
         SVGDocument(Frame*);
 
+        virtual bool isSVGDocument() const { return true; }
+
+        virtual bool childShouldCreateRenderer(Node*) const;
+
         FloatPoint m_translate;
     };
 
diff --git a/WebCore/svg/SVGElement.cpp b/WebCore/svg/SVGElement.cpp
index 3a7d3d4..d455717 100644
--- a/WebCore/svg/SVGElement.cpp
+++ b/WebCore/svg/SVGElement.cpp
@@ -51,14 +51,19 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-SVGElement::SVGElement(const QualifiedName& tagName, Document* doc)
-    : StyledElement(tagName, doc)
+SVGElement::SVGElement(const QualifiedName& tagName, Document* document)
+    : StyledElement(tagName, document, CreateElementZeroRefCount)
     , m_shadowParent(0)
     , m_cursorElement(0)
     , m_cursorImageValue(0)
 {
 }
 
+PassRefPtr<SVGElement> SVGElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new SVGElement(tagName, document);
+}
+
 SVGElement::~SVGElement()
 {
     if (m_cursorElement)
@@ -185,18 +190,17 @@ bool SVGElement::haveLoadedRequiredResources()
     return true;
 }
 
-static bool hasLoadListener(SVGElement* node)
+static bool hasLoadListener(Node* node)
 {
-    Node* currentNode = node;
-    while (currentNode && currentNode->isElementNode()) {
-        const RegisteredEventListenerVector& listeners = static_cast<Element*>(currentNode)->eventListeners();
-        size_t size = listeners.size();
-        for (size_t i = 0; i < size; ++i) {
-            const RegisteredEventListener& r = *listeners[i];
-            if (r.eventType() == eventNames().loadEvent && r.useCapture() || currentNode == node)
+    if (node->hasEventListeners(eventNames().loadEvent))
+        return true;
+
+    for (node = node->parentNode(); node && node->isElementNode(); node = node->parentNode()) {
+        const EventListenerVector& entry = node->getEventListeners(eventNames().loadEvent);
+        for (size_t i = 0; i < entry.size(); ++i) {
+            if (entry[i].useCapture)
                 return true;
         }
-        currentNode = currentNode->parentNode();
     }
 
     return false;
diff --git a/WebCore/svg/SVGElement.h b/WebCore/svg/SVGElement.h
index aed7e59..3a17567 100644
--- a/WebCore/svg/SVGElement.h
+++ b/WebCore/svg/SVGElement.h
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,25 +25,22 @@
 #if ENABLE(SVG)
 #include "StyledElement.h"
 #include "SVGAnimatedProperty.h"
-#include "SVGNames.h"
 
 namespace WebCore {
 
-    class TransformationMatrix;
     class CSSCursorImageValue;
     class Document;
     class SVGCursorElement;
     class SVGDocumentExtensions;
     class SVGElementInstance;
     class SVGSVGElement;
+    class TransformationMatrix;
 
     class SVGElement : public StyledElement {
     public:
-        SVGElement(const QualifiedName&, Document*);
+        static PassRefPtr<SVGElement> create(const QualifiedName&, Document*);
         virtual ~SVGElement();
-        virtual bool isSVGElement() const { return true; }
-        virtual bool isSupported(StringImpl* feature, StringImpl* version) const;
-        
+
         String id() const;
         void setId(const String&, ExceptionCode&);
         String xmlbase() const;
@@ -52,6 +48,7 @@ namespace WebCore {
 
         SVGSVGElement* ownerSVGElement() const;
         SVGElement* viewportElement() const;
+
         SVGDocumentExtensions* accessDocumentSVGExtensions() const;
 
         virtual void parseMappedAttribute(MappedAttribute*);
@@ -64,33 +61,53 @@ namespace WebCore {
         virtual bool isGradientStop() const { return false; }
         virtual bool isTextContent() const { return false; }
 
-        virtual bool isShadowNode() const { return m_shadowParent; }
-        virtual Node* shadowParentNode() { return m_shadowParent; }
         void setShadowParentNode(ContainerNode* node) { m_shadowParent = node; }
-        virtual ContainerNode* eventParentNode();
 
         // For SVGTests
         virtual bool isValid() const { return true; }
-  
-        virtual void finishParsingChildren();
+
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
         virtual bool childShouldCreateRenderer(Node*) const;
 
-        virtual void insertedIntoDocument();
-        virtual void buildPendingResource() { }
-
         virtual void svgAttributeChanged(const QualifiedName&) { }
-        virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
         void sendSVGLoadEventIfPossible(bool sendParentLoadEvents = false);
         
         virtual TransformationMatrix* supplementalTransform() { return 0; }
 
-        virtual void updateAnimatedSVGAttribute(const String&) const;
         virtual void setSynchronizedSVGAttributes(bool) const;
 
         HashSet<SVGElementInstance*> instancesForElement() const;
- 
+
+        void addSVGPropertySynchronizer(const QualifiedName& attrName, const SVGAnimatedPropertyBase& base) const
+        {
+            m_svgPropertyMap.set(attrName.localName(), &base);
+        }
+
+        void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
+        void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
+
+    protected:
+        SVGElement(const QualifiedName&, Document*);
+
+        virtual void finishParsingChildren();
+        virtual void insertedIntoDocument();
+        virtual void attributeChanged(Attribute*, bool preserveDecls = false);
+        virtual void updateAnimatedSVGAttribute(const String&) const;
+
+    private:
+        friend class SVGElementInstance;
+
+        virtual bool isSVGElement() const { return true; }
+
+        virtual bool isSupported(StringImpl* feature, StringImpl* version) const;
+        
+        virtual bool isShadowNode() const { return m_shadowParent; }
+        virtual Node* shadowParentNode() { return m_shadowParent; }
+        virtual ContainerNode* eventParentNode();
+
+        virtual void buildPendingResource() { }
+
         // Inlined methods handling SVG property synchronization
         void invokeSVGPropertySynchronizer(const String& name) const
         {
@@ -114,17 +131,6 @@ namespace WebCore {
             }
         }
 
-        void addSVGPropertySynchronizer(const QualifiedName& attrName, const SVGAnimatedPropertyBase& base) const
-        {
-            m_svgPropertyMap.set(attrName.localName(), &base);
-        }
-
-        void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
-        void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
-
-    private:
-        friend class SVGElementInstance;
-
         void mapInstanceToElement(SVGElementInstance*);
         void removeInstanceMapping(SVGElementInstance*);
 
diff --git a/WebCore/svg/SVGElementInstance.cpp b/WebCore/svg/SVGElementInstance.cpp
index 01555fc..46e8221 100644
--- a/WebCore/svg/SVGElementInstance.cpp
+++ b/WebCore/svg/SVGElementInstance.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,7 +23,6 @@
 #include "SVGElementInstance.h"
 
 #include "ContainerNodeAlgorithms.h"
-#include "Document.h"
 #include "Event.h"
 #include "EventException.h"
 #include "EventListener.h"
@@ -46,7 +43,14 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter instanceCounter("WebCoreSVGElementInstance");
 #endif
 
-SVGElementInstance::SVGElementInstance(SVGUseElement* useElement, SVGElement* originalElement)
+static EventTargetData& dummyEventTargetData()
+{
+    DEFINE_STATIC_LOCAL(EventTargetData, dummyEventTargetData, ());
+    dummyEventTargetData.eventListenerMap.clear();
+    return dummyEventTargetData;
+}
+
+SVGElementInstance::SVGElementInstance(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
     : m_needsUpdate(false)
     , m_useElement(useElement)
     , m_element(originalElement)
@@ -140,438 +144,52 @@ ScriptExecutionContext* SVGElementInstance::scriptExecutionContext() const
     return 0;
 }
 
-void SVGElementInstance::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-{
-    if (SVGElement* element = correspondingElement())
-        element->addEventListener(eventType, listener, useCapture);
-}
-
-void SVGElementInstance::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+bool SVGElementInstance::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    if (SVGElement* element = correspondingElement())
-        element->removeEventListener(eventType, listener, useCapture);
-}
-
-bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
-{
-    RefPtr<Event> evt(e);
-    ASSERT(!eventDispatchForbidden());
-    if (!evt || evt->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return false;
-    }
-
-    // The event has to be dispatched to the shadowTreeElement(), not the correspondingElement()!
-    SVGElement* element = shadowTreeElement();
-    if (!element)
+    if (!correspondingElement())
         return false;
-
-    evt->setTarget(this);
-
-    RefPtr<FrameView> view = element->document()->view();
-    return element->dispatchGenericEvent(evt.release());
-}
-
-EventListener* SVGElementInstance::onabort() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().abortEvent);
-}
-
-void SVGElementInstance::setOnabort(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().abortEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onblur() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().blurEvent);
-}
-
-void SVGElementInstance::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().blurEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onchange() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().changeEvent);
-}
-
-void SVGElementInstance::setOnchange(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().changeEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onclick() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().clickEvent);
-}
-
-void SVGElementInstance::setOnclick(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().clickEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::oncontextmenu() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().contextmenuEvent);
-}
-
-void SVGElementInstance::setOncontextmenu(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondblclick() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dblclickEvent);
-}
-
-void SVGElementInstance::setOndblclick(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dblclickEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onerror() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().errorEvent);
-}
-
-void SVGElementInstance::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().errorEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onfocus() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().focusEvent);
-}
-
-void SVGElementInstance::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().focusEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::oninput() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().inputEvent);
-}
-
-void SVGElementInstance::setOninput(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().inputEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onkeydown() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().keydownEvent);
-}
-
-void SVGElementInstance::setOnkeydown(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().keydownEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onkeypress() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().keypressEvent);
-}
-
-void SVGElementInstance::setOnkeypress(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().keypressEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onkeyup() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().keyupEvent);
-}
-
-void SVGElementInstance::setOnkeyup(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().keyupEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onload() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().loadEvent);
-}
-
-void SVGElementInstance::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().loadEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmousedown() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mousedownEvent);
-}
-
-void SVGElementInstance::setOnmousedown(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().mousedownEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmousemove() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mousemoveEvent);
-}
-
-void SVGElementInstance::setOnmousemove(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmouseout() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mouseoutEvent);
-}
-
-void SVGElementInstance::setOnmouseout(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmouseover() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mouseoverEvent);
-}
-
-void SVGElementInstance::setOnmouseover(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmouseup() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mouseupEvent);
+    return correspondingElement()->addEventListener(eventType, listener, useCapture);
 }
 
-void SVGElementInstance::setOnmouseup(PassRefPtr<EventListener> eventListener)
+bool SVGElementInstance::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    correspondingElement()->setAttributeEventListener(eventNames().mouseupEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmousewheel() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mousewheelEvent);
-}
-
-void SVGElementInstance::setOnmousewheel(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onbeforecut() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().beforecutEvent);
-}
-
-void SVGElementInstance::setOnbeforecut(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().beforecutEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::oncut() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().cutEvent);
-}
-
-void SVGElementInstance::setOncut(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().cutEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onbeforecopy() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().beforecopyEvent);
-}
-
-void SVGElementInstance::setOnbeforecopy(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().beforecopyEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::oncopy() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().copyEvent);
-}
-
-void SVGElementInstance::setOncopy(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().copyEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onbeforepaste() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().beforepasteEvent);
-}
-
-void SVGElementInstance::setOnbeforepaste(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().beforepasteEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onpaste() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().pasteEvent);
-}
-
-void SVGElementInstance::setOnpaste(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().pasteEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondragenter() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragenterEvent);
-}
-
-void SVGElementInstance::setOndragenter(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragenterEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondragover() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragoverEvent);
-}
-
-void SVGElementInstance::setOndragover(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragoverEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondragleave() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragleaveEvent);
-}
-
-void SVGElementInstance::setOndragleave(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondrop() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dropEvent);
-}
-
-void SVGElementInstance::setOndrop(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dropEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondragstart() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragstartEvent);
-}
-
-void SVGElementInstance::setOndragstart(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragstartEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondrag() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragEvent);
-}
-
-void SVGElementInstance::setOndrag(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondragend() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragendEvent);
-}
-
-void SVGElementInstance::setOndragend(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragendEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onreset() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().resetEvent);
-}
-
-void SVGElementInstance::setOnreset(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().resetEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onresize() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().resizeEvent);
-}
-
-void SVGElementInstance::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onscroll() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().scrollEvent);
-}
-
-void SVGElementInstance::setOnscroll(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().scrollEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onsearch() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().searchEvent);
-}
-
-void SVGElementInstance::setOnsearch(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().searchEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onselect() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().selectEvent);
+    if (!correspondingElement())
+        return false;
+    return correspondingElement()->removeEventListener(eventType, listener, useCapture);
 }
 
-void SVGElementInstance::setOnselect(PassRefPtr<EventListener> eventListener)
+void SVGElementInstance::removeAllEventListeners()
 {
-    correspondingElement()->setAttributeEventListener(eventNames().selectEvent, eventListener);
+    if (!correspondingElement())
+        return;
+    correspondingElement()->removeAllEventListeners();
 }
 
-EventListener* SVGElementInstance::onselectstart() const
+bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> prpEvent)
 {
-    return correspondingElement()->getAttributeEventListener(eventNames().selectstartEvent);
-}
+    RefPtr<EventTarget> protect = this;
+    RefPtr<Event> event = prpEvent;
 
-void SVGElementInstance::setOnselectstart(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().selectstartEvent, eventListener);
-}
+    event->setTarget(this);
 
-EventListener* SVGElementInstance::onsubmit() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().submitEvent);
-}
+    SVGElement* element = shadowTreeElement();
+    if (!element)
+        return false;
 
-void SVGElementInstance::setOnsubmit(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().submitEvent, eventListener);
+    RefPtr<FrameView> view = element->document()->view();
+    return element->dispatchGenericEvent(event.release());
 }
 
-EventListener* SVGElementInstance::onunload() const
+EventTargetData* SVGElementInstance::eventTargetData()
 {
-    return correspondingElement()->getAttributeEventListener(eventNames().unloadEvent);
+    return correspondingElement() ? correspondingElement()->eventTargetData() : 0;
 }
 
-void SVGElementInstance::setOnunload(PassRefPtr<EventListener> eventListener)
+EventTargetData* SVGElementInstance::ensureEventTargetData()
 {
-    correspondingElement()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
+    return &dummyEventTargetData(); // return something, so we don't crash
 }
 
-}
+} // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGElementInstance.h b/WebCore/svg/SVGElementInstance.h
index c477718..3cdc761 100644
--- a/WebCore/svg/SVGElementInstance.h
+++ b/WebCore/svg/SVGElementInstance.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -27,9 +25,6 @@
 #include "SVGElement.h"
 #include "TreeShared.h"
 
-#include <wtf/RefPtr.h>
-#include <wtf/PassRefPtr.h>
-
 namespace WebCore {
 
     namespace Private { 
@@ -37,8 +32,6 @@ namespace WebCore {
         void addChildNodesToDeletionQueue(GenericNode*& head, GenericNode*& tail, GenericNodeContainer* container);
     };
 
-    class EventListener;
-    class Frame;
     class SVGUseElement;
     class SVGElementInstanceList;
 
@@ -46,7 +39,11 @@ namespace WebCore {
     class SVGElementInstance : public TreeShared<SVGElementInstance>,
                                public EventTarget {
     public:
-        SVGElementInstance(SVGUseElement*, SVGElement* originalElement);
+        static PassRefPtr<SVGElementInstance> create(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
+        {
+            return adoptRef(new SVGElementInstance(useElement, originalElement));
+        }
+
         virtual ~SVGElementInstance();
 
         bool needsUpdate() const { return m_needsUpdate; }
@@ -54,13 +51,11 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        virtual Node* toNode() { return shadowTreeElement(); }
-        virtual SVGElementInstance* toSVGElementInstance() { return this; }
-
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-        const RegisteredEventListenerVector& eventListeners() const { return correspondingElement()->eventListeners(); }
+        virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual void removeAllEventListeners();
+        using EventTarget::dispatchEvent;
+        virtual bool dispatchEvent(PassRefPtr<Event>);
 
         SVGElement* correspondingElement() const { return m_element.get(); }
         SVGUseElement* correspondingUseElement() const { return m_useElement; }
@@ -83,90 +78,55 @@ namespace WebCore {
         using TreeShared<SVGElementInstance>::deref;
 
         // EventTarget API
-        EventListener* onabort() const;
-        void setOnabort(PassRefPtr<EventListener>);
-        EventListener* onblur() const;
-        void setOnblur(PassRefPtr<EventListener>);
-        EventListener* onchange() const;
-        void setOnchange(PassRefPtr<EventListener>);
-        EventListener* onclick() const;
-        void setOnclick(PassRefPtr<EventListener>);
-        EventListener* oncontextmenu() const;
-        void setOncontextmenu(PassRefPtr<EventListener>);
-        EventListener* ondblclick() const;
-        void setOndblclick(PassRefPtr<EventListener>);
-        EventListener* onerror() const;
-        void setOnerror(PassRefPtr<EventListener>);
-        EventListener* onfocus() const;
-        void setOnfocus(PassRefPtr<EventListener>);
-        EventListener* oninput() const;
-        void setOninput(PassRefPtr<EventListener>);
-        EventListener* onkeydown() const;
-        void setOnkeydown(PassRefPtr<EventListener>);
-        EventListener* onkeypress() const;
-        void setOnkeypress(PassRefPtr<EventListener>);
-        EventListener* onkeyup() const;
-        void setOnkeyup(PassRefPtr<EventListener>);
-        EventListener* onload() const;
-        void setOnload(PassRefPtr<EventListener>);
-        EventListener* onmousedown() const;
-        void setOnmousedown(PassRefPtr<EventListener>);
-        EventListener* onmousemove() const;
-        void setOnmousemove(PassRefPtr<EventListener>);
-        EventListener* onmouseout() const;
-        void setOnmouseout(PassRefPtr<EventListener>);
-        EventListener* onmouseover() const;
-        void setOnmouseover(PassRefPtr<EventListener>);
-        EventListener* onmouseup() const;
-        void setOnmouseup(PassRefPtr<EventListener>);
-        EventListener* onmousewheel() const;
-        void setOnmousewheel(PassRefPtr<EventListener>);
-        EventListener* onbeforecut() const;
-        void setOnbeforecut(PassRefPtr<EventListener>);
-        EventListener* oncut() const;
-        void setOncut(PassRefPtr<EventListener>);
-        EventListener* onbeforecopy() const;
-        void setOnbeforecopy(PassRefPtr<EventListener>);
-        EventListener* oncopy() const;
-        void setOncopy(PassRefPtr<EventListener>);
-        EventListener* onbeforepaste() const;
-        void setOnbeforepaste(PassRefPtr<EventListener>);
-        EventListener* onpaste() const;
-        void setOnpaste(PassRefPtr<EventListener>);
-        EventListener* ondragenter() const;
-        void setOndragenter(PassRefPtr<EventListener>);
-        EventListener* ondragover() const;
-        void setOndragover(PassRefPtr<EventListener>);
-        EventListener* ondragleave() const;
-        void setOndragleave(PassRefPtr<EventListener>);
-        EventListener* ondrop() const;
-        void setOndrop(PassRefPtr<EventListener>);
-        EventListener* ondragstart() const;
-        void setOndragstart(PassRefPtr<EventListener>);
-        EventListener* ondrag() const;
-        void setOndrag(PassRefPtr<EventListener>);
-        EventListener* ondragend() const;
-        void setOndragend(PassRefPtr<EventListener>);
-        EventListener* onreset() const;
-        void setOnreset(PassRefPtr<EventListener>);
-        EventListener* onresize() const;
-        void setOnresize(PassRefPtr<EventListener>);
-        EventListener* onscroll() const;
-        void setOnscroll(PassRefPtr<EventListener>);
-        EventListener* onsearch() const;
-        void setOnsearch(PassRefPtr<EventListener>);
-        EventListener* onselect() const;
-        void setOnselect(PassRefPtr<EventListener>);
-        EventListener* onselectstart() const;
-        void setOnselectstart(PassRefPtr<EventListener>);
-        EventListener* onsubmit() const;
-        void setOnsubmit(PassRefPtr<EventListener>);
-        EventListener* onunload() const;
-        void setOnunload(PassRefPtr<EventListener>);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), abort);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), blur);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), change);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), click);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), contextmenu);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dblclick);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), error);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), focus);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), input);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), keydown);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), keypress);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), keyup);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), load);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mousedown);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mousemove);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mouseout);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mouseover);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mouseup);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mousewheel);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), beforecut);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), cut);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), beforecopy);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), copy);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), beforepaste);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), paste);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dragenter);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dragover);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dragleave);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), drop);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dragstart);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), drag);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dragend);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), reset);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), resize);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), scroll);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), search);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), select);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), selectstart);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), submit);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), unload);
 
     private:
         friend class SVGUseElement;
 
+        SVGElementInstance(SVGUseElement*, PassRefPtr<SVGElement> originalElement);
+
+        virtual Node* toNode() { return shadowTreeElement(); }
+        virtual SVGElementInstance* toSVGElementInstance() { return this; }
+
         void appendChild(PassRefPtr<SVGElementInstance> child);
         void setShadowTreeElement(SVGElement*);
         void forgetWrapper();
@@ -190,8 +150,9 @@ namespace WebCore {
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
-    private:
         bool m_needsUpdate : 1;
 
         SVGUseElement* m_useElement;
diff --git a/WebCore/svg/SVGExternalResourcesRequired.h b/WebCore/svg/SVGExternalResourcesRequired.h
index 0ab6dc9..e491e4b 100644
--- a/WebCore/svg/SVGExternalResourcesRequired.h
+++ b/WebCore/svg/SVGExternalResourcesRequired.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG)
 #include "SVGElement.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGFEImageElement.cpp b/WebCore/svg/SVGFEImageElement.cpp
index 8122960..fade0f7 100644
--- a/WebCore/svg/SVGFEImageElement.cpp
+++ b/WebCore/svg/SVGFEImageElement.cpp
@@ -43,6 +43,7 @@ SVGFEImageElement::SVGFEImageElement(const QualifiedName& tagName, Document* doc
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGFEImageElement.h b/WebCore/svg/SVGFEImageElement.h
index 67f3bd5..0393c66 100644
--- a/WebCore/svg/SVGFEImageElement.h
+++ b/WebCore/svg/SVGFEImageElement.h
@@ -55,6 +55,9 @@ namespace WebCore {
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGNames::feImageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         CachedResourceHandle<CachedImage> m_cachedImage;
     };
 
diff --git a/WebCore/svg/SVGFELightElement.h b/WebCore/svg/SVGFELightElement.h
index a66ccf5..f6e79fb 100644
--- a/WebCore/svg/SVGFELightElement.h
+++ b/WebCore/svg/SVGFELightElement.h
@@ -25,6 +25,7 @@
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
 #include "SVGLightSource.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGFEMergeNodeElement.h b/WebCore/svg/SVGFEMergeNodeElement.h
index e2af642..4633f98 100644
--- a/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/WebCore/svg/SVGFEMergeNodeElement.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGFilterElement.cpp b/WebCore/svg/SVGFilterElement.cpp
index 7703b6f..bc39475 100644
--- a/WebCore/svg/SVGFilterElement.cpp
+++ b/WebCore/svg/SVGFilterElement.cpp
@@ -54,6 +54,7 @@ SVGFilterElement::SVGFilterElement(const QualifiedName& tagName, Document* doc)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
     , m_filterResX(this, SVGNames::filterResAttr)
     , m_filterResY(this, SVGNames::filterResAttr)
+    , m_href(this, XLinkNames::hrefAttr)
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
diff --git a/WebCore/svg/SVGFilterElement.h b/WebCore/svg/SVGFilterElement.h
index 541ec14..64b21f6 100644
--- a/WebCore/svg/SVGFilterElement.h
+++ b/WebCore/svg/SVGFilterElement.h
@@ -64,6 +64,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGFilterResXIdentifier, long, FilterResX, filterResX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGFilterResYIdentifier, long, FilterResY, filterResY)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         RefPtr<SVGResourceFilter> m_filter;
     };
 
diff --git a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index fa82f6a..3cdbb37 100644
--- a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterBuilder.h"
+#include "SVGNames.h"
 #include "SVGResourceFilter.h"
 #include "SVGStyledElement.h"
 
diff --git a/WebCore/svg/SVGFontFaceElement.cpp b/WebCore/svg/SVGFontFaceElement.cpp
index 1e5a0fe..aa0b6d8 100644
--- a/WebCore/svg/SVGFontFaceElement.cpp
+++ b/WebCore/svg/SVGFontFaceElement.cpp
@@ -37,7 +37,6 @@
 #include "Document.h"
 #include "Font.h"
 #include "MappedAttribute.h"
-#include "SVGDefinitionSrcElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceSrcElement.h"
 #include "SVGGlyphElement.h"
@@ -277,21 +276,12 @@ void SVGFontFaceElement::rebuildFontFace()
 
     // we currently ignore all but the first src element, alternatively we could concat them
     SVGFontFaceSrcElement* srcElement = 0;
-    SVGDefinitionSrcElement* definitionSrc = 0;
 
-    for (Node* child = firstChild(); child; child = child->nextSibling()) {
-        if (child->hasTagName(font_face_srcTag) && !srcElement)
+    for (Node* child = firstChild(); child && !srcElement; child = child->nextSibling()) {
+        if (child->hasTagName(font_face_srcTag))
             srcElement = static_cast<SVGFontFaceSrcElement*>(child);
-        else if (child->hasTagName(definition_srcTag) && !definitionSrc)
-            definitionSrc = static_cast<SVGDefinitionSrcElement*>(child);
     }
 
-#if 0
-    // @font-face (CSSFontFace) does not yet support definition-src, as soon as it does this code should do the trick!
-    if (definitionSrc)
-        m_styleDeclaration->setProperty(CSSPropertyDefinitionSrc, definitionSrc->getAttribute(XLinkNames::hrefAttr), false);
-#endif
-
     bool describesParentFont = parentNode()->hasTagName(fontTag);
     RefPtr<CSSValueList> list;
 
diff --git a/WebCore/svg/SVGForeignObjectElement.cpp b/WebCore/svg/SVGForeignObjectElement.cpp
index 5cfca8a..b93ddeb 100644
--- a/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/WebCore/svg/SVGForeignObjectElement.cpp
@@ -43,6 +43,7 @@ SVGForeignObjectElement::SVGForeignObjectElement(const QualifiedName& tagName, D
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGForeignObjectElement.h b/WebCore/svg/SVGForeignObjectElement.h
index 14dbe68..7b93bb6 100644
--- a/WebCore/svg/SVGForeignObjectElement.h
+++ b/WebCore/svg/SVGForeignObjectElement.h
@@ -56,6 +56,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::yAttrString, SVGLength, Y, y)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::heightAttrString, SVGLength, Height, height)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGGradientElement.cpp b/WebCore/svg/SVGGradientElement.cpp
index 8034286..29bbcac 100644
--- a/WebCore/svg/SVGGradientElement.cpp
+++ b/WebCore/svg/SVGGradientElement.cpp
@@ -48,6 +48,7 @@ SVGGradientElement::SVGGradientElement(const QualifiedName& tagName, Document* d
     , m_spreadMethod(this, SVGNames::spreadMethodAttr)
     , m_gradientUnits(this, SVGNames::gradientUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
     , m_gradientTransform(this, SVGNames::gradientTransformAttr, SVGTransformList::create(SVGNames::gradientTransformAttr))
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGGradientElement.h b/WebCore/svg/SVGGradientElement.h
index 2027258..3c8a760 100644
--- a/WebCore/svg/SVGGradientElement.h
+++ b/WebCore/svg/SVGGradientElement.h
@@ -66,6 +66,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::spreadMethodAttrString, int, SpreadMethod, spreadMethod)
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientUnitsAttrString, int, GradientUnits, gradientUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientTransformAttrString, SVGTransformList, GradientTransform, gradientTransform)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGImageElement.cpp b/WebCore/svg/SVGImageElement.cpp
index 299828f..5b7dee2 100644
--- a/WebCore/svg/SVGImageElement.cpp
+++ b/WebCore/svg/SVGImageElement.cpp
@@ -45,7 +45,8 @@ SVGImageElement::SVGImageElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create()) 
+    , m_href(this, XLinkNames::hrefAttr)
     , m_imageLoader(this)
 {
 }
diff --git a/WebCore/svg/SVGImageElement.h b/WebCore/svg/SVGImageElement.h
index 1d242b5..7840fc5 100644
--- a/WebCore/svg/SVGImageElement.h
+++ b/WebCore/svg/SVGImageElement.h
@@ -70,6 +70,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::heightAttrString, SVGLength, Height, height)
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         SVGImageLoader m_imageLoader;
     };
 
diff --git a/WebCore/svg/SVGImageLoader.cpp b/WebCore/svg/SVGImageLoader.cpp
index f8380f5..5d5d3bc 100644
--- a/WebCore/svg/SVGImageLoader.cpp
+++ b/WebCore/svg/SVGImageLoader.cpp
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "SVGImageLoader.h"
 
+#include "Event.h"
 #include "EventNames.h"
 #include "SVGImageElement.h"
 #include "RenderImage.h"
@@ -43,7 +44,7 @@ SVGImageLoader::~SVGImageLoader()
 void SVGImageLoader::dispatchLoadEvent()
 {
     if (image()->errorOccurred())
-        element()->dispatchEvent(eventNames().errorEvent, false, false);
+        element()->dispatchEvent(Event::create(eventNames().errorEvent, false, false));
     else {
         SVGImageElement* imageElement = static_cast<SVGImageElement*>(element());
         if (imageElement->externalResourcesRequiredBaseValue())
diff --git a/WebCore/svg/SVGMPathElement.cpp b/WebCore/svg/SVGMPathElement.cpp
index b3214ed..f19580c 100644
--- a/WebCore/svg/SVGMPathElement.cpp
+++ b/WebCore/svg/SVGMPathElement.cpp
@@ -31,6 +31,7 @@ namespace WebCore {
 
 SVGMPathElement::SVGMPathElement(const QualifiedName& qname, Document* doc)
     : SVGElement(qname, doc)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
@@ -47,7 +48,7 @@ void SVGMPathElement::parseMappedAttribute(MappedAttribute* attr)
 
 SVGPathElement* SVGMPathElement::pathElement()
 {
-    Element* target = document()->getElementById(getTarget(SVGURIReference::href()));
+    Element* target = document()->getElementById(getTarget(href()));
     if (target && target->hasTagName(SVGNames::pathTag))
         return static_cast<SVGPathElement*>(target);
     return 0;
diff --git a/WebCore/svg/SVGMPathElement.h b/WebCore/svg/SVGMPathElement.h
index 988cead..463542f 100644
--- a/WebCore/svg/SVGMPathElement.h
+++ b/WebCore/svg/SVGMPathElement.h
@@ -31,8 +31,8 @@ namespace WebCore {
     class SVGPathElement;
     
     class SVGMPathElement : public SVGElement,
-                                   SVGURIReference,
-                                   SVGExternalResourcesRequired {
+                            public SVGURIReference,
+                            public SVGExternalResourcesRequired {
     public:
         SVGMPathElement(const QualifiedName&, Document*);
         virtual ~SVGMPathElement();
@@ -43,6 +43,9 @@ namespace WebCore {
         
     protected:
         virtual const SVGElement* contextElement() const { return this; }
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href) 
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGMaskElement.cpp b/WebCore/svg/SVGMaskElement.cpp
index 6b75527..ea11b4a 100644
--- a/WebCore/svg/SVGMaskElement.cpp
+++ b/WebCore/svg/SVGMaskElement.cpp
@@ -55,6 +55,7 @@ SVGMaskElement::SVGMaskElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight, "-10%")
     , m_width(this, SVGNames::widthAttr, LengthModeWidth, "120%")
     , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
+    , m_href(this, XLinkNames::hrefAttr)
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
diff --git a/WebCore/svg/SVGMaskElement.h b/WebCore/svg/SVGMaskElement.h
index f2b7ae5..a152093 100644
--- a/WebCore/svg/SVGMaskElement.h
+++ b/WebCore/svg/SVGMaskElement.h
@@ -65,6 +65,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         RefPtr<SVGResourceMasker> m_masker;
     };
 
diff --git a/WebCore/svg/SVGNumberList.cpp b/WebCore/svg/SVGNumberList.cpp
index be1e895..4e904f4 100644
--- a/WebCore/svg/SVGNumberList.cpp
+++ b/WebCore/svg/SVGNumberList.cpp
@@ -41,6 +41,7 @@ SVGNumberList::~SVGNumberList()
 void SVGNumberList::parse(const String& value)
 {
     ExceptionCode ec = 0;
+    clear(ec);
 
     float number = 0.0f;
    
diff --git a/WebCore/svg/SVGParserUtilities.cpp b/WebCore/svg/SVGParserUtilities.cpp
index 6f696e6..c05e0f8 100644
--- a/WebCore/svg/SVGParserUtilities.cpp
+++ b/WebCore/svg/SVGParserUtilities.cpp
@@ -509,8 +509,8 @@ bool SVGPathParser::parseSVG(const String& s, bool process)
             return true;
 
         // Check for remaining coordinates in the current command.
-        if ((*ptr == '+' || *ptr == '-' || (*ptr >= '0' && *ptr <= '9')) &&
-            (command != 'z' && command != 'Z')) {
+        if ((*ptr == '+' || *ptr == '-' || *ptr == '.' || (*ptr >= '0' && *ptr <= '9'))
+            && (command != 'z' && command != 'Z')) {
             if (command == 'M')
                 command = 'L';
             else if (command == 'm')
diff --git a/WebCore/svg/SVGPatternElement.cpp b/WebCore/svg/SVGPatternElement.cpp
index befca85..ef2b29e 100644
--- a/WebCore/svg/SVGPatternElement.cpp
+++ b/WebCore/svg/SVGPatternElement.cpp
@@ -64,6 +64,7 @@ SVGPatternElement::SVGPatternElement(const QualifiedName& tagName, Document* doc
     , m_patternUnits(this, SVGNames::patternUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
     , m_patternContentUnits(this, SVGNames::patternContentUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
     , m_patternTransform(this, SVGNames::patternTransformAttr, SVGTransformList::create(SVGNames::patternTransformAttr))
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGPatternElement.h b/WebCore/svg/SVGPatternElement.h
index 2e6399c..46b031e 100644
--- a/WebCore/svg/SVGPatternElement.h
+++ b/WebCore/svg/SVGPatternElement.h
@@ -70,6 +70,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternContentUnitsAttrString, int, PatternContentUnits, patternContentUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternTransformAttrString, SVGTransformList, PatternTransform, patternTransform)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         mutable RefPtr<SVGPaintServerPattern> m_resource;
 
     private:
diff --git a/WebCore/svg/SVGSVGElement.cpp b/WebCore/svg/SVGSVGElement.cpp
index fcecd8c..29e72b8 100644
--- a/WebCore/svg/SVGSVGElement.cpp
+++ b/WebCore/svg/SVGSVGElement.cpp
@@ -307,15 +307,14 @@ void SVGSVGElement::svgAttributeChanged(const QualifiedName& attrName)
         renderer()->setNeedsLayout(true);
 }
 
-unsigned long SVGSVGElement::suspendRedraw(unsigned long /* max_wait_milliseconds */)
+unsigned SVGSVGElement::suspendRedraw(unsigned /* maxWaitMilliseconds */)
 {
     // FIXME: Implement me (see bug 11275)
     return 0;
 }
 
-void SVGSVGElement::unsuspendRedraw(unsigned long /* suspend_handle_id */, ExceptionCode&)
+void SVGSVGElement::unsuspendRedraw(unsigned /* suspendHandleId */)
 {
-    // if suspend_handle_id is not found, throw exception
     // FIXME: Implement me (see bug 11275)
 }
 
diff --git a/WebCore/svg/SVGSVGElement.h b/WebCore/svg/SVGSVGElement.h
index f92ed72..223ebf6 100644
--- a/WebCore/svg/SVGSVGElement.h
+++ b/WebCore/svg/SVGSVGElement.h
@@ -94,8 +94,8 @@ namespace WebCore {
         float getCurrentTime() const;
         void setCurrentTime(float seconds);
 
-        unsigned long suspendRedraw(unsigned long max_wait_milliseconds);
-        void unsuspendRedraw(unsigned long suspend_handle_id, ExceptionCode&);
+        unsigned suspendRedraw(unsigned maxWaitMilliseconds);
+        void unsuspendRedraw(unsigned suspendHandleId);
         void unsuspendRedrawAll();
         void forceRedraw();
 
diff --git a/WebCore/svg/SVGSVGElement.idl b/WebCore/svg/SVGSVGElement.idl
index 32b4e3c..b188894 100644
--- a/WebCore/svg/SVGSVGElement.idl
+++ b/WebCore/svg/SVGSVGElement.idl
@@ -56,8 +56,7 @@ module svg {
         readonly attribute SVGPoint currentTranslate;
 
         unsigned long suspendRedraw(in unsigned long maxWaitMilliseconds);
-        void unsuspendRedraw(in unsigned long suspendHandleId)
-            setter raises(DOMException);
+        void unsuspendRedraw(in unsigned long suspendHandleId);
         void unsuspendRedrawAll();
         void forceRedraw();
         void pauseAnimations();
diff --git a/WebCore/svg/SVGScriptElement.cpp b/WebCore/svg/SVGScriptElement.cpp
index 2ecf912..5e946ce 100644
--- a/WebCore/svg/SVGScriptElement.cpp
+++ b/WebCore/svg/SVGScriptElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGScriptElement.h"
 
 #include "Document.h"
+#include "Event.h"
 #include "EventNames.h"
 #include "MappedAttribute.h"
 #include "SVGNames.h"
@@ -36,6 +37,7 @@ SVGScriptElement::SVGScriptElement(const QualifiedName& tagName, Document* doc,
     : SVGElement(tagName, doc)
     , SVGURIReference()
     , SVGExternalResourcesRequired()
+    , m_href(this, XLinkNames::hrefAttr)
     , m_data(this, this)
 {
     m_data.setCreatedByParser(createdByParser);
@@ -209,7 +211,7 @@ void SVGScriptElement::dispatchLoadEvent()
 
 void SVGScriptElement::dispatchErrorEvent()
 {
-    dispatchEvent(eventNames().errorEvent, true, false);
+    dispatchEvent(Event::create(eventNames().errorEvent, true, false));
 }
 
 }
diff --git a/WebCore/svg/SVGScriptElement.h b/WebCore/svg/SVGScriptElement.h
index f2efc8e..0fd85ff 100644
--- a/WebCore/svg/SVGScriptElement.h
+++ b/WebCore/svg/SVGScriptElement.h
@@ -73,6 +73,10 @@ namespace WebCore {
         virtual void dispatchErrorEvent();
 
     private:
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGScriptElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+    private:
         ScriptElementData m_data;
         String m_type;
     };
diff --git a/WebCore/svg/SVGStopElement.h b/WebCore/svg/SVGStopElement.h
index bbfd770..5d14a40 100644
--- a/WebCore/svg/SVGStopElement.h
+++ b/WebCore/svg/SVGStopElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -24,6 +22,7 @@
 #define SVGStopElement_h
 
 #if ENABLE(SVG)
+#include "SVGNames.h"
 #include "SVGStyledElement.h"
 
 namespace WebCore {
@@ -33,13 +32,13 @@ namespace WebCore {
         SVGStopElement(const QualifiedName&, Document*);
         virtual ~SVGStopElement();
 
+    private:
         virtual bool isGradientStop() const { return true; }
 
         virtual void parseMappedAttribute(MappedAttribute*);
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGStopElement, SVGNames::stopTagString, SVGNames::offsetAttrString, float, Offset, offset)
     };
 
diff --git a/WebCore/svg/SVGStyleElement.cpp b/WebCore/svg/SVGStyleElement.cpp
index 72f70e6..31f5920 100644
--- a/WebCore/svg/SVGStyleElement.cpp
+++ b/WebCore/svg/SVGStyleElement.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.
+    Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
     This file is part of the KDE project
 
@@ -29,31 +30,21 @@
 #include "CSSStyleSheet.h"
 #include "Document.h"
 #include "ExceptionCode.h"
-#include "HTMLNames.h"
 #include "MappedAttribute.h"
-#include "XMLNames.h"
+#include "SVGNames.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-using namespace HTMLNames;
+using namespace SVGNames;
 
 SVGStyleElement::SVGStyleElement(const QualifiedName& tagName, Document* doc, bool createdByParser)
      : SVGElement(tagName, doc)
+     , SVGLangSpace()
      , m_createdByParser(createdByParser)
 {
 }
 
-const AtomicString& SVGStyleElement::xmlspace() const
-{
-    return getAttribute(XMLNames::spaceAttr);
-}
-
-void SVGStyleElement::setXmlspace(const AtomicString&, ExceptionCode& ec)
-{
-    ec = NO_MODIFICATION_ALLOWED_ERR;
-}
-
 const AtomicString& SVGStyleElement::type() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, defaultValue, ("text/css"));
@@ -61,9 +52,9 @@ const AtomicString& SVGStyleElement::type() const
     return n.isNull() ? defaultValue : n;
 }
 
-void SVGStyleElement::setType(const AtomicString&, ExceptionCode& ec)
+void SVGStyleElement::setType(const AtomicString& type, ExceptionCode& ec)
 {
-    ec = NO_MODIFICATION_ALLOWED_ERR;
+    setAttribute(typeAttr, type, ec);
 }
 
 const AtomicString& SVGStyleElement::media() const
@@ -73,9 +64,9 @@ const AtomicString& SVGStyleElement::media() const
     return n.isNull() ? defaultValue : n;
 }
 
-void SVGStyleElement::setMedia(const AtomicString&, ExceptionCode& ec)
+void SVGStyleElement::setMedia(const AtomicString& media, ExceptionCode& ec)
 {
-    ec = NO_MODIFICATION_ALLOWED_ERR;
+    setAttribute(mediaAttr, media, ec);
 }
 
 String SVGStyleElement::title() const
@@ -83,17 +74,20 @@ String SVGStyleElement::title() const
     return getAttribute(titleAttr);
 }
 
-void SVGStyleElement::setTitle(const AtomicString&, ExceptionCode& ec)
+void SVGStyleElement::setTitle(const AtomicString& title, ExceptionCode& ec)
 {
-    ec = NO_MODIFICATION_ALLOWED_ERR;
+    setAttribute(titleAttr, title, ec);
 }
 
 void SVGStyleElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == titleAttr && m_sheet)
         m_sheet->setTitle(attr->value());
-    else
+    else {
+        if (SVGLangSpace::parseMappedAttribute(attr))
+            return;
         SVGElement::parseMappedAttribute(attr);
+    }
 }
 
 void SVGStyleElement::finishParsingChildren()
diff --git a/WebCore/svg/SVGStyleElement.h b/WebCore/svg/SVGStyleElement.h
index 48afdb1..3853fb3 100644
--- a/WebCore/svg/SVGStyleElement.h
+++ b/WebCore/svg/SVGStyleElement.h
@@ -25,11 +25,14 @@
 #if ENABLE(SVG)
 
 #include <SVGElement.h>
+#include "SVGLangSpace.h"
 #include "StyleElement.h"
 
 namespace WebCore {
 
-    class SVGStyleElement : public SVGElement, public StyleElement {
+    class SVGStyleElement : public SVGElement,
+                            public SVGLangSpace,
+                            public StyleElement {
     public:
         SVGStyleElement(const QualifiedName&, Document*, bool createdByParser);
 
@@ -41,10 +44,6 @@ namespace WebCore {
 
         virtual void finishParsingChildren();
 
-        // 'SVGStyleElement' functions
-        const AtomicString& xmlspace() const;
-        void setXmlspace(const AtomicString&, ExceptionCode&);
-
         virtual bool sheetLoaded();
 
         virtual const AtomicString& type() const;
diff --git a/WebCore/svg/SVGStyleElement.idl b/WebCore/svg/SVGStyleElement.idl
index e87b79f..e47ed1d 100644
--- a/WebCore/svg/SVGStyleElement.idl
+++ b/WebCore/svg/SVGStyleElement.idl
@@ -26,9 +26,8 @@
 
 module svg {
 
-    interface [Conditional=SVG] SVGStyleElement : SVGElement {
-                 attribute core::DOMString xmlspace
-                     setter raises(DOMException);
+    interface [Conditional=SVG] SVGStyleElement : SVGElement,
+                                                  SVGLangSpace {
                  attribute core::DOMString type
                      setter raises(DOMException);
                  attribute core::DOMString media
diff --git a/WebCore/svg/SVGTRefElement.cpp b/WebCore/svg/SVGTRefElement.cpp
index 872e7c8..5b8640a 100644
--- a/WebCore/svg/SVGTRefElement.cpp
+++ b/WebCore/svg/SVGTRefElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 SVGTRefElement::SVGTRefElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
     , SVGURIReference()
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGTRefElement.h b/WebCore/svg/SVGTRefElement.h
index 88eeef1..63f5fac 100644
--- a/WebCore/svg/SVGTRefElement.h
+++ b/WebCore/svg/SVGTRefElement.h
@@ -45,6 +45,9 @@ namespace WebCore {
 
     private:
         void updateReferencedText();
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTRefElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGTextPathElement.cpp b/WebCore/svg/SVGTextPathElement.cpp
index 54a4aa2..ebbb628 100644
--- a/WebCore/svg/SVGTextPathElement.cpp
+++ b/WebCore/svg/SVGTextPathElement.cpp
@@ -41,6 +41,7 @@ SVGTextPathElement::SVGTextPathElement(const QualifiedName& tagName, Document* d
     , m_startOffset(this, SVGNames::startOffsetAttr, LengthModeOther)
     , m_method(this, SVGNames::methodAttr, SVG_TEXTPATH_METHODTYPE_ALIGN)
     , m_spacing(this, SVGNames::spacingAttr, SVG_TEXTPATH_SPACINGTYPE_EXACT)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGTextPathElement.h b/WebCore/svg/SVGTextPathElement.h
index 4e8899a..3266814 100644
--- a/WebCore/svg/SVGTextPathElement.h
+++ b/WebCore/svg/SVGTextPathElement.h
@@ -71,6 +71,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::startOffsetAttrString, SVGLength, StartOffset, startOffset)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::methodAttrString, int, Method, method)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::spacingAttrString, int, Spacing, spacing)
+    
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGURIReference.cpp b/WebCore/svg/SVGURIReference.cpp
index 8871229..24febc3 100644
--- a/WebCore/svg/SVGURIReference.cpp
+++ b/WebCore/svg/SVGURIReference.cpp
@@ -30,7 +30,6 @@ namespace WebCore {
 char SVGURIReferenceIdentifier[] = "SVGURIReference";
 
 SVGURIReference::SVGURIReference()
-    : m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGURIReference.h b/WebCore/svg/SVGURIReference.h
index 35ac640..812fb59 100644
--- a/WebCore/svg/SVGURIReference.h
+++ b/WebCore/svg/SVGURIReference.h
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+    Copyright (C) 2004, 2005, 2008, 2009 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
     This file is part of the KDE project
@@ -42,10 +42,8 @@ namespace WebCore {
 
         static String getTarget(const String& url);
 
-        virtual const SVGElement* contextElement() const = 0;
-
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGURIReference, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+    protected:
+        virtual void setHrefBaseValue(SVGAnimatedTypeValue<String>::DecoratedType type) = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
index b73a692..8a2d65f 100644
--- a/WebCore/svg/SVGUseElement.cpp
+++ b/WebCore/svg/SVGUseElement.cpp
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
 
     This file is part of the KDE project
 
@@ -64,6 +65,7 @@ SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
@@ -158,6 +160,9 @@ void SVGUseElement::childrenChanged(bool changedByParser, Node* beforeChange, No
  
 static bool shadowTreeContainsChangedNodes(SVGElementInstance* target)
 {
+    if (!target)      // when use is referencing an non-existing element, there will be no Instance tree built
+        return false;
+
     if (target->needsUpdate())
         return true;
 
@@ -324,7 +329,7 @@ void SVGUseElement::buildPendingResource()
     // Spec: If the 'use' element references a simple graphics element such as a 'rect', then there is only a
     // single SVGElementInstance object, and the correspondingElement attribute on this SVGElementInstance object
     // is the SVGRectElement that corresponds to the referenced 'rect' element.
-    m_targetElementInstance = new SVGElementInstance(this, target);
+    m_targetElementInstance = SVGElementInstance::create(this, target);
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
     bool foundProblem = false;
@@ -474,17 +479,17 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
             continue;
 
         // Create SVGElementInstance object, for both container/non-container nodes.
-        SVGElementInstance* instancePtr = new SVGElementInstance(this, element);
-        targetInstance->appendChild(instancePtr);
+        RefPtr<SVGElementInstance> instancePtr = SVGElementInstance::create(this, element);
+        targetInstance->appendChild(instancePtr.get());
 
         // Enter recursion, appending new instance tree nodes to the "instance" object.
         if (element->hasChildNodes())
-            buildInstanceTree(element, instancePtr, foundProblem);
+            buildInstanceTree(element, instancePtr.get(), foundProblem);
 
         // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
         // object, the instance tree will contain recursive expansion of the indirect references to form a complete tree.
         if (element->hasTagName(SVGNames::useTag))
-            handleDeepUseReferencing(static_cast<SVGUseElement*>(element), instancePtr, foundProblem);
+            handleDeepUseReferencing(static_cast<SVGUseElement*>(element), instancePtr.get(), foundProblem);
     }
 
     // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
@@ -524,11 +529,11 @@ void SVGUseElement::handleDeepUseReferencing(SVGUseElement* use, SVGElementInsta
     }
 
     // Create an instance object, even if we're dealing with a cycle
-    SVGElementInstance* newInstance = new SVGElementInstance(this, target);
+    RefPtr<SVGElementInstance> newInstance = SVGElementInstance::create(this, target);
     targetInstance->appendChild(newInstance);
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
-    buildInstanceTree(target, newInstance, foundProblem);
+    buildInstanceTree(target, newInstance.get(), foundProblem);
 }
 
 void SVGUseElement::alterShadowTreeForSVGTag(SVGElement* target)
@@ -768,18 +773,18 @@ void SVGUseElement::transferEventListenersToShadowTree(SVGElementInstance* targe
     ASSERT(originalElement);
 
     if (SVGElement* shadowTreeElement = target->shadowTreeElement()) {
-        const RegisteredEventListenerVector& listeners = originalElement->eventListeners();
-        size_t size = listeners.size();
-        for (size_t i = 0; i < size; ++i) {
-            const RegisteredEventListener& r = *listeners[i];
-            EventListener* listener = r.listener();
-            ASSERT(listener);
-
-            // Event listeners created from markup have already been transfered to the shadow tree during cloning!
-            if (listener->wasCreatedFromMarkup())
-                continue;
-
-            shadowTreeElement->addEventListener(r.eventType(), listener, r.useCapture());
+        if (EventTargetData* d = originalElement->eventTargetData()) {
+            EventListenerMap& map = d->eventListenerMap;
+            EventListenerMap::iterator end = map.end();
+            for (EventListenerMap::iterator it = map.begin(); it != end; ++it) {
+                EventListenerVector& entry = it->second;
+                for (size_t i = 0; i < entry.size(); ++i) {
+                    // Event listeners created from markup have already been transfered to the shadow tree during cloning.
+                    if (entry[i].listener->wasCreatedFromMarkup())
+                        continue;
+                    shadowTreeElement->addEventListener(it->first, entry[i].listener, entry[i].useCapture);
+                }
+            }
         }
     }
 
diff --git a/WebCore/svg/SVGUseElement.h b/WebCore/svg/SVGUseElement.h
index 1e5b81c..3eedf21 100644
--- a/WebCore/svg/SVGUseElement.h
+++ b/WebCore/svg/SVGUseElement.h
@@ -77,6 +77,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
     private:
         // Instance tree handling
         void buildInstanceTree(SVGElement* target, SVGElementInstance* targetInstance, bool& foundCycle);
diff --git a/WebCore/svg/animation/SVGSMILElement.cpp b/WebCore/svg/animation/SVGSMILElement.cpp
index 63a0d82..3957b81 100644
--- a/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/WebCore/svg/animation/SVGSMILElement.cpp
@@ -61,6 +61,15 @@ public:
         return adoptRef(new ConditionEventListener(animation, eventBase, condition));
     }
 
+    static const ConditionEventListener* cast(const EventListener* listener)
+    {
+        return listener->type() == ConditionEventListenerType
+            ? static_cast<const ConditionEventListener*>(listener)
+            : 0;
+    }
+
+    virtual bool operator==(const EventListener& other);
+
     void unregister()
     {
         // If this has only one ref then the event base is dead already and we don't need to remove ourself.
@@ -68,25 +77,37 @@ public:
             m_eventBase->removeEventListener(m_condition->m_name, this, false);
     }
 
-    virtual void handleEvent(Event* event, bool) 
-    {
-        m_animation->handleConditionEvent(event, m_condition);
-    }
-
 private:
     ConditionEventListener(SVGSMILElement* animation, Element* eventBase, SVGSMILElement::Condition* condition) 
-        : m_animation(animation)
+        : EventListener(ConditionEventListenerType)
+        , m_animation(animation)
         , m_condition(condition) 
         , m_eventBase(eventBase)
     {
         m_eventBase->addEventListener(m_condition->m_name, this, false);
     }
 
+    virtual void handleEvent(ScriptExecutionContext*, Event*);
+
     SVGSMILElement* m_animation;
     SVGSMILElement::Condition* m_condition;
     Element* m_eventBase;
 };
-    
+
+bool ConditionEventListener::operator==(const EventListener& listener)
+{
+    if (const ConditionEventListener* conditionEventListener = ConditionEventListener::cast(&listener))
+        return m_animation == conditionEventListener->m_animation
+               && m_condition == conditionEventListener->m_condition
+               && m_eventBase == conditionEventListener->m_eventBase;
+    return false;
+}
+
+void ConditionEventListener::handleEvent(ScriptExecutionContext*, Event* event) 
+{
+    m_animation->handleConditionEvent(event, m_condition);
+}
+
 SVGSMILElement::Condition::Condition(Type type, BeginOrEnd beginOrEnd, const String& baseID, const String& name, SMILTime offset, int repeats)
     : m_type(type)
     , m_beginOrEnd(beginOrEnd)
diff --git a/WebCore/svg/graphics/SVGImage.cpp b/WebCore/svg/graphics/SVGImage.cpp
index 64eb0e7..dc63582 100644
--- a/WebCore/svg/graphics/SVGImage.cpp
+++ b/WebCore/svg/graphics/SVGImage.cpp
@@ -228,26 +228,35 @@ bool SVGImage::dataChanged(bool allDataReceived)
     if (allDataReceived) {
         static FrameLoaderClient* dummyFrameLoaderClient =  new EmptyFrameLoaderClient;
         static EditorClient* dummyEditorClient = new EmptyEditorClient;
+#if ENABLE(CONTEXT_MENUS)
         static ContextMenuClient* dummyContextMenuClient = new EmptyContextMenuClient;
+#else
+        static ContextMenuClient* dummyContextMenuClient = 0;
+#endif
+#if ENABLE(DRAG_SUPPORT)
         static DragClient* dummyDragClient = new EmptyDragClient;
+#else
+        static DragClient* dummyDragClient = 0;
+#endif
         static InspectorClient* dummyInspectorClient = new EmptyInspectorClient;
+        static PluginHalterClient* dummyPluginHalterClient = new EmptyPluginHalterClient;
 
         m_chromeClient.set(new SVGImageChromeClient(this));
         
         // FIXME: If this SVG ends up loading itself, we might leak the world.
-        // THe comment said that the Cache code does not know about CachedImages
+        // The comment said that the Cache code does not know about CachedImages
         // holding Frames and won't know to break the cycle. But 
-        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient));
+        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, dummyPluginHalterClient));
         m_page->settings()->setJavaScriptEnabled(false);
         m_page->settings()->setPluginsEnabled(false);
 
         RefPtr<Frame> frame = Frame::create(m_page.get(), 0, dummyFrameLoaderClient);
         frame->setView(FrameView::create(frame.get()));
         frame->init();
-        ResourceRequest fakeRequest(KURL(""));
+        ResourceRequest fakeRequest(KURL(ParsedURLString, ""));
         FrameLoader* loader = frame->loader();
         loader->load(fakeRequest, false); // Make sure the DocumentLoader is created
-        loader->cancelContentPolicyCheck(); // cancel any policy checks
+        loader->policyChecker()->cancelCheck(); // cancel any policy checks
         loader->commitProvisionalLoad(0);
         loader->setResponseMIMEType("image/svg+xml");
         loader->begin(KURL()); // create the empty document
diff --git a/WebCore/svg/graphics/SVGResourceMasker.cpp b/WebCore/svg/graphics/SVGResourceMasker.cpp
index d6c401b..97467c1 100644
--- a/WebCore/svg/graphics/SVGResourceMasker.cpp
+++ b/WebCore/svg/graphics/SVGResourceMasker.cpp
@@ -76,8 +76,8 @@ void SVGResourceMasker::applyMask(GraphicsContext* context, const FloatRect& bou
     if (!luminancedImage)
         return;
 
-    PassRefPtr<CanvasPixelArray> srcPixelArray(m_mask->getImageData(intImageRect)->data());
-    PassRefPtr<ImageData> destImageData(luminancedImage->getImageData(intImageRect));
+    PassRefPtr<CanvasPixelArray> srcPixelArray(m_mask->getUnmultipliedImageData(intImageRect)->data());
+    PassRefPtr<ImageData> destImageData(luminancedImage->getUnmultipliedImageData(intImageRect));
 
     for (unsigned pixelOffset = 0; pixelOffset < srcPixelArray->length(); pixelOffset++) {
         unsigned pixelByteOffset = pixelOffset * 4;
@@ -93,7 +93,7 @@ void SVGResourceMasker::applyMask(GraphicsContext* context, const FloatRect& bou
         destImageData->data()->set(pixelByteOffset + 3, luma);
     }
 
-    luminancedImage->putImageData(destImageData.get(), intImageRect, IntPoint(0, 0));
+    luminancedImage->putUnmultipliedImageData(destImageData.get(), intImageRect, IntPoint(0, 0));
 
     context->clipToImageBuffer(m_maskRect, luminancedImage.get());
 }
diff --git a/WebCore/svg/svgtags.in b/WebCore/svg/svgtags.in
index 6ac430d..471c77b 100644
--- a/WebCore/svg/svgtags.in
+++ b/WebCore/svg/svgtags.in
@@ -3,114 +3,111 @@ namespaceURI="http://www.w3.org/2000/svg"
 guardFactoryWith="ENABLE(SVG)"
 exportStrings
 
-a
+a createWithNew
 #if ENABLE_SVG_FONTS
-altGlyph
+altGlyph createWithNew
 #endif
 #if 0
-altGlyphDef
-altGlyphItem
+altGlyphDef createWithNew
+altGlyphItem createWithNew
 #endif
 #if ENABLE_SVG_ANIMATION
-animate
-animateColor
-animateMotion JSInterfaceName=SVGElement
-animateTransform
-set
+animate createWithNew
+animateColor createWithNew
+animateMotion JSInterfaceName=SVGElement, createWithNew
+animateTransform createWithNew
+set createWithNew
 #endif
-circle
-clipPath
+circle createWithNew
+clipPath createWithNew
 #if 0
-color_profile
+color_profile createWithNew
 #endif
-cursor
-#if ENABLE_SVG_FONTS
-definition_src
-#endif
-defs
-desc
-ellipse
+cursor createWithNew
+defs createWithNew
+desc createWithNew
+ellipse createWithNew
 #if ENABLE_FILTERS
-feBlend
-feColorMatrix
-feComponentTransfer
-feComposite
+feBlend createWithNew
+feColorMatrix createWithNew
+feComponentTransfer createWithNew
+feComposite createWithNew
 #if 0
-feConvolveMatrix
+feConvolveMatrix createWithNew
 #endif
-feDiffuseLighting
-feDisplacementMap
-feDistantLight
-feFlood
-feFuncA
-feFuncB
-feFuncG
-feFuncR
-feGaussianBlur
-feImage
-feMerge
-feMergeNode
+feDiffuseLighting createWithNew
+feDisplacementMap createWithNew
+feDistantLight createWithNew
+feFlood createWithNew
+feFuncA createWithNew
+feFuncB createWithNew
+feFuncG createWithNew
+feFuncR createWithNew
+feGaussianBlur createWithNew
+feImage createWithNew
+feMerge createWithNew
+feMergeNode createWithNew
 #if 0
-feMorphology
+feMorphology createWithNew
 #endif
-feOffset
-fePointLight
-feSpecularLighting
-feSpotLight
-feTile
-feTurbulence
-filter
+feOffset createWithNew
+fePointLight createWithNew
+feSpecularLighting createWithNew
+feSpotLight createWithNew
+feTile createWithNew
+feTurbulence createWithNew
+filter createWithNew
 #endif
 #if ENABLE_SVG_FONTS
-font
-font_face
-font_face_format
-font_face_name
-font_face_src
-font_face_uri
+font createWithNew
+font_face createWithNew
+font_face_format createWithNew
+font_face_name createWithNew
+font_face_src createWithNew
+font_face_uri createWithNew
 #endif
 #if ENABLE_SVG_FOREIGN_OBJECT
-foreignObject
+foreignObject createWithNew
 #endif
-g
+g createWithNew
 #if ENABLE_SVG_FONTS
-glyph
+glyph createWithNew
 #endif
 #if 0
-glyphRef
+glyphRef createWithNew
 #endif
 #if ENABLE_SVG_FONTS
-hkern interfaceName=SVGHKernElement, JSInterfaceName=SVGElement
+hkern interfaceName=SVGHKernElement, JSInterfaceName=SVGElement, createWithNew
 #endif
-image
-line
-linearGradient
-marker
-mask
-metadata
+image createWithNew
+line createWithNew
+linearGradient createWithNew
+marker createWithNew
+mask createWithNew
+metadata createWithNew
 #if ENABLE_SVG_FONTS
-missing_glyph
+missing_glyph createWithNew
 #endif
-mpath interfaceName=SVGMPathElement, JSInterfaceName=SVGElement
-path
-pattern
-polygon
-polyline
-radialGradient
-rect
-script constructorNeedsCreatedByParser
-stop
-style constructorNeedsCreatedByParser
-svg interfaceName=SVGSVGElement
-switch
-symbol
-text
-textPath
-title
-tref interfaceName=SVGTRefElement
-tspan interfaceName=SVGTSpanElement
-use
-view
+mpath interfaceName=SVGMPathElement, JSInterfaceName=SVGElement, createWithNew
+path createWithNew
+pattern createWithNew
+polygon createWithNew
+polyline createWithNew
+radialGradient createWithNew
+rect createWithNew
+script constructorNeedsCreatedByParser, createWithNew
+stop createWithNew
+style constructorNeedsCreatedByParser, createWithNew
+svg interfaceName=SVGSVGElement, createWithNew
+switch createWithNew
+symbol createWithNew
+text createWithNew
+textPath createWithNew
+title createWithNew
+tref interfaceName=SVGTRefElement, createWithNew
+tspan interfaceName=SVGTSpanElement, createWithNew
+use createWithNew
+view createWithNew
 #if 0
-vkern interfaceName=SVGVKernElement
+vkern interfaceName=SVGVKernElement, createWithNew
 #endif
diff --git a/WebCore/webcore-wx.bkl b/WebCore/webcore-wx.bkl
index b31a178..35ea9d4 100644
--- a/WebCore/webcore-wx.bkl
+++ b/WebCore/webcore-wx.bkl
@@ -58,7 +58,6 @@ wxWebCore port Bakefile project file.
           platform/graphics/wx/GradientWx.cpp
           platform/graphics/wx/GraphicsContextWx.cpp
           platform/graphics/wx/ImageBufferWx.cpp
-          platform/graphics/wx/ImageSourceWx.cpp
           platform/graphics/wx/ImageWx.cpp
           platform/graphics/wx/IntPointWx.cpp
           platform/graphics/wx/IntRectWx.cpp
@@ -112,17 +111,20 @@ wxWebCore port Bakefile project file.
             <if cond="WX_PORT=='gtk2'">
                 platform/wx/wxcode/gtk/fontprops.cpp
                 platform/wx/wxcode/gtk/non-kerned-drawing.cpp
+                platform/wx/wxcode/gtk/scrollbar_render.cpp
                 platform/wx/SharedTimerWx.cpp
             </if>
             <if cond="PLATFORM_OS=='mac'">
                 platform/mac/PurgeableBufferMac.cpp
                 platform/wx/wxcode/mac/carbon/fontprops.cpp
                 platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
+                platform/wx/wxcode/mac/carbon/scrollbar_render.cpp
                 platform/wx/SharedTimerWx.cpp
             </if>
             <if cond="WX_PORT=='msw'">
                 platform/wx/wxcode/win/fontprops.cpp
                 platform/wx/wxcode/win/non-kerned-drawing.cpp
+                platform/wx/wxcode/win/scrollbar_render.cpp
                 <!-- grab the windows port's SharedTimer implementation -->
                 platform/win/SharedTimerWin.cpp
                 page/win/PageWin.cpp
diff --git a/WebCore/websockets/WebSocket.cpp b/WebCore/websockets/WebSocket.cpp
index 999c1ff..16211a7 100644
--- a/WebCore/websockets/WebSocket.cpp
+++ b/WebCore/websockets/WebSocket.cpp
@@ -34,13 +34,58 @@
 
 #include "WebSocket.h"
 
+#include "CString.h"
+#include "DOMWindow.h"
 #include "Event.h"
 #include "EventException.h"
 #include "EventListener.h"
+#include "EventNames.h"
+#include "Logging.h"
+#include "MessageEvent.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
+#include "WebSocketChannel.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
+class ProcessWebSocketEventTask : public ScriptExecutionContext::Task {
+public:
+    typedef void (WebSocket::*Method)(Event*);
+    static PassRefPtr<ProcessWebSocketEventTask> create(PassRefPtr<WebSocket> webSocket, PassRefPtr<Event> event)
+    {
+        return adoptRef(new ProcessWebSocketEventTask(webSocket, event));
+    }
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        ExceptionCode ec = 0;
+        m_webSocket->dispatchEvent(m_event.get(), ec);
+        ASSERT(!ec);
+    }
+
+  private:
+    ProcessWebSocketEventTask(PassRefPtr<WebSocket> webSocket, PassRefPtr<Event> event)
+        : m_webSocket(webSocket)
+        , m_event(event) { }
+
+    RefPtr<WebSocket> m_webSocket;
+    RefPtr<Event> m_event;
+};
+
+static bool isValidProtocolString(const WebCore::String& protocol)
+{
+    if (protocol.isNull())
+        return true;
+    if (protocol.isEmpty())
+        return false;
+    const UChar* characters = protocol.characters();
+    for (size_t i = 0; i < protocol.length(); i++) {
+        if (characters[i] < 0x21 || characters[i] > 0x7E)
+            return false;
+    }
+    return true;
+}
+
 WebSocket::WebSocket(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_state(CONNECTING)
@@ -59,39 +104,49 @@ void WebSocket::connect(const KURL& url, ExceptionCode& ec)
 
 void WebSocket::connect(const KURL& url, const String& protocol, ExceptionCode& ec)
 {
+    LOG(Network, "WebSocket %p connect to %s protocol=%s", this, url.string().utf8().data(), protocol.utf8().data());
     m_url = url;
     m_protocol = protocol;
 
     if (!m_url.protocolIs("ws") && !m_url.protocolIs("wss")) {
+        LOG_ERROR("Error: wrong url for WebSocket %s", url.string().utf8().data());
         m_state = CLOSED;
         ec = SYNTAX_ERR;
         return;
     }
-    if (!m_protocol.isNull() && m_protocol.isEmpty()) {
+    if (!isValidProtocolString(m_protocol)) {
+        LOG_ERROR("Error: wrong protocol for WebSocket %s", m_protocol.utf8().data());
         m_state = CLOSED;
         ec = SYNTAX_ERR;
         return;
     }
-    // FIXME: Check protocol is valid form.
-    // FIXME: Connect WebSocketChannel.
+    // FIXME: if m_url.port() is blocking port, raise SECURITY_ERR.
+
+    m_channel = WebSocketChannel::create(scriptExecutionContext(), this, m_url, m_protocol);
+    m_channel->connect();
 }
 
-bool WebSocket::send(const String&, ExceptionCode& ec)
+bool WebSocket::send(const String& message, ExceptionCode& ec)
 {
-    if (m_state != OPEN) {
+    LOG(Network, "WebSocket %p send %s", this, message.utf8().data());
+    if (m_state == CONNECTING) {
         ec = INVALID_STATE_ERR;
         return false;
     }
-    // FIXME: send message on WebSocketChannel.
-    return false;
+    // No exception is raised if the connection was once established but has subsequently been closed.
+    if (m_state == CLOSED)
+        return false;
+    // FIXME: check message is valid utf8.
+    return m_channel->send(message);
 }
 
 void WebSocket::close()
 {
+    LOG(Network, "WebSocket %p close", this);
     if (m_state == CLOSED)
         return;
     m_state = CLOSED;
-    // FIXME: close WebSocketChannel.
+    m_channel->close();
 }
 
 const KURL& WebSocket::url() const
@@ -106,7 +161,8 @@ WebSocket::State WebSocket::readyState() const
 
 unsigned long WebSocket::bufferedAmount() const
 {
-    // FIXME: ask platform code to get buffered amount to be sent.
+    if (m_state == OPEN)
+        return m_channel->bufferedAmount();
     return 0;
 }
 
@@ -115,58 +171,43 @@ ScriptExecutionContext* WebSocket::scriptExecutionContext() const
     return ActiveDOMObject::scriptExecutionContext();
 }
 
-void WebSocket::addEventListener(const AtomicString&, PassRefPtr<EventListener>, bool)
-{
-    // FIXME: implement this.
-}
-
-void WebSocket::removeEventListener(const AtomicString&, EventListener*, bool)
-{
-    // FIXME: implement this.
-}
-
-bool WebSocket::dispatchEvent(PassRefPtr<Event>, ExceptionCode&)
-{
-    // FIXME: implement this.
-    return false;
-}
-
 void WebSocket::didConnect()
 {
+    LOG(Network, "WebSocket %p didConnect", this);
     if (m_state != CONNECTING) {
         didClose();
         return;
     }
     m_state = OPEN;
-    dispatchOpenEvent();
+    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().openEvent, false, false)));
 }
 
 void WebSocket::didReceiveMessage(const String& msg)
 {
+    LOG(Network, "WebSocket %p didReceiveMessage %s", this, msg.utf8().data());
     if (m_state != OPEN)
         return;
-    dispatchMessageEvent(msg);
+    RefPtr<MessageEvent> evt = MessageEvent::create();
+    // FIXME: origin, lastEventId, source, messagePort.
+    evt->initMessageEvent(eventNames().messageEvent, false, false, SerializedScriptValue::create(msg), "", "", 0, 0);
+    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, evt));
 }
 
 void WebSocket::didClose()
 {
+    LOG(Network, "WebSocket %p didClose", this);
     m_state = CLOSED;
-    dispatchCloseEvent();
-}
-
-void WebSocket::dispatchOpenEvent()
-{
-    // FIXME: implement this.
+    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().closeEvent, false, false)));
 }
 
-void WebSocket::dispatchMessageEvent(const String&)
+EventTargetData* WebSocket::eventTargetData()
 {
-    // FIXME: implement this.
+    return &m_eventTargetData;
 }
 
-void WebSocket::dispatchCloseEvent()
+EventTargetData* WebSocket::ensureEventTargetData()
 {
-    // FIXME: implement this.
+    return &m_eventTargetData;
 }
 
 }  // namespace WebCore
diff --git a/WebCore/websockets/WebSocket.h b/WebCore/websockets/WebSocket.h
index 485e2cc..c5b7ee7 100644
--- a/WebCore/websockets/WebSocket.h
+++ b/WebCore/websockets/WebSocket.h
@@ -31,93 +31,92 @@
 #ifndef WebSocket_h
 #define WebSocket_h
 
+#if ENABLE(WEB_SOCKETS)
+
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include "KURL.h"
+#include "WebSocketChannelClient.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-class String;
-
-class WebSocket : public RefCounted<WebSocket>, public EventTarget, public ActiveDOMObject {
-public:
-    static PassRefPtr<WebSocket> create(ScriptExecutionContext* context) { return adoptRef(new WebSocket(context)); }
-    virtual ~WebSocket();
-
-    enum State {
-        CONNECTING = 0,
-        OPEN = 1,
-        CLOSED = 2
-    };
+    class String;
+    class WebSocketChannel;
 
-    void connect(const KURL& url, ExceptionCode&);
-    void connect(const KURL& url, const String& protocol, ExceptionCode&);
+    class WebSocket : public RefCounted<WebSocket>, public EventTarget, public ActiveDOMObject, public WebSocketChannelClient {
+    public:
+        static PassRefPtr<WebSocket> create(ScriptExecutionContext* context) { return adoptRef(new WebSocket(context)); }
+        virtual ~WebSocket();
 
-    bool send(const String& message, ExceptionCode&);
+        enum State {
+            CONNECTING = 0,
+            OPEN = 1,
+            CLOSED = 2
+        };
 
-    void close();
+        void connect(const KURL&, ExceptionCode&);
+        void connect(const KURL&, const String& protocol, ExceptionCode&);
 
-    const KURL& url() const;
-    State readyState() const;
-    unsigned long bufferedAmount() const;
+        bool send(const String& message, ExceptionCode&);
 
-    void setOnopen(PassRefPtr<EventListener> eventListener) { m_onopen = eventListener; }
-    EventListener* onopen() const { return m_onopen.get(); }
-    void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onmessage = eventListener; }
-    EventListener* onmessage() const { return m_onmessage.get(); }
-    void setOnclose(PassRefPtr<EventListener> eventListener) { m_onclose = eventListener; }
-    EventListener* onclose() const { return m_onclose.get(); }
+        void close();
 
-    // EventTarget
-    virtual WebSocket* toWebSocket() { return this; }
+        const KURL& url() const;
+        State readyState() const;
+        unsigned long bufferedAmount() const;
 
-    virtual ScriptExecutionContext* scriptExecutionContext() const;
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(open);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(close);
 
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+        // EventTarget
+        virtual WebSocket* toWebSocket() { return this; }
 
-    // ActiveDOMObject
-    // virtual bool hasPendingActivity() const;
-    // virtual void contextDestroyed();
-    // virtual bool canSuspend() const;
-    // virtual void suspend();
-    // virtual void resume();
-    // virtual void stop();
+        virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-    using RefCounted<WebSocket>::ref;
-    using RefCounted<WebSocket>::deref;
+        // ActiveDOMObject
+        //  virtual bool hasPendingActivity() const;
+        // virtual void contextDestroyed();
+        // virtual bool canSuspend() const;
+        // virtual void suspend();
+        // virtual void resume();
+        // virtual void stop();
 
-private:
-    WebSocket(ScriptExecutionContext*);
+        using RefCounted<WebSocket>::ref;
+        using RefCounted<WebSocket>::deref;
 
-    virtual void refEventTarget() { ref(); }
-    virtual void derefEventTarget() { deref(); }
+        // WebSocketChannelClient
+        virtual void didConnect();
+        virtual void didReceiveMessage(const String& msg);
+        virtual void didClose();
 
-    // WebSocketChannelClient
-    void didConnect();
-    void didReceiveMessage(const String& msg);
-    void didClose();
+    private:
+        WebSocket(ScriptExecutionContext*);
 
-    void dispatchOpenEvent();
-    void dispatchMessageEvent(const String& msg);
-    void dispatchCloseEvent();
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
-    // FIXME: add WebSocketChannel.
+        void dispatchOpenEvent(Event*);
+        void dispatchMessageEvent(Event*);
+        void dispatchCloseEvent(Event*);
 
-    RefPtr<EventListener> m_onopen;
-    RefPtr<EventListener> m_onmessage;
-    RefPtr<EventListener> m_onclose;
+        RefPtr<WebSocketChannel> m_channel;
 
-    State m_state;
-    KURL m_url;
-    String m_protocol;
-};
+        State m_state;
+        KURL m_url;
+        String m_protocol;
+        EventTargetData m_eventTargetData;
+    };
 
 }  // namespace WebCore
 
+#endif  // ENABLE(WEB_SOCKETS)
+
 #endif  // WebSocket_h
diff --git a/WebCore/websockets/WebSocket.idl b/WebCore/websockets/WebSocket.idl
index cdb916f..04606fe 100644
--- a/WebCore/websockets/WebSocket.idl
+++ b/WebCore/websockets/WebSocket.idl
@@ -31,9 +31,9 @@
 module websockets {
 
     interface [
-        CustomMarkFunction,
-        NoStaticTables,
-        Conditional=WEB_SOCKETS
+        Conditional=WEB_SOCKETS,
+        EventTarget,
+        NoStaticTables
     ] WebSocket {
         readonly attribute DOMString URL;
 
diff --git a/WebCore/websockets/WebSocketChannel.cpp b/WebCore/websockets/WebSocketChannel.cpp
new file mode 100644
index 0000000..145cd34
--- /dev/null
+++ b/WebCore/websockets/WebSocketChannel.cpp
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketChannel.h"
+
+#include "CString.h"
+#include "CookieJar.h"
+#include "Document.h"
+#include "Logging.h"
+#include "PlatformString.h"
+#include "ScriptExecutionContext.h"
+#include "SocketStreamError.h"
+#include "SocketStreamHandle.h"
+#include "StringHash.h"
+#include "WebSocketChannelClient.h"
+
+#include <wtf/Deque.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+WebSocketChannel::WebSocketChannel(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol)
+    : m_context(context)
+    , m_client(client)
+    , m_handshake(url, protocol, context)
+    , m_buffer(0)
+    , m_bufferSize(0)
+    , m_unhandledBufferSize(0)
+{
+}
+
+WebSocketChannel::~WebSocketChannel()
+{
+    fastFree(m_buffer);
+}
+
+void WebSocketChannel::connect()
+{
+    LOG(Network, "WebSocketChannel %p connect", this);
+    ASSERT(!m_handle.get());
+    m_handshake.reset();
+    m_handle = SocketStreamHandle::create(m_handshake.url(), this);
+}
+
+bool WebSocketChannel::send(const String& msg)
+{
+    LOG(Network, "WebSocketChannel %p send %s", this, msg.utf8().data());
+    Vector<char> buf;
+    buf.append('\0');  // frame type
+    buf.append(msg.utf8().data(), msg.utf8().length());
+    buf.append('\xff');  // frame end
+    if (!m_handle.get()) {
+        m_unhandledBufferSize += buf.size();
+        return false;
+    }
+    return m_handle->send(buf.data(), buf.size());
+}
+
+unsigned long WebSocketChannel::bufferedAmount() const
+{
+    LOG(Network, "WebSocketChannel %p bufferedAmount", this);
+    if (!m_handle.get())
+        return m_unhandledBufferSize;
+    return m_handle->bufferedAmount();
+}
+
+void WebSocketChannel::close()
+{
+    LOG(Network, "WebSocketChannel %p close", this);
+    if (m_handle.get())
+        m_handle->close();  // will call didClose()
+}
+
+void WebSocketChannel::willOpenStream(SocketStreamHandle*, const KURL&)
+{
+}
+
+void WebSocketChannel::willSendData(SocketStreamHandle*, const char*, int)
+{
+}
+
+void WebSocketChannel::didOpen(SocketStreamHandle* handle)
+{
+    LOG(Network, "WebSocketChannel %p didOpen", this);
+    ASSERT(handle == m_handle.get());
+    const CString& handshakeMessage = m_handshake.clientHandshakeMessage();
+    if (!handle->send(handshakeMessage.data(), handshakeMessage.length())) {
+        LOG(Network, "Error in sending handshake message.");
+        handle->close();
+    }
+}
+
+void WebSocketChannel::didClose(SocketStreamHandle* handle)
+{
+    LOG(Network, "WebSocketChannel %p didClose", this);
+    ASSERT(handle == m_handle.get() || !m_handle.get());
+    if (!m_handle.get())
+        return;
+    m_unhandledBufferSize = handle->bufferedAmount();
+    WebSocketChannelClient* client = m_client;
+    m_client = 0;
+    m_handle = 0;
+    client->didClose();
+}
+
+void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* data, int len)
+{
+    LOG(Network, "WebSocketChannel %p didReceiveData %d", this, len);
+    ASSERT(handle == m_handle.get());
+    if (!appendToBuffer(data, len)) {
+        handle->close();
+        return;
+    }
+    if (m_handshake.mode() != WebSocketHandshake::Connected) {
+        int headerLength = m_handshake.readServerHandshake(m_buffer, m_bufferSize);
+        if (headerLength <= 0)
+            return;
+        switch (m_handshake.mode()) {
+        case WebSocketHandshake::Connected:
+            if (!m_handshake.serverSetCookie().isEmpty()) {
+                if (m_context->isDocument()) {
+                    Document* document = static_cast<Document*>(m_context);
+                    if (cookiesEnabled(document))
+                        document->setCookie(m_handshake.serverSetCookie());
+                }
+            }
+            // FIXME: handle set-cookie2.
+            LOG(Network, "WebSocketChannel %p connected", this);
+            m_client->didConnect();
+            break;
+        default:
+            LOG(Network, "WebSocketChannel %p connection failed", this);
+            handle->close();
+            return;
+        }
+        skipBuffer(headerLength);
+        if (!m_buffer)
+            return;
+        LOG(Network, "remaining in read buf %ul", m_bufferSize);
+    }
+
+    const char* nextFrame = m_buffer;
+    const char* p = m_buffer;
+    const char* end = p + m_bufferSize;
+    while (p < end) {
+        unsigned char frameByte = static_cast<unsigned char>(*p++);
+        if ((frameByte & 0x80) == 0x80) {
+            int length = 0;
+            while (p < end && (*p & 0x80) == 0x80) {
+                if (length > std::numeric_limits<int>::max() / 128) {
+                    LOG(Network, "frame length overflow %d", length);
+                    handle->close();
+                    return;
+                }
+                length = length * 128 + *p & 0x7f;
+                ++p;
+            }
+            if (p + length < end) {
+                p += length;
+                nextFrame = p;
+            }
+        } else {
+            const char* msgStart = p;
+            while (p < end && *p != '\xff')
+                ++p;
+            if (p < end && *p == '\xff') {
+                if (frameByte == 0x00)
+                    m_client->didReceiveMessage(String::fromUTF8(msgStart, p - msgStart));
+                ++p;
+                nextFrame = p;
+            }
+        }
+    }
+    skipBuffer(nextFrame - m_buffer);
+}
+
+void WebSocketChannel::didFail(SocketStreamHandle* handle, const SocketStreamError&)
+{
+    LOG(Network, "WebSocketChannel %p didFail", this);
+    ASSERT(handle == m_handle.get() || !m_handle.get());
+    handle->close();
+}
+
+bool WebSocketChannel::appendToBuffer(const char* data, int len)
+{
+    char* newBuffer = 0;
+    if (tryFastMalloc(m_bufferSize + len).getValue(newBuffer)) {
+        if (m_buffer)
+            memcpy(newBuffer, m_buffer, m_bufferSize);
+        memcpy(newBuffer + m_bufferSize, data, len);
+        fastFree(m_buffer);
+        m_buffer = newBuffer;
+        m_bufferSize += len;
+        return true;
+    }
+    LOG(Network, "Too long WebSocket frame %d", m_bufferSize + len);
+    return false;
+}
+
+void WebSocketChannel::skipBuffer(int len)
+{
+    ASSERT(len <= m_bufferSize);
+    m_bufferSize -= len;
+    if (!m_bufferSize) {
+        fastFree(m_buffer);
+        m_buffer = 0;
+        return;
+    }
+    memmove(m_buffer, m_buffer + len, m_bufferSize);
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
diff --git a/WebCore/websockets/WebSocketChannel.h b/WebCore/websockets/WebSocketChannel.h
new file mode 100644
index 0000000..75f41f6
--- /dev/null
+++ b/WebCore/websockets/WebSocketChannel.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketChannel_h
+#define WebSocketChannel_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "SocketStreamHandleClient.h"
+#include "WebSocketHandshake.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class ScriptExecutionContext;
+    class String;
+    class SocketStreamHandle;
+    class SocketStreamError;
+    class WebSocketChannelClient;
+
+    class WebSocketChannel : public RefCounted<WebSocketChannel>, public SocketStreamHandleClient {
+    public:
+        static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol) { return new WebSocketChannel(context, client, url, protocol); }
+        virtual ~WebSocketChannel();
+
+        virtual void connect();
+
+        virtual bool send(const String& msg);
+        virtual unsigned long bufferedAmount() const;
+
+        virtual void close();
+
+        virtual void willOpenStream(SocketStreamHandle*, const KURL&);
+        virtual void willSendData(SocketStreamHandle*, const char*, int);
+        virtual void didOpen(SocketStreamHandle*);
+        virtual void didClose(SocketStreamHandle*);
+        virtual void didReceiveData(SocketStreamHandle*, const char*, int);
+        virtual void didFail(SocketStreamHandle*, const SocketStreamError&);
+
+    private:
+        WebSocketChannel(ScriptExecutionContext*, WebSocketChannelClient*, const KURL&, const String&);
+
+        bool appendToBuffer(const char* data, int len);
+        void skipBuffer(int len);
+
+        ScriptExecutionContext* m_context;
+        WebSocketChannelClient* m_client;
+        WebSocketHandshake m_handshake;
+        RefPtr<SocketStreamHandle> m_handle;
+        char* m_buffer;
+        int m_bufferSize;
+        unsigned long m_unhandledBufferSize;
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
+
+#endif  // WebSocketChannel_h
diff --git a/WebCore/websockets/WebSocketChannelClient.h b/WebCore/websockets/WebSocketChannelClient.h
new file mode 100644
index 0000000..463cada
--- /dev/null
+++ b/WebCore/websockets/WebSocketChannelClient.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketChannelClient_h
+#define WebSocketChannelClient_h
+
+#if ENABLE(WEB_SOCKETS)
+
+namespace WebCore {
+
+    class WebSocketChannelClient {
+    public:
+        virtual ~WebSocketChannelClient() { }
+        virtual void didConnect() { }
+        virtual void didReceiveMessage(const String&) { }
+        virtual void didClose() { }
+
+    protected:
+        WebSocketChannelClient() { }
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
+
+#endif  // WebSocketChannelClient_h
diff --git a/WebCore/websockets/WebSocketHandshake.cpp b/WebCore/websockets/WebSocketHandshake.cpp
new file mode 100644
index 0000000..691fa1c
--- /dev/null
+++ b/WebCore/websockets/WebSocketHandshake.cpp
@@ -0,0 +1,462 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketHandshake.h"
+
+#include "AtomicString.h"
+#include "CString.h"
+#include "CookieJar.h"
+#include "Document.h"
+#include "HTTPHeaderMap.h"
+#include "KURL.h"
+#include "Logging.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
+#include "StringBuilder.h"
+#include <wtf/StringExtras.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+const char webSocketServerHandshakeHeader[] = "HTTP/1.1 101 Web Socket Protocol Handshake\r\n";
+const char webSocketUpgradeHeader[] = "Upgrade: WebSocket\r\n";
+const char webSocketConnectionHeader[] = "Connection: Upgrade\r\n";
+
+static String extractResponseCode(const char* header, int len)
+{
+    const char* space1 = 0;
+    const char* space2 = 0;
+    const char* p;
+    for (p = header; p - header < len; p++) {
+        if (*p == ' ') {
+            if (!space1)
+                space1 = p;
+            else if (!space2)
+                space2 = p;
+        } else if (*p == '\n')
+            break;
+    }
+    if (p - header == len)
+        return String();
+    if (!space1 || !space2)
+        return "";
+    return String(space1 + 1, space2 - space1 - 1);
+}
+
+WebSocketHandshake::WebSocketHandshake(const KURL& url, const String& protocol, ScriptExecutionContext* context)
+    : m_url(url)
+    , m_clientProtocol(protocol)
+    , m_secure(m_url.protocolIs("wss"))
+    , m_context(context)
+    , m_mode(Incomplete)
+{
+}
+
+WebSocketHandshake::~WebSocketHandshake()
+{
+}
+
+const KURL& WebSocketHandshake::url() const
+{
+    return m_url;
+}
+
+void WebSocketHandshake::setURL(const KURL& url)
+{
+    m_url = url.copy();
+}
+
+const String WebSocketHandshake::host() const
+{
+    return m_url.host().lower();
+}
+
+const String& WebSocketHandshake::clientProtocol() const
+{
+    return m_clientProtocol;
+}
+
+void WebSocketHandshake::setClientProtocol(const String& protocol)
+{
+    m_clientProtocol = protocol;
+}
+
+bool WebSocketHandshake::secure() const
+{
+    return m_secure;
+}
+
+void WebSocketHandshake::setSecure(bool secure)
+{
+    m_secure = secure;
+}
+
+String WebSocketHandshake::clientOrigin() const
+{
+    return m_context->securityOrigin()->toString();
+}
+
+String WebSocketHandshake::clientLocation() const
+{
+    StringBuilder builder;
+    builder.append(m_secure ? "wss" : "ws");
+    builder.append("://");
+    builder.append(m_url.host().lower());
+    if (m_url.port()) {
+        if ((!m_secure && m_url.port() != 80) || (m_secure && m_url.port() != 443)) {
+            builder.append(":");
+            builder.append(String::number(m_url.port()));
+        }
+    }
+    builder.append(m_url.path());
+    return builder.toString();
+}
+
+CString WebSocketHandshake::clientHandshakeMessage() const
+{
+    StringBuilder builder;
+
+    builder.append("GET ");
+    builder.append(m_url.path());
+    if (!m_url.query().isEmpty()) {
+        builder.append("?");
+        builder.append(m_url.query());
+    }
+    builder.append(" HTTP/1.1\r\n");
+    builder.append("Upgrade: WebSocket\r\n");
+    builder.append("Connection: Upgrade\r\n");
+    builder.append("Host: ");
+    builder.append(m_url.host().lower());
+    if (m_url.port()) {
+        if ((!m_secure && m_url.port() != 80) || (m_secure && m_url.port() != 443)) {
+            builder.append(":");
+            builder.append(String::number(m_url.port()));
+        }
+    }
+    builder.append("\r\n");
+    builder.append("Origin: ");
+    builder.append(clientOrigin());
+    builder.append("\r\n");
+    if (!m_clientProtocol.isEmpty()) {
+        builder.append("WebSocket-Protocol: ");
+        builder.append(m_clientProtocol);
+        builder.append("\r\n");
+    }
+    KURL url = httpURLForAuthenticationAndCookies();
+    // FIXME: set authentication information or cookies for url.
+    // Set "Authorization: <credentials>" if authentication information exists for url.
+    if (m_context->isDocument()) {
+        Document* document = static_cast<Document*>(m_context);
+        String cookie = cookies(document, url);
+        if (!cookie.isEmpty()) {
+            builder.append("Cookie: ");
+            builder.append(cookie);
+            builder.append("\r\n");
+        }
+        // Set "Cookie2: <cookie>" if cookies 2 exists for url?
+    }
+    builder.append("\r\n");
+    return builder.toString().utf8();
+}
+
+void WebSocketHandshake::reset()
+{
+    m_mode = Incomplete;
+
+    m_wsOrigin = String();
+    m_wsLocation = String();
+    m_wsProtocol = String();
+    m_setCookie = String();
+    m_setCookie2 = String();
+}
+
+int WebSocketHandshake::readServerHandshake(const char* header, size_t len)
+{
+    m_mode = Incomplete;
+    if (len < sizeof(webSocketServerHandshakeHeader) - 1) {
+        // Just hasn't been received fully yet.
+        return -1;
+    }
+    if (!memcmp(header, webSocketServerHandshakeHeader, sizeof(webSocketServerHandshakeHeader) - 1))
+        m_mode = Normal;
+    else {
+        const String& code = extractResponseCode(header, len);
+        if (code.isNull()) {
+            LOG(Network, "short server handshake: %s", header);
+            return -1;
+        }
+        if (code.isEmpty()) {
+            LOG(Network, "no response code found: %s", header);
+            return len;
+        }
+        LOG(Network, "response code: %s", code.utf8().data());
+        if (code == "401") {
+            LOG(Network, "Authentication required");
+            return len;
+        } else {
+            LOG(Network, "Mismatch server handshake: %s", header);
+            return len;
+        }
+    }
+    const char* p = header + sizeof(webSocketServerHandshakeHeader) - 1;
+    const char* end = header + len + 1;
+
+    if (m_mode == Normal) {
+        size_t headerSize = end - p;
+        if (headerSize < sizeof(webSocketUpgradeHeader) - 1)
+            return 0;
+        if (memcmp(p, webSocketUpgradeHeader, sizeof(webSocketUpgradeHeader) - 1)) {
+            LOG(Network, "Bad upgrade header: %s", p);
+            return p - header + sizeof(webSocketUpgradeHeader) - 1;
+        }
+        p += sizeof(webSocketUpgradeHeader) - 1;
+
+        headerSize = end - p;
+        if (headerSize < sizeof(webSocketConnectionHeader) - 1)
+            return -1;
+        if (memcmp(p, webSocketConnectionHeader, sizeof(webSocketConnectionHeader) - 1)) {
+            LOG(Network, "Bad connection header: %s", p);
+            return p - header + sizeof(webSocketConnectionHeader) - 1;
+        }
+        p += sizeof(webSocketConnectionHeader) - 1;
+    }
+
+    if (!strnstr(p, "\r\n\r\n", end - p)) {
+        // Just hasn't been received fully yet.
+        return -1;
+    }
+    HTTPHeaderMap headers;
+    p = readHTTPHeaders(p, end, &headers);
+    if (!p) {
+        LOG(Network, "readHTTPHeaders failed");
+        m_mode = Failed;
+        return len;
+    }
+    if (!processHeaders(headers)) {
+        LOG(Network, "header process failed");
+        m_mode = Failed;
+        return p - header;
+    }
+    switch (m_mode) {
+    case Normal:
+        checkResponseHeaders();
+        break;
+    default:
+        m_mode = Failed;
+        break;
+    }
+    return p - header;
+}
+
+WebSocketHandshake::Mode WebSocketHandshake::mode() const
+{
+    return m_mode;
+}
+
+const String& WebSocketHandshake::serverWebSocketOrigin() const
+{
+    return m_wsOrigin;
+}
+
+void WebSocketHandshake::setServerWebSocketOrigin(const String& webSocketOrigin)
+{
+    m_wsOrigin = webSocketOrigin;
+}
+
+const String& WebSocketHandshake::serverWebSocketLocation() const
+{
+    return m_wsLocation;
+}
+
+void WebSocketHandshake::setServerWebSocketLocation(const String& webSocketLocation)
+{
+    m_wsLocation = webSocketLocation;
+}
+
+const String& WebSocketHandshake::serverWebSocketProtocol() const
+{
+    return m_wsProtocol;
+}
+
+void WebSocketHandshake::setServerWebSocketProtocol(const String& webSocketProtocol)
+{
+    m_wsProtocol = webSocketProtocol;
+}
+
+const String& WebSocketHandshake::serverSetCookie() const
+{
+    return m_setCookie;
+}
+
+void WebSocketHandshake::setServerSetCookie(const String& setCookie)
+{
+    m_setCookie = setCookie;
+}
+
+const String& WebSocketHandshake::serverSetCookie2() const
+{
+    return m_setCookie2;
+}
+
+void WebSocketHandshake::setServerSetCookie2(const String& setCookie2)
+{
+    m_setCookie2 = setCookie2;
+}
+
+KURL WebSocketHandshake::httpURLForAuthenticationAndCookies() const
+{
+    KURL url = m_url.copy();
+    url.setProtocol(m_secure ? "https" : "http");
+    return url;
+}
+
+const char* WebSocketHandshake::readHTTPHeaders(const char* start, const char* end, HTTPHeaderMap* headers)
+{
+    Vector<char> name;
+    Vector<char> value;
+    for (const char* p = start; p < end; p++) {
+        name.clear();
+        value.clear();
+
+        for (; p < end; p++) {
+            switch (*p) {
+            case '\r':
+                if (name.isEmpty()) {
+                    if (p + 1 < end && *(p + 1) == '\n')
+                        return p + 2;
+                    LOG(Network, "CR doesn't follow LF p=%p end=%p", p, end);
+                    return 0;
+                }
+                LOG(Network, "Unexpected CR in name");
+                return 0;
+            case '\n':
+                LOG(Network, "Unexpected LF in name");
+                return 0;
+            case ':':
+                break;
+            default:
+                if (*p >= 0x41 && *p <= 0x5a)
+                    name.append(*p + 0x20);
+                else
+                    name.append(*p);
+                continue;
+            }
+            if (*p == ':') {
+                ++p;
+                break;
+            }
+        }
+
+        for (; p < end && *p == 0x20; p++) { }
+
+        for (; p < end; p++) {
+            switch (*p) {
+            case '\r':
+                break;
+            case '\n':
+                LOG(Network, "Unexpected LF in value");
+                return 0;
+            default:
+                value.append(*p);
+            }
+            if (*p == '\r') {
+                ++p;
+                break;
+            }
+        }
+        if (p >= end || *p != '\n') {
+            LOG(Network, "CR doesn't follow LF after value p=%p end=%p", p, end);
+            return 0;
+        }
+        AtomicString nameStr(String::fromUTF8(name.data(), name.size()));
+        String valueStr = String::fromUTF8(value.data(), value.size());
+        LOG(Network, "name=%s value=%s", nameStr.string().utf8().data(), valueStr.utf8().data());
+        headers->add(nameStr, valueStr);
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+bool WebSocketHandshake::processHeaders(const HTTPHeaderMap& headers)
+{
+    for (HTTPHeaderMap::const_iterator it = headers.begin(); it != headers.end(); ++it) {
+        switch (m_mode) {
+        case Normal:
+            if (it->first == "websocket-origin")
+                m_wsOrigin = it->second;
+            else if (it->first == "websocket-location")
+                m_wsLocation = it->second;
+            else if (it->first == "websocket-protocol")
+                m_wsProtocol = it->second;
+            else if (it->first == "set-cookie")
+                m_setCookie = it->second;
+            else if (it->first == "set-cookie2")
+                m_setCookie2 = it->second;
+            continue;
+        case Incomplete:
+        case Failed:
+        case Connected:
+            ASSERT_NOT_REACHED();
+        }
+        ASSERT_NOT_REACHED();
+    }
+    return true;
+}
+
+void WebSocketHandshake::checkResponseHeaders()
+{
+    ASSERT(m_mode == Normal);
+    m_mode = Failed;
+    if (m_wsOrigin.isNull() || m_wsLocation.isNull())
+        return;
+
+    if (clientOrigin() != m_wsOrigin) {
+        LOG(Network, "Mismatch origin: %s != %s", clientOrigin().utf8().data(), m_wsOrigin.utf8().data());
+        return;
+    }
+    if (clientLocation() != m_wsLocation) {
+        LOG(Network, "Mismatch location: %s != %s", clientLocation().utf8().data(), m_wsLocation.utf8().data());
+        return;
+    }
+    if (!m_clientProtocol.isEmpty() && m_clientProtocol != m_wsProtocol) {
+        LOG(Network, "Mismatch protocol: %s != %s", m_clientProtocol.utf8().data(), m_wsProtocol.utf8().data());
+        return;
+    }
+    m_mode = Connected;
+    return;
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
diff --git a/WebCore/websockets/WebSocketHandshake.h b/WebCore/websockets/WebSocketHandshake.h
new file mode 100644
index 0000000..d5dbe68
--- /dev/null
+++ b/WebCore/websockets/WebSocketHandshake.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketHandshake_h
+#define WebSocketHandshake_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "KURL.h"
+#include "PlatformString.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+    class ScriptExecutionContext;
+    class HTTPHeaderMap;
+
+    class WebSocketHandshake : public Noncopyable {
+    public:
+        enum Mode {
+            Incomplete, Normal, Failed, Connected
+        };
+        WebSocketHandshake(const KURL&, const String& protocol, ScriptExecutionContext*);
+        ~WebSocketHandshake();
+
+        const KURL& url() const;
+        void setURL(const KURL&);
+        const String host() const;
+
+        const String& clientProtocol() const;
+        void setClientProtocol(const String& protocol);
+
+        bool secure() const;
+        void setSecure(bool secure);
+
+        String clientOrigin() const;
+        String clientLocation() const;
+
+        CString clientHandshakeMessage() const;
+
+        void reset();
+
+        int readServerHandshake(const char* header, size_t len);
+        Mode mode() const;
+
+        const String& serverWebSocketOrigin() const;
+        void setServerWebSocketOrigin(const String& webSocketOrigin);
+
+        const String& serverWebSocketLocation() const;
+        void setServerWebSocketLocation(const String& webSocketLocation);
+
+        const String& serverWebSocketProtocol() const;
+        void setServerWebSocketProtocol(const String& webSocketProtocol);
+
+        const String& serverSetCookie() const;
+        void setServerSetCookie(const String& setCookie);
+        const String& serverSetCookie2() const;
+        void setServerSetCookie2(const String& setCookie2);
+
+    private:
+        KURL httpURLForAuthenticationAndCookies() const;
+
+        // Reads all headers except for the two predefined ones.
+        const char* readHTTPHeaders(const char* start, const char* end, HTTPHeaderMap* headers);
+        bool processHeaders(const HTTPHeaderMap& headers);
+        void checkResponseHeaders();
+
+        KURL m_url;
+        String m_clientProtocol;
+        bool m_secure;
+        ScriptExecutionContext* m_context;
+
+        Mode m_mode;
+
+        String m_wsOrigin;
+        String m_wsLocation;
+        String m_wsProtocol;
+        String m_setCookie;
+        String m_setCookie2;
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
+
+#endif  // WebSocketHandshake_h
diff --git a/WebCore/wml/WMLAElement.cpp b/WebCore/wml/WMLAElement.cpp
index 9c84193..074c371 100644
--- a/WebCore/wml/WMLAElement.cpp
+++ b/WebCore/wml/WMLAElement.cpp
@@ -73,17 +73,7 @@ void WMLAElement::parseMappedAttribute(MappedAttribute* attr)
 
 bool WMLAElement::supportsFocus() const
 {
-    return isFocusable() || (isLink() && document() && !document()->haveStylesheetsLoaded());
-}
-
-bool WMLAElement::isFocusable() const
-{
-    // FIXME: Even if we are not visible, we might have a child that is visible.
-    // Dave wants to fix that some day with a "has visible content" flag or the like.
-    if (!(isLink() && renderer() && renderer()->style()->visibility() == VISIBLE))
-        return false;
-
-    return true;
+    return isLink() || WMLElement::supportsFocus();
 }
 
 bool WMLAElement::isMouseFocusable() const
diff --git a/WebCore/wml/WMLAElement.h b/WebCore/wml/WMLAElement.h
index 3eece4c..7b19081 100644
--- a/WebCore/wml/WMLAElement.h
+++ b/WebCore/wml/WMLAElement.h
@@ -36,7 +36,6 @@ public:
     WMLAElement(const QualifiedName& tagName, Document*);
 
     virtual bool supportsFocus() const;
-    virtual bool isFocusable() const;
     virtual bool isMouseFocusable() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
 
diff --git a/WebCore/wml/WMLAnchorElement.cpp b/WebCore/wml/WMLAnchorElement.cpp
index 91526b9..b9b3f53 100644
--- a/WebCore/wml/WMLAnchorElement.cpp
+++ b/WebCore/wml/WMLAnchorElement.cpp
@@ -54,7 +54,7 @@ void WMLAnchorElement::defaultEventHandler(Event* event)
         shouldHandle = static_cast<KeyboardEvent*>(event)->keyIdentifier() == "Enter";
 
     if (shouldHandle && m_task) {
-        m_task->executeTask(event);
+        m_task->executeTask();
         event->setDefaultHandled();
         return;
     }
@@ -71,7 +71,7 @@ void WMLAnchorElement::registerTask(WMLTaskElement* task)
 
 void WMLAnchorElement::deregisterTask(WMLTaskElement* task)
 {
-    ASSERT(m_task == task);
+    ASSERT_UNUSED(task, m_task == task);
     m_task = 0;
 }
 
diff --git a/WebCore/wml/WMLCardElement.cpp b/WebCore/wml/WMLCardElement.cpp
index 63240f3..818b818 100644
--- a/WebCore/wml/WMLCardElement.cpp
+++ b/WebCore/wml/WMLCardElement.cpp
@@ -339,8 +339,6 @@ WMLCardElement* WMLCardElement::determineActiveCard(Document* doc)
     // Update the document title
     doc->setTitle(activeCard->title());
 
-    // Set the active activeCard in the WMLPageState object
-    pageState->setActiveCard(activeCard);
     return activeCard;
 }
 
diff --git a/WebCore/wml/WMLDoElement.cpp b/WebCore/wml/WMLDoElement.cpp
index 34be6df..38ad5dd 100644
--- a/WebCore/wml/WMLDoElement.cpp
+++ b/WebCore/wml/WMLDoElement.cpp
@@ -70,14 +70,17 @@ void WMLDoElement::defaultEventHandler(Event* event)
 
     if (m_type == "accept" || m_type == "options") {
         if (m_task)
-            m_task->executeTask(event);
+            m_task->executeTask();
     } else if (m_type == "prev") {
-        WMLPageState* pageState = wmlPageStateForDocument(document());
+        ASSERT(document()->isWMLDocument());
+        WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+        WMLPageState* pageState = wmlPageStateForDocument(document);
         if (!pageState)
             return;
-
+    
         // Stop the timer of the current card if it is active
-        if (WMLCardElement* card = pageState->activeCard()) {
+        if (WMLCardElement* card = document->activeCard()) {
             if (WMLTimerElement* eventTimer = card->eventTimer())
                 eventTimer->stop();
         }
@@ -172,7 +175,7 @@ void WMLDoElement::registerTask(WMLTaskElement* task)
 
 void WMLDoElement::deregisterTask(WMLTaskElement* task)
 {
-    ASSERT(m_task == task);
+    ASSERT_UNUSED(task, m_task == task);
     m_task = 0;
 }
 
diff --git a/WebCore/wml/WMLDocument.cpp b/WebCore/wml/WMLDocument.cpp
index f2287be..ef0bfc8 100644
--- a/WebCore/wml/WMLDocument.cpp
+++ b/WebCore/wml/WMLDocument.cpp
@@ -79,10 +79,8 @@ void WMLDocument::finishedParsing()
         return;
     }
 
-    if (m_activeCard) {
+    if (m_activeCard)
         m_activeCard->handleIntrinsicEventIfNeeded();
-        m_activeCard = 0;
-    }
 }
 
 bool WMLDocument::initialize(bool aboutToFinishParsing)
diff --git a/WebCore/wml/WMLDocument.h b/WebCore/wml/WMLDocument.h
index fb3e62e..9053518 100644
--- a/WebCore/wml/WMLDocument.h
+++ b/WebCore/wml/WMLDocument.h
@@ -34,7 +34,7 @@ class WMLDocument : public Document {
 public:
     static PassRefPtr<WMLDocument> create(Frame* frame)
     {
-        return new WMLDocument(frame);
+        return adoptRef(new WMLDocument(frame));
     }
 
     virtual ~WMLDocument();
@@ -44,6 +44,8 @@ public:
 
     bool initialize(bool aboutToFinishParsing = false);
 
+    WMLCardElement* activeCard() const { return m_activeCard; }
+
 private:
     WMLDocument(Frame*);
     WMLCardElement* m_activeCard;
diff --git a/WebCore/wml/WMLElement.cpp b/WebCore/wml/WMLElement.cpp
index a9e4b5d..50b0fe4 100644
--- a/WebCore/wml/WMLElement.cpp
+++ b/WebCore/wml/WMLElement.cpp
@@ -38,11 +38,16 @@ namespace WebCore {
 
 using namespace WMLNames;
 
-WMLElement::WMLElement(const QualifiedName& tagName, Document* doc)
-    : StyledElement(tagName, doc)
+WMLElement::WMLElement(const QualifiedName& tagName, Document* document)
+    : StyledElement(tagName, document, CreateElementZeroRefCount)
 {
 }
 
+PassRefPtr<WMLElement> WMLElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new WMLElement(tagName, document);
+}
+
 bool WMLElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (attrName == HTMLNames::alignAttr) {
diff --git a/WebCore/wml/WMLElement.h b/WebCore/wml/WMLElement.h
index 46b0ff4..0bfaceb 100644
--- a/WebCore/wml/WMLElement.h
+++ b/WebCore/wml/WMLElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
 
 class WMLElement : public StyledElement {
 public:
-    WMLElement(const QualifiedName& tagName, Document*);
+    static PassRefPtr<WMLElement> create(const QualifiedName& tagName, Document*);
 
     virtual bool isWMLElement() const { return true; }
     virtual bool isWMLTaskElement() const { return false; }
@@ -43,6 +43,8 @@ public:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
 protected:
+    WMLElement(const QualifiedName& tagName, Document*);
+
     // Helper function for derived classes
     String parseValueSubstitutingVariableReferences(const AtomicString&, WMLErrorCode defaultErrorCode = WMLErrorInvalidVariableReference) const;
     String parseValueForbiddingVariableReferences(const AtomicString&) const;
diff --git a/WebCore/wml/WMLFormControlElement.cpp b/WebCore/wml/WMLFormControlElement.cpp
index f849ac8..93ffbda 100644
--- a/WebCore/wml/WMLFormControlElement.cpp
+++ b/WebCore/wml/WMLFormControlElement.cpp
@@ -39,6 +39,11 @@ WMLFormControlElement::~WMLFormControlElement()
 {
 }
 
+bool WMLFormControlElement::supportsFocus() const
+{
+    return true;
+}
+
 bool WMLFormControlElement::isFocusable() const
 {
     if (!renderer() || !renderer()->isBox())
@@ -46,14 +51,10 @@ bool WMLFormControlElement::isFocusable() const
 
     if (toRenderBox(renderer())->size().isEmpty())
         return false;
-
-    if (RenderStyle* style = renderer()->style()) {
-        if (style->visibility() != VISIBLE)
-            return false;
-    }
-
-    return true;
+    
+    return WMLElement::isFocusable();
 }
+    
 
 void WMLFormControlElement::attach()
 {
diff --git a/WebCore/wml/WMLFormControlElement.h b/WebCore/wml/WMLFormControlElement.h
index dde86ed..43f8dee 100644
--- a/WebCore/wml/WMLFormControlElement.h
+++ b/WebCore/wml/WMLFormControlElement.h
@@ -38,6 +38,7 @@ public:
     virtual bool formControlValueMatchesRenderer() const { return m_valueMatchesRenderer; }
     virtual void setFormControlValueMatchesRenderer(bool b = true) { m_valueMatchesRenderer = b; }
 
+    virtual bool supportsFocus() const;
     virtual bool isFocusable() const;
 
     virtual void attach();
diff --git a/WebCore/wml/WMLGoElement.cpp b/WebCore/wml/WMLGoElement.cpp
index 635302f..8076207 100644
--- a/WebCore/wml/WMLGoElement.cpp
+++ b/WebCore/wml/WMLGoElement.cpp
@@ -73,18 +73,20 @@ void WMLGoElement::parseMappedAttribute(MappedAttribute* attr)
         WMLTaskElement::parseMappedAttribute(attr);
 }
 
-void WMLGoElement::executeTask(Event*)
+void WMLGoElement::executeTask()
 {
-    Document* doc = document();
-    WMLPageState* pageState = wmlPageStateForDocument(doc);
+    ASSERT(document()->isWMLDocument());
+    WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+    WMLPageState* pageState = wmlPageStateForDocument(document);
     if (!pageState)
         return;
 
-    WMLCardElement* card = pageState->activeCard();
+    WMLCardElement* card = document->activeCard();
     if (!card)
         return;
 
-    Frame* frame = doc->frame();
+    Frame* frame = document->frame();
     if (!frame)
         return;
 
@@ -97,7 +99,7 @@ void WMLGoElement::executeTask(Event*)
         return;
 
     // Substitute variables within target url attribute value
-    KURL url = doc->completeURL(substituteVariableReferences(href, doc, WMLVariableEscapingEscape));
+    KURL url = document->completeURL(substituteVariableReferences(href, document, WMLVariableEscapingEscape));
     if (url.isEmpty())
         return;
 
@@ -108,9 +110,9 @@ void WMLGoElement::executeTask(Event*)
         eventTimer->stop();
 
     // FIXME: 'newcontext' handling not implemented for external cards
-    bool inSameDeck = doc->url().path() == url.path();
+    bool inSameDeck = document->url().path() == url.path();
     if (inSameDeck && url.hasFragmentIdentifier()) {
-        if (WMLCardElement* card = WMLCardElement::findNamedCardInDocument(doc, url.fragmentIdentifier())) {
+        if (WMLCardElement* card = WMLCardElement::findNamedCardInDocument(document, url.fragmentIdentifier())) {
             if (card->isNewContext())
                 pageState->reset();
         }
diff --git a/WebCore/wml/WMLGoElement.h b/WebCore/wml/WMLGoElement.h
index 75c1858..36c7be2 100644
--- a/WebCore/wml/WMLGoElement.h
+++ b/WebCore/wml/WMLGoElement.h
@@ -39,7 +39,7 @@ public:
     void deregisterPostfieldElement(WMLPostfieldElement*);
 
     virtual void parseMappedAttribute(MappedAttribute*);
-    virtual void executeTask(Event*);
+    virtual void executeTask();
 
 private:
     void preparePOSTRequest(ResourceRequest&, bool inSameDeck, const String& cacheControl);
diff --git a/WebCore/wml/WMLInputElement.cpp b/WebCore/wml/WMLInputElement.cpp
index d6fa79a..b027bf0 100644
--- a/WebCore/wml/WMLInputElement.cpp
+++ b/WebCore/wml/WMLInputElement.cpp
@@ -69,7 +69,7 @@ bool WMLInputElement::isMouseFocusable() const
 
 void WMLInputElement::dispatchFocusEvent()
 {
-    InputElement::dispatchFocusEvent(m_data, this, this);
+    InputElement::dispatchFocusEvent(this, this);
     WMLElement::dispatchFocusEvent();
 }
 
@@ -87,7 +87,7 @@ void WMLInputElement::dispatchBlurEvent()
     if (!nameVariable.isEmpty())
         wmlPageStateForDocument(document())->storeVariable(nameVariable, val); 
 
-    InputElement::dispatchBlurEvent(m_data, this, this);
+    InputElement::dispatchBlurEvent(this, this);
     WMLElement::dispatchBlurEvent();
 }
 
@@ -134,7 +134,6 @@ String WMLInputElement::value() const
 
 void WMLInputElement::setValue(const String& value)
 {
-    InputElement::updatePlaceholderVisibility(m_data, this, this);
     setFormControlValueMatchesRenderer(false);
     m_data.setValue(constrainValue(value));
     if (inDocument())
@@ -221,7 +220,7 @@ void WMLInputElement::copyNonAttributeProperties(const Element* source)
 
 RenderObject* WMLInputElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderTextControlSingleLine(this);
+    return new (arena) RenderTextControlSingleLine(this, false);
 }
 
 void WMLInputElement::detach()
@@ -295,7 +294,7 @@ void WMLInputElement::defaultEventHandler(Event* evt)
     }
 
     if (evt->isBeforeTextInsertedEvent())
-        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, this, evt);
 
     if (renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
         toRenderTextControlSingleLine(renderer())->forwardEvent(evt);
@@ -309,7 +308,7 @@ void WMLInputElement::cacheSelection(int start, int end)
 
 String WMLInputElement::constrainValue(const String& proposedValue) const
 {
-    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
+    return InputElement::sanitizeUserInputValue(this, proposedValue, m_data.maxLength());
 }
 
 void WMLInputElement::documentDidBecomeActive()
@@ -318,11 +317,6 @@ void WMLInputElement::documentDidBecomeActive()
     reset();
 }
 
-bool WMLInputElement::placeholderShouldBeVisible() const
-{
-    return m_data.placeholderShouldBeVisible();
-}
-
 void WMLInputElement::willMoveToNewOwnerDocument()
 {
     // Always unregister for cache callbacks when leaving a document, even if we would otherwise like to be registered
diff --git a/WebCore/wml/WMLInputElement.h b/WebCore/wml/WMLInputElement.h
index 7529968..98ea13a 100644
--- a/WebCore/wml/WMLInputElement.h
+++ b/WebCore/wml/WMLInputElement.h
@@ -58,8 +58,6 @@ public:
     virtual const AtomicString& formControlName() const;
     virtual String value() const;
     virtual void setValue(const String&);
-    virtual String placeholder() const { return String(); }
-    virtual void setPlaceholder(const String&) { }
     virtual void setValueFromRenderer(const String&);
 
     virtual bool saveFormControlState(String& value) const;
@@ -79,10 +77,9 @@ public:
     virtual void defaultEventHandler(Event*);
     virtual void cacheSelection(int start, int end);
 
-    virtual String constrainValue(const String& proposedValue) const;
+    virtual String sanitizeValue(const String& proposedValue) const { return constrainValue(proposedValue); }
 
     virtual void documentDidBecomeActive();
-    virtual bool placeholderShouldBeVisible() const;
 
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
@@ -96,6 +93,7 @@ private:
 
     String validateInputMask(const String&);
     unsigned cursorPositionToMaskIndex(unsigned);
+    String constrainValue(const String&) const;
 
     InputElementData m_data;
     bool m_isPasswordField;
diff --git a/WebCore/wml/WMLIntrinsicEventHandler.cpp b/WebCore/wml/WMLIntrinsicEventHandler.cpp
index 67364d9..8e4c276 100644
--- a/WebCore/wml/WMLIntrinsicEventHandler.cpp
+++ b/WebCore/wml/WMLIntrinsicEventHandler.cpp
@@ -48,7 +48,7 @@ void WMLIntrinsicEventHandler::triggerIntrinsicEvent(WMLIntrinsicEventType type)
 {
     RefPtr<WMLIntrinsicEvent> event = m_events.get(type);
     ASSERT(event->taskElement());
-    event->taskElement()->executeTask(0);
+    event->taskElement()->executeTask();
 }
 
 bool WMLIntrinsicEventHandler::hasIntrinsicEvent(WMLIntrinsicEventType type) const
diff --git a/WebCore/wml/WMLOptionElement.cpp b/WebCore/wml/WMLOptionElement.cpp
index 764d3a1..61fa762 100644
--- a/WebCore/wml/WMLOptionElement.cpp
+++ b/WebCore/wml/WMLOptionElement.cpp
@@ -158,6 +158,10 @@ RenderStyle* WMLOptionElement::nonRendererRenderStyle() const
 
 void WMLOptionElement::handleIntrinsicEventIfNeeded()
 {
+    WMLSelectElement* select = ownerSelectElement(this);
+    if (!select || !select->initialized())
+        return;
+
     WMLIntrinsicEventHandler* eventHandler = this->eventHandler();
     if (!eventHandler)
         return;
diff --git a/WebCore/wml/WMLPageState.cpp b/WebCore/wml/WMLPageState.cpp
index 5f431bb..3e1863d 100644
--- a/WebCore/wml/WMLPageState.cpp
+++ b/WebCore/wml/WMLPageState.cpp
@@ -35,7 +35,6 @@ namespace WebCore {
 
 WMLPageState::WMLPageState(Page* page)
     : m_page(page)
-    , m_activeCard(0)
     , m_hasAccessControlData(false)
 {
 }
diff --git a/WebCore/wml/WMLPageState.h b/WebCore/wml/WMLPageState.h
index de0af91..a5d8b23 100644
--- a/WebCore/wml/WMLPageState.h
+++ b/WebCore/wml/WMLPageState.h
@@ -54,9 +54,6 @@ public:
 
     Page* page() const { return m_page; }
 
-    WMLCardElement* activeCard() const { return m_activeCard; }
-    void setActiveCard(WMLCardElement* card) { m_activeCard = card; }
-
     // Deck access control
     bool processAccessControlData(const String& dmain, const String& path);
     void resetAccessControlData();
@@ -70,7 +67,6 @@ private:
 private:
     Page* m_page;
     WMLVariableMap m_variables;
-    WMLCardElement* m_activeCard;
     String m_accessDomain;
     String m_accessPath;
     bool m_hasAccessControlData;
diff --git a/WebCore/wml/WMLPrevElement.cpp b/WebCore/wml/WMLPrevElement.cpp
index 2688d03..3d487ea 100644
--- a/WebCore/wml/WMLPrevElement.cpp
+++ b/WebCore/wml/WMLPrevElement.cpp
@@ -40,13 +40,16 @@ WMLPrevElement::~WMLPrevElement()
 {
 }
 
-void WMLPrevElement::executeTask(Event*)
+void WMLPrevElement::executeTask()
 {
-    WMLPageState* pageState = wmlPageStateForDocument(document());
+    ASSERT(document()->isWMLDocument());
+    WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+    WMLPageState* pageState = wmlPageStateForDocument(document);
     if (!pageState)
         return;
 
-    WMLCardElement* card = pageState->activeCard();
+    WMLCardElement* card = document->activeCard();
     if (!card)
         return;
 
diff --git a/WebCore/wml/WMLPrevElement.h b/WebCore/wml/WMLPrevElement.h
index 232c1b0..ce8596e 100644
--- a/WebCore/wml/WMLPrevElement.h
+++ b/WebCore/wml/WMLPrevElement.h
@@ -31,7 +31,7 @@ public:
     WMLPrevElement(const QualifiedName& tagName, Document*);
     virtual ~WMLPrevElement();
 
-    virtual void executeTask(Event*);
+    virtual void executeTask();
 };
 
 }
diff --git a/WebCore/wml/WMLRefreshElement.cpp b/WebCore/wml/WMLRefreshElement.cpp
index c05a2c9..bcf87ac 100644
--- a/WebCore/wml/WMLRefreshElement.cpp
+++ b/WebCore/wml/WMLRefreshElement.cpp
@@ -41,13 +41,16 @@ WMLRefreshElement::~WMLRefreshElement()
 {
 }
 
-void WMLRefreshElement::executeTask(Event*)
+void WMLRefreshElement::executeTask()
 {
-    WMLPageState* pageState = wmlPageStateForDocument(document());
+    ASSERT(document()->isWMLDocument());
+    WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+    WMLPageState* pageState = wmlPageStateForDocument(document);
     if (!pageState)
         return;
 
-    WMLCardElement* card = pageState->activeCard();
+    WMLCardElement* card = document->activeCard();
     if (!card)
         return;
 
@@ -62,7 +65,7 @@ void WMLRefreshElement::executeTask(Event*)
     storeVariableState(pageState);
 
     // Redisplay curremt card with current variable state
-    if (Frame* frame = document()->frame()) {
+    if (Frame* frame = document->frame()) {
         if (FrameLoader* loader = frame->loader())
             loader->reload();
     }
diff --git a/WebCore/wml/WMLRefreshElement.h b/WebCore/wml/WMLRefreshElement.h
index 7b1729e..43b71b5 100644
--- a/WebCore/wml/WMLRefreshElement.h
+++ b/WebCore/wml/WMLRefreshElement.h
@@ -31,7 +31,7 @@ public:
     WMLRefreshElement(const QualifiedName& tagName, Document*);
     virtual ~WMLRefreshElement();
 
-    virtual void executeTask(Event*);
+    virtual void executeTask();
 };
 
 }
diff --git a/WebCore/wml/WMLSelectElement.cpp b/WebCore/wml/WMLSelectElement.cpp
index 2d03a3f..03ca05a 100644
--- a/WebCore/wml/WMLSelectElement.cpp
+++ b/WebCore/wml/WMLSelectElement.cpp
@@ -39,6 +39,7 @@ using namespace WMLNames;
 
 WMLSelectElement::WMLSelectElement(const QualifiedName& tagName, Document* document)
     : WMLFormControlElement(tagName, document)
+    , m_initialized(false)
 {
 }
 
@@ -242,14 +243,17 @@ void WMLSelectElement::selectInitialOptions()
     // Spec: Step 1 - the default option index is determined using iname and ivalue
     calculateDefaultOptionIndices();
 
-    if (m_defaultOptionIndices.isEmpty())
+    if (m_defaultOptionIndices.isEmpty()) {
+        m_initialized = true;
         return;
+    }
 
     // Spec: Step 2 – initialise variables
     initializeVariables();
 
     // Spec: Step 3 – pre-select option(s) specified by the default option index 
     selectDefaultOptions();
+    m_initialized = true;
 }
 
 void WMLSelectElement::insertedIntoTree(bool deep)
diff --git a/WebCore/wml/WMLSelectElement.h b/WebCore/wml/WMLSelectElement.h
index 412a950..5ab7da6 100644
--- a/WebCore/wml/WMLSelectElement.h
+++ b/WebCore/wml/WMLSelectElement.h
@@ -85,6 +85,8 @@ public:
     void scrollToSelection();
     void selectInitialOptions();
 
+    bool initialized() const { return m_initialized; }
+
 private:
     virtual void insertedIntoTree(bool);
 
@@ -104,6 +106,7 @@ private:
     String ivalue() const;
 
     SelectElementData m_data;
+    bool m_initialized;
     Vector<unsigned> m_defaultOptionIndices;
 };
 
diff --git a/WebCore/wml/WMLTableElement.cpp b/WebCore/wml/WMLTableElement.cpp
index 92c7580..b589fe8 100644
--- a/WebCore/wml/WMLTableElement.cpp
+++ b/WebCore/wml/WMLTableElement.cpp
@@ -176,7 +176,7 @@ void WMLTableElement::joinSuperflousColumns(Vector<WMLElement*>& columnElements,
     ASSERT(lastColumn);
 
     // Merge superflous columns into a single one
-    RefPtr<WMLElement> newCell = new WMLElement(tdTag, document());
+    RefPtr<WMLElement> newCell = WMLElement::create(tdTag, document());
     transferAllChildrenOfElementToTargetElement(lastColumn, newCell.get(), 0);
 
     ExceptionCode ec = 0;
@@ -213,7 +213,7 @@ void WMLTableElement::padWithEmptyColumns(Vector<WMLElement*>& columnElements, W
     ExceptionCode ec = 0;
 
     for (unsigned i = columnElements.size(); i < m_columns; ++i) {
-        RefPtr<WMLElement> newCell = new WMLElement(tdTag, document());
+        RefPtr<WMLElement> newCell = WMLElement::create(tdTag, document());
         rowElement->appendChild(newCell.release(), ec);
         ASSERT(ec == 0);
     }
diff --git a/WebCore/wml/WMLTagNames.in b/WebCore/wml/WMLTagNames.in
index fd7c762..1c24f42 100644
--- a/WebCore/wml/WMLTagNames.in
+++ b/WebCore/wml/WMLTagNames.in
@@ -2,34 +2,34 @@ namespace="WML"
 namespaceURI="http://www.wapforum.org/DTD/wml_1.1.xml"
 guardFactoryWith="ENABLE(WML)"
 
-a
-access
-anchor
-br interfaceName=WMLBRElement
-card
-do
-fieldset interfaceName=WMLFieldSetElement
-go
+a createWithNew
+access createWithNew
+anchor createWithNew
+br interfaceName=WMLBRElement, createWithNew
+card createWithNew
+do createWithNew
+fieldset interfaceName=WMLFieldSetElement, createWithNew
+go createWithNew
 head interfaceName=WMLElement
-img interfaceName=WMLImageElement
-input
+img interfaceName=WMLImageElement, createWithNew
+input createWithNew
 #if 0
 # Note: 'insertedLegend' is not an official WML element - internal purpose only!
 #endif
-insertedLegend interfaceName=WMLInsertedLegendElement
-meta
-noop
-onevent interfaceName=WMLOnEventElement
-optgroup interfaceName=WMLOptGroupElement
-option
-p
-postfield
-prev
-refresh
-select
-setvar
-table
+insertedLegend interfaceName=WMLInsertedLegendElement, createWithNew
+meta createWithNew
+noop createWithNew
+onevent interfaceName=WMLOnEventElement, createWithNew
+optgroup interfaceName=WMLOptGroupElement, createWithNew
+option createWithNew
+p createWithNew
+postfield createWithNew
+prev createWithNew
+refresh createWithNew
+select createWithNew
+setvar createWithNew
+table createWithNew
 td interfaceName=WMLElement
-template
-timer
+template createWithNew
+timer createWithNew
 tr interfaceName=WMLElement
diff --git a/WebCore/wml/WMLTaskElement.h b/WebCore/wml/WMLTaskElement.h
index b5dab8c..b813285 100644
--- a/WebCore/wml/WMLTaskElement.h
+++ b/WebCore/wml/WMLTaskElement.h
@@ -40,7 +40,7 @@ public:
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
-    virtual void executeTask(Event*) = 0;
+    virtual void executeTask() = 0;
 
     void registerVariableSetter(WMLSetvarElement*);
     void deregisterVariableSetter(WMLSetvarElement*);
diff --git a/WebCore/workers/AbstractWorker.cpp b/WebCore/workers/AbstractWorker.cpp
index 2371e9d..6ba8922 100644
--- a/WebCore/workers/AbstractWorker.cpp
+++ b/WebCore/workers/AbstractWorker.cpp
@@ -52,90 +52,6 @@ AbstractWorker::~AbstractWorker()
 {
 }
 
-void AbstractWorker::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
-                return;
-        }
-
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }
-}
-
-void AbstractWorker::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
-}
-
-bool AbstractWorker::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
-{
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    ListenerVector listenersCopy = m_eventListeners.get(event->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(event.get(), false);
-    }
-
-    return !event->defaultPrevented();
-}
-
-void AbstractWorker::dispatchLoadErrorEvent()
-{
-    RefPtr<Event> evt = Event::create(eventNames().errorEvent, false, true);
-    if (m_onErrorListener) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        m_onErrorListener->handleEvent(evt.get(), true);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
-bool AbstractWorker::dispatchScriptErrorEvent(const String& message, const String& sourceURL, int lineNumber)
-{
-    bool handled = false;
-    RefPtr<ErrorEvent> event = ErrorEvent::create(message, sourceURL, static_cast<unsigned>(lineNumber));
-    if (m_onErrorListener) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        m_onErrorListener->handleEvent(event.get(), true);
-        if (event->defaultPrevented())
-            handled = true;
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(event.release(), ec);
-    ASSERT(!ec);
-
-    return handled;
-}
-
 KURL AbstractWorker::resolveURL(const String& url, ExceptionCode& ec)
 {
     if (url.isEmpty()) {
@@ -157,6 +73,16 @@ KURL AbstractWorker::resolveURL(const String& url, ExceptionCode& ec)
     return scriptURL;
 }
 
+EventTargetData* AbstractWorker::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* AbstractWorker::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/WebCore/workers/AbstractWorker.h b/WebCore/workers/AbstractWorker.h
index a882542..2209856 100644
--- a/WebCore/workers/AbstractWorker.h
+++ b/WebCore/workers/AbstractWorker.h
@@ -36,6 +36,7 @@
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -51,19 +52,7 @@ namespace WebCore {
         // EventTarget APIs
         virtual ScriptExecutionContext* scriptExecutionContext() const { return ActiveDOMObject::scriptExecutionContext(); }
 
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-
-        // Utility routines to generate appropriate error events for loading and script exceptions.
-        void dispatchLoadErrorEvent();
-        bool dispatchScriptErrorEvent(const String& errorMessage, const String& sourceURL, int);
-
-        void setOnerror(PassRefPtr<EventListener> eventListener) { m_onErrorListener = eventListener; }
-        EventListener* onerror() const { return m_onErrorListener.get(); }
-        typedef Vector<RefPtr<EventListener> > ListenerVector;
-        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-        EventListenersMap& eventListeners() { return m_eventListeners; }
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
 
         using RefCounted<AbstractWorker>::ref;
         using RefCounted<AbstractWorker>::deref;
@@ -78,9 +67,10 @@ namespace WebCore {
     private:
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
-
-        RefPtr<EventListener> m_onErrorListener;
-        EventListenersMap m_eventListeners;
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
+        
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/AbstractWorker.idl b/WebCore/workers/AbstractWorker.idl
index ae7ebc6..00b8fbb 100644
--- a/WebCore/workers/AbstractWorker.idl
+++ b/WebCore/workers/AbstractWorker.idl
@@ -32,8 +32,8 @@ module threads {
 
     interface [
         Conditional=WORKERS,
-        CustomMarkFunction,
         CustomToJS,
+        EventTarget,
         GenerateConstructor
     ] AbstractWorker {
 
diff --git a/WebCore/workers/DedicatedWorkerContext.cpp b/WebCore/workers/DedicatedWorkerContext.cpp
index ae5c547..82dc4b3 100644
--- a/WebCore/workers/DedicatedWorkerContext.cpp
+++ b/WebCore/workers/DedicatedWorkerContext.cpp
@@ -46,54 +46,29 @@ DedicatedWorkerContext::DedicatedWorkerContext(const KURL& url, const String& us
 {
 }
 
-DedicatedWorkerContext::~DedicatedWorkerContext()
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
-    ASSERT(currentThread() == thread()->threadID());
-    // Notify parent worker we are going away. This can free the WorkerThread object, so do not access it after this.
-    thread()->workerObjectProxy().workerContextDestroyed();
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, ec);
 }
 
-void DedicatedWorkerContext::forwardException(const String& errorMessage, int lineNumber, const String& sourceURL)
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
 {
-    thread()->workerObjectProxy().postExceptionToWorkerObject(errorMessage, lineNumber, sourceURL);
+    postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void DedicatedWorkerContext::addMessage(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
-{
-    thread()->workerObjectProxy().postConsoleMessageToWorkerObject(destination, source, type, level, message, lineNumber, sourceURL);
-}
-
-void DedicatedWorkerContext::postMessage(const String& message, ExceptionCode& ec)
-{
-    postMessage(message, 0, ec);
-}
-
-void DedicatedWorkerContext::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     if (isClosing())
         return;
     // Disentangle the port in preparation for sending it to the remote context.
-    OwnPtr<MessagePortChannel> channel = port ? port->disentangle(ec) : 0;
+    OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
     if (ec)
         return;
-    thread()->workerObjectProxy().postMessageToWorkerObject(message, channel.release());
-}
-
-void DedicatedWorkerContext::dispatchMessage(const String& message, PassRefPtr<MessagePort> port)
-{
-    // Since close() stops the thread event loop, this should not ever get called while closing.
-    ASSERT(!isClosing());
-    RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, port);
-
-    if (m_onmessageListener.get()) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        m_onmessageListener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
+    thread()->workerObjectProxy().postMessageToWorkerObject(message, channels.release());
 }
 
 void DedicatedWorkerContext::importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode& ec)
diff --git a/WebCore/workers/DedicatedWorkerContext.h b/WebCore/workers/DedicatedWorkerContext.h
index e974cef..74a39d9 100644
--- a/WebCore/workers/DedicatedWorkerContext.h
+++ b/WebCore/workers/DedicatedWorkerContext.h
@@ -33,6 +33,7 @@
 
 #if ENABLE(WORKERS)
 
+#include "MessagePort.h"
 #include "WorkerContext.h"
 
 namespace WebCore {
@@ -46,31 +47,24 @@ namespace WebCore {
         {
             return adoptRef(new DedicatedWorkerContext(url, userAgent, thread));
         }
-        virtual ~DedicatedWorkerContext();
 
         virtual bool isDedicatedWorkerContext() const { return true; }
 
         // Overridden to allow us to check our pending activity after executing imported script.
         virtual void importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode&);
 
-        // ScriptExecutionContext
-        virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
-
-        virtual void forwardException(const String& errorMessage, int lineNumber, const String& sourceURL);
-
         // EventTarget
         virtual DedicatedWorkerContext* toDedicatedWorkerContext() { return this; }
-        void postMessage(const String&, ExceptionCode&);
-        void postMessage(const String&, MessagePort*, ExceptionCode&);
-        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onmessageListener = eventListener; }
-        EventListener* onmessage() const { return m_onmessageListener.get(); }
+        void postMessage(PassRefPtr<SerializedScriptValue>, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, const MessagePortArray*, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void postMessage(PassRefPtr<SerializedScriptValue>, MessagePort*, ExceptionCode&);
 
-        void dispatchMessage(const String&, PassRefPtr<MessagePort>);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
 
         DedicatedWorkerThread* thread();
     private:
         DedicatedWorkerContext(const KURL&, const String&, DedicatedWorkerThread*);
-        RefPtr<EventListener> m_onmessageListener;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/DedicatedWorkerContext.idl b/WebCore/workers/DedicatedWorkerContext.idl
index ebbee33..f421b9a 100644
--- a/WebCore/workers/DedicatedWorkerContext.idl
+++ b/WebCore/workers/DedicatedWorkerContext.idl
@@ -32,15 +32,20 @@ module threads {
 
     interface [
         Conditional=WORKERS,
-        CustomMarkFunction,
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         GenerateNativeConverter,
         NoStaticTables
     ] DedicatedWorkerContext : WorkerContext {
 
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [Custom] void postMessage(in any message, in [Optional] Array messagePorts)
+            raises(DOMException);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
         void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
             raises(DOMException);
+#endif
                  attribute EventListener onmessage;
 
     };
diff --git a/WebCore/workers/DedicatedWorkerThread.cpp b/WebCore/workers/DedicatedWorkerThread.cpp
index 0905843..d4789a1 100644
--- a/WebCore/workers/DedicatedWorkerThread.cpp
+++ b/WebCore/workers/DedicatedWorkerThread.cpp
@@ -45,7 +45,7 @@ PassRefPtr<DedicatedWorkerThread> DedicatedWorkerThread::create(const KURL& scri
 }
 
 DedicatedWorkerThread::DedicatedWorkerThread(const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy)
-    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy)
+    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy, workerObjectProxy)
     , m_workerObjectProxy(workerObjectProxy)
 {
 }
diff --git a/WebCore/workers/DefaultSharedWorkerRepository.cpp b/WebCore/workers/DefaultSharedWorkerRepository.cpp
index 1c1ed4c..8b1a480 100644
--- a/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -35,6 +35,9 @@
 #include "DefaultSharedWorkerRepository.h"
 
 #include "ActiveDOMObject.h"
+#include "Document.h"
+#include "GenericWorkerTask.h"
+#include "MessageEvent.h"
 #include "MessagePort.h"
 #include "NotImplemented.h"
 #include "PlatformString.h"
@@ -42,52 +45,178 @@
 #include "SecurityOriginHash.h"
 #include "SharedWorker.h"
 #include "SharedWorkerContext.h"
+#include "SharedWorkerRepository.h"
 #include "SharedWorkerThread.h"
 #include "WorkerLoaderProxy.h"
+#include "WorkerReportingProxy.h"
 #include "WorkerScriptLoader.h"
 #include "WorkerScriptLoaderClient.h"
-
+#include <wtf/HashSet.h>
 #include <wtf/Threading.h>
 
 namespace WebCore {
 
-class SharedWorkerProxy : public ThreadSafeShared<SharedWorkerProxy>, public WorkerLoaderProxy {
+class SharedWorkerProxy : public ThreadSafeShared<SharedWorkerProxy>, public WorkerLoaderProxy, public WorkerReportingProxy {
 public:
-    static PassRefPtr<SharedWorkerProxy> create(const String& name, const KURL& url) { return adoptRef(new SharedWorkerProxy(name, url)); }
+    static PassRefPtr<SharedWorkerProxy> create(const String& name, const KURL& url, PassRefPtr<SecurityOrigin> origin) { return adoptRef(new SharedWorkerProxy(name, url, origin)); }
 
     void setThread(PassRefPtr<SharedWorkerThread> thread) { m_thread = thread; }
     SharedWorkerThread* thread() { return m_thread.get(); }
-    bool closing() const { return m_closing; }
-    KURL url() const { return m_url.copy(); }
-    String name() const { return m_name.copy(); }
+    bool isClosing() const { return m_closing; }
+    KURL url() const
+    {
+        // Don't use m_url.copy() because it isn't a threadsafe method.
+        return KURL(ParsedURLString, m_url.string().threadsafeCopy());
+    }
+
+    String name() const { return m_name.threadsafeCopy(); }
+    bool matches(const String& name, PassRefPtr<SecurityOrigin> origin, const KURL& urlToMatch) const;
 
     // WorkerLoaderProxy
-    // FIXME: Implement WorkerLoaderProxy APIs by proxying to an active document.
-    virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>) { notImplemented(); }
-    virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String&) { notImplemented(); }
+    virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
+    virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String&);
+
+    // WorkerReportingProxy
+    virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
+    virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL);
+    virtual void workerContextClosed();
+    virtual void workerContextDestroyed();
 
     // Updates the list of the worker's documents, per section 4.5 of the WebWorkers spec.
     void addToWorkerDocuments(ScriptExecutionContext*);
+
+    bool isInWorkerDocuments(Document* document) { return m_workerDocuments.contains(document); }
+
+    // Removes a detached document from the list of worker's documents. May set the closing flag if this is the last document in the list.
+    void documentDetached(Document*);
+
 private:
-    SharedWorkerProxy(const String& name, const KURL&);
+    SharedWorkerProxy(const String& name, const KURL&, PassRefPtr<SecurityOrigin>);
+    void close();
+
     bool m_closing;
     String m_name;
     KURL m_url;
+    // The thread is freed when the proxy is destroyed, so we need to make sure that the proxy stays around until the SharedWorkerContext exits.
     RefPtr<SharedWorkerThread> m_thread;
+    RefPtr<SecurityOrigin> m_origin;
+    HashSet<Document*> m_workerDocuments;
+    // Ensures exclusive access to the worker documents. Must not grab any other locks (such as the DefaultSharedWorkerRepository lock) while holding this one.
+    Mutex m_workerDocumentsLock;
 };
 
-SharedWorkerProxy::SharedWorkerProxy(const String& name, const KURL& url)
+SharedWorkerProxy::SharedWorkerProxy(const String& name, const KURL& url, PassRefPtr<SecurityOrigin> origin)
     : m_closing(false)
-    , m_name(name.copy())
+    , m_name(name.crossThreadString())
     , m_url(url.copy())
+    , m_origin(origin)
+{
+    // We should be the sole owner of the SecurityOrigin, as we will free it on another thread.
+    ASSERT(m_origin->hasOneRef());
+}
+
+bool SharedWorkerProxy::matches(const String& name, PassRefPtr<SecurityOrigin> origin, const KURL& urlToMatch) const
+{
+    // If the origins don't match, or the names don't match, then this is not the proxy we are looking for.
+    if (!origin->equal(m_origin.get()))
+        return false;
+
+    // If the names are both empty, compares the URLs instead per the Web Workers spec.
+    if (name.isEmpty() && m_name.isEmpty())
+        return urlToMatch == url();
+
+    return name == m_name;
+}
+
+void SharedWorkerProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task> task)
+{
+    MutexLocker lock(m_workerDocumentsLock);
+
+    if (isClosing())
+        return;
+
+    // If we aren't closing, then we must have at least one document.
+    ASSERT(m_workerDocuments.size());
+
+    // Just pick an arbitrary active document from the HashSet and pass load requests to it.
+    // FIXME: Do we need to deal with the case where the user closes the document mid-load, via a shadow document or some other solution?
+    Document* document = *(m_workerDocuments.begin());
+    document->postTask(task);
+}
+
+void SharedWorkerProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+{
+    if (isClosing())
+        return;
+    ASSERT(m_thread);
+    m_thread->runLoop().postTaskForMode(task, mode);
+}
+
+static void postExceptionTask(ScriptExecutionContext* context, const String& errorMessage, int lineNumber, const String& sourceURL)
+{
+    context->reportException(errorMessage, lineNumber, sourceURL);
+}
+
+void SharedWorkerProxy::postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL)
+{
+    MutexLocker lock(m_workerDocumentsLock);
+    for (HashSet<Document*>::iterator iter = m_workerDocuments.begin(); iter != m_workerDocuments.end(); ++iter)
+        (*iter)->postTask(createCallbackTask(&postExceptionTask, errorMessage, lineNumber, sourceURL));
+}
+
+static void postConsoleMessageTask(ScriptExecutionContext* document, MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
+{
+    document->addMessage(destination, source, type, level, message, lineNumber, sourceURL);
+}
+
+void SharedWorkerProxy::postConsoleMessageToWorkerObject(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, int lineNumber, const String& sourceURL)
+{
+    MutexLocker lock(m_workerDocumentsLock);
+    for (HashSet<Document*>::iterator iter = m_workerDocuments.begin(); iter != m_workerDocuments.end(); ++iter)
+        (*iter)->postTask(createCallbackTask(&postConsoleMessageTask, destination, source, type, level, message, lineNumber, sourceURL));
+}
+
+void SharedWorkerProxy::workerContextClosed()
+{
+    if (isClosing())
+        return;
+    close();
+}
+
+void SharedWorkerProxy::workerContextDestroyed()
 {
+    // The proxy may be freed by this call, so do not reference it any further.
+    DefaultSharedWorkerRepository::instance().removeProxy(this);
 }
 
 void SharedWorkerProxy::addToWorkerDocuments(ScriptExecutionContext* context)
 {
     // Nested workers are not yet supported, so passed-in context should always be a Document.
     ASSERT(context->isDocument());
-    // FIXME: track referring documents so we can shutdown the thread when the last one exits and remove the proxy from the cache.
+    ASSERT(!isClosing());
+    MutexLocker lock(m_workerDocumentsLock);
+    Document* document = static_cast<Document*>(context);
+    m_workerDocuments.add(document);
+}
+
+void SharedWorkerProxy::documentDetached(Document* document)
+{
+    if (isClosing())
+        return;
+    // Remove the document from our set (if it's there) and if that was the last document in the set, mark the proxy as closed.
+    MutexLocker lock(m_workerDocumentsLock);
+    m_workerDocuments.remove(document);
+    if (!m_workerDocuments.size())
+        close();
+}
+
+void SharedWorkerProxy::close()
+{
+    ASSERT(!isClosing());
+    m_closing = true;
+    // Stop the worker thread - the proxy will stay around until we get workerThreadExited() notification.
+    if (m_thread)
+        m_thread->stop();
 }
 
 class SharedWorkerConnectTask : public ScriptExecutionContext::Task {
@@ -109,8 +238,10 @@ private:
         port->entangle(m_channel.release());
         ASSERT(scriptContext->isWorkerContext());
         WorkerContext* workerContext = static_cast<WorkerContext*>(scriptContext);
+        // Since close() stops the thread event loop, this should not ever get called while closing.
+        ASSERT(!workerContext->isClosing());
         ASSERT(workerContext->isSharedWorkerContext());
-        workerContext->toSharedWorkerContext()->dispatchConnect(port);
+        workerContext->toSharedWorkerContext()->dispatchEvent(createConnectEvent(port));
     }
 
     OwnPtr<MessagePortChannel> m_channel;
@@ -145,22 +276,23 @@ void SharedWorkerScriptLoader::load(const KURL& url)
     // Mark this object as active for the duration of the load.
     ASSERT(!hasPendingActivity());
     m_scriptLoader = new WorkerScriptLoader();
-    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), url, DenyCrossOriginRedirect, this);
+    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), url, DenyCrossOriginRequests, this);
 
     // Stay alive until the load finishes.
     setPendingActivity(this);
+    m_worker->setPendingActivity(m_worker.get());
 }
 
 void SharedWorkerScriptLoader::notifyFinished()
 {
     // Hand off the just-loaded code to the repository to start up the worker thread.
     if (m_scriptLoader->failed())
-        m_worker->dispatchLoadErrorEvent();
+        m_worker->dispatchEvent(Event::create(eventNames().errorEvent, false, true));
     else
         DefaultSharedWorkerRepository::instance().workerScriptLoaded(*m_proxy, scriptExecutionContext()->userAgent(m_scriptLoader->url()), m_scriptLoader->script(), m_port.release());
 
-    // This frees this object - must be the last action in this function.
-    unsetPendingActivity(this);
+    m_worker->unsetPendingActivity(m_worker.get());
+    unsetPendingActivity(this); // This frees this object - must be the last action in this function.
 }
 
 DefaultSharedWorkerRepository& DefaultSharedWorkerRepository::instance()
@@ -172,23 +304,67 @@ DefaultSharedWorkerRepository& DefaultSharedWorkerRepository::instance()
 void DefaultSharedWorkerRepository::workerScriptLoaded(SharedWorkerProxy& proxy, const String& userAgent, const String& workerScript, PassOwnPtr<MessagePortChannel> port)
 {
     MutexLocker lock(m_lock);
-    if (proxy.closing())
+    if (proxy.isClosing())
         return;
 
     // Another loader may have already started up a thread for this proxy - if so, just send a connect to the pre-existing thread.
     if (!proxy.thread()) {
-        RefPtr<SharedWorkerThread> thread = SharedWorkerThread::create(proxy.name(), proxy.url(), userAgent, workerScript, proxy);
+        RefPtr<SharedWorkerThread> thread = SharedWorkerThread::create(proxy.name(), proxy.url(), userAgent, workerScript, proxy, proxy);
         proxy.setThread(thread);
         thread->start();
     }
     proxy.thread()->runLoop().postTask(SharedWorkerConnectTask::create(port));
 }
 
+bool SharedWorkerRepository::isAvailable()
+{
+    // SharedWorkers are enabled on the default WebKit platform.
+    return true;
+}
+
 void SharedWorkerRepository::connect(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, const KURL& url, const String& name, ExceptionCode& ec)
 {
     DefaultSharedWorkerRepository::instance().connectToWorker(worker, port, url, name, ec);
 }
 
+void SharedWorkerRepository::documentDetached(Document* document)
+{
+    DefaultSharedWorkerRepository::instance().documentDetached(document);
+}
+
+bool SharedWorkerRepository::hasSharedWorkers(Document* document)
+{
+    return DefaultSharedWorkerRepository::instance().hasSharedWorkers(document);
+}
+
+bool DefaultSharedWorkerRepository::hasSharedWorkers(Document* document)
+{
+    MutexLocker lock(m_lock);
+    for (unsigned i = 0; i < m_proxies.size(); i++) {
+        if (m_proxies[i]->isInWorkerDocuments(document))
+            return true;
+    }
+    return false;
+}
+
+void DefaultSharedWorkerRepository::removeProxy(SharedWorkerProxy* proxy)
+{
+    MutexLocker lock(m_lock);
+    for (unsigned i = 0; i < m_proxies.size(); i++) {
+        if (proxy == m_proxies[i].get()) {
+            m_proxies.remove(i);
+            return;
+        }
+    }
+}
+
+void DefaultSharedWorkerRepository::documentDetached(Document* document)
+{
+    MutexLocker lock(m_lock);
+    for (unsigned i = 0; i < m_proxies.size(); i++)
+        m_proxies[i]->documentDetached(document);
+}
+
 void DefaultSharedWorkerRepository::connectToWorker(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, const KURL& url, const String& name, ExceptionCode& ec)
 {
     MutexLocker lock(m_lock);
@@ -214,20 +390,17 @@ void DefaultSharedWorkerRepository::connectToWorker(PassRefPtr<SharedWorker> wor
 PassRefPtr<SharedWorkerProxy> DefaultSharedWorkerRepository::getProxy(const String& name, const KURL& url)
 {
     // Look for an existing worker, and create one if it doesn't exist.
-    // Items in the cache are freed on another thread, so copy the URL before creating the origin, to make sure no references to external strings linger.
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url.copy());
-    SharedWorkerNameMap* nameMap = m_cache.get(origin);
-    if (!nameMap) {
-        nameMap = new SharedWorkerNameMap();
-        m_cache.set(origin, nameMap);
-    }
-
-    RefPtr<SharedWorkerProxy> proxy = nameMap->get(name);
-    if (!proxy.get()) {
-        proxy = SharedWorkerProxy::create(name, url);
-        nameMap->set(proxy->name(), proxy);
+    // Items in the cache are freed on another thread, so do a threadsafe copy of the URL before creating the origin,
+    // to make sure no references to external strings linger.
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(KURL(ParsedURLString, url.string().threadsafeCopy()));
+    for (unsigned i = 0; i < m_proxies.size(); i++) {
+        if (!m_proxies[i]->isClosing() && m_proxies[i]->matches(name, origin, url))
+            return m_proxies[i];
     }
-    return proxy;
+    // Proxy is not in the repository currently - create a new one.
+    RefPtr<SharedWorkerProxy> proxy = SharedWorkerProxy::create(name, url, origin.release());
+    m_proxies.append(proxy);
+    return proxy.release();
 }
 
 DefaultSharedWorkerRepository::DefaultSharedWorkerRepository()
diff --git a/WebCore/workers/DefaultSharedWorkerRepository.h b/WebCore/workers/DefaultSharedWorkerRepository.h
index 0b4e66c..c2eaff4 100644
--- a/WebCore/workers/DefaultSharedWorkerRepository.h
+++ b/WebCore/workers/DefaultSharedWorkerRepository.h
@@ -33,22 +33,24 @@
 
 #if ENABLE(SHARED_WORKERS)
 
-#include "SharedWorkerRepository.h"
+#include "ExceptionCode.h"
 #include "StringHash.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
 
 namespace WebCore {
 
+    class Document;
     class KURL;
+    class MessagePortChannel;
     class ScriptExecutionContext;
-    class SecurityOrigin;
+    class SharedWorker;
     class SharedWorkerProxy;
-
-    struct SecurityOriginHash;
-    struct SecurityOriginTraits;
+    class String;
 
     // Platform-specific implementation of the SharedWorkerRepository static interface.
     class DefaultSharedWorkerRepository : public Noncopyable {
@@ -59,6 +61,14 @@ namespace WebCore {
         // Internal implementation of SharedWorkerRepository::connect()
         void connectToWorker(PassRefPtr<SharedWorker>, PassOwnPtr<MessagePortChannel>, const KURL&, const String& name, ExceptionCode&);
 
+        // Notification that a document has been detached.
+        void documentDetached(Document*);
+
+        // Removes the passed SharedWorkerProxy from the repository.
+        void removeProxy(SharedWorkerProxy*);
+
+        bool hasSharedWorkers(Document*);
+
         static DefaultSharedWorkerRepository& instance();
     private:
         DefaultSharedWorkerRepository();
@@ -68,11 +78,9 @@ namespace WebCore {
         // Mutex used to protect internal data structures.
         Mutex m_lock;
 
-        typedef HashMap<String, RefPtr<SharedWorkerProxy> > SharedWorkerNameMap;
-        typedef HashMap<RefPtr<SecurityOrigin>, SharedWorkerNameMap*, SecurityOriginHash> SharedWorkerProxyCache;
-
-        // Items in this cache may be freed on another thread, so all keys and values must be either copied before insertion or thread safe.
-        SharedWorkerProxyCache m_cache;
+        // List of shared workers. Expectation is that there will be a limited number of shared workers, and so tracking them in a Vector is more efficient than nested HashMaps.
+        typedef Vector<RefPtr<SharedWorkerProxy> > SharedWorkerProxyRepository;
+        SharedWorkerProxyRepository m_proxies;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/SharedWorkerContext.cpp b/WebCore/workers/SharedWorkerContext.cpp
index 2c50d94..cd76e3b 100644
--- a/WebCore/workers/SharedWorkerContext.cpp
+++ b/WebCore/workers/SharedWorkerContext.cpp
@@ -39,10 +39,16 @@
 #include "MessageEvent.h"
 #include "NotImplemented.h"
 #include "SharedWorkerThread.h"
-#include "WorkerObjectProxy.h"
 
 namespace WebCore {
 
+PassRefPtr<MessageEvent> createConnectEvent(PassRefPtr<MessagePort> port)
+{
+    RefPtr<MessageEvent> event = MessageEvent::create(new MessagePortArray(1, port));
+    event->initEvent(eventNames().connectEvent, false, false);
+    return event;
+}
+
 SharedWorkerContext::SharedWorkerContext(const String& name, const KURL& url, const String& userAgent, SharedWorkerThread* thread)
     : WorkerContext(url, userAgent, thread)
     , m_name(name)
@@ -53,36 +59,6 @@ SharedWorkerContext::~SharedWorkerContext()
 {
 }
 
-void SharedWorkerContext::forwardException(const String&, int, const String&)
-{
-    // FIXME: forward to console (do not need to report to parent context).
-}
-
-void SharedWorkerContext::addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String&, unsigned, const String&)
-{
-    // FIXME: forward to console.
-    notImplemented();
-}
-
-void SharedWorkerContext::dispatchConnect(PassRefPtr<MessagePort> port)
-{
-    // Since close() stops the thread event loop, this should not ever get called while closing.
-    ASSERT(!isClosing());
-    // The connect event uses the MessageEvent interface, but has the name "connect".
-    RefPtr<Event> event = MessageEvent::create("", "", "", 0, port);
-    event->initEvent(eventNames().connectEvent, false, false);
-
-    if (m_onconnectListener.get()) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        m_onconnectListener->handleEvent(event.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(event.release(), ec);
-    ASSERT(!ec);
-}
-
 SharedWorkerThread* SharedWorkerContext::thread()
 {
     return static_cast<SharedWorkerThread*>(Base::thread());
diff --git a/WebCore/workers/SharedWorkerContext.h b/WebCore/workers/SharedWorkerContext.h
index a7e4133..59a7605 100644
--- a/WebCore/workers/SharedWorkerContext.h
+++ b/WebCore/workers/SharedWorkerContext.h
@@ -37,6 +37,7 @@
 
 namespace WebCore {
 
+    class MessageEvent;
     class SharedWorkerThread;
 
     class SharedWorkerContext : public WorkerContext {
@@ -50,28 +51,21 @@ namespace WebCore {
 
         virtual bool isSharedWorkerContext() const { return true; }
 
-        // ScriptExecutionContext
-        virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
-
-        virtual void forwardException(const String& errorMessage, int lineNumber, const String& sourceURL);
-
         // EventTarget
         virtual SharedWorkerContext* toSharedWorkerContext() { return this; }
 
         // Setters/Getters for attributes in SharedWorkerContext.idl
-        void setOnconnect(PassRefPtr<EventListener> eventListener) { m_onconnectListener = eventListener; }
-        EventListener* onconnect() const { return m_onconnectListener.get(); }
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(connect);
         String name() const { return m_name; }
 
-        void dispatchConnect(PassRefPtr<MessagePort>);
-
         SharedWorkerThread* thread();
     private:
         SharedWorkerContext(const String& name, const KURL&, const String&, SharedWorkerThread*);
-        RefPtr<EventListener> m_onconnectListener;
         String m_name;
     };
 
+    PassRefPtr<MessageEvent> createConnectEvent(PassRefPtr<MessagePort>);
+
 } // namespace WebCore
 
 #endif // ENABLE(SHARED_WORKERS)
diff --git a/WebCore/workers/SharedWorkerContext.idl b/WebCore/workers/SharedWorkerContext.idl
index 8e450e0..a48e5bd 100644
--- a/WebCore/workers/SharedWorkerContext.idl
+++ b/WebCore/workers/SharedWorkerContext.idl
@@ -32,7 +32,6 @@ module threads {
 
     interface [
         Conditional=SHARED_WORKERS,
-        CustomMarkFunction,
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         GenerateNativeConverter,
diff --git a/WebCore/workers/SharedWorkerRepository.h b/WebCore/workers/SharedWorkerRepository.h
index 84acf77..49f3941 100644
--- a/WebCore/workers/SharedWorkerRepository.h
+++ b/WebCore/workers/SharedWorkerRepository.h
@@ -34,12 +34,12 @@
 #if ENABLE(SHARED_WORKERS)
 
 #include "ExceptionCode.h"
-
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
+    class Document;
     class KURL;
     class MessagePortChannel;
     class SharedWorker;
@@ -48,8 +48,17 @@ namespace WebCore {
     // Interface to a repository which manages references to the set of active shared workers.
     class SharedWorkerRepository {
     public:
+        // Returns true if the platform supports SharedWorkers, otherwise false.
+        static bool isAvailable();
+
         // Connects the passed SharedWorker object with the specified worker thread, creating a new thread if necessary.
         static void connect(PassRefPtr<SharedWorker>, PassOwnPtr<MessagePortChannel>, const KURL&, const String& name, ExceptionCode&);
+
+        // Invoked when a document has been detached.
+        static void documentDetached(Document*);
+
+        // Returns true if the passed document is associated with any SharedWorkers.
+        static bool hasSharedWorkers(Document*);
     private:
         SharedWorkerRepository() { }
     };
diff --git a/WebCore/workers/SharedWorkerThread.cpp b/WebCore/workers/SharedWorkerThread.cpp
index 40bb2de..e59df4f 100644
--- a/WebCore/workers/SharedWorkerThread.cpp
+++ b/WebCore/workers/SharedWorkerThread.cpp
@@ -38,14 +38,14 @@
 
 namespace WebCore {
 
-PassRefPtr<SharedWorkerThread> SharedWorkerThread::create(const String& name, const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy)
+PassRefPtr<SharedWorkerThread> SharedWorkerThread::create(const String& name, const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
 {
-    return adoptRef(new SharedWorkerThread(name, scriptURL, userAgent, sourceCode, workerLoaderProxy));
+    return adoptRef(new SharedWorkerThread(name, scriptURL, userAgent, sourceCode, workerLoaderProxy, workerReportingProxy));
 }
 
-SharedWorkerThread::SharedWorkerThread(const String& name, const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy)
-    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy)
-    , m_name(name.copy())
+SharedWorkerThread::SharedWorkerThread(const String& name, const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
+    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy, workerReportingProxy)
+    , m_name(name.crossThreadString())
 {
 }
 
diff --git a/WebCore/workers/SharedWorkerThread.h b/WebCore/workers/SharedWorkerThread.h
index 15838d7..d96fd2a 100644
--- a/WebCore/workers/SharedWorkerThread.h
+++ b/WebCore/workers/SharedWorkerThread.h
@@ -38,14 +38,14 @@ namespace WebCore {
 
     class SharedWorkerThread : public WorkerThread {
     public:
-        static PassRefPtr<SharedWorkerThread> create(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&);
+        static PassRefPtr<SharedWorkerThread> create(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&);
         ~SharedWorkerThread();
 
     protected:
         virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String&);
 
     private:
-        SharedWorkerThread(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&);
+        SharedWorkerThread(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&);
 
         String m_name;
     };
diff --git a/WebCore/workers/Worker.cpp b/WebCore/workers/Worker.cpp
index a906134..864b7c6 100644
--- a/WebCore/workers/Worker.cpp
+++ b/WebCore/workers/Worker.cpp
@@ -58,7 +58,7 @@ Worker::Worker(const String& url, ScriptExecutionContext* context, ExceptionCode
         return;
 
     m_scriptLoader = new WorkerScriptLoader();
-    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), scriptURL, DenyCrossOriginRedirect, this);
+    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), scriptURL, DenyCrossOriginRequests, this);
     setPendingActivity(this);  // The worker context does not exist while loading, so we must ensure that the worker object is not collected, as well as its event listeners.
 }
 
@@ -69,18 +69,27 @@ Worker::~Worker()
     m_contextProxy->workerObjectDestroyed();
 }
 
-void Worker::postMessage(const String& message, ExceptionCode& ec)
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
-    postMessage(message, 0, ec);
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, ec);
 }
 
-void Worker::postMessage(const String& message, MessagePort* messagePort, ExceptionCode& ec)
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
+{
+    postMessage(message, static_cast<MessagePortArray*>(0), ec);
+}
+
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     // Disentangle the port in preparation for sending it to the remote context.
-    OwnPtr<MessagePortChannel> channel = messagePort ? messagePort->disentangle(ec) : 0;
+    OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
     if (ec)
         return;
-    m_contextProxy->postMessageToWorkerContext(message, channel.release());
+    m_contextProxy->postMessageToWorkerContext(message, channels.release());
 }
 
 void Worker::terminate()
@@ -107,7 +116,7 @@ bool Worker::hasPendingActivity() const
 void Worker::notifyFinished()
 {
     if (m_scriptLoader->failed())
-        dispatchLoadErrorEvent();
+        dispatchEvent(Event::create(eventNames().errorEvent, false, true));
     else
         m_contextProxy->startWorkerContext(m_scriptLoader->url(), scriptExecutionContext()->userAgent(m_scriptLoader->url()), m_scriptLoader->script());
 
@@ -116,21 +125,6 @@ void Worker::notifyFinished()
     unsetPendingActivity(this);
 }
 
-void Worker::dispatchMessage(const String& message, PassRefPtr<MessagePort> port)
-{
-    RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, port);
-
-    if (m_onMessageListener.get()) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        m_onMessageListener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/WebCore/workers/Worker.h b/WebCore/workers/Worker.h
index 66a8ae9..6b8fa84 100644
--- a/WebCore/workers/Worker.h
+++ b/WebCore/workers/Worker.h
@@ -33,7 +33,9 @@
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
+#include "MessagePort.h"
 #include "WorkerScriptLoaderClient.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -56,20 +58,18 @@ namespace WebCore {
 
         virtual Worker* toWorker() { return this; }
 
-        void postMessage(const String&, ExceptionCode&);
-        void postMessage(const String&, MessagePort*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, const MessagePortArray*, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, ExceptionCode&);
 
         void terminate();
 
-        void dispatchMessage(const String&, PassRefPtr<MessagePort>);
-        void dispatchErrorEvent();
-
         virtual bool canSuspend() const;
         virtual void stop();
         virtual bool hasPendingActivity() const;
-
-        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onMessageListener = eventListener; }
-        EventListener* onmessage() const { return m_onMessageListener.get(); }
+    
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
 
     private:
         Worker(const String&, ScriptExecutionContext*, ExceptionCode&);
@@ -80,10 +80,7 @@ namespace WebCore {
         virtual void derefEventTarget() { deref(); }
 
         OwnPtr<WorkerScriptLoader> m_scriptLoader;
-
         WorkerContextProxy* m_contextProxy; // The proxy outlives the worker to perform thread shutdown.
-
-        RefPtr<EventListener> m_onMessageListener;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/Worker.idl b/WebCore/workers/Worker.idl
index e701523..0382739 100644
--- a/WebCore/workers/Worker.idl
+++ b/WebCore/workers/Worker.idl
@@ -28,14 +28,20 @@ module threads {
 
     interface [
         Conditional=WORKERS,
-        CustomMarkFunction,
         GenerateNativeConverter,
         GenerateToJS
     ] Worker : AbstractWorker {
 
         attribute EventListener onmessage;
-        void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
+
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [Custom] void postMessage(in SerialisedScriptValue message, in [Optional] Array messagePorts)
+            raises(DOMException);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
+        void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort)
             raises(DOMException);
+#endif
 
         void terminate();
     };
diff --git a/WebCore/workers/WorkerContext.cpp b/WebCore/workers/WorkerContext.cpp
index 722588f..f4d795b 100644
--- a/WebCore/workers/WorkerContext.cpp
+++ b/WebCore/workers/WorkerContext.cpp
@@ -50,6 +50,10 @@
 #include "XMLHttpRequestException.h"
 #include <wtf/RefPtr.h>
 
+#if ENABLE(NOTIFICATIONS)
+#include "NotificationCenter.h"
+#endif
+
 namespace WebCore {
 
 WorkerContext::WorkerContext(const KURL& url, const String& userAgent, WorkerThread* thread)
@@ -64,6 +68,12 @@ WorkerContext::WorkerContext(const KURL& url, const String& userAgent, WorkerThr
 
 WorkerContext::~WorkerContext()
 {
+    ASSERT(currentThread() == thread()->threadID());
+#if ENABLE(NOTIFICATIONS)
+    m_notifications.clear();
+#endif
+    // Notify proxy that we are going away. This can free the WorkerThread object, so do not access it after this.
+    thread()->workerReportingProxy().workerContextDestroyed();
 }
 
 ScriptExecutionContext* WorkerContext::scriptExecutionContext() const
@@ -109,7 +119,8 @@ void WorkerContext::close()
         return;
 
     m_closing = true;
-    m_thread->stop();
+    // Notify parent that this context is closed. Parent is responsible for calling WorkerThread::stop().
+    thread()->workerReportingProxy().workerContextClosed();
 }
 
 WorkerNavigator* WorkerContext::navigator() const
@@ -150,57 +161,6 @@ void WorkerContext::scriptImported(unsigned long, const String&)
     notImplemented();
 }
 
-void WorkerContext::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
-                return;
-        }
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }    
-}
-
-void WorkerContext::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-    
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
-}
-
-bool WorkerContext::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
-{
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-    
-    ListenerVector listenersCopy = m_eventListeners.get(event->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(event.get(), false);
-    }
-    
-    return !event->defaultPrevented();
-}
-
 void WorkerContext::postTask(PassRefPtr<Task> task)
 {
     thread()->runLoop().postTask(task);
@@ -228,6 +188,10 @@ void WorkerContext::clearInterval(int timeoutId)
 
 void WorkerContext::importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode& ec)
 {
+#if !ENABLE(INSPECTOR)
+    UNUSED_PARAM(callerURL);
+    UNUSED_PARAM(callerLine);
+#endif
     ec = 0;
     Vector<String>::const_iterator urlsEnd = urls.end();
     Vector<KURL> completedURLs;
@@ -239,12 +203,11 @@ void WorkerContext::importScripts(const Vector<String>& urls, const String& call
         }
         completedURLs.append(url);
     }
-    String securityOrigin = scriptExecutionContext()->securityOrigin()->toString();
     Vector<KURL>::const_iterator end = completedURLs.end();
 
     for (Vector<KURL>::const_iterator it = completedURLs.begin(); it != end; ++it) {
         WorkerScriptLoader scriptLoader;
-        scriptLoader.loadSynchronously(scriptExecutionContext(), *it, AllowCrossOriginRedirect);
+        scriptLoader.loadSynchronously(scriptExecutionContext(), *it, AllowCrossOriginRequests);
 
         // If the fetching attempt failed, throw a NETWORK_ERR exception and abort all these steps.
         if (scriptLoader.failed()) {
@@ -253,7 +216,9 @@ void WorkerContext::importScripts(const Vector<String>& urls, const String& call
         }
 
         scriptExecutionContext()->scriptImported(scriptLoader.identifier(), scriptLoader.script());
+#if ENABLE(INSPECTOR)
         scriptExecutionContext()->addMessage(InspectorControllerDestination, JSMessageSource, LogMessageType, LogMessageLevel, "Worker script imported: \"" + *it + "\".", callerLine, callerURL);
+#endif
 
         ScriptValue exception;
         m_script->evaluate(ScriptSourceCode(scriptLoader.script(), *it), &exception);
@@ -268,10 +233,34 @@ void WorkerContext::reportException(const String& errorMessage, int lineNumber,
 {
     bool errorHandled = false;
     if (onerror())
-        errorHandled = onerror()->reportError(errorMessage, sourceURL, lineNumber);
+        errorHandled = onerror()->reportError(this, errorMessage, sourceURL, lineNumber);
 
     if (!errorHandled)
-        forwardException(errorMessage, lineNumber, sourceURL);
+        thread()->workerReportingProxy().postExceptionToWorkerObject(errorMessage, lineNumber, sourceURL);
+}
+
+void WorkerContext::addMessage(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
+{
+    thread()->workerReportingProxy().postConsoleMessageToWorkerObject(destination, source, type, level, message, lineNumber, sourceURL);
+}
+
+#if ENABLE(NOTIFICATIONS)
+NotificationCenter* WorkerContext::webkitNotifications() const
+{
+    if (!m_notifications)
+        m_notifications = NotificationCenter::create(scriptExecutionContext(), m_thread->getNotificationPresenter());
+    return m_notifications.get();
+}
+#endif
+
+EventTargetData* WorkerContext::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* WorkerContext::ensureEventTargetData()
+{
+    return &m_eventTargetData;
 }
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerContext.h b/WebCore/workers/WorkerContext.h
index aa47475..9725cf7 100644
--- a/WebCore/workers/WorkerContext.h
+++ b/WebCore/workers/WorkerContext.h
@@ -31,6 +31,7 @@
 
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include "ScriptExecutionContext.h"
 #include "WorkerScriptController.h"
@@ -41,6 +42,7 @@
 
 namespace WebCore {
 
+    class NotificationCenter;
     class ScheduledAction;
     class WorkerLocation;
     class WorkerNavigator;
@@ -48,7 +50,6 @@ namespace WebCore {
 
     class WorkerContext : public RefCounted<WorkerContext>, public ScriptExecutionContext, public EventTarget {
     public:
-
         virtual ~WorkerContext();
 
         virtual bool isWorkerContext() const { return true; }
@@ -79,8 +80,8 @@ namespace WebCore {
         WorkerContext* self() { return this; }
         WorkerLocation* location() const;
         void close();
-        void setOnerror(PassRefPtr<EventListener> eventListener) { m_onerrorListener = eventListener; }
-        EventListener* onerror() const { return m_onerrorListener.get(); }
+
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
 
         // WorkerUtils
         virtual void importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode&);
@@ -92,19 +93,13 @@ namespace WebCore {
         int setInterval(ScheduledAction*, int timeout);
         void clearInterval(int timeoutId);
 
-        // EventTarget
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-
-        typedef Vector<RefPtr<EventListener> > ListenerVector;
-        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-        EventListenersMap& eventListeners() { return m_eventListeners; }
-
         // ScriptExecutionContext
         virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL);
+        virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
 
-        virtual void forwardException(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
+#if ENABLE(NOTIFICATIONS)
+        NotificationCenter* webkitNotifications() const;
+#endif
 
         // These methods are used for GC marking. See JSWorkerContext::markChildren(MarkStack&) in
         // JSWorkerContextCustom.cpp.
@@ -114,15 +109,19 @@ namespace WebCore {
         using RefCounted<WorkerContext>::ref;
         using RefCounted<WorkerContext>::deref;
 
+        bool isClosing() { return m_closing; }
+
     protected:
         WorkerContext(const KURL&, const String&, WorkerThread*);
-        bool isClosing() { return m_closing; }
 
     private:
         virtual void refScriptExecutionContext() { ref(); }
         virtual void derefScriptExecutionContext() { deref(); }
+
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         virtual const KURL& virtualURL() const;
         virtual KURL virtualCompleteURL(const String&) const;
@@ -136,10 +135,11 @@ namespace WebCore {
         OwnPtr<WorkerScriptController> m_script;
         WorkerThread* m_thread;
 
-        RefPtr<EventListener> m_onerrorListener;
-        EventListenersMap m_eventListeners;
-
+#if ENABLE_NOTIFICATIONS
+        mutable RefPtr<NotificationCenter> m_notifications;
+#endif
         bool m_closing;
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerContext.idl b/WebCore/workers/WorkerContext.idl
index 2404d22..17bee55 100644
--- a/WebCore/workers/WorkerContext.idl
+++ b/WebCore/workers/WorkerContext.idl
@@ -30,6 +30,7 @@ module threads {
         Conditional=WORKERS,
         CustomMarkFunction,
         DelegatingGetOwnPropertySlot,
+        EventTarget,
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         LegacyParent=JSWorkerContextBase,
@@ -69,6 +70,10 @@ module threads {
         boolean dispatchEvent(in Event evt)
             raises(EventException);
 
+#if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
+        // Notification interface
+        readonly attribute NotificationCenter webkitNotifications;
+#endif
 
         // Constructors
         attribute MessageEventConstructor MessageEvent;
@@ -77,6 +82,9 @@ module threads {
 #if ENABLE_CHANNEL_MESSAGING
         attribute [JSCCustomGetter] MessageChannelConstructor MessageChannel;
 #endif
+#if ENABLE_EVENTSOURCE
+        attribute [JSCCustomGetter] EventSourceConstructor EventSource;
+#endif
         attribute [JSCCustomGetter] XMLHttpRequestConstructor XMLHttpRequest;
     };
 
diff --git a/WebCore/workers/WorkerContextProxy.h b/WebCore/workers/WorkerContextProxy.h
index f42527e..e1ca139 100644
--- a/WebCore/workers/WorkerContextProxy.h
+++ b/WebCore/workers/WorkerContextProxy.h
@@ -33,12 +33,12 @@
 
 #if ENABLE(WORKERS)
 
+#include "MessagePort.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
     class KURL;
-    class MessagePortChannel;
     class String;
     class Worker;
 
@@ -53,7 +53,7 @@ namespace WebCore {
 
         virtual void terminateWorkerContext() = 0;
 
-        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannel>) = 0;
+        virtual void postMessageToWorkerContext(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>) = 0;
 
         virtual bool hasPendingActivity() const = 0;
 
diff --git a/WebCore/workers/WorkerMessagingProxy.cpp b/WebCore/workers/WorkerMessagingProxy.cpp
index 1dac28e..0b66694 100644
--- a/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/WebCore/workers/WorkerMessagingProxy.cpp
@@ -35,6 +35,8 @@
 #include "DedicatedWorkerThread.h"
 #include "DOMWindow.h"
 #include "Document.h"
+#include "ErrorEvent.h"
+#include "ExceptionCode.h"
 #include "GenericWorkerTask.h"
 #include "MessageEvent.h"
 #include "ScriptExecutionContext.h"
@@ -44,15 +46,15 @@ namespace WebCore {
 
 class MessageWorkerContextTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerContextTask> create(const String& message, PassOwnPtr<MessagePortChannel> channel)
+    static PassRefPtr<MessageWorkerContextTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
     {
-        return adoptRef(new MessageWorkerContextTask(message, channel));
+        return adoptRef(new MessageWorkerContextTask(message, channels));
     }
 
 private:
-    MessageWorkerContextTask(const String& message, PassOwnPtr<MessagePortChannel> channel)
-        : m_message(message.copy())
-        , m_channel(channel)
+    MessageWorkerContextTask(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+        : m_message(message->release())
+        , m_channels(channels)
     {
     }
 
@@ -60,31 +62,27 @@ private:
     {
         ASSERT(scriptContext->isWorkerContext());
         DedicatedWorkerContext* context = static_cast<DedicatedWorkerContext*>(scriptContext);
-        RefPtr<MessagePort> port;
-        if (m_channel) {
-            port = MessagePort::create(*scriptContext);
-            port->entangle(m_channel.release());
-        }
-        context->dispatchMessage(m_message, port.release());
+        OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*scriptContext, m_channels.release());
+        context->dispatchEvent(MessageEvent::create(ports.release(), m_message));
         context->thread()->workerObjectProxy().confirmMessageFromWorkerObject(context->hasPendingActivity());
     }
 
 private:
-    String m_message;
-    OwnPtr<MessagePortChannel> m_channel;
+    RefPtr<SerializedScriptValue> m_message;
+    OwnPtr<MessagePortChannelArray> m_channels;
 };
 
 class MessageWorkerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerTask> create(const String& message, PassOwnPtr<MessagePortChannel> channel, WorkerMessagingProxy* messagingProxy)
+    static PassRefPtr<MessageWorkerTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new MessageWorkerTask(message, channel, messagingProxy));
+        return adoptRef(new MessageWorkerTask(message, channels, messagingProxy));
     }
 
 private:
-    MessageWorkerTask(const String& message, PassOwnPtr<MessagePortChannel> channel, WorkerMessagingProxy* messagingProxy)
-        : m_message(message.copy())
-        , m_channel(channel)
+    MessageWorkerTask(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
+        : m_message(message->release())
+        , m_channels(channels)
         , m_messagingProxy(messagingProxy)
     {
     }
@@ -95,17 +93,13 @@ private:
         if (!workerObject || m_messagingProxy->askedToTerminate())
             return;
 
-        RefPtr<MessagePort> port;
-        if (m_channel) {
-            port = MessagePort::create(*scriptContext);
-            port->entangle(m_channel.release());
-        }
-        workerObject->dispatchMessage(m_message, port.release());
+        OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*scriptContext, m_channels.release());
+        workerObject->dispatchEvent(MessageEvent::create(ports.release(), m_message));
     }
 
 private:
-    String m_message;
-    OwnPtr<MessagePortChannel> m_channel;
+    RefPtr<SerializedScriptValue> m_message;
+    OwnPtr<MessagePortChannelArray> m_channels;
     WorkerMessagingProxy* m_messagingProxy;
 };
 
@@ -118,9 +112,9 @@ public:
 
 private:
     WorkerExceptionTask(const String& errorMessage, int lineNumber, const String& sourceURL, WorkerMessagingProxy* messagingProxy)
-        : m_errorMessage(errorMessage.copy())
+        : m_errorMessage(errorMessage.crossThreadString())
         , m_lineNumber(lineNumber)
-        , m_sourceURL(sourceURL.copy())
+        , m_sourceURL(sourceURL.crossThreadString())
         , m_messagingProxy(messagingProxy)
     {
     }
@@ -128,13 +122,13 @@ private:
     virtual void performTask(ScriptExecutionContext* context)
     {
         Worker* workerObject = m_messagingProxy->workerObject();
-        if (!workerObject || m_messagingProxy->askedToTerminate())
+        if (!workerObject)
             return;
 
-        bool errorHandled = false;
-        if (workerObject->onerror())
-            errorHandled = workerObject->dispatchScriptErrorEvent(m_errorMessage, m_sourceURL, m_lineNumber);
+        // We don't bother checking the askedToTerminate() flag here, because exceptions should *always* be reported even if the thread is terminated.
+        // This is intentionally different than the behavior in MessageWorkerTask, because terminated workers no longer deliver messages (section 4.6 of the WebWorker spec), but they do report exceptions.
 
+        bool errorHandled = !workerObject->dispatchEvent(ErrorEvent::create(m_errorMessage, m_sourceURL, m_lineNumber));
         if (!errorHandled)
             context->reportException(m_errorMessage, m_lineNumber, m_sourceURL);
     }
@@ -166,6 +160,27 @@ private:
     WorkerMessagingProxy* m_messagingProxy;
 };
 
+class WorkerTerminateTask : public ScriptExecutionContext::Task {
+public:
+    static PassRefPtr<WorkerTerminateTask> create(WorkerMessagingProxy* messagingProxy)
+    {
+        return adoptRef(new WorkerTerminateTask(messagingProxy));
+    }
+
+private:
+    WorkerTerminateTask(WorkerMessagingProxy* messagingProxy)
+        : m_messagingProxy(messagingProxy)
+    {
+    }
+
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        m_messagingProxy->terminateWorkerContext();
+    }
+
+    WorkerMessagingProxy* m_messagingProxy;
+};
+
 class WorkerThreadActivityReportTask : public ScriptExecutionContext::Task {
 public:
     static PassRefPtr<WorkerThreadActivityReportTask> create(WorkerMessagingProxy* messagingProxy, bool confirmingMessage, bool hasPendingActivity)
@@ -225,21 +240,21 @@ void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const Strin
     thread->start();
 }
 
-void WorkerMessagingProxy::postMessageToWorkerObject(const String& message, PassOwnPtr<MessagePortChannel> channel)
+void WorkerMessagingProxy::postMessageToWorkerObject(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
-    m_scriptExecutionContext->postTask(MessageWorkerTask::create(message, channel, this));
+    m_scriptExecutionContext->postTask(MessageWorkerTask::create(message, channels.release(), this));
 }
 
-void WorkerMessagingProxy::postMessageToWorkerContext(const String& message, PassOwnPtr<MessagePortChannel> channel)
+void WorkerMessagingProxy::postMessageToWorkerContext(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
     if (m_askedToTerminate)
         return;
 
     if (m_workerThread) {
         ++m_unconfirmedMessageCount;
-        m_workerThread->runLoop().postTask(MessageWorkerContextTask::create(message, channel));
+        m_workerThread->runLoop().postTask(MessageWorkerContextTask::create(message, channels.release()));
     } else
-        m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message, channel));
+        m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message, channels.release()));
 }
 
 void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
@@ -309,6 +324,12 @@ void WorkerMessagingProxy::workerContextDestroyed()
     // Will execute workerContextDestroyedInternal() on context's thread.
 }
 
+void WorkerMessagingProxy::workerContextClosed()
+{
+    // Executes terminateWorkerContext() on parent context's thread.
+    m_scriptExecutionContext->postTask(WorkerTerminateTask::create(this));
+}
+
 void WorkerMessagingProxy::workerContextDestroyedInternal()
 {
     // WorkerContextDestroyedTask is always the last to be performed, so the proxy is not needed for communication
diff --git a/WebCore/workers/WorkerMessagingProxy.h b/WebCore/workers/WorkerMessagingProxy.h
index 841fc9a..754102a 100644
--- a/WebCore/workers/WorkerMessagingProxy.h
+++ b/WebCore/workers/WorkerMessagingProxy.h
@@ -42,7 +42,6 @@
 namespace WebCore {
 
     class DedicatedWorkerThread;
-    class MessagePortChannel;
     class ScriptExecutionContext;
     class String;
     class Worker;
@@ -55,17 +54,18 @@ namespace WebCore {
         // (Only use these methods in the worker object thread.)
         virtual void startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode);
         virtual void terminateWorkerContext();
-        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannel>);
+        virtual void postMessageToWorkerContext(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
         virtual bool hasPendingActivity() const;
         virtual void workerObjectDestroyed();
 
         // Implementations of WorkerObjectProxy.
         // (Only use these methods in the worker context thread.)
-        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannel>);
+        virtual void postMessageToWorkerObject(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
         virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
         virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL);
         virtual void confirmMessageFromWorkerObject(bool hasPendingActivity);
         virtual void reportPendingActivity(bool hasPendingActivity);
+        virtual void workerContextClosed();
         virtual void workerContextDestroyed();
 
         // Implementation of WorkerLoaderProxy.
diff --git a/WebCore/workers/WorkerObjectProxy.h b/WebCore/workers/WorkerObjectProxy.h
index c5f4456..33e0bc3 100644
--- a/WebCore/workers/WorkerObjectProxy.h
+++ b/WebCore/workers/WorkerObjectProxy.h
@@ -33,31 +33,24 @@
 
 #if ENABLE(WORKERS)
 
-#include "Console.h"
-
+#include "WorkerReportingProxy.h"
+#include "MessagePort.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
     class MessagePortChannel;
-    class String;
 
     // A proxy to talk to the worker object.
-    class WorkerObjectProxy {
+    class WorkerObjectProxy : public WorkerReportingProxy {
     public:
-        virtual ~WorkerObjectProxy() {}
-
-        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannel>) = 0;
-
-        virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
-
-        virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL) = 0;
+        virtual void postMessageToWorkerObject(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>) = 0;
 
         virtual void confirmMessageFromWorkerObject(bool hasPendingActivity) = 0;
-
         virtual void reportPendingActivity(bool hasPendingActivity) = 0;
 
-        virtual void workerContextDestroyed() = 0;
+        // No need to notify the parent page context when dedicated workers are closing.
+        virtual void workerContextClosed() { }
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8WorkerContextObjectEventListener.h b/WebCore/workers/WorkerReportingProxy.h
index 6471637..f0447c8 100644
--- a/WebCore/bindings/v8/V8WorkerContextObjectEventListener.h
+++ b/WebCore/workers/WorkerReportingProxy.h
@@ -28,32 +28,34 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8WorkerContextObjectEventListener_h
-#define V8WorkerContextObjectEventListener_h
+#ifndef WorkerReportingProxy_h
+#define WorkerReportingProxy_h
 
 #if ENABLE(WORKERS)
 
-#include "V8WorkerContextEventListener.h"
-#include <v8.h>
-#include <wtf/PassRefPtr.h>
+#include "Console.h"
 
 namespace WebCore {
 
-    class WorkerContextExecutionProxy;
+    class String;
 
-    class V8WorkerContextObjectEventListener : public V8WorkerContextEventListener {
+    // APIs used by workers to report console activity.
+    class WorkerReportingProxy {
     public:
-        static PassRefPtr<V8WorkerContextObjectEventListener> create(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
-        {
-            return adoptRef(new V8WorkerContextObjectEventListener(proxy, listener, isInline));
-        }
+        virtual ~WorkerReportingProxy() {}
 
-    private:
-        V8WorkerContextObjectEventListener(WorkerContextExecutionProxy*, v8::Local<v8::Object> listener, bool isInline);
-    };
+        virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
+
+        virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL) = 0;
 
+        // Invoked when close() is invoked on the worker context.
+        virtual void workerContextClosed() = 0;
+
+        // Invoked when the thread has stopped.
+        virtual void workerContextDestroyed() = 0;
+    };
 } // namespace WebCore
 
-#endif // WORKERS
+#endif // ENABLE(WORKERS)
 
-#endif // V8WorkerContextObjectEventListener_h
+#endif // WorkerReportingProxy_h
diff --git a/WebCore/workers/WorkerRunLoop.cpp b/WebCore/workers/WorkerRunLoop.cpp
index cb31fe7..39b21c6 100644
--- a/WebCore/workers/WorkerRunLoop.cpp
+++ b/WebCore/workers/WorkerRunLoop.cpp
@@ -77,7 +77,7 @@ public:
 private:
     Task(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
         : m_task(task)
-        , m_mode(mode.copy())
+        , m_mode(mode.crossThreadString())
     {
     }
 
@@ -173,6 +173,10 @@ MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const Mo
     RefPtr<Task> task;
     MessageQueueWaitResult result = m_messageQueue.waitForMessageFilteredWithTimeout(task, predicate, absoluteTime);
 
+    // If the context is closing, don't dispatch any further tasks (per section 4.1.1 of the Web Workers spec).
+    if (context->isClosing())
+        return result;
+
     switch (result) {
     case MessageQueueTerminated:
         break;
@@ -201,7 +205,7 @@ void WorkerRunLoop::postTask(PassRefPtr<ScriptExecutionContext::Task> task)
 
 void WorkerRunLoop::postTaskForMode(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
-    m_messageQueue.append(Task::create(task, mode.copy()));
+    m_messageQueue.append(Task::create(task, mode.crossThreadString()));
 }
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerScriptLoader.cpp b/WebCore/workers/WorkerScriptLoader.cpp
index 0162b26..52baf2d 100644
--- a/WebCore/workers/WorkerScriptLoader.cpp
+++ b/WebCore/workers/WorkerScriptLoader.cpp
@@ -50,7 +50,7 @@ WorkerScriptLoader::WorkerScriptLoader()
 {
 }
 
-void WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecutionContext, const KURL& url, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+void WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecutionContext, const KURL& url, CrossOriginRequestPolicy crossOriginRequestPolicy)
 {
     m_url = url;
 
@@ -59,10 +59,15 @@ void WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecuti
         return;
 
     ASSERT(scriptExecutionContext->isWorkerContext());
-    WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(scriptExecutionContext), *request, *this, AllowStoredCredentials, crossOriginRedirectPolicy);
+
+    ThreadableLoaderOptions options;
+    options.allowCredentials = true;
+    options.crossOriginRequestPolicy = crossOriginRequestPolicy;
+
+    WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(scriptExecutionContext), *request, *this, options);
 }
     
-void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext* scriptExecutionContext, const KURL& url, CrossOriginRedirectPolicy crossOriginRedirectPolicy, WorkerScriptLoaderClient* client)
+void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext* scriptExecutionContext, const KURL& url, CrossOriginRequestPolicy crossOriginRequestPolicy, WorkerScriptLoaderClient* client)
 {
     ASSERT(client);
     m_client = client;
@@ -72,7 +77,11 @@ void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext* scriptExecut
     if (!request)
         return;
 
-    m_threadableLoader = ThreadableLoader::create(scriptExecutionContext, this, *request, DoNotSendLoadCallbacks, DoNotSniffContent, AllowStoredCredentials, crossOriginRedirectPolicy);
+    ThreadableLoaderOptions options;
+    options.allowCredentials = true;
+    options.crossOriginRequestPolicy = crossOriginRequestPolicy;
+
+    m_threadableLoader = ThreadableLoader::create(scriptExecutionContext, this, *request, options);
 }
 
 PassOwnPtr<ResourceRequest> WorkerScriptLoader::createResourceRequest()
diff --git a/WebCore/workers/WorkerScriptLoader.h b/WebCore/workers/WorkerScriptLoader.h
index 2924ec8..47623f6 100644
--- a/WebCore/workers/WorkerScriptLoader.h
+++ b/WebCore/workers/WorkerScriptLoader.h
@@ -46,8 +46,8 @@ namespace WebCore {
     public:
         WorkerScriptLoader();
 
-        void loadSynchronously(ScriptExecutionContext*, const KURL&, CrossOriginRedirectPolicy);
-        void loadAsynchronously(ScriptExecutionContext*, const KURL&, CrossOriginRedirectPolicy, WorkerScriptLoaderClient*);
+        void loadSynchronously(ScriptExecutionContext*, const KURL&, CrossOriginRequestPolicy);
+        void loadAsynchronously(ScriptExecutionContext*, const KURL&, CrossOriginRequestPolicy, WorkerScriptLoaderClient*);
 
         void notifyError();
 
diff --git a/WebCore/workers/WorkerThread.cpp b/WebCore/workers/WorkerThread.cpp
index 86a5fa8..467157b 100644
--- a/WebCore/workers/WorkerThread.cpp
+++ b/WebCore/workers/WorkerThread.cpp
@@ -40,6 +40,21 @@
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
+
+static Mutex& threadCountMutex()
+{
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    return mutex;
+}
+
+unsigned WorkerThread::m_threadCount = 0;
+
+unsigned WorkerThread::workerThreadCount()
+{
+    MutexLocker lock(threadCountMutex());
+    return m_threadCount;
+}
+
 struct WorkerThreadStartupData : Noncopyable {
 public:
     static std::auto_ptr<WorkerThreadStartupData> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
@@ -56,20 +71,26 @@ private:
 
 WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
     : m_scriptURL(scriptURL.copy())
-    , m_userAgent(userAgent.copy())
-    , m_sourceCode(sourceCode.copy())
+    , m_userAgent(userAgent.crossThreadString())
+    , m_sourceCode(sourceCode.crossThreadString())
 {
 }
 
-WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy)
+WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
     : m_threadID(0)
     , m_workerLoaderProxy(workerLoaderProxy)
+    , m_workerReportingProxy(workerReportingProxy)
     , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, sourceCode))
 {
+    MutexLocker lock(threadCountMutex());
+    m_threadCount++;
 }
 
 WorkerThread::~WorkerThread()
 {
+    MutexLocker lock(threadCountMutex());
+    ASSERT(m_threadCount > 0);
+    m_threadCount--;
 }
 
 bool WorkerThread::start()
diff --git a/WebCore/workers/WorkerThread.h b/WebCore/workers/WorkerThread.h
index a6b22dc..cb33308 100644
--- a/WebCore/workers/WorkerThread.h
+++ b/WebCore/workers/WorkerThread.h
@@ -37,9 +37,11 @@
 namespace WebCore {
 
     class KURL;
+    class NotificationPresenter;
     class String;
     class WorkerContext;
     class WorkerLoaderProxy;
+    class WorkerReportingProxy;
     struct WorkerThreadStartupData;
 
     class WorkerThread : public RefCounted<WorkerThread> {
@@ -52,9 +54,18 @@ namespace WebCore {
         ThreadIdentifier threadID() const { return m_threadID; }
         WorkerRunLoop& runLoop() { return m_runLoop; }
         WorkerLoaderProxy& workerLoaderProxy() const { return m_workerLoaderProxy; }
+        WorkerReportingProxy& workerReportingProxy() const { return m_workerReportingProxy; }
+
+        // Number of active worker threads.
+        static unsigned workerThreadCount();
+
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* getNotificationPresenter() { return m_notificationPresenter; }
+        void setNotificationPresenter(NotificationPresenter* presenter) { m_notificationPresenter = presenter; }
+#endif
 
     protected:
-        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&);
+        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&);
 
         // Factory method for creating a new worker context for the thread.
         virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL& url, const String& userAgent) = 0;
@@ -72,11 +83,19 @@ namespace WebCore {
         ThreadIdentifier m_threadID;
         WorkerRunLoop m_runLoop;
         WorkerLoaderProxy& m_workerLoaderProxy;
+        WorkerReportingProxy& m_workerReportingProxy;
 
         RefPtr<WorkerContext> m_workerContext;
         Mutex m_threadCreationMutex;
 
         OwnPtr<WorkerThreadStartupData> m_startupData;
+
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* m_notificationPresenter;
+#endif
+
+        // Track the number of WorkerThread instances for use in layout tests.
+        static unsigned m_threadCount;
     };
 
 } // namespace WebCore
diff --git a/WebCore/wscript b/WebCore/wscript
index eeb0802..f183071 100644
--- a/WebCore/wscript
+++ b/WebCore/wscript
@@ -76,12 +76,11 @@ def set_options(opt):
 
 def configure(conf):
     common_configure(conf)
+    generate_webcore_derived_sources()
 
 def build(bld):
     import Options
 
-    generate_webcore_derived_sources()
-
     wk_includes = ['.', '..', 'DerivedSources',
                 wk_root, 
                 os.path.join(wk_root, 'JavaScriptCore'),
@@ -117,7 +116,7 @@ def build(bld):
         source = ' '.join(flattenSources(webcore_sources.values())),
         cxxflags = cxxflags,
         target = 'webcore',
-        uselib = 'WX ICU XML XSLT CURL ' + waf_configname,
+        uselib = 'WX ICU XML XSLT CURL ' + get_config(),
         uselib_local = '',
         install_path = output_dir,
         )
@@ -127,6 +126,11 @@ def build(bld):
         excludes = get_excludes(webcore_dir, ['*None.cpp', '*CF.cpp', '*Qt.cpp', '*Win.cpp', '*Wince.cpp', '*Gtk.cpp', '*Mac.cpp', '*Safari.cpp', '*Chromium*.cpp','*SVG*.cpp', '*AllInOne.cpp', 'test*bindings.*'])
         excludes.extend(['UserStyleSheetLoader.cpp', 'RenderMediaControls.cpp'])
 
+
+        # FIXME: undo this once these classes are fully implemented
+        excludes.append('SocketStreamErrorBase.cpp')
+        excludes.append('SocketStreamHandleBase.cpp')
+
         # intermediate sources
         excludes.append('CSSValueKeywords.c')
         excludes.append('CSSPropertyNames.cpp')
diff --git a/WebCore/xml/XMLHttpRequest.cpp b/WebCore/xml/XMLHttpRequest.cpp
index 5e20252..ca48d8d 100644
--- a/WebCore/xml/XMLHttpRequest.cpp
+++ b/WebCore/xml/XMLHttpRequest.cpp
@@ -25,7 +25,6 @@
 #include "Cache.h"
 #include "CString.h"
 #include "CrossOriginAccessControl.h"
-#include "CrossOriginPreflightResultCache.h"
 #include "DOMImplementation.h"
 #include "Document.h"
 #include "Event.h"
@@ -45,6 +44,7 @@
 #include "XMLHttpRequestUpload.h"
 #include "markup.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/RefCountedLeakCounter.h>
 
 #if USE(JSC)
 #include "JSDOMWindow.h"
@@ -52,6 +52,10 @@
 
 namespace WebCore {
 
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter xmlHttpRequestCounter("XMLHttpRequest");
+#endif
+
 struct XMLHttpRequestStaticData {
     XMLHttpRequestStaticData();
     String m_proxyHeaderPrefix;
@@ -93,25 +97,25 @@ static bool isValidToken(const String& name)
     unsigned length = name.length();
     for (unsigned i = 0; i < length; i++) {
         UChar c = name[i];
-        
+
         if (c >= 127 || c <= 32)
             return false;
-        
+
         if (c == '(' || c == ')' || c == '<' || c == '>' || c == '@' ||
             c == ',' || c == ';' || c == ':' || c == '\\' || c == '\"' ||
             c == '/' || c == '[' || c == ']' || c == '?' || c == '=' ||
             c == '{' || c == '}')
             return false;
     }
-    
+
     return true;
 }
-    
+
 static bool isValidHeaderValue(const String& name)
 {
-    // FIXME: This should really match name against 
+    // FIXME: This should really match name against
     // field-value in section 4.2 of RFC 2616.
-        
+
     return !name.contains('\r') && !name.contains('\n');
 }
 
@@ -143,15 +147,18 @@ XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context)
     , m_responseText("")
     , m_createdDocument(false)
     , m_error(false)
+    , m_uploadEventsAllowed(true)
     , m_uploadComplete(false)
     , m_sameOriginRequest(true)
-    , m_inPreflight(false)
     , m_didTellLoaderAboutRequest(false)
     , m_receivedLength(0)
     , m_lastSendLineNumber(0)
     , m_exceptionCode(0)
 {
     initializeXMLHttpRequestStaticData();
+#ifndef NDEBUG
+    xmlHttpRequestCounter.increment();
+#endif
 }
 
 XMLHttpRequest::~XMLHttpRequest()
@@ -162,6 +169,10 @@ XMLHttpRequest::~XMLHttpRequest()
     }
     if (m_upload)
         m_upload->disconnectXMLHttpRequest();
+
+#ifndef NDEBUG
+    xmlHttpRequestCounter.decrement();
+#endif
 }
 
 Document* XMLHttpRequest::document() const
@@ -207,7 +218,7 @@ Document* XMLHttpRequest::responseXML() const
             m_responseXML->write(String(m_responseText));
             m_responseXML->finishParsing();
             m_responseXML->close();
-            
+
             if (!m_responseXML->wellFormed())
                 m_responseXML = 0;
         }
@@ -224,56 +235,6 @@ XMLHttpRequestUpload* XMLHttpRequest::upload()
     return m_upload.get();
 }
 
-void XMLHttpRequest::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter)
-            if (*listenerIter == eventListener)
-                return;
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }
-}
-
-void XMLHttpRequest::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter)
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-}
-
-bool XMLHttpRequest::dispatchEvent(PassRefPtr<Event> evt, ExceptionCode& ec)
-{
-    // FIXME: check for other error conditions enumerated in the spec.
-    if (!evt || evt->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    ListenerVector listenersCopy = m_eventListeners.get(evt->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(evt.get(), false);
-    }
-
-    return !evt->defaultPrevented();
-}
-
 void XMLHttpRequest::changeState(State newState)
 {
     if (m_state != newState) {
@@ -287,10 +248,10 @@ void XMLHttpRequest::callReadyStateChangeListener()
     if (!scriptExecutionContext())
         return;
 
-    dispatchReadyStateChangeEvent();
+    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().readystatechangeEvent));
 
     if (m_state == DONE && !m_error)
-        dispatchLoadEvent();
+        dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
 }
 
 void XMLHttpRequest::setWithCredentials(bool value, ExceptionCode& ec)
@@ -322,10 +283,10 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, Exc
         ec = SYNTAX_ERR;
         return;
     }
-    
+
     // Method names are case sensitive. But since Firefox uppercases method names it knows, we'll do the same.
     String methodUpper(method.upper());
-    
+
     if (methodUpper == "TRACE" || methodUpper == "TRACK" || methodUpper == "CONNECT") {
         ec = SECURITY_ERR;
         return;
@@ -335,7 +296,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, Exc
 
     if (methodUpper == "COPY" || methodUpper == "DELETE" || methodUpper == "GET" || methodUpper == "HEAD"
         || methodUpper == "INDEX" || methodUpper == "LOCK" || methodUpper == "M-POST" || methodUpper == "MKCOL" || methodUpper == "MOVE"
-        || methodUpper == "OPTIONS" || methodUpper == "POST" || methodUpper == "PROPFIND" || methodUpper == "PROPPATCH" || methodUpper == "PUT" 
+        || methodUpper == "OPTIONS" || methodUpper == "POST" || methodUpper == "PROPFIND" || methodUpper == "PROPPATCH" || methodUpper == "PUT"
         || methodUpper == "UNLOCK")
         m_method = methodUpper;
     else
@@ -357,7 +318,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, con
 {
     KURL urlWithCredentials(url);
     urlWithCredentials.setUser(user);
-    
+
     open(method, urlWithCredentials, async, ec);
 }
 
@@ -366,7 +327,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, con
     KURL urlWithCredentials(url);
     urlWithCredentials.setUser(user);
     urlWithCredentials.setPass(password);
-    
+
     open(method, urlWithCredentials, async, ec);
 }
 
@@ -463,34 +424,23 @@ void XMLHttpRequest::send(File* body, ExceptionCode& ec)
 
 void XMLHttpRequest::createRequest(ExceptionCode& ec)
 {
-    // Upload event listeners should be disallowed for simple cross-origin requests, because POSTing to an URL that does not
-    // permit cross origin requests should look exactly like POSTing to an URL that does not respond at all. If a listener exists
-    // when creating the request, it will force preflight.
+    // The presence of upload event listeners forces us to use preflighting because POSTing to an URL that does not
+    // permit cross origin requests should look exactly like POSTing to an URL that does not respond at all.
     // Also, only async requests support upload progress events.
-    m_uploadEventsAllowed = false;
+    bool forcePreflight = false;
     if (m_async) {
-        dispatchLoadStartEvent();
+        dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));
         if (m_requestEntityBody && m_upload) {
-            m_uploadEventsAllowed = m_upload->hasListeners();
-            m_upload->dispatchLoadStartEvent();
+            forcePreflight = m_upload->hasEventListeners();
+            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));
         }
     }
 
     m_sameOriginRequest = scriptExecutionContext()->securityOrigin()->canRequest(m_url);
 
-    if (!m_sameOriginRequest) {
-        makeCrossOriginAccessRequest(ec);
-        return;
-    }
-
-    m_uploadEventsAllowed = true;
-
-    makeSameOriginRequest(ec);
-}
-
-void XMLHttpRequest::makeSameOriginRequest(ExceptionCode& ec)
-{
-    ASSERT(m_sameOriginRequest);
+    // We also remember whether upload events should be allowed for this request in case the upload listeners are
+    // added after the request is started.
+    m_uploadEventsAllowed = !isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders);
 
     ResourceRequest request(m_url);
     request.setHTTPMethod(m_method);
@@ -504,202 +454,49 @@ void XMLHttpRequest::makeSameOriginRequest(ExceptionCode& ec)
     if (m_requestHeaders.size() > 0)
         request.addHTTPHeaderFields(m_requestHeaders);
 
-    if (m_async)
-        loadRequestAsynchronously(request);
-    else
-        loadRequestSynchronously(request, ec);
-}
-
-void XMLHttpRequest::makeCrossOriginAccessRequest(ExceptionCode& ec)
-{
-    ASSERT(!m_sameOriginRequest);
-
-    if (!m_uploadEventsAllowed && isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders))
-        makeSimpleCrossOriginAccessRequest(ec);
-    else
-        makeCrossOriginAccessRequestWithPreflight(ec);
-}
-
-void XMLHttpRequest::makeSimpleCrossOriginAccessRequest(ExceptionCode& ec)
-{
-    ASSERT(isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders));
-
-    // Cross-origin requests are only defined for HTTP. We would catch this when checking response headers later, but there is no reason to send a request that's guaranteed to be denied.
-    if (!m_url.protocolInHTTPFamily()) {
-        ec = XMLHttpRequestException::NETWORK_ERR;
-        networkError();
-        return;
-    }
-
-    KURL url = m_url;
-    url.setUser(String());
-    url.setPass(String());
-
-    ResourceRequest request(url);
-    request.setHTTPMethod(m_method);
-    request.setAllowHTTPCookies(m_includeCredentials);
-    request.setHTTPOrigin(scriptExecutionContext()->securityOrigin()->toString());
-
-    if (m_requestHeaders.size() > 0)
-        request.addHTTPHeaderFields(m_requestHeaders);
-
-    if (m_requestEntityBody) {
-        ASSERT(m_method != "GET");
-        ASSERT(m_method != "HEAD");
-        request.setHTTPBody(m_requestEntityBody.release());
-    }
+    ThreadableLoaderOptions options;
+    options.sendLoadCallbacks = true;
+    options.sniffContent = false;
+    options.forcePreflight = forcePreflight;
+    options.allowCredentials = m_sameOriginRequest || m_includeCredentials;
+    options.crossOriginRequestPolicy = UseAccessControl;
 
-    if (m_async)
-        loadRequestAsynchronously(request);
-    else
-        loadRequestSynchronously(request, ec);
-}
+    m_exceptionCode = 0;
+    m_error = false;
 
-void XMLHttpRequest::makeCrossOriginAccessRequestWithPreflight(ExceptionCode& ec)
-{
-    String origin = scriptExecutionContext()->securityOrigin()->toString();
-    KURL url = m_url;
-    url.setUser(String());
-    url.setPass(String());
-
-    if (!CrossOriginPreflightResultCache::shared().canSkipPreflight(origin, url, m_includeCredentials, m_method, m_requestHeaders)) {
-        m_inPreflight = true;
-        ResourceRequest preflightRequest(url);
-        preflightRequest.setHTTPMethod("OPTIONS");
-        preflightRequest.setHTTPHeaderField("Origin", origin);
-        preflightRequest.setHTTPHeaderField("Access-Control-Request-Method", m_method);
-
-        if (m_requestHeaders.size() > 0) {
-            Vector<UChar> headerBuffer;
-            HTTPHeaderMap::const_iterator it = m_requestHeaders.begin();
-            append(headerBuffer, it->first);
-            ++it;
-
-            HTTPHeaderMap::const_iterator end = m_requestHeaders.end();
-            for (; it != end; ++it) {
-                headerBuffer.append(',');
-                headerBuffer.append(' ');
-                append(headerBuffer, it->first);
+    if (m_async) {
+        if (m_upload)
+            request.setReportUploadProgress(true);
+
+        // ThreadableLoader::create can return null here, for example if we're no longer attached to a page.
+        // This is true while running onunload handlers.
+        // FIXME: Maybe we need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
+        // FIXME: Maybe create() can return null for other reasons too?
+        m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, options);
+        if (m_loader) {
+            // Neither this object nor the JavaScript wrapper should be deleted while
+            // a request is in progress because we need to keep the listeners alive,
+            // and they are referenced by the JavaScript wrapper.
+            setPendingActivity(this);
+
+            // For now we should only balance the nonCached request count for main-thread XHRs and not
+            // Worker XHRs, as the Cache is not thread-safe.
+            // This will become irrelevant after https://bugs.webkit.org/show_bug.cgi?id=27165 is resolved.
+            if (!scriptExecutionContext()->isWorkerContext()) {
+                ASSERT(isMainThread());
+                ASSERT(!m_didTellLoaderAboutRequest);
+                cache()->loader()->nonCacheRequestInFlight(m_url);
+                m_didTellLoaderAboutRequest = true;
             }
-
-            preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
-            preflightRequest.addHTTPHeaderFields(m_requestHeaders);
-        }
-
-        if (m_async) {
-            m_uploadEventsAllowed = true;
-            loadRequestAsynchronously(preflightRequest);
-            return;
         }
+    } else
+        ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, options);
 
-        loadRequestSynchronously(preflightRequest, ec);
-        m_inPreflight = false;
-
-        if (ec)
-            return;
-    }
-
-    // Send the actual request.
-    ResourceRequest request(url);
-    request.setHTTPMethod(m_method);
-    request.setAllowHTTPCookies(m_includeCredentials);
-    request.setHTTPHeaderField("Origin", origin);
-
-    if (m_requestHeaders.size() > 0)
-        request.addHTTPHeaderFields(m_requestHeaders);
-
-    if (m_requestEntityBody) {
-        ASSERT(m_method != "GET");
-        ASSERT(m_method != "HEAD");
-        request.setHTTPBody(m_requestEntityBody.release());
-    }
-
-    if (m_async) {
-        m_uploadEventsAllowed = true;
-        loadRequestAsynchronously(request);
-        return;
-    }
-
-    loadRequestSynchronously(request, ec);
-}
-
-void XMLHttpRequest::handleAsynchronousPreflightResult()
-{
-    ASSERT(m_inPreflight);
-    ASSERT(m_async);
-
-    m_inPreflight = false;
-
-    KURL url = m_url;
-    url.setUser(String());
-    url.setPass(String());
-
-    ResourceRequest request(url);
-    request.setHTTPMethod(m_method);
-    request.setAllowHTTPCookies(m_includeCredentials);
-    request.setHTTPOrigin(scriptExecutionContext()->securityOrigin()->toString());
-
-    if (m_requestHeaders.size() > 0)
-        request.addHTTPHeaderFields(m_requestHeaders);
-
-    if (m_requestEntityBody) {
-        ASSERT(m_method != "GET");
-        ASSERT(m_method != "HEAD");
-        request.setHTTPBody(m_requestEntityBody.release());
-    }
-
-    m_uploadEventsAllowed = true;
-    loadRequestAsynchronously(request);
-}
-
-void XMLHttpRequest::loadRequestSynchronously(ResourceRequest& request, ExceptionCode& ec)
-{
-    ASSERT(!m_async);
-
-    m_loader = 0;
-    m_exceptionCode = 0;
-    StoredCredentials storedCredentials = (m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials;
-
-    ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, storedCredentials);
     if (!m_exceptionCode && m_error)
         m_exceptionCode = XMLHttpRequestException::NETWORK_ERR;
     ec = m_exceptionCode;
 }
 
-void XMLHttpRequest::loadRequestAsynchronously(ResourceRequest& request)
-{
-    ASSERT(m_async);
-    m_exceptionCode = 0;
-    // SubresourceLoader::create can return null here, for example if we're no longer attached to a page.
-    // This is true while running onunload handlers.
-    // FIXME: We need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
-    // FIXME: Maybe create can return null for other reasons too?
-    LoadCallbacks callbacks = m_inPreflight ? DoNotSendLoadCallbacks : SendLoadCallbacks;
-    StoredCredentials storedCredentials = (m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials;
-
-    if (m_upload)
-        request.setReportUploadProgress(true);
-
-    m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, callbacks, DoNotSniffContent, storedCredentials, DenyCrossOriginRedirect);
-
-    if (m_loader) {
-        // Neither this object nor the JavaScript wrapper should be deleted while
-        // a request is in progress because we need to keep the listeners alive,
-        // and they are referenced by the JavaScript wrapper.
-        setPendingActivity(this);
-        
-        // For now we should only balance the nonCached request count for main-thread XHRs and not
-        // Worker XHRs, as the Cache is not thread-safe.
-        // This will become irrelevant after https://bugs.webkit.org/show_bug.cgi?id=27165 is resolved.
-        if (!scriptExecutionContext()->isWorkerContext()) {
-            ASSERT(isMainThread());
-            ASSERT(!m_didTellLoaderAboutRequest);
-            cache()->loader()->nonCacheRequestInFlight(m_url);
-            m_didTellLoaderAboutRequest = true;
-        }
-    }
-}
-
 void XMLHttpRequest::abort()
 {
     // internalAbort() calls dropProtection(), which may release the last reference.
@@ -709,9 +506,13 @@ void XMLHttpRequest::abort()
 
     internalAbort();
 
+    m_responseText = "";
+    m_createdDocument = false;
+    m_responseXML = 0;
+
     // Clear headers as required by the spec
     m_requestHeaders.clear();
-    
+
     if ((m_state <= OPENED && !sendFlag) || m_state == DONE)
         m_state = UNSENT;
     else {
@@ -720,11 +521,11 @@ void XMLHttpRequest::abort()
         m_state = UNSENT;
     }
 
-    dispatchAbortEvent();
+    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
-            m_upload->dispatchAbortEvent();
+            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     }
 }
 
@@ -774,11 +575,11 @@ void XMLHttpRequest::genericError()
 void XMLHttpRequest::networkError()
 {
     genericError();
-    dispatchErrorEvent();
+    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
-            m_upload->dispatchErrorEvent();
+            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
     }
     internalAbort();
 }
@@ -786,15 +587,15 @@ void XMLHttpRequest::networkError()
 void XMLHttpRequest::abortError()
 {
     genericError();
-    dispatchAbortEvent();
+    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
-            m_upload->dispatchAbortEvent();
+            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     }
 }
 
-void XMLHttpRequest::dropProtection()        
+void XMLHttpRequest::dropProtection()
 {
 #if USE(JSC)
     // The XHR object itself holds on to the responseText, and
@@ -854,7 +655,7 @@ void XMLHttpRequest::setRequestHeader(const AtomicString& name, const String& va
 
 void XMLHttpRequest::setRequestHeaderInternal(const AtomicString& name, const String& value)
 {
-    pair<HTTPHeaderMap::iterator, bool> result = m_requestHeaders.add(name, value); 
+    pair<HTTPHeaderMap::iterator, bool> result = m_requestHeaders.add(name, value);
     if (!result.second)
         result.first->second += ", " + value;
 }
@@ -872,7 +673,7 @@ String XMLHttpRequest::getRequestHeader(const AtomicString& name) const
 
 String XMLHttpRequest::getAllResponseHeaders(ExceptionCode& ec) const
 {
-    if (m_state < LOADING) {
+    if (m_state < HEADERS_RECEIVED) {
         ec = INVALID_STATE_ERR;
         return "";
     }
@@ -906,25 +707,21 @@ String XMLHttpRequest::getAllResponseHeaders(ExceptionCode& ec) const
 
 String XMLHttpRequest::getResponseHeader(const AtomicString& name, ExceptionCode& ec) const
 {
-    if (m_state < LOADING) {
+    if (m_state < HEADERS_RECEIVED) {
         ec = INVALID_STATE_ERR;
-        return "";
+        return String();
     }
 
-    if (!isValidToken(name))
-        return "";
-
     // See comment in getAllResponseHeaders above.
     if (isSetCookieHeader(name) && !scriptExecutionContext()->securityOrigin()->canLoadLocalResources()) {
         reportUnsafeUsage(scriptExecutionContext(), "Refused to get unsafe header \"" + name + "\"");
-        return "";
+        return String();
     }
 
     if (!m_sameOriginRequest && !isOnAccessControlResponseHeaderWhitelist(name)) {
         reportUnsafeUsage(scriptExecutionContext(), "Refused to get unsafe header \"" + name + "\"");
-        return "";
+        return String();
     }
-
     return m_response.httpHeaderField(name);
 }
 
@@ -939,7 +736,7 @@ String XMLHttpRequest::responseMIMEType() const
     }
     if (mimeType.isEmpty())
         mimeType = "text/xml";
-    
+
     return mimeType;
 }
 
@@ -981,7 +778,7 @@ void XMLHttpRequest::didFail(const ResourceError& error)
         cache()->loader()->nonCacheRequestComplete(m_url);
         m_didTellLoaderAboutRequest = false;
     }
-    
+
     // If we are already in an error state, for instance we called abort(), bail out early.
     if (m_error)
         return;
@@ -1011,11 +808,6 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
     if (m_error)
         return;
 
-    if (m_inPreflight) {
-        didFinishLoadingPreflight();
-        return;
-    }
-
     if (m_state < HEADERS_RECEIVED)
         changeState(HEADERS_RECEIVED);
 
@@ -1023,7 +815,9 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
         m_responseText += m_decoder->flush();
 
     scriptExecutionContext()->resourceRetrievedByXMLHttpRequest(identifier, m_responseText);
+#if ENABLE(INSPECTOR)
     scriptExecutionContext()->addMessage(InspectorControllerDestination, JSMessageSource, LogMessageType, LogMessageLevel, "XHR finished loading: \"" + m_url + "\".", m_lastSendLineNumber, m_lastSendURL);
+#endif
 
     bool hadLoader = m_loader;
     m_loader = 0;
@@ -1035,75 +829,29 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
         dropProtection();
 }
 
-void XMLHttpRequest::didFinishLoadingPreflight()
-{
-    ASSERT(m_inPreflight);
-    ASSERT(!m_sameOriginRequest);
-
-    // FIXME: this can probably be moved to didReceiveResponsePreflight.
-    if (m_async)
-        handleAsynchronousPreflightResult();
-
-    if (m_loader)
-        unsetPendingActivity(this);
-}
-
 void XMLHttpRequest::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
     if (!m_upload)
         return;
 
     if (m_uploadEventsAllowed)
-        m_upload->dispatchProgressEvent(bytesSent, totalBytesToBeSent);
+        m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().progressEvent, true, static_cast<unsigned>(bytesSent), static_cast<unsigned>(totalBytesToBeSent)));
 
     if (bytesSent == totalBytesToBeSent && !m_uploadComplete) {
         m_uploadComplete = true;
         if (m_uploadEventsAllowed)
-            m_upload->dispatchLoadEvent();
+            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
     }
 }
 
 void XMLHttpRequest::didReceiveResponse(const ResourceResponse& response)
 {
-    if (m_inPreflight) {
-        didReceiveResponsePreflight(response);
-        return;
-    }
-
-    if (!m_sameOriginRequest) {
-        if (!passesAccessControlCheck(response, m_includeCredentials, scriptExecutionContext()->securityOrigin())) {
-            networkError();
-            return;
-        }
-    }
-
     m_response = response;
     m_responseEncoding = extractCharsetFromMediaType(m_mimeTypeOverride);
     if (m_responseEncoding.isEmpty())
         m_responseEncoding = response.textEncodingName();
 }
 
-void XMLHttpRequest::didReceiveResponsePreflight(const ResourceResponse& response)
-{
-    ASSERT(m_inPreflight);
-    ASSERT(!m_sameOriginRequest);
-
-    if (!passesAccessControlCheck(response, m_includeCredentials, scriptExecutionContext()->securityOrigin())) {
-        networkError();
-        return;
-    }
-
-    OwnPtr<CrossOriginPreflightResultCacheItem> preflightResult(new CrossOriginPreflightResultCacheItem(m_includeCredentials));
-    if (!preflightResult->parse(response)
-        || !preflightResult->allowsCrossOriginMethod(m_method)
-        || !preflightResult->allowsCrossOriginHeaders(m_requestHeaders)) {
-        networkError();
-        return;
-    }
-
-    CrossOriginPreflightResultCache::shared().appendEntry(scriptExecutionContext()->securityOrigin()->toString(), m_url, preflightResult.release());
-}
-
 void XMLHttpRequest::didReceiveAuthenticationCancellation(const ResourceResponse& failureResponse)
 {
     m_response = failureResponse;
@@ -1111,12 +859,12 @@ void XMLHttpRequest::didReceiveAuthenticationCancellation(const ResourceResponse
 
 void XMLHttpRequest::didReceiveData(const char* data, int len)
 {
-    if (m_inPreflight || m_error)
+    if (m_error)
         return;
 
     if (m_state < HEADERS_RECEIVED)
         changeState(HEADERS_RECEIVED);
-  
+
     if (!m_decoder) {
         if (!m_responseEncoding.isEmpty())
             m_decoder = TextResourceDecoder::create("text/plain", m_responseEncoding);
@@ -1140,7 +888,12 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
     m_responseText += m_decoder->decode(data, len);
 
     if (!m_error) {
-        updateAndDispatchOnProgress(len);
+        long long expectedLength = m_response.expectedContentLength();
+        m_receivedLength += len;
+
+        // FIXME: the spec requires that we dispatch the event according to the least
+        // frequent method between every 350ms (+/-200ms) and for every byte received.
+        dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().progressEvent, expectedLength && m_receivedLength <= expectedLength, static_cast<unsigned>(m_receivedLength), static_cast<unsigned>(expectedLength)));
 
         if (m_state != LOADING)
             changeState(LOADING);
@@ -1150,70 +903,6 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
     }
 }
 
-void XMLHttpRequest::updateAndDispatchOnProgress(unsigned int len)
-{
-    long long expectedLength = m_response.expectedContentLength();
-    m_receivedLength += len;
-
-    // FIXME: the spec requires that we dispatch the event according to the least
-    // frequent method between every 350ms (+/-200ms) and for every byte received.
-    dispatchProgressEvent(expectedLength);
-}
-
-void XMLHttpRequest::dispatchReadyStateChangeEvent()
-{
-    RefPtr<Event> evt = Event::create(eventNames().readystatechangeEvent, false, false);
-    if (m_onReadyStateChangeListener) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        m_onReadyStateChangeListener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
-void XMLHttpRequest::dispatchXMLHttpRequestProgressEvent(EventListener* listener, const AtomicString& type, bool lengthComputable, unsigned loaded, unsigned total)
-{
-    RefPtr<XMLHttpRequestProgressEvent> evt = XMLHttpRequestProgressEvent::create(type, lengthComputable, loaded, total);
-    if (listener) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        listener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
-void XMLHttpRequest::dispatchAbortEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onAbortListener.get(), eventNames().abortEvent, false, 0, 0);
-}
-
-void XMLHttpRequest::dispatchErrorEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onErrorListener.get(), eventNames().errorEvent, false, 0, 0);
-}
-
-void XMLHttpRequest::dispatchLoadEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onLoadListener.get(), eventNames().loadEvent, false, 0, 0);
-}
-
-void XMLHttpRequest::dispatchLoadStartEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onLoadStartListener.get(), eventNames().loadstartEvent, false, 0, 0);
-}
-
-void XMLHttpRequest::dispatchProgressEvent(long long expectedLength)
-{
-    dispatchXMLHttpRequestProgressEvent(m_onProgressListener.get(), eventNames().progressEvent, expectedLength && m_receivedLength <= expectedLength, 
-                                        static_cast<unsigned>(m_receivedLength), static_cast<unsigned>(expectedLength));
-}
-
 bool XMLHttpRequest::canSuspend() const
 {
     return !m_loader;
@@ -1235,4 +924,14 @@ ScriptExecutionContext* XMLHttpRequest::scriptExecutionContext() const
     return ActiveDOMObject::scriptExecutionContext();
 }
 
-} // namespace WebCore 
+EventTargetData* XMLHttpRequest::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* XMLHttpRequest::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+} // namespace WebCore
diff --git a/WebCore/xml/XMLHttpRequest.h b/WebCore/xml/XMLHttpRequest.h
index d581d3d..30744a0 100644
--- a/WebCore/xml/XMLHttpRequest.h
+++ b/WebCore/xml/XMLHttpRequest.h
@@ -23,6 +23,7 @@
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include "FormData.h"
 #include "ResourceResponse.h"
@@ -85,41 +86,23 @@ public:
     XMLHttpRequestUpload* upload();
     XMLHttpRequestUpload* optionalUpload() const { return m_upload.get(); }
 
-    void setOnreadystatechange(PassRefPtr<EventListener> eventListener) { m_onReadyStateChangeListener = eventListener; }
-    EventListener* onreadystatechange() const { return m_onReadyStateChangeListener.get(); }
-
-    void setOnabort(PassRefPtr<EventListener> eventListener) { m_onAbortListener = eventListener; }
-    EventListener* onabort() const { return m_onAbortListener.get(); }
-
-    void setOnerror(PassRefPtr<EventListener> eventListener) { m_onErrorListener = eventListener; }
-    EventListener* onerror() const { return m_onErrorListener.get(); }
-
-    void setOnload(PassRefPtr<EventListener> eventListener) { m_onLoadListener = eventListener; }
-    EventListener* onload() const { return m_onLoadListener.get(); }
-
-    void setOnloadstart(PassRefPtr<EventListener> eventListener) { m_onLoadStartListener = eventListener; }
-    EventListener* onloadstart() const { return m_onLoadStartListener.get(); }
-
-    void setOnprogress(PassRefPtr<EventListener> eventListener) { m_onProgressListener = eventListener; }
-    EventListener* onprogress() const { return m_onProgressListener.get(); }
-
-    typedef Vector<RefPtr<EventListener> > ListenerVector;
-    typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-
-    // useCapture is not used, even for add/remove pairing (for Firefox compatibility).
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-    EventListenersMap& eventListeners() { return m_eventListeners; }
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(readystatechange);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
 
     using RefCounted<XMLHttpRequest>::ref;
     using RefCounted<XMLHttpRequest>::deref;
 
 private:
     XMLHttpRequest(ScriptExecutionContext*);
-    
+
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
 
     Document* document() const;
 
@@ -135,12 +118,6 @@ private:
     virtual void didFailRedirectCheck();
     virtual void didReceiveAuthenticationCancellation(const ResourceResponse&);
 
-    // Special versions for the preflight
-    void didReceiveResponsePreflight(const ResourceResponse&);
-    void didFinishLoadingPreflight();
-
-    void updateAndDispatchOnProgress(unsigned int len);
-
     String responseMIMEType() const;
     bool responseIsXML() const;
 
@@ -159,36 +136,10 @@ private:
 
     void createRequest(ExceptionCode&);
 
-    void makeSameOriginRequest(ExceptionCode&);
-    void makeCrossOriginAccessRequest(ExceptionCode&);
-
-    void makeSimpleCrossOriginAccessRequest(ExceptionCode&);
-    void makeCrossOriginAccessRequestWithPreflight(ExceptionCode&);
-    void handleAsynchronousPreflightResult();
-
-    void loadRequestSynchronously(ResourceRequest&, ExceptionCode&);
-    void loadRequestAsynchronously(ResourceRequest&);
-
     void genericError();
     void networkError();
     void abortError();
 
-    void dispatchReadyStateChangeEvent();
-    void dispatchXMLHttpRequestProgressEvent(EventListener* listener, const AtomicString& type, bool lengthComputable, unsigned loaded, unsigned total);
-    void dispatchAbortEvent();
-    void dispatchErrorEvent();
-    void dispatchLoadEvent();
-    void dispatchLoadStartEvent();
-    void dispatchProgressEvent(long long expectedLength);
-
-    RefPtr<EventListener> m_onReadyStateChangeListener;
-    RefPtr<EventListener> m_onAbortListener;
-    RefPtr<EventListener> m_onErrorListener;
-    RefPtr<EventListener> m_onLoadListener;
-    RefPtr<EventListener> m_onLoadStartListener;
-    RefPtr<EventListener> m_onProgressListener;
-    EventListenersMap m_eventListeners;
-
     RefPtr<XMLHttpRequestUpload> m_upload;
 
     KURL m_url;
@@ -223,16 +174,16 @@ private:
     bool m_uploadComplete;
 
     bool m_sameOriginRequest;
-    bool m_allowAccess;
-    bool m_inPreflight;
     bool m_didTellLoaderAboutRequest;
 
     // Used for onprogress tracking
     long long m_receivedLength;
-    
+
     unsigned m_lastSendLineNumber;
     String m_lastSendURL;
     ExceptionCode m_exceptionCode;
+    
+    EventTargetData m_eventTargetData;
 };
 
 } // namespace WebCore
diff --git a/WebCore/xml/XMLHttpRequest.idl b/WebCore/xml/XMLHttpRequest.idl
index 79005e2..89d9c7f 100644
--- a/WebCore/xml/XMLHttpRequest.idl
+++ b/WebCore/xml/XMLHttpRequest.idl
@@ -30,6 +30,7 @@ module xml {
 
     interface [
         CustomMarkFunction,
+        EventTarget,
         NoStaticTables
     ] XMLHttpRequest {
         // From XMLHttpRequestEventTarget
diff --git a/WebCore/xml/XMLHttpRequestProgressEvent.h b/WebCore/xml/XMLHttpRequestProgressEvent.h
index 02bfdea..27f3b8c 100644
--- a/WebCore/xml/XMLHttpRequestProgressEvent.h
+++ b/WebCore/xml/XMLHttpRequestProgressEvent.h
@@ -37,7 +37,7 @@ namespace WebCore {
         {
             return adoptRef(new XMLHttpRequestProgressEvent);
         }
-        static PassRefPtr<XMLHttpRequestProgressEvent> create(const AtomicString& type, bool lengthComputable, unsigned loaded, unsigned total)
+        static PassRefPtr<XMLHttpRequestProgressEvent> create(const AtomicString& type, bool lengthComputable = false, unsigned loaded = 0, unsigned total = 0)
         {
             return adoptRef(new XMLHttpRequestProgressEvent(type, lengthComputable, loaded, total));
         }
diff --git a/WebCore/xml/XMLHttpRequestUpload.cpp b/WebCore/xml/XMLHttpRequestUpload.cpp
index d8a76d5..9d0fafc 100644
--- a/WebCore/xml/XMLHttpRequestUpload.cpp
+++ b/WebCore/xml/XMLHttpRequestUpload.cpp
@@ -41,11 +41,6 @@ XMLHttpRequestUpload::XMLHttpRequestUpload(XMLHttpRequest* xmlHttpRequest)
 {
 }
 
-bool XMLHttpRequestUpload::hasListeners() const
-{
-    return m_onAbortListener || m_onErrorListener || m_onLoadListener || m_onLoadStartListener || m_onProgressListener || !m_eventListeners.isEmpty();
-}
-
 ScriptExecutionContext* XMLHttpRequestUpload::scriptExecutionContext() const
 {
     XMLHttpRequest* xmlHttpRequest = associatedXMLHttpRequest();
@@ -54,95 +49,14 @@ ScriptExecutionContext* XMLHttpRequestUpload::scriptExecutionContext() const
     return xmlHttpRequest->scriptExecutionContext();
 }
 
-void XMLHttpRequestUpload::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
-                return;
-        }
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }
-}
-
-void XMLHttpRequestUpload::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
-}
-
-bool XMLHttpRequestUpload::dispatchEvent(PassRefPtr<Event> evt, ExceptionCode& ec)
-{
-    // FIXME: check for other error conditions enumerated in the spec.
-    if (!evt || evt->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    ListenerVector listenersCopy = m_eventListeners.get(evt->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(evt.get(), false);
-    }
-
-    return !evt->defaultPrevented();
-}
-
-void XMLHttpRequestUpload::dispatchXMLHttpRequestProgressEvent(EventListener* listener, const AtomicString& type, bool lengthComputable, unsigned loaded, unsigned total)
-{
-    RefPtr<XMLHttpRequestProgressEvent> evt = XMLHttpRequestProgressEvent::create(type, lengthComputable, loaded, total);
-    if (listener) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        listener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
-void XMLHttpRequestUpload::dispatchAbortEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onAbortListener.get(), eventNames().abortEvent, false, 0, 0);
-}
-
-void XMLHttpRequestUpload::dispatchErrorEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onErrorListener.get(), eventNames().errorEvent, false, 0, 0);
-}
-
-void XMLHttpRequestUpload::dispatchLoadEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onLoadListener.get(), eventNames().loadEvent, false, 0, 0);
-}
-
-void XMLHttpRequestUpload::dispatchLoadStartEvent()
+EventTargetData* XMLHttpRequestUpload::eventTargetData()
 {
-    dispatchXMLHttpRequestProgressEvent(m_onLoadStartListener.get(), eventNames().loadstartEvent, false, 0, 0);
+    return &m_eventTargetData;
 }
 
-void XMLHttpRequestUpload::dispatchProgressEvent(long long bytesSent, long long totalBytesToBeSent)
+EventTargetData* XMLHttpRequestUpload::ensureEventTargetData()
 {
-    dispatchXMLHttpRequestProgressEvent(m_onProgressListener.get(), eventNames().progressEvent, true, static_cast<unsigned>(bytesSent), static_cast<unsigned>(totalBytesToBeSent));
+    return &m_eventTargetData;
 }
 
 } // namespace WebCore
diff --git a/WebCore/xml/XMLHttpRequestUpload.h b/WebCore/xml/XMLHttpRequestUpload.h
index b4f40e0..7640643 100644
--- a/WebCore/xml/XMLHttpRequestUpload.h
+++ b/WebCore/xml/XMLHttpRequestUpload.h
@@ -28,6 +28,7 @@
 
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
@@ -48,8 +49,6 @@ namespace WebCore {
             return adoptRef(new XMLHttpRequestUpload(xmlHttpRequest));
         }
 
-        bool hasListeners() const;
-
         virtual XMLHttpRequestUpload* toXMLHttpRequestUpload() { return this; }
 
         XMLHttpRequest* associatedXMLHttpRequest() const { return m_xmlHttpRequest; }
@@ -57,34 +56,11 @@ namespace WebCore {
 
         ScriptExecutionContext* scriptExecutionContext() const;
 
-        void dispatchAbortEvent();
-        void dispatchErrorEvent();
-        void dispatchLoadEvent();
-        void dispatchLoadStartEvent();
-        void dispatchProgressEvent(long long bytesSent, long long totalBytesToBeSent);
-
-        void setOnabort(PassRefPtr<EventListener> eventListener) { m_onAbortListener = eventListener; }
-        EventListener* onabort() const { return m_onAbortListener.get(); }
-
-        void setOnerror(PassRefPtr<EventListener> eventListener) { m_onErrorListener = eventListener; }
-        EventListener* onerror() const { return m_onErrorListener.get(); }
-
-        void setOnload(PassRefPtr<EventListener> eventListener) { m_onLoadListener = eventListener; }
-        EventListener* onload() const { return m_onLoadListener.get(); }
-
-        void setOnloadstart(PassRefPtr<EventListener> eventListener) { m_onLoadStartListener = eventListener; }
-        EventListener* onloadstart() const { return m_onLoadStartListener.get(); }
-
-        void setOnprogress(PassRefPtr<EventListener> eventListener) { m_onProgressListener = eventListener; }
-        EventListener* onprogress() const { return m_onProgressListener.get(); }
-
-        typedef Vector<RefPtr<EventListener> > ListenerVector;
-        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-        EventListenersMap& eventListeners() { return m_eventListeners; }
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
 
         using RefCounted<XMLHttpRequestUpload>::ref;
         using RefCounted<XMLHttpRequestUpload>::deref;
@@ -92,19 +68,13 @@ namespace WebCore {
     private:
         XMLHttpRequestUpload(XMLHttpRequest*);
 
-        void dispatchXMLHttpRequestProgressEvent(EventListener*, const AtomicString& type, bool lengthComputable, unsigned loaded, unsigned total);
-
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
-
-        RefPtr<EventListener> m_onAbortListener;
-        RefPtr<EventListener> m_onErrorListener;
-        RefPtr<EventListener> m_onLoadListener;
-        RefPtr<EventListener> m_onLoadStartListener;
-        RefPtr<EventListener> m_onProgressListener;
-        EventListenersMap m_eventListeners;
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         XMLHttpRequest* m_xmlHttpRequest;
+        EventTargetData m_eventTargetData;
     };
     
 } // namespace WebCore
diff --git a/WebCore/xml/XMLHttpRequestUpload.idl b/WebCore/xml/XMLHttpRequestUpload.idl
index 3172f68..901b47c 100644
--- a/WebCore/xml/XMLHttpRequestUpload.idl
+++ b/WebCore/xml/XMLHttpRequestUpload.idl
@@ -29,8 +29,9 @@
 module xml {
 
     interface [
-        GenerateConstructor,
         CustomMarkFunction,
+        EventTarget,
+        GenerateConstructor,
         NoStaticTables
     ] XMLHttpRequestUpload {
         // From XMLHttpRequestEventTarget
diff --git a/WebCore/xml/XPathNamespace.cpp b/WebCore/xml/XPathNamespace.cpp
index 3c8c42c..9646402 100644
--- a/WebCore/xml/XPathNamespace.cpp
+++ b/WebCore/xml/XPathNamespace.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,18 +33,14 @@
 
 namespace WebCore {
 
-XPathNamespace::XPathNamespace(PassRefPtr<Element> ownerElement, const String& prefix, const String& uri)
-    : Node(ownerElement->document())
+XPathNamespace::XPathNamespace(PassRefPtr<Element> ownerElement, const AtomicString& prefix, const AtomicString& uri)
+    : Node(ownerElement->document(), CreateOther)
     , m_ownerElement(ownerElement)
     , m_prefix(prefix)
     , m_uri(uri)
 {
 }
 
-XPathNamespace::~XPathNamespace()
-{
-}
-
 Document* XPathNamespace::ownerDocument() const
 {
     return m_ownerElement->ownerDocument();
diff --git a/WebCore/xml/XPathNamespace.h b/WebCore/xml/XPathNamespace.h
index c0e4280..996cb9a 100644
--- a/WebCore/xml/XPathNamespace.h
+++ b/WebCore/xml/XPathNamespace.h
@@ -1,6 +1,6 @@
 /*
  * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,13 +34,11 @@
 
 namespace WebCore {
 
-    class Document;
-    class Element;
+    // FIXME: This class is never instantiated. Maybe it should be removed.
 
     class XPathNamespace : public Node {
-    public:
-        XPathNamespace(PassRefPtr<Element> ownerElement, const String& prefix, const String& uri);
-        virtual ~XPathNamespace();
+    private:
+        XPathNamespace(PassRefPtr<Element> ownerElement, const AtomicString& prefix, const AtomicString& uri);
 
         virtual Document* ownerDocument() const;
         virtual Element* ownerElement() const;
@@ -50,9 +48,8 @@ namespace WebCore {
         virtual String nodeValue() const;
         virtual const AtomicString& namespaceURI() const;
 
-        virtual Node::NodeType nodeType() const;
+        virtual NodeType nodeType() const;
 
-    private:
         RefPtr<Element> m_ownerElement;
         AtomicString m_prefix;
         AtomicString m_uri;
diff --git a/WebCore/xml/XSLImportRule.cpp b/WebCore/xml/XSLImportRule.cpp
index 6ceb108..b697c0d 100644
--- a/WebCore/xml/XSLImportRule.cpp
+++ b/WebCore/xml/XSLImportRule.cpp
@@ -89,7 +89,7 @@ void XSLImportRule::loadSheet()
     XSLStyleSheet* parentSheet = parentStyleSheet();
     if (!parentSheet->href().isNull())
         // use parent styleheet's URL as the base URL
-        absHref = KURL(KURL(parentSheet->href()), m_strHref).string();
+        absHref = KURL(KURL(ParsedURLString, parentSheet->href()), m_strHref).string();
     
     // Check for a cycle in our import chain.  If we encounter a stylesheet
     // in our parent chain with the same URL, then just bail.
diff --git a/WebCore/xml/XSLStyleSheet.h b/WebCore/xml/XSLStyleSheet.h
index fe97b54..c9729bb 100644
--- a/WebCore/xml/XSLStyleSheet.h
+++ b/WebCore/xml/XSLStyleSheet.h
@@ -26,8 +26,12 @@
 #if ENABLE(XSLT)
 
 #include "StyleSheet.h"
+
+#if !USE(QXMLQUERY)
 #include <libxml/parser.h>
 #include <libxslt/transform.h>
+#endif
+
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
@@ -38,10 +42,12 @@ class XSLImportRule;
     
 class XSLStyleSheet : public StyleSheet {
 public:
+#if !USE(QXMLQUERY)
     static PassRefPtr<XSLStyleSheet> create(XSLImportRule* parentImport, const String& href)
     {
         return adoptRef(new XSLStyleSheet(parentImport, href));
     }
+#endif
     static PassRefPtr<XSLStyleSheet> create(Node* parentNode, const String& href)
     {
         return adoptRef(new XSLStyleSheet(parentNode, href, false));
@@ -65,31 +71,41 @@ public:
     void loadChildSheets();
     void loadChildSheet(const String& href);
 
-    xsltStylesheetPtr compileStyleSheet();
-
     DocLoader* docLoader();
 
     Document* ownerDocument() { return m_ownerDocument; }
     void setParentStyleSheet(XSLStyleSheet* parent);
 
+#if USE(QXMLQUERY)
+    String sheetString() const { return m_sheetString; }
+#else
     xmlDocPtr document();
+    xsltStylesheetPtr compileStyleSheet();
+    xmlDocPtr locateStylesheetSubResource(xmlDocPtr parentDoc, const xmlChar* uri);
+#endif
 
     void clearDocuments();
 
-    xmlDocPtr locateStylesheetSubResource(xmlDocPtr parentDoc, const xmlChar* uri);
-    
     void markAsProcessed();
     bool processed() const { return m_processed; }
 
 private:
     XSLStyleSheet(Node* parentNode, const String& href, bool embedded);
+#if !USE(QXMLQUERY)
     XSLStyleSheet(XSLImportRule* parentImport, const String& href);
+#endif
 
     Document* m_ownerDocument;
-    xmlDocPtr m_stylesheetDoc;
     bool m_embedded;
     bool m_processed;
+
+#if USE(QXMLQUERY)
+    String m_sheetString;
+#else
+    xmlDocPtr m_stylesheetDoc;
     bool m_stylesheetDocTaken;
+#endif
+    
     XSLStyleSheet* m_parentStyleSheet;
 };
 
diff --git a/WebCore/xml/XSLStyleSheet.cpp b/WebCore/xml/XSLStyleSheetLibxslt.cpp
index b7d52f8..2ae8b82 100644
--- a/WebCore/xml/XSLStyleSheet.cpp
+++ b/WebCore/xml/XSLStyleSheetLibxslt.cpp
@@ -31,6 +31,7 @@
 #include "Document.h"
 #include "Frame.h"
 #include "Node.h"
+#include "TransformSource.h"
 #include "XMLTokenizer.h"
 #include "XMLTokenizerScope.h"
 #include "XSLImportRule.h"
@@ -57,9 +58,9 @@ namespace WebCore {
 XSLStyleSheet::XSLStyleSheet(XSLImportRule* parentRule, const String& href)
     : StyleSheet(parentRule, href)
     , m_ownerDocument(0)
-    , m_stylesheetDoc(0)
     , m_embedded(false)
     , m_processed(false) // Child sheets get marked as processed when the libxslt engine has finally seen them.
+    , m_stylesheetDoc(0)
     , m_stylesheetDocTaken(false)
     , m_parentStyleSheet(0)
 {
@@ -68,9 +69,9 @@ XSLStyleSheet::XSLStyleSheet(XSLImportRule* parentRule, const String& href)
 XSLStyleSheet::XSLStyleSheet(Node* parentNode, const String& href,  bool embedded)
     : StyleSheet(parentNode, href)
     , m_ownerDocument(parentNode->document())
-    , m_stylesheetDoc(0)
     , m_embedded(embedded)
     , m_processed(true) // The root sheet starts off processed.
+    , m_stylesheetDoc(0)
     , m_stylesheetDocTaken(false)
     , m_parentStyleSheet(0)
 {
@@ -98,7 +99,7 @@ bool XSLStyleSheet::isLoading()
 
 void XSLStyleSheet::checkLoaded()
 {
-    if (isLoading()) 
+    if (isLoading())
         return;
     if (parent())
         parent()->checkLoaded();
@@ -108,8 +109,8 @@ void XSLStyleSheet::checkLoaded()
 
 xmlDocPtr XSLStyleSheet::document()
 {
-    if (m_embedded && ownerDocument())
-        return (xmlDocPtr)ownerDocument()->transformSource();
+    if (m_embedded && ownerDocument() && ownerDocument()->transformSource())
+        return (xmlDocPtr)ownerDocument()->transformSource()->platformSource();
     return m_stylesheetDoc;
 }
 
@@ -168,7 +169,7 @@ bool XSLStyleSheet::parseString(const String& string, bool)
 
     m_stylesheetDoc = xmlCtxtReadMemory(ctxt, buffer, size,
         href().utf8().data(),
-        BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE", 
+        BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE",
         XML_PARSE_NOENT | XML_PARSE_DTDATTR | XML_PARSE_NOWARNING | XML_PARSE_NOCDATA);
     xmlFreeParserCtxt(ctxt);
 
@@ -181,15 +182,15 @@ void XSLStyleSheet::loadChildSheets()
 {
     if (!document())
         return;
-    
+
     xmlNodePtr stylesheetRoot = document()->children;
-    
+
     // Top level children may include other things such as DTD nodes, we ignore those.
     while (stylesheetRoot && stylesheetRoot->type != XML_ELEMENT_NODE)
         stylesheetRoot = stylesheetRoot->next;
-    
+
     if (m_embedded) {
-        // We have to locate (by ID) the appropriate embedded stylesheet element, so that we can walk the 
+        // We have to locate (by ID) the appropriate embedded stylesheet element, so that we can walk the
         // import/include list.
         xmlAttrPtr idNode = xmlGetID(document(), (const xmlChar*)(href().utf8().data()));
         if (!idNode)
@@ -199,7 +200,7 @@ void XSLStyleSheet::loadChildSheets()
         // FIXME: Need to handle an external URI with a # in it.  This is a pretty minor edge case, so we'll deal
         // with it later.
     }
-    
+
     if (stylesheetRoot) {
         // Walk the children of the root element and look for import/include elements.
         // Imports must occur first.
@@ -210,7 +211,7 @@ void XSLStyleSheet::loadChildSheets()
                 continue;
             }
             if (IS_XSLT_ELEM(curr) && IS_XSLT_NAME(curr, "import")) {
-                xmlChar* uriRef = xsltGetNsProp(curr, (const xmlChar*)"href", XSLT_NAMESPACE);                
+                xmlChar* uriRef = xsltGetNsProp(curr, (const xmlChar*)"href", XSLT_NAMESPACE);
                 loadChildSheet(String::fromUTF8((const char*)uriRef));
                 xmlFree(uriRef);
             } else
@@ -242,7 +243,7 @@ xsltStylesheetPtr XSLStyleSheet::compileStyleSheet()
     // FIXME: Hook up error reporting for the stylesheet compilation process.
     if (m_embedded)
         return xsltLoadStylesheetPI(document());
-    
+
     // xsltParseStylesheetDoc makes the document part of the stylesheet
     // so we have to release our pointer to it.
     ASSERT(!m_stylesheetDocTaken);
@@ -273,7 +274,7 @@ xmlDocPtr XSLStyleSheet::locateStylesheetSubResource(xmlDocPtr parentDoc, const
             if (matchedParent) {
                 if (child->processed())
                     continue; // libxslt has been given this sheet already.
-                
+
                 // Check the URI of the child stylesheet against the doc URI.
                 // In order to ensure that libxml canonicalized both URLs, we get the original href
                 // string from the import rule and canonicalize it using libxml before comparing it
@@ -295,7 +296,7 @@ xmlDocPtr XSLStyleSheet::locateStylesheetSubResource(xmlDocPtr parentDoc, const
             }
         }
     }
-    
+
     return 0;
 }
 
diff --git a/WebCore/xml/XSLStyleSheetQt.cpp b/WebCore/xml/XSLStyleSheetQt.cpp
new file mode 100644
index 0000000..6d27e20
--- /dev/null
+++ b/WebCore/xml/XSLStyleSheetQt.cpp
@@ -0,0 +1,103 @@
+/*
+ * This file is part of the XSL implementation.
+ *
+ * Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "XSLStyleSheet.h"
+
+#if ENABLE(XSLT)
+
+#include "DOMWindow.h"
+#include "Document.h"
+#include "Node.h"
+#include "NotImplemented.h"
+#include "XSLTProcessor.h"
+#include "loader.h"
+
+namespace WebCore {
+
+XSLStyleSheet::XSLStyleSheet(Node* parentNode, const String& href,  bool embedded)
+    : StyleSheet(parentNode, href)
+    , m_ownerDocument(parentNode->document())
+    , m_embedded(embedded)
+{
+}
+
+XSLStyleSheet::~XSLStyleSheet()
+{
+}
+
+bool XSLStyleSheet::isLoading()
+{
+    notImplemented();
+    return false;
+}
+
+void XSLStyleSheet::checkLoaded()
+{
+    if (ownerNode())
+        ownerNode()->sheetLoaded();
+}
+
+void XSLStyleSheet::clearDocuments()
+{
+    notImplemented();
+}
+
+DocLoader* XSLStyleSheet::docLoader()
+{
+    if (!m_ownerDocument)
+        return 0;
+    return m_ownerDocument->docLoader();
+}
+
+bool XSLStyleSheet::parseString(const String& string, bool)
+{
+    // FIXME: Fix QXmlQuery so that it allows compiling the stylesheet before setting the document
+    // to be transformed. This way we could not only check if the stylesheet is correct before using it
+    // but also turn XSLStyleSheet::sheetString() into XSLStyleSheet::query() that returns a QXmlQuery.
+
+    m_sheetString = string;
+    return !m_sheetString.isEmpty();
+}
+
+void XSLStyleSheet::loadChildSheets()
+{
+    notImplemented();
+}
+
+void XSLStyleSheet::loadChildSheet(const String&)
+{
+    notImplemented();
+}
+
+void XSLStyleSheet::setParentStyleSheet(XSLStyleSheet*)
+{
+    notImplemented();
+}
+
+void XSLStyleSheet::markAsProcessed()
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(XSLT)
diff --git a/WebCore/xml/XSLTProcessor.cpp b/WebCore/xml/XSLTProcessor.cpp
index a26fe77..b182243 100644
--- a/WebCore/xml/XSLTProcessor.cpp
+++ b/WebCore/xml/XSLTProcessor.cpp
@@ -26,10 +26,7 @@
 
 #include "XSLTProcessor.h"
 
-#include "CString.h"
-#include "Console.h"
 #include "DOMImplementation.h"
-#include "DOMWindow.h"
 #include "DocLoader.h"
 #include "DocumentFragment.h"
 #include "Frame.h"
@@ -38,166 +35,17 @@
 #include "HTMLDocument.h"
 #include "HTMLTokenizer.h" // for parseHTMLDocumentFragment
 #include "Page.h"
-#include "ResourceError.h"
-#include "ResourceHandle.h"
-#include "ResourceRequest.h"
-#include "ResourceResponse.h"
 #include "Text.h"
 #include "TextResourceDecoder.h"
 #include "XMLTokenizer.h"
-#include "XSLTExtensions.h"
-#include "XSLTUnicodeSort.h"
 #include "loader.h"
 #include "markup.h"
-#include <libxslt/imports.h>
-#include <libxslt/variables.h>
-#include <libxslt/xsltutils.h>
 #include <wtf/Assertions.h>
 #include <wtf/Platform.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(MAC)
-#include "SoftLinking.h"
-
-SOFT_LINK_LIBRARY(libxslt);
-SOFT_LINK(libxslt, xsltFreeStylesheet, void, (xsltStylesheetPtr sheet), (sheet))
-SOFT_LINK(libxslt, xsltFreeTransformContext, void, (xsltTransformContextPtr ctxt), (ctxt))
-SOFT_LINK(libxslt, xsltNewTransformContext, xsltTransformContextPtr, (xsltStylesheetPtr style, xmlDocPtr doc), (style, doc))
-SOFT_LINK(libxslt, xsltApplyStylesheetUser, xmlDocPtr, (xsltStylesheetPtr style, xmlDocPtr doc, const char** params, const char* output, FILE* profile, xsltTransformContextPtr userCtxt), (style, doc, params, output, profile, userCtxt))
-SOFT_LINK(libxslt, xsltQuoteUserParams, int, (xsltTransformContextPtr ctxt, const char** params), (ctxt, params))
-SOFT_LINK(libxslt, xsltSetCtxtSortFunc, void, (xsltTransformContextPtr ctxt, xsltSortFunc handler), (ctxt, handler))
-SOFT_LINK(libxslt, xsltSetLoaderFunc, void, (xsltDocLoaderFunc f), (f))
-SOFT_LINK(libxslt, xsltSaveResultTo, int, (xmlOutputBufferPtr buf, xmlDocPtr result, xsltStylesheetPtr style), (buf, result, style))
-SOFT_LINK(libxslt, xsltNextImport, xsltStylesheetPtr, (xsltStylesheetPtr style), (style))
-#endif
-
 namespace WebCore {
 
-void XSLTProcessor::genericErrorFunc(void*, const char*, ...)
-{
-    // It would be nice to do something with this error message.
-}
-    
-void XSLTProcessor::parseErrorFunc(void* userData, xmlError* error)
-{
-    Console* console = static_cast<Console*>(userData);
-    if (!console)
-        return;
-
-    MessageLevel level;
-    switch (error->level) {
-        case XML_ERR_NONE:
-            level = TipMessageLevel;
-            break;
-        case XML_ERR_WARNING:
-            level = WarningMessageLevel;
-            break;
-        case XML_ERR_ERROR:
-        case XML_ERR_FATAL:
-        default:
-            level = ErrorMessageLevel;
-            break;
-    }
-
-    console->addMessage(XMLMessageSource, LogMessageType, level, error->message, error->line, error->file);
-}
-
-// FIXME: There seems to be no way to control the ctxt pointer for loading here, thus we have globals.
-static XSLTProcessor* globalProcessor = 0;
-static DocLoader* globalDocLoader = 0;
-static xmlDocPtr docLoaderFunc(const xmlChar* uri,
-                                    xmlDictPtr,
-                                    int options,
-                                    void* ctxt,
-                                    xsltLoadType type)
-{
-    if (!globalProcessor)
-        return 0;
-    
-    switch (type) {
-        case XSLT_LOAD_DOCUMENT: {
-            xsltTransformContextPtr context = (xsltTransformContextPtr)ctxt;
-            xmlChar* base = xmlNodeGetBase(context->document->doc, context->node);
-            KURL url(KURL(reinterpret_cast<const char*>(base)), reinterpret_cast<const char*>(uri));
-            xmlFree(base);
-            ResourceError error;
-            ResourceResponse response;
-
-            Vector<char> data;
-
-            bool requestAllowed = globalDocLoader->frame() && globalDocLoader->doc()->securityOrigin()->canRequest(url);
-            if (requestAllowed) {
-                globalDocLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
-                requestAllowed = globalDocLoader->doc()->securityOrigin()->canRequest(response.url());
-            }
-            if (!requestAllowed) {
-                data.clear();
-                globalDocLoader->printAccessDeniedMessage(url);
-            }
-
-            Console* console = 0;
-            if (Frame* frame = globalProcessor->xslStylesheet()->ownerDocument()->frame())
-                console = frame->domWindow()->console();
-            xmlSetStructuredErrorFunc(console, XSLTProcessor::parseErrorFunc);
-            xmlSetGenericErrorFunc(console, XSLTProcessor::genericErrorFunc);
-            
-            // We don't specify an encoding here. Neither Gecko nor WinIE respects
-            // the encoding specified in the HTTP headers.
-            xmlDocPtr doc = xmlReadMemory(data.data(), data.size(), (const char*)uri, 0, options);
-
-            xmlSetStructuredErrorFunc(0, 0);
-            xmlSetGenericErrorFunc(0, 0);
-
-            return doc;
-        }
-        case XSLT_LOAD_STYLESHEET:
-            return globalProcessor->xslStylesheet()->locateStylesheetSubResource(((xsltStylesheetPtr)ctxt)->doc, uri);
-        default:
-            break;
-    }
-    
-    return 0;
-}
-
-static inline void setXSLTLoadCallBack(xsltDocLoaderFunc func, XSLTProcessor* processor, DocLoader* loader)
-{
-    xsltSetLoaderFunc(func);
-    globalProcessor = processor;
-    globalDocLoader = loader;
-}
-
-static int writeToVector(void* context, const char* buffer, int len)
-{
-    Vector<UChar>& resultOutput = *static_cast<Vector<UChar>*>(context);
-    String decodedChunk = String::fromUTF8(buffer, len);
-    resultOutput.append(decodedChunk.characters(), decodedChunk.length());
-    return len;
-}
-
-static bool saveResultToString(xmlDocPtr resultDoc, xsltStylesheetPtr sheet, String& resultString)
-{
-    xmlOutputBufferPtr outputBuf = xmlAllocOutputBuffer(0);
-    if (!outputBuf)
-        return false;
-
-    Vector<UChar> resultVector;
-    outputBuf->context = &resultVector;
-    outputBuf->writecallback = writeToVector;
-    
-    int retval = xsltSaveResultTo(outputBuf, resultDoc, sheet);
-    xmlOutputBufferClose(outputBuf);
-    if (retval < 0)
-        return false;
-
-    // Workaround for <http://bugzilla.gnome.org/show_bug.cgi?id=495668>: libxslt appends an extra line feed to the result.
-    if (resultVector.size() > 0 && resultVector[resultVector.size() - 1] == '\n')
-        resultVector.removeLast();
-
-    resultString = String::adopt(resultVector);
-
-    return true;
-}
-
 static inline void transformTextStringToXHTMLDocumentString(String& text)
 {
     // Modify the output so that it is a well-formed XHTML document with a <pre> tag enclosing the text.
@@ -213,38 +61,6 @@ static inline void transformTextStringToXHTMLDocumentString(String& text)
         "</html>\n";
 }
 
-static const char** xsltParamArrayFromParameterMap(XSLTProcessor::ParameterMap& parameters)
-{
-    if (parameters.isEmpty())
-        return 0;
-
-    const char** parameterArray = (const char**)fastMalloc(((parameters.size() * 2) + 1) * sizeof(char*));
-
-    XSLTProcessor::ParameterMap::iterator end = parameters.end();
-    unsigned index = 0;
-    for (XSLTProcessor::ParameterMap::iterator it = parameters.begin(); it != end; ++it) {
-        parameterArray[index++] = strdup(it->first.utf8().data());
-        parameterArray[index++] = strdup(it->second.utf8().data());
-    }
-    parameterArray[index] = 0;
-
-    return parameterArray;
-}
-
-static void freeXsltParamArray(const char** params)
-{
-    const char** temp = params;
-    if (!params)
-        return;
-    
-    while (*temp) {
-        free((void*)*(temp++)); // strdup returns malloc'd blocks, so we have to use free() here
-        free((void*)*(temp++));
-    }
-    fastFree(params);
-}
-
-
 PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourceString,
     const String& sourceEncoding, const String& sourceMIMEType, Node* sourceNode, Frame* frame)
 {
@@ -258,7 +74,7 @@ PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourc
         transformTextStringToXHTMLDocumentString(documentSource);
     } else
         result = ownerDocument->implementation()->createDocument(sourceMIMEType, frame, false);
-    
+
     // Before parsing, we need to save & detach the old document and get the new document
     // in place. We have to do this only if we're rendering the result document.
     if (frame) {
@@ -267,15 +83,15 @@ PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourc
         result->setTransformSourceDocument(frame->document());
         frame->setDocument(result);
     }
-    
+
     if (sourceIsDocument)
         result->setURL(ownerDocument->url());
     result->open();
-    
+
     RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create(sourceMIMEType);
     decoder->setEncoding(sourceEncoding.isEmpty() ? UTF8Encoding() : TextEncoding(sourceEncoding), TextResourceDecoder::EncodingFromXMLHeader);
     result->setDecoder(decoder.release());
-    
+
     result->write(documentSource);
     result->finishParsing();
     result->close();
@@ -285,129 +101,21 @@ PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourc
 
 static inline RefPtr<DocumentFragment> createFragmentFromSource(const String& sourceString, const String& sourceMIMEType, Document* outputDoc)
 {
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(outputDoc);
-    
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(outputDoc);
+
     if (sourceMIMEType == "text/html")
         parseHTMLDocumentFragment(sourceString, fragment.get());
     else if (sourceMIMEType == "text/plain")
-        fragment->addChild(new Text(outputDoc, sourceString));
+        fragment->addChild(Text::create(outputDoc, sourceString));
     else {
         bool successfulParse = parseXMLDocumentFragment(sourceString, fragment.get(), outputDoc->documentElement());
         if (!successfulParse)
             return 0;
     }
-    
-    // FIXME: Do we need to mess with URLs here?
-        
-    return fragment;
-}
-
-static xsltStylesheetPtr xsltStylesheetPointer(RefPtr<XSLStyleSheet>& cachedStylesheet, Node* stylesheetRootNode)
-{
-    if (!cachedStylesheet && stylesheetRootNode) {
-        cachedStylesheet = XSLStyleSheet::create(stylesheetRootNode->parent() ? stylesheetRootNode->parent() : stylesheetRootNode,
-            stylesheetRootNode->document()->url().string());
-        cachedStylesheet->parseString(createMarkup(stylesheetRootNode));
-    }
-    
-    if (!cachedStylesheet || !cachedStylesheet->document())
-        return 0;
-    
-    return cachedStylesheet->compileStyleSheet();
-}
 
-static inline xmlDocPtr xmlDocPtrFromNode(Node* sourceNode, bool& shouldDelete)
-{
-    RefPtr<Document> ownerDocument = sourceNode->document();
-    bool sourceIsDocument = (sourceNode == ownerDocument.get());
-    
-    xmlDocPtr sourceDoc = 0;
-    if (sourceIsDocument)
-        sourceDoc = (xmlDocPtr)ownerDocument->transformSource();
-    if (!sourceDoc) {
-        sourceDoc = (xmlDocPtr)xmlDocPtrForString(ownerDocument->docLoader(), createMarkup(sourceNode),
-            sourceIsDocument ? ownerDocument->url().string() : String());
-        shouldDelete = (sourceDoc != 0);
-    }
-    return sourceDoc;
-}
-
-static inline String resultMIMEType(xmlDocPtr resultDoc, xsltStylesheetPtr sheet)
-{
-    // There are three types of output we need to be able to deal with:
-    // HTML (create an HTML document), XML (create an XML document),
-    // and text (wrap in a <pre> and create an XML document).
-
-    const xmlChar* resultType = 0;
-    XSLT_GET_IMPORT_PTR(resultType, sheet, method);
-    if (resultType == 0 && resultDoc->type == XML_HTML_DOCUMENT_NODE)
-        resultType = (const xmlChar*)"html";
-    
-    if (xmlStrEqual(resultType, (const xmlChar*)"html"))
-        return "text/html";
-    else if (xmlStrEqual(resultType, (const xmlChar*)"text"))
-        return "text/plain";
-        
-    return "application/xml";
-}
-
-bool XSLTProcessor::transformToString(Node* sourceNode, String& mimeType, String& resultString, String& resultEncoding)
-{
-    RefPtr<Document> ownerDocument = sourceNode->document();
-    
-    setXSLTLoadCallBack(docLoaderFunc, this, ownerDocument->docLoader());
-    xsltStylesheetPtr sheet = xsltStylesheetPointer(m_stylesheet, m_stylesheetRootNode.get());
-    if (!sheet) {
-        setXSLTLoadCallBack(0, 0, 0);
-        return false;
-    }
-    m_stylesheet->clearDocuments();
-
-    xmlChar* origMethod = sheet->method;
-    if (!origMethod && mimeType == "text/html")
-        sheet->method = (xmlChar*)"html";
-
-    bool success = false;
-    bool shouldFreeSourceDoc = false;
-    if (xmlDocPtr sourceDoc = xmlDocPtrFromNode(sourceNode, shouldFreeSourceDoc)) {
-        // The XML declaration would prevent parsing the result as a fragment, and it's not needed even for documents, 
-        // as the result of this function is always immediately parsed.
-        sheet->omitXmlDeclaration = true;
-
-        xsltTransformContextPtr transformContext = xsltNewTransformContext(sheet, sourceDoc);
-        registerXSLTExtensions(transformContext);
-
-        // <http://bugs.webkit.org/show_bug.cgi?id=16077>: XSLT processor <xsl:sort> algorithm only compares by code point
-        xsltSetCtxtSortFunc(transformContext, xsltUnicodeSortFunction);
-
-        // This is a workaround for a bug in libxslt. 
-        // The bug has been fixed in version 1.1.13, so once we ship that this can be removed.
-        if (transformContext->globalVars == NULL)
-           transformContext->globalVars = xmlHashCreate(20);
-
-        const char** params = xsltParamArrayFromParameterMap(m_parameters);
-        xsltQuoteUserParams(transformContext, params);
-        xmlDocPtr resultDoc = xsltApplyStylesheetUser(sheet, sourceDoc, 0, 0, 0, transformContext);
-        
-        xsltFreeTransformContext(transformContext);        
-        freeXsltParamArray(params);
-        
-        if (shouldFreeSourceDoc)
-            xmlFreeDoc(sourceDoc);
-        
-        if (success = saveResultToString(resultDoc, sheet, resultString)) {
-            mimeType = resultMIMEType(resultDoc, sheet);
-            resultEncoding = (char*)resultDoc->encoding;
-        }
-        xmlFreeDoc(resultDoc);
-    }
-    
-    sheet->method = origMethod;
-    setXSLTLoadCallBack(0, 0, 0);
-    xsltFreeStylesheet(sheet);
-    m_stylesheet = 0;
+    // FIXME: Do we need to mess with URLs here?
 
-    return success;
+    return fragment;
 }
 
 PassRefPtr<Document> XSLTProcessor::transformToDocument(Node* sourceNode)
@@ -429,7 +137,7 @@ PassRefPtr<DocumentFragment> XSLTProcessor::transformToFragment(Node* sourceNode
     // If the output document is HTML, default to HTML method.
     if (outputDoc->isHTMLDocument())
         resultMIMEType = "text/html";
-    
+
     if (!transformToString(sourceNode, resultMIMEType, resultString, resultEncoding))
         return 0;
     return createFragmentFromSource(resultString, resultMIMEType, outputDoc);
@@ -455,6 +163,13 @@ void XSLTProcessor::removeParameter(const String& /*namespaceURI*/, const String
     m_parameters.remove(localName);
 }
 
+void XSLTProcessor::reset()
+{
+    m_stylesheet.clear();
+    m_stylesheetRootNode.clear();
+    m_parameters.clear();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(XSLT)
diff --git a/WebCore/xml/XSLTProcessor.h b/WebCore/xml/XSLTProcessor.h
index 9ee2aad..9b91017 100644
--- a/WebCore/xml/XSLTProcessor.h
+++ b/WebCore/xml/XSLTProcessor.h
@@ -28,9 +28,12 @@
 #include "Node.h"
 #include "StringHash.h"
 #include "XSLStyleSheet.h"
+#include <wtf/HashMap.h>
+
+#if !USE(QXMLQUERY)
 #include <libxml/parserInternals.h>
 #include <libxslt/documents.h>
-#include <wtf/HashMap.h>
+#endif
 
 namespace WebCore {
 
@@ -56,14 +59,15 @@ public:
     void removeParameter(const String& namespaceURI, const String& localName);
     void clearParameters() { m_parameters.clear(); }
 
-    void reset() { m_stylesheet.clear(); m_stylesheetRootNode.clear();  m_parameters.clear(); }
+    void reset();
 
+#if !USE(QXMLQUERY)
     static void parseErrorFunc(void* userData, xmlError*);
     static void genericErrorFunc(void* userData, const char* msg, ...);
     
-public:
     // Only for libXSLT callbacks
     XSLStyleSheet* xslStylesheet() const { return m_stylesheet.get(); }
+#endif
 
     typedef HashMap<String, String> ParameterMap;
 
diff --git a/WebCore/xml/XSLTProcessorLibxslt.cpp b/WebCore/xml/XSLTProcessorLibxslt.cpp
new file mode 100644
index 0000000..200c56b
--- /dev/null
+++ b/WebCore/xml/XSLTProcessorLibxslt.cpp
@@ -0,0 +1,335 @@
+/*
+ * This file is part of the XSL implementation.
+ *
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple, Inc. All rights reserved.
+ * Copyright (C) 2005, 2006 Alexey Proskuryakov <ap@webkit.org>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(XSLT)
+
+#include "XSLTProcessor.h"
+
+#include "Console.h"
+#include "CString.h"
+#include "DOMWindow.h"
+#include "DocLoader.h"
+#include "Frame.h"
+#include "ResourceError.h"
+#include "ResourceHandle.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "TransformSource.h"
+#include "XMLTokenizer.h"
+#include "XSLStyleSheet.h"
+#include "XSLTExtensions.h"
+#include "XSLTUnicodeSort.h"
+#include "loader.h"
+#include "markup.h"
+#include <libxslt/imports.h>
+#include <libxslt/variables.h>
+#include <libxslt/xsltutils.h>
+#include <wtf/Assertions.h>
+#include <wtf/Platform.h>
+#include <wtf/Vector.h>
+
+#if PLATFORM(MAC)
+#include "SoftLinking.h"
+
+SOFT_LINK_LIBRARY(libxslt);
+SOFT_LINK(libxslt, xsltFreeStylesheet, void, (xsltStylesheetPtr sheet), (sheet))
+SOFT_LINK(libxslt, xsltFreeTransformContext, void, (xsltTransformContextPtr ctxt), (ctxt))
+SOFT_LINK(libxslt, xsltNewTransformContext, xsltTransformContextPtr, (xsltStylesheetPtr style, xmlDocPtr doc), (style, doc))
+SOFT_LINK(libxslt, xsltApplyStylesheetUser, xmlDocPtr, (xsltStylesheetPtr style, xmlDocPtr doc, const char** params, const char* output, FILE* profile, xsltTransformContextPtr userCtxt), (style, doc, params, output, profile, userCtxt))
+SOFT_LINK(libxslt, xsltQuoteUserParams, int, (xsltTransformContextPtr ctxt, const char** params), (ctxt, params))
+SOFT_LINK(libxslt, xsltSetCtxtSortFunc, void, (xsltTransformContextPtr ctxt, xsltSortFunc handler), (ctxt, handler))
+SOFT_LINK(libxslt, xsltSetLoaderFunc, void, (xsltDocLoaderFunc f), (f))
+SOFT_LINK(libxslt, xsltSaveResultTo, int, (xmlOutputBufferPtr buf, xmlDocPtr result, xsltStylesheetPtr style), (buf, result, style))
+SOFT_LINK(libxslt, xsltNextImport, xsltStylesheetPtr, (xsltStylesheetPtr style), (style))
+#endif
+
+namespace WebCore {
+
+void XSLTProcessor::genericErrorFunc(void*, const char*, ...)
+{
+    // It would be nice to do something with this error message.
+}
+
+void XSLTProcessor::parseErrorFunc(void* userData, xmlError* error)
+{
+    Console* console = static_cast<Console*>(userData);
+    if (!console)
+        return;
+
+    MessageLevel level;
+    switch (error->level) {
+    case XML_ERR_NONE:
+        level = TipMessageLevel;
+        break;
+    case XML_ERR_WARNING:
+        level = WarningMessageLevel;
+        break;
+    case XML_ERR_ERROR:
+    case XML_ERR_FATAL:
+    default:
+        level = ErrorMessageLevel;
+        break;
+    }
+
+    console->addMessage(XMLMessageSource, LogMessageType, level, error->message, error->line, error->file);
+}
+
+// FIXME: There seems to be no way to control the ctxt pointer for loading here, thus we have globals.
+static XSLTProcessor* globalProcessor = 0;
+static DocLoader* globalDocLoader = 0;
+static xmlDocPtr docLoaderFunc(const xmlChar* uri,
+                                    xmlDictPtr,
+                                    int options,
+                                    void* ctxt,
+                                    xsltLoadType type)
+{
+    if (!globalProcessor)
+        return 0;
+
+    switch (type) {
+    case XSLT_LOAD_DOCUMENT: {
+        xsltTransformContextPtr context = (xsltTransformContextPtr)ctxt;
+        xmlChar* base = xmlNodeGetBase(context->document->doc, context->node);
+        KURL url(KURL(ParsedURLString, reinterpret_cast<const char*>(base)), reinterpret_cast<const char*>(uri));
+        xmlFree(base);
+        ResourceError error;
+        ResourceResponse response;
+
+        Vector<char> data;
+
+        bool requestAllowed = globalDocLoader->frame() && globalDocLoader->doc()->securityOrigin()->canRequest(url);
+        if (requestAllowed) {
+            globalDocLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
+            requestAllowed = globalDocLoader->doc()->securityOrigin()->canRequest(response.url());
+        }
+        if (!requestAllowed) {
+            data.clear();
+            globalDocLoader->printAccessDeniedMessage(url);
+        }
+
+        Console* console = 0;
+        if (Frame* frame = globalProcessor->xslStylesheet()->ownerDocument()->frame())
+            console = frame->domWindow()->console();
+        xmlSetStructuredErrorFunc(console, XSLTProcessor::parseErrorFunc);
+        xmlSetGenericErrorFunc(console, XSLTProcessor::genericErrorFunc);
+
+        // We don't specify an encoding here. Neither Gecko nor WinIE respects
+        // the encoding specified in the HTTP headers.
+        xmlDocPtr doc = xmlReadMemory(data.data(), data.size(), (const char*)uri, 0, options);
+
+        xmlSetStructuredErrorFunc(0, 0);
+        xmlSetGenericErrorFunc(0, 0);
+
+        return doc;
+    }
+    case XSLT_LOAD_STYLESHEET:
+        return globalProcessor->xslStylesheet()->locateStylesheetSubResource(((xsltStylesheetPtr)ctxt)->doc, uri);
+    default:
+        break;
+    }
+
+    return 0;
+}
+
+static inline void setXSLTLoadCallBack(xsltDocLoaderFunc func, XSLTProcessor* processor, DocLoader* loader)
+{
+    xsltSetLoaderFunc(func);
+    globalProcessor = processor;
+    globalDocLoader = loader;
+}
+
+static int writeToVector(void* context, const char* buffer, int len)
+{
+    Vector<UChar>& resultOutput = *static_cast<Vector<UChar>*>(context);
+    String decodedChunk = String::fromUTF8(buffer, len);
+    resultOutput.append(decodedChunk.characters(), decodedChunk.length());
+    return len;
+}
+
+static bool saveResultToString(xmlDocPtr resultDoc, xsltStylesheetPtr sheet, String& resultString)
+{
+    xmlOutputBufferPtr outputBuf = xmlAllocOutputBuffer(0);
+    if (!outputBuf)
+        return false;
+
+    Vector<UChar> resultVector;
+    outputBuf->context = &resultVector;
+    outputBuf->writecallback = writeToVector;
+
+    int retval = xsltSaveResultTo(outputBuf, resultDoc, sheet);
+    xmlOutputBufferClose(outputBuf);
+    if (retval < 0)
+        return false;
+
+    // Workaround for <http://bugzilla.gnome.org/show_bug.cgi?id=495668>: libxslt appends an extra line feed to the result.
+    if (resultVector.size() > 0 && resultVector[resultVector.size() - 1] == '\n')
+        resultVector.removeLast();
+
+    resultString = String::adopt(resultVector);
+
+    return true;
+}
+
+static const char** xsltParamArrayFromParameterMap(XSLTProcessor::ParameterMap& parameters)
+{
+    if (parameters.isEmpty())
+        return 0;
+
+    const char** parameterArray = (const char**)fastMalloc(((parameters.size() * 2) + 1) * sizeof(char*));
+
+    XSLTProcessor::ParameterMap::iterator end = parameters.end();
+    unsigned index = 0;
+    for (XSLTProcessor::ParameterMap::iterator it = parameters.begin(); it != end; ++it) {
+        parameterArray[index++] = strdup(it->first.utf8().data());
+        parameterArray[index++] = strdup(it->second.utf8().data());
+    }
+    parameterArray[index] = 0;
+
+    return parameterArray;
+}
+
+static void freeXsltParamArray(const char** params)
+{
+    const char** temp = params;
+    if (!params)
+        return;
+
+    while (*temp) {
+        free((void*)*(temp++)); // strdup returns malloc'd blocks, so we have to use free() here
+        free((void*)*(temp++));
+    }
+    fastFree(params);
+}
+
+static xsltStylesheetPtr xsltStylesheetPointer(RefPtr<XSLStyleSheet>& cachedStylesheet, Node* stylesheetRootNode)
+{
+    if (!cachedStylesheet && stylesheetRootNode) {
+        cachedStylesheet = XSLStyleSheet::create(stylesheetRootNode->parent() ? stylesheetRootNode->parent() : stylesheetRootNode,
+            stylesheetRootNode->document()->url().string());
+        cachedStylesheet->parseString(createMarkup(stylesheetRootNode));
+    }
+
+    if (!cachedStylesheet || !cachedStylesheet->document())
+        return 0;
+
+    return cachedStylesheet->compileStyleSheet();
+}
+
+static inline xmlDocPtr xmlDocPtrFromNode(Node* sourceNode, bool& shouldDelete)
+{
+    RefPtr<Document> ownerDocument = sourceNode->document();
+    bool sourceIsDocument = (sourceNode == ownerDocument.get());
+
+    xmlDocPtr sourceDoc = 0;
+    if (sourceIsDocument && ownerDocument->transformSource())
+        sourceDoc = (xmlDocPtr)ownerDocument->transformSource()->platformSource();
+    if (!sourceDoc) {
+        sourceDoc = (xmlDocPtr)xmlDocPtrForString(ownerDocument->docLoader(), createMarkup(sourceNode),
+            sourceIsDocument ? ownerDocument->url().string() : String());
+        shouldDelete = sourceDoc;
+    }
+    return sourceDoc;
+}
+
+static inline String resultMIMEType(xmlDocPtr resultDoc, xsltStylesheetPtr sheet)
+{
+    // There are three types of output we need to be able to deal with:
+    // HTML (create an HTML document), XML (create an XML document),
+    // and text (wrap in a <pre> and create an XML document).
+
+    const xmlChar* resultType = 0;
+    XSLT_GET_IMPORT_PTR(resultType, sheet, method);
+    if (!resultType && resultDoc->type == XML_HTML_DOCUMENT_NODE)
+        resultType = (const xmlChar*)"html";
+
+    if (xmlStrEqual(resultType, (const xmlChar*)"html"))
+        return "text/html";
+    if (xmlStrEqual(resultType, (const xmlChar*)"text"))
+        return "text/plain";
+
+    return "application/xml";
+}
+
+bool XSLTProcessor::transformToString(Node* sourceNode, String& mimeType, String& resultString, String& resultEncoding)
+{
+    RefPtr<Document> ownerDocument = sourceNode->document();
+
+    setXSLTLoadCallBack(docLoaderFunc, this, ownerDocument->docLoader());
+    xsltStylesheetPtr sheet = xsltStylesheetPointer(m_stylesheet, m_stylesheetRootNode.get());
+    if (!sheet) {
+        setXSLTLoadCallBack(0, 0, 0);
+        return false;
+    }
+    m_stylesheet->clearDocuments();
+
+    xmlChar* origMethod = sheet->method;
+    if (!origMethod && mimeType == "text/html")
+        sheet->method = (xmlChar*)"html";
+
+    bool success = false;
+    bool shouldFreeSourceDoc = false;
+    if (xmlDocPtr sourceDoc = xmlDocPtrFromNode(sourceNode, shouldFreeSourceDoc)) {
+        // The XML declaration would prevent parsing the result as a fragment, and it's not needed even for documents,
+        // as the result of this function is always immediately parsed.
+        sheet->omitXmlDeclaration = true;
+
+        xsltTransformContextPtr transformContext = xsltNewTransformContext(sheet, sourceDoc);
+        registerXSLTExtensions(transformContext);
+
+        // <http://bugs.webkit.org/show_bug.cgi?id=16077>: XSLT processor <xsl:sort> algorithm only compares by code point
+        xsltSetCtxtSortFunc(transformContext, xsltUnicodeSortFunction);
+
+        // This is a workaround for a bug in libxslt.
+        // The bug has been fixed in version 1.1.13, so once we ship that this can be removed.
+        if (!transformContext->globalVars)
+           transformContext->globalVars = xmlHashCreate(20);
+
+        const char** params = xsltParamArrayFromParameterMap(m_parameters);
+        xsltQuoteUserParams(transformContext, params);
+        xmlDocPtr resultDoc = xsltApplyStylesheetUser(sheet, sourceDoc, 0, 0, 0, transformContext);
+
+        xsltFreeTransformContext(transformContext);
+        freeXsltParamArray(params);
+
+        if (shouldFreeSourceDoc)
+            xmlFreeDoc(sourceDoc);
+
+        if (success = saveResultToString(resultDoc, sheet, resultString)) {
+            mimeType = resultMIMEType(resultDoc, sheet);
+            resultEncoding = (char*)resultDoc->encoding;
+        }
+        xmlFreeDoc(resultDoc);
+    }
+
+    sheet->method = origMethod;
+    setXSLTLoadCallBack(0, 0, 0);
+    xsltFreeStylesheet(sheet);
+    m_stylesheet = 0;
+
+    return success;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(XSLT)
diff --git a/WebCore/xml/XSLTProcessorQt.cpp b/WebCore/xml/XSLTProcessorQt.cpp
new file mode 100644
index 0000000..50ee427
--- /dev/null
+++ b/WebCore/xml/XSLTProcessorQt.cpp
@@ -0,0 +1,149 @@
+/*
+ * This file is part of the XSL implementation.
+ *
+ * Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(XSLT)
+
+#include "XSLTProcessor.h"
+
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "TransformSource.h"
+#include "loader.h"
+#include "markup.h"
+#include <wtf/Assertions.h>
+#include <wtf/Platform.h>
+#include <wtf/Vector.h>
+
+#include <qabstractmessagehandler.h>
+#include <qbuffer.h>
+#include <qsourcelocation.h>
+#include <qxmlquery.h>
+
+namespace WebCore {
+
+class XSLTMessageHandler : public QAbstractMessageHandler {
+
+public:
+    XSLTMessageHandler(Document* document = 0);
+    virtual void handleMessage(QtMsgType type, const QString& description,
+                               const QUrl& identifier, const QSourceLocation& sourceLocation);
+
+private:
+    Document* m_document;
+};
+
+XSLTMessageHandler::XSLTMessageHandler(Document* document)
+    : QAbstractMessageHandler()
+    , m_document(document)
+{
+}
+
+void XSLTMessageHandler::handleMessage(QtMsgType type, const QString& description,
+                                       const QUrl&, const QSourceLocation& sourceLocation)
+{
+    if (!m_document->frame())
+        return;
+
+    MessageLevel level;
+    switch (type) {
+    case QtDebugMsg:
+        level = TipMessageLevel;
+        break;
+    case QtWarningMsg:
+        level = WarningMessageLevel;
+        break;
+    case QtCriticalMsg:
+    case QtFatalMsg:
+        level = ErrorMessageLevel;
+        break;
+    default:
+        level = LogMessageLevel;
+        break;
+    }
+
+    Console* console = m_document->frame()->domWindow()->console();
+    console->addMessage(XMLMessageSource, LogMessageType, level, description,
+                        sourceLocation.line(), sourceLocation.uri().toString());
+}
+
+bool XSLTProcessor::transformToString(Node* sourceNode, String&, String& resultString, String&)
+{
+    bool success = false;
+
+    RefPtr<XSLStyleSheet> stylesheet = m_stylesheet;
+    if (!stylesheet && m_stylesheetRootNode) {
+        Node* node = m_stylesheetRootNode.get();
+        stylesheet = XSLStyleSheet::create(node->parent() ? node->parent() : node, node->document()->url().string());
+        stylesheet->parseString(createMarkup(node));
+    }
+
+    if (!stylesheet || stylesheet->sheetString().isEmpty())
+        return success;
+
+    RefPtr<Document> ownerDocument = sourceNode->document();
+    bool sourceIsDocument = (sourceNode == ownerDocument.get());
+
+    QXmlQuery query(QXmlQuery::XSLT20);
+
+    XSLTMessageHandler messageHandler(ownerDocument.get());
+    query.setMessageHandler(&messageHandler);
+
+    XSLTProcessor::ParameterMap::iterator end = m_parameters.end();
+    for (XSLTProcessor::ParameterMap::iterator it = m_parameters.begin(); it != end; ++it)
+        query.bindVariable(QString(it->first), QXmlItem(QVariant(it->second)));
+
+    QString source;
+    if (sourceIsDocument && ownerDocument->transformSource())
+        source = ownerDocument->transformSource()->platformSource();
+    if (!sourceIsDocument || source.isEmpty())
+        source = createMarkup(sourceNode);
+
+    QBuffer inputBuffer;
+    QBuffer styleSheetBuffer;
+    QBuffer outputBuffer;
+
+    inputBuffer.setData(source.toUtf8());
+    styleSheetBuffer.setData(QString(stylesheet->sheetString()).toUtf8());
+
+    inputBuffer.open(QIODevice::ReadOnly);
+    styleSheetBuffer.open(QIODevice::ReadOnly);
+    outputBuffer.open(QIODevice::ReadWrite);
+
+    query.setFocus(&inputBuffer);
+    query.setQuery(&styleSheetBuffer, QUrl(stylesheet->href()));
+    success = query.evaluateTo(&outputBuffer);
+    outputBuffer.reset();
+    resultString = QString::fromUtf8(outputBuffer.readAll()).trimmed();
+
+    if (m_stylesheet) {
+        m_stylesheet->clearDocuments();
+        m_stylesheet = 0;
+    }
+
+    return success;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(XSLT)
diff --git a/WebKit/ChangeLog b/WebKit/ChangeLog
index 7a0721a..9293336 100644
--- a/WebKit/ChangeLog
+++ b/WebKit/ChangeLog
@@ -1,3 +1,239 @@
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * English.lproj/Localizable.strings:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        * WebKit.xcodeproj/project.pbxproj: Add WebPluginHalterClient to the project.
+
+2009-10-05  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        One of the dependencies' SVN url was missing a @ before the revision number.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30101
+
+        * chromium/DEPS:
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add new files for video fullscreen.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-10-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add testing harness for Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30010
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Enable Web Sockets in chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=29917
+
+        * chromium/features.gypi:
+
+2009-10-02  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added gyp_webkit that does a subset of the things gyp_chromium does
+        plus some specialization for an upstream chromium build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29986
+
+        * chromium/DEPS: Points to gyp_webkit instead of gyp_chromium.
+        * chromium/gyp_webkit: A new python file.
+
+2009-10-01  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make it possible to override the list of feature defines when building
+        downstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29979
+
+        * chromium/features.gypi:
+
+2009-10-01  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added windows-specific dependencies, updated some revisions and
+        re-organized file to make revision tracking easier. Also removed
+        extensions/v8 dependency that is no longer needed upstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29973
+
+        * chromium/DEPS:
+
+2009-09-30  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        1. Keeping up with downstream revisions.
+        2. Turning off v8 snapshot build step.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29928
+
+        * chromium/DEPS
+
+2009-09-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by John Sullivan.
+
+        WebKit Mac API should provide a delegate interface for global history.
+        <rdar://problem/7042773> and https://webkit.org/b/29904
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29722
+
+        * chromium/DEPS: Describes the chromium port's dependencies and
+          is used by gclient to fetch them.
+        * chromium/webkit.gyp: Currently only builds webcore but in
+          the future will also build the webkit api.
+
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
+
+        * chromium/features.gypi: Added 'ENABLE_ORIENTATION_EVENTS=0' to
+        disable this feature by default.
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Create chromium directory and ported chromium.org's features.gypi for 
+        the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * chromium/features.gypi: Added.
+
+2009-09-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/4137135> iFrame with PDF not being handled correctly on
+        usps.com
+        https://bugs.webkit.org/show_bug.cgi?id=4151
+
+        * WebKit.xcodeproj/project.pbxproj: Added WebPDFDocumentExtras.{h,mm}
+        and WebJSPDFDoc.{h,mm} and changed WebPDFRepresentation to
+        Objective-C++.
+
+2009-09-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
+        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
+        Geolocation service with DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=28264
+
+        * WebKit.xcodeproj/project.pbxproj: Modified. Adds WebGeolocationMock.
+
+2009-09-03  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Adam Roben
+
+        * StringsNotToBeLocalized.txt:
+        Brought this file up to date.
+
+2009-08-31  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Beth Dakin.
+
+        Remove WebViewEditingContextMenu.nib and WebViewEditingContextMenuOld.nib.
+        We stopped using these back in r18592 when we switched over to context menus
+        driven by WebCore.
+
+        * English.lproj/WebViewEditingContextMenu.nib/classes.nib: Removed.
+        * English.lproj/WebViewEditingContextMenu.nib/info.nib: Removed.
+        * English.lproj/WebViewEditingContextMenu.nib/objects.nib: Removed.
+        * English.lproj/WebViewEditingContextMenuOld.nib/classes.nib: Removed.
+        * English.lproj/WebViewEditingContextMenuOld.nib/info.nib: Removed.
+        * English.lproj/WebViewEditingContextMenuOld.nib/objects.nib: Removed.
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-08-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by John Sullivan.
+
+        update-webkit-localizable-strings script can no longer complete
+        https://bugs.webkit.org/show_bug.cgi?id=28792
+
+        * English.lproj/Localizable.strings:
+
+2009-08-27  John Sullivan  <sullivan@apple.com>
+
+        * StringsNotToBeLocalized.txt:
+        Brought up to date, other than the problem mentioned in https://bugs.webkit.org/show_bug.cgi?id=28792
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <video> and <audio> controller should be accessible
+        https://bugs.webkit.org/show_bug.cgi?id=28081
+
+        Add localized strings for media controller accessiblility.
+
+        * English.lproj/Localizable.strings:
+
+2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Enable various "grouping" ARIA roles
+        https://bugs.webkit.org/show_bug.cgi?id=28486
+
+        * English.lproj/Localizable.strings:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads.
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        * WebKit.xcodeproj/project.pbxproj:
+        Added WebWorkersPrivate APIs to mac WebKit to expose workerThreadCount() for DumpRenderTree.
+
 2009-08-06  Mark Rowe  <mrowe@apple.com>
 
         Rubber-stamped by Sam Weinig.
diff --git a/WebKit/English.lproj/Localizable.strings b/WebKit/English.lproj/Localizable.strings
index a0182db..e4a172b 100644
--- a/WebKit/English.lproj/Localizable.strings
+++ b/WebKit/English.lproj/Localizable.strings
diff --git a/WebKit/English.lproj/WebViewEditingContextMenu.nib/classes.nib b/WebKit/English.lproj/WebViewEditingContextMenu.nib/classes.nib
deleted file mode 100644
index 0cdded5..0000000
--- a/WebKit/English.lproj/WebViewEditingContextMenu.nib/classes.nib
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-    IBClasses = (
-        {
-            ACTIONS = {
-                changeBaseWritingDirection = id; 
-                myAction = id; 
-                outline = id; 
-                startSpeaking = id; 
-                stopSpeaking = id; 
-                toggleBaseWritingDirection = id; 
-                toggleGrammarChecking = id; 
-            }; 
-            CLASS = FirstResponder; 
-            LANGUAGE = ObjC; 
-            SUPERCLASS = NSObject; 
-        }, 
-        {
-            CLASS = MyObject; 
-            LANGUAGE = ObjC; 
-            OUTLETS = {defaultMenu = id; }; 
-            SUPERCLASS = NSObject; 
-        }, 
-        {
-            ACTIONS = {orderFrontFontOptionsPanel = id; orderFrontStylesPanel = id; }; 
-            CLASS = NSFontManager; 
-            LANGUAGE = ObjC; 
-            SUPERCLASS = NSObject; 
-        }
-    ); 
-    IBVersion = 1; 
-}
\ No newline at end of file
diff --git a/WebKit/English.lproj/WebViewEditingContextMenu.nib/info.nib b/WebKit/English.lproj/WebViewEditingContextMenu.nib/info.nib
deleted file mode 100644
index d40ca6c..0000000
--- a/WebKit/English.lproj/WebViewEditingContextMenu.nib/info.nib
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>IBDocumentLocation</key>
-	<string>819 178 356 240 0 0 2560 1578 </string>
-	<key>IBEditorPositions</key>
-	<dict>
-		<key>5</key>
-		<string>138 491 215 175 0 0 2560 1578 </string>
-	</dict>
-	<key>IBFramework Version</key>
-	<string>446.1</string>
-	<key>IBOpenObjects</key>
-	<array>
-		<integer>5</integer>
-	</array>
-	<key>IBSystem Version</key>
-	<string>8L127</string>
-</dict>
-</plist>
diff --git a/WebKit/English.lproj/WebViewEditingContextMenu.nib/objects.nib b/WebKit/English.lproj/WebViewEditingContextMenu.nib/objects.nib
deleted file mode 100644
index aef59b9..0000000
--- a/WebKit/English.lproj/WebViewEditingContextMenu.nib/objects.nib
+++ /dev/null
diff --git a/WebKit/English.lproj/WebViewEditingContextMenuOld.nib/classes.nib b/WebKit/English.lproj/WebViewEditingContextMenuOld.nib/classes.nib
deleted file mode 100644
index 0cdded5..0000000
--- a/WebKit/English.lproj/WebViewEditingContextMenuOld.nib/classes.nib
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-    IBClasses = (
-        {
-            ACTIONS = {
-                changeBaseWritingDirection = id; 
-                myAction = id; 
-                outline = id; 
-                startSpeaking = id; 
-                stopSpeaking = id; 
-                toggleBaseWritingDirection = id; 
-                toggleGrammarChecking = id; 
-            }; 
-            CLASS = FirstResponder; 
-            LANGUAGE = ObjC; 
-            SUPERCLASS = NSObject; 
-        }, 
-        {
-            CLASS = MyObject; 
-            LANGUAGE = ObjC; 
-            OUTLETS = {defaultMenu = id; }; 
-            SUPERCLASS = NSObject; 
-        }, 
-        {
-            ACTIONS = {orderFrontFontOptionsPanel = id; orderFrontStylesPanel = id; }; 
-            CLASS = NSFontManager; 
-            LANGUAGE = ObjC; 
-            SUPERCLASS = NSObject; 
-        }
-    ); 
-    IBVersion = 1; 
-}
\ No newline at end of file
diff --git a/WebKit/English.lproj/WebViewEditingContextMenuOld.nib/info.nib b/WebKit/English.lproj/WebViewEditingContextMenuOld.nib/info.nib
deleted file mode 100644
index 70fed51..0000000
--- a/WebKit/English.lproj/WebViewEditingContextMenuOld.nib/info.nib
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>IBDocumentLocation</key>
-	<string>403 85 356 240 0 0 1440 878 </string>
-	<key>IBEditorPositions</key>
-	<dict>
-		<key>5</key>
-		<string>72 246 179 203 0 0 1440 878 </string>
-	</dict>
-	<key>IBFramework Version</key>
-	<string>453.0</string>
-	<key>IBOpenObjects</key>
-	<array>
-		<integer>5</integer>
-	</array>
-	<key>IBSystem Version</key>
-	<string>9A288</string>
-</dict>
-</plist>
diff --git a/WebKit/English.lproj/WebViewEditingContextMenuOld.nib/objects.nib b/WebKit/English.lproj/WebViewEditingContextMenuOld.nib/objects.nib
deleted file mode 100644
index dc68b9b..0000000
--- a/WebKit/English.lproj/WebViewEditingContextMenuOld.nib/objects.nib
+++ /dev/null
diff --git a/WebKit/StringsNotToBeLocalized.txt b/WebKit/StringsNotToBeLocalized.txt
index 7e593ca..3f1964d 100644
--- a/WebKit/StringsNotToBeLocalized.txt
+++ b/WebKit/StringsNotToBeLocalized.txt
@@ -8,7 +8,6 @@
 " Mac OS X %@; %@) AppleWebKit/%@ (KHTML, like Gecko) %@"
 " Mac OS X %@; %@) AppleWebKit/%@ (KHTML, like Gecko)"
 " Version/3.2.1"
-" webViewDrawResizer delegate call"
 "#"
 "%"
 "%.0f"
@@ -49,12 +48,12 @@
 "._"
 ".download"
 ".html"
+".jpg"
 ".svg"
 ".xhtml"
 "/"
 "/Frameworks/PDFKit.framework"
 "/Library/Internet Plug-Ins"
-"/System/Library/Frameworks/Accelerate.framework/Accelerate"
 "/System/Library/Frameworks/ApplicationServices.framework/Frameworks/LangAnalysis.framework/LangAnalysis"
 "/System/Library/Frameworks/Carbon.framework/Frameworks/HIToolbox.framework/HIToolbox"
 "/Volumes"
@@ -74,6 +73,7 @@
 "5CACD637-F82F-491F-947A-5DCA38AA0FEA"
 "6EB8D98F-2723-4472-88D3-5936F9D6E631"
 "7"
+"7.1"
 "9"
 ":"
 "://"
@@ -96,6 +96,22 @@
 "@"
 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-."
 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+.-"
+"ARIAApplicationLog"
+"ARIAApplicationMarquee"
+"ARIAApplicationStatus"
+"ARIAApplicationTimer"
+"ARIADocument"
+"ARIADocumentArticle"
+"ARIADocumentNote"
+"ARIADocumentRegion"
+"ARIALandmarkApplication"
+"ARIALandmarkBanner"
+"ARIALandmarkComplementary"
+"ARIALandmarkContentInfo"
+"ARIALandmarkMain"
+"ARIALandmarkNavigation"
+"ARIALandmarkSearch"
+"ARIAUserInterfaceTooltip"
 "AXEnhancedUserInterface"
 "AccessibleBase"
 "AccessibleObjectFromWindow"
@@ -104,6 +120,7 @@
 "AppleKeyboardUIMode"
 "AppleLanguages"
 "AppleTextDirection"
+"AudioElement"
 "BEGIN:VCALENDAR"
 "BEGIN:VCARD"
 "BP_CreatePluginMIMETypesPreferences"
@@ -113,6 +130,7 @@
 "Content-Encoding"
 "Content-Length"
 "Content-Type"
+"CurrentTimeDisplay"
 "D"
 "DCMDictionaryServiceWindowShow"
 "DELEGATE METHODS"
@@ -133,12 +151,14 @@
 "FastMallocHeapSize"
 "FastMallocReturnedSize"
 "FrameName"
+"FullscreenButton"
 "GEN_DOMObject"
 "GET"
 "GroupName"
 "HIDictionaryWindowShow"
 "HTTP "
 "Helvetica"
+"HostedNetscapePluginStream"
 "IDNScriptWhiteList"
 "IDNScriptWhiteList.txt"
 "IMM32.DLL"
@@ -167,7 +187,6 @@
 "Library/Caches"
 "Library/Internet Plug-Ins"
 "LresultFromObject"
-"Lucida Grande"
 "MIME\\Database\\Content Type"
 "MainPageJavaScript.js"
 "MemoryStream"
@@ -198,9 +217,8 @@
 "MoveWordRight"
 "MoveWordRightAndModifySelection"
 "Mozilla/5.0 (Macintosh; U; "
-"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-us) AppleWebKit/525.28.3 (KHTML, like Gecko) Version/3.2.3 Safari/525.28.3"
 "Mozilla/5.0 (Windows; U; %s; %s) AppleWebKit/%s (KHTML, like Gecko)%s%s"
-"Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.28.3 (KHTML, like Gecko) Version/3.2.3 Safari/525.29"
+"MuteButton"
 "NP_GetEntryPoints"
 "NP_Initialize"
 "NP_Shutdown"
@@ -213,6 +231,7 @@
 "NSEvent"
 "NSView"
 "NeXT smart paste pasteboard type"
+"NetscapePluginInstanceProxy"
 "PDFDocument"
 "PDFPreviewView"
 "PDFView"
@@ -222,21 +241,33 @@
 "PNG"
 "POST"
 "PPC"
+"PauseButton"
+"PlayButton"
 "Quartz.framework"
 "RTL"
 "Referer"
+"ReturnToRealtimeButton"
+"RewindButton"
 "SAMILang"
 "SAMIStyle"
 "Safari.exe"
+"SeekBackButton"
+"SeekForwardButton"
 "SelectAll"
+"Slider"
+"SliderThumb"
+"StatusDisplay"
+"TimeRemainingDisplay"
 "Times"
 "ToggleBold"
 "ToggleItalic"
 "U+0009"
 "U+001B"
 "UTF-8"
+"UnMuteButton"
 "UseBackForwardList"
 "User-Agent"
+"VideoElement"
 "Volumes"
 "W"
 "WEBKIT_UNSET_DYLD_FRAMEWORK_PATH"
@@ -285,7 +316,14 @@
 "WebElementTitle"
 "WebError"
 "WebFrame"
+"WebFrameCanSuspendActiveDOMObjectsKey"
+"WebFrameHasPluginsKey"
+"WebFrameHasUnloadListenerKey"
+"WebFrameMainDocumentErrorKey"
 "WebFramePolicyListener"
+"WebFrameUsesApplicationCacheKey"
+"WebFrameUsesDatabasesKey"
+"WebFrameUsesGeolocationKey"
 "WebHTMLRepresentation"
 "WebHistory"
 "WebHistoryAllItemsRemovedNotification"
@@ -321,8 +359,6 @@
 "WebKitErrorPlugInPageURLStringKey"
 "WebKitHistoryAgeInDaysLimit"
 "WebKitHistoryItemLimit"
-"WebKitInspectorAttached"
-"WebKitInspectorAttachedViewHeight"
 "WebKitInspectorHiddenPanels"
 "WebKitLocalCache"
 "WebKitLogLevel"
@@ -402,6 +438,7 @@
 "WebViewDidChangeTypingStyleNotification"
 "WebViewDidEndEditingNotification"
 "WebViewWindowClass"
+"WebWorkersPrivate"
 "Windows %d.%d"
 "Windows 95"
 "Windows 98"
@@ -429,7 +466,8 @@
 "a"
 "ab"
 "about:"
-"ads.pointroll.com"
+"actions"
+"anchorPoint"
 "applewebdata"
 "applewebdata://%@"
 "application.pdf"
@@ -446,6 +484,7 @@
 "attributeValues"
 "b"
 "basefont"
+"bounds"
 "bundlePath"
 "c"
 "canGoBack"
@@ -517,6 +556,8 @@
 "com.sunrisebrowser.Sunrise"
 "com.thinkmac.NewsLife"
 "com.yahoo.messenger3"
+"contents"
+"contentsRect"
 "cp949"
 "cpuType"
 "de.codingmonkeys.SubEthaEdit"
@@ -552,11 +593,11 @@
 "img"
 "info.colloquy"
 "insertText:"
+"inspectorStartsAttached"
 "isLoading"
 "isindex"
 "javascript:"
 "jpeg"
-"jpg"
 "js"
 "kioskmode"
 "ks_c_5601-1987"
@@ -581,6 +622,7 @@
 "nullPlugin"
 "nullplugin"
 "oleacc.dll"
+"opacity"
 "org.xlife.NewsFire"
 "panEastCursor"
 "panIcon"
@@ -593,6 +635,7 @@
 "panWestCursor"
 "pluginHostPath"
 "pluginspage"
+"position"
 "public.url"
 "public.url-name"
 "r"
@@ -608,6 +651,8 @@
 "sourceURL"
 "src"
 "sub"
+"sublayerTransform"
+"sublayers"
 "text/calendar"
 "text/directory"
 "text/html"
@@ -626,13 +671,13 @@
 "text/x-vcf"
 "textAreaResizeCorner"
 "tiff"
+"transform"
 "txt"
 "u"
 "uk.co.opencommunity.vienna2"
 "userAgent"
 "userInfo"
 "utf-16"
-"vImagePermuteChannels_ARGB8888"
 "verticalTextCursor"
 "visibleName"
 "visitCount"
diff --git a/WebKit/WebKit.xcodeproj/project.pbxproj b/WebKit/WebKit.xcodeproj/project.pbxproj
index 45bcd15..db25bf9 100644
--- a/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -11,10 +11,18 @@
 		065AD5A40B0C32C7005A2B1D /* WebContextMenuClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = 065AD5A20B0C32C7005A2B1D /* WebContextMenuClient.mm */; };
 		06693DDC0BFBA85200216072 /* WebInspectorClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 06693DDA0BFBA85200216072 /* WebInspectorClient.h */; };
 		06693DDD0BFBA85200216072 /* WebInspectorClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = 06693DDB0BFBA85200216072 /* WebInspectorClient.mm */; };
+		0A2D87FD107AF52B00CDDEE3 /* WebPluginHalterClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 0A2D87FB107AF52B00CDDEE3 /* WebPluginHalterClient.h */; };
+		0A2D87FE107AF52B00CDDEE3 /* WebPluginHalterClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = 0A2D87FC107AF52B00CDDEE3 /* WebPluginHalterClient.mm */; };
 		0AB752370FA2E4DB00D7CBB1 /* WebNetscapeContainerCheckContextInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0AB752350FA2E4DB00D7CBB1 /* WebNetscapeContainerCheckContextInfo.h */; };
 		0AB752380FA2E4DB00D7CBB1 /* WebNetscapeContainerCheckContextInfo.mm in Sources */ = {isa = PBXBuildFile; fileRef = 0AB752360FA2E4DB00D7CBB1 /* WebNetscapeContainerCheckContextInfo.mm */; };
 		0AEBFF630F9FA8BE000D486B /* WebNetscapeContainerCheckPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0AEBFF610F9FA8BE000D486B /* WebNetscapeContainerCheckPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0AEBFF640F9FA8BE000D486B /* WebNetscapeContainerCheckPrivate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 0AEBFF620F9FA8BE000D486B /* WebNetscapeContainerCheckPrivate.mm */; };
+		0FD3B0F21076C3E900039B96 /* WebVideoFullscreenController.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3B0EE1076C3E900039B96 /* WebVideoFullscreenController.h */; };
+		0FD3B0F31076C3E900039B96 /* WebVideoFullscreenController.mm in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3B0EF1076C3E900039B96 /* WebVideoFullscreenController.mm */; };
+		0FD3B0F41076C3E900039B96 /* WebVideoFullscreenHUDWindowController.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3B0F01076C3E900039B96 /* WebVideoFullscreenHUDWindowController.h */; };
+		0FD3B0F51076C3E900039B96 /* WebVideoFullscreenHUDWindowController.mm in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3B0F11076C3E900039B96 /* WebVideoFullscreenHUDWindowController.mm */; };
+		0FD3B0F81076C3F700039B96 /* WebWindowAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3B0F61076C3F700039B96 /* WebWindowAnimation.h */; };
+		0FD3B0F91076C3F700039B96 /* WebWindowAnimation.m in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3B0F71076C3F700039B96 /* WebWindowAnimation.m */; };
 		14D8252F0AF955090004F057 /* WebChromeClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D8252D0AF955090004F057 /* WebChromeClient.h */; };
 		14D825300AF955090004F057 /* WebChromeClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = 14D8252E0AF955090004F057 /* WebChromeClient.mm */; };
 		1A20D08B0ED384F20043FA9F /* QuartzCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 1A20D08A0ED384F20043FA9F /* QuartzCore.framework */; };
@@ -71,6 +79,12 @@
 		226E9E6A09D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 226E9E6809D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.h */; };
 		226E9E6B09D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.c in Sources */ = {isa = PBXBuildFile; fileRef = 226E9E6909D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.c */; settings = {COMPILER_FLAGS = "-Wno-deprecated-declarations"; }; };
 		22F219CC08D236730030E078 /* WebBackForwardListPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 22F219CB08D236730030E078 /* WebBackForwardListPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		37B6FB4E1063530C000FDB3B /* WebPDFDocumentExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 37B6FB4C1063530C000FDB3B /* WebPDFDocumentExtras.h */; };
+		37B6FB4F1063530C000FDB3B /* WebPDFDocumentExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37B6FB4D1063530C000FDB3B /* WebPDFDocumentExtras.mm */; };
+		37D1DCA81065928C0068F7EF /* WebJSPDFDoc.h in Headers */ = {isa = PBXBuildFile; fileRef = 37D1DCA61065928C0068F7EF /* WebJSPDFDoc.h */; };
+		37D1DCA91065928C0068F7EF /* WebJSPDFDoc.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37D1DCA71065928C0068F7EF /* WebJSPDFDoc.mm */; };
+		41F4484F10338E8C0030E55E /* WebWorkersPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F4484D10338E8C0030E55E /* WebWorkersPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		41F4485010338E8C0030E55E /* WebWorkersPrivate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 41F4484E10338E8C0030E55E /* WebWorkersPrivate.mm */; };
 		441793A60E34EE150055E1AE /* WebHTMLRepresentationInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 441793A50E34EE150055E1AE /* WebHTMLRepresentationInternal.h */; };
 		4BF99F900AE050BC00815C2B /* WebEditorClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 4BF99F8E0AE050BC00815C2B /* WebEditorClient.h */; settings = {ATTRIBUTES = (); }; };
 		4BF99F910AE050BC00815C2B /* WebEditorClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4BF99F8F0AE050BC00815C2B /* WebEditorClient.mm */; };
@@ -85,6 +99,9 @@
 		51494CD70C7EBDE0004178C5 /* WebIconDatabaseClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51494CD50C7EBDE0004178C5 /* WebIconDatabaseClient.mm */; };
 		51494D240C7EC1B7004178C5 /* WebNSNotificationCenterExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 51494D220C7EC1B6004178C5 /* WebNSNotificationCenterExtras.h */; };
 		51494D250C7EC1B7004178C5 /* WebNSNotificationCenterExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = 51494D230C7EC1B7004178C5 /* WebNSNotificationCenterExtras.m */; };
+		5158F6EF106D862A00AF457C /* WebHistoryDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 5158F6EE106D862A00AF457C /* WebHistoryDelegate.h */; };
+		5185F62610712B80007AA393 /* WebNavigationData.h in Headers */ = {isa = PBXBuildFile; fileRef = 5185F62510712B80007AA393 /* WebNavigationData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		5185F62810712B97007AA393 /* WebNavigationData.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5185F62710712B97007AA393 /* WebNavigationData.mm */; };
 		51AEDEF10CECF45700854328 /* WebDatabaseManagerInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 51AEDEF00CECF45700854328 /* WebDatabaseManagerInternal.h */; };
 		51B2A1000ADB15D0002A9BEE /* WebIconDatabaseDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 51B2A0FF0ADB15D0002A9BEE /* WebIconDatabaseDelegate.h */; };
 		51C714FB0B20F79F00E5E33C /* WebBackForwardListInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 51C714FA0B20F79F00E5E33C /* WebBackForwardListInternal.h */; };
@@ -92,12 +109,12 @@
 		51FDC4D30B0AF5C100F84EB3 /* WebHistoryItemPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 51FDC4D20B0AF5C100F84EB3 /* WebHistoryItemPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5241ADF50B1BC48A004012BD /* WebCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 5241ADF30B1BC48A004012BD /* WebCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5241ADF60B1BC48A004012BD /* WebCache.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5241ADF40B1BC48A004012BD /* WebCache.mm */; };
+		59C77F3510545F7E00506104 /* WebGeolocationMock.mm in Sources */ = {isa = PBXBuildFile; fileRef = 59C77F3310545F7E00506104 /* WebGeolocationMock.mm */; };
+		59C77F4B105471E700506104 /* WebGeolocationMockPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 59C77F4A105471E700506104 /* WebGeolocationMockPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5D1638F30E35B45D00F3038E /* EmptyProtocolDefinitions.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D1638F20E35B45D00F3038E /* EmptyProtocolDefinitions.h */; };
 		5D7BF8140C2A1D90008CE06D /* WebInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D7BF8120C2A1D90008CE06D /* WebInspector.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5D7BF8150C2A1D90008CE06D /* WebInspector.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5D7BF8130C2A1D90008CE06D /* WebInspector.mm */; };
 		5DE83A7A0D0F7F9400CAD12A /* WebJavaScriptTextInputPanel.nib in Resources */ = {isa = PBXBuildFile; fileRef = 5DE83A740D0F7F9400CAD12A /* WebJavaScriptTextInputPanel.nib */; };
-		5DE83A7B0D0F7F9400CAD12A /* WebViewEditingContextMenu.nib in Resources */ = {isa = PBXBuildFile; fileRef = 5DE83A760D0F7F9400CAD12A /* WebViewEditingContextMenu.nib */; };
-		5DE83A7C0D0F7F9400CAD12A /* WebViewEditingContextMenuOld.nib in Resources */ = {isa = PBXBuildFile; fileRef = 5DE83A780D0F7F9400CAD12A /* WebViewEditingContextMenuOld.nib */; };
 		5DE83A7F0D0F7FAD00CAD12A /* Localizable.strings in Resources */ = {isa = PBXBuildFile; fileRef = 5DE83A7D0D0F7FAD00CAD12A /* Localizable.strings */; };
 		5DE92FEF0BD7017E0059A5FD /* WebAssertions.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DE92FEE0BD7017E0059A5FD /* WebAssertions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		65488DA1084FBCCB00831AD0 /* WebNSDictionaryExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 65488D9F084FBCCB00831AD0 /* WebNSDictionaryExtras.h */; };
@@ -112,6 +129,7 @@
 		65EEDE58084FFC9E0002DB25 /* WebNSFileManagerExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = 65EEDE56084FFC9E0002DB25 /* WebNSFileManagerExtras.m */; };
 		65FFB7FC0AD0B7D30048CD05 /* WebDocumentLoaderMac.h in Headers */ = {isa = PBXBuildFile; fileRef = 65FFB7FA0AD0B7D30048CD05 /* WebDocumentLoaderMac.h */; };
 		65FFB7FD0AD0B7D30048CD05 /* WebDocumentLoaderMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 65FFB7FB0AD0B7D30048CD05 /* WebDocumentLoaderMac.mm */; };
+		7A8FF0D11075024A00A80A08 /* WebInspectorPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A8FF0D01075024A00A80A08 /* WebInspectorPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7E6FEF0808985A7200C44C3F /* WebScriptDebugDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E6FEF0508985A7200C44C3F /* WebScriptDebugDelegate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7E6FEF0908985A7200C44C3F /* WebScriptDebugDelegate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 7E6FEF0608985A7200C44C3F /* WebScriptDebugDelegate.mm */; };
 		9304B3000B02341500F7850D /* WebIconDatabaseInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 9304B2FF0B02341500F7850D /* WebIconDatabaseInternal.h */; };
@@ -289,7 +307,7 @@
 		9398111C0824BF01008DF038 /* WebDOMOperations.mm in Sources */ = {isa = PBXBuildFile; fileRef = 846171FA0624AE5B0071A4A3 /* WebDOMOperations.mm */; };
 		9398111D0824BF01008DF038 /* WebArchive.mm in Sources */ = {isa = PBXBuildFile; fileRef = 8373435B0624EE0D00F3B289 /* WebArchive.mm */; };
 		9398111E0824BF01008DF038 /* WebPDFView.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51E94C3506C0321200A9B09E /* WebPDFView.mm */; };
-		9398111F0824BF01008DF038 /* WebPDFRepresentation.m in Sources */ = {isa = PBXBuildFile; fileRef = 51E94C6906C0347500A9B09E /* WebPDFRepresentation.m */; };
+		9398111F0824BF01008DF038 /* WebPDFRepresentation.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51E94C6906C0347500A9B09E /* WebPDFRepresentation.mm */; };
 		939811260824BF01008DF038 /* WebPluginContainerCheck.mm in Sources */ = {isa = PBXBuildFile; fileRef = 65E1150407EFFEBF009B8BF7 /* WebPluginContainerCheck.mm */; };
 		939811290824BF01008DF038 /* Carbon.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = F5C2869402846DCD018635CA /* Carbon.framework */; };
 		9398112A0824BF01008DF038 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = F5C2869502846DCD018635CA /* Cocoa.framework */; };
@@ -335,10 +353,18 @@
 		065AD5A20B0C32C7005A2B1D /* WebContextMenuClient.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WebContextMenuClient.mm; sourceTree = "<group>"; };
 		06693DDA0BFBA85200216072 /* WebInspectorClient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebInspectorClient.h; sourceTree = "<group>"; };
 		06693DDB0BFBA85200216072 /* WebInspectorClient.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebInspectorClient.mm; sourceTree = "<group>"; };
+		0A2D87FB107AF52B00CDDEE3 /* WebPluginHalterClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebPluginHalterClient.h; sourceTree = "<group>"; };
+		0A2D87FC107AF52B00CDDEE3 /* WebPluginHalterClient.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebPluginHalterClient.mm; sourceTree = "<group>"; };
 		0AB752350FA2E4DB00D7CBB1 /* WebNetscapeContainerCheckContextInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebNetscapeContainerCheckContextInfo.h; sourceTree = "<group>"; };
 		0AB752360FA2E4DB00D7CBB1 /* WebNetscapeContainerCheckContextInfo.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNetscapeContainerCheckContextInfo.mm; sourceTree = "<group>"; };
 		0AEBFF610F9FA8BE000D486B /* WebNetscapeContainerCheckPrivate.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; path = WebNetscapeContainerCheckPrivate.h; sourceTree = "<group>"; };
 		0AEBFF620F9FA8BE000D486B /* WebNetscapeContainerCheckPrivate.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNetscapeContainerCheckPrivate.mm; sourceTree = "<group>"; };
+		0FD3B0EE1076C3E900039B96 /* WebVideoFullscreenController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebVideoFullscreenController.h; sourceTree = "<group>"; };
+		0FD3B0EF1076C3E900039B96 /* WebVideoFullscreenController.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebVideoFullscreenController.mm; sourceTree = "<group>"; };
+		0FD3B0F01076C3E900039B96 /* WebVideoFullscreenHUDWindowController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebVideoFullscreenHUDWindowController.h; sourceTree = "<group>"; };
+		0FD3B0F11076C3E900039B96 /* WebVideoFullscreenHUDWindowController.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebVideoFullscreenHUDWindowController.mm; sourceTree = "<group>"; };
+		0FD3B0F61076C3F700039B96 /* WebWindowAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebWindowAnimation.h; sourceTree = "<group>"; };
+		0FD3B0F71076C3F700039B96 /* WebWindowAnimation.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = WebWindowAnimation.m; sourceTree = "<group>"; };
 		14D8252D0AF955090004F057 /* WebChromeClient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebChromeClient.h; sourceTree = "<group>"; };
 		14D8252E0AF955090004F057 /* WebChromeClient.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WebChromeClient.mm; sourceTree = "<group>"; };
 		1A20D08A0ED384F20043FA9F /* QuartzCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = QuartzCore.framework; path = /System/Library/Frameworks/QuartzCore.framework; sourceTree = "<absolute>"; };
@@ -407,6 +433,10 @@
 		35081D9502B6D4D80ACA2ACA /* WebHTMLView.mm */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebHTMLView.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		35081D9602B6D4D80ACA2ACA /* WebHTMLViewPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebHTMLViewPrivate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		35081DAE02B6D4F50ACA2ACA /* WebDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebDocument.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		37B6FB4C1063530C000FDB3B /* WebPDFDocumentExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebPDFDocumentExtras.h; sourceTree = "<group>"; };
+		37B6FB4D1063530C000FDB3B /* WebPDFDocumentExtras.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebPDFDocumentExtras.mm; sourceTree = "<group>"; };
+		37D1DCA61065928C0068F7EF /* WebJSPDFDoc.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebJSPDFDoc.h; sourceTree = "<group>"; };
+		37D1DCA71065928C0068F7EF /* WebJSPDFDoc.mm */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; path = WebJSPDFDoc.mm; sourceTree = "<group>"; };
 		3944606B020F50ED0ECA1767 /* WebDynamicScrollBarsView.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebDynamicScrollBarsView.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		3944606C020F50ED0ECA1767 /* WebDynamicScrollBarsView.mm */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; indentWidth = 4; path = WebDynamicScrollBarsView.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		3944606E020F50ED0ECA1767 /* WebPreferences.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebPreferences.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -418,6 +448,8 @@
 		3944607E020F50ED0ECA1767 /* WebBackForwardList.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebBackForwardList.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		3944607F020F50ED0ECA1767 /* WebHistoryItem.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebHistoryItem.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		39446080020F50ED0ECA1767 /* WebHistoryItem.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebHistoryItem.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		41F4484D10338E8C0030E55E /* WebWorkersPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebWorkersPrivate.h; path = mac/Workers/WebWorkersPrivate.h; sourceTree = "<group>"; };
+		41F4484E10338E8C0030E55E /* WebWorkersPrivate.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = WebWorkersPrivate.mm; path = mac/Workers/WebWorkersPrivate.mm; sourceTree = "<group>"; };
 		441793A50E34EE150055E1AE /* WebHTMLRepresentationInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebHTMLRepresentationInternal.h; sourceTree = "<group>"; };
 		449098B90F8F82DF0076A327 /* FeatureDefines.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = FeatureDefines.xcconfig; sourceTree = "<group>"; };
 		4BF99F8E0AE050BC00815C2B /* WebEditorClient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebEditorClient.h; sourceTree = "<group>"; };
@@ -442,10 +474,13 @@
 		5152FADF033FC50400CA2ACD /* WebDefaultPolicyDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebDefaultPolicyDelegate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		5152FAE0033FC50400CA2ACD /* WebDefaultPolicyDelegate.m */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebDefaultPolicyDelegate.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		5152FAE5033FC52200CA2ACD /* WebFrameLoadDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebFrameLoadDelegate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		5158F6EE106D862A00AF457C /* WebHistoryDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebHistoryDelegate.h; sourceTree = "<group>"; };
 		515E27CC0458C86500CA2D3A /* WebUIDelegate.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebUIDelegate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		515E27CF0458CA4B00CA2D3A /* WebDefaultUIDelegate.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebDefaultUIDelegate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		515E27D00458CA4B00CA2D3A /* WebDefaultUIDelegate.m */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebDefaultUIDelegate.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		516F296F03A6C45A00CA2D3A /* WebHistoryItemInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebHistoryItemInternal.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		5185F62510712B80007AA393 /* WebNavigationData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebNavigationData.h; sourceTree = "<group>"; };
+		5185F62710712B97007AA393 /* WebNavigationData.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNavigationData.mm; sourceTree = "<group>"; };
 		51863EFC065419EB00E9E8DD /* WebJavaPlugIn.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebJavaPlugIn.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		51A8B52E04282B5900CA2D3A /* WebFrameView.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebFrameView.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		51A8B52F04282B5900CA2D3A /* WebFrameView.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebFrameView.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -460,16 +495,16 @@
 		51E94C3406C0321200A9B09E /* WebPDFView.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebPDFView.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		51E94C3506C0321200A9B09E /* WebPDFView.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebPDFView.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		51E94C6806C0347500A9B09E /* WebPDFRepresentation.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebPDFRepresentation.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		51E94C6906C0347500A9B09E /* WebPDFRepresentation.m */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebPDFRepresentation.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		51E94C6906C0347500A9B09E /* WebPDFRepresentation.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebPDFRepresentation.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		51FDC4D20B0AF5C100F84EB3 /* WebHistoryItemPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebHistoryItemPrivate.h; sourceTree = "<group>"; };
 		5241ADF30B1BC48A004012BD /* WebCache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebCache.h; sourceTree = "<group>"; };
 		5241ADF40B1BC48A004012BD /* WebCache.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCache.mm; sourceTree = "<group>"; };
+		59C77F3310545F7E00506104 /* WebGeolocationMock.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebGeolocationMock.mm; sourceTree = "<group>"; };
+		59C77F4A105471E700506104 /* WebGeolocationMockPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebGeolocationMockPrivate.h; sourceTree = "<group>"; };
 		5D1638F20E35B45D00F3038E /* EmptyProtocolDefinitions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EmptyProtocolDefinitions.h; sourceTree = "<group>"; };
 		5D7BF8120C2A1D90008CE06D /* WebInspector.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebInspector.h; sourceTree = "<group>"; };
 		5D7BF8130C2A1D90008CE06D /* WebInspector.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WebInspector.mm; sourceTree = "<group>"; };
 		5DE83A750D0F7F9400CAD12A /* English */ = {isa = PBXFileReference; lastKnownFileType = wrapper.nib; name = English; path = English.lproj/WebJavaScriptTextInputPanel.nib; sourceTree = SOURCE_ROOT; };
-		5DE83A770D0F7F9400CAD12A /* English */ = {isa = PBXFileReference; lastKnownFileType = wrapper.nib; name = English; path = English.lproj/WebViewEditingContextMenu.nib; sourceTree = SOURCE_ROOT; };
-		5DE83A790D0F7F9400CAD12A /* English */ = {isa = PBXFileReference; lastKnownFileType = wrapper.nib; name = English; path = English.lproj/WebViewEditingContextMenuOld.nib; sourceTree = SOURCE_ROOT; };
 		5DE83A7E0D0F7FAD00CAD12A /* English */ = {isa = PBXFileReference; fileEncoding = 10; lastKnownFileType = text.plist.strings; name = English; path = English.lproj/Localizable.strings; sourceTree = SOURCE_ROOT; };
 		5DE92FEE0BD7017E0059A5FD /* WebAssertions.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebAssertions.h; sourceTree = "<group>"; };
 		65488D9F084FBCCB00831AD0 /* WebNSDictionaryExtras.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebNSDictionaryExtras.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -492,6 +527,7 @@
 		65FFB7FB0AD0B7D30048CD05 /* WebDocumentLoaderMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WebDocumentLoaderMac.mm; sourceTree = "<group>"; };
 		7082F56F038EADAA00A80180 /* WebKitNSStringExtras.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebKitNSStringExtras.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		7082F570038EADAA00A80180 /* WebKitNSStringExtras.mm */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 30; indentWidth = 4; path = WebKitNSStringExtras.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		7A8FF0D01075024A00A80A08 /* WebInspectorPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebInspectorPrivate.h; sourceTree = "<group>"; };
 		7E6FEF0508985A7200C44C3F /* WebScriptDebugDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebScriptDebugDelegate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		7E6FEF0608985A7200C44C3F /* WebScriptDebugDelegate.mm */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebScriptDebugDelegate.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		830E81E005853AC000AD0891 /* Security.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Security.framework; path = /System/Library/Frameworks/Security.framework; sourceTree = "<absolute>"; };
@@ -705,6 +741,7 @@
 				F5B36B400281DE87018635CB /* WebCoreSupport */,
 				9C7CABBB0190A37C0ECA16EA /* WebView */,
 				1C68F63F095B5F9C00C2984E /* WebInspector */,
+				41F4484C10338E570030E55E /* Workers */,
 				F7EBEE5903F9DB2203CA0DE6 /* Carbon */,
 				089C1665FE841158C02AAC07 /* Resources */,
 				0867D69AFE84028FC02AAC07 /* Frameworks and Libraries */,
@@ -740,8 +777,6 @@
 				ED3B48DE0CC51F7E00DFF1EB /* StringsNotToBeLocalized.txt */,
 				F5B67130023EDF8901C1A525 /* url_icon.tiff */,
 				5DE83A740D0F7F9400CAD12A /* WebJavaScriptTextInputPanel.nib */,
-				5DE83A760D0F7F9400CAD12A /* WebViewEditingContextMenu.nib */,
-				5DE83A780D0F7F9400CAD12A /* WebViewEditingContextMenuOld.nib */,
 			);
 			name = Resources;
 			path = mac/Resources;
@@ -794,6 +829,7 @@
 			children = (
 				5D7BF8120C2A1D90008CE06D /* WebInspector.h */,
 				5D7BF8130C2A1D90008CE06D /* WebInspector.mm */,
+				7A8FF0D01075024A00A80A08 /* WebInspectorPrivate.h */,
 				1C68F663095B5FC100C2984E /* WebNodeHighlight.h */,
 				1C68F664095B5FC100C2984E /* WebNodeHighlight.mm */,
 				1C68F665095B5FC100C2984E /* WebNodeHighlightView.h */,
@@ -929,6 +965,15 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		41F4484C10338E570030E55E /* Workers */ = {
+			isa = PBXGroup;
+			children = (
+				41F4484D10338E8C0030E55E /* WebWorkersPrivate.h */,
+				41F4484E10338E8C0030E55E /* WebWorkersPrivate.mm */,
+			);
+			name = Workers;
+			sourceTree = "<group>";
+		};
 		511F3FC30CECC7E200852565 /* Storage */ = {
 			isa = PBXGroup;
 			children = (
@@ -948,8 +993,12 @@
 		51E94C0706C02CA300A9B09E /* PDF */ = {
 			isa = PBXGroup;
 			children = (
+				37D1DCA61065928C0068F7EF /* WebJSPDFDoc.h */,
+				37D1DCA71065928C0068F7EF /* WebJSPDFDoc.mm */,
+				37B6FB4C1063530C000FDB3B /* WebPDFDocumentExtras.h */,
+				37B6FB4D1063530C000FDB3B /* WebPDFDocumentExtras.mm */,
 				51E94C6806C0347500A9B09E /* WebPDFRepresentation.h */,
-				51E94C6906C0347500A9B09E /* WebPDFRepresentation.m */,
+				51E94C6906C0347500A9B09E /* WebPDFRepresentation.mm */,
 				51E94C3406C0321200A9B09E /* WebPDFView.h */,
 				51E94C3506C0321200A9B09E /* WebPDFView.mm */,
 			);
@@ -1057,6 +1106,9 @@
 				51A8B52F04282B5900CA2D3A /* WebFrameView.mm */,
 				51A8B53204282BD200CA2D3A /* WebFrameViewInternal.h */,
 				93C6F14507920B93002449CD /* WebFrameViewPrivate.h */,
+				5158F6EE106D862A00AF457C /* WebHistoryDelegate.h */,
+				5185F62710712B97007AA393 /* WebNavigationData.mm */,
+				5185F62510712B80007AA393 /* WebNavigationData.h */,
 				51443F9A0429392B00CA2D3A /* WebPolicyDelegate.h */,
 				51443F9B0429392B00CA2D3A /* WebPolicyDelegate.mm */,
 				51443F9C0429392B00CA2D3A /* WebPolicyDelegatePrivate.h */,
@@ -1082,12 +1134,18 @@
 				F834AAD60E64B1C700E2737C /* WebTextIterator.mm */,
 				515E27CC0458C86500CA2D3A /* WebUIDelegate.h */,
 				65A7D44A0568AB2600E70EF6 /* WebUIDelegatePrivate.h */,
+				0FD3B0EE1076C3E900039B96 /* WebVideoFullscreenController.h */,
+				0FD3B0EF1076C3E900039B96 /* WebVideoFullscreenController.mm */,
+				0FD3B0F01076C3E900039B96 /* WebVideoFullscreenHUDWindowController.h */,
+				0FD3B0F11076C3E900039B96 /* WebVideoFullscreenHUDWindowController.mm */,
 				51A8B579042834F700CA2D3A /* WebView.h */,
 				51A8B57A042834F700CA2D3A /* WebView.mm */,
 				BC2E464B0FD8A96800A9D9DE /* WebViewData.h */,
 				BC2E464C0FD8A96800A9D9DE /* WebViewData.mm */,
 				930D02BB06275F640076701E /* WebViewInternal.h */,
 				51A8B57D0428353A00CA2D3A /* WebViewPrivate.h */,
+				0FD3B0F61076C3F700039B96 /* WebWindowAnimation.h */,
+				0FD3B0F71076C3F700039B96 /* WebWindowAnimation.m */,
 			);
 			name = WebView;
 			path = mac/WebView;
@@ -1127,6 +1185,8 @@
 		F5B36B400281DE87018635CB /* WebCoreSupport */ = {
 			isa = PBXGroup;
 			children = (
+				59C77F4A105471E700506104 /* WebGeolocationMockPrivate.h */,
+				59C77F3310545F7E00506104 /* WebGeolocationMock.mm */,
 				B68049710FFBCEC1009F7F62 /* WebApplicationCache.h */,
 				B68049720FFBCEC1009F7F62 /* WebApplicationCache.mm */,
 				51CBFCAC0D10E6C5002DBF51 /* WebCachedFramePlatformData.h */,
@@ -1155,6 +1215,8 @@
 				84723BE4056D719E0044BFEA /* WebKeyGenerator.m */,
 				A7D3C5BA0B5773C5002CA450 /* WebPasteboardHelper.h */,
 				A7D3C5BB0B5773C5002CA450 /* WebPasteboardHelper.mm */,
+				0A2D87FB107AF52B00CDDEE3 /* WebPluginHalterClient.h */,
+				0A2D87FC107AF52B00CDDEE3 /* WebPluginHalterClient.mm */,
 				93EB178E09F88D510091F8FF /* WebSystemInterface.h */,
 				93EB178C09F88D460091F8FF /* WebSystemInterface.m */,
 				F5F7174C02885C5B018635CA /* WebViewFactory.h */,
@@ -1343,6 +1405,7 @@
 				1A2D75500DE4810E00F0A648 /* WebIconFetcherInternal.h in Headers */,
 				5D7BF8140C2A1D90008CE06D /* WebInspector.h in Headers */,
 				06693DDC0BFBA85200216072 /* WebInspectorClient.h in Headers */,
+				7A8FF0D11075024A00A80A08 /* WebInspectorPrivate.h in Headers */,
 				939810A00824BF01008DF038 /* WebJavaPlugIn.h in Headers */,
 				939810420824BF01008DF038 /* WebJavaScriptTextInputPanel.h in Headers */,
 				939810850824BF01008DF038 /* WebKeyGenerator.h in Headers */,
@@ -1437,6 +1500,16 @@
 				939810460824BF01008DF038 /* WebViewFactory.h in Headers */,
 				9398109B0824BF01008DF038 /* WebViewInternal.h in Headers */,
 				939810710824BF01008DF038 /* WebViewPrivate.h in Headers */,
+				41F4484F10338E8C0030E55E /* WebWorkersPrivate.h in Headers */,
+				59C77F4B105471E700506104 /* WebGeolocationMockPrivate.h in Headers */,
+				37B6FB4E1063530C000FDB3B /* WebPDFDocumentExtras.h in Headers */,
+				37D1DCA81065928C0068F7EF /* WebJSPDFDoc.h in Headers */,
+				5158F6EF106D862A00AF457C /* WebHistoryDelegate.h in Headers */,
+				5185F62610712B80007AA393 /* WebNavigationData.h in Headers */,
+				0FD3B0F21076C3E900039B96 /* WebVideoFullscreenController.h in Headers */,
+				0FD3B0F41076C3E900039B96 /* WebVideoFullscreenHUDWindowController.h in Headers */,
+				0FD3B0F81076C3F700039B96 /* WebWindowAnimation.h in Headers */,
+				0A2D87FD107AF52B00CDDEE3 /* WebPluginHalterClient.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1508,8 +1581,6 @@
 				939810B70824BF01008DF038 /* url_icon.tiff in Resources */,
 				939810B50824BF01008DF038 /* WebAuthenticationPanel.nib in Resources */,
 				5DE83A7A0D0F7F9400CAD12A /* WebJavaScriptTextInputPanel.nib in Resources */,
-				5DE83A7B0D0F7F9400CAD12A /* WebViewEditingContextMenu.nib in Resources */,
-				5DE83A7C0D0F7F9400CAD12A /* WebViewEditingContextMenuOld.nib in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1745,7 +1816,7 @@
 				939810D90824BF01008DF038 /* WebNullPluginView.mm in Sources */,
 				939810D00824BF01008DF038 /* WebPanelAuthenticationHandler.m in Sources */,
 				A7D3C5BD0B5773C5002CA450 /* WebPasteboardHelper.mm in Sources */,
-				9398111F0824BF01008DF038 /* WebPDFRepresentation.m in Sources */,
+				9398111F0824BF01008DF038 /* WebPDFRepresentation.mm in Sources */,
 				9398111E0824BF01008DF038 /* WebPDFView.mm in Sources */,
 				939811260824BF01008DF038 /* WebPluginContainerCheck.mm in Sources */,
 				939810DA0824BF01008DF038 /* WebPluginController.mm in Sources */,
@@ -1769,6 +1840,15 @@
 				939811070824BF01008DF038 /* WebView.mm in Sources */,
 				BC2E464E0FD8A96800A9D9DE /* WebViewData.mm in Sources */,
 				939810E80824BF01008DF038 /* WebViewFactory.mm in Sources */,
+				41F4485010338E8C0030E55E /* WebWorkersPrivate.mm in Sources */,
+				59C77F3510545F7E00506104 /* WebGeolocationMock.mm in Sources */,
+				37B6FB4F1063530C000FDB3B /* WebPDFDocumentExtras.mm in Sources */,
+				37D1DCA91065928C0068F7EF /* WebJSPDFDoc.mm in Sources */,
+				5185F62810712B97007AA393 /* WebNavigationData.mm in Sources */,
+				0FD3B0F31076C3E900039B96 /* WebVideoFullscreenController.mm in Sources */,
+				0FD3B0F51076C3E900039B96 /* WebVideoFullscreenHUDWindowController.mm in Sources */,
+				0FD3B0F91076C3F700039B96 /* WebWindowAnimation.m in Sources */,
+				0A2D87FE107AF52B00CDDEE3 /* WebPluginHalterClient.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1784,24 +1864,6 @@
 			path = mac/Resources;
 			sourceTree = SOURCE_ROOT;
 		};
-		5DE83A760D0F7F9400CAD12A /* WebViewEditingContextMenu.nib */ = {
-			isa = PBXVariantGroup;
-			children = (
-				5DE83A770D0F7F9400CAD12A /* English */,
-			);
-			name = WebViewEditingContextMenu.nib;
-			path = mac/Resources;
-			sourceTree = SOURCE_ROOT;
-		};
-		5DE83A780D0F7F9400CAD12A /* WebViewEditingContextMenuOld.nib */ = {
-			isa = PBXVariantGroup;
-			children = (
-				5DE83A790D0F7F9400CAD12A /* English */,
-			);
-			name = WebViewEditingContextMenuOld.nib;
-			path = mac/Resources;
-			sourceTree = SOURCE_ROOT;
-		};
 		5DE83A7D0D0F7FAD00CAD12A /* Localizable.strings */ = {
 			isa = PBXVariantGroup;
 			children = (
diff --git a/WebKit/chromium/DEPS b/WebKit/chromium/DEPS
new file mode 100644
index 0000000..514a640
--- /dev/null
+++ b/WebKit/chromium/DEPS
@@ -0,0 +1,179 @@
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#   * Redistributions of source code must retain the above copyright notice,
+#     this list of conditions and the following disclaimer.
+#   * Redistributions in binary form must reproduce the above copyright 
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#   * Neither the name of Google Inc. nor the names of its contributors 
+#     may be used to endorse or promote products derived from this software
+#     without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+# This file is used by gclient to fetch the projects that the webkit
+# chromium port depends on.
+
+vars = {
+  'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
+  'chromium_deps_svn': 'http://src.chromium.org/svn/trunk/deps/third_party',
+
+  # Dependencies' revisions to use:
+  'chromium_rev': '27692',
+  'google-url_rev': '119',
+  'gyp_rev': '671',
+  'icu_rev': '27687',
+  'openvcdiff_rev': '26',
+  'skia_rev': '341',
+  'v8_rev': '2966',
+
+  # Windows:
+  'cygwin_rev': '11984',
+  'ffmpeg_ia32_rev': '26428',
+  'pthreads-win32_rev': '26716',
+  'python_24_rev': '22967',
+}
+
+deps = {
+  # build tools
+  'build':
+    Var('chromium_svn')+'/build@'+Var('chromium_rev'),
+  'webkit/build':
+      Var('chromium_svn')+'/webkit/build@'+Var('chromium_rev'),
+  'tools/gyp':
+    'http://gyp.googlecode.com/svn/trunk@'+Var('gyp_rev'),
+
+  # Basic tools
+  'base':
+    Var('chromium_svn')+'/base@'+Var('chromium_rev'),
+
+  # skia dependencies
+  'skia':
+    Var('chromium_svn')+'/skia@'+Var('chromium_rev'),
+  'third_party/skia':
+    'http://skia.googlecode.com/svn/trunk@'+Var('skia_rev'),
+
+  # testing
+  'testing':
+    Var('chromium_svn')+'/testing@'+Var('chromium_rev'),
+
+  # v8 javascript engine
+  'v8':
+    'http://v8.googlecode.com/svn/trunk@'+Var('v8_rev'),
+  
+  # net dependencies
+  'net':
+    Var('chromium_svn')+'/net@'+Var('chromium_rev'),
+  'sdch':
+    Var('chromium_svn')+'/sdch@'+Var('chromium_rev'),
+  'sdch/open-vcdiff':
+    'http://open-vcdiff.googlecode.com/svn/trunk@'+Var('openvcdiff_rev'),
+  'googleurl':
+    'http://google-url.googlecode.com/svn/trunk@'+Var('google-url_rev'),
+
+  # other third party
+  'third_party/icu':
+    Var('chromium_deps_svn')+'/icu42@'+Var('icu_rev'),
+
+  'third_party/bzip2':
+    Var('chromium_svn')+'/third_party/bzip2@'+Var('chromium_rev'),
+
+  'third_party/libevent':
+    Var('chromium_svn')+'/third_party/libevent@'+Var('chromium_rev'),
+
+  'third_party/libjpeg':
+    Var('chromium_svn')+'/third_party/libjpeg@'+Var('chromium_rev'),
+
+  'third_party/libpng':
+    Var('chromium_svn')+'/third_party/libpng@'+Var('chromium_rev'),
+
+  'third_party/libxml':
+    Var('chromium_svn')+'/third_party/libxml@'+Var('chromium_rev'),
+
+  'third_party/libxslt':
+    Var('chromium_svn')+'/third_party/libxslt@'+Var('chromium_rev'),
+
+  'third_party/modp_b64':
+    Var('chromium_svn')+'/third_party/modp_b64@'+Var('chromium_rev'),
+
+  'third_party/npapi':
+    Var('chromium_svn')+'/third_party/npapi@'+Var('chromium_rev'),
+
+  'third_party/sqlite':
+    Var('chromium_svn')+'/third_party/sqlite@'+Var('chromium_rev'),
+
+  'third_party/zlib':
+    Var('chromium_svn')+'/third_party/zlib@'+Var('chromium_rev'),
+}
+
+deps_os = {
+  'win': {
+    'third_party/cygwin':
+      Var('chromium_deps_svn')+'/cygwin@'+Var('cygwin_rev'),
+
+    'third_party/python_24':
+      Var('chromium_deps_svn')+'/python_24@'+Var('python_24_rev'),
+
+    'third_party/ffmpeg/binaries/chromium/win/ia32':
+      Var('chromium_deps_svn')+'/ffmpeg/binaries/win@'+Var('ffmpeg_ia32_rev'),
+
+    'third_party/pthreads-win32':
+      Var('chromium_deps_svn')+'/pthreads-win32@'+Var('pthreads-win32_rev'),
+  },
+}
+
+skip_child_includes = [
+   # Don't look for dependencies in the following folders: 
+   'base',
+   'build',
+   'googleurl',
+   'net',
+   'sdch',
+   'skia',
+   'testing',
+   'third_party',
+   'tools',
+   'v8',
+   'webkit',
+]
+
+include_rules = [
+  # Everybody can use some things.
+  '+base',
+  '+build',
+  '+ipc',
+
+  # For now, we allow ICU to be included by specifying 'unicode/...', although
+  # this should probably change.
+  '+unicode',
+  '+testing',
+
+  # Allow anybody to include files from the 'public' Skia directory in the
+  # webkit port. This is shared between the webkit port and Chromium.
+  '+webkit/port/platform/graphics/skia/public',
+]
+
+
+hooks = [
+  {
+    # A change to any file in this directory should run the gyp generator.
+    'pattern': '.',
+    'action': ['python', 'gyp_webkit'],
+  },
+]
diff --git a/WebKit/chromium/features.gypi b/WebKit/chromium/features.gypi
new file mode 100644
index 0000000..f91598c
--- /dev/null
+++ b/WebKit/chromium/features.gypi
@@ -0,0 +1,70 @@
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+{
+  # The following defines turn webkit features on and off.
+  'variables': {
+    'variables': {
+      # We have to nest variables inside variables as a hack for variables
+      # override.
+
+      # WARNING: build/features_override.gypi which is included in a full
+      # chromium build, overrides this list with its own values. See
+      # features_override.gypi inline documentation for more details.
+      'feature_defines%': [
+        'ENABLE_3D_CANVAS=0',
+        'ENABLE_CHANNEL_MESSAGING=1',
+        'ENABLE_DATABASE=1',
+        'ENABLE_DATAGRID=0',
+        'ENABLE_OFFLINE_WEB_APPLICATIONS=1',
+        'ENABLE_DASHBOARD_SUPPORT=0',
+        'ENABLE_DOM_STORAGE=1',
+        'ENABLE_JAVASCRIPT_DEBUGGER=0',
+        'ENABLE_JSC_MULTIPLE_THREADS=0',
+        'ENABLE_ICONDATABASE=0',
+        'ENABLE_NOTIFICATIONS=0',
+        'ENABLE_ORIENTATION_EVENTS=0',
+        'ENABLE_XSLT=1',
+        'ENABLE_XPATH=1',
+        'ENABLE_SHARED_WORKERS=0',
+        'ENABLE_SVG=1',
+        'ENABLE_SVG_ANIMATION=1',
+        'ENABLE_SVG_AS_IMAGE=1',
+        'ENABLE_SVG_USE=1',
+        'ENABLE_SVG_FOREIGN_OBJECT=1',
+        'ENABLE_SVG_FONTS=1',
+        'ENABLE_VIDEO=1',
+	'ENABLE_WEB_SOCKETS=1',
+        'ENABLE_WORKERS=1',
+      ],
+    },
+    'feature_defines%': '<(feature_defines)',
+  },
+}
diff --git a/WebKit/chromium/gyp_webkit b/WebKit/chromium/gyp_webkit
new file mode 100644
index 0000000..810af54
--- /dev/null
+++ b/WebKit/chromium/gyp_webkit
@@ -0,0 +1,96 @@
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#   * Redistributions of source code must retain the above copyright notice,
+#     this list of conditions and the following disclaimer.
+#   * Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#   * Neither the name of Google Inc. nor the names of its contributors
+#     may be used to endorse or promote products derived from this software
+#     without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+# This file is used by gclient execute gyp with the proper command
+# line arguments.
+
+import glob
+import os
+import shlex
+import sys
+
+script_dir = os.path.dirname(__file__)
+
+sys.path.append(os.path.join(script_dir, 'tools', 'gyp', 'pylib'))
+import gyp
+
+def additional_include_files(args=[]):
+  """
+  Returns a list of additional (.gypi) files to include, without
+  duplicating ones that are already specified on the command line.
+  """
+  # Determine the include files specified on the command line.
+  # This doesn't cover all the different option formats you can use,
+  # but it's mainly intended to avoid duplicating flags on the automatic
+  # makefile regeneration which only uses this format.
+  specified_includes = set()
+  for arg in args:
+    if arg.startswith('-I') and len(arg) > 2:
+      specified_includes.add(os.path.realpath(arg[2:]))
+
+  result = []
+  def AddInclude(path):
+    if os.path.realpath(path) not in specified_includes:
+      result.append(path)
+
+  # Always include common.gypi
+  AddInclude(os.path.join(script_dir, 'build', 'common.gypi'))
+
+  # Optionally add supplemental .gypi files if present.
+  supplements = glob.glob(os.path.join(script_dir, '*', 'supplement.gypi'))
+  for supplement in supplements:
+    AddInclude(supplement)
+
+  return result
+
+if __name__ == '__main__':
+
+  args = sys.argv[1:]
+
+  # Add includes.
+  args.extend(['-I' + i for i in additional_include_files(args)])
+
+  # Other command args:
+  args.extend([
+               # gyp variable defines.
+               '-Dinside_chromium_build=0',
+               '-Dv8_use_snapshot=false',
+               '-Dmsvs_use_common_release=0',
+
+               # gyp hack: otherwise gyp assumes its in chromium's src/ dir.
+               '--depth=./',
+
+               # gyp file to execute.
+               'webkit.gyp'])
+
+  print 'Updating webkit projects from gyp files...'
+  sys.stdout.flush()
+
+  # Off we go...
+  sys.exit(gyp.main(args))
diff --git a/WebKit/chromium/webkit.gyp b/WebKit/chromium/webkit.gyp
new file mode 100644
index 0000000..04d1bad
--- /dev/null
+++ b/WebKit/chromium/webkit.gyp
@@ -0,0 +1,42 @@
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#   * Redistributions of source code must retain the above copyright notice,
+#     this list of conditions and the following disclaimer.
+#   * Redistributions in binary form must reproduce the above copyright 
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#   * Neither the name of Google Inc. nor the names of its contributors 
+#     may be used to endorse or promote products derived from this software
+#     without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+{
+  'targets': [
+    {
+      # This target only builds webcore right now, but it will also build
+      # the chromium webkit api once the api is upstreamed.
+      'target_name': 'webkit',
+      'type': 'none',
+      'dependencies': [
+        '../../WebCore/WebCore.gyp/WebCore.gyp:webcore',
+      ],
+    },
+  ], # targets
+}
diff --git a/WebKit/gtk/ChangeLog b/WebKit/gtk/ChangeLog
index 4d49861..370fb2b 100644
--- a/WebKit/gtk/ChangeLog
+++ b/WebKit/gtk/ChangeLog
@@ -1,3 +1,1250 @@
+2009-10-07  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the GTK+ build.
+
+        * webkit/webkitwebpolicydecision.cpp:
+        (webkit_web_policy_decision_use):
+        (webkit_web_policy_decision_ignore):
+        (webkit_web_policy_decision_download):
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        Move the policy callback to the policy object.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchWillSubmitForm):
+        (WebKit::FrameLoaderClient::dispatchDecidePolicyForMIMEType):
+        (WebKit::FrameLoaderClient::dispatchDecidePolicyForNewWindowAction):
+        (WebKit::FrameLoaderClient::dispatchDecidePolicyForNavigationAction):
+
+2009-10-07  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        [GTK] Segfault while testing fast/events/keydown-keypress-preventDefault.html
+        https://bugs.webkit.org/show_bug.cgi?id=30121
+
+        Clear previous preedit or pending composition before storing new ones.
+        This can happen when a WebView receives a native keydown event without
+        a matching keyup event or when preventDefault() is called on DOM keydown
+        events.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::setPendingComposition):
+        (WebKit::setPendingPreedit):
+        (WebKit::clearPendingIMData):
+        (WebKit::imContextCommitted):
+        (WebKit::imContextPreeditChanged):
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Remove special cases for caret browsing, they are now handled in
+        cross-platform code.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::EditorClient::handleKeyboardEvent):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect 
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * WebCoreSupport/InspectorClientGtk.cpp:
+        (WebKit::InspectorClient::createPage):
+
+2009-10-06  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        ASSERT executing the webhistory unittest in a debug build
+        https://bugs.webkit.org/show_bug.cgi?id=28947
+
+        We have to call g_object_new first to initialize webkit threading
+        before creating the KURL.
+
+        * WebKit/gtk/webkit/webkitwebhistoryitem.cpp:
+
+2009-10-06  José Millán Soto  <fid@gpul.org>
+
+        Reviewed by Xan Lopez.
+
+        Header files of WebKitGTK do not comply with WebKit coding style (Patch attached)
+        https://bugs.webkit.org/show_bug.cgi?id=30076
+
+        Solves various issues in header files.
+
+        * WebCoreSupport/DocumentLoaderGtk.h: Added "headed guards"
+        * webkit/webkitdefines.h:
+        * webkit/webkitdownload.h:
+        * webkit/webkiterror.h:
+        * webkit/webkithittestresult.h:
+        * webkit/webkitnetworkrequest.h:
+        * webkit/webkitnetworkresponse.h:
+        * webkit/webkitprivate.h:
+        * webkit/webkitsecurityorigin.h:
+        * webkit/webkitsoupauthdialog.h:
+        * webkit/webkitversion.h.in:
+        * webkit/webkitwebbackforwardlist.h:
+        * webkit/webkitwebdatabase.h:
+        * webkit/webkitwebdatasource.h:
+        * webkit/webkitwebframe.h:
+        * webkit/webkitwebhistoryitem.h:
+        * webkit/webkitwebinspector.h:
+        * webkit/webkitwebnavigationaction.h:
+        * webkit/webkitwebpolicydecision.h:
+        * webkit/webkitwebresource.h:
+        * webkit/webkitwebsettings.h:
+        * webkit/webkitwebview.h:
+        * webkit/webkitwebwindowfeatures.h:
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        More build fixing.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_go_back_or_forward):
+        (webkit_web_view_can_go_back_or_forward):
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_go_back_or_forward):
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Factor PageController out of FrameLoader and Page
+        https://bugs.webkit.org/show_bug.cgi?id=30037
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_can_go_back_or_forward):
+
+2009-10-01  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Set the type for the fake event, otherwise the test ASSERTs in
+        debug builds.
+
+        * tests/testhittestresult.c:
+        (load_status_cb):
+
+2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GtkIMContext filtering interferes with DOM key events
+        https://bugs.webkit.org/show_bug.cgi?id=28733
+
+        Ensure that keyboard events filtered by the GtkIMContext still create
+        the proper DOM events.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::clearPendingIMData):
+        (WebKit::imContextCommitted):
+        (WebKit::imContextPreeditChanged):
+        (WebKit::EditorClient::shouldBeginEditing):
+        (WebKit::EditorClient::shouldEndEditing):
+        (WebKit::interpretEditorCommandKeyEvent):
+        (WebKit::handleCaretBrowsingKeyboardEvent):
+        (WebKit::EditorClient::handleKeyboardEvent):
+        (WebKit::EditorClient::handleInputMethodKeydown):
+        * tests/testkeyevents.c: Added.
+        (test_info_new):
+        (test_info_destroy):
+        (key_event_fixture_setup):
+        (key_event_fixture_teardown):
+        (key_press_event_cb):
+        (key_release_event_cb):
+        (load_status_cb):
+        (map_event_cb):
+        (test_keypress):
+        (main):
+
+2009-09-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Do not set a non-default parent window for child widgets. We are
+        just doing the same than the default path does, and on top of that
+        if the widget's window changes (for example, during DnD widgets
+        are usually unrealized/realized) the child widget will we left
+        pointing to a dead window.
+
+        For examples of crashers caused by this see
+        https://bugzilla.gnome.org/show_bug.cgi?id=596397 and
+        https://bugzilla.gnome.org/show_bug.cgi?id=596398
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_container_add):
+
+2009-09-29  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Eric Seidel.
+
+        [Gtk] Crash when saving a password
+        https://bugs.webkit.org/show_bug.cgi?id=28070
+
+        Disconnect the 'got-headers' callback when we are done with
+        it. The signal can be emitted more than once if the message is
+        retransmitted, but each time that happens authData is created
+        again and a new callback connected, so we have to get rid of the
+        old one (which will crash because we free authData).
+
+        * webkit/webkitsoupauthdialog.c:
+        (save_password_callback):
+
+2009-09-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Pop down the context menu when the page transitions to committed,
+        to avoid keeping a context menu out of context.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::transitionToCommittedForNewPage):
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebview.cpp:
+        (destroy_menu_cb):
+        (webkit_web_view_forward_context_menu_event):
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Reviewed by Alice Liu.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_init):
+        Pass 0 for new Page constructor argument.
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha and Jan Alonzo.
+        [GTK] Add WEBKIT_LOAD_ERROR status
+        https://bugs.webkit.org/show_bug.cgi?id=29644
+
+        Add a new load-status enum value, WEBKIT_LOAD_FAILED, emitted when
+        there's an error during the load process. This is needed if we
+        want notify::load-status to be able to handle all situations,
+        since WEBKIT_LOAD_FINISHED is not emitted when there's an error
+        and we are lacking a notification of the load being stopped.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidFailLoad):
+        * tests/testloading.c:
+        (web_loading_fixture_setup):
+        (load_error_status_changed_cb):
+        (load_error_cb):
+        (test_loading_error):
+        (load_cancelled_cb):
+        (stop_load):
+        (load_cancelled_status_changed_cb):
+        (test_loading_cancelled):
+        (main):
+        * webkit/webkitwebframe.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Revert r48697, since it broke key handling notification to GTK+.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::imContextCommitted):
+        (WebKit::imContextPreeditChanged):
+        (WebKit::EditorClient::shouldBeginEditing):
+        (WebKit::EditorClient::shouldEndEditing):
+        (WebKit::interpretKeyEvent):
+        (WebKit::handleEditingKeyboardEvent):
+        (WebKit::EditorClient::handleKeyboardEvent):
+        (WebKit::EditorClient::handleInputMethodKeydown):
+
+2009-09-23  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Ensure that even when GTKSimpleIMContext filters non-IME keystrokes,
+        keyboard events are fired properly.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::clearPendingIMData):
+        (WebKit::imContextCommitted):
+        (WebKit::imContextPreeditChanged):
+        (WebKit::EditorClient::shouldBeginEditing):
+        (WebKit::EditorClient::shouldEndEditing):
+        (WebKit::interpretEditorCommandKeyEvent):
+        (WebKit::handleCaretBrowsingKeyboardEvent):
+        (WebKit::EditorClient::handleKeyboardEvent):
+        (WebKit::EditorClient::handleInputMethodKeydown):
+
+2009-09-23  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] need to dump number of pending unload handlers
+        https://bugs.webkit.org/show_bug.cgi?id=29685
+
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_get_pending_unload_event_count): New function to
+        satisfy DRT needs.
+
+2009-09-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Minor reorganization to the patch landed in
+        http://trac.webkit.org/changeset/48670. Also move JSCore-1.0.gir
+        in the gtk directory as that's only useful to the Gtk port at the
+        moment.
+
+        * JSCore-1.0.gir: Renamed from JSCore-1.0.gir.
+
+2009-09-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Hardcode element positions at 0,0 so that we know where to
+        generate events to test WebKitHitTestResult.
+
+        * tests/testhittestresult.c:
+        (load_status_cb):
+        (test_webkit_hit_test_result):
+        (main):
+
+2009-09-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] WebKitHitTestResult is completely broken in gmail
+        https://bugs.webkit.org/show_bug.cgi?id=29527
+
+        We need to use the main or focused frame when doing the coordinate
+        transformation instead of always using the main frame.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_get_hit_test_result):
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Update documentation control files to 1.1.15.
+
+        * docs/webkitgtk-docs.sgml:
+        * docs/webkitgtk-sections.txt:
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed docs build fix. Current CFLAGS and LIBS variables no
+        longer bring gthread in.
+
+        * docs/GNUmakefile.am:
+
+2009-09-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Update for release.
+
+        * NEWS:
+
+2009-09-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Small documentation fix.
+
+        * webkit/webkithittestresult.cpp:
+
+2009-09-18  Xan Lopez  <xlopez@igalia.com>
+
+        Build fix.
+
+        Add missing file to the repository.
+
+        * tests/testhittestresult.c: Added.
+        (test_info_new):
+        (test_info_destroy):
+        (hit_test_result_fixture_setup):
+        (hit_test_result_fixture_teardown):
+        (load_status_cb):
+        (test_webkit_hit_test_result):
+        (main):
+
+2009-09-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [Gtk] Unreviewed build fix.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::platformPageClient):
+
+2009-09-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Reflect the rename of platformWindow and it's return type.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::platformPageClient):
+        (WebKit::ChromeClient::runOpenPanel):
+        * WebCoreSupport/ChromeClientGtk.h:
+        * webkit/webkitprivate.cpp:
+        (currentToplevelCallback):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_popup_menu_handler):
+
+2009-09-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Document webkit_web_view_stop_loading.
+
+        * webkit/webkitwebview.cpp:
+
+2009-09-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha and Jan Alonzo.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Add webkit_web_view_get_hit_test_result, a function to get a hit
+        test result from a GdkEventButton. Useful to let applications
+        decide between several actions on button press depending on what
+        is being pressed.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_stop_loading):
+        (documentPointForWindowPoint):
+        (webkit_web_view_get_hit_test_result):
+        * webkit/webkitwebview.h:
+
+2009-09-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha and Jan Alonzo.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Add WebKitHitTestResult, a wrapper over HitTestResult. It contains
+        context information about a point in the web page.
+
+        * webkit/webkit.h:
+        * webkit/webkitdefines.h:
+        * webkit/webkithittestresult.cpp: Added.
+        (webkit_hit_test_result_finalize):
+        (webkit_hit_test_result_get_property):
+        (webkit_hit_test_result_set_property):
+        (webkit_hit_test_result_class_init):
+        (webkit_hit_test_result_init):
+        * webkit/webkithittestresult.h: Added.
+        * webkit/webkitprivate.cpp:
+        (WebKit::kit):
+        * webkit/webkitprivate.h:
+
+2009-09-14  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez and Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29134
+        [GTK] Add API to access sub resources
+
+        Implement getting subresources, and improve testing of
+        main, and sub resources loading.
+
+2009-09-11  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Use gtk_style_set_background instead of gdk_window_set_background
+        https://bugs.webkit.org/show_bug.cgi?id=29173
+
+        Use gtk_style_set_background instead of gdk_window_set_background,
+        as suggested by the documentation. Also, use GTK_STATE_NORMAL
+        directly, since that's the default state of a GtkWidget.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_realize):
+
+2009-09-09  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] DumpRenderTree needs eventSender object and implementation
+        https://bugs.webkit.org/show_bug.cgi?id=25990
+
+        Creates a function that is accessible from the DumpRenderTree tool
+        and calls the layout method on the frame view.
+
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_layout):
+
+2009-09-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29044
+        [GTK] Should update suggested-filename when the response is received
+
+        Set suggested filename also when the response only comes after the
+        download has started.
+
+        * webkit/webkitdownload.cpp:
+        (webkit_download_set_response):
+        (webkit_download_set_suggested_filename):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_request_download):
+
+2009-09-08  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Fix up erroneus 'Since: @version@' tags in documentation.
+
+        * webkit/webkitwebdatasource.cpp:
+        * webkit/webkitwebresource.cpp:
+        (webkit_web_resource_class_init):
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init):
+        * webkit/webkitwebwindowfeatures.cpp:
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Link new objects documents in the main document.
+
+        * docs/webkitgtk-docs.sgml:
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Documentation control files updated for 1.1.14.
+
+        * docs/webkitgtk-docs.sgml:
+        * docs/webkitgtk-sections.txt:
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        What's new for 1.1.14.
+
+        * NEWS:
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Use g_return_if_fail to check for the SoupURI creation, instead of
+        printing a custom warning.
+
+        * webkit/webkitnetworkrequest.cpp:
+        (webkit_network_request_set_uri):
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26854
+        [GTK] Needs API to allow more control over outgoing requests
+
+        Map the willSendRequest delegate to the 'resource-request-starting'
+        signal, allowing more control of the resources that are fetched.
+
+        Mapping willSendRequest properly requires an appropriate Response
+        object, so we are introducing WebKitNetworkResponse, which works in a
+        way similar to WebKitNetworkRequest.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchWillSendRequest):
+        (WebKit::FrameLoaderClient::assignIdentifierToInitialRequest):
+        (WebKit::FrameLoaderClient::dispatchDidFinishLoading):
+        (WebKit::FrameLoaderClient::dispatchDidFailLoading):
+        * tests/testnetworkresponse.c: Added.
+        (test_network_response_create_destroy):
+        (test_network_response_properties):
+        (main):
+        * tests/testwebresource.c:
+        (resource_request_starting_cb):
+        (load_finished_cb):
+        (test_web_resource_loading):
+        (main):
+        * webkit/webkit.h:
+        * webkit/webkitdefines.h:
+        * webkit/webkitnetworkrequest.cpp:
+        * webkit/webkitnetworkresponse.cpp: Added.
+        (webkit_network_response_dispose):
+        (webkit_network_response_finalize):
+        (webkit_network_response_get_property):
+        (webkit_network_response_set_property):
+        (webkit_network_response_class_init):
+        (webkit_network_response_init):
+        (webkit_network_response_new_with_core_response):
+        (webkit_network_response_new):
+        (webkit_network_response_set_uri):
+        (webkit_network_response_get_uri):
+        (webkit_network_response_get_message):
+        * webkit/webkitnetworkresponse.h: Added.
+        * webkit/webkitprivate.cpp:
+        (WTF::SoupMessage):
+        (WTF::WebKitNetworkRequest):
+        (WTF::WebKitNetworkResponse):
+        (WTF::WebKitWebResource):
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebresource.cpp:
+        (webkit_web_resource_cleanup):
+        (webkit_web_resource_finalize):
+        (webkit_web_resource_class_init):
+        (webkit_web_resource_set_property):
+        (webkit_web_resource_get_uri):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init):
+        * webkitmarshal.list:
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28979
+        [GTK] Misc improvments to NetworkRequest
+
+        Unref message in dispose, as it should be, not in finalize.
+
+        * webkit/webkitnetworkrequest.cpp:
+        (webkit_network_request_dispose):
+        (webkit_network_request_finalize):
+        (webkit_network_request_class_init):
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28979
+        [GTK] Misc improvments to NetworkRequest
+
+        Bring documentation up-to-date with reality regarding NetworkRequest.
+
+        * webkit/webkitnetworkrequest.cpp:
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Make the auth dialog usable when libsoup does not have a
+        SoupPasswordManager, since it might go away in the next
+        development cycle.
+
+        * webkit/webkitsoupauthdialog.c:
+        (response_callback):
+        (session_can_save_passwords):
+        (session_authenticate):
+2009-09-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Update the unitests to latest changes wrt scrollbar policy.
+
+        * tests/testwindow.c:
+        (test_webkit_window_scrollbar_policy):
+
+2009-09-06  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha, Jan Alonzo and Xan Lopez.
+
+        [Gtk] Expose a database API
+        https://bugs.webkit.org/show_bug.cgi?id=27899
+
+        Expose an HTML5 database API for GTK+.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::print):
+        * webkit/webkit.h:
+        * webkit/webkitdefines.h:
+        * webkit/webkitprivate.cpp:
+        (webkit_init):
+        * webkit/webkitprivate.h:
+        * webkit/webkitsecurityorigin.cpp: Added.
+        (webkit_security_origin_finalize):
+        (webkit_security_origin_dispose):
+        (webkit_security_origin_set_property):
+        (webkit_security_origin_get_property):
+        (webkit_security_origins):
+        (webkit_security_origin_class_init):
+        (webkit_security_origin_init):
+        (webkit_security_origin_get_protocol):
+        (webkit_security_origin_get_host):
+        (webkit_security_origin_get_port):
+        (webkit_security_origin_get_web_database_usage):
+        (webkit_security_origin_get_web_database_quota):
+        (webkit_security_origin_set_web_database_quota):
+        (webkit_security_origin_get_all_web_databases):
+        (WebKit::kit):
+        (WebKit::core):
+        (webkit_security_origin_get_web_database):
+        * webkit/webkitsecurityorigin.h: Added.
+        * webkit/webkitwebdatabase.cpp: Added.
+        (webkit_web_database_finalize):
+        (webkit_web_database_dispose):
+        (webkit_web_database_set_property):
+        (webkit_web_database_get_property):
+        (webkit_web_database_class_init):
+        (webkit_web_database_init):
+        (webkit_web_database_set_security_origin):
+        (webkit_web_database_set_name):
+        (webkit_web_database_get_security_origin):
+        (webkit_web_database_get_name):
+        (webkit_web_database_get_display_name):
+        (webkit_web_database_get_expected_size):
+        (webkit_web_database_get_size):
+        (webkit_web_database_get_filename):
+        (webkit_web_database_remove):
+        (webkit_remove_all_web_databases):
+        (webkit_get_web_database_directory_path):
+        (webkit_set_web_database_directory_path):
+        (webkit_get_default_web_database_quota):
+        * webkit/webkitwebdatabase.h: Added.
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_new):
+        (webkit_web_frame_get_focused_accessible_element):
+        (webkit_web_frame_get_horizontal_scrollbar_policy):
+        * webkit/webkitwebframe.h:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init):
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Stub implementations of mixed content methods of FrameLoaderClient. 
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::didDisplayInsecureContent):
+        (WebKit::FrameLoaderClient::didRunInsecureContent):
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+
+2009-09-03  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Access private member variables directly instead of using the
+        accessor.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::createFrame):
+        (WebKit::FrameLoaderClient::windowObjectCleared):
+
+2009-09-03  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Remove bogus asserts that break Debug builds at runtime.
+
+        * WebCoreSupport/DocumentLoaderGtk.cpp:
+        (WebKit::DocumentLoader::detachFromFrame):
+        (WebKit::DocumentLoader::decreaseLoadCount):
+
+2009-09-02  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez and Gustavo Noronha.
+
+         [Gtk] Implement a WebDataSource for the gtk port
+         https://bugs.webkit.org/show_bug.cgi?id=24758
+
+        Add data source API getters to WebKitWebFrame.
+        Also add WebKitWebDataSource unit test.
+
+        * tests/testwebdatasource.c: Added.
+        * webkit/webkitwebframe.cpp:
+        * webkit/webkitwebframe.h:
+
+2009-09-02  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez and Gustavo Noronha.
+
+        [Gtk] Implement a WebDataSource for the gtk port
+        https://bugs.webkit.org/show_bug.cgi?id=24758
+
+        Subclass DocumentLoader for Gtk and implement it under the WebKit
+        namespace. Add WebKitWebDataSource implementation that closely
+        follows the mac implementation of the API.
+
+        * WebCoreSupport/DocumentLoaderGtk.cpp: Added.
+        * WebCoreSupport/DocumentLoaderGtk.h: Added.
+        * webkit/webkitwebdatasource.cpp: Added.
+        * webkit/webkitwebdatasource.h: Added.
+
+2009-09-01  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Avoid causing unexpected issues with window sizing when sites
+        disable scrollbars completely.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::scrollbarsModeDidChange):
+        * tests/testwindow.c:
+        (test_webkit_window_scrollbar_policy):
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_class_init):
+
+2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez and Gustavo Noronha.
+
+        [Gtk] Implement a WebDataSource for the gtk port
+        https://bugs.webkit.org/show_bug.cgi?id=24758
+
+        Implement WebKitWebResource for the resource-related API for
+        WebKitWebDataSource.
+
+        * GNUmakefile.am:
+
+2009-09-01  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28842
+        [GTK] Do not emit extra FINISHED load-status signals
+
+        Do not emit FINISHED load-status signals on our own, just rely on
+        WebCore for that. Avoids emitting FINISHED several times when we
+        fail to load a URI.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidFailProvisionalLoad):
+        (WebKit::FrameLoaderClient::dispatchDidFailLoad):
+        * tests/testloading.c:
+        (web_loading_fixture_setup):
+        (web_loading_fixture_teardown):
+        (load_finished_cb):
+        (status_changed_cb):
+        (test_loading_status):
+        (load_error_status_changed_cb):
+        (load_error_cb):
+        (test_loading_error):
+        (main):
+        * webkit/webkitwebframe.h:
+
+2009-08-31  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28466
+        When downloading a file, two GET requests are sent to the HTTP server
+
+        Support reusing a connection that is already ongoing, instead of
+        cancelling the connection and creating another.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::download):
+        * webkit/webkitdownload.cpp:
+        (webkit_download_new_with_handle):
+        (webkit_download_start):
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_request_download):
+
+2009-08-31  Alexey Proskuryakov  <ap@apple.com>
+
+        Gtk build fix.
+
+        This is also a behavior fix, at least on debug builds - a caller of
+        webkit_web_history_item_new_with_data() could pass an URL that could cause an assertion
+        failure in KURL.
+
+        * webkit/webkitwebhistoryitem.cpp: (webkit_web_history_item_new_with_data): Pass a null
+        KURL as base to parse properly.
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Add properties and a signal to report scrollbar policy changes to
+        client code, and a default handler that does the right thing when
+        using GtkScrolledWindow.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::scrollbarsModeDidChange):
+        * WebCoreSupport/ChromeClientGtk.h:
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_get_property):
+        (webkit_web_frame_class_init):
+        (webkit_web_frame_get_horizontal_scrollbar_policy):
+        (webkit_web_frame_get_vertical_scrollbar_policy):
+        * webkit/webkitwebframe.h:
+        * tests/testwindow.c: Added.
+        (load_finished_cb):
+        (test_webkit_window_scrollbar_policy):
+        (main):
+
+2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha and Xan Lopez.
+
+        [Gtk] Add view source mode API
+        https://bugs.webkit.org/show_bug.cgi?id=28805
+
+        Implement setter and getter for "view source" mode.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_set_view_source_mode):
+        (webkit_web_frame_get_view_source_mode):
+        * webkit/webkitwebview.h:
+
+2009-08-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28738
+        Expose undo/redo functionality in WebKitWebView
+
+        Expose undo/redo functionality in WebKitWebView, keeping the
+        default bindings as they were.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_real_undo):
+        (webkit_web_view_real_redo):
+        (webkit_web_view_class_init):
+        (webkit_web_view_can_undo):
+        (webkit_web_view_undo):
+        (webkit_web_view_can_redo):
+        (webkit_web_view_redo):
+        * webkit/webkitwebview.h:
+
+2009-08-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        News about the 1.1.13 release.
+
+        * NEWS:
+
+2009-08-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Add new symbols, and an index of new symbols for the 1.1.13
+        release.
+
+        * docs/webkitgtk-docs.sgml:
+        * docs/webkitgtk-sections.txt:
+
+2009-08-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fix a couple of typos.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+
+2009-08-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Update editing-behavior property here too.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_settings_notify):
+
+2009-08-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubberstamped by Gustavo Noronha.
+
+        Fix regressions introduced by http://trac.webkit.org/changeset/47690.
+
+        Update the setting whenever the property gets set.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_settings_notify):
+
+2009-08-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] API for disabling local file access to web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28663
+
+        Add a setting to enable or disable file access to web URLs. It's
+        disabled by default for security reasons.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        (webkit_web_settings_set_property):
+        (webkit_web_settings_get_property):
+        (webkit_web_settings_copy):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+
+2009-08-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28154
+        clicking below end of text in a textarea moves cursor to wrong position
+
+        Expose the EditingBehavior setting and set it by default to Mac,
+        since that what matches the GTK+ default behavior.
+
+        * webkit/webkitprivate.cpp:
+        (WebKit::core):
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        (webkit_web_settings_set_property):
+        (webkit_web_settings_get_property):
+        (webkit_web_settings_copy):
+        * webkit/webkitwebsettings.h:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+
+2009-08-20  Aaron Boodman  <aa@chromium.org>
+
+        Hopefully the last speculative build for gtk.
+
+        * webkit/webkitprivate.cpp:
+        (webkit_white_list_access_from_origin):
+        * webkit/webkitprivate.h:
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Another speculative build for gtk.
+
+        * webkit/webkitprivate.cpp:
+        (webkit_white_list_access_to_origin):
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Speculative build for gtk.
+
+        * webkit/webkitprivate.cpp:
+        (webkit_white_list_access_to_origin):
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Fix build break.
+
+        * webkit/webkitprivate.h: "WEBKIT API" -> "WEBKIT_API"
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        * webkit/webkitprivate.cpp:
+        (webkit_white_list_access_to_origin): Add API to manipulate origin access whitelists.
+        (webkit_reset_origin_access_white_lists): Ditto.
+        * webkit/webkitprivate.h: Ditto.
+
+2009-08-18  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Holger Freyther.
+
+        Remove an unneeded include.
+
+        * WebCoreSupport/DragClientGtk.cpp:
+
+2009-08-18  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28443
+        Fix build break with gtk older than 2.14.
+
+        WebKit gtk port requires gtk 2.10 or later, but DragClientGtk.cpp
+        uses gtk_widget_get_window that is introduced in 2.14.
+
+        * WebCoreSupport/DragClientGtk.cpp:
+         define gtk_widget_get_window for gtk older than 2.14.
+
+2009-08-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Gtk] crash when closing page from javascript
+        https://bugs.webkit.org/show_bug.cgi?id=27439
+
+        Do not unref the WebView in ChromeClientGtk::closeWindowSoon
+        because (1) a create-web-view handler can return a NULL WebView,
+        (2) the created WebView is owned by its containing widget, and (3)
+        clients may not handle the close-web-view signal so this avoids
+        unreffing a WebView more than once.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::closeWindowSoon):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init):
+
+2009-08-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19360
+        Frags on current page don't generate "navigation-requested" events
+
+        Fix order of parameters for the creation of SubstituteData object,
+        so that normal data loads do not have an unreachable URL. Also
+        remove a confusion about the purpose of the last parameter.
+
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_load_data):
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        * webkit/webkitprivate.h:
+        * webkit/webkitworkers.cpp: Added.
+        (webkit_worker_thread_count):
+        Exposed WebCore::WorkerThread::workerThreadCount() for the gtk version of DumpRenderTree.
+
+2009-08-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fix the ATK unit test.
+
+        We now support line boundaries in the get_text functions, so we
+        need to make sure the test has the layout we expect by giving it
+        enough space to fit in one line.
+
+        * tests/testatk.c:
+        (test_webkit_atk_get_text_at_offset):
+
+2009-08-15  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        Fix compiler warnings.
+
+        * webkit/webkitwebview.cpp:
+        (clipboard_contents_received):
+        (webkit_web_view_drag_data_get):
+
+2009-08-14  Jiahua Huang  <jhuangjiahua@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Pasteboard/GtkClipboard can't handle the "text/html" target.
+        https://bugs.webkit.org/show_bug.cgi?id=27028
+
+        Add a function in WebKit::PasteboardHelperGtk that will return the
+        value of WEBKIT_WEB_VIEW_TARGET_INFO_HTML,
+        and WebCore::clipboard_get_contents_cb will use that.
+
+        * WebCoreSupport/PasteboardHelperGtk.cpp:
+        (WebKit::PasteboardHelperGtk::getWebViewTargetInfoHtml):
+        * WebCoreSupport/PasteboardHelperGtk.h:
+
+2009-08-14  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Fix webkit_web_view_set_highlight_text_matches() so that highlighting
+        works properly in documents with frames.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_set_highlight_text_matches):
+
+2009-08-13  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Drag and drop support
+        https://bugs.webkit.org/show_bug.cgi?id=23642
+
+        Adds support for drag actions in WebKitWebView and DragClient.
+
+        Defines a support structure that can hold additional drag and drop data,
+        such as selection data or target IDs (infos) and can be passed through
+        clipboard requests.
+
+        Implements DragClient functions that gather start position of the drag
+        and start the GTK drag.
+
+        * WebCoreSupport/DragClientGtk.cpp:
+        (WebKit::DragClient::DragClient):
+        (WebKit::DragClient::willPerformDragSourceAction):
+        (WebKit::DragClient::startDrag):
+        (WebKit::DragClient::createDragImageForLink): A small style fix.
+        * WebCoreSupport/DragClientGtk.h:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_drag_end):
+        (clipboard_contents_received): GtkClipboard callback.
+        (webkit_web_view_drag_data_get):
+        (webkit_web_view_class_init):
+        (webkit_web_view_init):
+        * webkit/webkitwebview.h: Add GTK selection targets.
+
+2009-08-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix.
+
+        Last-minute change on the new soup API to use the keyring was not
+        reflected in our usage - the documentation says we should use
+        g_slist_free, and soup_auth_free_saved_users doesn't exist.
+
+        * webkit/webkitsoupauthdialog.c:
+        (session_authenticate):
+
+2009-08-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Remove keyring optional features
+        https://bugs.webkit.org/show_bug.cgi?id=28173
+
+        Remove keyring support from our code and rely on libsoup to store
+        the authentication data if the user requests that support in their
+        application/library.
+
+        * webkit/webkitsoupauthdialog.c:
+        (response_callback):
+        (show_auth_dialog):
+        (session_authenticate):
+
+2009-08-11  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        When instructed to print an out-of-range page, print an empty page
+        instead of crashing.
+
+        * webkit/webkitwebframe.cpp:
+        (draw_page_callback):
+
 2009-08-10  Brady Eidson  <beidson@apple.com>
 
         GTK build fix.
diff --git a/WebKit/gtk/JSCore-1.0.gir b/WebKit/gtk/JSCore-1.0.gir
new file mode 100644
index 0000000..2fb4d46
--- /dev/null
+++ b/WebKit/gtk/JSCore-1.0.gir
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<repository version="1.0"
+            xmlns="http://www.gtk.org/introspection/core/1.0"
+            xmlns:c="http://www.gtk.org/introspection/c/1.0">
+  <namespace name="JSCore" version="1.0" shared-library="webkit-1.0">
+    <alias name="GlobalContextRef"
+           target="none"
+           c:type="JSGlobalContextRef"/>
+    <alias name="ObjectRef" target="none" c:type="JSObjectRef"/>
+    <function name="EvaluateScript" c:identifier="JSEvaluateScript">
+      <return-value transfer-ownership="none">
+        <type name="none" c:type="void"/>
+      </return-value>
+      <parameters>
+      </parameters>
+    </function>
+  </namespace>
+</repository>
diff --git a/WebKit/gtk/NEWS b/WebKit/gtk/NEWS
index 39a54ff..8d0803c 100644
--- a/WebKit/gtk/NEWS
+++ b/WebKit/gtk/NEWS
@@ -1,4 +1,71 @@
 =================
+WebKitGTK+ 1.1.15
+=================
+
+What's new in WebKitGTK+ 1.1.15?
+
+  - New API to get the subresources from a WebKitWebDataSource. This
+    provides a way of accessing all the resources that compose the
+    view to which the data source is attached.
+  - A new function, webkit_web_view_get_hit_test_result, which allows
+    to do a 'hit test' on the coordinates specified by a mouse
+    event. A hit test provides context information about that point in
+    the document, like whether it's an image, a link, an input box,
+    etc.
+  - Our DumpRenderTree implementation now supports eventSender, which
+    allows us to run many more LayoutTests and make WebKitGTK+ more
+    stable and feature-complete.
+  - JSNES runs 6x faster: http://trac.webkit.org/changeset/48573
+  - The usual small improvements and bugfixes.
+
+=================
+WebKitGTK+ 1.1.14
+=================
+
+What's new in WebKitGTK+ 1.1.14?
+
+  - New API has been added to WebKitWebFrame to allow applying
+    scrollbars policy as requested by web applications to the main
+    frame; if the parent of the WebKitWebView widget is a
+    GtkScrolledWindow, policy is applied by the default handler.
+  - A new API has been added to help dealing with the various
+    resources that are downloaded to compose the final rendering; you
+    can now obtain the source code for a page that is loaded, for
+    instance.
+  - A new property has been added to WebKitWebView to allow setting it
+    to "View Source" mode.
+  - HTML5 database has gained API to manage the individual databases,
+    including usage and quota.
+  - A new signal `resource-request-starting' has been added to the
+    WebKitWebView to allow modification of outgoing requests for every
+    resource.
+  - Connection limit has been increased to 60 total connections, 6
+    per-host, matching other browsers more closely; this seems to have
+    improved loading time of some sites.
+  - Undo/redo support has been added to editable texts.
+  - The usual stream of small improvements and bug fixes.
+
+=================
+WebKitGTK+ 1.1.13
+=================
+
+What's new in WebKitGTK+ 1.1.13?
+
+  - GNOME Keyring support was removed in favor of the new Password
+    Manager soup feature; to get exactly the same behavior,
+    applications should use SoupPasswordManagerGNOME. This requires
+    libsoup 2.27.91 or newer.
+  - Several accessibility improvements, including support for testing
+    the a11y infrastructure in our layout tests.
+  - You can now enable/disable HTML5 offline application cache using a
+    new setting added to WebKitWebSettings.
+  - Drag support has landed, meaning you can start playing with HTML5
+    drag and drop support; drop support is still missing.
+  - A crash with scripts closing windows has been fixed.
+  - Image cursors support has been added.
+  - The usual stream of small improvements and bug fixes.
+
+=================
 WebKitGTK+ 1.1.12
 =================
 
diff --git a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
index 1292e99..8d31af3 100644
--- a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
@@ -215,6 +215,10 @@ void ChromeClient::setResizable(bool)
 
 void ChromeClient::closeWindowSoon()
 {
+    // We may not have a WebView as create-web-view can return NULL.
+    if (!m_webView)
+        return;
+
     webkit_web_view_stop_loading(m_webView);
 
     gboolean isHandled = false;
@@ -226,7 +230,6 @@ void ChromeClient::closeWindowSoon()
     // FIXME: should we clear the frame group name here explicitly? Mac does it.
     // But this gets cleared in Page's destructor anyway.
     // webkit_web_view_set_group_name(m_webView, "");
-    g_object_unref(m_webView);
 }
 
 bool ChromeClient::canTakeFocus(FocusDirection)
@@ -383,7 +386,7 @@ IntPoint ChromeClient::screenToWindow(const IntPoint& point) const
     return result;
 }
 
-PlatformWidget ChromeClient::platformWindow() const
+PlatformPageClient ChromeClient::platformPageClient() const
 {
     return GTK_WIDGET(m_webView);
 }
@@ -399,6 +402,40 @@ void ChromeClient::contentsSizeChanged(Frame* frame, const IntSize& size) const
         gtk_widget_queue_resize_no_redraw(widget);
 }
 
+void ChromeClient::scrollbarsModeDidChange() const
+{
+    WebKitWebFrame* webFrame = webkit_web_view_get_main_frame(m_webView);
+
+    g_object_notify(G_OBJECT(webFrame), "horizontal-scrollbar-policy");
+    g_object_notify(G_OBJECT(webFrame), "vertical-scrollbar-policy");
+
+    gboolean isHandled;
+    g_signal_emit_by_name(webFrame, "scrollbars-policy-changed", &isHandled);
+
+    if (isHandled)
+        return;
+
+    GtkWidget* parent = gtk_widget_get_parent(GTK_WIDGET(m_webView));
+    if (!parent || !GTK_IS_SCROLLED_WINDOW(parent))
+        return;
+
+    GtkPolicyType horizontalPolicy = webkit_web_frame_get_horizontal_scrollbar_policy(webFrame);
+    GtkPolicyType verticalPolicy = webkit_web_frame_get_vertical_scrollbar_policy(webFrame);
+
+    // ScrolledWindow doesn't like to display only part of a widget if
+    // the scrollbars are completely disabled; We have a disparity
+    // here on what the policy requested by the web app is and what we
+    // can represent; the idea is not to show scrollbars, only.
+    if (horizontalPolicy == GTK_POLICY_NEVER)
+        horizontalPolicy = GTK_POLICY_AUTOMATIC;
+
+    if (verticalPolicy == GTK_POLICY_NEVER)
+        verticalPolicy = GTK_POLICY_AUTOMATIC;
+
+    gtk_scrolled_window_set_policy(GTK_SCROLLED_WINDOW(parent),
+                                   horizontalPolicy, verticalPolicy);
+}
+
 void ChromeClient::mouseDidMoveOverElement(const HitTestResult& hit, unsigned modifierFlags)
 {
     // If a tooltip must be displayed it will be, afterwards, when
@@ -459,13 +496,17 @@ void ChromeClient::print(Frame* frame)
 }
 
 #if ENABLE(DATABASE)
-void ChromeClient::exceededDatabaseQuota(Frame* frame, const String&)
+void ChromeClient::exceededDatabaseQuota(Frame* frame, const String& databaseName)
 {
-    // Set to 5M for testing
-    // FIXME: Make this configurable
-    notImplemented();
-    const unsigned long long defaultQuota = 5 * 1024 * 1024;
+    guint64 defaultQuota = webkit_get_default_web_database_quota();
     DatabaseTracker::tracker().setQuota(frame->document()->securityOrigin(), defaultQuota);
+
+    WebKitWebFrame* webFrame = kit(frame);
+    WebKitWebView* webView = getViewFromFrame(webFrame);
+
+    WebKitSecurityOrigin* origin = webkit_web_frame_get_security_origin(webFrame);
+    WebKitWebDatabase* webDatabase = webkit_security_origin_get_web_database(origin, databaseName.utf8().data());
+    g_signal_emit_by_name(webView, "database-quota-exceeded", webFrame, webDatabase);
 }
 #endif
 
@@ -482,7 +523,7 @@ void ChromeClient::runOpenPanel(Frame*, PassRefPtr<FileChooser> prpFileChooser)
     RefPtr<FileChooser> chooser = prpFileChooser;
 
     GtkWidget* dialog = gtk_file_chooser_dialog_new(_("Upload File"),
-                                                    GTK_WINDOW(gtk_widget_get_toplevel(GTK_WIDGET(platformWindow()))),
+                                                    GTK_WINDOW(gtk_widget_get_toplevel(GTK_WIDGET(platformPageClient()))),
                                                     GTK_FILE_CHOOSER_ACTION_OPEN,
                                                     GTK_STOCK_CANCEL, GTK_RESPONSE_CANCEL,
                                                     GTK_STOCK_OPEN, GTK_RESPONSE_ACCEPT,
diff --git a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
index 0f35e52..e321c35 100644
--- a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
+++ b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
@@ -89,9 +89,10 @@ namespace WebKit {
         virtual void scroll(const WebCore::IntSize& scrollDelta, const WebCore::IntRect& rectToScroll, const WebCore::IntRect& clipRect);
         virtual WebCore::IntPoint screenToWindow(const WebCore::IntPoint&) const;
         virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&) const;
-        virtual PlatformWidget platformWindow() const;
+        virtual PlatformPageClient platformPageClient() const;
         virtual void contentsSizeChanged(WebCore::Frame*, const WebCore::IntSize&) const;
 
+        virtual void scrollbarsModeDidChange() const;
         virtual void mouseDidMoveOverElement(const WebCore::HitTestResult&, unsigned modifierFlags);
 
         virtual void setToolTip(const WebCore::String&, WebCore::TextDirection);
diff --git a/WebKit/gtk/WebCoreSupport/DocumentLoaderGtk.cpp b/WebKit/gtk/WebCoreSupport/DocumentLoaderGtk.cpp
new file mode 100644
index 0000000..0efc9fa
--- /dev/null
+++ b/WebKit/gtk/WebCoreSupport/DocumentLoaderGtk.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009  Jan Michael Alonzo
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+    * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DocumentLoaderGtk.h"
+
+#include "webkitwebdatasource.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+DocumentLoader::DocumentLoader(const ResourceRequest& request, const SubstituteData& substituteData)
+    : WebCore::DocumentLoader(request, substituteData)
+    , m_isDataSourceReffed(false)
+    , m_dataSource(0)
+{
+}
+
+void DocumentLoader::setDataSource(WebKitWebDataSource* dataSource)
+{
+    ASSERT(!m_dataSource);
+
+    m_dataSource = dataSource;
+    refDataSource();
+}
+
+void DocumentLoader::detachDataSource()
+{
+    unrefDataSource();
+}
+
+void DocumentLoader::attachToFrame()
+{
+    WebCore::DocumentLoader::attachToFrame();
+
+    refDataSource();
+}
+
+void DocumentLoader::detachFromFrame()
+{
+    WebCore::DocumentLoader::detachFromFrame();
+
+    if (m_loadingResources.isEmpty())
+        unrefDataSource();
+}
+
+void DocumentLoader::increaseLoadCount(unsigned long identifier)
+{
+    ASSERT(m_dataSource);
+
+    if (m_loadingResources.contains(identifier))
+        return;
+    m_loadingResources.add(identifier);
+    refDataSource();
+}
+
+void DocumentLoader::decreaseLoadCount(unsigned long identifier)
+{
+    HashSet<unsigned long>::iterator it = m_loadingResources.find(identifier);
+
+    // It is valid for a load to be cancelled before it's started.
+    if (it == m_loadingResources.end())
+        return;
+
+    m_loadingResources.remove(it);
+
+    if (m_loadingResources.isEmpty() && !frame())
+        unrefDataSource();
+}
+
+// helper methos to avoid ref count churn
+void DocumentLoader::refDataSource()
+{
+    if (!m_dataSource || m_isDataSourceReffed)
+        return;
+    m_isDataSourceReffed = true;
+    g_object_ref(m_dataSource);
+}
+void DocumentLoader::unrefDataSource()
+{
+    if (!m_isDataSourceReffed)
+        return;
+    ASSERT(m_dataSource);
+    m_isDataSourceReffed = false;
+    g_object_unref(m_dataSource);
+}
+
+} // end namespace WebKit
diff --git a/WebKit/gtk/WebCoreSupport/DocumentLoaderGtk.h b/WebKit/gtk/WebCoreSupport/DocumentLoaderGtk.h
new file mode 100644
index 0000000..c601bc5
--- /dev/null
+++ b/WebKit/gtk/WebCoreSupport/DocumentLoaderGtk.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009  Jan Michael Alonzo
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DocumentLoaderGtk_h
+#define DocumentLoaderGtk_h
+
+#include "DocumentLoader.h"
+#include "webkitdefines.h"
+#include "wtf/HashSet.h"
+
+namespace WebCore {
+    class ResourceRequest;
+    class SubstituteData;
+}
+
+namespace WebKit {
+
+class DocumentLoader : public WebCore::DocumentLoader {
+public:
+    static PassRefPtr<WebKit::DocumentLoader> create(const WebCore::ResourceRequest& request, const WebCore::SubstituteData& data)
+    {
+        return adoptRef(new DocumentLoader(request, data));
+    }
+
+    void setDataSource(WebKitWebDataSource*);
+    void detachDataSource();
+    WebKitWebDataSource* dataSource() const { return m_dataSource; }
+
+    void increaseLoadCount(unsigned long identifier);
+    void decreaseLoadCount(unsigned long identifier);
+
+private:
+    DocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
+
+    virtual void attachToFrame();
+    virtual void detachFromFrame();
+
+    void refDataSource();
+    void unrefDataSource();
+
+    bool m_isDataSourceReffed;
+    WebKitWebDataSource* m_dataSource;
+    HashSet<unsigned long> m_loadingResources;
+};
+
+} // end namespace WebKit
+
+#endif
diff --git a/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp b/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp
index f55b6ea..f4b0df1 100644
--- a/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp
@@ -17,20 +17,36 @@
 #include "config.h"
 #include "DragClientGtk.h"
 
+#include "Document.h"
+#include "Element.h"
+#include "Frame.h"
 #include "NotImplemented.h"
+#include "RenderObject.h"
+#include "webkitwebview.h"
+
+#include <gtk/gtk.h>
+#if !GTK_CHECK_VERSION(2, 14, 0)
+#define gtk_widget_get_window(widget) (widget)->window
+#endif
 
 using namespace WebCore;
 
 namespace WebKit {
 
+DragClient::DragClient(WebKitWebView* webView)
+    : m_webView(webView)
+    , m_startPos(0, 0)
+{
+}
+
 void DragClient::willPerformDragDestinationAction(DragDestinationAction, DragData*)
 {
     notImplemented();
 }
 
-void DragClient::willPerformDragSourceAction(DragSourceAction, const IntPoint&, Clipboard*)
+void DragClient::willPerformDragSourceAction(DragSourceAction, const IntPoint& startPos, Clipboard*)
 {
-    notImplemented();
+    m_startPos = startPos;
 }
 
 DragDestinationAction DragClient::actionMaskForDrag(DragData*)
@@ -45,12 +61,53 @@ DragSourceAction DragClient::dragSourceActionMaskForPoint(const IntPoint&)
     return DragSourceActionAny;
 }
 
-void DragClient::startDrag(DragImageRef, const IntPoint&, const IntPoint&, Clipboard*, Frame*, bool)
+void DragClient::startDrag(DragImageRef image, const IntPoint& dragImageOrigin, const IntPoint& eventPos, Clipboard*, Frame* frame, bool linkDrag)
 {
-    notImplemented();
+    Element* targetElement = frame->document()->elementFromPoint(m_startPos.x(), m_startPos.y());
+    bool imageDrag = false;
+
+    if (targetElement)
+        imageDrag = targetElement->renderer()->isImage();
+
+    GdkAtom textHtml = gdk_atom_intern_static_string("text/html");
+    GdkAtom netscapeUrl = gdk_atom_intern_static_string("_NETSCAPE_URL");
+
+    GtkTargetList* targetList = gtk_target_list_new(NULL, 0);
+    gtk_target_list_add(targetList, textHtml, 0, WEBKIT_WEB_VIEW_TARGET_INFO_HTML);
+    gtk_target_list_add_text_targets(targetList, WEBKIT_WEB_VIEW_TARGET_INFO_TEXT);
+
+    if (linkDrag || imageDrag) {
+        gtk_target_list_add(targetList, netscapeUrl, 0, WEBKIT_WEB_VIEW_TARGET_INFO_NETSCAPE_URL);
+        gtk_target_list_add_uri_targets(targetList, WEBKIT_WEB_VIEW_TARGET_INFO_URI_LIST);
+    }
+
+    if (imageDrag)
+        gtk_target_list_add_image_targets(targetList, WEBKIT_WEB_VIEW_TARGET_INFO_IMAGE, false);
+
+    GdkDragAction dragAction = GDK_ACTION_COPY;
+    if (linkDrag) {
+        dragAction = GDK_ACTION_LINK;
+        if (imageDrag)
+            dragAction = (GdkDragAction)(dragAction | GDK_ACTION_COPY);
+    }
+
+    GdkEvent* event = gdk_event_new(GDK_BUTTON_PRESS);
+    reinterpret_cast<GdkEventButton*>(event)->window = gtk_widget_get_window(GTK_WIDGET(m_webView));
+    reinterpret_cast<GdkEventButton*>(event)->time = GDK_CURRENT_TIME;
+
+    GdkDragContext* context = gtk_drag_begin(GTK_WIDGET(m_webView),
+                                             targetList, dragAction, 1, event);
+    g_object_ref(context);
+
+    if (image)
+        gtk_drag_set_icon_pixbuf(context, image, eventPos.x() - dragImageOrigin.x(), eventPos.y() - dragImageOrigin.y());
+    else
+        gtk_drag_set_icon_default(context);
+
+    gtk_target_list_unref(targetList);
 }
 
-DragImageRef DragClient::createDragImageForLink(KURL&, const String& label, Frame*)
+DragImageRef DragClient::createDragImageForLink(KURL&, const String&, Frame*)
 {
     notImplemented();
     return 0;
@@ -61,4 +118,3 @@ void DragClient::dragControllerDestroyed()
     delete this;
 }
 }
-
diff --git a/WebKit/gtk/WebCoreSupport/DragClientGtk.h b/WebKit/gtk/WebCoreSupport/DragClientGtk.h
index 4367c68..97ea72a 100644
--- a/WebKit/gtk/WebCoreSupport/DragClientGtk.h
+++ b/WebKit/gtk/WebCoreSupport/DragClientGtk.h
@@ -32,9 +32,14 @@
 
 #include "DragClient.h"
 
+typedef struct _WebKitWebView WebKitWebView;
+
 namespace WebKit {
+
     class DragClient : public WebCore::DragClient {
     public:
+        DragClient(WebKitWebView*);
+
         virtual void willPerformDragDestinationAction(WebCore::DragDestinationAction, WebCore::DragData*);
         virtual void willPerformDragSourceAction(WebCore::DragSourceAction, const WebCore::IntPoint&, WebCore::Clipboard*);
         virtual WebCore::DragDestinationAction actionMaskForDrag(WebCore::DragData*);
@@ -45,6 +50,10 @@ namespace WebKit {
         virtual WebCore::DragImageRef createDragImageForLink(WebCore::KURL&, const WebCore::String& label, WebCore::Frame*);
 
         virtual void dragControllerDestroyed();
+
+        private:
+            WebKitWebView* m_webView;
+            WebCore::IntPoint m_startPos;
     };
 }
 
diff --git a/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp b/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
index b5148d8..7121163 100644
--- a/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
@@ -49,39 +49,40 @@ using namespace WebCore;
 
 namespace WebKit {
 
-static void imContextCommitted(GtkIMContext* context, const gchar* str, EditorClient* client)
-{
-    Frame* targetFrame = core(client->m_webView)->focusController()->focusedOrMainFrame();
+static gchar* pendingComposition = 0;
+static gchar* pendingPreedit = 0;
 
-    if (!targetFrame || !targetFrame->editor()->canEdit())
-        return;
+static void setPendingComposition(gchar* newComposition)
+{
+    g_free(pendingComposition);
+    pendingComposition = newComposition;
+}
 
-    Editor* editor = targetFrame->editor();
+static void setPendingPreedit(gchar* newPreedit)
+{
+    g_free(pendingPreedit);
+    pendingPreedit = newPreedit;
+}
 
-    String commitString = String::fromUTF8(str);
-    editor->confirmComposition(commitString);
+static void clearPendingIMData()
+{
+    setPendingComposition(0);
+    setPendingPreedit(0);
+}
+static void imContextCommitted(GtkIMContext* context, const gchar* str, EditorClient* client)
+{
+    // This signal will fire during a keydown event. We want the contents of the
+    // field to change right before the keyup event, so we wait until then to actually
+    // commit this composition.
+    setPendingComposition(g_strdup(str));
 }
 
 static void imContextPreeditChanged(GtkIMContext* context, EditorClient* client)
 {
-    Frame* frame = core(client->m_webView)->focusController()->focusedOrMainFrame();
-    Editor* editor = frame->editor();
-
-    gchar* preedit = NULL;
-    gint cursorPos = 0;
     // We ignore the provided PangoAttrList for now.
-    gtk_im_context_get_preedit_string(context, &preedit, NULL, &cursorPos);
-    String preeditString = String::fromUTF8(preedit);
-    g_free(preedit);
-
-    // setComposition() will replace the user selection if passed an empty
-    // preedit. We don't want this to happen.
-    if (preeditString.isEmpty() && !editor->hasComposition())
-        return;
-
-    Vector<CompositionUnderline> underlines;
-    underlines.append(CompositionUnderline(0, preeditString.length(), Color(0, 0, 0), false));
-    editor->setComposition(preeditString, underlines, cursorPos, 0);
+    gchar* newPreedit = 0;
+    gtk_im_context_get_preedit_string(context, &newPreedit, NULL, NULL);
+    setPendingPreedit(newPreedit);
 }
 
 void EditorClient::setInputMethodState(bool active)
@@ -136,12 +137,16 @@ int EditorClient::spellCheckerDocumentTag()
 
 bool EditorClient::shouldBeginEditing(WebCore::Range*)
 {
+    clearPendingIMData();
+
     notImplemented();
     return true;
 }
 
 bool EditorClient::shouldEndEditing(WebCore::Range*)
 {
+    clearPendingIMData();
+
     notImplemented();
     return true;
 }
@@ -410,11 +415,6 @@ static const KeyDownEntry keyDownEntries[] = {
     { VK_RETURN, CtrlKey,            "InsertNewline"                               },
     { VK_RETURN, AltKey,             "InsertNewline"                               },
     { VK_RETURN, AltKey | ShiftKey,  "InsertNewline"                               },
-
-    // It's not quite clear whether Undo/Redo should be handled
-    // in the application or in WebKit. We chose WebKit.
-    { 'Z',       CtrlKey,            "Undo"                                        },
-    { 'Z',       CtrlKey | ShiftKey, "Redo"                                        },
 };
 
 static const KeyPressEntry keyPressEntries[] = {
@@ -426,7 +426,7 @@ static const KeyPressEntry keyPressEntries[] = {
     { '\r',   AltKey | ShiftKey,  "InsertNewline"                               },
 };
 
-static const char* interpretKeyEvent(const KeyboardEvent* evt)
+static const char* interpretEditorCommandKeyEvent(const KeyboardEvent* evt)
 {
     ASSERT(evt->type() == eventNames().keydownEvent || evt->type() == eventNames().keypressEvent);
 
@@ -461,74 +461,79 @@ static const char* interpretKeyEvent(const KeyboardEvent* evt)
     return mapKey ? keyPressCommandsMap->get(mapKey) : 0;
 }
 
-static bool handleEditingKeyboardEvent(KeyboardEvent* evt)
+void EditorClient::handleKeyboardEvent(KeyboardEvent* event)
 {
-    Node* node = evt->target()->toNode();
+    Node* node = event->target()->toNode();
     ASSERT(node);
     Frame* frame = node->document()->frame();
     ASSERT(frame);
 
-    const PlatformKeyboardEvent* keyEvent = evt->keyEvent();
-    if (!keyEvent)
-        return false;
-
-    bool caretBrowsing = frame->settings()->caretBrowsingEnabled();
-    if (caretBrowsing) {
-        switch (keyEvent->windowsVirtualKeyCode()) {
-            case VK_LEFT:
-                frame->selection()->modify(keyEvent->shiftKey() ? SelectionController::EXTEND : SelectionController::MOVE,
-                        SelectionController::LEFT,
-                        keyEvent->ctrlKey() ? WordGranularity : CharacterGranularity,
-                        true);
-                return true;
-            case VK_RIGHT:
-                frame->selection()->modify(keyEvent->shiftKey() ? SelectionController::EXTEND : SelectionController::MOVE,
-                        SelectionController::RIGHT,
-                        keyEvent->ctrlKey() ? WordGranularity : CharacterGranularity,
-                        true);
-                return true;
-            case VK_UP:
-                frame->selection()->modify(keyEvent->shiftKey() ? SelectionController::EXTEND : SelectionController::MOVE,
-                        SelectionController::BACKWARD,
-                        keyEvent->ctrlKey() ? ParagraphGranularity : LineGranularity,
-                        true);
-                return true;
-            case VK_DOWN:
-                frame->selection()->modify(keyEvent->shiftKey() ? SelectionController::EXTEND : SelectionController::MOVE,
-                        SelectionController::FORWARD,
-                        keyEvent->ctrlKey() ? ParagraphGranularity : LineGranularity,
-                        true);
-                return true;
+    const PlatformKeyboardEvent* platformEvent = event->keyEvent();
+    if (!platformEvent)
+        return;
+
+    // Don't allow editor commands or text insertion for nodes that
+    // cannot edit, unless we are in caret mode.
+    if (!frame->editor()->canEdit() && !(frame->settings() && frame->settings()->caretBrowsingEnabled()))
+        return;
+
+    const gchar* editorCommandString = interpretEditorCommandKeyEvent(event);
+    if (editorCommandString) {
+        Editor::Command command = frame->editor()->command(editorCommandString);
+
+        // On editor commands from key down events, we only want to let the event bubble up to
+        // the DOM if it inserts text. If it doesn't insert text (e.g. Tab that changes focus)
+        // we just want WebKit to handle it immediately without a DOM event.
+        if (platformEvent->type() == PlatformKeyboardEvent::RawKeyDown) {
+            if (!command.isTextInsertion() && command.execute(event))
+                event->setDefaultHandled();
+
+            return;
+        } else if (command.execute(event)) {
+            event->setDefaultHandled();
+            return;
         }
     }
 
-    Editor::Command command = frame->editor()->command(interpretKeyEvent(evt));
+    // This is just a normal text insertion, so wait to execute the insertion
+    // until a keypress event happens. This will ensure that the insertion will not
+    // be reflected in the contents of the field until the keyup DOM event.
+    if (event->type() == eventNames().keypressEvent) {
 
-    if (keyEvent->type() == PlatformKeyboardEvent::RawKeyDown) {
-        // WebKit doesn't have enough information about mode to decide how commands that just insert text if executed via Editor should be treated,
-        // so we leave it upon WebCore to either handle them immediately (e.g. Tab that changes focus) or let a keypress event be generated
-        // (e.g. Tab that inserts a Tab character, or Enter).
-        return !command.isTextInsertion() && command.execute(evt);
-    }
+        if (pendingComposition) {
+            String compositionString = String::fromUTF8(pendingComposition);
+            frame->editor()->confirmComposition(compositionString);
 
-    if (command.execute(evt))
-        return true;
+            clearPendingIMData();
+            event->setDefaultHandled();
 
-    // Don't insert null or control characters as they can result in unexpected behaviour
-    if (evt->charCode() < ' ')
-        return false;
+        } else if (pendingPreedit) {
+            String preeditString = String::fromUTF8(pendingPreedit);
 
-    // Don't insert anything if a modifier is pressed
-    if (keyEvent->ctrlKey() || keyEvent->altKey())
-        return false;
+            // Don't use an empty preedit as it will destroy the current
+            // selection, even if the composition is cancelled or fails later on.
+            if (!preeditString.isEmpty()) {
+                Vector<CompositionUnderline> underlines;
+                underlines.append(CompositionUnderline(0, preeditString.length(), Color(0, 0, 0), false));
+                frame->editor()->setComposition(preeditString, underlines, 0, 0);
+            }
 
-    return frame->editor()->insertText(evt->keyEvent()->text(), evt);
-}
+            clearPendingIMData();
+            event->setDefaultHandled();
 
-void EditorClient::handleKeyboardEvent(KeyboardEvent* event)
-{
-    if (handleEditingKeyboardEvent(event))
-        event->setDefaultHandled();
+        } else {
+            // Don't insert null or control characters as they can result in unexpected behaviour
+            if (event->charCode() < ' ')
+                return;
+
+            // Don't insert anything if a modifier is pressed
+            if (platformEvent->ctrlKey() || platformEvent->altKey())
+                return;
+
+            if (frame->editor()->insertText(platformEvent->text(), event))
+                event->setDefaultHandled();
+        }
+    }
 }
 
 void EditorClient::handleInputMethodKeydown(KeyboardEvent* event)
@@ -537,10 +542,10 @@ void EditorClient::handleInputMethodKeydown(KeyboardEvent* event)
     if (!targetFrame || !targetFrame->editor()->canEdit())
         return;
 
+    // TODO: We need to decide which filtered keystrokes should be treated as IM
+    // events and which should not.
     WebKitWebViewPrivate* priv = m_webView->priv;
-    // TODO: Dispatch IE-compatible text input events for IM events.
-    if (gtk_im_context_filter_keypress(priv->imContext, event->keyEvent()->gdkEventKey()))
-        event->setDefaultHandled();
+    gtk_im_context_filter_keypress(priv->imContext, event->keyEvent()->gdkEventKey());
 }
 
 EditorClient::EditorClient(WebKitWebView* webView)
diff --git a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index 68c0435..1cf9aee 100644
--- a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -2,7 +2,7 @@
  *  Copyright (C) 2007, 2008 Alp Toker <alp@atoker.com>
  *  Copyright (C) 2007, 2008, 2009 Holger Hans Peter Freyther
  *  Copyright (C) 2007 Christian Dywan <christian@twotoasts.de>
- *  Copyright (C) 2008 Collabora Ltd.  All rights reserved.
+ *  Copyright (C) 2008, 2009 Collabora Ltd.  All rights reserved.
  *  Copyright (C) 2009 Gustavo Noronha Silva <gns@gnome.org>
  *
  *  This library is free software; you can redistribute it and/or
@@ -23,8 +23,10 @@
 #include "config.h"
 #include "FrameLoaderClientGtk.h"
 
+#include "ArchiveResource.h"
 #include "Color.h"
 #include "DocumentLoader.h"
+#include "DocumentLoaderGtk.h"
 #include "FormState.h"
 #include "FrameLoader.h"
 #include "FrameView.h"
@@ -53,6 +55,7 @@
 #include "ScriptController.h"
 #include "webkiterror.h"
 #include "webkitnetworkrequest.h"
+#include "webkitnetworkresponse.h"
 #include "webkitprivate.h"
 #include "webkitwebframe.h"
 #include "webkitwebnavigationaction.h"
@@ -111,7 +114,13 @@ static void loadDone(WebKitWebFrame* frame, bool didSucceed)
 
 WTF::PassRefPtr<WebCore::DocumentLoader> FrameLoaderClient::createDocumentLoader(const WebCore::ResourceRequest& request, const SubstituteData& substituteData)
 {
-    return DocumentLoader::create(request, substituteData);
+    RefPtr<WebKit::DocumentLoader> loader = WebKit::DocumentLoader::create(request, substituteData);
+
+    WebKitWebDataSource* webDataSource = webkit_web_data_source_new_with_loader(loader.get());
+    loader->setDataSource(webDataSource);
+    g_object_unref(webDataSource);
+
+    return loader.release();
 }
 
 void FrameLoaderClient::dispatchWillSubmitForm(FramePolicyFunction policyFunction, PassRefPtr<FormState>)
@@ -120,11 +129,11 @@ void FrameLoaderClient::dispatchWillSubmitForm(FramePolicyFunction policyFunctio
     ASSERT(policyFunction);
     if (!policyFunction)
         return;
-    (core(m_frame)->loader()->*policyFunction)(PolicyUse);
+    (core(m_frame)->loader()->policyChecker()->*policyFunction)(PolicyUse);
 }
 
 
-void FrameLoaderClient::committedLoad(DocumentLoader* loader, const char* data, int length)
+void FrameLoaderClient::committedLoad(WebCore::DocumentLoader* loader, const char* data, int length)
 {
     if (!m_pluginView) {
         ASSERT(loader->frame());
@@ -158,30 +167,68 @@ void FrameLoaderClient::committedLoad(DocumentLoader* loader, const char* data,
 }
 
 bool
-FrameLoaderClient::shouldUseCredentialStorage(DocumentLoader*, unsigned long  identifier)
+FrameLoaderClient::shouldUseCredentialStorage(WebCore::DocumentLoader*, unsigned long  identifier)
 {
     notImplemented();
     return false;
 }
 
-void FrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(DocumentLoader*, unsigned long  identifier, const AuthenticationChallenge&)
+void FrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long  identifier, const AuthenticationChallenge&)
 {
     notImplemented();
 }
 
-void FrameLoaderClient::dispatchDidCancelAuthenticationChallenge(DocumentLoader*, unsigned long  identifier, const AuthenticationChallenge&)
+void FrameLoaderClient::dispatchDidCancelAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long  identifier, const AuthenticationChallenge&)
 {
     notImplemented();
 }
 
-void FrameLoaderClient::dispatchWillSendRequest(DocumentLoader*, unsigned long, ResourceRequest&, const ResourceResponse&)
+// We convert this to string because it's easier to use strings as
+// keys in a GHashTable.
+static char* toString(unsigned long identifier)
 {
-    notImplemented();
+    return g_strdup_printf("%ld", identifier);
 }
 
-void FrameLoaderClient::assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&)
+void FrameLoaderClient::dispatchWillSendRequest(WebCore::DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
-    notImplemented();
+    GOwnPtr<WebKitNetworkResponse> networkResponse(0);
+
+    // We are adding one more resource to the load, or maybe we are
+    // just redirecting a load.
+    if (redirectResponse.isNull())
+        static_cast<WebKit::DocumentLoader*>(loader)->increaseLoadCount(identifier);
+    else
+        networkResponse.set(webkit_network_response_new_with_core_response(redirectResponse));
+
+    WebKitWebView* webView = getViewFromFrame(m_frame);
+    GOwnPtr<gchar> identifierString(toString(identifier));
+    WebKitWebResource* webResource = webkit_web_view_get_resource(webView, identifierString.get());
+    GOwnPtr<WebKitNetworkRequest> networkRequest(webkit_network_request_new_with_core_request(request));
+
+    if (!redirectResponse.isNull()) {
+        // This is a redirect, so we need to update the WebResource's knowledge
+        // of the URI.
+        g_free(webResource->priv->uri);
+        webResource->priv->uri = g_strdup(request.url().string().utf8().data());
+    }
+    
+    g_signal_emit_by_name(webView, "resource-request-starting", m_frame, webResource, networkRequest.get(), networkResponse.get());
+
+    // Feed any changes back into the ResourceRequest object.
+    SoupMessage* message = webkit_network_request_get_message(networkRequest.get());
+    if (!message) {
+        request.setURL(KURL(KURL(), String::fromUTF8(webkit_network_request_get_uri(networkRequest.get()))));
+        return;
+    }
+
+    request.updateFromSoupMessage(message);
+}
+
+void FrameLoaderClient::assignIdentifierToInitialRequest(unsigned long identifier, WebCore::DocumentLoader*, const ResourceRequest& request)
+{
+    webkit_web_view_add_resource(getViewFromFrame(m_frame), toString(identifier),
+                                 WEBKIT_WEB_RESOURCE(g_object_new(WEBKIT_TYPE_WEB_RESOURCE, "uri", request.url().string().utf8().data(), 0)));
 }
 
 void FrameLoaderClient::postProgressStartedNotification()
@@ -221,7 +268,7 @@ void FrameLoaderClient::frameLoaderDestroyed()
     delete this;
 }
 
-void FrameLoaderClient::dispatchDidReceiveResponse(DocumentLoader*, unsigned long, const ResourceResponse& response)
+void FrameLoaderClient::dispatchDidReceiveResponse(WebCore::DocumentLoader*, unsigned long, const ResourceResponse& response)
 {
     m_response = response;
 }
@@ -233,7 +280,7 @@ void FrameLoaderClient::dispatchDecidePolicyForMIMEType(FramePolicyFunction poli
         return;
 
     if (resourceRequest.isNull()) {
-        (core(m_frame)->loader()->*policyFunction)(PolicyIgnore);
+        (core(m_frame)->loader()->policyChecker()->*policyFunction)(PolicyIgnore);
         return;
     }
 
@@ -300,7 +347,7 @@ void FrameLoaderClient::dispatchDecidePolicyForNewWindowAction(FramePolicyFuncti
         return;
 
     if (resourceRequest.isNull()) {
-        (core(m_frame)->loader()->*policyFunction)(PolicyIgnore);
+        (core(m_frame)->loader()->policyChecker()->*policyFunction)(PolicyIgnore);
         return;
     }
 
@@ -323,7 +370,7 @@ void FrameLoaderClient::dispatchDecidePolicyForNewWindowAction(FramePolicyFuncti
     // FIXME: I think Qt version marshals this to another thread so when we
     // have multi-threaded download, we might need to do the same
     if (!isHandled)
-        (core(m_frame)->loader()->*policyFunction)(PolicyUse);
+        (core(m_frame)->loader()->policyChecker()->*policyFunction)(PolicyUse);
 }
 
 void FrameLoaderClient::dispatchDecidePolicyForNavigationAction(FramePolicyFunction policyFunction, const NavigationAction& action, const ResourceRequest& resourceRequest, PassRefPtr<FormState>)
@@ -333,7 +380,7 @@ void FrameLoaderClient::dispatchDecidePolicyForNavigationAction(FramePolicyFunct
         return;
 
     if (resourceRequest.isNull()) {
-        (core(m_frame)->loader()->*policyFunction)(PolicyIgnore);
+        (core(m_frame)->loader()->policyChecker()->*policyFunction)(PolicyIgnore);
         return;
     }
 
@@ -350,7 +397,7 @@ void FrameLoaderClient::dispatchDecidePolicyForNavigationAction(FramePolicyFunct
     g_signal_emit_by_name(webView, "navigation-requested", m_frame, request, &response);
 
     if (response == WEBKIT_NAVIGATION_RESPONSE_IGNORE) {
-        (core(m_frame)->loader()->*policyFunction)(PolicyIgnore);
+        (core(m_frame)->loader()->policyChecker()->*policyFunction)(PolicyIgnore);
         g_object_unref(request);
         return;
     }
@@ -403,11 +450,11 @@ PassRefPtr<Widget> FrameLoaderClient::createPlugin(const IntSize& pluginSize, HT
 PassRefPtr<Frame> FrameLoaderClient::createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
                                                  const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight)
 {
-    Frame* coreFrame = core(webFrame());
+    Frame* coreFrame = core(m_frame);
 
-    ASSERT(core(getViewFromFrame(webFrame())) == coreFrame->page());
+    ASSERT(core(getViewFromFrame(m_frame)) == coreFrame->page());
 
-    RefPtr<Frame> childFrame = webkit_web_frame_init_with_web_view(getViewFromFrame(webFrame()), ownerElement);
+    RefPtr<Frame> childFrame = webkit_web_frame_init_with_web_view(getViewFromFrame(m_frame), ownerElement);
 
     coreFrame->tree()->appendChild(childFrame);
 
@@ -474,7 +521,7 @@ void FrameLoaderClient::windowObjectCleared()
     // Is this obsolete now?
     g_signal_emit_by_name(m_frame, "cleared");
 
-    Frame* coreFrame = core(webFrame());
+    Frame* coreFrame = core(m_frame);
     ASSERT(coreFrame);
 
     Settings* settings = coreFrame->settings();
@@ -546,7 +593,17 @@ bool FrameLoaderClient::shouldGoToHistoryItem(HistoryItem* item) const
     return item != 0;
 }
 
-void FrameLoaderClient::makeRepresentation(DocumentLoader*)
+void FrameLoaderClient::didDisplayInsecureContent()
+{
+    notImplemented();
+}
+
+void FrameLoaderClient::didRunInsecureContent(SecurityOrigin*)
+{
+    notImplemented();
+}
+
+void FrameLoaderClient::makeRepresentation(WebCore::DocumentLoader*)
 {
     notImplemented();
 }
@@ -700,22 +757,22 @@ void FrameLoaderClient::cancelPolicyCheck()
         webkit_web_policy_decision_cancel(m_policyDecision);
 }
 
-void FrameLoaderClient::dispatchDidLoadMainResource(DocumentLoader*)
+void FrameLoaderClient::dispatchDidLoadMainResource(WebCore::DocumentLoader*)
 {
     notImplemented();
 }
 
-void FrameLoaderClient::revertToProvisionalState(DocumentLoader*)
+void FrameLoaderClient::revertToProvisionalState(WebCore::DocumentLoader*)
 {
     notImplemented();
 }
 
-void FrameLoaderClient::willChangeTitle(DocumentLoader*)
+void FrameLoaderClient::willChangeTitle(WebCore::DocumentLoader*)
 {
     notImplemented();
 }
 
-void FrameLoaderClient::didChangeTitle(DocumentLoader *l)
+void FrameLoaderClient::didChangeTitle(WebCore::DocumentLoader *l)
 {
     setTitle(l->title(), l->url());
 }
@@ -744,7 +801,7 @@ String FrameLoaderClient::generatedMIMETypeForURLScheme(const String&) const
     return String();
 }
 
-void FrameLoaderClient::finishedLoading(DocumentLoader* documentLoader)
+void FrameLoaderClient::finishedLoading(WebCore::DocumentLoader* documentLoader)
 {
     if (!m_pluginView)
         committedLoad(documentLoader, 0, 0);
@@ -758,7 +815,10 @@ void FrameLoaderClient::finishedLoading(DocumentLoader* documentLoader)
 
 void FrameLoaderClient::provisionalLoadStarted()
 {
-    notImplemented();
+    WebKitWebView* webView = getViewFromFrame(m_frame);
+
+    if (m_frame == webkit_web_view_get_main_frame(webView))
+        webkit_web_view_clear_resources(webView);
 }
 
 void FrameLoaderClient::didFinishLoad() {
@@ -774,19 +834,45 @@ void FrameLoaderClient::setTitle(const String& title, const KURL& url)
     frameData->title = g_strdup(title.utf8().data());
 }
 
-void FrameLoaderClient::dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived)
+void FrameLoaderClient::dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int lengthReceived)
 {
     notImplemented();
 }
 
-void FrameLoaderClient::dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier)
+void FrameLoaderClient::dispatchDidFinishLoading(WebCore::DocumentLoader* loader, unsigned long identifier)
 {
+    static_cast<WebKit::DocumentLoader*>(loader)->decreaseLoadCount(identifier);
+
+    WebKitWebView* webView = getViewFromFrame(m_frame);
+    GOwnPtr<gchar> identifierString(toString(identifier));
+    WebKitWebResource* webResource = webkit_web_view_get_resource(webView, identifierString.get());
+
+    const char* uri = webkit_web_resource_get_uri(webResource);
+    RefPtr<ArchiveResource> coreResource(loader->subresource(KURL(KURL(), uri)));
+
+    // If coreResource is NULL here, the resource failed to load,
+    // unless it's the main resource.
+    if (!coreResource && webResource != webkit_web_view_get_main_resource(webView))
+        return;
+
+    if (!coreResource)
+        coreResource = loader->mainResource().releaseRef();
+
+    webkit_web_resource_init_with_core_resource(webResource, coreResource.get());
+
+    // FIXME: This function should notify the application that the resource
+    // finished loading, maybe using a load-status property in the
+    // WebKitWebResource object, similar to what we do for WebKitWebFrame'
+    // signal.
     notImplemented();
 }
 
-void FrameLoaderClient::dispatchDidFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& error)
+void FrameLoaderClient::dispatchDidFailLoading(WebCore::DocumentLoader* loader, unsigned long identifier, const ResourceError& error)
 {
-    // FIXME: when does this occur and what should happen?
+    static_cast<WebKit::DocumentLoader*>(loader)->decreaseLoadCount(identifier);
+
+    // FIXME: This function should notify the application that the resource failed
+    // loading, maybe a 'load-error' signal in the WebKitWebResource object.
     notImplemented();
 }
 
@@ -795,7 +881,7 @@ void FrameLoaderClient::dispatchDidLoadResourceByXMLHttpRequest(unsigned long, c
     notImplemented();
 }
 
-bool FrameLoaderClient::dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int length)
+bool FrameLoaderClient::dispatchDidLoadResourceFromMemoryCache(WebCore::DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int length)
 {
     notImplemented();
     return false;
@@ -804,12 +890,12 @@ bool FrameLoaderClient::dispatchDidLoadResourceFromMemoryCache(DocumentLoader*,
 void FrameLoaderClient::dispatchDidFailProvisionalLoad(const ResourceError& error)
 {
     dispatchDidFailLoad(error);
-
-    loadDone(m_frame, false);
 }
 
 void FrameLoaderClient::dispatchDidFailLoad(const ResourceError& error)
 {
+    notifyStatus(m_frame, WEBKIT_LOAD_FAILED);
+
     WebKitWebView* webView = getViewFromFrame(m_frame);
     GError* webError = g_error_new_literal(g_quark_from_string(error.domain().utf8().data()),
                                            error.errorCode(),
@@ -824,7 +910,6 @@ void FrameLoaderClient::dispatchDidFailLoad(const ResourceError& error)
 
     if (!shouldFallBack(error)) {
         g_error_free(webError);
-        loadDone(m_frame, false);
         return;
     }
 
@@ -852,21 +937,14 @@ void FrameLoaderClient::dispatchDidFailLoad(const ResourceError& error)
         g_object_unref(errorFile);
 
     g_error_free(webError);
-
-    loadDone(m_frame, false);
 }
 
 void FrameLoaderClient::download(ResourceHandle* handle, const ResourceRequest& request, const ResourceRequest&, const ResourceResponse& response)
 {
-    // FIXME: We could reuse the same handle here, but when I tried
-    // implementing that the main load would fail and stop, so I have
-    // simplified this case for now.
-    handle->cancel();
-
-    WebKitNetworkRequest* networkRequest = webkit_network_request_new(request.url().string().utf8().data());
+    WebKitNetworkRequest* networkRequest = webkit_network_request_new_with_core_request(request);
     WebKitWebView* view = getViewFromFrame(m_frame);
 
-    webkit_web_view_request_download(view, networkRequest, response);
+    webkit_web_view_request_download(view, networkRequest, response, handle);
     g_object_unref(networkRequest);
 }
 
@@ -943,7 +1021,7 @@ void FrameLoaderClient::dispatchUnableToImplementPolicy(const ResourceError&)
     notImplemented();
 }
 
-void FrameLoaderClient::setMainDocumentError(DocumentLoader*, const ResourceError& error)
+void FrameLoaderClient::setMainDocumentError(WebCore::DocumentLoader*, const ResourceError& error)
 {
     if (m_pluginView) {
         m_pluginView->didFail(error);
@@ -997,6 +1075,14 @@ void FrameLoaderClient::transitionToCommittedForNewPage()
 
     WebKitWebViewPrivate* priv = WEBKIT_WEB_VIEW_GET_PRIVATE(containingWindow);
     frame->view()->setGtkAdjustments(priv->horizontalAdjustment, priv->verticalAdjustment);
+
+    if (priv->currentMenu) {
+        GtkMenu* menu = priv->currentMenu;
+        priv->currentMenu = NULL;
+
+        gtk_menu_popdown(menu);
+        g_object_unref(menu);
+    }
 }
 
 }
diff --git a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
index bc64c2f..c820135 100644
--- a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
+++ b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
@@ -136,6 +136,9 @@ namespace WebKit {
         virtual void updateGlobalHistoryRedirectLinks();
         virtual bool shouldGoToHistoryItem(WebCore::HistoryItem*) const;
 
+        virtual void didDisplayInsecureContent();
+        virtual void didRunInsecureContent(WebCore::SecurityOrigin*);
+
         virtual WebCore::ResourceError cancelledError(const WebCore::ResourceRequest&);
         virtual WebCore::ResourceError blockedError(const WebCore::ResourceRequest&);
         virtual WebCore::ResourceError cannotShowURLError(const WebCore::ResourceRequest&);
diff --git a/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp b/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
index 908bffa..fef07c1 100644
--- a/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
@@ -68,8 +68,13 @@ void InspectorClient::webViewDestroyed()
 
 Page* InspectorClient::createPage()
 {
-    if (m_webView)
-      return core(m_webView);
+    if (m_webView) {
+        gboolean handled = FALSE;
+        g_signal_emit_by_name(m_webInspector, "destroy", &handled);
+
+        /* we can now dispose our own reference */
+        g_object_unref(m_webInspector);
+    }
 
     // This g_object_get will ref the inspector. We're not doing an
     // unref if this method succeeds because the inspector object must
diff --git a/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.cpp b/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.cpp
index 5a7157e..f2ea316 100644
--- a/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.cpp
@@ -67,4 +67,9 @@ GtkTargetList* PasteboardHelperGtk::getPasteTargetList(Frame* frame) const
     return webkit_web_view_get_paste_target_list(webView);
 }
 
+gint PasteboardHelperGtk::getWebViewTargetInfoHtml() const
+{
+    return WEBKIT_WEB_VIEW_TARGET_INFO_HTML;
+}
+
 }
diff --git a/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.h b/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.h
index 4e66357..849b417 100644
--- a/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.h
+++ b/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.h
@@ -45,6 +45,7 @@ public:
     virtual GtkClipboard* getPrimary(Frame*) const;
     virtual GtkTargetList* getCopyTargetList(Frame*) const;
     virtual GtkTargetList* getPasteTargetList(Frame*) const;
+    virtual gint getWebViewTargetInfoHtml() const;
 };
 
 }
diff --git a/WebKit/gtk/docs/GNUmakefile.am b/WebKit/gtk/docs/GNUmakefile.am
index b34dace..968b7f6 100644
--- a/WebKit/gtk/docs/GNUmakefile.am
+++ b/WebKit/gtk/docs/GNUmakefile.am
@@ -80,10 +80,12 @@ INCLUDES= \
 	-I$(top_builddir)/DerivedSources \
 	$(GLOBALDEPS_CFLAGS) \
 	$(CAIRO_CFLAGS) \
+	$(GLIB_CFLAGS) \
 	$(GTK_CFLAGS) \
 	$(LIBSOUP_CFLAGS)
 GTKDOC_LIBS= \
 	$(top_builddir)/libwebkit-1.0.la \
+	$(GLIB_LIBS) \
 	$(GTK_LIBS) \
 	$(LIBSOUP_LIBS)
 
diff --git a/WebKit/gtk/docs/webkitgtk-docs.sgml b/WebKit/gtk/docs/webkitgtk-docs.sgml
index 402b41a..ca608d4 100644
--- a/WebKit/gtk/docs/webkitgtk-docs.sgml
+++ b/WebKit/gtk/docs/webkitgtk-docs.sgml
@@ -19,9 +19,14 @@
     <xi:include href="xml/webkitwebnavigationaction.xml"/>
     <xi:include href="xml/webkitwebpolicydecision.xml"/>
     <xi:include href="xml/webkitnetworkrequest.xml"/>
+    <xi:include href="xml/webkitnetworkresponse.xml"/>
     <xi:include href="xml/webkitwebinspector.xml"/>
+    <xi:include href="xml/webkitwebdatabase.xml"/>
+    <xi:include href="xml/webkitwebdatasource.xml"/>
+    <xi:include href="xml/webkitwebresource.xml"/>
     <xi:include href="xml/webkitdownload.xml"/>
     <xi:include href="xml/webkitsoupauthdialog.xml"/>
+    <xi:include href="xml/webkitsecurityorigin.xml"/>
     <xi:include href="xml/webkitwebwindowfeatures.xml"/>
   </chapter>
 
@@ -75,4 +80,13 @@
   <index id="index-1.1.11" role="1.1.11">
     <title>Index of new symbols in 1.1.11</title>
   </index>
+  <index id="index-1.1.13" role="1.1.13">
+    <title>Index of new symbols in 1.1.13</title>
+  </index>
+  <index id="index-1.1.14" role="1.1.14">
+    <title>Index of new symbols in 1.1.14</title>
+  </index>
+  <index id="index-1.1.15" role="1.1.15">
+    <title>Index of new symbols in 1.1.15</title>
+  </index>
 </book>
diff --git a/WebKit/gtk/docs/webkitgtk-sections.txt b/WebKit/gtk/docs/webkitgtk-sections.txt
index d038ae9..a7b636c 100644
--- a/WebKit/gtk/docs/webkitgtk-sections.txt
+++ b/WebKit/gtk/docs/webkitgtk-sections.txt
@@ -1,6 +1,7 @@
 <SECTION>
 <FILE>webkitwebsettings</FILE>
 <TITLE>WebKitWebSettings</TITLE>
+WebKitEditingBehavior
 WebKitWebSettings
 webkit_web_settings_copy
 webkit_web_settings_new
@@ -85,12 +86,17 @@ WebKitWebHistoryItemClass
 WebKitLoadStatus
 WebKitWebFrame
 webkit_web_frame_find_frame
+webkit_web_frame_get_data_source
 webkit_web_frame_get_global_context
+webkit_web_frame_get_horizontal_scrollbar_policy
 webkit_web_frame_get_load_status
 webkit_web_frame_get_name
 webkit_web_frame_get_parent
+webkit_web_frame_get_provisional_data_source
+webkit_web_frame_get_security_origin
 webkit_web_frame_get_title
 webkit_web_frame_get_uri
+webkit_web_frame_get_vertical_scrollbar_policy
 webkit_web_frame_get_web_view
 webkit_web_frame_load_alternate_string
 webkit_web_frame_load_request
@@ -154,6 +160,105 @@ WebKitDownloadStatus
 </SECTION>
 
 <SECTION>
+<FILE>webkitsecurityorigin</FILE>
+<TITLE>WebKitSecurityOrigin</TITLE>
+WebKitSecurityOrigin
+webkit_security_origin_get_all_web_databases
+webkit_security_origin_get_host
+webkit_security_origin_get_port
+webkit_security_origin_get_protocol
+webkit_security_origin_get_type
+webkit_security_origin_get_web_database_quota
+webkit_security_origin_get_web_database_usage
+webkit_security_origin_set_web_database_quota
+<SUBSECTION Standard>
+WEBKIT_SECURITY_ORIGIN
+WEBKIT_SECURITY_ORIGIN_CLASS
+WEBKIT_SECURITY_ORIGIN_GET_CLASS
+WEBKIT_IS_SECURITY_ORIGIN
+WEBKIT_IS_SECURITY_ORIGIN_CLASS
+WEBKIT_TYPE_SECURITY_ORIGIN
+<SUBSECTION Private>
+WebKitSecurityOrigin
+WebKitSecurityOriginClass
+WebKitSecurityOriginPrivate
+</SECTION>
+
+<SECTION>
+<FILE>webkithittestresult</FILE>
+<TITLE>WebKitHitTestResult</TITLE>
+WebKitHitTestResult
+WebKitHitTestResultContext
+<SUBSECTION Standard>
+WEBKIT_HIT_TEST_RESULT
+WEBKIT_HIT_TEST_RESULT_CLASS
+WEBKIT_HIT_TEST_RESULT_GET_CLASS
+WEBKIT_IS_HIT_TEST_RESULT
+WEBKIT_IS_HIT_TEST_RESULT_CLASS
+WEBKIT_TYPE_HIT_TEST_RESULT
+<SUBSECTION Private>
+WebKitHitTestResult
+WebKitHitTestResultClass
+WebKitHitTestResultContext
+WebKitHitTestResultPrivate
+webkit_hit_test_result_get_type
+</SECTION>
+
+<SECTION>
+<FILE>webkitwebdatasource</FILE>
+<TITLE>WebKitWebDataSource</TITLE>
+WebKitWebDataSource
+webkit_web_data_source_get_data
+webkit_web_data_source_get_encoding
+webkit_web_data_source_get_initial_request
+webkit_web_data_source_get_main_resource
+webkit_web_data_source_get_request
+webkit_web_data_source_get_subresources
+webkit_web_data_source_get_unreachable_uri
+webkit_web_data_source_get_web_frame
+webkit_web_data_source_is_loading
+webkit_web_data_source_new
+<SUBSECTION Standard>
+WEBKIT_IS_WEB_DATA_SOURCE
+WEBKIT_IS_WEB_DATA_SOURCE_CLASS
+WEBKIT_TYPE_WEB_DATA_SOURCE
+WEBKIT_WEB_DATA_SOURCE
+WEBKIT_WEB_DATA_SOURCE_CLASS
+WEBKIT_WEB_DATA_SOURCE_GET_CLASS
+<SUBSECTION Private>
+WebKitWebDataSource
+WebKitWebDataSourceClass
+WebKitWebDataSourcePrivate
+webkit_web_data_source_new_with_request
+webkit_web_data_source_get_type
+</SECTION>
+
+<SECTION>
+<FILE>webkitwebdatabase</FILE>
+<TITLE>WebKitWebDatabase</TITLE>
+WebKitWebDatabase
+webkit_web_database_get_display_name
+webkit_web_database_get_expected_size
+webkit_web_database_get_filename
+webkit_web_database_get_name
+webkit_web_database_get_security_origin
+webkit_web_database_get_size
+webkit_web_database_remove
+<SUBSECTION Standard>
+WEBKIT_IS_WEB_DATABASE
+WEBKIT_IS_WEB_DATABASE_CLASS
+WEBKIT_TYPE_WEB_DATABASE
+WEBKIT_WEB_DATABASE
+WEBKIT_WEB_DATABASE_CLASS
+WEBKIT_WEB_DATABASE_GET_CLASS
+<SUBSECTION Private>
+WebKitWebDatabase
+WebKitWebDatabaseClass
+WebKitWebDatabasePrivate
+webkit_web_database_get_type
+</SECTION>
+
+<SECTION>
 <FILE>webkitsoupauthdialog</FILE>
 <TITLE>WebKitSoupAuthDialog</TITLE>
 WebKitSoupAuthDialog
@@ -199,6 +304,7 @@ webkit_web_navigation_action_get_button
 webkit_web_navigation_action_get_modifier_state
 webkit_web_navigation_action_get_original_uri
 webkit_web_navigation_action_get_reason
+webkit_web_navigation_action_get_target_frame
 webkit_web_navigation_action_get_type
 webkit_web_navigation_action_set_original_uri
 webkit_web_navigation_action_set_reason
@@ -261,6 +367,28 @@ WebKitNetworkRequestClass
 </SECTION>
 
 <SECTION>
+<FILE>webkitnetworkresponse</FILE>
+<TITLE>WebKitNetworkResponse</TITLE>
+WebKitNetworkResponse
+webkit_network_response_get_uri
+webkit_network_response_get_message
+webkit_network_response_set_uri
+<SUBSECTION Standard>
+WEBKIT_NETWORK_RESPONSE
+WEBKIT_IS_NETWORK_RESPONSE
+WEBKIT_TYPE_NETWORK_RESPONSE
+WEBKIT_NETWORK_RESPONSE_CLASS
+WEBKIT_IS_NETWORK_RESPONSE_CLASS
+WEBKIT_NETWORK_RESPONSE_GET_CLASS
+<SUBSECTION Private>
+webkit_network_response_get_type
+webkit_network_response_new
+WebKitNetworkResponsePrivate
+WebKitNetworkResponse
+WebKitNetworkResponseClass
+</SECTION>
+
+<SECTION>
 <FILE>webkitwebview</FILE>
 WebKitNavigationResponse
 WebKitWebViewTargetInfo
@@ -272,7 +400,9 @@ webkit_web_view_can_go_back
 webkit_web_view_can_go_back_or_forward
 webkit_web_view_can_go_forward
 webkit_web_view_can_paste_clipboard
+webkit_web_view_can_redo
 webkit_web_view_can_show_mime_type
+webkit_web_view_can_undo
 webkit_web_view_copy_clipboard
 webkit_web_view_cut_clipboard
 webkit_web_view_delete_selection
@@ -284,6 +414,7 @@ webkit_web_view_get_editable
 webkit_web_view_get_encoding
 webkit_web_view_get_focused_frame
 webkit_web_view_get_full_content_zoom
+webkit_web_view_get_hit_test_result
 webkit_web_view_get_inspector
 webkit_web_view_get_load_status
 webkit_web_view_get_main_frame
@@ -293,6 +424,7 @@ webkit_web_view_get_settings
 webkit_web_view_get_title
 webkit_web_view_get_transparent
 webkit_web_view_get_uri
+webkit_web_view_get_view_source_mode
 webkit_web_view_get_zoom_level
 webkit_web_view_go_back
 webkit_web_view_go_back_or_forward
@@ -308,6 +440,7 @@ webkit_web_view_move_cursor
 webkit_web_view_new
 webkit_web_view_open
 webkit_web_view_paste_clipboard
+webkit_web_view_redo
 webkit_web_view_reload
 webkit_web_view_reload_bypass_cache
 webkit_web_view_search_text
@@ -319,9 +452,11 @@ webkit_web_view_set_highlight_text_matches
 webkit_web_view_set_maintains_back_forward_list
 webkit_web_view_set_settings
 webkit_web_view_set_transparent
+webkit_web_view_set_view_source_mode
 webkit_web_view_set_zoom_level
 webkit_web_view_stop_loading
 webkit_web_view_target_info_get_type
+webkit_web_view_undo
 webkit_web_view_unmark_text_matches
 webkit_web_view_zoom_in
 webkit_web_view_zoom_out
@@ -366,6 +501,37 @@ WebKitWebWindowFeaturesPrivate
 <FILE>webkit</FILE>
 webkit_init
 webkit_get_default_session
+webkit_get_default_web_database_quota
+webkit_get_web_database_directory_path
+webkit_remove_all_web_databases
+webkit_set_default_web_database_quota
+webkit_set_web_database_directory_path
+</SECTION>
+
+<SECTION>
+<FILE>webkitwebresource</FILE>
+<TITLE>WebKitWebResource</TITLE>
+WebKitWebResource
+webkit_web_resource_get_data
+webkit_web_resource_get_encoding
+webkit_web_resource_get_frame_name
+webkit_web_resource_get_mime_type
+webkit_web_resource_get_type
+webkit_web_resource_get_uri
+webkit_web_resource_new
+<SUBSECTION Standard>
+WEBKIT_WEB_RESOURCE
+WEBKIT_IS_WEB_RESOURCE
+WEBKIT_TYPE_WEB_RESOURCE
+WEBKIT_WEB_RESOURCE_CLASS
+WEBKIT_IS_WEB_RESOURCE_CLASS
+WEBKIT_WEB_RESOURCE_GET_CLASS
+<SUBSECTION Private>
+webkit_web_resource_get_type
+webkit_web_resource_new
+WebKitWebResourcePrivate
+WebKitWebResource
+WebKitWebResourceClass
 </SECTION>
 
 <SECTION>
diff --git a/WebKit/gtk/tests/testatk.c b/WebKit/gtk/tests/testatk.c
index 61eae60..3910347 100644
--- a/WebKit/gtk/tests/testatk.c
+++ b/WebKit/gtk/tests/testatk.c
@@ -60,6 +60,8 @@ static void test_webkit_atk_get_text_at_offset(void)
 
     webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
     g_object_ref_sink(webView);
+    GtkAllocation alloc = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
     webkit_web_view_load_string(webView, contents, NULL, NULL, NULL);
     loop = g_main_loop_new(NULL, TRUE);
 
diff --git a/WebKit/gtk/tests/testhittestresult.c b/WebKit/gtk/tests/testhittestresult.c
new file mode 100644
index 0000000..defda7a
--- /dev/null
+++ b/WebKit/gtk/tests/testhittestresult.c
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2009 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2,1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+#include <glib/gstdio.h>
+#include <webkit/webkit.h>
+
+#if GTK_CHECK_VERSION(2, 14, 0)
+
+typedef struct {
+  char* data;
+  guint flag;
+} TestInfo;
+
+static GMainLoop* loop;
+
+typedef struct {
+    WebKitWebView* webView;
+    TestInfo* info;
+} HitTestResultFixture;
+
+TestInfo*
+test_info_new(const char* data, guint flag)
+{
+    TestInfo* info;
+
+    info = g_slice_new(TestInfo);
+    info->data = g_strdup(data);
+    info->flag = flag;
+
+    return info;
+}
+
+void
+test_info_destroy(TestInfo* info)
+{
+    g_free(info->data);
+    g_slice_free(TestInfo, info);
+}
+
+static void hit_test_result_fixture_setup(HitTestResultFixture* fixture, gconstpointer data)
+{
+    fixture->webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(fixture->webView);
+    loop = g_main_loop_new(NULL, TRUE);
+    fixture->info = (TestInfo*)data;
+}
+
+static void hit_test_result_fixture_teardown(HitTestResultFixture* fixture, gconstpointer data)
+{
+    g_object_unref(fixture->webView);
+    g_main_loop_unref(loop);
+    test_info_destroy(fixture->info);
+}
+
+static void
+load_status_cb(WebKitWebView* webView,
+               GParamSpec* spec,
+               gpointer data)
+{
+    WebKitLoadStatus status = webkit_web_view_get_load_status(webView);
+    TestInfo* info = (TestInfo*)data;
+
+    if (status == WEBKIT_LOAD_FINISHED) {
+        WebKitHitTestResult* result;
+        guint context;
+        GdkEventButton event;
+        event.type = GDK_BUTTON_PRESS;
+        /* Close enough to 0,0 */
+        event.x = 5;
+        event.y = 5;
+
+        result = webkit_web_view_get_hit_test_result(webView, &event);
+        g_assert(result);
+        g_object_get(result, "context", &context, NULL);
+        g_assert(context & info->flag);
+        g_object_unref(result);
+        g_main_loop_quit(loop);
+    }
+}
+
+static void
+test_webkit_hit_test_result(HitTestResultFixture* fixture, gconstpointer data)
+{
+    TestInfo* info = (TestInfo*)data;
+    GtkAllocation allocation = { 0, 0, 50, 50 };
+
+    webkit_web_view_load_string(fixture->webView,
+                                info->data,
+                                "text/html",
+                                "utf-8",
+                                "file://");
+    gtk_widget_size_allocate(GTK_WIDGET(fixture->webView), &allocation);
+    g_signal_connect(fixture->webView, "notify::load-status", G_CALLBACK(load_status_cb), info);
+    g_main_loop_run(loop);
+}
+
+int main(int argc, char** argv)
+{
+    g_thread_init(NULL);
+    gtk_test_init(&argc, &argv, NULL);
+
+    g_test_bug_base("https://bugs.webkit.org/");
+
+    g_test_add("/webkit/hittestresult/document", HitTestResultFixture, 
+               test_info_new("<html><body><h1>WebKitGTK+!</h1></body></html>",
+                             WEBKIT_HIT_TEST_RESULT_CONTEXT_DOCUMENT),
+               hit_test_result_fixture_setup, test_webkit_hit_test_result, hit_test_result_fixture_teardown);
+    /* We hardcode all elements to be at 0,0 so that we know where to
+     * generate the button events */
+    g_test_add("/webkit/hittestresult/image", HitTestResultFixture,
+               test_info_new("<html><body><img style='position:absolute; left:0; top:0'src='0xdeadbeef' width=50 height=50></img></body></html>",
+                             WEBKIT_HIT_TEST_RESULT_CONTEXT_IMAGE),
+               hit_test_result_fixture_setup, test_webkit_hit_test_result, hit_test_result_fixture_teardown);
+    g_test_add("/webkit/hittestresult/editable", HitTestResultFixture,
+               test_info_new("<html><body><input style='position:absolute; left:0; top:0' size='35'></input>></body></html>",
+                             WEBKIT_HIT_TEST_RESULT_CONTEXT_EDITABLE),
+               hit_test_result_fixture_setup, test_webkit_hit_test_result, hit_test_result_fixture_teardown);
+    g_test_add("/webkit/hittestresult/link", HitTestResultFixture,
+               test_info_new("<html><body><a style='position:absolute; left:0; top:0' href='http://www.example.com'>HELLO WORLD</a></body></html>",
+                             WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK),
+               hit_test_result_fixture_setup, test_webkit_hit_test_result, hit_test_result_fixture_teardown);
+               
+    return g_test_run ();
+}
+
+#else
+
+int main(int argc, char** argv)
+{
+    g_critical("You will need at least GTK+ 2.14.0 to run the unit tests.");
+    return 0;
+}
+
+#endif
diff --git a/WebKit/gtk/tests/testkeyevents.c b/WebKit/gtk/tests/testkeyevents.c
new file mode 100644
index 0000000..ee7728c
--- /dev/null
+++ b/WebKit/gtk/tests/testkeyevents.c
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2009 Martin Robinson
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2,1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <glib/gstdio.h>
+#include <webkit/webkit.h>
+
+#if GTK_CHECK_VERSION(2, 14, 0)
+
+typedef struct {
+  char* page;
+  gboolean shouldBeHandled;
+} TestInfo;
+
+typedef struct {
+    GtkWidget* window;
+    WebKitWebView* webView;
+    GMainLoop* loop;
+    TestInfo* info;
+} KeyEventFixture;
+
+TestInfo*
+test_info_new(const char* page, gboolean shouldBeHandled)
+{
+    TestInfo* info;
+
+    info = g_slice_new(TestInfo);
+    info->page = g_strdup(page);
+    info->shouldBeHandled = shouldBeHandled;
+
+    return info;
+}
+
+void
+test_info_destroy(TestInfo* info)
+{
+    g_free(info->page);
+    g_slice_free(TestInfo, info);
+}
+
+static void key_event_fixture_setup(KeyEventFixture* fixture, gconstpointer data)
+{
+    fixture->loop = g_main_loop_new(NULL, TRUE);
+
+    fixture->window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
+    fixture->webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+
+    gtk_container_add(GTK_CONTAINER(fixture->window), GTK_WIDGET(fixture->webView));
+}
+
+static void key_event_fixture_teardown(KeyEventFixture* fixture, gconstpointer data)
+{
+    gtk_widget_destroy(fixture->window);
+    g_main_loop_unref(fixture->loop);
+    test_info_destroy(fixture->info);
+}
+
+static gboolean key_press_event_cb(WebKitWebView* webView, GdkEvent* event, gpointer data)
+{
+    KeyEventFixture* fixture = (KeyEventFixture*)data;
+    gboolean handled = GTK_WIDGET_GET_CLASS(fixture->webView)->key_press_event(GTK_WIDGET(fixture->webView), &event->key);
+    g_assert_cmpint(handled, ==, fixture->info->shouldBeHandled);
+
+    return FALSE;
+}
+
+
+static gboolean key_release_event_cb(WebKitWebView* webView, GdkEvent* event, gpointer data)
+{
+    // WebCore never seems to mark keyup events as handled.
+    KeyEventFixture* fixture = (KeyEventFixture*)data;
+    gboolean handled = GTK_WIDGET_GET_CLASS(fixture->webView)->key_press_event(GTK_WIDGET(fixture->webView), &event->key);
+    g_assert(!handled);
+
+    g_main_loop_quit(fixture->loop);
+
+    return FALSE;
+}
+
+static void load_status_cb(WebKitWebView* webView, GParamSpec* spec, gpointer data)
+{
+    KeyEventFixture* fixture = (KeyEventFixture*)data;
+    WebKitLoadStatus status = webkit_web_view_get_load_status(webView);
+    if (status == WEBKIT_LOAD_FINISHED) {
+        gtk_test_widget_send_key(GTK_WIDGET(fixture->webView),
+                                 gdk_unicode_to_keyval('a'), 0);
+    }
+
+}
+
+gboolean map_event_cb(GtkWidget *widget, GdkEvent* event, gpointer data)
+{
+    gtk_widget_grab_focus(widget);
+    KeyEventFixture* fixture = (KeyEventFixture*)data;
+
+    g_signal_connect(fixture->webView, "key-press-event",
+                     G_CALLBACK(key_press_event_cb), fixture);
+    g_signal_connect(fixture->webView, "key-release-event",
+                     G_CALLBACK(key_release_event_cb), fixture);
+
+    g_signal_connect(fixture->webView, "notify::load-status",
+                     G_CALLBACK(load_status_cb), fixture);
+
+    webkit_web_view_load_string(fixture->webView, fixture->info->page,
+                                "text/html", "utf-8", "file://");
+
+    return FALSE;
+}
+
+static void test_keypress(KeyEventFixture* fixture, gconstpointer data)
+{
+    fixture->info = (TestInfo*)data;
+
+    g_signal_connect(fixture->window, "map-event",
+                     G_CALLBACK(map_event_cb), fixture);
+
+    gtk_widget_show(fixture->window);
+    gtk_widget_show(GTK_WIDGET(fixture->webView));
+    gtk_window_present(GTK_WINDOW(fixture->window));
+
+    g_main_loop_run(fixture->loop);
+
+}
+
+int main(int argc, char** argv)
+{
+    g_thread_init(NULL);
+    gtk_test_init(&argc, &argv, NULL);
+
+    g_test_bug_base("https://bugs.webkit.org/");
+
+    g_test_add("/webkit/keyevent/textfield", KeyEventFixture,
+               test_info_new("<html><body><input id=\"in\" type=\"text\">"
+                             "<script>document.getElementById('in').focus();"
+                             "</script></body></html>", TRUE),
+               key_event_fixture_setup,
+               test_keypress,
+               key_event_fixture_teardown);
+
+    g_test_add("/webkit/keyevent/buttons", KeyEventFixture,
+               test_info_new("<html><body><input id=\"in\" type=\"button\">"
+                             "<script>document.getElementById('in').focus();"
+                             "</script></body></html>", FALSE),
+               key_event_fixture_setup,
+               test_keypress,
+               key_event_fixture_teardown);
+
+    g_test_add("/webkit/keyevent/link", KeyEventFixture,
+               test_info_new("<html><body><a href=\"http://www.gnome.org\" id=\"in\">"
+                             "LINKY MCLINKERSON</a><script>"
+                             "document.getElementById('in').focus();</script>"
+                             "</body></html>", FALSE),
+               key_event_fixture_setup,
+               test_keypress,
+               key_event_fixture_teardown);
+
+    return g_test_run();
+}
+
+#else
+
+int main(int argc, char** argv)
+{
+    g_critical("You will need at least GTK+ 2.14.0 to run the unit tests.");
+    return 0;
+}
+
+#endif
diff --git a/WebKit/gtk/tests/testloading.c b/WebKit/gtk/tests/testloading.c
index cd5f08e..c1f0fac 100644
--- a/WebKit/gtk/tests/testloading.c
+++ b/WebKit/gtk/tests/testloading.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Gustavo Noronha Silva
+ * Copyright (C) 2009 Igalia S.L.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,77 +23,201 @@
 
 #if GLIB_CHECK_VERSION(2, 16, 0) && GTK_CHECK_VERSION(2, 14, 0)
 
-static gboolean has_been_provisional = FALSE;
-static gboolean has_been_committed = FALSE;
-static gboolean has_been_first_visually_non_empty_layout = FALSE;
+typedef struct {
+    WebKitWebView* webView;
+    GMainLoop *loop;
+    gboolean has_been_provisional;
+    gboolean has_been_committed;
+    gboolean has_been_first_visually_non_empty_layout;
+    gboolean has_been_finished;
+    gboolean has_been_failed;
+    gboolean has_been_load_error;
+} WebLoadingFixture;
+
+static void web_loading_fixture_setup(WebLoadingFixture* fixture, gconstpointer data)
+{
+    fixture->webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    fixture->loop = g_main_loop_new(NULL, TRUE);
+    g_object_ref_sink(fixture->webView);
+    fixture->has_been_provisional = FALSE;
+    fixture->has_been_committed = FALSE;
+    fixture->has_been_first_visually_non_empty_layout = FALSE;
+    fixture->has_been_finished = FALSE;
+    fixture->has_been_failed = FALSE;
+    fixture->has_been_load_error = FALSE;
+}
 
-static void load_finished_cb(WebKitWebView* web_view, WebKitWebFrame* web_frame, gpointer data)
+static void web_loading_fixture_teardown(WebLoadingFixture* fixture, gconstpointer data)
 {
-    GMainLoop* loop = (GMainLoop*)data;
+    g_object_unref(fixture->webView);
+    g_main_loop_unref(fixture->loop);
+}
 
-    g_assert(has_been_provisional);
-    g_assert(has_been_committed);
-    g_assert(has_been_first_visually_non_empty_layout);
+static void load_finished_cb(WebKitWebView* web_view, WebKitWebFrame* web_frame, WebLoadingFixture* fixture)
+{
+    g_assert(fixture->has_been_provisional);
+    g_assert(fixture->has_been_committed);
+    g_assert(fixture->has_been_first_visually_non_empty_layout);
 
-    g_main_loop_quit(loop);
+    g_main_loop_quit(fixture->loop);
 }
 
 
-static void status_changed_cb(GObject* object, GParamSpec* pspec, gpointer data)
+static void status_changed_cb(GObject* object, GParamSpec* pspec, WebLoadingFixture* fixture)
 {
     WebKitLoadStatus status = webkit_web_view_get_load_status(WEBKIT_WEB_VIEW(object));
 
     switch (status) {
     case WEBKIT_LOAD_PROVISIONAL:
-        g_assert(!has_been_provisional);
-        g_assert(!has_been_committed);
-        g_assert(!has_been_first_visually_non_empty_layout);
-        has_been_provisional = TRUE;
+        g_assert(!fixture->has_been_provisional);
+        g_assert(!fixture->has_been_committed);
+        g_assert(!fixture->has_been_first_visually_non_empty_layout);
+        fixture->has_been_provisional = TRUE;
         break;
     case WEBKIT_LOAD_COMMITTED:
-        g_assert(has_been_provisional);
-        g_assert(!has_been_committed);
-        g_assert(!has_been_first_visually_non_empty_layout);
-        has_been_committed = TRUE;
+        g_assert(fixture->has_been_provisional);
+        g_assert(!fixture->has_been_committed);
+        g_assert(!fixture->has_been_first_visually_non_empty_layout);
+        fixture->has_been_committed = TRUE;
         break;
     case WEBKIT_LOAD_FIRST_VISUALLY_NON_EMPTY_LAYOUT:
-        g_assert(has_been_provisional);
-        g_assert(has_been_committed);
-        g_assert(!has_been_first_visually_non_empty_layout);
-        has_been_first_visually_non_empty_layout = TRUE;
+        g_assert(fixture->has_been_provisional);
+        g_assert(fixture->has_been_committed);
+        g_assert(!fixture->has_been_first_visually_non_empty_layout);
+        fixture->has_been_first_visually_non_empty_layout = TRUE;
         break;
     case WEBKIT_LOAD_FINISHED:
-        g_assert(has_been_provisional);
-        g_assert(has_been_committed);
-        g_assert(has_been_first_visually_non_empty_layout);
+        g_assert(fixture->has_been_provisional);
+        g_assert(fixture->has_been_committed);
+        g_assert(fixture->has_been_first_visually_non_empty_layout);
         break;
     default:
         g_assert_not_reached();
     }
 }
 
-static void test_loading_status()
+static void test_loading_status(WebLoadingFixture* fixture, gconstpointer data)
 {
-    WebKitWebView* web_view = WEBKIT_WEB_VIEW(webkit_web_view_new());
-    GMainLoop* loop = g_main_loop_new(NULL, TRUE);
+    g_assert_cmpint(webkit_web_view_get_load_status(fixture->webView), ==, WEBKIT_LOAD_PROVISIONAL);
 
-    g_object_ref_sink(web_view);
-
-    g_assert_cmpint(webkit_web_view_get_load_status(web_view), ==, WEBKIT_LOAD_PROVISIONAL);
-
-    g_object_connect(G_OBJECT(web_view),
-                     "signal::notify::load-status", G_CALLBACK(status_changed_cb), NULL,
-                     "signal::load-finished", G_CALLBACK(load_finished_cb), loop,
+    g_object_connect(G_OBJECT(fixture->webView),
+                     "signal::notify::load-status", G_CALLBACK(status_changed_cb), fixture,
+                     "signal::load-finished", G_CALLBACK(load_finished_cb), fixture,
                      NULL);
 
     /* load_uri will trigger the navigation-policy-decision-requested
      * signal emission;
      */
-    webkit_web_view_load_uri(web_view, "http://gnome.org/");
+    webkit_web_view_load_uri(fixture->webView, "http://gnome.org/");
+
+    g_main_loop_run(fixture->loop);
+}
+
+static void load_error_status_changed_cb(GObject* object, GParamSpec* pspec, WebLoadingFixture* fixture)
+{
+    WebKitLoadStatus status = webkit_web_view_get_load_status(WEBKIT_WEB_VIEW(object));
+
+    switch(status) {
+    case WEBKIT_LOAD_PROVISIONAL:
+        /* We are going to go through here twice, so don't assert
+         * anything */
+        fixture->has_been_provisional = TRUE;
+        break;
+    case WEBKIT_LOAD_FINISHED:
+        g_assert(fixture->has_been_provisional);
+        g_assert(fixture->has_been_load_error);
+        g_assert(fixture->has_been_failed);
+        /* We are checking that only one FINISHED is received in the
+           whole cycle, so assert it's FALSE */
+        g_assert(!fixture->has_been_finished);
+        fixture->has_been_finished = TRUE;
+        g_main_loop_quit(fixture->loop);
+        break;
+    case WEBKIT_LOAD_FAILED:
+        g_assert(!fixture->has_been_failed);
+        fixture->has_been_failed = TRUE;
+        break;
+    default:
+        break;
+    }
+}
+
+static gboolean load_error_cb(WebKitWebView* webView, WebKitWebFrame* frame, const char* uri, GError *error, WebLoadingFixture* fixture)
+{
+    g_assert(fixture->has_been_provisional);
+    g_assert(!fixture->has_been_load_error);
+    fixture->has_been_load_error = TRUE;
+
+    return FALSE;
+}
+
+static void test_loading_error(WebLoadingFixture* fixture, gconstpointer data)
+{
+    g_test_bug("28842");
+
+    g_signal_connect(fixture->webView, "load-error", G_CALLBACK(load_error_cb), fixture);
+    g_signal_connect(fixture->webView, "notify::load-status", G_CALLBACK(load_error_status_changed_cb), fixture);
+
+    webkit_web_view_load_uri(fixture->webView, "http://snoetuhsetuhseoutoeutc.com/");
+    g_main_loop_run(fixture->loop);
+}
+
+/* Cancelled load */
+
+static gboolean load_cancelled_cb(WebKitWebView* webView, WebKitWebFrame* frame, const char* uri, GError *error, WebLoadingFixture* fixture)
+{
+    g_assert(fixture->has_been_provisional);
+    g_assert(fixture->has_been_failed);
+    g_assert(!fixture->has_been_load_error);
+    g_assert(error->code == WEBKIT_NETWORK_ERROR_CANCELLED);
+    fixture->has_been_load_error = TRUE;
+
+    return TRUE;
+}
+
+static gboolean stop_load (gpointer data)
+{
+    webkit_web_view_stop_loading(WEBKIT_WEB_VIEW(data));
+    return FALSE;
+}
+
+static void load_cancelled_status_changed_cb(GObject* object, GParamSpec* pspec, WebLoadingFixture* fixture)
+{
+    WebKitLoadStatus status = webkit_web_view_get_load_status(WEBKIT_WEB_VIEW(object));
+
+    switch(status) {
+    case WEBKIT_LOAD_PROVISIONAL:
+        g_assert(!fixture->has_been_provisional);
+        g_assert(!fixture->has_been_failed);
+        fixture->has_been_provisional = TRUE;
+        break;
+    case WEBKIT_LOAD_COMMITTED:
+        g_idle_add (stop_load, object);
+        break;
+    case WEBKIT_LOAD_FAILED:
+        g_assert(fixture->has_been_provisional);
+        g_assert(!fixture->has_been_failed);
+        g_assert(!fixture->has_been_load_error);
+        fixture->has_been_failed = TRUE;
+        g_main_loop_quit(fixture->loop);
+        break;
+    case WEBKIT_LOAD_FINISHED:
+        g_assert_not_reached();
+        break;
+    default:
+        break;
+    }
+}
+
+static void test_loading_cancelled(WebLoadingFixture* fixture, gconstpointer data)
+{
+    g_test_bug("29644");
 
-    g_main_loop_run(loop);
+    g_signal_connect(fixture->webView, "load-error", G_CALLBACK(load_cancelled_cb), fixture);
+    g_signal_connect(fixture->webView, "notify::load-status", G_CALLBACK(load_cancelled_status_changed_cb), fixture);
 
-    g_object_unref(web_view);
+    webkit_web_view_load_uri(fixture->webView, "http://google.com/");
+    g_main_loop_run(fixture->loop);
 }
 
 int main(int argc, char** argv)
@@ -101,7 +226,21 @@ int main(int argc, char** argv)
     gtk_test_init(&argc, &argv, NULL);
 
     g_test_bug_base("https://bugs.webkit.org/");
-    g_test_add_func("/webkit/loading/status", test_loading_status);
+    g_test_add("/webkit/loading/status",
+               WebLoadingFixture, NULL,
+               web_loading_fixture_setup,
+               test_loading_status,
+               web_loading_fixture_teardown);
+    g_test_add("/webkit/loading/error",
+               WebLoadingFixture, NULL,
+               web_loading_fixture_setup,
+               test_loading_error,
+               web_loading_fixture_teardown);
+    g_test_add("/webkit/loading/cancelled",
+               WebLoadingFixture, NULL,
+               web_loading_fixture_setup,
+               test_loading_cancelled,
+               web_loading_fixture_teardown);
     return g_test_run();
 }
 
diff --git a/WebKit/gtk/tests/testnetworkresponse.c b/WebKit/gtk/tests/testnetworkresponse.c
new file mode 100644
index 0000000..9050c04
--- /dev/null
+++ b/WebKit/gtk/tests/testnetworkresponse.c
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2009 Gustavo Noronha Silva
+ * Copyright (C) 2009 Collabora Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+#include <glib.h>
+#include <glib/gstdio.h>
+#include <gtk/gtk.h>
+#include <stdlib.h>
+#include <webkit/webkit.h>
+
+#if GLIB_CHECK_VERSION(2, 16, 0) && GTK_CHECK_VERSION(2, 14, 0)
+
+static void test_network_response_create_destroy()
+{
+    WebKitNetworkResponse* response;
+    SoupMessage* message;
+
+    /* Test creation with URI */
+    response = WEBKIT_NETWORK_RESPONSE(g_object_new(WEBKIT_TYPE_NETWORK_RESPONSE, "uri", "http://debian.org/", NULL));
+    g_assert(WEBKIT_IS_NETWORK_RESPONSE(response));
+    message = webkit_network_response_get_message(response);
+    g_assert(!message);
+    g_object_unref(response);
+
+    /* Test creation with SoupMessage */
+    message = soup_message_new("GET", "http://debian.org/");
+    response = WEBKIT_NETWORK_RESPONSE(g_object_new(WEBKIT_TYPE_NETWORK_RESPONSE, "message", message, NULL));
+    g_assert(WEBKIT_IS_NETWORK_RESPONSE(response));
+    g_assert_cmpint(G_OBJECT(message)->ref_count, ==, 2);
+    g_object_unref(response);
+    g_assert_cmpint(G_OBJECT(message)->ref_count, ==, 1);
+    g_object_unref(message);
+
+    /* Test creation with both SoupMessage and URI */
+    message = soup_message_new("GET", "http://debian.org/");
+    response = WEBKIT_NETWORK_RESPONSE(g_object_new(WEBKIT_TYPE_NETWORK_RESPONSE, "message", message, "uri", "http://gnome.org/", NULL));
+    g_assert(WEBKIT_IS_NETWORK_RESPONSE(response));
+    g_assert_cmpint(G_OBJECT(message)->ref_count, ==, 2);
+    g_assert_cmpstr(webkit_network_response_get_uri(response), ==, "http://gnome.org/");
+    g_object_unref(response);
+    g_assert_cmpint(G_OBJECT(message)->ref_count, ==, 1);
+    g_object_unref(message);
+}
+
+static void test_network_response_properties()
+{
+    WebKitNetworkResponse* response;
+    SoupMessage* message;
+    gchar* soupURI;
+
+    /* Test URI is set correctly when creating with URI */
+    response = webkit_network_response_new("http://debian.org/");
+    g_assert(WEBKIT_IS_NETWORK_RESPONSE(response));
+    g_assert_cmpstr(webkit_network_response_get_uri(response), ==, "http://debian.org/");
+    g_object_unref(response);
+
+    /* Test URI is set correctly when creating with Message */
+    message = soup_message_new("GET", "http://debian.org/");
+    response = WEBKIT_NETWORK_RESPONSE(g_object_new(WEBKIT_TYPE_NETWORK_RESPONSE, "message", message, NULL));
+    g_assert(WEBKIT_IS_NETWORK_RESPONSE(response));
+    g_object_unref(message);
+
+    message = webkit_network_response_get_message(response);
+    soupURI = soup_uri_to_string(soup_message_get_uri(message), FALSE);
+    g_assert_cmpstr(soupURI, ==, "http://debian.org/");
+    g_free(soupURI);
+
+    g_assert_cmpstr(webkit_network_response_get_uri(response), ==, "http://debian.org/");
+    g_object_unref(response);
+}
+
+int main(int argc, char** argv)
+{
+    g_thread_init(NULL);
+    gtk_test_init(&argc, &argv, NULL);
+
+    g_test_bug_base("https://bugs.webkit.org/");
+    g_test_add_func("/webkit/networkresponse/createdestroy", test_network_response_create_destroy);
+    g_test_add_func("/webkit/networkresponse/properties", test_network_response_properties);
+    return g_test_run ();
+}
+
+#else
+int main(int argc, char** argv)
+{
+    g_critical("You will need at least glib-2.16.0 and gtk-2.14.0 to run the unit tests. Doing nothing now.");
+    return 0;
+}
+
+#endif
diff --git a/WebKit/gtk/tests/testwebdatasource.c b/WebKit/gtk/tests/testwebdatasource.c
new file mode 100644
index 0000000..de2430f
--- /dev/null
+++ b/WebKit/gtk/tests/testwebdatasource.c
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2009 Jan Michael Alonzo
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include <glib.h>
+#include <gtk/gtk.h>
+#include <webkit/webkit.h>
+
+#if GLIB_CHECK_VERSION(2, 16, 0) && GTK_CHECK_VERSION(2, 14, 0)
+
+static const gshort defaultTimeout = 10;
+guint waitTimer;
+gboolean shouldWait;
+
+typedef struct {
+    WebKitWebView* webView;
+    WebKitWebFrame* mainFrame;
+} WebDataSourceFixture;
+
+static void test_webkit_web_data_source_get_initial_request()
+{
+    WebKitWebView* view;
+    WebKitWebFrame* frame;
+    WebKitWebDataSource* dataSource;
+    WebKitNetworkRequest* initialRequest;
+
+    view = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(view);
+    frame = webkit_web_view_get_main_frame(view);
+
+    WebKitNetworkRequest* request = webkit_network_request_new("http://www.google.com");
+    webkit_web_frame_load_request(frame, request);
+    g_object_unref(request);
+
+    dataSource = webkit_web_frame_get_provisional_data_source(frame);
+    g_assert(dataSource);
+    initialRequest = webkit_web_data_source_get_initial_request(dataSource);
+    g_assert_cmpstr(webkit_network_request_get_uri(initialRequest), ==, "http://www.google.com/");
+
+    g_object_unref(view);
+}
+
+static void load_finished_unreachable_cb(WebKitWebView* view, WebKitWebFrame* frame, GMainLoop* loop)
+{
+    if (waitTimer) {
+        g_source_remove(waitTimer);
+        waitTimer = 0;
+    }
+
+    WebKitWebDataSource* datasource;
+    frame = webkit_web_view_get_main_frame(view);
+    datasource = webkit_web_frame_get_data_source(frame);
+
+    g_assert_cmpstr("http://localhost/doireallyexist.html", ==,
+                    webkit_web_data_source_get_unreachable_uri(datasource));
+
+    if (g_main_loop_is_running(loop))
+        g_main_loop_quit(loop);
+}
+
+static void load_finished_cb(WebKitWebView* view, WebKitWebFrame* frame, GMainLoop* loop)
+{
+    if (waitTimer) {
+        g_source_remove(waitTimer);
+        waitTimer = 0;
+    }
+
+    WebKitWebDataSource* dataSource;
+    frame = webkit_web_view_get_main_frame(view);
+    dataSource = webkit_web_frame_get_data_source(frame);
+
+    /* Test get_request */
+    g_test_message("Testing webkit_web_data_source_get_request");
+    WebKitNetworkRequest* request = webkit_web_data_source_get_request(dataSource);
+    g_assert_cmpstr(webkit_network_request_get_uri(request), ==, "http://webkit.org/");
+
+    /* Test get_main_resource */
+    g_test_message("Testing webkit_web_data_source_get_main_resource");
+    WebKitWebResource* resource = webkit_web_data_source_get_main_resource(dataSource);
+    g_assert_cmpstr("text/html", ==, webkit_web_resource_get_mime_type(resource));
+    g_assert_cmpstr("http://webkit.org/", ==, webkit_web_resource_get_uri(resource));
+
+    /* Test get_data. We just test if data has certain size for the mean time */
+    g_test_message("Testing webkit_web_data_source_get_data has certain size");
+    GString* data = webkit_web_data_source_get_data(dataSource);
+    g_assert(data->len > 100);
+
+    /* FIXME: Add test for get_encoding */
+
+    if (g_main_loop_is_running(loop))
+        g_main_loop_quit(loop);
+}
+
+static void load_committed_cb(WebKitWebView* view, WebKitWebFrame* frame)
+{
+    WebKitWebDataSource* dataSource = webkit_web_frame_get_data_source(frame);
+    g_assert(webkit_web_data_source_is_loading(dataSource));
+}
+
+static gboolean wait_timer_fired(GMainLoop* loop)
+{
+    waitTimer = 0;
+    if (g_main_loop_is_running(loop))
+        g_main_loop_quit(loop);
+
+    return FALSE;
+}
+
+static void test_webkit_web_data_source()
+{
+    WebKitWebView* view;
+    GMainLoop* loop;
+
+    view = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(view);
+    loop = g_main_loop_new(NULL, TRUE);
+    g_signal_connect(view, "load-committed", G_CALLBACK(load_committed_cb), loop);
+    g_signal_connect(view, "load-finished", G_CALLBACK(load_finished_cb), loop);
+    webkit_web_view_load_uri(view, "http://webkit.org");
+
+    if (!waitTimer)
+        waitTimer = g_timeout_add_seconds(defaultTimeout, (GSourceFunc)wait_timer_fired, loop);
+
+    g_main_loop_run(loop);
+    g_object_unref(view);
+}
+
+static void test_webkit_web_data_source_unreachable_uri()
+{
+    WebKitWebView* view;
+    GMainLoop* loop;
+
+    view = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(view);
+    loop = g_main_loop_new(NULL, TRUE);
+    g_signal_connect(view, "load-finished", G_CALLBACK(load_finished_unreachable_cb), loop);
+    webkit_web_view_load_uri(view, "http://localhost/doireallyexist.html");
+
+    if (!waitTimer)
+        waitTimer = g_timeout_add_seconds(defaultTimeout, (GSourceFunc)wait_timer_fired, loop);
+
+    g_main_loop_run(loop);
+    g_object_unref(view);
+}
+
+int main(int argc, char** argv)
+{
+    g_thread_init(NULL);
+    gtk_test_init(&argc, &argv, NULL);
+
+    g_test_bug_base("https://bugs.webkit.org/");
+    g_test_bug("24758");
+    g_test_add_func("/webkit/webdatasource/get_initial_request",
+                    test_webkit_web_data_source_get_initial_request);
+    g_test_add_func("/webkit/webdatasource/api",
+                    test_webkit_web_data_source);
+    g_test_add_func("/webkit/webdatasource/unreachable_uri",
+                    test_webkit_web_data_source_unreachable_uri);
+    return g_test_run ();
+}
+
+#else
+int main(int argc, char** argv)
+{
+    g_critical("You will need at least glib-2.16.0 and gtk-2.14.0 to run the unit tests. Doing nothing now.");
+    return 0;
+}
+
+#endif
diff --git a/WebKit/gtk/tests/testwebresource.c b/WebKit/gtk/tests/testwebresource.c
new file mode 100644
index 0000000..b9cd40b
--- /dev/null
+++ b/WebKit/gtk/tests/testwebresource.c
@@ -0,0 +1,332 @@
+/*
+ * Copyright (C) 2009 Jan Michael Alonzo
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include <glib.h>
+#include <gtk/gtk.h>
+#include <libsoup/soup.h>
+#include <string.h>
+#include <webkit/webkit.h>
+
+#if GLIB_CHECK_VERSION(2, 16, 0) && GTK_CHECK_VERSION(2, 14, 0)
+
+#define INDEX_HTML "<html></html>"
+#define MAIN_HTML "<html><head><script language=\"javascript\" src=\"/javascript.js\"></script></head><body><h1>hah</h1></html>"
+#define JAVASCRIPT "function blah () { var a = 1; }"
+
+GMainLoop* loop;
+SoupSession *session;
+char *base_uri;
+WebKitWebResource* main_resource;
+WebKitWebResource* sub_resource;
+
+typedef struct {
+    WebKitWebResource* webResource;
+    WebKitWebView* webView;
+} WebResourceFixture;
+
+/* For real request testing */
+static void
+server_callback (SoupServer *server, SoupMessage *msg,
+                 const char *path, GHashTable *query,
+                 SoupClientContext *context, gpointer data)
+{
+    if (msg->method != SOUP_METHOD_GET) {
+        soup_message_set_status (msg, SOUP_STATUS_NOT_IMPLEMENTED);
+        return;
+    }
+
+    soup_message_set_status (msg, SOUP_STATUS_OK);
+
+    /* Redirect */
+    if (g_str_equal (path, "/")) {
+        soup_message_set_status (msg, SOUP_STATUS_MOVED_PERMANENTLY);
+
+        soup_message_headers_append (msg->response_headers,
+                                     "Location", "/index.html");
+    } else if (g_str_equal (path, "/index.html")) {
+        soup_message_body_append (msg->response_body,
+                                  SOUP_MEMORY_COPY,
+                                  INDEX_HTML,
+                                  strlen (INDEX_HTML));
+    } else if (g_str_equal (path, "/main.html")) {
+        soup_message_body_append (msg->response_body,
+                                  SOUP_MEMORY_COPY,
+                                  MAIN_HTML,
+                                  strlen (MAIN_HTML));
+    } else if (g_str_equal (path, "/javascript.js")) {
+        soup_message_body_append (msg->response_body,
+                                  SOUP_MEMORY_COPY,
+                                  JAVASCRIPT,
+                                  strlen (JAVASCRIPT));
+    }
+
+
+    soup_message_body_complete (msg->response_body);
+}
+
+static void web_resource_fixture_setup(WebResourceFixture* fixture, gconstpointer data)
+{
+    fixture->webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(fixture->webView);
+    const gchar* webData = "<html></html>";
+    fixture->webResource = webkit_web_resource_new(webData, strlen(webData), "http://example.com/", "text/html", "utf8", "Example.com");
+    g_assert(fixture->webResource);
+}
+
+static void web_resource_fixture_teardown(WebResourceFixture* fixture, gconstpointer data)
+{
+    g_assert(fixture->webResource);
+    g_object_unref(fixture->webResource);
+    g_object_unref(fixture->webView);
+}
+
+static void test_webkit_web_resource_get_url(WebResourceFixture* fixture, gconstpointer data)
+{
+    gchar* url;
+    g_object_get(G_OBJECT(fixture->webResource), "uri", &url, NULL);
+    g_assert_cmpstr(url, ==, "http://example.com/");
+    g_assert_cmpstr(webkit_web_resource_get_uri(fixture->webResource) ,==,"http://example.com/");
+    g_free(url);
+}
+
+static void test_webkit_web_resource_get_data(WebResourceFixture* fixture, gconstpointer data)
+{
+    GString* charData = webkit_web_resource_get_data(fixture->webResource);
+    g_assert_cmpstr(charData->str, ==, "<html></html>");
+}
+
+static void test_webkit_web_resource_get_mime_type(WebResourceFixture* fixture, gconstpointer data)
+{
+    gchar* mime_type;
+    g_object_get(G_OBJECT(fixture->webResource), "mime-type", &mime_type, NULL);
+    g_assert_cmpstr(mime_type, ==, "text/html");
+    g_assert_cmpstr(webkit_web_resource_get_mime_type(fixture->webResource),==,"text/html");
+    g_free(mime_type);
+}
+
+static void test_webkit_web_resource_get_encoding(WebResourceFixture* fixture, gconstpointer data)
+{
+    gchar* text_encoding;
+    g_object_get(G_OBJECT(fixture->webResource), "encoding", &text_encoding, NULL);
+    g_assert_cmpstr(text_encoding, ==, "utf8");
+    g_assert_cmpstr(webkit_web_resource_get_encoding(fixture->webResource),==,"utf8");
+    g_free(text_encoding);
+}
+
+static void test_webkit_web_resource_get_frame_name(WebResourceFixture* fixture, gconstpointer data)
+{
+    gchar* frame_name;
+    g_object_get(G_OBJECT(fixture->webResource), "frame-name", &frame_name, NULL);
+    g_assert_cmpstr(frame_name, ==, "Example.com");
+    g_assert_cmpstr(webkit_web_resource_get_frame_name(fixture->webResource),==,"Example.com");
+    g_free(frame_name);
+}
+
+static void resource_request_starting_cb(WebKitWebView* web_view, WebKitWebFrame* web_frame, WebKitWebResource* web_resource, WebKitNetworkRequest* request, WebKitNetworkResponse* response, gpointer data)
+{
+    gint* been_there = data;
+    *been_there = *been_there + 1;
+
+    if (*been_there == 1) {
+        g_assert(!main_resource);
+        main_resource = g_object_ref(web_resource);
+
+        g_assert_cmpstr(webkit_web_resource_get_uri(web_resource), ==, base_uri);
+
+        /* This should be a redirect, so the response must be NULL */
+        g_assert(!response);
+    } else if (*been_there == 2) {
+        char* uri = g_strdup_printf("%sindex.html", base_uri);
+
+        g_assert_cmpstr(webkit_web_resource_get_uri(web_resource), ==, uri);
+
+        /* Cancel the request. */
+        webkit_network_request_set_uri(request, "about:blank");
+
+        g_free(uri);
+    }
+}
+
+static void load_finished_cb(WebKitWebView* web_view, WebKitWebFrame* web_frame, gpointer data)
+{
+    gboolean* been_there = data;
+    *been_there = TRUE;
+
+    g_assert_cmpstr(webkit_web_view_get_uri(web_view), ==, "about:blank");
+
+    g_main_loop_quit(loop);
+}
+
+static void test_web_resource_loading()
+{
+    WebKitWebView* web_view = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    gint been_to_resource_request_starting = 0;
+    gboolean been_to_load_finished = FALSE;
+    WebKitWebFrame* web_frame;
+    WebKitWebDataSource* data_source;
+
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_object_ref_sink(web_view);
+
+    g_signal_connect(web_view, "resource-request-starting",
+                     G_CALLBACK(resource_request_starting_cb),
+                     &been_to_resource_request_starting);
+
+    g_signal_connect(web_view, "load-finished",
+                     G_CALLBACK(load_finished_cb),
+                     &been_to_load_finished);
+
+    webkit_web_view_load_uri(web_view, base_uri);
+
+    /* We won't get finished immediately, because of the redirect */
+    g_main_loop_run(loop);
+    
+    web_frame = webkit_web_view_get_main_frame(web_view);
+    data_source = webkit_web_frame_get_data_source(web_frame);
+
+    g_assert(main_resource);
+    g_assert(webkit_web_data_source_get_main_resource(data_source) == main_resource);
+    g_object_unref(main_resource);
+    
+    g_assert_cmpint(been_to_resource_request_starting, ==, 2);
+    g_assert_cmpint(been_to_load_finished, ==, TRUE);
+
+    g_object_unref(web_view);
+    g_main_loop_unref(loop);
+}
+
+static void resource_request_starting_sub_cb(WebKitWebView* web_view, WebKitWebFrame* web_frame, WebKitWebResource* web_resource, WebKitNetworkRequest* request, WebKitNetworkResponse* response, gpointer data)
+{
+    if (!main_resource)
+        main_resource = g_object_ref(web_resource);
+    else
+        sub_resource = g_object_ref(web_resource);
+}
+
+static void load_finished_sub_cb(WebKitWebView* web_view, WebKitWebFrame* web_frame, gpointer data)
+{
+    g_main_loop_quit(loop);
+}
+
+static gboolean idle_quit_loop_cb(gpointer data)
+{
+    g_main_loop_quit(loop);
+    return FALSE;
+}
+
+static void test_web_resource_sub_resource_loading()
+{
+    WebKitWebView* web_view = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    WebKitWebFrame* web_frame;
+    WebKitWebDataSource* data_source;
+    GList* sub_resources;
+    char* uri = g_strdup_printf("%smain.html", base_uri);
+
+    main_resource = NULL;
+    
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_object_ref_sink(web_view);
+
+    g_signal_connect(web_view, "resource-request-starting",
+                     G_CALLBACK(resource_request_starting_sub_cb),
+                     NULL);
+
+    g_signal_connect(web_view, "load-finished",
+                     G_CALLBACK(load_finished_sub_cb),
+                     NULL);
+
+    webkit_web_view_load_uri(web_view, uri);
+
+    g_main_loop_run(loop);
+
+    /* The main resource should be loaded; now let's wait for the sub-resource to load */
+    g_idle_add(idle_quit_loop_cb, NULL);
+    g_main_loop_run(loop);
+    
+    g_assert(main_resource && sub_resource);
+    g_assert(main_resource != sub_resource);
+
+    web_frame = webkit_web_view_get_main_frame(web_view);
+    data_source = webkit_web_frame_get_data_source(web_frame);
+
+    g_assert(webkit_web_data_source_get_main_resource(data_source) == main_resource);
+    g_object_unref(main_resource);
+
+    sub_resources = webkit_web_data_source_get_subresources(data_source);
+    g_assert(sub_resources);
+    g_assert(!sub_resources->next);
+
+    g_assert(WEBKIT_WEB_RESOURCE(sub_resources->data) == sub_resource);
+    
+    g_object_unref(web_view);
+    g_main_loop_unref(loop);
+}
+
+int main(int argc, char** argv)
+{
+    SoupServer* server;
+    SoupURI* soup_uri;
+
+    g_thread_init(NULL);
+    gtk_test_init(&argc, &argv, NULL);
+
+    server = soup_server_new(SOUP_SERVER_PORT, 0, NULL);
+    soup_server_run_async(server);
+
+    soup_server_add_handler(server, NULL, server_callback, NULL, NULL);
+
+    soup_uri = soup_uri_new ("http://127.0.0.1/");                             
+    soup_uri_set_port(soup_uri, soup_server_get_port(server));
+
+    base_uri = soup_uri_to_string(soup_uri, FALSE);
+    soup_uri_free(soup_uri);
+
+    g_test_bug_base("https://bugs.webkit.org/");
+    g_test_add("/webkit/webresource/get_url",
+               WebResourceFixture, 0, web_resource_fixture_setup,
+               test_webkit_web_resource_get_url, web_resource_fixture_teardown);
+    g_test_add("/webkit/webresource/get_mime_type",
+               WebResourceFixture, 0, web_resource_fixture_setup,
+               test_webkit_web_resource_get_mime_type, web_resource_fixture_teardown);
+    g_test_add("/webkit/webresource/get_text_encoding_name",
+               WebResourceFixture, 0, web_resource_fixture_setup,
+               test_webkit_web_resource_get_encoding, web_resource_fixture_teardown);
+    g_test_add("/webkit/webresource/get_frame_name",
+               WebResourceFixture, 0, web_resource_fixture_setup,
+               test_webkit_web_resource_get_frame_name, web_resource_fixture_teardown);
+    g_test_add("/webkit/webresource/get_data",
+               WebResourceFixture, 0, web_resource_fixture_setup,
+               test_webkit_web_resource_get_data, web_resource_fixture_teardown);
+
+    g_test_add_func("/webkit/webresource/loading", test_web_resource_loading);
+    g_test_add_func("/webkit/webresource/sub_resource_loading", test_web_resource_sub_resource_loading);
+
+    return g_test_run ();
+}
+
+#else
+int main(int argc, char** argv)
+{
+    g_critical("You will need at least glib-2.16.0 and gtk-2.14.0 to run the unit tests. Doing nothing now.");
+    return 0;
+}
+
+#endif
diff --git a/WebKit/gtk/tests/testwindow.c b/WebKit/gtk/tests/testwindow.c
new file mode 100644
index 0000000..41ff323
--- /dev/null
+++ b/WebKit/gtk/tests/testwindow.c
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2009 Collabora Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include <gtk/gtk.h>
+#include <webkit/webkit.h>
+
+#if GLIB_CHECK_VERSION(2, 16, 0) && GTK_CHECK_VERSION(2, 14, 0)
+
+static void load_finished_cb(WebKitWebView* web_view, WebKitWebFrame* web_frame, gpointer data)
+{
+    GMainLoop* loop = (GMainLoop*)data;
+
+    g_main_loop_quit(loop);
+}
+
+static void test_webkit_window_scrollbar_policy(void)
+{
+    GMainLoop* loop;
+    GtkWidget* scrolledWindow;
+    GtkWidget* webView;
+    WebKitWebFrame* mainFrame;
+    GtkPolicyType horizontalPolicy;
+    GtkPolicyType verticalPolicy;
+
+    loop = g_main_loop_new(NULL, TRUE);
+
+    scrolledWindow = gtk_scrolled_window_new(NULL, NULL);
+    gtk_scrolled_window_set_policy(GTK_SCROLLED_WINDOW(scrolledWindow),
+                                   GTK_POLICY_AUTOMATIC, GTK_POLICY_AUTOMATIC);
+
+    webView = webkit_web_view_new();
+    g_object_ref_sink(webView);
+
+    g_signal_connect(webView, "load-finished",
+                     G_CALLBACK(load_finished_cb), loop);
+
+    gtk_container_add(GTK_CONTAINER(scrolledWindow), webView);
+
+    mainFrame = webkit_web_view_get_main_frame(WEBKIT_WEB_VIEW(webView));
+
+    /* Test we correctly apply policy for not having scrollbars; This
+     * case is special, because we turn the policy from NEVER to
+     * AUTOMATIC, since we cannot easily represent the same thing
+     * using GtkScrolledWindow */
+    webkit_web_view_load_html_string(WEBKIT_WEB_VIEW(webView),
+                                     "<html><body>WebKit!</body><script>document.getElementsByTagName('body')[0].style.overflow = 'hidden';</script></html>",
+                                     "file://");
+
+    g_main_loop_run(loop);
+
+    gtk_scrolled_window_get_policy(GTK_SCROLLED_WINDOW(scrolledWindow),
+                                   &horizontalPolicy, &verticalPolicy);
+
+    g_assert(horizontalPolicy == GTK_POLICY_AUTOMATIC);
+    g_assert(verticalPolicy == GTK_POLICY_AUTOMATIC);
+
+    g_assert(GTK_POLICY_NEVER == webkit_web_frame_get_horizontal_scrollbar_policy(mainFrame));
+    g_assert(GTK_POLICY_NEVER == webkit_web_frame_get_vertical_scrollbar_policy(mainFrame));
+
+    /* Test we correctly apply policy for always having scrollbars */
+    webkit_web_view_load_html_string(WEBKIT_WEB_VIEW(webView),
+                                     "<html><body>WebKit!</body><script>document.getElementsByTagName('body')[0].style.overflow = 'scroll';</script></html>",
+                                     "file://");
+
+    g_main_loop_run(loop);
+
+    gtk_scrolled_window_get_policy(GTK_SCROLLED_WINDOW(scrolledWindow),
+                                   &horizontalPolicy, &verticalPolicy);
+
+    g_assert(horizontalPolicy == GTK_POLICY_ALWAYS);
+    g_assert(verticalPolicy == GTK_POLICY_ALWAYS);
+
+    g_assert(horizontalPolicy == webkit_web_frame_get_horizontal_scrollbar_policy(mainFrame));
+    g_assert(verticalPolicy == webkit_web_frame_get_vertical_scrollbar_policy(mainFrame));
+
+    /* Test we correctly apply policy for having scrollbars when needed */
+    webkit_web_view_load_html_string(WEBKIT_WEB_VIEW(webView),
+                                     "<html><body>WebKit!</body><script>document.getElementsByTagName('body')[0].style.overflow = 'auto';</script></html>",
+                                     "file://");
+
+    g_main_loop_run(loop);
+
+    gtk_scrolled_window_get_policy(GTK_SCROLLED_WINDOW(scrolledWindow),
+                                   &horizontalPolicy, &verticalPolicy);
+
+    g_assert(horizontalPolicy == GTK_POLICY_AUTOMATIC);
+    g_assert(verticalPolicy == GTK_POLICY_AUTOMATIC);
+
+    g_assert(horizontalPolicy == webkit_web_frame_get_horizontal_scrollbar_policy(mainFrame));
+    g_assert(verticalPolicy == webkit_web_frame_get_vertical_scrollbar_policy(mainFrame));
+
+    g_object_unref(webView);
+}
+
+int main(int argc, char** argv)
+{
+    g_thread_init(NULL);
+    gtk_test_init(&argc, &argv, NULL);
+
+    g_test_bug_base("https://bugs.webkit.org/");
+    g_test_add_func("/webkit/window/scrollbar_policy", test_webkit_window_scrollbar_policy);
+    return g_test_run ();
+}
+
+#else
+int main(int argc, char** argv)
+{
+    g_critical("You will need at least glib-2.16.0 and gtk-2.14.0 to run the unit tests. Doing nothing now.");
+    return 0;
+}
+
+#endif
diff --git a/WebKit/gtk/webkit/webkit.h b/WebKit/gtk/webkit/webkit.h
index c22165e..4cd0709 100644
--- a/WebKit/gtk/webkit/webkit.h
+++ b/WebKit/gtk/webkit/webkit.h
@@ -24,8 +24,11 @@
 #include <webkit/webkitversion.h>
 #include <webkit/webkitdefines.h>
 #include <webkit/webkitdownload.h>
+#include <webkit/webkithittestresult.h>
 #include <webkit/webkitnetworkrequest.h>
+#include <webkit/webkitnetworkresponse.h>
 #include <webkit/webkitsoupauthdialog.h>
+#include <webkit/webkitwebdatasource.h>
 #include <webkit/webkitwebframe.h>
 #include <webkit/webkitwebsettings.h>
 #include <webkit/webkitwebinspector.h>
@@ -35,6 +38,9 @@
 #include <webkit/webkitwebhistoryitem.h>
 #include <webkit/webkitwebpolicydecision.h>
 #include <webkit/webkitwebnavigationaction.h>
+#include <webkit/webkitwebresource.h>
+#include <webkit/webkitwebdatabase.h>
+#include <webkit/webkitsecurityorigin.h>
 #include <webkit/webkitenumtypes.h>
 
 #endif /* __WEBKIT_H__ */
diff --git a/WebKit/gtk/webkit/webkitdefines.h b/WebKit/gtk/webkit/webkitdefines.h
index b0ab5e9..a5884f3 100644
--- a/WebKit/gtk/webkit/webkitdefines.h
+++ b/WebKit/gtk/webkit/webkitdefines.h
@@ -18,8 +18,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_DEFINES_H
-#define WEBKIT_DEFINES_H
+#ifndef webkitdefines_h
+#define webkitdefines_h
 
 #include <glib.h>
 
@@ -44,6 +44,9 @@ G_BEGIN_DECLS
 typedef struct _WebKitNetworkRequest WebKitNetworkRequest;
 typedef struct _WebKitNetworkRequestClass WebKitNetworkRequestClass;
 
+typedef struct _WebKitNetworkResponse WebKitNetworkResponse;
+typedef struct _WebKitNetworkResponseClass WebKitNetworkResponseClass;
+
 typedef struct _WebKitWebBackForwardList WebKitWebBackForwardList;
 typedef struct _WebKitWebBackForwardListClass WebKitWebBackForwardListClass;
 
@@ -71,6 +74,21 @@ typedef struct _WebKitWebViewClass WebKitWebViewClass;
 typedef struct _WebKitDownload WebKitDownload;
 typedef struct _WebKitDownloadClass WebKitDownloadClass;
 
+typedef struct _WebKitWebResource WebKitWebResource;
+typedef struct _WebKitWebResourceClass WebKitWebResourceClass;
+
+typedef struct _WebKitWebDataSource WebKitWebDataSource;
+typedef struct _WebKitWebDataSourceClass WebKitWebDataSourceClass;
+
+typedef struct _WebKitWebDatabase WebKitWebDatabase;
+typedef struct _WebKitWebDatabaseClass WebKitWebDatabaseClass;
+
+typedef struct _WebKitSecurityOrigin WebKitSecurityOrigin;
+typedef struct _WebKitSecurityOriginClass WebKitSecurityOriginClass;
+
+typedef struct _WebKitHitTestResult WebKitHitTestResult;
+typedef struct _WebKitHitTestResultClass WebKitHitTestResultClass;
+
 G_END_DECLS
 
 #endif
diff --git a/WebKit/gtk/webkit/webkitdownload.cpp b/WebKit/gtk/webkit/webkitdownload.cpp
index c0c6ea7..568378c 100644
--- a/WebKit/gtk/webkit/webkitdownload.cpp
+++ b/WebKit/gtk/webkit/webkitdownload.cpp
@@ -25,6 +25,7 @@
 #include "Noncopyable.h"
 #include "NotImplemented.h"
 #include "ResourceHandleClient.h"
+#include "ResourceHandleInternal.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "webkitdownload.h"
@@ -100,6 +101,7 @@ enum {
 G_DEFINE_TYPE(WebKitDownload, webkit_download, G_TYPE_OBJECT);
 
 
+static void webkit_download_set_response(WebKitDownload* download, const ResourceResponse& response);
 static void webkit_download_set_status(WebKitDownload* download, WebKitDownloadStatus status);
 
 static void webkit_download_dispose(GObject* object)
@@ -373,6 +375,25 @@ WebKitDownload* webkit_download_new(WebKitNetworkRequest* request)
     return WEBKIT_DOWNLOAD(g_object_new(WEBKIT_TYPE_DOWNLOAD, "network-request", request, NULL));
 }
 
+// Internal usage only
+WebKitDownload* webkit_download_new_with_handle(WebKitNetworkRequest* request, WebCore::ResourceHandle* handle, const WebCore::ResourceResponse& response)
+{
+    g_return_val_if_fail(request, NULL);
+
+    ResourceHandleInternal* d = handle->getInternal();
+    soup_session_pause_message(webkit_get_default_session(), d->m_msg);
+
+    WebKitDownload* download = WEBKIT_DOWNLOAD(g_object_new(WEBKIT_TYPE_DOWNLOAD, "network-request", request, NULL));
+    WebKitDownloadPrivate* priv = download->priv;
+
+    handle->ref();
+    priv->resourceHandle = handle;
+
+    webkit_download_set_response(download, response);
+
+    return download;
+}
+
 static gboolean webkit_download_open_stream_for_uri(WebKitDownload* download, const gchar* uri, gboolean append=FALSE)
 {
     g_return_val_if_fail(uri, FALSE);
@@ -425,10 +446,14 @@ void webkit_download_start(WebKitDownload* download)
     g_return_if_fail(priv->status == WEBKIT_DOWNLOAD_STATUS_CREATED);
     g_return_if_fail(priv->timer == NULL);
 
-    if (priv->resourceHandle)
-        priv->resourceHandle->setClient(priv->downloadClient);
-    else
+    if (!priv->resourceHandle)
         priv->resourceHandle = ResourceHandle::create(core(priv->networkRequest), priv->downloadClient, 0, false, false, false);
+    else {
+        priv->resourceHandle->setClient(priv->downloadClient);
+
+        ResourceHandleInternal* d = priv->resourceHandle->getInternal();
+        soup_session_unpause_message(webkit_get_default_session(), d->m_msg);
+    }
 
     priv->timer = g_timer_new();
     webkit_download_open_stream_for_uri(download, priv->destinationURI);
@@ -510,6 +535,9 @@ static void webkit_download_set_response(WebKitDownload* download, const Resourc
     // FIXME Use WebKitNetworkResponse when it's merged.
     WebKitDownloadPrivate* priv = download->priv;
     priv->networkResponse = new ResourceResponse(response);
+
+    if (!response.isNull() && !response.suggestedFilename().isEmpty())
+        webkit_download_set_suggested_filename(download, response.suggestedFilename().utf8().data());
 }
 
 /**
@@ -544,6 +572,8 @@ void webkit_download_set_suggested_filename(WebKitDownload* download, const gcha
     WebKitDownloadPrivate* priv = download->priv;
     g_free(priv->suggestedFilename);
     priv->suggestedFilename = g_strdup(suggestedFilename);
+
+    g_object_notify(G_OBJECT(download), "suggested-filename");
 }
 
 
diff --git a/WebKit/gtk/webkit/webkitdownload.h b/WebKit/gtk/webkit/webkitdownload.h
index 7c86c65..6e7f38b 100644
--- a/WebKit/gtk/webkit/webkitdownload.h
+++ b/WebKit/gtk/webkit/webkitdownload.h
@@ -18,8 +18,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_DOWNLOAD_H
-#define WEBKIT_DOWNLOAD_H
+#ifndef webkitdownload_h
+#define webkitdownload_h
 
 #include <webkit/webkitdefines.h>
 
diff --git a/WebKit/gtk/webkit/webkiterror.h b/WebKit/gtk/webkit/webkiterror.h
index 512bc7d..8fec949 100644
--- a/WebKit/gtk/webkit/webkiterror.h
+++ b/WebKit/gtk/webkit/webkiterror.h
@@ -17,8 +17,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_ERROR_H
-#define WEBKIT_ERROR_H
+#ifndef webkiterror_h
+#define webkiterror_h
 
 #include <glib.h>
 
diff --git a/WebKit/gtk/webkit/webkithittestresult.cpp b/WebKit/gtk/webkit/webkithittestresult.cpp
new file mode 100644
index 0000000..be97933
--- /dev/null
+++ b/WebKit/gtk/webkit/webkithittestresult.cpp
@@ -0,0 +1,193 @@
+/*
+ * Copyright (C) 2009 Collabora Ltd.
+ * Copyright (C) 2009 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "webkithittestresult.h"
+
+#include "CString.h"
+#include "GOwnPtr.h"
+#include "webkitenumtypes.h"
+#include "webkitprivate.h"
+
+#include <glib/gi18n-lib.h>
+
+/**
+ * SECTION:webkithittestresult
+ * @short_description: The target of a mouse event
+ *
+ * This class holds context information about the coordinates
+ * specified by a GDK event.
+ */
+
+G_DEFINE_TYPE(WebKitHitTestResult, webkit_hit_test_result, G_TYPE_OBJECT)
+
+struct _WebKitHitTestResultPrivate {
+    guint context;
+    char* linkURI;
+    char* imageURI;
+    char* mediaURI;
+};
+
+#define WEBKIT_HIT_TEST_RESULT_GET_PRIVATE(obj) (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_HIT_TEST_RESULT, WebKitHitTestResultPrivate))
+
+enum {
+    PROP_0,
+
+    PROP_CONTEXT,
+    PROP_LINK_URI,
+    PROP_IMAGE_URI,
+    PROP_MEDIA_URI
+};
+
+static void webkit_hit_test_result_finalize(GObject* object)
+{
+    WebKitHitTestResult* web_hit_test_result = WEBKIT_HIT_TEST_RESULT(object);
+    WebKitHitTestResultPrivate* priv = web_hit_test_result->priv;
+
+    g_free(priv->linkURI);
+    g_free(priv->imageURI);
+    g_free(priv->mediaURI);
+
+    G_OBJECT_CLASS(webkit_hit_test_result_parent_class)->finalize(object);
+}
+
+static void webkit_hit_test_result_get_property(GObject* object, guint propertyID, GValue* value, GParamSpec* pspec)
+{
+    WebKitHitTestResult* web_hit_test_result = WEBKIT_HIT_TEST_RESULT(object);
+    WebKitHitTestResultPrivate* priv = web_hit_test_result->priv;
+
+    switch(propertyID) {
+    case PROP_CONTEXT:
+        g_value_set_flags(value, priv->context);
+        break;
+    case PROP_LINK_URI:
+        g_value_set_string(value, priv->linkURI);
+        break;
+    case PROP_IMAGE_URI:
+        g_value_set_string(value, priv->imageURI);
+        break;
+    case PROP_MEDIA_URI:
+        g_value_set_string(value, priv->mediaURI);
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propertyID, pspec);
+    }
+}
+
+static void webkit_hit_test_result_set_property(GObject* object, guint propertyID, const GValue* value, GParamSpec* pspec)
+{
+    WebKitHitTestResult* web_hit_test_result = WEBKIT_HIT_TEST_RESULT(object);
+    WebKitHitTestResultPrivate* priv = web_hit_test_result->priv;
+
+    switch(propertyID) {
+    case PROP_CONTEXT:
+        priv->context = g_value_get_flags(value);
+        break;
+    case PROP_LINK_URI:
+        g_free (priv->linkURI);
+        priv->linkURI = g_value_dup_string(value);
+        break;
+    case PROP_IMAGE_URI:
+        g_free (priv->imageURI);
+        priv->imageURI = g_value_dup_string(value);
+        break;
+    case PROP_MEDIA_URI:
+        g_free (priv->mediaURI);
+        priv->mediaURI = g_value_dup_string(value);
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propertyID, pspec);
+    }
+}
+
+static void webkit_hit_test_result_class_init(WebKitHitTestResultClass* webHitTestResultClass)
+{
+    GObjectClass* objectClass = G_OBJECT_CLASS(webHitTestResultClass);
+
+    objectClass->finalize = webkit_hit_test_result_finalize;
+    objectClass->get_property = webkit_hit_test_result_get_property;
+    objectClass->set_property = webkit_hit_test_result_set_property;
+
+    webkit_init();
+
+    /**
+     * WebKitHitTestResult:context:
+     *
+     * Flags indicating the kind of target that received the event.
+     *
+     * Since: 1.1.15
+     */
+    g_object_class_install_property(objectClass, PROP_CONTEXT,
+                                    g_param_spec_flags("context",
+                                                       _("Context"),
+                                                       _("Flags indicating the kind of target that received the event."),
+                                                       WEBKIT_TYPE_HIT_TEST_RESULT_CONTEXT,
+                                                       WEBKIT_HIT_TEST_RESULT_CONTEXT_DOCUMENT,
+                                                       static_cast<GParamFlags>((WEBKIT_PARAM_READWRITE|G_PARAM_CONSTRUCT_ONLY))));
+
+    /**
+     * WebKitHitTestResult:link-uri:
+     *
+     * The URI to which the target that received the event points, if any.
+     *
+     * Since: 1.1.15
+     */
+    g_object_class_install_property(objectClass, PROP_LINK_URI,
+                                    g_param_spec_string("link-uri",
+                                                        _("Link URI"),
+                                                        _("The URI to which the target that received the event points, if any."),
+                                                        NULL,
+                                                        static_cast<GParamFlags>(WEBKIT_PARAM_READWRITE|G_PARAM_CONSTRUCT_ONLY)));
+
+    /**
+     * WebKitHitTestResult:image-uri:
+     *
+     * The URI of the image that is part of the target that received the event, if any.
+     *
+     * Since: 1.1.15
+     */
+    g_object_class_install_property(objectClass, PROP_IMAGE_URI,
+                                    g_param_spec_string("image-uri",
+                                                        _("Image URI"),
+                                                        _("The URI of the image that is part of the target that received the event, if any."),
+                                                        NULL,
+                                                        static_cast<GParamFlags>(WEBKIT_PARAM_READWRITE|G_PARAM_CONSTRUCT_ONLY)));
+
+    /**
+     * WebKitHitTestResult:media-uri:
+     *
+     * The URI of the media that is part of the target that received the event, if any.
+     *
+     * Since: 1.1.15
+     */
+    g_object_class_install_property(objectClass, PROP_MEDIA_URI,
+                                    g_param_spec_string("media-uri",
+                                                        _("Media URI"),
+                                                        _("The URI of the media that is part of the target that received the event, if any."),
+                                                        NULL,
+                                                        static_cast<GParamFlags>(WEBKIT_PARAM_READWRITE|G_PARAM_CONSTRUCT_ONLY)));
+
+    g_type_class_add_private(webHitTestResultClass, sizeof(WebKitHitTestResultPrivate));
+}
+
+static void webkit_hit_test_result_init(WebKitHitTestResult* web_hit_test_result)
+{
+    web_hit_test_result->priv = WEBKIT_HIT_TEST_RESULT_GET_PRIVATE(web_hit_test_result);
+}
diff --git a/WebKit/gtk/webkit/webkithittestresult.h b/WebKit/gtk/webkit/webkithittestresult.h
new file mode 100644
index 0000000..6caa84e
--- /dev/null
+++ b/WebKit/gtk/webkit/webkithittestresult.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Collabora Ltd.
+ * Copyright (C) 2009 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef webkithittestresult_h
+#define webkithittestresult_h
+
+#include <glib-object.h>
+
+#include <webkit/webkitdefines.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_HIT_TEST_RESULT            (webkit_hit_test_result_get_type())
+#define WEBKIT_HIT_TEST_RESULT(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_HIT_TEST_RESULT, WebKitHitTestResult))
+#define WEBKIT_HIT_TEST_RESULT_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_HIT_TEST_RESULT, WebKitHitTestResultClass))
+#define WEBKIT_IS_HIT_TEST_RESULT(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_HIT_TEST_RESULT))
+#define WEBKIT_IS_HIT_TEST_RESULT_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_HIT_TEST_RESULT))
+#define WEBKIT_HIT_TEST_RESULT_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_WEB_HIT_TEST_RESULT, WebKitHitTestResultClass))
+
+typedef struct _WebKitHitTestResultPrivate WebKitHitTestResultPrivate;
+
+struct _WebKitHitTestResult {
+    GObject parent_instance;
+
+    /*< private >*/
+    WebKitHitTestResultPrivate *priv;
+};
+
+struct _WebKitHitTestResultClass {
+    GObjectClass parent_class;
+
+    /* Padding for future expansion */
+    void (*_webkit_reserved0) (void);
+    void (*_webkit_reserved1) (void);
+    void (*_webkit_reserved2) (void);
+    void (*_webkit_reserved3) (void);
+};
+
+/**
+ * WebKitHitTestResultContext
+ * @WEBKIT_HIT_TEST_RESULT_CONTEXT_DOCUMENT: anywhere in the document.
+ * @WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK: a hyperlink element.
+ * @WEBKIT_HIT_TEST_RESULT_CONTEXT_IMAGE: an image element.
+ * @WEBKIT_HIT_TEST_RESULT_CONTEXT_MEDIA: a video or audio element.
+ * @WEBKIT_HIT_TEST_RESULT_CONTEXT_SELECTION: the area is selected by
+ * the user.
+ * @WEBKIT_HIT_TEST_RESULT_CONTEXT_EDITABLE: the area is
+ * editable by the user.
+ */
+typedef enum
+{
+    WEBKIT_HIT_TEST_RESULT_CONTEXT_DOCUMENT   = 1 << 1,
+    WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK       = 1 << 2,
+    WEBKIT_HIT_TEST_RESULT_CONTEXT_IMAGE      = 1 << 3,
+    WEBKIT_HIT_TEST_RESULT_CONTEXT_MEDIA      = 1 << 4,
+    WEBKIT_HIT_TEST_RESULT_CONTEXT_SELECTION  = 1 << 5,
+    WEBKIT_HIT_TEST_RESULT_CONTEXT_EDITABLE   = 1 << 6,
+} WebKitHitTestResultContext;
+
+WEBKIT_API GType
+webkit_hit_test_result_get_type (void);
+
+G_END_DECLS
+
+#endif
+
diff --git a/WebKit/gtk/webkit/webkitnetworkrequest.cpp b/WebKit/gtk/webkit/webkitnetworkrequest.cpp
index e8a225c..be6d5ff 100644
--- a/WebKit/gtk/webkit/webkitnetworkrequest.cpp
+++ b/WebKit/gtk/webkit/webkitnetworkrequest.cpp
@@ -28,26 +28,17 @@
 
 #include <glib/gi18n-lib.h>
 
-namespace WTF {
-
-template <> void freeOwnedGPtr<SoupMessage>(SoupMessage* soupMessage)
-{
-    if (soupMessage)
-        g_object_unref(soupMessage);
-}
-
-}
-
 /**
  * SECTION:webkitnetworkrequest
  * @short_description: The target of a navigation request
- * @see_also: #WebKitWebView::navigation-requested
+ * @see_also: #WebKitWebView::navigation-policy-decision-requested
  *
  * This class represents the network related aspects of a navigation
- * request. Currently this is only the uri of the target. In the future
- * the state of the web form might be added.
- * Currently this object is only used along with the
- * #WebKitWebView::navigation-requested signal.
+ * request. It is used whenever WebKit wants to provide information
+ * about a request that will be sent, or has been sent. Inside it you
+ * can find the URI of the request, and, for valid URIs, a
+ * #SoupMessage object, which provides access to further information
+ * such as headers.
  *
  */
 
@@ -67,18 +58,26 @@ enum {
     PROP_MESSAGE,
 };
 
-static void webkit_network_request_finalize(GObject* object)
+static void webkit_network_request_dispose(GObject* object)
 {
     WebKitNetworkRequest* request = WEBKIT_NETWORK_REQUEST(object);
     WebKitNetworkRequestPrivate* priv = request->priv;
 
-    g_free(priv->uri);
-
     if (priv->message) {
         g_object_unref(priv->message);
         priv->message = NULL;
     }
 
+    G_OBJECT_CLASS(webkit_network_request_parent_class)->dispose(object);
+}
+
+static void webkit_network_request_finalize(GObject* object)
+{
+    WebKitNetworkRequest* request = WEBKIT_NETWORK_REQUEST(object);
+    WebKitNetworkRequestPrivate* priv = request->priv;
+
+    g_free(priv->uri);
+
     G_OBJECT_CLASS(webkit_network_request_parent_class)->finalize(object);
 }
 
@@ -119,6 +118,7 @@ static void webkit_network_request_class_init(WebKitNetworkRequestClass* request
 {
     GObjectClass* objectClass = G_OBJECT_CLASS(requestClass);
 
+    objectClass->dispose = webkit_network_request_dispose;
     objectClass->finalize = webkit_network_request_finalize;
     objectClass->get_property = webkit_network_request_get_property;
     objectClass->set_property = webkit_network_request_set_property;
@@ -213,10 +213,7 @@ void webkit_network_request_set_uri(WebKitNetworkRequest* request, const gchar*
         return;
 
     SoupURI* soupURI = soup_uri_new(uri);
-    if (!soupURI) {
-        g_warning("Invalid URI: %s", uri);
-        return;
-    }
+    g_return_if_fail(soupURI);
 
     soup_message_set_uri(priv->message, soupURI);
     soup_uri_free(soupURI);
diff --git a/WebKit/gtk/webkit/webkitnetworkrequest.h b/WebKit/gtk/webkit/webkitnetworkrequest.h
index 78e04a1..825ca9e 100644
--- a/WebKit/gtk/webkit/webkitnetworkrequest.h
+++ b/WebKit/gtk/webkit/webkitnetworkrequest.h
@@ -17,8 +17,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_NETWORK_REQUEST_H
-#define WEBKIT_NETWORK_REQUEST_H
+#ifndef webkitnetworkrequest_h
+#define webkitnetworkrequest_h
 
 #include <glib-object.h>
 #include <libsoup/soup.h>
diff --git a/WebKit/gtk/webkit/webkitnetworkresponse.cpp b/WebKit/gtk/webkit/webkitnetworkresponse.cpp
new file mode 100644
index 0000000..33bcd28
--- /dev/null
+++ b/WebKit/gtk/webkit/webkitnetworkresponse.cpp
@@ -0,0 +1,261 @@
+/*
+ * Copyright (C) 2007, 2008 Holger Hans Peter Freyther
+ * Copyright (C) 2009 Gustavo Noronha Silva
+ * Copyright (C) 2009 Collabora Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "webkitnetworkresponse.h"
+
+#include "GOwnPtr.h"
+#include "ResourceResponse.h"
+#include "webkitprivate.h"
+
+#include <glib/gi18n-lib.h>
+
+/**
+ * SECTION:webkitnetworkresponse
+ * @short_description: the response given to a network request
+ * @see_also: #WebKitNetworkRequest
+ *
+ * This class represents the network related aspects of a navigation
+ * response.
+ *
+ * Since: 1.1.14
+ */
+
+G_DEFINE_TYPE(WebKitNetworkResponse, webkit_network_response, G_TYPE_OBJECT);
+
+struct _WebKitNetworkResponsePrivate {
+    gchar* uri;
+    SoupMessage* message;
+};
+
+#define WEBKIT_NETWORK_RESPONSE_GET_PRIVATE(obj) (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_NETWORK_RESPONSE, WebKitNetworkResponsePrivate))
+
+enum {
+    PROP_0,
+
+    PROP_URI,
+    PROP_MESSAGE,
+};
+
+static void webkit_network_response_dispose(GObject* object)
+{
+    WebKitNetworkResponse* response = WEBKIT_NETWORK_RESPONSE(object);
+    WebKitNetworkResponsePrivate* priv = response->priv;
+
+    if (priv->message) {
+        g_object_unref(priv->message);
+        priv->message = NULL;
+    }
+
+    G_OBJECT_CLASS(webkit_network_response_parent_class)->dispose(object);
+}
+
+static void webkit_network_response_finalize(GObject* object)
+{
+    WebKitNetworkResponse* response = WEBKIT_NETWORK_RESPONSE(object);
+    WebKitNetworkResponsePrivate* priv = response->priv;
+
+    g_free(priv->uri);
+
+    G_OBJECT_CLASS(webkit_network_response_parent_class)->finalize(object);
+}
+
+static void webkit_network_response_get_property(GObject* object, guint propertyID, GValue* value, GParamSpec* pspec)
+{
+    WebKitNetworkResponse* response = WEBKIT_NETWORK_RESPONSE(object);
+
+    switch(propertyID) {
+    case PROP_URI:
+        g_value_set_string(value, webkit_network_response_get_uri(response));
+        break;
+    case PROP_MESSAGE:
+        g_value_set_object(value, webkit_network_response_get_message(response));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propertyID, pspec);
+    }
+}
+
+static void webkit_network_response_set_property(GObject* object, guint propertyID, const GValue* value, GParamSpec* pspec)
+{
+    WebKitNetworkResponse* response = WEBKIT_NETWORK_RESPONSE(object);
+    WebKitNetworkResponsePrivate* priv = response->priv;
+
+    switch(propertyID) {
+    case PROP_URI:
+        webkit_network_response_set_uri(response, g_value_get_string(value));
+        break;
+    case PROP_MESSAGE:
+        priv->message = SOUP_MESSAGE(g_value_dup_object(value));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propertyID, pspec);
+    }
+}
+
+static void webkit_network_response_class_init(WebKitNetworkResponseClass* responseClass)
+{
+    GObjectClass* objectClass = G_OBJECT_CLASS(responseClass);
+
+    objectClass->dispose = webkit_network_response_dispose;
+    objectClass->finalize = webkit_network_response_finalize;
+    objectClass->get_property = webkit_network_response_get_property;
+    objectClass->set_property = webkit_network_response_set_property;
+
+    webkit_init();
+
+    /**
+     * WebKitNetworkResponse:uri:
+     *
+     * The URI to which the response will be made.
+     *
+     * Since: 1.1.14
+     */
+    g_object_class_install_property(objectClass, PROP_URI,
+                                    g_param_spec_string("uri",
+                                                        _("URI"),
+                                                        _("The URI to which the response will be made."),
+                                                        NULL,
+                                                        (GParamFlags)(WEBKIT_PARAM_READWRITE)));
+
+    /**
+     * WebKitNetworkResponse:message:
+     *
+     * The #SoupMessage that backs the response.
+     *
+     * Since: 1.1.14
+     */
+    g_object_class_install_property(objectClass, PROP_MESSAGE,
+                                    g_param_spec_object("message",
+                                                        _("Message"),
+                                                        _("The SoupMessage that backs the response."),
+                                                        SOUP_TYPE_MESSAGE,
+                                                        (GParamFlags)(WEBKIT_PARAM_READWRITE|G_PARAM_CONSTRUCT_ONLY)));
+
+    g_type_class_add_private(responseClass, sizeof(WebKitNetworkResponsePrivate));
+}
+
+static void webkit_network_response_init(WebKitNetworkResponse* response)
+{
+    response->priv = WEBKIT_NETWORK_RESPONSE_GET_PRIVATE(response);
+}
+
+// for internal use only
+WebKitNetworkResponse* webkit_network_response_new_with_core_response(const WebCore::ResourceResponse& resourceResponse)
+{
+    GOwnPtr<SoupMessage> soupMessage(resourceResponse.toSoupMessage());
+    if (soupMessage)
+        return WEBKIT_NETWORK_RESPONSE(g_object_new(WEBKIT_TYPE_NETWORK_RESPONSE, "message", soupMessage.get(), NULL));
+
+    return WEBKIT_NETWORK_RESPONSE(g_object_new(WEBKIT_TYPE_NETWORK_RESPONSE, "uri", resourceResponse.url().string().utf8().data(), NULL));
+}
+
+/**
+ * webkit_network_response_new:
+ * @uri: an URI
+ *
+ * Creates a new #WebKitNetworkResponse initialized with an URI.
+ *
+ * Returns: a new #WebKitNetworkResponse, or %NULL if the URI is
+ * invalid.
+ *
+ * Since: 1.1.14
+ */
+WebKitNetworkResponse* webkit_network_response_new(const gchar* uri)
+{
+    g_return_val_if_fail(uri, NULL);
+
+    return WEBKIT_NETWORK_RESPONSE(g_object_new(WEBKIT_TYPE_NETWORK_RESPONSE, "uri", uri, NULL));
+}
+
+/**
+ * webkit_network_response_set_uri:
+ * @response: a #WebKitNetworkResponse
+ * @uri: an URI
+ *
+ * Sets the URI held and used by the given response. When the response
+ * has an associated #SoupMessage, its URI will also be set by this
+ * call.
+ *
+ * Since: 1.1.14
+ */
+void webkit_network_response_set_uri(WebKitNetworkResponse* response, const gchar* uri)
+{
+    g_return_if_fail(WEBKIT_IS_NETWORK_RESPONSE(response));
+    g_return_if_fail(uri);
+
+    WebKitNetworkResponsePrivate* priv = response->priv;
+
+    if (priv->uri)
+        g_free(priv->uri);
+    priv->uri = g_strdup(uri);
+
+    if (!priv->message)
+        return;
+
+    SoupURI* soupURI = soup_uri_new(uri);
+    g_return_if_fail(soupURI);
+
+    soup_message_set_uri(priv->message, soupURI);
+    soup_uri_free(soupURI);
+}
+
+/**
+ * webkit_network_response_get_uri:
+ * @response: a #WebKitNetworkResponse
+ *
+ * Returns: the uri of the #WebKitNetworkResponse
+ *
+ * Since: 1.1.14
+ */
+G_CONST_RETURN gchar* webkit_network_response_get_uri(WebKitNetworkResponse* response)
+{
+    g_return_val_if_fail(WEBKIT_IS_NETWORK_RESPONSE(response), NULL);
+
+    WebKitNetworkResponsePrivate* priv = response->priv;
+
+    if (priv->uri)
+        return priv->uri;
+
+    SoupURI* soupURI = soup_message_get_uri(priv->message);
+    priv->uri = soup_uri_to_string(soupURI, FALSE);
+    return priv->uri;
+}
+
+/**
+ * webkit_network_response_get_soup_message:
+ * @response: a #WebKitNetworkResponse
+ *
+ * Obtains the #SoupMessage that represents the given response. Notice
+ * that only the response side of the HTTP conversation is
+ * represented.
+ *
+ * Returns: the #SoupMessage
+ * Since: 1.1.14
+ */
+SoupMessage* webkit_network_response_get_message(WebKitNetworkResponse* response)
+{
+    g_return_val_if_fail(WEBKIT_IS_NETWORK_RESPONSE(response), NULL);
+
+    WebKitNetworkResponsePrivate* priv = response->priv;
+
+    return priv->message;
+}
diff --git a/WebKit/gtk/webkit/webkitnetworkresponse.h b/WebKit/gtk/webkit/webkitnetworkresponse.h
new file mode 100644
index 0000000..a00308d
--- /dev/null
+++ b/WebKit/gtk/webkit/webkitnetworkresponse.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Collabora Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef webkitnewtorkresponse_h
+#define webkitnewtorkresponse_h
+
+#include <glib-object.h>
+#include <libsoup/soup.h>
+
+#include <webkit/webkitdefines.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_NETWORK_RESPONSE            (webkit_network_response_get_type())
+#define WEBKIT_NETWORK_RESPONSE(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_NETWORK_RESPONSE, WebKitNetworkResponse))
+#define WEBKIT_NETWORK_RESPONSE_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_NETWORK_RESPONSE, WebKitNetworkResponseClass))
+#define WEBKIT_IS_NETWORK_RESPONSE(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_NETWORK_RESPONSE))
+#define WEBKIT_IS_NETWORK_RESPONSE_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_NETWORK_RESPONSE))
+#define WEBKIT_NETWORK_RESPONSE_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_NETWORK_RESPONSE, WebKitNetworkResponseClass))
+
+typedef struct _WebKitNetworkResponsePrivate WebKitNetworkResponsePrivate;
+
+struct _WebKitNetworkResponse {
+    GObject parent_instance;
+
+    /*< private >*/
+    WebKitNetworkResponsePrivate *priv;
+};
+
+struct _WebKitNetworkResponseClass {
+    GObjectClass parent_class;
+
+    /* Padding for future expansion */
+    void (*_webkit_reserved0) (void);
+    void (*_webkit_reserved1) (void);
+    void (*_webkit_reserved2) (void);
+    void (*_webkit_reserved3) (void);
+};
+
+WEBKIT_API GType
+webkit_network_response_get_type (void);
+
+WEBKIT_API WebKitNetworkResponse *
+webkit_network_response_new      (const gchar          *uri);
+
+WEBKIT_API void
+webkit_network_response_set_uri  (WebKitNetworkResponse *response,
+                                  const gchar*          uri);
+
+WEBKIT_API G_CONST_RETURN gchar *
+webkit_network_response_get_uri  (WebKitNetworkResponse *response);
+
+WEBKIT_API SoupMessage *
+webkit_network_response_get_message(WebKitNetworkResponse* response);
+
+G_END_DECLS
+
+#endif
diff --git a/WebKit/gtk/webkit/webkitprivate.cpp b/WebKit/gtk/webkit/webkitprivate.cpp
index 755b4d3..4425dcd 100644
--- a/WebKit/gtk/webkit/webkitprivate.cpp
+++ b/WebKit/gtk/webkit/webkitprivate.cpp
@@ -27,6 +27,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClientGtk.h"
+#include "HitTestResult.h"
 #include <libintl.h>
 #include "Logging.h"
 #include "PageCache.h"
@@ -37,6 +38,7 @@
 #include "ResourceHandleClient.h"
 #include "ResourceHandleInternal.h"
 #include <runtime/InitializeThreading.h>
+#include "SecurityOrigin.h"
 
 #if ENABLE(DATABASE)
 #include "DatabaseTracker.h"
@@ -97,7 +99,7 @@ WebKitWebNavigationReason kit(WebCore::NavigationType type)
 
 WebCore::NavigationType core(WebKitWebNavigationReason type)
 {
-    return (WebCore::NavigationType)type;
+    return static_cast<WebCore::NavigationType>(type);
 }
 
 WebCore::ResourceRequest core(WebKitNetworkRequest* request)
@@ -110,8 +112,77 @@ WebCore::ResourceRequest core(WebKitNetworkRequest* request)
     return ResourceRequest(url);
 }
 
+WebCore::EditingBehavior core(WebKitEditingBehavior type)
+{
+    return (WebCore::EditingBehavior)type;
+}
+
+WebKitHitTestResult* kit(const WebCore::HitTestResult& result)
+{
+    guint context = WEBKIT_HIT_TEST_RESULT_CONTEXT_DOCUMENT;
+    GOwnPtr<char> linkURI(0);
+    GOwnPtr<char> imageURI(0);
+    GOwnPtr<char> mediaURI(0);
+
+    if (!result.absoluteLinkURL().isEmpty()) {
+        context |= WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK;
+        linkURI.set(g_strdup(result.absoluteLinkURL().string().utf8().data()));
+    }
+
+    if (!result.absoluteImageURL().isEmpty()) {
+        context |= WEBKIT_HIT_TEST_RESULT_CONTEXT_IMAGE;
+        imageURI.set(g_strdup(result.absoluteImageURL().string().utf8().data()));
+    }
+
+    if (!result.absoluteMediaURL().isEmpty()) {
+        context |= WEBKIT_HIT_TEST_RESULT_CONTEXT_MEDIA;
+        mediaURI.set(g_strdup(result.absoluteMediaURL().string().utf8().data()));
+    }
+
+    if (result.isSelected())
+        context |= WEBKIT_HIT_TEST_RESULT_CONTEXT_SELECTION;
+
+    if (result.isContentEditable())
+        context |= WEBKIT_HIT_TEST_RESULT_CONTEXT_EDITABLE;
+
+    return WEBKIT_HIT_TEST_RESULT(g_object_new(WEBKIT_TYPE_HIT_TEST_RESULT,
+                                           "link-uri", linkURI.get(),
+                                           "image-uri", imageURI.get(),
+                                           "media-uri", mediaURI.get(),
+                                           "context", context,
+                                           NULL));
+}
+
 } /** end namespace WebKit */
 
+namespace WTF {
+
+template <> void freeOwnedGPtr<SoupMessage>(SoupMessage* soupMessage)
+{
+    if (soupMessage)
+        g_object_unref(soupMessage);
+}
+
+template <> void freeOwnedGPtr<WebKitNetworkRequest>(WebKitNetworkRequest* request)
+{
+    if (request)
+        g_object_unref(request);
+}
+
+template <> void freeOwnedGPtr<WebKitNetworkResponse>(WebKitNetworkResponse* response)
+{
+    if (response)
+        g_object_unref(response);
+}
+
+template <> void freeOwnedGPtr<WebKitWebResource>(WebKitWebResource* resource)
+{
+    if (resource)
+        g_object_unref(resource);
+}
+
+}
+
 static GtkWidget* currentToplevelCallback(WebKitSoupAuthDialog* feature, SoupMessage* message, gpointer userData)
 {
     gpointer messageData = g_object_get_data(G_OBJECT(message), "resourceHandle");
@@ -130,7 +201,7 @@ static GtkWidget* currentToplevelCallback(WebKitSoupAuthDialog* feature, SoupMes
     if (!frame)
         return NULL;
 
-    GtkWidget* toplevel =  gtk_widget_get_toplevel(GTK_WIDGET(frame->page()->chrome()->platformWindow()));
+    GtkWidget* toplevel =  gtk_widget_get_toplevel(GTK_WIDGET(frame->page()->chrome()->platformPageClient()));
     if (GTK_WIDGET_TOPLEVEL(toplevel))
         return toplevel;
     else
@@ -156,9 +227,10 @@ void webkit_init()
     WebCore::pageCache()->setCapacity(3);
 
 #if ENABLE(DATABASE)
-    // FIXME: It should be possible for client applications to override this default location
     gchar* databaseDirectory = g_build_filename(g_get_user_data_dir(), "webkit", "databases", NULL);
-    WebCore::DatabaseTracker::tracker().setDatabaseDirectoryPath(databaseDirectory);
+    webkit_set_web_database_directory_path(databaseDirectory);
+
+    // FIXME: It should be possible for client applications to override the default appcache location
     WebCore::cacheStorage().setCacheDirectory(databaseDirectory);
     g_free(databaseDirectory);
 #endif
@@ -178,3 +250,13 @@ void webkit_init()
     soup_session_add_feature(session, sniffer);
     g_object_unref(sniffer);
 }
+
+void webkit_white_list_access_from_origin(const gchar* sourceOrigin, const gchar* destinationProtocol, const gchar* destinationHost, bool allowDestinationSubdomains)
+{
+    SecurityOrigin::whiteListAccessFromOrigin(*SecurityOrigin::createFromString(sourceOrigin), destinationProtocol, destinationHost, allowDestinationSubdomains);
+}
+
+void webkit_reset_origin_access_white_lists()
+{
+    SecurityOrigin::resetOriginAccessWhiteLists();
+}
diff --git a/WebKit/gtk/webkit/webkitprivate.h b/WebKit/gtk/webkit/webkitprivate.h
index 0c3fbd3..44dac04 100644
--- a/WebKit/gtk/webkit/webkitprivate.h
+++ b/WebKit/gtk/webkit/webkitprivate.h
@@ -19,8 +19,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_PRIVATE_H
-#define WEBKIT_PRIVATE_H
+#ifndef webkitprivate_h
+#define webkitprivate_h
 
 /*
  * This file knows the shared secret of WebKitWebView, WebKitWebFrame,
@@ -30,18 +30,25 @@
 
 #include <webkit/webkitdefines.h>
 #include <webkit/webkitdownload.h>
+#include <webkit/webkithittestresult.h>
 #include <webkit/webkitnetworkrequest.h>
 #include <webkit/webkitwebview.h>
+#include <webkit/webkitwebdatasource.h>
 #include <webkit/webkitwebframe.h>
 #include <webkit/webkitwebpolicydecision.h>
 #include <webkit/webkitwebnavigationaction.h>
+#include <webkit/webkitwebresource.h>
 #include <webkit/webkitwebsettings.h>
 #include <webkit/webkitwebwindowfeatures.h>
 #include <webkit/webkitwebbackforwardlist.h>
 #include <webkit/webkitnetworkrequest.h>
+#include <webkit/webkitsecurityorigin.h>
 
+#include "ArchiveResource.h"
 #include "BackForwardList.h"
+#include "CString.h"
 #include <enchant.h>
+#include "GOwnPtr.h"
 #include "HistoryItem.h"
 #include "Settings.h"
 #include "Page.h"
@@ -52,6 +59,7 @@
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "WindowFeatures.h"
+#include "SecurityOrigin.h"
 
 #include <atk/atk.h>
 #include <glib.h>
@@ -60,6 +68,9 @@
 class DownloadClient;
 
 namespace WebKit {
+
+    class DocumentLoader;
+
     WebKitWebView* getViewFromFrame(WebKitWebFrame*);
 
     WebCore::Frame* core(WebKitWebFrame*);
@@ -77,6 +88,15 @@ namespace WebKit {
     WebCore::NavigationType core(WebKitWebNavigationReason reason);
 
     WebCore::ResourceRequest core(WebKitNetworkRequest* request);
+
+    WebCore::ResourceResponse core(WebKitNetworkResponse* response);
+
+    WebCore::EditingBehavior core(WebKitEditingBehavior type);
+
+    WebKitSecurityOrigin* kit(WebCore::SecurityOrigin*);
+    WebCore::SecurityOrigin* core(WebKitSecurityOrigin*);
+
+    WebKitHitTestResult* kit(const WebCore::HitTestResult&);
 }
 
 typedef struct {
@@ -101,6 +121,7 @@ extern "C" {
         WebKitWebFrame* mainFrame;
         WebKitWebBackForwardList* backForwardList;
 
+        GtkMenu* currentMenu;
         gint lastPopupXPosition;
         gint lastPopupYPosition;
 
@@ -123,6 +144,12 @@ extern "C" {
 
         gboolean disposing;
         gboolean usePrimaryForPaste;
+
+        // These are hosted here because the DataSource object is
+        // created too late in the frame loading process.
+        WebKitWebResource* mainResource;
+        char* mainResourceIdentifier;
+        GHashTable* subResources;
     };
 
     #define WEBKIT_WEB_FRAME_GET_PRIVATE(obj)    (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_FRAME, WebKitWebFramePrivate))
@@ -135,6 +162,17 @@ extern "C" {
         gchar* title;
         gchar* uri;
         WebKitLoadStatus loadStatus;
+        WebKitSecurityOrigin* origin;
+    };
+
+#define WEBKIT_SECURITY_ORIGIN_GET_PRIVATE(obj) (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_SECURITY_ORIGIN, WebKitSecurityOriginPrivate))
+    struct _WebKitSecurityOriginPrivate {
+        RefPtr<WebCore::SecurityOrigin> coreOrigin;
+        gchar* protocol;
+        gchar* host;
+        GHashTable* webDatabases;
+
+        gboolean disposed;
     };
 
     PassRefPtr<WebCore::Frame>
@@ -157,6 +195,26 @@ extern "C" {
     webkit_web_history_item_get_children(WebKitWebHistoryItem*);
     // end WebKitWebHistoryItem private
 
+    // WebKitWebResource private
+    #define WEBKIT_WEB_RESOURCE_GET_PRIVATE(obj)        (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_RESOURCE, WebKitWebResourcePrivate))
+    struct _WebKitWebResourcePrivate {
+        WebCore::ArchiveResource* resource;
+
+        gchar* uri;
+        gchar* mimeType;
+        gchar* textEncoding;
+        gchar* frameName;
+
+        GString* data;
+    };
+    WebKitWebResource*
+    webkit_web_resource_new_with_core_resource(PassRefPtr<WebCore::ArchiveResource>);
+
+    void
+    webkit_web_resource_init_with_core_resource(WebKitWebResource*, PassRefPtr<WebCore::ArchiveResource>);
+
+    // end WebKitWebResource private
+
     void
     webkit_web_inspector_set_inspector_client(WebKitWebInspector*, WebCore::Page*);
 
@@ -173,7 +231,25 @@ extern "C" {
     webkit_web_view_notify_ready (WebKitWebView* web_view);
 
     void
-    webkit_web_view_request_download(WebKitWebView* web_view, WebKitNetworkRequest* request, const WebCore::ResourceResponse& response = WebCore::ResourceResponse());
+    webkit_web_view_request_download(WebKitWebView* web_view, WebKitNetworkRequest* request, const WebCore::ResourceResponse& response = WebCore::ResourceResponse(), WebCore::ResourceHandle* handle = 0);
+
+    void
+    webkit_web_view_add_resource(WebKitWebView*, char*, WebKitWebResource*);
+
+    WebKitWebResource*
+    webkit_web_view_get_resource(WebKitWebView*, char*);
+
+    WebKitWebResource*
+    webkit_web_view_get_main_resource(WebKitWebView*);
+
+    void
+    webkit_web_view_clear_resources(WebKitWebView*);
+
+    GList*
+    webkit_web_view_get_subresources(WebKitWebView*);
+
+    WebKitDownload*
+    webkit_download_new_with_handle(WebKitNetworkRequest* request, WebCore::ResourceHandle* handle, const WebCore::ResourceResponse& response);
 
     void
     webkit_download_set_suggested_filename(WebKitDownload* download, const gchar* suggestedFilename);
@@ -187,6 +263,9 @@ extern "C" {
     WebKitNetworkRequest*
     webkit_network_request_new_with_core_request(const WebCore::ResourceRequest& resourceRequest);
 
+    WebKitNetworkResponse*
+    webkit_network_response_new_with_core_response(const WebCore::ResourceResponse& resourceResponse);
+
     // FIXME: move this to webkitnetworkrequest.h once the API is agreed upon.
     WEBKIT_API SoupMessage*
     webkit_network_request_get_message(WebKitNetworkRequest* request);
@@ -206,6 +285,9 @@ extern "C" {
     WEBKIT_API gchar*
     webkit_web_frame_dump_render_tree (WebKitWebFrame* frame);
 
+    WEBKIT_API guint
+    webkit_web_frame_get_pending_unload_event_count(WebKitWebFrame* frame);
+
     WEBKIT_API bool
     webkit_web_frame_pause_animation(WebKitWebFrame* frame, const gchar* name, double time, const gchar* element);
 
@@ -250,6 +332,32 @@ extern "C" {
 
     WEBKIT_API void
     webkit_application_cache_set_maximum_size(unsigned long long size);
+
+    WEBKIT_API unsigned int
+    webkit_worker_thread_count();
+    
+    WEBKIT_API void
+    webkit_white_list_access_from_origin(const gchar* sourceOrigin, const gchar* destinationProtocol, const gchar* destinationHost, bool allowDestinationSubdomains);
+    
+    WEBKIT_API void
+    webkit_reset_origin_access_white_lists();
+
+    // WebKitWebDataSource private
+    WebKitWebDataSource*
+    webkit_web_data_source_new_with_loader(PassRefPtr<WebKit::DocumentLoader>);
+
+    WEBKIT_API WebKitWebDatabase *
+    webkit_security_origin_get_web_database(WebKitSecurityOrigin* securityOrigin, const char* databaseName);
+
+    WEBKIT_API void
+    webkit_web_frame_layout(WebKitWebFrame* frame);
+}
+
+namespace WTF {
+    template <> void freeOwnedGPtr<SoupMessage>(SoupMessage*);
+    template <> void freeOwnedGPtr<WebKitNetworkRequest>(WebKitNetworkRequest*);
+    template <> void freeOwnedGPtr<WebKitNetworkResponse>(WebKitNetworkResponse*);
+    template <> void freeOwnedGPtr<WebKitWebResource>(WebKitWebResource*);
 }
 
 #endif
diff --git a/WebKit/gtk/webkit/webkitsecurityorigin.cpp b/WebKit/gtk/webkit/webkitsecurityorigin.cpp
new file mode 100644
index 0000000..cd80236
--- /dev/null
+++ b/WebKit/gtk/webkit/webkitsecurityorigin.cpp
@@ -0,0 +1,423 @@
+/*
+ * Copyright (C) 2009 Martin Robinson, Jan Michael C. Alonzo
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "webkitwebdatabase.h"
+
+#include "webkitprivate.h"
+
+#include "CString.h"
+#include "PlatformString.h"
+#include "DatabaseTracker.h"
+
+#include <glib/gi18n-lib.h>
+
+/**
+ * SECTION:webkitsecurityorigin
+ * @short_description: A security boundary for web sites
+ *
+ * #WebKitSecurityOrigin is a representation of a security domain defined
+ * by web sites. An origin consists of a host name, a protocol, and a port
+ * number. Web sites with the same security origin can access each other's
+ * resources for client-side scripting or database access.
+ * 
+ * Use #webkit_web_frame_get_security_origin to get the security origin of a
+ * #WebKitWebFrame.
+ *
+ * Database quotas and usages are also defined per security origin. The
+ * cumulative disk usage of an origin's databases may be retrieved with
+ * #webkit_security_origin_get_web_database_usage. An origin's quota can be
+ * adjusted with #webkit_security_origin_set_web_database_quota.
+ */
+
+using namespace WebKit;
+
+enum {
+    PROP_0,
+
+    PROP_PROTOCOL,
+    PROP_HOST,
+    PROP_PORT,
+    PROP_DATABASE_USAGE,
+    PROP_DATABASE_QUOTA
+};
+
+G_DEFINE_TYPE(WebKitSecurityOrigin, webkit_security_origin, G_TYPE_OBJECT)
+
+static void webkit_security_origin_finalize(GObject* object)
+{
+    WebKitSecurityOrigin* securityOrigin = WEBKIT_SECURITY_ORIGIN(object);
+    WebKitSecurityOriginPrivate* priv = securityOrigin->priv;
+
+    g_free(priv->protocol);
+    g_free(priv->host);
+
+    G_OBJECT_CLASS(webkit_security_origin_parent_class)->finalize(object);
+}
+
+static void webkit_security_origin_dispose(GObject* object)
+{
+    WebKitSecurityOrigin* securityOrigin = WEBKIT_SECURITY_ORIGIN(object);
+    WebKitSecurityOriginPrivate* priv = securityOrigin->priv;
+
+    if (!priv->disposed) {
+        priv->coreOrigin->deref();
+        g_hash_table_destroy(priv->webDatabases);
+        priv->disposed = true;
+    }
+
+    G_OBJECT_CLASS(webkit_security_origin_parent_class)->dispose(object);
+}
+
+static void webkit_security_origin_set_property(GObject* object, guint propId, const GValue* value, GParamSpec* pspec)
+{
+    WebKitSecurityOrigin* securityOrigin = WEBKIT_SECURITY_ORIGIN(object);
+
+    switch (propId) {
+    case PROP_DATABASE_QUOTA:
+        webkit_security_origin_set_web_database_quota(securityOrigin, g_value_get_uint64(value));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, pspec);
+        break;
+    }
+}
+
+static void webkit_security_origin_get_property(GObject* object, guint propId, GValue* value, GParamSpec* pspec)
+{
+    WebKitSecurityOrigin* securityOrigin = WEBKIT_SECURITY_ORIGIN(object);
+
+    switch (propId) {
+    case PROP_PROTOCOL:
+        g_value_set_string(value, webkit_security_origin_get_protocol(securityOrigin));
+        break;
+    case PROP_HOST:
+        g_value_set_string(value, webkit_security_origin_get_host(securityOrigin));
+        break;
+    case PROP_PORT:
+        g_value_set_uint(value, webkit_security_origin_get_port(securityOrigin));
+        break;
+    case PROP_DATABASE_USAGE:
+        g_value_set_uint64(value, webkit_security_origin_get_web_database_usage(securityOrigin));
+        break;
+    case PROP_DATABASE_QUOTA:
+        g_value_set_uint64(value, webkit_security_origin_get_web_database_quota(securityOrigin));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, pspec);
+        break;
+    }
+}
+
+static GHashTable* webkit_security_origins()
+{
+    static GHashTable* securityOrigins = g_hash_table_new_full(g_direct_hash, g_direct_equal, NULL, g_object_unref);
+    return securityOrigins;
+}
+
+static void webkit_security_origin_class_init(WebKitSecurityOriginClass* klass)
+{
+    GObjectClass* gobjectClass = G_OBJECT_CLASS(klass);
+    gobjectClass->dispose = webkit_security_origin_dispose;
+    gobjectClass->finalize = webkit_security_origin_finalize;
+    gobjectClass->set_property = webkit_security_origin_set_property;
+    gobjectClass->get_property = webkit_security_origin_get_property;
+
+     /**
+      * WebKitSecurityOrigin:protocol:
+      *
+      * The protocol of the security origin.
+      *
+      * Since: 1.1.14
+      */
+     g_object_class_install_property(gobjectClass, PROP_PROTOCOL,
+                                     g_param_spec_string("protocol",
+                                                         _("Protocol"),
+                                                         _("The protocol of the security origin"),
+                                                         NULL,
+                                                         WEBKIT_PARAM_READABLE));
+
+     /**
+      * WebKitSecurityOrigin:host:
+      *
+      * The host of the security origin.
+      *
+      * Since: 1.1.14
+      */
+     g_object_class_install_property(gobjectClass, PROP_HOST,
+                                     g_param_spec_string("host",
+                                                         _("Host"),
+                                                         _("The host of the security origin"),
+                                                         NULL,
+                                                         WEBKIT_PARAM_READABLE));
+
+     /**
+      * WebKitSecurityOrigin:port:
+      *
+      * The port of the security origin.
+      *
+      * Since: 1.1.14
+      */
+     g_object_class_install_property(gobjectClass, PROP_PORT,
+                                     g_param_spec_uint("port",
+                                                       _("Port"),
+                                                       _("The port of the security origin"),
+                                                       0, G_MAXUSHORT, 0,
+                                                       WEBKIT_PARAM_READABLE));
+
+      /**
+      * WebKitSecurityOrigin:web-database-usage:
+      *
+      * The cumulative size of all web databases in the security origin in bytes.
+      *
+      * Since: 1.1.14
+      */
+      g_object_class_install_property(gobjectClass, PROP_DATABASE_USAGE,
+                                      g_param_spec_uint64("web-database-usage",
+                                                          _("Web Database Usage"),
+                                                          _("The cumulative size of all web databases in the security origin"),
+                                                          0, G_MAXUINT64, 0,
+                                                          WEBKIT_PARAM_READABLE));
+      /**
+      * WebKitSecurityOrigin:web-database-quota:
+      *
+      * The web database qouta of the security origin in bytes.
+      *
+      * Since: 1.1.14
+      */
+      g_object_class_install_property(gobjectClass, PROP_DATABASE_QUOTA,
+                                      g_param_spec_uint64("web-database-quota",
+                                                          _("Web Database Quota"),
+                                                          _("The web database quota of the security origin in bytes"),
+                                                          0, G_MAXUINT64, 0,
+                                                          WEBKIT_PARAM_READWRITE));
+
+    g_type_class_add_private(klass, sizeof(WebKitSecurityOriginPrivate));
+}
+
+static void webkit_security_origin_init(WebKitSecurityOrigin* securityOrigin)
+{
+    WebKitSecurityOriginPrivate* priv = WEBKIT_SECURITY_ORIGIN_GET_PRIVATE(securityOrigin);
+    priv->webDatabases = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, g_object_unref);
+    securityOrigin->priv = priv;
+}
+
+/**
+ * webkit_security_origin_get_protocol:
+ * @security_origin: a #WebKitSecurityOrigin
+ *
+ * Returns the protocol for the security origin.
+ *
+ * Returns: the protocol for the security origin
+ *
+ * Since: 1.1.14
+ **/
+G_CONST_RETURN gchar* webkit_security_origin_get_protocol(WebKitSecurityOrigin* securityOrigin)
+{
+    g_return_val_if_fail(WEBKIT_IS_SECURITY_ORIGIN(securityOrigin), NULL);
+
+    WebKitSecurityOriginPrivate* priv = securityOrigin->priv;
+    WebCore::String protocol =  priv->coreOrigin->protocol();
+
+    if (!priv->protocol)
+        priv->protocol = g_strdup(protocol.utf8().data());
+
+    return priv->protocol;
+}
+
+/**
+ * webkit_security_origin_get_host:
+ * @security_origin: a #WebKitSecurityOrigin
+ *
+ * Returns the hostname for the security origin.
+ *
+ * Returns: the hostname for the security origin
+ *
+ * Since: 1.1.14
+ **/
+G_CONST_RETURN gchar* webkit_security_origin_get_host(WebKitSecurityOrigin* securityOrigin)
+{
+    g_return_val_if_fail(WEBKIT_IS_SECURITY_ORIGIN(securityOrigin), NULL);
+
+    WebKitSecurityOriginPrivate* priv = securityOrigin->priv;
+    WebCore::String host =  priv->coreOrigin->host();
+
+    if (!priv->host)
+        priv->host = g_strdup(host.utf8().data());
+
+    return priv->host;
+}
+
+/**
+ * webkit_security_origin_get_port:
+ * @security_origin: a #WebKitSecurityOrigin
+ *
+ * Returns the port for the security origin.
+ *
+ * Returns: the port for the security origin
+ *
+ * Since: 1.1.14
+ **/
+guint webkit_security_origin_get_port(WebKitSecurityOrigin* securityOrigin)
+{
+    g_return_val_if_fail(WEBKIT_IS_SECURITY_ORIGIN(securityOrigin), 0);
+
+    WebCore::SecurityOrigin* coreOrigin = core(securityOrigin);
+    return coreOrigin->port();
+}
+
+/**
+ * webkit_security_origin_get_web_database_usage:
+ * @security_origin: a #WebKitSecurityOrigin
+ *
+ * Returns the cumulative size of all Web Database database's in the origin
+ * in bytes.
+ *
+ * Returns: the cumulative size of all databases 
+ *
+ * Since: 1.1.14
+ **/
+guint64 webkit_security_origin_get_web_database_usage(WebKitSecurityOrigin* securityOrigin)
+{
+    g_return_val_if_fail(WEBKIT_IS_SECURITY_ORIGIN(securityOrigin), 0);
+
+#if ENABLE(DATABASE)
+    WebCore::SecurityOrigin* coreOrigin = core(securityOrigin);
+    return WebCore::DatabaseTracker::tracker().usageForOrigin(coreOrigin);
+#else
+    return 0;
+#endif
+}
+
+/**
+ * webkit_security_origin_get_web_database_quota:
+ * @security_origin: a #WebKitSecurityOrigin
+ *
+ * Returns the quota for Web Database storage of the security origin
+ * in bytes.
+ *
+ * Returns: the Web Database quota
+ *
+ * Since: 1.1.14
+ **/
+guint64 webkit_security_origin_get_web_database_quota(WebKitSecurityOrigin* securityOrigin)
+{
+    g_return_val_if_fail(WEBKIT_IS_SECURITY_ORIGIN(securityOrigin), 0);
+
+#if ENABLE(DATABASE)
+    WebCore::SecurityOrigin* coreOrigin = core(securityOrigin);
+    return WebCore::DatabaseTracker::tracker().quotaForOrigin(coreOrigin);
+#else
+    return 0;
+#endif
+}
+
+/**
+ * webkit_security_origin_set_web_database_quota:
+ * @security_origin: a #WebKitSecurityOrigin
+ * @quota: a new Web Database quota in bytes
+ *
+ * Adjust the quota for Web Database storage of the security origin
+ *
+ * Since: 1.1.14
+ **/
+void webkit_security_origin_set_web_database_quota(WebKitSecurityOrigin* securityOrigin, guint64 quota)
+{
+    g_return_if_fail(WEBKIT_IS_SECURITY_ORIGIN(securityOrigin));
+
+#if ENABLE(DATABASE)
+    WebCore::SecurityOrigin* coreOrigin = core(securityOrigin);
+    WebCore::DatabaseTracker::tracker().setQuota(coreOrigin, quota);
+#endif
+}
+
+/**
+ * webkit_security_origin_get_all_web_databases:
+ * @security_origin: a #WebKitSecurityOrigin
+ *
+ * Returns a list of all Web Databases in the security origin.
+ *
+ * Returns: a #Glist of databases in the security origin.
+ *
+ * Since: 1.1.14
+ **/
+GList* webkit_security_origin_get_all_web_databases(WebKitSecurityOrigin* securityOrigin)
+{
+    g_return_val_if_fail(WEBKIT_IS_SECURITY_ORIGIN(securityOrigin), NULL);
+    GList* databases = NULL;
+
+#if ENABLE(DATABASE)
+    WebCore::SecurityOrigin* coreOrigin = core(securityOrigin);
+    Vector<WebCore::String> databaseNames;
+
+    if (!WebCore::DatabaseTracker::tracker().databaseNamesForOrigin(coreOrigin, databaseNames))
+        return NULL;
+
+    for (unsigned i = 0; i < databaseNames.size(); ++i) {
+        WebKitWebDatabase* database = webkit_security_origin_get_web_database(securityOrigin, databaseNames[i].utf8().data());
+        databases = g_list_append(databases, database);
+    }
+#endif
+
+    return databases;
+}
+
+WebKitSecurityOrigin* WebKit::kit(WebCore::SecurityOrigin* coreOrigin)
+{
+    ASSERT(coreOrigin);
+
+    GHashTable* table = webkit_security_origins();
+    WebKitSecurityOrigin* origin = (WebKitSecurityOrigin*) g_hash_table_lookup(table, coreOrigin);
+
+    if (!origin) {
+        origin = WEBKIT_SECURITY_ORIGIN(g_object_new(WEBKIT_TYPE_SECURITY_ORIGIN, NULL));
+        origin->priv->coreOrigin = coreOrigin;
+        g_hash_table_insert(table, coreOrigin, origin);
+    }
+
+    return origin;
+}
+
+
+WebCore::SecurityOrigin* WebKit::core(WebKitSecurityOrigin* securityOrigin)
+{
+    ASSERT(securityOrigin);
+
+    return securityOrigin->priv->coreOrigin.get();
+}
+
+WebKitWebDatabase* webkit_security_origin_get_web_database(WebKitSecurityOrigin* securityOrigin, const gchar* databaseName)
+{
+    g_return_val_if_fail(WEBKIT_IS_SECURITY_ORIGIN(securityOrigin), NULL);
+
+    WebKitSecurityOriginPrivate* priv = securityOrigin->priv;
+    GHashTable* databaseHash = priv->webDatabases;
+    WebKitWebDatabase* database = (WebKitWebDatabase*) g_hash_table_lookup(databaseHash, databaseName);
+
+    if (!database) {
+        database =  WEBKIT_WEB_DATABASE(g_object_new(WEBKIT_TYPE_WEB_DATABASE,
+                                       "security-origin", securityOrigin,
+                                       "name", databaseName,
+                                        NULL));
+        g_hash_table_insert(databaseHash, g_strdup(databaseName), database);
+    }
+
+    return database;
+}
+
diff --git a/WebKit/gtk/webkit/webkitsecurityorigin.h b/WebKit/gtk/webkit/webkitsecurityorigin.h
new file mode 100644
index 0000000..57bcd19
--- /dev/null
+++ b/WebKit/gtk/webkit/webkitsecurityorigin.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Martin Robinson, Jan Michael C. Alonzo
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef webkitsecurityorigin_h
+#define webkitsecurityorigin_h
+
+#include "webkitsecurityorigin.h"
+#include "webkitwebdatabase.h"
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_SECURITY_ORIGIN             (webkit_security_origin_get_type())
+#define WEBKIT_SECURITY_ORIGIN(obj)             (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_SECURITY_ORIGIN, WebKitSecurityOrigin))
+#define WEBKIT_SECURITY_ORIGIN_CLASS(klass)     (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_SECURITY_ORIGIN, WebKitSecurityOriginClass))
+#define WEBKIT_IS_SECURITY_ORIGIN(obj)          (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_SECURITY_ORIGIN))
+#define WEBKIT_IS_SECURITY_ORIGIN_CLASS(klass)  (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_SECURITY_ORIGIN))
+#define WEBKIT_SECURITY_ORIGIN_GET_CLASS(obj)   (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_SECURITY_ORIGIN, WebKitSecurityOriginClass))
+
+typedef struct _WebKitSecurityOriginPrivate WebKitSecurityOriginPrivate;
+
+struct _WebKitSecurityOrigin {
+    GObject parent_instance;
+
+    /*< private >*/
+    WebKitSecurityOriginPrivate* priv;
+};
+
+struct _WebKitSecurityOriginClass {
+    GObjectClass parent_class;
+
+    /* Padding for future expansion */
+    void (*_webkit_reserved1) (void);
+    void (*_webkit_reserved2) (void);
+    void (*_webkit_reserved3) (void);
+    void (*_webkit_reserved4) (void);
+};
+
+WEBKIT_API GType
+webkit_security_origin_get_type (void);
+
+WEBKIT_API G_CONST_RETURN gchar*
+webkit_security_origin_get_protocol           (WebKitSecurityOrigin* securityOrigin);
+
+WEBKIT_API G_CONST_RETURN gchar*
+webkit_security_origin_get_host               (WebKitSecurityOrigin* securityOrigin);
+
+WEBKIT_API guint
+webkit_security_origin_get_port               (WebKitSecurityOrigin* securityOrigin);
+
+WEBKIT_API guint64
+webkit_security_origin_get_web_database_usage (WebKitSecurityOrigin* securityOrigin);
+
+WEBKIT_API guint64
+webkit_security_origin_get_web_database_quota (WebKitSecurityOrigin* securityOrigin);
+
+WEBKIT_API void 
+webkit_security_origin_set_web_database_quota (WebKitSecurityOrigin* securityOrigin, guint64 quota);
+
+WEBKIT_API GList *
+webkit_security_origin_get_all_web_databases  (WebKitSecurityOrigin* securityOrigin);
+
+G_END_DECLS
+
+#endif /* __WEBKIT_SECURITY_ORIGIN_H__ */
diff --git a/WebKit/gtk/webkit/webkitsoupauthdialog.c b/WebKit/gtk/webkit/webkitsoupauthdialog.c
index 9bc188e..538dbfa 100644
--- a/WebKit/gtk/webkit/webkitsoupauthdialog.c
+++ b/WebKit/gtk/webkit/webkitsoupauthdialog.c
@@ -19,25 +19,24 @@
 
 #include "config.h"
 
+#define LIBSOUP_I_HAVE_READ_BUG_594377_AND_KNOW_SOUP_PASSWORD_MANAGER_MIGHT_GO_AWAY
+
 #include <glib/gi18n-lib.h>
 #include <gtk/gtk.h>
 #include <libsoup/soup.h>
-#if USE(GNOMEKEYRING)
-#include <gnome-keyring.h>
-#endif
 
 #include "webkitmarshal.h"
 #include "webkitsoupauthdialog.h"
 
 /**
  * SECTION:webkitsoupauthdialog
- * @short_description: A #SoupFeature to provide a simple
+ * @short_description: A #SoupSessionFeature to provide a simple
  * authentication dialog for HTTP basic auth support.
  *
- * #WebKitSoupAuthDialog is a #SoupFeature that you can attach to your
- * #SoupSession to provide a simple authentication dialog, with
- * optional GNOME Keyring support, while handling HTTP basic auth. It
- * is built as a simple C-only module to ease reuse.
+ * #WebKitSoupAuthDialog is a #SoupSessionFeature that you can attach to your
+ * #SoupSession to provide a simple authentication dialog while
+ * handling HTTP basic auth. It is built as a simple C-only module
+ * to ease reuse.
  */
 
 static void webkit_soup_auth_dialog_session_feature_init(SoupSessionFeatureInterface* feature_interface, gpointer interface_data);
@@ -88,9 +87,7 @@ typedef struct _WebKitAuthData {
     SoupSessionFeature* manager;
     GtkWidget* loginEntry;
     GtkWidget* passwordEntry;
-#if USE(GNOMEKEYRING)
     GtkWidget* checkButton;
-#endif
     char *username;
     char *password;
 } WebKitAuthData;
@@ -103,63 +100,53 @@ static void free_authData(WebKitAuthData* authData)
     g_slice_free(WebKitAuthData, authData);
 }
 
-#if USE(GNOMEKEYRING)
-static void set_password_callback(GnomeKeyringResult result, guint32 val, gpointer user_data)
-{
-    /* Dummy callback, gnome_keyring_set_network_password does not accept a NULL one */
-}
-
+#ifdef SOUP_TYPE_PASSWORD_MANAGER
 static void save_password_callback(SoupMessage* msg, WebKitAuthData* authData)
 {
-    /* Check only for Success status codes (2xx) */
-    if (msg->status_code >= 200 && msg->status_code < 300) {
-        SoupURI* uri = soup_message_get_uri(authData->msg);
-        gnome_keyring_set_network_password(NULL,
-                                           authData->username,
-                                           soup_auth_get_realm(authData->auth),
-                                           uri->host,
-                                           NULL,
-                                           uri->scheme,
-                                           soup_auth_get_scheme_name(authData->auth),
-                                           uri->port,
-                                           authData->password,
-                                           (GnomeKeyringOperationGetIntCallback)set_password_callback,
-                                           NULL,
-                                           NULL);
-    }
+    /* Anything but 401 and 5xx means the password was accepted */
+    if (msg->status_code != 401 && msg->status_code < 500)
+        soup_auth_save_password(authData->auth, authData->username, authData->password);
+
+    /* Disconnect the callback. If the authentication succeeded we are
+     * done, and if it failed we'll create a new authData and we'll
+     * connect to 'got-headers' again in response_callback */
+    g_signal_handlers_disconnect_by_func(msg, save_password_callback, authData);
+
     free_authData(authData);
 }
 #endif
 
 static void response_callback(GtkDialog* dialog, gint response_id, WebKitAuthData* authData)
 {
-    switch(response_id) {
-    case GTK_RESPONSE_OK:
+    gboolean freeAuthData = TRUE;
+
+    if (response_id == GTK_RESPONSE_OK) {
         authData->username = g_strdup(gtk_entry_get_text(GTK_ENTRY(authData->loginEntry)));
         authData->password = g_strdup(gtk_entry_get_text(GTK_ENTRY(authData->passwordEntry)));
+
         soup_auth_authenticate(authData->auth, authData->username, authData->password);
 
-#if USE(GNOMEKEYRING)
-        if (gtk_toggle_button_get_active(GTK_TOGGLE_BUTTON(authData->checkButton)))
+#ifdef SOUP_TYPE_PASSWORD_MANAGER
+        if (authData->checkButton &&
+            gtk_toggle_button_get_active(GTK_TOGGLE_BUTTON(authData->checkButton))) {
             g_signal_connect(authData->msg, "got-headers", G_CALLBACK(save_password_callback), authData);
+            freeAuthData = FALSE;
+        }
 #endif
-    default:
-        break;
     }
 
     soup_session_unpause_message(authData->session, authData->msg);
-#if !USE(GNOMEKEYRING)
-    free_authData(authData);
-#endif
+    if (freeAuthData)
+        free_authData(authData);
     gtk_widget_destroy(GTK_WIDGET(dialog));
 }
 
 static GtkWidget *
-table_add_entry (GtkWidget*  table,
-                 int         row,
-                 const char* label_text,
-                 const char* value,
-                 gpointer    user_data)
+table_add_entry(GtkWidget*  table,
+                int         row,
+                const char* label_text,
+                const char* value,
+                gpointer    user_data)
 {
     GtkWidget* entry;
     GtkWidget* label;
@@ -182,6 +169,15 @@ table_add_entry (GtkWidget*  table,
     return entry;
 }
 
+static gboolean session_can_save_passwords(SoupSession* session)
+{
+#ifdef SOUP_TYPE_PASSWORD_MANAGER
+    return soup_session_get_feature(session, SOUP_TYPE_PASSWORD_MANAGER) != NULL;
+#else
+    return FALSE;
+#endif
+}
+
 static void show_auth_dialog(WebKitAuthData* authData, const char* login, const char* password)
 {
     GtkWidget* toplevel;
@@ -197,10 +193,8 @@ static void show_auth_dialog(WebKitAuthData* authData, const char* login, const
     GtkWidget* messageLabel;
     char* message;
     SoupURI* uri;
-#if USE(GNOMEKEYRING)
     GtkWidget* rememberBox;
     GtkWidget* checkButton;
-#endif
 
     /* From GTK+ gtkmountoperation.c, modified and simplified. LGPL 2 license */
 
@@ -215,9 +209,9 @@ static void show_auth_dialog(WebKitAuthData* authData, const char* login, const
 
     /* Set the dialog up with HIG properties */
     gtk_dialog_set_has_separator(dialog, FALSE);
-    gtk_container_set_border_width(GTK_CONTAINER (dialog), 5);
+    gtk_container_set_border_width(GTK_CONTAINER(dialog), 5);
     gtk_box_set_spacing(GTK_BOX(dialog->vbox), 2); /* 2 * 5 + 2 = 12 */
-    gtk_container_set_border_width(GTK_CONTAINER (dialog->action_area), 5);
+    gtk_container_set_border_width(GTK_CONTAINER(dialog->action_area), 5);
     gtk_box_set_spacing(GTK_BOX(dialog->action_area), 6);
 
     gtk_window_set_resizable(window, FALSE);
@@ -256,7 +250,7 @@ static void show_auth_dialog(WebKitAuthData* authData, const char* login, const
                        FALSE, FALSE, 0);
 
     vbox = gtk_vbox_new(FALSE, 6);
-    gtk_box_pack_start(GTK_BOX (mainVBox), vbox, FALSE, FALSE, 0);
+    gtk_box_pack_start(GTK_BOX(mainVBox), vbox, FALSE, FALSE, 0);
 
     /* The table that holds the entries */
     entryContainer = gtk_alignment_new(0.0, 0.0, 1.0, 1.0);
@@ -268,8 +262,8 @@ static void show_auth_dialog(WebKitAuthData* authData, const char* login, const
                        FALSE, FALSE, 0);
 
     table = gtk_table_new(2, 2, FALSE);
-    gtk_table_set_col_spacings(GTK_TABLE (table), 12);
-    gtk_table_set_row_spacings(GTK_TABLE (table), 6);
+    gtk_table_set_col_spacings(GTK_TABLE(table), 12);
+    gtk_table_set_row_spacings(GTK_TABLE(table), 6);
     gtk_container_add(GTK_CONTAINER(entryContainer), table);
 
     authData->loginEntry = table_add_entry(table, 0, _("Username:"),
@@ -279,77 +273,55 @@ static void show_auth_dialog(WebKitAuthData* authData, const char* login, const
 
     gtk_entry_set_visibility(GTK_ENTRY(authData->passwordEntry), FALSE);
 
-#if USE(GNOMEKEYRING)
-    rememberBox = gtk_vbox_new (FALSE, 6);
-    gtk_box_pack_start (GTK_BOX (vbox), rememberBox,
-                        FALSE, FALSE, 0);
-
-    checkButton = gtk_check_button_new_with_mnemonic(_("_Remember password"));
-    if (login && password)
-        gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(checkButton), TRUE);
-    gtk_label_set_line_wrap(GTK_LABEL(gtk_bin_get_child(GTK_BIN(checkButton))), TRUE);
-    gtk_box_pack_start (GTK_BOX (rememberBox), checkButton, FALSE, FALSE, 0);
-    authData->checkButton = checkButton;
-#endif
+    if (session_can_save_passwords(authData->session)) {
+        rememberBox = gtk_vbox_new(FALSE, 6);
+        gtk_box_pack_start(GTK_BOX(vbox), rememberBox,
+                           FALSE, FALSE, 0);
+        checkButton = gtk_check_button_new_with_mnemonic(_("_Remember password"));
+        if (login && password)
+            gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(checkButton), TRUE);
+        gtk_label_set_line_wrap(GTK_LABEL(gtk_bin_get_child(GTK_BIN(checkButton))), TRUE);
+        gtk_box_pack_start(GTK_BOX(rememberBox), checkButton, FALSE, FALSE, 0);
+        authData->checkButton = checkButton;
+    }
 
     g_signal_connect(dialog, "response", G_CALLBACK(response_callback), authData);
     gtk_widget_show_all(widget);
 }
 
-#if USE(GNOMEKEYRING)
-static void find_password_callback(GnomeKeyringResult result, GList* list, WebKitAuthData* authData)
-{
-    GList* p;
-    const char* login = NULL;
-    const char* password = NULL;
-
-    for (p = list; p; p = p->next) {
-        /* FIXME: support multiple logins/passwords ? */
-        GnomeKeyringNetworkPasswordData* data = (GnomeKeyringNetworkPasswordData*)p->data;
-        login = data->user;
-        password = data->password;
-        break;
-    }
-
-    show_auth_dialog(authData, login, password);
-}
-#endif
-
 static void session_authenticate(SoupSession* session, SoupMessage* msg, SoupAuth* auth, gboolean retrying, gpointer user_data)
 {
     SoupURI* uri;
     WebKitAuthData* authData;
     SoupSessionFeature* manager = (SoupSessionFeature*)user_data;
+#ifdef SOUP_TYPE_PASSWORD_MANAGER
+    GSList* users;
+#endif
+    const char *login, *password;
 
     soup_session_pause_message(session, msg);
     /* We need to make sure the message sticks around when pausing it */
     g_object_ref(msg);
 
     uri = soup_message_get_uri(msg);
-    authData = g_slice_new(WebKitAuthData);
+    authData = g_slice_new0(WebKitAuthData);
     authData->msg = msg;
     authData->auth = auth;
     authData->session = session;
     authData->manager = manager;
 
-    /*
-     * If we have gnome-keyring let's try to find the password first in the ring.
-     * Otherwise just show the dialog straight away
-     */
-#if USE(GNOMEKEYRING)
-    gnome_keyring_find_network_password(NULL,
-                                        soup_auth_get_realm(auth),
-                                        uri->host,
-                                        NULL,
-                                        uri->scheme,
-                                        soup_auth_get_scheme_name(auth),
-                                        uri->port,
-                                        (GnomeKeyringOperationGetListCallback)find_password_callback,
-                                        authData,
-                                        NULL);
-#else
-    show_auth_dialog(authData, NULL, NULL);
+    login = password = NULL;
+
+#ifdef SOUP_TYPE_PASSWORD_MANAGER
+    users = soup_auth_get_saved_users(auth);
+    if (users) {
+        login = users->data;
+        password = soup_auth_get_saved_password(auth, login);
+        g_slist_free(users);
+    }
 #endif
+
+    show_auth_dialog(authData, login, password);
 }
 
 static void attach(SoupSessionFeature* manager, SoupSession* session)
diff --git a/WebKit/gtk/webkit/webkitsoupauthdialog.h b/WebKit/gtk/webkit/webkitsoupauthdialog.h
index 9721c72..01ccfc8 100644
--- a/WebKit/gtk/webkit/webkitsoupauthdialog.h
+++ b/WebKit/gtk/webkit/webkitsoupauthdialog.h
@@ -22,8 +22,8 @@
 
 #include <webkit/webkitdefines.h>
 
-#ifndef WEBKIT_SOUP_AUTH_DIALOG_H
-#define WEBKIT_SOUP_AUTH_DIALOG_H 1
+#ifndef webkitsoupauthdialog_h
+#define webkitsoupauthdialog_h
 
 G_BEGIN_DECLS
 
@@ -49,4 +49,4 @@ webkit_soup_auth_dialog_get_type (void);
 
 G_END_DECLS
 
-#endif /* WEBKIT_SOUP_AUTH_DIALOG_H */
+#endif /* webkitsoupauthdialog_h */
diff --git a/WebKit/gtk/webkit/webkitversion.h.in b/WebKit/gtk/webkit/webkitversion.h.in
index 9f1b818..5eb9426 100644
--- a/WebKit/gtk/webkit/webkitversion.h.in
+++ b/WebKit/gtk/webkit/webkitversion.h.in
@@ -17,8 +17,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_VERSION_H
-#define WEBKIT_VERSION_H
+#ifndef webkitversion_h
+#define webkitversion_h
 
 #include <glib.h>
 #include <webkit/webkitdefines.h>
diff --git a/WebKit/gtk/webkit/webkitwebbackforwardlist.h b/WebKit/gtk/webkit/webkitwebbackforwardlist.h
index a44cbcd..d08566e 100644
--- a/WebKit/gtk/webkit/webkitwebbackforwardlist.h
+++ b/WebKit/gtk/webkit/webkitwebbackforwardlist.h
@@ -17,8 +17,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_WEB_BACK_FORWARD_LIST_H
-#define WEBKIT_WEB_BACK_FORWARD_LIST_H
+#ifndef webkitwebbackforwardlist_h
+#define webkitwebbackforwardlist_h
 
 #include <glib.h>
 #include <glib-object.h>
@@ -114,4 +114,4 @@ webkit_web_back_forward_list_add_item                    (WebKitWebBackForwardLi
 G_END_DECLS
 
 
-#endif /* WEBKIT_WEB_BACK_FORWARD_LIST_H */
+#endif /* webkitwebbackforwardlist_h */
diff --git a/WebKit/gtk/webkit/webkitwebdatabase.cpp b/WebKit/gtk/webkit/webkitwebdatabase.cpp
new file mode 100644
index 0000000..100176e
--- /dev/null
+++ b/WebKit/gtk/webkit/webkitwebdatabase.cpp
@@ -0,0 +1,533 @@
+/*
+ * Copyright (C) 2009 Martin Robinson
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "webkitwebdatabase.h"
+
+#include "webkitprivate.h"
+
+#include "CString.h"
+#include "DatabaseDetails.h"
+#include "DatabaseTracker.h"
+
+#include <glib/gi18n-lib.h>
+
+/**
+ * SECTION:webkitwebdatabase
+ * @short_description: A WebKit web application database
+ *
+ * #WebKitWebDatabase is a representation of a Web Database database. The
+ * proposed Web Database standard introduces support for SQL databases that web
+ * sites can create and access on a local computer through JavaScript.
+ *
+ * To get access to all databases defined by a security origin, use
+ * #webkit_security_origin_get_databases. Each database has a canonical
+ * name, as well as a user-friendly display name.
+ * 
+ * WebKit uses SQLite to create and access the local SQL databases. The location
+ * of a #WebKitWebDatabase can be accessed wth #webkit_web_database_get_filename.
+ * You can configure the location of all databases with
+ * #webkit_set_database_directory_path.
+ * 
+ * For each database the web site can define an estimated size which can be
+ * accessed with #webkit_web_database_get_expected_size. The current size of the
+ * database in bytes is returned by #webkit_web_database_get_size.
+ * 
+ * For more information refer to the Web Database specification proposal at
+ * http://dev.w3.org/html5/webdatabase
+ */
+
+using namespace WebKit;
+
+enum {
+    PROP_0,
+
+    PROP_SECURITY_ORIGIN,
+    PROP_NAME,
+    PROP_DISPLAY_NAME,
+    PROP_EXPECTED_SIZE,
+    PROP_SIZE,
+    PROP_PATH
+};
+
+G_DEFINE_TYPE(WebKitWebDatabase, webkit_web_database, G_TYPE_OBJECT)
+
+struct _WebKitWebDatabasePrivate {
+    WebKitSecurityOrigin* origin;
+    gchar* name;
+    gchar* displayName;
+    gchar* filename;
+};
+
+static gchar* webkit_database_directory_path = NULL;
+static guint64 webkit_default_database_quota = 5 * 1024 * 1024;
+
+#define WEBKIT_WEB_DATABASE_GET_PRIVATE(obj) (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_DATABASE, WebKitWebDatabasePrivate))
+
+static void webkit_web_database_set_security_origin(WebKitWebDatabase* webDatabase, WebKitSecurityOrigin* security_origin);
+
+static void webkit_web_database_set_name(WebKitWebDatabase* webDatabase, const gchar* name);
+
+static void webkit_web_database_finalize(GObject* object)
+{
+    WebKitWebDatabase* webDatabase = WEBKIT_WEB_DATABASE(object);
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+
+    g_free(priv->name);
+    g_free(priv->displayName);
+    g_free(priv->filename);
+
+    G_OBJECT_CLASS(webkit_web_database_parent_class)->finalize(object);
+}
+
+static void webkit_web_database_dispose(GObject* object)
+{
+    WebKitWebDatabase* webDatabase = WEBKIT_WEB_DATABASE(object);
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+
+    if (priv->origin) {
+        g_object_unref(priv->origin);
+        priv->origin = NULL;
+    }
+
+    G_OBJECT_CLASS(webkit_web_database_parent_class)->dispose(object);
+}
+
+static void webkit_web_database_set_property(GObject* object, guint propId, const GValue* value, GParamSpec* pspec)
+{
+    WebKitWebDatabase* webDatabase = WEBKIT_WEB_DATABASE(object);
+
+    switch (propId) {
+    case PROP_SECURITY_ORIGIN:
+        webkit_web_database_set_security_origin(webDatabase, WEBKIT_SECURITY_ORIGIN(g_value_get_object(value)));
+        break;
+    case PROP_NAME:
+        webkit_web_database_set_name(webDatabase, g_value_get_string(value));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, pspec);
+        break;
+    }
+}
+
+static void webkit_web_database_get_property(GObject* object, guint propId, GValue* value, GParamSpec* pspec)
+{
+    WebKitWebDatabase* webDatabase = WEBKIT_WEB_DATABASE(object);
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+
+    switch (propId) {
+    case PROP_SECURITY_ORIGIN:
+        g_value_set_object(value, priv->origin);
+        break;
+    case PROP_NAME:
+        g_value_set_string(value, webkit_web_database_get_name(webDatabase));
+        break;
+    case PROP_DISPLAY_NAME:
+        g_value_set_string(value, webkit_web_database_get_display_name(webDatabase));
+        break;
+    case PROP_EXPECTED_SIZE:
+        g_value_set_uint64(value, webkit_web_database_get_expected_size(webDatabase));
+        break;
+    case PROP_SIZE:
+        g_value_set_uint64(value, webkit_web_database_get_size(webDatabase));
+        break;
+    case PROP_PATH:
+        g_value_set_string(value, webkit_web_database_get_filename(webDatabase));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, pspec);
+        break;
+    }
+}
+
+static void webkit_web_database_class_init(WebKitWebDatabaseClass* klass)
+{
+    GObjectClass* gobjectClass = G_OBJECT_CLASS(klass);
+    gobjectClass->dispose = webkit_web_database_dispose;
+    gobjectClass->finalize = webkit_web_database_finalize;
+    gobjectClass->set_property = webkit_web_database_set_property;
+    gobjectClass->get_property = webkit_web_database_get_property;
+
+     /**
+      * WebKitWebDatabase:security-origin:
+      *
+      * The security origin of the database.
+      *
+      * Since: 1.1.14
+      */
+     g_object_class_install_property(gobjectClass, PROP_SECURITY_ORIGIN,
+                                     g_param_spec_object("security-origin",
+                                                         _("Security Origin"),
+                                                         _("The security origin of the database"),
+                                                         WEBKIT_TYPE_SECURITY_ORIGIN,
+                                                         (GParamFlags) (G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY)));
+
+     /**
+      * WebKitWebDatabase:name:
+      *
+      * The name of the Web Database database.
+      *
+      * Since: 1.1.14
+      */
+     g_object_class_install_property(gobjectClass, PROP_NAME,
+                                     g_param_spec_string("name",
+                                                         _("Name"),
+                                                         _("The name of the Web Database database"),
+                                                         NULL,
+                                                         (GParamFlags) (G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY)));
+
+     /**
+      * WebKitWebDatabase:display-name:
+      *
+      * The display name of the Web Database database.
+      *
+      * Since: 1.1.14
+      */
+     g_object_class_install_property(gobjectClass, PROP_DISPLAY_NAME,
+                                     g_param_spec_string("display-name",
+                                                         _("Display Name"),
+                                                         _("The display name of the Web Storage database"),
+                                                         NULL,
+                                                         WEBKIT_PARAM_READABLE));
+
+     /**
+     * WebKitWebDatabase:expected-size:
+     *
+     * The expected size of the database in bytes as defined by the web author.
+     *
+     * Since: 1.1.14
+     */
+     g_object_class_install_property(gobjectClass, PROP_EXPECTED_SIZE,
+                                     g_param_spec_uint64("expected-size",
+                                                         _("Expected Size"),
+                                                         _("The expected size of the Web Database database"),
+                                                         0, G_MAXUINT64, 0,
+                                                         WEBKIT_PARAM_READABLE));
+     /**
+     * WebKitWebDatabase:size:
+     *
+     * The current size of the database in bytes.
+     *
+     * Since: 1.1.14
+     */
+     g_object_class_install_property(gobjectClass, PROP_SIZE,
+                                     g_param_spec_uint64("size",
+                                                         _("Size"),
+                                                         _("The current size of the Web Database database"),
+                                                         0, G_MAXUINT64, 0,
+                                                         WEBKIT_PARAM_READABLE));
+     /**
+      * WebKitWebDatabase:filename:
+      *
+      * The absolute filename of the Web Database database.
+      *
+      * Since: 1.1.14
+      */
+     g_object_class_install_property(gobjectClass, PROP_PATH,
+                                     g_param_spec_string("filename",
+                                                         _("Filename"),
+                                                         _("The absolute filename of the Web Storage database"),
+                                                         NULL,
+                                                         WEBKIT_PARAM_READABLE));
+
+    g_type_class_add_private(klass, sizeof(WebKitWebDatabasePrivate));
+}
+
+static void webkit_web_database_init(WebKitWebDatabase* webDatabase)
+{
+    webDatabase->priv = WEBKIT_WEB_DATABASE_GET_PRIVATE(webDatabase);
+}
+
+// Internal use only
+static void webkit_web_database_set_security_origin(WebKitWebDatabase *webDatabase, WebKitSecurityOrigin *securityOrigin)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_DATABASE(webDatabase));
+    g_return_if_fail(WEBKIT_IS_SECURITY_ORIGIN(securityOrigin));
+
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+
+    if (priv->origin)
+        g_object_unref(priv->origin);
+
+    g_object_ref(securityOrigin);
+    priv->origin = securityOrigin;
+}
+
+static void webkit_web_database_set_name(WebKitWebDatabase* webDatabase, const gchar* name)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_DATABASE(webDatabase));
+
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+    g_free(priv->name);
+    priv->name = g_strdup(name);
+}
+
+/**
+ * webkit_web_database_get_security_origin:
+ * @web_database: a #WebKitWebDatabase
+ *
+ * Returns the security origin of the #WebKitWebDatabase.
+ *
+ * Returns: the security origin of the database
+ *
+ * Since: 1.1.14
+ **/
+WebKitSecurityOrigin* webkit_web_database_get_security_origin(WebKitWebDatabase* webDatabase)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATABASE(webDatabase), NULL);
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+
+    return priv->origin;
+}
+
+/**
+ * webkit_web_database_get_name:
+ * @web_database: a #WebKitWebDatabase
+ *
+ * Returns the canonical name of the #WebKitWebDatabase.
+ *
+ * Returns: the name of the database
+ *
+ * Since: 1.1.14
+ **/
+G_CONST_RETURN gchar* webkit_web_database_get_name(WebKitWebDatabase* webDatabase)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATABASE(webDatabase), NULL);
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+
+    return priv->name;
+}
+
+/**
+ * webkit_web_database_get_display_name:
+ * @web_database: a #WebKitWebDatabase
+ *
+ * Returns the name of the #WebKitWebDatabase as seen by the user.
+ *
+ * Returns: the name of the database as seen by the user.
+ *
+ * Since: 1.1.14
+ **/
+G_CONST_RETURN gchar* webkit_web_database_get_display_name(WebKitWebDatabase* webDatabase)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATABASE(webDatabase), NULL);
+
+#if ENABLE(DATABASE)
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+    WebCore::DatabaseDetails details = WebCore::DatabaseTracker::tracker().detailsForNameAndOrigin(priv->name, core(priv->origin));
+    WebCore::String displayName =  details.displayName();
+
+    if (displayName.isEmpty())
+        return "";
+
+    g_free(priv->displayName);
+    priv->displayName = g_strdup(displayName.utf8().data());
+    return priv->displayName;
+#else
+    return "";
+#endif
+}
+
+/**
+ * webkit_web_database_get_expected_size:
+ * @web_database: a #WebKitWebDatabase
+ *
+ * Returns the expected size of the #WebKitWebDatabase in bytes as defined by the
+ * web author. The Web Database standard allows web authors to specify an expected
+ * size of the database to optimize the user experience.
+ *
+ * Returns: the expected size of the database in bytes
+ *
+ * Since: 1.1.14
+ **/
+guint64 webkit_web_database_get_expected_size(WebKitWebDatabase* webDatabase)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATABASE(webDatabase), 0);
+
+#if ENABLE(DATABASE)
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+    WebCore::DatabaseDetails details = WebCore::DatabaseTracker::tracker().detailsForNameAndOrigin(priv->name, core(priv->origin));
+    return details.expectedUsage();
+#else
+    return 0;
+#endif
+}
+
+/**
+ * webkit_web_database_get_size:
+ * @web_database: a #WebKitWebDatabase
+ *
+ * Returns the actual size of the #WebKitWebDatabase space on disk in bytes.
+ *
+ * Returns: the actual size of the database in bytes
+ *
+ * Since: 1.1.14
+ **/
+guint64 webkit_web_database_get_size(WebKitWebDatabase* webDatabase)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATABASE(webDatabase), 0);
+
+#if ENABLE(DATABASE)
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+    WebCore::DatabaseDetails details = WebCore::DatabaseTracker::tracker().detailsForNameAndOrigin(priv->name, core(priv->origin));
+    return details.currentUsage();
+#else
+    return 0;
+#endif
+}
+
+/**
+ * webkit_web_database_get_filename:
+ * @web_database: a #WebKitWebDatabase
+ *
+ * Returns the absolute filename to the #WebKitWebDatabase file on disk.
+ *
+ * Returns: the absolute filename of the database
+ *
+ * Since: 1.1.14
+ **/
+G_CONST_RETURN gchar* webkit_web_database_get_filename(WebKitWebDatabase* webDatabase)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATABASE(webDatabase), NULL);
+
+#if ENABLE(DATABASE)
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+    WebCore::String coreName = WebCore::String::fromUTF8(priv->name);
+    WebCore::String corePath = WebCore::DatabaseTracker::tracker().fullPathForDatabase(core(priv->origin), coreName);
+
+    if (corePath.isEmpty())
+        return"";
+
+    g_free(priv->filename);
+    priv->filename = g_strdup(corePath.utf8().data());
+    return priv->filename;
+
+#else
+    return "";
+#endif
+}
+
+/**
+ * webkit_web_database_remove:
+ * @web_database: a #WebKitWebDatabase
+ *
+ * Removes the #WebKitWebDatabase from its security origin and destroys all data
+ * stored in the database.
+ *
+ * Since: 1.1.14
+ **/
+void webkit_web_database_remove(WebKitWebDatabase* webDatabase)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_DATABASE(webDatabase));
+
+#if ENABLE(DATABASE)
+    WebKitWebDatabasePrivate* priv = webDatabase->priv;
+    WebCore::DatabaseTracker::tracker().deleteDatabase(core(priv->origin), priv->name);
+#endif
+}
+
+/**
+ * webkit_remove_all_web_databases:
+ *
+ * Removes all web databases from the current database directory path.
+ *
+ * Since: 1.1.14
+ **/
+void webkit_remove_all_web_databases()
+{
+#if ENABLE(DATABASE)
+    WebCore::DatabaseTracker::tracker().deleteAllDatabases();
+#endif
+}
+
+/**
+ * webkit_get_web_database_directory_path:
+ *
+ * Returns the current path to the directory WebKit will write Web 
+ * Database databases. By default this path will be in the user data
+ * directory.
+ *
+ * Returns: the current database directory path
+ *
+ * Since: 1.1.14
+ **/
+G_CONST_RETURN gchar* webkit_get_web_database_directory_path()
+{
+#if ENABLE(DATABASE)
+    WebCore::String path = WebCore::DatabaseTracker::tracker().databaseDirectoryPath();
+
+    if (path.isEmpty())
+        return "";
+
+    g_free(webkit_database_directory_path);
+    webkit_database_directory_path = g_strdup(path.utf8().data());
+    return webkit_database_directory_path;
+#else
+    return "";
+#endif
+}
+
+/**
+ * webkit_set_web_database_directory_path:
+ * @path: the new database directory path
+ *
+ * Sets the current path to the directory WebKit will write Web 
+ * Database databases. 
+ *
+ * Since: 1.1.14
+ **/
+void webkit_set_web_database_directory_path(const gchar* path)
+{
+#if ENABLE(DATABASE)
+    WebCore::String corePath = WebCore::String::fromUTF8(path);
+    WebCore::DatabaseTracker::tracker().setDatabaseDirectoryPath(corePath);
+
+    g_free(webkit_database_directory_path);
+    webkit_database_directory_path = g_strdup(corePath.utf8().data());
+#endif
+}
+
+/**
+ * webkit_get_default_web_database_quota:
+ *
+ * Returns the default quota for Web Database databases. By default
+ * this value is 5MB.
+ 
+ * Returns: the current default database quota in bytes
+ *
+ * Since: 1.1.14
+ **/
+guint64 webkit_get_default_web_database_quota()
+{
+    return webkit_default_database_quota;
+}
+
+/**
+ * webkit_set_default_web_database_quota:
+ * @default_quota: the new default database quota
+ *
+ * Sets the current path to the directory WebKit will write Web 
+ * Database databases. 
+ *
+ * Since: 1.1.14
+ **/
+void webkit_set_default_web_database_quota(guint64 defaultQuota)
+{
+    webkit_default_database_quota = defaultQuota;
+}
diff --git a/WebKit/gtk/webkit/webkitwebdatabase.h b/WebKit/gtk/webkit/webkitwebdatabase.h
new file mode 100644
index 0000000..8a9a151
--- /dev/null
+++ b/WebKit/gtk/webkit/webkitwebdatabase.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Martin Robinson
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef webkitwebdatabase_h
+#define webkitwebdatabase_h
+
+#include <glib-object.h>
+
+#include <webkit/webkitdefines.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_WEB_DATABASE             (webkit_web_database_get_type())
+#define WEBKIT_WEB_DATABASE(obj)             (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_WEB_DATABASE, WebKitWebDatabase))
+#define WEBKIT_WEB_DATABASE_CLASS(klass)     (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_WEB_DATABASE, WebKitWebDatabaseClass))
+#define WEBKIT_IS_WEB_DATABASE(obj)          (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_WEB_DATABASE))
+#define WEBKIT_IS_WEB_DATABASE_CLASS(klass)  (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_WEB_DATABASE))
+#define WEBKIT_WEB_DATABASE_GET_CLASS(obj)   (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_WEB_DATABASE, WebKitWebDatabaseClass))
+
+typedef struct _WebKitWebDatabasePrivate WebKitWebDatabasePrivate;
+
+struct _WebKitWebDatabase {
+    GObject parent_instance;
+
+    /*< private >*/
+    WebKitWebDatabasePrivate* priv;
+};
+
+struct _WebKitWebDatabaseClass {
+    GObjectClass parent_class;
+
+    /* Padding for future expansion */
+    void (*_webkit_reserved1) (void);
+    void (*_webkit_reserved2) (void);
+    void (*_webkit_reserved3) (void);
+    void (*_webkit_reserved4) (void);
+};
+
+WEBKIT_API GType
+webkit_web_database_get_type            (void);
+
+WEBKIT_API WebKitSecurityOrigin *
+webkit_web_database_get_security_origin (WebKitWebDatabase* webDatabase);
+
+WEBKIT_API G_CONST_RETURN gchar*
+webkit_web_database_get_name            (WebKitWebDatabase* webDatabase);
+
+WEBKIT_API G_CONST_RETURN gchar*
+webkit_web_database_get_display_name    (WebKitWebDatabase* webDatabase);
+
+WEBKIT_API guint64
+webkit_web_database_get_expected_size   (WebKitWebDatabase* webDatabase);
+
+WEBKIT_API guint64
+webkit_web_database_get_size            (WebKitWebDatabase* webDatabase);
+
+WEBKIT_API G_CONST_RETURN gchar*
+webkit_web_database_get_filename        (WebKitWebDatabase* webDatabase);
+
+WEBKIT_API void
+webkit_web_database_remove              (WebKitWebDatabase* webDatabase);
+
+WEBKIT_API void
+webkit_remove_all_web_databases         (void);
+
+WEBKIT_API G_CONST_RETURN gchar*
+webkit_get_web_database_directory_path  (void);
+
+WEBKIT_API void
+webkit_set_web_database_directory_path  (const gchar* path);
+
+WEBKIT_API guint64
+webkit_get_default_web_database_quota   (void);
+
+WEBKIT_API void
+webkit_set_default_web_database_quota   (guint64 defaultQuota);
+
+G_END_DECLS
+
+#endif /* webkitwebdatabase_h */
diff --git a/WebKit/gtk/webkit/webkitwebdatasource.cpp b/WebKit/gtk/webkit/webkitwebdatasource.cpp
new file mode 100644
index 0000000..059688e
--- /dev/null
+++ b/WebKit/gtk/webkit/webkitwebdatasource.cpp
@@ -0,0 +1,436 @@
+/*
+ * Copyright (C) 2009 Jan Michael C. Alonzo
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "webkitwebdatasource.h"
+
+#include "ArchiveResource.h"
+#include "DocumentLoaderGtk.h"
+#include "FrameLoaderClientGtk.h"
+#include "FrameLoader.h"
+#include "KURL.h"
+#include "PlatformString.h"
+#include "ResourceRequest.h"
+#include "runtime/InitializeThreading.h"
+#include "SharedBuffer.h"
+#include "SubstituteData.h"
+#include "webkitwebresource.h"
+#include "webkitprivate.h"
+#include "wtf/Assertions.h"
+
+#include <glib.h>
+
+/**
+ * SECTION:webkitwebdatasource
+ * @short_description: Encapsulates the content to be displayed in a #WebKitWebFrame.
+ * @see_also: #WebKitWebFrame
+ *
+ * Data source encapsulates the content of a #WebKitWebFrame. A
+ * #WebKitWebFrame has a main resource and subresources and the data source
+ * provides access to these resources. When a request gets loaded initially,
+ * it is set to a provisional state. The application can request for the
+ * request that initiated the load by asking for the provisional data source
+ * and invoking the webkit_web_data_source_get_initial_request method of
+ * #WebKitWebDataSource. This data source may not have enough data and some
+ * methods may return empty values. To get a "full" data source with the data
+ * and resources loaded, you need to get the non-provisional data source
+ * through #WebKitWebFrame's webkit_web_frame_get_data_source method. This
+ * data source will have the data after everything was loaded. Make sure that
+ * the data source was finished loading before using any of its methods. You
+ * can do this via webkit_web_data_source_is_loading.
+ */
+
+using namespace WebCore;
+using namespace WebKit;
+
+struct _WebKitWebDataSourcePrivate {
+    WebKit::DocumentLoader* loader;
+
+    WebKitNetworkRequest* initialRequest;
+    WebKitNetworkRequest* networkRequest;
+    WebKitWebResource* mainresource;
+
+    GString* data;
+
+    gchar* textEncoding;
+    gchar* unreachableURL;
+};
+
+#define WEBKIT_WEB_DATA_SOURCE_GET_PRIVATE(obj)        (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_DATA_SOURCE, WebKitWebDataSourcePrivate))
+
+G_DEFINE_TYPE(WebKitWebDataSource, webkit_web_data_source, G_TYPE_OBJECT);
+
+static void webkit_web_data_source_dispose(GObject* object)
+{
+    WebKitWebDataSource* webDataSource = WEBKIT_WEB_DATA_SOURCE(object);
+    WebKitWebDataSourcePrivate* priv = webDataSource->priv;
+
+    ASSERT(priv->loader);
+    ASSERT(!priv->loader->isLoading());
+    priv->loader->detachDataSource();
+    priv->loader->deref();
+
+    if (priv->initialRequest) {
+        g_object_unref(priv->initialRequest);
+        priv->initialRequest = NULL;
+    }
+
+    if (priv->networkRequest) {
+        g_object_unref(priv->networkRequest);
+        priv->networkRequest = NULL;
+    }
+
+    if (priv->mainresource) {
+        g_object_unref(priv->mainresource);
+        priv->mainresource = NULL;
+    }
+
+    G_OBJECT_CLASS(webkit_web_data_source_parent_class)->dispose(object);
+}
+
+static void webkit_web_data_source_finalize(GObject* object)
+{
+    WebKitWebDataSource* dataSource = WEBKIT_WEB_DATA_SOURCE(object);
+    WebKitWebDataSourcePrivate* priv = dataSource->priv;
+
+    g_free(priv->unreachableURL);
+    g_free(priv->textEncoding);
+
+    if (priv->data) {
+        g_string_free(priv->data, TRUE);
+        priv->data = NULL;
+    }
+
+    G_OBJECT_CLASS(webkit_web_data_source_parent_class)->finalize(object);
+}
+
+static void webkit_web_data_source_class_init(WebKitWebDataSourceClass* klass)
+{
+    GObjectClass* gobject_class = G_OBJECT_CLASS(klass);
+    gobject_class->dispose = webkit_web_data_source_dispose;
+    gobject_class->finalize = webkit_web_data_source_finalize;
+
+    webkit_init();
+
+    g_type_class_add_private(gobject_class, sizeof(WebKitWebDataSourcePrivate));
+}
+
+static void webkit_web_data_source_init(WebKitWebDataSource* webDataSource)
+{
+    webDataSource->priv = WEBKIT_WEB_DATA_SOURCE_GET_PRIVATE(webDataSource);
+}
+
+WebKitWebDataSource* webkit_web_data_source_new_with_loader(PassRefPtr<WebKit::DocumentLoader> loader)
+{
+    WebKitWebDataSource* webDataSource = WEBKIT_WEB_DATA_SOURCE(g_object_new(WEBKIT_TYPE_WEB_DATA_SOURCE, NULL));
+    WebKitWebDataSourcePrivate* priv = webDataSource->priv;
+    priv->loader = loader.releaseRef();
+
+    return webDataSource;
+}
+
+/**
+ * webkit_web_data_source_new:
+ *
+ * Creates a new #WebKitWebDataSource instance. The URL of the
+ * #WebKitWebDataSource will be set to "about:blank".
+ *
+ * Return: a new #WebKitWebDataSource.
+ *
+ * Since: 1.1.14
+ */
+WebKitWebDataSource* webkit_web_data_source_new()
+{
+    WebKitNetworkRequest* request = webkit_network_request_new("about:blank");
+    WebKitWebDataSource* datasource = webkit_web_data_source_new_with_request(request);
+    g_object_unref(request);
+
+    return datasource;
+}
+
+/**
+ * webkit_web_data_source_new_with_request:
+ * @request: the #WebKitNetworkRequest to use to create this data source
+ *
+ * Creates a new #WebKitWebDataSource from a #WebKitNetworkRequest. Normally,
+ * #WebKitWebFrame objects create their data sources so you will almost never
+ * want to invoke this method directly.
+ *
+ * Returns: a new #WebKitWebDataSource
+ *
+ * Since: 1.1.14
+ */
+WebKitWebDataSource* webkit_web_data_source_new_with_request(WebKitNetworkRequest* request)
+{
+    ASSERT(request);
+
+    const gchar* uri = webkit_network_request_get_uri(request);
+
+    WebKitWebDataSource* datasource;
+    datasource = webkit_web_data_source_new_with_loader(
+        WebKit::DocumentLoader::create(ResourceRequest(KURL(KURL(), String::fromUTF8(uri))),
+                                       SubstituteData()));
+
+    WebKitWebDataSourcePrivate* priv = datasource->priv;
+    priv->initialRequest = request;
+
+    return datasource;
+}
+
+/**
+ * webkit_web_data_source_get_web_frame
+ * @data_source: a #WebKitWebDataSource
+ *
+ * Returns the #WebKitWebFrame that represents this data source
+ *
+ * Return value: the #WebKitWebFrame that represents the @data_source. The
+ * #WebKitWebFrame is owned by WebKit and should not be freed or destroyed.
+ * This will return %NULL of the @data_source is not attached to a frame.
+ *
+ * Since: 1.1.14
+ */
+WebKitWebFrame* webkit_web_data_source_get_web_frame(WebKitWebDataSource* webDataSource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATA_SOURCE(webDataSource), NULL);
+
+    WebKitWebDataSourcePrivate* priv = webDataSource->priv;
+    FrameLoader* frameLoader = priv->loader->frameLoader();
+
+    if (!frameLoader)
+        return NULL;
+
+    return static_cast<WebKit::FrameLoaderClient*>(frameLoader->client())->webFrame();
+}
+
+/**
+ * webkit_web_data_source_get_initial_request:
+ * @data_source: a #WebKitWebDataSource
+ *
+ * Returns a reference to the original request that was used to load the web
+ * content. The #WebKitNetworkRequest returned by this method is the request
+ * prior to the "committed" load state. See webkit_web_data_source_get_request
+ * for getting the "committed" request.
+ *
+ * Return value: the original #WebKitNetworkRequest
+ *
+ * Since: 1.1.14
+ */
+WebKitNetworkRequest* webkit_web_data_source_get_initial_request(WebKitWebDataSource* webDataSource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATA_SOURCE(webDataSource), NULL);
+
+    WebKitWebDataSourcePrivate* priv = webDataSource->priv;
+    ResourceRequest request = priv->loader->originalRequest();
+
+    if (priv->initialRequest)
+        g_object_unref(priv->initialRequest);
+
+    priv->initialRequest = webkit_network_request_new_with_core_request(request);
+    return priv->initialRequest;
+}
+
+/**
+ * webkit_web_data_source_get_request:
+ * @data_source: a #WebKitWebDataSource
+ *
+ * Returns a #WebKitNetworkRequest that was used to create this
+ * #WebKitWebDataSource. The #WebKitNetworkRequest returned by this method is
+ * the request that was "committed", and hence, different from the request you
+ * get from the webkit_web_data_source_get_initial_request method.
+ *
+ * Return value: the #WebKitNetworkRequest that created the @data_source or
+ * %NULL if the @data_source is not attached to the frame or the frame hasn't
+ * been loaded.
+ *
+ * Since: 1.1.14
+ */
+WebKitNetworkRequest* webkit_web_data_source_get_request(WebKitWebDataSource* webDataSource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATA_SOURCE(webDataSource), NULL);
+
+    WebKitWebDataSourcePrivate* priv = webDataSource->priv;
+    FrameLoader* frameLoader = priv->loader->frameLoader();
+    if (!frameLoader || !frameLoader->frameHasLoaded())
+        return NULL;
+
+    ResourceRequest request = priv->loader->request();
+
+     if (priv->networkRequest)
+         g_object_unref(priv->networkRequest);
+
+     priv->networkRequest = webkit_network_request_new_with_core_request(request);
+     return priv->networkRequest;
+}
+
+/**
+ * webkit_web_data_source_get_encoding:
+ * @data_source: a #WebKitWebDataSource
+ *
+ * Returns the text encoding name as set in the #WebKitWebView, or if not, the
+ * text encoding of the response.
+ *
+ * Return value: the encoding name of the #WebKitWebView or of the response.
+ *
+ * Since: 1.1.14
+ */
+G_CONST_RETURN gchar* webkit_web_data_source_get_encoding(WebKitWebDataSource* webDataSource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATA_SOURCE(webDataSource), NULL);
+
+    WebKitWebDataSourcePrivate* priv = webDataSource->priv;
+    String textEncodingName = priv->loader->overrideEncoding();
+
+    if (!textEncodingName)
+        textEncodingName = priv->loader->response().textEncodingName();
+
+    CString encoding = textEncodingName.utf8();
+    g_free(priv->textEncoding);
+    priv->textEncoding = g_strdup(encoding.data());
+    return priv->textEncoding;
+}
+
+/**
+ * webkit_web_data_source_is_loading:
+ * @data_source: a #WebKitWebDataSource
+ *
+ * Determines whether the data source is in the process of loading its content.
+ *
+ * Return value: %TRUE if the @data_source is still loading, %FALSE otherwise
+ *
+ * Since: 1.1.14
+ */
+gboolean webkit_web_data_source_is_loading(WebKitWebDataSource* webDataSource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATA_SOURCE(webDataSource), NULL);
+
+    WebKitWebDataSourcePrivate* priv = webDataSource->priv;
+
+    return priv->loader->isLoadingInAPISense();
+}
+
+/**
+ * webkit_web_data_source_get_data:
+ * @data_source: a #WebKitWebDataSource
+ *
+ * Returns the raw data that represents the the frame's content.The data will
+ * be incomplete until the data has finished loading. Returns %NULL if the web
+ * frame hasn't loaded any data. Use webkit_web_data_source_is_loading to test
+ * if data source is in the process of loading.
+ *
+ * Return value: a #GString which contains the raw data that represents the @data_source or %NULL if the
+ * @data_source hasn't loaded any data.
+ *
+ * Since: 1.1.14
+ */
+GString* webkit_web_data_source_get_data(WebKitWebDataSource* webDataSource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATA_SOURCE(webDataSource), NULL);
+
+    WebKitWebDataSourcePrivate* priv = webDataSource->priv;
+
+    RefPtr<SharedBuffer> mainResourceData = priv->loader->mainResourceData();
+
+    if (!mainResourceData)
+        return NULL;
+
+    if (priv->data) {
+        g_string_free(priv->data, TRUE);
+        priv->data = NULL;
+    }
+
+    priv->data = g_string_new_len(mainResourceData->data(), mainResourceData->size());
+    return priv->data;
+}
+
+/**
+ * webkit_web_data_source_get_main_resource:
+ * @data_source: a #WebKitWebDataSource
+ *
+ * Returns the main resource of the @data_source
+ *
+ * Return value: a new #WebKitWebResource representing the main resource of
+ * the @data_source.
+ *
+ * Since: 1.1.14
+ */
+WebKitWebResource* webkit_web_data_source_get_main_resource(WebKitWebDataSource* webDataSource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATA_SOURCE(webDataSource), NULL);
+
+    WebKitWebDataSourcePrivate* priv = webDataSource->priv;
+
+    if (priv->mainresource)
+        return priv->mainresource;
+
+    WebKitWebFrame* webFrame = webkit_web_data_source_get_web_frame(webDataSource);
+    WebKitWebView* webView = getViewFromFrame(webFrame);
+
+    priv->mainresource = WEBKIT_WEB_RESOURCE(g_object_ref(webkit_web_view_get_main_resource(webView)));
+
+    return priv->mainresource;
+}
+
+/**
+ * webkit_web_data_source_get_unreachable_uri:
+ * @data_source: a #WebKitWebDataSource
+ *
+ * Return the unreachable URI of @data_source. The @data_source will have an
+ * unreachable URL if it was created using #WebKitWebFrame's
+ * webkit_web_frame_load_alternate_html_string method.
+ *
+ * Return value: the unreachable URL of @data_source or %NULL if there is no unreachable URL.
+ *
+ * Since: 1.1.14
+ */
+G_CONST_RETURN gchar* webkit_web_data_source_get_unreachable_uri(WebKitWebDataSource* webDataSource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATA_SOURCE(webDataSource), NULL);
+
+    WebKitWebDataSourcePrivate* priv = webDataSource->priv;
+    const KURL& unreachableURL = priv->loader->unreachableURL();
+
+    if (unreachableURL.isEmpty())
+        return NULL;
+
+    g_free(priv->unreachableURL);
+    priv->unreachableURL = g_strdup(unreachableURL.string().utf8().data());
+    return priv->unreachableURL;
+}
+
+/**
+ * webkit_web_data_source_get_subresources
+ * @data_source: a #WebKitWebDataSource
+ *
+ * Gives you a #GList of #WebKitWebResource objects that compose the
+ * #WebView to which this #WebKitWebDataSource is attached.
+ *
+ * Return value: a #GList of #WebKitResource objects; the objects are
+ * owned by WebKit, but the GList must be freed.
+ *
+ * Since: 1.1.15
+ */
+GList* webkit_web_data_source_get_subresources(WebKitWebDataSource* webDataSource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_DATA_SOURCE(webDataSource), NULL);
+
+    WebKitWebFrame* webFrame = webkit_web_data_source_get_web_frame(webDataSource);
+    WebKitWebView* webView = getViewFromFrame(webFrame);
+
+    return webkit_web_view_get_subresources(webView);
+}
diff --git a/WebKit/gtk/webkit/webkitwebdatasource.h b/WebKit/gtk/webkit/webkitwebdatasource.h
new file mode 100644
index 0000000..df83118
--- /dev/null
+++ b/WebKit/gtk/webkit/webkitwebdatasource.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Jan Michael C. Alonzo
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef webkitwebdatasource_h
+#define webkitwebdatasource_h
+
+#include <glib.h>
+#include <glib-object.h>
+
+#include <webkit/webkitdefines.h>
+#include <webkit/webkitwebframe.h>
+#include <webkit/webkitnetworkrequest.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_WEB_DATA_SOURCE            (webkit_web_data_source_get_type())
+#define WEBKIT_WEB_DATA_SOURCE(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_WEB_DATA_SOURCE, WebKitWebDataSource))
+#define WEBKIT_WEB_DATA_SOURCE_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_WEB_DATA_SOURCE, WebKitWebDataSourceClass))
+#define WEBKIT_IS_WEB_DATA_SOURCE(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_WEB_DATA_SOURCE))
+#define WEBKIT_IS_WEB_DATA_SOURCE_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_WEB_DATA_SOURCE))
+#define WEBKIT_WEB_DATA_SOURCE_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_WEB_DATA_SOURCE, WebKitWebDataSourceClass))
+
+typedef struct _WebKitWebDataSourcePrivate WebKitWebDataSourcePrivate;
+
+struct _WebKitWebDataSource {
+    GObject parent_instance;
+
+    /*< private >*/
+    WebKitWebDataSourcePrivate *priv;
+};
+
+struct _WebKitWebDataSourceClass {
+    GObjectClass parent_class;
+
+    /* Padding for future expansion */
+    void (*_webkit_reserved0) (void);
+    void (*_webkit_reserved1) (void);
+    void (*_webkit_reserved2) (void);
+    void (*_webkit_reserved3) (void);
+};
+
+WEBKIT_API GType
+webkit_web_data_source_get_type (void);
+
+WEBKIT_API WebKitWebDataSource *
+webkit_web_data_source_new                    (void);
+
+WEBKIT_API WebKitWebDataSource *
+webkit_web_data_source_new_with_request       (WebKitNetworkRequest *request);
+
+WEBKIT_API WebKitWebFrame *
+webkit_web_data_source_get_web_frame          (WebKitWebDataSource  *data_source);
+
+WEBKIT_API WebKitNetworkRequest *
+webkit_web_data_source_get_initial_request    (WebKitWebDataSource  *data_source);
+
+WEBKIT_API WebKitNetworkRequest *
+webkit_web_data_source_get_request            (WebKitWebDataSource  *data_source);
+
+WEBKIT_API G_CONST_RETURN gchar *
+webkit_web_data_source_get_encoding           (WebKitWebDataSource  *data_source);
+
+WEBKIT_API gboolean
+webkit_web_data_source_is_loading             (WebKitWebDataSource  *data_source);
+
+WEBKIT_API GString *
+webkit_web_data_source_get_data               (WebKitWebDataSource  *data_source);
+
+WEBKIT_API WebKitWebResource *
+webkit_web_data_source_get_main_resource      (WebKitWebDataSource  *data_source);
+
+WEBKIT_API G_CONST_RETURN gchar *
+webkit_web_data_source_get_unreachable_uri    (WebKitWebDataSource  *data_source);
+
+WEBKIT_API GList*
+webkit_web_data_source_get_subresources       (WebKitWebDataSource  *data_source);
+
+G_END_DECLS
+
+#endif /* webkitwebdatasource_h */
diff --git a/WebKit/gtk/webkit/webkitwebframe.cpp b/WebKit/gtk/webkit/webkitwebframe.cpp
index fba084e..67fa632 100644
--- a/WebKit/gtk/webkit/webkitwebframe.cpp
+++ b/WebKit/gtk/webkit/webkitwebframe.cpp
@@ -37,6 +37,7 @@
 #include "AXObjectCache.h"
 #include "CString.h"
 #include "DocumentLoader.h"
+#include "DocumentLoaderGtk.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClientGtk.h"
 #include "FrameTree.h"
@@ -85,6 +86,7 @@ enum {
     LOAD_DONE,
     TITLE_CHANGED,
     HOVERING_OVER_LINK,
+    SCROLLBARS_POLICY_CHANGED,
     LAST_SIGNAL
 };
 
@@ -94,7 +96,9 @@ enum {
     PROP_NAME,
     PROP_TITLE,
     PROP_URI,
-    PROP_LOAD_STATUS
+    PROP_LOAD_STATUS,
+    PROP_HORIZONTAL_SCROLLBAR_POLICY,
+    PROP_VERTICAL_SCROLLBAR_POLICY
 };
 
 static guint webkit_web_frame_signals[LAST_SIGNAL] = { 0, };
@@ -118,6 +122,12 @@ static void webkit_web_frame_get_property(GObject* object, guint prop_id, GValue
     case PROP_LOAD_STATUS:
         g_value_set_enum(value, webkit_web_frame_get_load_status(frame));
         break;
+    case PROP_HORIZONTAL_SCROLLBAR_POLICY:
+        g_value_set_enum(value, webkit_web_frame_get_horizontal_scrollbar_policy(frame));
+        break;
+    case PROP_VERTICAL_SCROLLBAR_POLICY:
+        g_value_set_enum(value, webkit_web_frame_get_vertical_scrollbar_policy(frame));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -133,6 +143,11 @@ void webkit_web_frame_core_frame_gone(WebKitWebFrame* frame)
     frame->priv->coreFrame = 0;
 }
 
+static WebKitWebDataSource* webkit_web_frame_get_data_source_from_core_loader(WebCore::DocumentLoader* loader)
+{
+    return loader ? static_cast<WebKit::DocumentLoader*>(loader)->dataSource() : NULL;
+}
+
 static void webkit_web_frame_finalize(GObject* object)
 {
     WebKitWebFrame* frame = WEBKIT_WEB_FRAME(object);
@@ -214,6 +229,37 @@ static void webkit_web_frame_class_init(WebKitWebFrameClass* frameClass)
             G_TYPE_NONE, 2,
             G_TYPE_STRING, G_TYPE_STRING);
 
+    /**
+     * WebKitWebFrame::scrollbars-policy-changed:
+     * @web_view: the object which received the signal
+     *
+     * Signal emitted when policy for one or both of the scrollbars of
+     * the view has changed. The default handler will apply the new
+     * policy to the container that holds the #WebKitWebFrame if it is
+     * a #GtkScrolledWindow and the frame is the main frame. If you do
+     * not want this to be handled automatically, you need to handle
+     * this signal.
+     *
+     * The exception to this rule is that policies to disable the
+     * scrollbars are applied as %GTK_POLICY_AUTOMATIC instead, since
+     * the size request of the widget would force browser windows to
+     * not be resizable.
+     *
+     * You can obtain the new policies from the
+     * WebKitWebFrame:horizontal-scrollbar-policy and
+     * WebKitWebFrame:vertical-scrollbar-policy properties.
+     *
+     * Since: 1.1.14
+     */
+    webkit_web_frame_signals[SCROLLBARS_POLICY_CHANGED] = g_signal_new("scrollbars-policy-changed",
+            G_TYPE_FROM_CLASS(frameClass),
+            (GSignalFlags)(G_SIGNAL_RUN_LAST | G_SIGNAL_ACTION),
+            0,
+            g_signal_accumulator_true_handled,
+            NULL,
+            webkit_marshal_BOOLEAN__VOID,
+            G_TYPE_BOOLEAN, 0);
+
     /*
      * implementations of virtual methods
      */
@@ -260,6 +306,42 @@ static void webkit_web_frame_class_init(WebKitWebFrameClass* frameClass)
                                                       WEBKIT_LOAD_FINISHED,
                                                       WEBKIT_PARAM_READABLE));
 
+    /**
+     * WebKitWebFrame:horizontal-scrollbar-policy:
+     *
+     * Determines the current policy for the horizontal scrollbar of
+     * the frame. For the main frame, make sure to set the same policy
+     * on the scrollable widget containing the #WebKitWebView, unless
+     * you know what you are doing.
+     *
+     * Since: 1.1.14
+     */
+    g_object_class_install_property(objectClass, PROP_HORIZONTAL_SCROLLBAR_POLICY,
+                                    g_param_spec_enum("horizontal-scrollbar-policy",
+                                                      _("Horizontal Scrollbar Policy"),
+                                                      _("Determines the current policy for the horizontal scrollbar of the frame."),
+                                                      GTK_TYPE_POLICY_TYPE,
+                                                      GTK_POLICY_AUTOMATIC,
+                                                      WEBKIT_PARAM_READABLE));
+
+    /**
+     * WebKitWebFrame:vertical-scrollbar-policy:
+     *
+     * Determines the current policy for the vertical scrollbar of
+     * the frame. For the main frame, make sure to set the same policy
+     * on the scrollable widget containing the #WebKitWebView, unless
+     * you know what you are doing.
+     *
+     * Since: 1.1.14
+     */
+    g_object_class_install_property(objectClass, PROP_VERTICAL_SCROLLBAR_POLICY,
+                                    g_param_spec_enum("vertical-scrollbar-policy",
+                                                      _("Vertical Scrollbar Policy"),
+                                                      _("Determines the current policy for the vertical scrollbar of the frame."),
+                                                      GTK_TYPE_POLICY_TYPE,
+                                                      GTK_POLICY_AUTOMATIC,
+                                                      WEBKIT_PARAM_READABLE));
+
     g_type_class_add_private(frameClass, sizeof(WebKitWebFramePrivate));
 }
 
@@ -295,6 +377,8 @@ WebKitWebFrame* webkit_web_frame_new(WebKitWebView* webView)
     priv->coreFrame = Frame::create(viewPriv->corePage, 0, client).get();
     priv->coreFrame->init();
 
+    priv->origin = NULL;
+
     return frame;
 }
 
@@ -443,7 +527,7 @@ static void webkit_web_frame_load_data(WebKitWebFrame* frame, const gchar* conte
     SubstituteData substituteData(sharedBuffer.release(),
                                   mimeType ? String::fromUTF8(mimeType) : String::fromUTF8("text/html"),
                                   encoding ? String::fromUTF8(encoding) : String::fromUTF8("UTF-8"),
-                                  baseKURL,
+                                  KURL(KURL(), String::fromUTF8(unreachableURL)),
                                   KURL(KURL(), String::fromUTF8(unreachableURL)));
 
     coreFrame->loader()->load(request, substituteData, false);
@@ -603,6 +687,46 @@ JSGlobalContextRef webkit_web_frame_get_global_context(WebKitWebFrame* frame)
 }
 
 /**
+ * webkit_web_frame_get_data_source:
+ * @frame: a #WebKitWebFrame
+ *
+ * Returns the committed data source.
+ *
+ * Return value: the committed #WebKitWebDataSource.
+ *
+ * Since: 1.1.14
+ */
+WebKitWebDataSource* webkit_web_frame_get_data_source(WebKitWebFrame* frame)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_FRAME(frame), NULL);
+
+    Frame* coreFrame = core(frame);
+    return webkit_web_frame_get_data_source_from_core_loader(coreFrame->loader()->documentLoader());
+}
+
+/**
+ * webkit_web_frame_get_provisional_data_source:
+ * @frame: a #WebKitWebFrame
+ *
+ * You use the webkit_web_frame_load_request method to initiate a request that
+ * creates a provisional data source. The provisional data source will
+ * transition to a committed data source once any data has been received. Use
+ * webkit_web_frame_get_data_source to get the committed data source.
+ *
+ * Return value: the provisional #WebKitWebDataSource or %NULL if a load
+ * request is not in progress.
+ *
+ * Since: 1.1.14
+ */
+WebKitWebDataSource* webkit_web_frame_get_provisional_data_source(WebKitWebFrame* frame)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_FRAME(frame), NULL);
+
+    Frame* coreFrame = core(frame);
+    return webkit_web_frame_get_data_source_from_core_loader(coreFrame->loader()->provisionalDocumentLoader());
+}
+
+/**
  * webkit_web_frame_get_children:
  * @frame: a #WebKitWebFrame
  *
@@ -674,6 +798,19 @@ gchar* webkit_web_frame_dump_render_tree(WebKitWebFrame* frame)
     return g_strdup(string.utf8().data());
 }
 
+/**
+ * webkit_web_frame_get_pending_unload_event_count:
+ * @frame: a #WebKitWebFrame
+ *
+ * Return value: number of pending unload events
+ */
+guint webkit_web_frame_get_pending_unload_event_count(WebKitWebFrame* frame)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_FRAME(frame), 0);
+
+    return core(frame)->domWindow()->pendingUnloadEventListeners();
+}
+
 static void begin_print_callback(GtkPrintOperation* op, GtkPrintContext* context, gpointer user_data)
 {
     PrintContext* printContext = reinterpret_cast<PrintContext*>(user_data);
@@ -696,6 +833,9 @@ static void draw_page_callback(GtkPrintOperation* op, GtkPrintContext* context,
 {
     PrintContext* printContext = reinterpret_cast<PrintContext*>(user_data);
 
+    if (page_nr >= printContext->pageCount())
+        return;
+
     cairo_t* cr = gtk_print_context_get_cairo_context(context);
     GraphicsContext ctx(cr);
     float width = gtk_print_context_get_width(context);
@@ -813,7 +953,7 @@ unsigned int webkit_web_frame_number_of_active_animations(WebKitWebFrame* frame)
 gchar* webkit_web_frame_get_response_mime_type(WebKitWebFrame* frame)
 {
     Frame* coreFrame = core(frame);
-    DocumentLoader* docLoader = coreFrame->loader()->documentLoader();
+    WebCore::DocumentLoader* docLoader = coreFrame->loader()->documentLoader();
     String mimeType = docLoader->responseMIMEType();
     return g_strdup(mimeType.utf8().data());
 }
@@ -883,3 +1023,82 @@ AtkObject* webkit_web_frame_get_focused_accessible_element(WebKitWebFrame* frame
     return NULL;
 #endif
 }
+
+GtkPolicyType webkit_web_frame_get_horizontal_scrollbar_policy(WebKitWebFrame* frame)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_FRAME(frame), GTK_POLICY_AUTOMATIC);
+
+    Frame* coreFrame = core(frame);
+    FrameView* view = coreFrame->view();
+    if (!view)
+        return GTK_POLICY_AUTOMATIC;
+
+    ScrollbarMode hMode = view->horizontalScrollbarMode();
+
+    if (hMode == ScrollbarAlwaysOn)
+        return GTK_POLICY_ALWAYS;
+
+    if (hMode == ScrollbarAlwaysOff)
+        return GTK_POLICY_NEVER;
+
+    return GTK_POLICY_AUTOMATIC;
+}
+
+GtkPolicyType webkit_web_frame_get_vertical_scrollbar_policy(WebKitWebFrame* frame)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_FRAME(frame), GTK_POLICY_AUTOMATIC);
+
+    Frame* coreFrame = core(frame);
+    FrameView* view = coreFrame->view();
+    if (!view)
+        return GTK_POLICY_AUTOMATIC;
+
+    ScrollbarMode vMode = view->verticalScrollbarMode();
+
+    if (vMode == ScrollbarAlwaysOn)
+        return GTK_POLICY_ALWAYS;
+
+    if (vMode == ScrollbarAlwaysOff)
+        return GTK_POLICY_NEVER;
+
+    return GTK_POLICY_AUTOMATIC;
+}
+
+/**
+ * webkit_web_frame_get_security_origin:
+ * @frame: a #WebKitWebFrame
+ *
+ * Returns the @frame's security origin.
+ *
+ * Return value: the security origin of @frame
+ *
+ * Since: 1.1.14
+ */
+WebKitSecurityOrigin* webkit_web_frame_get_security_origin(WebKitWebFrame* frame)
+{
+    WebKitWebFramePrivate* priv = frame->priv;
+    if (!priv->coreFrame || !priv->coreFrame->document() || !priv->coreFrame->document()->securityOrigin())
+        return NULL;
+
+    if (priv->origin && priv->origin->priv->coreOrigin.get() == priv->coreFrame->document()->securityOrigin())
+        return priv->origin;
+
+    if (priv->origin)
+        g_object_unref(priv->origin);
+
+    priv->origin = kit(priv->coreFrame->document()->securityOrigin());
+    return priv->origin;
+}
+
+void webkit_web_frame_layout(WebKitWebFrame* frame)
+{
+    Frame* coreFrame = core(frame);
+    if (!coreFrame)
+        return;
+
+    FrameView* view = coreFrame->view();
+    if (!view)
+        return;
+
+    view->layout();
+}
diff --git a/WebKit/gtk/webkit/webkitwebframe.h b/WebKit/gtk/webkit/webkitwebframe.h
index b2e61b9..7a95545 100644
--- a/WebKit/gtk/webkit/webkitwebframe.h
+++ b/WebKit/gtk/webkit/webkitwebframe.h
@@ -18,8 +18,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_WEB_FRAME_H
-#define WEBKIT_WEB_FRAME_H
+#ifndef webkitwebframe_h
+#define webkitwebframe_h
 
 #include <glib-object.h>
 #include <gtk/gtk.h>
@@ -28,6 +28,7 @@
 
 #include <webkit/webkitdefines.h>
 #include <webkit/webkitnetworkrequest.h>
+#include <webkit/webkitwebdatasource.h>
 
 G_BEGIN_DECLS
 
@@ -72,15 +73,19 @@ struct _WebKitWebFrameClass {
  * actual visible content happened; one or more layouts may have
  * happened before that caused nothing to be visible on the screen,
  * because the data available at the time was not significant enough.
- * @WEBKIT_LOAD_FINISHED: This state means either that everything that
- * was required to display the page has been loaded, or that an error
- * has happened.
+ * @WEBKIT_LOAD_FINISHED: This state means that everything that was
+ * required to display the page has been loaded.
+ * @WEBKIT_LOAD_FAILED: This state means that some error occurred
+ * during the page load that prevented it from being completed. You
+ * can connect to the #WebKitWebView::load-error signal if you want to
+ * know precisely what kind of error occurred.
  */
 typedef enum {
     WEBKIT_LOAD_PROVISIONAL,
     WEBKIT_LOAD_COMMITTED,
     WEBKIT_LOAD_FINISHED,
-    WEBKIT_LOAD_FIRST_VISUALLY_NON_EMPTY_LAYOUT
+    WEBKIT_LOAD_FIRST_VISUALLY_NON_EMPTY_LAYOUT,
+    WEBKIT_LOAD_FAILED
 } WebKitLoadStatus;
 
 WEBKIT_API GType
@@ -152,6 +157,21 @@ webkit_web_frame_print              (WebKitWebFrame       *frame);
 WEBKIT_API WebKitLoadStatus
 webkit_web_frame_get_load_status    (WebKitWebFrame       *frame);
 
+WEBKIT_API GtkPolicyType
+webkit_web_frame_get_horizontal_scrollbar_policy (WebKitWebFrame        *frame);
+
+WEBKIT_API GtkPolicyType
+webkit_web_frame_get_vertical_scrollbar_policy   (WebKitWebFrame        *frame);
+
+WEBKIT_API WebKitWebDataSource *
+webkit_web_frame_get_data_source             (WebKitWebFrame       *frame);
+
+WEBKIT_API WebKitWebDataSource *
+webkit_web_frame_get_provisional_data_source (WebKitWebFrame       *frame);
+
+WEBKIT_API WebKitSecurityOrigin*
+webkit_web_frame_get_security_origin         (WebKitWebFrame       *frame);
+
 G_END_DECLS
 
 #endif
diff --git a/WebKit/gtk/webkit/webkitwebhistoryitem.cpp b/WebKit/gtk/webkit/webkitwebhistoryitem.cpp
index a75bc0d..aab8b51 100644
--- a/WebKit/gtk/webkit/webkitwebhistoryitem.cpp
+++ b/WebKit/gtk/webkit/webkitwebhistoryitem.cpp
@@ -297,12 +297,11 @@ WebKitWebHistoryItem* webkit_web_history_item_new()
  */
 WebKitWebHistoryItem* webkit_web_history_item_new_with_data(const gchar* uri, const gchar* title)
 {
-    WebCore::KURL historyUri(uri);
-    WebCore::String historyTitle = WebCore::String::fromUTF8(title);
-
     WebKitWebHistoryItem* webHistoryItem = WEBKIT_WEB_HISTORY_ITEM(g_object_new(WEBKIT_TYPE_WEB_HISTORY_ITEM, NULL));
     WebKitWebHistoryItemPrivate* priv = webHistoryItem->priv;
 
+    WebCore::KURL historyUri(WebCore::KURL(), uri);
+    WebCore::String historyTitle = WebCore::String::fromUTF8(title);
     RefPtr<WebCore::HistoryItem> item = WebCore::HistoryItem::create(historyUri, historyTitle, 0);
     priv->historyItem = item.release().releaseRef();
     webkit_history_item_add(webHistoryItem, priv->historyItem);
diff --git a/WebKit/gtk/webkit/webkitwebhistoryitem.h b/WebKit/gtk/webkit/webkitwebhistoryitem.h
index c8a754a..cafeb36 100644
--- a/WebKit/gtk/webkit/webkitwebhistoryitem.h
+++ b/WebKit/gtk/webkit/webkitwebhistoryitem.h
@@ -17,8 +17,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_WEB_HISTORY_ITEM_H
-#define WEBKIT_WEB_HISTORY_ITEM_H
+#ifndef webkitwebhistoryitem_h
+#define webkitwebhistoryitem_h
 
 #include <glib.h>
 #include <glib-object.h>
@@ -84,4 +84,4 @@ webkit_web_history_item_get_last_visited_time (WebKitWebHistoryItem *web_history
 
 G_END_DECLS
 
-#endif /* WEBKIT_WEB_HISTORY_ITEM_H */
+#endif /* webkitwebhistoryitem_h */
diff --git a/WebKit/gtk/webkit/webkitwebinspector.h b/WebKit/gtk/webkit/webkitwebinspector.h
index 41ccf92..9010e26 100644
--- a/WebKit/gtk/webkit/webkitwebinspector.h
+++ b/WebKit/gtk/webkit/webkitwebinspector.h
@@ -17,8 +17,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef __WEBKIT_WEB_INSPECTOR_H__
-#define __WEBKIT_WEB_INSPECTOR_H__
+#ifndef webkitwebinspector_h
+#define webkitwebinspector_h
 
 #include <glib-object.h>
 
@@ -62,4 +62,4 @@ webkit_web_inspector_get_inspected_uri(WebKitWebInspector* web_inspector);
 
 G_END_DECLS
 
-#endif /* __WEBKIT_WEB_INSPECTOR_H__ */
+#endif /* webkitwebinspector_h */
diff --git a/WebKit/gtk/webkit/webkitwebnavigationaction.h b/WebKit/gtk/webkit/webkitwebnavigationaction.h
index c437c50..dbb47a8 100644
--- a/WebKit/gtk/webkit/webkitwebnavigationaction.h
+++ b/WebKit/gtk/webkit/webkitwebnavigationaction.h
@@ -17,8 +17,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_WEB_NAVIGATION_ACTION_H
-#define WEBKIT_WEB_NAVIGATION_ACTION_H
+#ifndef webkitwebnavigationaction_h
+#define webkitwebnavigationaction_h
 
 #include <glib-object.h>
 
diff --git a/WebKit/gtk/webkit/webkitwebpolicydecision.cpp b/WebKit/gtk/webkit/webkitwebpolicydecision.cpp
index b2bab6b..5ef6310 100644
--- a/WebKit/gtk/webkit/webkitwebpolicydecision.cpp
+++ b/WebKit/gtk/webkit/webkitwebpolicydecision.cpp
@@ -86,7 +86,7 @@ void webkit_web_policy_decision_use(WebKitWebPolicyDecision* decision)
     WebKitWebPolicyDecisionPrivate* priv = decision->priv;
 
     if (!priv->isCancelled)
-        (core(priv->frame)->loader()->*(priv->framePolicyFunction))(WebCore::PolicyUse);
+        (core(priv->frame)->loader()->policyChecker()->*(priv->framePolicyFunction))(WebCore::PolicyUse);
 }
 
 /**
@@ -104,7 +104,7 @@ void webkit_web_policy_decision_ignore(WebKitWebPolicyDecision* decision)
     WebKitWebPolicyDecisionPrivate* priv = decision->priv;
 
     if (!priv->isCancelled)
-        (core(priv->frame)->loader()->*(priv->framePolicyFunction))(WebCore::PolicyIgnore);
+        (core(priv->frame)->loader()->policyChecker()->*(priv->framePolicyFunction))(WebCore::PolicyIgnore);
 }
 
 /**
@@ -122,7 +122,7 @@ void webkit_web_policy_decision_download(WebKitWebPolicyDecision* decision)
     WebKitWebPolicyDecisionPrivate* priv = decision->priv;
 
     if (!priv->isCancelled)
-        (core(priv->frame)->loader()->*(priv->framePolicyFunction))(WebCore::PolicyDownload);
+        (core(priv->frame)->loader()->policyChecker()->*(priv->framePolicyFunction))(WebCore::PolicyDownload);
 }
 
 void webkit_web_policy_decision_cancel(WebKitWebPolicyDecision* decision)
diff --git a/WebKit/gtk/webkit/webkitwebpolicydecision.h b/WebKit/gtk/webkit/webkitwebpolicydecision.h
index f1ec963..2b61837 100644
--- a/WebKit/gtk/webkit/webkitwebpolicydecision.h
+++ b/WebKit/gtk/webkit/webkitwebpolicydecision.h
@@ -17,8 +17,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_WEB_POLICY_DECISION_H
-#define WEBKIT_WEB_POLICY_DECISION_H
+#ifndef webkitwebpolicydecision_h
+#define webkitwebpolicydecision_h
 
 #include <glib-object.h>
 #include <stdint.h>
diff --git a/WebKit/gtk/webkit/webkitwebresource.cpp b/WebKit/gtk/webkit/webkitwebresource.cpp
new file mode 100644
index 0000000..e995e08
--- /dev/null
+++ b/WebKit/gtk/webkit/webkitwebresource.cpp
@@ -0,0 +1,401 @@
+/*
+ * Copyright (C) 2009 Jan Michael C. Alonzo
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#include "webkitwebresource.h"
+#include "webkitprivate.h"
+
+#include "ArchiveResource.h"
+#include "CString.h"
+#include "KURL.h"
+#include "PlatformString.h"
+#include "SharedBuffer.h"
+#include "webkitenumtypes.h"
+#include "webkitmarshal.h"
+#include "wtf/Assertions.h"
+
+#include <glib.h>
+#include <glib/gi18n-lib.h>
+
+/**
+ * SECTION:webkitwebresource
+ * @short_description: Represents a downloaded URI.
+ * @see_also: #WebKitWebDataSource
+ *
+ * A web resource encapsulates the data of the download as well as the URI,
+ * MIME type and frame name of the resource.
+ */
+
+using namespace WebCore;
+using namespace WebKit;
+
+enum {
+    PROP_0,
+
+    PROP_URI,
+    PROP_MIME_TYPE,
+    PROP_ENCODING,
+    PROP_FRAME_NAME
+};
+
+G_DEFINE_TYPE(WebKitWebResource, webkit_web_resource, G_TYPE_OBJECT);
+
+static void webkit_web_resource_get_property(GObject* object, guint prop_id, GValue* value, GParamSpec* pspec);
+static void webkit_web_resource_set_property(GObject* object, guint prop_id, const GValue* value, GParamSpec* pspec);
+
+static void webkit_web_resource_cleanup(WebKitWebResource* webResource)
+{
+    WebKitWebResourcePrivate* priv = webResource->priv;
+
+    g_free(priv->uri);
+    priv->uri = NULL;
+
+    g_free(priv->mimeType);
+    priv->mimeType = NULL;
+
+    g_free(priv->textEncoding);
+    priv->textEncoding = NULL;
+
+    g_free(priv->frameName);
+    priv->frameName = NULL;
+
+    if (priv->data)
+        g_string_free(priv->data, TRUE);
+    priv->data = NULL;
+}
+
+static void webkit_web_resource_dispose(GObject* object)
+{
+    WebKitWebResource* webResource = WEBKIT_WEB_RESOURCE(object);
+    WebKitWebResourcePrivate* priv = webResource->priv;
+
+    if (priv->resource) {
+        priv->resource->deref();
+        priv->resource = 0;
+    }
+
+    G_OBJECT_CLASS(webkit_web_resource_parent_class)->dispose(object);
+}
+
+static void webkit_web_resource_finalize(GObject* object)
+{
+    WebKitWebResource* webResource = WEBKIT_WEB_RESOURCE(object);
+
+    webkit_web_resource_cleanup(webResource);
+
+    G_OBJECT_CLASS(webkit_web_resource_parent_class)->finalize(object);
+}
+
+static void webkit_web_resource_class_init(WebKitWebResourceClass* klass)
+{
+    GObjectClass* gobject_class = G_OBJECT_CLASS(klass);
+
+    gobject_class->dispose = webkit_web_resource_dispose;
+    gobject_class->finalize = webkit_web_resource_finalize;
+    gobject_class->get_property = webkit_web_resource_get_property;
+    gobject_class->set_property = webkit_web_resource_set_property;
+
+    /**
+     * WebKitWebResource:uri:
+     *
+     * The URI of the web resource
+     *
+     * Since: 1.1.14
+     */
+    g_object_class_install_property(gobject_class,
+                                    PROP_URI,
+                                    g_param_spec_string(
+                                    "uri",
+                                    _("URI"),
+                                    _("The uri of the resource"),
+                                    NULL,
+                                    (GParamFlags)(WEBKIT_PARAM_READWRITE|G_PARAM_CONSTRUCT_ONLY)));
+    /**
+     * WebKitWebResource:mime-type:
+     *
+     * The MIME type of the web resource.
+     *
+     * Since: 1.1.14
+     */
+    g_object_class_install_property(gobject_class,
+                                    PROP_MIME_TYPE,
+                                    g_param_spec_string(
+                                    "mime-type",
+                                    _("MIME Type"),
+                                    _("The MIME type of the resource"),
+                                    NULL,
+                                    WEBKIT_PARAM_READABLE));
+    /**
+     * WebKitWebResource:encoding:
+     *
+     * The encoding name to which the web resource was encoded in.
+     *
+     * Since: 1.1.14
+     */
+    g_object_class_install_property(gobject_class,
+                                    PROP_ENCODING,
+                                    g_param_spec_string(
+                                    "encoding",
+                                    _("Encoding"),
+                                    _("The text encoding name of the resource"),
+                                    NULL,
+                                    WEBKIT_PARAM_READABLE));
+
+    /**
+     * WebKitWebResource:frame-name:
+     *
+     * The frame name for the web resource.
+     *
+     * Since: 1.1.14
+     */
+    g_object_class_install_property(gobject_class,
+                                    PROP_FRAME_NAME,
+                                    g_param_spec_string(
+                                    "frame-name",
+                                    _("Frame Name"),
+                                    _("The frame name of the resource"),
+                                    NULL,
+                                    WEBKIT_PARAM_READABLE));
+
+    g_type_class_add_private(gobject_class, sizeof(WebKitWebResourcePrivate));
+}
+
+static void webkit_web_resource_get_property(GObject* object, guint prop_id, GValue* value, GParamSpec* pspec)
+{
+    WebKitWebResource* webResource = WEBKIT_WEB_RESOURCE(object);
+
+    switch (prop_id) {
+    case PROP_URI:
+        g_value_set_string(value, webkit_web_resource_get_uri(webResource));
+        break;
+    case PROP_MIME_TYPE:
+        g_value_set_string(value, webkit_web_resource_get_mime_type(webResource));
+        break;
+    case PROP_ENCODING:
+        g_value_set_string(value, webkit_web_resource_get_encoding(webResource));
+        break;
+    case PROP_FRAME_NAME:
+        g_value_set_string(value, webkit_web_resource_get_frame_name(webResource));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
+        break;
+    }
+}
+
+static void webkit_web_resource_set_property(GObject* object, guint prop_id, const GValue* value, GParamSpec* pspec)
+{
+    WebKitWebResource* webResource = WEBKIT_WEB_RESOURCE(object);
+
+    switch (prop_id) {
+    case PROP_URI:
+        g_free(webResource->priv->uri);
+        webResource->priv->uri = g_value_dup_string(value);
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
+        break;
+    }
+}
+
+static void webkit_web_resource_init(WebKitWebResource* webResource)
+{
+    webResource->priv = WEBKIT_WEB_RESOURCE_GET_PRIVATE(webResource);
+}
+
+// internal use only
+WebKitWebResource* webkit_web_resource_new_with_core_resource(PassRefPtr<ArchiveResource> resource)
+{
+    WebKitWebResource* webResource = WEBKIT_WEB_RESOURCE(g_object_new(WEBKIT_TYPE_WEB_RESOURCE, NULL));
+    WebKitWebResourcePrivate* priv = webResource->priv;
+    priv->resource = resource.releaseRef();
+
+    return webResource;
+}
+
+void webkit_web_resource_init_with_core_resource(WebKitWebResource* webResource, PassRefPtr<ArchiveResource> resource)
+{
+    ASSERT(resource);
+
+    WebKitWebResourcePrivate* priv = webResource->priv;
+
+    if (priv->resource)
+        priv->resource->deref();
+
+    priv->resource = resource.releaseRef();
+}
+
+/**
+ * webkit_web_resource_new:
+ * @data: the data to initialize the #WebKitWebResource
+ * @length: the length of @data
+ * @uri: the uri of the #WebKitWebResource
+ * @mime_type: the MIME type of the #WebKitWebResource
+ * @text_encoding_name: the text encoding name of the #WebKitWebResource
+ * @frame_name: the frame name of the #WebKitWebResource
+ *
+ * Returns a new #WebKitWebResource. The @text_encoding_name can be %NULL. The
+ * @frame_name argument can be used if the resource represents contents of an
+ * entire HTML frame, otherwise pass %NULL.
+ *
+ * Return value: a new #WebKitWebResource
+ *
+ * Since: 1.1.14
+ */
+WebKitWebResource* webkit_web_resource_new(const gchar* data,
+                                           gssize size,
+                                           const gchar* uri,
+                                           const gchar* mimeType,
+                                           const gchar* encoding,
+                                           const gchar* frameName)
+{
+    g_return_val_if_fail(data, NULL);
+    g_return_val_if_fail(uri, NULL);
+    g_return_val_if_fail(mimeType, NULL);
+
+    if (size < 0)
+        size = strlen(data);
+
+    RefPtr<SharedBuffer> buffer = SharedBuffer::create(data, size);
+    WebKitWebResource* webResource = webkit_web_resource_new_with_core_resource(ArchiveResource::create(buffer, KURL(KURL(), String::fromUTF8(uri)), String::fromUTF8(mimeType), String::fromUTF8(encoding), String::fromUTF8(frameName)));
+
+    return webResource;
+}
+
+/**
+ * webkit_web_resource_get_data:
+ * @web_resource: a #WebKitWebResource
+ *
+ * Returns the data of the @webResource.
+ *
+ * Return value: a #GString containing the character data of the @webResource.
+ * The string is owned by WebKit and should not be freed or destroyed.
+ *
+ * Since: 1.1.14
+ */
+GString* webkit_web_resource_get_data(WebKitWebResource* webResource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_RESOURCE(webResource), NULL);
+
+    WebKitWebResourcePrivate* priv = webResource->priv;
+
+    if (!priv->resource)
+        return NULL;
+
+    if (!priv->data)
+        priv->data = g_string_new_len(priv->resource->data()->data(), priv->resource->data()->size());
+
+    return priv->data;
+}
+
+/**
+ * webkit_web_resource_get_uri:
+ * @web_resource: a #WebKitWebResource
+ *
+ * Return value: the URI of the resource
+ *
+ * Since: 1.1.14
+ */
+G_CONST_RETURN gchar* webkit_web_resource_get_uri(WebKitWebResource* webResource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_RESOURCE(webResource), NULL);
+
+    WebKitWebResourcePrivate* priv = webResource->priv;
+
+
+    // We may have an URI without having a resource assigned to us (e.g., if the
+    // FrameLoaderClient only had a ResourceRequest when we got created
+    if (priv->uri)
+        return priv->uri;
+
+    if (!priv->resource)
+        return NULL;
+
+    priv->uri = g_strdup(priv->resource->url().string().utf8().data());
+
+    return priv->uri;
+}
+
+/**
+ * webkit_web_resource_get_mime_type:
+ * @web_resource: a #WebKitWebResource
+ *
+ * Return value: the MIME type of the resource
+ *
+ * Since: 1.1.14
+ */
+G_CONST_RETURN gchar* webkit_web_resource_get_mime_type(WebKitWebResource* webResource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_RESOURCE(webResource), NULL);
+
+    WebKitWebResourcePrivate* priv = webResource->priv;
+    if (!priv->resource)
+        return NULL;
+
+    if (!priv->mimeType)
+        priv->mimeType = g_strdup(priv->resource->mimeType().utf8().data());
+
+    return priv->mimeType;
+}
+
+/**
+ * webkit_web_resource_get_encoding:
+ * @web_resource: a #WebKitWebResource
+ *
+ * Return value: the encoding name of the resource
+ *
+ * Since: 1.1.14
+ */
+G_CONST_RETURN gchar* webkit_web_resource_get_encoding(WebKitWebResource* webResource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_RESOURCE(webResource), NULL);
+
+    WebKitWebResourcePrivate* priv = webResource->priv;
+    if (!priv->resource)
+        return NULL;
+
+    if (!priv->textEncoding)
+        priv->textEncoding = g_strdup(priv->resource->textEncoding().utf8().data());
+
+    return priv->textEncoding;
+}
+
+/**
+ * webkit_web_resource_get_frame_name:
+ * @web_resource: a #WebKitWebResource
+ *
+ * Return value: the frame name of the resource.
+ *
+ * Since: 1.1.14
+ */
+G_CONST_RETURN gchar* webkit_web_resource_get_frame_name(WebKitWebResource* webResource)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_RESOURCE(webResource), NULL);
+
+    WebKitWebResourcePrivate* priv = webResource->priv;
+    if (!priv->resource)
+        return NULL;
+
+    if (!priv->frameName)
+        priv->frameName = g_strdup(priv->resource->frameName().utf8().data());
+
+    return priv->frameName;
+}
+
diff --git a/WebKit/gtk/webkit/webkitwebresource.h b/WebKit/gtk/webkit/webkitwebresource.h
new file mode 100644
index 0000000..05f6066
--- /dev/null
+++ b/WebKit/gtk/webkit/webkitwebresource.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Jan Michael C. Alonzo
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef webkitwebresource_h
+#define webkitwebresource_h
+
+#include <glib.h>
+#include <glib-object.h>
+
+#include <webkit/webkitdefines.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_WEB_RESOURCE            (webkit_web_resource_get_type())
+#define WEBKIT_WEB_RESOURCE(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_WEB_RESOURCE, WebKitWebResource))
+#define WEBKIT_WEB_RESOURCE_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_WEB_RESOURCE, WebKitWebResourceClass))
+#define WEBKIT_IS_WEB_RESOURCE(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_WEB_RESOURCE))
+#define WEBKIT_IS_WEB_RESOURCE_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_WEB_RESOURCE))
+#define WEBKIT_WEB_RESOURCE_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_WEB_RESOURCE, WebKitWebResourceClass))
+
+typedef struct _WebKitWebResourcePrivate WebKitWebResourcePrivate;
+
+struct _WebKitWebResource {
+    GObject parent_instance;
+
+    /*< private >*/
+    WebKitWebResourcePrivate *priv;
+};
+
+struct _WebKitWebResourceClass {
+    GObjectClass parent_class;
+
+    /* Padding for future expansion */
+    void (*_webkit_reserved0) (void);
+    void (*_webkit_reserved1) (void);
+    void (*_webkit_reserved2) (void);
+    void (*_webkit_reserved3) (void);
+};
+
+WEBKIT_API GType
+webkit_web_resource_get_type (void);
+
+WEBKIT_API WebKitWebResource *
+webkit_web_resource_new                    (const gchar        *data,
+                                            gssize             size,
+                                            const gchar        *uri,
+                                            const gchar        *mime_type,
+                                            const gchar        *encoding,
+                                            const gchar        *frame_name);
+
+WEBKIT_API GString *
+webkit_web_resource_get_data               (WebKitWebResource  *web_resource);
+
+WEBKIT_API G_CONST_RETURN gchar *
+webkit_web_resource_get_uri                (WebKitWebResource  *web_resource);
+
+WEBKIT_API G_CONST_RETURN gchar *
+webkit_web_resource_get_mime_type          (WebKitWebResource  *web_resource);
+
+WEBKIT_API G_CONST_RETURN gchar *
+webkit_web_resource_get_encoding           (WebKitWebResource  *web_resource);
+
+WEBKIT_API G_CONST_RETURN gchar *
+webkit_web_resource_get_frame_name         (WebKitWebResource  *web_resource);
+
+G_END_DECLS
+
+#endif /* webkitwebresource_h */
diff --git a/WebKit/gtk/webkit/webkitwebsettings.cpp b/WebKit/gtk/webkit/webkitwebsettings.cpp
index 061d3e2..588d5bd 100644
--- a/WebKit/gtk/webkit/webkitwebsettings.cpp
+++ b/WebKit/gtk/webkit/webkitwebsettings.cpp
@@ -24,6 +24,7 @@
 #include "config.h"
 #include "webkitwebsettings.h"
 
+#include "webkitenumtypes.h"
 #include "webkitprivate.h"
 #include "webkitversion.h"
 
@@ -93,6 +94,8 @@ struct _WebKitWebSettingsPrivate {
     gchar* user_agent;
     gboolean javascript_can_open_windows_automatically;
     gboolean enable_offline_web_application_cache;
+    WebKitEditingBehavior editing_behavior;
+    gboolean enable_universal_access_from_file_uris;
 };
 
 #define WEBKIT_WEB_SETTINGS_GET_PRIVATE(obj) (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_SETTINGS, WebKitWebSettingsPrivate))
@@ -130,7 +133,9 @@ enum {
     PROP_ENABLE_XSS_AUDITOR,
     PROP_USER_AGENT,
     PROP_JAVASCRIPT_CAN_OPEN_WINDOWS_AUTOMATICALLY,
-    PROP_ENABLE_OFFLINE_WEB_APPLICATION_CACHE
+    PROP_ENABLE_OFFLINE_WEB_APPLICATION_CACHE,
+    PROP_EDITING_BEHAVIOR,
+    PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS
 };
 
 // Create a default user agent string
@@ -433,7 +438,7 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
     *
     * This is currently experimental for WebKitGtk.
     *
-    * Since 1.1.2
+    * Since: 1.1.2
     */
     g_object_class_install_property(gobject_class,
                                     PROP_ENABLE_PRIVATE_BROWSING,
@@ -449,7 +454,7 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
     *
     * Whether to enable spell checking while typing.
     *
-    * Since 1.1.6
+    * Since: 1.1.6
     */
     g_object_class_install_property(gobject_class,
                                     PROP_ENABLE_SPELL_CHECKING,
@@ -473,7 +478,7 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
     * If no value is specified then the value returned by
     * gtk_get_default_language will be used.
     *
-    * Since 1.1.6
+    * Since: 1.1.6
     */
     g_object_class_install_property(gobject_class,
                                     PROP_SPELL_CHECKING_LANGUAGES,
@@ -489,7 +494,7 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
     *
     * Whether to enable caret browsing mode.
     *
-    * Since 1.1.6
+    * Since: 1.1.6
     */
     g_object_class_install_property(gobject_class,
                                     PROP_ENABLE_CARET_BROWSING,
@@ -505,7 +510,7 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
     * SQL database allows web pages to store structured data and be able to
     * use SQL to manipulate that data asynchronously.
     *
-    * Since 1.1.8
+    * Since: 1.1.8
     */
     g_object_class_install_property(gobject_class,
                                     PROP_ENABLE_HTML5_DATABASE,
@@ -521,7 +526,7 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
     * Whether to enable HTML5 localStorage support. localStorage provides
     * simple synchronous storage access.
     *
-    * Since 1.1.8
+    * Since: 1.1.8
     */
     g_object_class_install_property(gobject_class,
                                     PROP_ENABLE_HTML5_LOCAL_STORAGE,
@@ -536,7 +541,7 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
     * Whether to enable the XSS Auditor. This feature filters some kinds of
     * reflective XSS attacks on vulnerable web sites.
     *
-    * Since 1.1.11
+    * Since: 1.1.11
     */
     g_object_class_install_property(gobject_class,
                                     PROP_ENABLE_XSS_AUDITOR,
@@ -571,7 +576,7 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
     * Whether JavaScript can open popup windows automatically without user
     * intervention.
     *
-    * Since 1.1.11
+    * Since: 1.1.11
     */
     g_object_class_install_property(gobject_class,
                                     PROP_JAVASCRIPT_CAN_OPEN_WINDOWS_AUTOMATICALLY,
@@ -587,7 +592,7 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
     * Web Application Cache ensures web applications are available even when
     * the user is not connected to the network.
     *
-    * Since 1.1.13
+    * Since: 1.1.13
     */
     g_object_class_install_property(gobject_class,
                                     PROP_ENABLE_OFFLINE_WEB_APPLICATION_CACHE,
@@ -597,7 +602,50 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
                                                          TRUE,
                                                          flags));
 
+    COMPILE_ASSERT(static_cast<int>(WEBKIT_EDITING_BEHAVIOR_MAC) == static_cast<int>(WebCore::EditingMacBehavior), editing_behavior_type_mac_match);
+    COMPILE_ASSERT(static_cast<int>(WEBKIT_EDITING_BEHAVIOR_WINDOWS) == static_cast<int>(WebCore::EditingWindowsBehavior), editing_behavior_type_windows_match);
 
+    /**
+    * WebKitWebSettings:editing-behavior
+    *
+    * This setting controls various editing behaviors that differ
+    * between platforms and that have been combined in two groups,
+    * 'Mac' and 'Windows'. Some examples:
+    * 
+    *  1) Clicking below the last line of an editable area puts the
+    * caret at the end of the last line on Mac, but in the middle of
+    * the last line on Windows.
+    *
+    *  2) Pushing down the arrow key on the last line puts the caret
+    *  at the end of the last line on Mac, but does nothing on
+    *  Windows. A similar case exists on the top line.
+    *
+    * Since: 1.1.13
+    */
+    g_object_class_install_property(gobject_class,
+                                    PROP_EDITING_BEHAVIOR,
+                                    g_param_spec_enum("editing-behavior",
+                                                      _("Editing behavior"),
+                                                      _("The behavior mode to use in editing mode"),
+                                                      WEBKIT_TYPE_EDITING_BEHAVIOR,
+                                                      WEBKIT_EDITING_BEHAVIOR_MAC,
+                                                      flags));
+
+    /**
+     * WebKitWebSettings:enable-universal-access-from-file-uris
+     *
+     * Whether to allow files loaded through file:// URIs universal access to
+     * all pages.
+     *
+     * Since: 1.1.13
+     */
+    g_object_class_install_property(gobject_class,
+                                    PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS,
+                                    g_param_spec_boolean("enable-universal-access-from-file-uris",
+                                                         _("Enable universal access from file URIs"),
+                                                         _("Whether to allow universal access from file URIs"),
+                                                         FALSE,
+                                                         flags));
 
     g_type_class_add_private(klass, sizeof(WebKitWebSettingsPrivate));
 }
@@ -779,6 +827,12 @@ static void webkit_web_settings_set_property(GObject* object, guint prop_id, con
     case PROP_ENABLE_OFFLINE_WEB_APPLICATION_CACHE:
         priv->enable_offline_web_application_cache = g_value_get_boolean(value);
         break;
+    case PROP_EDITING_BEHAVIOR:
+        priv->editing_behavior = static_cast<WebKitEditingBehavior>(g_value_get_enum(value));
+        break;
+    case PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS:
+        priv->enable_universal_access_from_file_uris = g_value_get_boolean(value);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -884,7 +938,13 @@ static void webkit_web_settings_get_property(GObject* object, guint prop_id, GVa
    case PROP_ENABLE_OFFLINE_WEB_APPLICATION_CACHE:
         g_value_set_boolean(value, priv->enable_offline_web_application_cache);
         break;
-    default:
+    case PROP_EDITING_BEHAVIOR:
+        g_value_set_enum(value, priv->editing_behavior);
+        break;
+   case PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS:
+        g_value_set_boolean(value, priv->enable_universal_access_from_file_uris);
+        break;
+   default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
     }
@@ -946,6 +1006,8 @@ WebKitWebSettings* webkit_web_settings_copy(WebKitWebSettings* web_settings)
                  "user-agent", webkit_web_settings_get_user_agent(web_settings),
                  "javascript-can-open-windows-automatically", priv->javascript_can_open_windows_automatically,
                  "enable-offline-web-application-cache", priv->enable_offline_web_application_cache,
+                 "editing-behavior", priv->editing_behavior,
+                 "enable-universal-access-from-file-uris", priv->enable_universal_access_from_file_uris,
                  NULL));
 
     return copy;
diff --git a/WebKit/gtk/webkit/webkitwebsettings.h b/WebKit/gtk/webkit/webkitwebsettings.h
index 9eac321..d8dafd9 100644
--- a/WebKit/gtk/webkit/webkitwebsettings.h
+++ b/WebKit/gtk/webkit/webkitwebsettings.h
@@ -18,8 +18,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef __WEBKIT_WEB_SETTINGS_H__
-#define __WEBKIT_WEB_SETTINGS_H__
+#ifndef webkitwebsettings_h
+#define webkitwebsettings_h
 
 #include <glib-object.h>
 
@@ -34,6 +34,11 @@ G_BEGIN_DECLS
 #define WEBKIT_IS_WEB_SETTINGS_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_WEB_SETTINGS))
 #define WEBKIT_WEB_SETTINGS_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_WEB_SETTINGS, WebKitWebSettingsClass))
 
+typedef enum {
+    WEBKIT_EDITING_BEHAVIOR_MAC,
+    WEBKIT_EDITING_BEHAVIOR_WINDOWS
+} WebKitEditingBehavior;
+
 typedef struct _WebKitWebSettingsPrivate WebKitWebSettingsPrivate;
 
 struct _WebKitWebSettings {
@@ -67,4 +72,4 @@ webkit_web_settings_get_user_agent    (WebKitWebSettings *web_settings);
 
 G_END_DECLS
 
-#endif /* __WEBKIT_WEB_SETTINGS_H__ */
+#endif /* webkitwebsettings_h */
diff --git a/WebKit/gtk/webkit/webkitwebview.cpp b/WebKit/gtk/webkit/webkitwebview.cpp
index ec59e60..47d7d98 100644
--- a/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/WebKit/gtk/webkit/webkitwebview.cpp
@@ -6,7 +6,7 @@
  *  Copyright (C) 2008 Jan Alonzo <jmalonzo@unpluggable.com>
  *  Copyright (C) 2008 Gustavo Noronha Silva <gns@gnome.org>
  *  Copyright (C) 2008 Nuanti Ltd.
- *  Copyright (C) 2008 Collabora Ltd.
+ *  Copyright (C) 2008, 2009 Collabora Ltd.
  *  Copyright (C) 2009 Igalia S.L.
  *
  *  This library is free software; you can redistribute it and/or
@@ -25,11 +25,13 @@
  */
 
 #include "config.h"
+#include "webkitwebview.h"
 
 #include "webkitdownload.h"
-#include "webkitwebview.h"
 #include "webkitenumtypes.h"
 #include "webkitmarshal.h"
+#include "webkitnetworkrequest.h"
+#include "webkitnetworkresponse.h"
 #include "webkitprivate.h"
 #include "webkitwebinspector.h"
 #include "webkitwebbackforwardlist.h"
@@ -60,11 +62,13 @@
 #include "InspectorClientGtk.h"
 #include "FrameLoader.h"
 #include "FrameView.h"
+#include "MouseEventWithHitTestResults.h"
 #include "PasteboardHelper.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformWheelEvent.h"
 #include "ProgressTracker.h"
 #include "ResourceHandle.h"
+#include "RenderView.h"
 #include "ScriptValue.h"
 #include "Scrollbar.h"
 #include <wtf/GOwnPtr.h>
@@ -96,7 +100,7 @@
  * gtk_container_add (GTK_CONTAINER (main_window), scrolled_window);
  *
  * /<!-- -->* Open a webpage *<!-- -->/
- * webkit_web_view_open (WEBKIT_WEB_VIEW (web_view), "http://www.gnome.org");
+ * webkit_web_view_load_uri (WEBKIT_WEB_VIEW (web_view), "http://www.gnome.org");
  *
  * /<!-- -->* Show the result *<!-- -->/
  * gtk_window_set_default_size (GTK_WINDOW (main_window), 800, 600);
@@ -142,6 +146,10 @@ enum {
     PRINT_REQUESTED,
     PLUGIN_WIDGET,
     CLOSE_WEB_VIEW,
+    UNDO,
+    REDO,
+    DATABASE_QUOTA_EXCEEDED,
+    RESOURCE_REQUEST_STARTING,
     LAST_SIGNAL
 };
 
@@ -172,6 +180,15 @@ G_DEFINE_TYPE(WebKitWebView, webkit_web_view, GTK_TYPE_CONTAINER)
 static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GParamSpec* pspec, WebKitWebView* webView);
 static void webkit_web_view_set_window_features(WebKitWebView* webView, WebKitWebWindowFeatures* webWindowFeatures);
 
+static void destroy_menu_cb(GtkObject* object, gpointer data)
+{
+    WebKitWebView* webView = WEBKIT_WEB_VIEW(data);
+    WebKitWebViewPrivate* priv = WEBKIT_WEB_VIEW_GET_PRIVATE(webView);
+
+    g_object_unref(priv->currentMenu);
+    priv->currentMenu = NULL;
+}
+
 static gboolean webkit_web_view_forward_context_menu_event(WebKitWebView* webView, const PlatformMouseEvent& event)
 {
     Page* page = core(webView);
@@ -203,8 +220,14 @@ static gboolean webkit_web_view_forward_context_menu_event(WebKitWebView* webVie
         return FALSE;
 
     WebKitWebViewPrivate* priv = WEBKIT_WEB_VIEW_GET_PRIVATE(webView);
+    priv->currentMenu = GTK_MENU(g_object_ref(menu));
     priv->lastPopupXPosition = event.globalX();
     priv->lastPopupYPosition = event.globalY();
+
+    g_signal_connect(menu, "destroy",
+                     G_CALLBACK(destroy_menu_cb),
+                     NULL);
+
     gtk_menu_popup(menu, NULL, NULL,
                    NULL,
                    priv, event.button() + 1, gtk_get_current_event_time());
@@ -268,7 +291,7 @@ static gboolean webkit_web_view_popup_menu_handler(GtkWidget* widget)
     }
 
     int x, y;
-    gdk_window_get_origin(GTK_WIDGET(view->hostWindow()->platformWindow())->window, &x, &y);
+    gdk_window_get_origin(GTK_WIDGET(view->hostWindow()->platformPageClient())->window, &x, &y);
 
     // FIXME: The IntSize(0, -1) is a hack to get the hit-testing to result in the selected element.
     // Ideally we'd have the position of a context menu event be separate from its target node.
@@ -649,7 +672,7 @@ static void webkit_web_view_realize(GtkWidget* widget)
     gdk_window_set_user_data(widget->window, widget);
 
     widget->style = gtk_style_attach(widget->style, widget->window);
-    gdk_window_set_background(widget->window, &widget->style->base[GTK_WIDGET_STATE(widget)]);
+    gtk_style_set_background(widget->style, widget->window, GTK_STATE_NORMAL);
 
     WebKitWebView* webView = WEBKIT_WEB_VIEW(widget);
     WebKitWebViewPrivate* priv = webView->priv;
@@ -690,8 +713,6 @@ static void webkit_web_view_container_add(GtkContainer* container, GtkWidget* wi
     WebKitWebViewPrivate* priv = webView->priv;
 
     priv->children.add(widget);
-    if (GTK_WIDGET_REALIZED(container))
-        gtk_widget_set_parent_window(widget, GTK_WIDGET(webView)->window);
     gtk_widget_set_parent(widget, GTK_WIDGET(container));
 }
 
@@ -866,6 +887,18 @@ static void webkit_web_view_real_copy_clipboard(WebKitWebView* webView)
     frame->editor()->command("Copy").execute();
 }
 
+static void webkit_web_view_real_undo(WebKitWebView* webView)
+{
+    Frame* frame = core(webView)->focusController()->focusedOrMainFrame();
+    frame->editor()->command("Undo").execute();
+}
+
+static void webkit_web_view_real_redo(WebKitWebView* webView)
+{
+    Frame* frame = core(webView)->focusController()->focusedOrMainFrame();
+    frame->editor()->command("Redo").execute();
+}
+
 static gboolean webkit_web_view_real_move_cursor (WebKitWebView* webView, GtkMovementStep step, gint count)
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_VIEW (webView), FALSE);
@@ -976,6 +1009,16 @@ static void webkit_web_view_dispose(GObject* object)
         priv->paste_target_list = NULL;
     }
 
+    if (priv->mainResource) {
+        g_object_unref(priv->mainResource);
+        priv->mainResource = NULL;
+    }
+
+    if (priv->subResources) {
+        g_hash_table_unref(priv->subResources);
+        priv->subResources = NULL;
+    }
+
     G_OBJECT_CLASS(webkit_web_view_parent_class)->dispose(object);
 }
 
@@ -984,6 +1027,7 @@ static void webkit_web_view_finalize(GObject* object)
     WebKitWebView* webView = WEBKIT_WEB_VIEW(object);
     WebKitWebViewPrivate* priv = webView->priv;
 
+    g_free(priv->mainResourceIdentifier);
     g_free(priv->encoding);
     g_free(priv->customEncoding);
 
@@ -1081,6 +1125,130 @@ static void webkit_web_view_screen_changed(GtkWidget* widget, GdkScreen* previou
     settings->setMinimumLogicalFontSize(minimumLogicalFontSize / 72.0 * DPI);
 }
 
+static void webkit_web_view_drag_end(GtkWidget* widget, GdkDragContext* context)
+{
+    g_object_unref(context);
+}
+
+struct DNDContentsRequest
+{
+    gint info;
+    GtkSelectionData* dnd_selection_data;
+
+    gboolean is_url_label_request;
+    gchar* url;
+};
+
+void clipboard_contents_received(GtkClipboard* clipboard, GtkSelectionData* selection_data, gpointer data)
+{
+    DNDContentsRequest* contents_request = reinterpret_cast<DNDContentsRequest*>(data);
+
+    if (contents_request->is_url_label_request) {
+        // We have received contents of the label clipboard. Use them to form
+        // required structures. When formed, enhance the dnd's selection data
+        // with them and return.
+
+        // If the label is empty, use the url itself.
+        gchar* url_label = reinterpret_cast<gchar*>(gtk_selection_data_get_text(selection_data));
+        if (!url_label)
+            url_label = g_strdup(contents_request->url);
+
+        gchar* data = 0;
+        switch (contents_request->info) {
+        case WEBKIT_WEB_VIEW_TARGET_INFO_URI_LIST:
+            data = g_strdup_printf("%s\r\n%s\r\n", contents_request->url, url_label);
+            break;
+        case WEBKIT_WEB_VIEW_TARGET_INFO_NETSCAPE_URL:
+            data = g_strdup_printf("%s\n%s", contents_request->url, url_label);
+            break;
+        }
+
+        if (data) {
+            gtk_selection_data_set(contents_request->dnd_selection_data,
+                                   contents_request->dnd_selection_data->target, 8,
+                                   reinterpret_cast<const guchar*>(data), strlen(data));
+            g_free(data);
+        }
+
+        g_free(url_label);
+        g_free(contents_request->url);
+        g_free(contents_request);
+
+        return;
+    }
+
+    switch (contents_request->info) {
+    case WEBKIT_WEB_VIEW_TARGET_INFO_HTML:
+    case WEBKIT_WEB_VIEW_TARGET_INFO_TEXT:
+        {
+        gchar* data = reinterpret_cast<gchar*>(gtk_selection_data_get_text(selection_data));
+        if (data) {
+            gtk_selection_data_set(contents_request->dnd_selection_data,
+                                   contents_request->dnd_selection_data->target, 8,
+                                   reinterpret_cast<const guchar*>(data),
+                                   strlen(data));
+            g_free(data);
+        }
+        break;
+        }
+    case WEBKIT_WEB_VIEW_TARGET_INFO_IMAGE:
+        {
+        GdkPixbuf* pixbuf = gtk_selection_data_get_pixbuf(selection_data);
+        if (pixbuf) {
+            gtk_selection_data_set_pixbuf(contents_request->dnd_selection_data, pixbuf);
+            g_object_unref(pixbuf);
+        }
+        break;
+        }
+    case WEBKIT_WEB_VIEW_TARGET_INFO_URI_LIST:
+    case WEBKIT_WEB_VIEW_TARGET_INFO_NETSCAPE_URL:
+        // URL's label is stored in another clipboard, so we store URL into
+        // contents request, mark the latter as an url label request
+        // and request for contents of the label clipboard.
+        contents_request->is_url_label_request = TRUE;
+        contents_request->url = reinterpret_cast<gchar*>(gtk_selection_data_get_text(selection_data));
+
+        gtk_clipboard_request_contents(gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardUrlLabel")),
+                                       selection_data->target, clipboard_contents_received, contents_request);
+        break;
+    }
+}
+
+static void webkit_web_view_drag_data_get(GtkWidget* widget, GdkDragContext* context, GtkSelectionData* selection_data, guint info, guint time_)
+{
+    GdkAtom selection_atom = GDK_NONE;
+    GdkAtom target_atom = selection_data->target;
+
+    switch (info) {
+        case WEBKIT_WEB_VIEW_TARGET_INFO_HTML:
+            selection_atom = gdk_atom_intern_static_string("WebKitClipboardHtml");
+            // HTML markup data is set as text, therefor, we need a text-like target atom
+            target_atom = gdk_atom_intern_static_string("UTF8_STRING");
+            break;
+        case WEBKIT_WEB_VIEW_TARGET_INFO_TEXT:
+            selection_atom = gdk_atom_intern_static_string("WebKitClipboardText");
+            break;
+        case WEBKIT_WEB_VIEW_TARGET_INFO_IMAGE:
+            selection_atom = gdk_atom_intern_static_string("WebKitClipboardImage");
+            break;
+        case WEBKIT_WEB_VIEW_TARGET_INFO_URI_LIST:
+        case WEBKIT_WEB_VIEW_TARGET_INFO_NETSCAPE_URL:
+            selection_atom = gdk_atom_intern_static_string("WebKitClipboardUrl");
+            // We require URL and label, which are both stored in text format
+            // and are needed to be retrieved as such.
+            target_atom = gdk_atom_intern_static_string("UTF8_STRING");
+            break;
+    }
+
+    DNDContentsRequest* contents_request = g_new(DNDContentsRequest, 1);
+    contents_request->info = info;
+    contents_request->is_url_label_request = FALSE;
+    contents_request->dnd_selection_data = selection_data;
+
+    gtk_clipboard_request_contents(gtk_clipboard_get(selection_atom), target_atom,
+                                   clipboard_contents_received, contents_request);
+}
+
 static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 {
     GtkBindingSet* binding_set;
@@ -1104,11 +1272,11 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
      * The new #WebKitWebView should not be displayed to the user
      * until the #WebKitWebView::web-view-ready signal is emitted.
      *
-     * The signal handlers should not try to deal with the reference
-     * count for the new #WebKitWebView. The widget to which the
-     * widget is added will handle that.
+     * The signal handlers should not try to deal with the reference count for
+     * the new #WebKitWebView. The widget to which the widget is added will
+     * handle that.
      *
-     * Since 1.0.3
+     * Since: 1.0.3
      */
     webkit_web_view_signals[CREATE_WEB_VIEW] = g_signal_new("create-web-view",
             G_TYPE_FROM_CLASS(webViewClass),
@@ -1137,7 +1305,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
      * time of the window, so you may want to connect to the ::notify
      * signal of the #WebKitWebWindowFeatures object to handle those.
      *
-     * Since 1.0.3
+     * Since: 1.0.3
      */
     webkit_web_view_signals[WEB_VIEW_READY] = g_signal_new("web-view-ready",
             G_TYPE_FROM_CLASS(webViewClass),
@@ -1154,10 +1322,12 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
      * @return: %TRUE to stop handlers from being invoked for the event or
      * %FALSE to propagate the event furter
      *
-     * Emitted when closing a WebView is requested. This occurs when a call
-     * is made from JavaScript's window.close function.
+     * Emitted when closing a #WebKitWebView is requested. This occurs when a
+     * call is made from JavaScript's window.close function. The default
+     * signal handler does not do anything. It is the owner's responsibility
+     * to hide or delete the web view, if necessary.
      *
-     * Since 1.1.11
+     * Since: 1.1.11
      */
     webkit_web_view_signals[CLOSE_WEB_VIEW] = g_signal_new("close-web-view",
             G_TYPE_FROM_CLASS(webViewClass),
@@ -1727,6 +1897,44 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
             G_TYPE_NONE, 0);
 
     /**
+     * WebKitWebView::undo
+     * @web_view: the object which received the signal
+     *
+     * The #WebKitWebView::undo signal is a keybinding signal which gets emitted to
+     * undo the last editing command.
+     *
+     * The default binding for this signal is Ctrl-z
+     *
+     * Since: 1.1.14
+     */
+    webkit_web_view_signals[UNDO] = g_signal_new("undo",
+            G_TYPE_FROM_CLASS(webViewClass),
+            (GSignalFlags)(G_SIGNAL_RUN_LAST | G_SIGNAL_ACTION),
+            G_STRUCT_OFFSET(WebKitWebViewClass, undo),
+            NULL, NULL,
+            g_cclosure_marshal_VOID__VOID,
+            G_TYPE_NONE, 0);
+
+    /**
+     * WebKitWebView::redo
+     * @web_view: the object which received the signal
+     *
+     * The #WebKitWebView::redo signal is a keybinding signal which gets emitted to
+     * redo the last editing command.
+     *
+     * The default binding for this signal is Ctrl-Shift-z
+     *
+     * Since: 1.1.14
+     */
+    webkit_web_view_signals[REDO] = g_signal_new("redo",
+            G_TYPE_FROM_CLASS(webViewClass),
+            (GSignalFlags)(G_SIGNAL_RUN_LAST | G_SIGNAL_ACTION),
+            G_STRUCT_OFFSET(WebKitWebViewClass, redo),
+            NULL, NULL,
+            g_cclosure_marshal_VOID__VOID,
+            G_TYPE_NONE, 0);
+
+    /**
      * WebKitWebView::move-cursor:
      * @web_view: the object which received the signal
      * @step: the type of movement, one of #GtkMovementStep
@@ -1774,6 +1982,69 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
             GTK_TYPE_WIDGET, 3,
             G_TYPE_STRING, G_TYPE_STRING, G_TYPE_HASH_TABLE);
 
+    /**
+     * WebKitWebView::database-quota-exceeded
+     * @web_view: the object which received the signal
+     * @frame: the relevant frame
+     * @database: the #WebKitWebDatabase which exceeded the quota of its #WebKitSecurityOrigin
+     *
+     * The #WebKitWebView::database-exceeded-quota signal will be emitted when
+     * a Web Database exceeds the quota of its security origin. This signal
+     * may be used to increase the size of the quota before the originating
+     * operation fails.
+     *
+     * Since: 1.1.14
+     */
+    webkit_web_view_signals[DATABASE_QUOTA_EXCEEDED] = g_signal_new("database-quota-exceeded",
+            G_TYPE_FROM_CLASS(webViewClass),
+            (GSignalFlags) (G_SIGNAL_RUN_LAST | G_SIGNAL_ACTION),
+            0,
+            NULL, NULL,
+            webkit_marshal_VOID__OBJECT_OBJECT,
+            G_TYPE_NONE, 2,
+            G_TYPE_OBJECT, G_TYPE_OBJECT);
+
+    /**
+     * WebKitWebView::resource-request-starting:
+     * @web_view: the object which received the signal
+     * @web_frame: the #WebKitWebFrame whose load dispatched this request
+     * @web_resource: an empty #WebKitWebResource object
+     * @request: the #WebKitNetworkRequest that will be dispatched
+     * @response: the #WebKitNetworkResponse representing the redirect
+     * response, if any
+     *
+     * Emitted when a request is about to be sent. You can modify the
+     * request while handling this signal. You can set the URI in the
+     * #WebKitNetworkRequest object itself, and add/remove/replace
+     * headers using the #SoupMessage object it carries, if it is
+     * present. See webkit_network_request_get_message(). Setting the
+     * request URI to "about:blank" will effectively cause the request
+     * to load nothing, and can be used to disable the loading of
+     * specific resources.
+     *
+     * Notice that information about an eventual redirect is available
+     * in @response's #SoupMessage, not in the #SoupMessage carried by
+     * the @request. If @response is %NULL, then this is not a
+     * redirected request.
+     *
+     * The #WebKitWebResource object will be the same throughout all
+     * the lifetime of the resource, but the contents may change from
+     * inbetween signal emissions.
+     *
+     * Since: 1.1.14
+     */
+    webkit_web_view_signals[RESOURCE_REQUEST_STARTING] = g_signal_new("resource-request-starting",
+            G_TYPE_FROM_CLASS(webViewClass),
+            (GSignalFlags)(G_SIGNAL_RUN_LAST | G_SIGNAL_ACTION),
+            0,
+            NULL, NULL,
+            webkit_marshal_VOID__OBJECT_OBJECT_OBJECT_OBJECT,
+            G_TYPE_NONE, 4,
+            WEBKIT_TYPE_WEB_FRAME,
+            WEBKIT_TYPE_WEB_RESOURCE,
+            WEBKIT_TYPE_NETWORK_REQUEST,
+            WEBKIT_TYPE_NETWORK_RESPONSE);
+
     /*
      * implementations of virtual methods
      */
@@ -1791,6 +2062,8 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
     webViewClass->cut_clipboard = webkit_web_view_real_cut_clipboard;
     webViewClass->copy_clipboard = webkit_web_view_real_copy_clipboard;
     webViewClass->paste_clipboard = webkit_web_view_real_paste_clipboard;
+    webViewClass->undo = webkit_web_view_real_undo;
+    webViewClass->redo = webkit_web_view_real_redo;
     webViewClass->move_cursor = webkit_web_view_real_move_cursor;
 
     GObjectClass* objectClass = G_OBJECT_CLASS(webViewClass);
@@ -1816,6 +2089,8 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
     widgetClass->focus_out_event = webkit_web_view_focus_out_event;
     widgetClass->get_accessible = webkit_web_view_get_accessible;
     widgetClass->screen_changed = webkit_web_view_screen_changed;
+    widgetClass->drag_end = webkit_web_view_drag_end;
+    widgetClass->drag_data_get = webkit_web_view_drag_data_get;
 
     GtkContainerClass* containerClass = GTK_CONTAINER_CLASS(webViewClass);
     containerClass->add = webkit_web_view_container_add;
@@ -1852,6 +2127,10 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
                                  "copy_clipboard", 0);
     gtk_binding_entry_add_signal(binding_set, GDK_v, GDK_CONTROL_MASK,
                                  "paste_clipboard", 0);
+    gtk_binding_entry_add_signal(binding_set, GDK_z, GDK_CONTROL_MASK,
+                                 "undo", 0);
+    gtk_binding_entry_add_signal(binding_set, GDK_z, static_cast<GdkModifierType>(GDK_CONTROL_MASK | GDK_SHIFT_MASK),
+                                 "redo", 0);
 
     gtk_binding_entry_add_signal(binding_set, GDK_Delete, GDK_SHIFT_MASK,
                                  "cut_clipboard", 0);
@@ -2112,7 +2391,10 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     gboolean autoLoadImages, autoShrinkImages, printBackgrounds,
         enableScripts, enablePlugins, enableDeveloperExtras, resizableTextAreas,
         enablePrivateBrowsing, enableCaretBrowsing, enableHTML5Database, enableHTML5LocalStorage,
-        enableXSSAuditor, javascriptCanOpenWindows, enableOfflineWebAppCache;
+        enableXSSAuditor, javascriptCanOpenWindows, enableOfflineWebAppCache,
+        enableUniversalAccessFromFileURI;
+
+    WebKitEditingBehavior editingBehavior;
 
     g_object_get(webSettings,
                  "default-encoding", &defaultEncoding,
@@ -2137,6 +2419,8 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
                  "enable-xss-auditor", &enableXSSAuditor,
                  "javascript-can-open-windows-automatically", &javascriptCanOpenWindows,
                  "enable-offline-web-application-cache", &enableOfflineWebAppCache,
+                 "editing-behavior", &editingBehavior,
+                 "enable-universal-access-from-file-uris", &enableUniversalAccessFromFileURI,
                  NULL);
 
     settings->setDefaultTextEncodingName(defaultEncoding);
@@ -2161,6 +2445,8 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     settings->setXSSAuditorEnabled(enableXSSAuditor);
     settings->setJavaScriptCanOpenWindowsAutomatically(javascriptCanOpenWindows);
     settings->setOfflineWebApplicationCacheEnabled(enableOfflineWebAppCache);
+    settings->setEditingBehavior(core(editingBehavior));
+    settings->setAllowUniversalAccessFromFileURLs(enableUniversalAccessFromFileURI);
 
     g_free(defaultEncoding);
     g_free(cursiveFontFamily);
@@ -2243,6 +2529,10 @@ static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GPar
         settings->setJavaScriptCanOpenWindowsAutomatically(g_value_get_boolean(&value));
     else if (name == g_intern_string("enable-offline-web-application-cache"))
         settings->setOfflineWebApplicationCacheEnabled(g_value_get_boolean(&value));
+    else if (name == g_intern_string("editing-behavior"))
+        settings->setEditingBehavior(core(static_cast<WebKitEditingBehavior>(g_value_get_enum(&value))));
+    else if (name == g_intern_string("enable-universal-access-from-file-uris"))
+        settings->setAllowUniversalAccessFromFileURLs(g_value_get_boolean(&value));
     else if (!g_object_class_find_property(G_OBJECT_GET_CLASS(webSettings), name))
         g_warning("Unexpected setting '%s'", name);
     g_value_unset(&value);
@@ -2256,7 +2546,7 @@ static void webkit_web_view_init(WebKitWebView* webView)
     priv->imContext = gtk_im_multicontext_new();
 
     WebKit::InspectorClient* inspectorClient = new WebKit::InspectorClient(webView);
-    priv->corePage = new Page(new WebKit::ChromeClient(webView), new WebKit::ContextMenuClient(webView), new WebKit::EditorClient(webView), new WebKit::DragClient, inspectorClient);
+    priv->corePage = new Page(new WebKit::ChromeClient(webView), new WebKit::ContextMenuClient(webView), new WebKit::EditorClient(webView), new WebKit::DragClient(webView), inspectorClient, 0);
 
     // We also add a simple wrapper class to provide the public
     // interface for the Web Inspector.
@@ -2294,6 +2584,8 @@ static void webkit_web_view_init(WebKitWebView* webView)
     g_signal_connect(priv->webSettings, "notify", G_CALLBACK(webkit_web_view_settings_notify), webView);
 
     priv->webWindowFeatures = webkit_web_window_features_new();
+
+    priv->subResources = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, g_object_unref);
 }
 
 GtkWidget* webkit_web_view_new(void)
@@ -2312,14 +2604,16 @@ void webkit_web_view_notify_ready(WebKitWebView* webView)
     g_signal_emit(webView, webkit_web_view_signals[WEB_VIEW_READY], 0, &isHandled);
 }
 
-void webkit_web_view_request_download(WebKitWebView* webView, WebKitNetworkRequest* request, const ResourceResponse& response)
+void webkit_web_view_request_download(WebKitWebView* webView, WebKitNetworkRequest* request, const ResourceResponse& response, ResourceHandle* handle)
 {
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
 
-    WebKitDownload* download = webkit_download_new(request);
+    WebKitDownload* download;
 
-    if (!response.isNull() && !response.suggestedFilename().isEmpty())
-        webkit_download_set_suggested_filename(download, response.suggestedFilename().utf8().data());
+    if (handle)
+        download = webkit_download_new_with_handle(request, handle, response);
+    else
+        download = webkit_download_new(request);
 
     gboolean handled;
     g_signal_emit(webView, webkit_web_view_signals[DOWNLOAD_REQUESTED], 0, download, &handled);
@@ -2535,8 +2829,7 @@ void webkit_web_view_go_back_or_forward(WebKitWebView* webView, gint steps)
 {
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
 
-    Frame* frame = core(webView)->mainFrame();
-    frame->loader()->goBackOrForward(steps);
+    core(webView)->goBackOrForward(steps);
 }
 
 /**
@@ -2585,8 +2878,7 @@ gboolean webkit_web_view_can_go_back_or_forward(WebKitWebView* webView, gint ste
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), FALSE);
 
-    Frame* frame = core(webView)->mainFrame();
-    return frame->loader()->canGoBackOrForward(steps);
+    return core(webView)->canGoBackOrForward(steps);
 }
 
 /**
@@ -2740,6 +3032,12 @@ void webkit_web_view_load_request(WebKitWebView* webView, WebKitNetworkRequest*
     webkit_web_frame_load_request(frame, request);
 }
 
+/**
+ * webkit_web_view_stop_loading:
+ * @webView: a #WebKitWebView
+ * 
+ * Stops any ongoing load in the @webView.
+ **/
 void webkit_web_view_stop_loading(WebKitWebView* webView)
 {
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
@@ -2747,7 +3045,7 @@ void webkit_web_view_stop_loading(WebKitWebView* webView)
     Frame* frame = core(webView)->mainFrame();
 
     if (FrameLoader* loader = frame->loader())
-        loader->stopAllLoaders();
+        loader->stopForUserCancel();
 }
 
 /**
@@ -2805,7 +3103,11 @@ void webkit_web_view_set_highlight_text_matches(WebKitWebView* webView, gboolean
 {
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
 
-    core(webView)->mainFrame()->setMarkedTextMatchesAreHighlighted(shouldHighlight);
+    Frame *frame = core(webView)->mainFrame();
+    do {
+        frame->setMarkedTextMatchesAreHighlighted(shouldHighlight);
+        frame = frame->tree()->traverseNextWithWrap(false);
+    } while (frame);
 }
 
 /**
@@ -3462,3 +3764,205 @@ void webkit_web_view_set_group_name(WebKitWebView* webView, const gchar* groupNa
 
     priv->corePage->setGroupName(String::fromUTF8(groupName));
 }
+
+/**
+ * webkit_web_view_can_undo:
+ * @web_view: a #WebKitWebView
+ *
+ * Determines whether or not it is currently possible to undo the last
+ * editing command in the view.
+ *
+ * Return value: %TRUE if a undo can be done, %FALSE if not
+ *
+ * Since: 1.1.14
+ */
+gboolean webkit_web_view_can_undo(WebKitWebView* webView)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), FALSE);
+
+    Frame* frame = core(webView)->focusController()->focusedOrMainFrame();
+    return frame->editor()->canUndo();
+}
+
+/**
+ * webkit_web_view_undo:
+ * @web_view: a #WebKitWebView
+ *
+ * Undoes the last editing command in the view, if possible.
+ *
+ * Since: 1.1.14
+ */
+void webkit_web_view_undo(WebKitWebView* webView)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
+
+    if (webkit_web_view_can_undo(webView))
+        g_signal_emit(webView, webkit_web_view_signals[UNDO], 0);
+}
+
+/**
+ * webkit_web_view_can_redo:
+ * @web_view: a #WebKitWebView
+ *
+ * Determines whether or not it is currently possible to redo the last
+ * editing command in the view.
+ *
+ * Return value: %TRUE if a redo can be done, %FALSE if not
+ *
+ * Since: 1.1.14
+ */
+gboolean webkit_web_view_can_redo(WebKitWebView* webView)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), FALSE);
+
+    Frame* frame = core(webView)->focusController()->focusedOrMainFrame();
+    return frame->editor()->canRedo();
+}
+
+/**
+ * webkit_web_view_redo:
+ * @web_view: a #WebKitWebView
+ *
+ * Redoes the last editing command in the view, if possible.
+ *
+ * Since: 1.1.14
+ */
+void webkit_web_view_redo(WebKitWebView* webView)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
+
+    if (webkit_web_view_can_redo(webView))
+        g_signal_emit(webView, webkit_web_view_signals[REDO], 0);
+}
+
+
+/**
+ * webkit_web_view_set_view_source_mode:
+ * @web_view: a #WebKitWebView
+ * @view_source_mode: the mode to turn on or off view source mode
+ *
+ * Set whether the view should be in view source mode. Setting this mode to
+ * %TRUE before loading a URI will display the source of the web page in a
+ * nice and readable format.
+ *
+ * Since: 1.1.14
+ */
+void webkit_web_view_set_view_source_mode (WebKitWebView* webView, gboolean mode)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
+
+    if (Frame* mainFrame = core(webView)->mainFrame())
+        mainFrame->setInViewSourceMode(mode);
+}
+
+/**
+ * webkit_web_view_get_view_source_mode:
+ * @web_view: a #WebKitWebView
+ *
+ * Return value: %TRUE if @web_view is in view source mode, %FALSE otherwise.
+ *
+ * Since: 1.1.14
+ */
+gboolean webkit_web_view_get_view_source_mode (WebKitWebView* webView)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), FALSE);
+
+    if (Frame* mainFrame = core(webView)->mainFrame())
+        return mainFrame->inViewSourceMode();
+
+    return FALSE;
+}
+
+// Internal subresource management
+void webkit_web_view_add_resource(WebKitWebView* webView, char* identifier, WebKitWebResource* webResource)
+{
+    WebKitWebViewPrivate* priv = webView->priv;
+
+    if (!priv->mainResource) {
+        priv->mainResource = webResource;
+        priv->mainResourceIdentifier = g_strdup(identifier);
+        return;
+    }
+
+    g_hash_table_insert(priv->subResources, identifier, webResource);
+}
+
+WebKitWebResource* webkit_web_view_get_resource(WebKitWebView* webView, char* identifier)
+{
+    WebKitWebViewPrivate* priv = webView->priv;
+    gpointer webResource = NULL;
+
+    gboolean resourceFound = g_hash_table_lookup_extended(priv->subResources, identifier, NULL, &webResource);
+
+    // The only resource we do not store in this hash table is the main!
+    g_return_val_if_fail(resourceFound || g_str_equal(identifier, priv->mainResourceIdentifier), NULL);
+
+    if (!webResource)
+        return webkit_web_view_get_main_resource(webView);
+
+    return WEBKIT_WEB_RESOURCE(webResource);
+}
+
+WebKitWebResource* webkit_web_view_get_main_resource(WebKitWebView* webView)
+{
+    return webView->priv->mainResource;
+}
+
+void webkit_web_view_clear_resources(WebKitWebView* webView)
+{
+    WebKitWebViewPrivate* priv = webView->priv;
+
+    g_free(priv->mainResourceIdentifier);
+    priv->mainResourceIdentifier = NULL;
+
+    if (priv->mainResource) {
+        g_object_unref(priv->mainResource);
+        priv->mainResource = NULL;
+    }
+
+    if (priv->subResources)
+        g_hash_table_remove_all(priv->subResources);
+}
+
+GList* webkit_web_view_get_subresources(WebKitWebView* webView)
+{
+    WebKitWebViewPrivate* priv = webView->priv;
+    GList* subResources = g_hash_table_get_values(priv->subResources);
+    return g_list_remove(subResources, priv->mainResource);
+}
+
+/* From EventHandler.cpp */
+static IntPoint documentPointForWindowPoint(Frame* frame, const IntPoint& windowPoint)
+{
+    FrameView* view = frame->view();
+    // FIXME: Is it really OK to use the wrong coordinates here when view is 0?
+    // Historically the code would just crash; this is clearly no worse than that.
+    return view ? view->windowToContents(windowPoint) : windowPoint;
+}
+
+/**
+ * webkit_web_view_get_hit_test_result:
+ * @webView: a #WebKitWebView
+ * @event: a #GdkEventButton
+ * 
+ * Does a 'hit test' in the coordinates specified by @event to figure
+ * out context information about that position in the @webView.
+ * 
+ * Returns: a newly created #WebKitHitTestResult with the context of the
+ * specified position.
+ *
+ * Since: 1.1.15
+ **/
+WebKitHitTestResult* webkit_web_view_get_hit_test_result(WebKitWebView* webView, GdkEventButton* event)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), NULL);
+    g_return_val_if_fail(event, NULL);
+
+    PlatformMouseEvent mouseEvent = PlatformMouseEvent(event);
+    Frame* frame = core(webView)->focusController()->focusedOrMainFrame();
+    HitTestRequest request(HitTestRequest::Active);
+    IntPoint documentPoint = documentPointForWindowPoint(frame, mouseEvent.pos());
+    MouseEventWithHitTestResults mev = frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
+
+    return kit(mev.hitTestResult());
+}
diff --git a/WebKit/gtk/webkit/webkitwebview.h b/WebKit/gtk/webkit/webkitwebview.h
index fbdefa8..1297695 100644
--- a/WebKit/gtk/webkit/webkitwebview.h
+++ b/WebKit/gtk/webkit/webkitwebview.h
@@ -19,8 +19,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_WEB_VIEW_H
-#define WEBKIT_WEB_VIEW_H
+#ifndef webkitwebview_h
+#define webkitwebview_h
 
 #include <gtk/gtk.h>
 #include <libsoup/soup.h>
@@ -52,7 +52,10 @@ typedef enum {
 typedef enum
 {
     WEBKIT_WEB_VIEW_TARGET_INFO_HTML,
-    WEBKIT_WEB_VIEW_TARGET_INFO_TEXT
+    WEBKIT_WEB_VIEW_TARGET_INFO_TEXT,
+    WEBKIT_WEB_VIEW_TARGET_INFO_IMAGE,
+    WEBKIT_WEB_VIEW_TARGET_INFO_URI_LIST,
+    WEBKIT_WEB_VIEW_TARGET_INFO_NETSCAPE_URL
 } WebKitWebViewTargetInfo;
 
 struct _WebKitWebView {
@@ -116,13 +119,15 @@ struct _WebKitWebViewClass {
     void                       (* set_scroll_adjustments) (WebKitWebView        *web_view,
                                                            GtkAdjustment        *hadjustment,
                                                            GtkAdjustment        *vadjustment);
+
+    void                       (* undo)                   (WebKitWebView        *web_view);
+    void                       (* redo)                   (WebKitWebView        *web_view);
+
     /* Padding for future expansion */
     void (*_webkit_reserved0) (void);
     void (*_webkit_reserved1) (void);
     void (*_webkit_reserved2) (void);
     void (*_webkit_reserved3) (void);
-    void (*_webkit_reserved4) (void);
-    void (*_webkit_reserved5) (void);
 };
 
 WEBKIT_API GType
@@ -339,6 +344,28 @@ webkit_web_view_get_load_status                 (WebKitWebView        *web_view)
 WEBKIT_API gdouble
 webkit_web_view_get_progress                    (WebKitWebView        *web_view);
 
+WEBKIT_API void
+webkit_web_view_undo                            (WebKitWebView        *webView);
+
+WEBKIT_API gboolean
+webkit_web_view_can_undo                        (WebKitWebView        *webView);
+
+WEBKIT_API void
+webkit_web_view_redo                            (WebKitWebView        *webView);
+
+WEBKIT_API gboolean
+webkit_web_view_can_redo                        (WebKitWebView        *webView);
+
+WEBKIT_API void
+webkit_web_view_set_view_source_mode            (WebKitWebView        *web_view,
+                                                 gboolean             view_source_mode);
+
+WEBKIT_API gboolean
+webkit_web_view_get_view_source_mode            (WebKitWebView        *web_view);
+
+WEBKIT_API WebKitHitTestResult*
+webkit_web_view_get_hit_test_result             (WebKitWebView        *webView,
+                                                 GdkEventButton       *event);
 G_END_DECLS
 
 #endif
diff --git a/WebKit/gtk/webkit/webkitwebwindowfeatures.cpp b/WebKit/gtk/webkit/webkitwebwindowfeatures.cpp
index 47610d3..cdb6858 100644
--- a/WebKit/gtk/webkit/webkitwebwindowfeatures.cpp
+++ b/WebKit/gtk/webkit/webkitwebwindowfeatures.cpp
@@ -371,7 +371,7 @@ static void webkit_web_window_features_get_property(GObject* object, guint prop_
  *
  * Returns: a new #WebKitWebWindowFeatures instance
  *
- * Since 1.0.3
+ * Since: 1.0.3
  */
 WebKitWebWindowFeatures* webkit_web_window_features_new()
 {
@@ -418,7 +418,7 @@ WebKitWebWindowFeatures* webkit_web_window_features_new_from_core_features(const
  * Returns: %TRUE if the instances have the same values, %FALSE
  * otherwise
  *
- * Since 1.0.3
+ * Since: 1.0.3
  */
 gboolean webkit_web_window_features_equal(WebKitWebWindowFeatures* features1, WebKitWebWindowFeatures* features2)
 {
diff --git a/WebKit/gtk/webkit/webkitwebwindowfeatures.h b/WebKit/gtk/webkit/webkitwebwindowfeatures.h
index cd28988..a79119d 100644
--- a/WebKit/gtk/webkit/webkitwebwindowfeatures.h
+++ b/WebKit/gtk/webkit/webkitwebwindowfeatures.h
@@ -17,8 +17,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef WEBKIT_WEB_WINDOW_FEATURES_H
-#define WEBKIT_WEB_WINDOW_FEATURES_H
+#ifndef webkitwebwindowfeatures_h
+#define webkitwebwindowfeatures_h
 
 #include <glib-object.h>
 
@@ -65,4 +65,4 @@ webkit_web_window_features_equal               (WebKitWebWindowFeatures* feature
 
 G_END_DECLS
 
-#endif /* WEBKIT_WEB_WINDOW_FEATURES_H */
+#endif /* webkitwebwindowfeatures_h */
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp b/WebKit/gtk/webkit/webkitworkers.cpp
index 3582448..255863c 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp
+++ b/WebKit/gtk/webkit/webkitworkers.cpp
@@ -29,14 +29,17 @@
  */
 
 #include "config.h"
-#include "SQLiteFileSystem.h"
+#include "webkitprivate.h"
 
-namespace WebCore {
+#include "WorkerThread.h"
 
-void SQLiteFileSystem::registerSQLiteVFS()
+unsigned int webkit_worker_thread_count(void)
 {
-    // stub for registering Chromium's SQLite VFS for Linux
-    ASSERT_NOT_REACHED();
+#if ENABLE(WORKERS)
+    return WebCore::WorkerThread::workerThreadCount();
+#else
+    return 0;
+#endif
 }
 
-} // namespace WebCore
+
diff --git a/WebKit/gtk/webkitmarshal.list b/WebKit/gtk/webkitmarshal.list
index aa0d40c..fefdff3 100644
--- a/WebKit/gtk/webkitmarshal.list
+++ b/WebKit/gtk/webkitmarshal.list
@@ -13,6 +13,7 @@ OBJECT:OBJECT
 OBJECT:STRING,STRING,POINTER
 OBJECT:VOID
 VOID:OBJECT,OBJECT
+VOID:OBJECT,OBJECT,OBJECT,OBJECT
 VOID:OBJECT,POINTER,POINTER
 VOID:OBJECT,STRING
 VOID:STRING
diff --git a/WebKit/haiku/ChangeLog b/WebKit/haiku/ChangeLog
index f73a332..457e3f4 100644
--- a/WebKit/haiku/ChangeLog
+++ b/WebKit/haiku/ChangeLog
@@ -1,3 +1,43 @@
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        Move the policy callback to the policy object.
+
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::dispatchWillSubmitForm):
+        (WebCore::FrameLoaderClientHaiku::dispatchDecidePolicyForMIMEType):
+        (WebCore::FrameLoaderClientHaiku::dispatchDecidePolicyForNewWindowAction):
+        (WebCore::FrameLoaderClientHaiku::dispatchDecidePolicyForNavigationAction):
+
+2009-09-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Reflect the rename of platformWindow and it's return type.
+
+        * WebCoreSupport/ChromeClientHaiku.cpp:
+        (WebCore::ChromeClientHaiku::platformPageClient):
+        * WebCoreSupport/ChromeClientHaiku.h:
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Add empty implementation for new ChromeClient method.
+
+        * WebCoreSupport/ChromeClientHaiku.h:
+        (ChromeClientHaiku::scrollbarsModeDidChange):
+
 2009-07-29  Kevin McCullough  <kmccullough@apple.com>
 
         Reviewed by Darin Adler.
diff --git a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp
index 8932da1..4820d78 100644
--- a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp
+++ b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp
@@ -271,7 +271,7 @@ IntRect ChromeClientHaiku::windowToScreen(const IntRect&) const
     return IntRect();
 }
 
-PlatformWidget ChromeClientHaiku::platformWindow() const
+PlatformPageClient ChromeClientHaiku::platformPageClient() const
 {
     notImplemented();
     return PlatformWidget();
diff --git a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h
index 386c380..a6f57eb 100644
--- a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h
+++ b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h
@@ -104,7 +104,7 @@ namespace WebCore {
         void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
         IntPoint screenToWindow(const IntPoint&) const;
         IntRect windowToScreen(const IntRect&) const;
-        PlatformWidget platformWindow() const;
+        PlatformPageClient platformPageClient() const;
         void contentsSizeChanged(Frame*, const IntSize&) const;
         void scrollRectIntoView(const IntRect&, const ScrollView*) const;
 
@@ -112,6 +112,7 @@ namespace WebCore {
         void scrollBackingStore(int, int, const IntRect&, const IntRect&);
         void updateBackingStore();
 
+        void scrollbarsModeDidChange() const { }
         void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
 
         void setToolTip(const String&);
diff --git a/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp b/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
index d2683c0..a8ba16f 100644
--- a/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
+++ b/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
@@ -280,7 +280,7 @@ void FrameLoaderClientHaiku::dispatchWillSubmitForm(FramePolicyFunction function
     // FIXME: Send an event to allow for alerts and cancellation.
     if (!m_frame)
         return;
-    (m_frame->loader()->*function)(PolicyUse);
+    (m_frame->loader()->policyChecker()->*function)(PolicyUse);
 }
 
 void FrameLoaderClientHaiku::dispatchDidLoadMainResource(DocumentLoader*)
@@ -635,7 +635,7 @@ void FrameLoaderClientHaiku::dispatchDecidePolicyForMIMEType(FramePolicyFunction
         return;
 
     notImplemented();
-    (m_frame->loader()->*function)(PolicyUse);
+    (m_frame->loader()->policyChecker()->*function)(PolicyUse);
 }
 
 void FrameLoaderClientHaiku::dispatchDecidePolicyForNewWindowAction(FramePolicyFunction function,
@@ -650,12 +650,12 @@ void FrameLoaderClientHaiku::dispatchDecidePolicyForNewWindowAction(FramePolicyF
         BMessage message(NEW_WINDOW_REQUESTED);
         message.AddString("url", request.url().string());
         if (m_messenger->SendMessage(&message)) {
-            (m_frame->loader()->*function)(PolicyIgnore);
+            (m_frame->loader()->policyChecker()->*function)(PolicyIgnore);
             return;
         }
     }
 
-    (m_frame->loader()->*function)(PolicyUse);
+    (m_frame->loader()->policyChecker()->*function)(PolicyUse);
 }
 
 void FrameLoaderClientHaiku::dispatchDecidePolicyForNavigationAction(FramePolicyFunction function,
@@ -671,7 +671,7 @@ void FrameLoaderClientHaiku::dispatchDecidePolicyForNavigationAction(FramePolicy
         message.AddString("url", request.url().string());
         m_messenger->SendMessage(&message);
 
-        (m_frame->loader()->*function)(PolicyUse);
+        (m_frame->loader()->policyChecker()->*function)(PolicyUse);
     }
 }
 
diff --git a/WebKit/mac/ChangeLog b/WebKit/mac/ChangeLog
index e35709c..63c888a 100644
--- a/WebKit/mac/ChangeLog
+++ b/WebKit/mac/ChangeLog
@@ -1,3 +1,1362 @@
+2009-10-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Re-land 49269-49271 since reverting them did not fix the tests.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView drawRect:]):
+
+2009-10-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Revert 49269-49271 to see if it fixes test failures on SnowLeopard that do not
+        reproduce locally.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView drawRect:]):
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        Move the policy callback to the policy object.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchWillSubmitForm):
+        (WebFrameLoaderClient::receivedPolicyDecison):
+
+2009-10-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Send title changes to the global history delegate.
+        <rdar://problem/7285293> and https://webkit.org/b/29904
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::setTitle):
+        * WebView/WebDelegateImplementationCaching.h:
+        * WebView/WebHistoryDelegate.h:
+        * WebView/WebView.mm:
+        (-[WebView _cacheHistoryDelegateImplementations]):
+
+2009-10-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Make the setMetadataURL function foolproof by having it remove user info
+        https://bugs.webkit.org/show_bug.cgi?id=30178
+        rdar://problem/6544670
+
+        * Misc/WebNSFileManagerExtras.m:
+        (-[NSFileManager _webkit_setMetadataURL:referrer:atPath:]):
+        Call _web_URLByRemovingUserInfo on the passed in URL string after converting
+        it to a URL, and then convert it back to a string.
+
+        * Misc/WebNSURLExtras.h: Added _web_URLByRemovingUserInfo.
+        * Misc/WebNSURLExtras.mm: Removed unused WebKitURLComponents struct.
+        (-[NSURL _web_URLByTruncatingOneCharacterBeforeComponent:]): Renamed to be
+        clearer on what this does.
+        (-[NSURL _webkit_URLByRemovingFragment]): Changed to call new name.
+        (-[NSURL _webkit_URLByRemovingResourceSpecifier]): Ditto.
+        (-[NSURL _web_URLByRemovingComponentAndSubsequentCharacter:]): Added.
+        (-[NSURL _web_URLByRemovingUserInfo]): Added.
+
+2009-10-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Make Dan Bernstein happy.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView drawRect:]):
+
+2009-10-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Avoid Obj-C message dispatch when possible by storing accessed objects
+        in local variables.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView drawRect:]):
+
+2009-10-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Animation stalls for a few seconds partway through
+        https://bugs.webkit.org/show_bug.cgi?id=30182
+        
+        Make sure that we only call -disableScreenUpdatesUntilFlush when a window
+        update is actually going to happen, otherwise screen updates are disabled
+        for too long.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView drawRect:]):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: default to an attached inspector window on Windows (as on Mac).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30134
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindowController showWindow:]):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move FrameLoader::canLoad to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30111
+
+        * Plugins/Hosted/HostedNetscapePluginStream.mm:
+        (WebKit::HostedNetscapePluginStream::HostedNetscapePluginStream):
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::loadRequest):
+        * Plugins/WebBaseNetscapePluginStream.mm:
+        (WebNetscapePluginStream::WebNetscapePluginStream):
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView loadRequest:inTarget:withNotifyData:sendNotification:]):
+        * Plugins/WebPluginContainerCheck.mm:
+        (-[WebPluginContainerCheck _isForbiddenFileLoad]):
+        * WebView/WebFrame.mm:
+        (-[WebFrame _allowsFollowingLink:]):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        Call the new API.
+
+        * WebView/WebView.mm:
+        (-[WebView _commonInitializationWithFrameName:groupName:usesDocumentViews:]):
+
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory localizedMediaControlElementString:]):
+        Handle "ControlsPanel" which is just an empty container, to avoid
+        asserting in debug builds.
+
+2009-10-06  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30107
+        
+        Fixes an issue where the Mac build does return the correct drop effect
+        with respect to the HTML 5 specification when effectAllowed == "none".
+        
+        Currently, when effectAllowed == "none" and dropEffect == "copy" or 
+        dropEffect == "move" the resulting drop effect is "copy" and "move",
+        respectively. However, the HTML 5 specification states that regardless
+        of the specified dropEffect, when effectAllowed == "none" the resulting
+        drop effect should be "none".
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView draggingSourceOperationMaskForLocal:]):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect 
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (WebInspectorClient::createPage):
+
+2009-10-05  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Moved a WebPluginHalterClient out of the WebCore namesapce.
+
+        * WebCoreSupport/WebPluginHalterClient.h:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Added new PluginHalter client, delegate and few more WebPreferences keys.
+
+        * WebView/WebPreferenceKeysPrivate.h: Added two new keys.
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]): Initialize newly added key.
+        (-[WebPreferences pluginAllowedRunTime]): Added.
+        (-[WebPreferences setPluginAllowedRunTime:]): Added.
+        * WebView/WebPreferencesPrivate.h: Added above two methods.
+        * WebView/WebUIDelegatePrivate.h: Added shouldHaltPlugin delegate.
+        * WebView/WebView.mm:
+        (-[WebView _commonInitializationWithFrameName:groupName:usesDocumentViews:]):
+        Setup a new WebPluginHalterClient.
+        (-[WebView _preferencesChangedNotification:]): Update WebCore settings accordingly.
+        * WebCoreSupport/WebPluginHalterClient.h: Added.
+        * WebCoreSupport/WebPluginHalterClient.mm: Added.
+        (WebPluginHalterClient::WebPluginHalterClient):
+        (WebPluginHalterClient::shouldHaltPlugin): Added, invoke the delegate.
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        More build fixes for Tiger.
+
+        * WebView/WebVideoFullscreenController.mm:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        More build fixes for Tiger.
+
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenWindow animationDidEnd:]):
+        * WebView/WebWindowAnimation.m:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        More build fixes for Tiger.
+
+        * WebView/WebVideoFullscreenController.mm:
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindow initWithContentRect:styleMask:backing:defer:]):
+        (-[WebVideoFullscreenHUDWindowController scheduleTimeUpdate]):
+        (-[WebVideoFullscreenHUDWindowController fadeWindowIn]):
+        (-[WebVideoFullscreenHUDWindowController fadeWindowOut]):
+        (-[WebVideoFullscreenHUDWindowController closeWindow]):
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fixes for Tiger.
+
+        * WebView/WebVideoFullscreenHUDWindowController.h:
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindow initWithContentRect:styleMask:backing:defer:]):
+        (-[WebVideoFullscreenHUDWindowController dealloc]):
+        (-[WebVideoFullscreenHUDWindowController closeWindow]):
+        (-[WebVideoFullscreenHUDWindowController windowDidLoad]):
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix. If you call Node::hasTagName(), you also have to include Element.h.
+
+        * WebCoreSupport/WebChromeClient.mm:
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add a fullscreen button to the <video> controller if the media engine,
+        and the theme have support for fullscreen, and can show appropriate controls.
+        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
+        in WebKit to do a nice animation to fullscreen, with a custom controller.
+
+        * WebCoreSupport/WebChromeClient.h:
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::supportsFullscreenForNode):
+        (WebChromeClient::enterFullscreenForNode):
+        (WebChromeClient::exitFullscreenForNode):
+        New methods to ask whether fullscreen is possible for a given node, and
+        notifications on enterying and exiting fullscreen.
+        
+        * WebView/WebVideoFullscreenController.h: Added.
+        * WebView/WebVideoFullscreenController.mm: Added.
+        WebVideoFullscreenController is responsible for creating the fullscreen window,
+        and coordinating the various animations when going fullscreen.
+
+        * WebView/WebVideoFullscreenHUDWindowController.h: Added.
+        * WebView/WebVideoFullscreenHUDWindowController.mm: Added.
+        This class manages the heads-up display (HUD) control bar.
+
+        * WebView/WebView.mm:
+        (-[WebView _close]):
+        Make sure we come out of fullscreen if the WebView is torn down (e.g. if
+        you close a background window).
+
+        (-[WebView _enterFullscreenForNode:WebCore::]):
+        Make a WebVideoFullscreenController and tell is to start to go fullscreen.
+        
+        (-[WebView _exitFullscreen]):
+        Tell the WebVideoFullscreenController to come out of fullscreen, and clean up.
+        
+        * WebView/WebViewData.h:
+        * WebView/WebViewData.mm:
+        (-[WebViewPrivate dealloc]):
+        (-[WebViewPrivate finalize]):
+        * WebView/WebViewInternal.h:
+        Keep a pointer to the WebVideoFullscreenController.
+        
+        * WebView/WebWindowAnimation.h: Added.
+        * WebView/WebWindowAnimation.m: Added.
+        (WebWindowAnimationDurationFromDuration):
+        (scaledRect):
+        (squaredDistance):
+        Handle the animations used during the transitition to fullscreen.
+
+2009-10-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+       
+        WebKit side of <rdar://problem/7179166>
+       
+        * Plugins/Hosted/NetscapePluginInstanceProxy.h:
+        Add an m_pluginIsWaitingForDraw member variable.
+        
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::NetscapePluginInstanceProxy):
+        Initialize m_pluginIsWaitingForDraw.
+        
+        (WebKit::NetscapePluginInstanceProxy::invalidateRect):
+        Set m_pluginIsWaitingForDraw to true.
+        
+        (WebKit::NetscapePluginInstanceProxy::didDraw):
+        If m_pluginIsWaitingForDraw is true, call _WKPHPluginInstanceDidDraw.
+        
+        * Plugins/Hosted/WebHostedNetscapePluginView.mm:
+        (-[WebHostedNetscapePluginView drawRect:]):
+        Call didDraw.
+        
+        * Plugins/Hosted/WebKitPluginHost.defs:
+        Add PHPluginInstanceDidDraw.
+
+2009-10-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add functionality to pause/throttle CSS transitions/animations in a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=29942
+
+        Added both a setter and getter function
+
+        * WebView/WebView.mm:
+        (-[WebView cssAnimationsSuspended]):
+        (-[WebView setCSSAnimationsSuspended:]):
+        * WebView/WebViewData.h:
+        * WebView/WebViewData.mm:
+        (-[WebViewPrivate init]):
+        * WebView/WebViewPrivate.h:
+
+2009-10-04  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7273363> Plug-ins should use PluginHalter
+        
+        * Plugins/WebBaseNetscapePluginView.h: Add WebHaltablePlugin forward declare and _haltable ivar.
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (WebHaltablePlugin::WebHaltablePlugin): Added.
+        (WebHaltablePlugin::halt): New method that stops a plug-in.
+        (WebHaltablePlugin::restart): New method that starts a plug-in.
+        (WebHaltablePlugin::node): Added. Provides the DOMNode corresponding to the plug-in in WebBaseNetscapePluginView.
+        (-[WebBaseNetscapePluginView initWithFrame:pluginPackage:URL:baseURL:MIMEType:attributeKeys:attributeValues:loadManually:element:WebCore::]):
+        Initialize new _haltable ivar.
+        (-[WebBaseNetscapePluginView start]): Call the page's didStartPlugin() upon starting a plug-in.
+        (-[WebBaseNetscapePluginView stop]): Call the page's didStopPlugin() upon stopping a plug-in.
+
+2009-10-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add testing harness for Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30010
+
+        * WebInspector/WebInspector.mm:
+        (-[WebInspector evaluateInFrontend:callId:script:]):
+        * WebInspector/WebInspectorPrivate.h: Added.
+
+2009-10-04  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        * WebView/WebPreferenceKeysPrivate.h: Added new key.
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]): Leave plug-in halting disabled by default.
+        (-[WebPreferences pluginHalterEnabled]): Added.
+        (-[WebPreferences setPluginHalterEnabled:]): Ditto.
+        * WebView/WebPreferencesPrivate.h: Added above new methods. 
+
+2009-10-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
+
+        * WebView/WebView.mm:
+        (toStringVector):
+        (+[WebView _addUserScriptToGroup:source:url:worldID:whitelist:blacklist:injectionTime:]):
+        (+[WebView _addUserStyleSheetToGroup:source:url:worldID:whitelist:blacklist:]):
+        * WebView/WebViewPrivate.h:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn on ENABLE_3D_CANVAS in TOT
+        https://bugs.webkit.org/show_bug.cgi?id=29906
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        (-[WebPreferences webGLEnabled]):
+        (-[WebPreferences setWebGLEnabled:]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2009-09-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/7259706>
+        Need WebKit API or SPI on Mac and Windows to test whether it's safe to load a page in a new tab/window
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _allowsFollowingLink:]):
+        * WebView/WebFramePrivate.h:
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add the ability to remove user stylesheets and scripts by URL.
+
+        * WebView/WebView.mm:
+        (+[WebView _removeUserContentFromGroup:url:worldID:]):
+        * WebView/WebViewPrivate.h:
+
+2009-09-29  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Dan Bernstein.
+
+        Fix license and some sorting in new files.
+
+        * WebView/WebHistoryDelegate.h:
+        * WebView/WebNavigationData.h:
+        * WebView/WebNavigationData.mm:
+
+2009-09-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by John Sullivan.
+
+        WebKit Mac API should provide a delegate interface for global history.
+        <rdar://problem/7042773> and https://webkit.org/b/29904
+
+        * WebView/WebHistoryDelegate.h: Added. New interface for WebKit clients to implement to manage 
+          their own global history store.
+
+        Object to store all of the bits of data relevant to a page visit:
+        * WebView/WebNavigationData.h: Added.
+        * WebView/WebNavigationData.mm: Added.
+        (-[WebNavigationDataPrivate dealloc]):
+        (-[WebNavigationData initWithURLString:title:originalRequest:response:hasSubstituteData:clientRedirectSource:]):
+        (-[WebNavigationData url]):
+        (-[WebNavigationData title]):
+        (-[WebNavigationData originalRequest]):
+        (-[WebNavigationData response]):
+        (-[WebNavigationData hasSubstituteData]):
+        (-[WebNavigationData clientRedirectSource]):
+        (-[WebNavigationData dealloc]):
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::updateGlobalHistory): If the delegate exists, don't use the built-in WebHistory.
+          If the implementation for this method exists, call it.
+        (WebFrameLoaderClient::updateGlobalHistoryRedirectLinks): Ditto
+
+        * WebView/WebDelegateImplementationCaching.h:
+        * WebView/WebDelegateImplementationCaching.mm:
+        (WebViewGetHistoryDelegateImplementations):
+        (CallHistoryDelegate):
+
+        * WebView/WebView.mm:
+        (-[WebView _cacheHistoryDelegateImplementations]):
+        (-[WebView setHistoryDelegate:]):
+        (-[WebView historyDelegate]):
+        * WebView/WebViewData.h:
+        * WebView/WebViewPrivate.h:
+
+2009-09-29  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add support for run-time flag for 3D canvas
+        https://bugs.webkit.org/show_bug.cgi?id=29826
+
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]): Enable experimental
+        WebGL flag when 3D_CANVAS is enabled in the build.
+
+2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add experimentalWebSocketsEnabled in WebPreferences.
+        https://bugs.webkit.org/show_bug.cgi?id=28941
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        (-[WebPreferences experimentalWebSocketsEnabled]):
+        (-[WebPreferences setExperimentalWebSocketsEnabled:]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/7240911> REGRESSION (r48586): Crash occurs when loading
+        a PDF
+
+        CGPDFObjectRef is not a CFTypeRef, and cannot be retained or released.
+        Its lifetime is managed by its container. Just use a Vector to store
+        CGPDFObjectRefs, relying on the CGPDFDocument to keep them alive.
+
+        * WebView/WebPDFDocumentExtras.mm:
+        (appendValuesInPDFNameSubtreeToVector):
+        (getAllValuesInPDFNameTree):
+        (web_PDFDocumentAllScripts):
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Reviewed by Alice Liu.
+
+        * WebView/WebView.mm:
+        (-[WebView _commonInitializationWithFrameName:groupName:usesDocumentViews:]):
+        Pass 0 for new Page constructor argument.
+
+2009-09-14  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Eric Seidel.
+
+        isEnabled switch for notifications (experimental) in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=28930
+
+        Adds support for the experimentalNotificationsEnabled flag in Settings
+        through WebPreferencesPrivate.
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        (-[WebPreferences experimentalNotificationsEnabled]):
+        (-[WebPreferences setExperimentalNotificationsEnabled:]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Updated for a WebCore rename.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _cacheabilityDictionary]):
+
+2009-09-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Speed up access to history items by caching date computation.
+
+        * History/WebHistory.mm:
+        (getDayBoundaries): Refactored from timeIntervalForBeginningOfDay.
+        Returns the beginning of the day that the passed time is within and
+        the beginning of the next day.
+        (beginningOfDay): Added. Uses getDayBoundaries so it can be fast for
+        multiple dates within the same day, which is the common case.
+        (dateKey): Added. Calls beginningOfDay and converts to an integer.
+        (-[WebHistoryPrivate findKey:forDay:]): Changed to call dateKey
+        insetad of timeIntervalForBeginningOfDay.
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        Move definition of USE(PLUGIN_HOST_PROCESS) from WebKitPrefix.h to Platform.h
+
+        Reviewed by Mark Rowe.
+
+        * WebKitPrefix.h: Removed definition of
+        WTF_USE_PLUGIN_HOST_PROCESS.
+
+2009-09-22  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent scrolling multiple frames during latched wheel events.
+
+        Reviewed by Anders Carlsson.
+
+        * WebView/WebDynamicScrollBarsView.h:
+        * WebView/WebDynamicScrollBarsView.mm:
+        (-[WebDynamicScrollBarsView scrollWheel:]):
+
+2009-09-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/7240911> REGRESSION (r48586): Crash occurs when loading
+        a PDF
+
+        * WebView/WebPDFDocumentExtras.mm:
+        (addWebPDFDocumentExtras): Made methodList static, because
+        class_addMethods() doesn't copy it.
+
+2009-09-21  Dan Bernstein  <mitz@apple.com>
+
+        Attempt to fix the Tiger build
+
+        * WebView/WebPDFDocumentExtras.mm:
+        (addWebPDFDocumentExtras):
+
+2009-09-21  Dan Bernstein  <mitz@apple.com>
+
+        Attempt to fix the Tiger build
+
+        * WebView/WebPDFDocumentExtras.mm:
+        (web_PDFDocumentAllScripts):
+        (addWebPDFDocumentExtras):
+
+2009-09-21  Dan Bernstein  <mitz@apple.com>
+
+        Attempt to fix the Tiger build
+
+        * WebView/WebPDFDocumentExtras.mm:
+        * WebView/WebPDFRepresentation.mm:
+
+2009-09-21  Dan Bernstein  <mitz@apple.com>
+
+        Attempt to fix the Leopard and Tiger builds
+
+        * WebView/WebPDFDocumentExtras.mm:
+
+2009-09-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/4137135> iFrame with PDF not being handled correctly on
+        usps.com
+        https://bugs.webkit.org/show_bug.cgi?id=4151
+
+        * WebView/WebJSPDFDoc.h: Added.
+        * WebView/WebJSPDFDoc.mm: Added.
+        (jsPDFDocInitialize): Retains the WebDataSource.
+        (jsPDFDocFinalize): Releases the WebDataSource.
+        (jsPDFDocPrint): Call the WebUIDelegate method -webView:printFrameView:
+        with the PDF document's view.
+        (makeJSPDFDoc): Makes and returns a JavaScript Doc instance that wraps
+        the WebDataSource.
+        * WebView/WebPDFDocumentExtras.h: Added.
+        * WebView/WebPDFDocumentExtras.mm: Added.
+        (appendValuesInPDFNameSubtreeToArray): Traverses a subtree of a PDF name
+        tree and adds all values in the subtree to an array.
+        (allValuesInPDFNameTree): Returns an array with all of the values in a
+        PDF name tree.
+        (web_PDFDocumentAllScripts): This is the implementation of -[PDFDocument
+        _web_allScripts]. It gets all values in the document-level "JavaScript"
+        name tree, which are action dictionaries, and returns an array of the
+        actions' scripts.
+        (addWebPDFDocumentExtras): Adds the -_web_allScripts method to
+        PDFDocument.
+        * WebView/WebPDFRepresentation.h:
+        * WebView/WebPDFRepresentation.m: Removed.
+        * WebView/WebPDFRepresentation.mm: Copied from WebKit/mac/WebView/WebPDFRepresentation.m.
+        (+[WebPDFRepresentation initialize]): Added. Calls
+        addWebPDFDocumentExtras().
+        (-[WebPDFRepresentation finishedLoadingWithDataSource:]): Get the
+        scripts from the PDF document, create a JavaScript Doc object for the
+        document, and a JavaScript execution context, then execute every script
+        in the context, with the Doc object as "this".
+
+2009-09-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Compositing layers are incorrectly positioned after scrolling with position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29262
+        
+        When scrolling a page with compositing layers inside a position:fixed element,
+        we need to update the compositing layer positions when the scroll position changes.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _frameOrBoundsChanged]):
+        Call the new FrameView::scrollPositionChanged() method rather than sending the
+        scroll event directly.
+
+2009-09-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Reflect the rename of platformWindow and it's return type.
+
+        * WebCoreSupport/WebChromeClient.h:
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::platformPageClient):
+
+2009-09-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7007541> 
+        CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
+
+        Add null checks for m_instanceProxy (It will be null when a plug-in has crashed).
+        
+        * Plugins/Hosted/ProxyInstance.mm:
+        (WebKit::ProxyInstance::invoke):
+        (WebKit::ProxyInstance::supportsInvokeDefaultMethod):
+        (WebKit::ProxyInstance::supportsConstruct):
+        (WebKit::ProxyInstance::getPropertyNames):
+        (WebKit::ProxyInstance::methodsNamed):
+        (WebKit::ProxyInstance::fieldNamed):
+        (WebKit::ProxyInstance::fieldValue):
+        (WebKit::ProxyInstance::setFieldValue):
+        (WebKit::ProxyInstance::invalidate):
+
+2009-09-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Work around a bug in AppKit on Leopard which causes compositing layers to jitter, and
+        become misplaced when the WebHTMLView is resized or scrolled sometimes.
+        <rdar://problem/7071636>
+        
+        The previous fix didn't fix the case where the layers jiggle when resizing the docked
+        inspector when the view size is over 2048px tall, on Leopard.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _updateLayerHostingViewPosition]):
+
+2009-09-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Work around a bug in AppKit on Leopard which causes compositing layers to jitter, and
+        become misplaced when the WebHTMLView is resized or scrolled sometimes.
+        <rdar://problem/7071636>
+        
+        We call an internal AppKit method to make sure the layer geometry is updated correctly.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _updateLayerHostingViewPosition]):
+
+2009-09-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fixed position elements flash when CSS transforms are applied on page > 2048px tall
+        https://bugs.webkit.org/show_bug.cgi?id=27272
+        
+        Update the previous workaround for misplaced compositing layers, which used a 4096px
+        threshold, to 2048px since that's the GPU max texture size on some older hardware.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _updateLayerHostingViewPosition]):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added the ENABLE_MATHML to the feaure defines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-15  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/7224378> REGRESSION(r48360): Dragging a tab with a plug-in out of a window, the plug-in gets slow and confused
+
+        In r48360, the fix for <rdar://problem/7090444>, I neglected to consider the case where the plug-in had already been started and
+        -start would do an early-return rather than calling -restartTimers and -addWindowObservers itself.
+
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView viewDidMoveToWindow]): Reinstate the call to -restartTimers and -addWindowObservers, but guard them
+        with a check that the view is still in the window.
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Safari 4 cannot be used to update firmware on Linksys routers.
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        Adopt the new WebCore::CredentialStorage in WebKit/Mac.
+
+        * Misc/WebDownload.mm:
+        (-[WebDownloadInternal download:didReceiveAuthenticationChallenge:]):
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (WebKit::getAuthenticationInfo):
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix <rdar://problem/7090444> Crashes in-[WebBaseNetscapePluginView stop] handling NSWindowWillCloseNotification.
+
+        It's not valid to call -addWindowObservers when the view is not in a window, but this can happen when -start
+        initializes a plug-in and the plug-in removes itself from the document during initialization.  -viewDidMoveToWindow
+        calls -start and then calls -addWindowObservers without ensuring that the view is still in a window.
+
+        If -[WebBaseNetscapePluginView addWindowObservers] is incorrectly called when the view is not in a window, it will
+        observe NSWindowWillCloseNotification on all windows.  This unexpected observer registration is not balanced by an
+        unregistration so the notification can be delivered after the view is deallocated, causing the crash seen in
+        <rdar://problem/7090444>.
+
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView start]): Only call -updateAndSetWindow if we still have a current window.
+        (-[WebBaseNetscapePluginView viewDidMoveToWindow]): Remove unnecessary calls to -restartTimers and -addWindowObservers
+        from -[WebBaseNetscapePluginView viewDidMoveToWindow].  They are already called from within -start with the extra benefit
+        of ensuring that the view is still in a window when they are called.
+
+2009-09-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix <rdar://problem/7145242> Crashes inside WTF::HashTable below NetscapePluginInstanceProxy::disconnectStream
+
+        * Plugins/Hosted/HostedNetscapePluginStream.mm:
+        (WebKit::HostedNetscapePluginStream::cancelLoad): Canceling the load can result in calling through to disconnectStream.
+        If the plug-in instance holds the last reference to the plug-in stream this will result in the stream being deallocated.
+        This leads to HostedNetscapePluginStream::cancelLoad's call to disconnectStream being passed a deallocated stream object.
+        Since the stream was already disconnected by the call to cancel there's no need to call disconnectStream a second time.
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r48229.
+        http://trac.webkit.org/changeset/48229
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _dragSourceMovedTo:]):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Update JavaScriptCore and WebKit's FeatureDefines.xcconfig so that they are in sync with WebCore as they need to be.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize DataTransfer's effectAllowed and dropEffect properties correctly
+        according to HTML5 spec (sec. 7.9.2-7.9.3).
+        https://bugs.webkit.org/show_bug.cgi?id=26700
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _dragSourceMovedTo:]):
+            Pass current drag operation (if known) to EventHandler::dragSourceMovedTo().
+
+2009-09-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29102, add support for user stylesheet injection.  This is similar
+        to user script injection but allows for user stylesheets to be added.  The stylesheets are applied immediately
+        to all Frames in the PageGroup.
+
+        Added userscripts/simple-stylesheet.html test case.
+
+        * WebView/WebView.mm:
+        (+[WebView _addUserStyleSheetToGroup:source:url:worldID:patterns:]):
+        * WebView/WebViewPrivate.h:
+
+2009-09-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
+        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
+        Geolocation service with DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=28264
+
+        * WebCoreSupport/WebGeolocationMockPrivate.h: Added.
+        * WebCoreSupport/WebGeolocationMock.mm: Added.
+        (+[WebGeolocationMock setError:code:]): Added. Used by DumpRender tree to configure the mock Geolocation service.
+        (+[WebGeolocationMock setPosition:latitude:longitude:accuracy:]): Added. Used by DumpRender tree to configure the mock Geolocation service.
+        * WebKit.exp: Modified. Exports WebGeolocationMock.
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default.
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-06  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop <definition-src> support
+        https://bugs.webkit.org/show_bug.cgi?id=28991
+
+        * MigrateHeaders.make: Remove reference to ObjC definition-src
+        binding class.
+
+2009-09-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Account for scrollbar state changes that occur during layout.
+
+        * WebView/WebDynamicScrollBarsView.mm:
+        (-[WebDynamicScrollBarsView updateScrollers]):
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * WebView/WebFrameView.mm:
+        (-[WebFrameView _install]):
+
+        Eliminate duplicated (and incorrect) scrollbar mode tracking between
+        FrameView and ScrollView.
+
+2009-09-03  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28890, make simple user script injection work.
+        
+        This patch adds new API for adding and removing user scripts from page groups.  User scripts
+        are bundled together in isolated worlds (you can have multiple scripts together in the same
+        world).
+
+        Added userscripts/ directory for holding new tests (along with a simple test of script injection).
+
+        * WebView/WebView.mm:
+        (+[WebView _addUserScriptToGroup:source:url:worldID:patterns:injectionTime:]):
+        (+[WebView _removeUserContentFromGroup:worldID:]):
+        (+[WebView _removeAllUserContentFromGroup:]):
+        * WebView/WebViewPrivate.h:
+
+2009-09-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Plumb mixed content notifications to WebFrameLoadDelegatePrivate.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::didDisplayInsecureContent):
+        (WebFrameLoaderClient::didRunInsecureContent):
+        * WebView/WebDelegateImplementationCaching.h:
+        * WebView/WebFrameLoadDelegatePrivate.h: Added.
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.
+
+        Change notImplemented() to a FIXME.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::didDisplayInsecureContent):
+        (WebFrameLoaderClient::didRunInsecureContent):
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Plumb mixed content notifications to WebFrameLoadDelegatePrivate.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::didDisplayInsecureContent):
+        (WebFrameLoaderClient::didRunInsecureContent):
+        * WebView/WebDelegateImplementationCaching.h:
+        * WebView/WebFrameLoadDelegatePrivate.h: Added.
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Stub implementations of mixed content methods of FrameLoaderClient. 
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::didDisplayInsecureContent):
+        (WebFrameLoaderClient::didRunInsecureContent):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _topHTMLView]): Rework the ASSERT in this method to reflect the
+          reality of calling this method for pages currently in the PageCache.
+
+2009-08-31  Dimitri Glazkov  <dglazkov@chromium.org>
+
+    Reverting http://trac.webkit.org/changeset/47904, because it caused
+    layout test failure.
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28852
+        Rename KURL single argument constructor to avoid confusion
+
+        * WebView/WebScriptDebugger.mm: (toNSURL): Adapt to the change.
+
+2009-08-31  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * WebView/WebDynamicScrollBarsView.mm:
+        (-[WebDynamicScrollBarsView updateScrollers]):
+
+2009-08-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by John Sullivan.
+
+        update-webkit-localizable-strings script can no longer complete
+        https://bugs.webkit.org/show_bug.cgi?id=28792
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory AXARIAContentGroupText:]):
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Add empty implementation for new ChromeClient method.
+
+        * WebCoreSupport/WebChromeClient.h:
+        (WebChromeClient::scrollbarsModeDidChange):
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <video> and <audio> controller should be accessible
+        https://bugs.webkit.org/show_bug.cgi?id=28081
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory localizedMediaControlElementString:]):
+        (-[WebViewFactory localizedMediaControlElementHelpText:]):
+        (-[WebViewFactory localizedMediaTimeDescription:]):
+            New.
+
+2009-08-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by NOBODY (build fix)
+
+        Turn off ENABLE_3D_CANVAS in the xconfig files.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-22  Adam Barth  <abarth@webkit.org>
+
+        Revert 47684.  We're going to do this later once clients have had a
+        chance to opt into the setting they like.
+
+        * Misc/WebKitVersionChecks.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+
+2009-08-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't let local files access web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28480
+
+        * Misc/WebKitVersionChecks.m:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+
+2009-08-21  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7162480>
+        Sometimes WebKit does not layout correctly when a WebView is embedded in an HICocoaView
+        
+        Add a null check for the current context when reflectScrolledClipView: is called from outside a 
+        draw operation.
+        
+        * WebView/WebDynamicScrollBarsView.mm:
+        (-[WebDynamicScrollBarsView reflectScrolledClipView:]):
+
+2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Enable various "grouping" ARIA roles
+        https://bugs.webkit.org/show_bug.cgi?id=28486
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory AXARIAContentGroupText:]):
+
+2009-08-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <http://webkit.org/b/28484> Plug-in-related leaks seen on the build bot
+
+        When the plug-in data is being loaded manually there is a reference cycle between the
+        NetscapePluginInstanceProxy and the HostedNetscapePluginStream.  We need to explicitly
+        break the reference cycle in NetscapePluginInstanceProxy::cleanup so that both objects
+        will be destroyed.
+
+        Take the opportunity to add RefCountedLeakCounter support to HostedNetscapePluginStream
+        and NetscapePluginInstanceProxy to simplify tracking down leaks of these objects in the future.
+
+        * Plugins/Hosted/HostedNetscapePluginStream.h:
+        * Plugins/Hosted/HostedNetscapePluginStream.mm:
+        (WebKit::HostedNetscapePluginStream::HostedNetscapePluginStream):
+        (WebKit::HostedNetscapePluginStream::~HostedNetscapePluginStream):
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::NetscapePluginInstanceProxy):
+        (WebKit::NetscapePluginInstanceProxy::~NetscapePluginInstanceProxy):
+        (WebKit::NetscapePluginInstanceProxy::cleanup): Clear m_manualStream to break the reference
+        cycle.
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        * WebView/WebView.mm: Add SPI to manipulate origin access whitelists.
+        (+[WebView _whiteListAccessFromOrigin:destinationProtocol:destinationHost:allowDestinationSubdomains:]): Ditto.
+        (+[WebView _resetOriginAccessWhiteLists]): Ditto.
+        * WebView/WebViewPrivate.h: Ditto.
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Mac specific part of
+        
+        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        Implement shouldLoadMediaElementURL by asking the policy delegate.
+        
+        * WebView/WebPolicyDelegatePrivate.h:
+        Add new delegate method, remove some unused cruft.
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads.
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        * WebKit.exp:
+        Exported WebWorkersPrivate so DumpRenderTree can access it.
+        * Workers/WebWorkersPrivate.h: Added.
+        * Workers/WebWorkersPrivate.mm: Added.
+        (+[WebWorkersPrivate workerThreadCount]):
+        Added WebWorkersPrivate::workerThreadCount() API for DumpRenderTree.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use a HashMap instead of a list of if statements for the command
+        name exception map.
+
+        * WebView/WebHTMLView.mm:
+        (createSelectorExceptionMap): Added.
+        (commandNameForSelector): Use createSelectorExceptionMap.
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28366> WebHTMLViewInternal.h: add @class CALayer declaration
+
+        Reviewed by Simon Fraser.
+
+        Without WebKitPrefix.h, the missing @class CALayer declaration
+        causes a compile-time error.
+
+        * WebView/WebHTMLViewInternal.h: Added @class CALayer
+        declaration with USE(ACCELERATED_COMPOSITING).
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28355> Replace MAX()/MIN() macros with type-safe std::max()/min() templates
+
+        Reviewed by Dan Bernstein.
+
+        * Plugins/WebBaseNetscapePluginStream.mm: Added using std::min
+        statement.
+        (WebNetscapePluginStream::deliverData): Changed MIN() to min().
+        Changed C-style cast to a static_cast.
+        * Plugins/WebNetscapePluginView.mm: Added using std::min
+        statement.
+        (-[WebNetscapePluginView _postURL:target:len:buf:file:notifyData:sendNotification:allowHeaders:]):
+        Changed MIN() to min().  Changed C-style cast to a static_cast.
+        * WebView/WebHTMLView.mm: Added using std::max statement.
+        (-[WebHTMLView _dragImageForURL:withLabel:]): Changed MAX() to
+        max().
+        (-[WebHTMLView _scaleFactorForPrintOperation:]): Ditto.
+        * WebView/WebTextCompletionController.mm: Added using std::max
+        and using std::min statements.
+        (-[WebTextCompletionController _placePopupWindow:]): Changed
+        type of maxWidth variable from float to CGFloat to prevent a
+        type mismatch on x86_64.  Changed MAX() to max() and MIN() to
+        min().  Added static_cast for a constant value since CGFloat is
+        defined as a float on i386 and as a double on x86_64.
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added ENABLE_EVENTSOURCE flag.
+        https://bugs.webkit.org/show_bug.cgi?id=14997
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-14  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::enumerate):  Add the necessary .get() calls.
+
+2009-08-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/7091546> - Assertion failure in plugins/return-error-from-new-stream-doesnt-invoke-destroy-stream.html 
+        on 64-bit SnowLeopard
+
+        * Plugins/Hosted/HostedNetscapePluginStream.mm:
+        (WebKit::HostedNetscapePluginStream::cancelLoad): Since this might be called while the FrameLoader is switching DocumentLoaders
+          during the brief moment where there is no activeDocumentLoader(), accept and handle a validly null DocumentLoader.
+
+2009-08-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Fix leaks of NSNumber and NSMutableArray objects seen during layout tests.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::enumerate): Don't leak an NSMutableArray that we allocate.
+
+2009-08-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix leaks of HostedNetscapePluginStream and NetscapePlugInStreamLoader objects seen during layout tests.
+
+        * Plugins/Hosted/HostedNetscapePluginStream.mm:
+        (WebKit::HostedNetscapePluginStream::didFail): Disconnect the stream from the plug-in instance proxy
+        when the load fails.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm: Updated includes.
+        * WebView/WebScriptDebugger.mm: Ditto.
+
+2009-08-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/6017913> Replace use of HISearchWindowShow in -[WebView _searchWithSpotlightFromMenu].
+
+        * WebView/WebView.mm:
+        (-[WebView _searchWithSpotlightFromMenu:]): Use -[NSWorkspace showSearchResultsForQueryString:] post-Leopard.
+
+2009-08-12  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Add delegate methods about focus and blur and state change
+        https://bugs.webkit.org/show_bug.cgi?id=27153
+        
+        Have ObjC delegate methods match C++ method names in the ChromeClient.
+
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::formDidFocus):
+        (WebChromeClient::formDidBlur):
+        * WebView/WebUIDelegatePrivate.h:
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25643
+
+        Adds ENABLE_NOTIFICATION flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove dead declarations.
+        
+        * WebView/WebViewInternal.h:
+
+2009-08-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Originally implemented by Glenn Wilson <gwilson@chromium.org>.
+
+        Added new methods for overriding default WebPreference values
+        and for resetting preferences to their defaults.
+        See https://bugs.webkit.org/show_bug.cgi?id=20534
+
+        * WebView/WebPreferences.mm:
+        (-[WebPreferences _setPreferenceForTestWithValue:withKey:]): added.
+        * WebView/WebPreferencesPrivate.h: same.
+
 2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
 
         Reviewed by George Staikos.
diff --git a/WebKit/mac/Configurations/FeatureDefines.xcconfig b/WebKit/mac/Configurations/FeatureDefines.xcconfig
index 63c8190..ed387aa 100644
--- a/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -28,7 +28,9 @@
 
 // Set any ENABLE_FEATURE_NAME macro to an empty string to disable that feature.
 
-ENABLE_3D_CANVAS = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(MAC_OS_X_VERSION_MAJOR));
+ENABLE_3D_CANVAS_1050 = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS_1060 = ENABLE_3D_CANVAS;
 
 ENABLE_3D_RENDERING = $(ENABLE_3D_RENDERING_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_RENDERING_1050 = ENABLE_3D_RENDERING;
@@ -37,14 +39,18 @@ ENABLE_3D_RENDERING_1060 = ENABLE_3D_RENDERING;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_DATABASE = ENABLE_DATABASE;
 ENABLE_DATAGRID = ENABLE_DATAGRID;
+ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
+ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
 ENABLE_FILTERS = ;
 ENABLE_GEOLOCATION = ;
 ENABLE_ICONDATABASE = ENABLE_ICONDATABASE;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_MATHML = ;
+ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
 ENABLE_RUBY = ENABLE_RUBY;
-ENABLE_SHARED_WORKERS = ;
+ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_ANIMATION = ENABLE_SVG_ANIMATION;
 ENABLE_SVG_AS_IMAGE = ENABLE_SVG_AS_IMAGE;
@@ -53,10 +59,10 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
-ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS
+ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 ENABLE_WML = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DOM_STORAGE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebKit/mac/Configurations/Version.xcconfig b/WebKit/mac/Configurations/Version.xcconfig
index d07d57f..66d574b 100644
--- a/WebKit/mac/Configurations/Version.xcconfig
+++ b/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 0;
+MINOR_VERSION = 2;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebKit/mac/History/WebHistory.mm b/WebKit/mac/History/WebHistory.mm
index e971aba..6304fd2 100644
--- a/WebKit/mac/History/WebHistory.mm
+++ b/WebKit/mac/History/WebHistory.mm
@@ -148,27 +148,42 @@ private:
 
 #pragma mark MODIFYING CONTENTS
 
-static WebHistoryDateKey timeIntervalForBeginningOfDay(NSTimeInterval interval)
+static void getDayBoundaries(NSTimeInterval interval, NSTimeInterval& beginningOfDay, NSTimeInterval& beginningOfNextDay)
 {
     CFTimeZoneRef timeZone = CFTimeZoneCopyDefault();
     CFGregorianDate date = CFAbsoluteTimeGetGregorianDate(interval, timeZone);
     date.hour = 0;
     date.minute = 0;
     date.second = 0;
-    NSTimeInterval result = CFGregorianDateGetAbsoluteTime(date, timeZone);
+    beginningOfDay = CFGregorianDateGetAbsoluteTime(date, timeZone);
+    date.day += 1;
+    beginningOfNextDay = CFGregorianDateGetAbsoluteTime(date, timeZone);
     CFRelease(timeZone);
+}
 
-    // Converting from double to int64_t is safe here as NSDate's useful range
-    // is -2**48 .. 2**47 which will safely fit in an int64_t.
-    return (WebHistoryDateKey)result;
+static inline NSTimeInterval beginningOfDay(NSTimeInterval date)
+{
+    static NSTimeInterval cachedBeginningOfDay = NAN;
+    static NSTimeInterval cachedBeginningOfNextDay;
+    if (!(date >= cachedBeginningOfDay && date < cachedBeginningOfNextDay))
+        getDayBoundaries(date, cachedBeginningOfDay, cachedBeginningOfNextDay);
+    return cachedBeginningOfDay;
+}
+
+static inline WebHistoryDateKey dateKey(NSTimeInterval date)
+{
+    // Converting from double (NSTimeInterval) to int64_t (WebHistoryDateKey) is
+    // safe here because all sensible dates are in the range -2**48 .. 2**47 which
+    // safely fits in an int64_t.
+    return beginningOfDay(date);
 }
 
 // Returns whether the day is already in the list of days,
 // and fills in *key with the key used to access its location
 - (BOOL)findKey:(WebHistoryDateKey*)key forDay:(NSTimeInterval)date
 {
-    ASSERT_ARG(key, key != nil);
-    *key = timeIntervalForBeginningOfDay(date);
+    ASSERT_ARG(key, key);
+    *key = dateKey(date);
     return _entriesByDate->contains(*key);
 }
 
diff --git a/WebKit/mac/MigrateHeaders.make b/WebKit/mac/MigrateHeaders.make
index 7211aa3..9e78367 100644
--- a/WebKit/mac/MigrateHeaders.make
+++ b/WebKit/mac/MigrateHeaders.make
@@ -242,7 +242,6 @@ all : \
     $(INTERNAL_HEADERS_DIR)/DOMSVGCursorElementInternal.h \
     $(PRIVATE_HEADERS_DIR)/DOMSVGDefsElement.h \
     $(INTERNAL_HEADERS_DIR)/DOMSVGDefsElementInternal.h \
-    $(PRIVATE_HEADERS_DIR)/DOMSVGDefinitionSrcElement.h \
     $(PRIVATE_HEADERS_DIR)/DOMSVGDescElement.h \
     $(INTERNAL_HEADERS_DIR)/DOMSVGDescElementInternal.h \
     $(PRIVATE_HEADERS_DIR)/DOMSVGDocument.h \
diff --git a/WebKit/mac/Misc/WebDownload.mm b/WebKit/mac/Misc/WebDownload.mm
index 978465a..01ed767 100644
--- a/WebKit/mac/Misc/WebDownload.mm
+++ b/WebKit/mac/Misc/WebDownload.mm
@@ -31,6 +31,9 @@
 #import <Foundation/NSURLAuthenticationChallenge.h>
 #import <Foundation/NSURLDownload.h>
 #import <WebCore/AuthenticationMac.h>
+#import <WebCore/Credential.h>
+#import <WebCore/CredentialStorage.h>
+#import <WebCore/ProtectionSpace.h>
 #import <WebKit/WebPanelAuthenticationHandler.h>
 #import <wtf/Assertions.h>
 
@@ -111,7 +114,7 @@ using namespace WebCore;
 {
     // Try previously stored credential first.
     if (![challenge previousFailureCount]) {
-        NSURLCredential *credential = WebCoreCredentialStorage::get([challenge protectionSpace]);
+        NSURLCredential *credential = mac(CredentialStorage::get(core([challenge protectionSpace])));
         if (credential) {
             [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
             return;
diff --git a/WebKit/mac/Misc/WebNSFileManagerExtras.m b/WebKit/mac/Misc/WebNSFileManagerExtras.m
index 5733598..fb1286f 100644
--- a/WebKit/mac/Misc/WebNSFileManagerExtras.m
+++ b/WebKit/mac/Misc/WebNSFileManagerExtras.m
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,13 +28,13 @@
 
 #import <WebKit/WebNSFileManagerExtras.h>
 
+#import "WebKitNSStringExtras.h"
+#import "WebNSURLExtras.h"
 #import <WebCore/FoundationExtras.h>
-#import <WebKit/WebKitNSStringExtras.h>
 #import <WebKitSystemInterface.h>
-#import <wtf/Assertions.h>
-
 #import <pthread.h>
 #import <sys/mount.h>
+#import <JavaScriptCore/Assertions.h>
 
 @implementation NSFileManager (WebNSFileManagerExtras)
 
@@ -170,6 +170,10 @@ static void *setMetaData(void* context)
 {
     ASSERT(URLString);
     ASSERT(path);
+
+    NSURL *URL = [NSURL _web_URLWithUserTypedString:URLString];
+    if (URL)
+        URLString = [[URL _web_URLByRemovingUserInfo] _web_userVisibleString];
  
     // Spawn a background thread for WKSetMetadataURL because this function will not return until mds has
     // journaled the data we're're trying to set. Depending on what other I/O is going on, it can take some
diff --git a/WebKit/mac/Misc/WebNSURLExtras.h b/WebKit/mac/Misc/WebNSURLExtras.h
index 40f7cf7..c7b266e 100644
--- a/WebKit/mac/Misc/WebNSURLExtras.h
+++ b/WebKit/mac/Misc/WebNSURLExtras.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,6 +28,9 @@
 
 #import <Foundation/Foundation.h>
 
+// FIXME: Change method names back to _web_ from _webkit_ when identically-named
+// methods are no longer present in Foundation.
+
 @interface NSURL (WebNSURLExtras)
 
 + (NSURL *)_web_URLWithUserTypedString:(NSString *)string;
@@ -52,12 +55,10 @@
 
 - (BOOL)_web_isEmpty;
 
-// FIXME: change these names back to _web_ when identically-named
-// methods are removed from Foundation
-
 - (NSURL *)_webkit_canonicalize;
 - (NSURL *)_webkit_URLByRemovingFragment;
 - (NSURL *)_webkit_URLByRemovingResourceSpecifier;
+- (NSURL *)_web_URLByRemovingUserInfo;
 
 - (BOOL)_webkit_isJavaScriptURL;
 - (BOOL)_webkit_isFileURL;
@@ -83,8 +84,6 @@
 - (NSString *)_web_decodeHostName; // turns funny-looking ASCII form into Unicode, returns self if no decoding needed, convenient cover
 - (NSString *)_web_encodeHostName; // turns Unicode into funny-looking ASCII form, returns self if no decoding needed, convenient cover
 
-// FIXME: change these names back to _web_ when identically-named
-// methods are removed from or renamed in Foundation
 - (BOOL)_webkit_isJavaScriptURL;
 - (BOOL)_webkit_isFTPDirectoryURL;
 - (BOOL)_webkit_isFileURL;
diff --git a/WebKit/mac/Misc/WebNSURLExtras.mm b/WebKit/mac/Misc/WebNSURLExtras.mm
index d956f09..2affbed 100644
--- a/WebKit/mac/Misc/WebNSURLExtras.mm
+++ b/WebKit/mac/Misc/WebNSURLExtras.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -619,21 +619,9 @@ static CFStringRef createStringWithEscapedUnsafeCharacters(CFStringRef string)
     return result;
 }
 
-typedef struct {
-    NSString *scheme;
-    NSString *user;
-    NSString *password;
-    NSString *host;
-    CFIndex port; // kCFNotFound means ignore/omit
-    NSString *path;
-    NSString *query;
-    NSString *fragment;
-} WebKitURLComponents;
-
-- (NSURL *)_webkit_URLByRemovingComponent:(CFURLComponentType)component
+- (NSURL *)_web_URLByTruncatingOneCharacterBeforeComponent:(CFURLComponentType)component
 {
     CFRange fragRg = CFURLGetByteRangeForComponent((CFURLRef)self, component, NULL);
-    // Check to see if a fragment exists before decomposing the URL.
     if (fragRg.location == kCFNotFound)
         return self;
  
@@ -656,12 +644,53 @@ typedef struct {
 
 - (NSURL *)_webkit_URLByRemovingFragment
 {
-    return [self _webkit_URLByRemovingComponent:kCFURLComponentFragment];
+    return [self _web_URLByTruncatingOneCharacterBeforeComponent:kCFURLComponentFragment];
 }
 
 - (NSURL *)_webkit_URLByRemovingResourceSpecifier
 {
-    return [self _webkit_URLByRemovingComponent:kCFURLComponentResourceSpecifier];
+    return [self _web_URLByTruncatingOneCharacterBeforeComponent:kCFURLComponentResourceSpecifier];
+}
+
+- (NSURL *)_web_URLByRemovingComponentAndSubsequentCharacter:(CFURLComponentType)component
+{
+    CFRange range = CFURLGetByteRangeForComponent((CFURLRef)self, component, 0);
+    if (range.location == kCFNotFound)
+        return self;
+
+    // Remove one subsequent character.
+    ++range.length;
+
+    UInt8* urlBytes;
+    UInt8 buffer[2048];
+    CFIndex numBytes = CFURLGetBytes((CFURLRef)self, buffer, 2048);
+    if (numBytes == -1) {
+        numBytes = CFURLGetBytes((CFURLRef)self, NULL, 0);
+        urlBytes = static_cast<UInt8*>(malloc(numBytes));
+        CFURLGetBytes((CFURLRef)self, urlBytes, numBytes);
+    } else
+        urlBytes = buffer;
+
+    if (numBytes < range.location)
+        return self;
+    if (numBytes < range.location + range.length)
+        range.length = numBytes - range.location;
+
+    memmove(urlBytes + range.location, urlBytes + range.location + range.length, numBytes - range.location + range.length);
+
+    NSURL *result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, numBytes - range.length, kCFStringEncodingUTF8, NULL));
+    if (!result)
+        result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, numBytes - range.length, kCFStringEncodingISOLatin1, NULL));
+
+    if (urlBytes != buffer)
+        free(urlBytes);
+
+    return result ? [result autorelease] : self;
+}
+
+- (NSURL *)_web_URLByRemovingUserInfo
+{
+    return [self _web_URLByRemovingComponentAndSubsequentCharacter:kCFURLComponentUserInfo];
 }
 
 - (BOOL)_webkit_isJavaScriptURL
diff --git a/WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.h b/WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.h
index 72e845b..946c8ac 100644
--- a/WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.h
+++ b/WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.h
@@ -43,7 +43,7 @@ namespace WebCore {
 namespace WebKit {
 
 class NetscapePluginInstanceProxy;
-    
+
 class HostedNetscapePluginStream : public RefCounted<HostedNetscapePluginStream>
                                  , private WebCore::NetscapePlugInStreamLoaderClient {
 public:
@@ -55,9 +55,11 @@ public:
     {
         return adoptRef(new HostedNetscapePluginStream(instance, frameLoader));
     }
-                                     
+
+    ~HostedNetscapePluginStream();
+
     uint32_t streamID() const { return m_streamID; }
-    
+
     void startStreamWithResponse(NSURLResponse *response);
     void didReceiveData(WebCore::NetscapePlugInStreamLoader*, const char* bytes, int length);
     void didFinishLoading(WebCore::NetscapePlugInStreamLoader*);
diff --git a/WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm b/WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm
index 63e18a0..5c25ef7 100644
--- a/WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm
+++ b/WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm
@@ -39,12 +39,18 @@
 #import <WebCore/DocumentLoader.h>
 #import <WebCore/Frame.h>
 #import <WebCore/FrameLoader.h>
+#import <WebCore/SecurityOrigin.h>
 #import <WebCore/WebCoreURLResponse.h>
+#import <wtf/RefCountedLeakCounter.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter hostedNetscapePluginStreamCounter("HostedNetscapePluginStream");
+#endif
+
 HostedNetscapePluginStream::HostedNetscapePluginStream(NetscapePluginInstanceProxy* instance, uint32_t streamID, NSURLRequest *request)
     : m_instance(instance)
     , m_streamID(streamID)
@@ -53,8 +59,12 @@ HostedNetscapePluginStream::HostedNetscapePluginStream(NetscapePluginInstancePro
     , m_requestURL([request URL])
     , m_frameLoader(0)
 {
-    if (core([instance->pluginView() webFrame])->loader()->shouldHideReferrer([request URL], core([instance->pluginView() webFrame])->loader()->outgoingReferrer()))
+    if (SecurityOrigin::shouldHideReferrer([request URL], core([instance->pluginView() webFrame])->loader()->outgoingReferrer()))
         [m_request.get() _web_setHTTPReferrer:nil];
+
+#ifndef NDEBUG
+    hostedNetscapePluginStreamCounter.increment();
+#endif
 }
 
 HostedNetscapePluginStream::HostedNetscapePluginStream(NetscapePluginInstanceProxy* instance, WebCore::FrameLoader* frameLoader)
@@ -63,6 +73,16 @@ HostedNetscapePluginStream::HostedNetscapePluginStream(NetscapePluginInstancePro
     , m_isTerminated(false)
     , m_frameLoader(frameLoader)
 {
+#ifndef NDEBUG
+    hostedNetscapePluginStreamCounter.increment();
+#endif
+}
+
+HostedNetscapePluginStream::~HostedNetscapePluginStream()
+{
+#ifndef NDEBUG
+    hostedNetscapePluginStreamCounter.decrement();
+#endif
 }
 
 void HostedNetscapePluginStream::startStreamWithResponse(NSURLResponse *response)
@@ -178,8 +198,9 @@ void HostedNetscapePluginStream::didFail(WebCore::NetscapePlugInStreamLoader*, c
 {
     if (NetscapePluginHostProxy* hostProxy = m_instance->hostProxy())
         _WKPHStreamDidFail(hostProxy->port(), m_instance->pluginID(), m_streamID, reasonForError(error));
+    m_instance->disconnectStream(this);
 }
-    
+
 bool HostedNetscapePluginStream::wantsAllStreams() const
 {
     // FIXME: Implement.
@@ -218,17 +239,17 @@ void HostedNetscapePluginStream::cancelLoad(NSError *error)
         ASSERT(!m_loader);
         
         DocumentLoader* documentLoader = m_frameLoader->activeDocumentLoader();
-        ASSERT(documentLoader);
-        
-        if (documentLoader->isLoadingMainResource())
+        if (documentLoader && documentLoader->isLoadingMainResource())
             documentLoader->cancelMainResourceLoad(error);
         return;
     }
-    
-    if (!m_loader->isDone())
+
+    if (!m_loader->isDone()) {
+        // Cancelling the load will disconnect the stream so there's no need to do it explicitly.
         m_loader->cancel(error);
-    m_instance->disconnectStream(this);
-}        
+    } else
+        m_instance->disconnectStream(this);
+}
 
 NSError *HostedNetscapePluginStream::pluginCancelledConnectionError() const
 {
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
index 1841afd..280f161 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
@@ -162,6 +162,8 @@ public:
 
     void resolveURL(const char* url, const char* target, data_t& resolvedURLData, mach_msg_type_number_t& resolvedURLLength);
     
+    void didDraw();
+    
     // Reply structs
     struct Reply {
         enum Type {
@@ -307,6 +309,7 @@ private:
     bool m_shouldStopSoon;
     uint32_t m_currentRequestID;
     bool m_inDestroy;
+    bool m_pluginIsWaitingForDraw;
     
     RefPtr<HostedNetscapePluginStream> m_manualStream;
 };
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
index c01ae92..21f35e2 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
@@ -33,30 +33,32 @@
 #import "WebDataSourceInternal.h"
 #import "WebFrameInternal.h"
 #import "WebHostedNetscapePluginView.h"
+#import "WebKitNSStringExtras.h"
 #import "WebNSDataExtras.h"
 #import "WebNSURLExtras.h"
-#import "WebKitNSStringExtras.h"
 #import "WebPluginRequest.h"
-#import "WebViewInternal.h"
 #import "WebUIDelegate.h"
 #import "WebUIDelegatePrivate.h"
-
-#import <mach/mach.h>
-#import <WebCore/CookieJar.h>
+#import "WebViewInternal.h"
+#import <JavaScriptCore/JSLock.h>
+#import <JavaScriptCore/PropertyNameArray.h>
 #import <WebCore/CString.h>
+#import <WebCore/CookieJar.h>
 #import <WebCore/DocumentLoader.h>
 #import <WebCore/Frame.h>
 #import <WebCore/FrameLoader.h>
 #import <WebCore/FrameTree.h>
 #import <WebCore/KURL.h>
-#import <WebCore/npruntime_impl.h>
-#import <WebCore/runtime_object.h>
+#import <WebCore/SecurityOrigin.h>
 #import <WebCore/ScriptController.h>
 #import <WebCore/ScriptValue.h>
+#import <WebCore/StringSourceProvider.h>
+#import <WebCore/npruntime_impl.h>
+#import <WebCore/runtime_object.h>
 #import <WebKitSystemInterface.h>
-#import <runtime/JSLock.h>
-#import <runtime/PropertyNameArray.h>
+#import <mach/mach.h>
 #import <utility>
+#import <wtf/RefCountedLeakCounter.h>
 
 extern "C" {
 #import "WebKitPluginClientServer.h"
@@ -94,6 +96,10 @@ private:
 
 static uint32_t pluginIDCounter;
 
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter netscapePluginInstanceProxyCounter("NetscapePluginInstanceProxy");
+#endif
+
 NetscapePluginInstanceProxy::NetscapePluginInstanceProxy(NetscapePluginHostProxy* pluginHostProxy, WebHostedNetscapePluginView *pluginView, bool fullFramePlugin)
     : m_pluginHostProxy(pluginHostProxy)
     , m_pluginView(pluginView)
@@ -108,6 +114,7 @@ NetscapePluginInstanceProxy::NetscapePluginInstanceProxy(NetscapePluginHostProxy
     , m_shouldStopSoon(false)
     , m_currentRequestID(0)
     , m_inDestroy(false)
+    , m_pluginIsWaitingForDraw(false)
 {
     ASSERT(m_pluginView);
     
@@ -123,6 +130,10 @@ NetscapePluginInstanceProxy::NetscapePluginInstanceProxy(NetscapePluginHostProxy
     } while (pluginHostProxy->pluginInstance(m_pluginID) || !m_pluginID);
     
     pluginHostProxy->addPluginInstance(this);
+
+#ifndef NDEBUG
+    netscapePluginInstanceProxyCounter.increment();
+#endif
 }
 
 NetscapePluginInstanceProxy::~NetscapePluginInstanceProxy()
@@ -131,6 +142,10 @@ NetscapePluginInstanceProxy::~NetscapePluginInstanceProxy()
     
     m_pluginID = 0;
     deleteAllValues(m_replies);
+
+#ifndef NDEBUG
+    netscapePluginInstanceProxyCounter.decrement();
+#endif
 }
 
 void NetscapePluginInstanceProxy::resize(NSRect size, NSRect clipRect, bool sync)
@@ -178,6 +193,7 @@ void NetscapePluginInstanceProxy::cleanup()
         (*it)->invalidate();
     
     m_pluginView = nil;
+    m_manualStream = 0;
 }
 
 void NetscapePluginInstanceProxy::invalidate()
@@ -583,7 +599,7 @@ NPError NetscapePluginInstanceProxy::loadRequest(NSURLRequest *request, const ch
             return NPERR_GENERIC_ERROR;
         }
     } else {
-        if (!FrameLoader::canLoad(URL, String(), core([m_pluginView webFrame])->document()))
+        if (!SecurityOrigin::canLoad(URL, String(), core([m_pluginView webFrame])->document()))
             return NPERR_GENERIC_ERROR;
     }
     
@@ -1032,22 +1048,22 @@ bool NetscapePluginInstanceProxy::enumerate(uint32_t objectID, data_t& resultDat
  
     PropertyNameArray propertyNames(exec);
     object->getPropertyNames(exec, propertyNames);
-    
-    NSMutableArray *array = [[NSMutableArray alloc] init];
+
+    RetainPtr<NSMutableArray*> array(AdoptNS, [[NSMutableArray alloc] init]);
     for (unsigned i = 0; i < propertyNames.size(); i++) {
         uint64_t methodName = reinterpret_cast<uint64_t>(_NPN_GetStringIdentifier(propertyNames[i].ustring().UTF8String().c_str()));
 
-        [array addObject:[NSNumber numberWithLongLong:methodName]];
+        [array.get() addObject:[NSNumber numberWithLongLong:methodName]];
     }
 
-    NSData *data = [NSPropertyListSerialization dataFromPropertyList:array format:NSPropertyListBinaryFormat_v1_0 errorDescription:0];
+    NSData *data = [NSPropertyListSerialization dataFromPropertyList:array.get() format:NSPropertyListBinaryFormat_v1_0 errorDescription:0];
     ASSERT(data);
-    
+
     resultLength = [data length];
     mig_allocate(reinterpret_cast<vm_address_t*>(&resultData), resultLength);
-    
+
     memcpy(resultData, [data bytes], resultLength);
-    
+
     exec->clearException();
 
     return true;
@@ -1271,9 +1287,19 @@ void NetscapePluginInstanceProxy::invalidateRect(double x, double y, double widt
 {
     ASSERT(m_pluginView);
     
+    m_pluginIsWaitingForDraw = true;
     [m_pluginView invalidatePluginContentRect:NSMakeRect(x, y, width, height)];
 }
 
+void NetscapePluginInstanceProxy::didDraw()
+{
+    if (!m_pluginIsWaitingForDraw)
+        return;
+    
+    m_pluginIsWaitingForDraw = false;
+    _WKPHPluginInstanceDidDraw(m_pluginHostProxy->port(), m_pluginID);
+}
+    
 bool NetscapePluginInstanceProxy::getCookies(data_t urlData, mach_msg_type_number_t urlLength, data_t& cookiesData, mach_msg_type_number_t& cookiesLength)
 {
     ASSERT(m_pluginView);
diff --git a/WebKit/mac/Plugins/Hosted/ProxyInstance.mm b/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
index 75bc639..0b3a32f 100644
--- a/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
+++ b/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
@@ -136,6 +136,9 @@ JSC::Bindings::Class *ProxyInstance::getClass() const
 
 JSValue ProxyInstance::invoke(JSC::ExecState* exec, InvokeType type, uint64_t identifier, const JSC::ArgList& args)
 {
+    if (!m_instanceProxy)
+        return jsUndefined();
+    
     RetainPtr<NSData*> arguments(m_instanceProxy->marshalValues(exec, args));
 
     uint32_t requestID = m_instanceProxy->nextRequestID();
@@ -162,6 +165,9 @@ JSValue ProxyInstance::invokeMethod(ExecState* exec, const MethodList& methodLis
 
 bool ProxyInstance::supportsInvokeDefaultMethod() const
 {
+    if (!m_instanceProxy)
+        return false;
+    
     uint32_t requestID = m_instanceProxy->nextRequestID();
     
     if (_WKPHNPObjectHasInvokeDefaultMethod(m_instanceProxy->hostProxy()->port(),
@@ -183,6 +189,9 @@ JSValue ProxyInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
 
 bool ProxyInstance::supportsConstruct() const
 {
+    if (!m_instanceProxy)
+        return false;
+    
     uint32_t requestID = m_instanceProxy->nextRequestID();
     
     if (_WKPHNPObjectHasConstructMethod(m_instanceProxy->hostProxy()->port(),
@@ -236,6 +245,9 @@ JSValue ProxyInstance::valueOf(ExecState* exec) const
 
 void ProxyInstance::getPropertyNames(ExecState* exec, PropertyNameArray& nameArray)
 {
+    if (!m_instanceProxy)
+        return;
+    
     uint32_t requestID = m_instanceProxy->nextRequestID();
     
     if (_WKPHNPObjectEnumerate(m_instanceProxy->hostProxy()->port(), m_instanceProxy->pluginID(), requestID, m_objectID) != KERN_SUCCESS)
@@ -266,6 +278,9 @@ void ProxyInstance::getPropertyNames(ExecState* exec, PropertyNameArray& nameArr
 
 MethodList ProxyInstance::methodsNamed(const Identifier& identifier)
 {
+    if (!m_instanceProxy)
+        return MethodList();
+    
     // If we already have an entry in the map, use it.
     MethodMap::iterator existingMapEntry = m_methods.find(identifier.ustring().rep());
     if (existingMapEntry != m_methods.end()) {
@@ -303,6 +318,9 @@ MethodList ProxyInstance::methodsNamed(const Identifier& identifier)
 
 Field* ProxyInstance::fieldNamed(const Identifier& identifier)
 {
+    if (!m_instanceProxy)
+        return 0;
+    
     // If we already have an entry in the map, use it.
     FieldMap::iterator existingMapEntry = m_fields.find(identifier.ustring().rep());
     if (existingMapEntry != m_fields.end())
@@ -332,6 +350,9 @@ Field* ProxyInstance::fieldNamed(const Identifier& identifier)
 
 JSC::JSValue ProxyInstance::fieldValue(ExecState* exec, const Field* field) const
 {
+    if (!m_instanceProxy)
+        return jsUndefined();
+    
     uint64_t serverIdentifier = static_cast<const ProxyField*>(field)->serverIdentifier();
     uint32_t requestID = m_instanceProxy->nextRequestID();
     
@@ -349,6 +370,9 @@ JSC::JSValue ProxyInstance::fieldValue(ExecState* exec, const Field* field) cons
     
 void ProxyInstance::setFieldValue(ExecState* exec, const Field* field, JSValue value) const
 {
+    if (m_instanceProxy)
+        return;
+    
     uint64_t serverIdentifier = static_cast<const ProxyField*>(field)->serverIdentifier();
     uint32_t requestID = m_instanceProxy->nextRequestID();
     
@@ -368,6 +392,8 @@ void ProxyInstance::setFieldValue(ExecState* exec, const Field* field, JSValue v
 
 void ProxyInstance::invalidate()
 {
+    ASSERT(m_instanceProxy);
+    
     if (NetscapePluginHostProxy* hostProxy = m_instanceProxy->hostProxy())
         _WKPHNPObjectRelease(hostProxy->port(),
                              m_instanceProxy->pluginID(), m_objectID);
diff --git a/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm b/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm
index 0cce014..34a2211 100644
--- a/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm
@@ -330,9 +330,10 @@ extern "C" {
 {
     if (_proxy) {
         if (_softwareRenderer) {
-            if ([NSGraphicsContext currentContextDrawingToScreen])
+            if ([NSGraphicsContext currentContextDrawingToScreen]) {
                 WKSoftwareCARendererRender(_softwareRenderer, (CGContextRef)[[NSGraphicsContext currentContext] graphicsPort], NSRectToCGRect(rect));
-            else
+                _proxy->didDraw();
+            } else
                 _proxy->print(reinterpret_cast<CGContextRef>([[NSGraphicsContext currentContext] graphicsPort]), [self bounds].size.width, [self bounds].size.height);
         }
             
diff --git a/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs b/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
index 41d7498..04edf64 100644
--- a/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
+++ b/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
@@ -220,7 +220,7 @@ simpleroutine PHNPObjectEnumerate(pluginHostPort :mach_port_t;
                                   pluginID :uint32_t;
                                   requestID :uint32_t;
                                   objectID :uint32_t);
-                                  
+
 // Replies
 
 simpleroutine PHBooleanReply(clientPort :mach_port_t;
@@ -233,3 +233,7 @@ simpleroutine PHBooleanAndDataReply(pluginHostPort :mach_port_t;
                                     requestID :uint32_t;
                                     returnValue :boolean_t;
                                     result :data_t);
+             
+simpleroutine PHPluginInstanceDidDraw(pluginHostPort :mach_port_t;
+                                      pluginID :uint32_t);
+                              
diff --git a/WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm b/WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm
index a5a8a2d..232a6c4 100644
--- a/WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm
+++ b/WebKit/mac/Plugins/WebBaseNetscapePluginStream.mm
@@ -42,6 +42,7 @@
 #import <WebCore/DocumentLoader.h>
 #import <WebCore/Frame.h>
 #import <WebCore/FrameLoader.h>
+#import <WebCore/SecurityOrigin.h>
 #import <WebCore/WebCoreObjCExtras.h>
 #import <WebCore/WebCoreURLResponse.h>
 #import <WebKitSystemInterface.h>
@@ -49,6 +50,7 @@
 #import <wtf/StdLibExtras.h>
 
 using namespace WebCore;
+using namespace std;
 
 #define WEB_REASON_NONE -1
 
@@ -159,7 +161,7 @@ WebNetscapePluginStream::WebNetscapePluginStream(NSURLRequest *request, NPP plug
     WebNetscapePluginView *view = (WebNetscapePluginView *)plugin->ndata;
     
     // This check has already been done by the plug-in view.
-    ASSERT(FrameLoader::canLoad([request URL], String(), core([view webFrame])->document()));
+    ASSERT(SecurityOrigin::canLoad([request URL], String(), core([view webFrame])->document()));
     
     ASSERT([request URL]);
     ASSERT(plugin);
@@ -168,7 +170,7 @@ WebNetscapePluginStream::WebNetscapePluginStream(NSURLRequest *request, NPP plug
     
     streams().add(&m_stream, plugin);
         
-    if (core([view webFrame])->loader()->shouldHideReferrer([request URL], core([view webFrame])->loader()->outgoingReferrer()))
+    if (SecurityOrigin::shouldHideReferrer([request URL], core([view webFrame])->loader()->outgoingReferrer()))
         [m_request.get() _web_setHTTPReferrer:nil];
 }
 
@@ -522,7 +524,7 @@ void WebNetscapePluginStream::deliverData()
                 m_deliverDataTimer.startOneShot(0);
             break;
         } else {
-            deliveryBytes = MIN(deliveryBytes, totalBytes - totalBytesDelivered);
+            deliveryBytes = min(deliveryBytes, totalBytes - totalBytesDelivered);
             NSData *subdata = [m_deliveryData.get() subdataWithRange:NSMakeRange(totalBytesDelivered, deliveryBytes)];
             PluginStopDeferrer deferrer(m_pluginView.get());
             deliveryBytes = m_pluginFuncs->write(m_plugin, &m_stream, m_offset, [subdata length], (void *)[subdata bytes]);
@@ -531,7 +533,7 @@ void WebNetscapePluginStream::deliverData()
                 cancelLoadAndDestroyStreamWithError(pluginCancelledConnectionError());
                 return;
             }
-            deliveryBytes = MIN((unsigned)deliveryBytes, [subdata length]);
+            deliveryBytes = min<int32>(deliveryBytes, [subdata length]);
             m_offset += deliveryBytes;
             totalBytesDelivered += deliveryBytes;
             LOG(Plugins, "NPP_Write responseURL=%@ bytes=%d total-delivered=%d/%d", m_responseURL.get(), deliveryBytes, m_offset, m_stream.end);
diff --git a/WebKit/mac/Plugins/WebBaseNetscapePluginView.h b/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
index a9fb188..bd05ebe 100644
--- a/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
+++ b/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
@@ -31,6 +31,7 @@
 
 #import "WebNetscapePluginPackage.h"
 #import "WebPluginContainerCheck.h"
+#import <wtf/OwnPtr.h>
 #import <wtf/PassRefPtr.h>
 #import <wtf/RefPtr.h>
 #import <wtf/RetainPtr.h>
@@ -45,6 +46,8 @@ namespace WebCore {
     class HTMLPlugInElement;
 }
 
+class WebHaltablePlugin;
+
 @interface WebBaseNetscapePluginView : NSView
 {
     RetainPtr<WebNetscapePluginPackage> _pluginPackage;
@@ -65,6 +68,8 @@ namespace WebCore {
     RetainPtr<NSURL> _baseURL;
     RetainPtr<NSURL> _sourceURL;
     
+    OwnPtr<WebHaltablePlugin> _haltable;
+    
     NSTrackingRectTag _trackingTag;
 }
 
@@ -101,6 +106,7 @@ namespace WebCore {
 - (void)startTimers;
 - (void)restartTimers;
 
+- (void)start;
 - (void)stop;
 
 - (void)addWindowObservers;
diff --git a/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm b/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
index 1345fc3..e730419 100644
--- a/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
@@ -43,13 +43,17 @@
 
 #import <WebCore/WebCoreObjCExtras.h>
 #import <WebCore/AuthenticationMac.h>
+#import <WebCore/Credential.h>
+#import <WebCore/CredentialStorage.h>
 #import <WebCore/CString.h>
 #import <WebCore/Document.h>
 #import <WebCore/Element.h>
 #import <WebCore/Frame.h>
 #import <WebCore/FrameLoader.h>
 #import <WebCore/HTMLPlugInElement.h>
+#import <WebCore/HaltablePlugin.h>
 #import <WebCore/Page.h>
+#import <WebCore/ProtectionSpace.h>
 #import <WebCore/RenderView.h>
 #import <WebKit/DOMPrivate.h>
 #import <runtime/InitializeThreading.h>
@@ -60,6 +64,21 @@
 
 using namespace WebCore;
 
+class WebHaltablePlugin : public HaltablePlugin {
+public:
+    WebHaltablePlugin(WebBaseNetscapePluginView* view)
+        : m_view(view)
+    {
+    }
+    
+private:
+    virtual void halt() { [m_view stop]; }
+    virtual void restart() { [m_view start]; }
+    virtual Node* node() const { return [m_view element]; }
+
+    WebBaseNetscapePluginView* m_view;
+};
+
 @implementation WebBaseNetscapePluginView
 
 + (void)initialize
@@ -111,7 +130,7 @@ using namespace WebCore;
         _mode = NP_EMBED;
     
     _loadManually = loadManually;
-
+    _haltable = new WebHaltablePlugin(self);
     return self;
 }
 
@@ -388,10 +407,13 @@ using namespace WebCore;
     }
     
     _isStarted = YES;
+    page->didStartPlugin(_haltable.get());
+
     [[self webView] addPluginInstanceView:self];
-    
-    [self updateAndSetWindow];
-    
+
+    if ([self currentWindow])
+        [self updateAndSetWindow];
+
     if ([self window]) {
         [self addWindowObservers];
         if ([[self window] isKeyWindow]) {
@@ -414,6 +436,11 @@ using namespace WebCore;
     
     if (!_isStarted)
         return;
+
+    if (Frame* frame = core([self webFrame])) {
+        if (Page* page = frame->page())
+            page->didStopPlugin(_haltable.get());
+    }
     
     _isStarted = NO;
     
@@ -478,11 +505,16 @@ using namespace WebCore;
                                                  selector:@selector(preferencesHaveChanged:)
                                                      name:WebPreferencesChangedNotification
                                                    object:nil];
-        
+
         // View moved to an actual window. Start it if not already started.
         [self start];
-        [self restartTimers];
-        [self addWindowObservers];
+
+        // Starting the plug-in can result in it removing itself from the window so we need to ensure that we're still in
+        // place before doing anything that requires a window.
+        if ([self window]) {
+            [self restartTimers];
+            [self addWindowObservers];
+        }
     } else if ([[self webView] hostWindow]) {
         // View moved out of an actual window, but still has a host window.
         // Call setWindow to explicitly "clip out" the plug-in from sight.
@@ -868,7 +900,7 @@ bool getAuthenticationInfo(const char* protocolStr, const char* hostStr, int32_t
     
     RetainPtr<NSURLProtectionSpace> protectionSpace(AdoptNS, [[NSURLProtectionSpace alloc] initWithHost:host port:port protocol:protocol realm:realm authenticationMethod:authenticationMethod]);
     
-    NSURLCredential *credential = WebCoreCredentialStorage::get(protectionSpace.get());
+    NSURLCredential *credential = mac(CredentialStorage::get(core(protectionSpace.get())));
     if (!credential)
         credential = [[NSURLCredentialStorage sharedCredentialStorage] defaultCredentialForProtectionSpace:protectionSpace.get()];
     if (!credential)
diff --git a/WebKit/mac/Plugins/WebNetscapePluginView.mm b/WebKit/mac/Plugins/WebNetscapePluginView.mm
index 24c5944..5debb97 100644
--- a/WebKit/mac/Plugins/WebNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/WebNetscapePluginView.mm
@@ -69,6 +69,7 @@
 #import <WebCore/Page.h> 
 #import <WebCore/PluginMainThreadScheduler.h>
 #import <WebCore/ScriptController.h>
+#import <WebCore/SecurityOrigin.h>
 #import <WebCore/SoftLinking.h> 
 #import <WebCore/WebCoreObjCExtras.h>
 #import <WebCore/WebCoreURLResponse.h>
@@ -78,13 +79,12 @@
 #import <wtf/Assertions.h>
 #import <objc/objc-runtime.h>
 
-using std::max;
-
 #define LoginWindowDidSwitchFromUserNotification    @"WebLoginWindowDidSwitchFromUserNotification"
 #define LoginWindowDidSwitchToUserNotification      @"WebLoginWindowDidSwitchToUserNotification"
 
 using namespace WebCore;
 using namespace WebKit;
+using namespace std;
 
 static inline bool isDrawingModelQuickDraw(NPDrawingModel drawingModel)
 {
@@ -1683,7 +1683,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
             return NPERR_INVALID_PARAM;
         }
     } else {
-        if (!FrameLoader::canLoad(URL, String(), core([self webFrame])->document()))
+        if (!SecurityOrigin::canLoad(URL, String(), core([self webFrame])->document()))
             return NPERR_GENERIC_ERROR;
     }
         
@@ -1794,7 +1794,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
                 NSString *contentLength = [header objectForKey:@"Content-Length"];
 
                 if (contentLength != nil)
-                    dataLength = MIN((unsigned)[contentLength intValue], dataLength);
+                    dataLength = min<unsigned>([contentLength intValue], dataLength);
                 [header removeObjectForKey:@"Content-Length"];
 
                 if ([header count] > 0) {
diff --git a/WebKit/mac/Plugins/WebPluginContainerCheck.mm b/WebKit/mac/Plugins/WebPluginContainerCheck.mm
index 2180b02..5609d80 100644
--- a/WebKit/mac/Plugins/WebPluginContainerCheck.mm
+++ b/WebKit/mac/Plugins/WebPluginContainerCheck.mm
@@ -40,6 +40,7 @@
 #import <WebCore/Frame.h>
 #import <WebCore/FrameLoader.h>
 #import <WebCore/FrameLoaderTypes.h>
+#import <WebCore/SecurityOrigin.h>
 #import <wtf/Assertions.h>
 #import <objc/objc-runtime.h>
 
@@ -98,7 +99,7 @@ using namespace WebCore;
 {
    Frame* coreFrame = core([_controller webFrame]);
    ASSERT(coreFrame);
-   if (!coreFrame->loader()->canLoad([_request URL], String(), coreFrame->document())) {
+   if (!SecurityOrigin::canLoad([_request URL], String(), coreFrame->document())) {
        [self _continueWithPolicy:PolicyIgnore];
        return YES;
    }
diff --git a/WebKit/mac/WebCoreSupport/WebChromeClient.h b/WebKit/mac/WebCoreSupport/WebChromeClient.h
index 7a1d7b3..a8f22f6 100644
--- a/WebKit/mac/WebCoreSupport/WebChromeClient.h
+++ b/WebKit/mac/WebCoreSupport/WebChromeClient.h
@@ -93,12 +93,13 @@ public:
     virtual void scroll(const WebCore::IntSize& scrollDelta, const WebCore::IntRect& rectToScroll, const WebCore::IntRect& clipRect);
     virtual WebCore::IntPoint screenToWindow(const WebCore::IntPoint&) const;
     virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&) const;
-    virtual PlatformWidget platformWindow() const;
+    virtual PlatformPageClient platformPageClient() const;
     virtual void contentsSizeChanged(WebCore::Frame*, const WebCore::IntSize&) const;
     virtual void scrollRectIntoView(const WebCore::IntRect&, const WebCore::ScrollView*) const;
     
     virtual void setStatusbarText(const WebCore::String&);
 
+    virtual void scrollbarsModeDidChange() const { }
     virtual void mouseDidMoveOverElement(const WebCore::HitTestResult&, unsigned modifierFlags);
 
     virtual void setToolTip(const WebCore::String&, WebCore::TextDirection);
@@ -149,6 +150,10 @@ public:
     virtual void scheduleCompositingLayerSync();
 #endif
 
+    virtual bool supportsFullscreenForNode(const WebCore::Node*);
+    virtual void enterFullscreenForNode(WebCore::Node*);
+    virtual void exitFullscreenForNode(WebCore::Node*);
+
     virtual void requestGeolocationPermissionForFrame(WebCore::Frame*, WebCore::Geolocation*);
 
 private:
diff --git a/WebKit/mac/WebCoreSupport/WebChromeClient.mm b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
index 145255e..a3f004e 100644
--- a/WebKit/mac/WebCoreSupport/WebChromeClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
@@ -49,12 +49,14 @@
 #import <Foundation/Foundation.h>
 #import <WebCore/BlockExceptions.h>
 #import <WebCore/Console.h>
+#import <WebCore/Element.h>
 #import <WebCore/FileChooser.h>
 #import <WebCore/FloatRect.h>
 #import <WebCore/Frame.h>
 #import <WebCore/FrameLoadRequest.h>
 #import <WebCore/Geolocation.h>
 #import <WebCore/HitTestResult.h>
+#import <WebCore/HTMLNames.h>
 #import <WebCore/IntRect.h>
 #import <WebCore/Page.h>
 #import <WebCore/PlatformScreen.h>
@@ -462,7 +464,7 @@ IntRect WebChromeClient::windowToScreen(const IntRect& r) const
     return enclosingIntRect(tempRect);
 }
 
-PlatformWidget WebChromeClient::platformWindow() const
+PlatformPageClient WebChromeClient::platformPageClient() const
 {
     if ([m_webView _usesDocumentViews])
         return 0;
@@ -670,12 +672,12 @@ void WebChromeClient::formStateDidChange(const WebCore::Node* node)
 
 void WebChromeClient::formDidFocus(const WebCore::Node* node)
 {
-    CallUIDelegate(m_webView, @selector(webView:formStateDidFocusNode:), kit(const_cast<WebCore::Node*>(node)));
+    CallUIDelegate(m_webView, @selector(webView:formDidFocusNode:), kit(const_cast<WebCore::Node*>(node)));
 }
 
 void WebChromeClient::formDidBlur(const WebCore::Node* node)
 {
-    CallUIDelegate(m_webView, @selector(webView:formStateDidBlurNode:), kit(const_cast<WebCore::Node*>(node)));
+    CallUIDelegate(m_webView, @selector(webView:formDidBlurNode:), kit(const_cast<WebCore::Node*>(node)));
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -715,6 +717,29 @@ void WebChromeClient::scheduleCompositingLayerSync()
 
 #endif
 
+#if ENABLE(VIDEO)
+
+bool WebChromeClient::supportsFullscreenForNode(const Node* node)
+{
+    return node->hasTagName(WebCore::HTMLNames::videoTag);
+}
+
+void WebChromeClient::enterFullscreenForNode(Node* node)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    [m_webView _enterFullscreenForNode:node];
+    END_BLOCK_OBJC_EXCEPTIONS;
+}
+
+void WebChromeClient::exitFullscreenForNode(Node*)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    [m_webView _exitFullscreen];
+    END_BLOCK_OBJC_EXCEPTIONS;    
+}
+
+#endif
+
 void WebChromeClient::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
index 6f0f39f..6259c80 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
@@ -144,6 +144,9 @@ private:
 
     virtual bool shouldGoToHistoryItem(WebCore::HistoryItem*) const;
 
+    virtual void didDisplayInsecureContent();
+    virtual void didRunInsecureContent(WebCore::SecurityOrigin*);
+
     virtual WebCore::ResourceError cancelledError(const WebCore::ResourceRequest&);
     virtual WebCore::ResourceError blockedError(const WebCore::ResourceRequest&);
     virtual WebCore::ResourceError cannotShowURLError(const WebCore::ResourceRequest&);
@@ -205,7 +208,8 @@ private:
     NSDictionary *actionDictionary(const WebCore::NavigationAction&, PassRefPtr<WebCore::FormState>) const;
     
     virtual bool canCachePage() const;
-
+    virtual bool shouldLoadMediaElementURL(const WebCore::KURL&) const;
+    
     RetainPtr<WebFrame> m_webFrame;
 
     RetainPtr<WebFramePolicyListener> m_policyListener;
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
index 42b7ff8..ec05572 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
@@ -56,6 +56,7 @@
 #import "WebKitErrorsPrivate.h"
 #import "WebKitLogging.h"
 #import "WebKitNSStringExtras.h"
+#import "WebNavigationData.h"
 #import "WebNSURLExtras.h"
 #import "WebNetscapePluginView.h"
 #import "WebNetscapePluginPackage.h"
@@ -68,6 +69,7 @@
 #import "WebPolicyDelegatePrivate.h"
 #import "WebPreferences.h"
 #import "WebResourceLoadDelegate.h"
+#import "WebSecurityOriginInternal.h"
 #import "WebUIDelegate.h"
 #import "WebUIDelegatePrivate.h"
 #import "WebViewInternal.h"
@@ -716,7 +718,7 @@ void WebFrameLoaderClient::dispatchWillSubmitForm(FramePolicyFunction function,
 {
     id <WebFormDelegate> formDelegate = [getWebView(m_webFrame.get()) _formDelegate];
     if (!formDelegate) {
-        (core(m_webFrame.get())->loader()->*function)(PolicyUse);
+        (core(m_webFrame.get())->loader()->policyChecker()->*function)(PolicyUse);
         return;
     }
 
@@ -809,7 +811,26 @@ void WebFrameLoaderClient::finishedLoading(DocumentLoader* loader)
 
 void WebFrameLoaderClient::updateGlobalHistory()
 {
+    WebView* view = getWebView(m_webFrame.get());
     DocumentLoader* loader = core(m_webFrame.get())->loader()->documentLoader();
+
+    if ([view historyDelegate]) {
+        WebHistoryDelegateImplementationCache* implementations = WebViewGetHistoryDelegateImplementations(view);
+        if (implementations->navigatedFunc) {
+            WebNavigationData *data = [[WebNavigationData alloc] initWithURLString:loader->urlForHistory()
+                                                                             title:loader->title()
+                                                                   originalRequest:loader->originalRequestCopy().nsURLRequest()
+                                                                          response:loader->response().nsURLResponse()
+                                                                 hasSubstituteData:loader->substituteData().isValid()
+                                                              clientRedirectSource:loader->clientRedirectSourceForHistory()];
+
+            CallHistoryDelegate(implementations->navigatedFunc, view, @selector(webView:didNavigateWithNavigationData:inFrame:), data, m_webFrame.get());
+            [data release];
+        }
+    
+        return;
+    }
+
     [[WebHistory optionalSharedHistory] _visitedURL:loader->urlForHistory() 
                                           withTitle:loader->title()
                                              method:loader->originalRequestCopy().httpMethod()
@@ -819,16 +840,29 @@ void WebFrameLoaderClient::updateGlobalHistory()
 
 void WebFrameLoaderClient::updateGlobalHistoryRedirectLinks()
 {
+    WebView* view = getWebView(m_webFrame.get());
+    WebHistoryDelegateImplementationCache* implementations = [view historyDelegate] ? WebViewGetHistoryDelegateImplementations(view) : 0;
+    
     DocumentLoader* loader = core(m_webFrame.get())->loader()->documentLoader();
     ASSERT(loader->unreachableURL().isEmpty());
 
     if (!loader->clientRedirectSourceForHistory().isNull()) {
-        if (WebHistoryItem *item = [[WebHistory optionalSharedHistory] _itemForURLString:loader->clientRedirectSourceForHistory()])
+        if (implementations) {
+            if (implementations->clientRedirectFunc) {
+                CallHistoryDelegate(implementations->clientRedirectFunc, view, @selector(webView:didPerformClientRedirectFromURL:toURL:inFrame:), 
+                    loader->clientRedirectSourceForHistory(), loader->clientRedirectDestinationForHistory(), m_webFrame.get());
+            }
+        } else if (WebHistoryItem *item = [[WebHistory optionalSharedHistory] _itemForURLString:loader->clientRedirectSourceForHistory()])
             core(item)->addRedirectURL(loader->clientRedirectDestinationForHistory());
     }
 
     if (!loader->serverRedirectSourceForHistory().isNull()) {
-        if (WebHistoryItem *item = [[WebHistory optionalSharedHistory] _itemForURLString:loader->serverRedirectSourceForHistory()])
+        if (implementations) {
+            if (implementations->serverRedirectFunc) {
+                CallHistoryDelegate(implementations->serverRedirectFunc, view, @selector(webView:didPerformServerRedirectFromURL:toURL:inFrame:), 
+                    loader->serverRedirectSourceForHistory(), loader->serverRedirectDestinationForHistory(), m_webFrame.get());
+            }
+        } else if (WebHistoryItem *item = [[WebHistory optionalSharedHistory] _itemForURLString:loader->serverRedirectSourceForHistory()])
             core(item)->addRedirectURL(loader->serverRedirectDestinationForHistory());
     }
 }
@@ -841,6 +875,24 @@ bool WebFrameLoaderClient::shouldGoToHistoryItem(HistoryItem* item) const
     return [[view _policyDelegateForwarder] webView:view shouldGoToHistoryItem:webItem];
 }
 
+void WebFrameLoaderClient::didDisplayInsecureContent()
+{
+    WebView *webView = getWebView(m_webFrame.get());   
+    WebFrameLoadDelegateImplementationCache* implementations = WebViewGetFrameLoadDelegateImplementations(webView);
+    if (implementations->didDisplayInsecureContentFunc)
+        CallFrameLoadDelegate(implementations->didDisplayInsecureContentFunc, webView, @selector(webViewDidDisplayInsecureContent:));
+}
+
+void WebFrameLoaderClient::didRunInsecureContent(SecurityOrigin* origin)
+{
+    RetainPtr<WebSecurityOrigin> webSecurityOrigin(AdoptNS, [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:origin]);
+
+    WebView *webView = getWebView(m_webFrame.get());   
+    WebFrameLoadDelegateImplementationCache* implementations = WebViewGetFrameLoadDelegateImplementations(webView);
+    if (implementations->didRunInsecureContentFunc)
+        CallFrameLoadDelegate(implementations->didRunInsecureContentFunc, webView, @selector(webView:didRunInsecureContent:), webSecurityOrigin.get());
+}
+
 ResourceError WebFrameLoaderClient::cancelledError(const ResourceRequest& request)
 {
     return [NSError _webKitErrorWithDomain:NSURLErrorDomain code:NSURLErrorCancelled URL:request.url()];
@@ -1012,15 +1064,25 @@ PassRefPtr<DocumentLoader> WebFrameLoaderClient::createDocumentLoader(const Reso
     return loader.release();
 }
 
-// FIXME: <rdar://problem/4880065> - Push Global History into WebCore
-// Once that task is complete, this will go away
-void WebFrameLoaderClient::setTitle(const String& title, const KURL& URL)
+void WebFrameLoaderClient::setTitle(const String& title, const KURL& url)
 {
-    NSURL* nsURL = URL;
+    WebView* view = getWebView(m_webFrame.get());
+    
+    if ([view historyDelegate]) {
+        WebHistoryDelegateImplementationCache* implementations = WebViewGetHistoryDelegateImplementations(view);
+        if (!implementations->setTitleFunc)
+            return;
+            
+        CallHistoryDelegate(implementations->setTitleFunc, view, @selector(webView:updateHistoryTitle:forURL:), (NSString *)title, (NSString *)url);
+        return;
+    }
+    
+    NSURL* nsURL = url;
     nsURL = [nsURL _webkit_canonicalize];
     if(!nsURL)
         return;
     NSString *titleNSString = title;
+       
     [[[WebHistory optionalSharedHistory] itemForURL:nsURL] setTitle:titleNSString];
 }
 
@@ -1145,7 +1207,7 @@ void WebFrameLoaderClient::receivedPolicyDecison(PolicyAction action)
     m_policyListener = nil;
     m_policyFunction = 0;
 
-    (core(m_webFrame.get())->loader()->*function)(action);
+    (core(m_webFrame.get())->loader()->policyChecker()->*function)(action);
 }
 
 String WebFrameLoaderClient::userAgent(const KURL& url)
@@ -1676,6 +1738,16 @@ jobject WebFrameLoaderClient::javaApplet(NSView* view)
 }
 #endif
 
+bool WebFrameLoaderClient::shouldLoadMediaElementURL(const KURL& url) const {
+    WebView *webView = getWebView(m_webFrame.get());
+    
+    if (id policyDelegate = [webView policyDelegate]) {
+        if ([policyDelegate respondsToSelector:@selector(webView:shouldLoadMediaURL:inFrame:)])
+            return [policyDelegate webView:webView shouldLoadMediaURL:url inFrame:m_webFrame.get()];
+    }
+    return true;
+}
+
 @implementation WebFramePolicyListener
 
 + (void)initialize
diff --git a/WebKit/mac/WebCoreSupport/WebGeolocationMock.mm b/WebKit/mac/WebCoreSupport/WebGeolocationMock.mm
new file mode 100644
index 0000000..95b4301
--- /dev/null
+++ b/WebKit/mac/WebCoreSupport/WebGeolocationMock.mm
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "WebGeolocationMockPrivate.h"
+
+#import "WebGeolocationInternal.h"
+#import <WebCore/GeolocationServiceMock.h>
+#import <WebCore/Geoposition.h>
+#import <WebCore/PositionError.h>
+#import <wtf/CurrentTime.h>
+
+
+using namespace WebCore;
+using namespace WTF;
+
+@implementation WebGeolocationMock
+
++ (void)setPosition:(double)latitude:(double)longitude:(double)accuracy
+{
+    RefPtr<Coordinates> coordinates = Coordinates::create(latitude,
+                                                          longitude,
+                                                          false, 0.0,  // altitude
+                                                          accuracy,
+                                                          false, 0.0,  // altitudeAccuracy
+                                                          false, 0.0,  // heading
+                                                          false, 0.0);  // speed
+    RefPtr<Geoposition> position = Geoposition::create(coordinates.release(), currentTime() * 1000.0);
+    GeolocationServiceMock::setPosition(position.release());
+}
+
++ (void)setError:(int)code:(NSString *)message
+{
+    PositionError::ErrorCode codeEnum = static_cast<PositionError::ErrorCode>(code);
+    RefPtr<PositionError> error = PositionError::create(codeEnum, message);
+    GeolocationServiceMock::setError(error.release());
+}
+
+@end
diff --git a/WebKit/mac/WebCoreSupport/WebGeolocationMockPrivate.h b/WebKit/mac/WebCoreSupport/WebGeolocationMockPrivate.h
new file mode 100644
index 0000000..28895f2
--- /dev/null
+++ b/WebKit/mac/WebCoreSupport/WebGeolocationMockPrivate.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <Foundation/Foundation.h>
+
+@interface WebGeolocationMock : NSObject {
+}
+
++ (void)setPosition:(double)latitude:(double)longitude:(double)accuracy;
++ (void)setError:(int)code:(NSString *)message;
+@end
diff --git a/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index 3f0b43d..6a4f67d 100644
--- a/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -81,8 +81,9 @@ void WebInspectorClient::inspectorDestroyed()
 
 Page* WebInspectorClient::createPage()
 {
-    if (!m_windowController)
-        m_windowController.adoptNS([[WebInspectorWindowController alloc] initWithInspectedWebView:m_webView]);
+    if (m_windowController)
+        [[m_windowController.get() webView] close];
+    m_windowController.adoptNS([[WebInspectorWindowController alloc] initWithInspectedWebView:m_webView]);
 
     return core([m_windowController.get() webView]);
 }
@@ -325,7 +326,7 @@ void WebInspectorClient::inspectorWindowObjectCleared()
 
     _visible = YES;
     
-    // If no preference is set - default to an attached window
+    // If no preference is set - default to an attached window. This is important for inspector LayoutTests.
     InspectorController::Setting shouldAttach = [_inspectedWebView page]->inspectorController()->setting(inspectorStartsAttachedName);
     _shouldAttach = (shouldAttach.type() == InspectorController::Setting::BooleanType) ? shouldAttach.booleanValue() : true;
 
diff --git a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
new file mode 100644
index 0000000..48c655d
--- /dev/null
+++ b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <WebCore/PluginHalterClient.h>
+
+namespace WebCore {
+    class Node;
+}
+
+@class WebView;
+
+class WebPluginHalterClient : public WebCore::PluginHalterClient {
+public:
+    WebPluginHalterClient(WebView *);
+    
+    virtual bool shouldHaltPlugin(WebCore::Node*) const;
+    
+private:
+    WebView *m_webView;
+};
diff --git a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
new file mode 100644
index 0000000..2384d0b
--- /dev/null
+++ b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "WebPluginHalterClient.h"
+
+#import "DOMNodeInternal.h"
+#import "WebDelegateImplementationCaching.h"
+#import "WebView.h"
+
+using namespace WebCore;
+
+WebPluginHalterClient::WebPluginHalterClient(WebView *webView)
+    : m_webView(webView)
+{
+    ASSERT_ARG(webView, webView);
+}
+
+bool WebPluginHalterClient::shouldHaltPlugin(Node* pluginNode) const
+{
+    ASSERT_ARG(pluginNode, pluginNode);    
+    return CallUIDelegateReturningBoolean(NO, m_webView, @selector(webView:shouldHaltPlugin:), kit(pluginNode));
+}
diff --git a/WebKit/mac/WebCoreSupport/WebViewFactory.mm b/WebKit/mac/WebCoreSupport/WebViewFactory.mm
index 96ebaa4..79b2959 100644
--- a/WebKit/mac/WebCoreSupport/WebViewFactory.mm
+++ b/WebKit/mac/WebCoreSupport/WebViewFactory.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -553,6 +553,43 @@
     return UI_STRING("definition", "definition phrase");
 }
 
+- (NSString *)AXARIAContentGroupText:(NSString *)ariaType
+{
+    if ([ariaType isEqualToString:@"ARIAApplicationLog"])
+        return UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
+    if ([ariaType isEqualToString:@"ARIAApplicationMarquee"])
+        return UI_STRING("marquee", "An ARIA accessibility group that acts as a marquee.");    
+    if ([ariaType isEqualToString:@"ARIAApplicationStatus"])
+        return UI_STRING("application status", "An ARIA accessibility group that acts as a status update.");    
+    if ([ariaType isEqualToString:@"ARIAApplicationTimer"])
+        return UI_STRING("timer", "An ARIA accessibility group that acts as an updating timer.");    
+    if ([ariaType isEqualToString:@"ARIADocument"])
+        return UI_STRING("document", "An ARIA accessibility group that acts as a document.");    
+    if ([ariaType isEqualToString:@"ARIADocumentArticle"])
+        return UI_STRING("article", "An ARIA accessibility group that acts as an article.");    
+    if ([ariaType isEqualToString:@"ARIADocumentNote"])
+        return UI_STRING("note", "An ARIA accessibility group that acts as a note in a document.");    
+    if ([ariaType isEqualToString:@"ARIADocumentRegion"])
+        return UI_STRING("region", "An ARIA accessibility group that acts as a distinct region in a document.");    
+    if ([ariaType isEqualToString:@"ARIALandmarkApplication"])
+        return UI_STRING("application", "An ARIA accessibility group that acts as an application.");    
+    if ([ariaType isEqualToString:@"ARIALandmarkBanner"])
+        return UI_STRING("banner", "An ARIA accessibility group that acts as a banner.");    
+    if ([ariaType isEqualToString:@"ARIALandmarkComplementary"])
+        return UI_STRING("complementary", "An ARIA accessibility group that acts as a region of complementary information.");    
+    if ([ariaType isEqualToString:@"ARIALandmarkContentInfo"])
+        return UI_STRING("content", "An ARIA accessibility group that contains content.");    
+    if ([ariaType isEqualToString:@"ARIALandmarkMain"])
+        return UI_STRING("main", "An ARIA accessibility group that is the main portion of the website.");    
+    if ([ariaType isEqualToString:@"ARIALandmarkNavigation"])
+        return UI_STRING("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");    
+    if ([ariaType isEqualToString:@"ARIALandmarkSearch"])
+        return UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");    
+    if ([ariaType isEqualToString:@"ARIAUserInterfaceTooltip"])
+        return UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");    
+    return nil;
+}
+
 - (NSString *)AXButtonActionVerb
 {
     return UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
@@ -608,4 +645,107 @@
     return UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
 }
 
+- (NSString*)localizedMediaControlElementString:(NSString*)name
+{
+    if ([name isEqualToString:@"AudioElement"])
+        return UI_STRING("audio element controller", "accessibility role description for audio element controller");
+    if ([name isEqualToString:@"VideoElement"])
+        return UI_STRING("video element controller", "accessibility role description for video element controller");
+
+    // FIXME: the ControlsPanel container should never be visible in the accessibility hierarchy.
+    if ([name isEqualToString:@"ControlsPanel"])
+        return @"";
+
+    if ([name isEqualToString:@"MuteButton"])
+        return UI_STRING("mute", "accessibility role description for mute button");
+    if ([name isEqualToString:@"UnMuteButton"])
+        return UI_STRING("unmute", "accessibility role description for turn mute off button");
+    if ([name isEqualToString:@"PlayButton"])
+        return UI_STRING("play", "accessibility role description for play button");
+    if ([name isEqualToString:@"PauseButton"])
+        return UI_STRING("pause", "accessibility role description for pause button");
+    if ([name isEqualToString:@"Slider"])
+        return UI_STRING("movie time", "accessibility role description for timeline slider");
+    if ([name isEqualToString:@"SliderThumb"])
+        return UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
+    if ([name isEqualToString:@"RewindButton"])
+        return UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
+    if ([name isEqualToString:@"ReturnToRealtimeButton"])
+        return UI_STRING("return to realtime", "accessibility role description for return to real time button");
+    if ([name isEqualToString:@"CurrentTimeDisplay"])
+        return UI_STRING("elapsed time", "accessibility role description for elapsed time display");
+    if ([name isEqualToString:@"TimeRemainingDisplay"])
+        return UI_STRING("remaining time", "accessibility role description for time remaining display");
+    if ([name isEqualToString:@"StatusDisplay"])
+        return UI_STRING("status", "accessibility role description for movie status");
+    if ([name isEqualToString:@"FullscreenButton"])
+        return UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
+    if ([name isEqualToString:@"SeekForwardButton"])
+        return UI_STRING("fast forward", "accessibility role description for fast forward button");
+    if ([name isEqualToString:@"SeekBackButton"])
+        return UI_STRING("fast reverse", "accessibility role description for fast reverse button");
+    ASSERT_NOT_REACHED();
+    return @"";
+}
+
+- (NSString*)localizedMediaControlElementHelpText:(NSString*)name
+{
+    if ([name isEqualToString:@"AudioElement"])
+        return UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
+    if ([name isEqualToString:@"VideoElement"])
+        return UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
+
+    if ([name isEqualToString:@"MuteButton"])
+        return UI_STRING("mute audio tracks", "accessibility help text for mute button");
+    if ([name isEqualToString:@"UnMuteButton"])
+        return UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
+    if ([name isEqualToString:@"PlayButton"])
+        return UI_STRING("begin playback", "accessibility help text for play button");
+    if ([name isEqualToString:@"PauseButton"])
+        return UI_STRING("pause playback", "accessibility help text for pause button");
+    if ([name isEqualToString:@"Slider"])
+        return UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
+    if ([name isEqualToString:@"SliderThumb"])
+        return UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
+    if ([name isEqualToString:@"RewindButton"])
+        return UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
+    if ([name isEqualToString:@"ReturnToRealtimeButton"])
+        return UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
+    if ([name isEqualToString:@"CurrentTimeDisplay"])
+        return UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
+    if ([name isEqualToString:@"TimeRemainingDisplay"])
+        return UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
+    if ([name isEqualToString:@"StatusDisplay"])
+        return UI_STRING("current movie status", "accessibility help text for movie status display");
+    if ([name isEqualToString:@"SeekBackButton"])
+        return UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
+    if ([name isEqualToString:@"SeekForwardButton"])
+        return UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
+    if ([name isEqualToString:@"FullscreenButton"])
+        return UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
+    ASSERT_NOT_REACHED();
+    return @"";
+}
+
+- (NSString*)localizedMediaTimeDescription:(float)time
+{
+    if (!isfinite(time))
+        return UI_STRING("indefinite time", "string for an indefinite movie time");
+
+    int seconds = (int)fabsf(time); 
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days)
+        return [NSString stringWithFormat:UI_STRING("date.format.for.days", "string for days, hours, minutes & seconds"), days, hours, minutes, seconds];
+    else if (hours)
+        return [NSString stringWithFormat:UI_STRING("date.format.for.hours", "string for hours, minutes & seconds"), hours, minutes, seconds];
+    else if (minutes)
+        return [NSString stringWithFormat:UI_STRING("date.format.for.minutes", "string for minutes & seconds"), minutes, seconds];
+
+    return [NSString stringWithFormat:UI_STRING("date.format.for.seconds", "string for seconds"), seconds];
+}
+
 @end
diff --git a/WebKit/mac/WebInspector/WebInspector.mm b/WebKit/mac/WebInspector/WebInspector.mm
index c04a56c..ccb09c5 100644
--- a/WebKit/mac/WebInspector/WebInspector.mm
+++ b/WebKit/mac/WebInspector/WebInspector.mm
@@ -27,7 +27,9 @@
  */
 
 #import "WebInspector.h"
+
 #import "WebFrameInternal.h"
+#import "WebInspectorPrivate.h"
 
 #include <WebCore/Document.h>
 #include <WebCore/Frame.h>
@@ -163,6 +165,12 @@ using namespace WebCore;
     if (Page* page = core(_webView))
         page->inspectorController()->detachWindow();
 }
+
+- (void)evaluateInFrontend:(id)sender callId:(long)callId script:(NSString *)script
+{
+    if (Page* page = core(_webView))
+        page->inspectorController()->evaluateForTestInFrontend(callId, script);
+}
 @end
 
 @implementation WebInspector (Obsolete)
diff --git a/WebKit/mac/WebInspector/WebInspectorPrivate.h b/WebKit/mac/WebInspector/WebInspectorPrivate.h
new file mode 100644
index 0000000..c82bb92
--- /dev/null
+++ b/WebKit/mac/WebInspector/WebInspectorPrivate.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This header contains the WebInspector SPI.
+
+#import "WebInspector.h"
+
+@interface WebInspector (WebPrivate)
+- (void)evaluateInFrontend:(id)sender callId:(long)callId script:(NSString *)script;
+@end
diff --git a/WebKit/mac/WebKit.exp b/WebKit/mac/WebKit.exp
index f32d1a8..12507d0 100644
--- a/WebKit/mac/WebKit.exp
+++ b/WebKit/mac/WebKit.exp
@@ -12,6 +12,7 @@
 .objc_class_name_WebFormDelegate
 .objc_class_name_WebFrame
 .objc_class_name_WebFrameView
+.objc_class_name_WebGeolocationMock
 .objc_class_name_WebHTMLRepresentation
 .objc_class_name_WebHTMLView
 .objc_class_name_WebHistory
@@ -32,6 +33,7 @@
 .objc_class_name_WebTextIterator
 .objc_class_name_WebURLsWithTitles
 .objc_class_name_WebView
+.objc_class_name_WebWorkersPrivate
 _HIWebViewCreate
 _HIWebViewGetWebView
 _WebActionButtonKey
diff --git a/WebKit/mac/WebKitPrefix.h b/WebKit/mac/WebKitPrefix.h
index 0edec06..518fc1b 100644
--- a/WebKit/mac/WebKitPrefix.h
+++ b/WebKit/mac/WebKitPrefix.h
@@ -74,10 +74,6 @@ typedef float CGFloat;
 
 #include "EmptyProtocolDefinitions.h"
 
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && defined(__x86_64__)
-#define WTF_USE_PLUGIN_HOST_PROCESS 1
-#endif
-
 /* WebKit has no way to pull settings from WebCore/config.h for now */
 /* so we assume WebKit is always being compiled on top of JavaScriptCore */
 #define WTF_USE_JSC 1
diff --git a/WebKit/mac/WebView/WebDelegateImplementationCaching.h b/WebKit/mac/WebView/WebDelegateImplementationCaching.h
index 41e44e0..907ba42 100644
--- a/WebKit/mac/WebView/WebDelegateImplementationCaching.h
+++ b/WebKit/mac/WebView/WebDelegateImplementationCaching.h
@@ -67,6 +67,8 @@ struct WebFrameLoadDelegateImplementationCache {
     IMP didFirstVisuallyNonEmptyLayoutInFrameFunc;
     IMP didReceiveIconForFrameFunc;
     IMP didFinishDocumentLoadForFrameFunc;
+    IMP didDisplayInsecureContentFunc;
+    IMP didRunInsecureContentFunc;
 };
 
 struct WebScriptDebugDelegateImplementationCache {
@@ -79,9 +81,17 @@ struct WebScriptDebugDelegateImplementationCache {
     IMP exceptionWasRaisedFunc;
 };
 
+struct WebHistoryDelegateImplementationCache {
+    IMP navigatedFunc;
+    IMP clientRedirectFunc;
+    IMP serverRedirectFunc;
+    IMP setTitleFunc;
+};
+
 WebResourceDelegateImplementationCache* WebViewGetResourceLoadDelegateImplementations(WebView *);
 WebFrameLoadDelegateImplementationCache* WebViewGetFrameLoadDelegateImplementations(WebView *);
 WebScriptDebugDelegateImplementationCache* WebViewGetScriptDebugDelegateImplementations(WebView *);
+WebHistoryDelegateImplementationCache* WebViewGetHistoryDelegateImplementations(WebView *webView);
 
 id CallFormDelegate(WebView *, SEL, id, id);
 id CallFormDelegate(WebView *self, SEL selector, id object1, id object2, id object3, id object4, id object5);
@@ -119,3 +129,6 @@ id CallScriptDebugDelegate(IMP, WebView *, SEL, id, id, NSInteger, id);
 id CallScriptDebugDelegate(IMP, WebView *, SEL, id, NSInteger, id, NSInteger, id);
 id CallScriptDebugDelegate(IMP, WebView *, SEL, id, NSInteger, id, id, id);
 id CallScriptDebugDelegate(IMP, WebView *, SEL, id, NSInteger, NSInteger, id);
+
+id CallHistoryDelegate(IMP, WebView *, SEL, id, id);
+id CallHistoryDelegate(IMP, WebView *, SEL, id, id, id);
diff --git a/WebKit/mac/WebView/WebDelegateImplementationCaching.mm b/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
index 441df92..7757fc7 100644
--- a/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
+++ b/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
@@ -60,6 +60,14 @@ WebScriptDebugDelegateImplementationCache* WebViewGetScriptDebugDelegateImplemen
     return &webView->_private->scriptDebugDelegateImplementations;
 }
 
+WebHistoryDelegateImplementationCache* WebViewGetHistoryDelegateImplementations(WebView *webView)
+{
+    static WebHistoryDelegateImplementationCache empty;
+    if (!webView)
+        return &empty;
+    return &webView->_private->historyDelegateImplementations;
+}
+
 // We use these functions to call the delegates and block exceptions. These functions are
 // declared inside a WebView category to get direct access to the delegate data memebers,
 // preventing more ObjC message dispatch and compensating for the expense of the @try/@catch.
@@ -540,6 +548,16 @@ id CallScriptDebugDelegate(IMP implementation, WebView *self, SEL selector, id o
     return CallDelegate(implementation, self, self->_private->scriptDebugDelegate, selector, object1, integer1, integer2, object2);
 }
 
+id CallHistoryDelegate(IMP implementation, WebView *self, SEL selector, id object1, id object2)
+{
+    return CallDelegate(implementation, self, self->_private->historyDelegate, selector, object1, object2);
+}
+
+id CallHistoryDelegate(IMP implementation, WebView *self, SEL selector, id object1, id object2, id object3)
+{
+    return CallDelegate(implementation, self, self->_private->historyDelegate, selector, object1, object2, object3);
+}
+
 // The form delegate needs to have it's own implementation, because the first argument is never the WebView
 
 id CallFormDelegate(WebView *self, SEL selector, id object1, id object2)
diff --git a/WebKit/mac/WebView/WebDynamicScrollBarsView.h b/WebKit/mac/WebView/WebDynamicScrollBarsView.h
index ce92b33..40aadc0 100644
--- a/WebKit/mac/WebView/WebDynamicScrollBarsView.h
+++ b/WebKit/mac/WebView/WebDynamicScrollBarsView.h
@@ -43,6 +43,8 @@ extern const int WebCoreScrollbarAlwaysOn;
     BOOL suppressLayout;
     BOOL suppressScrollers;
     BOOL inUpdateScrollers;
+    BOOL verticallyPinnedByPreviousWheelEvent;
+    BOOL horizontallyPinnedByPreviousWheelEvent;
     unsigned inUpdateScrollersLayoutPass;
 }
 - (void)setAllowsHorizontalScrolling:(BOOL)flag; // This method is used by Safari, so it cannot be removed.
diff --git a/WebKit/mac/WebView/WebDynamicScrollBarsView.mm b/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
index 0cf2a98..3c28e3c 100644
--- a/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
+++ b/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
@@ -89,15 +89,26 @@ static const unsigned cMaxUpdateScrollbarsPass = 2;
 
 - (void)updateScrollers
 {
-    BOOL hasVerticalScroller = [self hasVerticalScroller];
+    NSView *documentView = [self documentView];
+
+    // If we came in here with the view already needing a layout, then go ahead and do that
+    // first.  (This will be the common case, e.g., when the page changes due to window resizing for example).
+    // This layout will not re-enter updateScrollers and does not count towards our max layout pass total.
+    if (!suppressLayout && !suppressScrollers && [documentView isKindOfClass:[WebHTMLView class]]) {
+        WebHTMLView* htmlView = (WebHTMLView*)documentView;
+        if ([htmlView _needsLayout]) {
+            inUpdateScrollers = YES;
+            [(id <WebDocumentView>)documentView layout];
+            inUpdateScrollers = NO;
+        }
+    }
+
     BOOL hasHorizontalScroller = [self hasHorizontalScroller];
+    BOOL hasVerticalScroller = [self hasVerticalScroller];
     
     BOOL newHasHorizontalScroller = hasHorizontalScroller;
     BOOL newHasVerticalScroller = hasVerticalScroller;
     
-    BOOL needsLayout = NO;
-
-    NSView *documentView = [self documentView];
     if (!documentView) {
         newHasHorizontalScroller = NO;
         newHasVerticalScroller = NO;
@@ -122,19 +133,7 @@ static const unsigned cMaxUpdateScrollbarsPass = 2;
         return;
     }
 
-    needsLayout = NO;
-
-    // If we came in here with the view already needing a layout, then go ahead and do that
-    // first.  (This will be the common case, e.g., when the page changes due to window resizing for example).
-    // This layout will not re-enter updateScrollers and does not count towards our max layout pass total.
-    if ([documentView isKindOfClass:[WebHTMLView class]]) {
-        WebHTMLView* htmlView = (WebHTMLView*)documentView;
-        if ([htmlView _needsLayout]) {
-            inUpdateScrollers = YES;
-            [(id <WebDocumentView>)documentView layout];
-            inUpdateScrollers = NO;
-        }
-    }
+    BOOL needsLayout = NO;
 
     NSSize documentSize = [documentView frame].size;
     NSSize visibleSize = [self documentVisibleRect].size;
@@ -199,7 +198,8 @@ static const unsigned cMaxUpdateScrollbarsPass = 2;
         // http://www.linuxpowered.com/archive/howto/Net-HOWTO-8.html.
         // The underlying cause is some problem in the NSText machinery, but I was not
         // able to pin it down.
-        if (!inUpdateScrollers && [[NSGraphicsContext currentContext] isDrawingToScreen])
+        NSGraphicsContext *currentContext = [NSGraphicsContext currentContext];
+        if (!inUpdateScrollers && (!currentContext || [currentContext isDrawingToScreen]))
             [self updateScrollers];
     }
 
@@ -328,17 +328,41 @@ static const unsigned cMaxUpdateScrollbarsPass = 2;
     BOOL isContinuous;
     WKGetWheelEventDeltas(event, &deltaX, &deltaY, &isContinuous);
 
+    BOOL isLatchingEvent = WKIsLatchingWheelEvent(event);
+
     if (fabsf(deltaY) > fabsf(deltaX)) {
         if (![self allowsVerticalScrolling]) {
             [[self nextResponder] scrollWheel:event];
             return;
         }
-    } else if (![self allowsHorizontalScrolling]) {
-        [[self nextResponder] scrollWheel:event];
-        return;
+
+        if (isLatchingEvent && !verticallyPinnedByPreviousWheelEvent) {
+            double verticalPosition = [[self verticalScroller] doubleValue];
+            if ((deltaY >= 0.0 && verticalPosition == 0.0) || (deltaY <= 0.0 && verticalPosition == 1.0))
+                return;
+        }
+    } else {
+        if (![self allowsHorizontalScrolling]) {
+            [[self nextResponder] scrollWheel:event];
+            return;
+        }
+
+        if (isLatchingEvent && !horizontallyPinnedByPreviousWheelEvent) {
+            double horizontalPosition = [[self horizontalScroller] doubleValue];
+            if ((deltaX >= 0.0 && horizontalPosition == 0.0) || (deltaX <= 0.0 && horizontalPosition == 1.0))
+                return;
+        }
     }
 
     [super scrollWheel:event];
+
+    if (!isLatchingEvent) {
+        double verticalPosition = [[self verticalScroller] doubleValue];
+        double horizontalPosition = [[self horizontalScroller] doubleValue];
+
+        verticallyPinnedByPreviousWheelEvent = (verticalPosition == 0.0 || verticalPosition == 1.0);
+        horizontallyPinnedByPreviousWheelEvent = (horizontalPosition == 0.0 || horizontalPosition == 1.0);
+    }
 }
 
 - (BOOL)accessibilityIsIgnored 
diff --git a/WebKit/mac/WebView/WebFrame.mm b/WebKit/mac/WebView/WebFrame.mm
index c03ef58..27aac67 100644
--- a/WebKit/mac/WebView/WebFrame.mm
+++ b/WebKit/mac/WebView/WebFrame.mm
@@ -1174,7 +1174,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
         [result setObject:[NSNumber numberWithBool:YES] forKey:WebFrameHasPlugins];
     
     if (DOMWindow* domWindow = _private->coreFrame->domWindow()) {
-        if (domWindow->hasEventListener(eventNames().unloadEvent))
+        if (domWindow->hasEventListeners(eventNames().unloadEvent))
             [result setObject:[NSNumber numberWithBool:YES] forKey:WebFrameHasUnloadListener];
             
         if (domWindow->optionalApplicationCache())
@@ -1195,6 +1195,13 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     return result;
 }
 
+- (BOOL)_allowsFollowingLink:(NSURL *)URL
+{
+    if (!_private->coreFrame)
+        return YES;
+    return SecurityOrigin::canLoad(URL, String(), _private->coreFrame->document());
+}
+
 @end
 
 @implementation WebFrame
diff --git a/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h b/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h
new file mode 100644
index 0000000..80fa08a
--- /dev/null
+++ b/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Adam Barth.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import <WebKit/WebFrameLoadDelegate.h>
+
+@class WebSecurityOrigin;
+
+@interface NSObject (WebFrameLoadDelegatePrivate)
+
+- (void)webViewDidDisplayInsecureContent:(WebView *)webView;
+
+- (void)webView:(WebView *)webView didRunInsecureContent:(WebSecurityOrigin *)origin;
+
+@end
diff --git a/WebKit/mac/WebView/WebFramePrivate.h b/WebKit/mac/WebView/WebFramePrivate.h
index 8e7a2ef..7446584 100644
--- a/WebKit/mac/WebView/WebFramePrivate.h
+++ b/WebKit/mac/WebView/WebFramePrivate.h
@@ -110,4 +110,6 @@ typedef enum {
 - (void)_replaceSelectionWithMarkupString:(NSString *)markupString baseURLString:(NSString *)baseURLString selectReplacement:(BOOL)selectReplacement smartReplace:(BOOL)smartReplace;
 
 - (NSMutableDictionary *)_cacheabilityDictionary;
+
+- (BOOL)_allowsFollowingLink:(NSURL *)URL;
 @end
diff --git a/WebKit/mac/WebView/WebFrameView.mm b/WebKit/mac/WebView/WebFrameView.mm
index 1a460ea..c300586 100644
--- a/WebKit/mac/WebView/WebFrameView.mm
+++ b/WebKit/mac/WebView/WebFrameView.mm
@@ -273,8 +273,6 @@ static inline void addTypesFromClass(NSMutableDictionary *allTypes, Class objCCl
         owner->setWidget(view);
         // Now the render part owns the view, so we don't any more.
     }
-
-    view->initScrollbars();
 }
 
 @end
diff --git a/WebKit/mac/WebView/WebHTMLView.mm b/WebKit/mac/WebView/WebHTMLView.mm
index d58c765..102f630 100644
--- a/WebKit/mac/WebView/WebHTMLView.mm
+++ b/WebKit/mac/WebView/WebHTMLView.mm
@@ -125,6 +125,7 @@
 using namespace WebCore;
 using namespace HTMLNames;
 using namespace WTF;
+using namespace std;
 
 @interface NSWindow (BorderViewAccess)
 - (NSView*)_web_borderView;
@@ -212,6 +213,9 @@ extern NSString *NSTextInputReplacementRangeAttributeName;
 - (void)_setDrawsOwnDescendants:(BOOL)drawsOwnDescendants;
 - (void)_propagateDirtyRectsToOpaqueAncestors;
 - (void)_windowChangedKeyState;
+#if USE(ACCELERATED_COMPOSITING) && defined(BUILDING_ON_LEOPARD)
+- (void)_updateLayerGeometryFromView;
+#endif
 @end
 
 @interface NSApplication (WebNSApplicationDetails)
@@ -979,8 +983,7 @@ static NSURL* uniqueURLWithRelativePart(NSString *relativePart)
 {
     // FIXME: this can fail if the dataSource is nil, which happens when the WebView is tearing down from the window closing.
     WebHTMLView *view = (WebHTMLView *)[[[[_private->dataSource _webView] mainFrame] frameView] documentView];
-    ASSERT(view);
-    ASSERT([view isKindOfClass:[WebHTMLView class]]);
+    ASSERT(!view || [view isKindOfClass:[WebHTMLView class]]);
     return view;
 }
 
@@ -1148,8 +1151,11 @@ static void _updateMouseoverTimerCallback(CFRunLoopTimerRef timer, void *info)
 {
     NSPoint origin = [[self superview] bounds].origin;
     if (!NSEqualPoints(_private->lastScrollPosition, origin)) {
-        if (Frame* coreFrame = core([self _frame]))
-            coreFrame->eventHandler()->sendScrollEvent();
+        if (Frame* coreFrame = core([self _frame])) {
+            if (FrameView* coreView = coreFrame->view())
+                coreView->scrollPositionChanged();
+        }
+    
         [_private->completionController endRevertingChange:NO moveLeft:NO];
         
         WebView *webView = [self _webView];
@@ -1649,10 +1655,10 @@ static void _updateMouseoverTimerCallback(CFRunLoopTimerRef timer, void *info)
         urlStringSize.height = [urlFont ascender] - [urlFont descender];
         imageSize.height += urlStringSize.height;
         if (urlStringSize.width > MAX_DRAG_LABEL_WIDTH) {
-            imageSize.width = MAX(MAX_DRAG_LABEL_WIDTH + DRAG_LABEL_BORDER_X * 2.0f, MIN_DRAG_LABEL_WIDTH_BEFORE_CLIP);
+            imageSize.width = max(MAX_DRAG_LABEL_WIDTH + DRAG_LABEL_BORDER_X * 2, MIN_DRAG_LABEL_WIDTH_BEFORE_CLIP);
             clipURLString = YES;
         } else {
-            imageSize.width = MAX(labelSize.width + DRAG_LABEL_BORDER_X * 2.0f, urlStringSize.width + DRAG_LABEL_BORDER_X * 2.0f);
+            imageSize.width = max(labelSize.width + DRAG_LABEL_BORDER_X * 2, urlStringSize.width + DRAG_LABEL_BORDER_X * 2);
         }
     }
     NSImage *dragImage = [[[NSImage alloc] initWithSize: imageSize] autorelease];
@@ -2299,24 +2305,36 @@ static bool matchesExtensionOrEquivalent(NSString *filename, NSString *extension
     return [[webView _editingDelegateForwarder] webView:webView doCommandBySelector:selector];
 }
 
+typedef HashMap<SEL, String> SelectorNameMap;
+
+// Map selectors into Editor command names.
+// This is not needed for any selectors that have the same name as the Editor command.
+static const SelectorNameMap* createSelectorExceptionMap()
+{
+    SelectorNameMap* map = new HashMap<SEL, String>;
+
+    map->add(@selector(insertNewlineIgnoringFieldEditor:), "InsertNewline");
+    map->add(@selector(insertParagraphSeparator:), "InsertNewline");
+    map->add(@selector(insertTabIgnoringFieldEditor:), "InsertTab");
+    map->add(@selector(pageDown:), "MovePageDown");
+    map->add(@selector(pageDownAndModifySelection:), "MovePageDownAndModifySelection");
+    map->add(@selector(pageUp:), "MovePageUp");
+    map->add(@selector(pageUpAndModifySelection:), "MovePageUpAndModifySelection");
+
+    return map;
+}
+
 static String commandNameForSelector(SEL selector)
 {
-    // Change a few command names into ones supported by WebCore::Editor.
-    // If this list gets too long we might decide we need to use a hash table.
-    if (selector == @selector(insertParagraphSeparator:) || selector == @selector(insertNewlineIgnoringFieldEditor:))
-        return "InsertNewline";
-    if (selector == @selector(insertTabIgnoringFieldEditor:))
-        return "InsertTab";
-    if (selector == @selector(pageDown:))
-        return "MovePageDown";
-    if (selector == @selector(pageDownAndModifySelection:))
-        return "MovePageDownAndModifySelection";
-    if (selector == @selector(pageUp:))
-        return "MovePageUp";
-    if (selector == @selector(pageUpAndModifySelection:))
-        return "MovePageUpAndModifySelection";
+    // Check the exception map first.
+    static const SelectorNameMap* exceptionMap = createSelectorExceptionMap();
+    SelectorNameMap::const_iterator it = exceptionMap->find(selector);
+    if (it != exceptionMap->end())
+        return it->second;
 
     // Remove the trailing colon.
+    // No need to capitalize the command name since Editor command names are
+    // not case sensitive.
     const char* selectorName = sel_getName(selector);
     size_t selectorNameLength = strlen(selectorName);
     if (selectorNameLength < 2 || selectorName[selectorNameLength - 1] != ':')
@@ -3160,7 +3178,8 @@ WEBCORE_COMMAND(yankAndSelect)
     double start = CFAbsoluteTimeGetCurrent();
 #endif
 
-    if ([[self _webView] _mustDrawUnionedRect:rect singleRects:rects count:count])
+    WebView *webView = [self _webView];
+    if ([webView _mustDrawUnionedRect:rect singleRects:rects count:count])
         [self drawSingleRect:rect];
     else
         for (int i = 0; i < count; ++i)
@@ -3175,16 +3194,19 @@ WEBCORE_COMMAND(yankAndSelect)
         [self _setAsideSubviews];
         
 #if USE(ACCELERATED_COMPOSITING)
-    if ([[self _webView] _needsOneShotDrawingSynchronization]) {
+    if ([webView _needsOneShotDrawingSynchronization]) {
         // Disable screen updates so that any layer changes committed here
         // don't show up on the screen before the window flush at the end
-        // of the current window display.
-        [[self window] disableScreenUpdatesUntilFlush];
+        // of the current window display, but only if a window flush is actually
+        // going to happen.
+        NSWindow *window = [self window];
+        if ([window viewsNeedDisplay])
+            [window disableScreenUpdatesUntilFlush];
         
         // Make sure any layer changes that happened as a result of layout
         // via -viewWillDraw are committed.
         [CATransaction flush];
-        [[self _webView] _setNeedsOneShotDrawingSynchronization:NO];
+        [webView _setNeedsOneShotDrawingSynchronization:NO];
     }
 #endif
 }
@@ -3407,10 +3429,6 @@ done:
     if (!page)
         return NSDragOperationNone;
 
-    // FIXME: Why do we override the source provided operation here?  Why not in DragController::startDrag
-    if (page->dragController()->sourceDragOperation() == DragOperationNone)
-        return NSDragOperationGeneric | NSDragOperationCopy;
-
     return (NSDragOperation)page->dragController()->sourceDragOperation();
 }
 
@@ -3715,7 +3733,7 @@ static BOOL isInPasswordField(Frame* coreFrame)
 #ifdef __LP64__
     // If the new bottom is equal to the old bottom (when both are treated as floats), we just copy
     // oldBottom over to newBottom. This prevents rounding errors that can occur when converting newBottomFloat to a double.
-    if (fabs((float)oldBottom - newBottomFloat) <= std::numeric_limits<float>::epsilon()) 
+    if (fabs((float)oldBottom - newBottomFloat) <= numeric_limits<float>::epsilon()) 
         *newBottom = oldBottom;
     else
 #endif
@@ -3750,7 +3768,7 @@ static BOOL isInPasswordField(Frame* coreFrame)
     float maxShrinkToFitScaleFactor = 1.0f / PrintingMaximumShrinkFactor;
     float shrinkToFitScaleFactor = [self _availablePaperWidthForPrintOperation:printOperation]/viewWidth;
     float shrinkToAvoidOrphan = _private->avoidingPrintOrphan ? (1.0f / PrintingOrphanShrinkAdjustment) : 1.0f;
-    return userScaleFactor * MAX(maxShrinkToFitScaleFactor, shrinkToFitScaleFactor) * shrinkToAvoidOrphan;
+    return userScaleFactor * max(maxShrinkToFitScaleFactor, shrinkToFitScaleFactor) * shrinkToAvoidOrphan;
 }
 
 // FIXME 3491344: This is a secret AppKit-internal method that we need to override in order
@@ -5450,13 +5468,13 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
     if (!_private->layerHostingView)
         return;
     
-    const CGFloat maxHeight = 4096;
+    const CGFloat maxHeight = 2048;
     NSRect layerViewFrame = [self bounds];
 
     if (layerViewFrame.size.height > maxHeight) {
         CGFloat documentHeight = layerViewFrame.size.height;
             
-        // Clamp the size of the view to <= 4096px to avoid the bug.
+        // Clamp the size of the view to <= maxHeight to avoid the bug.
         layerViewFrame.size.height = maxHeight;
         NSRect visibleRect = [[self enclosingScrollView] documentVisibleRect];
         
@@ -5468,7 +5486,8 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
         CGFloat bottomOffset = documentHeight - layerViewFrame.size.height - topOffset;
         [[_private->layerHostingView layer] setSublayerTransform:CATransform3DMakeTranslation(0, -bottomOffset, 0)];
     }
-        
+
+    [_private->layerHostingView _updateLayerGeometryFromView];  // Workaround for <rdar://problem/7071636>
     [_private->layerHostingView setFrame:layerViewFrame];
 }
 #endif // defined(BUILDING_ON_LEOPARD)
diff --git a/WebKit/mac/WebView/WebHTMLViewInternal.h b/WebKit/mac/WebView/WebHTMLViewInternal.h
index b5ec1c0..3f1f50d 100644
--- a/WebKit/mac/WebView/WebHTMLViewInternal.h
+++ b/WebKit/mac/WebView/WebHTMLViewInternal.h
@@ -30,6 +30,9 @@
 
 #import "WebHTMLViewPrivate.h"
 
+#if USE(ACCELERATED_COMPOSITING)
+@class CALayer;
+#endif
 @class WebFrame;
 
 namespace WebCore {
diff --git a/WebKit/mac/WebView/WebHistoryDelegate.h b/WebKit/mac/WebView/WebHistoryDelegate.h
new file mode 100644
index 0000000..4029eb0
--- /dev/null
+++ b/WebKit/mac/WebView/WebHistoryDelegate.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <Foundation/Foundation.h>
+
+@class WebFrame;
+@class WebNavigationData;
+@class WebView;
+
+@interface NSObject (WebHistoryDelegate)
+
+- (void)webView:(WebView *)webView didNavigateWithNavigationData:(WebNavigationData *)navigationData inFrame:(WebFrame *)webFrame;
+                              
+- (void)webView:(WebView *)webView didPerformClientRedirectFromURL:(NSString *)sourceURL toURL:(NSString *)destinationURL inFrame:(WebFrame *)webFrame;
+
+- (void)webView:(WebView *)webView didPerformServerRedirectFromURL:(NSString *)sourceURL toURL:(NSString *)destinationURL inFrame:(WebFrame *)webFrame;
+
+- (void)webView:(WebView *)webView updateHistoryTitle:(NSString *)title forURL:(NSString *)url;
+
+@end
diff --git a/WebKit/mac/WebView/WebJSPDFDoc.h b/WebKit/mac/WebView/WebJSPDFDoc.h
new file mode 100644
index 0000000..d3e756c
--- /dev/null
+++ b/WebKit/mac/WebView/WebJSPDFDoc.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <JavaScriptCore/JSBase.h>
+
+@class WebDataSource;
+
+JSObjectRef makeJSPDFDoc(JSContextRef, WebDataSource *);
diff --git a/WebKit/mac/WebView/WebJSPDFDoc.mm b/WebKit/mac/WebView/WebJSPDFDoc.mm
new file mode 100644
index 0000000..24169fe
--- /dev/null
+++ b/WebKit/mac/WebView/WebJSPDFDoc.mm
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "WebJSPDFDoc.h"
+
+#import "WebDataSource.h"
+#import "WebDelegateImplementationCaching.h"
+#import "WebFrame.h"
+#import "WebView.h"
+#import <JavaScriptCore/JSObjectRef.h>
+
+static void jsPDFDocInitialize(JSContextRef ctx, JSObjectRef object)
+{
+    WebDataSource *dataSource = (WebDataSource *)JSObjectGetPrivate(object);
+    CFRetain(dataSource);
+}
+
+static void jsPDFDocFinalize(JSObjectRef object)
+{
+    WebDataSource *dataSource = (WebDataSource *)JSObjectGetPrivate(object);
+    CFRelease(dataSource);
+}
+
+static JSValueRef jsPDFDocPrint(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    WebDataSource *dataSource = (WebDataSource *)JSObjectGetPrivate(thisObject);
+
+    WebView *webView = [[dataSource webFrame] webView];
+    CallUIDelegate(webView, @selector(webView:printFrameView:), [[dataSource webFrame] frameView]);
+
+    return JSValueMakeUndefined(ctx);
+}
+
+static JSStaticFunction jsPDFDocStaticFunctions[] = {
+    { "print", jsPDFDocPrint, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { 0, 0, 0 },
+};
+
+static JSClassDefinition jsPDFDocClassDefinition = {
+    0,
+    kJSClassAttributeNone,
+    "Doc",
+    0,
+    0,
+    jsPDFDocStaticFunctions,
+    jsPDFDocInitialize, jsPDFDocFinalize, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+JSObjectRef makeJSPDFDoc(JSContextRef ctx, WebDataSource *dataSource)
+{
+    static JSClassRef jsPDFDocClass = JSClassCreate(&jsPDFDocClassDefinition);
+
+    return JSObjectMake(ctx, jsPDFDocClass, dataSource);
+}
diff --git a/WebKit/mac/WebView/WebNavigationData.h b/WebKit/mac/WebView/WebNavigationData.h
new file mode 100644
index 0000000..227df16
--- /dev/null
+++ b/WebKit/mac/WebView/WebNavigationData.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <Foundation/Foundation.h>
+
+@class WebFrame;
+@class WebNavigationDataPrivate;
+@class WebView;
+
+@interface WebNavigationData : NSObject
+{
+@private
+    WebNavigationDataPrivate *_private;
+}
+
+- (id)initWithURLString:(NSString *)url title:(NSString *)title originalRequest:(NSURLRequest *)request response:(NSURLResponse *)response hasSubstituteData:(BOOL)hasSubstituteData clientRedirectSource:(NSString *)redirectSource;
+- (NSString *)url;
+- (NSString *)title;
+- (NSURLRequest *)originalRequest;
+- (NSURLResponse *)response;
+- (BOOL)hasSubstituteData;
+- (NSString *)clientRedirectSource;
+
+@end
diff --git a/WebKit/mac/WebView/WebNavigationData.mm b/WebKit/mac/WebView/WebNavigationData.mm
new file mode 100644
index 0000000..290d8b1
--- /dev/null
+++ b/WebKit/mac/WebView/WebNavigationData.mm
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "WebNavigationData.h"
+
+@interface WebNavigationDataPrivate : NSObject
+{
+@public
+    NSString *url;
+    NSString *title;
+    NSURLRequest *originalRequest;
+    NSURLResponse *response;
+    BOOL hasSubstituteData;
+    NSString *clientRedirectSource;
+}
+
+@end
+
+@implementation WebNavigationDataPrivate
+
+- (void)dealloc
+{
+    [url release];
+    [title release];
+    [originalRequest release];
+    [response release];
+    [clientRedirectSource release];
+
+    [super dealloc];
+}
+
+@end
+
+@implementation WebNavigationData
+
+- (id)initWithURLString:(NSString *)url title:(NSString *)title originalRequest:(NSURLRequest *)request response:(NSURLResponse *)response hasSubstituteData:(BOOL)hasSubstituteData clientRedirectSource:(NSString *)redirectSource;
+{
+    _private = [[WebNavigationDataPrivate alloc] init];
+    
+    _private->url = [url retain];
+    _private->title = [title retain];
+    _private->originalRequest = [request retain];
+    _private->response = [response retain];
+    _private->hasSubstituteData = hasSubstituteData;
+    _private->clientRedirectSource = [redirectSource retain];
+    
+    return self;
+}
+
+- (NSString *)url
+{
+    return _private->url;
+}
+
+- (NSString *)title
+{
+    return _private->title;
+}
+
+- (NSURLRequest *)originalRequest
+{
+    return _private->originalRequest;
+}
+
+- (NSURLResponse *)response
+{
+    return _private->response;
+}
+
+- (BOOL)hasSubstituteData
+{
+    return _private->hasSubstituteData;
+}
+
+- (NSString *)clientRedirectSource
+{
+    return _private->clientRedirectSource;
+}
+
+- (void)dealloc
+{
+    [_private release];
+    [super dealloc];
+}
+
+@end
diff --git a/WebKit/mac/WebView/WebPDFDocumentExtras.h b/WebKit/mac/WebView/WebPDFDocumentExtras.h
new file mode 100644
index 0000000..5a33ccf
--- /dev/null
+++ b/WebKit/mac/WebView/WebPDFDocumentExtras.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <PDFKit/PDFDocument.h>
+
+@interface PDFDocument (WebPDFDocumentExtras)
+- (NSArray *)_web_allScripts;
+@end
+
+void addWebPDFDocumentExtras(Class);
diff --git a/WebKit/mac/WebView/WebPDFDocumentExtras.mm b/WebKit/mac/WebView/WebPDFDocumentExtras.mm
new file mode 100644
index 0000000..ec580ec
--- /dev/null
+++ b/WebKit/mac/WebView/WebPDFDocumentExtras.mm
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "WebPDFDocumentExtras.h"
+
+#import "WebTypesInternal.h"
+#import <JavaScriptCore/Vector.h>
+#import <JavaScriptCore/RetainPtr.h>
+#import <PDFKit/PDFDocument.h>
+#import <objc/objc-runtime.h>
+
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)
+@interface PDFDocument (Internal)
+- (CGPDFDocumentRef)documentRef;
+@end
+#endif
+
+static void appendValuesInPDFNameSubtreeToVector(CGPDFDictionaryRef subtree, Vector<CGPDFObjectRef>& values)
+{
+    CGPDFArrayRef names;
+    if (CGPDFDictionaryGetArray(subtree, "Names", &names)) {
+        size_t nameCount = CGPDFArrayGetCount(names) / 2;
+        for (size_t i = 0; i < nameCount; ++i) {
+            CGPDFObjectRef object;
+            CGPDFArrayGetObject(names, 2 * i + 1, &object);
+            values.append(object);
+        }
+        return;
+    }
+
+    CGPDFArrayRef kids;
+    if (!CGPDFDictionaryGetArray(subtree, "Kids", &kids))
+        return;
+
+    size_t kidCount = CGPDFArrayGetCount(kids);
+    for (size_t i = 0; i < kidCount; ++i) {
+        CGPDFDictionaryRef kid;
+        if (!CGPDFArrayGetDictionary(kids, i, &kid))
+            continue;
+        appendValuesInPDFNameSubtreeToVector(kid, values);
+    }
+}
+
+static void getAllValuesInPDFNameTree(CGPDFDictionaryRef tree, Vector<CGPDFObjectRef>& allValues)
+{
+    appendValuesInPDFNameSubtreeToVector(tree, allValues);
+}
+
+static NSArray *web_PDFDocumentAllScripts(id self, SEL _cmd)
+{
+    NSMutableArray *scripts = [NSMutableArray array];
+    CGPDFDocumentRef pdfDocument = [self documentRef];
+    if (!pdfDocument)
+        return scripts;
+
+    CGPDFDictionaryRef pdfCatalog = CGPDFDocumentGetCatalog(pdfDocument);
+    if (!pdfCatalog)
+        return scripts;
+
+    // Get the dictionary of all document-level name trees.
+    CGPDFDictionaryRef namesDictionary;
+    if (!CGPDFDictionaryGetDictionary(pdfCatalog, "Names", &namesDictionary))
+        return scripts;
+
+    // Get the document-level "JavaScript" name tree.
+    CGPDFDictionaryRef javaScriptNameTree;
+    if (!CGPDFDictionaryGetDictionary(namesDictionary, "JavaScript", &javaScriptNameTree))
+        return scripts;
+
+    // The names are aribtrary. We are only interested in the values.
+    Vector<CGPDFObjectRef> objects;
+    getAllValuesInPDFNameTree(javaScriptNameTree, objects);
+    size_t objectCount = objects.size();
+
+    for (size_t i = 0; i < objectCount; ++i) {
+        CGPDFDictionaryRef javaScriptAction;
+        if (!CGPDFObjectGetValue(reinterpret_cast<CGPDFObjectRef>(objects[i]), kCGPDFObjectTypeDictionary, &javaScriptAction))
+            continue;
+
+        // A JavaScript action must have an action type of "JavaScript".
+        const char* actionType;
+        if (!CGPDFDictionaryGetName(javaScriptAction, "S", &actionType) || strcmp(actionType, "JavaScript"))
+            continue;
+
+        const UInt8* bytes = 0;
+        CFIndex length;
+        CGPDFStreamRef stream;
+        CGPDFStringRef string;
+        RetainPtr<CFDataRef> data;
+        if (CGPDFDictionaryGetStream(javaScriptAction, "JS", &stream)) {
+            CGPDFDataFormat format;
+            data.adoptCF(CGPDFStreamCopyData(stream, &format));
+            bytes = CFDataGetBytePtr(data.get());
+            length = CFDataGetLength(data.get());
+        } else if (CGPDFDictionaryGetString(javaScriptAction, "JS", &string)) {
+            bytes = CGPDFStringGetBytePtr(string);
+            length = CGPDFStringGetLength(string);
+        }
+        if (!bytes)
+            continue;
+
+        NSStringEncoding encoding = (length > 1 && bytes[0] == 0xFE && bytes[1] == 0xFF) ? NSUnicodeStringEncoding : NSUTF8StringEncoding;
+        NSString *script = [[NSString alloc] initWithBytes:bytes length:length encoding:encoding];
+        [scripts addObject:script];
+        [script release];
+    }
+
+    return scripts;
+}
+
+void addWebPDFDocumentExtras(Class pdfDocumentClass)
+{
+#ifndef BUILDING_ON_TIGER
+    class_addMethod(pdfDocumentClass, @selector(_web_allScripts), (IMP)web_PDFDocumentAllScripts, "@@:");
+#else
+    static struct objc_method_list methodList = { 0, 1, { @selector(_web_allScripts), (char*)"@@:", (IMP)web_PDFDocumentAllScripts } };
+    class_addMethods(pdfDocumentClass, &methodList);
+#endif
+}
diff --git a/WebKit/mac/WebView/WebPDFRepresentation.h b/WebKit/mac/WebView/WebPDFRepresentation.h
index 6b60d4c..be40ae1 100644
--- a/WebKit/mac/WebView/WebPDFRepresentation.h
+++ b/WebKit/mac/WebView/WebPDFRepresentation.h
@@ -26,7 +26,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import <Foundation/Foundation.h>
+#import "WebDocument.h"
 
 @protocol WebDocumentRepresentation;
 
diff --git a/WebKit/mac/WebView/WebPDFRepresentation.m b/WebKit/mac/WebView/WebPDFRepresentation.mm
index 7eae380..924bda8 100644
--- a/WebKit/mac/WebView/WebPDFRepresentation.m
+++ b/WebKit/mac/WebView/WebPDFRepresentation.mm
@@ -26,15 +26,19 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import <WebKit/WebDataSourcePrivate.h>
-#import <WebKit/WebFrame.h>
-#import <WebKit/WebFrameView.h>
-#import <WebKit/WebNSObjectExtras.h>
-#import <WebKit/WebPDFRepresentation.h>
-#import <WebKit/WebPDFView.h>
-#import <wtf/Assertions.h>
-
-#import <PDFKit/PDFDocument.h>
+#import "WebPDFRepresentation.h"
+
+#import "WebDataSourcePrivate.h"
+#import "WebFrame.h"
+#import "WebJSPDFDoc.h"
+#import "WebNSObjectExtras.h"
+#import "WebPDFDocumentExtras.h"
+#import "WebPDFView.h"
+#import "WebTypesInternal.h"
+#import <JavaScriptCore/Assertions.h>
+#import <JavaScriptCore/JSContextRef.h>
+#import <JavaScriptCore/JSStringRef.h>
+#import <JavaScriptCore/JSStringRefCF.h>
 
 @implementation WebPDFRepresentation
 
@@ -66,6 +70,16 @@
     return PDFDocumentClass;
 }
 
++ (void)initialize
+{
+    if (self != [WebPDFRepresentation class])
+        return;
+
+    Class pdfDocumentClass = [self PDFDocumentClass];
+    if (pdfDocumentClass)
+        addWebPDFDocumentExtras(pdfDocumentClass);
+}
+
 - (void)setDataSource:(WebDataSource *)dataSource;
 {
 }
@@ -121,9 +135,26 @@
     WebPDFView *view = (WebPDFView *)[[[dataSource webFrame] frameView] documentView];
     PDFDocument *doc = [[[[self class] PDFDocumentClass] alloc] initWithData:data];
     [view setPDFDocument:doc];
+
+    NSArray *scripts = [doc _web_allScripts];
     [doc release];
-}
+    doc = nil;
+
+    NSUInteger scriptCount = [scripts count];
+    if (!scriptCount)
+        return;
+
+    JSGlobalContextRef ctx = JSGlobalContextCreate(0);
+    JSObjectRef jsPDFDoc = makeJSPDFDoc(ctx, dataSource);
 
+    for (NSUInteger i = 0; i < scriptCount; ++i) {
+        JSStringRef script = JSStringCreateWithCFString((CFStringRef)[scripts objectAtIndex:i]);
+        JSEvaluateScript(ctx, script, jsPDFDoc, 0, 0, 0);
+        JSStringRelease(script);
+    }
+
+    JSGlobalContextRelease(ctx);
+}
 
 - (BOOL)canProvideDocumentSource
 {
diff --git a/WebKit/mac/WebView/WebPolicyDelegatePrivate.h b/WebKit/mac/WebView/WebPolicyDelegatePrivate.h
index 45f8f45..efdf007 100644
--- a/WebKit/mac/WebView/WebPolicyDelegatePrivate.h
+++ b/WebKit/mac/WebView/WebPolicyDelegatePrivate.h
@@ -49,4 +49,6 @@ typedef enum {
 @interface NSObject (WebPolicyDelegatePrivate)
 // Needed for <rdar://problem/3951283> can view pages from the back/forward cache that should be disallowed by Parental Controls
 - (BOOL)webView:(WebView *)webView shouldGoToHistoryItem:(WebHistoryItem *)item;
+
+- (BOOL)webView:(WebView *)webView shouldLoadMediaURL:(NSURL *)url inFrame:(WebFrame *)frame;
 @end
diff --git a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
index 6565c09..d6c9d3c 100644
--- a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
+++ b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
@@ -55,6 +55,8 @@
 #define WebKitPluginsEnabledPreferenceKey @"WebKitPluginsEnabled"
 #define WebKitDatabasesEnabledPreferenceKey @"WebKitDatabasesEnabledPreferenceKey"
 #define WebKitLocalStorageEnabledPreferenceKey @"WebKitLocalStorageEnabledPreferenceKey"
+#define WebKitExperimentalNotificationsEnabledPreferenceKey @"WebKitExperimentalNotificationsEnabledPreferenceKey"
+#define WebKitExperimentalWebSocketsEnabledPreferenceKey @"WebKitExperimentalWebSocketsEnabledPreferenceKey"
 #define WebKitAllowAnimatedImagesPreferenceKey @"WebKitAllowAnimatedImagesPreferenceKey"
 #define WebKitAllowAnimatedImageLoopingPreferenceKey @"WebKitAllowAnimatedImageLoopingPreferenceKey"
 #define WebKitDisplayImagesKey @"WebKitDisplayImagesKey"
@@ -84,6 +86,9 @@
 #define WebKitZoomsTextOnlyPreferenceKey @"WebKitZoomsTextOnly"
 #define WebKitXSSAuditorEnabledPreferenceKey @"WebKitXSSAuditorEnabled"
 #define WebKitAcceleratedCompositingEnabledPreferenceKey @"WebKitAcceleratedCompositingEnabled"
+#define WebKitWebGLEnabledPreferenceKey @"WebKitWebGLEnabled"
+#define WebKitPluginHalterEnabledPreferenceKey @"WebKitPluginHalterEnabled"
+#define WebKitPluginAllowedRunTimePreferenceKey @"WebKitPluginAllowedRunTime"
 
 // These are private both because callers should be using the cover methods and because the
 // cover methods themselves are private.
diff --git a/WebKit/mac/WebView/WebPreferences.mm b/WebKit/mac/WebView/WebPreferences.mm
index 378b280..2910d27 100644
--- a/WebKit/mac/WebView/WebPreferences.mm
+++ b/WebKit/mac/WebView/WebPreferences.mm
@@ -320,6 +320,8 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitPluginsEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitDatabasesEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitLocalStorageEnabledPreferenceKey,
+        [NSNumber numberWithBool:NO],   WebKitExperimentalNotificationsEnabledPreferenceKey,
+        [NSNumber numberWithBool:NO],   WebKitExperimentalWebSocketsEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAllowAnimatedImagesPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAllowAnimatedImageLoopingPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitDisplayImagesKey,
@@ -350,6 +352,9 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitZoomsTextOnlyPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitXSSAuditorEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAcceleratedCompositingEnabledPreferenceKey,
+        [NSNumber numberWithBool:NO],   WebKitWebGLEnabledPreferenceKey,
+        [NSNumber numberWithBool:NO],   WebKitPluginHalterEnabledPreferenceKey,
+        [NSNumber numberWithUnsignedInt:4], WebKitPluginAllowedRunTimePreferenceKey,
         nil];
 
     // This value shouldn't ever change, which is assumed in the initialization of WebKitPDFDisplayModePreferenceKey above
@@ -1011,6 +1016,26 @@ static WebCacheModel cacheModelForMainBundle(void)
     [self _setBoolValue:localStorageEnabled forKey:WebKitLocalStorageEnabledPreferenceKey];
 }
 
+- (BOOL)experimentalNotificationsEnabled
+{
+    return [self _boolValueForKey:WebKitExperimentalNotificationsEnabledPreferenceKey];
+}
+
+- (void)setExperimentalNotificationsEnabled:(BOOL)experimentalNotificationsEnabled
+{
+    [self _setBoolValue:experimentalNotificationsEnabled forKey:WebKitExperimentalNotificationsEnabledPreferenceKey];
+}
+
+- (BOOL)experimentalWebSocketsEnabled
+{
+    return [self _boolValueForKey:WebKitExperimentalWebSocketsEnabledPreferenceKey];
+}
+
+- (void)setExperimentalWebSocketsEnabled:(BOOL)experimentalWebSocketsEnabled
+{
+    [self _setBoolValue:experimentalWebSocketsEnabled forKey:WebKitExperimentalWebSocketsEnabledPreferenceKey];
+}
+
 + (WebPreferences *)_getInstanceForIdentifier:(NSString *)ident
 {
     LOG(Encoding, "requesting for %@\n", ident);
@@ -1138,6 +1163,36 @@ static NSString *classIBCreatorID = nil;
     [self _setBoolValue:enabled forKey:WebKitAcceleratedCompositingEnabledPreferenceKey];
 }
 
+- (BOOL)webGLEnabled
+{
+    return [self _boolValueForKey:WebKitWebGLEnabledPreferenceKey];
+}
+
+- (void)setWebGLEnabled:(BOOL)enabled
+{
+    [self _setBoolValue:enabled forKey:WebKitWebGLEnabledPreferenceKey];
+}
+
+- (BOOL)pluginHalterEnabled
+{
+    return [self _boolValueForKey:WebKitPluginHalterEnabledPreferenceKey];
+}
+
+- (void)setPluginHalterEnabled:(BOOL)enabled
+{
+    [self _setBoolValue:enabled forKey:WebKitPluginHalterEnabledPreferenceKey];
+}
+
+- (unsigned)pluginAllowedRunTime
+{
+    return [self _integerValueForKey:WebKitPluginAllowedRunTimePreferenceKey];
+}
+
+- (void)setPluginAllowedRunTime:(unsigned)allowedRunTime
+{
+    return [self _setIntegerValue:allowedRunTime forKey:WebKitPluginAllowedRunTimePreferenceKey];
+}
+
 - (void)didRemoveFromWebView
 {
     ASSERT(_private->numWebViews);
@@ -1152,6 +1207,12 @@ static NSString *classIBCreatorID = nil;
 {
     ++_private->numWebViews;
 }
+
+- (void)_setPreferenceForTestWithValue:(NSString *)value forKey:(NSString *)key
+{
+    [self _setStringValue:value forKey:key];
+}
+
 @end
 
 @implementation WebPreferences (WebInternal)
diff --git a/WebKit/mac/WebView/WebPreferencesPrivate.h b/WebKit/mac/WebView/WebPreferencesPrivate.h
index d571869..6a25921 100644
--- a/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -107,6 +107,18 @@ extern NSString *WebPreferencesRemovedNotification;
 - (BOOL)isXSSAuditorEnabled;
 - (void)setXSSAuditorEnabled:(BOOL)flag;
 
+- (BOOL)experimentalNotificationsEnabled;
+- (void)setExperimentalNotificationsEnabled:(BOOL)notificationsEnabled;
+
+- (BOOL)experimentalWebSocketsEnabled;
+- (void)setExperimentalWebSocketsEnabled:(BOOL)websocketsEnabled;
+
+- (BOOL)pluginHalterEnabled;
+- (void)setPluginHalterEnabled:(BOOL)enabled;
+
+- (unsigned)pluginAllowedRunTime;
+- (void)setPluginAllowedRunTime:(unsigned)allowedRunTime;
+
 // zero means do AutoScale
 - (float)PDFScaleFactor;
 - (void)setPDFScaleFactor:(float)scale;
@@ -117,6 +129,10 @@ extern NSString *WebPreferencesRemovedNotification;
 - (WebTextDirectionSubmenuInclusionBehavior)textDirectionSubmenuInclusionBehavior;
 - (void)setTextDirectionSubmenuInclusionBehavior:(WebTextDirectionSubmenuInclusionBehavior)behavior;
 
+// Used to set preference specified in the test via LayoutTestController.overridePreference(..).
+// For use with DumpRenderTree only.
+- (void)_setPreferenceForTestWithValue:(NSString *)value forKey:(NSString *)key;
+
 // If site-specific spoofing is enabled, some pages that do inappropriate user-agent string checks will be
 // passed a nonstandard user-agent string to get them to work correctly. This method might be removed in
 // the future when there's no more need for it.
@@ -139,6 +155,9 @@ extern NSString *WebPreferencesRemovedNotification;
 - (BOOL)acceleratedCompositingEnabled;
 - (void)setAcceleratedCompositingEnabled:(BOOL)enabled;
 
+- (BOOL)webGLEnabled;
+- (void)setWebGLEnabled:(BOOL)enabled;
+
 // Other private methods
 - (void)_postPreferencesChangesNotification;
 + (WebPreferences *)_getInstanceForIdentifier:(NSString *)identifier;
diff --git a/WebKit/mac/WebView/WebScriptDebugger.mm b/WebKit/mac/WebView/WebScriptDebugger.mm
index 76bdf58..8deccff 100644
--- a/WebKit/mac/WebView/WebScriptDebugger.mm
+++ b/WebKit/mac/WebView/WebScriptDebugger.mm
@@ -32,13 +32,14 @@
 #import "WebFrameInternal.h"
 #import "WebScriptDebugDelegate.h"
 #import "WebViewInternal.h"
+#import <JavaScriptCore/DebuggerCallFrame.h>
+#import <JavaScriptCore/JSGlobalObject.h>
+#import <JavaScriptCore/SourceCode.h>
 #import <WebCore/DOMWindow.h>
 #import <WebCore/Frame.h>
 #import <WebCore/JSDOMWindow.h>
 #import <WebCore/KURL.h>
 #import <WebCore/ScriptController.h>
-#import <debugger/DebuggerCallFrame.h>
-#import <runtime/JSGlobalObject.h>
 
 using namespace JSC;
 using namespace WebCore;
@@ -68,7 +69,7 @@ static NSURL *toNSURL(const UString& s)
 {
     if (s.isEmpty())
         return nil;
-    return KURL(s);
+    return KURL(ParsedURLString, s);
 }
 
 static WebFrame *toWebFrame(JSGlobalObject* globalObject)
diff --git a/WebKit/mac/WebView/WebTextCompletionController.mm b/WebKit/mac/WebView/WebTextCompletionController.mm
index f7c172f..6c37b98 100644
--- a/WebKit/mac/WebView/WebTextCompletionController.mm
+++ b/WebKit/mac/WebView/WebTextCompletionController.mm
@@ -39,6 +39,7 @@
 @end
 
 using namespace WebCore;
+using namespace std;
 
 // This class handles the complete: operation.
 // It counts on its host view to call endRevertingChange: whenever the current completion needs to be aborted.
@@ -131,7 +132,7 @@ using namespace WebCore;
     windowFrame.size.height = numberToShow * [_tableView rowHeight] + (numberToShow + 1) * [_tableView intercellSpacing].height;
     windowFrame.origin.y -= windowFrame.size.height;
     NSDictionary *attributes = [NSDictionary dictionaryWithObjectsAndKeys:[NSFont systemFontOfSize:12.0f], NSFontAttributeName, nil];
-    float maxWidth = 0.0f;
+    CGFloat maxWidth = 0;
     int maxIndex = -1;
     int i;
     for (i = 0; i < numberToShow; i++) {
@@ -146,8 +147,8 @@ using namespace WebCore;
         maxWidth = ceilf([NSScrollView frameSizeForContentSize:NSMakeSize(maxWidth, 100.0f) hasHorizontalScroller:NO hasVerticalScroller:YES borderType:NSNoBorder].width);
         maxWidth = ceilf([NSWindow frameRectForContentRect:NSMakeRect(0.0f, 0.0f, maxWidth, 100.0f) styleMask:NSBorderlessWindowMask].size.width);
         maxWidth += 5.0f;
-        windowFrame.size.width = MAX(maxWidth, windowFrame.size.width);
-        maxWidth = MIN(400.0f, windowFrame.size.width);
+        windowFrame.size.width = max(maxWidth, windowFrame.size.width);
+        maxWidth = min<CGFloat>(400, windowFrame.size.width);
     }
     [_popupWindow setFrame:windowFrame display:NO];
     
diff --git a/WebKit/mac/WebView/WebUIDelegatePrivate.h b/WebKit/mac/WebView/WebUIDelegatePrivate.h
index 717cf01..0715475 100644
--- a/WebKit/mac/WebView/WebUIDelegatePrivate.h
+++ b/WebKit/mac/WebView/WebUIDelegatePrivate.h
@@ -109,7 +109,7 @@ enum {
 - (void)webView:(WebView *)sender willPopupMenu:(NSMenu *)menu;
 - (void)webView:(WebView *)sender contextMenuItemSelected:(NSMenuItem *)item forElement:(NSDictionary *)element;
 - (void)webView:(WebView *)sender saveFrameView:(WebFrameView *)frameView showingPanel:(BOOL)showingPanel;
-
+- (BOOL)webView:(WebView *)sender shouldHaltPlugin:(DOMNode *)pluginNode;
 /*!
     @method webView:frame:exceededDatabaseQuotaForSecurityOrigin:database:
     @param sender The WebView sending the delegate method.
@@ -127,8 +127,8 @@ enum {
 - (BOOL)webView:(WebView *)sender frame:(WebFrame *)frame requestGeolocationPermission:(WebGeolocation *)geolocation securityOrigin:(WebSecurityOrigin *)origin;
 
 - (void)webView:(WebView *)sender formStateDidChangeForNode:(DOMNode *)node;
-- (void)webView:(WebView *)sender formStateDidFocusNode:(DOMNode *)node;
-- (void)webView:(WebView *)sender formStateDidBlurNode:(DOMNode *)node;
+- (void)webView:(WebView *)sender formDidFocusNode:(DOMNode *)node;
+- (void)webView:(WebView *)sender formDidBlurNode:(DOMNode *)node;
 
 /*!
     @method webView:printFrame:
diff --git a/WebKit/mac/WebView/WebVideoFullscreenController.h b/WebKit/mac/WebView/WebVideoFullscreenController.h
new file mode 100644
index 0000000..bb6a083
--- /dev/null
+++ b/WebKit/mac/WebView/WebVideoFullscreenController.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#if ENABLE(VIDEO)
+
+#import <Cocoa/Cocoa.h>
+#import <wtf/RefPtr.h>
+#import <WebCore/HTMLMediaElement.h>
+
+@protocol WebVideoFullscreenControllerDelegate;
+@class WebVideoFullscreenHUDWindowController;
+@class WebWindowFadeAnimation;
+
+@interface WebVideoFullscreenController : NSWindowController
+{
+@private
+    RefPtr<WebCore::HTMLMediaElement> _mediaElement; // (retain)
+    id<WebVideoFullscreenControllerDelegate> _delegate; // (assign)
+
+    NSWindow *_backgroundFullscreenWindow; // (retain)
+    WebVideoFullscreenHUDWindowController* _hudController; // (retain)
+
+    WebWindowFadeAnimation *_fadeAnimation; // (retain)
+
+    BOOL _isEndingFullscreen;
+    BOOL _isWindowLoaded;
+    BOOL _forceDisableAnimation;
+}
+
+- (id<WebVideoFullscreenControllerDelegate>)delegate;
+- (void)setDelegate:(id<WebVideoFullscreenControllerDelegate>)delegate;
+
+- (void)setMediaElement:(WebCore::HTMLMediaElement*)mediaElement;
+- (WebCore::HTMLMediaElement*)mediaElement;
+
+- (void)enterFullscreen:(NSScreen *)screen;
+- (void)exitFullscreen;
+
+@end
+
+#endif
+
diff --git a/WebKit/mac/WebView/WebVideoFullscreenController.mm b/WebKit/mac/WebView/WebVideoFullscreenController.mm
new file mode 100644
index 0000000..6592ad2
--- /dev/null
+++ b/WebKit/mac/WebView/WebVideoFullscreenController.mm
@@ -0,0 +1,444 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#if ENABLE(VIDEO)
+
+#import <QTKit/QTKit.h>
+#import <objc/objc-runtime.h>
+#import <HIToolbox/HIToolbox.h>
+
+#import <wtf/UnusedParam.h>
+#import <WebCore/SoftLinking.h>
+#import <WebCore/IntRect.h>
+
+#import "WebVideoFullscreenController.h"
+#import "WebVideoFullscreenHUDWindowController.h"
+#import "WebKitSystemInterface.h"
+#import "WebTypesInternal.h"
+#import "WebWindowAnimation.h"
+
+SOFT_LINK_FRAMEWORK(QTKit)
+SOFT_LINK_CLASS(QTKit, QTMovieView)
+
+@interface WebVideoFullscreenWindow : NSWindow
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER)
+<NSAnimationDelegate>
+#endif
+{
+    SEL _controllerActionOnAnimationEnd;
+    WebWindowScaleAnimation *_fullscreenAnimation; // (retain)
+    QTMovieView *_movieView; // (retain)
+}
+- (void)animateFromRect:(NSRect)startRect toRect:(NSRect)endRect withSubAnimation:(NSAnimation *)subAnimation controllerAction:(SEL)controllerAction;
+- (QTMovieView *)movieView;
+- (void)setMovieView:(QTMovieView *)movieView;
+@end
+
+@interface WebVideoFullscreenController(HUDWindowControllerDelegate) <WebVideoFullscreenHUDWindowControllerDelegate>
+@end
+
+@implementation WebVideoFullscreenController
+- (id)init
+{
+    // Do not defer window creation, to make sure -windowNumber is created (needed by WebWindowScaleAnimation).
+    NSWindow *window = [[WebVideoFullscreenWindow alloc] initWithContentRect:NSZeroRect styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
+    self = [super initWithWindow:window];
+    [window release];
+    if (!self)
+        return nil;
+    [self windowDidLoad];
+    return self;
+    
+}
+- (void)dealloc
+{
+    ASSERT(!_backgroundFullscreenWindow);
+    ASSERT(!_fadeAnimation);
+    [super dealloc];
+}
+
+- (WebVideoFullscreenWindow *)fullscreenWindow
+{
+    return (WebVideoFullscreenWindow *)[super window];
+}
+
+- (void)windowDidLoad
+{
+    WebVideoFullscreenWindow *window = [self fullscreenWindow];
+    QTMovieView *view = [[getQTMovieViewClass() alloc] init];
+    [view setFillColor:[NSColor clearColor]];
+    [window setMovieView:view];
+    [view setControllerVisible:NO];
+    [view setPreservesAspectRatio:YES];
+    if (_mediaElement)
+        [view setMovie:_mediaElement->platformMedia().qtMovie];
+    [window setHasShadow:YES]; // This is nicer with a shadow.
+    [window setLevel:NSPopUpMenuWindowLevel-1];
+    [view release];
+}
+
+- (WebCore::HTMLMediaElement*)mediaElement;
+{
+    return _mediaElement.get();
+}
+
+- (void)setMediaElement:(WebCore::HTMLMediaElement*)mediaElement;
+{
+    _mediaElement = mediaElement;
+    if ([self isWindowLoaded]) {
+        QTMovieView *movieView = [[self fullscreenWindow] movieView];
+        [movieView setMovie:_mediaElement->platformMedia().qtMovie];
+    }
+}
+
+- (id<WebVideoFullscreenControllerDelegate>)delegate
+{
+    return _delegate;
+}
+
+- (void)setDelegate:(id<WebVideoFullscreenControllerDelegate>)delegate;
+{
+    _delegate = delegate;
+}
+
+- (CGFloat)clearFadeAnimation
+{
+    [_fadeAnimation stopAnimation];
+    CGFloat previousAlpha = [_fadeAnimation currentAlpha];
+    [_fadeAnimation setWindow:nil];
+    [_fadeAnimation release];
+    _fadeAnimation = nil;
+    return previousAlpha;
+}
+
+- (void)windowDidExitFullscreen
+{
+    [self clearFadeAnimation];
+    [[self window] close];
+    [self setWindow:nil];
+    SetSystemUIMode(kUIModeNormal, 0);
+    [_hudController setDelegate:nil];
+    [_hudController release];
+    _hudController = nil;
+    [_backgroundFullscreenWindow close];
+    [_backgroundFullscreenWindow release];
+    _backgroundFullscreenWindow = nil;
+    
+    [self autorelease]; // Associated -retain is in -exitFullscreen.
+    _isEndingFullscreen = NO;
+}
+
+- (void)windowDidEnterFullscreen
+{
+    [self clearFadeAnimation];
+
+    ASSERT(!_hudController);
+    _hudController = [[WebVideoFullscreenHUDWindowController alloc] init];
+    [_hudController setDelegate:self];
+
+    SetSystemUIMode(kUIModeAllSuppressed , 0);
+    [NSCursor setHiddenUntilMouseMoves:YES];
+    
+    // Give the HUD keyboard focus initially
+    [_hudController fadeWindowIn];
+}
+
+- (NSRect)mediaElementRect
+{
+    return _mediaElement->screenRect();
+}
+
+#pragma mark -
+#pragma mark Exposed Interface
+
+static void constrainFrameToRatioOfFrame(NSRect *frameToConstrain, const NSRect *frame)
+{
+    // Keep a constrained aspect ratio for the destination window
+    double originalRatio = frame->size.width / frame->size.height;
+    double newRatio = frameToConstrain->size.width / frameToConstrain->size.height;
+    if (newRatio > originalRatio) {
+        double newWidth = originalRatio * frameToConstrain->size.height;
+        double diff = frameToConstrain->size.width - newWidth;
+        frameToConstrain->size.width = newWidth;
+        frameToConstrain->origin.x += diff / 2;
+    } else {
+        double newHeight = frameToConstrain->size.width / originalRatio;
+        double diff = frameToConstrain->size.height - newHeight;
+        frameToConstrain->size.height = newHeight;
+        frameToConstrain->origin.y += diff / 2;
+    }    
+}
+
+static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
+{
+    NSWindow *window = [[NSWindow alloc] initWithContentRect:frame styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
+    [window setOpaque:YES];
+    [window setBackgroundColor:[NSColor blackColor]];
+    [window setLevel:level];
+    [window setHidesOnDeactivate:YES];
+    [window setReleasedWhenClosed:NO];
+    return window;
+}
+
+- (void)setupFadeAnimationIfNeededAndFadeIn:(BOOL)fadeIn
+{
+    CGFloat initialAlpha = fadeIn ? 0 : 1;
+    if (_fadeAnimation) {
+        // Make sure we support queuing animation if the previous one isn't over yet
+        initialAlpha = [self clearFadeAnimation];
+    }
+    if (!_forceDisableAnimation)
+        _fadeAnimation = [[WebWindowFadeAnimation alloc] initWithDuration:0.2 window:_backgroundFullscreenWindow initialAlpha:initialAlpha finalAlpha:fadeIn ? 1 : 0];
+}
+
+- (void)enterFullscreen:(NSScreen *)screen;
+{
+    if (!screen)
+        screen = [NSScreen mainScreen];
+
+    NSRect frame = [self mediaElementRect];
+    NSRect endFrame = [screen frame];
+    constrainFrameToRatioOfFrame(&endFrame, &frame);
+
+    // Create a black window if needed
+    if (!_backgroundFullscreenWindow)
+        _backgroundFullscreenWindow = createBackgroundFullscreenWindow([screen frame], [[self window] level]-1);
+    else
+        [_backgroundFullscreenWindow setFrame:[screen frame] display:NO];
+
+    [self setupFadeAnimationIfNeededAndFadeIn:YES];
+    if (_forceDisableAnimation) {
+        // This will disable scale animation
+        frame = NSZeroRect;
+    }
+    [[self fullscreenWindow] animateFromRect:frame toRect:endFrame withSubAnimation:_fadeAnimation controllerAction:@selector(windowDidEnterFullscreen)];
+
+    [_backgroundFullscreenWindow orderWindow:NSWindowBelow relativeTo:[[self fullscreenWindow] windowNumber]];
+}
+
+- (void)exitFullscreen
+{
+    if (_isEndingFullscreen)
+        return;
+    _isEndingFullscreen = YES;
+    [_hudController closeWindow];
+
+    NSRect endFrame = [self mediaElementRect];
+
+    [self setupFadeAnimationIfNeededAndFadeIn:NO];
+    if (_forceDisableAnimation) {
+        // This will disable scale animation
+        endFrame = NSZeroRect;
+    }
+    
+    // We have to retain ourselves because we want to be alive for the end of the animation.
+    // If our owner releases us we could crash if this is not the case.
+    // Balanced in windowDidExitFullscreen
+    [self retain];    
+    
+    [[self fullscreenWindow] animateFromRect:[[self window] frame] toRect:endFrame withSubAnimation:_fadeAnimation controllerAction:@selector(windowDidExitFullscreen)];
+}
+
+#pragma mark -
+#pragma mark Window callback
+
+- (void)requestExitFullscreenWithAnimation:(BOOL)animation
+{
+    if (_isEndingFullscreen)
+        return;
+
+    _forceDisableAnimation = !animation;
+    _mediaElement->exitFullscreen();
+    _forceDisableAnimation = NO;
+}
+
+- (void)requestExitFullscreen
+{
+    [self requestExitFullscreenWithAnimation:YES];
+}
+
+- (void)fadeHUDIn
+{
+    [_hudController fadeWindowIn];
+}
+@end
+
+@implementation WebVideoFullscreenWindow
+
+- (id)initWithContentRect:(NSRect)contentRect styleMask:(NSUInteger)aStyle backing:(NSBackingStoreType)bufferingType defer:(BOOL)flag
+{
+    UNUSED_PARAM(aStyle);
+    self = [super initWithContentRect:contentRect styleMask:NSBorderlessWindowMask backing:bufferingType defer:flag];
+    if (!self)
+        return nil;
+    [self setOpaque:NO];
+    [self setBackgroundColor:[NSColor clearColor]];
+    [self setHidesOnDeactivate:YES];
+    [self setIgnoresMouseEvents:NO];
+    [self setAcceptsMouseMovedEvents:YES];
+    return self;
+}
+
+- (void)dealloc
+{
+    ASSERT(!_fullscreenAnimation);
+    [super dealloc];
+}
+
+- (QTMovieView *)movieView
+{
+    return _movieView;
+}
+
+- (void)setMovieView:(QTMovieView *)movieView
+{
+    if (_movieView == movieView)
+        return;
+    [_movieView release];
+    _movieView = [movieView retain];
+    [self setContentView:_movieView];
+}
+
+- (BOOL)resignFirstResponder
+{
+    return NO;
+}
+
+- (BOOL)canBecomeKeyWindow
+{
+    return NO;
+}
+
+- (void)mouseDown:(NSEvent *)theEvent
+{
+    UNUSED_PARAM(theEvent);
+}
+
+- (void)cancelOperation:(id)sender
+{
+    UNUSED_PARAM(sender);
+    [[self windowController] requestExitFullscreen];
+}
+
+- (void)animatedResizeDidEnd
+{
+    // Call our windowController.
+    if (_controllerActionOnAnimationEnd)
+        [[self windowController] performSelector:_controllerActionOnAnimationEnd];
+    _controllerActionOnAnimationEnd = NULL;
+}
+
+//
+// This function will animate a change of frame rectangle
+// We support queuing animation, that means that we'll correctly
+// interrupt the running animation, and queue the next one.
+//
+- (void)animateFromRect:(NSRect)startRect toRect:(NSRect)endRect withSubAnimation:(NSAnimation *)subAnimation controllerAction:(SEL)controllerAction
+{
+    _controllerActionOnAnimationEnd = controllerAction;
+
+    BOOL wasAnimating = NO;
+    if (_fullscreenAnimation) {
+        wasAnimating = YES;
+
+        // Interrupt any running animation.
+        [_fullscreenAnimation stopAnimation];
+
+        // Save the current rect to ensure a smooth transition.
+        startRect = [_fullscreenAnimation currentFrame];
+        [_fullscreenAnimation release];
+        _fullscreenAnimation = nil;
+    }
+    
+    if (NSIsEmptyRect(startRect) || NSIsEmptyRect(endRect)) {
+        // Fakely end the subanimation.
+        [subAnimation setCurrentProgress:1.0];
+        // And remove the weak link to the window.
+        [subAnimation stopAnimation];
+
+        [self setFrame:endRect display:NO];
+        [self makeKeyAndOrderFront:self];
+        [self animatedResizeDidEnd];
+        return;
+    }
+
+    if (!wasAnimating) {
+        // We'll downscale the window during the animation based on the higher resolution rect
+        BOOL higherResolutionIsEndRect = startRect.size.width < endRect.size.width && startRect.size.height < endRect.size.height;
+        [self setFrame:higherResolutionIsEndRect ? endRect : startRect display:NO];        
+    }
+    
+    ASSERT(!_fullscreenAnimation);
+    _fullscreenAnimation = [[WebWindowScaleAnimation alloc] initWithHintedDuration:0.2 window:self initalFrame:startRect finalFrame:endRect];
+    [_fullscreenAnimation setSubAnimation:subAnimation];
+    [_fullscreenAnimation setDelegate:self];
+    
+    // Make sure the animation has scaled the window before showing it.
+    [_fullscreenAnimation setCurrentProgress:0];
+    [self makeKeyAndOrderFront:self];
+
+    [_fullscreenAnimation startAnimation];
+}
+
+- (void)animationDidEnd:(NSAnimation *)animation
+{
+#if !defined(BUILDING_ON_TIGER) // Animations are never threaded on Tiger.
+    if (![NSThread isMainThread]) {
+        [self performSelectorOnMainThread:@selector(animationDidEnd:) withObject:animation waitUntilDone:NO];
+        return;
+    }
+#endif
+    if (animation != _fullscreenAnimation)
+        return;
+
+    // The animation is not really over and was interrupted
+    // Don't send completion events.
+    if ([animation currentProgress] < 1.0)
+        return;
+
+    // Ensure that animation (and subanimation) don't keep
+    // the weak reference to the window ivar that may be destroyed from
+    // now on.
+    [_fullscreenAnimation setWindow:nil];
+
+    [_fullscreenAnimation autorelease];
+    _fullscreenAnimation = nil;
+
+    [self animatedResizeDidEnd];
+}
+
+- (void)mouseMoved:(NSEvent *)theEvent
+{
+    [[self windowController] fadeHUDIn];
+}
+
+- (void)resignKeyWindow
+{
+    [super resignKeyWindow];
+    [[self windowController] requestExitFullscreenWithAnimation:NO];
+}
+@end
+
+#endif /* ENABLE(VIDEO) */
diff --git a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
new file mode 100644
index 0000000..8b06c1c
--- /dev/null
+++ b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#if ENABLE(VIDEO)
+
+#import <Cocoa/Cocoa.h>
+#import <WebCore/HTMLMediaElement.h>
+
+@protocol WebVideoFullscreenHUDWindowControllerDelegate;
+
+@interface WebVideoFullscreenHUDWindowController : NSWindowController {
+@private
+    id<WebVideoFullscreenHUDWindowControllerDelegate> _delegate;
+    NSTimer *_timelineUpdateTimer;
+#if !defined(BUILDING_ON_TIGER)
+    NSTrackingArea *_area;
+#endif
+    BOOL _mouseIsInHUD;
+
+    NSControl *_timeline;
+    NSTextField *_remainingTimeText;
+    NSTextField *_elapsedTimeText;
+    NSControl *_volumeSlider;
+    NSControl *_playButton;
+}
+- (id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate;
+- (void)setDelegate:(id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate;
+- (void)fadeWindowIn;
+- (void)fadeWindowOut;
+- (void)closeWindow;
+
+@end
+
+@protocol WebVideoFullscreenHUDWindowControllerDelegate <NSObject>
+- (void)requestExitFullscreen;
+- (WebCore::HTMLMediaElement*)mediaElement;
+@end
+
+#endif
diff --git a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
new file mode 100644
index 0000000..2edfccc
--- /dev/null
+++ b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
@@ -0,0 +1,583 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#if ENABLE(VIDEO)
+
+#import "WebVideoFullscreenHUDWindowController.h"
+
+#import <QTKit/QTKit.h>
+#import "WebKitSystemInterface.h"
+#import "WebTypesInternal.h"
+#import <wtf/RetainPtr.h>
+
+#define HAVE_MEDIA_CONTROL (!defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD))
+
+@interface WebVideoFullscreenHUDWindowController (Private) <NSWindowDelegate>
+
+- (void)updateTime;
+- (void)timelinePositionChanged:(id)sender;
+- (float)currentTime;
+- (void)setCurrentTime:(float)currentTime;
+- (double)duration;
+
+- (double)maxVolume;
+- (void)volumeChanged:(id)sender;
+- (double)volume;
+- (void)setVolume:(double)volume;
+
+- (void)playingChanged:(id)sender;
+- (BOOL)playing;
+- (void)setPlaying:(BOOL)playing;
+
+- (void)rewind:(id)sender;
+- (void)fastForward:(id)sender;
+
+- (NSString *)remainingTimeText;
+- (NSString *)elapsedTimeText;
+
+- (void)exitFullscreen:(id)sender;
+@end
+
+
+//
+// HUD Window
+//
+
+@interface WebVideoFullscreenHUDWindow : NSWindow
+@end
+
+@implementation WebVideoFullscreenHUDWindow
+
+- (id)initWithContentRect:(NSRect)contentRect styleMask:(NSUInteger)aStyle backing:(NSBackingStoreType)bufferingType defer:(BOOL)flag
+{
+    UNUSED_PARAM(aStyle);
+    self = [super initWithContentRect:contentRect styleMask:NSBorderlessWindowMask backing:bufferingType defer:flag];
+    if (!self)
+        return nil;
+
+    [self setOpaque:NO];
+    [self setBackgroundColor:[NSColor clearColor]];
+    [self setLevel:NSPopUpMenuWindowLevel];
+    [self setAcceptsMouseMovedEvents:YES];
+    [self setIgnoresMouseEvents:NO];
+    [self setMovableByWindowBackground:YES];
+    [self setHidesOnDeactivate:YES];
+
+    return self;
+}
+
+- (BOOL)canBecomeKeyWindow
+{
+    return YES;
+}
+
+- (void)cancelOperation:(id)sender
+{
+    [[self windowController] exitFullscreen:self];
+}
+
+- (void)center
+{
+    NSRect hudFrame = [self frame];
+    NSRect screenFrame = [[NSScreen mainScreen] frame];
+    [self setFrameTopLeftPoint:NSMakePoint(screenFrame.origin.x + (screenFrame.size.width - hudFrame.size.width) / 2,
+                                           screenFrame.origin.y + (screenFrame.size.height - hudFrame.size.height) / 6)];
+}
+
+- (void)keyDown:(NSEvent *)event
+{
+    [super keyDown:event];
+    [[self windowController] fadeWindowIn];
+}
+
+@end
+
+//
+// HUD Window Controller
+//
+
+static const CGFloat windowHeight = 59;
+static const CGFloat windowWidth = 438;
+
+static const NSTimeInterval HUDWindowFadeOutDelay = 3;
+
+@implementation WebVideoFullscreenHUDWindowController
+
+- (id)init
+{
+    NSWindow* window = [[WebVideoFullscreenHUDWindow alloc] initWithContentRect:NSMakeRect(0, 0, windowWidth, windowHeight)
+                            styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
+    self = [super initWithWindow:window];
+    [window setDelegate:self];
+    [window release];
+    if (!self)
+        return nil;
+    [self windowDidLoad];
+    return self;
+}
+
+- (void)dealloc
+{
+    ASSERT(!_timelineUpdateTimer);
+#if !defined(BUILDING_ON_TIGER)
+    ASSERT(!_area);
+#endif
+    [_timeline release];
+    [_remainingTimeText release];
+    [_elapsedTimeText release];
+    [_volumeSlider release];
+    [_playButton release];
+    [super dealloc];
+}
+
+#if !defined(BUILDING_ON_TIGER)
+- (void)setArea:(NSTrackingArea *)area
+{
+    if (area == _area)
+        return;
+    [_area release];
+    _area = [area retain];
+}
+#endif
+
+- (id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate
+{
+    return _delegate;
+}
+     
+- (void)setDelegate:(id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate
+{
+    _delegate = delegate;
+}
+
+- (void)scheduleTimeUpdate
+{
+    [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(unscheduleTimeUpdate) object:self];
+
+    // First, update right away, then schedule future update
+    [self updateTime];
+
+    [_timelineUpdateTimer invalidate];
+    [_timelineUpdateTimer release];
+
+    // Note that this creates a retain cycle between the window and us.
+    _timelineUpdateTimer = [[NSTimer timerWithTimeInterval:0.25 target:self selector:@selector(updateTime) userInfo:nil repeats:YES] retain];
+#if defined(BUILDING_ON_TIGER)
+    [[NSRunLoop currentRunLoop] addTimer:_timelineUpdateTimer forMode:(NSString*)kCFRunLoopCommonModes];
+#else
+    [[NSRunLoop currentRunLoop] addTimer:_timelineUpdateTimer forMode:NSRunLoopCommonModes];
+#endif
+}
+
+- (void)unscheduleTimeUpdate
+{
+    [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(unscheduleTimeUpdate) object:nil];
+
+    [_timelineUpdateTimer invalidate];
+    [_timelineUpdateTimer release];
+    _timelineUpdateTimer = nil;
+}
+
+- (void)fadeWindowIn
+{
+    NSWindow *window = [self window];
+    if (![window isVisible])
+        [window setAlphaValue:0];
+
+    [window makeKeyAndOrderFront:self];
+#if defined(BUILDING_ON_TIGER)
+    [window setAlphaValue:1];
+#else
+    [[window animator] setAlphaValue:1];
+#endif
+    [self scheduleTimeUpdate];
+
+    [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(fadeWindowOut) object:nil];
+    if (!_mouseIsInHUD && [self playing])   // Don't fade out when paused.
+        [self performSelector:@selector(fadeWindowOut) withObject:nil afterDelay:HUDWindowFadeOutDelay];
+}
+
+- (void)fadeWindowOut
+{
+    [NSCursor setHiddenUntilMouseMoves:YES];
+#if defined(BUILDING_ON_TIGER)
+    [[self window] setAlphaValue:0];
+#else
+    [[[self window] animator] setAlphaValue:0];
+#endif
+    [self performSelector:@selector(unscheduleTimeUpdate) withObject:nil afterDelay:1];
+}
+
+- (void)closeWindow
+{
+    [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(fadeWindowOut) object:nil];
+    [self unscheduleTimeUpdate];
+    NSWindow *window = [self window];
+#if !defined(BUILDING_ON_TIGER)
+    [[window contentView] removeTrackingArea:_area];
+    [self setArea:nil];
+#endif
+    [window close];
+    [window setDelegate:nil];
+    [self setWindow:nil];
+}
+
+#ifndef HAVE_MEDIA_CONTROL
+enum {
+    WKMediaUIControlPlayPauseButton,
+    WKMediaUIControlRewindButton,
+    WKMediaUIControlFastForwardButton,
+    WKMediaUIControlExitFullscreenButton,
+    WKMediaUIControlVolumeDownButton,
+    WKMediaUIControlSlider,
+    WKMediaUIControlVolumeUpButton,
+    WKMediaUIControlTimeline
+};
+#endif
+
+static NSControl *createControlWithMediaUIControlType(int controlType, NSRect frame)
+{
+#ifdef HAVE_MEDIA_CONTROL
+    NSControl *control = WKCreateMediaUIControl(controlType);
+    [control setFrame:frame];
+    return control;
+#else
+    if (controlType == WKMediaUIControlSlider)
+        return [[NSSlider alloc] initWithFrame:frame];
+    return [[NSControl alloc] initWithFrame:frame];
+#endif
+}
+
+static NSTextField *createTimeTextField(NSRect frame)
+{
+    NSTextField *textField = [[NSTextField alloc] initWithFrame:frame];
+    [textField setTextColor:[NSColor whiteColor]];
+    [textField setBordered:NO];
+    [textField setFont:[NSFont systemFontOfSize:10]];
+    [textField setDrawsBackground:NO];
+    [textField setBezeled:NO];
+    [textField setEditable:NO];
+    [textField setSelectable:NO];
+    return textField;
+}
+
+- (void)windowDidLoad
+{
+    static const CGFloat kMargin = 9;
+    static const CGFloat kMarginTop = 9;
+    static const CGFloat kButtonSize = 25;
+    static const CGFloat kButtonMiniSize = 16;
+
+    NSWindow *window = [self window];
+    ASSERT(window);
+
+#ifdef HAVE_MEDIA_CONTROL
+    NSView *background = WKCreateMediaUIBackgroundView();
+#else
+    NSView *background = [[NSView alloc] init];
+#endif
+    [window setContentView:background];
+#if !defined(BUILDING_ON_TIGER)
+    _area = [[NSTrackingArea alloc] initWithRect:[background bounds] options:NSTrackingMouseEnteredAndExited|NSTrackingActiveAlways owner:self userInfo:nil];
+    [background addTrackingArea:_area];
+#endif
+    [background release];    
+
+    NSView *contentView = [[self window] contentView];
+
+    CGFloat top = windowHeight - kMarginTop;
+    CGFloat center = (windowWidth - kButtonSize) / 2;
+    _playButton = createControlWithMediaUIControlType(WKMediaUIControlPlayPauseButton, NSMakeRect(center, top - kButtonSize, kButtonSize, kButtonSize));
+    [_playButton setTarget:self];
+    [_playButton setAction:@selector(playingChanged:)];
+    [contentView addSubview:_playButton];
+
+    CGFloat closeToRight = windowWidth - 2 * kMargin - kButtonMiniSize;
+    NSControl *exitFullscreenButton = createControlWithMediaUIControlType(WKMediaUIControlExitFullscreenButton, NSMakeRect(closeToRight, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
+    [exitFullscreenButton setAction:@selector(exitFullscreen:)];
+    [exitFullscreenButton setTarget:self];
+    [contentView addSubview:exitFullscreenButton];
+    [exitFullscreenButton release];
+    
+    CGFloat left = kMargin;
+    NSControl *volumeDownButton = createControlWithMediaUIControlType(WKMediaUIControlVolumeDownButton, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
+    [contentView addSubview:volumeDownButton];
+    [volumeDownButton release];
+
+    static const int volumeSliderWidth = 50;
+
+    left = kMargin + kButtonMiniSize;
+    _volumeSlider = createControlWithMediaUIControlType(WKMediaUIControlSlider, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, volumeSliderWidth, kButtonMiniSize));
+    [_volumeSlider setValue:[NSNumber numberWithDouble:[self maxVolume]] forKey:@"maxValue"];
+    [_volumeSlider setTarget:self];
+    [_volumeSlider setAction:@selector(volumeChanged:)];
+    [contentView addSubview:_volumeSlider];
+
+    left = kMargin + kButtonMiniSize + volumeSliderWidth + kButtonMiniSize / 2;
+    NSControl *button = createControlWithMediaUIControlType(WKMediaUIControlVolumeUpButton, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
+    [contentView addSubview:button];
+    [button release];
+    
+    static const int timeTextWidth = 50;
+    static const int sliderHeight = 13;
+    static const int sliderMarginFixup = 4;
+
+#ifdef HAVE_MEDIA_CONTROL
+    _timeline = WKCreateMediaUIControl(WKMediaUIControlTimeline);
+#else
+    _timeline = [[NSSlider alloc] init];
+#endif
+    [_timeline setTarget:self];
+    [_timeline setAction:@selector(timelinePositionChanged:)];
+    [_timeline setFrame:NSMakeRect(kMargin + timeTextWidth + kMargin/2, kMargin - sliderMarginFixup, windowWidth - 2 * (kMargin - sliderMarginFixup) - kMargin * 2 - 2 * timeTextWidth, sliderHeight)];
+    [contentView addSubview:_timeline];
+
+    static const int timeTextHeight = 11;
+
+    _elapsedTimeText = createTimeTextField(NSMakeRect(kMargin, kMargin, timeTextWidth, timeTextHeight));
+    [contentView addSubview:_elapsedTimeText];
+
+    _remainingTimeText = createTimeTextField(NSMakeRect(windowWidth - kMargin - timeTextWidth, kMargin, timeTextWidth, timeTextHeight));
+    [contentView addSubview:_remainingTimeText];
+    
+    [window recalculateKeyViewLoop];
+    [window setInitialFirstResponder:_playButton];
+    [window center];
+}
+                                
+/*
+ *  Bindings
+ *
+ */
+
+- (void)updateVolume
+{
+    [_volumeSlider setDoubleValue:[self volume]];
+}
+
+- (void)updateTime
+{
+    [self updateVolume];
+
+    [_timeline setFloatValue:[self currentTime]];
+    [(NSSlider*)_timeline setMaxValue:[self duration]];
+
+    [_remainingTimeText setStringValue:[self remainingTimeText]];
+    [_elapsedTimeText setStringValue:[self elapsedTimeText]];
+}
+
+- (void)fastForward
+{
+}
+
+- (void)timelinePositionChanged:(id)sender
+{
+    [self setCurrentTime:[_timeline floatValue]];
+}
+
+- (float)currentTime
+{
+    return [_delegate mediaElement] ? [_delegate mediaElement]->currentTime() : 0;
+}
+
+- (void)setCurrentTime:(float)currentTime
+{
+    if (![_delegate mediaElement])
+        return;
+    WebCore::ExceptionCode e;
+    [_delegate mediaElement]->setCurrentTime(currentTime, e);
+}
+
+- (double)duration
+{
+    return [_delegate mediaElement] ? [_delegate mediaElement]->duration() : 0;
+}
+
+- (double)maxVolume
+{
+    // Set the volume slider resolution
+    return 100;
+}
+
+- (void)volumeChanged:(id)sender
+{
+    [self setVolume:[_volumeSlider doubleValue]];
+}
+
+- (double)volume
+{
+    return [_delegate mediaElement] ? [_delegate mediaElement]->volume() * [self maxVolume] : 0;
+}
+
+- (void)setVolume:(double)volume
+{
+    if (![_delegate mediaElement])
+        return;
+    WebCore::ExceptionCode e;
+    [_delegate mediaElement]->setVolume(volume / [self maxVolume], e);
+}
+
+- (void)playingChanged:(id)sender
+{
+    [self setPlaying:![self playing]];
+    
+    // Keep HUD visible when paused
+    if (![self playing])
+        [self fadeWindowIn];
+    else if (!_mouseIsInHUD) {
+        [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(fadeWindowOut) object:nil];
+        [self performSelector:@selector(fadeWindowOut) withObject:nil afterDelay:HUDWindowFadeOutDelay];
+    }
+}
+
+- (BOOL)playing
+{
+    if (![_delegate mediaElement])
+        return false;
+    return ![_delegate mediaElement]->canPlay();
+}
+
+- (void)setPlaying:(BOOL)playing
+{
+    if (![_delegate mediaElement])
+        return;
+
+    if (playing)
+        [_delegate mediaElement]->play();
+    else
+        [_delegate mediaElement]->pause();
+}
+
+static NSString *timeToString(double time)
+{
+    if (!isfinite(time))
+        time = 0;
+    int seconds = (int)fabsf(time); 
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+    if (hours) {
+        if (hours > 9)
+            return [NSString stringWithFormat:@"%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds];
+        else
+            return [NSString stringWithFormat:@"%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds];
+    }
+    else
+        return [NSString stringWithFormat:@"%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds];
+    
+}
+
+static NSString *stringToTimeTextAttributed(NSString *string, NSTextAlignment align)
+{
+    NSShadow *blackShadow = [[NSShadow alloc] init];
+    [blackShadow setShadowColor:[NSColor blackColor]];
+    [blackShadow setShadowBlurRadius:0];
+    [blackShadow setShadowOffset:NSMakeSize(0, -1)];
+    NSMutableParagraphStyle *style = [[NSMutableParagraphStyle alloc] init];
+    [style setAlignment:align];
+    NSDictionary *dict = [NSDictionary dictionaryWithObjectsAndKeys:blackShadow, NSShadowAttributeName, style, NSParagraphStyleAttributeName, nil];
+    [style release];
+    [blackShadow release];
+
+    NSAttributedString *attrString = [[NSAttributedString alloc] initWithString:string attributes:dict];
+    return [attrString autorelease];    
+}
+
+- (NSString *)remainingTimeText
+{
+    if (![_delegate mediaElement])
+        return @"";
+
+    // Negative number
+    return stringToTimeTextAttributed(timeToString([_delegate mediaElement]->currentTime() - [_delegate mediaElement]->duration()), NSLeftTextAlignment);
+}
+
+- (NSString *)elapsedTimeText
+{
+    if (![_delegate mediaElement])
+        return @"";
+
+    return stringToTimeTextAttributed(timeToString([_delegate mediaElement]->currentTime()), NSRightTextAlignment);
+}
+
+/*
+ *  Tracking area callbacks
+ *
+ */
+
+- (void)mouseEntered:(NSEvent *)theEvent
+{
+    // Make sure the HUD won't be hidden from now
+    _mouseIsInHUD = YES;
+    [self fadeWindowIn];
+}
+
+- (void)mouseExited:(NSEvent *)theEvent
+{
+    _mouseIsInHUD = NO;
+    [self fadeWindowIn];
+}
+
+/*
+ *  Other Interface callbacks
+ *
+ */
+
+- (void)rewind:(id)sender
+{
+    if (![_delegate mediaElement])
+        return;
+    [_delegate mediaElement]->rewind(30);
+}
+
+- (void)fastForward:(id)sender
+{
+    if (![_delegate mediaElement])
+        return;
+}
+
+- (void)exitFullscreen:(id)sender
+{
+    [_delegate requestExitFullscreen]; 
+}
+
+/*
+ *  Window callback
+ *
+ */
+
+- (void)windowDidExpose:(NSNotification *)notification
+{
+    [self scheduleTimeUpdate];
+}
+
+- (void)windowDidClose:(NSNotification *)notification
+{
+    [self unscheduleTimeUpdate];
+}
+
+@end
+
+#endif
diff --git a/WebKit/mac/WebView/WebView.mm b/WebKit/mac/WebView/WebView.mm
index 20f2712..83c7e20 100644
--- a/WebKit/mac/WebView/WebView.mm
+++ b/WebKit/mac/WebView/WebView.mm
@@ -84,6 +84,7 @@
 #import "WebPanelAuthenticationHandler.h"
 #import "WebPasteboardHelper.h"
 #import "WebPluginDatabase.h"
+#import "WebPluginHalterClient.h"
 #import "WebPolicyDelegate.h"
 #import "WebPreferenceKeysPrivate.h"
 #import "WebPreferencesPrivate.h"
@@ -93,6 +94,7 @@
 #import "WebTextIterator.h"
 #import "WebUIDelegate.h"
 #import "WebUIDelegatePrivate.h"
+#import "WebVideoFullscreenController.h"
 #import <CoreFoundation/CFSet.h>
 #import <Foundation/NSURLConnection.h>
 #import <WebCore/ApplicationCacheStorage.h>
@@ -619,7 +621,7 @@ static bool runningTigerMail()
         didOneTimeInitialization = true;
     }
 
-    _private->page = new Page(new WebChromeClient(self), new WebContextMenuClient(self), new WebEditorClient(self), new WebDragClient(self), new WebInspectorClient(self));
+    _private->page = new Page(new WebChromeClient(self), new WebContextMenuClient(self), new WebEditorClient(self), new WebDragClient(self), new WebInspectorClient(self), new WebPluginHalterClient(self));
 
     _private->page->settings()->setLocalStorageDatabasePath([[self preferences] _localStorageDatabasePath]);
 
@@ -661,11 +663,11 @@ static bool runningTigerMail()
 
     if (!WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITH_LOCAL_RESOURCE_SECURITY_RESTRICTION)) {
         // Originally, we allowed all local loads.
-        FrameLoader::setLocalLoadPolicy(FrameLoader::AllowLocalLoadsForAll);
+        SecurityOrigin::setLocalLoadPolicy(SecurityOrigin::AllowLocalLoadsForAll);
     } else if (!WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITH_MORE_STRICT_LOCAL_RESOURCE_SECURITY_RESTRICTION)) {
         // Later, we allowed local loads for local URLs and documents loaded
         // with substitute data.
-        FrameLoader::setLocalLoadPolicy(FrameLoader::AllowLocalLoadsForLocalAndSubstituteData);
+        SecurityOrigin::setLocalLoadPolicy(SecurityOrigin::AllowLocalLoadsForLocalAndSubstituteData);
     }
 
     if (!WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITHOUT_CONTENT_SNIFFING_FOR_FILE_URLS))
@@ -997,6 +999,8 @@ static bool fastDocumentTeardownEnabled()
         return;
     }
 
+    [self _exitFullscreen];
+
     if (Frame* mainFrame = [self _mainCoreFrame])
         mainFrame->loader()->detachFromParent();
 
@@ -1277,6 +1281,8 @@ static bool fastDocumentTeardownEnabled()
     settings->setPluginsEnabled([preferences arePlugInsEnabled]);
     settings->setDatabasesEnabled([preferences databasesEnabled]);
     settings->setLocalStorageEnabled([preferences localStorageEnabled]);
+    settings->setExperimentalNotificationsEnabled([preferences experimentalNotificationsEnabled]);
+    settings->setExperimentalWebSocketsEnabled([preferences experimentalWebSocketsEnabled]);
     settings->setPrivateBrowsingEnabled([preferences privateBrowsingEnabled]);
     settings->setSansSerifFontFamily([preferences sansSerifFontFamily]);
     settings->setSerifFontFamily([preferences serifFontFamily]);
@@ -1311,6 +1317,9 @@ static bool fastDocumentTeardownEnabled()
     settings->setXSSAuditorEnabled([preferences isXSSAuditorEnabled]);
     settings->setEnforceCSSMIMETypeInStrictMode(!WKAppVersionCheckLessThan(@"com.apple.iWeb", -1, 2.1));
     settings->setAcceleratedCompositingEnabled([preferences acceleratedCompositingEnabled]);
+    settings->setPluginHalterEnabled([preferences pluginHalterEnabled]);
+    settings->setPluginAllowedRunTime([preferences pluginAllowedRunTime]);
+    settings->setWebGLEnabled([preferences webGLEnabled]);
 }
 
 static inline IMP getMethod(id o, SEL s)
@@ -1371,6 +1380,8 @@ static inline IMP getMethod(id o, SEL s)
     cache->willCloseFrameFunc = getMethod(delegate, @selector(webView:willCloseFrame:));
     cache->willPerformClientRedirectToURLDelayFireDateForFrameFunc = getMethod(delegate, @selector(webView:willPerformClientRedirectToURL:delay:fireDate:forFrame:));
     cache->windowScriptObjectAvailableFunc = getMethod(delegate, @selector(webView:windowScriptObjectAvailable:));
+    cache->didDisplayInsecureContentFunc = getMethod(delegate, @selector(webViewDidDisplayInsecureContent:));
+    cache->didRunInsecureContentFunc = getMethod(delegate, @selector(webView:didRunInsecureContent:));
 }
 
 - (void)_cacheScriptDebugDelegateImplementations
@@ -1396,6 +1407,22 @@ static inline IMP getMethod(id o, SEL s)
     cache->exceptionWasRaisedFunc = getMethod(delegate, @selector(webView:exceptionWasRaised:sourceId:line:forWebFrame:));
 }
 
+- (void)_cacheHistoryDelegateImplementations
+{
+    WebHistoryDelegateImplementationCache *cache = &_private->historyDelegateImplementations;
+    id delegate = _private->historyDelegate;
+
+    if (!delegate) {
+        bzero(cache, sizeof(WebHistoryDelegateImplementationCache));
+        return;
+    }
+
+    cache->navigatedFunc = getMethod(delegate, @selector(webView:didNavigateWithNavigationData:inFrame:));
+    cache->clientRedirectFunc = getMethod(delegate, @selector(webView:didPerformClientRedirectFromURL:toURL:inFrame:));
+    cache->serverRedirectFunc = getMethod(delegate, @selector(webView:didPerformServerRedirectFromURL:toURL:inFrame:));
+    cache->setTitleFunc = getMethod(delegate, @selector(webView:updateHistoryTitle:forURL:));
+}
+
 - (id)_policyDelegateForwarder
 {
     if (!_private->policyDelegateForwarder)
@@ -2092,6 +2119,15 @@ static inline IMP getMethod(id o, SEL s)
     return _private ? _private->insertionPasteboard : nil;
 }
 
++ (void)_whiteListAccessFromOrigin:(NSString *)sourceOrigin destinationProtocol:(NSString *)destinationProtocol destinationHost:(NSString *)destinationHost allowDestinationSubdomains:(BOOL)allowDestinationSubdomains
+{
+    SecurityOrigin::whiteListAccessFromOrigin(*SecurityOrigin::createFromString(sourceOrigin), destinationProtocol, destinationHost, allowDestinationSubdomains);
+}
+
++(void)_resetOriginAccessWhiteLists
+{
+    SecurityOrigin::resetOriginAccessWhiteLists();
+}
 
 - (void)_updateActiveState
 {
@@ -2099,6 +2135,108 @@ static inline IMP getMethod(id o, SEL s)
         _private->page->focusController()->setActive([[self window] isKeyWindow]);
 }
 
+static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
+{
+    // Convert the patterns into Vectors.
+    NSUInteger count = [patterns count];
+    if (count == 0)
+        return 0;
+    Vector<String>* patternsVector = new Vector<String>;
+    for (NSUInteger i = 0; i < count; ++i) {
+        id entry = [patterns objectAtIndex:i];
+        if ([entry isKindOfClass:[NSString class]])
+            patternsVector->append(String((NSString*)entry));
+    }
+    return patternsVector;
+}
+
++ (void)_addUserScriptToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID 
+                    whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime
+{
+    String group(groupName);
+    if (group.isEmpty() || worldID == UINT_MAX)
+        return;
+    
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    if (!pageGroup)
+        return;
+    
+    pageGroup->addUserScript(source, url, toStringVector(whitelist), toStringVector(blacklist), worldID, 
+                             injectionTime == WebInjectAtDocumentStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
+}
+
++ (void)_addUserStyleSheetToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID
+                        whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist
+{
+    String group(groupName);
+    if (group.isEmpty() || worldID == UINT_MAX)
+        return;
+    
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    if (!pageGroup)
+        return;
+
+    pageGroup->addUserStyleSheet(source, url, toStringVector(whitelist), toStringVector(blacklist), worldID);
+}
+
++ (void)_removeUserContentFromGroup:(NSString *)groupName url:(NSURL *)url worldID:(unsigned)worldID
+{
+    String group(groupName);
+    if (group.isEmpty())
+        return;
+    
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    if (!pageGroup)
+        return;
+
+    pageGroup->removeUserContentWithURLForWorld(url, worldID);
+}
+
++ (void)_removeUserContentFromGroup:(NSString *)groupName worldID:(unsigned)worldID
+{
+    String group(groupName);
+    if (group.isEmpty())
+        return;
+    
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    if (!pageGroup)
+        return;
+
+    pageGroup->removeUserContentForWorld(worldID);
+}
+
++ (void)_removeAllUserContentFromGroup:(NSString *)groupName
+{
+    String group(groupName);
+    if (group.isEmpty())
+        return;
+    
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    if (!pageGroup)
+        return;
+    
+    pageGroup->removeAllUserContent();
+}
+
+- (BOOL)cssAnimationsSuspended
+{
+    return _private->cssAnimationsSuspended;
+}
+
+- (void)setCSSAnimationsSuspended:(BOOL)suspended
+{
+    if (suspended == _private->cssAnimationsSuspended)
+        return;
+        
+    _private->cssAnimationsSuspended = suspended;
+    
+    Frame* frame = core([self mainFrame]);
+    if (suspended)
+        frame->animation()->suspendAnimations(frame->document());
+    else
+        frame->animation()->resumeAnimations(frame->document());
+}
+
 @end
 
 @implementation _WebSafeForwarder
@@ -3875,6 +4013,17 @@ done:
 {
     return _private->scriptDebugDelegate;
 }
+  
+- (void)setHistoryDelegate:(id)delegate
+{
+    _private->historyDelegate = delegate;
+    [self _cacheHistoryDelegateImplementations];
+}
+
+- (id)historyDelegate
+{
+    return _private->historyDelegate;
+}
 
 - (BOOL)shouldClose
 {
@@ -5091,13 +5240,16 @@ static WebFrameView *containingFrameView(NSView *view)
     id documentView = [[[self selectedFrame] frameView] documentView];
     if (![documentView conformsToProtocol:@protocol(WebDocumentText)])
         return;
-    
+
     NSString *selectedString = [(id <WebDocumentText>)documentView selectedString];
-    if ([selectedString length] == 0) {
+    if (![selectedString length])
         return;
-    }
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    [[NSWorkspace sharedWorkspace] showSearchResultsForQueryString:selectedString];
+#else
     (void)HISearchWindowShow((CFStringRef)selectedString, kNilOptions);
+#endif
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -5469,6 +5621,45 @@ static void layerSyncRunLoopObserverCallBack(CFRunLoopObserverRef, CFRunLoopActi
 
 #endif
 
+#if ENABLE(VIDEO)
+
+- (void)_enterFullscreenForNode:(WebCore::Node*)node
+{
+    ASSERT(node->hasTagName(WebCore::HTMLNames::videoTag));
+    HTMLMediaElement* videoElement = static_cast<HTMLMediaElement*>(node);
+
+    if (_private->fullscreenController) {
+        if ([_private->fullscreenController mediaElement] == videoElement) {
+            // The backend may just warn us that the underlaying plaftormMovie()
+            // has changed. Just force an update.
+            [_private->fullscreenController setMediaElement:videoElement];
+            return; // No more to do.
+        }
+
+        // First exit Fullscreen for the old mediaElement.
+        [_private->fullscreenController mediaElement]->exitFullscreen();
+        // This previous call has to trigger _exitFullscreen,
+        // which has to clear _private->fullscreenController.
+        ASSERT(!_private->fullscreenController);
+    }
+    if (!_private->fullscreenController) {
+        _private->fullscreenController = [[WebVideoFullscreenController alloc] init];
+        [_private->fullscreenController setMediaElement:videoElement];
+        [_private->fullscreenController enterFullscreen:[[self window] screen]];        
+    }
+    else
+        [_private->fullscreenController setMediaElement:videoElement];
+}
+
+- (void)_exitFullscreen
+{
+    [_private->fullscreenController exitFullscreen];
+    [_private->fullscreenController release];
+    _private->fullscreenController = nil;
+}
+
+#endif
+
 @end
 
 #ifdef BUILDING_ON_LEOPARD
diff --git a/WebKit/mac/WebView/WebViewData.h b/WebKit/mac/WebView/WebViewData.h
index 91d83a7..6ec94a7 100644
--- a/WebKit/mac/WebView/WebViewData.h
+++ b/WebKit/mac/WebView/WebViewData.h
@@ -43,6 +43,9 @@ namespace WebCore {
 @class WebPreferences;
 @class WebTextCompletionController;
 @protocol WebFormDelegate;
+#if ENABLE(VIDEO)
+@class WebVideoFullscreenController;
+#endif
 
 extern BOOL applicationIsTerminating;
 extern int pluginDatabaseClientCount;
@@ -64,6 +67,7 @@ extern int pluginDatabaseClientCount;
     id editingDelegate;
     id editingDelegateForwarder;
     id scriptDebugDelegate;
+    id historyDelegate;
 
     WebInspector *inspector;
     WebNodeHighlight *currentNodeHighlight;
@@ -86,6 +90,7 @@ extern int pluginDatabaseClientCount;
     WebResourceDelegateImplementationCache resourceLoadDelegateImplementations;
     WebFrameLoadDelegateImplementationCache frameLoadDelegateImplementations;
     WebScriptDebugDelegateImplementationCache scriptDebugDelegateImplementations;
+    WebHistoryDelegateImplementationCache historyDelegateImplementations;
 
     void *observationInfo;
     
@@ -100,6 +105,7 @@ extern int pluginDatabaseClientCount;
     BOOL hoverFeedbackSuspended;
     BOOL usesPageCache;
     BOOL catchesDelegateExceptions;
+    BOOL cssAnimationsSuspended;
 
     NSColor *backgroundColor;
 
@@ -157,5 +163,8 @@ extern int pluginDatabaseClientCount;
     NSEvent *autoscrollTriggerEvent;
 
     CFRunLoopTimerRef updateMouseoverTimer;
+#if ENABLE(VIDEO)
+    WebVideoFullscreenController *fullscreenController;
+#endif
 }
 @end
diff --git a/WebKit/mac/WebView/WebViewData.mm b/WebKit/mac/WebView/WebViewData.mm
index 48e7f6c..835f46e 100644
--- a/WebKit/mac/WebView/WebViewData.mm
+++ b/WebKit/mac/WebView/WebViewData.mm
@@ -57,6 +57,7 @@ int pluginDatabaseClientCount = 0;
     allowsUndo = YES;
     usesPageCache = YES;
     shouldUpdateWhileOffscreen = YES;
+    cssAnimationsSuspended = NO;
 
     zoomMultiplier = 1;
 
@@ -80,6 +81,7 @@ int pluginDatabaseClientCount = 0;
     ASSERT(applicationIsTerminating || !page);
     ASSERT(applicationIsTerminating || !preferences);
     ASSERT(!insertionPasteboard);
+    ASSERT(!fullscreenController);
 
     [applicationNameForUserAgent release];
     [backgroundColor release];
@@ -99,6 +101,7 @@ int pluginDatabaseClientCount = 0;
 {
     ASSERT_MAIN_THREAD();
     ASSERT(!insertionPasteboard);
+    ASSERT(!fullscreenController);
 
     [super finalize];
 }
diff --git a/WebKit/mac/WebView/WebViewInternal.h b/WebKit/mac/WebView/WebViewInternal.h
index b8266c5..521aeee 100644
--- a/WebKit/mac/WebView/WebViewInternal.h
+++ b/WebKit/mac/WebView/WebViewInternal.h
@@ -41,6 +41,7 @@ namespace WebCore {
     class KURL;
     class KeyboardEvent;
     class Page;
+    class Node;
 }
 #endif
 
@@ -110,10 +111,6 @@ namespace WebCore {
 - (id)_policyDelegateForwarder;
 - (void)_pushPerformingProgrammaticFocus;
 - (void)_popPerformingProgrammaticFocus;
-- (void)_incrementProgressForIdentifier:(id)identifier response:(NSURLResponse *)response;
-- (void)_incrementProgressForIdentifier:(id)identifier length:(int)length;
-- (void)_completeProgressForIdentifier:(id)identifer;
-- (void)_progressStarted:(WebFrame *)frame;
 - (void)_didStartProvisionalLoadForFrame:(WebFrame *)frame;
 + (BOOL)_viewClass:(Class *)vClass andRepresentationClass:(Class *)rClass forMIMEType:(NSString *)MIMEType;
 - (BOOL)_viewClass:(Class *)vClass andRepresentationClass:(Class *)rClass forMIMEType:(NSString *)MIMEType;
@@ -138,7 +135,6 @@ namespace WebCore {
 - (void)_didChangeValueForKey:(NSString *)key;
 - (WebBasePluginPackage *)_pluginForMIMEType:(NSString *)MIMEType;
 - (WebBasePluginPackage *)_pluginForExtension:(NSString *)extension;
-- (BOOL)_isMIMETypeRegisteredAsPlugin:(NSString *)MIMEType;
 
 - (void)setCurrentNodeHighlight:(WebNodeHighlight *)nodeHighlight;
 - (WebNodeHighlight *)currentNodeHighlight;
@@ -168,4 +164,9 @@ namespace WebCore {
 
 - (void)_setInsertionPasteboard:(NSPasteboard *)pasteboard;
 
+#if ENABLE(VIDEO) && defined(__cplusplus)
+- (void)_enterFullscreenForNode:(WebCore::Node*)node;
+- (void)_exitFullscreen;
+#endif
+
 @end
diff --git a/WebKit/mac/WebView/WebViewPrivate.h b/WebKit/mac/WebView/WebViewPrivate.h
index 362b2e6..fa5d28c 100644
--- a/WebKit/mac/WebView/WebViewPrivate.h
+++ b/WebKit/mac/WebView/WebViewPrivate.h
@@ -76,6 +76,11 @@ typedef enum {
 } WebDashboardBehavior;
 #endif
 
+typedef enum {
+    WebInjectAtDocumentStart,
+    WebInjectAtDocumentEnd,
+} WebUserScriptInjectionTime;
+
 @interface WebController : NSTreeController {
     IBOutlet WebView *webView;
 }
@@ -134,6 +139,20 @@ typedef enum {
 */    
 - (id)scriptDebugDelegate;
 
+/*!
+    @method setHistoryDelegate:
+    @abstract Set the WebView's WebHistoryDelegate delegate.
+    @param delegate The WebHistoryDelegate to set as the delegate.
+*/    
+- (void)setHistoryDelegate:(id)delegate;
+
+/*!
+    @method historyDelegate
+    @abstract Return the WebView's WebHistoryDelegate delegate.
+    @result The WebView's WebHistoryDelegate delegate.
+*/    
+- (id)historyDelegate;
+
 - (BOOL)shouldClose;
 
 /*!
@@ -443,6 +462,35 @@ Could be worth adding to the API.
 // Which pasteboard text is coming from in editing delegate methods such as shouldInsertNode.
 - (NSPasteboard *)_insertionPasteboard;
 
+// Whitelists access from an origin (sourceOrigin) to a set of one or more origins described by the parameters:
+// - destinationProtocol: The protocol to grant access to.
+// - destinationHost: The host to grant access to.
+// - allowDestinationSubdomains: If host is a domain, setting this to YES will whitelist host and all its subdomains, recursively.
++ (void)_whiteListAccessFromOrigin:(NSString *)sourceOrigin destinationProtocol:(NSString *)destinationProtocol destinationHost:(NSString *)destinationHost allowDestinationSubdomains:(BOOL)allowDestinationSubdomains;
+
+// Removes all white list entries created with _whiteListAccessFromOrigin.
++ (void)_resetOriginAccessWhiteLists;
+
++ (void)_addUserScriptToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime;
++ (void)_addUserStyleSheetToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist;
++ (void)_removeUserContentFromGroup:(NSString *)groupName url:(NSURL *)url worldID:(unsigned)worldID;
++ (void)_removeUserContentFromGroup:(NSString *)groupName worldID:(unsigned)worldID;
++ (void)_removeAllUserContentFromGroup:(NSString *)groupName;
+
+/*!
+    @method cssAnimationsSuspended
+    @abstract Returns whether or not CSS Animations are suspended.
+    @result YES if CSS Animations are suspended.
+*/
+- (BOOL)cssAnimationsSuspended;
+
+/*!
+    @method setCSSAnimationsSuspended
+    @param paused YES to suspend animations, NO to resume animations.
+    @discussion Suspends or resumes all running animations and transitions in the page.
+*/
+- (void)setCSSAnimationsSuspended:(BOOL)suspended;
+
 @end
 
 @interface WebView (WebViewPrintingPrivate)
diff --git a/WebKit/mac/WebView/WebWindowAnimation.h b/WebKit/mac/WebView/WebWindowAnimation.h
new file mode 100644
index 0000000..c73dcce
--- /dev/null
+++ b/WebKit/mac/WebView/WebWindowAnimation.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <Cocoa/Cocoa.h>
+
+@interface WebWindowScaleAnimation : NSAnimation {
+@private
+    NSRect _initialFrame, _finalFrame, _realFrame;
+    NSWindow *_window; // (assign)
+    NSAnimation *_subAnimation; // (retain)
+    NSTimeInterval _hintedDuration;
+}
+- (id)initWithHintedDuration:(NSTimeInterval)duration window:(NSWindow *)window initalFrame:(NSRect)initialFrame finalFrame:(NSRect)finalFrame;
+
+- (void)setSubAnimation:(NSAnimation *)animation;
+
+- (NSRect)currentFrame;
+
+// Be sure to call setWindow:nil to clear the weak link _window when appropriate
+- (void)setWindow:(NSWindow *)window;
+@end
+
+
+@interface WebWindowFadeAnimation : NSAnimation {
+@private
+    CGFloat _initialAlpha, _finalAlpha;
+    NSWindow *_window; // (retain)
+    BOOL _isStopped;
+    
+}
+- (id)initWithDuration:(NSTimeInterval)duration window:(NSWindow *)window initialAlpha:(CGFloat)initialAlpha finalAlpha:(CGFloat)finalAlpha;
+
+- (CGFloat)currentAlpha;
+
+// Be sure to call setWindow:nil to clear the weak link _window when appropriate
+- (void)setWindow:(NSWindow *)window;
+@end
diff --git a/WebKit/mac/WebView/WebWindowAnimation.m b/WebKit/mac/WebView/WebWindowAnimation.m
new file mode 100644
index 0000000..3ab64bf
--- /dev/null
+++ b/WebKit/mac/WebView/WebWindowAnimation.m
@@ -0,0 +1,239 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "WebWindowAnimation.h"
+#import "WebKitSystemInterface.h"
+#import <wtf/Assertions.h>
+
+static const CGFloat slowMotionFactor = 10.;
+
+static NSTimeInterval WebWindowAnimationDurationFromDuration(NSTimeInterval duration)
+{
+    return ([[NSApp currentEvent] modifierFlags] & NSShiftKeyMask) ? duration * slowMotionFactor : duration;        
+}
+
+static NSRect scaledRect(NSRect _initialFrame, NSRect _finalFrame, double factor)
+{
+    NSRect currentRect = _initialFrame;
+    currentRect.origin.x += (NSMinX(_finalFrame) - NSMinX(_initialFrame)) * factor;
+    currentRect.origin.y += (NSMinY(_finalFrame) - NSMinY(_initialFrame)) * factor;
+    currentRect.size.width += (NSWidth(_finalFrame) - NSWidth(_initialFrame)) * factor;
+    currentRect.size.height += (NSHeight(_finalFrame) - NSHeight(_initialFrame)) * factor;
+    return currentRect;
+}
+
+static CGFloat squaredDistance(NSPoint point1, NSPoint point2)
+{
+    CGFloat deltaX = point1.x - point2.x;
+    CGFloat deltaY = point1.y - point2.y;
+    return deltaX * deltaX + deltaY * deltaY;
+}
+
+@implementation WebWindowScaleAnimation
+
+- (id)init
+{
+    self = [super init];
+    if (!self)
+        return nil;
+#ifndef BUILDING_ON_TIGER
+    [self setAnimationBlockingMode:NSAnimationNonblockingThreaded];
+#endif
+    [self setFrameRate:60.];
+    return self;
+}
+
+- (id)initWithHintedDuration:(NSTimeInterval)duration window:(NSWindow *)window initalFrame:(NSRect)initialFrame finalFrame:(NSRect)finalFrame
+{
+    self = [self init];
+    if (!self)
+        return nil;
+    _hintedDuration = duration;
+    _window = window;
+    _initialFrame = initialFrame;
+    _finalFrame = finalFrame;
+    _realFrame = [window frame];
+    return self;
+}
+
+- (void) dealloc
+{
+    [_window release];
+    [_subAnimation release];
+    [super dealloc];
+}
+
+- (void)setDuration:(NSTimeInterval)duration
+{
+    [super setDuration:WebWindowAnimationDurationFromDuration(duration)];
+}
+
+- (void)setWindow:(NSWindow *)window
+{
+    _window = window;
+}
+
+- (float)currentValue
+{
+    return 0.5 - 0.5 * cos(M_PI * (1 - [self currentProgress]));
+}
+
+- (NSRect)currentFrame
+{
+    return scaledRect(_finalFrame, _initialFrame, [self currentValue]);
+}
+
+- (void)setCurrentProgress:(NSAnimationProgress)progress
+{
+    if (!_window)
+        return;
+
+    [super setCurrentProgress:progress];
+
+    NSRect currentRect = [self currentFrame];
+#ifndef BUILDING_ON_TIGER
+    WKWindowSetScaledFrame(_window, currentRect, _realFrame);
+#else
+    [_window setFrame:currentRect display:YES];
+#endif
+    [_subAnimation setCurrentProgress:progress];
+}
+
+- (void)setSubAnimation:(NSAnimation *)animation
+{
+    id oldAnimation = _subAnimation;
+    _subAnimation = [animation retain];
+    [oldAnimation release];
+}
+
+- (NSTimeInterval)additionalDurationNeededToReachFinalFrame
+{
+    static const CGFloat maxAdditionalDuration = 1.0;
+    static const CGFloat speedFactor = 0.0001;
+    
+    CGFloat maxDist = squaredDistance(_initialFrame.origin, _finalFrame.origin);
+    CGFloat dist;
+    
+    dist = squaredDistance(NSMakePoint(NSMaxX(_initialFrame), NSMinY(_initialFrame)), NSMakePoint(NSMaxX(_finalFrame), NSMinY(_finalFrame)));
+    if (dist > maxDist)
+        maxDist = dist;
+    
+    dist = squaredDistance(NSMakePoint(NSMaxX(_initialFrame), NSMaxY(_initialFrame)), NSMakePoint(NSMaxX(_finalFrame), NSMaxY(_finalFrame)));
+    if (dist > maxDist)
+        maxDist = dist;
+    
+    dist = squaredDistance(NSMakePoint(NSMinX(_initialFrame), NSMinY(_initialFrame)), NSMakePoint(NSMinX(_finalFrame), NSMinY(_finalFrame)));
+    if (dist > maxDist)
+        maxDist = dist;
+    
+    return MIN(sqrt(maxDist) * speedFactor, maxAdditionalDuration);    
+}
+
+- (void)startAnimation
+{
+    // Compute extra time
+    if (_hintedDuration)
+        [self setDuration:_hintedDuration + [self additionalDurationNeededToReachFinalFrame]];
+    [super startAnimation];
+}
+
+- (void)stopAnimation
+{
+    _window = nil;
+    [super stopAnimation];
+    [_subAnimation stopAnimation];
+}
+
+@end
+
+@implementation WebWindowFadeAnimation
+
+- (id)init
+{
+    self = [super init];
+    if (!self)
+        return nil;
+#ifndef BUILDING_ON_TIGER
+    [self setAnimationBlockingMode:NSAnimationNonblockingThreaded];
+#endif
+    [self setFrameRate:60];
+    [self setAnimationCurve:NSAnimationEaseInOut];
+    return self;
+}
+
+- (id)initWithDuration:(NSTimeInterval)duration window:(NSWindow *)window initialAlpha:(CGFloat)initialAlpha finalAlpha:(CGFloat)finalAlpha
+{
+    self = [self init];
+    if (!self)
+        return nil;    
+    _window = window;
+    _initialAlpha = initialAlpha;
+    _finalAlpha = finalAlpha;
+    return self;
+}
+
+- (void)setDuration:(NSTimeInterval)duration
+{
+    [super setDuration:WebWindowAnimationDurationFromDuration(duration)];
+}
+
+- (CGFloat)currentAlpha
+{
+    return MAX(0.0, MIN(1.0, _initialAlpha + [self currentValue] * (_finalAlpha - _initialAlpha)));
+}
+
+- (void)setCurrentProgress:(NSAnimationProgress)progress
+{
+    if (_isStopped)
+        return;
+
+    ASSERT(_window);
+    [super setCurrentProgress:progress];
+
+#ifndef BUILDING_ON_TIGER
+    WKWindowSetAlpha(_window, [self currentAlpha]);
+#else
+    [_window setAlphaValue:[self currentAlpha]];
+#endif
+}
+
+- (void)setWindow:(NSWindow*)window
+{
+    _window = window;
+}
+
+- (void)stopAnimation
+{
+    // This is relevant when we are a sub animation of a scale animation.
+    // In this case we are hosted in the animated thread of the parent
+    // and even after [super stopAnimation], the parent might call
+    // setCurrrentProgress.
+    _isStopped = YES;
+
+    [super stopAnimation];
+}
+
+@end
+
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp b/WebKit/mac/Workers/WebWorkersPrivate.h
index 35a40f5..0ff60d5 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp
+++ b/WebKit/mac/Workers/WebWorkersPrivate.h
@@ -28,15 +28,10 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "SQLiteFileSystem.h"
-
-namespace WebCore {
-
-void SQLiteFileSystem::registerSQLiteVFS()
-{
-    // stub for registering Chromium's SQLite VFS for Mac
-    ASSERT_NOT_REACHED();
+@interface WebWorkersPrivate : NSObject {
 }
 
-} // namespace WebCore
+// Returns the total number of currently executing worker threads (shared + dedicated).
++ (unsigned) workerThreadCount;
+
+@end
diff --git a/WebKit/mac/Workers/WebWorkersPrivate.mm b/WebKit/mac/Workers/WebWorkersPrivate.mm
new file mode 100644
index 0000000..2c14ad1
--- /dev/null
+++ b/WebKit/mac/Workers/WebWorkersPrivate.mm
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebWorkersPrivate.h"
+
+#import <WebCore/WorkerThread.h>
+
+@implementation WebWorkersPrivate
+
++ (unsigned) workerThreadCount
+{
+#if ENABLE_WORKERS
+    return WebCore::WorkerThread::workerThreadCount();
+#else
+    return 0;
+#endif
+}
+
+@end
diff --git a/WebKit/qt/Api/headers.pri b/WebKit/qt/Api/headers.pri
index 92a120d..5a95c67 100644
--- a/WebKit/qt/Api/headers.pri
+++ b/WebKit/qt/Api/headers.pri
@@ -1,4 +1,5 @@
 WEBKIT_API_HEADERS = $$PWD/qwebframe.h \
+                     $$PWD/qgraphicswebview.h \
                      $$PWD/qwebkitglobal.h \
                      $$PWD/qwebpage.h \
                      $$PWD/qwebview.h \
@@ -10,4 +11,5 @@ WEBKIT_API_HEADERS = $$PWD/qwebframe.h \
                      $$PWD/qwebplugindatabase.h \
                      $$PWD/qwebpluginfactory.h \
                      $$PWD/qwebhistory.h \
+                     $$PWD/qwebinspector.h \
                      $$PWD/qwebkitversion.h
diff --git a/WebKit/qt/Api/qgraphicswebview.cpp b/WebKit/qt/Api/qgraphicswebview.cpp
new file mode 100644
index 0000000..c267745
--- /dev/null
+++ b/WebKit/qt/Api/qgraphicswebview.cpp
@@ -0,0 +1,832 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "qgraphicswebview.h"
+
+#include "qwebframe.h"
+#include "qwebpage.h"
+#include "qwebpage_p.h"
+#include "QWebPageClient.h"
+#include <QtGui/QGraphicsScene>
+#include <QtGui/QGraphicsView>
+#include <QtGui/qapplication.h>
+#include <QtGui/qgraphicssceneevent.h>
+#include <QtGui/qstyleoption.h>
+#if defined(Q_WS_X11)
+#include <QX11Info>
+#endif
+
+class QGraphicsWebViewPrivate : public QWebPageClient {
+public:
+    QGraphicsWebViewPrivate(QGraphicsWebView* parent)
+        : q(parent)
+        , page(0)
+        , interactive(true)
+        , progress(1.0)
+    {}
+
+    virtual void scroll(int dx, int dy, const QRect&);
+    virtual void update(const QRect& dirtyRect);
+
+#ifndef QT_NO_CURSOR
+    virtual QCursor cursor() const;
+    virtual void updateCursor(const QCursor& cursor);
+#endif
+
+    virtual int screenNumber() const;
+    virtual WId winId() const;
+
+    virtual QObject* pluginParent() const;
+
+    void _q_doLoadProgress(int progress);
+    void _q_doLoadFinished(bool success);
+    void _q_setStatusBarMessage(const QString& message);
+
+    QGraphicsWebView* q;
+    QWebPage* page;
+
+    QString statusBarMessage;
+    bool interactive;
+    qreal progress;
+};
+
+void QGraphicsWebViewPrivate::_q_doLoadProgress(int progress)
+{
+    if (qFuzzyCompare(this->progress, qreal(progress / 100.)))
+        return;
+
+    this->progress = progress / 100.;
+
+    emit q->progressChanged(this->progress);
+}
+
+void QGraphicsWebViewPrivate::_q_doLoadFinished(bool success)
+{
+    // If the page had no title, still make sure it gets the signal
+    if (q->title().isEmpty())
+        emit q->urlChanged(q->url());
+
+    emit q->loadFinished(success);
+}
+
+void QGraphicsWebViewPrivate::scroll(int dx, int dy, const QRect& rectToScroll)
+{
+    q->scroll(qreal(dx), qreal(dy), QRectF(rectToScroll));
+}
+
+void QGraphicsWebViewPrivate::update(const QRect & dirtyRect)
+{
+    q->update(QRectF(dirtyRect));
+}
+
+#ifndef QT_NO_CURSOR
+QCursor QGraphicsWebViewPrivate::cursor() const
+{
+    return q->cursor();
+}
+
+void QGraphicsWebViewPrivate::updateCursor(const QCursor& cursor)
+{
+    q->setCursor(cursor);
+}
+#endif
+
+int QGraphicsWebViewPrivate::screenNumber() const
+{
+#if defined(Q_WS_X11)
+    const QList<QGraphicsView*> views = q->scene()->views();
+
+    if (!views.isEmpty())
+        return views.at(0)->x11Info().screen();
+#endif
+
+    return 0;
+}
+
+WId QGraphicsWebViewPrivate::winId() const
+{
+    const QList<QGraphicsView*> views = q->scene()->views();
+
+    if (!views.isEmpty())
+        return views.at(0)->winId();
+
+    return 0;
+}
+
+QObject* QGraphicsWebViewPrivate::pluginParent() const
+{
+    return q;
+}
+
+void QGraphicsWebViewPrivate::_q_setStatusBarMessage(const QString& s)
+{
+    statusBarMessage = s;
+    emit q->statusChanged();
+}
+
+/*!
+    \class QGraphicsWebView
+    \brief The QGraphicsWebView class allows web content to be added to a GraphicsView.
+    \since 4.6
+
+    A WebGraphicsItem renders web content based on a URL or set data.
+
+    If the width and height of the item is not set, they will
+    dynamically adjust to a size appropriate for the content.
+    This width may be large (eg. 980) for typical online web pages.
+*/
+
+/*!
+    Constructs an empty QGraphicsWebView with parent \a parent.
+
+    \sa load()
+*/
+QGraphicsWebView::QGraphicsWebView(QGraphicsItem* parent)
+    : QGraphicsWidget(parent)
+    , d(new QGraphicsWebViewPrivate(this))
+{
+#if QT_VERSION >= 0x040600
+    setFlag(QGraphicsItem::ItemUsesExtendedStyleOption, true);
+#endif
+    setAcceptHoverEvents(true);
+    setFocusPolicy(Qt::StrongFocus);
+}
+
+/*!
+    Destroys the web graphicsitem.
+*/
+QGraphicsWebView::~QGraphicsWebView()
+{
+    if (d->page)
+        d->page->d->view = 0;
+
+    if (d->page && d->page->parent() == this)
+        delete d->page;
+
+    delete d;
+}
+
+/*!
+    Returns a pointer to the underlying web page.
+
+    \sa setPage()
+*/
+QWebPage* QGraphicsWebView::page() const
+{
+    if (!d->page) {
+        QGraphicsWebView* that = const_cast<QGraphicsWebView*>(this);
+        QWebPage* page = new QWebPage(that);
+
+        // Default to not having a background, in the case
+        // the page doesn't provide one.
+        QPalette palette = QApplication::palette();
+        palette.setBrush(QPalette::Base, QColor::fromRgbF(0, 0, 0, 0));
+        page->setPalette(palette);
+
+        that->setPage(page);
+    }
+
+    return d->page;
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget*)
+{
+    page()->mainFrame()->render(painter, option->exposedRect.toRect());
+}
+
+/*! \reimp
+*/
+bool QGraphicsWebView::sceneEvent(QEvent* event)
+{
+    // Re-implemented in order to allows fixing event-related bugs in patch releases.
+    return QGraphicsWidget::sceneEvent(event);
+}
+
+/*! \reimp
+*/
+bool QGraphicsWebView::event(QEvent* event)
+{
+    // Re-implemented in order to allows fixing event-related bugs in patch releases.
+
+    if (d->page) {
+#ifndef QT_NO_CURSOR
+#if QT_VERSION >= 0x040400
+        } else if (event->type() == QEvent::CursorChange) {
+            // An unsetCursor will set the cursor to Qt::ArrowCursor.
+            // Thus this cursor change might be a QWidget::unsetCursor()
+            // If this is not the case and it came from WebCore, the
+            // QWebPageClient already has set its cursor internally
+            // to Qt::ArrowCursor, so updating the cursor is always
+            // right, as it falls back to the last cursor set by
+            // WebCore.
+            // FIXME: Add a QEvent::CursorUnset or similar to Qt.
+            if (cursor().shape() == Qt::ArrowCursor)
+                d->resetCursor();
+#endif
+#endif
+    }
+    return QGraphicsWidget::event(event);
+}
+
+/*!
+    Makes \a page the new web page of the web graphicsitem.
+
+    The parent QObject of the provided page remains the owner
+    of the object. If the current document is a child of the web
+    view, it will be deleted.
+
+    \sa page()
+*/
+void QGraphicsWebView::setPage(QWebPage* page)
+{
+    if (d->page == page)
+        return;
+
+    if (d->page) {
+        d->page->d->client = 0; // unset the page client
+        if (d->page->parent() == this)
+            delete d->page;
+        else
+            d->page->disconnect(this);
+    }
+
+    d->page = page;
+    if (!d->page)
+        return;
+    d->page->d->client = d; // set the page client
+
+    QSize size = geometry().size().toSize();
+    page->setViewportSize(size);
+
+    QWebFrame* mainFrame = d->page->mainFrame();
+
+    connect(mainFrame, SIGNAL(titleChanged(const QString&)),
+            this, SIGNAL(titleChanged(const QString&)));
+    connect(mainFrame, SIGNAL(iconChanged()),
+            this, SIGNAL(iconChanged()));
+    connect(mainFrame, SIGNAL(urlChanged(const QUrl&)),
+            this, SIGNAL(urlChanged(const QUrl&)));
+    connect(d->page, SIGNAL(loadStarted()),
+            this, SIGNAL(loadStarted()));
+    connect(d->page, SIGNAL(loadProgress(int)),
+            this, SLOT(_q_doLoadProgress(int)));
+    connect(d->page, SIGNAL(loadFinished(bool)),
+            this, SLOT(_q_doLoadFinished(bool)));
+    connect(d->page, SIGNAL(statusBarMessage(const QString&)),
+            this, SLOT(_q_setStatusBarMessage(const QString&)));
+}
+
+/*!
+    \property QGraphicsWebView::url
+    \brief the url of the web page currently viewed
+
+    Setting this property clears the view and loads the URL.
+
+    By default, this property contains an empty, invalid URL.
+
+    \sa load(), urlChanged()
+*/
+
+void QGraphicsWebView::setUrl(const QUrl &url)
+{
+    page()->mainFrame()->setUrl(url);
+}
+
+QUrl QGraphicsWebView::url() const
+{
+    if (d->page)
+        return d->page->mainFrame()->url();
+
+    return QUrl();
+}
+
+/*!
+    \property QGraphicsWebView::title
+    \brief the title of the web page currently viewed
+
+    By default, this property contains an empty string.
+
+    \sa titleChanged()
+*/
+QString QGraphicsWebView::title() const
+{
+    if (d->page)
+        return d->page->mainFrame()->title();
+
+    return QString();
+}
+
+/*!
+    \property QGraphicsWebView::icon
+    \brief the icon associated with the web page currently viewed
+
+    By default, this property contains a null icon.
+
+    \sa iconChanged(), QWebSettings::iconForUrl()
+*/
+QIcon QGraphicsWebView::icon() const
+{
+    if (d->page)
+        return d->page->mainFrame()->icon();
+
+    return QIcon();
+}
+
+/*!
+    \property QGraphicsWebView::zoomFactor
+    \since 4.5
+    \brief the zoom factor for the view
+*/
+
+void QGraphicsWebView::setZoomFactor(qreal factor)
+{
+    if (factor == page()->mainFrame()->zoomFactor())
+        return;
+
+    page()->mainFrame()->setZoomFactor(factor);
+    emit zoomFactorChanged();
+}
+
+qreal QGraphicsWebView::zoomFactor() const
+{
+    return page()->mainFrame()->zoomFactor();
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::updateGeometry()
+{
+    QGraphicsWidget::updateGeometry();
+
+    if (!d->page)
+        return;
+
+    QSize size = geometry().size().toSize();
+    d->page->setViewportSize(size);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::setGeometry(const QRectF& rect)
+{
+    QGraphicsWidget::setGeometry(rect);
+
+    if (!d->page)
+        return;
+
+    // NOTE: call geometry() as setGeometry ensures that
+    // the geometry is within legal bounds (minimumSize, maximumSize)
+    QSize size = geometry().size().toSize();
+    d->page->setViewportSize(size);
+}
+
+/*!
+    \property QGraphicsWebView::status
+    \brief the load status message.
+
+    Provides the latest status message set during the load of a URL.
+    Commonly shown by Status Bar widgets.
+
+    \sa statusChanged()
+*/
+
+QString QGraphicsWebView::status() const
+{
+    return d->statusBarMessage;
+}
+
+/*!
+    Convenience slot that stops loading the document.
+
+    \sa reload(), loadFinished()
+*/
+void QGraphicsWebView::stop()
+{
+    if (d->page)
+        d->page->triggerAction(QWebPage::Stop);
+}
+
+/*!
+    Convenience slot that loads the previous document in the list of documents
+    built by navigating links. Does nothing if there is no previous document.
+
+    \sa forward()
+*/
+void QGraphicsWebView::back()
+{
+    if (d->page)
+        d->page->triggerAction(QWebPage::Back);
+}
+
+/*!
+    Convenience slot that loads the next document in the list of documents
+    built by navigating links. Does nothing if there is no next document.
+
+    \sa back()
+*/
+void QGraphicsWebView::forward()
+{
+    if (d->page)
+        d->page->triggerAction(QWebPage::Forward);
+}
+
+/*!
+    Reloads the current document.
+
+    \sa stop(), loadStarted()
+*/
+void QGraphicsWebView::reload()
+{
+    if (d->page)
+        d->page->triggerAction(QWebPage::Reload);
+}
+
+/*!
+    \property QGraphicsWebView::progress
+    \brief the progress of loading the current URL, from 0 to 1.
+*/
+qreal QGraphicsWebView::progress() const
+{
+    return d->progress;
+}
+
+/*!
+    Loads the specified \a url and displays it.
+
+    \note The view remains the same until enough data has arrived to display the new \a url.
+
+    \sa setUrl(), url(), urlChanged()
+*/
+void QGraphicsWebView::load(const QUrl& url)
+{
+    page()->mainFrame()->load(url);
+}
+
+/*!
+    \fn void QGraphicsWebView::load(const QNetworkRequest &request, QNetworkAccessManager::Operation operation, const QByteArray &body)
+
+    Loads a network request, \a request, using the method specified in \a operation.
+
+    \a body is optional and is only used for POST operations.
+
+    \note The view remains the same until enough data has arrived to display the new url.
+
+    \sa url(), urlChanged()
+*/
+
+void QGraphicsWebView::load(const QNetworkRequest& request,
+                    QNetworkAccessManager::Operation operation,
+                    const QByteArray& body)
+{
+    page()->mainFrame()->load(request, operation, body);
+}
+
+/*!
+    \property QGraphicsWebView::html
+    This property provides an HTML interface to the text in the webview.
+
+    When setting this property, external objects such as stylesheets or images
+    referenced in the HTML document are located relative to \a baseUrl.
+
+    The \a html is loaded immediately; external objects are loaded asynchronously.
+
+    When using these methods, WebKit assumes that external resources such as
+    JavaScript programs or style sheets are encoded in UTF-8 unless otherwise
+    specified. For example, the encoding of an external script can be specified
+    through the charset attribute of the HTML script tag. Alternatively, the
+    encoding can also be specified by the web server.
+
+    \sa load(), setContent(), QWebFrame::toHtml()
+*/
+void QGraphicsWebView::setHtml(const QString& html, const QUrl& baseUrl)
+{
+    page()->mainFrame()->setHtml(html, baseUrl);
+}
+
+QString QGraphicsWebView::toHtml() const
+{
+    return page()->mainFrame()->toHtml();
+}
+
+/*!
+    Sets the content of the web graphicsitem to the specified content \a data. If the \a mimeType argument
+    is empty it is currently assumed that the content is HTML but in future versions we may introduce
+    auto-detection.
+
+    External objects referenced in the content are located relative to \a baseUrl.
+
+    The \a data is loaded immediately; external objects are loaded asynchronously.
+
+    \sa load(), setHtml(), QWebFrame::toHtml()
+*/
+void QGraphicsWebView::setContent(const QByteArray& data, const QString& mimeType, const QUrl& baseUrl)
+{
+    page()->mainFrame()->setContent(data, mimeType, baseUrl);
+}
+
+/*!
+    Returns a pointer to the view's history of navigated web pages.
+
+    It is equivalent to
+
+    \snippet webkitsnippets/qtwebkit_qwebview_snippet.cpp 0
+*/
+QWebHistory* QGraphicsWebView::history() const
+{
+    return page()->history();
+}
+
+/*!
+  \property QGraphicsWebView::interactive
+  \brief controls whether the item responds to mouse and key events.
+*/
+
+bool QGraphicsWebView::isInteractive() const
+{
+    return d->interactive;
+}
+
+void QGraphicsWebView::setInteractive(bool allowed)
+{
+    if (d->interactive == allowed)
+        return;
+
+    d->interactive = allowed;
+    emit interactivityChanged();
+}
+
+/*!
+    Returns a pointer to the view/page specific settings object.
+
+    It is equivalent to
+
+    \snippet webkitsnippets/qtwebkit_qwebview_snippet.cpp 1
+
+    \sa QWebSettings::globalSettings()
+*/
+QWebSettings* QGraphicsWebView::settings() const
+{
+    return page()->settings();
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::hoverMoveEvent(QGraphicsSceneHoverEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        QMouseEvent me = QMouseEvent(QEvent::MouseMove,
+                ev->pos().toPoint(), Qt::NoButton,
+                Qt::NoButton, Qt::NoModifier);
+        d->page->setView(ev->widget());
+        d->page->event(&me);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::hoverMoveEvent(ev);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::hoverLeaveEvent(QGraphicsSceneHoverEvent* ev)
+{
+    Q_UNUSED(ev);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::mouseMoveEvent(ev);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::mousePressEvent(QGraphicsSceneMouseEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::mousePressEvent(ev);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::mouseReleaseEvent(ev);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::mouseDoubleClickEvent(QGraphicsSceneMouseEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::mouseDoubleClickEvent(ev);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::keyPressEvent(QKeyEvent* ev)
+{
+    if (d->interactive && d->page)
+        d->page->event(ev);
+
+    if (!ev->isAccepted())
+        QGraphicsItem::keyPressEvent(ev);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::keyReleaseEvent(QKeyEvent* ev)
+{
+    if (d->interactive && d->page)
+        d->page->event(ev);
+
+    if (!ev->isAccepted())
+        QGraphicsItem::keyReleaseEvent(ev);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::focusInEvent(QFocusEvent* ev)
+{
+    if (d->page)
+        d->page->event(ev);
+    else
+        QGraphicsItem::focusInEvent(ev);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::focusOutEvent(QFocusEvent* ev)
+{
+    if (d->page)
+        d->page->event(ev);
+    else
+        QGraphicsItem::focusOutEvent(ev);
+}
+
+/*! \reimp
+*/
+bool QGraphicsWebView::focusNextPrevChild(bool next)
+{
+    if (d->page)
+        return d->page->focusNextPrevChild(next);
+
+    return QGraphicsWidget::focusNextPrevChild(next);
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    //if (d->page)
+    //    d->page->event(ev);
+    //Just remove this line below when the code above is working
+    Q_UNUSED(ev);
+#else
+    Q_UNUSED(ev);
+#endif
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::dragLeaveEvent(QGraphicsSceneDragDropEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsWidget::dragLeaveEvent(ev);
+#else
+    Q_UNUSED(ev);
+#endif
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsWidget::dragMoveEvent(ev);
+#else
+    Q_UNUSED(ev);
+#endif
+}
+
+/*! \reimp
+*/
+void QGraphicsWebView::dropEvent(QGraphicsSceneDragDropEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsWidget::dropEvent(ev);
+#else
+    Q_UNUSED(ev);
+#endif
+}
+
+#ifndef QT_NO_CONTEXTMENU
+/*! \reimp
+*/
+void QGraphicsWebView::contextMenuEvent(QGraphicsSceneContextMenuEvent* ev)
+{
+    if (d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+}
+#endif // QT_NO_CONTEXTMENU
+
+#ifndef QT_NO_WHEELEVENT
+/*! \reimp
+*/
+void QGraphicsWebView::wheelEvent(QGraphicsSceneWheelEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::wheelEvent(ev);
+}
+#endif // QT_NO_WHEELEVENT
+
+/*! \reimp
+*/
+void QGraphicsWebView::inputMethodEvent(QInputMethodEvent* ev)
+{
+    if (d->interactive && d->page)
+        d->page->event(ev);
+
+    if (!ev->isAccepted())
+        QGraphicsItem::inputMethodEvent(ev);
+}
+
+#include "moc_qgraphicswebview.cpp"
diff --git a/WebKit/qt/Api/qgraphicswebview.h b/WebKit/qt/Api/qgraphicswebview.h
new file mode 100644
index 0000000..26f7374
--- /dev/null
+++ b/WebKit/qt/Api/qgraphicswebview.h
@@ -0,0 +1,143 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef QGraphicsWebView_h
+#define QGraphicsWebView_h
+
+#include "qwebkitglobal.h"
+#include <QtCore/qurl.h>
+#include <QtGui/qevent.h>
+#include <QtGui/qgraphicswidget.h>
+#include <QtGui/qicon.h>
+#include <QtGui/qpainter.h>
+#include <QtNetwork/qnetworkaccessmanager.h>
+
+class QWebPage;
+class QWebHistory;
+class QWebSettings;
+
+class QGraphicsWebViewPrivate;
+
+class QWEBKIT_EXPORT QGraphicsWebView : public QGraphicsWidget {
+    Q_OBJECT
+
+    Q_PROPERTY(QString title READ title NOTIFY titleChanged)
+    Q_PROPERTY(QIcon icon READ icon NOTIFY iconChanged)
+    Q_PROPERTY(qreal zoomFactor READ zoomFactor WRITE setZoomFactor NOTIFY zoomFactorChanged)
+    Q_PROPERTY(QString status READ status NOTIFY statusChanged)
+
+    Q_PROPERTY(QString html READ toHtml WRITE setHtml)
+    Q_PROPERTY(QUrl url READ url WRITE setUrl NOTIFY urlChanged)
+    Q_PROPERTY(qreal progress READ progress NOTIFY progressChanged)
+
+    Q_PROPERTY(bool interactive READ isInteractive WRITE setInteractive NOTIFY interactivityChanged)
+
+public:
+    QGraphicsWebView(QGraphicsItem* parent = 0);
+    ~QGraphicsWebView();
+
+    QWebPage* page() const;
+    void setPage(QWebPage*);
+
+    QUrl url() const;
+    void setUrl(const QUrl&);
+
+    QString title() const;
+    QIcon icon() const;
+
+    qreal zoomFactor() const;
+    void setZoomFactor(qreal);
+
+    bool isInteractive() const;
+    void setInteractive(bool);
+
+    qreal progress() const;
+
+    void load(const QUrl &url);
+    void load(const QNetworkRequest& request, QNetworkAccessManager::Operation operation = QNetworkAccessManager::GetOperation, const QByteArray& body = QByteArray());
+
+    QString toHtml() const;
+    void setHtml(const QString& html, const QUrl& baseUrl = QUrl());
+    // FIXME: Consider rename to setHtml?
+    void setContent(const QByteArray& data, const QString& mimeType = QString(), const QUrl& baseUrl = QUrl());
+
+    QWebHistory* history() const;
+    QWebSettings* settings() const;
+
+    QString status() const;
+
+    virtual void setGeometry(const QRectF& rect);
+    virtual void updateGeometry();
+    virtual void paint(QPainter*, const QStyleOptionGraphicsItem* options, QWidget* widget = 0);
+    virtual bool event(QEvent*);
+
+public Q_SLOTS:
+    void stop();
+    void back();
+    void forward();
+    void reload();
+
+Q_SIGNALS:
+    void loadStarted();
+    void loadFinished(bool);
+
+    void progressChanged(qreal);
+    void interactivityChanged();
+    void urlChanged(const QUrl&);
+    void titleChanged(const QString&);
+    void iconChanged();
+    void statusChanged();
+    void zoomFactorChanged();
+
+protected:
+    virtual void mousePressEvent(QGraphicsSceneMouseEvent*);
+    virtual void mouseDoubleClickEvent(QGraphicsSceneMouseEvent*);
+    virtual void mouseReleaseEvent(QGraphicsSceneMouseEvent*);
+    virtual void mouseMoveEvent(QGraphicsSceneMouseEvent*);
+    virtual void hoverMoveEvent(QGraphicsSceneHoverEvent*);
+    virtual void hoverLeaveEvent(QGraphicsSceneHoverEvent*);
+#ifndef QT_NO_WHEELEVENT
+    virtual void wheelEvent(QGraphicsSceneWheelEvent*);
+#endif
+    virtual void keyPressEvent(QKeyEvent*);
+    virtual void keyReleaseEvent(QKeyEvent*);
+#ifndef QT_NO_CONTEXTMENU
+    virtual void contextMenuEvent(QGraphicsSceneContextMenuEvent*);
+#endif
+    virtual void dragEnterEvent(QGraphicsSceneDragDropEvent*);
+    virtual void dragLeaveEvent(QGraphicsSceneDragDropEvent*);
+    virtual void dragMoveEvent(QGraphicsSceneDragDropEvent*);
+    virtual void dropEvent(QGraphicsSceneDragDropEvent*);
+    virtual void focusInEvent(QFocusEvent*);
+    virtual void focusOutEvent(QFocusEvent*);
+    virtual void inputMethodEvent(QInputMethodEvent*);
+    virtual bool focusNextPrevChild(bool next);
+
+    virtual bool sceneEvent(QEvent*);
+
+private:
+    Q_PRIVATE_SLOT(d, void _q_doLoadProgress(int progress))
+    Q_PRIVATE_SLOT(d, void _q_doLoadFinished(bool success))
+    Q_PRIVATE_SLOT(d, void _q_setStatusBarMessage(const QString& message))
+
+    QGraphicsWebViewPrivate* const d;
+    friend class QGraphicsWebViewPrivate;
+};
+
+#endif // QGraphicsWebView_h
diff --git a/WebKit/qt/Api/qwebdatabase.cpp b/WebKit/qt/Api/qwebdatabase.cpp
index d51e4e6..4e8fd30 100644
--- a/WebKit/qt/Api/qwebdatabase.cpp
+++ b/WebKit/qt/Api/qwebdatabase.cpp
@@ -33,6 +33,8 @@ using namespace WebCore;
     \since 4.5
     \brief The QWebDatabase class provides access to HTML 5 databases created with JavaScript.
 
+    \inmodule QtWebKit
+
     The upcoming HTML 5 standard includes support for SQL databases that web sites can create and
     access on a local computer through JavaScript. QWebDatabase is the C++ interface to these
     databases.
diff --git a/WebKit/qt/Api/qwebelement.cpp b/WebKit/qt/Api/qwebelement.cpp
index 14b2811..939d881 100644
--- a/WebKit/qt/Api/qwebelement.cpp
+++ b/WebKit/qt/Api/qwebelement.cpp
@@ -23,8 +23,8 @@
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSParser.h"
-#include "CSSRuleList.h"
 #include "CSSRule.h"
+#include "CSSRuleList.h"
 #include "CSSStyleRule.h"
 #include "CString.h"
 #include "Document.h"
@@ -42,6 +42,7 @@
 #include "qwebframe.h"
 #include "qwebframe_p.h"
 #include "runtime_root.h"
+#include <parser/SourceCode.h>
 #include <wtf/Vector.h>
 
 using namespace WebCore;
@@ -53,45 +54,47 @@ public:
 /*!
     \class QWebElement
     \since 4.6
-    \brief The QWebElement class provides convenient access to DOM elements in a QWebFrame.
+    \brief The QWebElement class provides convenient access to DOM elements in
+    a QWebFrame.
+    \inmodule QtWebKit
 
-    QWebElement is the main class to easily access to the document model.
-    The document model is represented by a tree-like structure of DOM elements.
-    The root of the tree is called the document element and can be accessed using QWebFrame::documentElement().
+    A QWebElement object allows easy access to the document model, represented
+    by a tree-like structure of DOM elements. The root of the tree is called
+    the document element and can be accessed using
+    QWebFrame::documentElement().
 
-    You can reach specific elements using findAll() and findFirst(); the elements
-    are identified through CSS selectors.
+    Specific elements can be accessed using findAll() and findFirst(). These
+    elements are identified using CSS selectors. The code snippet below
+    demonstrates the use of findAll().
 
     \snippet webkitsnippets/webelement/main.cpp FindAll
 
-    The first list contains all \c span elements in the document. The second list contains
-    \c span elements that are children of \c p, classified with \c intro.
+    The first list contains all \c span elements in the document. The second
+    list contains \c span elements that are children of \c p, classified with
+    \c intro.
 
-    Using findFirst() is more efficient than calling findAll() and extracting the first element
-    only in the returned list.
+    Using findFirst() is more efficient than calling findAll(), and extracting
+    the first element only in the list returned.
 
-    Alternatively you can manually traverse the document using firstChild() and nextSibling():
+    Alternatively you can traverse the document manually using firstChild() and
+    nextSibling():
 
     \snippet webkitsnippets/webelement/main.cpp Traversing with QWebElement
 
-    The underlying content of QWebElement is explicitly shared. Creating a copy of a QWebElement
-    does not create a copy of the content. Instead, both instances point to the same element.
-
-    The element's attributes can be read using attribute() and modified with setAttribute().
-
-    The contents of child elements can be converted to plain text with toPlainText() and to
-    XHTML using toInnerXml(). To also include the element's tag in the output, use toOuterXml().
+    The underlying content of QWebElement is explicitly shared. Creating a copy
+    of a QWebElement does not create a copy of the content. Instead, both
+    instances point to the same element.
 
-    It is possible to replace the contents using setPlainText() and setInnerXml(). To replace
-    the element itself and its contents, use setOuterXml().
+    The element's attributes can be read using attribute() and modified with
+    setAttribute().
 
-    In the JavaScript DOM interfaces, elements can have additional functions depending on their
-    type. For example an HTML form element can be triggered to submit the entire form to the
-    web server using the submit() function. A list of these special functions can be obtained
-    in QWebElement using functions(); they can be invoked using callFunction().
+    The contents of child elements can be converted to plain text with
+    toPlainText(); to XHTML using toInnerXml(). To include the element's tag in
+    the output, use toOuterXml().
 
-    Similarly element specific properties can be obtained using scriptableProperties() and
-    read/written using scriptableProperty()/setScriptableProperty().
+    It is possible to replace the contents of child elements using
+    setPlainText() and setInnerXml(). To replace the element itself and its
+    contents, use setOuterXml().
 */
 
 /*!
@@ -156,7 +159,7 @@ QWebElement &QWebElement::operator=(const QWebElement &other)
 }
 
 /*!
-    Destroys the element. The underlying DOM element is not destroyed.
+    Destroys the element. However, the underlying DOM element is not destroyed.
 */
 QWebElement::~QWebElement()
 {
@@ -176,7 +179,7 @@ bool QWebElement::operator!=(const QWebElement& o) const
 }
 
 /*!
-    Returns true if the element is a null element; false otherwise.
+    Returns true if the element is a null element; otherwise returns false.
 */
 bool QWebElement::isNull() const
 {
@@ -184,13 +187,16 @@ bool QWebElement::isNull() const
 }
 
 /*!
-    Returns a new list of child elements matching the given CSS selector \a selectorQuery.
-    If there are no matching elements, an empty list is returned.
+    Returns a new list of child elements matching the given CSS selector
+    \a selectorQuery. If there are no matching elements, an empty list is
+    returned.
 
-    \l{http://www.w3.org/TR/REC-CSS2/selector.html#q1}{Standard CSS2 selector} syntax is
-    used for the query.
+    \l{http://www.w3.org/TR/REC-CSS2/selector.html#q1}{Standard CSS2 selector}
+    syntax is used for the query.
 
     \note This search is performed recursively.
+
+    \sa findFirst()
 */
 QList<QWebElement> QWebElement::findAll(const QString &selectorQuery) const
 {
@@ -203,7 +209,7 @@ QList<QWebElement> QWebElement::findAll(const QString &selectorQuery) const
     if (!nodes)
         return elements;
 
-    for (int i = 0; i < nodes->length(); ++i) {
+    for (unsigned i = 0; i < nodes->length(); ++i) {
         WebCore::Node* n = nodes->item(i);
         elements.append(QWebElement(static_cast<Element*>(n)));
     }
@@ -212,12 +218,15 @@ QList<QWebElement> QWebElement::findAll(const QString &selectorQuery) const
 }
 
 /*!
-    Returns the first child element that matches the given CSS selector \a selectorQuery.
+    Returns the first child element that matches the given CSS selector
+    \a selectorQuery.
 
-    \l{http://www.w3.org/TR/REC-CSS2/selector.html#q1}{Standard CSS2 selector} syntax is
-    used for the query.
+    \l{http://www.w3.org/TR/REC-CSS2/selector.html#q1}{Standard CSS2 selector}
+    syntax is used for the query.
 
     \note This search is performed recursively.
+
+    \sa findAll()
 */
 QWebElement QWebElement::findFirst(const QString &selectorQuery) const
 {
@@ -231,6 +240,8 @@ QWebElement QWebElement::findFirst(const QString &selectorQuery) const
     Replaces the existing content of this element with \a text.
 
     This is equivalent to setting the HTML innerText property.
+
+    \sa toPlainText()
 */
 void QWebElement::setPlainText(const QString &text)
 {
@@ -245,6 +256,8 @@ void QWebElement::setPlainText(const QString &text)
     element.
 
     This is equivalent to reading the HTML innerText property.
+
+    \sa setPlainText()
 */
 QString QWebElement::toPlainText() const
 {
@@ -254,11 +267,13 @@ QString QWebElement::toPlainText() const
 }
 
 /*!
-    Replaces the contents of this element as well as its own tag with \a markup.
-    The string may contain HTML or XML tags, which is parsed and formatted
-    before insertion into the document.
+    Replaces the contents of this element as well as its own tag with
+    \a markup. The string may contain HTML or XML tags, which is parsed and
+    formatted before insertion into the document.
 
     \note This is currently only implemented for (X)HTML elements.
+
+    \sa toOuterXml(), toInnerXml(), setInnerXml()
 */
 void QWebElement::setOuterXml(const QString &markup)
 {
@@ -272,9 +287,11 @@ void QWebElement::setOuterXml(const QString &markup)
 
 /*!
     Returns this element converted to XML, including the start and the end
-    tag of this element and its attributes.
+    tags as well as its attributes.
 
-    \note This is currently only implemented for (X)HTML elements.
+    \note This is currently implemented for (X)HTML elements only.
+
+    \sa setOuterXml(), setInnerXml(), toInnerXml()
 */
 QString QWebElement::toOuterXml() const
 {
@@ -285,11 +302,13 @@ QString QWebElement::toOuterXml() const
 }
 
 /*!
-    Replaces the content of this element with \a markup.
-    The string may contain HTML or XML tags, which is parsed and formatted
-    before insertion into the document.
+    Replaces the contents of this element with \a markup. The string may
+    contain HTML or XML tags, which is parsed and formatted before insertion
+    into the document.
 
-    \note This is currently only implemented for (X)HTML elements.
+    \note This is currently implemented for (X)HTML elements only.
+
+    \sa toInnerXml(), toOuterXml(), setOuterXml()
 */
 void QWebElement::setInnerXml(const QString &markup)
 {
@@ -302,10 +321,11 @@ void QWebElement::setInnerXml(const QString &markup)
 }
 
 /*!
-    Returns the XML between the start and the end tag of this
-    element.
+    Returns the XML content between the element's start and end tags.
 
-    \note This is currently only implemented for (X)HTML elements.
+    \note This is currently implemented for (X)HTML elements only.
+
+    \sa setInnerXml(), setOuterXml(), toOuterXml()
 */
 QString QWebElement::toInnerXml() const
 {
@@ -316,8 +336,10 @@ QString QWebElement::toInnerXml() const
 }
 
 /*!
-    Adds an attribute called \a name with the value \a value. If an attribute
-    with the same name exists, its value is replaced by \a value.
+    Adds an attribute with the given \a name and \a value. If an attribute with
+    the same name exists, its value is replaced by \a value.
+
+    \sa attribute(), attributeNS(), setAttributeNS()
 */
 void QWebElement::setAttribute(const QString &name, const QString &value)
 {
@@ -328,9 +350,11 @@ void QWebElement::setAttribute(const QString &name, const QString &value)
 }
 
 /*!
-    Adds an attribute called \a name in the namespace described with \a namespaceUri
-    with the value \a value. If an attribute with the same name exists, its value is
-    replaced by \a value.
+    Adds an attribute with the given \a name in \a namespaceUri with \a value.
+    If an attribute with the same name exists, its value is replaced by
+    \a value.
+
+    \sa attributeNS(), attribute(), setAttribute()
 */
 void QWebElement::setAttributeNS(const QString &namespaceUri, const QString &name, const QString &value)
 {
@@ -341,8 +365,10 @@ void QWebElement::setAttributeNS(const QString &namespaceUri, const QString &nam
 }
 
 /*!
-    Returns the attributed called \a name. If the attribute does not exist \a defaultValue is
-    returned.
+    Returns the attribute with the given \a name. If the attribute does not
+    exist, \a defaultValue is returned.
+
+    \sa setAttribute(), setAttributeNS(), attributeNS()
 */
 QString QWebElement::attribute(const QString &name, const QString &defaultValue) const
 {
@@ -355,8 +381,10 @@ QString QWebElement::attribute(const QString &name, const QString &defaultValue)
 }
 
 /*!
-    Returns the attributed called \a name in the namespace described with \a namespaceUri.
-    If the attribute does not exist \a defaultValue is returned.
+    Returns the attribute with the given \a name in \a namespaceUri. If the
+    attribute does not exist, \a defaultValue is returned.
+
+    \sa setAttributeNS(), setAttribute(), attribute()
 */
 QString QWebElement::attributeNS(const QString &namespaceUri, const QString &name, const QString &defaultValue) const
 {
@@ -369,7 +397,10 @@ QString QWebElement::attributeNS(const QString &namespaceUri, const QString &nam
 }
 
 /*!
-    Returns true if this element has an attribute called \a name; otherwise returns false.
+    Returns true if this element has an attribute with the given \a name;
+    otherwise returns false.
+
+    \sa attribute(), setAttribute()
 */
 bool QWebElement::hasAttribute(const QString &name) const
 {
@@ -379,8 +410,10 @@ bool QWebElement::hasAttribute(const QString &name) const
 }
 
 /*!
-    Returns true if this element has an attribute called \a name in the namespace described
-    with \a namespaceUri; otherwise returns false.
+    Returns true if this element has an attribute with the given \a name, in
+    \a namespaceUri; otherwise returns false.
+
+    \sa attributeNS(), setAttributeNS()
 */
 bool QWebElement::hasAttributeNS(const QString &namespaceUri, const QString &name) const
 {
@@ -390,7 +423,9 @@ bool QWebElement::hasAttributeNS(const QString &namespaceUri, const QString &nam
 }
 
 /*!
-    Removes the attribute called \a name from this element.
+    Removes the attribute with the given \a name from this element.
+
+    \sa attribute(), setAttribute(), hasAttribute()
 */
 void QWebElement::removeAttribute(const QString &name)
 {
@@ -401,8 +436,10 @@ void QWebElement::removeAttribute(const QString &name)
 }
 
 /*!
-    Removes the attribute called \a name in the namespace described with \a namespaceUri
-    from this element.
+    Removes the attribute with the given \a name, in \a namespaceUri, from this
+    element.
+
+    \sa attributeNS(), setAttributeNS(), hasAttributeNS()
 */
 void QWebElement::removeAttributeNS(const QString &namespaceUri, const QString &name)
 {
@@ -413,7 +450,10 @@ void QWebElement::removeAttributeNS(const QString &namespaceUri, const QString &
 }
 
 /*!
-    Returns true if the element has any attributes defined; otherwise returns false;
+    Returns true if the element has any attributes defined; otherwise returns
+    false;
+
+    \sa attribute(), setAttribute()
 */
 bool QWebElement::hasAttributes() const
 {
@@ -423,7 +463,36 @@ bool QWebElement::hasAttributes() const
 }
 
 /*!
+    Returns true if the element has keyboard input focus; otherwise, returns false
+
+    \sa setFocus()
+*/
+bool QWebElement::hasFocus() const
+{
+    if (!m_element)
+        return false;
+    if (m_element->document())
+        return m_element == m_element->document()->focusedNode();
+    return false;
+}
+
+/*!
+    Gives keyboard input focus to this element
+
+    \sa hasFocus()
+*/
+void QWebElement::setFocus()
+{
+    if (!m_element)
+        return;
+    if (m_element->document() && m_element->isFocusable())
+        m_element->document()->setFocusedNode(m_element);
+}
+
+/*!
     Returns the geometry of this element, relative to its containing frame.
+
+    \sa tagName()
 */
 QRect QWebElement::geometry() const
 {
@@ -434,6 +503,8 @@ QRect QWebElement::geometry() const
 
 /*!
     Returns the tag name of this element.
+
+    \sa geometry()
 */
 QString QWebElement::tagName() const
 {
@@ -443,7 +514,8 @@ QString QWebElement::tagName() const
 }
 
 /*!
-    Returns the namespace prefix of the element or an empty string if the element has no namespace prefix.
+    Returns the namespace prefix of the element. If the element has no\
+    namespace prefix, empty string is returned.
 */
 QString QWebElement::prefix() const
 {
@@ -453,8 +525,8 @@ QString QWebElement::prefix() const
 }
 
 /*!
-    If the element uses namespaces, this function returns the local name of the element;
-    otherwise it returns an empty string.
+    Returns the local name of the element. If the element does not use
+    namespaces, an empty string is returned.
 */
 QString QWebElement::localName() const
 {
@@ -464,7 +536,8 @@ QString QWebElement::localName() const
 }
 
 /*!
-    Returns the namespace URI of this element or an empty string if the element has no namespace URI.
+    Returns the namespace URI of this element. If the element has no namespace
+    URI, an empty string is returned.
 */
 QString QWebElement::namespaceUri() const
 {
@@ -474,8 +547,8 @@ QString QWebElement::namespaceUri() const
 }
 
 /*!
-    Returns the parent element of this element or a null element if this element
-    is the root document element.
+    Returns the parent element of this elemen. If this element is the root
+    document element, a null element is returned.
 */
 QWebElement QWebElement::parent() const
 {
@@ -485,9 +558,9 @@ QWebElement QWebElement::parent() const
 }
 
 /*!
-    Returns the first child element of this element.
+    Returns the element's first child.
 
-    \sa lastChild() previousSibling() nextSibling()
+    \sa lastChild(), previousSibling(), nextSibling()
 */
 QWebElement QWebElement::firstChild() const
 {
@@ -503,9 +576,9 @@ QWebElement QWebElement::firstChild() const
 }
 
 /*!
-    Returns the last child element of this element.
+    Returns the element's last child.
 
-    \sa firstChild() previousSibling() nextSibling()
+    \sa firstChild(), previousSibling(), nextSibling()
 */
 QWebElement QWebElement::lastChild() const
 {
@@ -521,9 +594,9 @@ QWebElement QWebElement::lastChild() const
 }
 
 /*!
-    Returns the next sibling element of this element.
+    Returns the element's next sibling.
 
-    \sa firstChild() previousSibling() lastChild()
+    \sa firstChild(), previousSibling(), lastChild()
 */
 QWebElement QWebElement::nextSibling() const
 {
@@ -539,9 +612,9 @@ QWebElement QWebElement::nextSibling() const
 }
 
 /*!
-    Returns the previous sibling element of this element.
+    Returns the element's previous sibling.
 
-    \sa firstChild() nextSibling() lastChild()
+    \sa firstChild(), nextSibling(), lastChild()
 */
 QWebElement QWebElement::previousSibling() const
 {
@@ -557,7 +630,7 @@ QWebElement QWebElement::previousSibling() const
 }
 
 /*!
-    Returns the document this element belongs to.
+    Returns the document which this element belongs to.
 */
 QWebElement QWebElement::document() const
 {
@@ -570,8 +643,8 @@ QWebElement QWebElement::document() const
 }
 
 /*!
-    Returns the web frame this elements is a part of. If the element is
-    a null element null is returned.
+    Returns the web frame which this element is a part of. If the element is a
+    null element, null is returned.
 */
 QWebFrame *QWebElement::webFrame() const
 {
@@ -617,41 +690,10 @@ static bool setupScriptContext(WebCore::Element* element, JSC::JSValue& thisValu
 }
 
 
-static bool setupScriptObject(WebCore::Element* element, ScriptObject& object, ScriptState*& state, ScriptController*& scriptController)
-{
-    if (!element)
-        return false;
-
-    Document* document = element->document();
-    if (!document)
-        return false;
-
-    Frame* frame = document->frame();
-    if (!frame)
-        return false;
-
-    scriptController = frame->script();
-
-    state = scriptController->globalObject()->globalExec();
-
-    JSC::JSValue thisValue = toJS(state, element);
-    if (!thisValue)
-        return false;
-
-    JSC::JSObject* thisObject = thisValue.toObject(state);
-    if (!thisObject)
-        return false;
-
-    object = ScriptObject(state, thisObject);
-    return true;
-}
-
 /*!
-    Executes the \a scriptSource with this element as the `this' object.
-
-    \sa callFunction()
+    Executes \a scriptSource with this element as \c this object.
 */
-QVariant QWebElement::evaluateScript(const QString& scriptSource)
+QVariant QWebElement::evaluateJavaScript(const QString& scriptSource)
 {
     if (scriptSource.isEmpty())
         return QVariant();
@@ -678,263 +720,40 @@ QVariant QWebElement::evaluateScript(const QString& scriptSource)
 }
 
 /*!
-    Calls the function with the given \a name and \a arguments.
-
-    The underlying DOM element that QWebElement wraps may have dedicated functions depending
-    on its type. For example a form element can have the "submit" function, that would submit
-    the form to the destination specified in the HTML.
-
-    \sa functions()
-*/
-QVariant QWebElement::callFunction(const QString &name, const QVariantList &arguments)
-{
-    ScriptState* state = 0;
-    ScriptObject thisObject;
-    ScriptController* scriptController = 0;
-
-    if (!setupScriptObject(m_element, thisObject, state, scriptController))
-        return QVariant();
-
-    ScriptFunctionCall functionCall(state, thisObject, name);
-
-    for (QVariantList::ConstIterator it = arguments.constBegin(), end = arguments.constEnd();
-         it != end; ++it)
-        functionCall.appendArgument(JSC::Bindings::convertQVariantToValue(state, scriptController->bindingRootObject(), *it));
-
-    bool hadException = false;
-    ScriptValue result = functionCall.call(hadException);
-    if (hadException)
-        return QVariant();
-
-    int distance = 0;
-    return JSC::Bindings::convertValueToQVariant(state, result.jsValue(), QMetaType::Void, &distance);
-}
-
-/*!
-    Returns a list of function names this element supports.
-
-    The function names returned are the same functions that are callable from the DOM
-    element's JavaScript binding.
-
-    \sa callFunction()
-*/
-QStringList QWebElement::functions() const
-{
-    ScriptState* state = 0;
-    ScriptObject thisObject;
-    ScriptController* scriptController = 0;
-
-    if (!setupScriptObject(m_element, thisObject, state, scriptController))
-        return QStringList();
-
-    JSC::JSObject* object = thisObject.jsObject();
-    if (!object)
-        return QStringList();
-
-    QStringList names;
-
-    // Enumerate the contents of the object
-    JSC::PropertyNameArray properties(state);
-    object->getPropertyNames(state, properties);
-    for (JSC::PropertyNameArray::const_iterator it = properties.begin();
-         it != properties.end(); ++it) {
-
-        JSC::JSValue property = object->get(state, *it);
-        if (!property)
-            continue;
-
-        JSC::JSObject* function = property.toObject(state);
-        if (!function)
-            continue;
-
-        JSC::CallData callData;
-        JSC::CallType callType = function->getCallData(callData);
-        if (callType == JSC::CallTypeNone)
-            continue;
-
-        JSC::UString ustring = (*it).ustring();
-        names << QString::fromUtf16((const ushort*)ustring.rep()->data(), ustring.size());
-    }
-
-    if (state->hadException())
-        state->clearException();
-
-    return names;
-}
-
-/*!
-    Returns the value of the element's \a name property.
-
-    If no such property exists, the returned variant is invalid.
-
-    The return property has the same value as the corresponding property
-    in the element's JavaScript binding with the same name.
-
-    Information about all available properties is provided through scriptProperties().
-
-    \sa setScriptableProperty(), scriptableProperties()
-*/
-QVariant QWebElement::scriptableProperty(const QString &name) const
-{
-    ScriptState* state = 0;
-    ScriptObject thisObject;
-    ScriptController *scriptController = 0;
-
-    if (!setupScriptObject(m_element, thisObject, state, scriptController))
-        return QVariant();
-
-    String wcName(name);
-    JSC::JSValue property = thisObject.jsObject()->get(state, JSC::Identifier(state, wcName));
-
-    // ###
-    if (state->hadException())
-        state->clearException();
-
-    int distance = 0;
-    return JSC::Bindings::convertValueToQVariant(state, property, QMetaType::Void, &distance);
-}
-
-/*!
-    Sets the value of the element's \a name property to \a value.
-
-    Information about all available properties is provided through scriptProperties().
-
-    Setting the property will affect the corresponding property
-    in the element's JavaScript binding with the same name.
-
-    \sa scriptableProperty(), scriptableProperties()
-*/
-void QWebElement::setScriptableProperty(const QString &name, const QVariant &value)
-{
-    ScriptState* state = 0;
-    ScriptObject thisObject;
-    ScriptController* scriptController = 0;
-
-    if (!setupScriptObject(m_element, thisObject, state, scriptController))
-        return;
-
-    JSC::JSValue jsValue = JSC::Bindings::convertQVariantToValue(state, scriptController->bindingRootObject(), value);
-    if (!jsValue)
-        return;
-
-    String wcName(name);
-    JSC::PutPropertySlot slot;
-    thisObject.jsObject()->put(state, JSC::Identifier(state, wcName), jsValue, slot);
-    if (state->hadException())
-        state->clearException();
-}
-
-/*!
-    Returns a list of property names this element supports.
-
-    The function names returned are the same properties that are accessible from the DOM
-    element's JavaScript binding.
-
-    \sa setScriptableProperty(), scriptableProperty()
-*/
-QStringList QWebElement::scriptableProperties() const
-{
-    if (!m_element)
-        return QStringList();
-
-    Document* document = m_element->document();
-    if (!document)
-        return QStringList();
-
-    Frame* frame = document->frame();
-    if (!frame)
-        return QStringList();
-
-    ScriptController* script = frame->script();
-    JSC::ExecState* exec = script->globalObject()->globalExec();
-
-    JSC::JSValue thisValue = toJS(exec, m_element);
-    if (!thisValue)
-        return QStringList();
-
-    JSC::JSObject* object = thisValue.toObject(exec);
-    if (!object)
-        return QStringList();
-
-    QStringList names;
-
-    // Enumerate the contents of the object
-    JSC::PropertyNameArray properties(exec);
-    object->getPropertyNames(exec, properties);
-    for (JSC::PropertyNameArray::const_iterator it = properties.begin();
-         it != properties.end(); ++it) {
-
-        JSC::JSValue property = object->get(exec, *it);
-        if (!property)
-            continue;
-
-        JSC::JSObject* function = property.toObject(exec);
-        if (!function)
-            continue;
-
-        JSC::CallData callData;
-        JSC::CallType callType = function->getCallData(callData);
-        if (callType != JSC::CallTypeNone)
-            continue;
-
-        JSC::UString ustring = (*it).ustring();
-        names << QString::fromUtf16((const ushort*)ustring.rep()->data(), ustring.size());
-    }
-
-    if (exec->hadException())
-        exec->clearException();
-
-    return names;
-}
-
-/*!
-    \enum QWebElement::ResolveRule
-    \since 4.6
+    \enum QWebElement::StyleResolveStrategy
 
     This enum describes how QWebElement's styleProperty resolves the given
     property name.
 
-    \value IgnoreCascadingStyles Return the property value as it is defined
-    in the element, without respecting style inheritance and other CSS rules.
-    \value RespectCascadingStyles The property's value is determined using
-    the inheritance and importance rules defined in the document's stylesheet.
-*/
-
-/*!
-    \enum QWebElement::StylePriority
-    \since 4.6
-
-    This enum describes the priority newly set CSS properties should have when
-    set using QWebElement::setStyleProperty().
-
-    \value NormalStylePriority Define the property without important
-    priority even if "!important" is explicitly set in \a value.
-    \value DeclaredStylePriority Define the property respecting the
-    priority specified in \a value.
-    \value ImportantStylePriority Define the property to have
-    an important priority, this is equal to appending "!important" to the value.
+    \value InlineStyle Return the property value as it is defined in
+           the element, without respecting style inheritance and other CSS
+           rules.
+    \value CascadedStyle The property's value is determined using the
+           inheritance and importance rules defined in the document's
+           stylesheet.
+    \value ComputedStyle The property's value is the absolute value
+           of the style property resolved from the environment.
 */
 
 /*!
-    Returns the value of the style named \a name or an empty string if such one
-    does not exist.
-
-    If \a rule is IgnoreCascadingStyles, the value defined inside the element
-    (inline in CSS terminology) is returned.
+    Returns the value of the style with the given \a name using the specified
+    \a strategy. If a style with \a name does not exist, an empty string is
+    returned.
 
-    if \a rule is RespectCascadingStyles, the actual style applied to the
-    element is returned.
+    In CSS, the cascading part depends on which CSS rule has priority and is
+    thus applied. Generally, the last defined rule has priority. Thus, an
+    inline style rule has priority over an embedded block style rule, which
+    in return has priority over an external style rule.
 
-    In CSS, the cascading part has to do with which CSS rule has priority and
-    is thus applied. Generally speaking, the last defined rule has priority,
-    thus an inline style rule has priority over an embedded block style rule,
-    which in return has priority over an external style rule.
+    If the "!important" declaration is set on one of those, the declaration
+    receives highest priority, unless other declarations also use the
+    "!important" declaration. Then, the last "!important" declaration takes
+    predecence.
 
-    If the !important declaration is set on one of those, the declaration gets
-    highest priority, unless other declarations also use the !important
-    declaration, in which the last !important declaration takes predecence.
+    \sa setStyleProperty()
 */
-QString QWebElement::styleProperty(const QString &name, ResolveRule rule) const
+
+QString QWebElement::styleProperty(const QString &name, StyleResolveStrategy strategy) const
 {
     if (!m_element || !m_element->isStyledElement())
         return QString();
@@ -946,10 +765,10 @@ QString QWebElement::styleProperty(const QString &name, ResolveRule rule) const
 
     CSSStyleDeclaration* style = static_cast<StyledElement*>(m_element)->style();
 
-    if (rule == IgnoreCascadingStyles)
+    if (strategy == InlineStyle)
         return style->getPropertyValue(propID);
 
-    if (rule == RespectCascadingStyles) {
+    if (strategy == CascadedStyle) {
         if (style->getPropertyPriority(propID))
             return style->getPropertyValue(propID);
 
@@ -977,32 +796,33 @@ QString QWebElement::styleProperty(const QString &name, ResolveRule rule) const
         return style->getPropertyValue(propID);
     }
 
+    if (strategy == ComputedStyle) {
+        if (!m_element || !m_element->isStyledElement())
+            return QString();
+
+        int propID = cssPropertyID(name);
+
+        RefPtr<CSSComputedStyleDeclaration> style = computedStyle(m_element);
+        if (!propID || !style)
+            return QString();
+
+        return style->getPropertyValue(propID);
+    }
+
     return QString();
 }
 
 /*!
-    Sets the value of the style named \a name to \a value.
+    Sets the value of the inline style with the given \a name to \a value.
 
-    Setting a value, doesn't necessarily mean that it will become the applied
+    Setting a value, does not necessarily mean that it will become the applied
     value, due to the fact that the style property's value might have been set
-    earlier with priority in external or embedded style declarations.
+    earlier with a higher priority in external or embedded style declarations.
 
-    In order to ensure that the value will be applied, ImportantStylePriority
-    should be used as \a priority.
-
-    Following the CSS syntax for property values, this is equal to appending
+    In order to ensure that the value will be applied, you may have to append
     "!important" to the value.
-
-    This syntax is supported when using DeclaredStylePriority as \a priority.
-
-    Using NormalStylePriority as \a priority, the property will have normal
-    priority, and any "!important" declaration will be ignored. On the other
-    hand, using ImportantStylePriority sets the important priority even when
-    not explicit passed in \a value.
-    By using DeclaredStylePriority as \a priority the property will respect the
-    priority specified in \a value.
 */
-void QWebElement::setStyleProperty(const QString &name, const QString &value, StylePriority priority)
+void QWebElement::setStyleProperty(const QString &name, const QString &value)
 {
     if (!m_element || !m_element->isStyledElement())
         return;
@@ -1013,42 +833,7 @@ void QWebElement::setStyleProperty(const QString &name, const QString &value, St
         return;
 
     ExceptionCode exception = 0;
-
-    const QRegExp hasImportantTest(QLatin1String("!\\s*important"));
-    int index = value.indexOf(hasImportantTest);
-
-    QString newValue = (index != -1) ? value.left(index - 1) : value;
-
-    switch (priority) {
-    case NormalStylePriority:
-        style->setProperty(name, newValue, "", exception);
-        break;
-    case DeclaredStylePriority:
-        style->setProperty(name, newValue, (index != -1) ? "important" : "", exception);
-        break;
-    case ImportantStylePriority:
-        style->setProperty(name, newValue, "important", exception);
-        break;
-    default:
-        break;
-    }
-}
-
-/*!
-    Returns the computed value for style named \a name or an empty string if the style has no such name.
-*/
-QString QWebElement::computedStyleProperty(const QString &name) const
-{
-    if (!m_element || !m_element->isStyledElement())
-        return QString();
-
-    int propID = cssPropertyID(name);
-
-    RefPtr<CSSComputedStyleDeclaration> style = computedStyle(m_element);
-    if (!propID || !style)
-        return QString();
-
-    return style->getPropertyValue(propID);
+    style->setProperty(name, value, exception);
 }
 
 /*!
@@ -1083,7 +868,8 @@ QStringList QWebElement::classes() const
 }
 
 /*!
-    Returns true if this element has a class called \a name; otherwise returns false.
+    Returns true if this element has a class with the given \a name; otherwise
+    returns false.
 */
 bool QWebElement::hasClass(const QString &name) const
 {
@@ -1092,7 +878,7 @@ bool QWebElement::hasClass(const QString &name) const
 }
 
 /*!
-    Adds the specified class \a name to the element.
+    Adds the specified class with the given \a name to the element.
 */
 void QWebElement::addClass(const QString &name)
 {
@@ -1105,7 +891,7 @@ void QWebElement::addClass(const QString &name)
 }
 
 /*!
-    Removes the specified class \a name from the element.
+    Removes the specified class with the given \a name from the element.
 */
 void QWebElement::removeClass(const QString &name)
 {
@@ -1118,8 +904,8 @@ void QWebElement::removeClass(const QString &name)
 }
 
 /*!
-    Adds the specified class \a name if it is not present,
-    removes it if it is already present.
+    Adds the specified class with the given \a name if it is not present. If
+    the class is already present, it will be removed.
 */
 void QWebElement::toggleClass(const QString &name)
 {
@@ -1134,11 +920,11 @@ void QWebElement::toggleClass(const QString &name)
 }
 
 /*!
-    Appends \a element as the element's last child.
+    Appends the given \a element as the element's last child.
 
-    If \a element is the child of another element, it is re-parented
-    to this element. If \a element is a child of this element, then
-    its position in the list of children is changed.
+    If \a element is the child of another element, it is re-parented to this
+    element. If \a element is a child of this element, then its position in
+    the list of children is changed.
 
     Calling this function on a null element does nothing.
 
@@ -1178,9 +964,9 @@ void QWebElement::appendInside(const QString &markup)
 /*!
     Prepends \a element as the element's first child.
 
-    If \a element is the child of another element, it is re-parented
-    to this element. If \a element is a child of this element, then
-    its position in the list of children is changed.
+    If \a element is the child of another element, it is re-parented to this
+    element. If \a element is a child of this element, then its position in
+    the list of children is changed.
 
     Calling this function on a null element does nothing.
 
@@ -1227,10 +1013,10 @@ void QWebElement::prependInside(const QString &markup)
 
 
 /*!
-    Inserts \a element before this element.
+    Inserts the given \a element before this element.
 
-    If \a element is the child of another element, it is re-parented
-    to the parent of this element.
+    If \a element is the child of another element, it is re-parented to the
+    parent of this element.
 
     Calling this function on a null element does nothing.
 
@@ -1274,10 +1060,10 @@ void QWebElement::prependOutside(const QString &markup)
 }
 
 /*!
-    Inserts \a element after this element.
+    Inserts the given \a element after this element.
 
-    If \a element is the child of another element, it is re-parented
-    to the parent of this element.
+    If \a element is the child of another element, it is re-parented to the
+    parent of this element.
 
     Calling this function on a null element does nothing.
 
@@ -1342,11 +1128,10 @@ QWebElement QWebElement::clone() const
 }
 
 /*!
-    Removes this element from the document and returns a reference
-    to this.
+    Removes this element from the document and returns a reference to it.
 
-    The element is still valid after removal, and can be inserted into
-    other parts of the document.
+    The element is still valid after removal, and can be inserted into other
+    parts of the document.
 
     \sa removeChildren(), removeFromDocument()
 */
@@ -1362,8 +1147,7 @@ QWebElement &QWebElement::takeFromDocument()
 }
 
 /*!
-    Removes this element from the document and makes this
-    a null element.
+    Removes this element from the document and makes it a null element.
 
     \sa removeChildren(), takeFromDocument()
 */
@@ -1414,9 +1198,10 @@ static RefPtr<Node> findInsertionPoint(PassRefPtr<Node> root)
 }
 
 /*!
-    Enclose the contents of this element in \a element as the child
-    of the deepest descendant element within the structure of the
-    first element provided.
+    Encloses the contents of this element with \a element. This element becomes
+    the child of the deepest descendant within \a element.
+
+    ### illustration
 
     \sa encloseWith()
 */
@@ -1446,9 +1231,8 @@ void QWebElement::encloseContentsWith(const QWebElement &element)
 }
 
 /*!
-    Enclose the contents of this element in the result of parsing
-    \a markup as the child of the deepest descendant element within
-    the structure of the first element provided.
+    Encloses the contents of this element with the result of parsing \a markup.
+    This element becomes the child of the deepest descendant within \a markup.
 
     \sa encloseWith()
 */
@@ -1490,9 +1274,8 @@ void QWebElement::encloseContentsWith(const QString &markup)
 }
 
 /*!
-    Enclose this element in \a element as the child of the deepest
-    descendant element within the structure of the first element
-    provided.
+    Encloses this element with \a element. This element becomes the child of
+    the deepest descendant within \a element.
 
     \sa replace()
 */
@@ -1523,8 +1306,8 @@ void QWebElement::encloseWith(const QWebElement &element)
 }
 
 /*!
-    Enclose this element in the result of parsing \a markup,
-    as the last child.
+    Encloses this element with the result of parsing \a markup. This element
+    becomes the child of the deepest descendant within \a markup.
 
     \sa replace()
 */
@@ -1569,8 +1352,7 @@ void QWebElement::encloseWith(const QString &markup)
 /*!
     Replaces this element with \a element.
 
-    It is not possible to replace the <html>, <head>, or <body>
-    elements using this method.
+    This method will not replace the <html>, <head> or <body> elements.
 
     \sa encloseWith()
 */
@@ -1586,8 +1368,7 @@ void QWebElement::replace(const QWebElement &element)
 /*!
     Replaces this element with the result of parsing \a markup.
 
-    It is not possible to replace the <html>, <head>, or <body>
-    elements using this method.
+    This method will not replace the <html>, <head> or <body> elements.
 
     \sa encloseWith()
 */
@@ -1601,13 +1382,32 @@ void QWebElement::replace(const QString &markup)
 }
 
 /*!
+    \internal
+    Walk \a node's parents until a valid QWebElement is found.
+    For example, a WebCore::Text node is not a valid Html QWebElement, but its
+    enclosing p tag is.
+*/
+QWebElement QWebElement::enclosingElement(WebCore::Node* node)
+{
+    QWebElement element(node);
+
+    while (element.isNull() && node) {
+        node = node->parentNode();
+        element = QWebElement(node);
+    }
+    return element;
+}
+
+/*!
     \fn inline bool QWebElement::operator==(const QWebElement& o) const;
 
-    Returns true if this element points to the same underlying DOM object than \a o; otherwise returns false.
+    Returns true if this element points to the same underlying DOM object as
+    \a o; otherwise returns false.
 */
 
 /*!
     \fn inline bool QWebElement::operator!=(const QWebElement& o) const;
 
-    Returns true if this element points to a different underlying DOM object than \a o; otherwise returns false.
+    Returns true if this element points to a different underlying DOM object
+    than \a o; otherwise returns false.
 */
diff --git a/WebKit/qt/Api/qwebelement.h b/WebKit/qt/Api/qwebelement.h
index bc6f8a9..3db4637 100644
--- a/WebKit/qt/Api/qwebelement.h
+++ b/WebKit/qt/Api/qwebelement.h
@@ -74,6 +74,9 @@ public:
     void removeClass(const QString& name);
     void toggleClass(const QString& name);
 
+    bool hasFocus() const;
+    void setFocus();
+
     QRect geometry() const;
 
     QString tagName() const;
@@ -120,30 +123,26 @@ public:
     void removeFromDocument();
     void removeChildren();
 
-    QVariant evaluateScript(const QString& scriptSource);
-
-    QVariant callFunction(const QString& functionName, const QVariantList& arguments = QVariantList());
-    QStringList functions() const;
-
-    QVariant scriptableProperty(const QString& name) const;
-    void setScriptableProperty(const QString& name, const QVariant& value);
-    QStringList scriptableProperties() const;
+    QVariant evaluateJavaScript(const QString& scriptSource);
 
-    enum ResolveRule { IgnoreCascadingStyles, RespectCascadingStyles };
-    QString styleProperty(const QString& name, ResolveRule = IgnoreCascadingStyles) const;
-
-    enum StylePriority { NormalStylePriority, DeclaredStylePriority, ImportantStylePriority };
-    void setStyleProperty(const QString& name, const QString& value, StylePriority = DeclaredStylePriority);
-
-    QString computedStyleProperty(const QString& name) const;
+    enum StyleResolveStrategy {
+         InlineStyle,
+         CascadedStyle,
+         ComputedStyle,
+    };
+    QString styleProperty(const QString& name, StyleResolveStrategy strategy) const;
+    void setStyleProperty(const QString& name, const QString& value);
 
 private:
     explicit QWebElement(WebCore::Element*);
     explicit QWebElement(WebCore::Node*);
 
+    static QWebElement enclosingElement(WebCore::Node*);
+
     friend class QWebFrame;
     friend class QWebHitTestResult;
     friend class QWebHitTestResultPrivate;
+    friend class QWebPage;
 
     QWebElementPrivate* d;
     WebCore::Element* m_element;
diff --git a/WebKit/qt/Api/qwebframe.cpp b/WebKit/qt/Api/qwebframe.cpp
index c857df2..1777cc8 100644
--- a/WebKit/qt/Api/qwebframe.cpp
+++ b/WebKit/qt/Api/qwebframe.cpp
@@ -268,6 +268,8 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, const QRegion &clip)
     \since 4.4
     \brief The QWebFrame class represents a frame in a web page.
 
+    \inmodule QtWebKit
+
     QWebFrame represents a frame inside a web page. Each QWebPage
     object contains at least one frame, the main frame, obtained using
     QWebPage::mainFrame(). Additional frames will be created for HTML
@@ -542,7 +544,7 @@ QUrl QWebFrame::requestedUrl() const
     // loader does not get commited by the frame loader) it is
     // safer to rely on outgoingReferrer than originalRequest.
     if (!d->frame->loader()->activeDocumentLoader()
-        || (!d->frameLoaderClient->m_loadSucceeded
+        || (!d->frameLoaderClient->m_loadError.isNull()
         &&  !d->frame->loader()->outgoingReferrer().isEmpty()))
         return QUrl(d->frame->loader()->outgoingReferrer());
 
@@ -708,7 +710,9 @@ void QWebFrame::load(const QNetworkRequest &req,
   script can be specified through the charset attribute of the HTML script tag. It is also possible
   for the encoding to be specified by web server.
 
-  \sa toHtml()
+  \note This method will not affect session or global history for the frame.
+
+  \sa toHtml(), setContent()
 */
 void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
 {
@@ -716,7 +720,7 @@ void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
     WebCore::ResourceRequest request(kurl);
     const QByteArray utf8 = html.toUtf8();
     WTF::RefPtr<WebCore::SharedBuffer> data = WebCore::SharedBuffer::create(utf8.constData(), utf8.length());
-    WebCore::SubstituteData substituteData(data, WebCore::String("text/html"), WebCore::String("utf-8"), kurl);
+    WebCore::SubstituteData substituteData(data, WebCore::String("text/html"), WebCore::String("utf-8"), KURL());
     d->frame->loader()->load(request, substituteData, false);
 }
 
@@ -729,7 +733,9 @@ void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
 
   The \a data is loaded immediately; external objects are loaded asynchronously.
 
-  \sa toHtml()
+  \note This method will not affect session or global history for the frame.
+
+  \sa toHtml(), setHtml()
 */
 void QWebFrame::setContent(const QByteArray &data, const QString &mimeType, const QUrl &baseUrl)
 {
@@ -739,11 +745,10 @@ void QWebFrame::setContent(const QByteArray &data, const QString &mimeType, cons
     QString actualMimeType = mimeType;
     if (actualMimeType.isEmpty())
         actualMimeType = QLatin1String("text/html");
-    WebCore::SubstituteData substituteData(buffer, WebCore::String(actualMimeType), WebCore::String(), kurl);
+    WebCore::SubstituteData substituteData(buffer, WebCore::String(actualMimeType), WebCore::String(), KURL());
     d->frame->loader()->load(request, substituteData, false);
 }
 
-
 /*!
   Returns the parent frame of this frame, or 0 if the frame is the web pages
   main frame.
@@ -801,13 +806,11 @@ void QWebFrame::setScrollBarPolicy(Qt::Orientation orientation, Qt::ScrollBarPol
         d->horizontalScrollBarPolicy = policy;
         if (d->frame->view()) {
             d->frame->view()->setHorizontalScrollbarMode((ScrollbarMode)policy);
-            d->frame->view()->updateDefaultScrollbarState();
         }
     } else {
         d->verticalScrollBarPolicy = policy;
         if (d->frame->view()) {
             d->frame->view()->setVerticalScrollbarMode((ScrollbarMode)policy);
-            d->frame->view()->updateDefaultScrollbarState();
         }
     }
 }
@@ -873,6 +876,7 @@ int QWebFrame::scrollBarMaximum(Qt::Orientation orientation) const
 */
 int QWebFrame::scrollBarMinimum(Qt::Orientation orientation) const
 {
+    Q_UNUSED(orientation)
     return 0;
 }
 
@@ -1024,7 +1028,8 @@ qreal QWebFrame::zoomFactor() const
 */
 bool QWebFrame::hasFocus() const
 {
-    return QWebFramePrivate::kit(d->frame->page()->focusController()->focusedFrame()) == this;
+    WebCore::Frame* ff = d->frame->page()->focusController()->focusedFrame();
+    return ff && QWebFramePrivate::kit(ff) == this;
 }
 
 /*!
@@ -1246,7 +1251,7 @@ QVariant QWebFrame::evaluateJavaScript(const QString& scriptSource)
     ScriptController *proxy = d->frame->script();
     QVariant rc;
     if (proxy) {
-        JSC::JSValue v = proxy->evaluate(ScriptSourceCode(scriptSource)).jsValue();
+        JSC::JSValue v = d->frame->loader()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
         int distance = 0;
         rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject()->globalExec(), v, QMetaType::Void, &distance);
     }
@@ -1364,6 +1369,8 @@ QWebFrame* QWebFramePrivate::kit(WebCore::Frame* coreFrame)
     \brief The QWebHitTestResult class provides information about the web
     page content after a hit test.
 
+    \inmodule QtWebKit
+
     QWebHitTestResult is returned by QWebFrame::hitTestContent() to provide
     information about the content of the web page at the specified position.
 */
diff --git a/WebKit/qt/Api/qwebframe_p.h b/WebKit/qt/Api/qwebframe_p.h
index d6afc01..632f83a 100644
--- a/WebKit/qt/Api/qwebframe_p.h
+++ b/WebKit/qt/Api/qwebframe_p.h
@@ -79,15 +79,14 @@ public:
     WebCore::Scrollbar* horizontalScrollBar() const;
     WebCore::Scrollbar* verticalScrollBar() const;
 
-    Qt::ScrollBarPolicy horizontalScrollBarPolicy;
-    Qt::ScrollBarPolicy verticalScrollBarPolicy;
-
     static WebCore::Frame* core(QWebFrame*);
     static QWebFrame* kit(WebCore::Frame*);
 
     void renderPrivate(QPainter *painter, const QRegion &clip);
 
     QWebFrame *q;
+    Qt::ScrollBarPolicy horizontalScrollBarPolicy;
+    Qt::ScrollBarPolicy verticalScrollBarPolicy;
     WebCore::FrameLoaderClientQt *frameLoaderClient;
     WebCore::Frame *frame;
     QWebPage *page;
diff --git a/WebKit/qt/Api/qwebhistory.cpp b/WebKit/qt/Api/qwebhistory.cpp
index 1c1c72a..5752d66 100644
--- a/WebKit/qt/Api/qwebhistory.cpp
+++ b/WebKit/qt/Api/qwebhistory.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "qwebhistory.h"
 #include "qwebhistory_p.h"
+#include "qwebframe_p.h"
 
 #include "PlatformString.h"
 #include "Image.h"
@@ -35,6 +36,8 @@
   \since 4.4
   \brief The QWebHistoryItem class represents one item in the history of a QWebPage
 
+  \inmodule QtWebKit
+
   Each QWebHistoryItem instance represents an entry in the history stack of a Web page,
   containing information about the page, its location, and when it was last visited.
 
@@ -201,6 +204,8 @@ bool QWebHistoryItem::isValid() const
   \since 4.4
   \brief The QWebHistory class represents the history of a QWebPage
 
+  \inmodule QtWebKit
+
   Each QWebPage instance contains a history of visited pages that can be accessed
   by QWebPage::history(). QWebHistory represents this history and makes it possible
   to navigate it.
@@ -244,17 +249,27 @@ QWebHistory::~QWebHistory()
 */
 void QWebHistory::clear()
 {
-    RefPtr<WebCore::HistoryItem> current = d->lst->currentItem();
-    int capacity = d->lst->capacity();
-    d->lst->setCapacity(0);
+    //shortcut to private BackForwardList
+    WebCore::BackForwardList* lst = d->lst;
 
-    WebCore::Page* page = d->lst->page();
+    //clear visited links
+    WebCore::Page* page = lst->page();
     if (page && page->groupPtr())
         page->groupPtr()->removeVisitedLinks();
 
-    d->lst->setCapacity(capacity);
-    d->lst->addItem(current.get());
-    d->lst->goToItem(current.get());
+    //if count() == 0 then just return
+    if (!lst->entries().size())
+        return;
+
+    RefPtr<WebCore::HistoryItem> current = lst->currentItem();
+    int capacity = lst->capacity();
+    lst->setCapacity(0);
+
+    lst->setCapacity(capacity);   //revert capacity
+    lst->addItem(current.get());  //insert old current item
+    lst->goToItem(current.get()); //and set it as current again
+
+    d->page()->updateNavigationActions();
 }
 
 /*!
@@ -267,7 +282,7 @@ QList<QWebHistoryItem> QWebHistory::items() const
     const WebCore::HistoryItemVector &items = d->lst->entries();
 
     QList<QWebHistoryItem> ret;
-    for (int i = 0; i < items.size(); ++i) {
+    for (unsigned i = 0; i < items.size(); ++i) {
         QWebHistoryItemPrivate *priv = new QWebHistoryItemPrivate(items[i].get());
         ret.append(QWebHistoryItem(priv));
     }
@@ -286,7 +301,7 @@ QList<QWebHistoryItem> QWebHistory::backItems(int maxItems) const
     d->lst->backListWithLimit(maxItems, items);
 
     QList<QWebHistoryItem> ret;
-    for (int i = 0; i < items.size(); ++i) {
+    for (unsigned i = 0; i < items.size(); ++i) {
         QWebHistoryItemPrivate *priv = new QWebHistoryItemPrivate(items[i].get());
         ret.append(QWebHistoryItem(priv));
     }
@@ -305,7 +320,7 @@ QList<QWebHistoryItem> QWebHistory::forwardItems(int maxItems) const
     d->lst->forwardListWithLimit(maxItems, items);
 
     QList<QWebHistoryItem> ret;
-    for (int i = 0; i < items.size(); ++i) {
+    for (unsigned i = 0; i < items.size(); ++i) {
         QWebHistoryItemPrivate *priv = new QWebHistoryItemPrivate(items[i].get());
         ret.append(QWebHistoryItem(priv));
     }
@@ -341,9 +356,11 @@ bool QWebHistory::canGoForward() const
 */
 void QWebHistory::back()
 {
-    d->lst->goBack();
-    WebCore::Page* page = d->lst->page();
-    page->goToItem(currentItem().d->item, WebCore::FrameLoadTypeIndexedBackForward);
+    if (canGoBack()) {
+        d->lst->goBack();
+        WebCore::Page* page = d->lst->page();
+        page->goToItem(currentItem().d->item, WebCore::FrameLoadTypeIndexedBackForward);
+    }
 }
 
 /*!
@@ -354,9 +371,11 @@ void QWebHistory::back()
 */
 void QWebHistory::forward()
 {
-    d->lst->goForward();
-    WebCore::Page* page = d->lst->page();
-    page->goToItem(currentItem().d->item, WebCore::FrameLoadTypeIndexedBackForward);
+    if (canGoForward()) {
+        d->lst->goForward();
+        WebCore::Page* page = d->lst->page();
+        page->goToItem(currentItem().d->item, WebCore::FrameLoadTypeIndexedBackForward);
+    }
 }
 
 /*!
@@ -504,6 +523,8 @@ bool QWebHistory::restoreState(const QByteArray& buffer)
     default: {} // result is false;
     }
 
+    d->page()->updateNavigationActions();
+
     return result;
 };
 
@@ -529,7 +550,7 @@ QByteArray QWebHistory::saveState(HistoryStateVersion version) const
         stream << count() << currentItemIndex();
 
         const WebCore::HistoryItemVector &items = d->lst->entries();
-        for (int i = 0; i < items.size(); i++)
+        for (unsigned i = 0; i < items.size(); i++)
             items[i].get()->saveState(stream, version);
 
         if (stream.status() != QDataStream::Ok)
@@ -549,8 +570,11 @@ QByteArray QWebHistory::saveState(HistoryStateVersion version) const
   \fn QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
   \relates QWebHistory
 
-  Saves the given \a history into the specified \a stream. This is a convenience function
-  and is equivalent to calling the saveState() method.
+  \brief The operator<< function streams a history into a data stream.
+
+  It saves the \a history into the specified \a stream. This is a
+  convenience function and is equivalent to calling the saveState()
+  method.
 
   \sa QWebHistory::saveState()
 */
@@ -565,6 +589,8 @@ QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
   \relates QWebHistory
   \since 4.6
 
+  \brief The operator>> function loads a history from a data stream.
+
   Loads a QWebHistory from the specified \a stream into the given \a history.
   This is a convenience function and it is equivalent to calling the restoreState()
   method.
@@ -580,4 +606,7 @@ QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
     return stream;
 }
 
-
+QWebPagePrivate* QWebHistoryPrivate::page()
+{
+    return QWebFramePrivate::kit(lst->page()->mainFrame())->page()->handle();
+}
diff --git a/WebKit/qt/Api/qwebhistory_p.h b/WebKit/qt/Api/qwebhistory_p.h
index e77adef..a6682cd 100644
--- a/WebKit/qt/Api/qwebhistory_p.h
+++ b/WebKit/qt/Api/qwebhistory_p.h
@@ -25,13 +25,15 @@
 #include <QtCore/qglobal.h>
 #include <QtCore/qshareddata.h>
 
+class QWebPagePrivate;
+
 class Q_AUTOTEST_EXPORT QWebHistoryItemPrivate : public QSharedData {
 public:
-    static QExplicitlySharedDataPointer<QWebHistoryItemPrivate> get(QWebHistoryItem *q)
+    static QExplicitlySharedDataPointer<QWebHistoryItemPrivate> get(QWebHistoryItem* q)
     {
         return q->d;
     }
-    QWebHistoryItemPrivate(WebCore::HistoryItem *i)
+    QWebHistoryItemPrivate(WebCore::HistoryItem* i)
     {
         if (i)
             i->ref();
@@ -43,30 +45,12 @@ public:
             item->deref();
     }
 
- /*   QByteArray saveStateWithoutVersionControl(QWebHistory::HistoryStateVersion version)
-    {
-        QByteArray buffer;
-        switch(version){
-            case QWebHistory::HistoryVersion1:
-                buffer=item->saveState(version);
-                break;
-            default:{}
-        }
-        return buffer;
-    }
-
-    bool restoreStateWithoutVersionControl(QWebHistory::HistoryStateVersion version,QDataStream& stream)
-    {
-
-    }
-*/
-
-    WebCore::HistoryItem *item;
+    WebCore::HistoryItem* item;
 };
 
 class QWebHistoryPrivate : public QSharedData {
 public:
-    QWebHistoryPrivate(WebCore::BackForwardList *l)
+    QWebHistoryPrivate(WebCore::BackForwardList* l)
     {
         l->ref();
         lst = l;
@@ -75,7 +59,10 @@ public:
     {
         lst->deref();
     }
-    WebCore::BackForwardList *lst;
+
+    QWebPagePrivate* page();
+
+    WebCore::BackForwardList* lst;
 };
 
 
diff --git a/WebKit/qt/Api/qwebhistoryinterface.cpp b/WebKit/qt/Api/qwebhistoryinterface.cpp
index 87d52ce..80567d1 100644
--- a/WebKit/qt/Api/qwebhistoryinterface.cpp
+++ b/WebKit/qt/Api/qwebhistoryinterface.cpp
@@ -81,6 +81,8 @@ QWebHistoryInterface* QWebHistoryInterface::defaultInterface()
   \since 4.4
   \brief The QWebHistoryInterface class provides an interface to implement link history.
 
+  \inmodule QtWebKit
+
   The QWebHistoryInterface is an interface that can be used to
   implement link history. It contains two pure virtual methods that
   are called by the WebKit engine.  addHistoryEntry() is used to add
diff --git a/WebKit/qt/Api/qwebinspector.cpp b/WebKit/qt/Api/qwebinspector.cpp
new file mode 100644
index 0000000..4578dc9
--- /dev/null
+++ b/WebKit/qt/Api/qwebinspector.cpp
@@ -0,0 +1,196 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "qwebinspector.h"
+
+#include "Element.h"
+#include "InspectorController.h"
+#include "qwebelement.h"
+#include "qwebinspector_p.h"
+#include "qwebpage_p.h"
+
+#include <QResizeEvent>
+
+/*!
+    \class QWebInspector
+    \since 4.6
+    \brief The QWebInspector class allows the placement and control of a
+    QWebPage's inspector.
+    The inspector allows you to see a page current hierarchy and loading
+    statistics.
+
+    The QWebPage to be inspected is determined with the setPage() method.
+
+    A typical use of QWebInspector follows:
+
+    \snippet webkitsnippets/qtwebkit_qwebinspector_snippet.cpp 0
+
+    \note A QWebInspector will display a blank widget if either:
+    \list
+        \o page() is null
+        \o QWebSettings::DeveloperExtrasEnabled is false
+    \endlist
+
+    \section1 Resources
+
+    Most of the resources needed by the inspector are owned by the associated
+    QWebPage and are allocated the first time that:
+    \list
+        \o an element is inspected
+        \o the QWebInspector is shown.
+    \endlist
+
+    This class acts mostly as a container and a controller for the inspector.
+    You can defer the creation and association of the QWebInspector until
+    the first emission of QWebPage::webInspectorTriggered() to save additional
+    resources.
+
+    \section1 Inspector configuration persistence
+
+    The inspector allows the user to configure some options through its
+    interface (e.g. the resource tracking "Always enable" option).
+    These settings are persisted automatically by QtWebKit using QSettings.
+
+    However since the QSettings object is instantiated using the empty
+    constructor, QCoreApplication::setOrganizationName() and
+    QCoreApplication::setApplicationName() must be called within your
+    application to enable the persistence of these options.
+*/
+
+/*!
+    Constructs an empty QWebInspector with parent \a parent.
+*/
+QWebInspector::QWebInspector(QWidget* parent)
+    : QWidget(parent)
+    , d(new QWebInspectorPrivate(this))
+{
+}
+
+/*!
+    Destroys the inspector.
+*/
+QWebInspector::~QWebInspector()
+{
+    // Remove association principally to prevent deleting a child frontend
+    setPage(0);
+}
+
+/*!
+    Sets the QWebPage to be inspected.
+
+    There can only be one QWebInspector associated with a QWebPage
+    and vices versa.
+
+    Calling with \a page as null will break the current association, if any.
+
+    If \a page is already associated to another QWebInspector, the association
+    will be replaced and the previous QWebInspector will have no page
+    associated.
+
+    \sa page()
+*/
+void QWebInspector::setPage(QWebPage* page)
+{
+    if (d->page) {
+        // Break currentPage-->this
+        d->page->d->setInspector(0);
+    }
+    if (page && page->d->inspector && page->d->inspector != this) {
+        // Break newPage<->newPageCurrentInspector
+        page->d->inspector->setPage(0);
+    }
+
+    d->page = page;
+
+    if (page) {
+        // Setup the reciprocal association
+        page->d->setInspector(this);
+    }
+}
+
+/*!
+    Returns the inspected QWebPage.
+    If no web page is currently associated, a null pointer is returned.
+*/
+QWebPage* QWebInspector::page() const
+{
+    return d->page;
+}
+
+/*! \reimp */
+QSize QWebInspector::sizeHint() const
+{
+    return QSize(450, 300);
+}
+
+/*! \reimp */
+bool QWebInspector::event(QEvent* ev)
+{
+    return QWidget::event(ev);
+}
+
+/*! \reimp */
+void QWebInspector::resizeEvent(QResizeEvent* event)
+{
+    d->adjustFrontendSize(event->size());
+}
+
+/*! \reimp */
+void QWebInspector::showEvent(QShowEvent* event)
+{
+    // Allows QWebInspector::show() to init the inspector.
+    if (d->page)
+        d->page->d->inspectorController()->show();
+}
+
+/*! \reimp */
+void QWebInspector::hideEvent(QHideEvent* event)
+{
+    if (d->page)
+        d->page->d->inspectorController()->setWindowVisible(false);
+}
+
+/*! \internal */
+void QWebInspectorPrivate::setFrontend(QWidget* newFrontend)
+{
+    if (frontend)
+        frontend->setParent(0);
+
+    frontend = newFrontend;
+
+    if (frontend) {
+        frontend->setParent(q);
+        frontend->show();
+        adjustFrontendSize(q->size());
+    }
+}
+
+void QWebInspectorPrivate::adjustFrontendSize(const QSize& size)
+{
+    if (frontend)
+        frontend->resize(size);
+}
+
+/*!
+    \fn void QWebInspector::windowTitleChanged(const QString& newTitle);
+
+    This is emitted to signal that this widget's title changed to \a newTitle.
+*/
+
diff --git a/WebKit/qt/Api/qwebinspector.h b/WebKit/qt/Api/qwebinspector.h
new file mode 100644
index 0000000..bb5bd64
--- /dev/null
+++ b/WebKit/qt/Api/qwebinspector.h
@@ -0,0 +1,58 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef QWEBINSPECTOR_H
+#define QWEBINSPECTOR_H
+
+#include "qwebkitglobal.h"
+#include "qwebpage.h"
+
+#include "qwebview.h"
+
+class QWebInspectorPrivate;
+
+class QWEBKIT_EXPORT QWebInspector : public QWidget {
+    Q_OBJECT
+public:
+    QWebInspector(QWidget* parent = 0);
+    ~QWebInspector();
+
+    void setPage(QWebPage* page);
+    QWebPage* page() const;
+
+    QSize sizeHint() const;
+    bool event(QEvent*);
+
+Q_SIGNALS:
+    void windowTitleChanged(const QString& newTitle);
+
+protected:
+    void resizeEvent(QResizeEvent* event);
+    void showEvent(QShowEvent* event);
+    void hideEvent(QHideEvent* event);
+
+private:
+    QWebInspectorPrivate* d;
+
+    friend class QWebInspectorPrivate;
+    friend class QWebPage;
+    friend class QWebPagePrivate;
+    friend class WebCore::InspectorClientQt;
+};
+#endif
diff --git a/WebKit/qt/Api/qwebinspector_p.h b/WebKit/qt/Api/qwebinspector_p.h
new file mode 100644
index 0000000..4d327cc
--- /dev/null
+++ b/WebKit/qt/Api/qwebinspector_p.h
@@ -0,0 +1,46 @@
+/*
+    Copyright (C) 2008, 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef QWEBINSPECTOR_P_H
+#define QWEBINSPECTOR_P_H
+
+QT_BEGIN_NAMESPACE
+class QSize;
+class QWidget;
+QT_END_NAMESPACE
+class QWebInspector;
+class QWebPage;
+
+class QWebInspectorPrivate {
+public:
+    QWebInspectorPrivate(QWebInspector* qq)
+    : q(qq)
+    , page(0)
+    , frontend(0)
+    {}
+
+    void setFrontend(QWidget* newFrontend);
+    void adjustFrontendSize(const QSize& size);
+
+    QWebInspector* q;
+    QWebPage* page;
+    QWidget* frontend;
+};
+
+#endif
diff --git a/WebKit/qt/Api/qwebpage.cpp b/WebKit/qt/Api/qwebpage.cpp
index 8e40339..0acec48 100644
--- a/WebKit/qt/Api/qwebpage.cpp
+++ b/WebKit/qt/Api/qwebpage.cpp
@@ -27,6 +27,8 @@
 #include "qwebframe_p.h"
 #include "qwebhistory.h"
 #include "qwebhistory_p.h"
+#include "qwebinspector.h"
+#include "qwebinspector_p.h"
 #include "qwebsettings.h"
 #include "qwebkitversion.h"
 
@@ -64,8 +66,12 @@
 #include "PluginDatabase.h"
 #include "ProgressTracker.h"
 #include "RefPtr.h"
+#include "RenderTextControl.h"
+#include "TextIterator.h"
 #include "HashMap.h"
 #include "HTMLFormElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "WindowFeatures.h"
 #include "LocalizedStrings.h"
@@ -76,7 +82,6 @@
 #include <QBasicTimer>
 #include <QBitArray>
 #include <QDebug>
-#include <QDesktopServices>
 #include <QDragEnterEvent>
 #include <QDragLeaveEvent>
 #include <QDragMoveEvent>
@@ -94,6 +99,7 @@
 #include <QSslSocket>
 #include <QStyle>
 #include <QSysInfo>
+#include <QTextCharFormat>
 #if QT_VERSION >= 0x040400
 #include <QNetworkAccessManager>
 #include <QNetworkRequest>
@@ -108,7 +114,7 @@ void QWEBKIT_EXPORT qt_drt_overwritePluginDirectories()
     PluginDatabase* db = PluginDatabase::installedPlugins(/* populate */ false);
 
     Vector<String> paths;
-    String qtPath(getenv("QTWEBKIT_PLUGIN_PATH"));
+    String qtPath(qgetenv("QTWEBKIT_PLUGIN_PATH").data());
     qtPath.split(UChar(':'), /* allowEmptyEntries */ false, paths);
 
     db->setPluginDirectories(paths);
@@ -226,18 +232,6 @@ const char* QWebPagePrivate::editorCommandForWebActions(QWebPage::WebAction acti
     return 0;
 }
 
-#ifndef QT_NO_CURSOR
-SetCursorEvent::SetCursorEvent(const QCursor& cursor)
-    : QEvent(static_cast<QEvent::Type>(EventType))
-    , m_cursor(cursor)
-{}
-
-QCursor SetCursorEvent::cursor() const
-{
-    return m_cursor;
-}
-#endif
-
 // If you change this make sure to also adjust the docs for QWebPage::userAgentForUrl
 #define WEBKIT_VERSION "527+"
 
@@ -265,45 +259,25 @@ static inline Qt::DropAction dragOpToDropAction(unsigned actions)
     return result;
 }
 
-static void initializeApplicationCachePathIfNecessary()
-{
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    static bool initialized = false;
-        
-    if (initialized)
-        return;
-
-    // Determine the path for HTML5 Application Cache DB
-    QString appCachePath;
-#if QT_VERSION >= 0x040500
-    appCachePath = QDesktopServices::storageLocation(QDesktopServices::CacheLocation);
-#else
-    appCachePath = QDesktopServices::storageLocation(QDesktopServices::DataLocation);
-#endif
-
-    if (appCachePath.isEmpty())
-        appCachePath = QDir::homePath() + QLatin1String("/.") + QCoreApplication::applicationName();
-
-    WebCore::cacheStorage().setCacheDirectory(appCachePath);
-    initialized = true;
-#endif
-}                                                
-
 QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     : q(qq)
+    , client(0)
     , view(0)
+    , inspectorFrontend(0)
+    , inspector(0)
+    , inspectorIsInternalOnly(false)
     , viewportSize(QSize(0, 0))
+    , clickCausedFocus(false)
 {
     WebCore::InitializeLoggingChannelsIfNecessary();
     JSC::initializeThreading();
-    WebCore::FrameLoader::setLocalLoadPolicy(WebCore::FrameLoader::AllowLocalLoadsForLocalAndSubstituteData);
-    initializeApplicationCachePathIfNecessary();
+    WebCore::SecurityOrigin::setLocalLoadPolicy(WebCore::SecurityOrigin::AllowLocalLoadsForLocalAndSubstituteData);
 
     chromeClient = new ChromeClientQt(q);
     contextMenuClient = new ContextMenuClientQt();
     editorClient = new EditorClientQt(q);
     page = new Page(chromeClient, contextMenuClient, editorClient,
-                    new DragClientQt(q), new InspectorClientQt(q));
+                    new DragClientQt(q), new InspectorClientQt(q), 0);
 
     // ### should be configurable
     page->settings()->setDefaultTextEncodingName("iso-8859-1");
@@ -465,13 +439,13 @@ void QWebPagePrivate::_q_webActionTriggered(bool checked)
     q->triggerAction(action, checked);
 }
 
-#ifndef NDEBUG
 void QWebPagePrivate::_q_cleanupLeakMessages()
 {
+#ifndef NDEBUG
     // Need this to make leak messages accurate.
     cache()->setCapacities(0, 0, 0);
-}
 #endif
+}
 
 void QWebPagePrivate::updateAction(QWebPage::WebAction action)
 {
@@ -487,10 +461,10 @@ void QWebPagePrivate::updateAction(QWebPage::WebAction action)
 
     switch (action) {
         case QWebPage::Back:
-            enabled = loader->canGoBackOrForward(-1);
+            enabled = page->canGoBackOrForward(-1);
             break;
         case QWebPage::Forward:
-            enabled = loader->canGoBackOrForward(1);
+            enabled = page->canGoBackOrForward(1);
             break;
         case QWebPage::Stop:
             enabled = loader->isLoading();
@@ -608,6 +582,18 @@ void QWebPagePrivate::timerEvent(QTimerEvent *ev)
         q->QObject::timerEvent(ev);
 }
 
+void QWebPagePrivate::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
+{
+    q->setView(ev->widget());
+
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    bool accepted = frame->eventHandler()->mouseMoved(PlatformMouseEvent(ev, 0));
+    ev->setAccepted(accepted);
+}
+
 void QWebPagePrivate::mouseMoveEvent(QMouseEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
@@ -618,12 +604,40 @@ void QWebPagePrivate::mouseMoveEvent(QMouseEvent *ev)
     ev->setAccepted(accepted);
 }
 
+void QWebPagePrivate::mousePressEvent(QGraphicsSceneMouseEvent* ev)
+{
+    q->setView(ev->widget());
+
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    if (tripleClickTimer.isActive()
+            && (ev->pos().toPoint() - tripleClick).manhattanLength()
+                < QApplication::startDragDistance()) {
+        mouseTripleClickEvent(ev);
+        return;
+    }
+
+    bool accepted = false;
+    PlatformMouseEvent mev(ev, 1);
+    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
+    if (mev.button() != NoButton)
+        accepted = frame->eventHandler()->handleMousePressEvent(mev);
+    ev->setAccepted(accepted);
+}
+
 void QWebPagePrivate::mousePressEvent(QMouseEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
 
+    RefPtr<WebCore::Node> oldNode;
+    if (page->focusController()->focusedFrame()
+        && page->focusController()->focusedFrame()->document())
+        oldNode = page->focusController()->focusedFrame()->document()->focusedNode();
+
     if (tripleClickTimer.isActive()
             && (ev->pos() - tripleClick).manhattanLength()
                 < QApplication::startDragDistance()) {
@@ -637,6 +651,33 @@ void QWebPagePrivate::mousePressEvent(QMouseEvent *ev)
     if (mev.button() != NoButton)
         accepted = frame->eventHandler()->handleMousePressEvent(mev);
     ev->setAccepted(accepted);
+
+    RefPtr<WebCore::Node> newNode;
+    if (page->focusController()->focusedFrame()
+        && page->focusController()->focusedFrame()->document())
+        newNode = page->focusController()->focusedFrame()->document()->focusedNode();
+
+    if (newNode && oldNode != newNode)
+        clickCausedFocus = true;
+}
+
+void QWebPagePrivate::mouseDoubleClickEvent(QGraphicsSceneMouseEvent *ev)
+{
+    q->setView(ev->widget());
+
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    bool accepted = false;
+    PlatformMouseEvent mev(ev, 2);
+    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
+    if (mev.button() != NoButton)
+        accepted = frame->eventHandler()->handleMousePressEvent(mev);
+    ev->setAccepted(accepted);
+
+    tripleClickTimer.start(QApplication::doubleClickInterval(), q);
+    tripleClick = ev->pos().toPoint();
 }
 
 void QWebPagePrivate::mouseDoubleClickEvent(QMouseEvent *ev)
@@ -656,7 +697,7 @@ void QWebPagePrivate::mouseDoubleClickEvent(QMouseEvent *ev)
     tripleClick = ev->pos();
 }
 
-void QWebPagePrivate::mouseTripleClickEvent(QMouseEvent *ev)
+void QWebPagePrivate::mouseTripleClickEvent(QGraphicsSceneMouseEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
@@ -670,30 +711,33 @@ void QWebPagePrivate::mouseTripleClickEvent(QMouseEvent *ev)
     ev->setAccepted(accepted);
 }
 
-void QWebPagePrivate::mouseReleaseEvent(QMouseEvent *ev)
+void QWebPagePrivate::mouseTripleClickEvent(QMouseEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
 
     bool accepted = false;
-    PlatformMouseEvent mev(ev, 0);
+    PlatformMouseEvent mev(ev, 3);
     // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
     if (mev.button() != NoButton)
-        accepted = frame->eventHandler()->handleMouseReleaseEvent(mev);
+        accepted = frame->eventHandler()->handleMousePressEvent(mev);
     ev->setAccepted(accepted);
+}
 
+void QWebPagePrivate::handleClipboard(QEvent* ev, Qt::MouseButton button)
+{
 #ifndef QT_NO_CLIPBOARD
     if (QApplication::clipboard()->supportsSelection()) {
         bool oldSelectionMode = Pasteboard::generalPasteboard()->isSelectionMode();
         Pasteboard::generalPasteboard()->setSelectionMode(true);
         WebCore::Frame* focusFrame = page->focusController()->focusedOrMainFrame();
-        if (ev->button() == Qt::LeftButton) {
+        if (button == Qt::LeftButton) {
             if (focusFrame && (focusFrame->editor()->canCopy() || focusFrame->editor()->canDHTMLCopy())) {
                 focusFrame->editor()->copy();
                 ev->setAccepted(true);
             }
-        } else if (ev->button() == Qt::MidButton) {
+        } else if (button == Qt::MidButton) {
             if (focusFrame && (focusFrame->editor()->canPaste() || focusFrame->editor()->canDHTMLPaste())) {
                 focusFrame->editor()->paste();
                 ev->setAccepted(true);
@@ -704,12 +748,65 @@ void QWebPagePrivate::mouseReleaseEvent(QMouseEvent *ev)
 #endif
 }
 
+void QWebPagePrivate::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
+{
+    q->setView(ev->widget());
+
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    bool accepted = false;
+    PlatformMouseEvent mev(ev, 0);
+    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
+    if (mev.button() != NoButton)
+        accepted = frame->eventHandler()->handleMouseReleaseEvent(mev);
+    ev->setAccepted(accepted);
+
+    handleClipboard(ev, ev->button());
+    handleSoftwareInputPanel(ev->button());
+}
+
+void QWebPagePrivate::handleSoftwareInputPanel(Qt::MouseButton button)
+{
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    if (view && view->testAttribute(Qt::WA_InputMethodEnabled)
+        && button == Qt::LeftButton && qApp->autoSipEnabled()) {
+        QStyle::RequestSoftwareInputPanel behavior = QStyle::RequestSoftwareInputPanel(
+            view->style()->styleHint(QStyle::SH_RequestSoftwareInputPanel));
+        if (!clickCausedFocus || behavior == QStyle::RSIP_OnMouseClick) {
+            QEvent event(QEvent::RequestSoftwareInputPanel);
+            QApplication::sendEvent(view, &event);
+        }
+    }
+
+    clickCausedFocus = false;
+#endif
+}
+
+void QWebPagePrivate::mouseReleaseEvent(QMouseEvent *ev)
+{
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    bool accepted = false;
+    PlatformMouseEvent mev(ev, 0);
+    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
+    if (mev.button() != NoButton)
+        accepted = frame->eventHandler()->handleMouseReleaseEvent(mev);
+    ev->setAccepted(accepted);
+
+    handleClipboard(ev, ev->button());
+    handleSoftwareInputPanel(ev->button());
+}
+
 #ifndef QT_NO_CONTEXTMENU
-void QWebPagePrivate::contextMenuEvent(QContextMenuEvent *ev)
+void QWebPagePrivate::contextMenuEvent(const QPoint& globalPos)
 {
     QMenu *menu = q->createStandardContextMenu();
     if (menu) {
-        menu->exec(ev->globalPos());
+        menu->exec(globalPos);
         delete menu;
     }
 }
@@ -734,6 +831,19 @@ QMenu *QWebPage::createStandardContextMenu()
 }
 
 #ifndef QT_NO_WHEELEVENT
+void QWebPagePrivate::wheelEvent(QGraphicsSceneWheelEvent* ev)
+{
+    q->setView(ev->widget());
+
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    WebCore::PlatformWheelEvent pev(ev);
+    bool accepted = frame->eventHandler()->handleWheelEvent(pev);
+    ev->setAccepted(accepted);
+}
+
 void QWebPagePrivate::wheelEvent(QWheelEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
@@ -804,7 +914,6 @@ void QWebPagePrivate::keyPressEvent(QKeyEvent *ev)
 {
     bool handled = false;
     WebCore::Frame* frame = page->focusController()->focusedOrMainFrame();
-    WebCore::Editor* editor = frame->editor();
     // we forward the key event to WebCore first to handle potential DOM
     // defined event handlers and later on end up in EditorClientQt::handleKeyboardEvent
     // to trigger editor commands via triggerAction().
@@ -816,7 +925,6 @@ void QWebPagePrivate::keyPressEvent(QKeyEvent *ev)
         if (view)
             defaultFont = view->font();
         QFontMetrics fm(defaultFont);
-        int fontHeight = fm.height();
         if (!handleScrolling(ev, frame)) {
             switch (ev->key()) {
             case Qt::Key_Back:
@@ -859,7 +967,7 @@ void QWebPagePrivate::keyReleaseEvent(QKeyEvent *ev)
     ev->setAccepted(handled);
 }
 
-void QWebPagePrivate::focusInEvent(QFocusEvent *ev)
+void QWebPagePrivate::focusInEvent(QFocusEvent*)
 {
     FocusController *focusController = page->focusController();
     Frame *frame = focusController->focusedFrame();
@@ -870,7 +978,7 @@ void QWebPagePrivate::focusInEvent(QFocusEvent *ev)
         focusController->setFocusedFrame(QWebFramePrivate::core(mainFrame));
 }
 
-void QWebPagePrivate::focusOutEvent(QFocusEvent *ev)
+void QWebPagePrivate::focusOutEvent(QFocusEvent*)
 {
     // only set the focused frame inactive so that we stop painting the caret
     // and the focus frame. But don't tell the focus controller so that upon
@@ -880,7 +988,21 @@ void QWebPagePrivate::focusOutEvent(QFocusEvent *ev)
     focusController->setFocused(false);
 }
 
-void QWebPagePrivate::dragEnterEvent(QDragEnterEvent *ev)
+void QWebPagePrivate::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
+{
+    q->setView(ev->widget());
+
+#ifndef QT_NO_DRAGANDDROP
+    DragData dragData(ev->mimeData(), ev->pos().toPoint(),
+            QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
+    Qt::DropAction action = dragOpToDropAction(page->dragController()->dragEntered(&dragData));
+    ev->setDropAction(action);
+    if (action != Qt::IgnoreAction)
+        ev->accept();
+#endif
+}
+
+void QWebPagePrivate::dragEnterEvent(QDragEnterEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
@@ -892,7 +1014,18 @@ void QWebPagePrivate::dragEnterEvent(QDragEnterEvent *ev)
 #endif
 }
 
-void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent *ev)
+void QWebPagePrivate::dragLeaveEvent(QGraphicsSceneDragDropEvent* ev)
+{
+    q->setView(ev->widget());
+
+#ifndef QT_NO_DRAGANDDROP
+    DragData dragData(0, IntPoint(), QCursor::pos(), DragOperationNone);
+    page->dragController()->dragExited(&dragData);
+    ev->accept();
+#endif
+}
+
+void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(0, IntPoint(), QCursor::pos(), DragOperationNone);
@@ -901,7 +1034,21 @@ void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent *ev)
 #endif
 }
 
-void QWebPagePrivate::dragMoveEvent(QDragMoveEvent *ev)
+void QWebPagePrivate::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
+{
+    q->setView(ev->widget());
+
+#ifndef QT_NO_DRAGANDDROP
+    DragData dragData(ev->mimeData(), ev->pos().toPoint(),
+            QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
+    Qt::DropAction action = dragOpToDropAction(page->dragController()->dragUpdated(&dragData));
+    ev->setDropAction(action);
+    if (action != Qt::IgnoreAction)
+        ev->accept();
+#endif
+}
+
+void QWebPagePrivate::dragMoveEvent(QDragMoveEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
@@ -913,7 +1060,18 @@ void QWebPagePrivate::dragMoveEvent(QDragMoveEvent *ev)
 #endif
 }
 
-void QWebPagePrivate::dropEvent(QDropEvent *ev)
+void QWebPagePrivate::dropEvent(QGraphicsSceneDragDropEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    DragData dragData(ev->mimeData(), ev->pos().toPoint(),
+            QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
+    Qt::DropAction action = dragOpToDropAction(page->dragController()->performDrag(&dragData));
+    if (action != Qt::IgnoreAction)
+        ev->accept();
+#endif
+}
+
+void QWebPagePrivate::dropEvent(QDropEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
@@ -924,7 +1082,7 @@ void QWebPagePrivate::dropEvent(QDropEvent *ev)
 #endif
 }
 
-void QWebPagePrivate::leaveEvent(QEvent *ev)
+void QWebPagePrivate::leaveEvent(QEvent*)
 {
     // Fake a mouse move event just outside of the widget, since all
     // the interesting mouse-out behavior like invalidating scrollbars
@@ -967,13 +1125,53 @@ void QWebPagePrivate::inputMethodEvent(QInputMethodEvent *ev)
         return;
     }
 
+    RenderObject* renderer = 0;
+    RenderTextControl* renderTextControl = 0;
+
+    if (frame->selection()->rootEditableElement())
+        renderer = frame->selection()->rootEditableElement()->shadowAncestorNode()->renderer();
+
+    if (renderer && renderer->isTextControl())
+        renderTextControl = toRenderTextControl(renderer);
+
+    Vector<CompositionUnderline> underlines;
+
+    for (int i = 0; i < ev->attributes().size(); ++i) {
+        const QInputMethodEvent::Attribute& a = ev->attributes().at(i);
+        switch (a.type) {
+        case QInputMethodEvent::TextFormat: {
+            QTextCharFormat textCharFormat = a.value.value<QTextFormat>().toCharFormat();
+            QColor qcolor = textCharFormat.underlineColor();
+            underlines.append(CompositionUnderline(a.start, a.length, Color(makeRGBA(qcolor.red(), qcolor.green(), qcolor.blue(), qcolor.alpha())), false));
+            break;
+        }
+        case QInputMethodEvent::Cursor: {
+            frame->setCaretVisible(a.length); //if length is 0 cursor is invisible
+            if (a.length > 0) {
+                RenderObject* caretRenderer = frame->selection()->caretRenderer();
+                if (caretRenderer) {
+                    QColor qcolor = a.value.value<QColor>();
+                    caretRenderer->style()->setColor(Color(makeRGBA(qcolor.red(), qcolor.green(), qcolor.blue(), qcolor.alpha())));
+                }
+            }
+            break;
+        }
+#if QT_VERSION >= 0x040600
+        case QInputMethodEvent::Selection: {
+            if (renderTextControl) {
+                renderTextControl->setSelectionStart(a.start);
+                renderTextControl->setSelectionEnd(a.start + a.length);
+            }
+            break;
+        }
+#endif
+        }
+    }
+
     if (!ev->commitString().isEmpty())
         editor->confirmComposition(ev->commitString());
-    else {
+    else if (!ev->preeditString().isEmpty()) {
         QString preedit = ev->preeditString();
-        // ### FIXME: use the provided QTextCharFormat (use color at least)
-        Vector<CompositionUnderline> underlines;
-        underlines.append(CompositionUnderline(0, preedit.length(), Color(0, 0, 0), false));
         editor->setComposition(preedit, underlines, preedit.length(), 0);
     }
     ev->accept();
@@ -1076,44 +1274,140 @@ bool QWebPagePrivate::handleScrolling(QKeyEvent *ev, Frame *frame)
 */
 QVariant QWebPage::inputMethodQuery(Qt::InputMethodQuery property) const
 {
+    Frame* frame = d->page->focusController()->focusedFrame();
+    if (!frame)
+        return QVariant();
+
+    WebCore::Editor* editor = frame->editor();
+
+    RenderObject* renderer = 0;
+    RenderTextControl* renderTextControl = 0;
+
+    if (frame->selection()->rootEditableElement())
+        renderer = frame->selection()->rootEditableElement()->shadowAncestorNode()->renderer();
+
+    if (renderer && renderer->isTextControl())
+        renderTextControl = toRenderTextControl(renderer);
+
     switch (property) {
-    case Qt::ImMicroFocus: {
-        Frame *frame = d->page->focusController()->focusedFrame();
-        if (frame)
+        case Qt::ImMicroFocus: {
             return QVariant(frame->selection()->absoluteCaretBounds());
-        return QVariant();
-    }
-    case Qt::ImFont: {
-        QWebView *webView = qobject_cast<QWebView *>(d->view);
-        if (webView)
-            return QVariant(webView->font());
-        return QVariant();
-    }
-    case Qt::ImCursorPosition: {
-        Frame *frame = d->page->focusController()->focusedFrame();
-        if (frame) {
-            VisibleSelection selection = frame->selection()->selection();
-            if (selection.isCaret())
-                return QVariant(selection.start().deprecatedEditingOffset());
         }
-        return QVariant();
-    }
-    case Qt::ImSurroundingText: {
-        Frame *frame = d->page->focusController()->focusedFrame();
-        if (frame) {
-            Document *document = frame->document();
-            if (document->focusedNode())
-                return QVariant(document->focusedNode()->nodeValue());
+        case Qt::ImFont: {
+            if (renderTextControl) {
+                RenderStyle* renderStyle = renderTextControl->style();
+                return QVariant(QFont(renderStyle->font().font()));
+            }
+            return QVariant(QFont());
         }
-        return QVariant();
+        case Qt::ImCursorPosition: {
+            if (renderTextControl) {
+                if (editor->hasComposition()) {
+                    RefPtr<Range> range = editor->compositionRange();
+                    return QVariant(renderTextControl->selectionEnd() - TextIterator::rangeLength(range.get()));
+                }
+                return QVariant(renderTextControl->selectionEnd());
+            }
+            return QVariant();
+        }
+        case Qt::ImSurroundingText: {
+            if (renderTextControl) {
+                QString text = renderTextControl->text();
+                RefPtr<Range> range = editor->compositionRange();
+                if (range) {
+                    text.remove(range->startPosition().offsetInContainerNode(), TextIterator::rangeLength(range.get()));
+                }
+                return QVariant(text);
+            }
+            return QVariant();
+        }
+        case Qt::ImCurrentSelection: {
+            if (renderTextControl) {
+                int start = renderTextControl->selectionStart();
+                int end = renderTextControl->selectionEnd();
+                if (end > start)
+                    return QVariant(QString(renderTextControl->text()).mid(start,end-start));
+            }
+            return QVariant();
+
+        }
+#if QT_VERSION >= 0x040600
+        case Qt::ImAnchorPosition: {
+            if (renderTextControl) {
+                if (editor->hasComposition()) {
+                    RefPtr<Range> range = editor->compositionRange();
+                    return QVariant(renderTextControl->selectionStart() - TextIterator::rangeLength(range.get()));
+                }
+                return QVariant(renderTextControl->selectionStart());
+            }
+            return QVariant();
+        }
+        case Qt::ImMaximumTextLength: {
+            if (frame->selection()->isContentEditable()) {
+                if (frame->document() && frame->document()->focusedNode()) {
+                    if (frame->document()->focusedNode()->hasTagName(HTMLNames::inputTag)) {
+                        HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(frame->document()->focusedNode());
+                        return QVariant(inputElement->maxLength());
+                    }
+                }
+                return QVariant(InputElement::s_maximumLength);
+            }
+            return QVariant(0);
+        }
+#endif
+        default:
+            return QVariant();
     }
-    case Qt::ImCurrentSelection:
-        return QVariant(selectedText());
-    default:
-        return QVariant();
+}
+
+/*!
+    \internal
+*/
+void QWebPagePrivate::setInspector(QWebInspector* insp)
+{
+    if (inspector)
+        inspector->d->setFrontend(0);
+
+    if (inspectorIsInternalOnly) {
+        QWebInspector* inspToDelete = inspector;
+        inspector = 0;
+        inspectorIsInternalOnly = false;
+        delete inspToDelete;    // Delete after to prevent infinite recursion
+    }
+
+    inspector = insp;
+
+    // Give inspector frontend web view if previously created
+    if (inspector && inspectorFrontend)
+        inspector->d->setFrontend(inspectorFrontend);
+}
+
+/*!
+    \internal
+    Returns the inspector and creates it if it wasn't created yet.
+    The instance created here will not be available through QWebPage's API.
+*/
+QWebInspector* QWebPagePrivate::getOrCreateInspector()
+{
+    if (!inspector) {
+        QWebInspector* insp = new QWebInspector;
+        insp->setPage(q);
+        insp->connect(q, SIGNAL(webInspectorTriggered(const QWebElement&)), SLOT(show()));
+        insp->show(); // The inspector is expected to be shown on inspection
+        inspectorIsInternalOnly = true;
+
+        Q_ASSERT(inspector); // Associated through QWebInspector::setPage(q)
     }
+    return inspector;
 }
 
+/*! \internal */
+InspectorController* QWebPagePrivate::inspectorController()
+{
+    return page->inspectorController();
+}
+
+
 /*!
    \enum QWebPage::FindFlag
 
@@ -1252,6 +1546,8 @@ QVariant QWebPage::inputMethodQuery(Qt::InputMethodQuery property) const
     \since 4.4
     \brief The QWebPage class provides an object to view and edit web documents.
 
+    \inmodule QtWebKit
+
     QWebPage holds a main frame responsible for web content, settings, the history
     of navigated links and actions. This class can be used, together with QWebFrame,
     to provide functionality like QWebView in a widget-less environment.
@@ -1321,9 +1617,12 @@ QWebPage::QWebPage(QObject *parent)
 */
 QWebPage::~QWebPage()
 {
+    d->createMainFrame();
     FrameLoader *loader = d->mainFrame->d->frame->loader();
     if (loader)
         loader->detachFromParent();
+    if (d->inspector)
+        d->inspector->setPage(0);
     delete d;
 }
 
@@ -1348,6 +1647,7 @@ QWebFrame *QWebPage::mainFrame() const
 */
 QWebFrame *QWebPage::currentFrame() const
 {
+    d->createMainFrame();
     return static_cast<WebCore::FrameLoaderClientQt *>(d->page->focusController()->focusedOrMainFrame()->loader()->client())->webFrame();
 }
 
@@ -1373,6 +1673,7 @@ QWebFrame* QWebPage::frameAt(const QPoint& pos) const
 */
 QWebHistory *QWebPage::history() const
 {
+    d->createMainFrame();
     return &d->history;
 }
 
@@ -1383,8 +1684,10 @@ QWebHistory *QWebPage::history() const
 */
 void QWebPage::setView(QWidget *view)
 {
-    d->view = view;
-    setViewportSize(view ? view->size() : QSize(0, 0));
+    if (d->view != view) {
+        d->view = view;
+        setViewportSize(view ? view->size() : QSize(0, 0));
+    }
 }
 
 /*!
@@ -1419,6 +1722,7 @@ void QWebPage::javaScriptConsoleMessage(const QString& message, int lineNumber,
 */
 void QWebPage::javaScriptAlert(QWebFrame *frame, const QString& msg)
 {
+    Q_UNUSED(frame)
 #ifndef QT_NO_MESSAGEBOX
     QMessageBox::information(d->view, tr("JavaScript Alert - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Ok);
 #endif
@@ -1432,6 +1736,7 @@ void QWebPage::javaScriptAlert(QWebFrame *frame, const QString& msg)
 */
 bool QWebPage::javaScriptConfirm(QWebFrame *frame, const QString& msg)
 {
+    Q_UNUSED(frame)
 #ifdef QT_NO_MESSAGEBOX
     return true;
 #else
@@ -1450,6 +1755,7 @@ bool QWebPage::javaScriptConfirm(QWebFrame *frame, const QString& msg)
 */
 bool QWebPage::javaScriptPrompt(QWebFrame *frame, const QString& msg, const QString& defaultValue, QString* result)
 {
+    Q_UNUSED(frame)
     bool ok = false;
 #ifndef QT_NO_INPUTDIALOG
     QString x = QInputDialog::getText(d->view, tr("JavaScript Prompt - %1").arg(mainFrame()->url().host()), msg, QLineEdit::Normal, defaultValue, &ok);
@@ -1543,7 +1849,7 @@ static void openNewWindow(const QUrl& url, WebCore::Frame* frame)
 
     \sa action()
 */
-void QWebPage::triggerAction(WebAction action, bool checked)
+void QWebPage::triggerAction(WebAction action, bool)
 {
     WebCore::Frame *frame = d->page->focusController()->focusedOrMainFrame();
     if (!frame)
@@ -1619,12 +1925,16 @@ void QWebPage::triggerAction(WebAction action, bool checked)
         case SetTextDirectionRightToLeft:
             editor->setBaseWritingDirection(RightToLeftWritingDirection);
             break;
-        case InspectElement:
-            if (!d->hitTestResult.isNull())
+        case InspectElement: {
+            QWebElement inspectedElement(QWebElement::enclosingElement(d->hitTestResult.d->innerNonSharedNode.get()));
+            emit webInspectorTriggered(inspectedElement);
+
+            if (!d->hitTestResult.isNull()) {
+                d->getOrCreateInspector(); // Make sure the inspector is created
                 d->page->inspectorController()->inspect(d->hitTestResult.d->innerNonSharedNode.get());
-            else
-                d->page->inspectorController()->show();
+            }
             break;
+        }
         default:
             command = QWebPagePrivate::editorCommandForWebActions(action);
             break;
@@ -1725,6 +2035,7 @@ bool QWebPage::acceptNavigationRequest(QWebFrame *frame, const QNetworkRequest &
 bool QWebPage::acceptNavigationRequest(QWebFrame *frame, const QWebNetworkRequest &request, QWebPage::NavigationType type)
 #endif
 {
+    Q_UNUSED(frame)
     if (type == NavigationTypeLinkClicked) {
         switch (d->linkPolicy) {
             case DontDelegateLinks:
@@ -1754,6 +2065,7 @@ bool QWebPage::acceptNavigationRequest(QWebFrame *frame, const QWebNetworkReques
 */
 QString QWebPage::selectedText() const
 {
+    d->createMainFrame();
     return d->page->focusController()->focusedOrMainFrame()->selectedText();
 }
 
@@ -2079,24 +2391,42 @@ bool QWebPage::event(QEvent *ev)
     case QEvent::MouseMove:
         d->mouseMoveEvent(static_cast<QMouseEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneMouseMove:
+        d->mouseMoveEvent(static_cast<QGraphicsSceneMouseEvent*>(ev));
+        break;
     case QEvent::MouseButtonPress:
         d->mousePressEvent(static_cast<QMouseEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneMousePress:
+        d->mousePressEvent(static_cast<QGraphicsSceneMouseEvent*>(ev));
+        break;
     case QEvent::MouseButtonDblClick:
         d->mouseDoubleClickEvent(static_cast<QMouseEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneMouseDoubleClick:
+        d->mouseDoubleClickEvent(static_cast<QGraphicsSceneMouseEvent*>(ev));
+        break;
     case QEvent::MouseButtonRelease:
         d->mouseReleaseEvent(static_cast<QMouseEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneMouseRelease:
+        d->mouseReleaseEvent(static_cast<QGraphicsSceneMouseEvent*>(ev));
+        break;
 #ifndef QT_NO_CONTEXTMENU
     case QEvent::ContextMenu:
-        d->contextMenuEvent(static_cast<QContextMenuEvent*>(ev));
+        d->contextMenuEvent(static_cast<QContextMenuEvent*>(ev)->globalPos());
+        break;
+    case QEvent::GraphicsSceneContextMenu:
+        d->contextMenuEvent(static_cast<QGraphicsSceneContextMenuEvent*>(ev)->screenPos());
         break;
 #endif
 #ifndef QT_NO_WHEELEVENT
     case QEvent::Wheel:
         d->wheelEvent(static_cast<QWheelEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneWheel:
+        d->wheelEvent(static_cast<QGraphicsSceneWheelEvent*>(ev));
+        break;
 #endif
     case QEvent::KeyPress:
         d->keyPressEvent(static_cast<QKeyEvent*>(ev));
@@ -2114,15 +2444,27 @@ bool QWebPage::event(QEvent *ev)
     case QEvent::DragEnter:
         d->dragEnterEvent(static_cast<QDragEnterEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneDragEnter:
+        d->dragEnterEvent(static_cast<QGraphicsSceneDragDropEvent*>(ev));
+        break;
     case QEvent::DragLeave:
         d->dragLeaveEvent(static_cast<QDragLeaveEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneDragLeave:
+        d->dragLeaveEvent(static_cast<QGraphicsSceneDragDropEvent*>(ev));
+        break;
     case QEvent::DragMove:
         d->dragMoveEvent(static_cast<QDragMoveEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneDragMove:
+        d->dragMoveEvent(static_cast<QGraphicsSceneDragDropEvent*>(ev));
+        break;
     case QEvent::Drop:
         d->dropEvent(static_cast<QDropEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneDrop:
+        d->dropEvent(static_cast<QGraphicsSceneDragDropEvent*>(ev));
+        break;
 #endif
     case QEvent::InputMethod:
         d->inputMethodEvent(static_cast<QInputMethodEvent*>(ev));
@@ -2279,6 +2621,7 @@ void QWebPage::updatePositionDependentActions(const QPoint &pos)
         }
     }
 
+    d->createMainFrame();
     WebCore::Frame* focusedFrame = d->page->focusController()->focusedOrMainFrame();
     HitTestResult result = focusedFrame->eventHandler()->hitTestResultAtPoint(focusedFrame->view()->windowToContents(pos), /*allowShadowContent*/ false);
 
@@ -2335,15 +2678,56 @@ void QWebPage::updatePositionDependentActions(const QPoint &pos)
     \since 4.4
     \brief The ExtensionOption class provides an extended input argument to QWebPage's extension support.
 
+    \inmodule QtWebKit
+
     \sa QWebPage::extension()
 */
 
 /*!
+    \class QWebPage::ErrorPageExtensionOption
+    \since 4.6
+    \brief The ErrorPageExtensionOption class describes the option
+    for the error page extension.
+
+    \inmodule QtWebKit
+
+    The ErrorPageExtensionOption class holds the \a url for which an error occoured as well as
+    the associated \a frame.
+
+    The error itself is reported by an error \a domain, the \a error code as well as \a errorString.
+
+    \sa QWebPage::ErrorPageExtensionReturn
+*/
+
+/*!
+    \class QWebPage::ErrorPageExtensionReturn
+    \since 4.6
+    \brief The ErrorPageExtensionReturn describes the error page, which will be shown for the
+    frame for which the error occured.
+
+    \inmodule QtWebKit
+
+    The ErrorPageExtensionReturn class holds the data needed for creating an error page. Some are
+    optional such as \a contentType, which defaults to "text/html", as well as the \a encoding, which
+    is assumed to be UTF-8 if not indicated otherwise.
+
+    The error page is stored in the \a content byte array, as HTML content. In order to convert a
+    QString to a byte array, the QString::toUtf8() method can be used.
+
+    External objects such as stylesheets or images referenced in the HTML are located relative to
+    \a baseUrl.
+
+    \sa QWebPage::ErrorPageExtensionOption, QString::toUtf8()
+*/
+
+/*!
     \class QWebPage::ChooseMultipleFilesExtensionOption
     \since 4.5
     \brief The ChooseMultipleFilesExtensionOption class describes the option
     for the multiple files selection extension.
 
+    \inmodule QtWebKit
+
     The ChooseMultipleFilesExtensionOption class holds the frame originating the request
     and the suggested filenames which might be provided.
 
@@ -2356,6 +2740,8 @@ void QWebPage::updatePositionDependentActions(const QPoint &pos)
     \brief The ChooseMultipleFilesExtensionReturn describes the return value
     for the multiple files selection extension.
 
+    \inmodule QtWebKit
+
     The ChooseMultipleFilesExtensionReturn class holds the filenames selected by the user
     when the extension is invoked.
 
@@ -2460,6 +2846,7 @@ QWebSettings *QWebPage::settings() const
 */
 QString QWebPage::chooseFile(QWebFrame *parentFrame, const QString& suggestedFile)
 {
+    Q_UNUSED(parentFrame)
 #ifndef QT_NO_FILEDIALOG
     return QFileDialog::getOpenFileName(d->view, QString::null, suggestedFile);
 #else
@@ -2698,6 +3085,11 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
         case QSysInfo::WV_VISTA:
             ver = "Windows NT 6.0";
             break;
+#if QT_VERSION > 0x040500
+        case QSysInfo::WV_WINDOWS7:
+            ver = "Windows NT 6.1";
+            break;
+#endif
         case QSysInfo::WV_CE:
             ver = "Windows CE";
             break;
@@ -2936,6 +3328,24 @@ quint64 QWebPage::bytesReceived() const
 */
 
 /*!
+    \fn void QWebPage::webInspectorTriggered(const QWebElement& inspectedElement);
+    \since 4.6
+
+    This signal is emitted when the user triggered an inspection through the
+    context menu. If a QWebInspector is associated to this page, it should be
+    visible to the user after this signal has been emitted.
+
+    If still no QWebInspector is associated to this QWebPage after the emission
+    of this signal, a privately owned inspector will be shown to the user.
+
+    \note \a inspectedElement contains the QWebElement under the context menu.
+    It is not garanteed to be the same as the focused element in the web
+    inspector.
+
+    \sa QWebInspector
+*/
+
+/*!
     \fn void QWebPage::toolBarVisibilityChangeRequested(bool visible)
 
     This signal is emitted whenever the visibility of the toolbar in a web browser
@@ -2986,6 +3396,16 @@ quint64 QWebPage::bytesReceived() const
 */
 
 /*!
+  \since 4.6
+  \fn void QWebPage::networkRequestStarted(QWebFrame* frame, QNetworkRequest* request);
+  \preliminary
+
+  This signal is emitted when a \a frame of the current page requests a web resource. The application
+  may want to associate the \a request with the \a frame that initiated it by storing the \a frame
+  as an attribute of the \a request.
+*/
+
+/*!
   \fn QWebPagePrivate* QWebPage::handle() const
   \internal
 */
diff --git a/WebKit/qt/Api/qwebpage.h b/WebKit/qt/Api/qwebpage.h
index 24741a1..d77656c 100644
--- a/WebKit/qt/Api/qwebpage.h
+++ b/WebKit/qt/Api/qwebpage.h
@@ -25,18 +25,19 @@
 #include "qwebkitglobal.h"
 
 #include <QtCore/qobject.h>
+#include <QtCore/qurl.h>
 #include <QtGui/qwidget.h>
 
 QT_BEGIN_NAMESPACE
 class QNetworkProxy;
 class QUndoStack;
-class QUrl;
 class QMenu;
 class QNetworkRequest;
 class QNetworkReply;
 class QNetworkAccessManager;
 QT_END_NAMESPACE
 
+class QWebElement;
 class QWebFrame;
 class QWebNetworkRequest;
 class QWebHistory;
@@ -55,6 +56,7 @@ namespace WebCore {
     class InspectorClientQt;
     class ResourceHandle;
     class HitTestResult;
+    class QNetworkReplyHandler;
 
     struct FrameLoadRequest;
 }
@@ -265,7 +267,8 @@ public:
     QMenu *createStandardContextMenu();
 
     enum Extension {
-        ChooseMultipleFilesExtension
+        ChooseMultipleFilesExtension,
+        ErrorPageExtension
     };
     class ExtensionOption
     {};
@@ -283,6 +286,26 @@ public:
         QStringList fileNames;
     };
 
+    enum ErrorDomain { QtNetwork, Http, WebKit };
+    class ErrorPageExtensionOption : public ExtensionOption {
+    public:
+        QUrl url;
+        QWebFrame* frame;
+        ErrorDomain domain;
+        int error;
+        QString errorString;
+    };
+
+    class ErrorPageExtensionReturn : public ExtensionReturn {
+    public:
+        ErrorPageExtensionReturn() : contentType(QLatin1String("text/html")), encoding(QLatin1String("utf-8")) {};
+        QString contentType;
+        QString encoding;
+        QUrl baseUrl;
+        QByteArray content;
+    };
+
+
     virtual bool extension(Extension extension, const ExtensionOption *option = 0, ExtensionReturn *output = 0);
     virtual bool supportsExtension(Extension extension) const;
 
@@ -306,6 +329,7 @@ Q_SIGNALS:
     void windowCloseRequested();
     void printRequested(QWebFrame *frame);
     void linkClicked(const QUrl &url);
+    void webInspectorTriggered(const QWebElement& inspectedElement);
 
     void toolBarVisibilityChangeRequested(bool visible);
     void statusBarVisibilityChangeRequested(bool visible);
@@ -323,6 +347,8 @@ Q_SIGNALS:
     void saveFrameStateRequested(QWebFrame* frame, QWebHistoryItem* item);
     void restoreFrameStateRequested(QWebFrame* frame);
 
+    void networkRequestStarted(QWebFrame* frame, QNetworkRequest* request);
+
 protected:
     virtual QWebPage *createWindow(WebWindowType type);
     virtual QObject *createPlugin(const QString &classid, const QUrl &url, const QStringList &paramNames, const QStringList &paramValues);
@@ -343,19 +369,21 @@ protected:
 private:
     Q_PRIVATE_SLOT(d, void _q_onLoadProgressChanged(int))
     Q_PRIVATE_SLOT(d, void _q_webActionTriggered(bool checked))
-#ifndef NDEBUG
     Q_PRIVATE_SLOT(d, void _q_cleanupLeakMessages())
-#endif
+
     QWebPagePrivate *d;
 
     friend class QWebFrame;
     friend class QWebPagePrivate;
     friend class QWebView;
+    friend class QGraphicsWebView;
+    friend class QWebInspector;
     friend class WebCore::ChromeClientQt;
     friend class WebCore::EditorClientQt;
     friend class WebCore::FrameLoaderClientQt;
     friend class WebCore::InspectorClientQt;
     friend class WebCore::ResourceHandle;
+    friend class WebCore::QNetworkReplyHandler;
 };
 
 Q_DECLARE_OPERATORS_FOR_FLAGS(QWebPage::FindFlags)
diff --git a/WebKit/qt/Api/qwebpage_p.h b/WebKit/qt/Api/qwebpage_p.h
index 87c624d..b9571fa 100644
--- a/WebKit/qt/Api/qwebpage_p.h
+++ b/WebKit/qt/Api/qwebpage_p.h
@@ -25,6 +25,7 @@
 #include <qnetworkproxy.h>
 #include <qpointer.h>
 #include <qevent.h>
+#include <qgraphicssceneevent.h>
 
 #include "qwebpage.h"
 #include "qwebhistory.h"
@@ -42,21 +43,10 @@ namespace WebCore {
     class ContextMenu;
     class EditorClientQt;
     class Element;
+    class InspectorController;
     class Node;
     class Page;
     class Frame;
-
-#ifndef QT_NO_CURSOR
-    class SetCursorEvent : public QEvent {
-    public:
-        static const int EventType = 724;
-        SetCursorEvent(const QCursor&);
-
-        QCursor cursor() const;
-    private:
-        QCursor m_cursor;
-    };
-#endif
 }
 
 QT_BEGIN_NAMESPACE
@@ -65,6 +55,9 @@ class QMenu;
 class QBitArray;
 QT_END_NAMESPACE
 
+class QWebInspector;
+class QWebPageClient;
+
 class QWebPagePrivate {
 public:
     QWebPagePrivate(QWebPage*);
@@ -75,9 +68,7 @@ public:
 #endif
     void _q_onLoadProgressChanged(int);
     void _q_webActionTriggered(bool checked);
-#ifndef NDEBUG
     void _q_cleanupLeakMessages();
-#endif
     void updateAction(QWebPage::WebAction action);
     void updateNavigationActions();
     void updateEditorActions();
@@ -85,32 +76,48 @@ public:
     void timerEvent(QTimerEvent*);
 
     void mouseMoveEvent(QMouseEvent*);
+    void mouseMoveEvent(QGraphicsSceneMouseEvent*);
     void mousePressEvent(QMouseEvent*);
+    void mousePressEvent(QGraphicsSceneMouseEvent*);
     void mouseDoubleClickEvent(QMouseEvent*);
+    void mouseDoubleClickEvent(QGraphicsSceneMouseEvent*);
     void mouseTripleClickEvent(QMouseEvent*);
+    void mouseTripleClickEvent(QGraphicsSceneMouseEvent*);
     void mouseReleaseEvent(QMouseEvent*);
+    void mouseReleaseEvent(QGraphicsSceneMouseEvent*);
 #ifndef QT_NO_CONTEXTMENU
-    void contextMenuEvent(QContextMenuEvent*);
+    void contextMenuEvent(const QPoint& globalPos);
 #endif
 #ifndef QT_NO_WHEELEVENT
     void wheelEvent(QWheelEvent*);
+    void wheelEvent(QGraphicsSceneWheelEvent*);
 #endif
     void keyPressEvent(QKeyEvent*);
     void keyReleaseEvent(QKeyEvent*);
     void focusInEvent(QFocusEvent*);
     void focusOutEvent(QFocusEvent*);
 
-    void dragEnterEvent(QDragEnterEvent *);
-    void dragLeaveEvent(QDragLeaveEvent *);
-    void dragMoveEvent(QDragMoveEvent *);
-    void dropEvent(QDropEvent *);
+    void dragEnterEvent(QDragEnterEvent*);
+    void dragEnterEvent(QGraphicsSceneDragDropEvent*);
+    void dragLeaveEvent(QDragLeaveEvent*);
+    void dragLeaveEvent(QGraphicsSceneDragDropEvent*);
+    void dragMoveEvent(QDragMoveEvent*);
+    void dragMoveEvent(QGraphicsSceneDragDropEvent*);
+    void dropEvent(QDropEvent*);
+    void dropEvent(QGraphicsSceneDragDropEvent*);
 
     void inputMethodEvent(QInputMethodEvent*);
 
     void shortcutOverrideEvent(QKeyEvent*);
-    void leaveEvent(QEvent *);
+    void leaveEvent(QEvent*);
+    void handleClipboard(QEvent*, Qt::MouseButton);
+    void handleSoftwareInputPanel(Qt::MouseButton);
     bool handleScrolling(QKeyEvent*, WebCore::Frame*);
 
+    void setInspector(QWebInspector*);
+    QWebInspector* getOrCreateInspector();
+    WebCore::InspectorController* inspectorController();
+
 #ifndef QT_NO_SHORTCUT
     static QWebPage::WebAction editorActionForKeyEvent(QKeyEvent* event);
 #endif
@@ -124,10 +131,11 @@ public:
     QPointer<QWebFrame> mainFrame;
 
     QWebPage *q;
+    QWebPageClient* client;
 #ifndef QT_NO_UNDOSTACK
     QUndoStack *undoStack;
 #endif
-    QWidget *view;
+    QWidget* view;
 
     bool insideOpenCall;
     quint64 m_totalBytes;
@@ -136,6 +144,8 @@ public:
     QPoint tripleClick;
     QBasicTimer tripleClickTimer;
 
+    bool clickCausedFocus;
+
 #if QT_VERSION < 0x040400
     bool acceptNavigationRequest(QWebFrame *frame, const QWebNetworkRequest &request, QWebPage::NavigationType type);
 
@@ -168,6 +178,10 @@ public:
 
     QWebPluginFactory *pluginFactory;
 
+    QWidget* inspectorFrontend;
+    QWebInspector* inspector;
+    bool inspectorIsInternalOnly; // True if created through the Inspect context menu action
+
     static bool drtRun;
 };
 
diff --git a/WebKit/qt/Api/qwebplugindatabase.cpp b/WebKit/qt/Api/qwebplugindatabase.cpp
index 8758c60..623895f 100644
--- a/WebKit/qt/Api/qwebplugindatabase.cpp
+++ b/WebKit/qt/Api/qwebplugindatabase.cpp
@@ -19,7 +19,6 @@
 
 #include "config.h"
 #include "qwebplugindatabase.h"
-#include "qwebplugindatabase_p.h"
 
 #include "PluginDatabase.h"
 #include "PluginPackage.h"
@@ -32,16 +31,6 @@ using namespace WebCore;
     \brief Represents a single MIME type supported by a plugin.
 */
 
-QWebPluginInfoPrivate::QWebPluginInfoPrivate(RefPtr<PluginPackage> pluginPackage)
-    : plugin(pluginPackage)
-{
-}
-
-QWebPluginDatabasePrivate::QWebPluginDatabasePrivate(PluginDatabase* pluginDatabase)
-    : database(pluginDatabase)
-{
-}
-
 /*!
     \class QWebPluginInfo
     \since 4.6
@@ -64,21 +53,25 @@ QWebPluginDatabasePrivate::QWebPluginDatabasePrivate(PluginDatabase* pluginDatab
     Constructs a null QWebPluginInfo.
 */
 QWebPluginInfo::QWebPluginInfo()
-    : d(new QWebPluginInfoPrivate(0))
+    : m_package(0)
 {
 }
 
-QWebPluginInfo::QWebPluginInfo(PluginPackage* plugin)
-    : d(new QWebPluginInfoPrivate(plugin))
+QWebPluginInfo::QWebPluginInfo(PluginPackage* package)
+    : m_package(package)
 {
+    if (m_package)
+        m_package->ref();
 }
 
 /*!
     Contructs a copy of \a other.
 */
 QWebPluginInfo::QWebPluginInfo(const QWebPluginInfo& other)
-    : d(new QWebPluginInfoPrivate(other.d->plugin))
+    : m_package(other.m_package)
 {
+    if (m_package)
+        m_package->ref();
 }
 
 /*!
@@ -86,7 +79,8 @@ QWebPluginInfo::QWebPluginInfo(const QWebPluginInfo& other)
 */
 QWebPluginInfo::~QWebPluginInfo()
 {
-    delete d;
+    if (m_package)
+        m_package->deref();
 }
 
 /*!
@@ -96,9 +90,9 @@ QWebPluginInfo::~QWebPluginInfo()
 */
 QString QWebPluginInfo::name() const
 {
-    if (!d->plugin)
+    if (!m_package)
         return QString();
-    return d->plugin->name();
+    return m_package->name();
 }
 
 /*!
@@ -108,9 +102,9 @@ QString QWebPluginInfo::name() const
 */
 QString QWebPluginInfo::description() const
 {
-    if (!d->plugin)
+    if (!m_package)
         return QString();
-    return d->plugin->description();
+    return m_package->description();
 }
 
 /*!
@@ -120,28 +114,27 @@ QString QWebPluginInfo::description() const
 */
 QList<QWebPluginInfo::MimeType> QWebPluginInfo::mimeTypes() const
 {
-    if (!d->plugin)
-        return QList<MimeType>();
+    if (m_package && m_mimeTypes.isEmpty()) {
+        const MIMEToDescriptionsMap& mimeToDescriptions = m_package->mimeToDescriptions();
+        MIMEToDescriptionsMap::const_iterator end = mimeToDescriptions.end();
 
-    QList<MimeType> mimeTypes;
-    const MIMEToDescriptionsMap& mimeToDescriptions = d->plugin->mimeToDescriptions();
-    MIMEToDescriptionsMap::const_iterator end = mimeToDescriptions.end();
-    for (MIMEToDescriptionsMap::const_iterator it = mimeToDescriptions.begin(); it != end; ++it) {
-        MimeType mimeType;
-        mimeType.name = it->first;
-        mimeType.description = it->second;
+        for (MIMEToDescriptionsMap::const_iterator it = mimeToDescriptions.begin(); it != end; ++it) {
+            MimeType mimeType;
+            mimeType.name = it->first;
+            mimeType.description = it->second;
 
-        QStringList fileExtensions;
-        Vector<String> extensions = d->plugin->mimeToExtensions().get(mimeType.name);
+            QStringList fileExtensions;
+            Vector<String> extensions = m_package->mimeToExtensions().get(mimeType.name);
 
-        for (unsigned i = 0; i < extensions.size(); ++i)
-            fileExtensions.append(extensions[i]);
+            for (unsigned i = 0; i < extensions.size(); ++i)
+                fileExtensions.append(extensions[i]);
 
-        mimeType.fileExtensions = fileExtensions;
-        mimeTypes.append(mimeType);
+            mimeType.fileExtensions = fileExtensions;
+            m_mimeTypes.append(mimeType);
+        }
     }
 
-    return mimeTypes;
+    return m_mimeTypes;
 }
 
 /*!
@@ -152,13 +145,9 @@ QList<QWebPluginInfo::MimeType> QWebPluginInfo::mimeTypes() const
 */
 bool QWebPluginInfo::supportsMimeType(const QString& mimeType) const
 {
-    QList<MimeType> types = mimeTypes();
-    foreach (const MimeType& type, types) {
-        if (type.name == mimeType)
-            return true;
-    }
-
-    return false;
+    if (!m_package)
+        return false;
+    return m_package->mimeToDescriptions().contains(mimeType);
 }
 
 /*!
@@ -166,9 +155,9 @@ bool QWebPluginInfo::supportsMimeType(const QString& mimeType) const
 */
 QString QWebPluginInfo::path() const
 {
-    if (!d->plugin)
+    if (!m_package)
         return QString();
-    return d->plugin->path();
+    return m_package->path();
 }
 
 /*!
@@ -176,7 +165,7 @@ QString QWebPluginInfo::path() const
 */
 bool QWebPluginInfo::isNull() const
 {
-    return !d->plugin;
+    return !m_package;
 }
 
 /*!
@@ -189,9 +178,9 @@ bool QWebPluginInfo::isNull() const
 */
 void QWebPluginInfo::setEnabled(bool enabled)
 {
-    if (!d->plugin)
+    if (!m_package)
         return;
-    d->plugin->setEnabled(enabled);
+    m_package->setEnabled(enabled);
 }
 
 /*!
@@ -201,27 +190,43 @@ void QWebPluginInfo::setEnabled(bool enabled)
 */
 bool QWebPluginInfo::isEnabled() const
 {
-    if (!d->plugin)
+    if (!m_package)
         return false;
-    return d->plugin->isEnabled();
+    return m_package->isEnabled();
 }
 
+/*!
+    Returns true if this plugin info is the same as the \a other plugin info.
+*/
 bool QWebPluginInfo::operator==(const QWebPluginInfo& other) const
 {
-    return d->plugin == other.d->plugin;
+    return m_package == other.m_package;
 }
 
+/*!
+    Returns true if this plugin info is different from the \a other plugin info.
+*/
 bool QWebPluginInfo::operator!=(const QWebPluginInfo& other) const
 {
-    return d->plugin != other.d->plugin;
+    return m_package != other.m_package;
 }
 
+/*!
+    Assigns the \a other plugin info to this plugin info, and returns a reference
+    to this plugin info.
+*/
 QWebPluginInfo &QWebPluginInfo::operator=(const QWebPluginInfo& other)
 {
     if (this == &other)
         return *this;
 
-    d->plugin = other.d->plugin;
+    if (m_package)
+        m_package->deref();
+    m_package = other.m_package;
+    if (m_package)
+        m_package->ref();
+    m_mimeTypes = other.m_mimeTypes;
+
     return *this;
 }
 
@@ -253,13 +258,12 @@ QWebPluginInfo &QWebPluginInfo::operator=(const QWebPluginInfo& other)
 
 QWebPluginDatabase::QWebPluginDatabase(QObject* parent)
     : QObject(parent)
-    , d(new QWebPluginDatabasePrivate(PluginDatabase::installedPlugins()))
+    , m_database(PluginDatabase::installedPlugins())
 {
 }
 
 QWebPluginDatabase::~QWebPluginDatabase()
 {
-    delete d;
 }
 
 /*!
@@ -273,7 +277,7 @@ QWebPluginDatabase::~QWebPluginDatabase()
 QList<QWebPluginInfo> QWebPluginDatabase::plugins() const
 {
     QList<QWebPluginInfo> qwebplugins;
-    const Vector<PluginPackage*>& plugins = d->database->plugins();
+    const Vector<PluginPackage*>& plugins = m_database->plugins();
 
     for (unsigned int i = 0; i < plugins.size(); ++i) {
         PluginPackage* plugin = plugins[i];
@@ -308,7 +312,7 @@ QStringList QWebPluginDatabase::searchPaths() const
 {
     QStringList paths;
 
-    const Vector<String>& directories = d->database->pluginDirectories();
+    const Vector<String>& directories = m_database->pluginDirectories();
     for (unsigned int i = 0; i < directories.size(); ++i)
         paths.append(directories[i]);
 
@@ -325,12 +329,12 @@ void QWebPluginDatabase::setSearchPaths(const QStringList& paths)
 {
     Vector<String> directories;
 
-    for (unsigned int i = 0; i < paths.count(); ++i)
+    for (int i = 0; i < paths.count(); ++i)
         directories.append(paths.at(i));
 
-    d->database->setPluginDirectories(directories);
+    m_database->setPluginDirectories(directories);
     // PluginDatabase::setPluginDirectories() does not refresh the database.
-    d->database->refresh();
+    m_database->refresh();
 }
 
 /*!
@@ -341,7 +345,7 @@ void QWebPluginDatabase::setSearchPaths(const QStringList& paths)
 */
 void QWebPluginDatabase::addSearchPath(const QString& path)
 {
-    d->database->addExtraPluginDirectory(path);
+    m_database->addExtraPluginDirectory(path);
     // PluginDatabase::addExtraPluginDirectory() does refresh the database.
 }
 
@@ -355,7 +359,7 @@ void QWebPluginDatabase::addSearchPath(const QString& path)
 */
 void QWebPluginDatabase::refresh()
 {
-    d->database->refresh();
+    m_database->refresh();
 }
 
 /*!
@@ -365,7 +369,7 @@ void QWebPluginDatabase::refresh()
 */
 QWebPluginInfo QWebPluginDatabase::pluginForMimeType(const QString& mimeType)
 {
-    return QWebPluginInfo(d->database->pluginForMIMEType(mimeType));
+    return QWebPluginInfo(m_database->pluginForMIMEType(mimeType));
 }
 
 /*!
@@ -378,5 +382,5 @@ QWebPluginInfo QWebPluginDatabase::pluginForMimeType(const QString& mimeType)
 */
 void QWebPluginDatabase::setPreferredPluginForMimeType(const QString& mimeType, const QWebPluginInfo& plugin)
 {
-    d->database->setPreferredPluginForMIMEType(mimeType, plugin.d->plugin.get());
+    m_database->setPreferredPluginForMIMEType(mimeType, plugin.m_package);
 }
diff --git a/WebKit/qt/Api/qwebplugindatabase.h b/WebKit/qt/Api/qwebplugindatabase.h
index 4b50119..b22c3de 100644
--- a/WebKit/qt/Api/qwebplugindatabase.h
+++ b/WebKit/qt/Api/qwebplugindatabase.h
@@ -27,6 +27,7 @@
 #include <QtCore/qstringlist.h>
 
 namespace WebCore {
+    class PluginDatabase;
     class PluginPackage;
 }
 
@@ -39,7 +40,7 @@ public:
     ~QWebPluginInfo();
 
 private:
-    QWebPluginInfo(WebCore::PluginPackage* plugin);
+    QWebPluginInfo(WebCore::PluginPackage* package);
 
 public:
     typedef QWebPluginFactory::MimeType MimeType;
@@ -61,7 +62,9 @@ public:
     friend class QWebPluginDatabase;
 
 private:
-    QWebPluginInfoPrivate *d;
+    QWebPluginInfoPrivate* d;
+    WebCore::PluginPackage* m_package;
+    mutable QList<MimeType> m_mimeTypes;
 };
 
 class QWebPluginDatabasePrivate;
@@ -88,7 +91,8 @@ public:
     friend class QWebSettings;
 
 private:
-    QWebPluginDatabasePrivate *d;
+    QWebPluginDatabasePrivate* d;
+    WebCore::PluginDatabase* m_database;
 };
 
 #endif // QWEBPLUGINDATABASE_H
diff --git a/WebKit/qt/Api/qwebpluginfactory.cpp b/WebKit/qt/Api/qwebpluginfactory.cpp
index 7a8cabe..8ff13b1 100644
--- a/WebKit/qt/Api/qwebpluginfactory.cpp
+++ b/WebKit/qt/Api/qwebpluginfactory.cpp
@@ -26,6 +26,8 @@
     \brief The QWebPluginFactory class creates plugins to be embedded into web
     pages.
 
+    \inmodule QtWebKit
+
     QWebPluginFactory is a factory for creating plugins for QWebPage. A plugin
     factory can be installed on a QWebPage using QWebPage::setPluginFactory().
 
@@ -47,6 +49,8 @@
     \class QWebPluginFactory::Plugin
     \since 4.4
     \brief the QWebPluginFactory::Plugin structure describes the properties of a plugin a QWebPluginFactory can create.
+
+    \inmodule QtWebKit
 */
 
 /*!
@@ -68,8 +72,13 @@
     \class QWebPluginFactory::MimeType
     \since 4.4
     \brief The QWebPluginFactory::MimeType structure describes a mime type supported by a plugin.
+
+    \inmodule QtWebKit
 */
 
+/*!
+    Returns true if this mimetype is the same as the \a other mime type.
+*/
 bool QWebPluginFactory::MimeType::operator==(const MimeType& other) const
 {
     return name == other.name
@@ -78,6 +87,12 @@ bool QWebPluginFactory::MimeType::operator==(const MimeType& other) const
 }
 
 /*!
+    \fn bool QWebPluginFactory::MimeType::operator!=(const MimeType& other) const
+
+    Returns true if this mimetype is different from the \a other mime type.
+*/
+
+/*!
     \variable QWebPluginFactory::MimeType::name
 
     The full name of the MIME type; e.g., \c{text/plain} or \c{image/png}.
@@ -143,7 +158,7 @@ void QWebPluginFactory::refreshPlugins()
     For example:
 
     \code
-    <object type="application/x-pdf" data="http://qtsoftware.com/document.pdf" width="500" height="400">
+    <object type="application/x-pdf" data="http://qt.nokia.com/document.pdf" width="500" height="400">
         <param name="showTableOfContents" value="true" />
         <param name="hideThumbnails" value="false" />
     </object>
@@ -156,7 +171,7 @@ void QWebPluginFactory::refreshPlugins()
     \row    \o mimeType
             \o "application/x-pdf"
     \row    \o url
-            \o "http://qtsoftware.com/document.pdf"
+            \o "http://qt.nokia.com/document.pdf"
     \row    \o argumentNames
             \o "showTableOfContents" "hideThumbnails"
     \row    \o argumentVaues
@@ -180,6 +195,8 @@ void QWebPluginFactory::refreshPlugins()
     \since 4.4
     \brief The ExtensionOption class provides an extended input argument to QWebPluginFactory's extension support.
 
+    \inmodule QtWebKit
+
     \sa QWebPluginFactory::extension()
 */
 
@@ -188,6 +205,8 @@ void QWebPluginFactory::refreshPlugins()
     \since 4.4
     \brief The ExtensionOption class provides an extended output argument to QWebPluginFactory's extension support.
 
+    \inmodule QtWebKit
+
     \sa QWebPluginFactory::extension()
 */
 
diff --git a/WebKit/qt/Api/qwebsecurityorigin.cpp b/WebKit/qt/Api/qwebsecurityorigin.cpp
index d2eaf10..7c44e37 100644
--- a/WebKit/qt/Api/qwebsecurityorigin.cpp
+++ b/WebKit/qt/Api/qwebsecurityorigin.cpp
@@ -35,6 +35,8 @@ using namespace WebCore;
     \since 4.5
     \brief The QWebSecurityOrigin class defines a security boundary for web sites.
 
+    \inmodule QtWebKit
+
     QWebSecurityOrigin provides access to the security domains defined by web sites.
     An origin consists of a host name, a scheme, and a port number. Web sites
     with the same security origin can access each other's resources for client-side
@@ -198,3 +200,60 @@ QList<QWebDatabase> QWebSecurityOrigin::databases() const
     return databases;
 }
 
+/*!
+    \since 4.6
+
+    Adds the given \a scheme to the list of schemes that are considered equivalent
+    to the \c file: scheme. They are not subject to cross domain restrictions.
+*/
+void QWebSecurityOrigin::addLocalScheme(const QString& scheme)
+{
+    SecurityOrigin::registerURLSchemeAsLocal(scheme);
+}
+
+/*!
+    \since 4.6
+
+    Removes the given \a scheme from the list of local schemes.
+
+    \sa addLocalScheme()
+*/
+void QWebSecurityOrigin::removeLocalScheme(const QString& scheme)
+{
+    SecurityOrigin::removeURLSchemeRegisteredAsLocal(scheme);
+}
+
+/*!
+    \since 4.6
+    Returns a list of all the schemes that were set by the application as local schemes,
+    \sa addLocalScheme(), removeLocalScheme()
+*/
+QStringList QWebSecurityOrigin::localSchemes()
+{
+    QStringList list;
+    const URLSchemesMap& map = SecurityOrigin::localURLSchemes();
+    URLSchemesMap::const_iterator end = map.end();
+    for (URLSchemesMap::const_iterator i = map.begin(); i != end; ++i) {
+        const QString scheme = *i;
+        list.append(scheme);
+    }
+    return list;
+}
+
+/*!
+    \since 4.6
+    \internal
+*/
+void QWebSecurityOrigin::whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains)
+{
+    SecurityOrigin::whiteListAccessFromOrigin(*SecurityOrigin::createFromString(sourceOrigin), destinationProtocol, destinationHost, allowDestinationSubdomains);
+}
+
+/*!
+    \since 4.6
+    \internal
+*/
+void QWebSecurityOrigin::resetOriginAccessWhiteLists()
+{
+    SecurityOrigin::resetOriginAccessWhiteLists();
+}
diff --git a/WebKit/qt/Api/qwebsecurityorigin.h b/WebKit/qt/Api/qwebsecurityorigin.h
index 3cfb0f4..94b96f0 100644
--- a/WebKit/qt/Api/qwebsecurityorigin.h
+++ b/WebKit/qt/Api/qwebsecurityorigin.h
@@ -37,6 +37,11 @@ class QWebFrame;
 class QWEBKIT_EXPORT QWebSecurityOrigin {
 public:
     static QList<QWebSecurityOrigin> allOrigins();
+    static void addLocalScheme(const QString& scheme);
+    static void removeLocalScheme(const QString& scheme);
+    static QStringList localSchemes();
+    static void whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains);
+    static void resetOriginAccessWhiteLists();
 
     ~QWebSecurityOrigin();
 
diff --git a/WebKit/qt/Api/qwebsettings.cpp b/WebKit/qt/Api/qwebsettings.cpp
index 47b2818..abd7036 100644
--- a/WebKit/qt/Api/qwebsettings.cpp
+++ b/WebKit/qt/Api/qwebsettings.cpp
@@ -37,7 +37,11 @@
 #include "IntSize.h"
 #include "ApplicationCacheStorage.h"
 #include "DatabaseTracker.h"
+#include "FileSystem.h"
 
+#include <QApplication>
+#include <QDesktopServices>
+#include <QDir>
 #include <QHash>
 #include <QSharedData>
 #include <QUrl>
@@ -55,7 +59,7 @@ public:
     QHash<int, bool> attributes;
     QUrl userStyleSheetLocation;
     QString defaultTextEncoding;
-    QString localStorageDatabasePath;
+    QString localStoragePath;
     QString offlineWebApplicationCachePath;
     qint64 offlineStorageDefaultQuota;
 
@@ -167,8 +171,8 @@ void QWebSettingsPrivate::apply()
         QString encoding = !defaultTextEncoding.isEmpty() ? defaultTextEncoding: global->defaultTextEncoding;
         settings->setDefaultTextEncodingName(encoding);
 
-        QString localStoragePath = !localStorageDatabasePath.isEmpty() ? localStorageDatabasePath : global->localStorageDatabasePath;
-        settings->setLocalStorageDatabasePath(localStoragePath);
+        QString storagePath = !localStoragePath.isEmpty() ? localStoragePath : global->localStoragePath;
+        settings->setLocalStorageDatabasePath(storagePath);
 
         value = attributes.value(QWebSettings::ZoomTextOnly,
                                  global->attributes.value(QWebSettings::ZoomTextOnly));
@@ -186,13 +190,18 @@ void QWebSettingsPrivate::apply()
                                       global->attributes.value(QWebSettings::OfflineWebApplicationCacheEnabled));
         settings->setOfflineWebApplicationCacheEnabled(value);
 
-        value = attributes.value(QWebSettings::LocalStorageDatabaseEnabled,
-                                      global->attributes.value(QWebSettings::LocalStorageDatabaseEnabled));
+        value = attributes.value(QWebSettings::LocalStorageEnabled,
+                                      global->attributes.value(QWebSettings::LocalStorageEnabled));
+                                                                                                                                  
         settings->setLocalStorageEnabled(value);
 
         value = attributes.value(QWebSettings::LocalContentCanAccessRemoteUrls,
                                       global->attributes.value(QWebSettings::LocalContentCanAccessRemoteUrls));
         settings->setAllowUniversalAccessFromFileURLs(value);
+
+        value = attributes.value(QWebSettings::SessionStorageEnabled,
+                                    global->attributes.value(QWebSettings::SessionStorageEnabled));
+        settings->setSessionStorageEnabled(value);
     } else {
         QList<QWebSettingsPrivate*> settings = *::allSettings();
         for (int i = 0; i < settings.count(); ++i)
@@ -220,6 +229,8 @@ QWebSettings* QWebSettings::globalSettings()
     \brief The QWebSettings class provides an object to store the settings used
     by QWebPage and QWebFrame.
 
+    \inmodule QtWebKit
+
     Each QWebPage object has its own QWebSettings object, which configures the
     settings for that page. If a setting is not configured, then it is looked
     up in the global settings object, which can be accessed using
@@ -302,6 +313,8 @@ QWebSettings* QWebSettings::globalSettings()
 
     \value AutoLoadImages Specifies whether images are automatically loaded in
         web pages.
+    \value DnsPrefetchEnabled Specifies whether QtWebkit will try to pre-fetch DNS entries to
+        speed up browsing. This only works as a global attribute. Only for Qt 4.6 and later.
     \value JavascriptEnabled Enables or disables the running of JavaScript
         programs.
     \value JavaEnabled Enables or disables Java applets.
@@ -314,8 +327,9 @@ QWebSettings* QWebSettings::globalSettings()
     \value JavascriptCanAccessClipboard Specifies whether JavaScript programs
         can read or write to the clipboard.
     \value DeveloperExtrasEnabled Enables extra tools for Web developers.
-        Currently this enables the "Inspect" element in the context menu,
-    which shows the WebKit WebInspector for web site debugging.
+        Currently this enables the "Inspect" element in the context menu as
+        well as the use of QWebInspector which controls the WebKit WebInspector
+        for web site debugging.
     \value LinksIncludedInFocusChain Specifies whether hyperlinks should be
         included in the keyboard focus chain.
     \value ZoomTextOnly Specifies whether the zoom factor on a frame applies to
@@ -323,12 +337,14 @@ QWebSettings* QWebSettings::globalSettings()
     \value PrintElementBackgrounds Specifies whether the background color and images
         are also drawn when the page is printed.
     \value OfflineStorageDatabaseEnabled Specifies whether support for the HTML 5
-        offline storage feature is enabled or not.
+        offline storage feature is enabled or not. Disabled by default.
     \value OfflineWebApplicationCacheEnabled Specifies whether support for the HTML 5
-        web application cache feature is enabled or not.
-    \value LocalStorageDatabaseEnabled Specifies whether support for the HTML 5
-        local storage feature is enabled or not.
+        web application cache feature is enabled or not. Disabled by default.
+    \value LocalStorageEnabled Specifies whether support for the HTML 5
+        local storage feature is enabled or not. Disabled by default.
     \value LocalContentCanAccessRemoteUrls Specifies whether locally loaded documents are allowed to access remote urls.
+    \value SessionStorageEnabled Specifies whether support for the HTML 5
+        session storage feature is enabled or not. Enabled by default.                
 */
 
 /*!
@@ -340,8 +356,8 @@ QWebSettings::QWebSettings()
     // Initialize our global defaults
     d->fontSizes.insert(QWebSettings::MinimumFontSize, 0);
     d->fontSizes.insert(QWebSettings::MinimumLogicalFontSize, 0);
-    d->fontSizes.insert(QWebSettings::DefaultFontSize, 14);
-    d->fontSizes.insert(QWebSettings::DefaultFixedFontSize, 14);
+    d->fontSizes.insert(QWebSettings::DefaultFontSize, 16);
+    d->fontSizes.insert(QWebSettings::DefaultFixedFontSize, 13);
     d->fontFamilies.insert(QWebSettings::StandardFont, QLatin1String("Arial"));
     d->fontFamilies.insert(QWebSettings::FixedFont, QLatin1String("Courier New"));
     d->fontFamilies.insert(QWebSettings::SerifFont, QLatin1String("Times New Roman"));
@@ -350,14 +366,16 @@ QWebSettings::QWebSettings()
     d->fontFamilies.insert(QWebSettings::FantasyFont, QLatin1String("Arial"));
 
     d->attributes.insert(QWebSettings::AutoLoadImages, true);
+    d->attributes.insert(QWebSettings::DnsPrefetchEnabled, false);
     d->attributes.insert(QWebSettings::JavascriptEnabled, true);
     d->attributes.insert(QWebSettings::LinksIncludedInFocusChain, true);
     d->attributes.insert(QWebSettings::ZoomTextOnly, false);
     d->attributes.insert(QWebSettings::PrintElementBackgrounds, true);
-    d->attributes.insert(QWebSettings::OfflineStorageDatabaseEnabled, true);
-    d->attributes.insert(QWebSettings::OfflineWebApplicationCacheEnabled, true);
-    d->attributes.insert(QWebSettings::LocalStorageDatabaseEnabled, true);
-    d->attributes.insert(QWebSettings::LocalContentCanAccessRemoteUrls, true);
+    d->attributes.insert(QWebSettings::OfflineStorageDatabaseEnabled, false);
+    d->attributes.insert(QWebSettings::OfflineWebApplicationCacheEnabled, false);
+    d->attributes.insert(QWebSettings::LocalStorageEnabled, false);
+    d->attributes.insert(QWebSettings::LocalContentCanAccessRemoteUrls, false);
+    d->attributes.insert(QWebSettings::SessionStorageEnabled, true);
     d->offlineStorageDefaultQuota = 5 * 1024 * 1024;
 }
 
@@ -422,7 +440,10 @@ void QWebSettings::resetFontSize(FontSize type)
 /*!
     Specifies the location of a user stylesheet to load with every web page.
 
-    The \a location can be a URL or a path on the local filesystem.
+    The \a location must be either a path on the local filesystem, or a data URL
+    with UTF-8 and Base64 encoded data, such as:
+
+    "data:text/css;charset=utf-8;base64,cCB7IGJhY2tncm91bmQtY29sb3I6IHJlZCB9Ow==;"
 
     \sa userStyleSheetUrl()
 */
@@ -607,17 +628,20 @@ void QWebSettings::clearMemoryCaches()
     // Invalidating the font cache and freeing all inactive font data.
     WebCore::fontCache()->invalidate();
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    // Empty the application cache.
-    WebCore::cacheStorage().empty();
-#endif
-
     // Empty the Cross-Origin Preflight cache
     WebCore::CrossOriginPreflightResultCache::shared().empty();
 }
 
 /*!
-    Sets the maximum number of pages to hold in the memory cache to \a pages.
+    Sets the maximum number of pages to hold in the memory page cache to \a pages.
+
+    The Page Cache allows for a nicer user experience when navigating forth or back
+    to pages in the forward/back history, by pausing and resuming up to \a pages
+    per page group.
+
+    For more information about the feature, please refer to:
+
+    http://webkit.org/blog/427/webkit-page-cache-i-the-basics/
 */
 void QWebSettings::setMaximumPagesInCache(int pages)
 {
@@ -867,37 +891,71 @@ qint64 QWebSettings::offlineWebApplicationCacheQuota()
 #endif
 }
 
-/*
-    \since 4.5
+/*!
+    \since 4.6
     \relates QWebSettings
 
-    Sets the path for HTML5 local storage databases to \a path.
-
-    \a path must point to an existing directory where the cache is stored.
-
-    Setting an empty path disables the feature.
+    Sets the path for HTML5 local storage to \a path.
+    
+    For more information on HTML5 local storage see the
+    \l{http://www.w3.org/TR/webstorage/#the-localstorage-attribute}{Web Storage standard}.
+    
+    Support for local storage can enabled by setting the
+    \l{QWebSettings::LocalStorageEnabled}{LocalStorageEnabled} attribute.     
 
-    \sa localStorageDatabasePath()
+    \sa localStoragePath()
 */
-void QWEBKIT_EXPORT qt_websettings_setLocalStorageDatabasePath(QWebSettings* settings, const QString& path)
+void QWebSettings::setLocalStoragePath(const QString& path)
 {
-    QWebSettingsPrivate* d = settings->handle();
-    d->localStorageDatabasePath = path;
+    d->localStoragePath = path;
     d->apply();
 }
 
-/*
-    \since 4.5
+/*!
+    \since 4.6
     \relates QWebSettings
 
-    Returns the path for HTML5 local storage databases
-    or an empty string if the feature is disabled.
+    Returns the path for HTML5 local storage.
+    
+    \sa setLocalStoragePath()
+*/
+QString QWebSettings::localStoragePath() const
+{
+    return d->localStoragePath;
+}
 
-    \sa setLocalStorageDatabasePath()
+/*!
+    \since 4.6
+    \relates QWebSettings
+
+    Enables WebKit persistent data and sets the path to \a path.
+    If the \a path is empty the path for persistent data is set to the 
+    user-specific data location specified by 
+    \l{QDesktopServices::DataLocation}{DataLocation}.
+    
+    \sa localStoragePath()
 */
-QString QWEBKIT_EXPORT qt_websettings_localStorageDatabasePath(QWebSettings* settings)
+void QWebSettings::enablePersistentStorage(const QString& path)
 {
-    return settings->handle()->localStorageDatabasePath;
+    QString storagePath;
+
+    if (path.isEmpty()) {
+        storagePath = QDesktopServices::storageLocation(QDesktopServices::DataLocation);
+
+        if (storagePath.isEmpty())
+            storagePath = WebCore::pathByAppendingComponent(QDir::homePath(), QCoreApplication::applicationName());
+    } else
+        storagePath = path;
+
+    WebCore::makeAllDirectories(storagePath);
+
+    QWebSettings::setIconDatabasePath(storagePath);
+    QWebSettings::setOfflineWebApplicationCachePath(storagePath);
+    QWebSettings::setOfflineStoragePath(WebCore::pathByAppendingComponent(storagePath, "Databases"));
+    QWebSettings::globalSettings()->setLocalStoragePath(WebCore::pathByAppendingComponent(storagePath, "LocalStorage"));
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::LocalStorageEnabled, true);
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::OfflineStorageDatabaseEnabled, true);
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::OfflineWebApplicationCacheEnabled, true);
 }
 
 /*!
diff --git a/WebKit/qt/Api/qwebsettings.h b/WebKit/qt/Api/qwebsettings.h
index b7ea54b..4790823 100644
--- a/WebKit/qt/Api/qwebsettings.h
+++ b/WebKit/qt/Api/qwebsettings.h
@@ -62,8 +62,13 @@ public:
         PrintElementBackgrounds,
         OfflineStorageDatabaseEnabled,
         OfflineWebApplicationCacheEnabled,
-        LocalStorageDatabaseEnabled,
-        LocalContentCanAccessRemoteUrls
+        LocalStorageEnabled,
+#ifdef QT_DEPRECATED
+        LocalStorageDatabaseEnabled = LocalStorageEnabled,
+#endif
+        LocalContentCanAccessRemoteUrls,
+        SessionStorageEnabled,
+        DnsPrefetchEnabled
     };
     enum WebGraphic {
         MissingImageGraphic,
@@ -121,9 +126,14 @@ public:
     static QString offlineWebApplicationCachePath();
     static void setOfflineWebApplicationCacheQuota(qint64 maximumSize);
     static qint64 offlineWebApplicationCacheQuota();
+    
+    void setLocalStoragePath(const QString& path);
+    QString localStoragePath() const; 
 
     static void clearMemoryCaches();
 
+    static void enablePersistentStorage(const QString& path = QString());
+
     inline QWebSettingsPrivate* handle() const { return d; }
 
 private:
diff --git a/WebKit/qt/Api/qwebview.cpp b/WebKit/qt/Api/qwebview.cpp
index e1a0c98..ce8b923 100644
--- a/WebKit/qt/Api/qwebview.cpp
+++ b/WebKit/qt/Api/qwebview.cpp
@@ -20,6 +20,8 @@
 
 #include "config.h"
 #include "qwebview.h"
+
+#include "QWebPageClient.h"
 #include "qwebframe.h"
 #include "qwebpage_p.h"
 
@@ -29,46 +31,91 @@
 #include "qprinter.h"
 #include "qdir.h"
 #include "qfile.h"
+#if defined(Q_WS_X11)
+#include <QX11Info>
+#endif
 
-class QWebViewPrivate {
+class QWebViewPrivate : public QWebPageClient {
 public:
     QWebViewPrivate(QWebView *view)
         : view(view)
         , page(0)
         , renderHints(QPainter::TextAntialiasing)
+    {
+        Q_ASSERT(view);
+    }
+
+    virtual void scroll(int dx, int dy, const QRect&);
+    virtual void update(const QRect& dirtyRect);
+
 #ifndef QT_NO_CURSOR
-        , cursorSetByWebCore(false)
-        , usesWebCoreCursor(true)
+    virtual QCursor cursor() const;
+    virtual void updateCursor(const QCursor& cursor);
 #endif
-    {}
+
+    virtual int screenNumber() const;
+    virtual WId winId() const;
+
+    virtual QObject* pluginParent() const;
+
+    void _q_pageDestroyed();
 
     QWebView *view;
     QWebPage *page;
 
     QPainter::RenderHints renderHints;
+};
+
+void QWebViewPrivate::scroll(int dx, int dy, const QRect& rectToScroll)
+{
+    view->scroll(qreal(dx), qreal(dy), rectToScroll);
+}
+
+void QWebViewPrivate::update(const QRect & dirtyRect)
+{
+    view->update(dirtyRect);
+}
 
 #ifndef QT_NO_CURSOR
-    /*
-     * We keep track of if we have called setCursor and if the CursorChange
-     * event is sent due our setCursor call and if we currently use the WebCore
-     * Cursor and use it to decide if we can update to another WebCore Cursor.
-     */
-    bool cursorSetByWebCore;
-    bool usesWebCoreCursor;
-
-    void setCursor(const QCursor& newCursor)
-    {
-        webCoreCursor = newCursor;
+QCursor QWebViewPrivate::cursor() const
+{
+    return view->cursor();
+}
 
-        if (usesWebCoreCursor) {
-            cursorSetByWebCore = true;
-            view->setCursor(webCoreCursor);
-        }
-    }
+void QWebViewPrivate::updateCursor(const QCursor& cursor)
+{
+    view->setCursor(cursor);
+}
+#endif
 
-    QCursor webCoreCursor;
+int QWebViewPrivate::screenNumber() const
+{
+#if defined(Q_WS_X11)
+    if (view)
+        return view->x11Info().screen();
 #endif
-};
+
+    return 0;
+}
+
+WId QWebViewPrivate::winId() const
+{
+    if (view)
+        return view->winId();
+
+    return 0;
+}
+
+QObject* QWebViewPrivate::pluginParent() const
+{
+    return view;
+}
+
+void QWebViewPrivate::_q_pageDestroyed()
+{
+    page = 0;
+    view->setPage(0);
+}
 
 /*!
     \class QWebView
@@ -77,6 +124,8 @@ public:
     web documents.
     \ingroup advanced
 
+    \inmodule QtWebKit
+
     QWebView is the main widget component of the QtWebKit web browsing module.
     It can be used in various applications to display web content live from the
     Internet.
@@ -160,7 +209,7 @@ QWebView::QWebView(QWidget *parent)
 {
     d = new QWebViewPrivate(this);
 
-#if !defined(Q_WS_QWS)
+#if !defined(Q_WS_QWS) && !defined(Q_OS_SYMBIAN)
     setAttribute(Qt::WA_InputMethodEnabled);
 #endif
 
@@ -211,6 +260,7 @@ void QWebView::setPage(QWebPage* page)
     if (d->page == page)
         return;
     if (d->page) {
+        d->page->d->client = 0; // unset the page client
         if (d->page->parent() == this)
             delete d->page;
         else
@@ -219,6 +269,7 @@ void QWebView::setPage(QWebPage* page)
     d->page = page;
     if (d->page) {
         d->page->setView(this);
+        d->page->d->client = d; // set the page client
         d->page->setPalette(palette());
         // #### connect signals
         QWebFrame *mainFrame = d->page->mainFrame();
@@ -242,6 +293,8 @@ void QWebView::setPage(QWebPage* page)
 
         connect(d->page, SIGNAL(microFocusChanged()),
                 this, SLOT(updateMicroFocus()));
+        connect(d->page, SIGNAL(destroyed()),
+                this, SLOT(_q_pageDestroyed()));
     }
     setAttribute(Qt::WA_OpaquePaintEvent, d->page);
     update();
@@ -608,6 +661,7 @@ qreal QWebView::textSizeMultiplier() const
     return page()->mainFrame()->textSizeMultiplier();
 }
 
+#if !defined(Q_OS_SYMBIAN)
 /*!
     \property QWebView::renderHints
     \since 4.6
@@ -619,6 +673,7 @@ qreal QWebView::textSizeMultiplier() const
 
     \sa QPainter::renderHints()
 */
+#endif
 QPainter::RenderHints QWebView::renderHints() const
 {
     return d->renderHints;
@@ -694,19 +749,18 @@ bool QWebView::event(QEvent *e)
         if (e->type() == QEvent::ShortcutOverride) {
             d->page->event(e);
 #ifndef QT_NO_CURSOR
-        } else if (e->type() == static_cast<QEvent::Type>(WebCore::SetCursorEvent::EventType)) {
-            d->setCursor(static_cast<WebCore::SetCursorEvent*>(e)->cursor());
 #if QT_VERSION >= 0x040400
         } else if (e->type() == QEvent::CursorChange) {
-            // Okay we might use the WebCore Cursor now.
-            d->usesWebCoreCursor = d->cursorSetByWebCore;
-            d->cursorSetByWebCore = false;
-
-            // Go back to the WebCore Cursor. QWidget::unsetCursor is appromixated with this
-            if (!d->usesWebCoreCursor && cursor().shape() == Qt::ArrowCursor) {
-                d->usesWebCoreCursor = true;
-                d->setCursor(d->webCoreCursor);
-            }
+            // An unsetCursor will set the cursor to Qt::ArrowCursor.
+            // Thus this cursor change might be a QWidget::unsetCursor()
+            // If this is not the case and it came from WebCore, the
+            // QWebPageClient already has set its cursor internally
+            // to Qt::ArrowCursor, so updating the cursor is always
+            // right, as it falls back to the last cursor set by
+            // WebCore.
+            // FIXME: Add a QEvent::CursorUnset or similar to Qt.
+            if (cursor().shape() == Qt::ArrowCursor)
+                d->resetCursor();
 #endif
 #endif
         } else if (e->type() == QEvent::Leave)
@@ -1094,3 +1148,6 @@ void QWebView::changeEvent(QEvent *e)
 
     \sa QWebPage::linkDelegationPolicy()
 */
+
+#include "moc_qwebview.cpp"
+
diff --git a/WebKit/qt/Api/qwebview.h b/WebKit/qt/Api/qwebview.h
index e886144..15b5836 100644
--- a/WebKit/qt/Api/qwebview.h
+++ b/WebKit/qt/Api/qwebview.h
@@ -50,7 +50,14 @@ class QWEBKIT_EXPORT QWebView : public QWidget {
     //Q_PROPERTY(Qt::TextInteractionFlags textInteractionFlags READ textInteractionFlags WRITE setTextInteractionFlags)
     Q_PROPERTY(qreal textSizeMultiplier READ textSizeMultiplier WRITE setTextSizeMultiplier DESIGNABLE false)
     Q_PROPERTY(qreal zoomFactor READ zoomFactor WRITE setZoomFactor)
+
+// FIXME: temporary work around for elftran issue that it couldn't find the QPainter::staticMetaObject
+// symbol from Qt lib; it should be reverted after the right symbol is exported.  
+// remember to revert the qdoc \property comment as well.
+// See bug: http://qt.nokia.com/developer/task-tracker/index_html?method=entry&id=258893
+#if !defined(Q_OS_SYMBIAN)
     Q_PROPERTY(QPainter::RenderHints renderHints READ renderHints WRITE setRenderHints)
+#endif
     Q_FLAGS(QPainter::RenderHints)
 public:
     explicit QWebView(QWidget* parent = 0);
@@ -162,6 +169,7 @@ protected:
 private:
     friend class QWebPage;
     QWebViewPrivate* d;
+    Q_PRIVATE_SLOT(d, void _q_pageDestroyed())
 };
 
 #endif // QWEBVIEW_H
diff --git a/WebKit/qt/ChangeLog b/WebKit/qt/ChangeLog
index 6b05b18..5aff018 100644
--- a/WebKit/qt/ChangeLog
+++ b/WebKit/qt/ChangeLog
@@ -1,3 +1,1689 @@
+2009-10-08  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Part of testOptionalJSObjects autotest was marked as "expect to fail".
+
+        Two places in tst_QWebPage::testOptionalJSObjects were marked as
+        expected to fail. The problem concern checking if a feature is enabled
+        or disabled. According to discussion on webkit dev mailing list
+        a disabled feature should be invisible from java script level, but
+        there are exceptions from the rule. So we decided to disable the test
+        for now.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29867
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::testOptionalJSObjects):
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        Move the policy callback to the policy object.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callPolicyFunction):
+
+2009-10-07  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Get rid of useless loadFailed signal in QGraphicsWebView
+        https://bugs.webkit.org/show_bug.cgi?id=30166
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::_q_doLoadFinished):
+        * Api/qgraphicswebview.h:
+        * QGVLauncher/main.cpp:
+        (MainWindow::init):
+        (MainWindow::loadFinished):
+
+2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Add a simple rotation effect to QGVLauncher
+
+        https://bugs.webkit.org/show_bug.cgi?id=30162
+
+        * QGVLauncher/main.cpp:
+        (MainView::animatedFlip):
+        (MainWindow::animatedFlip):
+        (MainWindow::buildUI):
+
+2009-10-07  Volker Hilsheimer  <volker.hilsheimer@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Doc: Document HTML and status as properties.
+
+        * Api/qgraphicswebview.cpp:
+
+2009-10-07  Martin Smith  <msmith@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix qdoc warning about disabled renderHints property
+        on Symbian.
+
+        * Api/qwebview.cpp:
+        * Api/qwebview.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        Call the new API.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+
+2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Reviewed by Ariya Hidayat.
+        
+        When the drag data contains an image set it on the QDrag so it will be visible to the user.
+        
+        * WebCoreSupport/DragClientQt.cpp:
+        (WebCore::DragClientQt::startDrag):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::createPage):
+
+2009-10-06  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] don't enable input methods on Symbian by default.
+        https://bugs.webkit.org/show_bug.cgi?id=30117
+
+        If input methods are enabled Symbian FEP will be launched on every
+        pointer event making webpage navigation impossible with QWebView.
+
+        * Api/qwebview.cpp:
+        (QWebView::QWebView):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        QtLauncher: print the number of loaded urls
+        
+        When using the -r mode print the number of URLs loaded so far. This
+        is extremly useful when opening the same URL over and over again and
+        one wants to see the progress.
+
+        * QtLauncher/main.cpp:
+        (URLLoader::URLLoader):
+        (URLLoader::loadNext):
+
+2009-10-05  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Add screenshot option to menubar
+
+        https://bugs.webkit.org/show_bug.cgi?id=30067
+
+        * QtLauncher/main.cpp:
+        (MainWindow::screenshot):
+        (MainWindow::setupUI):
+
+2009-10-05  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Setting the env QTLAUNCHER_USE_ARGB_VISUALS makes Qt use WA_TranslucentWindow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30068
+
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+
+2009-10-05  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Simon Hausmann.
+
+        Add documentation to the ErrorPageExtension.
+
+        * Api/qwebpage.cpp:
+
+2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Inform the application when a new request is created
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        Add a signal to QWebPage, to inform the application when a request is created.
+
+        * Api/qwebpage.cpp:
+        * Api/qwebpage.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::loadFinished):
+
+2009-10-05  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        ErrorPageExtension: Add a pointer to the QWebFrame that had
+        an error.
+
+        * Api/qwebpage.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+
+2009-10-05  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Do not empty the offline web appcache when clearing
+        memory caches. That one is not in memory, but stored
+        in sqlite.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::clearMemoryCaches):
+
+2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added QGraphicsWidget-plugins support to FrameLoaderClientQt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29710
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::pluginParent):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::pluginParent):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::):
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Unreview build fix.  I wish I had a try server...
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::updateAction):
+
+2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
+        Otherwise, it is inconsistent with class declaration of QCursor.
+
+        * Api/qgraphicswebview.cpp:
+        * Api/qwebview.cpp:
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compiler warnings about unused function arguments.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::scrollBarMinimum):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::focusInEvent):
+        (QWebPagePrivate::focusOutEvent):
+        (QWebPagePrivate::leaveEvent):
+        (QWebPage::javaScriptAlert):
+        (QWebPage::javaScriptConfirm):
+        (QWebPage::javaScriptPrompt):
+        (QWebPage::triggerAction):
+        (QWebPage::acceptNavigationRequest):
+        (QWebPage::chooseFile):
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::repaint):
+        (WebCore::ChromeClientQt::mouseDidMoveOverElement):
+        (WebCore::ChromeClientQt::reachedMaxAppCacheSize):
+        * WebCoreSupport/ContextMenuClientQt.cpp:
+        (WebCore::ContextMenuClientQt::downloadURL):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchWillPerformClientRedirect):
+        (WebCore::FrameLoaderClientQt::setMainFrameDocumentReady):
+        (WebCore::FrameLoaderClientQt::representationExistsForURLScheme):
+        (WebCore::FrameLoaderClientQt::generatedMIMETypeForURLScheme):
+        (WebCore::FrameLoaderClientQt::shouldGoToHistoryItem):
+        (WebCore::FrameLoaderClientQt::pluginWillHandleLoadError):
+        (WebCore::FrameLoaderClientQt::assignIdentifierToInitialRequest):
+        (WebCore::FrameLoaderClientQt::dispatchDidFinishLoading):
+        (WebCore::FrameLoaderClientQt::createJavaAppletWidget):
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::setAttachedWindowHeight):
+        (WebCore::InspectorClientQt::highlight):
+        (WebCore::InspectorClientQt::removeSetting):
+
+2009-10-01  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make Software Input Panel requests work with QGraphicsWebView
+        _and_ QWebView by sharing the event code in handleSoftwareInputPanel().
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::mouseReleaseEvent):
+        (QWebPagePrivate::handleSoftwareInputPanel):
+        * Api/qwebpage_p.h:
+
+2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebGraphicsItem to QGraphicsWebView
+
+        * Api/headers.pri:
+        * Api/qwebpage.h:
+        * Api/qwebgraphicsitem.cpp: Renamed.
+        * Api/qwebgraphicsitem.h: Renamed.
+        * WebKit/qt/QGVLauncher/main.cpp:
+        * tests/tests.pro:
+        * tests/qwebgraphicsitem/qwebgraphicsitem.pro: Renamed.
+        * tests/qwebgraphicsitem/tst_qwebgraphicsitem.cpp: Renamed.
+
+2009-10-01  Antonio Gomes   <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29248
+        [Qt] [API] Make it possible to have 'invisible' loads
+
+        Make QWebFrame's setHtml and setContent methods to not change
+        session and global history at all.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::setHtml):
+        (QWebFrame::setContent):
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-10-01  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fixed software input panel support on web input elements.
+
+        Send the RequestSoftwareInputPanel event if the element supports focus
+        and the element is clicked.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        (QWebPagePrivate::mousePressEvent):
+        (QWebPagePrivate::mouseReleaseEvent):
+        * Api/qwebpage_p.h:
+
+2009-10-01  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Implementation for QWebPage::inputMethodQuery and QWebPagePrivate::inputMethodEvent
+
+        https://bugs.webkit.org/show_bug.cgi?id=29681
+
+        Some additional changes from Kristian Amlie <kristian.amlie@nokia.com>:
+
+            * Fixed surrounding text to exclude preedit string
+            * Avoid emission of microFocusChanged during setComposition()
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::inputMethodEvent):
+        (QWebPage::inputMethodQuery):
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::respondToChangedSelection):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
+2009-09-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Add the failed URL to the ErrorPageExtension, as it is quite
+        useful for creating error pages.
+
+        * Api/qwebpage.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+
+2009-09-29  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Default font size reconciliation to 16px/13px to match other platform's de-facto standard.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=19674.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2009-09-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29844
+
+        QWebPage dependency autotest fix.
+
+        Fix for database() autotest. All opened databases should be removed at
+        end of test.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::database):
+
+2009-09-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Some QWebHistory and QWebPage autotest crash fixes.
+
+        Some checking for m_mainFrame were added. MainFrame should be created
+        at some point of QWebPage live cicle.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29803
+
+        * Api/qwebpage.cpp:
+        (QWebPage::~QWebPage):
+        (QWebPage::currentFrame):
+        (QWebPage::history):
+        (QWebPage::selectedText):
+        (QWebPage::updatePositionDependentActions):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::crashTests_LazyInitializationOfMainFrame):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann and Tor Arne Vestbø.
+
+        Implement QWebPage Extension for error pages, incl.
+        an example on how to use it in QtLauncher.
+
+        Correct our use of ResourceError.
+
+        * Api/qwebpage.h:
+        (ExtensionOption::):
+        (ExtensionOption::ErrorPageExtensionReturn::ErrorPageExtensionReturn):
+        * QtLauncher/main.cpp:
+        (WebPage::supportsExtension):
+        (MainWindow::MainWindow):
+        (MainWindow::selectElements):
+        (WebPage::extension):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::cancelledError):
+        (WebCore::FrameLoaderClientQt::blockedError):
+        (WebCore::FrameLoaderClientQt::cannotShowURLError):
+        (WebCore::FrameLoaderClientQt::interruptForPolicyChangeError):
+        (WebCore::FrameLoaderClientQt::cannotShowMIMETypeError):
+        (WebCore::FrameLoaderClientQt::fileDoesNotExistError):
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+        (WebCore::FrameLoaderClientQt::dispatchDidFailProvisionalLoad):
+        (WebCore::FrameLoaderClientQt::dispatchDidFailLoad):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-09-28  Andre Poenitz  <andre.poenitz@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compile fix with namespaced Qt.
+
+        * Api/qwebinspector_p.h:
+
+2009-09-27  Joe Ligman  <joseph.ligman@mindspring.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Adding API setFocus and hasFocus to QWebElement. This API is needed for
+        clients that want to check/set the focus node of the document.
+        https://bugs.webkit.org/show_bug.cgi?id=29682
+
+        * Api/qwebelement.cpp:
+        (QWebElement::hasFocus):
+        (QWebElement::setFocus):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::hasSetFocus):
+
+2009-09-25  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make tst_qwebframe work if Qt built without SSL support
+        https://bugs.webkit.org/show_bug.cgi?id=29735
+
+        * tests/qwebframe/tst_qwebframe.cpp: Missing #ifndef blocks added.
+
+2009-09-24  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update QWebElement API to remove script related methods.
+        QWebElement::evaluateScript is the only one kept, these are
+        removed to postpone most of the QtWebKit<->JavaScript API design
+        after 4.6.
+        https://bugs.webkit.org/show_bug.cgi?id=29708
+
+        * Api/qwebelement.cpp:
+        * Api/qwebelement.h:
+        Methods removed:
+        - QWebElement::callFunction
+        - QWebElement::functions
+        - QWebElement::scriptableProperty
+        - QWebElement::setScriptableProperty
+        - QWebElement::scriptableProperties
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::evaluateScript):
+
+2009-09-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Rename QWebElement::evaluateScript
+        to QWebElement::evaluateJavaScript.
+        https://bugs.webkit.org/show_bug.cgi?id=29709
+
+        * Api/qwebelement.cpp:
+        (QWebElement::evaluateJavaScript):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::evaluateJavaScript):
+
+2009-09-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update the stypeProperty API of QWebElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29711
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+        - Merge the stypeProperty and the computedStyleProperty methods
+        - Remove the default value for the style resolving enum
+        - Rename ResolveRule to StyleResolveStrategy
+        (QWebElement::setStyleProperty):
+        - Remove the priority argument since it is possible to control the
+          behaviour by adding !important or removing in the value.
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::style):
+        (tst_QWebElement::computedStyle):
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Reviewed by Alice Liu.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        Pass 0 for new Page constructor argument.
+
+2009-09-24  Martin Smith  <msmith@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        qdoc: Added \brief texts to all the since 4.6 functions.
+
+        * Api/qwebhistory.cpp:
+
+2009-09-23  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Prevent QWebPage::setView() from changing the viewport size on the fly
+        in case the view doesn't actually change. QWebPage::setView() is
+        called upon every QWebGraphicsItem::hoverMoveEvent(), which forced
+        the viewport size to be equal to the size of the whole graphics view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29676
+
+        * Api/qwebpage.cpp:
+        (QWebPage::setView):
+
+2009-09-23  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Crash fix in QWebHistory back and forward methods.
+        
+        QWebHistory::back() and QWebHistory::forward() were crashing on
+        ASSERT in WebCore::BackForwardList. The methods should check
+        canGoBack() and canGoForward() at the beginning.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29675
+
+        * Api/qwebhistory.cpp:
+        (QWebHistory::back):
+        (QWebHistory::forward):
+
+2009-09-23  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Bug fix. QWebHistory should call QWebPage::updateNavigationActions
+        
+        In QWebHistory's methods that change item count or current item call
+        to QWebPage::updateNavigationActions should be executed.
+        QWebHistory::clear() and QWebHistory::restorState() were changed.
+        New helper method, QWebPagePrivate accesor, were created in
+        QWebHistoryPrivate class.
+        Two autotest were developed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29246
+
+        * Api/qwebhistory.cpp:
+        (QWebHistory::clear):
+        (QWebHistory::restoreState):
+        (QWebHistoryPrivate::page):
+        * Api/qwebhistory_p.h:
+        * tests/qwebhistory/tst_qwebhistory.cpp:
+        (tst_QWebHistory::saveAndRestore_1):
+        (tst_QWebHistory::clear):
+
+2009-09-23  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Need to guard QX11Info include with Q_WS_X11.
+        That class may not be available (in QT 4.5 for Symbian, for instance).
+        Completes fixes in r48627 and r48604.
+
+        * Api/qwebgraphicsitem.cpp:
+        * Api/qwebview.cpp:
+
+2009-09-22  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add default timeout while waiting for signals in QWebPage auto
+        tests.
+        https://bugs.webkit.org/show_bug.cgi?id=29637
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (waitForSignal):
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reivewed by Simon Hausmann.
+
+        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)
+
+        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
+        takes a QWidget*, not a QWebPageClient*
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItemPrivate::screenNumber):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::screenNumber):
+
+2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        For Qt, platformPageClient() will now return a class derived from
+        the QWebPageClient, so the patch adapts our Qt hooks to go though
+        this class and not depend on the QWebView.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItemPrivate::scroll):
+        (QWebGraphicsItemPrivate::update):
+        (QWebGraphicsItemPrivate::cursor):
+        (QWebGraphicsItemPrivate::updateCursor):
+        (QWebGraphicsItemPrivate::screenNumber):
+        (QWebGraphicsItemPrivate::winId):
+        (QWebGraphicsItem::event):
+        (QWebGraphicsItem::setPage):
+        * Api/qwebgraphicsitem.h:
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        * Api/qwebpage_p.h:
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::scroll):
+        (QWebViewPrivate::update):
+        (QWebViewPrivate::cursor):
+        (QWebViewPrivate::updateCursor):
+        (QWebViewPrivate::screenNumber):
+        (QWebViewPrivate::winId):
+        (QWebView::setPage):
+        (QWebView::event):
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::repaint):
+        (WebCore::ChromeClientQt::scroll):
+        (WebCore::ChromeClientQt::platformPageClient):
+
+2009-09-21  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29609
+        Build fix for windows when using Qt 4.5.0.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::userAgentForUrl):
+
+2009-09-19  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29345
+        The tests of QWebFrame did not use QTRY_VERIFY for
+        tests involving the event loop.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+        * tests/util.h: Added. Copy of tests/shared/util.h of Qt
+
+2009-09-19  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add an autotest stub for QWebGraphicsItem.
+
+        It just calls all the functions and makes sure they don't crash.
+
+        * tests/qwebgraphicsitem/qwebgraphicsitem.pro: Added.
+        * tests/qwebgraphicsitem/tst_qwebgraphicsitem.cpp: Added.
+        (tst_QWebGraphicsItem::qwebgraphicsitem):
+        * tests/tests.pro:
+
+2009-09-18  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Corrected the Symbian specific UID3 values to be assigned
+        from the "unprotected" pool that permits self-signing of
+        those test and demo executables. (Added new UID3 values
+        where they were missing for new components.)
+
+        * QGVLauncher/QGVLauncher.pro:
+        * QtLauncher/QtLauncher.pro:
+        * tests/benchmarks/loading/tst_loading.pro:
+        * tests/benchmarks/painting/tst_painting.pro:
+        * tests/qwebelement/qwebelement.pro:
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebhistory/qwebhistory.pro:
+        * tests/qwebhistoryinterface/qwebhistoryinterface.pro:
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebplugindatabase/qwebplugindatabase.pro:
+        * tests/qwebview/qwebview.pro:
+
+2009-09-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Reflect the rename of platformWindow and it's return type.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::platformPageClient):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add persistence support for configuration options in the
+        inspector.
+
+        * Api/qwebinspector.cpp:
+        * QtLauncher/main.cpp:
+        (main):
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::populateSetting):
+        (WebCore::InspectorClientQt::storeSetting):
+        (WebCore::variantToSetting):
+        (WebCore::settingToVariant):
+
+2009-09-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fixed a bunch of documentation warnings.
+
+        * Api/qwebgraphicsitem.cpp:
+        * Api/qwebplugindatabase.cpp:
+        * Api/qwebpluginfactory.cpp:
+        * Api/qwebsecurityorigin.cpp:
+
+2009-09-18  Warwick Allison  <warwick.allison@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added a test that console output works.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (ConsolePage::ConsolePage):
+        (ConsolePage::javaScriptConsoleMessage):
+        (tst_QWebPage::consoleOutput):
+
+2009-09-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Improve documentation for Page Cache.
+
+        * Api/qwebsettings.cpp:
+
+2009-09-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update QWebSettings::setUserStyleSheetUrl() docs and test
+
+        https://bugs.webkit.org/show_bug.cgi?id=29081
+
+        The documentation now specifies that the URL has to be a local file
+        or a a data-URL (with utf-8 and base64-encoded data), as these are the
+        only two schemes that the current code path accepts.
+
+        The auto-test has been updated to reflect this limitation.
+
+        At a later point we should concider adding API for the new way of
+        doing both user defined stylesheets and scripts.
+
+        * Api/qwebsettings.cpp:
+        * tests/qwebpage/tst_qwebpage.cpp:
+
+2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian build fix.
+
+        Moved the #ifdefs around _q_cleanupLeakMessages() into the function
+        definition.
+
+        QMake is not being able to distinguish between release and debug builds
+        in Symbian build. This is a Symbian toolchain issue.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::_q_cleanupLeakMessages):
+        * Api/qwebpage.h:
+        * Api/qwebpage_p.h:
+
+2009-09-17  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Small cosmetic documentation fixlet in the QWebInspector.
+
+        * Api/qwebinspector.cpp:
+
+2009-09-16  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Detect and add Windows7 properly to the user agent.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::userAgentForUrl):
+
+2009-09-16  Andras Becsi  <andrewbecsi@yahoo.co.uk>
+
+        Rubberstamped by Kenneth Christiansen.
+
+        [Qt] Build fix for previous changes.
+
+        * QGVLauncher/main.cpp:
+        (MainView::flip):
+
+2009-09-16  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed potential Qt < 4.6 build fix.
+
+        * QGVLauncher/main.cpp:
+        (MainView::flip):
+
+2009-09-16  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add a "Flip effect" to our GraphicsView based launcher.
+
+        * QGVLauncher/main.cpp:
+        (MainView::resizeEvent):
+        (MainView::flip):
+        (MainWindow::flip):
+        (MainWindow::buildUI):
+
+2009-09-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Typo fix. Pass the window object to the Format
+        menu. In this way Qt can free its internal graphical
+        objects during exit.
+
+        * QtLauncher/main.cpp:
+        (MainWindow::setupUI):
+
+2009-09-16  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build break fix on gcc ARM.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItemPrivate::_q_doLoadProgress):
+
+2009-09-16  Warwick Allison  <warwick.allison@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix a crash in QWebFrame::hasFocus() with a simple null pointer check
+        when the focused frame is null. We do the same check in other places
+        where we call kit().
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::hasFocus):
+
+2009-09-16  Jure Repinc  <jlp@holodeck1.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fixed a typo found during translation.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::interruptForPolicyChangeError):
+
+2009-09-14  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QWebGraphicsItem should check for null QWebPage.
+        https://bugs.webkit.org/show_bug.cgi?id=29185
+
+        Don't crash in QWebGraphicsItem when the page is still null, by
+        either checking if it's the case or constructing the default one.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItem::icon):
+        (QWebGraphicsItem::setZoomFactor):
+        (QWebGraphicsItem::zoomFactor):
+        (QWebGraphicsItem::setGeometry):
+        (QWebGraphicsItem::load):
+        (QWebGraphicsItem::setHtml):
+        (QWebGraphicsItem::toHtml):
+        (QWebGraphicsItem::setContent):
+        (QWebGraphicsItem::history):
+        (QWebGraphicsItem::settings):
+
+2009-09-11  David Boddie  <dboddie@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Doc: Note that Netscape plugins are only available on desktop platforms.
+
+        * docs/qtwebkit.qdoc:
+
+2009-09-11  Martin Smith  <msmith@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Adjust the name of the contentspage for the documentation
+        to the new name used in Qt 4.6.
+
+        * docs/qtwebkit.qdoc:
+
+2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
+        renaming.
+
+        * Api/qwebpluginfactory.cpp:
+        * docs/webkitsnippets/simple/main.cpp:
+        (main):
+        * docs/webkitsnippets/webpage/main.cpp:
+        (main):
+
+2009-09-11  Volker Hilsheimer  <volker.hilsheimer@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Restructure the documentation, both on a file and on a content level.
+
+        * Api/qwebdatabase.cpp:
+        * Api/qwebelement.cpp:
+        * Api/qwebframe.cpp:
+        * Api/qwebhistory.cpp:
+        * Api/qwebhistoryinterface.cpp:
+        * Api/qwebpage.cpp:
+        * Api/qwebpluginfactory.cpp:
+        * Api/qwebsecurityorigin.cpp:
+        * Api/qwebsettings.cpp:
+        * Api/qwebview.cpp:
+        * docs/qtwebkit.qdoc:
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29136
+        [Qt] emit microFocusChanged() signal when no QWidget-based view is present.
+
+        emit microFocusChange() signal regardless of view.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::setInputMethodState):
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28806
+
+        [Qt] Make the WebInspector available as a QWidget.
+
+        * Api/headers.pri:
+        * Api/qwebelement.cpp:
+        (QWebElement::enclosingElement):
+        * Api/qwebelement.h:
+        * Api/qwebinspector.cpp: Added.
+        * Api/qwebinspector.h: Added.
+        * Api/qwebinspector_p.h: Added.
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        (QWebPagePrivate::setInspector):
+        (QWebPagePrivate::getOrCreateInspector):
+        (QWebPagePrivate::inspectorController):
+        (QWebPage::~QWebPage):
+        (QWebPage::triggerAction):
+        * Api/qwebpage.h:
+        * Api/qwebpage_p.h:
+        * Api/qwebsettings.cpp:
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientWebPage::InspectorClientWebPage):
+        (WebCore::InspectorClientWebPage::createWindow):
+        (WebCore::InspectorClientQt::createPage):
+        (WebCore::InspectorClientQt::showWindow):
+        (WebCore::InspectorClientQt::closeWindow):
+        (WebCore::InspectorClientQt::attachWindow):
+        (WebCore::InspectorClientQt::detachWindow):
+        (WebCore::InspectorClientQt::updateWindowTitle):
+        * WebCoreSupport/InspectorClientQt.h:
+        * docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp: Added.
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix comparison between signed and unsigned integer warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29162
+
+        No functional change.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::findAll):
+        * Api/qwebhistory.cpp:
+        (QWebHistory::items):
+        (QWebHistory::backItems):
+        (QWebHistory::forwardItems):
+        (QWebHistory::saveState):
+        * Api/qwebplugindatabase.cpp:
+        (QWebPluginDatabase::setSearchPaths):
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::runOpenPanel):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2009-09-10  Simon Hausmann  <hausmann@webkit.org>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Fix a bunch of qdoc warnings: Invalid references, non-standard
+        wording, etc.
+
+        * Api/qwebelement.cpp:
+        * Api/qwebgraphicsitem.cpp:
+        * Api/qwebsecurityorigin.cpp:
+
+2009-09-10  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix context menu event delivery with QWebGraphicsItem.
+
+        Re-implement the correct context menu virtual function using
+        a QGraphicsSceneContextMenuEvent and forward & handle it in
+        QWebPage.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItem::contextMenuEvent):
+        * Api/qwebgraphicsitem.h:
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::contextMenuEvent):
+        (QWebPage::event):
+        * Api/qwebpage_p.h:
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        Build fix for QtWebKit for Mac after r48219.
+
+        qevent and qstyleoption are QtGui interfaces.
+
+        * Api/qwebgraphicsitem.cpp:
+        * Api/qwebgraphicsitem.h:
+
+2009-09-09  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Call the right base class function QGraphicsWidget::event() instead
+        of skipping it and using QObject::event() instead.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItem::event):
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed.
+
+        Fix comment at Tor Arne Vestbø's request.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItem::sceneEvent):
+        (QWebGraphicsItem::event):
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Implement some virtual event methods so that we can fix
+        event-related bugs in Qt patch releases.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItem::sceneEvent):
+        (QWebGraphicsItem::event):
+        * Api/qwebgraphicsitem.h:
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>, Antonio Gomes  <antonio.gomes@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add a new QGraphicsWidget based version of the "QWebView"
+        under the name "QWebGraphicsItem".
+
+        https://bugs.webkit.org/show_bug.cgi?id=28862
+
+        Includes an alternative Qt launcher using the QGraphicsView.
+
+        * Api/headers.pri:
+        * Api/qwebgraphicsitem.cpp: Added.
+        * Api/qwebgraphicsitem.h: Added.
+        * Api/qwebpage.h:
+        * QGVLauncher/QGVLauncher.pro: Copied from WebKit/qt/QtLauncher/QtLauncher.pro.
+        * QGVLauncher/main.cpp: Added.
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::repaint):
+        (WebCore::ChromeClientQt::scroll):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed build fix.
+
+        Potential build fix for Qt 4.5
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::mousePressEvent):
+
+2009-09-08  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29007
+        Add a test for the signal QWebFrame::javaScriptWindowObjectCleared()
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix unused variable warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29018
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::keyPressEvent):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::startDownload):
+        (WebCore::FrameLoaderClientQt::createFrame):
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Use the declaration order in initializer lists
+        https://bugs.webkit.org/show_bug.cgi?id=29017
+
+        * Api/qwebframe_p.h:
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for handling QGraphicsScene events.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::mouseMoveEvent):
+        (QWebPagePrivate::mousePressEvent):
+        (QWebPagePrivate::mouseDoubleClickEvent):
+        (QWebPagePrivate::mouseTripleClickEvent):
+        (QWebPagePrivate::handleClipboard):
+        (QWebPagePrivate::mouseReleaseEvent):
+        (QWebPagePrivate::wheelEvent):
+        (QWebPagePrivate::dragEnterEvent):
+        (QWebPagePrivate::dragLeaveEvent):
+        (QWebPagePrivate::dragMoveEvent):
+        (QWebPagePrivate::dropEvent):
+        (QWebPage::event):
+        * Api/qwebpage_p.h:
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
+        https://bugs.webkit.org/show_bug.cgi?id=28865
+
+        Clean up the unserCursor hack to use the QCursor set
+        as a property of the QWidget by WebCore::WidgetQt.
+
+        Remove all code that are no longer necessary for getting
+        cursor change events.
+
+        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
+                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
+
+        * Api/qwebpage.cpp:
+        * Api/qwebpage_p.h:
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::QWebViewPrivate):
+        (QWebView::event):
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QtWebKit single API to enable persistency
+        https://bugs.webkit.org/show_bug.cgi?id=28682
+
+        Disable LocalStorage, ApplicationCache, HTML5 offline storage by
+        default.
+
+        If persistency is enabled the default directory for LocalStorage and
+        ApplicationCache is now based on QDesktopServices::DataLocation and not
+        QDesktopServices::CacheLocation (as it is expected to keep this data
+        around after a reboot).
+
+        If persistency is enabled initialize HTML5 offline storage as well - this
+        fixed offline Storage for QtLauncher.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+        (QWebSettings::enablePersistentStorage):
+        * Api/qwebsettings.h: Add a new API called enablePersistentStorage
+        * QtLauncher/main.cpp: Use the new enablePersistentStorage API
+        (main):
+
+2009-09-07  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Speed up the QWebPluginInfo::supportsMimeType() function.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Instead of going through the MIME types list constructed with
+        mimeTypes() function, look up the internal mimeToDescriptions map.
+
+        * Api/qwebplugindatabase.cpp:
+        (QWebPluginInfo::supportsMimeType):
+
+2009-09-07  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Speed up the QWebPluginInfo::mimeTypes() function.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Instead of constructing a list of MIME types every time it is called,
+        do this only once.
+
+        * Api/qwebplugindatabase.cpp:
+        (QWebPluginInfo::mimeTypes):
+        (QWebPluginInfo::operator=):
+        * Api/qwebplugindatabase.h:
+        * tests/qwebplugindatabase/tst_qwebplugindatabase.cpp:
+        (tst_QWebPluginDatabase::operatorassign_data):
+        (tst_QWebPluginDatabase::operatorassign):
+
+2009-09-07  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Remove the private classes from QWebPluginDatabase.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Instead, hold the PluginDatabase and PluginPackage objects as class
+        members and take care of refcounting on our own instead of using RefPtr.
+
+        This way we not only made the code cleaner but also got rid of
+        redundant allocations when constructing null QWebPluginInfo objects.
+
+        The private classes have been forward-declared and the d-pointers left
+        to be on the safe side.
+
+        * Api/qwebplugindatabase.cpp:
+        (QWebPluginInfo::QWebPluginInfo):
+        (QWebPluginInfo::~QWebPluginInfo):
+        (QWebPluginInfo::name):
+        (QWebPluginInfo::description):
+        (QWebPluginInfo::mimeTypes):
+        (QWebPluginInfo::path):
+        (QWebPluginInfo::isNull):
+        (QWebPluginInfo::setEnabled):
+        (QWebPluginInfo::isEnabled):
+        (QWebPluginInfo::operator==):
+        (QWebPluginInfo::operator!=):
+        (QWebPluginInfo::operator=):
+        (QWebPluginDatabase::QWebPluginDatabase):
+        (QWebPluginDatabase::~QWebPluginDatabase):
+        (QWebPluginDatabase::plugins):
+        (QWebPluginDatabase::searchPaths):
+        (QWebPluginDatabase::setSearchPaths):
+        (QWebPluginDatabase::addSearchPath):
+        (QWebPluginDatabase::refresh):
+        (QWebPluginDatabase::pluginForMimeType):
+        (QWebPluginDatabase::setPreferredPluginForMimeType):
+        * Api/qwebplugindatabase.h:
+        * Api/qwebplugindatabase_p.h: Removed.
+
+2009-09-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] r47424 broke binary compatibility
+        https://bugs.webkit.org/show_bug.cgi?id=28996
+
+        Append the new DnsPrefetchEnabled attribute at the end of the enum.
+
+        * Api/qwebsettings.h:
+
+2009-09-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Account for scrollbar state changes that occur during layout.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::setScrollBarPolicy):
+
+        Eliminate duplicated (and incorrect) scrollbar mode tracking between
+        FrameView and ScrollView.
+
+2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix tst_QWebPage::database autotest failure
+        https://bugs.webkit.org/show_bug.cgi?id=28961
+
+        Make sure that the test case enables the feature before 
+        the feature gets tested
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::database):
+
+2009-09-04  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+        
+        Any QtWebKit application crashes on exit if the inspector is
+        used during the session rather then exiting.
+        
+        If a QWebView has a QWebPage that is destroyed the QWebView
+        does not update its pointer and will crash the next time
+        it access the page pointers (such as in its destructor).
+        
+        InspectorClientView should not call deleteLater when the page
+        is destroyed because it does not have a parent and is a top
+        level widget.  close() needs to be called so that QApplication
+        can exit the application if quitOnLastWindowClosed is set
+        and a InspectorClientView is the last window, otherwise
+        the application will never exit.
+        
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::_q_pageDestroyed):
+        (QWebView::setPage):
+        * Api/qwebview.h:
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientView::InspectorClientView):
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Stub implementations of mixed content methods of FrameLoaderClient. 
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::didDisplayInsecureContent):
+        (WebCore::FrameLoaderClientQt::didRunInsecureContent):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-09-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add a setting to turn SessionStorage on/off
+        https://bugs.webkit.org/show_bug.cgi?id=28836
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (testFlag):
+        (tst_QWebPage::testOptionalJSObjects):
+
+2009-09-02  Richard Moore  <rich@kde.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make sure we relayout the page after evaluating JS
+
+        https://bugs.webkit.org/show_bug.cgi?id=28235
+
+        QtWebKit does not always seem to reflow the page when evaluating
+        javascript. This patch changes the way evaluateJavaScript works to
+        use the frameloader which ensures that this is done properly.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::evaluateJavaScript):
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Add empty implementation for new ChromeClient method.
+
+        * WebCoreSupport/ChromeClientQt.h:
+        (WebCore::ChromeClientQt::scrollbarsModeDidChange):
+
+2009-08-27  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        QWebHistory::clear() modifications.
+
+        Clear() method was changed. If QWebHistory is empty (there is no
+        elements even current) clear() do nothing. If there at least one
+        element clear() will delete everything apart of current.
+
+        New autotests in QWebHistory
+
+        New autotests were added to QWebHistory. They should check some crashes
+        in save and restore state process and clear() method and general
+        behavior on where QWebHistory::count() == 0 or QWebHistory::count() == 1
+
+        Bugzilla: https://bugs.webkit.org/show_bug.cgi?id=28711
+
+        * Api/qwebhistory.cpp:
+        (QWebHistory::clear):
+        * tests/qwebhistory/tst_qwebhistory.cpp:
+        (tst_QWebHistory::back):
+        (tst_QWebHistory::forward):
+        (tst_QWebHistory::saveAndRestore_crash_1):
+        (tst_QWebHistory::saveAndRestore_crash_2):
+        (tst_QWebHistory::saveAndRestore_crash_3):
+        (tst_QWebHistory::clear):
+
+2009-08-27  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Cleanup, old and commented part of source code was removed.
+        Fix some formatting problems.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28712
+
+        * Api/qwebhistory_p.h:
+        (QWebHistoryPrivate::QWebHistoryPrivate):
+
+2009-08-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Don't let local files access web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28480
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2009-08-25  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Bug 28708 - Make possible to better use ResourceError in FrameLoaderClientQt class.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::requestedUrl):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::FrameLoaderClientQt):
+        (WebCore::FrameLoaderClientQt::dispatchDidFinishLoad):
+        (WebCore::FrameLoaderClientQt::postProgressFinishedNotification):
+        (WebCore::FrameLoaderClientQt::dispatchDidFailProvisionalLoad):
+        (WebCore::FrameLoaderClientQt::dispatchDidFailLoad):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-08-22  Adam Barth  <abarth@webkit.org>
+
+        Revert 47684.  We're going to do this later once clients have had a
+        chance to opt into the setting they like.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2009-08-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't let local files access web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28480
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Speculative build break fix for qt.
+
+        * Api/qwebsecurityorigin.cpp:
+        (QWebSecurityOrigin::whiteListAccessFromOrigin):
+        * Api/qwebsecurityorigin.h:
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        * Api/qwebsecurityorigin.cpp: Add API to manipulate origin access whitelists.
+        (QWebSecurityOrigin::whiteListAccessFromOrigin): Ditto.
+        (QWebSecurityOrigin::resetOriginAccessWhiteLists): Ditto.
+        * Api/qwebsecurityorigin.h: Ditto.
+
+2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviwed by Ariya Hidayat.
+
+        [Qt] For prefecthDNS, the pre-fetching has to be enabled in the
+        WebSettings.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Try to fix Qt build again.
+
+        * WebCoreSupport/EditorClientQt.cpp: Move "using namespace".
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Try to fix Qt build.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::shouldShowDeleteInterface):
+        Use getAttribute(classAttr) instead of className() function.
+
+2009-08-14  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        RVCT elftran fails to resolve QPainter::staticMetaObject coming with 
+        QWebView::RenderHints property.
+
+        This is a temporary fix and will be revereted when the right symbols
+        exported from Qt lib in S60.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28181
+
+        * Api/qwebview.h:
+
+2009-08-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Public API to configure the storage path for HTML5 localStorage
+        https://bugs.webkit.org/show_bug.cgi?id=28036
+
+        Disables LocalStorage for QtWebKit by default by setting
+        QWebSettings::LocalStorageEnabled to false.
+
+        Sets up a default for the LocalStorage path so that clients would only
+        need to enable the LocalStorageEnabled setting to turn on LocalStoragre
+        support.
+
+        Turn on LocalStorage support for QtLauncher and the relevant test
+        since LocalStorage is now disabled by default for QtWebkit.
+
+        * Api/qwebpage.cpp:
+        (defaultCachePath):
+        (initializeApplicationCachePathIfNecessary):
+        (QWebPagePrivate::QWebPagePrivate):
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        (QWebSettings::setLocalStoragePath):
+        (QWebSettings::localStoragePath):
+        * Api/qwebsettings.h:
+        * QtLauncher/main.cpp:
+        (main):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::multiplePageGroupsAndLocalStorage):
+
+2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow applications to register their own local URL scheme.
+        https://bugs.webkit.org/show_bug.cgi?id=28240
+
+        * Api/qwebsecurityorigin.cpp:
+        (QWebSecurityOrigin::addLocalScheme):
+        (QWebSecurityOrigin::removeLocalScheme):
+        (QWebSecurityOrigin::localSchemes):
+        * Api/qwebsecurityorigin.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::localURLSchemes):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * Api/qwebelement.cpp:
+
+2009-08-13  Kavindra Devi Palaraja  <kavindra.palaraja@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Doc - Some cleanup on the documentation of QWebElement
+
+        * Api/qwebelement.cpp:
+
+2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian target components (library and executable files)
+        require Unique Identifiers (i.e., UID3).
+        These identifiers are defined in the respective project
+        files, conditionally for "symbian" platform.
+
+        * QtLauncher/QtLauncher.pro:
+        * tests/qwebelement/qwebelement.pro:
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebhistory/qwebhistory.pro:
+        * tests/qwebhistoryinterface/qwebhistoryinterface.pro:
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebview/qwebview.pro:
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Initialise zoom levels independent of whether a URL is valid or not to
+        fix https://bugs.webkit.org/show_bug.cgi?id=28162
+
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+
+2009-08-12  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        QtWebKit compile fix for Windows CE
+
+        There's no getenv on Windows CE, use qgetenv instead.
+
+        * Api/qwebpage.cpp:
+        (qt_drt_overwritePluginDirectories):
+
 2009-08-10  Kavindra Palaraja  <kavindra.palaraja@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -2956,7 +4642,7 @@
 
         Reviewed by Simon Hausmann.
 
-        http://www.qtsoftware.com/developer/task-tracker/index_html?id=238391&method=entry
+        http://qt.nokia.com/developer/task-tracker/index_html?id=238391&method=entry
 
         [Qt] If QPainter fails to start on a QPrinter instance, do not
         continue printing.
@@ -3149,7 +4835,7 @@
 
         Rubber-stamped by Simon Hausmann.
 
-        http://www.qtsoftware.com/developer/task-tracker/index_html?id=219344&method=entry
+        http://qt.nokia.com/developer/task-tracker/index_html?id=219344&method=entry
 
         [Qt] API documentation for QWebPage::WebAction enum.
 
@@ -3204,7 +4890,7 @@
 
         Reviewed by Simon Hausmann.
 
-        http://www.qtsoftware.com/developer/task-tracker/index_html?id=241144&method=entry
+        http://qt.nokia.com/developer/task-tracker/index_html?id=241144&method=entry
 
         [Qt] Create actions for text selection and editing for QWebPage.
         Also properly disable and enable them when contentEditable is toggled.
diff --git a/WebKit/qt/QGVLauncher/QGVLauncher.pro b/WebKit/qt/QGVLauncher/QGVLauncher.pro
new file mode 100644
index 0000000..dec1c9b
--- /dev/null
+++ b/WebKit/qt/QGVLauncher/QGVLauncher.pro
@@ -0,0 +1,13 @@
+TEMPLATE = app
+SOURCES += main.cpp
+CONFIG -= app_bundle
+CONFIG += uitools
+DESTDIR = ../../../bin
+
+include(../../../WebKit.pri)
+
+QT += network
+macx:QT+=xml
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0xA000E544
diff --git a/WebKit/qt/QGVLauncher/main.cpp b/WebKit/qt/QGVLauncher/main.cpp
new file mode 100644
index 0000000..1d67c35
--- /dev/null
+++ b/WebKit/qt/QGVLauncher/main.cpp
@@ -0,0 +1,337 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2006 George Staikos <staikos@kde.org>
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2006 Simon Hausmann <hausmann@kde.org>
+ * Copyright (C) 2009 Kenneth Christiansen <kenneth@webkit.org>
+ * Copyright (C) 2009 Antonio Gomes <antonio.gomes@openbossa.org>
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <QDebug>
+#include <QFile>
+#include <QGraphicsScene>
+#include <QGraphicsView>
+#include <QGraphicsWidget>
+#include <QNetworkRequest>
+#include <QTextStream>
+#include <QVector>
+#include <QtGui>
+#include <QtNetwork/QNetworkProxy>
+#include <cstdio>
+#include <qwebelement.h>
+#include <qwebframe.h>
+#include <qgraphicswebview.h>
+#include <qwebpage.h>
+#include <qwebsettings.h>
+#include <qwebview.h>
+
+class WebPage : public QWebPage {
+    Q_OBJECT
+
+public:
+    WebPage(QWidget* parent = 0) : QWebPage(parent)
+    {
+        applyProxy();
+    }
+    virtual QWebPage* createWindow(QWebPage::WebWindowType);
+
+private:
+    void applyProxy();
+};
+
+class MainView : public QGraphicsView {
+    Q_OBJECT
+
+public:
+    MainView(QWidget* parent) : QGraphicsView(parent), m_mainWidget(0)
+    {
+        setHorizontalScrollBarPolicy(Qt::ScrollBarAlwaysOff);
+        setVerticalScrollBarPolicy(Qt::ScrollBarAlwaysOff);
+    }
+
+    void setMainWidget(QGraphicsWidget* widget)
+    {
+        QRectF rect(QRect(QPoint(0, 0), size()));
+        widget->setGeometry(rect);
+        m_mainWidget = widget;
+    }
+
+    void resizeEvent(QResizeEvent* event)
+    {
+        QGraphicsView::resizeEvent(event);
+        if (!m_mainWidget)
+            return;
+        QRectF rect(QPoint(0, 0), event->size());
+        m_mainWidget->setGeometry(rect);
+    }
+
+public slots:
+    void flip()
+    {
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+        QSizeF center = m_mainWidget->boundingRect().size() / 2;
+        QPointF centerPoint = QPointF(center.width(), center.height());
+        m_mainWidget->setTransformOriginPoint(centerPoint);
+
+        m_mainWidget->setRotation(m_mainWidget->rotation() ? 0 : 180);
+#endif
+    }
+
+    void animatedFlip()
+    {
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+        QSizeF center = m_mainWidget->boundingRect().size() / 2;
+        QPointF centerPoint = QPointF(center.width(), center.height());
+        m_mainWidget->setTransformOriginPoint(centerPoint);
+
+        QPropertyAnimation* animation = new QPropertyAnimation(m_mainWidget, "rotation", this);
+        animation->setDuration(1000);
+        animation->setStartValue(m_mainWidget->rotation());
+        animation->setEndValue(m_mainWidget->rotation() + 180);
+        animation->start(QAbstractAnimation::DeleteWhenStopped);
+#endif
+    }
+private:
+    QGraphicsWidget* m_mainWidget;
+};
+
+class SharedScene : public QSharedData {
+public:
+    SharedScene()
+    {
+        m_scene = new QGraphicsScene;
+
+        m_item = new QGraphicsWebView;
+        m_item->setPage(new WebPage());
+
+        m_scene->addItem(m_item);
+        m_scene->setActiveWindow(m_item);
+    }
+
+    ~SharedScene()
+    {
+        delete m_item;
+        delete m_scene;
+    }
+
+    QGraphicsScene* scene() const { return m_scene; }
+    QGraphicsWebView* webView() const { return m_item; }
+
+private:
+    QGraphicsScene* m_scene;
+    QGraphicsWebView* m_item;
+};
+
+
+class MainWindow : public QMainWindow {
+    Q_OBJECT
+
+public:
+    MainWindow(QExplicitlySharedDataPointer<SharedScene> other)
+        : QMainWindow(), view(new MainView(this)), scene(other)
+    {
+        init();
+    }
+
+    MainWindow()
+        : QMainWindow(), view(new MainView(this)), scene(new SharedScene())
+    {
+        init();
+    }
+
+    void init()
+    {
+        setAttribute(Qt::WA_DeleteOnClose);
+
+        view->setScene(scene->scene());
+        view->setFrameShape(QFrame::NoFrame);
+        view->setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding);
+        setCentralWidget(view);
+
+        view->setMainWidget(scene->webView());
+
+        connect(scene->webView(), SIGNAL(loadFinished(bool)), this, SLOT(loadFinished(bool)));
+        connect(scene->webView(), SIGNAL(titleChanged(const QString&)), this, SLOT(setWindowTitle(const QString&)));
+        connect(scene->webView()->page(), SIGNAL(windowCloseRequested()), this, SLOT(close()));
+
+        resize(640, 480);
+        buildUI();
+    }
+
+    void load(const QString& url)
+    {
+        QUrl deducedUrl = guessUrlFromString(url);
+        if (!deducedUrl.isValid())
+            deducedUrl = QUrl("http://" + url + "/");
+
+        urlEdit->setText(deducedUrl.toEncoded());
+        scene->webView()->load(deducedUrl);
+        scene->webView()->setFocus(Qt::OtherFocusReason);
+    }
+
+    QUrl guessUrlFromString(const QString& string)
+    {
+        QString input(string);
+        QFileInfo fi(input);
+        if (fi.exists() && fi.isRelative())
+            input = fi.absoluteFilePath();
+
+        return QWebView::guessUrlFromString(input);
+    }
+
+    QWebPage* page() const
+    {
+        return scene->webView()->page();
+    }
+
+protected slots:
+    void changeLocation()
+    {
+        load(urlEdit->text());
+    }
+
+    void loadFinished(bool)
+    {
+        QUrl url = scene->webView()->url();
+        urlEdit->setText(url.toString());
+
+        QUrl::FormattingOptions opts;
+        opts |= QUrl::RemoveScheme;
+        opts |= QUrl::RemoveUserInfo;
+        opts |= QUrl::StripTrailingSlash;
+        QString s = url.toString(opts);
+        s = s.mid(2);
+        if (s.isEmpty())
+            return;
+        //FIXME: something missing here
+    }
+
+public slots:
+    void newWindow(const QString &url = QString())
+    {
+        MainWindow* mw = new MainWindow();
+        mw->load(url);
+        mw->show();
+    }
+
+    void clone()
+    {
+        MainWindow* mw = new MainWindow(scene);
+        mw->show();
+    }
+
+    void flip()
+    {
+        view->flip();
+    }
+
+    void animatedFlip()
+    {
+        view->animatedFlip();
+    }
+private:
+    void buildUI()
+    {
+        QWebPage* page = scene->webView()->page();
+        urlEdit = new QLineEdit(this);
+        urlEdit->setSizePolicy(QSizePolicy::Expanding, urlEdit->sizePolicy().verticalPolicy());
+        connect(urlEdit, SIGNAL(returnPressed()), SLOT(changeLocation()));
+
+        QToolBar* bar = addToolBar("Navigation");
+        bar->addAction(page->action(QWebPage::Back));
+        bar->addAction(page->action(QWebPage::Forward));
+        bar->addAction(page->action(QWebPage::Reload));
+        bar->addAction(page->action(QWebPage::Stop));
+        bar->addWidget(urlEdit);
+
+        QMenu* fileMenu = menuBar()->addMenu("&File");
+        fileMenu->addAction("New Window", this, SLOT(newWindow()));
+        fileMenu->addAction("Clone view", this, SLOT(clone()));
+        fileMenu->addAction("Close", this, SLOT(close()));
+
+        QMenu* viewMenu = menuBar()->addMenu("&View");
+        viewMenu->addAction(page->action(QWebPage::Stop));
+        viewMenu->addAction(page->action(QWebPage::Reload));
+
+        QMenu* fxMenu = menuBar()->addMenu("&Effects");
+        fxMenu->addAction("Flip", this, SLOT(flip()));
+        fxMenu->addAction("Animated Flip", this, SLOT(animatedFlip()));
+    }
+
+private:
+    MainView* view;
+    QExplicitlySharedDataPointer<SharedScene> scene;
+
+    QLineEdit* urlEdit;
+};
+
+QWebPage* WebPage::createWindow(QWebPage::WebWindowType)
+{
+    MainWindow* mw = new MainWindow;
+    mw->show();
+    return mw->page();
+}
+
+void WebPage::applyProxy()
+{
+    QUrl proxyUrl = QWebView::guessUrlFromString(qgetenv("http_proxy"));
+
+    if (proxyUrl.isValid() && !proxyUrl.host().isEmpty()) {
+        int proxyPort = (proxyUrl.port() > 0) ? proxyUrl.port() : 8080;
+        networkAccessManager()->setProxy(QNetworkProxy(QNetworkProxy::HttpProxy, proxyUrl.host(), proxyPort));
+    }
+}
+
+int main(int argc, char** argv)
+{
+    QApplication app(argc, argv);
+    QString url = QString("file://%1/%2").arg(QDir::homePath()).arg(QLatin1String("index.html"));
+
+    app.setApplicationName("GQVLauncher");
+
+    QWebSettings::setObjectCacheCapacities((16 * 1024 * 1024) / 8, (16 * 1024 * 1024) / 8, 16 * 1024 * 1024);
+    QWebSettings::setMaximumPagesInCache(4);
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::LocalStorageEnabled, true);
+
+    const QStringList args = app.arguments();
+    if (args.count() > 1)
+        url = args.at(1);
+
+    MainWindow* window = new MainWindow;
+    window->load(url);
+
+    for (int i = 2; i < args.count(); i++)
+        window->newWindow(args.at(i));
+
+    window->show();
+    return app.exec();
+}
+
+#include "main.moc"
diff --git a/WebKit/qt/QtLauncher/QtLauncher.pro b/WebKit/qt/QtLauncher/QtLauncher.pro
index 42138c8..5b10dea 100644
--- a/WebKit/qt/QtLauncher/QtLauncher.pro
+++ b/WebKit/qt/QtLauncher/QtLauncher.pro
@@ -9,3 +9,5 @@ include(../../../WebKit.pri)
 QT += network
 macx:QT+=xml
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0xA000E543
diff --git a/WebKit/qt/QtLauncher/main.cpp b/WebKit/qt/QtLauncher/main.cpp
index 9cbab53..8cc8a09 100644
--- a/WebKit/qt/QtLauncher/main.cpp
+++ b/WebKit/qt/QtLauncher/main.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  * Copyright (C) 2006 George Staikos <staikos@kde.org>
  * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
@@ -34,6 +35,7 @@
 #include <qwebframe.h>
 #include <qwebsettings.h>
 #include <qwebelement.h>
+#include <qwebinspector.h>
 
 #include <QtGui>
 #include <QDebug>
@@ -62,6 +64,13 @@ public:
 
     virtual QWebPage *createWindow(QWebPage::WebWindowType);
     virtual QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&);
+    virtual bool supportsExtension(QWebPage::Extension extension) const
+    {
+        if (extension == QWebPage::ErrorPageExtension)
+            return true;
+        return false;
+    }
+    virtual bool extension(Extension extension, const ExtensionOption *option, ExtensionReturn *output);
 };
 
 class MainWindow : public QMainWindow
@@ -70,13 +79,15 @@ class MainWindow : public QMainWindow
 public:
     MainWindow(QString url = QString()): currentZoom(100) {
         setAttribute(Qt::WA_DeleteOnClose);
+        if (qgetenv("QTLAUNCHER_USE_ARGB_VISUALS").toInt() == 1)
+            setAttribute(Qt::WA_TranslucentBackground);
 
-        view = new QWebView(this);
-        setCentralWidget(view);
+        QSplitter* splitter = new QSplitter(Qt::Vertical, this);
+        setCentralWidget(splitter);
 
+        view = new QWebView(splitter);
         WebPage* page = new WebPage(view);
         view->setPage(page);
-        
         connect(view, SIGNAL(loadFinished(bool)),
                 this, SLOT(loadFinished()));
         connect(view, SIGNAL(titleChanged(const QString&)),
@@ -85,9 +96,15 @@ public:
                 this, SLOT(showLinkHover(const QString&, const QString&)));
         connect(view->page(), SIGNAL(windowCloseRequested()), this, SLOT(close()));
 
+        inspector = new QWebInspector(splitter);
+        inspector->setPage(page);
+        inspector->hide();
+        connect(this, SIGNAL(destroyed()), inspector, SLOT(deleteLater()));
+        connect(page, SIGNAL(webInspectorTriggered(const QWebElement&)), inspector, SLOT(show()));
+
         setupUI();
 
-        // set the proxy to the http_proxy env variable - if present        
+        // set the proxy to the http_proxy env variable - if present
         QUrl proxyUrl = view->guessUrlFromString(qgetenv("http_proxy"));
         if (proxyUrl.isValid() && !proxyUrl.host().isEmpty()) {
             int proxyPort = (proxyUrl.port() > 0)  ? proxyUrl.port() : 8080;
@@ -103,11 +120,12 @@ public:
             urlEdit->setText(qurl.toEncoded());
             view->load(qurl);
 
-            // the zoom values are chosen to be like in Mozilla Firefox 3
-            zoomLevels << 30 << 50 << 67 << 80 << 90;
-            zoomLevels << 100;
-            zoomLevels << 110 << 120 << 133 << 150 << 170 << 200 << 240 << 300;
         }
+
+        // the zoom values are chosen to be like in Mozilla Firefox 3
+        zoomLevels << 30 << 50 << 67 << 80 << 90;
+        zoomLevels << 100;
+        zoomLevels << 110 << 120 << 133 << 150 << 170 << 200 << 240 << 300;
     }
 
     QWebPage* webPage() const {
@@ -193,6 +211,22 @@ protected slots:
 #endif
     }
 
+    void screenshot()
+    {
+        QPixmap pixmap = QPixmap::grabWidget(view);
+        QLabel* label = new QLabel;
+        label->setAttribute(Qt::WA_DeleteOnClose);
+        label->setWindowTitle("Screenshot - Preview");
+        label->setPixmap(pixmap);
+        label->show();
+
+        QString fileName = QFileDialog::getSaveFileName(label, "Screenshot");
+        if (!fileName.isEmpty()) {
+            pixmap.save(fileName, "png");
+            label->setWindowTitle(QString("Screenshot - Saved at %1").arg(fileName));
+        }
+    }
+
     void setEditable(bool on) {
         view->page()->setContentEditable(on);
         formatMenuAction->setVisible(on);
@@ -206,6 +240,7 @@ protected slots:
         bool ok;
         QString str = QInputDialog::getText(this, "Select elements", "Choose elements",
                                             QLineEdit::Normal, "a", &ok);
+
         if (ok && !str.isEmpty()) {
             QList<QWebElement> result =  view->page()->mainFrame()->findAllElements(str);
             foreach (QWebElement e, result)
@@ -259,6 +294,7 @@ private:
 #if QT_VERSION >= 0x040400
         fileMenu->addAction(tr("Print"), this, SLOT(print()));
 #endif
+        QAction* screenshot = fileMenu->addAction("Screenshot", this, SLOT(screenshot()));
         fileMenu->addAction("Close", this, SLOT(close()));
 
         QMenu *editMenu = menuBar()->addMenu("&Edit");
@@ -285,7 +321,7 @@ private:
         viewMenu->addSeparator();
         viewMenu->addAction("Dump HTML", this, SLOT(dumpHtml()));
 
-        QMenu *formatMenu = new QMenu("F&ormat");
+        QMenu *formatMenu = new QMenu("F&ormat", this);
         formatMenuAction = menuBar()->addMenu(formatMenu);
         formatMenuAction->setVisible(false);
         formatMenu->addAction(view->pageAction(QWebPage::ToggleBold));
@@ -297,6 +333,7 @@ private:
         writingMenu->addAction(view->pageAction(QWebPage::SetTextDirectionRightToLeft));
 
         newWindow->setShortcut(QKeySequence(Qt::CTRL | Qt::Key_N));
+        screenshot->setShortcut(QKeySequence(Qt::CTRL | Qt::Key_S));
         view->pageAction(QWebPage::Back)->setShortcut(QKeySequence::Back);
         view->pageAction(QWebPage::Stop)->setShortcut(Qt::Key_Escape);
         view->pageAction(QWebPage::Forward)->setShortcut(QKeySequence::Forward);
@@ -321,6 +358,7 @@ private:
     QWebView *view;
     QLineEdit *urlEdit;
     QProgressBar *progress;
+    QWebInspector* inspector;
 
     QAction *formatMenuAction;
 
@@ -328,6 +366,17 @@ private:
     QStringListModel urlModel;
 };
 
+bool WebPage::extension(Extension extension, const ExtensionOption *option, ExtensionReturn *output)
+{
+    const QWebPage::ErrorPageExtensionOption* info = static_cast<const QWebPage::ErrorPageExtensionOption*>(option);
+    QWebPage::ErrorPageExtensionReturn* errorPage = static_cast<QWebPage::ErrorPageExtensionReturn*>(output);
+
+    errorPage->content = QString("<html><head><title>Failed loading page</title></head><body>%1</body></html>")
+        .arg(info->errorString).toUtf8();
+
+    return true;
+}
+
 QWebPage *WebPage::createWindow(QWebPage::WebWindowType)
 {
     MainWindow *mw = new MainWindow;
@@ -356,6 +405,7 @@ public:
     URLLoader(QWebView* view, const QString& inputFileName)
         : m_view(view)
         , m_stdOut(stdout)
+        , m_loaded(0)
     {
         init(inputFileName);
     }
@@ -367,7 +417,7 @@ public slots:
         if (getUrl(qstr)) {
             QUrl url(qstr, QUrl::StrictMode);
             if (url.isValid()) {
-                m_stdOut << "Loading " << qstr << " ......" << endl;
+                m_stdOut << "Loading " << qstr << " ......" << ++m_loaded << endl;
                 m_view->load(url);
             } else
                 loadNext();
@@ -410,6 +460,7 @@ private:
     int m_index;
     QWebView* m_view;
     QTextStream m_stdOut;
+    int m_loaded;
 };
 
 #include "main.moc"
@@ -442,6 +493,11 @@ int main(int argc, char **argv)
 
     QWebSettings::globalSettings()->setAttribute(QWebSettings::PluginsEnabled, true);
     QWebSettings::globalSettings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+    QWebSettings::enablePersistentStorage();
+
+    // To allow QWebInspector's configuration persistence
+    QCoreApplication::setOrganizationName("Nokia");
+    QCoreApplication::setApplicationName("QtLauncher");
 
     const QStringList args = app.arguments();
 
diff --git a/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index d659833..26cf6f6 100644
--- a/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -39,12 +39,14 @@
 #include "WindowFeatures.h"
 #include "DatabaseTracker.h"
 #include "SecurityOrigin.h"
+#include "QWebPageClient.h"
 
 #include "qwebpage.h"
 #include "qwebpage_p.h"
 #include "qwebframe_p.h"
 #include "qwebsecurityorigin.h"
 #include "qwebsecurityorigin_p.h"
+#include "qwebview.h"
 
 #include <qtooltip.h>
 #include <qtextdocument.h>
@@ -303,16 +305,15 @@ IntRect ChromeClientQt::windowResizerRect() const
     return IntRect();
 }
 
-void ChromeClientQt::repaint(const IntRect& windowRect, bool contentChanged, bool immediate, bool repaintContentOnly)
+void ChromeClientQt::repaint(const IntRect& windowRect, bool contentChanged, bool, bool)
 {
     // No double buffer, so only update the QWidget if content changed.
     if (contentChanged) {
-        QWidget* view = m_webPage->view();
-        if (view) {
+        if (platformPageClient()) {
             QRect rect(windowRect);
             rect = rect.intersected(QRect(QPoint(0, 0), m_webPage->viewportSize()));
             if (!rect.isEmpty())
-                view->update(rect);
+                platformPageClient()->update(rect);
         }
         emit m_webPage->repaintRequested(windowRect);
     }
@@ -323,9 +324,8 @@ void ChromeClientQt::repaint(const IntRect& windowRect, bool contentChanged, boo
 
 void ChromeClientQt::scroll(const IntSize& delta, const IntRect& scrollViewRect, const IntRect&)
 {
-    QWidget* view = m_webPage->view();
-    if (view)
-        view->scroll(delta.width(), delta.height(), scrollViewRect);
+    if (platformPageClient())
+        platformPageClient()->scroll(delta.width(), delta.height(), scrollViewRect);
     emit m_webPage->scrollRequested(delta.width(), delta.height(), scrollViewRect);
 }
 
@@ -341,9 +341,9 @@ IntPoint ChromeClientQt::screenToWindow(const IntPoint& point) const
     return point;
 }
 
-PlatformWidget ChromeClientQt::platformWindow() const
+PlatformPageClient ChromeClientQt::platformPageClient() const
 {
-    return m_webPage->view();
+    return m_webPage->d->client;
 }
 
 void ChromeClientQt::contentsSizeChanged(Frame* frame, const IntSize& size) const
@@ -351,7 +351,7 @@ void ChromeClientQt::contentsSizeChanged(Frame* frame, const IntSize& size) cons
     emit QWebFramePrivate::kit(frame)->contentsSizeChanged(size);
 }
 
-void ChromeClientQt::mouseDidMoveOverElement(const HitTestResult& result, unsigned modifierFlags)
+void ChromeClientQt::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
 {
     TextDirection dir;
     if (result.absoluteLinkURL() != lastHoverURL
@@ -402,7 +402,7 @@ void ChromeClientQt::exceededDatabaseQuota(Frame* frame, const String& databaseN
 #endif
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-void ChromeClientQt::reachedMaxAppCacheSize(int64_t spaceNeeded)
+void ChromeClientQt::reachedMaxAppCacheSize(int64_t)
 {
     // FIXME: Free some space.
     notImplemented();
@@ -419,7 +419,7 @@ void ChromeClientQt::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> prpFileC
         option.parentFrame = QWebFramePrivate::kit(frame);
 
         if (!fileChooser->filenames().isEmpty())
-            for (int i = 0; i < fileChooser->filenames().size(); ++i)
+            for (unsigned i = 0; i < fileChooser->filenames().size(); ++i)
                 option.suggestedFileNames += fileChooser->filenames()[i];
 
         QWebPage::ChooseMultipleFilesExtensionReturn output;
diff --git a/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index 96c7fab..196c4fc 100644
--- a/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -105,9 +105,10 @@ namespace WebCore {
         virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
         virtual IntPoint screenToWindow(const IntPoint&) const;
         virtual IntRect windowToScreen(const IntRect&) const;
-        virtual PlatformWidget platformWindow() const;
+        virtual PlatformPageClient platformPageClient() const;
         virtual void contentsSizeChanged(Frame*, const IntSize&) const;
 
+        virtual void scrollbarsModeDidChange() const { }
         virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
 
         virtual void setToolTip(const String&, TextDirection);
diff --git a/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp b/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp
index ed79946..b4400ff 100644
--- a/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp
@@ -52,7 +52,7 @@ void ContextMenuClientQt::contextMenuItemSelected(ContextMenuItem*, const Contex
     notImplemented();
 }
 
-void ContextMenuClientQt::downloadURL(const KURL& url)
+void ContextMenuClientQt::downloadURL(const KURL&)
 {
     notImplemented();
 }
diff --git a/WebKit/qt/WebCoreSupport/DragClientQt.cpp b/WebKit/qt/WebCoreSupport/DragClientQt.cpp
index 0df0768..99e438d 100644
--- a/WebKit/qt/WebCoreSupport/DragClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/DragClientQt.cpp
@@ -66,6 +66,8 @@ void DragClientQt::startDrag(DragImageRef, const IntPoint&, const IntPoint&, Cli
     QWidget* view = m_webPage->view();
     if (view) {
         QDrag *drag = new QDrag(view);
+        if (clipboardData->hasImage())
+            drag->setPixmap(qvariant_cast<QPixmap>(clipboardData->imageData()));
         drag->setMimeData(clipboardData);
         drag->start();
     }
diff --git a/WebKit/qt/WebCoreSupport/EditorClientQt.cpp b/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
index 995d61d..5d5df97 100644
--- a/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
@@ -41,6 +41,7 @@
 #include "FocusController.h"
 #include "Frame.h"
 #include "HTMLElement.h"
+#include "HTMLNames.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
 #include "NotImplemented.h"
@@ -96,6 +97,7 @@ static QString dumpRange(WebCore::Range *range)
 
 namespace WebCore {
 
+using namespace HTMLNames;
 
 bool EditorClientQt::shouldDeleteRange(Range* range)
 {
@@ -108,7 +110,7 @@ bool EditorClientQt::shouldDeleteRange(Range* range)
 bool EditorClientQt::shouldShowDeleteInterface(HTMLElement* element)
 {
     if (QWebPagePrivate::drtRun)
-        return element->className() == "needsDeletionUI";
+        return element->getAttribute(classAttr) == "needsDeletionUI";
     return false;
 }
 
@@ -218,7 +220,9 @@ void EditorClientQt::respondToChangedSelection()
 
     m_page->d->updateEditorActions();
     emit m_page->selectionChanged();
-    emit m_page->microFocusChanged();
+    Frame* frame = m_page->d->page->focusController()->focusedOrMainFrame();
+    if (!frame->editor()->ignoreCompositionSelectionChange())
+        emit m_page->microFocusChanged();
 }
 
 void EditorClientQt::didEndEditing()
@@ -593,10 +597,10 @@ bool EditorClientQt::isEditing() const
 void EditorClientQt::setInputMethodState(bool active)
 {
     QWidget *view = m_page->view();
-    if (view) {
+    if (view)
         view->setAttribute(Qt::WA_InputMethodEnabled, active);
-        emit m_page->microFocusChanged();
-    }
+
+    emit m_page->microFocusChanged();
 }
 
 }
diff --git a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 5cf86b1..665f16a 100644
--- a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -55,8 +55,10 @@
 #include "ResourceHandle.h"
 #include "Settings.h"
 #include "ScriptString.h"
+#include "QWebPageClient.h"
 
 #include "qwebpage.h"
+#include "qwebpage_p.h"
 #include "qwebframe.h"
 #include "qwebframe_p.h"
 #include "qwebhistoryinterface.h"
@@ -67,6 +69,8 @@
 #include <QCoreApplication>
 #include <QDebug>
 #if QT_VERSION >= 0x040400
+#include <QGraphicsScene>
+#include <QGraphicsWidget>
 #include <QNetworkRequest>
 #include <QNetworkReply>
 #else
@@ -144,7 +148,7 @@ FrameLoaderClientQt::FrameLoaderClientQt()
     , m_pluginView(0)
     , m_hasSentResponseToPlugin(false)
     , m_firstData(false)
-    , m_loadSucceeded(false)
+    , m_loadError (ResourceError())
 {
 }
 
@@ -183,7 +187,7 @@ QWebFrame* FrameLoaderClientQt::webFrame() const
 
 void FrameLoaderClientQt::callPolicyFunction(FramePolicyFunction function, PolicyAction action)
 {
-    (m_frame->loader()->*function)(action);
+    (m_frame->loader()->policyChecker()->*function)(action);
 }
 
 bool FrameLoaderClientQt::hasWebView() const
@@ -282,9 +286,7 @@ void FrameLoaderClientQt::dispatchDidCancelClientRedirect()
 }
 
 
-void FrameLoaderClientQt::dispatchWillPerformClientRedirect(const KURL& url,
-                                                            double interval,
-                                                            double fireDate)
+void FrameLoaderClientQt::dispatchWillPerformClientRedirect(const KURL& url, double, double)
 {
     if (dumpFrameLoaderCallbacks)
         printf("%s - willPerformClientRedirectToURL: %s \n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)), qPrintable(drtDescriptionSuitableForTestResult(url)));
@@ -376,7 +378,7 @@ void FrameLoaderClientQt::dispatchDidFinishLoad()
     if (dumpFrameLoaderCallbacks)
         printf("%s - didFinishLoadForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    m_loadSucceeded = true;
+    m_loadError = ResourceError(); // clears the previous error
 
     if (!m_webFrame)
         return;
@@ -461,10 +463,10 @@ void FrameLoaderClientQt::postProgressFinishedNotification()
     }
 
     if (m_webFrame && m_frame->page())
-        emit loadFinished(m_loadSucceeded);
+        emit loadFinished(m_loadError.isNull());
 }
 
-void FrameLoaderClientQt::setMainFrameDocumentReady(bool b)
+void FrameLoaderClientQt::setMainFrameDocumentReady(bool)
 {
     // this is only interesting once we provide an external API for the DOM
 }
@@ -514,13 +516,13 @@ bool FrameLoaderClientQt::canShowMIMEType(const String& MIMEType) const
     return false;
 }
 
-bool FrameLoaderClientQt::representationExistsForURLScheme(const String& URLScheme) const
+bool FrameLoaderClientQt::representationExistsForURLScheme(const String&) const
 {
     return false;
 }
 
 
-String FrameLoaderClientQt::generatedMIMETypeForURLScheme(const String& URLScheme) const
+String FrameLoaderClientQt::generatedMIMETypeForURLScheme(const String&) const
 {
     notImplemented();
     return String();
@@ -632,11 +634,21 @@ void FrameLoaderClientQt::updateGlobalHistoryRedirectLinks()
 {
 }
 
-bool FrameLoaderClientQt::shouldGoToHistoryItem(WebCore::HistoryItem *item) const
+bool FrameLoaderClientQt::shouldGoToHistoryItem(WebCore::HistoryItem *) const
 {
     return true;
 }
 
+void FrameLoaderClientQt::didDisplayInsecureContent()
+{
+    notImplemented();
+}
+
+void FrameLoaderClientQt::didRunInsecureContent(WebCore::SecurityOrigin*)
+{
+    notImplemented();
+}
+
 void FrameLoaderClientQt::saveViewStateToItem(WebCore::HistoryItem* item)
 {
     QWebHistoryItem historyItem(new QWebHistoryItemPrivate(item));
@@ -692,8 +704,10 @@ void FrameLoaderClientQt::committedLoad(WebCore::DocumentLoader* loader, const c
 
 WebCore::ResourceError FrameLoaderClientQt::cancelledError(const WebCore::ResourceRequest& request)
 {
-    return ResourceError("Error", -999, request.url().prettyURL(),
+    ResourceError error = ResourceError("QtNetwork", QNetworkReply::OperationCanceledError, request.url().prettyURL(),
             QCoreApplication::translate("QWebFrame", "Request cancelled", 0, QCoreApplication::UnicodeUTF8));
+    error.setIsCancellation(true);
+    return error;
 }
 
 // copied from WebKit/Misc/WebKitErrors[Private].h
@@ -709,36 +723,36 @@ enum {
 
 WebCore::ResourceError FrameLoaderClientQt::blockedError(const WebCore::ResourceRequest& request)
 {
-    return ResourceError("Error", WebKitErrorCannotUseRestrictedPort, request.url().prettyURL(),
+    return ResourceError("WebKit", WebKitErrorCannotUseRestrictedPort, request.url().prettyURL(),
             QCoreApplication::translate("QWebFrame", "Request blocked", 0, QCoreApplication::UnicodeUTF8));
 }
 
 
 WebCore::ResourceError FrameLoaderClientQt::cannotShowURLError(const WebCore::ResourceRequest& request)
 {
-    return ResourceError("Error", WebKitErrorCannotShowURL, request.url().string(),
+    return ResourceError("WebKit", WebKitErrorCannotShowURL, request.url().string(),
             QCoreApplication::translate("QWebFrame", "Cannot show URL", 0, QCoreApplication::UnicodeUTF8));
 }
 
 WebCore::ResourceError FrameLoaderClientQt::interruptForPolicyChangeError(const WebCore::ResourceRequest& request)
 {
-    return ResourceError("Error", WebKitErrorFrameLoadInterruptedByPolicyChange, request.url().string(),
-            QCoreApplication::translate("QWebFrame", "Frame load interruped by policy change", 0, QCoreApplication::UnicodeUTF8));
+    return ResourceError("WebKit", WebKitErrorFrameLoadInterruptedByPolicyChange, request.url().string(),
+            QCoreApplication::translate("QWebFrame", "Frame load interrupted by policy change", 0, QCoreApplication::UnicodeUTF8));
 }
 
 WebCore::ResourceError FrameLoaderClientQt::cannotShowMIMETypeError(const WebCore::ResourceResponse& response)
 {
-    return ResourceError("Error", WebKitErrorCannotShowMIMEType, response.url().string(),
+    return ResourceError("WebKit", WebKitErrorCannotShowMIMEType, response.url().string(),
             QCoreApplication::translate("QWebFrame", "Cannot show mimetype", 0, QCoreApplication::UnicodeUTF8));
 }
 
 WebCore::ResourceError FrameLoaderClientQt::fileDoesNotExistError(const WebCore::ResourceResponse& response)
 {
-    return ResourceError("Error", -998 /* ### */, response.url().string(),
+    return ResourceError("QtNetwork", QNetworkReply::ContentNotFoundError, response.url().string(),
             QCoreApplication::translate("QWebFrame", "File does not exist", 0, QCoreApplication::UnicodeUTF8));
 }
 
-WebCore::ResourceError FrameLoaderClientQt::pluginWillHandleLoadError(const WebCore::ResourceResponse& response)
+WebCore::ResourceError FrameLoaderClientQt::pluginWillHandleLoadError(const WebCore::ResourceResponse&)
 {
     notImplemented();
     return ResourceError();
@@ -776,7 +790,7 @@ void FrameLoaderClientQt::download(WebCore::ResourceHandle* handle, const WebCor
 #endif
 }
 
-void FrameLoaderClientQt::assignIdentifierToInitialRequest(unsigned long identifier, WebCore::DocumentLoader* loader, const WebCore::ResourceRequest& request)
+void FrameLoaderClientQt::assignIdentifierToInitialRequest(unsigned long identifier, WebCore::DocumentLoader*, const WebCore::ResourceRequest& request)
 {
     if (dumpResourceLoadCallbacks)
         dumpAssignedUrls[identifier] = drtDescriptionSuitableForTestResult(request.url());
@@ -823,7 +837,7 @@ void FrameLoaderClientQt::dispatchDidReceiveContentLength(WebCore::DocumentLoade
 {
 }
 
-void FrameLoaderClientQt::dispatchDidFinishLoading(WebCore::DocumentLoader* loader, unsigned long)
+void FrameLoaderClientQt::dispatchDidFinishLoading(WebCore::DocumentLoader*, unsigned long)
 {
 }
 
@@ -850,20 +864,58 @@ void FrameLoaderClientQt::dispatchDidLoadResourceByXMLHttpRequest(unsigned long,
     notImplemented();
 }
 
-void FrameLoaderClientQt::dispatchDidFailProvisionalLoad(const WebCore::ResourceError&)
+void FrameLoaderClientQt::callErrorPageExtension(const WebCore::ResourceError& error)
+{
+    QWebPage* page = m_webFrame->page();
+    if (page->supportsExtension(QWebPage::ErrorPageExtension)) {
+        QWebPage::ErrorPageExtensionOption option;
+
+        if (error.domain() == "QtNetwork")
+            option.domain = QWebPage::QtNetwork;
+        else if (error.domain() == "HTTP")
+            option.domain = QWebPage::Http;
+        else if (error.domain() == "WebKit")
+            option.domain = QWebPage::WebKit;
+        else
+            return;
+
+        option.url = QUrl(error.failingURL());
+        option.frame = m_webFrame;
+        option.error = error.errorCode();
+        option.errorString = error.localizedDescription();
+
+        QWebPage::ErrorPageExtensionReturn output;
+        if (!page->extension(QWebPage::ErrorPageExtension, &option, &output))
+            return;
+
+        KURL baseUrl(output.baseUrl);
+        KURL failingUrl(option.url);
+
+        WebCore::ResourceRequest request(baseUrl);
+        WTF::RefPtr<WebCore::SharedBuffer> buffer = WebCore::SharedBuffer::create(output.content.constData(), output.content.length());
+        WebCore::SubstituteData substituteData(buffer, output.contentType, output.encoding, failingUrl);
+        m_frame->loader()->load(request, substituteData, false);
+    }
+}
+
+void FrameLoaderClientQt::dispatchDidFailProvisionalLoad(const WebCore::ResourceError& error)
 {
     if (dumpFrameLoaderCallbacks)
         printf("%s - didFailProvisionalLoadWithError\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    m_loadSucceeded = false;
+    m_loadError = error;
+    if (!error.isNull() && !error.isCancellation())
+        callErrorPageExtension(error);
 }
 
-void FrameLoaderClientQt::dispatchDidFailLoad(const WebCore::ResourceError&)
+void FrameLoaderClientQt::dispatchDidFailLoad(const WebCore::ResourceError& error)
 {
     if (dumpFrameLoaderCallbacks)
         printf("%s - didFailLoadWithError\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    m_loadSucceeded = false;
+    m_loadError = error;
+    if (!error.isNull() && !error.isCancellation())
+        callErrorPageExtension(error);
 }
 
 WebCore::Frame* FrameLoaderClientQt::dispatchCreatePage()
@@ -946,7 +998,6 @@ void FrameLoaderClientQt::startDownload(const WebCore::ResourceRequest& request)
     if (!m_webFrame)
         return;
 
-    QWebPage *page = m_webFrame->page();
     emit m_webFrame->page()->downloadRequested(request.toNetworkRequest());
 #endif
 }
@@ -976,9 +1027,6 @@ PassRefPtr<Frame> FrameLoaderClientQt::createFrame(const KURL& url, const String
 
     // ### set override encoding if we have one
 
-    FrameLoadType loadType = m_frame->loader()->loadType();
-    FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedBackForwardList;
-
     frameData.frame->loader()->loadURLIntoChildFrame(frameData.url, frameData.referrer, frameData.frame.get());
 
     // The frame's onload handler may have removed it from the document.
@@ -1074,6 +1122,53 @@ public:
     }
 };
 
+#if QT_VERSION >= 0x040600
+class QtPluginGraphicsWidget: public Widget
+{
+public:
+    static RefPtr<QtPluginGraphicsWidget> create(QGraphicsWidget* w = 0)
+    {
+        return adoptRef(new QtPluginGraphicsWidget(w));
+    }
+
+    ~QtPluginGraphicsWidget()
+    {
+        if (graphicsWidget)
+            graphicsWidget->deleteLater();
+    }
+    virtual void invalidateRect(const IntRect& r)
+    {
+        QGraphicsScene* scene = graphicsWidget ? graphicsWidget->scene() : 0;
+        if (scene)
+            scene->update(QRect(r));
+    }
+    virtual void frameRectsChanged()
+    {
+        if (!graphicsWidget)
+            return;
+
+        IntRect windowRect = convertToContainingWindow(IntRect(0, 0, frameRect().width(), frameRect().height()));
+        graphicsWidget->setGeometry(QRect(windowRect));
+
+        // FIXME: clipping of graphics widgets
+    }
+    virtual void show()
+    {
+        if (graphicsWidget)
+            graphicsWidget->show();
+    }
+    virtual void hide()
+    {
+        if (graphicsWidget)
+            graphicsWidget->hide();
+    }
+private:
+    QtPluginGraphicsWidget(QGraphicsWidget* w = 0): Widget(0), graphicsWidget(w) {}
+
+    QGraphicsWidget* graphicsWidget;
+};
+#endif
+
 PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize, HTMLPlugInElement* element, const KURL& url, const Vector<String>& paramNames,
                                           const Vector<String>& paramValues, const String& mimeType, bool loadManually)
 {
@@ -1087,12 +1182,12 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
     QStringList values;
     QString classid(element->getAttribute("classid"));
 
-    for (int i = 0; i < paramNames.size(); ++i) {
+    for (unsigned i = 0; i < paramNames.size(); ++i) {
         params.append(paramNames[i]);
         if (paramNames[i] == "classid")
             classid = paramValues[i];
     }
-    for (int i = 0; i < paramValues.size(); ++i)
+    for (unsigned i = 0; i < paramValues.size(); ++i)
         values.append(paramValues[i]);
 
     QString urlStr(url.string());
@@ -1110,7 +1205,7 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
             if (!styleSheet.isEmpty())
                 styleSheet += QLatin1Char(';');
 
-            for (int i = 0; i < numqStyleSheetProperties; ++i) {
+            for (unsigned i = 0; i < numqStyleSheetProperties; ++i) {
                 CSSPropertyID property = qstyleSheetProperties[i];
 
                 styleSheet += QString::fromLatin1(::getPropertyName(property));
@@ -1135,15 +1230,26 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
         if (object) {
             QWidget* widget = qobject_cast<QWidget*>(object);
             if (widget) {
-                QWidget* view = m_webFrame->page()->view();
-                if (view)
-                    widget->setParent(view);
+                QWidget* parentWidget = qobject_cast<QWidget*>(m_webFrame->page()->d->client->pluginParent());
+                if (parentWidget)
+                    widget->setParent(parentWidget);
                 RefPtr<QtPluginWidget> w = adoptRef(new QtPluginWidget());
                 w->setPlatformWidget(widget);
                 // Make sure it's invisible until properly placed into the layout
                 w->setFrameRect(IntRect(0, 0, 0, 0));
                 return w;
             }
+#if QT_VERSION >= 0x040600
+            QGraphicsWidget* graphicsWidget = qobject_cast<QGraphicsWidget*>(object);
+            if (graphicsWidget) {
+                graphicsWidget->hide();
+                graphicsWidget->setParentItem(qobject_cast<QGraphicsObject*>(m_webFrame->page()->d->client->pluginParent()));
+                RefPtr<QtPluginGraphicsWidget> w = QtPluginGraphicsWidget::create(graphicsWidget);
+                // Make sure it's invisible until properly placed into the layout
+                w->setFrameRect(IntRect(0, 0, 0, 0));
+                return w;
+            }
+#endif
             // FIXME: make things work for widgetless plugins as well
             delete object;
     } else { // NPAPI Plugins
@@ -1162,8 +1268,8 @@ void FrameLoaderClientQt::redirectDataToPlugin(Widget* pluginWidget)
     m_hasSentResponseToPlugin = false;
 }
 
-PassRefPtr<Widget> FrameLoaderClientQt::createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL& baseURL,
-                                                    const Vector<String>& paramNames, const Vector<String>& paramValues)
+PassRefPtr<Widget> FrameLoaderClientQt::createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL&,
+                                                    const Vector<String>&, const Vector<String>&)
 {
     notImplemented();
     return 0;
diff --git a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index 754d8bc..66c4252 100644
--- a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -59,6 +59,7 @@ namespace WebCore {
 
         friend class ::QWebFrame;
         void callPolicyFunction(FramePolicyFunction function, PolicyAction action);
+        void callErrorPageExtension(const ResourceError&);
     signals:
         void loadStarted();
         void loadProgress(int d);
@@ -148,6 +149,9 @@ namespace WebCore {
         virtual void updateGlobalHistoryRedirectLinks();
         virtual bool shouldGoToHistoryItem(HistoryItem*) const;
 
+        virtual void didDisplayInsecureContent();
+        virtual void didRunInsecureContent(SecurityOrigin*);
+
         virtual ResourceError cancelledError(const ResourceRequest&);
         virtual ResourceError blockedError(const ResourceRequest&);
         virtual ResourceError cannotShowURLError(const ResourceRequest&);
@@ -211,7 +215,7 @@ namespace WebCore {
         WebCore::PluginView* m_pluginView;
         bool m_hasSentResponseToPlugin;
 
-        bool m_loadSucceeded;
+        ResourceError m_loadError;
     };
 
 }
diff --git a/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index d7f03d1..12f405c 100644
--- a/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -31,10 +31,13 @@
 #include "config.h"
 #include "InspectorClientQt.h"
 
+#include "qwebinspector.h"
+#include "qwebinspector_p.h"
 #include "qwebpage.h"
 #include "qwebpage_p.h"
 #include "qwebview.h"
 
+#include <QtCore/QSettings>
 #include <QtCore/QCoreApplication>
 
 #include "InspectorController.h"
@@ -44,49 +47,32 @@
 
 namespace WebCore {
 
-class InspectorClientWebPage : public QWebPage
-{
-    Q_OBJECT
-    friend class InspectorClientQt;
-public:
-    QWebPage* createWindow(QWebPage::WebWindowType)
-    {
-        QWidget *w = new QWebView(0);
-        QWebPage *page = new QWebPage(w);
-        page->setView(w);
-        connect(page, SIGNAL(destroyed()), w, SLOT(deleteLater()));
-        return page;
-    }
-
-Q_SIGNALS:
-    void attachRequested();
-    void detachRequested();
-};
+static const QLatin1String settingStoragePrefix("Qt/QtWebKit/QWebInspector/");
+static const QLatin1String settingStorageTypeSuffix(".type");
 
+static InspectorController::Setting variantToSetting(const QVariant& qvariant);
+static QVariant settingToVariant(const InspectorController::Setting& icSetting);
 
-class InspectorClientView : public QWebView {
+class InspectorClientWebPage : public QWebPage {
+    Q_OBJECT
+    friend class InspectorClientQt;
 public:
-    InspectorClientView(InspectorController* controller)
-        : QWebView(0)
-        , m_controller(controller)
+    InspectorClientWebPage(QObject* parent = 0)
+    : QWebPage(parent)
     {
-        setPage(new InspectorClientWebPage);
-        connect(page(), SIGNAL(destroyed()), SLOT(deleteLater()));
+        settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, false);
     }
 
-protected:
-
-    void closeEvent(QCloseEvent* ev)
+    QWebPage* createWindow(QWebPage::WebWindowType)
     {
-        QWidget::closeEvent(ev);
-        m_controller->setWindowVisible(false);
+        QWebView* view = new QWebView;
+        QWebPage* page = new QWebPage;
+        view->setPage(page);
+        view->setAttribute(Qt::WA_DeleteOnClose);
+        return page;
     }
-
-private:
-    InspectorController* m_controller;
 };
 
-
 InspectorClientQt::InspectorClientQt(QWebPage* page)
     : m_inspectedWebPage(page)
 {}
@@ -98,14 +84,16 @@ void InspectorClientQt::inspectorDestroyed()
 
 Page* InspectorClientQt::createPage()
 {
-    if (m_webPage)
-        return m_webPage->d->page;
+    QWebView* inspectorView = new QWebView;
+    InspectorClientWebPage* inspectorPage = new InspectorClientWebPage(inspectorView);
+    inspectorView->setPage(inspectorPage);
+    m_inspectorView.set(inspectorView);
+
+    inspectorPage->mainFrame()->load(QString::fromLatin1("qrc:/webkit/inspector/inspector.html"));
+    m_inspectedWebPage->d->inspectorFrontend = inspectorView;
+    m_inspectedWebPage->d->getOrCreateInspector()->d->setFrontend(inspectorView);
 
-    InspectorClientView* view = new InspectorClientView(m_inspectedWebPage->d->page->inspectorController());
-    m_webPage.set(qobject_cast<InspectorClientWebPage*>(view->page()));
-    m_webPage->mainFrame()->load(QString::fromLatin1("qrc:/webkit/inspector/inspector.html"));
-    m_webPage->view()->setMinimumSize(400,300);
-    return m_webPage->d->page;
+    return m_inspectorView->page()->d->page;
 }
 
 String InspectorClientQt::localizedStringsURL()
@@ -122,52 +110,37 @@ String InspectorClientQt::hiddenPanels()
 
 void InspectorClientQt::showWindow()
 {
-    if (!m_webPage)
-        return;
-
     updateWindowTitle();
-    m_webPage->view()->show();
-    m_inspectedWebPage->d->page->inspectorController()->setWindowVisible(true);
-}
 
-void InspectorClientQt::closeWindow()
-{
-    if (!m_webPage)
-        return;
-
-    m_webPage->view()->hide();
-    m_inspectedWebPage->d->page->inspectorController()->setWindowVisible(false);
+    m_inspectedWebPage->d->inspectorController()->setWindowVisible(true, true);
+    // We don't allow the inspector to ask for widget visibility itself because showWindow is
+    // not always called when we want.
+    // Inspecting an element or calling QWebInspector::show() should already have made the
+    // widget visible.
 }
 
-bool InspectorClientQt::windowVisible()
+void InspectorClientQt::closeWindow()
 {
-    if (!m_webPage)
-        return false;
-    return m_webPage->view()->isVisible();
+    if (m_inspectedWebPage->d->inspector)
+        m_inspectedWebPage->d->inspector->close();
 }
 
 void InspectorClientQt::attachWindow()
 {
-    if (!m_webPage)
-        return;
-
-    emit m_webPage->attachRequested();
+    notImplemented();
 }
 
 void InspectorClientQt::detachWindow()
 {
-    if (!m_webPage)
-        return;
-
-    emit m_webPage->detachRequested();
+    notImplemented();
 }
 
-void InspectorClientQt::setAttachedWindowHeight(unsigned height)
+void InspectorClientQt::setAttachedWindowHeight(unsigned)
 {
     notImplemented();
 }
 
-void InspectorClientQt::highlight(Node* node)
+void InspectorClientQt::highlight(Node*)
 {
     notImplemented();
 }
@@ -190,28 +163,112 @@ void InspectorClientQt::inspectorWindowObjectCleared()
 
 void InspectorClientQt::updateWindowTitle()
 {
-    if (!m_webPage)
-        return;
-
-    QString caption = QCoreApplication::translate("QWebPage", "Web Inspector - %2");
-    m_webPage->view()->setWindowTitle(caption.arg(m_inspectedURL));
+    if (m_inspectedWebPage->d->inspector) {
+        QString caption = QCoreApplication::translate("QWebPage", "Web Inspector - %2").arg(m_inspectedURL);
+        m_inspectedWebPage->d->inspector->setWindowTitle(caption);
+        emit m_inspectedWebPage->d->inspector->windowTitleChanged(caption);
+    }
 }
 
 void InspectorClientQt::populateSetting(const String& key, InspectorController::Setting& setting)
 {
-    notImplemented();
+    QSettings qsettings;
+    if (qsettings.status() == QSettings::AccessError) {
+        // QCoreApplication::setOrganizationName and QCoreApplication::setApplicationName haven't been called
+        qWarning("QWebInspector: QSettings couldn't read configuration setting [%s].",
+                 qPrintable(static_cast<QString>(key)));
+        return;
+    }
+
+    QString settingKey(settingStoragePrefix + key);
+    QString storedValueType = qsettings.value(settingKey + settingStorageTypeSuffix).toString();
+    QVariant storedValue = qsettings.value(settingKey);
+    storedValue.convert(QVariant::nameToType(storedValueType.toAscii().data()));
+    setting = variantToSetting(storedValue);
 }
 
 void InspectorClientQt::storeSetting(const String& key, const InspectorController::Setting& setting)
 {
-    notImplemented();
+    QSettings qsettings;
+    if (qsettings.status() == QSettings::AccessError) {
+        qWarning("QWebInspector: QSettings couldn't persist configuration setting [%s].",
+                 qPrintable(static_cast<QString>(key)));
+        return;
+    }
+
+    QVariant valueToStore = settingToVariant(setting);
+    QString settingKey(settingStoragePrefix + key);
+    qsettings.setValue(settingKey, valueToStore);
+    qsettings.setValue(settingKey + settingStorageTypeSuffix, QVariant::typeToName(valueToStore.type()));
 }
 
-void InspectorClientQt::removeSetting(const String& key)
+void InspectorClientQt::removeSetting(const String&)
 {
     notImplemented();
 }
 
+static InspectorController::Setting variantToSetting(const QVariant& qvariant)
+{
+    InspectorController::Setting retVal;
+
+    switch (qvariant.type()) {
+    case QVariant::Bool:
+        retVal.set(qvariant.toBool());
+        break;
+    case QVariant::Double:
+        retVal.set(qvariant.toDouble());
+        break;
+    case QVariant::Int:
+        retVal.set((long)qvariant.toInt());
+        break;
+    case QVariant::String:
+        retVal.set(qvariant.toString());
+        break;
+    case QVariant::StringList: {
+        QStringList qsList = qvariant.toStringList();
+        int listCount = qsList.count();
+        Vector<String> vector(listCount);
+        for (int i = 0; i < listCount; ++i)
+            vector[i] = qsList[i];
+        retVal.set(vector);
+        break;
+    }
+    }
+
+    return retVal;
+}
+
+static QVariant settingToVariant(const InspectorController::Setting& icSetting)
+{
+    QVariant retVal;
+
+    switch (icSetting.type()) {
+    case InspectorController::Setting::StringType:
+        retVal.setValue(static_cast<QString>(icSetting.string()));
+        break;
+    case InspectorController::Setting::StringVectorType: {
+        const Vector<String>& vector = icSetting.stringVector();
+        Vector<String>::const_iterator iter;
+        QStringList qsList;
+        for (iter = vector.begin(); iter != vector.end(); ++iter)
+            qsList << *iter;
+        retVal.setValue(qsList);
+        break;
+    }
+    case InspectorController::Setting::DoubleType:
+        retVal.setValue(icSetting.doubleValue());
+        break;
+    case InspectorController::Setting::IntegerType:
+        retVal.setValue((int)icSetting.integerValue());
+        break;
+    case InspectorController::Setting::BooleanType:
+        retVal.setValue(icSetting.booleanValue());
+        break;
+    }
+
+    return retVal;
+}
+
 }
 
 #include "InspectorClientQt.moc"
diff --git a/WebKit/qt/WebCoreSupport/InspectorClientQt.h b/WebKit/qt/WebCoreSupport/InspectorClientQt.h
index 03c684a..ccf8b69 100644
--- a/WebKit/qt/WebCoreSupport/InspectorClientQt.h
+++ b/WebKit/qt/WebCoreSupport/InspectorClientQt.h
@@ -35,12 +35,12 @@
 #include <QtCore/QString>
 
 class QWebPage;
+class QWebView;
 
 namespace WebCore {
     class Node;
     class Page;
     class String;
-    class InspectorClientWebPage;
 
     class InspectorClientQt : public InspectorClient {
     public:
@@ -56,7 +56,6 @@ namespace WebCore {
 
         virtual void showWindow();
         virtual void closeWindow();
-        virtual bool windowVisible();
 
         virtual void attachWindow();
         virtual void detachWindow();
@@ -76,7 +75,7 @@ namespace WebCore {
     private:
         void updateWindowTitle();
         QWebPage* m_inspectedWebPage;
-        OwnPtr<InspectorClientWebPage> m_webPage;
+        OwnPtr<QWebView> m_inspectorView;
         QString m_inspectedURL;
     };
 }
diff --git a/WebKit/qt/docs/qtwebkit.qdoc b/WebKit/qt/docs/qtwebkit.qdoc
index f3681ee..09dfae5 100644
--- a/WebKit/qt/docs/qtwebkit.qdoc
+++ b/WebKit/qt/docs/qtwebkit.qdoc
@@ -1,18 +1,70 @@
 /*!
     \module QtWebKit
     \title QtWebKit Module
-    \contentspage Qt's Modules
+    \contentspage All Qt Modules
     \previouspage QtSvg
     \nextpage QtXml
-    \ingroup architecture
     \ingroup modules
-    \brief An introduction to the QtWebKit module.
+    \brief The QtWebKit module provides a web browser engine as well as
+    classes to render and interact with web content.
 
-    \keyword Browser
-    \keyword Web Browser
+    To include the definitions of the module's classes, use the
+    following directive:
+
+    \snippet webkitsnippets/qtwebkit_build_snippet.qdoc 1
+
+    To link against the module, add this line to your \l qmake \c
+    .pro file:
+
+    \snippet webkitsnippets/qtwebkit_build_snippet.qdoc 0
+
+    \section1 License Information
+
+    This is a snapshot of the Qt port of WebKit. The exact version information
+    can be found in the \c{src/3rdparty/webkit/VERSION} file supplied with Qt.
 
+    Qt Commercial Edition licensees that wish to distribute applications that
+    use the QtWebKit module need to be aware of their obligations under the
+    GNU Lesser General Public License (LGPL). 
+
+    Developers using the Open Source Edition can choose to redistribute
+    the module under the appropriate version of the GNU LGPL; version 2.1
+    for applications and libraries licensed under the GNU GPL version 2,
+    or version 3 for applications and libraries licensed under the GNU
+    GPL version 2.
+
+    \legalese
+    WebKit is licensed under the GNU Library General Public License.
+    Individual contributor names and copyright dates can be found
+    inline in the code.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+    \endlegalese
+*/
+
+/*!
+    \page webintegration.html
+    \title Integrating Web Content with QtWebKit
     \since 4.4
 
+    \ingroup frameworks-technologies
+
+    \keyword Browser
+    \keyword Web Browser
+
     QtWebKit provides a Web browser engine that makes it easy to embed content
     from the World Wide Web into your Qt application. At the same time Web
     content can be enhanced with native controls.
@@ -55,20 +107,6 @@
 
     \tableofcontents
 
-    \section1 Configuring the Build Process
-
-    Applications using QtWebKit's classes need to be configured to be built
-    against the QtWebKit module. The following declaration in a \c qmake
-    project file ensures that an application is compiled and linked
-    appropriately:
-
-    \snippet webkitsnippets/qtwebkit_build_snippet.qdoc 0
-
-    To include the definitions of the module's classes, use the following
-    directive:
-
-    \snippet webkitsnippets/qtwebkit_build_snippet.qdoc 1
-
     \section1 Architecture
 
     The easiest way to render content is through the QWebView class. As a
@@ -101,15 +139,18 @@
 
     \section1 Netscape Plugin Support
 
+    \note Netscape plugin support is only available on desktop platforms.
+
     Since WebKit supports the Netscape Plugin API, Qt applications can display
-    Web pages that embed common plugins, as long as the user has the appropriate
+    Web pages that embed common plugins on platforms for which those plugins
+    are available. To enable plugin support, the user must have the appropriate
     binary files for those plugins installed and the \l{QWebSettings::PluginsEnabled}
-    attribute is enabled for the application.
+    attribute must be enabled for the application.
 
     The following locations are searched for plugins:
 
     \table
-    \header \o Linux/Unix  \o Windows
+    \header \o Linux/Unix (X11)  \o Windows
     \row \o{1,3}
     \list
     \o \c{.mozilla/plugins} in the user's home directory
@@ -158,40 +199,4 @@
     \o The system \c{/Library/Internet Plug-Ins} directory
     \endlist
     \endtable
-
-    \section1 License Information
-
-    This is a snapshot of the Qt port of WebKit. The exact version information
-    can be found in the \c{src/3rdparty/webkit/VERSION} file supplied with Qt.
-
-    Qt Commercial Edition licensees that wish to distribute applications that
-    use the QtWebKit module need to be aware of their obligations under the
-    GNU Lesser General Public License (LGPL). 
-
-    Developers using the Open Source Edition can choose to redistribute
-    the module under the appropriate version of the GNU LGPL; version 2.1
-    for applications and libraries licensed under the GNU GPL version 2,
-    or version 3 for applications and libraries licensed under the GNU
-    GPL version 2.
-
-    \legalese
-    WebKit is licensed under the GNU Library General Public License.
-    Individual contributor names and copyright dates can be found
-    inline in the code.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-    \endlegalese
 */
diff --git a/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp b/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp
new file mode 100644
index 0000000..0ba1cad
--- /dev/null
+++ b/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp
@@ -0,0 +1,17 @@
+
+void wrapInFunction()
+{
+
+//! [0]
+    // ...
+    QWebPage *page = new QWebPage;
+    // ...
+
+    QWebInspector *inspector = new QWebInspector;
+    inspector->setPage(page);
+
+    connect(page, SIGNAL(webInspectorTriggered(const QWebElement&)), inspector, SLOT(show()));
+//! [0]
+
+}
+
diff --git a/WebKit/qt/docs/webkitsnippets/simple/main.cpp b/WebKit/qt/docs/webkitsnippets/simple/main.cpp
index 82f5b6c..408630e 100644
--- a/WebKit/qt/docs/webkitsnippets/simple/main.cpp
+++ b/WebKit/qt/docs/webkitsnippets/simple/main.cpp
@@ -27,7 +27,7 @@ int main(int argc, char *argv[])
     QWidget *parent = 0;
 //! [Using QWebView]
     QWebView *view = new QWebView(parent);
-    view->load(QUrl("http://qtsoftware.com/"));
+    view->load(QUrl("http://qt.nokia.com/"));
     view->show();
 //! [Using QWebView]
     return app.exec();
diff --git a/WebKit/qt/docs/webkitsnippets/webpage/main.cpp b/WebKit/qt/docs/webkitsnippets/webpage/main.cpp
index b91bc30..393b16a 100644
--- a/WebKit/qt/docs/webkitsnippets/webpage/main.cpp
+++ b/WebKit/qt/docs/webkitsnippets/webpage/main.cpp
@@ -45,7 +45,7 @@ int main(int argc, char *argv[])
 {
     QApplication app(argc, argv);
 
-    Thumbnailer thumbnail(QUrl("http://qtsoftware.com"));
+    Thumbnailer thumbnail(QUrl("http://qt.nokia.com"));
 
     QObject::connect(&thumbnail, SIGNAL(finished()),
         &app, SLOT(quit()));
diff --git a/WebKit/qt/tests/benchmarks/loading/tst_loading.pro b/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
index af0387e..80717c2 100644
--- a/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
+++ b/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
@@ -4,3 +4,5 @@ include(../../../../../WebKit.pri)
 SOURCES += tst_loading.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0xA000E541
diff --git a/WebKit/qt/tests/benchmarks/painting/tst_painting.pro b/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
index 496210e..f45d804 100644
--- a/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
+++ b/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
@@ -4,3 +4,5 @@ include(../../../../../WebKit.pri)
 SOURCES += tst_painting.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0xA000E542
diff --git a/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro b/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
new file mode 100644
index 0000000..cba6f11
--- /dev/null
+++ b/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
@@ -0,0 +1,6 @@
+TEMPLATE = app
+TARGET = tst_qgraphicswebview
+include(../../../../WebKit.pri)
+SOURCES  += tst_qgraphicswebview.cpp
+QT += testlib network
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp b/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
new file mode 100644
index 0000000..1a57286
--- /dev/null
+++ b/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
@@ -0,0 +1,58 @@
+/*
+    Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <QtTest/QtTest>
+
+#include <qgraphicswebview.h>
+
+class tst_QGraphicsWebView : public QObject
+{
+    Q_OBJECT
+
+private slots:
+    void qgraphicswebview();
+};
+
+void tst_QGraphicsWebView::qgraphicswebview()
+{
+    QGraphicsWebView item;
+    item.url();
+    item.title();
+    item.icon();
+    item.zoomFactor();
+    item.isInteractive();
+    item.progress();
+    item.toHtml();
+    item.history();
+    item.settings();
+    item.status();
+    item.page();
+    item.setPage(0);
+    item.page();
+    item.setUrl(QUrl());
+    item.setZoomFactor(0);
+    item.setInteractive(true);
+    item.load(QUrl());
+    item.setHtml(QString());
+    item.setContent(QByteArray());
+}
+
+QTEST_MAIN(tst_QGraphicsWebView)
+
+#include "tst_qgraphicswebview.moc"
diff --git a/WebKit/qt/tests/qwebelement/qwebelement.pro b/WebKit/qt/tests/qwebelement/qwebelement.pro
index dd0b88a..0a140ad 100644
--- a/WebKit/qt/tests/qwebelement/qwebelement.pro
+++ b/WebKit/qt/tests/qwebelement/qwebelement.pro
@@ -5,3 +5,5 @@ SOURCES  += tst_qwebelement.cpp
 RESOURCES += qwebelement.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0xA000E53A
diff --git a/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index 0819a3a..00783d1 100644
--- a/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -71,15 +71,11 @@ private slots:
     void classes();
     void namespaceURI();
     void foreachManipulation();
-    void evaluateScript();
-    void callFunction();
-    void callFunctionSubmitForm();
-    void functionNames();
+    void evaluateJavaScript();
     void documentElement();
     void frame();
     void style();
     void computedStyle();
-    void properties();
     void appendAndPrepend();
     void insertBeforeAndAfter();
     void remove();
@@ -90,6 +86,7 @@ private slots:
     void nullSelect();
     void firstChildNextSibling();
     void lastChildPreviousSibling();
+    void hasSetFocus();
 
 private:
     QWebView* m_view;
@@ -282,69 +279,31 @@ void tst_QWebElement::foreachManipulation()
     QCOMPARE(body.findAll("div").count(), 4);
 }
 
-void tst_QWebElement::evaluateScript()
+void tst_QWebElement::evaluateJavaScript()
 {
     QVariant result;
     m_mainFrame->setHtml("<body><p>test");
     QWebElement para = m_mainFrame->findFirstElement("p");
 
-    result = para.evaluateScript("this.tagName");
+    result = para.evaluateJavaScript("this.tagName");
     QVERIFY(result.isValid());
     QVERIFY(result.type() == QVariant::String);
     QCOMPARE(result.toString(), QLatin1String("P"));
 
-    QVERIFY(para.functions().contains("hasAttributes"));
-    result = para.evaluateScript("this.hasAttributes()");
+    result = para.evaluateJavaScript("this.hasAttributes()");
     QVERIFY(result.isValid());
     QVERIFY(result.type() == QVariant::Bool);
     QVERIFY(!result.toBool());
 
-    para.evaluateScript("this.setAttribute('align', 'left');");
+    para.evaluateJavaScript("this.setAttribute('align', 'left');");
     QCOMPARE(para.attribute("align"), QLatin1String("left"));
 
-    result = para.evaluateScript("this.hasAttributes()");
+    result = para.evaluateJavaScript("this.hasAttributes()");
     QVERIFY(result.isValid());
     QVERIFY(result.type() == QVariant::Bool);
     QVERIFY(result.toBool());
 }
 
-void tst_QWebElement::callFunction()
-{
-    m_mainFrame->setHtml("<body><p>test");
-    QWebElement body = m_mainFrame->documentElement();
-    QVERIFY(body.functions().contains("hasChildNodes"));
-    QVariant result = body.callFunction("hasChildNodes");
-    QVERIFY(result.isValid());
-    QVERIFY(result.type() == QVariant::Bool);
-    QVERIFY(result.toBool());
-
-    body.callFunction("setAttribute", QVariantList() << "foo" << "bar");
-    QCOMPARE(body.attribute("foo"), QString("bar"));
-}
-
-void tst_QWebElement::callFunctionSubmitForm()
-{
-    m_mainFrame->setHtml(QString("<html><body><form name='tstform' action='data:text/html,foo'method='get'>"
-                                 "<input type='text'><input type='submit'></form></body></html>"), QUrl());
-
-    QWebElement form = m_mainFrame->documentElement().findAll("form").at(0);
-    QVERIFY(form.functions().contains("submit"));
-    QVERIFY(!form.isNull());
-    form.callFunction("submit");
-
-    waitForSignal(m_page, SIGNAL(loadFinished(bool)));
-    QCOMPARE(m_mainFrame->url().toString(), QString("data:text/html,foo?"));
-}
-
-void tst_QWebElement::functionNames()
-{
-    m_mainFrame->setHtml("<body><p>Test");
-
-    QWebElement body = m_mainFrame->documentElement();
-
-    QVERIFY(body.functions().contains("setAttribute"));
-}
-
 void tst_QWebElement::documentElement()
 {
     m_mainFrame->setHtml("<body><p>Test");
@@ -398,27 +357,27 @@ void tst_QWebElement::style()
     m_mainFrame->setHtml(html);
 
     QWebElement p = m_mainFrame->documentElement().findAll("p").at(0);
-    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
-    QVERIFY(p.styleProperty("cursor").isEmpty());
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    QVERIFY(p.styleProperty("cursor", QWebElement::InlineStyle).isEmpty());
 
     p.setStyleProperty("color", "red");
     p.setStyleProperty("cursor", "auto");
 
-    QCOMPARE(p.styleProperty("color"), QLatin1String("red"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("yellow"));
-    QCOMPARE(p.styleProperty("cursor"), QLatin1String("auto"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("red"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("yellow"));
+    QCOMPARE(p.styleProperty("cursor", QWebElement::InlineStyle), QLatin1String("auto"));
 
     p.setStyleProperty("color", "green !important");
-    QCOMPARE(p.styleProperty("color"), QLatin1String("green"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("green"));
 
     p.setStyleProperty("color", "blue");
-    QCOMPARE(p.styleProperty("color"), QLatin1String("green"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("green"));
 
-    p.setStyleProperty("color", "blue", QWebElement::ImportantStylePriority);
-    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("blue"));
+    p.setStyleProperty("color", "blue !important");
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("blue"));
 
     QString html2 = "<head>"
         "<style type='text/css'>"
@@ -434,8 +393,8 @@ void tst_QWebElement::style()
     m_mainFrame->setHtml(html2);
     p = m_mainFrame->documentElement().findAll("p").at(0);
 
-    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("blue"));
 
     QString html3 = "<head>"
         "<style type='text/css'>"
@@ -451,8 +410,8 @@ void tst_QWebElement::style()
     m_mainFrame->setHtml(html3);
     p = m_mainFrame->documentElement().findAll("p").at(0);
 
-    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("blue"));
 
     QString html5 = "<head>"
         "<style type='text/css'>"
@@ -468,8 +427,8 @@ void tst_QWebElement::style()
     m_mainFrame->setHtml(html5);
     p = m_mainFrame->documentElement().findAll("p").at(0);
 
-    QCOMPARE(p.styleProperty("color"), QLatin1String(""));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("red"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String(""));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("red"));
 
     QString html6 = "<head>"
         "<link rel='stylesheet' href='qrc:/style.css' type='text/css' />"
@@ -489,8 +448,8 @@ void tst_QWebElement::style()
     QTest::qWait(200);
 
     p = m_mainFrame->documentElement().findAll("p").at(0);
-    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("black"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("black"));
 
     QString html7 = "<head>"
         "<style type='text/css'>"
@@ -507,15 +466,15 @@ void tst_QWebElement::style()
     QTest::qWait(200);
 
     p = m_mainFrame->documentElement().findAll("p").at(0);
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("black"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("black"));
 
     QString html8 = "<body><p>some text</p></body>";
 
     m_mainFrame->setHtml(html8);
     p = m_mainFrame->documentElement().findAll("p").at(0);
 
-    QCOMPARE(p.styleProperty("color"), QLatin1String(""));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String(""));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String(""));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String(""));
 }
 
 void tst_QWebElement::computedStyle()
@@ -524,47 +483,16 @@ void tst_QWebElement::computedStyle()
     m_mainFrame->setHtml(html);
 
     QWebElement p = m_mainFrame->documentElement().findAll("p").at(0);
-    QCOMPARE(p.computedStyleProperty("cursor"), QLatin1String("auto"));
-    QVERIFY(!p.computedStyleProperty("cursor").isEmpty());
-    QVERIFY(p.styleProperty("cursor").isEmpty());
+    QCOMPARE(p.styleProperty("cursor", QWebElement::ComputedStyle), QLatin1String("auto"));
+    QVERIFY(!p.styleProperty("cursor", QWebElement::ComputedStyle).isEmpty());
+    QVERIFY(p.styleProperty("cursor", QWebElement::InlineStyle).isEmpty());
 
     p.setStyleProperty("cursor", "text");
     p.setStyleProperty("color", "red");
 
-    QCOMPARE(p.computedStyleProperty("cursor"), QLatin1String("text"));
-    QCOMPARE(p.computedStyleProperty("color"), QLatin1String("rgb(255, 0, 0)"));
-    QCOMPARE(p.styleProperty("color"), QLatin1String("red"));
-}
-
-void tst_QWebElement::properties()
-{
-    m_mainFrame->setHtml("<body><form><input type=checkbox id=ourcheckbox checked=true>");
-
-    QWebElement checkBox = m_mainFrame->findFirstElement("#ourcheckbox");
-    QVERIFY(!checkBox.isNull());
-
-    QVERIFY(checkBox.scriptableProperties().contains("checked"));
-
-    QCOMPARE(checkBox.scriptableProperty("checked"), QVariant(true));
-    checkBox.setScriptableProperty("checked", false);
-    QCOMPARE(checkBox.scriptableProperty("checked"), QVariant(false));
-
-    QVERIFY(!checkBox.scriptableProperties().contains("non_existant"));
-    QCOMPARE(checkBox.scriptableProperty("non_existant"), QVariant());
-
-    checkBox.setScriptableProperty("non_existant", "test");
-
-    QCOMPARE(checkBox.scriptableProperty("non_existant"), QVariant("test"));
-    QVERIFY(checkBox.scriptableProperties().contains("non_existant"));
-
-    // removing scriptableProperties is currently not supported. We should look into this
-    // and consider the option of just allowing through the QtScript API only.
-#if 0
-    checkBox.setScriptableProperty("non_existant", QVariant());
-
-    QCOMPARE(checkBox.scriptableProperty("non_existant"), QVariant());
-    QVERIFY(!checkBox.scriptableProperties().contains("non_existant"));
-#endif
+    QCOMPARE(p.styleProperty("cursor", QWebElement::ComputedStyle), QLatin1String("text"));
+    QCOMPARE(p.styleProperty("color", QWebElement::ComputedStyle), QLatin1String("rgb(255, 0, 0)"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("red"));
 }
 
 void tst_QWebElement::appendAndPrepend()
@@ -878,5 +806,24 @@ void tst_QWebElement::lastChildPreviousSibling()
     QVERIFY(p.previousSibling().isNull());
 }
 
+void tst_QWebElement::hasSetFocus()
+{
+    m_mainFrame->setHtml("<html><body>" \
+                            "<input type='text' id='input1'/>" \
+                            "<br>"\
+                            "<input type='text' id='input2'/>" \
+                            "</body></html>");
+
+    QList<QWebElement> inputs = m_mainFrame->documentElement().findAll("input");
+    QWebElement input1 = inputs.at(0);
+    input1.setFocus();
+    QVERIFY(input1.hasFocus());
+
+    QWebElement input2 = inputs.at(1);
+    input2.setFocus();
+    QVERIFY(!input1.hasFocus());
+    QVERIFY(input2.hasFocus());
+}
+
 QTEST_MAIN(tst_QWebElement)
 #include "tst_qwebelement.moc"
diff --git a/WebKit/qt/tests/qwebframe/qwebframe.pro b/WebKit/qt/tests/qwebframe/qwebframe.pro
index e45e6dc..4c92e91 100644
--- a/WebKit/qt/tests/qwebframe/qwebframe.pro
+++ b/WebKit/qt/tests/qwebframe/qwebframe.pro
@@ -5,3 +5,6 @@ SOURCES  += tst_qwebframe.cpp
 RESOURCES += qwebframe.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+DEFINES += SRCDIR=\\\"$$PWD/resources\\\"
+
+symbian:TARGET.UID3 = 0xA000E53D
diff --git a/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 17dea99..80c9d72 100644
--- a/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -33,7 +33,10 @@
 #include <QRegExp>
 #include <QNetworkRequest>
 #include <QNetworkReply>
+#ifndef QT_NO_OPENSSL
 #include <qsslerror.h>
+#endif
+#include "../util.h"
 
 //TESTED_CLASS=
 //TESTED_FILES=
@@ -578,8 +581,12 @@ private slots:
     void urlChange();
     void domCycles();
     void requestedUrl();
+    void javaScriptWindowObjectCleared_data();
+    void javaScriptWindowObjectCleared();
+    void javaScriptWindowObjectClearedOnEvaluate();
     void setHtml();
     void setHtmlWithResource();
+    void setHtmlWithBaseURL();
     void ipv6HostEncoding();
     void metaData();
     void popupFocus();
@@ -592,6 +599,7 @@ private slots:
     void hasSetFocus();
     void render();
     void scrollPosition();
+    void evaluateWillCauseRepaint();
 
 private:
     QString  evalJS(const QString&s) {
@@ -692,6 +700,7 @@ void tst_QWebFrame::init()
     m_page = m_view->page();
     m_myObject = new MyQObject();
     m_page->mainFrame()->addToJavaScriptWindowObject("myObject", m_myObject);
+    QDir::setCurrent(SRCDIR);
 }
 
 void tst_QWebFrame::cleanup()
@@ -2178,8 +2187,11 @@ public:
         if (request.url() == QUrl("qrc:/test1.html")) {
             setHeader(QNetworkRequest::LocationHeader, QString("qrc:/test2.html"));
             setAttribute(QNetworkRequest::RedirectionTargetAttribute, QUrl("qrc:/test2.html"));
-        } else if (request.url() == QUrl("qrc:/fake-ssl-error.html"))
+        }
+#ifndef QT_NO_OPENSSL
+        else if (request.url() == QUrl("qrc:/fake-ssl-error.html"))
             setError(QNetworkReply::SslHandshakeFailedError, tr("Fake error !")); // force a ssl error
+#endif
         else if (request.url() == QUrl("http://abcdef.abcdef/"))
             setError(QNetworkReply::HostNotFoundError, tr("Invalid URL"));
 
@@ -2206,8 +2218,10 @@ private slots:
             emit error(this->error());
         else if (request().url() == QUrl("http://abcdef.abcdef/"))
             emit metaDataChanged();
+#ifndef QT_NO_OPENSSL
         else if (request().url() == QUrl("qrc:/fake-ssl-error.html"))
             return;
+#endif
 
         emit readyRead();
         emit finished();
@@ -2227,12 +2241,14 @@ protected:
         if (op == QNetworkAccessManager::GetOperation)
             if (url == "qrc:/test1.html" ||  url == "http://abcdef.abcdef/")
                 return new FakeReply(request, this);
+#ifndef QT_NO_OPENSSL
             else if (url == "qrc:/fake-ssl-error.html") {
                 FakeReply* reply = new FakeReply(request, this);
                 QList<QSslError> errors;
                 emit sslErrors(reply, errors << QSslError(QSslError::UnspecifiedError));
                 return reply;
             }
+#endif
 
         return QNetworkAccessManager::createRequest(op, request, outgoingData);
     }
@@ -2266,6 +2282,7 @@ void tst_QWebFrame::requestedUrl()
     QCOMPARE(frame->requestedUrl(), QUrl("http://abcdef.abcdef/"));
     QCOMPARE(frame->url(), QUrl("http://abcdef.abcdef/"));
 
+#ifndef QT_NO_OPENSSL
     qRegisterMetaType<QList<QSslError> >("QList<QSslError>");
     qRegisterMetaType<QNetworkReply* >("QNetworkReply*");
 
@@ -2275,6 +2292,41 @@ void tst_QWebFrame::requestedUrl()
     QCOMPARE(spy2.count(), 1);
     QCOMPARE(frame->requestedUrl(), QUrl("qrc:/fake-ssl-error.html"));
     QCOMPARE(frame->url(), QUrl("qrc:/fake-ssl-error.html"));
+#endif
+}
+
+void tst_QWebFrame::javaScriptWindowObjectCleared_data()
+{
+    QTest::addColumn<QString>("html");
+    QTest::addColumn<int>("signalCount");
+    QTest::newRow("with <script>") << "<html><body><script></script><p>hello world</p></body></html>" << 1;
+    QTest::newRow("without <script>") << "<html><body><p>hello world</p></body></html>" << 0;
+}
+
+void tst_QWebFrame::javaScriptWindowObjectCleared()
+{
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+    QSignalSpy spy(frame, SIGNAL(javaScriptWindowObjectCleared()));
+    QFETCH(QString, html);
+    frame->setHtml(html);
+
+    QFETCH(int, signalCount);
+    QCOMPARE(spy.count(), signalCount);
+}
+
+void tst_QWebFrame::javaScriptWindowObjectClearedOnEvaluate()
+{
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+    QSignalSpy spy(frame, SIGNAL(javaScriptWindowObjectCleared()));
+    frame->setHtml("<html></html>");
+    QCOMPARE(spy.count(), 0);
+    frame->evaluateJavaScript("var a = 'a';");
+    QCOMPARE(spy.count(), 1);
+    // no new clear for a new script:
+    frame->evaluateJavaScript("var a = 1;");
+    QCOMPARE(spy.count(), 1);
 }
 
 void tst_QWebFrame::setHtml()
@@ -2317,7 +2369,29 @@ void tst_QWebFrame::setHtmlWithResource()
     QCOMPARE(spy.size(), 2);
 
     QWebElement p = frame->documentElement().findAll("p").at(0);
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("red"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("red"));
+}
+
+void tst_QWebFrame::setHtmlWithBaseURL()
+{
+    QString html("<html><body><p>hello world</p><img src='resources/image2.png'/></body></html>");
+
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+
+    // in few seconds, the image should be completey loaded
+    QSignalSpy spy(&page, SIGNAL(loadFinished(bool)));
+
+    frame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    QTest::qWait(200);
+    QCOMPARE(spy.count(), 1);
+
+    QCOMPARE(frame->evaluateJavaScript("document.images.length").toInt(), 1);
+    QCOMPARE(frame->evaluateJavaScript("document.images[0].width").toInt(), 128);
+    QCOMPARE(frame->evaluateJavaScript("document.images[0].height").toInt(), 128);
+
+    // no history item has to be added.
+    QCOMPARE(m_view->page()->history()->count(), 0);
 }
 
 class TestNetworkManager : public QNetworkAccessManager
@@ -2408,23 +2482,17 @@ void tst_QWebFrame::popupFocus()
     view.resize(400, 100);
     view.show();
     view.setFocus();
-    QTest::qWait(200);
-    QVERIFY2(view.hasFocus(),
-             "The WebView should be created");
+    QTRY_VERIFY(view.hasFocus());
 
     // open the popup by clicking. check if focus is on the popup
     QTest::mouseClick(&view, Qt::LeftButton, 0, QPoint(25, 25));
     QObject* webpopup = firstChildByClassName(&view, "WebCore::QWebPopup");
     QComboBox* combo = qobject_cast<QComboBox*>(webpopup);
-    QTest::qWait(500);
-    QVERIFY2(!view.hasFocus() && combo->view()->hasFocus(),
-             "Focus sould be on the Popup");
+    QTRY_VERIFY(!view.hasFocus() && combo->view()->hasFocus()); // Focus should be on the popup
 
     // hide the popup and check if focus is on the page
     combo->hidePopup();
-    QTest::qWait(500);
-    QVERIFY2(view.hasFocus() && !combo->view()->hasFocus(),
-             "Focus sould be back on the WebView");
+    QTRY_VERIFY(view.hasFocus() && !combo->view()->hasFocus()); // Focus should be back on the WebView
 
     // triple the flashing time, should at least blink twice already
     int delay = qApp->cursorFlashTime() * 3;
@@ -2592,16 +2660,16 @@ void tst_QWebFrame::hasSetFocus()
     QCOMPARE(loadSpy.size(), 2);
 
     m_page->mainFrame()->setFocus();
-    QVERIFY(m_page->mainFrame()->hasFocus());
+    QTRY_VERIFY(m_page->mainFrame()->hasFocus());
 
     for (int i = 0; i < children.size(); ++i) {
         children.at(i)->setFocus();
-        QVERIFY(children.at(i)->hasFocus());
+        QTRY_VERIFY(children.at(i)->hasFocus());
         QVERIFY(!m_page->mainFrame()->hasFocus());
     }
 
     m_page->mainFrame()->setFocus();
-    QVERIFY(m_page->mainFrame()->hasFocus());
+    QTRY_VERIFY(m_page->mainFrame()->hasFocus());
 }
 
 void tst_QWebFrame::render()
@@ -2669,5 +2737,24 @@ void tst_QWebFrame::scrollPosition()
     QCOMPARE(y, 29);
 }
 
+void tst_QWebFrame::evaluateWillCauseRepaint()
+{
+    QWebView view;
+    QString html("<html><body>top<div id=\"junk\" style=\"display: block;\">"
+                    "junk</div>bottom</body></html>");
+    view.setHtml(html);
+    view.show();
+
+    QTest::qWait(200);
+
+    view.page()->mainFrame()->evaluateJavaScript(
+        "document.getElementById('junk').style.display = 'none';");
+
+    ::waitForSignal(view.page(), SIGNAL(repaintRequested( const QRect &)));
+
+    QTest::qWait(2000);
+}
+
+
 QTEST_MAIN(tst_QWebFrame)
 #include "tst_qwebframe.moc"
diff --git a/WebKit/qt/tests/qwebhistory/qwebhistory.pro b/WebKit/qt/tests/qwebhistory/qwebhistory.pro
index fd1074c..8ee63cc 100644
--- a/WebKit/qt/tests/qwebhistory/qwebhistory.pro
+++ b/WebKit/qt/tests/qwebhistory/qwebhistory.pro
@@ -5,3 +5,5 @@ SOURCES  += tst_qwebhistory.cpp
 RESOURCES  += tst_qwebhistory.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0xA000E53B
diff --git a/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp b/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
index 5b55613..4f4d3c4 100644
--- a/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
+++ b/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
@@ -18,6 +18,7 @@
 */
 
 #include <QtTest/QtTest>
+#include <QAction>
 
 #include "qwebpage.h"
 #include "qwebview.h"
@@ -58,6 +59,11 @@ private slots:
     void saveAndRestore_1();  //simple checks saveState and restoreState
     void saveAndRestore_2();  //bad parameters saveState and restoreState
     void saveAndRestore_3();  //try use different version
+    void saveAndRestore_crash_1();
+    void saveAndRestore_crash_2();
+    void saveAndRestore_crash_3();
+    void clear();
+
 
 private:
     QWebPage* page;
@@ -119,6 +125,8 @@ void tst_QWebHistory::back()
         hist->back();
         waitForLoadFinished.exec();
     }
+    //try one more time (too many). crash test
+    hist->back();
 }
 
 /**
@@ -137,6 +145,8 @@ void tst_QWebHistory::forward()
         hist->forward();
         waitForLoadFinished.exec();
     }
+    //try one more time (too many). crash test
+    hist->forward();
 }
 
 /**
@@ -287,10 +297,13 @@ void tst_QWebHistory::serialize_3()
 /** Simple checks should be a bit redundant to streaming operators */
 void tst_QWebHistory::saveAndRestore_1() 
 {
+    QAction* actionBack = page->action(QWebPage::Back);
     hist->back();
     waitForLoadFinished.exec();
+    QVERIFY(actionBack->isEnabled());
     QByteArray buffer(hist->saveState());
     hist->clear();
+    QVERIFY(!actionBack->isEnabled());
     QVERIFY(hist->count() == 1);
     hist->restoreState(buffer);
 
@@ -301,6 +314,7 @@ void tst_QWebHistory::saveAndRestore_1()
     QCOMPARE(hist->currentItemIndex(), histsize - 2);
     QCOMPARE(hist->itemAt(0).title(), QString("page1"));
     QCOMPARE(hist->itemAt(histsize - 1).title(), QString("page") + QString::number(histsize));
+    QVERIFY(actionBack->isEnabled());
 }
 
 /** Check returns value if there are bad parameters. Actually, result
@@ -322,5 +336,67 @@ void tst_QWebHistory::saveAndRestore_3()
     QVERIFY(hist->itemAt(3).isValid());
 }
 
+/** The test shouldn't crash */
+void tst_QWebHistory::saveAndRestore_crash_1()
+{
+    QByteArray tmp = hist->saveState();
+    for (unsigned i = 0; i < 5; i++){
+        hist->restoreState(tmp);
+        hist->saveState();
+    }
+}
+
+/** The test shouldn't crash */
+void tst_QWebHistory::saveAndRestore_crash_2()
+{
+    QByteArray tmp = hist->saveState();
+    QWebPage* page2 = new QWebPage(this);
+    QWebHistory* hist2 = page2->history();
+    for (unsigned i = 0; i < 5; i++){
+        hist2->restoreState(tmp);
+        hist2->saveState();
+    }
+    delete page2;
+}
+
+/** The test shouldn't crash */
+void tst_QWebHistory::saveAndRestore_crash_3()
+{
+    QByteArray tmp = hist->saveState();
+    QWebPage* page2 = new QWebPage(this);
+    QWebHistory* hist1 = hist;
+    QWebHistory* hist2 = page2->history();
+    for (unsigned i = 0; i < 5; i++){
+        hist1->restoreState(tmp);
+        hist2->restoreState(tmp);
+        QVERIFY(hist1->count() == hist2->count());
+        QVERIFY(hist1->count() == histsize);
+        hist2->back();
+        tmp = hist2->saveState();
+        hist2->clear();
+    }
+    delete page2;
+}
+
+/** ::clear */
+void tst_QWebHistory::clear()
+{
+    QAction* actionBack = page->action(QWebPage::Back);
+    QVERIFY(actionBack->isEnabled());
+    hist->saveState();
+    QVERIFY(hist->count() > 1);
+    hist->clear();
+    QVERIFY(hist->count() == 1);  // Leave current item.
+    QVERIFY(!actionBack->isEnabled());
+
+
+    QWebPage* page2 = new QWebPage(this);
+    QWebHistory* hist2 = page2->history();
+    QVERIFY(hist2->count() == 0);
+    hist2->clear();
+    QVERIFY(hist2->count() == 0); // Do not change anything.
+    delete page2;
+}
+
 QTEST_MAIN(tst_QWebHistory)
 #include "tst_qwebhistory.moc"
diff --git a/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro b/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
index af3b348..53e1afe 100644
--- a/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
+++ b/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
@@ -4,3 +4,5 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qwebhistoryinterface.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0xA000E53C
diff --git a/WebKit/qt/tests/qwebpage/qwebpage.pro b/WebKit/qt/tests/qwebpage/qwebpage.pro
index 2f3a108..82ffac6 100644
--- a/WebKit/qt/tests/qwebpage/qwebpage.pro
+++ b/WebKit/qt/tests/qwebpage/qwebpage.pro
@@ -5,3 +5,5 @@ SOURCES  += tst_qwebpage.cpp
 RESOURCES  += tst_qwebpage.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0xA000E53E
diff --git a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 966f049..a9f9f16 100644
--- a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -20,6 +20,7 @@
 
 #include <QtTest/QtTest>
 
+#include <qwebelement.h>
 #include <qwebpage.h>
 #include <qwidget.h>
 #include <qwebview.h>
@@ -59,7 +60,7 @@
  * \return \p true if the requested signal was received
  *         \p false on timeout
  */
-static bool waitForSignal(QObject* obj, const char* signal, int timeout = 0)
+static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
 {
     QEventLoop loop;
     QObject::connect(obj, signal, &loop, SLOT(quit()));
@@ -110,9 +111,13 @@ private slots:
     void frameAt();
     void requestCache();
     void protectBindingsRuntimeObjectsFromCollector();
+    void localURLSchemes();
+    void testOptionalJSObjects();
+    void testEnablePersistentStorage();
+    void consoleOutput();
+    void inputMethods();
 
-private:
-
+    void crashTests_LazyInitializationOfMainFrame();
 
 private:
     QWebView* m_view;
@@ -217,6 +222,9 @@ void tst_QWebPage::infiniteLoopJS()
 
 void tst_QWebPage::loadFinished()
 {
+    qRegisterMetaType<QWebFrame*>("QWebFrame*");
+    qRegisterMetaType<QNetworkRequest*>("QNetworkRequest*");
+    QSignalSpy spyNetworkRequestStarted(m_page, SIGNAL(networkRequestStarted(QWebFrame*, QNetworkRequest*)));
     QSignalSpy spyLoadStarted(m_view, SIGNAL(loadStarted()));
     QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
 
@@ -227,6 +235,7 @@ void tst_QWebPage::loadFinished()
 
     QTest::qWait(3000);
 
+    QVERIFY(spyNetworkRequestStarted.count() > 1);
     QVERIFY(spyLoadStarted.count() > 1);
     QVERIFY(spyLoadFinished.count() > 1);
 
@@ -238,6 +247,31 @@ void tst_QWebPage::loadFinished()
     QCOMPARE(spyLoadFinished.count(), 1);
 }
 
+class ConsolePage : public QWebPage
+{
+public:
+    ConsolePage(QObject* parent = 0) : QWebPage(parent) {}
+
+    virtual void javaScriptConsoleMessage(const QString& message, int lineNumber, const QString& sourceID)
+    {
+        messages.append(message);
+        lineNumbers.append(lineNumber);
+        sourceIDs.append(sourceID);
+    }
+
+    QStringList messages;
+    QList<int> lineNumbers;
+    QStringList sourceIDs;
+};
+
+void tst_QWebPage::consoleOutput()
+{
+    ConsolePage page;
+    page.mainFrame()->evaluateJavaScript("this is not valid JavaScript");
+    QCOMPARE(page.messages.count(), 1);
+    QCOMPARE(page.lineNumbers.at(0), 1);
+}
+
 class TestPage : public QWebPage
 {
 public:
@@ -316,13 +350,13 @@ void tst_QWebPage::userStyleSheet()
     m_page->setNetworkAccessManager(networkManager);
     networkManager->requestedUrls.clear();
 
-    m_page->settings()->setUserStyleSheetUrl(QUrl("data:text/css,p { background-image: url('http://does.not/exist.png');}"));
+    m_page->settings()->setUserStyleSheetUrl(QUrl("data:text/css;charset=utf-8;base64,"
+            + QByteArray("p { background-image: url('http://does.not/exist.png');}").toBase64()));
     m_view->setHtml("<p>hello world</p>");
     QVERIFY(::waitForSignal(m_view, SIGNAL(loadFinished(bool))));
 
-    QVERIFY(networkManager->requestedUrls.count() >= 2);
-    QCOMPARE(networkManager->requestedUrls.at(0), QUrl("data:text/css,p { background-image: url('http://does.not/exist.png');}"));
-    QCOMPARE(networkManager->requestedUrls.at(1), QUrl("http://does.not/exist.png"));
+    QVERIFY(networkManager->requestedUrls.count() >= 1);
+    QCOMPARE(networkManager->requestedUrls.at(0), QUrl("http://does.not/exist.png"));
 }
 
 void tst_QWebPage::modified()
@@ -405,6 +439,10 @@ void tst_QWebPage::database()
     QWebSettings::setOfflineStorageDefaultQuota(1024 * 1024);
     QVERIFY(QWebSettings::offlineStorageDefaultQuota() == 1024 * 1024);
 
+    m_page->settings()->setAttribute(QWebSettings::LocalStorageEnabled, true);
+    m_page->settings()->setAttribute(QWebSettings::SessionStorageEnabled, true);
+    m_page->settings()->setAttribute(QWebSettings::OfflineStorageDatabaseEnabled, true);
+
     QString dbFileName = path + "Databases.db";
 
     if (QFile::exists(dbFileName))
@@ -432,14 +470,19 @@ void tst_QWebPage::database()
     m_page->mainFrame()->evaluateJavaScript("var db3; db3=openDatabase('testdb', '1.0', 'test database API', 50000);db3.transaction(function(tx) { tx.executeSql('CREATE TABLE IF NOT EXISTS Test (text TEXT)', []); }, function(tx, result) { }, function(tx, error) { });");
     QTest::qWait(200);
 
+    // Remove all databases.
     QWebSecurityOrigin origin = m_page->mainFrame()->securityOrigin();
     QList<QWebDatabase> dbs = origin.databases();
-    if (dbs.count() > 0) {
-        QString fileName = dbs[0].fileName();
+    for (int i = 0; i < dbs.count(); i++) {
+        QString fileName = dbs[i].fileName();
         QVERIFY(QFile::exists(fileName));
-        QWebDatabase::removeDatabase(dbs[0]);
+        QWebDatabase::removeDatabase(dbs[i]);
         QVERIFY(!QFile::exists(fileName));
     }
+    QVERIFY(!origin.databases().size());
+    // Remove removed test :-)
+    QWebDatabase::removeAllDatabases();
+    QVERIFY(!origin.databases().size());
     QTest::qWait(1000);
 }
 
@@ -627,7 +670,6 @@ void tst_QWebPage::createViewlessPlugin()
 // import private API
 void QWEBKIT_EXPORT qt_webpage_setGroupName(QWebPage* page, const QString& groupName);
 QString QWEBKIT_EXPORT qt_webpage_groupName(QWebPage* page);
-void QWEBKIT_EXPORT qt_websettings_setLocalStorageDatabasePath(QWebSettings* settings, const QString& path);
 
 void tst_QWebPage::multiplePageGroupsAndLocalStorage()
 {
@@ -638,9 +680,11 @@ void tst_QWebPage::multiplePageGroupsAndLocalStorage()
     QWebView view1;
     QWebView view2;
 
-    qt_websettings_setLocalStorageDatabasePath(view1.page()->settings(), QDir::toNativeSeparators(QDir::currentPath() + "/path1"));
+    view1.page()->settings()->setAttribute(QWebSettings::LocalStorageEnabled, true);
+    view1.page()->settings()->setLocalStoragePath(QDir::toNativeSeparators(QDir::currentPath() + "/path1"));
     qt_webpage_setGroupName(view1.page(), "group1");
-    qt_websettings_setLocalStorageDatabasePath(view2.page()->settings(), QDir::toNativeSeparators(QDir::currentPath() + "/path2"));
+    view2.page()->settings()->setAttribute(QWebSettings::LocalStorageEnabled, true);    
+    view2.page()->settings()->setLocalStoragePath(QDir::toNativeSeparators(QDir::currentPath() + "/path2"));
     qt_webpage_setGroupName(view2.page(), "group2");
     QCOMPARE(qt_webpage_groupName(view1.page()), QString("group1"));
     QCOMPARE(qt_webpage_groupName(view2.page()), QString("group2"));
@@ -1165,6 +1209,94 @@ void tst_QWebPage::frameAt()
     frameAtHelper(webPage, webPage->mainFrame(), webPage->mainFrame()->pos());
 }
 
+void tst_QWebPage::inputMethods()
+{
+    m_view->page()->mainFrame()->setHtml("<html><body>" \
+                                            "<input type='text' id='input1' style='font-family: serif' value='' maxlength='20'/>" \
+                                            "</body></html>");
+    m_view->page()->mainFrame()->setFocus();
+
+    QList<QWebElement> inputs = m_view->page()->mainFrame()->documentElement().findAll("input");
+
+    QMouseEvent evpres(QEvent::MouseButtonPress, inputs.at(0).geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
+    m_view->page()->event(&evpres);
+    QMouseEvent evrel(QEvent::MouseButtonRelease, inputs.at(0).geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
+    m_view->page()->event(&evrel);
+
+    //ImMicroFocus
+    QVariant variant = m_view->page()->inputMethodQuery(Qt::ImMicroFocus);
+    QRect focusRect = variant.toRect();
+    QVERIFY(inputs.at(0).geometry().contains(variant.toRect().topLeft()));
+
+    //ImFont
+    variant = m_view->page()->inputMethodQuery(Qt::ImFont);
+    QFont font = variant.value<QFont>();
+    QCOMPARE(QString("-webkit-serif"), font.family());
+
+    QList<QInputMethodEvent::Attribute> inputAttributes;
+
+    //Insert text.
+    {
+        QInputMethodEvent eventText("QtWebKit", inputAttributes);
+        QSignalSpy signalSpy(m_view->page(), SIGNAL(microFocusChanged()));
+        m_view->page()->event(&eventText);
+        QCOMPARE(signalSpy.count(), 0);
+    }
+
+    {
+        QInputMethodEvent eventText("", inputAttributes);
+        eventText.setCommitString(QString("QtWebKit"), 0, 0);
+        m_view->page()->event(&eventText);
+    }
+
+#if QT_VERSION >= 0x040600
+    //ImMaximumTextLength
+    variant = m_view->page()->inputMethodQuery(Qt::ImMaximumTextLength);
+    QCOMPARE(20, variant.toInt());
+
+    //Set selection
+    inputAttributes << QInputMethodEvent::Attribute(QInputMethodEvent::Selection, 3, 2, QVariant());
+    QInputMethodEvent eventSelection("",inputAttributes);
+    m_view->page()->event(&eventSelection);
+
+    //ImAnchorPosition
+    variant = m_view->page()->inputMethodQuery(Qt::ImAnchorPosition);
+    int anchorPosition =  variant.toInt();
+    QCOMPARE(anchorPosition, 3);
+
+    //ImCursorPosition
+    variant = m_view->page()->inputMethodQuery(Qt::ImCursorPosition);
+    int cursorPosition =  variant.toInt();
+    QCOMPARE(cursorPosition, 5);
+
+    //ImCurrentSelection
+    variant = m_view->page()->inputMethodQuery(Qt::ImCurrentSelection);
+    QString selectionValue = variant.value<QString>();
+    QCOMPARE(selectionValue, QString("eb"));
+#endif
+
+    //ImSurroundingText
+    variant = m_view->page()->inputMethodQuery(Qt::ImSurroundingText);
+    QString value = variant.value<QString>();
+    QCOMPARE(value, QString("QtWebKit"));
+
+#if QT_VERSION >= 0x040600
+    {
+        QList<QInputMethodEvent::Attribute> attributes;
+        // Clear the selection, so the next test does not clear any contents.
+        QInputMethodEvent::Attribute newSelection(QInputMethodEvent::Selection, 0, 0, QVariant());
+        attributes.append(newSelection);
+        QInputMethodEvent event("composition", attributes);
+        m_view->page()->event(&event);
+    }
+
+    // A ongoing composition should not change the surrounding text before it is committed.
+    variant = m_view->page()->inputMethodQuery(Qt::ImSurroundingText);
+    value = variant.value<QString>();
+    QCOMPARE(value, QString("QtWebKit"));
+#endif
+}
+
 // import a little DRT helper function to trigger the garbage collector
 void QWEBKIT_EXPORT qt_drt_garbageCollector_collect();
 
@@ -1190,5 +1322,104 @@ void tst_QWebPage::protectBindingsRuntimeObjectsFromCollector()
     newPage->mainFrame()->evaluateJavaScript("testme('bar')");
 }
 
+void tst_QWebPage::localURLSchemes()
+{
+    int i = QWebSecurityOrigin::localSchemes().size();
+    QWebSecurityOrigin::removeLocalScheme("file");
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+    QWebSecurityOrigin::addLocalScheme("file");
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+    QString myscheme = "myscheme";
+    QWebSecurityOrigin::addLocalScheme(myscheme);
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i + 1);
+    QVERIFY(QWebSecurityOrigin::localSchemes().contains(myscheme));
+    QWebSecurityOrigin::removeLocalScheme(myscheme);
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+    QWebSecurityOrigin::removeLocalScheme(myscheme);
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+}
+
+static inline bool testFlag(QWebPage& webPage, QWebSettings::WebAttribute settingAttribute, const QString& jsObjectName, bool settingValue)
+{
+    webPage.settings()->setAttribute(settingAttribute, settingValue);
+    return webPage.mainFrame()->evaluateJavaScript(QString("(window.%1 != undefined)").arg(jsObjectName)).toBool();
+}
+
+void tst_QWebPage::testOptionalJSObjects()
+{
+    // Once a feature is enabled and the JS object is accessed turning off the setting will not turn off
+    // the visibility of the JS object any more. For this reason this test uses two QWebPage instances.
+    // Part of the test is to make sure that the QWebPage instances do not interfere with each other so turning on
+    // a feature for one instance will not turn it on for another.
+
+    QWebPage webPage1;
+    QWebPage webPage2;
+
+    webPage1.currentFrame()->setHtml(QString("<html><body>test</body></html>"), QUrl());
+    webPage2.currentFrame()->setHtml(QString("<html><body>test</body></html>"), QUrl());
+
+    QEXPECT_FAIL("","Feature enabled/disabled checking problem. Look at bugs.webkit.org/show_bug.cgi?id=29867", Continue);
+    QCOMPARE(testFlag(webPage1, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", true),  true);
+    QEXPECT_FAIL("","Feature enabled/disabled checking problem. Look at bugs.webkit.org/show_bug.cgi?id=29867", Continue);
+    QCOMPARE(testFlag(webPage1, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), true);
+
+    QCOMPARE(testFlag(webPage1, QWebSettings::LocalStorageEnabled, "localStorage", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::LocalStorageEnabled, "localStorage", true),  true);
+    QCOMPARE(testFlag(webPage1, QWebSettings::LocalStorageEnabled, "localStorage", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::LocalStorageEnabled, "localStorage", false), true);
+
+    QCOMPARE(testFlag(webPage1, QWebSettings::SessionStorageEnabled, "sessionStorage", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::SessionStorageEnabled, "sessionStorage", true),  true);
+    QCOMPARE(testFlag(webPage1, QWebSettings::SessionStorageEnabled, "sessionStorage", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::SessionStorageEnabled, "sessionStorage", false), true);
+}
+
+void tst_QWebPage::testEnablePersistentStorage()
+{
+    QWebPage webPage;
+
+    // By default all persistent options should be disabled
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::LocalStorageEnabled), false);
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineStorageDatabaseEnabled), false);
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineWebApplicationCacheEnabled), false);
+    QVERIFY(webPage.settings()->iconDatabasePath().isEmpty());
+
+    QWebSettings::enablePersistentStorage();
+
+    // Give it some time to initialize - icon database needs it
+    QTest::qWait(1000);
+
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::LocalStorageEnabled), true);
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineStorageDatabaseEnabled), true);
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineWebApplicationCacheEnabled), true);
+
+    QVERIFY(!webPage.settings()->offlineStoragePath().isEmpty());
+    QVERIFY(!webPage.settings()->offlineWebApplicationCachePath().isEmpty());
+    QVERIFY(!webPage.settings()->iconDatabasePath().isEmpty());
+}
+
+void tst_QWebPage::crashTests_LazyInitializationOfMainFrame()
+{
+    {
+        QWebPage webPage;
+    }
+    {
+        QWebPage webPage;
+        webPage.selectedText();
+    }
+    {
+        QWebPage webPage;
+        webPage.triggerAction(QWebPage::Back, true);
+    }
+    {
+        QWebPage webPage;
+        QPoint pos(10,10);
+        webPage.updatePositionDependentActions(pos);
+    }
+}
+
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro b/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
index 5d10993..1376ca5 100644
--- a/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
+++ b/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
@@ -4,3 +4,5 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qwebplugindatabase.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0xA000E540
diff --git a/WebKit/qt/tests/qwebplugindatabase/tst_qwebplugindatabase.cpp b/WebKit/qt/tests/qwebplugindatabase/tst_qwebplugindatabase.cpp
index c0533ad..1ee6206 100644
--- a/WebKit/qt/tests/qwebplugindatabase/tst_qwebplugindatabase.cpp
+++ b/WebKit/qt/tests/qwebplugindatabase/tst_qwebplugindatabase.cpp
@@ -40,6 +40,8 @@ private slots:
     void operatorequal_data();
     void operatorequal();
     void preferredPlugin();
+    void operatorassign_data();
+    void operatorassign();
 };
 
 typedef QWebPluginInfo::MimeType MimeType;
@@ -396,6 +398,40 @@ void tst_QWebPluginDatabase::preferredPlugin()
     }
 }
 
+void tst_QWebPluginDatabase::operatorassign_data()
+{
+    QTest::addColumn<QWebPluginInfo>("first");
+    QTest::addColumn<QWebPluginInfo>("second");
+
+    QWebPluginDatabase* database = QWebSettings::pluginDatabase();
+    QTest::newRow("null") << QWebPluginInfo() << QWebPluginInfo();
+
+    QList<QWebPluginInfo> plugins = database->plugins();
+    for (int i = 0; i < (plugins.count() - 1); ++i) {
+        QWebPluginInfo first = plugins.at(i);
+        QWebPluginInfo second = plugins.at(i + 1);
+
+        QTest::newRow(QString("%1=%2").arg(first.name(), second.name()).toUtf8().constData()) << first << second;
+    }
+}
+
+void tst_QWebPluginDatabase::operatorassign()
+{
+    QFETCH(QWebPluginInfo, first);
+    QFETCH(QWebPluginInfo, second);
+
+    QWebPluginInfo info;
+    QCOMPARE(info.mimeTypes(), QList<MimeType>());
+    QCOMPARE(info = first, first);
+    QCOMPARE(info, first);
+    QCOMPARE(info.mimeTypes(), first.mimeTypes());
+    QCOMPARE(info = second, second);
+    QCOMPARE(info, second);
+    QCOMPARE(info.mimeTypes(), second.mimeTypes());
+    QCOMPARE(info = QWebPluginInfo(), QWebPluginInfo());
+    QCOMPARE(info.mimeTypes(), QList<MimeType>());
+}
+
 QTEST_MAIN(tst_QWebPluginDatabase)
 
 #include "tst_qwebplugindatabase.moc"
diff --git a/WebKit/qt/tests/qwebview/qwebview.pro b/WebKit/qt/tests/qwebview/qwebview.pro
index 799ccfb..d9d122c 100644
--- a/WebKit/qt/tests/qwebview/qwebview.pro
+++ b/WebKit/qt/tests/qwebview/qwebview.pro
@@ -4,3 +4,5 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qwebview.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0xA000E53F
diff --git a/WebKit/qt/tests/tests.pro b/WebKit/qt/tests/tests.pro
index b5f66ee..81cc8f3 100644
--- a/WebKit/qt/tests/tests.pro
+++ b/WebKit/qt/tests/tests.pro
@@ -1,4 +1,4 @@
 
 TEMPLATE = subdirs
-SUBDIRS = qwebframe qwebpage qwebelement qwebhistoryinterface qwebplugindatabase qwebview qwebhistory
+SUBDIRS = qwebframe qwebpage qwebelement qgraphicswebview qwebhistoryinterface qwebplugindatabase qwebview qwebhistory
 greaterThan(QT_MINOR_VERSION, 4): SUBDIRS += benchmarks/painting/tst_painting.pro benchmarks/loading/tst_loading.pro
diff --git a/WebKit/qt/tests/util.h b/WebKit/qt/tests/util.h
new file mode 100644
index 0000000..7f7e613
--- /dev/null
+++ b/WebKit/qt/tests/util.h
@@ -0,0 +1,48 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+// Functions and macros that really need to be in QTestLib
+
+// Will try to wait for the condition while allowing event processing
+#define QTRY_VERIFY(__expr) \
+    do { \
+        const int __step = 50; \
+        const int __timeout = 5000; \
+        if (!(__expr)) { \
+            QTest::qWait(0); \
+        } \
+        for (int __i = 0; __i < __timeout && !(__expr); __i+=__step) { \
+            QTest::qWait(__step); \
+        } \
+        QVERIFY(__expr); \
+    } while(0)
+
+// Will try to wait for the condition while allowing event processing
+#define QTRY_COMPARE(__expr, __expected) \
+    do { \
+        const int __step = 50; \
+        const int __timeout = 5000; \
+        if ((__expr) != (__expected)) { \
+            QTest::qWait(0); \
+        } \
+        for (int __i = 0; __i < __timeout && ((__expr) != (__expected)); __i+=__step) { \
+            QTest::qWait(__step); \
+        } \
+        QCOMPARE(__expr, __expected); \
+    } while(0)
+
diff --git a/WebKit/win/AccessibleBase.cpp b/WebKit/win/AccessibleBase.cpp
index df91151..d02ec7e 100644
--- a/WebKit/win/AccessibleBase.cpp
+++ b/WebKit/win/AccessibleBase.cpp
@@ -105,7 +105,7 @@ HRESULT STDMETHODCALLTYPE AccessibleBase::get_accParent(IDispatch** parent)
     if (!m_object || !m_object->topDocumentFrameView())
         return E_FAIL;
 
-    return WebView::AccessibleObjectFromWindow(m_object->topDocumentFrameView()->hostWindow()->platformWindow(),
+    return WebView::AccessibleObjectFromWindow(m_object->topDocumentFrameView()->hostWindow()->platformPageClient(),
         OBJID_WINDOW, __uuidof(IAccessible), reinterpret_cast<void**>(parent));
 }
 
@@ -592,7 +592,15 @@ HRESULT AccessibleBase::getAccessibilityObjectForChild(VARIANT vChild, Accessibi
 
     if (vChild.lVal == CHILDID_SELF)
         childObj = m_object;
-    else {
+    else if (vChild.lVal < 0) {
+        // When broadcasting MSAA events, we negate the AXID and pass it as the
+        // child ID.
+        Document* document = m_object->document();
+        if (!document)
+            return E_FAIL;
+
+        childObj = document->axObjectCache()->objectFromAXID(-vChild.lVal);
+    } else {
         size_t childIndex = static_cast<size_t>(vChild.lVal - 1);
 
         if (childIndex >= m_object->children().size())
diff --git a/WebKit/win/COMVariantSetter.h b/WebKit/win/COMVariantSetter.h
index 76ca927..22c20e4 100644
--- a/WebKit/win/COMVariantSetter.h
+++ b/WebKit/win/COMVariantSetter.h
@@ -57,6 +57,19 @@ template<> struct COMVariantSetter<WebCore::String> : COMVariantSetterBase<WebCo
     }

 };

 

+template<> struct COMVariantSetter<bool> : COMVariantSetterBase<bool>

+{

+    static const VARENUM VariantType = VT_BOOL;

+

+    static void setVariant(VARIANT* variant, bool value)

+    {

+        ASSERT(V_VT(variant) == VT_EMPTY);

+

+        V_VT(variant) = VariantType;

+        V_BOOL(variant) = value;

+    }

+};

+

 template<> struct COMVariantSetter<unsigned long long> : COMVariantSetterBase<unsigned long long>

 {

     static const VARENUM VariantType = VT_UI8;

@@ -83,6 +96,19 @@ template<> struct COMVariantSetter<int> : COMVariantSetterBase<int>
     }

 };

 

+template<> struct COMVariantSetter<float> : COMVariantSetterBase<float>

+{

+    static const VARENUM VariantType = VT_R4;

+

+    static void setVariant(VARIANT* variant, float value)

+    {

+        ASSERT(V_VT(variant) == VT_EMPTY);

+

+        V_VT(variant) = VariantType;

+        V_R4(variant) = value;

+    }

+};

+

 template<typename T> struct COMVariantSetter<COMPtr<T> > : COMVariantSetterBase<COMPtr<T> >

 {

     static const VARENUM VariantType = VT_UNKNOWN;

diff --git a/WebKit/win/ChangeLog b/WebKit/win/ChangeLog
index 479d81b..354f82f 100644
--- a/WebKit/win/ChangeLog
+++ b/WebKit/win/ChangeLog
@@ -1,3 +1,1160 @@
+2009-10-08  Adam Roben  <aroben@apple.com>
+
+        Make IWebInspectorPrivate be accessed in a more standard way
+
+        IWebViewPrivate::inspectorPrivate has been removed. Callers should
+        instead use IWebViewPrivate::inspector and then use QueryInterface to
+        get the IWebInspectorPrivate interface. This matches how our other COM
+        classes work.
+
+        Fixes <http://webkit.org/b/30215> Make IWebInspectorPrivate be
+        accessed in a more standard way
+
+        Reviewed by John Sullivan and Tim Hatcher.
+
+        * Interfaces/IWebViewPrivate.idl: Removed inspectorPrivate.
+
+        * WebInspector.cpp:
+        (WebInspector::QueryInterface): Support querying to
+        IWebInspectorPrivate.
+
+        * WebView.cpp:
+        * WebView.h:
+        Removed inspectorPrivate.
+
+2009-10-08  Adam Roben  <aroben@apple.com>
+
+        Move the new IWebViewPrivate::inspectorPrivate function after all
+        functions that existed when Safari 4.0.3 was released
+
+        Fixes <http://webkit.org/b/30085> REGRESSION (r49091): run-safari
+        crashes in Safari.dll
+
+        Reviewed by John Sullivan.
+
+        * Interfaces/IWebViewPrivate.idl: Moved inspectorPrivate to the end of
+        the interface, so it won't modify the vtable that Safari 4.0.3 sees.
+
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Expose origin whitelisting in the WebKit API on Windows
+
+        Fixes <http://webkit.org/b/30185>.
+
+        Reviewed by Eric Seidel.
+
+        * Interfaces/IWebViewPrivate.idl: Added whiteListAccessFromOrigin and
+        resetOriginAccessWhiteLists, to match the Mac SPI.
+
+        * WebView.cpp:
+        (WebView::whiteListAccessFromOrigin):
+        (WebView::resetOriginAccessWhiteLists):
+        * WebView.h:
+        Added. These just call through to SecurityOrigin.
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        Move the policy callback to the policy object.
+
+        * WebFrame.cpp:
+        (WebFrame::dispatchWillSubmitForm):
+        (WebFrame::receivedPolicyDecision):
+        (WebFrame::dispatchDecidePolicyForMIMEType):
+        (WebFrame::dispatchDecidePolicyForNewWindowAction):
+        (WebFrame::dispatchDecidePolicyForNavigationAction):
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30102
+        And
+        <rdar://problem/5015957>
+        
+        Fixes an issue (in the Windows build) where the cursor does not change to the
+        not-allowed cursor when the drag-and-drop operation is not allowed.
+        
+        The allowed effects in WebDragClient::startDrag are hard-coded to be 
+        DROPEFFECT_COPY | DROPEFFECT_LINK | DROPEFFECT_MOVE. Instead, the list of 
+        allowed drop effects should be determined by the allowed operations of the
+        drag source.
+        
+        We cannot test this using DRT because DRT looks at the programmatic drop 
+        cursor and until bug #24731 is fixed this value is hard-coded to DragOperationCopy.
+        That is, there is a discrepancy in the Windows build between the Windows API-based 
+        drop effect and the WebKit drop effect. Because DRT cannot read the screen buffer 
+        to determine the cursor, a manual test is needed.
+
+        * WebCoreSupport/WebDragClient.cpp:
+        (draggingSourceOperationMaskToDragCursors): Added method.
+        (WebDragClient::startDrag):
+
+2009-10-07  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30176
+        <rdar://problem/7281553> Extra information in UA causes problems with gmail
+        
+        * WebKit.vcproj/WebKit.rc: Restore PRODUCTVERSION to build number only. Remove extra space.
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: default to an attached inspector window on Windows (as on Mac).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30134
+
+        * WebCoreSupport/WebInspectorClient.cpp:
+        (WebInspectorClient::showWindowWithoutNotifications):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move FrameLoader::canLoad to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30111
+
+        * WebFrame.cpp:
+        (WebFrame::allowsFollowingLink):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect 
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * WebCoreSupport/WebInspectorClient.cpp:
+        (WebInspectorClient::createPage):
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (windows build fix).
+
+        Speculative build fix for windows (due to r49160).
+
+        * WebDownloadCFNet.cpp:
+        (WebDownload::initToResumeWithBundle):
+        * WebIconDatabase.cpp:
+        (WebIconDatabase::dispatchDidAddIconForPageURL):
+
+2009-10-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add testing harness for Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30010
+
+        * Interfaces/IWebInspectorPrivate.idl: Added.
+        * Interfaces/IWebViewPrivate.idl:
+        * Interfaces/WebKit.idl:
+        * WebInspector.cpp:
+        (WebInspector::evaluateInFrontend):
+        * WebInspector.h:
+        * WebView.cpp:
+        (WebView::inspectorPrivate):
+        * WebView.h:
+
+2009-10-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
+
+        * Interfaces/IWebViewPrivate.idl:
+        * WebView.cpp:
+        (toStringVector):
+        (WebView::addUserScriptToGroup):
+        (WebView::addUserStyleSheetToGroup):
+        * WebView.h:
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * WebKit.vcproj/WebKit.rc:
+
+2009-09-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/7259706>
+        Need WebKit API or SPI on Mac and Windows to test whether it's safe to load a page in a new tab/window
+
+        * Interfaces/IWebFramePrivate.idl:
+        * WebFrame.cpp:
+        (WebFrame::allowsFollowingLink):
+        * WebFrame.h:
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add the ability to remove user stylesheets and scripts by URL.
+
+        * Interfaces/IWebViewPrivate.idl:
+        * WebView.cpp:
+        (WebView::removeUserContentWithURLFromGroup):
+        * WebView.h:
+
+2009-09-29  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add support for run-time flag for 3D canvas
+        https://bugs.webkit.org/show_bug.cgi?id=29826
+
+        * WebView.cpp:
+        (WebView::notifyPreferencesChanged): Enable experimental WebGL
+        flag when 3D_CANVAS is enabled in the build.
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        * DOMCreateInstance.cpp: GEN_DOMEventListener is a pure interface now.
+
+        * WebKit.vcproj/WebKit.vcproj: Removed GEN_DOMEventListener.cpp.
+
+2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add experimentalWebSocketsEnabled in WebPreferences.
+        https://bugs.webkit.org/show_bug.cgi?id=28941
+
+        * Interfaces/IWebPreferencesPrivate.idl:
+        * WebPreferenceKeysPrivate.h:
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+        (WebPreferences::setExperimentalWebSocketsEnabled):
+        (WebPreferences::experimentalWebSocketsEnabled):
+        * WebPreferences.h:
+        * WebView.cpp:
+        (WebView::notifyPreferencesChanged):
+        (core):
+
+2009-09-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Speed up access to history items by caching date computation.
+
+        * History/WebHistory.mm:
+        (getDayBoundaries): Refactored from timeIntervalForBeginningOfDay.
+        Returns the beginning of the day that the passed time is within and
+        the beginning of the next day.
+        (beginningOfDay): Added. Uses getDayBoundaries so it can be fast for
+        multiple dates within the same day, which is the common case.
+        (dateKey): Added. Calls beginningOfDay and converts to an integer.
+        (WebHistory::findKey): Changed to call dateKey instead of
+        timeIntervalForBeginningOfDay.
+
+2009-09-25  Adam Roben  <aroben@apple.com>
+
+        Add SPI to invalidate a WebView's backing store
+
+        This is useful in conjunction with
+        IWebUIDelegatePrivate2::drawBackground. This provides a way for the UI
+        delegate to force WebView to get its background redrawn.
+
+        Fixes <http://webkit.org/b/29737> Need SPI to invalidate a WebView's
+        backing store
+
+        Reviewed by Anders Carlsson.
+
+        * Interfaces/IWebViewPrivate.idl: Added invalidateBackingStore.
+        * WebView.cpp:
+        (WebView::invalidateBackingStore): If rect is 0, invalidate our whole
+        client rect. Otherwise invalidate the intersection of rect with our
+        client rect.
+        * WebView.h:
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add a mechanism for automatically halting plug-ins.
+
+        Reviewed by Oliver Hunt.
+
+        * Interfaces/IWebPluginHalterDelegate.idl: Added. Defines an interface
+        for a delegate that determines whether plug-ins should be halted.
+
+        * Interfaces/IWebPreferencesPrivate.idl:
+        Declare functions to get and set the enabled state of the plug-in
+        halter and the plug-in allowed run time.
+
+        * Interfaces/IWebViewPrivate.idl:
+        Declare functions to get and set the IWebPluginHalterDelegate.
+
+        * Interfaces/WebKit.idl:
+
+        * WebCoreSupport/WebPluginHalterClient.cpp: Added.
+        (WebPluginHalterClient::WebPluginHalterClient):
+        (WebPluginHalterClient::shouldHaltPlugin):
+        Get the IWebPluginHalterDelegate for the WebView. Create a WebKit
+        DOMNode for the WebCore Node. Call the delegate's shouldHaltPlugin().
+        If the call fails, return false. Otherwise, return the result of the
+        call.
+
+        * WebCoreSupport/WebPluginHalterClient.h: Added.
+
+        * WebKit.vcproj/Interfaces.vcproj:
+        Add IWebPluginHalterDelegate.idl.
+
+        * WebKit.vcproj/WebKit.vcproj:
+        Add WebPluginHalterClient.{h,cpp}.
+
+        * WebPreferenceKeysPrivate.h:
+        Define WebKitPluginHalterEnabledPreferenceKey and
+        WebKitPluginAllowedRunTimePreferenceKey.
+
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+        Leave plug-in halting disabled by default. Set the default value for
+        the plug-in allowed run time to the max value of an unsigned int.
+        (WebPreferences::setPluginHalterEnabled):
+        (WebPreferences::pluginHalterEnabled):
+        (WebPreferences::setPluginAllowedRunTime):
+        (WebPreferences::pluginAllowedRunTime):
+
+        * WebPreferences.h:
+
+        * WebView.cpp:
+        (WebView::close):
+        Clear the IWebPluginHalterDelegate.
+        (WebView::initWithFrame):
+        Pass a WebPluginHalterClient when creating the Page.
+        (WebView::notifyPreferencesChanged):
+        Set the new settings when the preferences changed notification is
+        received.
+        (WebView::setPluginHalterDelegate):
+        (WebView::pluginHalterDelegate):
+
+        * WebView.h:
+        Declare overrides of setPluginHalterDelegate() and
+        pluginHalterDelegate(). Added a member to track the
+        IWebPluginHalterDelegate.
+
+2009-09-14  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Enable switch for notifications (experimental) in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=28930
+
+        Adds support for the experimentalNotificationsEnabled flag in Settings through
+        WebPreferencesPrivate interface.  Also cleans up some issues accessing the
+        notification delegate through DumpRenderTree.
+
+        * Interfaces/IWebPreferencesPrivate.idl:
+        * WebCoreSupport/WebDesktopNotificationsDelegate.cpp:
+        (WebDesktopNotificationsDelegate::hasNotificationDelegate):
+        (WebDesktopNotificationsDelegate::notificationDelegate):
+        * WebPreferenceKeysPrivate.h:
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+        (WebPreferences::setExperimentalNotificationsEnabled):
+        (WebPreferences::experimentalNotificationsEnabled):
+        * WebPreferences.h:
+        * WebView.cpp:
+        (WebView::notifyPreferencesChanged):
+
+2009-09-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7243354> 
+        REGRESSION(48580-48636): Crash clicking embedded QT preview button on apple.com/trailers
+        
+        Check for a null IWebPolicyDelegatePrivate.
+        
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::shouldLoadMediaElementURL):
+
+2009-09-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Adam Roben.
+
+        Remove accidentally left in declaration of reloadFromOrigin in IWebFramePrivate.idl
+
+        * Interfaces/IWebFramePrivate.idl:
+
+2009-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Fix for <rdar://problem/6451745>
+        Windows WebKit needs to implement reloadFromOrigin()
+
+        * Interfaces/IWebFrame.idl:
+        * Interfaces/IWebFramePrivate.idl:
+        * Interfaces/IWebView.idl:
+        * WebFrame.cpp:
+        (WebFrame::reloadFromOrigin):
+        * WebFrame.h:
+        * WebView.cpp:
+        (WebView::reloadFromOrigin):
+        * WebView.h:
+
+2009-09-22  Adam Roben  <aroben@apple.com>
+
+        Manage refcounts correctly in DefaultDownloadDelegate::willSendRequest
+
+        Fixes <http://webkit.org/b/29650> Crash in
+        WebDownload::willSendRequest when using DefaultDownloadDelegate
+
+        Reviewed by Brady Eidson.
+
+        * DefaultDownloadDelegate.cpp:
+        (DefaultDownloadDelegate::willSendRequest): Call AddRef() on the
+        object we're returning via the finalRequest out-parameter.
+
+2009-09-21  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
+
+        Implement WebFrameLoaderClient::shouldLoadMediaElementURL and have it call the new private policy
+        delegate method.
+        
+        * Interfaces/IWebPolicyDelegatePrivate.idl: Added.
+        * Interfaces/WebKit.idl:
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::shouldLoadMediaElementURL):
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebKit.vcproj/Interfaces.vcproj:
+
+2009-09-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Reflect the rename of platformWindow and it's return type.
+
+        * AccessibleBase.cpp:
+        (AccessibleBase::get_accParent):
+        * WebCoreSupport/WebChromeClient.cpp:
+        (WebChromeClient::platformPageClient):
+        * WebCoreSupport/WebChromeClient.h:
+
+2009-09-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Remove assertions that were being hit by calls to
+        m_verticalScrollbar->invalidate(). These assertions were valid,
+        but they were causing tests to fail, so replacing with a FIXME 
+        until we can find out the real cause/solution that is being tracked 
+        by http://webkit.org/b/29350.
+
+        * WebView.cpp:
+        (WebView::addToDirtyRegion):
+        (WebView::paintIntoBackingStore):
+
+2009-09-17  Ada Chan  <adachan@apple.com>
+
+        Post WebViewDidChangeSelectionNotification when the text selection changes.
+
+        Fixes <http://webkit.org/b/29321>
+
+        Reviewed by Adam Roben.
+
+        * Interfaces/IWebView.idl:
+        * WebCoreSupport/WebEditorClient.cpp:
+        (WebEditorClient::respondToChangedSelection):
+
+2009-09-17  Adam Roben  <aroben@apple.com>
+
+        Fix a crash when a WebView's HWND is destroyed before IWebView::close
+        is called
+
+        WebView's HWND was being sent a WM_TIMER message after the WebView was
+        destroyed. This normally isn't possible (we call DestroyWindow inside
+        WebView's destructor to ensure the HWND doesn't outlive the WebView),
+        but r48060 changed WebView to call SetParent(m_viewWindow,
+        HWND_MESSAGE) while handling WM_DESTROY, and apparently this puts the
+        HWND into some weird half-destroyed state where it can still receive
+        WM_TIMER messages.
+
+        Fixes <http://webkit.org/b/29337> <rdar://problem/7209897> REGRESSION
+        (r48060): unrepro but frequent crash in WebViewWndProc
+
+        Reviewed by Steve Falkenburg.
+
+        * WebView.cpp:
+        (WebViewWndProc): When handling WM_DESTROY, call setIsBeingDestroyed()
+        before calling close(). This allows setHostWindow to detect that we're
+        handling WM_DESTROY. No other code in close() cared whether
+        isBeingDestroyed() was true or not.
+        (WebView::setHostWindow): If our host window is being set to 0 and
+        we're being destroyed, don't become a message-only window. Doing this
+        while handling WM_DESTROY seems to lead to crashes.
+
+2009-09-16  Adam Roben  <aroben@apple.com>
+
+        Add a UI delegate callback to let the delegate draw a WebView's
+        background
+
+        Fixes <http://webkit.org/b/29315>.
+
+        Reviewed by Dave Hyatt.
+
+        * Interfaces/IWebUIDelegatePrivate.idl: Added
+        IWebUIDelegatePrivate2::drawBackground.
+
+        * WebView.cpp:
+        (WebView::paintIntoBackingStore): After clearing or filling with
+        white, let the delegate draw whatever background it wants. Also added
+        an assertion that the dirty rect is within our bounds.
+
+2009-09-16  Adam Roben  <aroben@apple.com>
+
+        Prevent WebView from painting over sibling windows
+
+        Fixes <http://webkit.org/b/29300> <rdar://problem/7227960> WebView can
+        paint over sibling windows
+
+        Reviewed by Darin Adler.
+
+        * WebView.cpp:
+        (WebView::initWithFrame): Create the WebView's HWND with the
+        WS_CLIPSIBLINGS style.
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Safari 4 cannot be used to update firmware on Linksys routers.
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        Adopt the new WebCore::CredentialStorage in WebKit/Win.
+
+        * WebDownloadCFNet.cpp:
+        (WebDownload::didReceiveAuthenticationChallenge):
+
+2009-09-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Properly propagate preference from WebPreferences to WebCore::Settings.
+        https://bugs.webkit.org/show_bug.cgi?id=29192
+
+        * WebView.cpp:
+        (WebView::initWithFrame): Apply setting when creating a new WebView.
+        (WebView::notifyPreferencesChanged): Apply setting when preferences change.
+
+2009-09-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow WebKit clients to opt out of high resolution timers on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=29192
+
+        * Interfaces/IWebPreferencesPrivate.idl: Added getter/setter.
+        Put this just after last 4.0.3 method for future merging.
+        * Interfaces/WebKit.idl: Touched to force a rebuild.
+        * WebPreferenceKeysPrivate.h: Added prefs key for high res timers.
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings): Initialize high res timers to enabled.
+        (WebPreferences::setShouldUseHighResolutionTimers): Added.
+        (WebPreferences::shouldUseHighResolutionTimers): Added.
+        * WebPreferences.h: Added getter/setter.
+
+2009-09-11  Adam Roben  <aroben@apple.com>
+
+        Get user script/stylesheet tests running on Windows
+
+        Fixes <http://webkit.org/b/29181> User script/stylesheet tests are
+        skipped on Windows
+
+        Reviewed by John Sullivan.
+
+        * Interfaces/IWebViewPrivate.idl: Added addUserScriptToGroup,
+        addUserStyleSheetToGroup, removeUserContentFromGroup,
+        removeAllUserContentFromGropu to match the Mac SPI.
+
+        * WebView.cpp:
+        (WebView::addUserScriptToGroup):
+        (WebView::addUserStyleSheetToGroup):
+        (WebView::removeUserContentFromGroup):
+        (WebView::removeAllUserContentFromGroup):
+        * WebView.h:
+        Added. Implementation was based on similar methods in WebView.mm.
+
+2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Fix crash on launch on Windows.
+
+        Rubber-stamped by Mark Rowe.
+
+        * WebKit.vcproj/WebKit.vcproj:
+        Define ENABLE_WEB_SOCKETS for all configurations.
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default.
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        * WebKit.vcproj/WebKit.vcproj:
+
+2009-09-04  Adam Roben  <aroben@apple.com>
+
+        Make WebView function without a parent window
+
+        When WebView has no parent window, it becomes a message-only window,
+        which hides it from the screen and prevents it from appearing on the
+        taskbar.
+
+        Fixes <http://webkit.org/b/28971> <rdar://problem/4976998>
+        WebView::initWithFrame fails if there's no host window
+
+        Reviewed by Dave Hyatt.
+
+        * WebView.cpp:
+        (WebView::initWithFrame): m_hostWindow is null, use HWND_MESSAGE as
+        our parent window, which will make us a message-only window.
+        (WebView::setHostWindow): If he new host window is null, use
+        HWND_MESSAGE as our parent window, which will make us a message-only
+        window.
+
+2009-09-04  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempt at a build fix.
+
+        Added missing include.
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+
+2009-09-04  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempt at a build fix.
+
+        Fix typo of IWebFrameLoadDelegatePrivate2 and make
+        IWebFrameLoadDelegatePrivate inherit from IWebFrameLoadDelegatePrivate
+        as requestd by Adam Roben.
+
+        * Interfaces/IWebFrameLoadDelegatePrivate2.idl:
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::didDisplayInsecureContent):
+        (WebFrameLoaderClient::didRunInsecureContent):
+
+2009-09-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Plumb mixed content notifications to IWebFrameLoadDelegatePrivate.
+
+        * Interfaces/IWebFrameLoadDelegatePrivate2.idl: Added.
+        * Interfaces/WebKit.idl:
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::didDisplayInsecureContent):
+        (WebFrameLoaderClient::didRunInsecureContent):
+        * WebKit.vcproj/Interfaces.vcproj:
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Stub implementations of mixed content methods of FrameLoaderClient. 
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::didDisplayInsecureContent):
+        (WebFrameLoaderClient::didRunInsecureContent):
+        * WebCoreSupport/WebFrameLoaderClient.h:
+
+2009-09-01  Adam Roben  <aroben@apple.com>
+
+        Post a notification when a WebView is closing
+
+        This is useful for situations where some code wants to react to the
+        WebView closing but isn't in charge of the WebView and can't otherwise
+        be notified. This notification could replace
+        IWebUIDelegatePrivate::webViewClosing if we decide that the
+        notification system isn't too burdensome.
+
+        <http://webkit.org/b/28875>
+
+        Reviewed by John Sullivan.
+
+        * Interfaces/IWebViewPrivate.idl: Added the
+        WebViewWillCloseNotification string constant.
+        * WebKit.vcproj/WebKit.vcproj: Link against comsuppw.lib in all
+        configurations so that we can use _bstr_t.
+        * WebView.cpp:
+        (WebView::close): Post the WebViewWillCloseNotification.
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28852
+        Rename KURL single argument constructor to avoid confusion
+
+        * WebURLResponse.cpp: (WebURLResponse::createInstance): Adapt to the change.
+
+2009-08-20  Adam Roben  <aroben@apple.com>
+
+        Give WebKit clients access to the window features specified in
+        window.open
+
+        Reviewed by Steve Falkenburg.
+
+        * COMVariantSetter.h: Added COMVariantSetters for bool and float.
+
+        * Interfaces/IWebUIDelegatePrivate.idl: Added IWebUIDelegatePrivate2,
+        which contains a new version of createWebViewWithRequest that also
+        passes the window features as an IPropertyBag. This is analagous to
+        the -createWebViewWithRequest:windowFeatures: method added to
+        WebUIDelegate on Mac in r27452. Also added key strings for use with
+        the window features property bag.
+
+        * WebCoreSupport/WebChromeClient.cpp:
+        (createWindowFeaturesPropertyBag): Added this helper function to turn
+        a WebCore::WindowFeatures into an IPropertyBag for passing to WebKit
+        clients.
+        (WebChromeClient::createWindow): If the UI delegate implements
+        IWebUIDelegatePrivate2, call the new createWebViewWithRequest function
+        that takes a window features property bag. If the delegate doesn't
+        implement the new function, fall back to the old functions.
+
+2009-08-20  Adam Roben  <aroben@apple.com>
+
+        A little clean-up in WebChromeClient::createWindow
+
+        Reviewed by Steve Falkenburg.
+
+        * WebCoreSupport/WebChromeClient.cpp:
+        (WebChromeClient::createWindow): Refactored to share more code between
+        the dialog and non-dialog cases.
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Add empty implementation for new ChromeClient method.
+
+        * WebCoreSupport/WebChromeClient.h:
+        (WebChromeClient::scrollbarsModeDidChange):
+
+2009-08-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Modify Release_Cairo target to build testapi using the
+        Release_CFLite target so that the correct CoreFoundation
+        (in this case, CFLite.dll) is linked.
+
+        * WebKit.vcproj/WebKit.sln:
+
+2009-08-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Don't let local files access web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28480
+
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+
+2009-08-26  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        ResourceRequestBase::*[Aa]llowHTTPCookies shouldn't mention http.
+        https://bugs.webkit.org/show_bug.cgi?id=28735
+
+        * WebMutableURLRequest.cpp:
+        (WebMutableURLRequest::setHTTPShouldHandleCookies):
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <video> and <audio> controller should be accessible
+        https://bugs.webkit.org/show_bug.cgi?id=28081
+
+        * WebCoreLocalizedStrings.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+            New.
+
+2009-08-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix for Windows.
+
+        Revise Debug_Cairo build target to build testapi, jsc, WinLauncher,
+        DumpRenderTree, and TestNetscapeAPI using WinCairo debug build
+        settings so they link against the proper libraries.
+
+        * WebKit.vcproj/WebKit.sln:
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        PLATFORM(CFNETWORK) should be USE(CFNETWORK).
+        https://bugs.webkit.org/show_bug.cgi?id=28713
+
+        Also, moved the #if header section after the other #includes.
+
+        * WebError.cpp:
+        (WebError::localizedDescription):
+
+2009-08-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Revise CFLite Debug build to emit DLL's with _debug label.
+        https://bugs.webkit.org/show_bug.cgi?id=28695.
+
+        * WebKit.vcproj/WebKit.vcproj: Modify Debug_Cairo target to
+          inherit from new debug_wincairo property sheet, instead of
+          the current debug sheet. 
+
+2009-08-22  Adam Barth  <abarth@webkit.org>
+
+        Revert 47684.  We're going to do this later once clients have had a
+        chance to opt into the setting they like.
+
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+
+2009-08-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't let local files access web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28480
+
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <http://webkit.org/b/27850>. Panning by emulating Mouse Wheel Events breaks Google Maps.
+        
+        Switched to using RenderLayer::scrollByRecursively instead of emulating a mouse wheel,
+        and switched to handling the hit testing in WebView from doing it as part of the mouse wheel event.
+        One downside of this fix is that panning will not jump out of frames anymore (same behavior as pan-scrolling), but
+        this is tracked in <http://webkit.org/b/28237>.
+
+        * WebView.cpp:
+        (WebView::gestureNotify): Added hit testing here to figure out the node the user started the gesture on.
+        (WebView::gesture): Switched from emulating mouse wheel events for panning to calling RenderLayer::scrollByRecursively.
+        * WebView.h:
+
+2009-08-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
+        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
+        
+        Added a setQuota interface method to IWebDatabaseManager and implemented it.
+
+        * Interfaces/IWebDatabaseManager.idl:
+        * WebDatabaseManager.cpp:
+        (WebDatabaseManager::setQuota):
+        * WebDatabaseManager.h:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed (build break).
+
+        Added missing include for WebWorkersPrivate.h.
+
+        * WebKitClassFactory.cpp:
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * WebKit.vcproj/InterfacesGenerated.vcproj:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        Defined/implemented COM interfaces to expose WorkerThread::workerThreadCount() for DumpRenderTree.
+
+        * ForEachCoClass.h:
+        Added WebWorkersPrivate.
+        * Interfaces/IWebWorkersPrivate.idl: Added.
+        * Interfaces/WebKit.idl:
+        Added WebWorkersPrivate.
+        * WebKit.vcproj/Interfaces.vcproj:
+        * WebKit.vcproj/WebKit.vcproj:
+        * WebWorkersPrivate.cpp: Added.
+        Implementation of the IWebWorkersPrivate COM interface, to expose workerThreadCount() for DumpRenderTree.
+        (WebWorkersPrivate::QueryInterface):
+        (WebWorkersPrivate::AddRef):
+        (WebWorkersPrivate::Release):
+        (WebWorkersPrivate::workerThreadCount):
+        (WebWorkersPrivate::createInstance):
+        (WebWorkersPrivate::WebWorkersPrivate):
+        (WebWorkersPrivate::~WebWorkersPrivate):
+        * WebWorkersPrivate.h: Added.
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * WebKit.vcproj/Interfaces.vcproj:
+        * WebKit.vcproj/InterfacesGenerated.vcproj:
+        * WebKit.vcproj/WebKit.vcproj:
+        * WebKit.vcproj/WebKitGUID.vcproj:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Speculative fix for Windows build bustage.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLElement::idName):
+
+2009-08-13  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
+        nightly (20866)
+
+        https://bugs.webkit.org/show_bug.cgi?id=20866
+
+        Reviewed by Oliver Hunt.
+
+        * AccessibleBase.cpp:
+        (AccessibleBase::getAccessibilityObjectForChild):
+        If the child ID is negative, negate it and treat it as an AXID.
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://6728361> Mouse wheel scrolling on a page with expanded drop down 
+        list detaches drop down.
+        
+        Added a check in mouseWheel to see if our focus is currently in a popup, if so, close
+        the popup (matches other browser behavior).
+
+        * WebView.cpp:
+        (WebView::mouseWheel):
+
+2009-08-12  Adam Roben  <aroben@apple.com>
+
+        Make WebPreferenceKeysPrivate.h available for client use
+
+        Reviewed by Dave Hyatt.
+
+        Fixes <http://webkit.org/b/28227>.
+
+        * WebKit.vcproj/WebKit.vcproj: Copy WebPreferenceKeysPrivate.h to
+        $WebKitOutputDir, just like we do for a few other headers. Also let VS
+        reorder some XML attributes.
+
+        * WebPreferenceKeysPrivate.h: Touched this file to force a build.
+
+2009-08-11  Adam Roben  <aroben@apple.com>
+
+        Remove support for a window resizer within the WebView
+
+        Starting with Safari 4, there is never a window resizer inside the
+        WebView, so we no longer need to support that functionality.
+
+        Fixes <http://webkit.org/b/28190> Remove support for a window resizer
+        within the WebView
+
+        Reviewed by Dave Hyatt.
+
+        * Interfaces/IWebUIDelegatePrivate.idl: Replaced the delegate
+        functions related to the window resizer with unused*() functions. We
+        can't remove them entirely because we need to keep the vtable
+        unchanged so new versions of WebKit will work with old versions of
+        Safari (e.g., for nightlies and WebKit development).
+
+        * WebCoreSupport/WebChromeClient.cpp:
+        (WebChromeClient::windowResizerRect): Now always returns an empty
+        rect.
+
+        * WebView.cpp:
+        (WebView::paint):
+        (WebView::handleMouseEvent):
+        * WebView.h:
+        Removed window-resizer-related code.
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Move the accessor for notifications presenter from WebUIDelegate
+        to WebUIDelegate2 which extends it.  When making this call from
+        WebCoreSupport, check using QueryInterface before calling.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28198
+
+        * Interfaces/IWebUIDelegate.idl:
+        * Interfaces/IWebUIDelegate2.idl: Added.
+        * Interfaces/WebKit.idl:
+        * WebCoreSupport/WebDesktopNotificationsDelegate.cpp:
+        (WebDesktopNotificationsDelegate::show):
+        (WebDesktopNotificationsDelegate::cancel):
+        (WebDesktopNotificationsDelegate::notificationObjectDestroyed):
+        (WebDesktopNotificationsDelegate::requestPermission):
+        (WebDesktopNotificationsDelegate::checkPermission):
+        (WebDesktopNotificationsDelegate::hasNotificationDelegate):
+        (WebDesktopNotificationsDelegate::notificationDelegate):
+        * WebCoreSupport/WebDesktopNotificationsDelegate.h:
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative Windows build fix - undo previous unnecessary change.
+
+        * WebCoreSupport/WebDesktopNotificationsDelegate.h:
+
+2009-08-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Refactored MIMETypeforExtension to be a member of IWebViewPrivate
+        instead of IWebView.
+
+        * Interfaces/IWebView.idl:
+        * Interfaces/IWebViewPrivate.idl:
+        * WebView.cpp:
+        (WebView::MIMETypeForExtension):
+        * WebView.h:
+
+2009-08-11  Drew Wilson <atwilson@google.com>
+
+        Reviewed by NOBODY (build break)
+
+        Speculative fix for windows build break.
+
+        * WebKitSupport/WebDesktopNotificationsDelegate.h:
+        WebCore/Notification*.h => WebCore/notifications/Notification*.h
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25643
+
+        Adds test hooks for notification features to WebCoreSupport for
+        use in DumpRenderTree.
+
+        * Interfaces/IWebDesktopNotificationsDelegate.idl: Added.
+        * Interfaces/IWebUIDelegate.idl:
+        * Interfaces/WebKit.idl:
+        * WebCoreSupport/WebChromeClient.cpp:
+        (WebChromeClient::WebChromeClient):
+        * WebCoreSupport/WebChromeClient.h:
+        (WebChromeClient::notificationPresenter):
+        * WebCoreSupport/WebDesktopNotificationsDelegate.cpp: Added.
+        (NotificationCOMWrapper::create):
+        (NotificationCOMWrapper::NotificationCOMWrapper):
+        (NotificationCOMWrapper::QueryInterface):
+        (NotificationCOMWrapper::AddRef):
+        (NotificationCOMWrapper::Release):
+        (NotificationCOMWrapper::isHTML):
+        (NotificationCOMWrapper::contentsURL):
+        (NotificationCOMWrapper::iconURL):
+        (NotificationCOMWrapper::title):
+        (NotificationCOMWrapper::text):
+        (NotificationCOMWrapper::notifyDisplay):
+        (NotificationCOMWrapper::notifyError):
+        (NotificationCOMWrapper::notifyClose):
+        (WebDesktopNotificationsDelegate::WebDesktopNotificationsDelegate):
+        (WebDesktopNotificationsDelegate::show):
+        (WebDesktopNotificationsDelegate::cancel):
+        (WebDesktopNotificationsDelegate::notificationObjectDestroyed):
+        (WebDesktopNotificationsDelegate::requestPermission):
+        (WebDesktopNotificationsDelegate::checkPermission):
+        (WebDesktopNotificationsDelegate::notificationDelegate):
+        * WebCoreSupport/WebDesktopNotificationsDelegate.h: Added.
+        * WebCoreSupport/WebInspectorDelegate.h:
+        (WebInspectorDelegate::desktopNotificationsDelegate):
+        * WebKit.vcproj/Interfaces.vcproj:
+        * WebKit.vcproj/WebKit.vcproj:
+
+2009-08-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://5016504> SVG file cannot be dragged to webview,
+        but can be opened via Open File.
+        
+        Added a new function to IWebView that gets the MIME type for a given 
+        extension from the MIMETypeRegistry.
+
+        * Interfaces/IWebView.idl:
+        * WebView.cpp:
+        (WebView::MIMETypeForExtension):
+        * WebView.h:
+
+2009-08-11  Dmitry Titov <dimich@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Originally implemented by Glenn Wilson  <gwilson@chromium.org>.
+
+        Added support for overriding default preferences per-test.
+        See https://bugs.webkit.org/show_bug.cgi?id=20534
+
+        * Interfaces/IWebPreferencesPrivate.idl: added new method setPreferenceForTest
+        * WebPreferences.cpp: same.
+        * WebPreferences.h: same.
+
 2009-08-10  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
diff --git a/WebKit/win/DOMCreateInstance.cpp b/WebKit/win/DOMCreateInstance.cpp
index 78b2d4e..ebaa4ce 100644
--- a/WebKit/win/DOMCreateInstance.cpp
+++ b/WebKit/win/DOMCreateInstance.cpp
@@ -72,7 +72,6 @@
 #include "GEN_DOMStyleSheet.h"
 #include "GEN_DOMStyleSheetList.h"
 #include "GEN_DOMEvent.h"
-#include "GEN_DOMEventListener.h"
 #include "GEN_DOMEvent.h"
 #include <wtf/HashMap.h>
 
@@ -249,7 +248,6 @@ CREATE_ONLY_SELF(NodeList)
 
 // FIXME: Add the subclasses for Event when they get generated.
 CREATE_ONLY_SELF(Event)
-CREATE_ONLY_SELF(EventListener)
 
 
 // CSS
diff --git a/WebKit/win/DOMHTMLClasses.cpp b/WebKit/win/DOMHTMLClasses.cpp
index a216c1f..9ce6004 100644
--- a/WebKit/win/DOMHTMLClasses.cpp
+++ b/WebKit/win/DOMHTMLClasses.cpp
@@ -367,7 +367,7 @@ HRESULT STDMETHODCALLTYPE DOMHTMLElement::idName(
         return E_POINTER;
 
     ASSERT(m_element && m_element->isHTMLElement());
-    String idString = static_cast<HTMLElement*>(m_element)->id();
+    String idString = static_cast<HTMLElement*>(m_element)->getAttribute(idAttr);
     *result = BString(idString).release();
     return S_OK;
 }
diff --git a/WebKit/win/DefaultDownloadDelegate.cpp b/WebKit/win/DefaultDownloadDelegate.cpp
index a50d119..cf443b5 100644
--- a/WebKit/win/DefaultDownloadDelegate.cpp
+++ b/WebKit/win/DefaultDownloadDelegate.cpp
@@ -203,6 +203,7 @@ HRESULT STDMETHODCALLTYPE DefaultDownloadDelegate::willSendRequest(IWebDownload*
     download = 0;
     redirectResponse = 0;
     *finalRequest = request;
+    (*finalRequest)->AddRef();
     return S_OK;
 }
 
diff --git a/WebKit/win/ForEachCoClass.h b/WebKit/win/ForEachCoClass.h
index 05a81ff..26f4a6c 100644
--- a/WebKit/win/ForEachCoClass.h
+++ b/WebKit/win/ForEachCoClass.h
@@ -62,6 +62,7 @@
     macro(WebArchive) \
     macro(WebCoreStatistics) \
     macro(WebCookieManager) \
+    macro(WebWorkersPrivate) \
     // end of macro
 
 // Everything below this point is deprecated. Please do not use.
diff --git a/WebKit/win/Interfaces/IWebDatabaseManager.idl b/WebKit/win/Interfaces/IWebDatabaseManager.idl
index c877c03..4292dc6 100644
--- a/WebKit/win/Interfaces/IWebDatabaseManager.idl
+++ b/WebKit/win/Interfaces/IWebDatabaseManager.idl
@@ -59,4 +59,6 @@ interface IWebDatabaseManager : IUnknown
     HRESULT deleteAllDatabases();
     HRESULT deleteOrigin([in] IWebSecurityOrigin* origin);
     HRESULT deleteDatabase([in] BSTR databaseName, [in] IWebSecurityOrigin* origin);
+
+    HRESULT setQuota([in] BSTR originName, [in] unsigned long long quota);
 }
diff --git a/WebKit/win/Interfaces/IWebDesktopNotificationsDelegate.idl b/WebKit/win/Interfaces/IWebDesktopNotificationsDelegate.idl
new file mode 100644
index 0000000..20bb541
--- /dev/null
+++ b/WebKit/win/Interfaces/IWebDesktopNotificationsDelegate.idl
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+#endif
+
+/*!
+    @category WebDesktopNotification
+    @discussion A class that represents a notification being shown
+    on the user's desktop.  It provides the contents of the notification
+    and receives events related to the display.
+    @interface NSObject (WebDesktopNotificationProvider)
+*/
+[
+    object,
+    oleautomation,
+    uuid(0A0AAFA8-C698-4cff-BD28-39614622EEA4),
+    pointer_default(unique)
+]
+interface IWebDesktopNotification : IUnknown
+{
+    HRESULT isHTML([out, retval] BOOL* result);
+    HRESULT contentsURL([out, retval] BSTR* result);
+    HRESULT iconURL([out, retval] BSTR* result);
+    HRESULT title([out, retval] BSTR* result);
+    HRESULT text([out, retval] BSTR* result);
+
+    HRESULT notifyDisplay();
+    HRESULT notifyError();
+    HRESULT notifyClose([in] BOOL xplicit);
+}
+
+/*!
+    @category WebDesktopNotificationsDelegate
+    @discussion A class that implements WebDesktopNotificationProvider provides
+    methods that may be used by Javascript to display notifications ("toasts")
+    on the user's desktop.
+    @interface NSObject (WebDesktopNotificationProvider)
+*/
+[
+    object,
+    oleautomation,
+    uuid(09DA073E-38B3-466a-9828-B2915FDD2ECB),
+    pointer_default(unique)
+]
+
+interface IWebDesktopNotificationsDelegate : IUnknown
+{
+    /*!
+        @method showDesktopNotification:
+        @abstract Show a notification.
+        @param notification The Notification to be shown.
+    */
+    HRESULT showDesktopNotification([in] IWebDesktopNotification* notification);
+
+    /*!
+        @method cancelDesktopNotification:
+        @abstract Cancel showing a notification (or take it down if it's shown).
+        @param notification The Notification to be canceled.
+    */
+    HRESULT cancelDesktopNotification([in] IWebDesktopNotification* notification);
+
+    /*!
+        @method notificationDestroyed:
+        @abstract Notify the presenter that the object has been destroyed.  The
+        notification need not be un-shown, but events should not be invoked.
+        @param notification The Notification that was destroyed.
+    */
+    HRESULT notificationDestroyed([in] IWebDesktopNotification* notification);
+
+    /*!
+        @method checkNotificationPermission:
+        @abstract See if the origin context is allowed to show notifications.
+        @param origin The origin to be checked.
+        @param result A value from WebCore::NotificationProvider::Permission enum.
+    */
+    HRESULT checkNotificationPermission([in] BSTR origin, [out, retval] int* result);
+
+    /*!
+        @method requestNotificationPermission:
+        @abstract Request permission to show notifications on a given origin.
+        @param origin The origin to be requested.
+    */
+    HRESULT requestNotificationPermission([in] BSTR origin);
+}
diff --git a/WebKit/win/Interfaces/IWebFrame.idl b/WebKit/win/Interfaces/IWebFrame.idl
index 30af7b9..da2a78f 100644
--- a/WebKit/win/Interfaces/IWebFrame.idl
+++ b/WebKit/win/Interfaces/IWebFrame.idl
@@ -254,4 +254,10 @@ interface IWebFrame : IUnknown
         @param flag YES to mark the frame as not searchable
    */
    HRESULT setExcludeFromTextSearch([in] BOOL flag);
+
+   /*!
+       @method reloadFromOrigin
+       @discussion Performs HTTP/1.1 end-to-end reload.
+   */
+   HRESULT reloadFromOrigin();
 }
diff --git a/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl b/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl
new file mode 100644
index 0000000..d646528
--- /dev/null
+++ b/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+import "IWebFrame.idl";
+import "IWebView.idl";
+#endif
+
+interface IWebFrame;
+interface IWebView;
+interface IWebSecurityOrigin;
+
+[
+    object,
+    oleautomation,
+    uuid(4148C9F8-94D9-479A-BCF1-C15E5269CCC1),
+    pointer_default(unique)
+]
+interface IWebFrameLoadDelegatePrivate2 : IWebFrameLoadDelegatePrivate
+{
+    HRESULT didDisplayInsecureContent([in] IWebView* sender);
+
+    HRESULT didRunInsecureContent([in] IWebView* sender, [in] IWebSecurityOrigin* origin);
+}
diff --git a/WebKit/win/Interfaces/IWebFramePrivate.idl b/WebKit/win/Interfaces/IWebFramePrivate.idl
index 96b42ab..a3366da 100755
--- a/WebKit/win/Interfaces/IWebFramePrivate.idl
+++ b/WebKit/win/Interfaces/IWebFramePrivate.idl
@@ -91,4 +91,6 @@ interface IWebFramePrivate : IUnknown
     HRESULT numberOfActiveAnimations([out, retval] UINT* number);
 
     HRESULT isDisplayingStandaloneImage([out, retval] BOOL* result);
+
+    HRESULT allowsFollowingLink([in] BSTR url, [out, retval] BOOL* result);
 }
diff --git a/WebCore/loader/UserStyleSheetLoader.cpp b/WebKit/win/Interfaces/IWebInspectorPrivate.idl
index 3afbc15..74421bd 100644
--- a/WebCore/loader/UserStyleSheetLoader.cpp
+++ b/WebKit/win/Interfaces/IWebInspectorPrivate.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,37 +26,18 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "UserStyleSheetLoader.h"
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+#endif
 
-#include "CachedCSSStyleSheet.h"
-#include "DocLoader.h"
-#include "Frame.h"
-
-using namespace WebCore;
-
-UserStyleSheetLoader::UserStyleSheetLoader(PassRefPtr<Document> document, const String& url)
-    : m_document(document)
-    , m_cachedSheet(m_document->docLoader()->requestUserCSSStyleSheet(url, ""))
-{
-    if (m_cachedSheet) {
-        m_document->addPendingSheet();
-        m_cachedSheet->addClient(this);
-    }
-}
-
-UserStyleSheetLoader::~UserStyleSheetLoader()
-{
-    if (m_cachedSheet) {
-        if (!m_cachedSheet->isLoaded())
-            m_document->removePendingSheet();
-        m_cachedSheet->removeClient(this);
-    }
-}
-
-void UserStyleSheetLoader::setCSSStyleSheet(const String& /*URL*/, const String& /*charset*/, const CachedCSSStyleSheet* sheet)
+[
+    object,
+    oleautomation,
+    uuid(A5A31CD0-AEA9-11de-8A39-0800200C9A66),
+    pointer_default(unique)
+]
+interface IWebInspectorPrivate : IUnknown
 {
-    m_document->removePendingSheet();
-    if (Frame* frame = m_document->frame())
-        frame->setUserStyleSheet(sheet->sheetText());
+    HRESULT evaluateInFrontend([in] ULONG callId, [in] BSTR script);
 }
diff --git a/WebKit/win/Interfaces/IWebPluginHalterDelegate.idl b/WebKit/win/Interfaces/IWebPluginHalterDelegate.idl
new file mode 100644
index 0000000..f79e304
--- /dev/null
+++ b/WebKit/win/Interfaces/IWebPluginHalterDelegate.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+#endif
+
+interface IDOMNode;
+interface IWebView;
+
+[
+    object,
+    oleautomation,
+    uuid(2e0e5d9e-ffc9-4185-aa15-e66868d548ee),
+    pointer_default(unique)
+]
+interface IWebPluginHalterDelegate : IUnknown
+{
+    HRESULT shouldHaltPlugin([in] IWebView* webView, [in] IDOMNode*, [out, retval] BOOL* result);
+}
diff --git a/WebKit/win/Interfaces/IWebPolicyDelegatePrivate.idl b/WebKit/win/Interfaces/IWebPolicyDelegatePrivate.idl
new file mode 100644
index 0000000..4bb052c
--- /dev/null
+++ b/WebKit/win/Interfaces/IWebPolicyDelegatePrivate.idl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+import "IWebFrame.idl"
+import "IWebView.idl"
+#endif
+
+interface IWebView;
+interface IWebFrame;
+
+[
+    object,
+    oleautomation,
+    uuid(BA053E15-559F-46ee-A1D4-F8003EFFB658),
+    pointer_default(unique)
+]
+interface IWebPolicyDelegatePrivate : IUnknown
+{
+    HRESULT shouldLoadMediaURL([in] IWebView* webView, [in] BSTR url, [in] IWebFrame* frame, [out, retval] BOOL* retval);
+}
diff --git a/WebKit/win/Interfaces/IWebPreferencesPrivate.idl b/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
index 562a75b..d994211 100644
--- a/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
+++ b/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
@@ -78,4 +78,23 @@ interface IWebPreferencesPrivate : IUnknown
 
     HRESULT isXSSAuditorEnabled([out, retval] BOOL *enabled);
     HRESULT setXSSAuditorEnabled([in] BOOL enabled);
+
+    HRESULT experimentalNotificationsEnabled([out, retval] BOOL *enabled);
+    HRESULT setExperimentalNotificationsEnabled([in] BOOL enabled);
+
+    HRESULT experimentalWebSocketsEnabled([out, retval] BOOL *enabled);
+    HRESULT setExperimentalWebSocketsEnabled([in] BOOL enabled);
+
+    HRESULT setShouldUseHighResolutionTimers([in] BOOL useHighResolutionTimers);
+    HRESULT shouldUseHighResolutionTimers([out, retval] BOOL* useHighResolutionTimers);
+
+    // Used to set preference specified by a test via LayoutTestController.overridePreference(..).
+    // Used by DumpRenderTree.
+    HRESULT setPreferenceForTest([in] BSTR key, [in] BSTR value);
+
+    HRESULT setPluginHalterEnabled([in] BOOL enabled);
+    HRESULT pluginHalterEnabled([out, retval] BOOL* enabled);
+
+    HRESULT setPluginAllowedRunTime([in] UINT allowedRunTime);
+    HRESULT pluginAllowedRunTime([out, retval] UINT* allowedRunTime);
 }
diff --git a/WebKit/win/Interfaces/IWebUIDelegate2.idl b/WebKit/win/Interfaces/IWebUIDelegate2.idl
new file mode 100644
index 0000000..a413389
--- /dev/null
+++ b/WebKit/win/Interfaces/IWebUIDelegate2.idl
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+#endif
+
+/*!
+    @category WebUIDelegate2
+    @discussion An extension of WebUIDelegate which additionally
+    provides access to a notification presenter.
+    @interface NSObject (WebUIDelegate2)
+*/
+[
+    object,
+    oleautomation,
+    uuid(C6DEF152-86CD-11de-8BF4-ADD456D89593),
+    pointer_default(unique)
+]
+
+interface IWebUIDelegate2 : IWebUIDelegate
+{
+    /*!
+        @method desktopNotificationsDelegate:
+        @abstract Returns the notifications delegate object.
+    */
+    HRESULT desktopNotificationsDelegate([out, retval] IWebDesktopNotificationsDelegate** result);
+}
diff --git a/WebKit/win/Interfaces/IWebUIDelegatePrivate.idl b/WebKit/win/Interfaces/IWebUIDelegatePrivate.idl
index da8269b..e09aac4 100755
--- a/WebKit/win/Interfaces/IWebUIDelegatePrivate.idl
+++ b/WebKit/win/Interfaces/IWebUIDelegatePrivate.idl
@@ -48,8 +48,8 @@ interface IWebView;
 ]
 interface IWebUIDelegatePrivate : IUnknown
 {
-    HRESULT webViewResizerRect([in] IWebView* sender, [out, retval] RECT* rect);
-    HRESULT webViewDrawResizer([in] IWebView* sender, [in] HDC dc, [in] BOOL overlapsContent, [in] RECT* rect);
+    HRESULT unused1();
+    HRESULT unused2();
     HRESULT webViewScrolled([in] IWebView* sender);
     HRESULT webViewAddMessageToConsole([in] IWebView* sender, [in] BSTR message, [in] int lineNumber, [in] BSTR url, [in] BOOL isError);
     HRESULT webViewShouldInterruptJavaScript([in] IWebView* sender, [out, retval] BOOL* result);
@@ -60,8 +60,38 @@ interface IWebUIDelegatePrivate : IUnknown
     HRESULT webViewPainted([in] IWebView* sender);
     HRESULT exceededDatabaseQuota([in] IWebView* sender, [in] IWebFrame* frame, [in] IWebSecurityOrigin* origin, [in] BSTR databaseIdentifier);
     HRESULT embeddedViewWithArguments([in] IWebView* sender, [in] IWebFrame* frame, [in] IPropertyBag* arguments, [out, retval] IWebEmbeddedView** view);
-    HRESULT webViewSendResizeMessage([in] UINT uMsg, [in] WPARAM wParam, [in] LPARAM lParam);
+    HRESULT unused3();
     HRESULT webViewClosing([in] IWebView* sender);
     HRESULT webViewSetCursor([in] IWebView* sender, [in] OLE_HANDLE cursor);
     HRESULT webViewDidInvalidate([in] IWebView* sender);
 }
+
+cpp_quote("#define WebWindowFeaturesXKey L\"x\"")
+cpp_quote("#define WebWindowFeaturesYKey L\"y\"")
+cpp_quote("#define WebWindowFeaturesWidthKey L\"width\"")
+cpp_quote("#define WebWindowFeaturesHeightKey L\"height\"")
+cpp_quote("#define WebWindowFeaturesMenuBarVisibleKey L\"menuBarVisible\"")
+cpp_quote("#define WebWindowFeaturesStatusBarVisibleKey L\"statusBarVisible\"")
+cpp_quote("#define WebWindowFeaturesToolBarVisibleKey L\"toolBarVisible\"")
+cpp_quote("#define WebWindowFeaturesScrollbarsVisibleKey L\"scrollbarsVisible\"")
+cpp_quote("#define WebWindowFeaturesResizableKey L\"resizable\"")
+cpp_quote("#define WebWindowFeaturesFullscreenKey L\"fullscreen\"")
+cpp_quote("#define WebWindowFeaturesDialogKey L\"dialog\"")
+
+[
+    object,
+    oleautomation,
+    uuid(b7d6a98e-9c4f-43f2-b6a7-0975a0b18421),
+    pointer_default(unique)
+]
+interface IWebUIDelegatePrivate2 : IWebUIDelegatePrivate
+{
+    // This function obsoletes IWebUIDelegate::createWebViewWithRequest and
+    // IWebUIDelegate::createModalDialog. Clients should determine whether to create a modal dialog
+    // based on whether WebWindowFeaturesDialogKey returns a TRUE value from the windowFeatures
+    // IPropertyBag. The keys of the windowFeatures IPropertyBag are the WebWindowFeatures*Key
+    // strings above.
+    HRESULT createWebViewWithRequest([in] IWebView* sender, [in] IWebURLRequest* request, [in] IPropertyBag* windowFeatures, [out, retval] IWebView** newWebView);
+
+    HRESULT drawBackground([in] IWebView* sender, [in] OLE_HANDLE hdc, [in] const RECT* dirtyRect);
+}
diff --git a/WebKit/win/Interfaces/IWebView.idl b/WebKit/win/Interfaces/IWebView.idl
index 04e996c..bec4df5 100644
--- a/WebKit/win/Interfaces/IWebView.idl
+++ b/WebKit/win/Interfaces/IWebView.idl
@@ -29,6 +29,7 @@ cpp_quote("enum WebViewCmd { Cut = 100, Copy, Paste, ForwardDelete, SelectAll, U
 cpp_quote("#define WebViewProgressStartedNotification TEXT(\"WebProgressStartedNotification\")")
 cpp_quote("#define WebViewProgressEstimateChangedNotification TEXT(\"WebProgressEstimateChangedNotification\")")
 cpp_quote("#define WebViewProgressFinishedNotification TEXT(\"WebProgressFinishedNotification\")")
+cpp_quote("#define WebViewDidChangeSelectionNotification TEXT(\"WebViewDidChangeSelectionNotification\")")
 
 #ifndef DO_NO_IMPORTS
 import "oaidl.idl";
@@ -872,6 +873,11 @@ interface IWebIBActions : IUnknown
         - (IBAction)resetPageZoom:(id)sender;
     */
     HRESULT resetPageZoom([in] IUnknown* sender);
+
+    /*
+        - (IBAction)reloadFromOrigin:(id)sender;
+    */
+    HRESULT reloadFromOrigin([in] IUnknown* sender);
 }
 
 /*
diff --git a/WebKit/win/Interfaces/IWebViewPrivate.idl b/WebKit/win/Interfaces/IWebViewPrivate.idl
index e4680a1..465d804 100644
--- a/WebKit/win/Interfaces/IWebViewPrivate.idl
+++ b/WebKit/win/Interfaces/IWebViewPrivate.idl
@@ -29,15 +29,26 @@ import "ocidl.idl";
 import "IWebFormDelegate.idl";
 import "IWebFrameLoadDelegatePrivate.idl";
 import "IWebInspector.idl";
+import "IWebInspectorPrivate.idl";
 #endif
 
+// Sent when IWebView::close is called. No userInfo is associated with this notification.
+cpp_quote("#define WebViewWillCloseNotification L\"WebViewWillCloseNotification\"")
+
 interface IEnumTextMatches;
 interface IWebFormDelegate;
 interface IWebFrameLoadDelegatePrivate;
 interface IWebInspector;
+interface IWebInspectorPrivate;
+interface IWebPluginHalterDelegate;
 interface IWebURLRequest;
 interface IWebView;
 
+typedef enum {
+    WebInjectAtDocumentStart = 0,
+    WebInjectAtDocumentEnd,
+} WebUserScriptInjectionTime;
+
 [
     object,
     oleautomation,
@@ -161,4 +172,40 @@ interface IWebViewPrivate : IUnknown
     HRESULT setJavaScriptURLsAreAllowed([in] BOOL areAllowed);
 
     HRESULT setCanStartPlugins([in] BOOL canStartPlugins);
+
+    /*!
+        @method MIMETypeForExtension:
+        @abstract Returns the mime type for a certian file extension.
+        @param path The extension of the file to check.
+        @result The mime type of the specified extension.
+        + (BSTR)MIMETypeForPath:(NSString *)path;
+    */
+    HRESULT MIMETypeForExtension([in] BSTR extension, [out, retval] BSTR* mimeType);
+
+    // For the following functions, 0 < worldID < UINT_MAX.
+    HRESULT addUserScriptToGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR source, [in] BSTR url,
+                                 [in] unsigned whitelistCount, [in, size_is(whitelistCount)] BSTR* whitelist,
+                                 [in] unsigned blacklistCount, [in, size_is(blacklistCount)] BSTR* blacklist,
+                                 [in] WebUserScriptInjectionTime injectionTime);
+    HRESULT addUserStyleSheetToGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR source, [in] BSTR url,
+                                     [in] unsigned whitelistCount, [in, size_is(whitelistCount)] BSTR* whitelist,
+                                     [in] unsigned blacklistCount, [in, size_is(blacklistCount)] BSTR* blacklist);
+    HRESULT removeUserContentWithURLFromGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR url);
+    HRESULT removeUserContentFromGroup([in] BSTR groupName, [in] unsigned worldID);
+    HRESULT removeAllUserContentFromGroup([in] BSTR groupName);
+
+    HRESULT setPluginHalterDelegate([in] IWebPluginHalterDelegate* d);
+    HRESULT pluginHalterDelegate([retval, out] IWebPluginHalterDelegate** d);
+
+    // If rect is 0, the entire backing store will be invalidated.
+    HRESULT invalidateBackingStore([in] const RECT* rect);
+
+    // Whitelists access from an origin (sourceOrigin) to a set of one or more origins described by the parameters:
+    // - destinationProtocol: The protocol to grant access to.
+    // - destinationHost: The host to grant access to.
+    // - allowDestinationSubdomains: If host is a domain, setting this to YES will whitelist host and all its subdomains, recursively.
+    HRESULT whiteListAccessFromOrigin([in] BSTR sourceOrigin, [in] BSTR destinationProtocol, [in] BSTR destinationHost, [in] BOOL allowDestinationSubdomains);
+
+    // Removes all white list entries created with whiteListAccessFromOrigin.
+    HRESULT resetOriginAccessWhiteLists();
 }
diff --git a/WebKit/win/Interfaces/IWebWorkersPrivate.idl b/WebKit/win/Interfaces/IWebWorkersPrivate.idl
new file mode 100644
index 0000000..990b8f7
--- /dev/null
+++ b/WebKit/win/Interfaces/IWebWorkersPrivate.idl
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+#endif
+
+/*!
+    @class WebWorkersPrivate
+    @discussion WebWorkersPrivate exposes internals about WebWorkers for use in
+    layout tests.
+*/
+[
+    object,
+    oleautomation,
+    hidden,
+    uuid(537069C5-389C-41ae-9A82-423ACA8B2C02),
+    pointer_default(unique)
+]
+
+interface IWebWorkersPrivate : IUnknown
+{
+    HRESULT workerThreadCount([out, retval] UINT* number);
+}
diff --git a/WebKit/win/Interfaces/WebKit.idl b/WebKit/win/Interfaces/WebKit.idl
index 3a6fd8d..c9b33cc 100644
--- a/WebKit/win/Interfaces/WebKit.idl
+++ b/WebKit/win/Interfaces/WebKit.idl
@@ -73,6 +73,7 @@ import "ocidl.idl";
 #include "IWebCoreStatistics.idl"
 #include "IWebDataSource.idl"
 #include "IWebDatabaseManager.idl"
+#include "IWebDesktopNotificationsDelegate.idl"
 #include "IWebDocument.idl"
 #include "IWebDownload.idl"
 #include "IWebEditingDelegate.idl"
@@ -83,6 +84,7 @@ import "ocidl.idl";
 #include "IWebFrame.idl"
 #include "IWebFrameLoadDelegate.idl"
 #include "IWebFrameLoadDelegatePrivate.idl"
+#include "IWebFrameLoadDelegatePrivate2.idl"
 #include "IWebFramePrivate.idl"
 #include "IWebFrameView.idl"
 #include "IWebHTMLRepresentation.idl"
@@ -94,13 +96,16 @@ import "ocidl.idl";
 #include "IWebIconDatabase.idl"
 #include "IWebIconFetcher.idl"
 #include "IWebInspector.idl"
+#include "IWebInspectorPrivate.idl"
 #include "IWebJavaScriptCollector.idl"
 #include "IWebKitStatistics.idl"
 #include "IWebMutableURLRequestPrivate.idl"
 #include "IWebNotification.idl"
 #include "IWebNotificationCenter.idl"
 #include "IWebNotificationObserver.idl"
+#include "IWebPluginHalterDelegate.idl"
 #include "IWebPolicyDelegate.idl"
+#include "IWebPolicyDelegatePrivate.idl"
 #include "IWebPreferences.idl"
 #include "IWebPreferencesPrivate.idl"
 #include "IWebResource.idl"
@@ -111,6 +116,7 @@ import "ocidl.idl";
 #include "IWebSecurityOrigin.idl"
 #include "IWebTextRenderer.idl"
 #include "IWebUIDelegate.idl"
+#include "IWebUIDelegate2.idl"
 #include "IWebUIDelegatePrivate.idl"
 #include "IWebURLAuthenticationChallenge.idl"
 #include "IWebURLRequest.idl"
@@ -121,6 +127,7 @@ import "ocidl.idl";
 #include "IWebUndoTarget.idl"
 #include "IWebView.idl"
 #include "IWebViewPrivate.idl"
+#include "IWebWorkersPrivate.idl"
 
 #include "IGEN_DOMObject.idl"
 #include "IGEN_DOMCharacterData.idl"
@@ -357,6 +364,10 @@ library WebKit
     coclass WebCookieManager{
         [default] interface IWebCookieManager;
     }
-}
 
+    [uuid(0967AAFF-2FFE-4fcc-81F3-3FF2A9C6DCE2)]
+    coclass WebWorkersPrivate{
+        [default] interface IWebWorkersPrivate;
+    }
+}
 
diff --git a/WebKit/win/WebCoreLocalizedStrings.cpp b/WebKit/win/WebCoreLocalizedStrings.cpp
index 389b1c0..03d03e7 100644
--- a/WebKit/win/WebCoreLocalizedStrings.cpp
+++ b/WebKit/win/WebCoreLocalizedStrings.cpp
@@ -94,8 +94,6 @@ String WebCore::AXLinkActionVerb() { return String(LPCTSTR_UI_STRING("jump", "Ve
 String WebCore::unknownFileSizeText() { return String(LPCTSTR_UI_STRING("Unknown", "Unknown filesize FTP directory listing item")); }
 String WebCore::uploadFileText() { return String(LPCTSTR_UI_STRING("Upload file", "(Windows) Form submit file upload dialog title")); }
 String WebCore::allFilesText() { return String(LPCTSTR_UI_STRING("All Files", "(Windows) Form submit file upload all files pop-up")); }
-String WebCore::mediaElementLoadingStateText() { return String(LPCTSTR_UI_STRING("Loading...", "Media controller status message when the media is loading")); }
-String WebCore::mediaElementLiveBroadcastStateText() { return String(LPCTSTR_UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast")); }
 
 String WebCore::imageTitle(const String& filename, const IntSize& size) 
 { 
@@ -114,3 +112,122 @@ String multipleFileUploadText(unsigned numberOfFiles)
 
     return result.get();
 }
+
+#if ENABLE(VIDEO)
+String WebCore::mediaElementLoadingStateText() { return String(LPCTSTR_UI_STRING("Loading...", "Media controller status message when the media is loading")); }
+String WebCore::mediaElementLiveBroadcastStateText() { return String(LPCTSTR_UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast")); }
+
+String WebCore::localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return String(LPCTSTR_UI_STRING("audio element controller", "accessibility role description for audio element controller"));
+    if (name == "VideoElement")
+        return String(LPCTSTR_UI_STRING("video element controller", "accessibility role description for video element controller"));
+    if (name == "MuteButton")
+        return String(LPCTSTR_UI_STRING("mute", "accessibility role description for mute button"));
+    if (name == "UnMuteButton")
+        return String(LPCTSTR_UI_STRING("unmute", "accessibility role description for turn mute off button"));
+    if (name == "PlayButton")
+        return String(LPCTSTR_UI_STRING("play", "accessibility role description for play button"));
+    if (name == "PauseButton")
+        return String(LPCTSTR_UI_STRING("pause", "accessibility role description for pause button"));
+    if (name == "Slider")
+        return String(LPCTSTR_UI_STRING("movie time", "accessibility role description for timeline slider"));
+    if (name == "SliderThumb")
+        return String(LPCTSTR_UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb"));
+    if (name == "RewindButton")
+        return String(LPCTSTR_UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button"));
+    if (name == "ReturnToRealtimeButton")
+        return String(LPCTSTR_UI_STRING("return to realtime", "accessibility role description for return to real time button"));
+    if (name == "CurrentTimeDisplay")
+        return String(LPCTSTR_UI_STRING("elapsed time", "accessibility role description for elapsed time display"));
+    if (name == "TimeRemainingDisplay")
+        return String(LPCTSTR_UI_STRING("remaining time", "accessibility role description for time remaining display"));
+    if (name == "StatusDisplay")
+        return String(LPCTSTR_UI_STRING("status", "accessibility role description for movie status"));
+    if (name == "FullscreenButton")
+        return String(LPCTSTR_UI_STRING("fullscreen", "accessibility role description for enter fullscreen button"));
+    if (name == "SeekForwardButton")
+        return String(LPCTSTR_UI_STRING("fast forward", "accessibility role description for fast forward button"));
+    if (name == "SeekBackButton")
+        return String(LPCTSTR_UI_STRING("fast reverse", "accessibility role description for fast reverse button"));
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String WebCore::localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return String(LPCTSTR_UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller"));
+    if (name == "VideoElement")
+        return String(LPCTSTR_UI_STRING("video element playback controls and status display", "accessibility role description for video element controller"));
+    if (name == "MuteButton")
+        return String(LPCTSTR_UI_STRING("mute audio tracks", "accessibility help text for mute button"));
+    if (name == "UnMuteButton")
+        return String(LPCTSTR_UI_STRING("unmute audio tracks", "accessibility help text for un mute button"));
+    if (name == "PlayButton")
+        return String(LPCTSTR_UI_STRING("begin playback", "accessibility help text for play button"));
+    if (name == "PauseButton")
+        return String(LPCTSTR_UI_STRING("pause playback", "accessibility help text for pause button"));
+    if (name == "Slider")
+        return String(LPCTSTR_UI_STRING("movie time scrubber", "accessibility help text for timeline slider"));
+    if (name == "SliderThumb")
+        return String(LPCTSTR_UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb"));
+    if (name == "RewindButton")
+        return String(LPCTSTR_UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button"));
+    if (name == "ReturnToRealtimeButton")
+        return String(LPCTSTR_UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button"));
+    if (name == "CurrentTimeDisplay")
+        return String(LPCTSTR_UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display"));
+    if (name == "TimeRemainingDisplay")
+        return String(LPCTSTR_UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display"));
+    if (name == "StatusDisplay")
+        return String(LPCTSTR_UI_STRING("current movie status", "accessibility help text for movie status display"));
+    if (name == "SeekBackButton")
+        return String(LPCTSTR_UI_STRING("seek quickly back", "accessibility help text for fast rewind button"));
+    if (name == "SeekForwardButton")
+        return String(LPCTSTR_UI_STRING("seek quickly forward", "accessibility help text for fast forward button"));
+    if (name == "FullscreenButton")
+        return String(LPCTSTR_UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button"));
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String WebCore::localizedMediaTimeDescription(float time)
+{
+    if (!isfinite(time))
+        return String(LPCTSTR_UI_STRING("indefinite time", "string for an indefinite movie time"));
+
+    int seconds = (int)fabsf(time);
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days) {
+        static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("date.format.for.days", "string for days, hours, minutes & seconds"));
+        RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormat(0, 0, format.get(), days, hours, minutes, seconds));
+        return result.get();
+    }
+
+    if (hours) {
+        static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("date.format.for.hours", "string for hours, minutes & seconds"));
+        RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormat(0, 0, format.get(), hours, minutes, seconds));
+        return result.get();
+    }
+
+    if (minutes) {
+        static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("date.format.for.minutes", "string for minutes & seconds"));
+        RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormat(0, 0, format.get(), minutes, seconds));
+        return result.get();
+    }
+
+    static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("date.format.for.seconds", "string for seconds"));
+    RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormat(0, 0, format.get(), seconds));
+    return result.get();
+}
+
+#endif  // ENABLE(VIDEO)
+
diff --git a/WebKit/win/WebCoreSupport/WebChromeClient.cpp b/WebKit/win/WebCoreSupport/WebChromeClient.cpp
index 1c0401f..5d39452 100644
--- a/WebKit/win/WebCoreSupport/WebChromeClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebChromeClient.cpp
@@ -26,10 +26,13 @@
 #include "config.h"
 #include "WebChromeClient.h"
 
+#include "COMPropertyBag.h"
+#include "COMVariantSetter.h"
 #include "WebElementPropertyBag.h"
 #include "WebFrame.h"
 #include "WebHistory.h"
 #include "WebMutableURLRequest.h"
+#include "WebDesktopNotificationsDelegate.h"
 #include "WebSecurityOrigin.h"
 #include "WebView.h"
 #pragma warning(push, 0)
@@ -58,6 +61,9 @@ static const size_t maxFilePathsListSize = USHRT_MAX;
 
 WebChromeClient::WebChromeClient(WebView* webView)
     : m_webView(webView)
+#if ENABLE(NOTIFICATIONS)
+    , m_notificationsDelegate(new WebDesktopNotificationsDelegate(webView))
+#endif
 {
 }
 
@@ -150,35 +156,59 @@ void WebChromeClient::takeFocus(FocusDirection direction)
     }
 }
 
+static COMPtr<IPropertyBag> createWindowFeaturesPropertyBag(const WindowFeatures& features)
+{
+    HashMap<String, COMVariant> map;
+    if (features.xSet)
+        map.set(WebWindowFeaturesXKey, features.x);
+    if (features.ySet)
+        map.set(WebWindowFeaturesYKey, features.y);
+    if (features.widthSet)
+        map.set(WebWindowFeaturesWidthKey, features.width);
+    if (features.heightSet)
+        map.set(WebWindowFeaturesHeightKey, features.height);
+    map.set(WebWindowFeaturesMenuBarVisibleKey, features.menuBarVisible);
+    map.set(WebWindowFeaturesStatusBarVisibleKey, features.statusBarVisible);
+    map.set(WebWindowFeaturesToolBarVisibleKey, features.toolBarVisible);
+    map.set(WebWindowFeaturesScrollbarsVisibleKey, features.scrollbarsVisible);
+    map.set(WebWindowFeaturesResizableKey, features.resizable);
+    map.set(WebWindowFeaturesFullscreenKey, features.fullscreen);
+    map.set(WebWindowFeaturesDialogKey, features.dialog);
+
+    return COMPtr<IPropertyBag>(AdoptCOM, COMPropertyBag<COMVariant>::adopt(map));
+}
+
 Page* WebChromeClient::createWindow(Frame*, const FrameLoadRequest& frameLoadRequest, const WindowFeatures& features)
 {
-    if (features.dialog) {
-        COMPtr<IWebUIDelegate> delegate = uiDelegate();
-        if (!delegate)
-            return 0;
-        COMPtr<IWebMutableURLRequest> request(AdoptCOM, WebMutableURLRequest::createInstance(frameLoadRequest.resourceRequest()));
-        COMPtr<IWebView> dialog;
-        if (FAILED(delegate->createModalDialog(m_webView, request.get(), &dialog)))
+    COMPtr<IWebUIDelegate> delegate = uiDelegate();
+    if (!delegate)
+        return 0;
+
+    COMPtr<IWebMutableURLRequest> request(AdoptCOM, WebMutableURLRequest::createInstance(frameLoadRequest.resourceRequest()));
+
+    COMPtr<IWebUIDelegatePrivate2> delegatePrivate(Query, delegate);
+    if (delegatePrivate) {
+        COMPtr<IWebView> newWebView;
+        HRESULT hr = delegatePrivate->createWebViewWithRequest(m_webView, request.get(), createWindowFeaturesPropertyBag(features).get(), &newWebView);
+
+        if (SUCCEEDED(hr) && newWebView)
+            return core(newWebView.get());
+
+        // If the delegate doesn't implement the IWebUIDelegatePrivate2 version of the call, fall back
+        // to the old versions (even if they support the IWebUIDelegatePrivate2 interface).
+        if (hr != E_NOTIMPL)
             return 0;
-        return core(dialog.get());
     }
 
-    Page* page = 0;
-    IWebUIDelegate* uiDelegate = 0;
-    IWebMutableURLRequest* request = WebMutableURLRequest::createInstance(frameLoadRequest.resourceRequest());
+    COMPtr<IWebView> newWebView;
 
-    if (SUCCEEDED(m_webView->uiDelegate(&uiDelegate))) {
-        IWebView* webView = 0;
-        if (SUCCEEDED(uiDelegate->createWebViewWithRequest(m_webView, request, &webView))) {
-            page = core(webView);
-            webView->Release();
-        }
-    
-        uiDelegate->Release();
-    }
+    if (features.dialog) {
+        if (FAILED(delegate->createModalDialog(m_webView, request.get(), &newWebView)))
+            return 0;
+    } else if (FAILED(delegate->createWebViewWithRequest(m_webView, request.get(), &newWebView)))
+        return 0;
 
-    request->Release();
-    return page;
+    return newWebView ? core(newWebView.get()) : 0;
 }
 
 void WebChromeClient::show()
@@ -411,20 +441,7 @@ bool WebChromeClient::tabsToLinks() const
 
 IntRect WebChromeClient::windowResizerRect() const
 {
-    IntRect intRect;
-
-    IWebUIDelegate* ui;
-    if (SUCCEEDED(m_webView->uiDelegate(&ui)) && ui) {
-        IWebUIDelegatePrivate* uiPrivate;
-        if (SUCCEEDED(ui->QueryInterface(IID_IWebUIDelegatePrivate, (void**)&uiPrivate))) {
-            RECT r;
-            if (SUCCEEDED(uiPrivate->webViewResizerRect(m_webView, &r)))
-                intRect = IntRect(r.left, r.top, r.right-r.left, r.bottom-r.top);
-            uiPrivate->Release();
-        }
-        ui->Release();
-    }
-    return intRect;
+    return IntRect();
 }
 
 void WebChromeClient::repaint(const IntRect& windowRect, bool contentChanged, bool immediate, bool repaintContentOnly)
@@ -469,7 +486,7 @@ IntPoint WebChromeClient::screenToWindow(const IntPoint& point) const
     return result;
 }
 
-PlatformWidget WebChromeClient::platformWindow() const
+PlatformPageClient WebChromeClient::platformPageClient() const
 {
     HWND viewWindow;
     if (FAILED(m_webView->viewWindow(reinterpret_cast<OLE_HANDLE*>(&viewWindow))))
diff --git a/WebKit/win/WebCoreSupport/WebChromeClient.h b/WebKit/win/WebCoreSupport/WebChromeClient.h
index c601c8e..d01e47d 100644
--- a/WebKit/win/WebCoreSupport/WebChromeClient.h
+++ b/WebKit/win/WebCoreSupport/WebChromeClient.h
@@ -29,8 +29,10 @@
 #include <WebCore/FocusDirection.h>
 #include <WebCore/ScrollTypes.h>
 #include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
 
 class WebView;
+class WebDesktopNotificationsDelegate;
 
 interface IWebUIDelegate;
 
@@ -93,9 +95,10 @@ public:
     virtual void scroll(const WebCore::IntSize& scrollDelta, const WebCore::IntRect& rectToScroll, const WebCore::IntRect& clipRect);
     virtual WebCore::IntPoint screenToWindow(const WebCore::IntPoint& p) const;
     virtual WebCore::IntRect windowToScreen(const WebCore::IntRect& r) const;
-    virtual PlatformWidget platformWindow() const;
+    virtual PlatformPageClient platformPageClient() const;
     virtual void contentsSizeChanged(WebCore::Frame*, const WebCore::IntSize&) const;
 
+    virtual void scrollbarsModeDidChange() const { }
     virtual void mouseDidMoveOverElement(const WebCore::HitTestResult&, unsigned modifierFlags);
 
     virtual void setToolTip(const WebCore::String&, WebCore::TextDirection);
@@ -131,8 +134,16 @@ public:
 
     virtual void requestGeolocationPermissionForFrame(WebCore::Frame*, WebCore::Geolocation*);
 
+#if ENABLE(NOTIFICATIONS)
+    virtual WebCore::NotificationPresenter* notificationPresenter() const { return reinterpret_cast<WebCore::NotificationPresenter*>(m_notificationsDelegate.get()); }
+#endif
+
 private:
     COMPtr<IWebUIDelegate> uiDelegate();
 
     WebView* m_webView;
+
+#if ENABLE(NOTIFICATIONS)
+    OwnPtr<WebDesktopNotificationsDelegate> m_notificationsDelegate;
+#endif
 };
diff --git a/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.cpp b/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.cpp
new file mode 100644
index 0000000..f822bfe
--- /dev/null
+++ b/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.cpp
@@ -0,0 +1,204 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebDesktopNotificationsDelegate.h"
+#include "WebSecurityOrigin.h"
+#include "WebView.h"
+#include <WebCore/BString.h>
+
+#if ENABLE(NOTIFICATIONS)
+
+using namespace WebCore;
+
+class NotificationCOMWrapper : public IWebDesktopNotification {
+public:
+    static NotificationCOMWrapper* create(Notification* inner) { return new NotificationCOMWrapper(inner); }
+   
+    // IUnknown
+    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);
+    virtual ULONG STDMETHODCALLTYPE AddRef();
+    virtual ULONG STDMETHODCALLTYPE Release();
+
+    // IWebDesktopNotification
+    HRESULT STDMETHODCALLTYPE isHTML(BOOL* result);
+    HRESULT STDMETHODCALLTYPE contentsURL(BSTR* result);
+    HRESULT STDMETHODCALLTYPE iconURL(BSTR* result);
+    HRESULT STDMETHODCALLTYPE title(BSTR* result);
+    HRESULT STDMETHODCALLTYPE text(BSTR* result);
+    HRESULT STDMETHODCALLTYPE notifyDisplay();
+    HRESULT STDMETHODCALLTYPE notifyError();
+    HRESULT STDMETHODCALLTYPE notifyClose(BOOL xplicit);
+
+private:
+    NotificationCOMWrapper(Notification* inner) : m_refCount(1), m_inner(inner) {}
+
+    int m_refCount;
+    Notification* m_inner;
+};
+
+HRESULT STDMETHODCALLTYPE NotificationCOMWrapper::QueryInterface(REFIID riid, void** ppvObject)
+{
+    *ppvObject = 0;
+    if (IsEqualGUID(riid, IID_IUnknown))
+        *ppvObject = static_cast<NotificationCOMWrapper*>(this);
+    else if (IsEqualGUID(riid, IID_IWebDesktopNotification))
+        *ppvObject = static_cast<NotificationCOMWrapper*>(this);
+    else
+        return E_NOINTERFACE;
+
+    AddRef();
+    return S_OK;
+}
+
+ULONG STDMETHODCALLTYPE NotificationCOMWrapper::AddRef()
+{ 
+    return ++m_refCount; 
+}
+
+ULONG STDMETHODCALLTYPE NotificationCOMWrapper::Release()
+{
+    ULONG newRef = --m_refCount;
+    if (!newRef)
+        delete(this);
+    return newRef;
+}
+
+HRESULT STDMETHODCALLTYPE NotificationCOMWrapper::isHTML(BOOL* result)
+{
+    *result = m_inner->isHTML();
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE NotificationCOMWrapper::contentsURL(BSTR* result)
+{
+    *result = BString(m_inner->url()).release();
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE NotificationCOMWrapper::iconURL(BSTR* result)
+{
+    *result = BString(m_inner->contents().icon()).release();
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE NotificationCOMWrapper::title(BSTR* result)
+{
+    *result = BString(m_inner->contents().title()).release();
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE NotificationCOMWrapper::text(BSTR* result)
+{
+    *result = BString(m_inner->contents().body()).release();
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE NotificationCOMWrapper::notifyDisplay()
+{
+    m_inner->dispatchDisplayEvent();
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE NotificationCOMWrapper::notifyError()
+{
+    m_inner->dispatchErrorEvent();
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE NotificationCOMWrapper::notifyClose(BOOL xplicit)
+{
+    m_inner->dispatchCloseEvent();
+    return S_OK;
+}
+
+WebDesktopNotificationsDelegate::WebDesktopNotificationsDelegate(WebView* webView)
+    : m_webView(webView)
+{
+}
+
+bool WebDesktopNotificationsDelegate::show(Notification* object)
+{
+    if (hasNotificationDelegate())
+        notificationDelegate()->showDesktopNotification(NotificationCOMWrapper::create(object));
+    return true;
+}
+
+void WebDesktopNotificationsDelegate::cancel(Notification* object)
+{
+    if (hasNotificationDelegate())
+        notificationDelegate()->cancelDesktopNotification(NotificationCOMWrapper::create(object));
+}
+
+void WebDesktopNotificationsDelegate::notificationObjectDestroyed(Notification* object)
+{
+    if (hasNotificationDelegate())
+        notificationDelegate()->notificationDestroyed(NotificationCOMWrapper::create(object));
+}
+
+void WebDesktopNotificationsDelegate::requestPermission(SecurityOrigin* origin, PassRefPtr<VoidCallback> callback)
+{
+    BString org(origin->toString());
+    if (hasNotificationDelegate())
+        notificationDelegate()->requestNotificationPermission(org);
+}
+
+NotificationPresenter::Permission WebDesktopNotificationsDelegate::checkPermission(SecurityOrigin* origin)
+{
+    int out = 0;
+    BString org(origin->toString());
+    if (hasNotificationDelegate())
+        notificationDelegate()->checkNotificationPermission(org, &out);
+    return (NotificationPresenter::Permission) out;
+}
+
+bool WebDesktopNotificationsDelegate::hasNotificationDelegate()
+{
+    COMPtr<IWebUIDelegate> ui;
+    m_webView->uiDelegate(&ui);
+
+    COMPtr<IWebUIDelegate2> ui2;
+    return SUCCEEDED(ui->QueryInterface(IID_IWebUIDelegate2, (void**) &ui2));
+}
+
+COMPtr<IWebDesktopNotificationsDelegate> WebDesktopNotificationsDelegate::notificationDelegate()
+{
+    COMPtr<IWebUIDelegate> ui;
+    m_webView->uiDelegate(&ui);
+
+    COMPtr<IWebUIDelegate2> ui2;
+    COMPtr<IWebDesktopNotificationsDelegate> delegate;
+    if (SUCCEEDED(ui->QueryInterface(IID_IWebUIDelegate2, (void**) &ui2)))
+        ui2->desktopNotificationsDelegate(&delegate);
+
+    return delegate;
+}
+
+#endif  // ENABLE(NOTIFICATIONS)
diff --git a/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.h b/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.h
new file mode 100644
index 0000000..00c00d5
--- /dev/null
+++ b/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <WebCore/COMPtr.h>
+#include <WebCore/Notification.h>
+#include <WebCore/NotificationPresenter.h>
+
+#if ENABLE(NOTIFICATIONS)
+
+interface IWebDesktopNotificationPresenter;
+
+class WebDesktopNotificationsDelegate : public WebCore::NotificationPresenter {
+public:
+    WebDesktopNotificationsDelegate(WebView* view);
+
+    /* WebCore::NotificationPresenter interface */
+    virtual bool show(WebCore::Notification* object);
+    virtual void cancel(WebCore::Notification* object);
+    virtual void notificationObjectDestroyed(WebCore::Notification* object);
+    virtual void requestPermission(WebCore::SecurityOrigin* origin, PassRefPtr<WebCore::VoidCallback> callback);
+    virtual WebCore::NotificationPresenter::Permission checkPermission(WebCore::SecurityOrigin* origin);
+
+private:
+    bool hasNotificationDelegate();
+    COMPtr<IWebDesktopNotificationsDelegate> notificationDelegate();
+
+    WebView* m_webView;
+};
+
+#endif
diff --git a/WebKit/win/WebCoreSupport/WebDragClient.cpp b/WebKit/win/WebCoreSupport/WebDragClient.cpp
index e5c5a20..840fca1 100644
--- a/WebKit/win/WebCoreSupport/WebDragClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebDragClient.cpp
@@ -33,6 +33,7 @@
 
 #pragma warning(push, 0) 
 #include <WebCore/ClipboardWin.h>
+#include <WebCore/DragController.h>
 #include <WebCore/DragData.h>
 #include <WebCore/Font.h>
 #include <WebCore/FontDescription.h>
@@ -68,6 +69,22 @@ namespace WebCore {
 
 using namespace WebCore;
 
+static DWORD draggingSourceOperationMaskToDragCursors(DragOperation op)
+{
+    DWORD result = DROPEFFECT_NONE;
+    if (op == DragOperationEvery)
+        return DROPEFFECT_COPY | DROPEFFECT_LINK | DROPEFFECT_MOVE; 
+    if (op & DragOperationCopy)
+        result |= DROPEFFECT_COPY; 
+    if (op & DragOperationLink)
+        result |= DROPEFFECT_LINK; 
+    if (op & DragOperationMove)
+        result |= DROPEFFECT_MOVE;
+    if (op & DragOperationGeneric)
+        result |= DROPEFFECT_MOVE;
+    return result;
+}
+
 WebDragClient::WebDragClient(WebView* webView)
     : m_webView(webView) 
 {
@@ -154,8 +171,7 @@ void WebDragClient::startDrag(DragImageRef image, const IntPoint& imageOrigin, c
             }
         }
 
-        //FIXME: Ensure correct drag ops are available <rdar://problem/5015957>
-        DWORD okEffect = DROPEFFECT_COPY | DROPEFFECT_LINK | DROPEFFECT_MOVE;
+        DWORD okEffect = draggingSourceOperationMaskToDragCursors(m_webView->page()->dragController()->sourceDragOperation());
         DWORD effect;
         COMPtr<IWebUIDelegate> ui;
         if (SUCCEEDED(m_webView->uiDelegate(&ui))) {
diff --git a/WebKit/win/WebCoreSupport/WebEditorClient.cpp b/WebKit/win/WebCoreSupport/WebEditorClient.cpp
index e626178..c9118e5 100644
--- a/WebKit/win/WebCoreSupport/WebEditorClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebEditorClient.cpp
@@ -29,6 +29,8 @@
 
 #include "WebKit.h"
 #include "WebLocalizableStrings.h"
+#include "WebNotification.h"
+#include "WebNotificationCenter.h"
 #include "WebView.h"
 #include "DOMCoreClasses.h"
 #pragma warning(push, 0)
@@ -209,6 +211,10 @@ void WebEditorClient::respondToChangedContents()
 void WebEditorClient::respondToChangedSelection()
 {
     m_webView->selectionChanged();
+
+    static BSTR webViewDidChangeSelectionNotificationName = SysAllocString(WebViewDidChangeSelectionNotification);
+    IWebNotificationCenter* notifyCenter = WebNotificationCenter::defaultCenterInternal();
+    notifyCenter->postNotificationName(webViewDidChangeSelectionNotificationName, static_cast<IWebView*>(m_webView), 0);
 }
 
 void WebEditorClient::didEndEditing()
diff --git a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
index 0fea348..1281420 100644
--- a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -44,6 +44,7 @@
 #include "WebHistoryItem.h"
 #include "WebMutableURLRequest.h"
 #include "WebNotificationCenter.h"
+#include "WebSecurityOrigin.h"
 #include "WebURLAuthenticationChallenge.h"
 #include "WebURLResponse.h"
 #include "WebView.h"
@@ -529,6 +530,36 @@ bool WebFrameLoaderClient::shouldGoToHistoryItem(HistoryItem*) const
     return true;
 }
 
+void WebFrameLoaderClient::didDisplayInsecureContent()
+{
+    WebView* webView = m_webFrame->webView();
+    COMPtr<IWebFrameLoadDelegatePrivate> frameLoadDelegatePriv;
+    if (FAILED(webView->frameLoadDelegatePrivate(&frameLoadDelegatePriv)) || !frameLoadDelegatePriv)
+        return;
+
+    COMPtr<IWebFrameLoadDelegatePrivate2> frameLoadDelegatePriv2(Query, frameLoadDelegatePriv);
+    if (!frameLoadDelegatePriv2)
+        return;
+
+    frameLoadDelegatePriv2->didDisplayInsecureContent(webView);
+}
+
+void WebFrameLoaderClient::didRunInsecureContent(SecurityOrigin* origin)
+{
+    COMPtr<IWebSecurityOrigin> webSecurityOrigin = WebSecurityOrigin::createInstance(origin);
+
+    WebView* webView = m_webFrame->webView();
+    COMPtr<IWebFrameLoadDelegatePrivate> frameLoadDelegatePriv;
+    if (FAILED(webView->frameLoadDelegatePrivate(&frameLoadDelegatePriv)) || !frameLoadDelegatePriv)
+        return;
+
+    COMPtr<IWebFrameLoadDelegatePrivate2> frameLoadDelegatePriv2(Query, frameLoadDelegatePriv);
+    if (!frameLoadDelegatePriv2)
+        return;
+
+    frameLoadDelegatePriv2->didRunInsecureContent(webView, webSecurityOrigin.get());
+}
+
 PassRefPtr<DocumentLoader> WebFrameLoaderClient::createDocumentLoader(const ResourceRequest& request, const SubstituteData& substituteData)
 {
     RefPtr<WebDocumentLoader> loader = WebDocumentLoader::create(request, substituteData);
@@ -764,3 +795,24 @@ bool WebFrameLoaderClient::shouldUsePluginDocument(const String& mimeType) const
 
     return webView->shouldUseEmbeddedView(mimeType);
 }
+
+bool WebFrameLoaderClient::shouldLoadMediaElementURL(const KURL& url) const
+{
+    WebView* webView = m_webFrame->webView();
+    if (!webView)
+        return true;
+
+    COMPtr<IWebPolicyDelegate> policyDelegate;
+    if (FAILED(webView->policyDelegate(&policyDelegate)) || !policyDelegate)
+        return true;
+
+    COMPtr<IWebPolicyDelegatePrivate> policyDelegatePrivate(Query, policyDelegate);
+    if (!policyDelegatePrivate)
+        return true;
+
+    BOOL retval;
+    if (FAILED(policyDelegatePrivate->shouldLoadMediaURL(webView, BString(url), m_webFrame, &retval)))
+        return true;
+
+    return retval;
+}
diff --git a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
index ef7e982..a215cf9 100644
--- a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
+++ b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
@@ -92,6 +92,9 @@ public:
     virtual void updateGlobalHistoryRedirectLinks();
     virtual bool shouldGoToHistoryItem(WebCore::HistoryItem*) const;
 
+    virtual void didDisplayInsecureContent();
+    virtual void didRunInsecureContent(WebCore::SecurityOrigin*);
+
     virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
     virtual void setTitle(const WebCore::String& title, const WebCore::KURL&);
 
@@ -109,6 +112,7 @@ public:
     virtual bool shouldUsePluginDocument(const WebCore::String& mimeType) const;
 
     virtual void dispatchDidFailToStartPlugin(const WebCore::PluginView*) const;
+    virtual bool shouldLoadMediaElementURL(const WebCore::KURL&) const;
 
 protected:
     WebFrameLoaderClient(WebFrame*);
diff --git a/WebKit/win/WebCoreSupport/WebInspectorClient.cpp b/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
index ba724b4..75a76f2 100644
--- a/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
@@ -99,13 +99,11 @@ void WebInspectorClient::inspectorDestroyed()
 
 Page* WebInspectorClient::createPage()
 {
-    if (m_webView)
-        return core(m_webView.get());
-
-    ASSERT(!m_hwnd);
-
     registerWindowClass();
 
+    if (m_hwnd)
+        ::DestroyWindow(m_hwnd);
+
     m_hwnd = ::CreateWindowEx(0, kWebInspectorWindowClassName, 0, WS_OVERLAPPEDWINDOW,
         defaultWindowRect().x(), defaultWindowRect().y(), defaultWindowRect().width(), defaultWindowRect().height(),
         0, 0, 0, 0);
@@ -351,8 +349,9 @@ void WebInspectorClient::showWindowWithoutNotifications()
     ASSERT(m_webView);
     ASSERT(m_inspectedWebViewHwnd);
 
+    // If no preference is set - default to an attached window. This is important for inspector LayoutTests.
     InspectorController::Setting shouldAttach = m_inspectedWebView->page()->inspectorController()->setting(inspectorStartsAttachedName);
-    m_shouldAttachWhenShown = shouldAttach.type() == InspectorController::Setting::BooleanType ? shouldAttach.booleanValue() : false;
+    m_shouldAttachWhenShown = shouldAttach.type() == InspectorController::Setting::BooleanType ? shouldAttach.booleanValue() : true;
 
     if (!m_shouldAttachWhenShown) {
         // Put the Inspector's WebView inside our window and show it.
diff --git a/WebKit/win/WebCoreSupport/WebInspectorDelegate.h b/WebKit/win/WebCoreSupport/WebInspectorDelegate.h
index 85f14b2..7561d5a 100644
--- a/WebKit/win/WebCoreSupport/WebInspectorDelegate.h
+++ b/WebKit/win/WebCoreSupport/WebInspectorDelegate.h
@@ -324,6 +324,9 @@ public:
         /* [in] */ HDC hDC,

         /* [in] */ RECT rect) { return E_NOTIMPL; }

 

+    virtual HRESULT STDMETHODCALLTYPE desktopNotificationsDelegate(

+        /* [retval][out] */ IWebDesktopNotificationsDelegate **result) { return E_NOTIMPL; }

+

 private:

     WebInspectorDelegate();

 

diff --git a/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp b/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp
new file mode 100644
index 0000000..aef313b
--- /dev/null
+++ b/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "WebPluginHalterClient.h"
+
+#include "DOMCoreClasses.h"
+#include "WebView.h"
+#include <WebCore/Node.h>
+#include <wtf/Assertions.h>
+
+using WebCore::Node;
+
+WebPluginHalterClient::WebPluginHalterClient(WebView* webView)
+    : m_webView(webView)
+{
+    ASSERT_ARG(webView, webView);
+}
+
+bool WebPluginHalterClient::shouldHaltPlugin(WebCore::Node* n) const
+{
+    ASSERT_ARG(n, n);
+
+    IWebPluginHalterDelegate* d;
+    if (FAILED(m_webView->pluginHalterDelegate(&d)) || !d)
+        return false;
+
+    COMPtr<IDOMNode> domNode(AdoptCOM, DOMNode::createInstance(n));
+
+    BOOL shouldHalt;
+    if (FAILED(d->shouldHaltPlugin(m_webView, domNode.get(), &shouldHalt)))
+        return false;
+
+    return shouldHalt;
+}
diff --git a/WebKit/win/WebCoreSupport/WebPluginHalterClient.h b/WebKit/win/WebCoreSupport/WebPluginHalterClient.h
new file mode 100644
index 0000000..1752444
--- /dev/null
+++ b/WebKit/win/WebCoreSupport/WebPluginHalterClient.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebPluginHalterClient_h
+#define WebPluginHalterClient_h
+
+#include <WebCore/PluginHalterClient.h>
+
+namespace WebCore {
+    class Node;
+}
+
+class WebView;
+
+class WebPluginHalterClient : public WebCore::PluginHalterClient {
+public:
+    WebPluginHalterClient(WebView* webView);
+
+    virtual bool shouldHaltPlugin(WebCore::Node* n) const;
+
+private:
+    WebView* m_webView;
+};
+
+#endif // WebPluginHalterClient_h
diff --git a/WebKit/win/WebDatabaseManager.cpp b/WebKit/win/WebDatabaseManager.cpp
index 969bde7..a531997 100644
--- a/WebKit/win/WebDatabaseManager.cpp
+++ b/WebKit/win/WebDatabaseManager.cpp
@@ -286,7 +286,7 @@ HRESULT STDMETHODCALLTYPE WebDatabaseManager::deleteAllDatabases()
 
     return S_OK;
 }
-   
+
 HRESULT STDMETHODCALLTYPE WebDatabaseManager::deleteOrigin( 
     /* [in] */ IWebSecurityOrigin* origin)
 {
@@ -336,6 +336,21 @@ void WebDatabaseManager::dispatchDidModifyOrigin(SecurityOrigin* origin)
     notifyCenter->postNotificationName(databaseDidModifyOriginName, securityOrigin.get(), 0);
 }
 
+HRESULT STDMETHODCALLTYPE WebDatabaseManager::setQuota(
+    /* [in] */ BSTR origin,
+    /* [in] */ unsigned long long quota)
+{
+    if (!origin)
+        return E_POINTER;
+
+    if (this != s_sharedWebDatabaseManager)
+        return E_FAIL;
+
+    DatabaseTracker::tracker().setQuota(SecurityOrigin::createFromString(origin).get(), quota);
+
+    return S_OK;
+}
+
 void WebDatabaseManager::dispatchDidModifyDatabase(SecurityOrigin* origin, const String& databaseName)
 {
     static BSTR databaseDidModifyOriginName = SysAllocString(WebDatabaseDidModifyDatabaseNotification);
diff --git a/WebKit/win/WebDatabaseManager.h b/WebKit/win/WebDatabaseManager.h
index f7084ba..c932986 100644
--- a/WebKit/win/WebDatabaseManager.h
+++ b/WebKit/win/WebDatabaseManager.h
@@ -73,6 +73,10 @@ public:
         /* [in] */ BSTR databaseName,
         /* [in] */ IWebSecurityOrigin* origin);
 
+    virtual HRESULT STDMETHODCALLTYPE setQuota(
+        /* [in] */ BSTR origin,
+        /* [in] */ unsigned long long quota);
+
     // DatabaseTrackerClient
     virtual void dispatchDidModifyOrigin(WebCore::SecurityOrigin*);
     virtual void dispatchDidModifyDatabase(WebCore::SecurityOrigin*, const WebCore::String& databaseName);
diff --git a/WebKit/win/WebDownloadCFNet.cpp b/WebKit/win/WebDownloadCFNet.cpp
index 0df738e..144a6a5 100644
--- a/WebKit/win/WebDownloadCFNet.cpp
+++ b/WebKit/win/WebDownloadCFNet.cpp
@@ -47,6 +47,7 @@
 #pragma warning(push, 0)
 #include <WebCore/AuthenticationCF.h>
 #include <WebCore/BString.h>
+#include <WebCore/CredentialStorage.h>
 #include <WebCore/ResourceError.h>
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/ResourceRequest.h>
@@ -193,7 +194,7 @@ HRESULT STDMETHODCALLTYPE WebDownload::initToResumeWithBundle(
     // Attempt to remove the ".download" extension from the bundle for the final file destination
     // Failing that, we clear m_destination and will ask the delegate later once the download starts
     if (m_bundlePath.endsWith(bundleExtension(), false)) {
-        m_destination = m_bundlePath.copy();
+        m_destination = m_bundlePath.threadsafeCopy();
         m_destination.truncate(m_destination.length() - bundleExtension().length());
     } else
         m_destination = String();
@@ -381,9 +382,10 @@ void WebDownload::didReceiveAuthenticationChallenge(CFURLAuthChallengeRef challe
 {
     // Try previously stored credential first.
     if (!CFURLAuthChallengeGetPreviousFailureCount(challenge)) {
-        CFURLCredentialRef credential = WebCoreCredentialStorage::get(CFURLAuthChallengeGetProtectionSpace(challenge));
-        if (credential) {
-            CFURLDownloadUseCredential(m_download.get(), credential, challenge);
+        Credential credential = CredentialStorage::get(core(CFURLAuthChallengeGetProtectionSpace(challenge)));
+        if (!credential.isEmpty()) {
+            RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
+            CFURLDownloadUseCredential(m_download.get(), cfCredential.get(), challenge);
             return;
         }
     }
diff --git a/WebKit/win/WebError.cpp b/WebKit/win/WebError.cpp
index 8514fd6..c9f1dff 100644
--- a/WebKit/win/WebError.cpp
+++ b/WebKit/win/WebError.cpp
@@ -137,7 +137,7 @@ HRESULT STDMETHODCALLTYPE WebError::localizedDescription(
 
     *result = BString(m_error.localizedDescription()).release();
 
-#if PLATFORM(CFNETWORK)
+#if USE(CFNETWORK)
     if (!*result) {
         if (int code = m_error.errorCode())
             *result = BString(wkCFNetworkErrorGetLocalizedDescription(code)).release();
diff --git a/WebKit/win/WebFrame.cpp b/WebKit/win/WebFrame.cpp
index e50a830..6bdf51e 100644
--- a/WebKit/win/WebFrame.cpp
+++ b/WebKit/win/WebFrame.cpp
@@ -94,6 +94,7 @@
 #include <WebCore/TextIterator.h>
 #include <WebCore/JSDOMBinding.h>
 #include <WebCore/ScriptController.h>
+#include <WebCore/SecurityOrigin.h>
 #include <JavaScriptCore/APICast.h>
 #include <wtf/MathExtras.h>
 #pragma warning(pop)
@@ -304,6 +305,16 @@ HRESULT STDMETHODCALLTYPE WebFrame::setExcludeFromTextSearch(
     return E_FAIL;
 }
 
+HRESULT WebFrame::reloadFromOrigin()
+{
+    Frame* coreFrame = core(this);
+    if (!coreFrame)
+        return E_FAIL;
+
+    coreFrame->loader()->reload(true);
+    return S_OK;
+}
+
 HRESULT STDMETHODCALLTYPE WebFrame::paintDocumentRectToContext(
     /* [in] */ RECT rect,
     /* [in] */ OLE_HANDLE deviceContext)
@@ -1138,6 +1149,21 @@ HRESULT WebFrame::isDisplayingStandaloneImage(BOOL* result)
     return S_OK;
 }
 
+HRESULT WebFrame::allowsFollowingLink(BSTR url, BOOL* result)
+{
+    if (!result)
+        return E_POINTER;
+
+    *result = TRUE;
+
+    Frame* frame = core(this);
+    if (!frame)
+        return E_FAIL;
+
+    *result = SecurityOrigin::canLoad(MarshallingHelpers::BSTRToKURL(url), String(), frame->document());
+    return S_OK;
+}
+
 HRESULT WebFrame::controlsInForm(IDOMElement* form, IDOMElement** controls, int* cControls)
 {
     if (!form)
@@ -1315,7 +1341,7 @@ void WebFrame::dispatchWillSubmitForm(FramePolicyFunction function, PassRefPtr<F
     COMPtr<IWebFormDelegate> formDelegate;
 
     if (FAILED(d->webView->formDelegate(&formDelegate))) {
-        (coreFrame->loader()->*function)(PolicyUse);
+        (coreFrame->loader()->policyChecker()->*function)(PolicyUse);
         return;
     }
 
@@ -1334,7 +1360,7 @@ void WebFrame::dispatchWillSubmitForm(FramePolicyFunction function, PassRefPtr<F
         return;
 
     // FIXME: Add a sane default implementation
-    (coreFrame->loader()->*function)(PolicyUse);
+    (coreFrame->loader()->policyChecker()->*function)(PolicyUse);
 }
 
 void WebFrame::revertToProvisionalState(DocumentLoader*)
@@ -1500,7 +1526,7 @@ void WebFrame::receivedPolicyDecision(PolicyAction action)
     Frame* coreFrame = core(this);
     ASSERT(coreFrame);
 
-    (coreFrame->loader()->*function)(action);
+    (coreFrame->loader()->policyChecker()->*function)(action);
 }
 
 void WebFrame::dispatchDecidePolicyForMIMEType(FramePolicyFunction function, const String& mimeType, const ResourceRequest& request)
@@ -1517,7 +1543,7 @@ void WebFrame::dispatchDecidePolicyForMIMEType(FramePolicyFunction function, con
     if (SUCCEEDED(policyDelegate->decidePolicyForMIMEType(d->webView, BString(mimeType), urlRequest.get(), this, setUpPolicyListener(function).get())))
         return;
 
-    (coreFrame->loader()->*function)(PolicyUse);
+    (coreFrame->loader()->policyChecker()->*function)(PolicyUse);
 }
 
 void WebFrame::dispatchDecidePolicyForNewWindowAction(FramePolicyFunction function, const NavigationAction& action, const ResourceRequest& request, PassRefPtr<FormState> formState, const String& frameName)
@@ -1535,7 +1561,7 @@ void WebFrame::dispatchDecidePolicyForNewWindowAction(FramePolicyFunction functi
     if (SUCCEEDED(policyDelegate->decidePolicyForNewWindowAction(d->webView, actionInformation.get(), urlRequest.get(), BString(frameName), setUpPolicyListener(function).get())))
         return;
 
-    (coreFrame->loader()->*function)(PolicyUse);
+    (coreFrame->loader()->policyChecker()->*function)(PolicyUse);
 }
 
 void WebFrame::dispatchDecidePolicyForNavigationAction(FramePolicyFunction function, const NavigationAction& action, const ResourceRequest& request, PassRefPtr<FormState> formState)
@@ -1553,7 +1579,7 @@ void WebFrame::dispatchDecidePolicyForNavigationAction(FramePolicyFunction funct
     if (SUCCEEDED(policyDelegate->decidePolicyForNavigationAction(d->webView, actionInformation.get(), urlRequest.get(), this, setUpPolicyListener(function).get())))
         return;
 
-    (coreFrame->loader()->*function)(PolicyUse);
+    (coreFrame->loader()->policyChecker()->*function)(PolicyUse);
 }
 
 void WebFrame::dispatchUnableToImplementPolicy(const ResourceError& error)
diff --git a/WebKit/win/WebFrame.h b/WebKit/win/WebFrame.h
index 7af72d4..8edc81a 100644
--- a/WebKit/win/WebFrame.h
+++ b/WebKit/win/WebFrame.h
@@ -224,6 +224,8 @@ public:
     virtual HRESULT STDMETHODCALLTYPE setExcludeFromTextSearch(
         /* [in] */ BOOL flag);
 
+    virtual HRESULT STDMETHODCALLTYPE reloadFromOrigin();
+
     virtual HRESULT STDMETHODCALLTYPE paintDocumentRectToContext(
         /* [in] */ RECT rect,
         /* [in] */ OLE_HANDLE deviceContext);
@@ -238,6 +240,10 @@ public:
 
     virtual HRESULT STDMETHODCALLTYPE isDisplayingStandaloneImage(BOOL*);
 
+    virtual HRESULT STDMETHODCALLTYPE allowsFollowingLink(
+        /* [in] */ BSTR url,
+        /* [retval][out] */ BOOL* result);
+
     // IWebDocumentText
     virtual HRESULT STDMETHODCALLTYPE supportsTextEncoding( 
         /* [retval][out] */ BOOL* result);
diff --git a/WebKit/win/WebHistory.cpp b/WebKit/win/WebHistory.cpp
index 095a74b..854031a 100644
--- a/WebKit/win/WebHistory.cpp
+++ b/WebKit/win/WebHistory.cpp
@@ -855,18 +855,33 @@ HRESULT WebHistory::removeItemFromDateCaches(IWebHistoryItem* entry)
     return hr;
 }
 
-WebHistory::DateKey timeIntervalForBeginningOfDay(CFAbsoluteTime day)
+static void getDayBoundaries(CFAbsoluteTime day, CFAbsoluteTime& beginningOfDay, CFAbsoluteTime& beginningOfNextDay)
 {
     RetainPtr<CFTimeZoneRef> timeZone(AdoptCF, CFTimeZoneCopyDefault());
     CFGregorianDate date = CFAbsoluteTimeGetGregorianDate(day, timeZone.get());
     date.hour = 0;
     date.minute = 0;
     date.second = 0;
-    CFAbsoluteTime result = CFGregorianDateGetAbsoluteTime(date, timeZone.get());
+    beginningOfDay = CFGregorianDateGetAbsoluteTime(date, timeZone.get());
+    date.day += 1;
+    beginningOfNextDay = CFGregorianDateGetAbsoluteTime(date, timeZone.get());
+}
 
-    // Converting from double to int64_t is safe here as NSDate's useful range
-    // is -2**48 .. 2**47 which will safely fit in an int64_t.
-    return static_cast<WebHistory::DateKey>(result);
+static inline CFAbsoluteTime beginningOfDay(CFAbsoluteTime date)
+{
+    static CFAbsoluteTime cachedBeginningOfDay = numeric_limits<CFAbsoluteTime>::quiet_NaN();
+    static CFAbsoluteTime cachedBeginningOfNextDay;
+    if (!(date >= cachedBeginningOfDay && date < cachedBeginningOfNextDay))
+        getDayBoundaries(date, cachedBeginningOfDay, cachedBeginningOfNextDay);
+    return cachedBeginningOfDay;
+}
+
+static inline WebHistory::DateKey dateKey(CFAbsoluteTime date)
+{
+    // Converting from double (CFAbsoluteTime) to int64_t (WebHistoryDateKey) is
+    // safe here because all sensible dates are in the range -2**48 .. 2**47 which
+    // safely fits in an int64_t.
+    return beginningOfDay(date);
 }
 
 // Returns whether the day is already in the list of days,
@@ -875,7 +890,7 @@ bool WebHistory::findKey(DateKey* key, CFAbsoluteTime forDay)
 {
     ASSERT_ARG(key, key);
 
-    *key = timeIntervalForBeginningOfDay(forDay);
+    *key = dateKey(forDay);
     return m_entriesByDate.contains(*key);
 }
 
diff --git a/WebKit/win/WebIconDatabase.cpp b/WebKit/win/WebIconDatabase.cpp
index 8aab6af..315db9e 100644
--- a/WebKit/win/WebIconDatabase.cpp
+++ b/WebKit/win/WebIconDatabase.cpp
@@ -311,7 +311,7 @@ void WebIconDatabase::dispatchDidRemoveAllIcons()
 void WebIconDatabase::dispatchDidAddIconForPageURL(const String& pageURL)
 {   
     MutexLocker locker(m_notificationMutex);
-    m_notificationQueue.append(pageURL.copy());
+    m_notificationQueue.append(pageURL.threadsafeCopy());
     scheduleNotificationDelivery();
 }
 
diff --git a/WebKit/win/WebInspector.cpp b/WebKit/win/WebInspector.cpp
index 1ddbdd8..97587f9 100644
--- a/WebKit/win/WebInspector.cpp
+++ b/WebKit/win/WebInspector.cpp
@@ -72,6 +72,8 @@ HRESULT STDMETHODCALLTYPE WebInspector::QueryInterface(REFIID riid, void** ppvOb
     *ppvObject = 0;
     if (IsEqualGUID(riid, IID_IWebInspector))
         *ppvObject = static_cast<IWebInspector*>(this);
+    else if (IsEqualGUID(riid, IID_IWebInspectorPrivate))
+        *ppvObject = static_cast<IWebInspectorPrivate*>(this);
     else if (IsEqualGUID(riid, IID_IUnknown))
         *ppvObject = static_cast<IWebInspector*>(this);
     else
@@ -256,3 +258,17 @@ HRESULT STDMETHODCALLTYPE WebInspector::setJavaScriptProfilingEnabled(BOOL enabl
 
     return S_OK;
 }
+
+HRESULT STDMETHODCALLTYPE  WebInspector::evaluateInFrontend(ULONG callId, BSTR bScript)
+{
+    if (!m_webView)
+        return S_OK;
+
+    Page* page = m_webView->page();
+    if (!page)
+        return S_OK;
+
+    String script(bScript, SysStringLen(bScript));
+    page->inspectorController()->evaluateForTestInFrontend(callId, script);
+    return S_OK;
+}
diff --git a/WebKit/win/WebInspector.h b/WebKit/win/WebInspector.h
index 5303a61..4f9bedb 100644
--- a/WebKit/win/WebInspector.h
+++ b/WebKit/win/WebInspector.h
@@ -34,7 +34,7 @@
 
 class WebView;
 
-class WebInspector : public IWebInspector, public Noncopyable {
+class WebInspector : public IWebInspector, public IWebInspectorPrivate, public Noncopyable {
 public:
     static WebInspector* createInstance(WebView*);
 
@@ -59,6 +59,8 @@ public:
 
     virtual HRESULT STDMETHODCALLTYPE isJavaScriptProfilingEnabled(BOOL* isProfilingEnabled);
     virtual HRESULT STDMETHODCALLTYPE setJavaScriptProfilingEnabled(BOOL);
+    
+    virtual HRESULT STDMETHODCALLTYPE evaluateInFrontend(ULONG callId, BSTR script);
 
 private:
     WebInspector(WebView*);
diff --git a/WebKit/win/WebKit.vcproj/Interfaces.vcproj b/WebKit/win/WebKit.vcproj/Interfaces.vcproj
index fe2a470..cbc8231 100644
--- a/WebKit/win/WebKit.vcproj/Interfaces.vcproj
+++ b/WebKit/win/WebKit.vcproj/Interfaces.vcproj
@@ -24,7 +24,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\obj\WebKit\$(ProjectName)&quot;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\obj\WebKit\$(ProjectName)&quot;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -79,7 +79,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;perl FixMIDLHeaders.pl &quot;$(WebkitOutputDir)/include/webkit/&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;perl FixMIDLHeaders.pl &quot;$(WebkitOutputDir)/include/webkit/&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -92,7 +92,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\obj\WebKit\$(ProjectName)&quot;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\obj\WebKit\$(ProjectName)&quot;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -144,7 +144,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;perl FixMIDLHeaders.pl &quot;$(WebkitOutputDir)/include/webkit/&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;perl FixMIDLHeaders.pl &quot;$(WebkitOutputDir)/include/webkit/&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -492,6 +492,18 @@
 			</FileConfiguration>

 		</File>

 		<File

+			RelativePath="..\Interfaces\IWebDesktopNotificationsDelegate.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

 			RelativePath="..\Interfaces\IWebDocument.idl"

 			>

 			<FileConfiguration

@@ -692,6 +704,26 @@
 			</FileConfiguration>

 		</File>

 		<File

+			RelativePath="..\Interfaces\IWebFrameLoadDelegatePrivate2.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

 			RelativePath="..\Interfaces\IWebFramePrivate.idl"

 			>

 			<FileConfiguration

@@ -912,6 +944,26 @@
 			</FileConfiguration>

 		</File>

 		<File

+			RelativePath="..\Interfaces\IWebInspectorPrivate.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

 			RelativePath="..\Interfaces\IWebJavaScriptCollector.idl"

 			>

 			<FileConfiguration

@@ -1052,6 +1104,26 @@
 			</FileConfiguration>

 		</File>

 		<File

+			RelativePath="..\Interfaces\IWebPluginHalterDelegate.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

 			RelativePath="..\Interfaces\IWebPolicyDelegate.idl"

 			>

 			<FileConfiguration

@@ -1072,6 +1144,26 @@
 			</FileConfiguration>

 		</File>

 		<File

+			RelativePath="..\Interfaces\IWebPolicyDelegatePrivate.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

 			RelativePath="..\Interfaces\IWebPreferences.idl"

 			>

 			<FileConfiguration

@@ -1472,6 +1564,26 @@
 			</FileConfiguration>

 		</File>

 		<File

+			RelativePath="..\Interfaces\IWebWorkersPrivate.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

 			RelativePath="..\Interfaces\WebKit.idl"

 			>

 			<FileConfiguration

diff --git a/WebKit/win/WebKit.vcproj/InterfacesGenerated.vcproj b/WebKit/win/WebKit.vcproj/InterfacesGenerated.vcproj
index 3eb83df..f6cc1d4 100644
--- a/WebKit/win/WebKit.vcproj/InterfacesGenerated.vcproj
+++ b/WebKit/win/WebKit.vcproj/InterfacesGenerated.vcproj
@@ -1,48 +1,48 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="InterfacesGenerated"
-	ProjectGUID="{62C897BE-E207-4BC4-B37D-6F9F9116F166}"
-	Keyword="MakeFileProj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory="$(WebKitOutputDir)\lib"
-			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"
-			ConfigurationType="0"
-			>
-			<Tool
-				Name="VCNMakeTool"
-				BuildCommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;&#x0D;&#x0A;set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-				CleanCommandLine="del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-				Output=""
-				PreprocessorDefinitions=""
-				IncludeSearchPath=""
-				ForcedIncludes=""
-				AssemblySearchPath=""
-				ForcedUsingAssemblies=""
-				CompileAsManaged=""
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<File
-			RelativePath=".\build-generated-files.sh"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="InterfacesGenerated"

+	ProjectGUID="{62C897BE-E207-4BC4-B37D-6F9F9116F166}"

+	Keyword="MakeFileProj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Release|Win32"

+			OutputDirectory="$(WebKitOutputDir)\lib"

+			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

+			ConfigurationType="0"

+			>

+			<Tool

+				Name="VCNMakeTool"

+				BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CleanCommandLine="del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				Output=""

+				PreprocessorDefinitions=""

+				IncludeSearchPath=""

+				ForcedIncludes=""

+				AssemblySearchPath=""

+				ForcedUsingAssemblies=""

+				CompileAsManaged=""

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<File

+			RelativePath=".\build-generated-files.sh"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/WebKit/win/WebKit.vcproj/WebKit.rc b/WebKit/win/WebKit.vcproj/WebKit.rc
index 1c4e4f5..a7cbfd3 100644
--- a/WebKit/win/WebKit.vcproj/WebKit.rc
+++ b/WebKit/win/WebKit.vcproj/WebKit.rc
@@ -22,8 +22,8 @@ IDR_WEBKIT              TYPELIB                 "WebKit.tlb"
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION __VERSION_MAJOR__,__BUILD_NUMBER_MAJOR__,__BUILD_NUMBER_MINOR__,__BUILD_NUMBER_VARIANT__
- PRODUCTVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,0
+ FILEVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,__VERSION_BUILD__
+ PRODUCTVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,__VERSION_BUILD__
  FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -44,7 +44,7 @@ BEGIN
             VALUE "InternalName", "WebKit"
             VALUE "LegalCopyright", "Copyright Apple Inc. 2003-2009"
             VALUE "OriginalFilename", "WebKit.dll"
-            VALUE "ProductName", " WebKit"
+            VALUE "ProductName", "WebKit"
             VALUE "ProductVersion", __BUILD_NUMBER_SHORT__
         END
     END
diff --git a/WebKit/win/WebKit.vcproj/WebKit.sln b/WebKit/win/WebKit.vcproj/WebKit.sln
index 3babb13..79dff87 100644
--- a/WebKit/win/WebKit.vcproj/WebKit.sln
+++ b/WebKit/win/WebKit.vcproj/WebKit.sln
@@ -144,8 +144,8 @@ Global
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_Cairo|Win32.Build.0 = Release_Cairo|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.ActiveCfg = Release|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.Build.0 = Release|Win32

-		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

-		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Cairo|Win32.Build.0 = Debug|Win32

+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Cairo|Win32.Build.0 = Debug_Cairo|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug|Win32.ActiveCfg = Debug|Win32

@@ -164,8 +164,8 @@ Global
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo|Win32.Build.0 = Release_CFLite|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32

-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo|Win32.Build.0 = Debug|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo|Win32.Build.0 = Debug_CFLite|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32

@@ -242,8 +242,8 @@ Global
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_Cairo|Win32.ActiveCfg = Release|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.ActiveCfg = Release|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.Build.0 = Release|Win32

-		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

-		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Cairo|Win32.Build.0 = Debug|Win32

+		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

+		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Cairo|Win32.Build.0 = Debug_Cairo|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Internal|Win32.ActiveCfg = Debug|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Internal|Win32.Build.0 = Debug|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug|Win32.ActiveCfg = Debug|Win32

@@ -252,14 +252,14 @@ Global
 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release|Win32.ActiveCfg = Release|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release|Win32.Build.0 = Release|Win32

-		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

-		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_Cairo|Win32.Build.0 = Debug|Win32

+		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

+		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_Cairo|Win32.Build.0 = Debug_CFLite|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug|Win32.ActiveCfg = Debug|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug|Win32.Build.0 = Debug|Win32

-		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release_Cairo|Win32.ActiveCfg = Release|Win32

-		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release_Cairo|Win32.Build.0 = Release|Win32

+		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release_Cairo|Win32.ActiveCfg = Release_CFLite|Win32

+		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release_Cairo|Win32.Build.0 = Release_CFLite|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release|Win32.ActiveCfg = Release|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release|Win32.Build.0 = Release|Win32

 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug_Cairo|Win32.ActiveCfg = Release|Win32

diff --git a/WebKit/win/WebKit.vcproj/WebKit.vcproj b/WebKit/win/WebKit.vcproj/WebKit.vcproj
index 9a70440..021dc94 100644
--- a/WebKit/win/WebKit.vcproj/WebKit.vcproj
+++ b/WebKit/win/WebKit.vcproj/WebKit.vcproj
@@ -23,7 +23,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -40,11 +40,11 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

-				ForcedIncludeFiles="WebKitPrefix.h"

 				DisableSpecificWarnings="4819"

+				ForcedIncludeFiles="WebKitPrefix.h"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -59,7 +59,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib JavaScriptCore$(WebKitDLLConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib WebKitSystemInterface$(WebKitConfigSuffix).lib msimg32.lib QTMovieWin$(WebKitConfigSuffix).lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib"

+				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib JavaScriptCore$(WebKitDLLConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib WebKitSystemInterface$(WebKitConfigSuffix).lib msimg32.lib QTMovieWin$(WebKitConfigSuffix).lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib comsuppw.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

 				AdditionalLibraryDirectories=""

 				ModuleDefinitionFile="WebKit$(WebKitDLLConfigSuffix).def"

@@ -88,7 +88,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebPreferenceKeysPrivate.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -100,7 +100,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -117,11 +117,11 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

-				ForcedIncludeFiles="WebKitPrefix.h"

 				DisableSpecificWarnings="4819"

+				ForcedIncludeFiles="WebKitPrefix.h"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -136,7 +136,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib JavaScriptCore$(WebKitDLLConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib WebKitSystemInterface$(WebKitConfigSuffix).lib msimg32.lib QTMovieWin$(WebKitConfigSuffix).lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib"

+				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib JavaScriptCore$(WebKitDLLConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib WebKitSystemInterface$(WebKitConfigSuffix).lib msimg32.lib QTMovieWin$(WebKitConfigSuffix).lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib comsuppw.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

 				AdditionalLibraryDirectories=""

 				ModuleDefinitionFile="WebKit$(WebKitDLLConfigSuffix).def"

@@ -165,7 +165,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebPreferenceKeysPrivate.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -176,7 +176,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -193,12 +193,12 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

 				Detect64BitPortabilityProblems="false"

-				ForcedIncludeFiles="WebKitPrefix.h"

 				DisableSpecificWarnings="4819"

+				ForcedIncludeFiles="WebKitPrefix.h"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -213,7 +213,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib JavaScriptCore$(WebKitDLLConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib WebKitSystemInterface$(WebKitConfigSuffix).lib msimg32.lib QTMovieWin$(WebKitConfigSuffix).lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib"

+				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib JavaScriptCore$(WebKitDLLConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib WebKitSystemInterface$(WebKitConfigSuffix).lib msimg32.lib QTMovieWin$(WebKitConfigSuffix).lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib comsuppw.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

 				AdditionalLibraryDirectories=""

 				ModuleDefinitionFile="WebKit$(WebKitDLLConfigSuffix).def"

@@ -242,7 +242,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebPreferenceKeysPrivate.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -250,12 +250,12 @@
 			OutputDirectory="$(WebKitOutputDir)\bin"

 			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

 			ConfigurationType="2"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\WinCairo.vsprops;$(WebKitLibrariesDir)\tools\vsprops\cURL.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_wincairo.vsprops;$(WebKitLibrariesDir)\tools\vsprops\WinCairo.vsprops;$(WebKitLibrariesDir)\tools\vsprops\cURL.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -272,11 +272,11 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

-				ForcedIncludeFiles="WebKitPrefix.h"

 				DisableSpecificWarnings="4819"

+				ForcedIncludeFiles="WebKitPrefix.h"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -291,7 +291,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CFLite_Debug.lib JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib msimg32.lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib"

+				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CFLite_Debug.lib JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib msimg32.lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib comsuppw.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

 				AdditionalLibraryDirectories=""

 				ModuleDefinitionFile="WebKit_Cairo$(WebKitDLLConfigSuffix).def"

@@ -321,7 +321,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebPreferenceKeysPrivate.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -335,7 +335,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -352,11 +352,11 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

-				ForcedIncludeFiles="WebKitPrefix.h"

 				DisableSpecificWarnings="4819"

+				ForcedIncludeFiles="WebKitPrefix.h"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -371,7 +371,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CFLite.lib JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib msimg32.lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib"

+				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CFLite.lib JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib msimg32.lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib comsuppw.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

 				AdditionalLibraryDirectories=""

 				ModuleDefinitionFile="WebKit_Cairo$(WebKitDLLConfigSuffix).def"

@@ -400,7 +400,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebPreferenceKeysPrivate.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -743,6 +743,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\WebWorkersPrivate.h"

+				>

+			</File>

+			<File

 				RelativePath="..\WindowsTouch.h"

 				>

 			</File>

@@ -1094,6 +1098,10 @@
 				RelativePath="..\WebView.cpp"

 				>

 			</File>

+			<File

+				RelativePath="..\WebWorkersPrivate.cpp"

+				>

+			</File>

 		</Filter>

 		<Filter

 			Name="Resources"

@@ -1470,10 +1478,6 @@
 					>

 				</File>

 				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMEventListener.cpp"

-					>

-				</File>

-				<File

 					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMEventListener.h"

 					>

 				</File>

@@ -2063,6 +2067,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\WebCoreSupport\WebDesktopNotificationsDelegate.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\WebCoreSupport\WebDesktopNotificationsDelegate.h"

+				>

+			</File>

+			<File

 				RelativePath="..\WebCoreSupport\WebDragClient.cpp"

 				>

 			</File>

@@ -2106,6 +2118,14 @@
 				RelativePath="..\WebCoreSupport\WebInspectorDelegate.h"

 				>

 			</File>

+			<File

+				RelativePath="..\WebCoreSupport\WebPluginHalterClient.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\WebCoreSupport\WebPluginHalterClient.h"

+				>

+			</File>

 		</Filter>

 		<File

 			RelativePath="..\WebKitPrefix.cpp"

diff --git a/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj b/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj
index 8e5af7e..309a021 100644
--- a/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj
+++ b/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj
@@ -24,7 +24,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -85,7 +85,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -145,7 +145,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

diff --git a/WebKit/win/WebKitClassFactory.cpp b/WebKit/win/WebKitClassFactory.cpp
index ab3c406..d1c4b72 100644
--- a/WebKit/win/WebKitClassFactory.cpp
+++ b/WebKit/win/WebKitClassFactory.cpp
@@ -52,6 +52,7 @@
 #include "WebURLProtectionSpace.h"
 #include "WebURLResponse.h"
 #include "WebView.h"
+#include "WebWorkersPrivate.h"
 #pragma warning(push, 0)
 #include <JavaScriptCore/InitializeThreading.h>
 #include <WebCore/FontDatabase.h>
diff --git a/WebKit/win/WebMutableURLRequest.cpp b/WebKit/win/WebMutableURLRequest.cpp
index e529993..69555c8 100644
--- a/WebKit/win/WebMutableURLRequest.cpp
+++ b/WebKit/win/WebMutableURLRequest.cpp
@@ -308,7 +308,7 @@ HRESULT STDMETHODCALLTYPE WebMutableURLRequest::setHTTPMethod(
 HRESULT STDMETHODCALLTYPE WebMutableURLRequest::setHTTPShouldHandleCookies( 
     /* [in] */ BOOL handleCookies)
 {
-    m_request.setAllowHTTPCookies(handleCookies);
+    m_request.setAllowCookies(handleCookies);
     return S_OK;
 }
 
diff --git a/WebKit/win/WebPreferenceKeysPrivate.h b/WebKit/win/WebPreferenceKeysPrivate.h
index d9bb5c3..e0c2b6f 100644
--- a/WebKit/win/WebPreferenceKeysPrivate.h
+++ b/WebKit/win/WebPreferenceKeysPrivate.h
@@ -53,6 +53,8 @@
 #define WebKitPluginsEnabledPreferenceKey "WebKitPluginsEnabled"
 #define WebKitDatabasesEnabledPreferenceKey "WebKitDatabasesEnabled"
 #define WebKitLocalStorageEnabledPreferenceKey "WebKitLocalStorageEnabled"
+#define WebKitExperimentalNotificationsEnabledPreferenceKey "WebKitExperimentalNotificationsEnabled"
+#define WebKitExperimentalWebSocketsEnabledPreferenceKey "WebKitExperimentalWebSocketsEnabled"
 #define WebKitAllowAnimatedImagesPreferenceKey "WebKitAllowAnimatedImagesPreferenceKey"
 #define WebKitAllowAnimatedImageLoopingPreferenceKey "WebKitAllowAnimatedImageLoopingPreferenceKey"
 #define WebKitDisplayImagesKey "WebKitDisplayImagesKey"
@@ -125,3 +127,8 @@
 
 #define WebKitXSSAuditorEnabledPreferenceKey "WebKitXSSAuditorEnabled"
 
+#define WebKitUseHighResolutionTimersPreferenceKey "WebKitUseHighResolutionTimers"
+
+#define WebKitPluginHalterEnabledPreferenceKey "WebKitPluginHalterEnabled"
+
+#define WebKitPluginAllowedRunTimePreferenceKey "WebKitPluginAllowedRunTime"
diff --git a/WebKit/win/WebPreferences.cpp b/WebKit/win/WebPreferences.cpp
index 8ea0319..e37177e 100644
--- a/WebKit/win/WebPreferences.cpp
+++ b/WebKit/win/WebPreferences.cpp
@@ -42,6 +42,7 @@
 #pragma warning( pop )
 
 #include <CoreFoundation/CoreFoundation.h>
+#include <limits>
 #include <shlobj.h>
 #include <shfolder.h>
 #include <tchar.h>
@@ -54,6 +55,7 @@
 #endif
 
 using namespace WebCore;
+using std::numeric_limits;
 
 static const String& oldPreferencesPath()
 {
@@ -204,12 +206,14 @@ void WebPreferences::initializeDefaultSettings()
     CFDictionaryAddValue(defaults, CFSTR(WebKitJavaEnabledPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitJavaScriptEnabledPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitWebSecurityEnabledPreferenceKey), kCFBooleanTrue);
-    CFDictionaryAddValue(defaults, CFSTR(WebKitAllowUniversalAccessFromFileURLsPreferenceKey), kCFBooleanTrue);
+    CFDictionaryAddValue(defaults, CFSTR(WebKitAllowUniversalAccessFromFileURLsPreferenceKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitXSSAuditorEnabledPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitJavaScriptCanOpenWindowsAutomaticallyPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitPluginsEnabledPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitDatabasesEnabledPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitLocalStorageEnabledPreferenceKey), kCFBooleanTrue);
+    CFDictionaryAddValue(defaults, CFSTR(WebKitExperimentalNotificationsEnabledPreferenceKey), kCFBooleanFalse);
+    CFDictionaryAddValue(defaults, CFSTR(WebKitExperimentalWebSocketsEnabledPreferenceKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitAllowAnimatedImagesPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitAllowAnimatedImageLoopingPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitDisplayImagesKey), kCFBooleanTrue);
@@ -247,6 +251,13 @@ void WebPreferences::initializeDefaultSettings()
 
     CFDictionaryAddValue(defaults, CFSTR(WebKitPaintNativeControlsPreferenceKey), kCFBooleanTrue);
 
+    CFDictionaryAddValue(defaults, CFSTR(WebKitUseHighResolutionTimersPreferenceKey), kCFBooleanTrue);
+
+    CFDictionaryAddValue(defaults, CFSTR(WebKitPluginHalterEnabledPreferenceKey), kCFBooleanFalse);
+
+    RetainPtr<CFStringRef> pluginAllowedRunTime(AdoptCF, CFStringCreateWithFormat(0, 0, CFSTR("%u"), numeric_limits<unsigned>::max()));
+    CFDictionaryAddValue(defaults, CFSTR(WebKitPluginAllowedRunTimePreferenceKey), pluginAllowedRunTime.get());
+
     defaultSettings = defaults;
 }
 
@@ -1289,6 +1300,30 @@ HRESULT STDMETHODCALLTYPE WebPreferences::setLocalStorageDatabasePath(BSTR locat
     return S_OK;
 }
 
+HRESULT STDMETHODCALLTYPE WebPreferences::setExperimentalNotificationsEnabled(BOOL enabled)
+{
+    setBoolValue(CFSTR(WebKitExperimentalNotificationsEnabledPreferenceKey), enabled);
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE WebPreferences::experimentalNotificationsEnabled(BOOL* enabled)
+{
+    *enabled = boolValueForKey(CFSTR(WebKitExperimentalNotificationsEnabledPreferenceKey));
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE WebPreferences::setExperimentalWebSocketsEnabled(BOOL enabled)
+{
+    setBoolValue(CFSTR(WebKitExperimentalWebSocketsEnabledPreferenceKey), enabled);
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE WebPreferences::experimentalWebSocketsEnabled(BOOL* enabled)
+{
+    *enabled = boolValueForKey(CFSTR(WebKitExperimentalWebSocketsEnabledPreferenceKey));
+    return S_OK;
+}
+
 HRESULT WebPreferences::setZoomsTextOnly(BOOL zoomsTextOnly)
 {
     setBoolValue(CFSTR(WebKitZoomsTextOnlyPreferenceKey), zoomsTextOnly);
@@ -1301,6 +1336,54 @@ HRESULT WebPreferences::zoomsTextOnly(BOOL* zoomsTextOnly)
     return S_OK;
 }
 
+HRESULT STDMETHODCALLTYPE WebPreferences::setShouldUseHighResolutionTimers(BOOL useHighResolutionTimers)
+{
+    setBoolValue(CFSTR(WebKitUseHighResolutionTimersPreferenceKey), useHighResolutionTimers);
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE WebPreferences::shouldUseHighResolutionTimers(BOOL* useHighResolutionTimers)
+{
+    *useHighResolutionTimers = boolValueForKey(CFSTR(WebKitUseHighResolutionTimersPreferenceKey));
+    return S_OK;
+}
+
+
+HRESULT STDMETHODCALLTYPE WebPreferences::setPluginHalterEnabled(BOOL enabled)
+{
+    setBoolValue(CFSTR(WebKitPluginHalterEnabledPreferenceKey), enabled);
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE WebPreferences::pluginHalterEnabled(BOOL* enabled)
+{
+    *enabled = boolValueForKey(CFSTR(WebKitPluginHalterEnabledPreferenceKey));
+    return S_OK;
+}
+
+HRESULT WebPreferences::setPluginAllowedRunTime(UINT allowedRunTime)
+{
+    setIntegerValue(CFSTR(WebKitPluginAllowedRunTimePreferenceKey), allowedRunTime);
+    return S_OK;
+}
+
+HRESULT WebPreferences::pluginAllowedRunTime(UINT* allowedRunTime)
+{
+    *allowedRunTime = integerValueForKey(CFSTR(WebKitPluginAllowedRunTimePreferenceKey));
+    return S_OK;
+}
+
+HRESULT WebPreferences::setPreferenceForTest(BSTR key, BSTR value)
+{
+    if (!SysStringLen(key) || !SysStringLen(value))
+        return E_FAIL;
+    RetainPtr<CFStringRef> keyString(AdoptCF, CFStringCreateWithCharacters(0, reinterpret_cast<UniChar*>(key), SysStringLen(key)));
+    RetainPtr<CFStringRef> valueString(AdoptCF, CFStringCreateWithCharacters(0, reinterpret_cast<UniChar*>(value), SysStringLen(value)));
+    setValueForKey(keyString.get(), valueString.get());
+    postPreferencesChangesNotification();
+    return S_OK;
+}
+
 void WebPreferences::willAddToWebView()
 {
     ++m_numWebViews;
diff --git a/WebKit/win/WebPreferences.h b/WebKit/win/WebPreferences.h
index 2f94382..14035d0 100644
--- a/WebKit/win/WebPreferences.h
+++ b/WebKit/win/WebPreferences.h
@@ -325,7 +325,19 @@ public:
 
     virtual HRESULT STDMETHODCALLTYPE setLocalStorageDatabasePath(
         /* [in] */ BSTR location);
-    
+
+    virtual HRESULT STDMETHODCALLTYPE experimentalNotificationsEnabled(
+        /* [retval][out] */ BOOL *enabled);
+
+    virtual HRESULT STDMETHODCALLTYPE setExperimentalNotificationsEnabled(
+        /* [in] */ BOOL enabled);
+
+    virtual HRESULT STDMETHODCALLTYPE experimentalWebSocketsEnabled(
+        /* [retval][out] */ BOOL *enabled);
+
+    virtual HRESULT STDMETHODCALLTYPE setExperimentalWebSocketsEnabled(
+        /* [in] */ BOOL enabled);
+
     virtual HRESULT STDMETHODCALLTYPE setShouldPaintNativeControls( 
     /* [in] */ BOOL shouldPaint);
 
@@ -340,7 +352,7 @@ public:
 
     virtual HRESULT STDMETHODCALLTYPE fontSmoothingContrast( 
     /* [retval][out] */ float* contrast);
-    
+
     virtual HRESULT STDMETHODCALLTYPE setFontSmoothingContrast( 
     /* [in] */ float contrast);
 
@@ -362,6 +374,29 @@ public:
     virtual HRESULT STDMETHODCALLTYPE setXSSAuditorEnabled(
     /* [in] */ BOOL enabled);
 
+    virtual HRESULT STDMETHODCALLTYPE setShouldUseHighResolutionTimers(
+    /* [in] */ BOOL useHighResolutionTimers);
+
+    virtual HRESULT STDMETHODCALLTYPE shouldUseHighResolutionTimers(
+    /* [retval][out] */ BOOL* useHighResolutionTimers);
+
+    virtual HRESULT STDMETHODCALLTYPE setPluginHalterEnabled(
+    /* [in] */ BOOL enabled);
+
+    virtual HRESULT STDMETHODCALLTYPE pluginHalterEnabled(
+    /* [retval][out] */ BOOL* enabled);
+
+    virtual HRESULT STDMETHODCALLTYPE setPluginAllowedRunTime(
+    /* [in] */ UINT allowedRunTime);
+
+    virtual HRESULT STDMETHODCALLTYPE pluginAllowedRunTime(
+    /* [retval][out] */ UINT* allowedRunTime);
+
+    virtual HRESULT STDMETHODCALLTYPE setPreferenceForTest(
+    /* [in] */ BSTR key,
+    /* [in] */ BSTR value);
+
+
     // WebPreferences
 
     // This method accesses a different preference key than developerExtrasEnabled.
diff --git a/WebKit/win/WebURLResponse.cpp b/WebKit/win/WebURLResponse.cpp
index b1f4488..644e1d8 100644
--- a/WebKit/win/WebURLResponse.cpp
+++ b/WebKit/win/WebURLResponse.cpp
@@ -228,7 +228,7 @@ WebURLResponse* WebURLResponse::createInstance()
 {
     WebURLResponse* instance = new WebURLResponse();
     // fake an http response - so it has the IWebHTTPURLResponse interface
-    instance->m_response = ResourceResponse(KURL("http://"), String(), 0, String(), String());
+    instance->m_response = ResourceResponse(KURL(ParsedURLString, "http://"), String(), 0, String(), String());
     instance->AddRef();
     return instance;
 }
diff --git a/WebKit/win/WebView.cpp b/WebKit/win/WebView.cpp
index b51af67..85b2ac2 100644
--- a/WebKit/win/WebView.cpp
+++ b/WebKit/win/WebView.cpp
@@ -50,6 +50,7 @@
 #include "WebKitSystemBits.h"
 #include "WebMutableURLRequest.h"
 #include "WebNotificationCenter.h"
+#include "WebPluginHalterClient.h"
 #include "WebPreferences.h"
 #include "WindowsTouch.h"
 #pragma warning( push, 0 )
@@ -88,12 +89,14 @@
 #include <WebCore/MIMETypeRegistry.h>
 #include <WebCore/Page.h>
 #include <WebCore/PageCache.h>
+#include <WebCore/PageGroup.h>
 #include <WebCore/PlatformKeyboardEvent.h>
 #include <WebCore/PlatformMouseEvent.h>
 #include <WebCore/PlatformWheelEvent.h>
 #include <WebCore/PluginDatabase.h>
 #include <WebCore/PluginInfoStore.h>
 #include <WebCore/PluginView.h>
+#include <WebCore/PopupMenu.h>
 #include <WebCore/ProgressTracker.h>
 #include <WebCore/RenderTheme.h>
 #include <WebCore/RenderView.h>
@@ -128,6 +131,7 @@
 #endif
 
 #include <wtf/HashSet.h>
+#include <comutil.h>
 #include <dimm.h>
 #include <oleacc.h>
 #include <ShlObj.h>
@@ -145,9 +149,8 @@ SOFT_LINK_OPTIONAL(Uxtheme, EndPanningFeedback, BOOL, WINAPI, (HWND, BOOL));
 SOFT_LINK_OPTIONAL(Uxtheme, UpdatePanningFeedback, BOOL, WINAPI, (HWND, LONG, LONG, BOOL));
 
 using namespace WebCore;
+using namespace std;
 using JSC::JSLock;
-using std::min;
-using std::max;
 
 static HMODULE accessibilityLib;
 static HashSet<WebView*> pendingDeleteBackingStoreSet;
@@ -613,6 +616,8 @@ HRESULT STDMETHODCALLTYPE WebView::close()
 
     m_didClose = true;
 
+    WebNotificationCenter::defaultCenterInternal()->postNotificationName(_bstr_t(WebViewWillCloseNotification).GetBSTR(), static_cast<IWebView*>(this), 0);
+
     if (m_uiDelegatePrivate)
         m_uiDelegatePrivate->webViewClosing(this);
 
@@ -638,6 +643,7 @@ HRESULT STDMETHODCALLTYPE WebView::close()
     setResourceLoadDelegate(0);
     setUIDelegate(0);
     setFormDelegate(0);
+    setPluginHalterDelegate(0);
 
     if (m_webInspector)
         m_webInspector->webViewClosed();
@@ -719,6 +725,10 @@ bool WebView::ensureBackingStore()
 
 void WebView::addToDirtyRegion(const IntRect& dirtyRect)
 {
+    // FIXME: We want an assert here saying that the dirtyRect is inside the clienRect,
+    // but it was being hit during our layout tests, and is being investigated in
+    // http://webkit.org/b/29350.
+
     HRGN newRegion = ::CreateRectRgn(dirtyRect.x(), dirtyRect.y(),
                                      dirtyRect.right(), dirtyRect.bottom());
     addToDirtyRegion(newRegion);
@@ -930,19 +940,6 @@ void WebView::paint(HDC dc, LPARAM options)
 
     ::DeleteDC(bitmapDC);
 
-    // Paint the gripper.
-    COMPtr<IWebUIDelegate> ui;
-    if (SUCCEEDED(uiDelegate(&ui))) {
-        COMPtr<IWebUIDelegatePrivate> uiPrivate;
-        if (SUCCEEDED(ui->QueryInterface(IID_IWebUIDelegatePrivate, (void**)&uiPrivate))) {
-            RECT r;
-            if (SUCCEEDED(uiPrivate->webViewResizerRect(this, &r))) {
-                LOCAL_GDI_COUNTER(2, __FUNCTION__" webViewDrawResizer delegate call");
-                uiPrivate->webViewDrawResizer(this, hdc, (frameView->containsScrollbarsAvoidingResizer() ? true : false), &r);
-            }
-        }
-    }
-
     if (!dc)
         EndPaint(m_viewWindow, &ps);
 
@@ -958,6 +955,10 @@ void WebView::paintIntoBackingStore(FrameView* frameView, HDC bitmapDC, const In
 {
     LOCAL_GDI_COUNTER(0, __FUNCTION__);
 
+    // FIXME: We want an assert here saying that the dirtyRect is inside the clienRect,
+    // but it was being hit during our layout tests, and is being investigated in
+    // http://webkit.org/b/29350.
+
     RECT rect = dirtyRect;
 
 #if FLASH_BACKING_STORE_REDRAW
@@ -977,6 +978,11 @@ void WebView::paintIntoBackingStore(FrameView* frameView, HDC bitmapDC, const In
         gc.clearRect(dirtyRect);
     else
         FillRect(bitmapDC, &rect, (HBRUSH)GetStockObject(WHITE_BRUSH));
+
+    COMPtr<IWebUIDelegatePrivate2> uiPrivate(Query, m_uiDelegate);
+    if (uiPrivate)
+        uiPrivate->drawBackground(this, reinterpret_cast<OLE_HANDLE>(bitmapDC), &rect);
+
     if (frameView && frameView->frame() && frameView->frame()->contentRenderer()) {
         gc.clip(dirtyRect);
         frameView->paint(&gc, dirtyRect);
@@ -1270,12 +1276,6 @@ bool WebView::handleMouseEvent(UINT message, WPARAM wParam, LPARAM lParam)
                            abs(globalPrevPoint.y() - mouseEvent.pos().y()) < ::GetSystemMetrics(SM_CYDOUBLECLK);
     LONG messageTime = ::GetMessageTime();
 
-    if (inResizer(position)) {
-        if (m_uiDelegatePrivate)
-            m_uiDelegatePrivate->webViewSendResizeMessage(message, wParam, position);
-        return true;
-    }
-
     bool handled = false;
 
     if (message == WM_LBUTTONDOWN || message == WM_MBUTTONDOWN || message == WM_RBUTTONDOWN) {
@@ -1349,25 +1349,65 @@ bool WebView::gestureNotify(WPARAM wParam, LPARAM lParam)
     // If we don't have this function, we shouldn't be receiving this message
     ASSERT(SetGestureConfigPtr());
 
-    DWORD dwPanWant;
-    DWORD dwPanBlock;
-
-    // Translate gesture location to client to hit test on scrollbars
+    bool hitScrollbar = false;
     POINT gestureBeginPoint = {gn->ptsLocation.x, gn->ptsLocation.y};
-    IntPoint eventHandlerPoint = m_page->mainFrame()->view()->screenToContents(gestureBeginPoint);
+    HitTestRequest request(HitTestRequest::ReadOnly);
+    for (Frame* childFrame = m_page->mainFrame(); childFrame; childFrame = EventHandler::subframeForTargetNode(m_gestureTargetNode.get())) {
+        FrameView* frameView = childFrame->view();
+        if (!frameView)
+            break;
+        RenderView* renderView = childFrame->document()->renderView();
+        if (!renderView)
+            break;
+        RenderLayer* layer = renderView->layer();
+        if (!layer)
+            break;
+
+        HitTestResult result(frameView->screenToContents(gestureBeginPoint));
+        layer->hitTest(request, result);
+        m_gestureTargetNode = result.innerNode();
 
-    HitTestResult scrollbarTest = m_page->mainFrame()->eventHandler()->hitTestResultAtPoint(eventHandlerPoint, true, false, ShouldHitTestScrollbars);
+        if (!hitScrollbar)
+            hitScrollbar = result.scrollbar();
+    }
+
+    if (!hitScrollbar) {
+        // The hit testing above won't detect if we've hit the main frame's vertical scrollbar. Check that manually now.
+        RECT webViewRect;
+        GetWindowRect(m_viewWindow, &webViewRect);
+        hitScrollbar = view->verticalScrollbar() && (gestureBeginPoint.x > (webViewRect.right - view->verticalScrollbar()->theme()->scrollbarThickness()));  
+    }
 
-    if (eventHandlerPoint.x() > view->visibleWidth() || scrollbarTest.scrollbar()) {
-        // We are in the scrollbar, turn off panning, need to be able to drag the scrollbar
-        dwPanWant = GC_PAN  | GC_PAN_WITH_INERTIA | GC_PAN_WITH_GUTTER;
-        dwPanBlock = GC_PAN_WITH_SINGLE_FINGER_HORIZONTALLY | GC_PAN_WITH_SINGLE_FINGER_VERTICALLY;
+    bool canBeScrolled = false;
+    if (m_gestureTargetNode) {
+        for (RenderObject* renderer = m_gestureTargetNode->renderer(); renderer; renderer = renderer->parent()) {
+            if (renderer->isBox() && toRenderBox(renderer)->canBeScrolledAndHasScrollableArea()) {
+                canBeScrolled = true;
+                break;
+            }
+        }
+    }
+
+    // We always allow two-fingered panning with inertia and a gutter (which limits movement to one
+    // direction in most cases).
+    DWORD dwPanWant = GC_PAN | GC_PAN_WITH_INERTIA | GC_PAN_WITH_GUTTER;
+    // We never allow single-fingered horizontal panning. That gesture is reserved for creating text
+    // selections. This matches IE.
+    DWORD dwPanBlock = GC_PAN_WITH_SINGLE_FINGER_HORIZONTALLY;
+
+    if (hitScrollbar || !canBeScrolled) {
+        // The part of the page under the gesture can't be scrolled, or the gesture is on a scrollbar.
+        // Disallow single-fingered vertical panning in this case, too, so we'll fall back to the default
+        // behavior (which allows the scrollbar thumb to be dragged, text selections to be made, etc.).
+        dwPanBlock |= GC_PAN_WITH_SINGLE_FINGER_VERTICALLY;
     } else {
-        dwPanWant = GC_PAN  | GC_PAN_WITH_SINGLE_FINGER_VERTICALLY | GC_PAN_WITH_INERTIA | GC_PAN_WITH_GUTTER;
-        dwPanBlock = GC_PAN_WITH_SINGLE_FINGER_HORIZONTALLY;
+        // The part of the page the gesture is under can be scrolled, and we're not under a scrollbar.
+        // Allow single-fingered vertical panning in this case, so the user will be able to pan the page
+        // with one or two fingers.
+        dwPanWant |= GC_PAN_WITH_SINGLE_FINGER_VERTICALLY;
     }
 
-    GESTURECONFIG gc = { GID_PAN, dwPanWant , dwPanBlock } ;
+    GESTURECONFIG gc = { GID_PAN, dwPanWant, dwPanBlock };
     return SetGestureConfigPtr()(m_viewWindow, 0, 1, &gc, sizeof(GESTURECONFIG));
 }
 
@@ -1390,21 +1430,20 @@ bool WebView::gesture(WPARAM wParam, LPARAM lParam)
         m_lastPanX = gi.ptsLocation.x;
         m_lastPanY = gi.ptsLocation.y;
 
-        CloseGestureInfoHandlePtr()(gestureHandle);
+        break;
+    case GID_END:
+        m_gestureTargetNode = 0;
         break;
     case GID_PAN: {
         // Where are the fingers currently?
         long currentX = gi.ptsLocation.x;
         long currentY = gi.ptsLocation.y;
-        
         // How far did we pan in each direction?
         long deltaX = currentX - m_lastPanX;
         long deltaY = currentY - m_lastPanY;
-
         // Calculate the overpan for window bounce
         m_yOverpan -= m_lastPanY - currentY;
         m_xOverpan -= m_lastPanX - currentX;
-        
         // Update our class variables with updated values
         m_lastPanX = currentX;
         m_lastPanY = currentY;
@@ -1414,10 +1453,13 @@ bool WebView::gesture(WPARAM wParam, LPARAM lParam)
             CloseGestureInfoHandlePtr()(gestureHandle);
             return false;
         }
-        // Represent the pan gesture as a mouse wheel event
-        PlatformWheelEvent wheelEvent(m_viewWindow, FloatSize(deltaX, deltaY), FloatPoint(currentX, currentY));
-        coreFrame->eventHandler()->handleWheelEvent(wheelEvent);
 
+        if (!m_gestureTargetNode || !m_gestureTargetNode->renderer())
+            return false;
+
+        // We negate here since panning up moves the content up, but moves the scrollbar down.
+        m_gestureTargetNode->renderer()->enclosingLayer()->scrollByRecursively(-deltaX, -deltaY);
+           
         if (!(UpdatePanningFeedbackPtr() && BeginPanningFeedbackPtr() && EndPanningFeedbackPtr())) {
             CloseGestureInfoHandlePtr()(gestureHandle);
             return true;
@@ -1434,7 +1476,7 @@ bool WebView::gesture(WPARAM wParam, LPARAM lParam)
         ScrollView* view = coreFrame->view();
         if (!view) {
             CloseGestureInfoHandlePtr()(gestureHandle);
-            return false;
+            return true;
         }
         Scrollbar* vertScrollbar = view->verticalScrollbar();
         if (!vertScrollbar) {
@@ -1442,22 +1484,26 @@ bool WebView::gesture(WPARAM wParam, LPARAM lParam)
             return true;
         }
 
-        // FIXME: Support Horizontal Window Bounce
+        // FIXME: Support Horizontal Window Bounce. <https://webkit.org/b/28500>.
+        // FIXME: If the user starts panning down after a window bounce has started, the window doesn't bounce back 
+        // until they release their finger. <https://webkit.org/b/28501>.
         if (vertScrollbar->currentPos() == 0)
             UpdatePanningFeedbackPtr()(m_viewWindow, 0, m_yOverpan, gi.dwFlags & GF_INERTIA);
         else if (vertScrollbar->currentPos() >= vertScrollbar->maximum())
             UpdatePanningFeedbackPtr()(m_viewWindow, 0, m_yOverpan, gi.dwFlags & GF_INERTIA);
 
         CloseGestureInfoHandlePtr()(gestureHandle);
-        break;
+        return true;
     }
     default:
-        // We have encountered an unknown gesture - return false to pass it to DefWindowProc
-        CloseGestureInfoHandlePtr()(gestureHandle);
         break;
     }
 
-    return true;
+    // If we get to this point, the gesture has not been handled. We forward
+    // the call to DefWindowProc by returning false, and we don't need to 
+    // to call CloseGestureInfoHandle. 
+    // http://msdn.microsoft.com/en-us/library/dd353228(VS.85).aspx
+    return false;
 }
 
 bool WebView::mouseWheel(WPARAM wParam, LPARAM lParam, bool isMouseHWheel)
@@ -1473,6 +1519,23 @@ bool WebView::mouseWheel(WPARAM wParam, LPARAM lParam, bool isMouseHWheel)
             makeTextLarger(0);
         return true;
     }
+    
+    // FIXME: This doesn't fix https://bugs.webkit.org/show_bug.cgi?id=28217. This only fixes https://bugs.webkit.org/show_bug.cgi?id=28203.
+    HWND focusedWindow = GetFocus();
+    if (focusedWindow && focusedWindow != m_viewWindow) {
+        // Our focus is on a different hwnd, see if it's a PopupMenu and if so, set the focus back on us (which will hide the popup).
+        TCHAR className[256];
+
+        // Make sure truncation won't affect the comparison.
+        ASSERT(ARRAYSIZE(className) > _tcslen(PopupMenu::popupClassName()));
+
+        if (GetClassName(focusedWindow, className, ARRAYSIZE(className)) && !_tcscmp(className, PopupMenu::popupClassName())) {
+            // We don't let the WebView scroll here for two reasons - 1) To match Firefox behavior, 2) If we do scroll, we lose the
+            // focus ring around the select menu.
+            SetFocus(m_viewWindow);
+            return true;
+        }
+    }
 
     PlatformWheelEvent wheelEvent(m_viewWindow, wParam, lParam, isMouseHWheel);
     Frame* coreFrame = core(m_mainFrame);
@@ -1740,21 +1803,6 @@ bool WebView::keyPress(WPARAM charCode, LPARAM keyData, bool systemKeyDown)
     return frame->eventHandler()->keyEvent(keyEvent);
 }
 
-bool WebView::inResizer(LPARAM lParam)
-{
-    if (!m_uiDelegatePrivate)
-        return false;
-
-    RECT r;
-    if (FAILED(m_uiDelegatePrivate->webViewResizerRect(this, &r)))
-        return false;
-
-    POINT pt;
-    pt.x = LOWORD(lParam);
-    pt.y = HIWORD(lParam);
-    return !!PtInRect(&r, pt);
-}
-
 static bool registerWebViewWindowClass()
 {
     static bool haveRegisteredWindowClass = false;
@@ -1834,8 +1882,8 @@ static LRESULT CALLBACK WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam, L
             webView->paint((HDC)wParam, lParam);
             break;
         case WM_DESTROY:
-            webView->close();
             webView->setIsBeingDestroyed();
+            webView->close();
             webView->revokeDragDrop();
             break;
         case WM_GESTURENOTIFY:
@@ -2281,13 +2329,8 @@ HRESULT STDMETHODCALLTYPE WebView::initWithFrame(
 
     registerWebViewWindowClass();
 
-    if (!::IsWindow(m_hostWindow)) {
-        ASSERT_NOT_REACHED();
-        return E_FAIL;
-    }
-
-    m_viewWindow = CreateWindowEx(0, kWebViewWindowClassName, 0, WS_CHILD | WS_CLIPCHILDREN,
-        frame.left, frame.top, frame.right - frame.left, frame.bottom - frame.top, m_hostWindow, 0, gInstance, 0);
+    m_viewWindow = CreateWindowEx(0, kWebViewWindowClassName, 0, WS_CHILD | WS_CLIPSIBLINGS | WS_CLIPCHILDREN,
+        frame.left, frame.top, frame.right - frame.left, frame.bottom - frame.top, m_hostWindow ? m_hostWindow : HWND_MESSAGE, 0, gInstance, 0);
     ASSERT(::IsWindow(m_viewWindow));
 
     hr = registerDragDrop();
@@ -2310,7 +2353,11 @@ HRESULT STDMETHODCALLTYPE WebView::initWithFrame(
         Settings::setShouldPaintNativeControls(shouldPaintNativeControls);
 #endif
 
-    m_page = new Page(new WebChromeClient(this), new WebContextMenuClient(this), new WebEditorClient(this), new WebDragClient(this), new WebInspectorClient(this));
+    BOOL useHighResolutionTimer;
+    if (SUCCEEDED(m_preferences->shouldUseHighResolutionTimers(&useHighResolutionTimer)))
+        Settings::setShouldUseHighResolutionTimers(useHighResolutionTimer);
+
+    m_page = new Page(new WebChromeClient(this), new WebContextMenuClient(this), new WebEditorClient(this), new WebDragClient(this), new WebInspectorClient(this), new WebPluginHalterClient(this));
 
     BSTR localStoragePath;
     if (SUCCEEDED(m_preferences->localStorageDatabasePath(&localStoragePath))) {
@@ -2952,8 +2999,17 @@ HRESULT STDMETHODCALLTYPE WebView::setHostWindow(
     /* [in] */ OLE_HANDLE oleWindow)
 {
     HWND window = (HWND)(ULONG64)oleWindow;
-    if (m_viewWindow && window)
-        SetParent(m_viewWindow, window);
+    if (m_viewWindow) {
+        if (window)
+            SetParent(m_viewWindow, window);
+        else if (!isBeingDestroyed()) {
+            // Turn the WebView into a message-only window so it will no longer be a child of the
+            // old host window and will be hidden from screen. We only do this when
+            // isBeingDestroyed() is false because doing this while handling WM_DESTROY can leave
+            // m_viewWindow in a weird state (see <http://webkit.org/b/29337>).
+            SetParent(m_viewWindow, HWND_MESSAGE);
+        }
+    }
 
     m_hostWindow = window;
 
@@ -3569,6 +3625,15 @@ HRESULT STDMETHODCALLTYPE WebView::toggleGrammarChecking(
     return setGrammarCheckingEnabled(enabled ? FALSE : TRUE);
 }
 
+HRESULT STDMETHODCALLTYPE WebView::reloadFromOrigin( 
+        /* [in] */ IUnknown* /*sender*/)
+{
+    if (!m_mainFrame)
+        return E_FAIL;
+
+    return m_mainFrame->reloadFromOrigin();
+}
+
 // IWebViewCSS -----------------------------------------------------------------
 
 HRESULT STDMETHODCALLTYPE WebView::computedStyleForElement( 
@@ -4339,6 +4404,16 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
         return hr;
     settings->setLocalStorageEnabled(enabled);
 
+    hr = prefsPrivate->experimentalNotificationsEnabled(&enabled);
+    if (FAILED(hr))
+        return hr;
+    settings->setExperimentalNotificationsEnabled(enabled);
+
+    hr = prefsPrivate->experimentalWebSocketsEnabled(&enabled);
+    if (FAILED(hr))
+        return hr;
+    settings->setExperimentalWebSocketsEnabled(enabled);
+
     hr = prefsPrivate->isWebSecurityEnabled(&enabled);
     if (FAILED(hr))
         return hr;
@@ -4361,6 +4436,26 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
     settings->setShouldPaintNativeControls(!!enabled);
 #endif
 
+    hr = prefsPrivate->shouldUseHighResolutionTimers(&enabled);
+    if (FAILED(hr))
+        return hr;
+    settings->setShouldUseHighResolutionTimers(enabled);
+
+    hr = prefsPrivate->pluginHalterEnabled(&enabled);
+    if (FAILED(hr))
+        return hr;
+    settings->setPluginHalterEnabled(enabled);
+
+    UINT runTime;
+    hr = prefsPrivate->pluginAllowedRunTime(&runTime);
+    if (FAILED(hr))
+        return hr;
+    settings->setPluginAllowedRunTime(runTime);
+
+#if ENABLE(3D_CANVAS)
+    settings->setExperimentalWebGLEnabled(true);
+#endif  // ENABLE(3D_CANVAS)
+
     if (!m_closeWindowTimer.isActive())
         m_mainFrame->invalidate(); // FIXME
 
@@ -4392,6 +4487,20 @@ HRESULT updateSharedSettingsFromPreferencesIfNeeded(IWebPreferences* preferences
 
 // IWebViewPrivate ------------------------------------------------------------
 
+HRESULT STDMETHODCALLTYPE WebView::MIMETypeForExtension(
+    /* [in] */ BSTR extension,
+    /* [retval][out] */ BSTR* mimeType)
+{
+    if (!mimeType)
+        return E_POINTER;
+
+    String extensionStr(extension, SysStringLen(extension));
+
+    *mimeType = BString(MIMETypeRegistry::getMIMETypeForExtension(extensionStr)).release();
+
+    return S_OK;
+}
+
 HRESULT STDMETHODCALLTYPE WebView::setCustomDropTarget(
     /* [in] */ IDropTarget* dt)
 {
@@ -5324,6 +5433,134 @@ HRESULT WebView::setCanStartPlugins(BOOL canStartPlugins)
     return S_OK;
 }
 
+static PassOwnPtr<Vector<String> > toStringVector(unsigned patternsCount, BSTR* patterns)
+{
+    // Convert the patterns into a Vector.
+    if (patternsCount == 0)
+        return 0;
+    Vector<String>* patternsVector = new Vector<String>;
+    for (unsigned i = 0; i < patternsCount; ++i)
+        patternsVector->append(String(patterns[i], SysStringLen(patterns[i])));
+    return patternsVector;
+}
+
+HRESULT WebView::addUserScriptToGroup(BSTR groupName, unsigned worldID, BSTR source, BSTR url, 
+                                      unsigned whitelistCount, BSTR* whitelist,
+                                      unsigned blacklistCount, BSTR* blacklist,
+                                      WebUserScriptInjectionTime injectionTime)
+{
+    String group(groupName, SysStringLen(groupName));
+    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+        return E_INVALIDARG;
+
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    ASSERT(pageGroup);
+    if (!pageGroup)
+        return E_FAIL;
+
+    pageGroup->addUserScript(String(source, SysStringLen(source)), KURL(KURL(), String(url, SysStringLen(url))),
+                             toStringVector(whitelistCount, whitelist), toStringVector(blacklistCount, blacklist), worldID,
+                             injectionTime == WebInjectAtDocumentStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
+
+    return S_OK;
+}
+
+HRESULT WebView::addUserStyleSheetToGroup(BSTR groupName, unsigned worldID, BSTR source, BSTR url,
+                                          unsigned whitelistCount, BSTR* whitelist,
+                                          unsigned blacklistCount, BSTR* blacklist)
+{
+    String group(groupName, SysStringLen(groupName));
+    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+        return E_INVALIDARG;
+
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    ASSERT(pageGroup);
+    if (!pageGroup)
+        return E_FAIL;
+
+    pageGroup->addUserStyleSheet(String(source, SysStringLen(source)), KURL(KURL(), String(url, SysStringLen(url))),
+                                 toStringVector(whitelistCount, whitelist), toStringVector(blacklistCount, blacklist), worldID);
+
+    return S_OK;
+}
+
+HRESULT WebView::removeUserContentWithURLFromGroup(BSTR groupName, unsigned worldID, BSTR url)
+{
+    String group(groupName, SysStringLen(groupName));
+    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+        return E_INVALIDARG;
+
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    ASSERT(pageGroup);
+    if (!pageGroup)
+        return E_FAIL;
+
+    pageGroup->removeUserContentWithURLForWorld(KURL(KURL(), String(url, SysStringLen(url))), worldID);
+
+    return S_OK;
+}
+
+HRESULT WebView::removeUserContentFromGroup(BSTR groupName, unsigned worldID)
+{
+    String group(groupName, SysStringLen(groupName));
+    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+        return E_INVALIDARG;
+
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    ASSERT(pageGroup);
+    if (!pageGroup)
+        return E_FAIL;
+
+    pageGroup->removeUserContentForWorld(worldID);
+    return S_OK;
+}
+
+HRESULT WebView::removeAllUserContentFromGroup(BSTR groupName)
+{
+    String group(groupName, SysStringLen(groupName));
+    if (group.isEmpty())
+        return E_INVALIDARG;
+
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    ASSERT(pageGroup);
+    if (!pageGroup)
+        return E_FAIL;
+
+    pageGroup->removeAllUserContent();
+    return S_OK;
+}
+
+HRESULT WebView::invalidateBackingStore(const RECT* rect)
+{
+    if (!IsWindow(m_viewWindow))
+        return S_OK;
+
+    RECT clientRect;
+    if (!GetClientRect(m_viewWindow, &clientRect))
+        return E_FAIL;
+
+    RECT rectToInvalidate;
+    if (!rect)
+        rectToInvalidate = clientRect;
+    else if (!IntersectRect(&rectToInvalidate, &clientRect, rect))
+        return S_OK;
+
+    repaint(rectToInvalidate, true);
+    return S_OK;
+}
+
+HRESULT WebView::whiteListAccessFromOrigin(BSTR sourceOrigin, BSTR destinationProtocol, BSTR destinationHost, BOOL allowDestinationSubdomains)
+{
+    SecurityOrigin::whiteListAccessFromOrigin(*SecurityOrigin::createFromString(String(sourceOrigin, SysStringLen(sourceOrigin))), String(destinationProtocol, SysStringLen(destinationProtocol)), String(destinationHost, SysStringLen(destinationHost)), allowDestinationSubdomains);
+    return S_OK;
+}
+
+HRESULT WebView::resetOriginAccessWhiteLists()
+{
+    SecurityOrigin::resetOriginAccessWhiteLists();
+    return S_OK;
+}
+
 void WebView::downloadURL(const KURL& url)
 {
     // It's the delegate's job to ref the WebDownload to keep it alive - otherwise it will be
@@ -5332,6 +5569,24 @@ void WebView::downloadURL(const KURL& url)
     download->start();
 }
 
+
+HRESULT STDMETHODCALLTYPE WebView::setPluginHalterDelegate(IWebPluginHalterDelegate* d)
+{
+    m_pluginHalterDelegate = d;
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE WebView::pluginHalterDelegate(IWebPluginHalterDelegate** d)
+{
+    if (!d)
+        return E_POINTER;
+
+    if (!m_pluginHalterDelegate)
+        return E_FAIL;
+
+    return m_pluginHalterDelegate.copyRefTo(d);
+}
+
 class EnumTextMatches : public IEnumTextMatches
 {
     long m_ref;
@@ -5415,4 +5670,3 @@ Page* core(IWebView* iWebView)
 
     return page;
 }
-
diff --git a/WebKit/win/WebView.h b/WebKit/win/WebView.h
index a97dd94..3f20c69 100644
--- a/WebKit/win/WebView.h
+++ b/WebKit/win/WebView.h
@@ -76,11 +76,11 @@ public:
     virtual HRESULT STDMETHODCALLTYPE canShowMIMEType( 
         /* [in] */ BSTR mimeType,
         /* [retval][out] */ BOOL *canShow);
-    
+
     virtual HRESULT STDMETHODCALLTYPE canShowMIMETypeAsHTML( 
         /* [in] */ BSTR mimeType,
         /* [retval][out] */ BOOL *canShow);
-    
+
     virtual HRESULT STDMETHODCALLTYPE MIMETypesShownAsHTML( 
         /* [retval][out] */ IEnumVARIANT **enumVariant);
     
@@ -353,6 +353,9 @@ public:
     virtual HRESULT STDMETHODCALLTYPE toggleGrammarChecking( 
         /* [in] */ IUnknown *sender);
 
+    virtual HRESULT STDMETHODCALLTYPE reloadFromOrigin( 
+        /* [in] */ IUnknown *sender);
+
     // IWebViewCSS
 
     virtual HRESULT STDMETHODCALLTYPE computedStyleForElement( 
@@ -568,6 +571,11 @@ public:
         /* [in] */ IWebNotification *notification);
 
     // IWebViewPrivate
+
+    virtual HRESULT STDMETHODCALLTYPE MIMETypeForExtension(
+        /* [in] */ BSTR extension,
+        /* [retval][out] */ BSTR *mimeType);
+
     virtual HRESULT STDMETHODCALLTYPE setCustomDropTarget(
         /* [in] */ IDropTarget* dt);
 
@@ -732,6 +740,25 @@ public:
     virtual HRESULT STDMETHODCALLTYPE setCanStartPlugins(
         /* [in] */ BOOL canStartPlugins);
 
+    virtual HRESULT STDMETHODCALLTYPE addUserScriptToGroup(BSTR groupName, unsigned worldID, BSTR source, BSTR url,
+                                                           unsigned whitelistCount, BSTR* whitelist, 
+                                                           unsigned blacklistCount, BSTR* blacklist,
+                                                           WebUserScriptInjectionTime);
+    virtual HRESULT STDMETHODCALLTYPE addUserStyleSheetToGroup(BSTR groupName, unsigned worldID, BSTR source, BSTR url,
+                                                               unsigned whitelistCount, BSTR* whitelist, 
+                                                               unsigned blacklistCount, BSTR* blacklist);
+    virtual HRESULT STDMETHODCALLTYPE removeUserContentWithURLFromGroup(BSTR groupName, unsigned worldID, BSTR url);
+    virtual HRESULT STDMETHODCALLTYPE removeUserContentFromGroup(BSTR groupName, unsigned worldID);
+    virtual HRESULT STDMETHODCALLTYPE removeAllUserContentFromGroup(BSTR groupName);
+
+    virtual HRESULT STDMETHODCALLTYPE setPluginHalterDelegate(IWebPluginHalterDelegate*);
+    virtual HRESULT STDMETHODCALLTYPE pluginHalterDelegate(IWebPluginHalterDelegate**);
+
+    virtual HRESULT STDMETHODCALLTYPE invalidateBackingStore(const RECT*);
+
+    virtual HRESULT STDMETHODCALLTYPE whiteListAccessFromOrigin(BSTR sourceOrigin, BSTR destinationProtocol, BSTR destinationHost, BOOL allowDestinationSubdomains);
+    virtual HRESULT STDMETHODCALLTYPE resetOriginAccessWhiteLists();
+
     // WebView
     bool shouldUseEmbeddedView(const WebCore::String& mimeType) const;
 
@@ -751,7 +778,6 @@ public:
     bool keyDown(WPARAM, LPARAM, bool systemKeyDown = false);
     bool keyUp(WPARAM, LPARAM, bool systemKeyDown = false);
     bool keyPress(WPARAM, LPARAM, bool systemKeyDown = false);
-    bool inResizer(LPARAM lParam);
     void paint(HDC, LPARAM);
     void paintIntoWindow(HDC bitmapDC, HDC windowDC, const WebCore::IntRect& dirtyRect);
     bool ensureBackingStore();
@@ -880,6 +906,7 @@ protected:
     COMPtr<IWebDownloadDelegate> m_downloadDelegate;
     COMPtr<WebPreferences> m_preferences;
     COMPtr<WebInspector> m_webInspector;
+    COMPtr<IWebPluginHalterDelegate> m_pluginHalterDelegate;
 
     bool m_userAgentOverridden;
     bool m_useBackForwardList;
@@ -918,6 +945,7 @@ protected:
     OwnPtr<HashSet<WebCore::String> > m_embeddedViewMIMETypes;
 
     //Variables needed to store gesture information
+    RefPtr<WebCore::Node> m_gestureTargetNode;
     long m_lastPanX;
     long m_lastPanY;
     long m_xOverpan;
diff --git a/WebKit/win/WebWorkersPrivate.cpp b/WebKit/win/WebWorkersPrivate.cpp
new file mode 100644
index 0000000..f55c27c
--- /dev/null
+++ b/WebKit/win/WebWorkersPrivate.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebKitDLL.h"
+#include "WebWorkersPrivate.h"
+
+#include <WebCore/WorkerThread.h>
+
+// IUnknown -------------------------------------------------------------------
+
+HRESULT STDMETHODCALLTYPE WebWorkersPrivate::QueryInterface(REFIID riid, void** ppvObject)
+{
+    *ppvObject = 0;
+    if (IsEqualGUID(riid, __uuidof(IWebWorkersPrivate)))
+        *ppvObject = this;
+    else if (IsEqualGUID(riid, IID_IUnknown))
+        *ppvObject = static_cast<IWebWorkersPrivate*>(this);
+    else if (IsEqualGUID(riid, IID_IWebWorkersPrivate))
+        *ppvObject = static_cast<IWebWorkersPrivate*>(this);
+    else
+        return E_NOINTERFACE;
+
+    AddRef();
+    return S_OK;
+}
+
+ULONG STDMETHODCALLTYPE WebWorkersPrivate::AddRef(void)
+{
+    return ++m_refCount;
+}
+
+ULONG STDMETHODCALLTYPE WebWorkersPrivate::Release(void)
+{
+    ULONG newRef = --m_refCount;
+    if (!newRef)
+        delete(this);
+
+    return newRef;
+}
+
+// IWebWorkersPrivate ---------------------------------------------------------
+
+HRESULT WebWorkersPrivate::workerThreadCount(UINT* number)
+{
+    if (!number)
+        return E_POINTER;
+
+#if ENABLE(WORKERS)
+    *number = WebCore::WorkerThread::workerThreadCount();
+#else
+    *number = 0;
+#endif
+    return S_OK;
+}
+
+// WebWorkersPrivate ----------------------------------------------------------
+
+WebWorkersPrivate* WebWorkersPrivate::createInstance()
+{
+    WebWorkersPrivate* instance = new WebWorkersPrivate();
+    instance->AddRef();
+    return instance;
+}
+
+WebWorkersPrivate::WebWorkersPrivate()
+    : m_refCount(0)
+{
+    gClassCount++;
+    gClassNameCount.add("WebWorkersPrivate");
+}
+
+WebWorkersPrivate::~WebWorkersPrivate()
+{
+    gClassCount--;
+    gClassNameCount.remove("WebWorkersPrivate");
+}
diff --git a/WebKit/win/WebWorkersPrivate.h b/WebKit/win/WebWorkersPrivate.h
new file mode 100644
index 0000000..231c11c
--- /dev/null
+++ b/WebKit/win/WebWorkersPrivate.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebWorkersPrivate_h
+#define WebWorkersPrivate_h
+
+#include "WebKit.h"
+
+class WebWorkersPrivate : public IWebWorkersPrivate {
+public:
+    static WebWorkersPrivate* createInstance();
+private:
+    WebWorkersPrivate();
+    ~WebWorkersPrivate();
+
+public:
+    // IUnknown
+    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);
+    virtual ULONG STDMETHODCALLTYPE AddRef(void);
+    virtual ULONG STDMETHODCALLTYPE Release(void);
+
+    // IWebWorkersPrivate
+    virtual HRESULT STDMETHODCALLTYPE workerThreadCount(UINT*);
+
+private:
+    ULONG m_refCount;
+};
+
+#endif // WebWorkersPrivate_h
diff --git a/WebKit/wx/ChangeLog b/WebKit/wx/ChangeLog
index 455aebd..76f4533 100644
--- a/WebKit/wx/ChangeLog
+++ b/WebKit/wx/ChangeLog
@@ -1,3 +1,234 @@
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        Move the policy callback to the policy object.
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::dispatchWillSubmitForm):
+        (WebCore::FrameLoaderClientWx::dispatchDecidePolicyForMIMEType):
+        (WebCore::FrameLoaderClientWx::dispatchDecidePolicyForNewWindowAction):
+        (WebCore::FrameLoaderClientWx::dispatchDecidePolicyForNavigationAction):
+
+2009-09-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add EmptyPluginHalterClient when creating the Page.
+
+        * WebView.cpp:
+        (wxWebView::Create):
+
+2009-09-22  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix to ensure the import library gets properly installed on Windows.
+
+        * wscript:
+
+2009-09-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Reflect the rename of platformWindow and it's return type.
+
+        * WebKitSupport/ChromeClientWx.cpp:
+        (WebCore::ChromeClientWx::platformPageClient):
+        * WebKitSupport/ChromeClientWx.h:
+        * WebKitSupport/EditorClientWx.cpp:
+        (WebCore::EditorClientWx::isEditable):
+        (WebCore::EditorClientWx::registerCommandForUndo):
+        (WebCore::EditorClientWx::registerCommandForRedo):
+        (WebCore::EditorClientWx::clearUndoRedoOperations):
+        (WebCore::EditorClientWx::canUndo):
+        (WebCore::EditorClientWx::canRedo):
+        (WebCore::EditorClientWx::undo):
+        (WebCore::EditorClientWx::redo):
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxPython bindings build fixes after recent changes.
+
+        * WebView.h:
+        * bindings/python/wscript:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Allow a way to set the cache policy via wx API.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29200
+
+        * WebView.cpp:
+        (wxWebView::SetCachePolicy):
+        (wxWebView::GetCachePolicy):
+        * WebView.h:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Allow the user to query Frame::shouldClose via wx API.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29199
+
+        * WebFrame.cpp:
+        (wxWebFrame::ShouldClose):
+        * WebFrame.h:
+        * WebView.cpp:
+        (wxWebView::ShouldClose):
+        * WebView.h:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Fix mouse handling when the mouse leaves the window during mouse down.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29198
+
+        * WebView.cpp:
+        (wxWebView::OnMouseEvents):
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add support for console MessageLevel at wx API level.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29197
+
+        * WebKitSupport/ChromeClientWx.cpp:
+        (WebCore::ChromeClientWx::addMessageToConsole):
+        * WebView.h:
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Stub implementations of mixed content methods of FrameLoaderClient. 
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::didDisplayInsecureContent):
+        (WebCore::FrameLoaderClientWx::didRunInsecureContent):
+        * WebKitSupport/FrameLoaderClientWx.h:
+
+2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Frames support
+        https://bugs.webkit.org/show_bug.cgi?id=19041
+
+        * WebFrame.cpp:
+        (wxWebFrame::wxWebFrame):
+        (wxWebFrame::~wxWebFrame):
+        (wxWebFrame::GetFrame):
+        * WebFrame.h:
+        * WebFramePrivate.h:
+        * WebKitSupport/ChromeClientWx.cpp:
+        (WebCore::ChromeClientWx::platformWindow):
+        (WebCore::ChromeClientWx::scroll):
+        * WebKitSupport/EditorClientWx.cpp:
+        (WebCore::EditorClientWx::isEditable):
+        (WebCore::EditorClientWx::registerCommandForUndo):
+        (WebCore::EditorClientWx::registerCommandForRedo):
+        (WebCore::EditorClientWx::clearUndoRedoOperations):
+        (WebCore::EditorClientWx::canUndo):
+        (WebCore::EditorClientWx::canRedo):
+        (WebCore::EditorClientWx::undo):
+        (WebCore::EditorClientWx::redo):
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::FrameLoaderClientWx):
+        (WebCore::FrameLoaderClientWx::setFrame):
+        (WebCore::FrameLoaderClientWx::dispatchWillSubmitForm):
+        (WebCore::FrameLoaderClientWx::frameLoaderDestroyed):
+        (WebCore::FrameLoaderClientWx::committedLoad):
+        (WebCore::FrameLoaderClientWx::dispatchDecidePolicyForMIMEType):
+        (WebCore::FrameLoaderClientWx::dispatchDecidePolicyForNewWindowAction):
+        (WebCore::FrameLoaderClientWx::dispatchDecidePolicyForNavigationAction):
+        (WebCore::FrameLoaderClientWx::createFrame):
+        (WebCore::FrameLoaderClientWx::transitionToCommittedForNewPage):
+        * WebKitSupport/FrameLoaderClientWx.h:
+        * WebView.h:
+        * WebViewPrivate.h:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * bindings/python/wscript:
+        * wscript:
+
+2009-09-02  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        wx port: Call WTF::initializeThreading().
+        https://bugs.webkit.org/show_bug.cgi?id=28912
+
+        * WebView.cpp:
+        (wxWebView::Create): call WTF::initializeThreading()
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Use the 2 param KURL constructor.
+
+        * WebFrame.cpp:
+        (wxWebFrame::SetPageSource):
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28852
+        Rename KURL single argument constructor to avoid confusion
+
+        * WebFrame.cpp: (wxWebFrame::SetPageSource): Adapt to the change.
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Add empty implementation for new ChromeClient method.
+
+        * WebKitSupport/ChromeClientWx.h:
+        (WebCore::ChromeClientWx::scrollbarsModeDidChange):
+
+2009-08-19  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Use FrameLoader::load() for loading pages from a HTML page string to address
+        bugs with using begin/write/end loading.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28488
+
+        * WebFrame.cpp:
+        (wxWebFrame::SetPageSource):
+
+2009-08-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Make sure that the wxWebKit dynamic library is rebuilt whenever
+        webcore or jscore libs change.
+
+        * wscript:
+
+2009-08-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxPython build fix, the SWIG defines must also be available when compiling.
+
+        * bindings/python/wscript:
+
 2009-08-05  Kevin Ollivier  <kevino@theolliviers.com>
 
         Reviewed by Eric Seidel.
diff --git a/WebKit/wx/WebFrame.cpp b/WebKit/wx/WebFrame.cpp
index 630eb8f..f205152 100644
--- a/WebKit/wx/WebFrame.cpp
+++ b/WebKit/wx/WebFrame.cpp
@@ -42,6 +42,7 @@
 #include "RenderView.h"
 #include "ScriptController.h"
 #include "ScriptValue.h"
+#include "SubstituteData.h"
 #include "TextEncoding.h"
 
 #include "JSDOMBinding.h"
@@ -73,8 +74,7 @@ wxWebFrame::wxWebFrame(wxWebView* container, wxWebFrame* parent, WebViewFrameDat
     m_textMagnifier(1.0),
     m_isEditable(false),
     m_isInitialized(false),
-    m_beingDestroyed(false),
-    m_title(wxEmptyString)
+    m_beingDestroyed(false)
 {
 
     m_impl = new WebFramePrivate();
@@ -86,13 +86,16 @@ wxWebFrame::wxWebFrame(wxWebView* container, wxWebFrame* parent, WebViewFrameDat
     }
     
     WebCore::FrameLoaderClientWx* loaderClient = new WebCore::FrameLoaderClientWx();
-    
-    m_impl->frame = WebCore::Frame::create(container->m_impl->page, parentFrame, loaderClient);
-    m_impl->frame->deref();
+    RefPtr<WebCore::Frame> newFrame = WebCore::Frame::create(container->m_impl->page, parentFrame, loaderClient);
+
+    m_impl->frame = newFrame.get();
 
-    loaderClient->setFrame(m_impl->frame.get());
+    loaderClient->setFrame(this);
     loaderClient->setWebView(container);
     
+    if (data && data->ownerElement)
+        m_impl->frame->ref();
+
     m_impl->frame->init();
         
     m_isInitialized = true;
@@ -100,13 +103,14 @@ wxWebFrame::wxWebFrame(wxWebView* container, wxWebFrame* parent, WebViewFrameDat
 
 wxWebFrame::~wxWebFrame()
 {
-    m_impl->frame->loader()->detachFromParent();
+    if (m_impl)
+        delete m_impl;
 }
 
 WebCore::Frame* wxWebFrame::GetFrame()
 {
     if (m_impl)
-        return m_impl->frame.get();
+        return m_impl->frame;
         
     return 0;
 }
@@ -142,10 +146,16 @@ wxString wxWebFrame::GetPageSource()
 void wxWebFrame::SetPageSource(const wxString& source, const wxString& baseUrl)
 {
     if (m_impl->frame && m_impl->frame->loader()) {
-        WebCore::FrameLoader* loader = m_impl->frame->loader();
-        loader->begin(WebCore::KURL(WebCore::KURL(), static_cast<const char*>(baseUrl.mb_str(wxConvUTF8)), WebCore::UTF8Encoding()));
-        loader->write(static_cast<const WebCore::String>(source));
-        loader->end();
+        WebCore::KURL url(WebCore::KURL(), static_cast<const char*>(baseUrl.mb_str(wxConvUTF8)));
+
+        wxCharBuffer charBuffer(source.mb_str(wxConvUTF8));
+        const char* contents = charBuffer;
+
+        WTF::PassRefPtr<WebCore::SharedBuffer> sharedBuffer = WebCore::SharedBuffer::create(contents, strlen(contents));
+        WebCore::SubstituteData substituteData(sharedBuffer, WebCore::String("text/html"), WebCore::String("UTF-8"), WebCore::blankURL(), url);
+
+        m_impl->frame->loader()->stop();
+        m_impl->frame->loader()->load(WebCore::ResourceRequest(url), substituteData, false);
     }
 }
 
@@ -383,3 +393,10 @@ wxWebViewDOMElementInfo wxWebFrame::HitTest(const wxPoint& pos) const
     return domInfo;
 }
 
+bool wxWebFrame::ShouldClose() const
+{
+    if (m_impl->frame)
+        return m_impl->frame->shouldClose();
+
+    return true;
+}
diff --git a/WebKit/wx/WebFrame.h b/WebKit/wx/WebFrame.h
index 9bf21cd..bd4bdb0 100644
--- a/WebKit/wx/WebFrame.h
+++ b/WebKit/wx/WebFrame.h
@@ -146,21 +146,19 @@ public:
     void ResetTextSize();
     void MakeEditable(bool enable);
     bool IsEditable() const { return m_isEditable; }
-
-    wxString GetPageTitle() const { return m_title; }
-    void SetPageTitle(const wxString& title) { m_title = title; }
     
     WebCore::Frame* GetFrame();
 
     wxWebViewDOMElementInfo HitTest(const wxPoint& post) const;
     
+    bool ShouldClose() const;
+    
 private:
     float m_textMagnifier;
     bool m_isEditable;
     bool m_isInitialized;
     bool m_beingDestroyed;
     WebFramePrivate* m_impl;
-    wxString m_title;
     
 };
 
diff --git a/WebKit/wx/WebFramePrivate.h b/WebKit/wx/WebFramePrivate.h
index 7af70a8..58bc40a 100644
--- a/WebKit/wx/WebFramePrivate.h
+++ b/WebKit/wx/WebFramePrivate.h
@@ -30,11 +30,9 @@
 #define WXWEBFRAMEPRIVATE_H
 
 #include "config.h"
-#include "EditCommand.h"
-#include "EditCommandWx.h"
 #include "Frame.h"
-#include "wtf/RefPtr.h"
-#include "wtf/Vector.h"
+#include "HTMLFrameOwnerElement.h"
+#include "KURL.h"
 
 class WebFramePrivate {
 
@@ -42,11 +40,21 @@ public:
     WebFramePrivate() :
             frame(0)
     {}
+    
+    WebCore::Frame* frame;
+};
 
-    WTF::Vector<EditCommandWx> undoStack;
-    WTF::Vector<EditCommandWx> redoStack;
+class WebViewFrameData
+{
+public:
+    WebCore::KURL url;
+    WebCore::String name;
+    WebCore::HTMLFrameOwnerElement* ownerElement;
     
-    WTF::RefPtr<WebCore::Frame> frame;
+    WebCore::String referrer;
+    bool allowsScrolling;
+    int marginWidth;
+    int marginHeight;    
 };
 
 #endif
diff --git a/WebKit/wx/WebKitSupport/ChromeClientWx.cpp b/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
index b25fce9..9b2f264 100644
--- a/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
@@ -212,6 +212,7 @@ void ChromeClientWx::addMessageToConsole(MessageSource source,
         wkEvent.SetMessage(message);
         wkEvent.SetLineNumber(lineNumber);
         wkEvent.SetSourceID(sourceID);
+        wkEvent.SetLevel(static_cast<wxWebViewConsoleMessageLevel>(level));
         m_webView->GetEventHandler()->ProcessEvent(wkEvent);
     }
 }
@@ -338,9 +339,9 @@ IntPoint ChromeClientWx::screenToWindow(const IntPoint& point) const
     return point;
 }
 
-PlatformWidget ChromeClientWx::platformWindow() const
+PlatformPageClient ChromeClientWx::platformPageClient() const
 {
-    return 0;
+    return m_webView;
 }
 
 void ChromeClientWx::contentsSizeChanged(Frame*, const IntSize&) const
@@ -393,6 +394,7 @@ void ChromeClientWx::reachedMaxAppCacheSize(int64_t spaceNeeded)
 
 void ChromeClientWx::scroll(const IntSize&, const IntRect&, const IntRect&)
 {
+    m_webView->Refresh();
     notImplemented();
 }
 
diff --git a/WebKit/wx/WebKitSupport/ChromeClientWx.h b/WebKit/wx/WebKitSupport/ChromeClientWx.h
index 85335c8..07f70a8 100644
--- a/WebKit/wx/WebKitSupport/ChromeClientWx.h
+++ b/WebKit/wx/WebKitSupport/ChromeClientWx.h
@@ -104,9 +104,10 @@ public:
     virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
     virtual IntPoint screenToWindow(const IntPoint&) const;
     virtual IntRect windowToScreen(const IntRect&) const;
-    virtual PlatformWidget platformWindow() const;
+    virtual PlatformPageClient platformPageClient() const;
     virtual void contentsSizeChanged(Frame*, const IntSize&) const;
 
+    virtual void scrollbarsModeDidChange() const { }
     virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
 
     virtual void setToolTip(const String&, TextDirection);
diff --git a/WebKit/wx/WebKitSupport/EditorClientWx.cpp b/WebKit/wx/WebKitSupport/EditorClientWx.cpp
index 3808bfe..bd3af48 100644
--- a/WebKit/wx/WebKitSupport/EditorClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/EditorClientWx.cpp
@@ -202,7 +202,7 @@ bool EditorClientWx::isEditable()
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
 
     if (frame) {
-        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->platformWidget());
+        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->hostWindow()->platformPageClient());
         if (webKitWin) 
             return webKitWin->IsEditable();
     }
@@ -285,9 +285,9 @@ void EditorClientWx::registerCommandForUndo(PassRefPtr<EditCommand> command)
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
 
     if (frame) {
-        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->platformWidget());
+        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->hostWindow()->platformPageClient());
         if (webKitWin) {
-            webKitWin->GetMainFrame()->m_impl->undoStack.append(EditCommandWx(command));
+            webKitWin->m_impl->undoStack.append(EditCommandWx(command));
         }
     }
 }
@@ -297,16 +297,24 @@ void EditorClientWx::registerCommandForRedo(PassRefPtr<EditCommand> command)
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
 
     if (frame) {
-        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->platformWidget());
+        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->hostWindow()->platformPageClient());
         if (webKitWin) {
-            webKitWin->GetMainFrame()->m_impl->redoStack.insert(0, EditCommandWx(command));
+            webKitWin->m_impl->redoStack.insert(0, EditCommandWx(command));
         }
     }
 }
 
 void EditorClientWx::clearUndoRedoOperations()
 {
-    notImplemented();
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    
+    if (frame) {
+        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->hostWindow()->platformPageClient());
+        if (webKitWin) {
+            webKitWin->m_impl->redoStack.clear();
+            webKitWin->m_impl->undoStack.clear();
+        }
+    }
 }
 
 bool EditorClientWx::canUndo() const
@@ -314,9 +322,9 @@ bool EditorClientWx::canUndo() const
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
 
     if (frame) {
-        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->platformWidget());
-        if (webKitWin && webKitWin->GetMainFrame()) {
-            return webKitWin->GetMainFrame()->m_impl->undoStack.size() != 0;
+        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->hostWindow()->platformPageClient());
+        if (webKitWin) {
+            return webKitWin->m_impl->undoStack.size() != 0;
         }
     }
     return false;
@@ -327,9 +335,9 @@ bool EditorClientWx::canRedo() const
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
 
     if (frame) {
-        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->platformWidget());
-        if (webKitWin && webKitWin->GetMainFrame()) {
-            return webKitWin->GetMainFrame()->m_impl->redoStack.size() != 0;
+        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->hostWindow()->platformPageClient());
+        if (webKitWin && webKitWin) {
+            return webKitWin->m_impl->redoStack.size() != 0;
         }
     }
     return false;
@@ -340,10 +348,10 @@ void EditorClientWx::undo()
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
 
     if (frame) {
-        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->platformWidget());
-        if (webKitWin && webKitWin->GetMainFrame()) {
-            webKitWin->GetMainFrame()->m_impl->undoStack.last().editCommand()->unapply();
-            webKitWin->GetMainFrame()->m_impl->undoStack.removeLast();
+        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->hostWindow()->platformPageClient());
+        if (webKitWin) {
+            webKitWin->m_impl->undoStack.last().editCommand()->unapply();
+            webKitWin->m_impl->undoStack.removeLast();
         }
     }
 }
@@ -352,11 +360,11 @@ void EditorClientWx::redo()
 {
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
 
-    if (frame) {
-        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->platformWidget());
-        if (webKitWin && webKitWin->GetMainFrame()) {
-            webKitWin->GetMainFrame()->m_impl->redoStack.first().editCommand()->reapply();
-            webKitWin->GetMainFrame()->m_impl->redoStack.remove(0);
+    if (frame) {    
+        wxWebView* webKitWin = dynamic_cast<wxWebView*>(frame->view()->hostWindow()->platformPageClient());
+        if (webKitWin) {
+            webKitWin->m_impl->redoStack.first().editCommand()->reapply();
+            webKitWin->m_impl->redoStack.remove(0);
         }
     }
 }
diff --git a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
index 9603bd5..0a5eeaf 100644
--- a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
@@ -48,10 +48,13 @@
 #include "ResourceResponse.h"
 #include "ScriptController.h"
 #include "ScriptString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
 
 #include <stdio.h>
 
 #include "WebFrame.h"
+#include "WebFramePrivate.h"
 #include "WebView.h"
 #include "WebViewPrivate.h"
 
@@ -77,7 +80,7 @@ inline int wxNavTypeFromWebNavType(NavigationType type){
 }
 
 FrameLoaderClientWx::FrameLoaderClientWx()
-    : m_frame(0)
+    : m_webFrame(0)
 {
 }
 
@@ -86,9 +89,10 @@ FrameLoaderClientWx::~FrameLoaderClientWx()
 {
 }
 
-void FrameLoaderClientWx::setFrame(Frame *frame)
+void FrameLoaderClientWx::setFrame(wxWebFrame *frame)
 {
-    m_frame = frame;
+    m_webFrame = frame;
+    m_frame = m_webFrame->m_impl->frame;
 }
 
 void FrameLoaderClientWx::setWebView(wxWebView *webview)
@@ -96,11 +100,6 @@ void FrameLoaderClientWx::setWebView(wxWebView *webview)
     m_webView = webview;
 }
 
-void FrameLoaderClientWx::detachFrameLoader()
-{
-    m_frame = 0;
-}
-
 bool FrameLoaderClientWx::hasWebView() const
 {
     return m_webView != NULL;
@@ -339,9 +338,9 @@ void FrameLoaderClientWx::dispatchWillSubmitForm(FramePolicyFunction function,
                                                  PassRefPtr<FormState>)
 {
     // FIXME: Send an event to allow for alerts and cancellation
-    if (!m_frame)
+    if (!m_webFrame)
         return;
-    (m_frame->loader()->*function)(PolicyUse);
+    (m_frame->loader()->policyChecker()->*function)(PolicyUse);
 }
 
 
@@ -505,6 +504,9 @@ void FrameLoaderClientWx::dispatchDidReceiveIcon()
 
 void FrameLoaderClientWx::frameLoaderDestroyed()
 {
+    if (m_webFrame)
+        delete m_webFrame;
+    m_webFrame = 0;
     m_frame = 0;
     delete this;
 }
@@ -536,6 +538,16 @@ bool FrameLoaderClientWx::shouldGoToHistoryItem(WebCore::HistoryItem*) const
     return true;
 }
 
+void FrameLoaderClientWx::didDisplayInsecureContent()
+{
+    notImplemented();
+}
+
+void FrameLoaderClientWx::didRunInsecureContent(WebCore::SecurityOrigin*)
+{
+    notImplemented();
+}
+
 void FrameLoaderClientWx::saveScrollPositionAndViewStateToItem(WebCore::HistoryItem*)
 {
     notImplemented();
@@ -553,7 +565,7 @@ void FrameLoaderClientWx::setMainDocumentError(WebCore::DocumentLoader*, const W
 
 void FrameLoaderClientWx::committedLoad(WebCore::DocumentLoader* loader, const char* data, int length)
 {
-    if (!m_frame)
+    if (!m_webFrame)
         return;
     FrameLoader* fl = loader->frameLoader();
     fl->setEncoding(m_response.textEncodingName(), false);
@@ -693,16 +705,16 @@ Frame* FrameLoaderClientWx::dispatchCreatePage()
 
 void FrameLoaderClientWx::dispatchDecidePolicyForMIMEType(FramePolicyFunction function, const String& mimetype, const ResourceRequest& request)
 {
-    if (!m_frame)
+    if (!m_webFrame)
         return;
     
     notImplemented();
-    (m_frame->loader()->*function)(PolicyUse);
+    (m_frame->loader()->policyChecker()->*function)(PolicyUse);
 }
 
 void FrameLoaderClientWx::dispatchDecidePolicyForNewWindowAction(FramePolicyFunction function, const NavigationAction&, const ResourceRequest& request, PassRefPtr<FormState>, const String& targetName)
 {
-    if (!m_frame)
+    if (!m_webFrame)
         return;
 
     if (m_webView) {
@@ -712,17 +724,17 @@ void FrameLoaderClientWx::dispatchDecidePolicyForNewWindowAction(FramePolicyFunc
         if (m_webView->GetEventHandler()->ProcessEvent(wkEvent)) {
             // if the app handles and doesn't skip the event, 
             // from WebKit's perspective treat it as blocked / ignored
-            (m_frame->loader()->*function)(PolicyIgnore);
+            (m_frame->loader()->policyChecker()->*function)(PolicyIgnore);
             return;
         }
     }
     
-    (m_frame->loader()->*function)(PolicyUse);
+    (m_frame->loader()->policyChecker()->*function)(PolicyUse);
 }
 
 void FrameLoaderClientWx::dispatchDecidePolicyForNavigationAction(FramePolicyFunction function, const NavigationAction& action, const ResourceRequest& request, PassRefPtr<FormState>)
 {
-    if (!m_frame)
+    if (!m_webFrame)
         return;
         
     if (m_webView) {
@@ -732,9 +744,9 @@ void FrameLoaderClientWx::dispatchDecidePolicyForNavigationAction(FramePolicyFun
         
         m_webView->GetEventHandler()->ProcessEvent(wkEvent);
         if (wkEvent.IsCancelled())
-            (m_frame->loader()->*function)(PolicyIgnore);
+            (m_frame->loader()->policyChecker()->*function)(PolicyIgnore);
         else
-            (m_frame->loader()->*function)(PolicyUse);
+            (m_frame->loader()->policyChecker()->*function)(PolicyUse);
         
     }
 }
@@ -752,56 +764,34 @@ void FrameLoaderClientWx::startDownload(const ResourceRequest&)
 PassRefPtr<Frame> FrameLoaderClientWx::createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
                                    const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight)
 {
-/*
-    FIXME: Temporarily disabling code for loading subframes. While most 
-    (i)frames load and are destroyed properly, the iframe created by
-    google.com in its new homepage does not get destroyed when 
-    document()->detach() is called, as other (i)frames do. It is destroyed on 
-    app shutdown, but until that point, this 'in limbo' frame will do things
-    like steal keyboard focus and crash when clicked on. (On some platforms,
-    it is actually a visible object, even though it's not in a valid state.)
-    
-    Since just about every user is probably going to test against Google at 
-    some point, I'm disabling this functionality until I have time to track down
-    why it is not being destroyed.
-*/
-
-/*
-    wxWindow* parent = m_webView;
-
     WebViewFrameData* data = new WebViewFrameData();
     data->name = name;
     data->ownerElement = ownerElement;
     data->url = url;
     data->referrer = referrer;
+    data->allowsScrolling = allowsScrolling;
     data->marginWidth = marginWidth;
     data->marginHeight = marginHeight;
 
-    wxWebView* newWin = new wxWebView(parent, -1, wxDefaultPosition, wxDefaultSize, data);
+    wxWebFrame* newFrame = new wxWebFrame(m_webView, m_webFrame, data);
 
-    RefPtr<Frame> childFrame = newWin->m_impl->frame;
+    RefPtr<Frame> childFrame = adoptRef(newFrame->m_impl->frame);
 
-    // FIXME: All of the below should probably be moved over into WebCore
-    childFrame->tree()->setName(name);
     m_frame->tree()->appendChild(childFrame);
-    // ### set override encoding if we have one
+    childFrame->tree()->setName(name);
+    childFrame->init();
 
-    FrameLoadType loadType = m_frame->loader()->loadType();
-    FrameLoadType childLoadType = FrameLoadTypeInternal;
+    // The creation of the frame may have run arbitrary JavaScript that removed it from the page already.
+    if (!childFrame->page())
+        return 0;
 
-    childFrame->loader()->load(url, referrer, childLoadType,
-                            String(), 0, 0);
+    childFrame->loader()->loadURLIntoChildFrame(url, referrer, childFrame.get());
     
     // The frame's onload handler may have removed it from the document.
     if (!childFrame->tree()->parent())
         return 0;
     
-    delete data;
-    
-    return childFrame.get();
-*/
-    notImplemented();
-    return 0;
+    return childFrame.release();
 }
 
 ObjectContentType FrameLoaderClientWx::objectContentType(const KURL& url, const String& mimeType)
@@ -880,29 +870,19 @@ void FrameLoaderClientWx::transitionToCommittedFromCachedFrame(CachedFrame*)
 
 void FrameLoaderClientWx::transitionToCommittedForNewPage()
 { 
+    ASSERT(m_webFrame);
     ASSERT(m_frame);
     ASSERT(m_webView);
     
-    Page* page = m_frame->page();
-    ASSERT(page);
-
-    bool isMainFrame = m_frame == page->mainFrame();
-
-    m_frame->setView(0);
-
-    RefPtr<FrameView> frameView;
-    if (isMainFrame)
-        frameView = FrameView::create(m_frame, IntRect(m_webView->GetRect()).size());
-    else
-        frameView = FrameView::create(m_frame);
-
-    ASSERT(frameView);
-    m_frame->setView(frameView);
-
-    frameView->setPlatformWidget(m_webView);
-
-    if (HTMLFrameOwnerElement* owner = m_frame->ownerElement())
-        m_frame->view()->setScrollbarModes(owner->scrollingMode(), owner->scrollingMode());
+    IntSize size = IntRect(m_webView->GetRect()).size();
+    // FIXME: This value should be gotten from m_webView->IsTransparent();
+    // but transitionToCommittedForNewPage() can be called while m_webView is
+    // still being initialized.
+    bool transparent = false;
+    Color backgroundColor = transparent ? WebCore::Color::transparent : WebCore::Color::white;
+    
+    if (m_frame)
+        m_frame->createView(size, backgroundColor, transparent, IntSize(), false); 
 }
 
 }
diff --git a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
index 7b44149..bfa162f 100644
--- a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
+++ b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
@@ -33,6 +33,7 @@
 #include "KURL.h"
 #include "ResourceResponse.h"
 
+class wxWebFrame;
 class wxWebView;
 
 namespace WebCore {
@@ -51,9 +52,8 @@ namespace WebCore {
     public:
         FrameLoaderClientWx();
         ~FrameLoaderClientWx();
-        void setFrame(Frame *frame);
+        void setFrame(wxWebFrame *frame);
         void setWebView(wxWebView *webview);
-        virtual void detachFrameLoader();
 
         virtual bool hasWebView() const; // mainly for assertions
 
@@ -150,6 +150,9 @@ namespace WebCore {
         virtual void saveScrollPositionAndViewStateToItem(HistoryItem*);
         virtual bool canCachePage() const;
         
+        virtual void didDisplayInsecureContent();
+        virtual void didRunInsecureContent(SecurityOrigin*);
+
         virtual void setMainDocumentError(DocumentLoader*, const ResourceError&);
         virtual void committedLoad(DocumentLoader*, const char*, int);
         virtual ResourceError cancelledError(const ResourceRequest&);
@@ -207,7 +210,8 @@ namespace WebCore {
         virtual void registerForIconNotification(bool listen = true);
 
     private:
-        Frame *m_frame;
+        wxWebFrame *m_webFrame;
+        Frame* m_frame;
         wxWebView *m_webView;
         ResourceResponse m_response;
         bool m_firstData;
diff --git a/WebKit/wx/WebView.cpp b/WebKit/wx/WebView.cpp
index 6bb1f7c..88b5990 100644
--- a/WebKit/wx/WebView.cpp
+++ b/WebKit/wx/WebView.cpp
@@ -24,10 +24,15 @@
  */
 
 #include "config.h"
+#include "Cache.h"
+#include "ContextMenu.h"
+#include "ContextMenuItem.h"
+#include "ContextMenuController.h"
 #include "CString.h"
 #include "Document.h"
 #include "Element.h"
 #include "Editor.h"
+#include "EmptyClients.h"
 #include "EventHandler.h"
 #include "FocusController.h"
 #include "Frame.h"
@@ -37,19 +42,18 @@
 #include "Logging.h"
 #include "markup.h"
 #include "Page.h"
-#include "ContextMenu.h"
-#include "ContextMenuItem.h"
-#include "ContextMenuController.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformString.h"
 #include "PlatformWheelEvent.h"
+#include "PluginHalterClient.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 #include "Scrollbar.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "SubstituteData.h"
+#include "Threading.h"
 
 #include "ChromeClientWx.h"
 #include "ContextMenuClientWx.h"
@@ -222,6 +226,26 @@ wxWebViewDOMElementInfo::wxWebViewDOMElementInfo() :
 {
 }
 
+static wxWebViewCachePolicy gs_cachePolicy;
+
+/* static */
+void wxWebView::SetCachePolicy(const wxWebViewCachePolicy& cachePolicy)
+{
+    WebCore::Cache* globalCache = WebCore::cache();
+    globalCache->setCapacities(cachePolicy.GetMinDeadCapacity(),
+                               cachePolicy.GetMaxDeadCapacity(),
+                               cachePolicy.GetCapacity());
+
+    // store a copy since there is no getter for Cache values
+    gs_cachePolicy = cachePolicy;
+}
+
+/* static */
+wxWebViewCachePolicy wxWebView::GetCachePolicy()
+{
+    return gs_cachePolicy;
+}
+
 BEGIN_EVENT_TABLE(wxWebView, wxWindow)
     EVT_PAINT(wxWebView::OnPaint)
     EVT_SIZE(wxWebView::OnSize)
@@ -233,7 +257,6 @@ BEGIN_EVENT_TABLE(wxWebView, wxWindow)
     EVT_CHAR(wxWebView::OnKeyEvents)
     EVT_SET_FOCUS(wxWebView::OnSetFocus)
     EVT_KILL_FOCUS(wxWebView::OnKillFocus)
-    EVT_ACTIVATE(wxWebView::OnActivate)
 END_EVENT_TABLE()
 
 IMPLEMENT_DYNAMIC_CLASS(wxWebView, wxWindow)
@@ -265,11 +288,12 @@ bool wxWebView::Create(wxWindow* parent, int id, const wxPoint& position,
 {
     if ( (style & wxBORDER_MASK) == 0)
         style |= wxBORDER_NONE;
-    style |= wxHSCROLL | wxVSCROLL;
     
     if (!wxWindow::Create(parent, id, position, size, style, name))
         return false;
 
+    WTF::initializeThreading();
+
 // This is necessary because we are using SharedTimerWin.cpp on Windows,
 // due to a problem with exceptions getting eaten when using the callback
 // approach to timers (which wx itself uses).
@@ -286,7 +310,7 @@ bool wxWebView::Create(wxWindow* parent, int id, const wxPoint& position,
     WebCore::HTMLFrameOwnerElement* parentFrame = 0;
 
     WebCore::EditorClientWx* editorClient = new WebCore::EditorClientWx();
-    m_impl->page = new WebCore::Page(new WebCore::ChromeClientWx(this), new WebCore::ContextMenuClientWx(), editorClient, new WebCore::DragClientWx(), new WebCore::InspectorClientWx());
+    m_impl->page = new WebCore::Page(new WebCore::ChromeClientWx(this), new WebCore::ContextMenuClientWx(), editorClient, new WebCore::DragClientWx(), new WebCore::InspectorClientWx(), new WebCore::EmptyPluginHalterClient());
     editorClient->setPage(m_impl->page);
     
     m_mainFrame = new wxWebFrame(this);
@@ -312,7 +336,8 @@ wxWebView::~wxWebView()
 {
     m_beingDestroyed = true;
     
-    delete m_mainFrame;
+    if (m_mainFrame && m_mainFrame->GetFrame())
+        m_mainFrame->GetFrame()->loader()->detachFromParent();
     
     delete m_impl->page;
     m_impl->page = 0;   
@@ -484,10 +509,16 @@ void wxWebView::MakeEditable(bool enable)
 
 void wxWebView::OnPaint(wxPaintEvent& event)
 {
-    
     if (m_beingDestroyed || !m_mainFrame)
         return;
-    
+
+    // WebView active state is based on TLW active state.
+    wxTopLevelWindow* tlw = dynamic_cast<wxTopLevelWindow*>(wxGetTopLevelParent(this));
+    if (tlw && tlw->IsActive())
+        m_impl->page->focusController()->setActive(true);
+    else {
+        m_impl->page->focusController()->setActive(false);
+    }
     WebCore::Frame* frame = m_mainFrame->GetFrame();
     if (!frame || !frame->view())
         return;
@@ -502,23 +533,14 @@ void wxWebView::OnPaint(wxPaintEvent& event)
         if (dc.IsOk()) {
             wxRect paintRect = GetUpdateRegion().GetBox();
 
-            WebCore::IntSize offset = frame->view()->scrollOffset();
-#if USE(WXGC)
-            gcdc.SetDeviceOrigin(-offset.width(), -offset.height());
-#endif
-            dc.SetDeviceOrigin(-offset.width(), -offset.height());
-            paintRect.Offset(offset.width(), offset.height());
-
 #if USE(WXGC)
             WebCore::GraphicsContext gc(&gcdc);
 #else
             WebCore::GraphicsContext gc(&dc);
 #endif
             if (frame->contentRenderer()) {
-                if (frame->view()->needsLayout())
-                    frame->view()->layout();
-
-                frame->view()->paintContents(&gc, paintRect);
+                frame->view()->layoutIfNeededRecursive();
+                frame->view()->paint(&gc, paintRect);
             }
         }
     }
@@ -536,9 +558,9 @@ void wxWebView::OnSize(wxSizeEvent& event)
 { 
     if (m_isInitialized && m_mainFrame) {
         WebCore::Frame* frame = m_mainFrame->GetFrame();
-        frame->eventHandler()->sendResizeEvent();
-        frame->view()->layout();
-        frame->view()->adjustScrollbars();
+        frame->view()->setFrameRect(wxRect(wxPoint(0,0), event.GetSize()));
+        frame->view()->forceLayout();
+        frame->view()->adjustViewSize();
     }
       
     event.Skip();
@@ -557,10 +579,7 @@ void wxWebView::OnMouseEvents(wxMouseEvent& event)
 {
     event.Skip();
     
-    if (m_beingDestroyed)
-        return;
-    
-    if (!m_mainFrame)
+    if (!m_impl->page)
         return; 
         
     WebCore::Frame* frame = m_mainFrame->GetFrame();  
@@ -593,13 +612,15 @@ void wxWebView::OnMouseEvents(wxMouseEvent& event)
     WebCore::PlatformMouseEvent wkEvent(event, globalPoint, clickCount);
 
     if (type == wxEVT_LEFT_DOWN || type == wxEVT_MIDDLE_DOWN || type == wxEVT_RIGHT_DOWN || 
-                type == wxEVT_LEFT_DCLICK || type == wxEVT_MIDDLE_DCLICK || type == wxEVT_RIGHT_DCLICK)
+                type == wxEVT_LEFT_DCLICK || type == wxEVT_MIDDLE_DCLICK || type == wxEVT_RIGHT_DCLICK) {
         frame->eventHandler()->handleMousePressEvent(wkEvent);
-    
-    else if (type == wxEVT_LEFT_UP || type == wxEVT_MIDDLE_UP || type == wxEVT_RIGHT_UP)
+        if (!HasCapture())
+            CaptureMouse();
+    } else if (type == wxEVT_LEFT_UP || type == wxEVT_MIDDLE_UP || type == wxEVT_RIGHT_UP) {
         frame->eventHandler()->handleMouseReleaseEvent(wkEvent);
-
-    else if (type == wxEVT_MOTION)
+        while (HasCapture())
+            ReleaseMouse();
+    } else if (type == wxEVT_MOTION || type == wxEVT_ENTER_WINDOW || type == wxEVT_LEAVE_WINDOW)
         frame->eventHandler()->mouseMoved(wkEvent);
 }
 
@@ -608,10 +629,10 @@ void wxWebView::OnContextMenuEvents(wxContextMenuEvent& event)
     m_impl->page->contextMenuController()->clearContextMenu();
     wxPoint localEventPoint = ScreenToClient(event.GetPosition());
 
-    if (!m_mainFrame)
+    if (!m_impl->page)
         return;
         
-    WebCore::Frame* focusedFrame = m_mainFrame->GetFrame();
+    WebCore::Frame* focusedFrame = m_impl->page->focusController()->focusedOrMainFrame();
     if (!focusedFrame->view())
         return;
 
@@ -691,8 +712,8 @@ void wxWebView::Paste()
 void wxWebView::OnKeyEvents(wxKeyEvent& event)
 {
     WebCore::Frame* frame = 0;
-    if (m_mainFrame)
-        frame = m_mainFrame->GetFrame();
+    if (m_impl->page)
+        frame = m_impl->page->focusController()->focusedOrMainFrame();
 
     if (!(frame && frame->view()))
         return;
@@ -833,7 +854,6 @@ void wxWebView::OnSetFocus(wxFocusEvent& event)
         frame = m_mainFrame->GetFrame();
         
     if (frame) {
-        m_impl->page->focusController()->setActive(true);
         frame->selection()->setFocused(true);
     }
 
@@ -847,20 +867,11 @@ void wxWebView::OnKillFocus(wxFocusEvent& event)
         frame = m_mainFrame->GetFrame();
         
     if (frame) {
-        m_impl->page->focusController()->setActive(false);
         frame->selection()->setFocused(false);
     }
     event.Skip();
 }
 
-void wxWebView::OnActivate(wxActivateEvent& event)
-{
-    if (m_impl->page)
-        m_impl->page->focusController()->setActive(event.GetActive());
-
-    event.Skip();
-}
-
 wxWebViewDOMElementInfo wxWebView::HitTest(const wxPoint& pos) const
 {
     if (m_mainFrame)
@@ -869,3 +880,10 @@ wxWebViewDOMElementInfo wxWebView::HitTest(const wxPoint& pos) const
     return wxWebViewDOMElementInfo();
 }
 
+bool wxWebView::ShouldClose() const
+{
+    if (m_mainFrame)
+        return m_mainFrame->ShouldClose();
+
+    return true;
+}
diff --git a/WebKit/wx/WebView.h b/WebKit/wx/WebView.h
index 3e6b8f2..e83c420 100644
--- a/WebKit/wx/WebView.h
+++ b/WebKit/wx/WebView.h
@@ -65,6 +65,35 @@ namespace WebCore {
 extern WXDLLIMPEXP_WEBKIT const wxChar* wxWebViewNameStr;
 #endif
 
+static const int defaultCacheCapacity = 8192 * 1024; // mirrors Cache.cpp
+
+class WXDLLIMPEXP_WEBKIT wxWebViewCachePolicy
+{
+public:
+    wxWebViewCachePolicy(unsigned minDead = 0, unsigned maxDead = defaultCacheCapacity, unsigned totalCapacity = defaultCacheCapacity)
+        : m_minDeadCapacity(minDead)
+        , m_maxDeadCapacity(maxDead)
+        , m_capacity(totalCapacity)
+    {}
+
+    ~wxWebViewCachePolicy() {}
+
+    unsigned GetCapacity() const { return m_capacity; }
+    void SetCapacity(int capacity) { m_capacity = capacity; }
+
+    unsigned GetMinDeadCapacity() const { return m_minDeadCapacity; }
+    void SetMinDeadCapacity(unsigned minDeadCapacity) { m_minDeadCapacity = minDeadCapacity; }
+
+    unsigned GetMaxDeadCapacity() const { return m_maxDeadCapacity; }
+    void SetMaxDeadCapacity(unsigned maxDeadCapacity) { m_maxDeadCapacity = maxDeadCapacity; }
+
+protected:
+    unsigned m_capacity;
+    unsigned m_minDeadCapacity;
+    unsigned m_maxDeadCapacity;
+};
+
+
 // copied from WebKit/mac/Misc/WebKitErrors[Private].h
 enum {
     WebKitErrorCannotShowMIMEType =                             100,
@@ -159,6 +188,11 @@ public:
     wxWebFrame* GetMainFrame() { return m_mainFrame; }
 
     wxWebViewDOMElementInfo HitTest(const wxPoint& pos) const;
+    
+    bool ShouldClose() const;
+      
+    static void SetCachePolicy(const wxWebViewCachePolicy& cachePolicy);
+    static wxWebViewCachePolicy GetCachePolicy();
 
 protected:
 
@@ -171,7 +205,6 @@ protected:
     void OnKeyEvents(wxKeyEvent& event);
     void OnSetFocus(wxFocusEvent& event);
     void OnKillFocus(wxFocusEvent& event);
-    void OnActivate(wxActivateEvent& event);
     
 private:
     // any class wishing to process wxWindows events must use this macro
@@ -299,6 +332,14 @@ private:
     wxPoint m_position;
 };
 
+// copied from page/Console.h
+enum wxWebViewConsoleMessageLevel {
+    TipMessageLevel,
+    LogMessageLevel,
+    WarningMessageLevel,
+    ErrorMessageLevel
+};
+
 class WXDLLIMPEXP_WEBKIT wxWebViewConsoleMessageEvent : public wxCommandEvent
 {
 #ifndef SWIG
@@ -318,10 +359,14 @@ public:
     wxWebViewConsoleMessageEvent( wxWindow* win = (wxWindow*) NULL );
     wxEvent *Clone(void) const { return new wxWebViewConsoleMessageEvent(*this); }
 
+    wxWebViewConsoleMessageLevel GetLevel() const { return m_level; }
+    void SetLevel(wxWebViewConsoleMessageLevel level) { m_level = level; }
+
 private:
     unsigned int m_lineNumber;
     wxString m_message;
     wxString m_sourceID;
+    wxWebViewConsoleMessageLevel m_level;
 };
 
 class WXDLLIMPEXP_WEBKIT wxWebViewAlertEvent : public wxCommandEvent
diff --git a/WebKit/wx/WebViewPrivate.h b/WebKit/wx/WebViewPrivate.h
index c6f24d1..989a579 100644
--- a/WebKit/wx/WebViewPrivate.h
+++ b/WebKit/wx/WebViewPrivate.h
@@ -30,10 +30,10 @@
 #define WXWEBVIEWPRIVATE_H
 
 #include "config.h"
-#include "HTMLFrameOwnerElement.h"
+#include "EditCommand.h"
+#include "EditCommandWx.h"
 #include "Page.h"
-#include "wtf/RefPtr.h"
-#include "KURL.h"
+#include "wtf/Vector.h"
 
 #include <wx/timer.h>
 
@@ -48,19 +48,9 @@ public:
 
     wxTimer tripleClickTimer;
     wxPoint tripleClickPos;
-};
-
-class WebViewFrameData
-{
-public:
-    WebCore::KURL url;
-    WebCore::String name;
-    WebCore::HTMLFrameOwnerElement* ownerElement;
     
-    WebCore::String referrer;
-    bool allowsScrolling;
-    int marginWidth;
-    int marginHeight;    
+    WTF::Vector<EditCommandWx> undoStack;
+    WTF::Vector<EditCommandWx> redoStack;
 };
 
 #endif
diff --git a/WebKit/wx/bindings/python/wscript b/WebKit/wx/bindings/python/wscript
index f9d73c3..41e5d41 100644
--- a/WebKit/wx/bindings/python/wscript
+++ b/WebKit/wx/bindings/python/wscript
@@ -55,13 +55,18 @@ def set_options(opt):
     common_set_options(opt)
 
 def configure(conf):
-    common_configure(conf)
-    conf.check_tool('swig', tooldir='.')
-    conf.check_swig_version('1.3.29')
+    if Options.options.wxpython:
+        common_configure(conf)
+        conf.check_tool('swig', tooldir='.')
+        conf.check_swig_version('1.3.29')
     
 def build(bld):
     if Options.options.wxpython:
-        wx_swig_args = ['-DSWIG_TYPE_TABLE=_wxPython_table', '-DWXP_USE_THREAD=1', '-DSWIG_PYTHON_OUTPUT_TUPLE']
+        defines = ['SWIG_TYPE_TABLE=_wxPython_table', 'WXP_USE_THREAD=1', 'SWIG_PYTHON_OUTPUT_TUPLE']
+        wx_swig_args = []
+        for define in defines:
+            wx_swig_args.append('-D%s' % define)
+
         try:
             import wx.build.config
             wx_swig_args += wx.build.config.swig_args
@@ -76,13 +81,17 @@ def build(bld):
             Logs.warn("Cannot find location of wxPython .i files, wxPython extension will not be built.")
             return
     
+        for inc_path in include_paths:
+            wx_swig_args.append('-I' + inc_path)
+
         obj = bld.new_task_gen(
             features = 'cxx cshlib pyext',
             includes = ' '.join(include_paths),
             source = 'webview.i',
             swig_flags = ' '.join(wx_swig_args),
+            defines = defines,
             target = '_webview',
-            uselib = 'WX CURL ICU XSLT XML SQLITE3 WXWEBKIT ' + waf_configname,
+            uselib = 'WX CURL ICU XSLT XML SQLITE3 WXWEBKIT ' + get_config(),
             
             libpath = [output_dir],
             uselib_local = '',
diff --git a/WebKit/wx/wscript b/WebKit/wx/wscript
index 695ddc3..b5ba580 100644
--- a/WebKit/wx/wscript
+++ b/WebKit/wx/wscript
@@ -40,6 +40,13 @@ include_paths = webkit_dirs + common_includes + ['.', '..',
                 os.path.join(wk_root, 'WebCore', 'platform', 'graphics', 'wx'),
 ]
 
+windows_deps = [
+                'lib/pthreadVC2.dll',
+                'bin/icuuc40.dll', 'bin/icudt40.dll', 'bin/icuin40.dll',
+                'bin/libcurl.dll', 'bin/libeay32.dll', 'bin/ssleay32.dll', 'bin/zlib1.dll',
+                'lib/sqlite3.dll', 'bin/libxml2.dll', 'bin/libxslt.dll', 'bin/iconv.dll',
+                ]
+
 webcore_include_dirs = []
 for dir in webcore_dirs + ['DerivedSources']:
     include_paths.append(os.path.join(wk_root, 'WebCore', dir)) 
@@ -54,15 +61,47 @@ def set_options(opt):
 def configure(conf):
     common_configure(conf)
     
+def pre_build(bld):
+    """
+    The wxWebKit library should be rebuilt if jscore or webcore changes,
+    so we make those static libs as dependencies.
+    """
+    
+    ext = '.a'
+    if sys.platform.startswith('win'):
+        ext = '.lib'
+    
+    libjscore = os.path.join(output_dir, 'libjscore%s' % ext)
+    libwebcore = os.path.join(output_dir, 'libwebcore%s' % ext)
+    
+    assert os.path.exists(libjscore)
+    assert os.path.exists(libwebcore)
+    
+    bld.env.CXXDEPS_JSCORE = Utils.h_file(libjscore)
+    bld.env.CXXDEPS_WEBCORE = Utils.h_file(libwebcore)
+    
 def build(bld):
+    bld.add_pre_fun(pre_build)
+
+    bld.env.LIBDIR = output_dir
+
     obj = bld.new_task_gen(
         features = 'cxx cshlib implib',
         includes = ' '.join(include_paths + js_include_dirs),
         target = 'wxwebkit',
         defines = ['WXMAKINGDLL_WEBKIT'],
-        uselib = 'WX CURL ICU XSLT XML SQLITE3 WEBCORE JSCORE ' + waf_configname,
+        uselib = 'WX CURL ICU XSLT XML SQLITE3 WEBCORE JSCORE ' + get_config(),
         libpath = [output_dir],
         uselib_local = '',
         install_path = output_dir)
         
     obj.find_sources_in_dirs(webkit_dirs)
+
+    if building_on_win32:
+        for wxlib in bld.env['LIB_WX']:
+            wxlibname = os.path.join(bld.env['LIBPATH_WX'][0], wxlib + '_vc.dll')
+            if os.path.exists(wxlibname):
+                bld.install_files(obj.install_path, [wxlibname])
+        
+        for dep in windows_deps:
+            bld.install_files(obj.install_path, [os.path.join(msvclibs_dir, dep)])
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index 66f1e38..6ad863d 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,123 @@
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+        
+        New methods required for video fullscreen.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+        * libWebKitSystemInterfaceTiger.a:
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        Re-apply lost changes to auto-version.sh.
+        
+        * win/tools/scripts/auto-version.sh:
+
+2009-10-02  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7271334> 
+        Rename MediaControllerThemeQT to MediaControllerThemeQuickTime
+
+        * WebKitSystemInterface.h: 
+        MediaControllerThemeQT -> MediaControllerThemeQuickTime
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * win/tools/scripts/PRODUCTVERSION: Removed.
+        * win/tools/scripts/auto-version.sh: Re-worked script to remove references to PRODUCTVERSION.
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKitSystemInterface changes for
+        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
+        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
+
+        * win/include/WebKitSystemInterface/WebKitSystemInterface.h: Added
+        wkAddFontsFromPlistRepresentation() and replaced
+        wkCreateFontsPlistRepresentation() with wkCreateFontsPlist() and
+        wkAddFontsFromPlistRepresentation() with wkAddFontsFromPlist().
+        * win/lib/WebKitSystemInterface.lib:
+        * win/lib/WebKitSystemInterface_debug.lib:
+
+2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Eric Seidel.
+        
+        Added $(WebKitLibrariesDir)/include/cairo so cairo.h is found by
+        default when the necessary dependencies are extracted into the
+        WebKitLibrariesDir.
+        https://bugs.webkit.org/show_bug.cgi?id=29661
+
+        * win/tools/vsprops/WinCairo.vsprops:
+
+2009-09-09  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Dave Levin.
+
+        Adjust WinCairo-specific property sheet to use static versions of
+        libjpeg.lib and libpng.lib.  Change to libpng.lib required addition
+        of zlib.lib to link.
+
+        * win/tools/vsprops/WinCairo.vsprops:
+
+2009-08-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Define _CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES=1
+        to automatically use secure versions of C runtime lib calls on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=28824
+        
+        * win/tools/vsprops/common.vsprops:
+
+2009-08-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber stamped by Steve Falkenburg.
+
+        debug_wincairo.vsprops was linking against wrong C runtime.
+
+        * win/tools/vsprops/debug_wincairo.vsprops: Link to correct
+          C runtime (as in the standard 'debug.vsprops' file.)
+
+2009-08-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Revise CFLite Debug build to emit DLL's with _debug label.
+        https://bugs.webkit.org/show_bug.cgi?id=28695.
+
+        * win/tools/vsprops/debug_wincairo.vsprops: Added.
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Change pattern that strips all trailing whitespace to just remove EOL
+        chars (\r, \n), to make it clear that varying EOL chars is the primary
+        problem being solved.
+
+        * win/tools/scripts/auto-version.sh:
+
 2009-08-10  Peter Kasting  <pkasting@google.com>
 
         Reviewed by George Staikos.
diff --git a/WebKitLibraries/WebKitSystemInterface.h b/WebKitLibraries/WebKitSystemInterface.h
index 0efa2f4..a97e635 100644
--- a/WebKitLibraries/WebKitSystemInterface.h
+++ b/WebKitLibraries/WebKitSystemInterface.h
@@ -216,7 +216,7 @@ typedef enum {
 
 typedef enum {
     WKMediaControllerThemeClassic   = 1,
-    WKMediaControllerThemeQT        = 2
+    WKMediaControllerThemeQuickTime = 2
 } WKMediaControllerThemeStyle;
 
 typedef enum {
@@ -229,6 +229,21 @@ BOOL WKHitTestMediaUIPart(int part, int themeStyle, CGRect bounds, CGPoint point
 void WKMeasureMediaUIPart(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
 void WKDrawMediaUIPart(int part, int themeStyle, CGContextRef context, CGRect rect, unsigned state);
 void WKDrawMediaSliderTrack(int themeStyle, CGContextRef context, CGRect rect, float timeLoaded, float currentTime, float duration, unsigned state);
+NSView *WKCreateMediaUIBackgroundView(void);
+
+typedef enum {
+    WKMediaUIControlTimeline,
+    WKMediaUIControlSlider,
+    WKMediaUIControlPlayPauseButton,
+    WKMediaUIControlExitFullscreenButton,
+    WKMediaUIControlRewindButton,
+    WKMediaUIControlFastForwardButton,
+    WKMediaUIControlVolumeUpButton,
+    WKMediaUIControlVolumeDownButton
+
+} WKMediaUIControlType;
+    
+NSControl *WKCreateMediaUIControl(int controlType);
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && defined(__x86_64__)
 mach_port_t WKInitializeRenderServer(void);
@@ -259,6 +274,11 @@ void WKSetCAAnimationValueFunction(CAPropertyAnimation*, NSString* function);
 unsigned WKInitializeMaximumHTTPConnectionCountPerHost(unsigned preferredConnectionCount);
 
 BOOL WKIsLatchingWheelEvent(NSEvent *);
+
+#ifndef BUILDING_ON_TIGER
+void WKWindowSetAlpha(NSWindow *window, float alphaValue);
+void WKWindowSetScaledFrame(NSWindow *window, NSRect scaleFrame, NSRect nonScaledFrame);
+#endif
     
 #ifdef __cplusplus
 }
diff --git a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
index 1e9e637..60c8017 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
index 61daf46..a4b8ae7 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceTiger.a b/WebKitLibraries/libWebKitSystemInterfaceTiger.a
index 83fa4dc..9ef1695 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceTiger.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceTiger.a
diff --git a/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h b/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
index d2183d4..b5ce097 100644
--- a/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
+++ b/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
@@ -56,8 +56,9 @@ void wkSetFontPlatformInfo(CGFontRef, LOGFONT*, void(*)(void*));
 void wkSetUpFontCache(size_t s);
 void wkAddFontsInDirectory(CFStringRef);
 void wkAddFontsAtPath(CFStringRef);
-void wkAddFontsFromPlistRepresentation(CFDataRef);
-CFDataRef wkCreateFontsPlistRepresentation();
+void wkAddFontsFromRegistry();
+void wkAddFontsFromPlist(CFPropertyListRef);
+CFPropertyListRef wkCreateFontsPlist();
 
 void wkSetPatternBaseCTM(CGContextRef, CGAffineTransform);
 void wkSetPatternPhaseInUserSpace(CGContextRef, CGPoint phasePoint);
diff --git a/WebKitLibraries/win/lib/WebKitSystemInterface.lib b/WebKitLibraries/win/lib/WebKitSystemInterface.lib
index 718f791..d4f9dd9 100644
--- a/WebKitLibraries/win/lib/WebKitSystemInterface.lib
+++ b/WebKitLibraries/win/lib/WebKitSystemInterface.lib
diff --git a/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib b/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
index 02b431a..6d18588 100644
--- a/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
+++ b/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
diff --git a/WebKitLibraries/win/tools/scripts/PRODUCTVERSION b/WebKitLibraries/win/tools/scripts/PRODUCTVERSION
deleted file mode 100644
index aa31e71..0000000
--- a/WebKitLibraries/win/tools/scripts/PRODUCTVERSION
+++ /dev/null
@@ -1 +0,0 @@
-4.0.3
\ No newline at end of file
diff --git a/WebKitLibraries/win/tools/scripts/auto-version.sh b/WebKitLibraries/win/tools/scripts/auto-version.sh
index 06f7667..2e9a9ed 100755
--- a/WebKitLibraries/win/tools/scripts/auto-version.sh
+++ b/WebKitLibraries/win/tools/scripts/auto-version.sh
@@ -29,20 +29,12 @@ VERSIONPATH=$VERSIONPATH/include
 VERSIONFILE=$VERSIONPATH/autoversion.h
 mkdir -p "$VERSIONPATH"
 
-PRODUCTVERSION=`cat $SRCPATH/PRODUCTVERSION | sed -r 's/(.*\S+)\s*$/\1/'`
-MAJORVERSION=`echo "$PRODUCTVERSION" | sed 's/\([^\.]*\)\.\([^.]*\)\(\.\([^.]*\)\)\?/\1/'`
-MINORVERSION=`echo "$PRODUCTVERSION" | sed 's/\([^\.]*\)\.\([^.]*\)\(\.\([^.]*\)\)\?/\2/'`
-TINYVERSION=`echo "$PRODUCTVERSION" | sed 's/\([^\.]*\)\.\([^.]*\)\(\.\([^.]*\)\)\?/\4/'`
-if [ "$TINYVERSION" == "" ]; then
-    TINYVERSION=0
-fi
-
 if [ "$RC_PROJECTSOURCEVERSION" == "" ]; then
     PROPOSEDVERSION=`cat $SRCPATH/VERSION`
 else
     PROPOSEDVERSION="$RC_PROJECTSOURCEVERSION"
 fi
-PROPOSEDVERSION=`echo "$PROPOSEDVERSION" | sed -r 's/(.*\S+)\s*$/\1/'`
+PROPOSEDVERSION=`echo "$PROPOSEDVERSION" | sed -r 's/(.+?)[\r\n]*$/\1/'`
 
 BLDMAJORVERSION=`echo "$PROPOSEDVERSION" | sed 's/\([^\.]*\)\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\1/'`
 BLDMINORVERSION=`echo "$PROPOSEDVERSION" | sed 's/\([^\.]*\)\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\3/'`
@@ -53,25 +45,36 @@ fi
 if [ "$BLDVARIANTVERSION" == "" ]; then
     BLDVARIANTVERSION=0
 fi
-SVNOPENSOURCEREVISION=`svn info | grep '^Revision' | sed -r 's/^Revision: (.*\S+)\s*$/\1/'`
+SVNOPENSOURCEREVISION=`svn info | grep '^Revision' | sed -r 's/^Revision: (.+?)[\r\n]*$/\1/'`
+
+MAJORVERSION=`echo "$PROPOSEDVERSION" | sed 's/\(.\)[^\.]*\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\1/'`
+MINORVERSION=`echo "$PROPOSEDVERSION" | sed 's/.\([^\.]*\)\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\1/'`
+TINYVERSION=`echo "$PROPOSEDVERSION" | sed 's/\([^\.]*\)\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\3/'`
+if [ "$MINORVERSION" == "" ]; then
+    MINORVERSION=0
+fi
+if [ "$TINYVERSION" == "" ]; then
+    TINYVERSION=0
+fi
 
 BLDNMBR="$PROPOSEDVERSION"
 BLDNMBRSHORT="$BLDNMBR"
 
 if [ "$RC_PROJECTSOURCEVERSION" == "" ]; then
     BLDNMBRSHORT="$BLDNMBRSHORT+"
-    BLDUSERNAME=`echo "$(whoami)" | sed -r 's/(.*\S+)\s*$/\1/'`
-    BLDDATE=`echo "$(date)" | sed -r 's/(.*\S+)\s*$/\1/'`
+    BLDUSERNAME=`echo "$(whoami)" | sed -r 's/(.+?)[\r\n]*$/\1/'`
+    BLDDATE=`echo "$(date)" | sed -r 's/(.+?)[\r\n]*$/\1/'`
     BLDNMBR="$BLDNMBRSHORT $BLDUSERNAME - $BLDDATE - r$SVNOPENSOURCEREVISION"
 fi
 
 cat > "$VERSIONFILE" <<EOF
-#define __VERSION_TEXT__ "$PRODUCTVERSION ($BLDNMBR)"
+#define __VERSION_TEXT__ "$BLDNMBR"
 #define __BUILD_NUMBER__ "$BLDNMBR"
 #define __BUILD_NUMBER_SHORT__ "$BLDNMBRSHORT"
 #define __VERSION_MAJOR__ $MAJORVERSION
 #define __VERSION_MINOR__ $MINORVERSION
 #define __VERSION_TINY__ $TINYVERSION
+#define __VERSION_BUILD__ $BLDVARIANTVERSION
 #define __BUILD_NUMBER_MAJOR__ $BLDMAJORVERSION
 #define __BUILD_NUMBER_MINOR__ $BLDMINORVERSION
 #define __BUILD_NUMBER_VARIANT__ $BLDVARIANTVERSION
diff --git a/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops b/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops
index f42c8ec..b3b1e4c 100644
--- a/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops
@@ -7,9 +7,11 @@
 	<Tool

 		Name="VCCLCompilerTool"

 		PreprocessorDefinitions="WIN_CAIRO=1"

+		AdditionalIncludeDirectories="&quot;$(WebKitLibrariesDir)\include\cairo&quot;"

 	/>

 	<Tool

 		Name="VCLinkerTool"

-		AdditionalDependencies="cairo.lib jpeg.lib libpng.lib"

+		AdditionalDependencies="cairo.lib libjpeg.lib zlib.lib libpng.lib"

+		AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\lib&quot;"

 	/>

 </VisualStudioPropertySheet>

diff --git a/WebKitLibraries/win/tools/vsprops/common.vsprops b/WebKitLibraries/win/tools/vsprops/common.vsprops
index 4c7c9df..290db9a 100644
--- a/WebKitLibraries/win/tools/vsprops/common.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/common.vsprops
@@ -9,7 +9,7 @@
 	<Tool
 		Name="VCCLCompilerTool"
 		AdditionalOptions="/GS"
-		PreprocessorDefinitions="WIN32;_WINDOWS;WINVER=0x501;_WIN32_WINNT=0x501;_WIN32_IE=0x600;_CRT_SECURE_NO_DEPRECATE;_SCL_SECURE_NO_DEPRECATE;__PRODUCTION__=0$(ProductionBuild);_HAS_EXCEPTIONS=0;BUILDING_$(ProjectName)"
+		PreprocessorDefinitions="WIN32;_WINDOWS;WINVER=0x501;_WIN32_WINNT=0x501;_WIN32_IE=0x600;_CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES=1;__PRODUCTION__=0$(ProductionBuild);_HAS_EXCEPTIONS=0;BUILDING_$(ProjectName)"
 		ExceptionHandling="0"
 		RuntimeTypeInfo="false"
 		WarningLevel="4"
diff --git a/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops b/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops
new file mode 100644
index 0000000..0e7db13
--- /dev/null
+++ b/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="debug_wincairo"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		Optimization="0"

+		MinimalRebuild="true"

+		BasicRuntimeChecks="3"

+		RuntimeLibrary="2"

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		LinkIncremental="2"

+	/>

+	<UserMacro

+		Name="WebKitConfigSuffix"

+		Value="_debug"

+		PerformEnvironmentSet="true"

+	/>

+	<UserMacro

+		Name="LibraryConfigSuffix"

+		Value=""

+		PerformEnvironmentSet="true"

+	/>

+	<UserMacro

+		Name="WebKitDLLConfigSuffix"

+		Value="_debug"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json
index b650b4c..2b8faf6 100644
--- a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json
+++ b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json
@@ -7,8 +7,15 @@
                     { "name": "apple-xserve-2", "platform": "mac-leopard" },
                     { "name": "apple-xserve-3", "platform": "mac-leopard" },
 
+                    { "name": "apple-xserve-4", "platform": "mac-snowleopard" },
+                    { "name": "apple-xserve-5", "platform": "mac-snowleopard" },
+                    { "name": "apple-xserve-6", "platform": "mac-snowleopard" },
+
                     { "name": "apple-pixel-1", "platform": "mac-leopard" },
 
+                    { "name": "apple-macpro-1", "platform": "mac-snowleopard" },
+                    { "name": "apple-macpro-2", "platform": "mac-snowleopard" },
+
                     { "name": "apple-windows-1", "platform": "win"},
                     { "name": "apple-windows-2", "platform": "win"},
                     { "name": "apple-windows-3", "platform": "win"},
@@ -16,7 +23,9 @@
 
                     { "name": "gtk-linux-slave-1", "platform": "gtk"},
 
-                    { "name": "szeged-linux-1", "platform": "qt"}
+                    { "name": "szeged-linux-1", "platform": "qt"},
+
+                    { "name": "google-slave-1", "platform": "chromium-win" }
                   ],
 
     "builders":   [ { "name": "Tiger Intel Release", "type": "BuildAndTest", "builddir": "tiger-intel-release",
@@ -43,6 +52,19 @@
                       "platform": "mac-leopard", "configuration": "debug", "architectures": ["i386"],
                       "slavenames": ["apple-xserve-3", "test-slave"]
                     },
+                    { "name": "SnowLeopard Intel Release (Build)", "type": "Build", "builddir": "snowleopard-intel-release",
+                      "platform": "mac-snowleopard", "configuration": "release", "architectures": ["x86_64"],
+                      "triggers": ["snowleopard-intel-release-tests"],
+                      "slavenames": ["apple-xserve-4", "test-slave"]
+                    },
+                    { "name": "SnowLeopard Intel Release (Tests)", "type": "Test", "builddir": "snowleopard-intel-release-tests",
+                      "platform": "mac-snowleopard", "configuration": "release", "architectures": ["x86_64"],
+                      "slavenames": ["apple-xserve-5", "apple-xserve-6", "test-slave"]
+                    },
+                    { "name": "SnowLeopard Intel Leaks", "type": "BuildAndTestLeaks", "builddir": "snowleopard-intel-leaks",
+                      "platform": "mac-snowleopard", "configuration": "debug", "architectures": ["x86_64"],
+                      "slavenames": ["apple-macpro-1", "test-slave"]
+                    },
                     {
                       "name": "Windows Release (Build)", "type": "Build", "builddir": "win-release",
                       "platform": "win", "configuration": "release", "architectures": ["i386"],
@@ -74,13 +96,20 @@
                       "name": "Qt Linux Release", "type": "BuildAndTest", "builddir": "qt-linux-release",
                       "platform": "qt", "configuration": "release", "architectures": ["i386"],
                       "slavenames": ["szeged-linux-1"]
+                    },
+                    {
+                      "name": "Chromium Win Release", "type": "ChromiumBuild", "builddir": "chromium-win-release",
+                      "platform": "chromium-win", "configuration": "release", "architectures": ["i386"],
+                      "slavenames": ["google-slave-1"]
                     }
                   ],
 
     "schedulers": [ { "type": "AnyBranchScheduler", "name": "trunk", "branches": ["trunk"], "treeStableTimer": 45.0,
                       "builderNames": ["Tiger Intel Release", "Leopard Intel Release (Build)", "Leopard Intel Debug (Build)",
+                                       "SnowLeopard Intel Release (Build)", "SnowLeopard Intel Leaks",
                                        "Windows Release (Build)", "Windows Debug (Build)",
-                                       "GTK Linux Release", "Qt Linux Release"]
+                                       "GTK Linux Release", "Qt Linux Release",
+                                       "Chromium Win Release"]
                     },
                     { "type": "Triggerable", "name": "leopard-intel-release-tests",
                       "builderNames": ["Leopard Intel Release (Tests)"]
@@ -88,6 +117,9 @@
                     { "type": "Triggerable", "name": "leopard-intel-debug-tests",
                       "builderNames": ["Leopard Intel Debug (Tests)"]
                     },
+                    { "type": "Triggerable", "name": "snowleopard-intel-release-tests",
+                      "builderNames": ["SnowLeopard Intel Release (Tests)"]
+                    },
                     { "type": "Triggerable", "name": "win-release-tests",
                       "builderNames": ["Windows Release (Tests)"]
                     },
diff --git a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg
index 4d92436..6219b0d 100644
--- a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg
+++ b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg
@@ -13,6 +13,7 @@ from buildbot.status.builder import SUCCESS, FAILURE, WARNINGS, SKIPPED
 
 from twisted.internet import defer
 
+import re
 import simplejson
 
 WithProperties = properties.WithProperties
@@ -47,6 +48,55 @@ class CheckOutSource(source.SVN):
         source.SVN.__init__(self, baseURL=self.baseURL, defaultBranch="trunk", mode=self.mode, *args, **kwargs)
 
 
+# FIXME: Remove this step once Chromium WebKit port build system is decoupled from
+# Chromium (https://bugs.webkit.org/show_bug.cgi?id=28396)
+class UpdateChromiumSource(shell.ShellCommand):
+    command = ["gclient", "sync"]
+    name = "update-chromium"
+    description = ["updating chromium source"]
+    descriptionDone = ["updated"]
+    haltOnFailure = True
+
+    def createSummary(self, log):
+        scraper = re.compile(r"^________ running '[^\n]+third_party[/\\]WebKit[^\n]+$\n(?:^[UA]\W+[^\n]+$\n)*^(?:Updated to|At) revision (\d+)", re.DOTALL | re.MULTILINE)
+        revisions = scraper.findall(log.getText())
+        gotRevision = "??" # This matches SVN unknown revision response.
+        if len(revisions):
+            gotRevision = "r%s" % revisions[-1]
+        self.descriptionDone = ["updated", gotRevision]
+
+    def start(self):
+        os = self.getProperty("fullPlatform").split('-')[1]
+        if os == "win":
+            self.setCommand(["gclient.bat", "sync"])
+        revision = self.getProperty("revision")
+        if revision:
+            command = self.command[:]
+            command.append("--revision=src/third_party/WebKit@%d" % revision)
+            self.setCommand(command)
+        return shell.ShellCommand.start(self)
+
+
+# FIXME: Remove this step once Chromium WebKit port build system is decoupled from
+# Chromium (https://bugs.webkit.org/show_bug.cgi?id=28396)
+class CompileChromiumWebKit(shell.ShellCommand):
+    command = ["python", "../../../scripts/slave/compile.py"]
+    name = "build-chromium"
+    description = ["compiling"]
+    descriptionDone = ["compiled"]
+    haltOnFailure = True
+
+    def start(self):
+        os = self.getProperty("fullPlatform").split('-')[1]
+        command = self.command[:]
+        if os == "win":
+            command.extend(["--solution=webkit.sln", "--build-dir=src\\webkit", "--", "/project", "webcore"])
+        elif os == "mac":
+            command.extend(["--solution=__solution__", "--build-dir=src/build", "--", "-project", "../webkit/webkit.xcodeproj", "-target", "webcore"])
+        self.setCommand(command)
+        return shell.ShellCommand.start(self)
+
+
 class InstallWin32Dependencies(shell.Compile):
     description = ["installing dependencies"]
     descriptionDone = ["installed dependencies"]
@@ -188,13 +238,19 @@ class RunWebKitTests(shell.Test):
                 incorrectLayoutLines.append(line)
             elif line.find('test case') >= 0 and (line.find(' crashed') >= 0 or line.find(' timed out') >= 0):
                 incorrectLayoutLines.append(line)
+            elif line.startswith("WARNING:") and line.find(' leak') >= 0:
+                incorrectLayoutLines.append(line.replace('WARNING: ', ''))
+
+            # FIXME: Detect and summarize leaks of RefCounted objects
 
         self.incorrectLayoutLines = incorrectLayoutLines
 
     def evaluateCommand(self, cmd):
         if self.incorrectLayoutLines:
-            if len(self.incorrectLayoutLines) == 1 and (self.incorrectLayoutLines[0].find('were new') >= 0 or self.incorrectLayoutLines[0].find('was new') >= 0):
-                return WARNINGS
+            if len(self.incorrectLayoutLines) == 1:
+                line = self.incorrectLayoutLines[0]
+                if line.find('were new') >= 0 or line.find('was new') >= 0 or line.find(' leak') >= 0:
+                    return WARNINGS
 
             return FAILURE
 
@@ -213,6 +269,12 @@ class RunWebKitTests(shell.Test):
         return [self.name]
 
 
+class RunWebKitLeakTests(RunWebKitTests):
+    def start(self):
+        self.setCommand(self.command + ["--leaks"])
+        return RunWebKitTests.start(self)
+
+
 class ArchiveTestResults(shell.ShellCommand):
     command = ["python", "./WebKitTools/BuildSlaveSupport/test-result-archive",
                WithProperties("--platform=%(platform)s"), WithProperties("--%(configuration)s"), "archive"]
@@ -257,6 +319,15 @@ class Factory(factory.BuildFactory):
         if platform == "win":
             self.addStep(InstallWin32Dependencies)
 
+# FIXME: Remove this factory once Chromium WebKit port build system is decoupled from
+# Chromium (https://bugs.webkit.org/show_bug.cgi?id=28396)
+class ChromiumBuildFactory(factory.BuildFactory):
+    def __init__(self, platform, configuration, architectures):
+        factory.BuildFactory.__init__(self)
+        self.addStep(ConfigureBuild, platform=platform, configuration=configuration, architecture=" ".join(architectures), buildOnly=True)
+        self.addStep(UpdateChromiumSource)
+        self.addStep(CompileChromiumWebKit)
+
 class BuildFactory(Factory):
     def __init__(self, platform, configuration, architectures, triggers):
         Factory.__init__(self, platform, configuration, architectures, True)
@@ -277,15 +348,19 @@ class TestFactory(Factory):
         self.addStep(ExtractTestResults)
 
 class BuildAndTestFactory(Factory):
+    TestClass = RunWebKitTests
     def __init__(self, platform, configuration, architectures):
         Factory.__init__(self, platform, configuration, architectures, False)
         self.addStep(CompileWebKit)
         self.addStep(RunJavaScriptCoreTests)
-        self.addStep(RunWebKitTests)
+        self.addStep(self.TestClass)
         self.addStep(ArchiveTestResults)
         self.addStep(UploadTestResults)
         self.addStep(ExtractTestResults)
 
+class BuildAndTestLeaksFactory(BuildAndTestFactory):
+    TestClass = RunWebKitLeakTests
+
 
 def loadBuilderConfig(c):
     passwords = simplejson.load(open('passwords.json'))
diff --git a/WebKitTools/ChangeLog b/WebKitTools/ChangeLog
index 93d94cd..6a8a912 100644
--- a/WebKitTools/ChangeLog
+++ b/WebKitTools/ChangeLog
@@ -1,3 +1,3639 @@
+2009-10-08  Adam Roben  <aroben@apple.com>
+
+        Use QueryInterface to get IWebInspectorPrivate
+
+        Fixes <http://webkit.org/b/30215> Make IWebInspectorPrivate be
+        accessed in a more standard way
+
+        Reviewed by John Sullivan and Tim Hatcher.
+
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::evaluateInWebInspector): Get the IWebInspector
+        by calling IWebViewPrivate::inspector, then use QueryInterface to get
+        to the IWebInspectorPrivate interface.
+
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Implement DRT support for origin whitelisting
+
+        Fixes <http://webkit.org/b/30185>.
+
+        Reviewed by Eric Seidel.
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetWebViewToConsistentStateBeforeTesting): Reset any origin
+        whitelist, to match Mac DRT.
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::whiteListAccessFromOrigin): Call through to
+        IWebViewPrivate::whiteListAccessFromOrigin.
+
+2009-10-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Send title changes to the global history delegate.
+        <rdar://problem/7285293> and https://webkit.org/b/29904
+
+        * DumpRenderTree/mac/HistoryDelegate.mm:
+        (-[HistoryDelegate webView:updateHistoryTitle:forURL:]):
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Remove some folks from committers.py who were listed on
+        the WebKit Team wiki page but who weren't actually listed as commit+.
+        At some point, we should coorelate this list with the committers
+        mailing list.
+
+        * Scripts/modules/committers.py:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Import a bunch of committers from the WebKit Team page on
+        the wiki into committers.py.
+
+        * Scripts/modules/committers.py:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Added Aaron Boodman to committers.py.
+
+        * Scripts/modules/committers.py:
+
+2009-10-07  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add API to LayoutTestController for re/setting the system locale.
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (setLocaleCallback):
+        (LayoutTestController::staticFunctions):
+        (LayoutTestController::setLocale):
+        * DumpRenderTree/LayoutTestController.h:
+
+2009-10-06  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Jan Alonzo.
+
+        [Layout tests] [Gtk] Gtk DumpRenderTree should use WebKit test fonts
+        https://bugs.webkit.org/show_bug.cgi?id=29689
+
+        Build fix by adding -lfontconfig for DumpRenderTree.
+
+        * GNUmakefile.am:
+
+2009-10-07  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Re-enable use-remote-links-to-tests for Qt. Disabled in r46416.
+
+        * Scripts/run-webkit-tests:
+
+2009-10-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        "delete" in EventSender is the backspace key, not the delete one.
+
+        * DumpRenderTree/gtk/EventSender.cpp:
+        (keyDownCallback):
+
+2009-10-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        getChildrenWithRange expects as last parameter the end index, not
+        the length of the range. Correct this and clarify the variable
+        names to reflect how the code works.
+
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::getChildrenWithRange):
+        (AccessibilityUIElement::getChildAtIndex):
+
+2009-10-06  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <http://webkit.org/b/30138> update-webkit-localizable-strings assumes that WebKitTools/Scripts is in the PATH
+
+        * Scripts/update-webkit-localizable-strings: Use an explicit path to extract-localizable-strings based on the
+        the fact we have already changed the working directory to the top of the open source tree.
+
+2009-10-06  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed. Fixing the entry for myself in committers.py to use my bugzilla email,
+        rather than my committer email.
+
+        * Scripts/modules/committers.py:
+
+2009-10-06  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] LayoutTestController: Reset m_dumpStatusCallbacks to false in reset().
+
+        r49189 added support for the 'dumpStatusCallbacks' setting but didn't reset
+        it after each layout test as it should do, making the DRT dump additional output
+        for all of the subsequent layout tests.
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (LayoutTestController::reset):
+
+2009-10-06  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement layoutTestController.dumpStatusCallbacks() and unskip the
+        fast/dom/assign-to-window-status.html test, which is passing as a result.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30127
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::DumpRenderTree):
+        (WebCore::DumpRenderTree::statusBarMessage):
+        * DumpRenderTree/qt/DumpRenderTree.h:
+        * DumpRenderTree/qt/jsobjects.h:
+        (LayoutTestController::shouldDumpStatusCallbacks):
+        (LayoutTestController::dumpStatusCallbacks):
+
+2009-10-06  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] The implementation of EventSender::mouseUp() and EventSender::mouseDown()
+        ignores the argument indicating which mouse button to trigger.
+        https://bugs.webkit.org/show_bug.cgi?id=30048
+
+        This affects the fast/events/mouse-click-events.html layout test.
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (EventSender::mouseDown):
+        (EventSender::mouseUp):
+        * DumpRenderTree/qt/jsobjects.h:
+
+2009-10-06  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the EventSender::keyDown() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=30043
+
+        It should post both a key press event and a key release event,
+        just like other ports do.
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (EventSender::keyDown):
+
+2009-10-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add jpeg to the list of libs to link against.
+
+        * wx/build/settings.py:
+
+2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] EventSender::keyDown() cannot send function-key events.
+        https://bugs.webkit.org/show_bug.cgi?id=30044
+
+        This affects the fast/events/keydown-function-keys.html layout test.
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (EventSender::keyDown):
+
+2009-10-05  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Added --wx-compiler-prefix waf option to allow building wxWebKit with
+        wxWidgets built using "nmake COMPILER_PREFIX=something-non-default".
+
+        * wx/build/settings.py:
+        * wx/build/wxpresets.py:
+
+2009-10-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add testing harness for Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30010
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (showWebInspectorCallback):
+        (closeWebInspectorCallback):
+        (evaluateInWebInspectorCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::showWebInspector):
+        (LayoutTestController::closeWebInspector):
+        (LayoutTestController::evaluateInWebInspector):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::showWebInspector):
+        (LayoutTestController::closeWebInspector):
+        (LayoutTestController::evaluateInWebInspector):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::showWebInspector):
+        (LayoutTestController::closeWebInspector):
+        (LayoutTestController::evaluateInWebInspector):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::showWebInspector):
+        (LayoutTestController::closeWebInspector):
+        (LayoutTestController::evaluateInWebInspector):
+
+2009-10-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariyha Hidayat.
+
+        Pass arguments to system() as a string instead of array
+
+        When passed as an array entries with a space fail to translate
+        to two arguments to the child process, so instead of manually
+        splitting all the entries in @buildArgs we pass the whole thing
+        as a string instead.
+
+        * Scripts/webkitdirs.pm:
+
+2009-10-04  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Levin.
+
+        check-webkit-style misses whitespace errors for operators:
+        <<, >>, <<=, >>=, &=, |=, +=, -=, *=, /=, /, |, &&, ||.
+        https://bugs.webkit.org/show_bug.cgi?id=30021
+
+        * Scripts/modules/cpp_style.py:
+        Added the operators mentioned above to the same list as == and !=.
+
+2009-10-02  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed.
+
+        Adding myself and Ojan Vafai as committers, because we are committers.
+
+        * Scripts/modules/committers.py:
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        svn-create-patch should have an --ignore-changelogs to not add ChangeLogs to the diff,
+        this will help the patch merging process when TryBots are used.
+
+        * Scripts/svn-create-patch:
+
+2009-10-02  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement layoutTestController.overridePreference().
+        https://bugs.webkit.org/show_bug.cgi?id=29970
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::WebPage):
+        (WebCore::WebPage::resetSettings):
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (LayoutTestController::reset):
+        (LayoutTestController::setPrivateBrowsingEnabled):
+        (LayoutTestController::setPopupBlockingEnabled):
+        (LayoutTestController::overridePreference):
+        * DumpRenderTree/qt/jsobjects.h:
+
+2009-10-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn on ENABLE_3D_CANVAS in TOT
+        https://bugs.webkit.org/show_bug.cgi?id=29906
+
+        * Scripts/build-webkit:
+
+2009-10-01  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Simon Hausmann.
+
+        Enable HTTP tests for Qt
+
+        * Scripts/run-webkit-tests:
+
+2009-10-01  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        build-webkit --chromium now also works on cygwin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29973
+
+        * Scripts/webkitdirs.pm:
+
+2009-10-01  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Don't use TCmalloc in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=27029
+
+        Add USE_SYSTEM_MALLOC macro to the DRT's profile to avoid using TCmalloc in Qt's DRT.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+
+2009-10-01  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement eventSender.scheduleAsynchronousClick().
+
+        https://bugs.webkit.org/show_bug.cgi?id=29931
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (EventSender::scheduleAsynchronousClick):
+        * DumpRenderTree/qt/jsobjects.h:
+
+2009-10-01  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement setPopupBlockingEnabled() in the LayoutTestController and remove
+        fast/events/open-window-from-another-frame.html from the Skipped list.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29930
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (LayoutTestController::setPopupBlockingEnabled):
+        * DumpRenderTree/qt/jsobjects.h:
+
+2009-09-30  Cameron McCormack  <cam@mcc.id.au>
+
+        Unreviewed.
+
+        Added myself to the list of committers.
+
+        * Scripts/modules/committers.py:
+
+2009-09-30  Eric Seidel  <eric@webkit.org>
+
+        No review, just adding Geoff to the list of reviewers.
+
+        * Scripts/modules/committers.py:
+
+2009-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added the WebKit Layout Tests fonts that are referenced in
+        LayoutTests/platform/win/css2.1/resources/Mac-compatible-font-fallback.css
+
+        * DumpRenderTree/fonts/WebKit Layout Tests 2.ttf: Added.
+        * DumpRenderTree/fonts/WebKit Layout Tests.ttf: Added.
+
+2009-09-30  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by David Kilzer.
+
+        Make sunspider scripts work on Windows platform.
+        https://bugs.webkit.org/show_bug.cgi?id=29656
+
+        * Scripts/run-sunspider: Perl scripts invoked with same Perl interpreter.
+        * Scripts/sunspider-compare-results: Perl scripts invoked with same Perl interpreter.
+        * Scripts/webkitdirs.pm: currentPerlPath() added.
+
+2009-09-29  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Dan Bernstein.
+
+        Fix license and some sorting in new files.
+
+        * DumpRenderTree/mac/HistoryDelegate.h:
+        * DumpRenderTree/mac/HistoryDelegate.mm:
+
+2009-09-29  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        Fixed how error codes are handled.
+        https://bugs.webkit.org/show_bug.cgi?id=29898
+
+        * Scripts/update-webkit:
+        * Scripts/update-webkit-chromium:
+
+2009-09-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Updated way-out-of-date sorting throughout the dump methods/flags.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (dumpAsPDFCallback):
+        (dumpAsTextCallback):
+        (dumpFrameLoadCallbacksCallback):
+        (dumpResourceLoadCallbacksCallback):
+        (LayoutTestController::staticFunctions):
+
+        * DumpRenderTree/LayoutTestController.h:
+        (LayoutTestController::dumpAsText):
+        (LayoutTestController::setDumpAsText):
+        (LayoutTestController::dumpFrameLoadCallbacks):
+        (LayoutTestController::setDumpFrameLoadCallbacks):
+        (LayoutTestController::dumpSelectionRect):
+        (LayoutTestController::setDumpSelectionRect):
+        (LayoutTestController::dumpSourceAsWebArchive):
+        (LayoutTestController::setDumpSourceAsWebArchive):
+        (LayoutTestController::dumpStatusCallbacks):
+        (LayoutTestController::setDumpStatusCallbacks):
+        (LayoutTestController::dumpTitleChanges):
+        (LayoutTestController::setDumpTitleChanges):
+        (LayoutTestController::dumpWillCacheResponse):
+        (LayoutTestController::setDumpWillCacheResponse):
+
+2009-09-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by John Sullivan.
+
+        WebKit Mac API should provide a delegate interface for global history.
+        <rdar://problem/7042773> and https://webkit.org/b/29904
+
+        Adding the dumping of global history delegate callbacks.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+
+        Automatically dump history delegate callbacks for tests with "globalhistory/" in their URL:
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (createWebViewAndOffscreenWindow):
+        (allocateGlobalControllers):
+        (shouldLogFrameLoadDelegates):
+        (shouldLogHistoryDelegates):
+        (runTest):
+
+        Dump history delegate callbacks:
+        * DumpRenderTree/mac/HistoryDelegate.h: Added.
+        * DumpRenderTree/mac/HistoryDelegate.mm: Added.
+        (-[HistoryDelegate webView:didNavigateWithNavigationData:inFrame:]):
+        (-[HistoryDelegate webView:didPerformClientRedirectFromURL:toURL:inFrame:]):
+        (-[HistoryDelegate webView:didPerformServerRedirectFromURL:toURL:inFrame:]):
+
+2009-09-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28902
+        
+        Fixes an issue where the drop effect returned by Window Dump Render Tree 
+        was always DROPEFFECT_NONE (since it was hard coded to do so).
+        
+        This patch corrects this issue by determining the actual drop effect 
+        performed by the corresponding drag-and-drop operation so that we can 
+        return it.
+
+        * DumpRenderTree/win/DraggingInfo.h: Added field m_dropEffect to store performed drop effect.
+        (DraggingInfo::DraggingInfo):
+        (DraggingInfo::performedDropEffect): Added method.
+        (DraggingInfo::setPerformedDropEffect): Added method.
+        * DumpRenderTree/win/EventSender.cpp:
+        (doMouseUp): Calls method DraggingInfo::setPerformedDropEffect with performed drop effect.
+        Moved delete draggingInfo to UIDelegate::doDragDrop.
+        * DumpRenderTree/win/UIDelegate.cpp:
+        (UIDelegate::doDragDrop): Sets performedDropEffect to DraggingInfo::performedDropEffect().
+
+2009-09-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Remove copying of unnecessary or nonexistent files from the ImageDiff
+        post-build event.
+
+        * DumpRenderTree/win/ImageDiff.vcproj:
+
+2009-09-29  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by David Kilzer.
+
+        [Qt] Make build-webkit script work on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=29802
+
+        * Scripts/run-webkit-tests:
+        * Scripts/webkitdirs.pm:
+         - Removed unnecessary -p switch for mkdir on Windows.
+         - Use canonical path, which uses slashes or backslashes depends on platform.
+         - isWindows() only test for Windows and not for Cyqwin.
+
+2009-09-29  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Fix time measurement in build-webkit after refactoring done in r48853.
+
+        * Scripts/build-webkit:
+
+2009-09-29  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Default font size reconciliation to 16px/13px to match other platform's de-facto standard.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=19674.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::WebPage):
+
+2009-09-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement eventSender.contextClick().
+        https://bugs.webkit.org/show_bug.cgi?id=29821
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (EventSender::contextClick):
+        * DumpRenderTree/qt/jsobjects.h:
+
+2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add experimentalWebSocketsEnabled in WebPreferences.
+        https://bugs.webkit.org/show_bug.cgi?id=28941
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+
+2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        Integrated chromium port building into webkit tools update-webkit and
+        build-webkit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29749
+
+        * Scripts/build-webkit: When --chromium is specified, will build
+          the chromium port (currently only Mac is supported).
+        * Scripts/update-webkit: When --chromium is specified, delegates to
+          update-webkit-chromium.
+        * Scripts/webkitdirs.pm: Added chromium specific defs.
+        * Scripts/update-webkit-chromium: Uses gclient and gyp to fetch
+          chromium port's dependencies and update its project files.
+
+2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed.
+
+        Add myself to list of committers.
+
+        * Scripts/modules/committers.py:
+
+2009-09-27  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        run-webkit-tests: Do not strip the metrics when there is no expected result for a test.
+        https://bugs.webkit.org/show_bug.cgi?id=29771
+
+        * Scripts/run-webkit-tests:
+
+2009-09-27  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement layoutTestController.waitForPolicyDelegate.
+        https://bugs.webkit.org/show_bug.cgi?id=25037
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::acceptNavigationRequest):
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (LayoutTestController::reset):
+        (LayoutTestController::notifyDone):
+        (LayoutTestController::waitForPolicyDelegate):
+        * DumpRenderTree/qt/jsobjects.h:
+        (LayoutTestController::waitForPolicy):
+
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29764> mark-bug-fixed: add -o|--open switch
+
+        Reviewed by Eric Seidel.
+
+        The -o|--open switch uses the open(1) command on Mac OS X to
+        open the bug URL in the default web browser.  If there are
+        similar mechanisms on other platforms, they may be added later.
+
+        * Scripts/mark-bug-fixed:
+        (MarkBugFixed.__init__): Added -o|--open switch to list of parse
+        options.
+        (MarkBugFixed._determine_bug_id_and_svn_revision): Moved logging
+        code into main() and extracted prompting code into
+        _prompt_user_for_correctness().
+        (MarkBugFixed._open_bug_in_web_browser): Added.
+        (MarkBugFixed._prompt_user_for_correctness): Added.
+        (MarkBugFixed.main): Added logging code from
+        _determine_bug_id_and_svn_revision().  Added code to call
+        _open_bug_in_web_browser() if the switch is set.  Added code to
+        call _prompt_user_for_correctness() when needed.
+        * Scripts/modules/bugzilla.py:
+        (Bugzilla.short_bug_url_for_bug_id): Added.
+
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        svn-unapply and svn-apply don't work when used outside multiple svn working directories
+
+        <http://webkit.org/b/29744>
+        <rdar://problem/7252905>
+
+        Reviewed by Eric Seidel.
+
+        Some users have a workflow where svn-create-patch, svn-apply and
+        svn-unapply are used outside of multiple svn working
+        directories.  Instead of aborting the scripts in these cases,
+        print a warning and assume that Subversion is being used.
+
+        * Scripts/VCSUtils.pm:
+        (determineVCSRoot): Call warn() instead of die() if both isGit()
+        and isSVN() initially return false.  Set $VCSUtils::isSVN to 1
+        to enforce the assumption about Subversion, then return
+        determineSVNRoot().
+        * Scripts/svn-apply: Switch to using isGit() and isSVN() from
+        VCSUtils.pm.  They both already cache their values and checking
+        here is redundant since determineVCSRoot() is called later.
+
+2009-09-26  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Layout tests] [Gtk] Gtk DumpRenderTree should use WebKit test fonts
+        https://bugs.webkit.org/show_bug.cgi?id=29689
+
+        Load test fonts through FontConfig before each test.
+        This ensures a more proper rendering of the tests.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (initializeFonts):
+        (runTest):
+        (main):
+        * DumpRenderTree/gtk/fonts.conf: Copied from WebKitTools/DumpRenderTree/qt/fonts.conf.
+        * GNUmakefile.am:
+
+2009-09-25  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29718> mark-bug-fixed: add -u|--update-only switch
+
+        Reviewed by Eric Seidel.
+
+        * Scripts/mark-bug-fixed:
+        (MarkBugFixed.__init__): Added -u|--update-only switch to list
+        of parse options.
+        (MarkBugFixed.main): When -u|--update-only is specified, add a
+        comment to the bug without marking it Resolved/Fixed.
+
+2009-09-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        * Scripts/prepare-ChangeLog: Leave files from the script-tests directory
+        out, just as we do for the resources directory.
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Added Tony to committers.py because he's a
+        committer now.
+
+        * Scripts/modules/committers.py:
+
+2009-09-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION: media/video-pause-empty-events.html is occasionally timing out on bots
+        https://bugs.webkit.org/show_bug.cgi?id=28624
+
+        Disable hardware compositing on Leopard for versions of QuickTime 7.6.4 and older.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+
+2009-09-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue should auto-retry patches which fail to commit due to out of date files
+        https://bugs.webkit.org/show_bug.cgi?id=28316
+
+        * Scripts/bugzilla-tool:
+         - Handle new CheckoutNeedsUpdate exception.
+        * Scripts/modules/logging_unittest.py:
+         - Call the ScriptError constructor correctly (this test had regressed).
+        * Scripts/modules/scm.py:
+         - Added the ability to define custom error handlers for run_command
+           and added a commit_error_handler which throws CheckoutNeedsUpdate
+           instead of ScriptError.
+         - Re-ordered ScriptError constructor arguments to make ScriptError("message text") usage possible.
+        * Scripts/modules/scm_unittest.py:
+         - Added tests of new error handlers.
+
+2009-09-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue should give better feedback when failing a patch
+        https://bugs.webkit.org/show_bug.cgi?id=29316
+
+        * Scripts/bugzilla-tool:
+         - Update ScriptError uses to the new constructor format.
+         - Move CommitQueue._run_command to WebKitLandingScripts.run_command_with_teed_output
+           so that we can print to both stdout as well as an output buffer for error reporting.
+         - Update run_and_throw_if_fail to use teed output so that it can report the "output" as part of ScriptError.
+         - Use e.message_with_output() when failing a patch (this is the real fix here).
+           I also removed use of "This patch will require manual commit." as that's not always true.
+         - Add missing word "bug" from log message.
+        * Scripts/modules/scm.py:
+         - Make ScriptError save a bunch more data so that error messages can be nicer.
+         - Update ScriptError callers.
+
+2009-09-24  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Enable switch for notifications (experimental) in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=28930
+
+        Now that desktop notifications are controlled by run-time switch,
+        set that switch to true for DumpRenderTree.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/win/UIDelegate.cpp:
+        (UIDelegate::QueryInterface):
+
+2009-09-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. SnowLeopard fixes for Mac dependencies.
+
+        * wx/build/build_utils.py:
+        * wx/build/settings.py:
+        * wx/install-unix-extras:
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Add support for DRT to send mouse wheel events.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29348
+        [Gtk] Scrollwheel on horizontal scrollbars should slide horizontally
+
+        * DumpRenderTree/gtk/EventSender.cpp:
+        (mouseWheelToCallback):
+
+2009-09-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Levin.
+
+        commit-queue needs web-based status reporting
+        https://bugs.webkit.org/show_bug.cgi?id=29307
+
+        Add a first-pass web-based status for the commit-queue.
+        The bot is currently reachable at:
+        http://webkit-commit-queue.appspot.com/
+
+        * CommitQueueStatus/app.yaml: Added.
+         - Application description file required by App Engine.
+        * CommitQueueStatus/filters/__init__.py: Added.
+         - Required by python to treat 'filters' as a module.
+        * CommitQueueStatus/filters/webkit_extras.py: Added.
+         - Support for turning 'bug 123' and 'patch 123' into links.
+           This lets us use plain text strings in our logs yet display nice HTML (help prevent XSS attacks on the page).
+        * CommitQueueStatus/index.html: Added.
+        * CommitQueueStatus/index.yaml: Added.
+         - Some auto-generated file from app engine.
+        * CommitQueueStatus/queue_status.py: Added.
+         - The core logic of this bot.  We could eventually split this file out into pieces.
+        * CommitQueueStatus/stylesheets/main.css: Added.
+         - Some basic lame-o CSS to make the page look less awful.
+        * CommitQueueStatus/update_status.html: Added.
+         - The form that the commit-queue (or a human) can use to update the status.
+        * Scripts/bugzilla-tool:
+         - Add some very basic update_status calls.
+        * Scripts/modules/statusbot.py: Added.
+         - Knows how to post to the CommitQueueStatus web application.
+
+2009-09-24  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29712> mark-bug-fixed: add -m|--comment switch
+
+        Reviewed by Adam Roben.
+
+        * Scripts/mark-bug-fixed:
+        (MarkBugFixed.__init__): Added -m|--comment switch to list of
+        parse options.
+        (MarkBugFixed.main): When specified, prepend comment from
+        -m|--comment command-line switch to the bug comment.
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] DRT must display window instead of just realizing, to enable synthesizing events correctly
+        https://bugs.webkit.org/show_bug.cgi?id=29693
+
+        Show the window, to be able to synthesize events correctly.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (runTest):
+        (main):
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY(rollout)
+
+        Roll out r48712 as it is incorrect.
+
+        * DumpRenderTree/mac/ObjCController.m:
+        (+[ObjCController isSelectorExcludedFromWebScript:]):
+        (+[ObjCController webScriptNameForSelector:]):
+
+2009-09-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29005
+        The indices of RuntimeArray should be enumerated like for a regular array.
+
+        * DumpRenderTree/mac/ObjCController.m:
+        (+[ObjCController isSelectorExcludedFromWebScript:]):
+        (+[ObjCController webScriptNameForSelector:]):
+        (-[ObjCController arrayOfString]):
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28910> Move bugzilla-tool mark-fixed to standalone mark-bug-fixed tool
+
+        Reviewed by Darin Adler.
+
+        Also fixed a bug where specifying a revision on the command-line
+        as 'r12345' would fail.  See <http://webkit.org/b/29699>.
+
+        * Scripts/bugzilla-tool: Updated module import statements.
+        (parse_bug_id): Removed.  Moved to bugzilla.py.
+        (bug_comment_from_svn_revision): Removed.  Moved to comments.py.
+        (bug_comment_from_commit_text): Removed.  Moved to comments.py.
+        (MarkBugFixed): Removed.  Code moved to mark-bug-fixed.
+        (BugzillaTool.__init__): Removed mark-fixed subcommand.
+        * Scripts/mark-bug-fixed: Added.
+        * Scripts/modules/bugzilla.py:
+        (parse_bug_id): Added.  Moved from bugzilla-tool.
+        * Scripts/modules/comments.py: Added.
+        (bug_comment_from_svn_revision): Added.  Moved from bugzilla-tool.
+        (bug_comment_from_commit_text): Added.  Moved from bugzilla-tool.
+
+2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Eric Seidel.
+        
+         jpeg.lib is now libjpeg.lib in DRT Cairo dependencies. return
+         "false" in non-implemented stub for setAlwaysAcceptCookies.
+         https://bugs.webkit.org/show_bug.cgi?id=29661
+
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+
+2009-09-23  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] need to dump number of pending unload handlers
+        https://bugs.webkit.org/show_bug.cgi?id=29685
+
+        Implement dumping of the number of pending unload handlers.
+
+        The following tests will pass:
+
+          fast/loader/unload-form-about-blank.html
+          fast/loader/unload-form-post-about-blank.html
+          fast/loader/unload-form-post.html
+          fast/loader/unload-form.html
+          fast/loader/unload-hyperlink.html
+          fast/loader/unload-javascript-url.html
+          fast/loader/unload-reload.html
+          fast/loader/unload-window-location.html
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (getFrameNameSuitableForTestResult):
+        (webViewLoadFinished):
+
+2009-09-22  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        js tests should move into jstests subdirectory instead of resources/
+        https://bugs.webkit.org/show_bug.cgi?id=25880
+
+        Remove support of resources directory.
+
+        * Scripts/make-script-test-wrappers:
+
+2009-09-22  Eric Seidel  <eric@webkit.org>
+
+        No review, only fixing typo (missing space character).
+
+        Fix typo from https://bugs.webkit.org/show_bug.cgi?id=29220
+
+        * Scripts/run-webkit-tests:
+
+2009-09-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        run-webkit-tests needs a --repeat-each=N option (AAABBBCCC instead of ABCABCABC)
+        https://bugs.webkit.org/show_bug.cgi?id=29220
+
+        * Scripts/run-webkit-tests:
+
+2009-09-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        svn-apply can't handle single-line binary file additions
+        https://bugs.webkit.org/show_bug.cgi?id=29100
+
+        Fixed the regexp and added a unit test.
+
+        * Scripts/modules/scm_unittest.py:
+        * Scripts/svn-apply:
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        post-diff and post-commits should be able to find bug urls in ChangeLogs.
+        https://bugs.webkit.org/show_bug.cgi?id=29206
+
+        * Scripts/bugzilla-tool:
+         - Share common options by adding a PostDiffAsPatchToBug.posting_options() method.
+         - Rename --no-comment to --add-log-as-comment and reverse behavior.
+           Comments tend to just be noise.  I'll eventually remove this argument if no one uses it.
+         - Split out code into helper functions to try and make execute() more legible.
+         - Make post-diff find the bug url in the ChangeLogs if not passed as an argument.
+         - Fallback to bug urls in commit diffs, instead of just in commit messages,
+           meaning post-commits will now find bug urls in ChangeLogs.
+
+2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        --parse-only parameter wasn't passed to SunSpider/sunspider script.
+        https://bugs.webkit.org/show_bug.cgi?id=29611
+
+        * Scripts/run-sunspider: Missing parameter passing added.
+
+2009-09-20  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29521> run-webkit-tests: use require instead eval to load DumpRenderTreeSupport module
+
+        Reviewed by Mark Rowe.
+
+        The require statement is like the use statement, except that it
+        is run during script execution instead of during the 'BEGIN'
+        phase.  This makes it possible to change @INC before the require
+        statement is run.  See 'require' and 'use' in the perlfunc(1)
+        manpage and 'BEGIN' in perlmod(1) manpage.
+
+        * Scripts/run-webkit-tests: Replace eval statement with require
+        statement.
+
+2009-09-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes. Fix the config name under git and allow users to specify
+        their own waf install for experimenting with new versions.
+
+        * Scripts/webkitdirs.pm:
+        * wx/build/settings.py:
+
+2009-09-18  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added checkWebCoreMathMLSupport and hasMathMLSupport to support 
+        checking for whether MathML tests should be run
+
+        * Scripts/run-webkit-tests:
+        * Scripts/webkitdirs.pm:
+
+2009-08-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Break more of run-webkit-tests into separate functions
+        https://bugs.webkit.org/show_bug.cgi?id=29497
+
+        Some small steps toward improving run-webkit-tests. My goal is to
+        refactor much more of the script into functions. Later we can add
+        parallel test running to the tool. But better structure may help
+        even if someone decides to translate this into another scripting
+        language instead.
+
+        * Scripts/run-webkit-tests: Break more pieces of the script into
+        seprate functions. Added readSkippedFiles, findTestsToRun, and
+        printResults functions. Removed custom code to skip results.html
+        and instead just put it into the ignoredFiles hash. Fixed some
+        indentation. Sorted function declarations, global variables,
+        and options at the top of the file alphabetically so they're not
+        in a semi-random order.
+
+2009-09-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, add missing dependency.
+
+        * wx/browser/wscript:
+
+2009-09-16  Mark Rowe  <mrowe@apple.com>
+
+        Split the SnowLeopard build across a few machines.
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json:
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix to support monolithic builds on Windows.
+
+        * wx/build/wxpresets.py:
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, improve debug support and 2.9 support on MSW.
+
+        * wx/build/settings.py:
+        * wx/build/wxpresets.py:
+
+2009-09-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Blind try at fixing new test failure on Windows.
+
+        * DumpRenderTree/win/FrameLoadDelegate.cpp:
+        (FrameLoadDelegate::didReceiveTitle):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added mathml toggle
+
+        * Scripts/build-webkit:
+
+2009-09-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Allow waf build to support Python < 2.6.
+
+        * wx/build/waf_extensions.py:
+
+2009-09-14  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add LayoutTests infrastructure to enable and disable webgl tests.
+        https://bugs.webkit.org/show_bug.cgi?id=29254
+
+        * Scripts/run-webkit-tests:
+        * Scripts/webkitdirs.pm:
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Add --iterations option to run-webkit-tests to repeat the tests N times
+        https://bugs.webkit.org/show_bug.cgi?id=29263
+
+        When run with --iterations N, run-webkit-tests will repeat the tests N times.
+
+        * Scripts/run-webkit-tests:
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Not reviewed, maybe should've been:
+
+        Cleaning up more Windows-specific fallout from the fix for:
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        * DumpRenderTree/win/ResourceLoadDelegate.cpp:
+        (ResourceLoadDelegate::didReceiveAuthenticationChallenge):  Correct printf() formatter, 
+          and call the correct method to get the Sender.
+
+2009-09-14  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        GTK build fix.
+
+        Unreviewed.
+
+        * DumpRenderTree/gtk/AccessibilityControllerGtk.cpp:
+        (AccessibilityController::setLogScrollingStartEvents):
+
+2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        DRT/test part of
+        <rdar://problem/7197644> WebKit should broadcast an MSAA event when
+        jumping to a named anchor
+
+        https://bugs.webkit.org/show_bug.cgi?id=28899
+
+        Reviewed by Adam Roben.
+
+        * DumpRenderTree/AccessibilityController.cpp:
+        (logScrollingStartEventsCallback):
+        Turn on logging of scrolling start events.
+        (AccessibilityController::getJSClass):
+        Add a "logScrollingStartEvents" to the AccessibilityController's JS
+        class definition.
+        (AccessibilityController::resetToConsistentState):
+        Turn off logging of scrolling start events.
+
+        * DumpRenderTree/AccessibilityController.h:
+        Declare setLogScrollingStartEvents(). Add a member for the scrolling
+        start event hook.
+
+        * DumpRenderTree/mac/AccessibilityControllerMac.cpp:
+        (AccessibilityController::setLogScrollingStartEvents):
+        Stubbed.
+
+        * DumpRenderTree/win/AccessibilityControllerWin.cpp:
+        (AccessibilityController::AccessibilityController):
+        Initialize the handle to 0.
+        (logEventProc):
+        Renamed from logFocusEventProc; now logs scrolling start events, too.
+        Removed the assertion that the event is a focus event. Added a switch
+        to print a message for focus, scrolling start, and other, unknown
+        events.
+        (AccessibilityController::setLogFocusEvents):
+        Changed to use logEventProc.
+        (AccessibilityController::setLogScrollingStartEvents):
+        If turning logging off, unhook the scrolling start event hook, and clear
+        the member holding the handle. If turning on, query for the root
+        accessible, so that accessibility is enabled for the WebView, and call
+        SetWinEventHook to setup an event hook using logEventProc as the
+        callback function.
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (setAuthenticationPasswordCallback):
+        (setAuthenticationUsernameCallback):
+        
+        * DumpRenderTree/win/ResourceLoadDelegate.cpp:
+        (ResourceLoadDelegate::didReceiveAuthenticationChallenge):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Safari 4 cannot be used to update firmware on Linksys routers.
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        Add the ability for DRT to handle authentication challenges.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (setAuthenticationPasswordCallback):
+        (setAuthenticationUsernameCallback):
+        (setHandlesAuthenticationChallengesCallback):
+        (LayoutTestController::staticFunctions):
+
+        * DumpRenderTree/LayoutTestController.h:
+        (LayoutTestController::handlesAuthenticationChallenges):
+        (LayoutTestController::setHandlesAuthenticationChallenges):
+        (LayoutTestController::authenticationUsername):
+        (LayoutTestController::setAuthenticationUsername):
+        (LayoutTestController::authenticationPassword):
+        (LayoutTestController::setAuthenticationPassword):
+
+        * DumpRenderTree/mac/ResourceLoadDelegate.mm:
+        (-[ResourceLoadDelegate webView:resource:didReceiveAuthenticationChallenge:fromDataSource:]):
+
+        * DumpRenderTree/win/ResourceLoadDelegate.cpp:
+        (ResourceLoadDelegate::didReceiveAuthenticationChallenge):
+        * DumpRenderTree/win/ResourceLoadDelegate.h:
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Test for <rdar://problem/6954546> and <rdar://problem/7090444>.
+
+        Add a flag on the test plug-in that asks it to clear the document during the call to NPP_New.
+        This is the trigger for both <rdar://problem/6954546> and <rdar://problem/7090444>.
+
+        * DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp:
+        (NPP_New):
+
+2009-09-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for non-wxPython builds and a fix for errors when updating swig.py.
+
+        * wx/build/build_utils.py:
+        * wx/build/settings.py:
+
+2009-09-14  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for windows build.
+
+        * Scripts/bisect-builds: Add missing paranthesis for tmpdir function.
+
+2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Fix typo accidently landed in last commit.
+
+        * wx/build/settings.py:
+
+2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, error out if using the wrong Python.
+
+        * wx/build/settings.py:
+
+2009-09-13  Xan Lopez  <xlopez@igalia.com>
+
+        Build fix for GTK+ < 2.14.
+
+        Do not use gtk_widget_get_window, access the window directly
+        through the struct.
+
+        * DumpRenderTree/gtk/EventSender.cpp:
+        (contextClickCallback):
+        (mouseDownCallback):
+        (mouseUpCallback):
+        (mouseMoveToCallback):
+        (keyDownCallback):
+
+2009-09-13  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez and Jan Alonzo.
+
+        [GTK] EventSender does not set 'window' property on synthesized GDK events
+        https://bugs.webkit.org/show_bug.cgi?id=29169
+
+        Set the window property on synthesized GDK events in the GTK+ EventSender.
+
+        * DumpRenderTree/gtk/EventSender.cpp:
+        (contextClickCallback):
+        (mouseDownCallback):
+        (mouseUpCallback):
+        (mouseMoveToCallback):
+        (keyDownCallback):
+
+2009-09-12  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Mark Rowe.
+
+        run-webkit-tests has a timeout value that is too low
+        https://bugs.webkit.org/show_bug.cgi?id=29223
+
+        * Scripts/run-webkit-tests:
+        Changed timeout value to 20 seconds to avoid timing out too early.
+
+2009-09-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Mark dependencies as mandatory and declare which MSVC versions and
+        architectures are supported for building wxWebKit.
+
+        * wx/build/settings.py:
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Levin.
+
+        bugzilla-tool rollout threw exception under svn
+        https://bugs.webkit.org/show_bug.cgi?id=29211
+
+        * Scripts/modules/scm.py: add missing return, and convert number arguments to strings.
+        * Scripts/modules/scm_unittest.py: add testing for this fix.
+
+2009-09-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Add myself to the committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool land-patches should only fail-fast in --commit-queue mode
+        https://bugs.webkit.org/show_bug.cgi?id=29201
+
+        * Scripts/bugzilla-tool:
+
+2009-09-11  Adam Roben  <aroben@apple.com>
+
+        Make commit-log-editor move common prefixes to the top of the log
+
+        Fies <http://webkit.org/b/29190> commit-log-editor should move common
+        prefixes to the top of the commit log
+
+        Reviewed by Darin Adler.
+
+        * Scripts/commit-log-editor: Find and remove the longest common prefix
+        ending in a double newline from each ChangeLog entry, then put that
+        common prefix at the top of the commit log.
+        (removeLongestCommonPrefixEndingInDoubleNewline): Added. Finds,
+        removes, and returns the longest common prefix ending in a double
+        newline from a hash of strings
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        Fix obvious typo in previous commit, no review.
+
+        bugzilla-tool should automate rollouts
+        https://bugs.webkit.org/show_bug.cgi?id=26715
+
+        * Scripts/bugzilla-tool: add back missing "scm" argument.
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool should automate rollouts
+        https://bugs.webkit.org/show_bug.cgi?id=26715
+
+        bugzilla-tool rollout will do the rollout locally and leave the diff for you to verify and commit.
+        The --complete-rollout option will automatically land and update the bug.
+        Eventually --complete-rollout will be default, but that will require more testing.
+
+        This first pass is good enough for others to try and file bugs about.
+
+        * Scripts/bugzilla-tool:
+         - Move modified_changelogs into scm.py.
+         - Move svn_revision_from_commit_text logic into scm.py.
+         - Add RolloutCommit command.
+        * Scripts/modules/bugzilla.py:
+         - Add reopen_bug command used by RolloutCommit.
+        * Scripts/modules/scm.py:
+         - Add functions to support RolloutCommit.
+         - Abstract find_uuid into value_from_svn_info so it can be re-used for _repository_url (needed by svn merge).
+         - Add a str() call so that svn_commit_log can take a numeric argument.
+         - Remove a bunch of very slow code from last_svn_commit_log and used the built-in 'BASE' alias instead.
+         - Made dry_run commits return something that svn_revision_from_commit_text can parse.
+        * Scripts/modules/scm_unittest.py:
+         - Add read_from_path for easy file reading.
+         - Put test4 on a new line to make reverts work w/o conflict.
+         - Add an "svn update" call so that the checkout revision matches the server revision.
+         - Add tests for svn_revision_from_commit_text.
+         - Add a simple test for apply_reverse_diff.
+         - Add a new self.scm member and use it in the new tests (eventually other tests can use it too).
+         - Add test for svn_commit_log to make sure my 'BASE' change above worked as expected.
+
+2009-09-11  Adam Roben  <aroben@apple.com>
+
+        Get user script/stylesheet tests running on Windows
+
+        Fixes <http://webkit.org/b/29181> User script/stylesheet tests are
+        skipped on Windows
+
+        Reviewed by John Sullivan.
+
+        * DumpRenderTree/win/DumpRenderTree.vcproj: Link all configurations
+        against comsuppw.lib so we can use _bstr_t.
+
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp: Fixed #include
+        order, added #include of comutil.h for _bstr_t.
+
+        (bstrT): Helper function to convert a JSStringRef to a _bstr_t.
+        (LayoutTestController::addUserScript):
+        (LayoutTestController::addUserStyleSheet):
+        Implemented. Implementations were based on those in
+        LayoutTestControllerMac.mm.
+
+2009-09-10  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29147> run-webkit-tests:  make -h show help 
+
+        Reviewed by Mark Rowe.
+
+        * Scripts/run-webkit-tests: Updated to make -h switch show help.
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add WebCore/websockets directory in wx build system.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+
+        * wx/build/settings.py:
+
+2009-09-10  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        [GTK] EventSender does not properly convert some keyDown strings
+        https://bugs.webkit.org/show_bug.cgi?id=29119
+
+        Add more keyDown string to character code conversions for GTK+ EventSender.
+
+        * DumpRenderTree/gtk/EventSender.cpp:
+        (keyDownCallback):
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Geolocation Coordinates::toString() prints bogus values for unspecified properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29080
+
+        * Scripts/make-script-test-wrappers: Modified. Adds asynchronous Geolocation tests to exclusion list.
+
+2009-09-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Eric Carlson.
+
+        reviewer/committer lookups are backwards
+        https://bugs.webkit.org/show_bug.cgi?id=29113
+
+        I also moved Eric Carlson from the committer list to the reviewer list now that he is one.
+
+        * Scripts/modules/bugzilla.py:
+        * Scripts/modules/committers.py:
+
+2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        svn-unapply doesn't revert directories correctly
+        https://bugs.webkit.org/show_bug.cgi?id=29065
+
+        * Scripts/svn-unapply: Make svnStatus consistently return status
+        lines including a newline.
+        * Scripts/svn-apply: Keep svnStatus in sync with the one in
+        svn-unapply, in lieu of moving it to a common file.
+
+2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        svn-apply doesn't handle changes to files copied to new directories properly
+        https://bugs.webkit.org/show_bug.cgi?id=29059
+
+        * Scripts/svn-apply: Don't treat "--- revision 0" patches as being
+        additions if we know that we've just copied a file to this name.
+
+2009-09-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Levin.
+
+        commit-queue hangs if a builder has never built
+        https://bugs.webkit.org/show_bug.cgi?id=29091
+
+        * Scripts/modules/buildbot.py:
+        * Scripts/modules/buildbot_unittest.py:
+
+2009-09-09  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] DumpRenderTree needs eventSender object and implementation
+        https://bugs.webkit.org/show_bug.cgi?id=25990
+
+        Implements most of the EventSender object's functionality for
+        the DumpRenderTree tool. Implementation still lacks support
+        for drag and drop tests and forward leaps.
+
+        Based on work by Holger Hans Peter Freyther.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (runTest): Focus on the view before loading a new test.
+        (webViewWindowObjectCleared):
+        * DumpRenderTree/gtk/EventSender.cpp: Added.
+        (getDragModeCallback):
+        (setDragModeCallback):
+        (leapForwardCallback):
+        (contextClickCallback):
+        (updateClickCount):
+        (mouseDownCallback):
+        (mouseUpCallback):
+        (mouseMoveToCallback):
+        (beginDragWithFilesCallback):
+        (replaySavedEvents):
+        (keyDownCallback):
+        (textZoomInCallback):
+        (textZoomOutCallback):
+        (zoomPageInCallback):
+        (zoomPageOutCallback):
+        (getClass):
+        (makeEventSender):
+        * DumpRenderTree/gtk/EventSender.h: Added.
+        * GNUmakefile.am: Add build rules for EventSender.
+
+2009-09-09  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Roben.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28953
+
+        Added pre- and post- build events so that on build failure, the file 
+        buildfailed is written to the directory $(WebKitOutputDir).
+
+        * WinLauncher/WinLauncher.vcproj:
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed.
+
+        Add myself to list of committers.
+
+        * Scripts/modules/committers.py:
+
+2009-09-08  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Levin.
+
+        commit-queue gets stuck if a non-committer sets commit-queue+ or review+
+        https://bugs.webkit.org/show_bug.cgi?id=28605
+        https://bugs.webkit.org/show_bug.cgi?id=28916
+
+        * Scripts/bugzilla-tool:
+         - Fix comment and adjust reject_patch_from_commit_queue call to pass "manual commit"
+           comment now that it's used for rejecting patches for invalid committers too.
+         - Pass reject_invalid_patches=True for commit-queue calls, normally we just ignore patches with invalid reviewers, the commit-queue rejects them.
+         - Make the commit queue print patches count instead of bugs count, this also fixes https://bugs.webkit.org/show_bug.cgi?id=28916.
+        * Scripts/modules/bugzilla.py:
+         - Make _parse_attachment_element not validate reviewer/committer.
+         - Share flag parsing code in _parse_attachment_flag.
+         - Add _validate* methods for validating reviewers and committers and updating bugs when validation fails.
+         - Add reject_invalid_patches argument so the commit-queue can update bugs on failed validation and other "read only" commands will not.
+         - Add reject_patch_from_review_queue using a new _set_flag_on_attachment abstraction.
+        * Scripts/modules/bugzilla_unittest.py:
+         - Update this test to no longer expect committer/reviewer validation.
+        * Scripts/modules/committers.py:
+         - Return None on failed lookups instead of raising Exceptions.
+        * Scripts/modules/committers_unittest.py:
+         - Update tests to expect None returns instead of exceptions.
+
+2009-09-09  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29061> Fix obvious copy-paste error in AccessibilityUIElement::clickPointY()
+
+        Reviewed by Mark Rowe.
+
+        No change to layout test results.
+
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::clickPointY): Changed to return y value
+        instead of x value.
+
+2009-09-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Reduce dglazkov's boboiness by properly concatenating revision value.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg: Used substitution
+            rather than "+".
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxWebKit Python extension build fix - get swig.py if it doesn't exist.
+
+        * wx/build/build_utils.py:
+
+2009-09-08  Mark Rowe  <mrowe@apple.com>
+
+        Fix an incorrect variable name in UpdateChromiumSource.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+
+2009-09-08  Mark Rowe  <mrowe@apple.com>
+
+        Don't check for leaks on the release SnowLeopard builder.
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json:
+
+2009-09-08  Mark Rowe  <mrowe@apple.com>
+
+        Add a SnowLeopard release builder.
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json:
+
+2009-09-08  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove end of line whitespace check from check-webkit-style.
+        https://bugs.webkit.org/show_bug.cgi?id=29053
+
+        * Scripts/modules/cpp_style.py:
+
+2009-09-08  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Darin Adler.
+
+        Fix DumpRenderTree build from clean tree on Tiger
+        https://bugs.webkit.org/show_bug.cgi?id=28927
+
+        * DumpRenderTree/mac/PerlSupport/Makefile: Ensure the
+        DerivedSources/DumpRenderTree directory exists when
+        building on Tiger.
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after introduction of platform/mock directory.
+
+        * wx/build/settings.py:
+
+2009-09-08  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed.
+
+        Add myself to list of committers.
+
+        * Scripts/modules/committers.py:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        Add myself to list of committers.
+
+        * Scripts/modules/committers.py:
+
+2009-09-08  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Darin Adler.
+
+        prepare-ChangeLog too chatty on file additions
+        https://bugs.webkit.org/show_bug.cgi?id=29019
+
+        * Scripts/prepare-ChangeLog: Omit description of added properties
+        on newly added files.
+
+2009-09-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a LayoutTestController method to set the permission state for Geolocation.
+        This is required to use the mock Geolocation service for testing.
+        https://bugs.webkit.org/show_bug.cgi?id=29027
+
+        * DumpRenderTree/LayoutTestController.cpp: Modified.
+        (setDatabaseQuotaCallback): Modified. Style fix.
+        (setGeolocationPermissionCallback): Added. Sets the Geolocation permission state.
+        (LayoutTestController::staticFunctions): Modified. Registers the above function on the LayoutTestController.
+        * DumpRenderTree/LayoutTestController.h: Modified.
+        (LayoutTestController::setGeolocationPermission): Added. Sets the Geolocation permission state.
+        (LayoutTestController::isGeolocationPermissionSet): Added. Returns whether the Geolocation permission has been set.
+        (LayoutTestController::geolocationPermission): Added. Returns the Geolocation permission state.
+        * DumpRenderTree/mac/UIDelegate.mm: Modified.
+        (-[UIDelegate webView:frame:requestGeolocationPermission:securityOrigin:]): Added. Implement chrome method to respond to request for Geolocation permission state. Response is made using above methods to access permission state.
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QtWebKit single API to enable persistency
+        https://bugs.webkit.org/show_bug.cgi?id=28682
+
+        Use the new enablePersistentStorage API instead 
+        of enabling all persistent features one-by-one.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::WebPage):
+        (WebCore::DumpRenderTree::DumpRenderTree):
+
+2009-09-07  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Refactor --strict switch to --ignore-metrics and correct the
+        implementation to make the feature usable on all platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=28907
+
+        run-webkit-tests --ignore-metrics strips the font related metrics from
+        the actual and expected data before comparing them.
+        In this way the render trees can be checked for obvious differences but
+        a successful test implies by no means that the layout is actually correct.
+
+        * Scripts/run-webkit-tests:
+
+2009-09-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
+        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
+        Geolocation service with DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=28264
+
+        * DumpRenderTree/LayoutTestController.cpp: Modified.
+        (setMockGeolocationPositionCallback): Added. Configures the mock Geolocation service.
+        (setMockGeolocationErrorCallback): Added. Configures the mock Geolocation service.
+        (LayoutTestController::staticFunctions): Added. Registers the above functions on the LayoutTestController.
+        * DumpRenderTree/LayoutTestController.h: Modified.
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm: Modified.
+        (LayoutTestController::setMockGeolocationPosition): Added. Configures the mock Geolocation service.
+        (LayoutTestController::setMockGeolocationError): Added. Configures the mock Geolocation service.
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        * Scripts/build-webkit:
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx SVN trunk.
+
+        * wx/build/settings.py:
+
+2009-09-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switch USE_ defines over to the compiler so that they can be
+        checked by files not including config.h (like WebCorePrefix.h).
+
+        * wx/build/settings.py:
+
+2009-09-04  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.
+
+        Update declaration of FrameLoadDelegate to reflect that
+        IWebFrameLoadDelegatePrivate2 inherits from
+        IWebFrameLoadDelegatePrivate.
+
+        * DumpRenderTree/win/FrameLoadDelegate.h:
+
+2009-09-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Add testing instrumentation for mixed content.
+
+        * DumpRenderTree/mac/FrameLoadDelegate.mm:
+        (-[FrameLoadDelegate webView:]):
+        (-[FrameLoadDelegate webView:didRunInsecureContent:]):
+        * DumpRenderTree/win/FrameLoadDelegate.cpp:
+        (descriptionSuitableForTestResult):
+        (FrameLoadDelegate::QueryInterface):
+        (FrameLoadDelegate::didDisplayInsecureContent):
+        (FrameLoadDelegate::didRunInsecureContent):
+        * DumpRenderTree/win/FrameLoadDelegate.h:
+
+2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Frames support
+        https://bugs.webkit.org/show_bug.cgi?id=19041
+
+        * wx/build-wxwebkit:
+
+2009-09-02  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28880> svn-apply --force doesn't actually work
+
+        Reviewed by Eric Seidel.
+
+        This fixes "svn-apply --force" and adds unit tests for the
+        scm.apply_patch() method which uses this script.
+
+        * Scripts/svn-apply: Created $globalExitCode variable that
+        defaults to 0.  Exit with a value of $globalExitCode when the
+        script is finished.
+        (applyPatch): Ignore a non-zero $exitCode if $force is true, but
+        set $globalExitCode to $exitCode so that svn-apply exits with a
+        non-zero status if any patches did not apply cleanly.  Also
+        print out the actual patch command if $force was not true.
+
+        * Scripts/modules/scm.py:
+        (scripts_directory): Added.  Extracted from script_path().
+        (script_path): Extracted scripts_directory().
+        * Scripts/modules/scm_unittest.py: Import urllib.
+        (SVNTestRepository.setup): Save the original working directory
+        in test_object since this represents the WebKit repository from
+        where the unit tests are run.
+        (SCMTest): Created new super class to hold utility methods.
+        (SCMTest._create_patch): Creates a patch file on disk and a
+        dictionary for use with scm.svn_apply().
+        (SCMTest._setup_webkittools_scripts_symlink): Sets up a symlink
+        back to WebKitTools/Scripts in the test repository so that
+        scm.apply_patch() is able to find the svn-apply script.
+        (SVNTest): Inherit from SCMTest instead of unittest.TestCase.
+        (SVNTest.tearDown): Make sure to change directories back to the
+        original_path before the next test.
+        (SVNTest.test_apply_svn_patch): New test case for applying an
+        svn patch with scm.apply_patch().
+        (SVNTest.test_apply_svn_patch_force): New test case for applying
+        an svn patch with scm.apply_patch() that conflicts.
+        (GitTest): Inherit from SCMTest instead of unittest.TestCase.
+        (GitTest.tearDown): Make sure to change directories back to the
+        original_path before the next test.
+        (GitTest.test_apply_git_patch): New test case for applying a git
+        patch with scm.apply_patch().
+        (GitTest.test_apply_git_patch_force): New test case for applying
+        a git patch with scm.apply_patch() that conflicts.
+
+2009-09-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Mark Rowe.
+
+        [Qt] Add support for platform-spesific layout-test results
+
+        For the Qt port we use the qt-[mac|linux|win] directories and then fall
+        back to the generic qt directory for both test results and skipped list.
+
+        * Scripts/run-webkit-tests:
+        * Scripts/webkitdirs.pm:
+
+2009-09-02  Laurent Cerveau  <lcerveau@me.com>
+
+        Reviewed by David Kilzer.
+
+        <http://webkit.org/b/25517> build-webkit script should print build time at end
+
+        * Scripts/build-webkit:
+        Added startTime and endTime variable so that the build time is computed and printed as
+        part of the build message; display formatting has been separated in a dedicated subroutine.
+
+2009-09-02  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28881> svn-create-patch should check if the repo path is the same when trying to find the root
+
+        Reviewed by Eric Seidel.
+
+        * Scripts/VCSUtils.pm:
+        (determineSvnRoot): Added back check for repository root that
+        was removed in r46134 when this code lived in svn-create-patch.
+        It's necessary to check both the repository root and the
+        repository UUID in case two different working directories are
+        checked out from the same repository.
+
+2009-09-02  Timothy Hatcher  <timothy@apple.com>
+
+        Use new 512x512 icons for nightly builds.
+
+        Rubber-stamped by Mark Rowe.
+
+        * WebKitLauncher/webkit.icns:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix. Remove local variable shadowing global.
+
+        * wx/build/settings.py:
+
+2009-09-02  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by David Kilzer.
+
+        Calls exitStatus function from the main package where it is also defined.
+
+        * Scripts/VCSUtils.pm:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC and Mac/Snow Leopard.
+
+        * wx/browser/wscript:
+        * wx/build/build_utils.py:
+        * wx/build/settings.py:
+
+2009-08-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Changes needed for build-webkit to support the waf build system for the wx port.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27619
+
+        * Scripts/build-webkit:
+        * Scripts/run-launcher:
+        * Scripts/webkitdirs.pm:
+
+2009-09-02  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/27168> With Subversion 1.6, update-webkit prompts on conflicts
+
+        Reviewed by Eric Seidel.
+
+        * Scripts/update-webkit: Added "--accept postpone" to
+        @svnOptions when running with svn-1.6 or newer.
+
+2009-09-02  David Kilzer  <ddkilzer@apple.com>
+
+        Moved svn 1.6 version check into VCSUtils::isSVNVersion16OrNewer()
+
+        Reviewed by Eric Seidel.
+
+        * Scripts/VCSUtils.pm:
+        (@EXPORT): Added &isSVNVersion16OrNewer.
+        (svnVersion): Added.  Internal method that gets the SVN version
+        and caches it.
+        (isSVNVersion16OrNewer): Added.  Method that does the SVN 1.6
+        version check.
+        * Scripts/prepare-ChangeLog: Switched to use new
+        isSVNVersion16OrNewer() method.
+        * Scripts/resolve-ChangeLogs: Ditto.
+        * Scripts/svn-create-patch: Ditto.
+
+2009-09-02  David Kilzer  <ddkilzer@apple.com>
+
+        Clean up VCSUtils.pm
+
+        Reviewed by Eric Seidel.
+
+        * Scripts/VCSUtils.pm: Added proper package statement.  Fixed
+        indentation of BEGIN block.  Listed each exported method on a
+        line by itself.  Added methods to the export list after adding
+        the package statement.  Sorted module variables.  Moved
+        definiton of $gitRoot next to other module variables.
+
+2009-09-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Fix layout-test plugins/plugin-javascript-access.html
+
+        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
+
+2009-09-02  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        js tests should move into jstests subdirectory instead of resources/
+        https://bugs.webkit.org/show_bug.cgi?id=25880
+
+        make-script-wrappers supports both resources and script-tests directories.
+        run-webkit-tests ignores files in script-tests.
+        Move script tests of animations to check the new script is working.
+
+        * Scripts/make-script-test-wrappers:
+        * Scripts/run-webkit-tests:
+
+2009-09-02  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by David Levin.
+
+        check-webkit-style uses python from /usr/bin instead of the PATH
+        https://bugs.webkit.org/show_bug.cgi?id=28225
+
+        * Scripts/bugzilla-tool:
+        * Scripts/check-webkit-style:
+        * Scripts/run-webkit-unittests:
+        * Scripts/update-sources-list.py:
+          Changed the first line from
+          #!/usr/bin/python
+          to
+          #!/usr/bin/env python
+          which causes python to be invoked from the path location returned
+          by "which python" when any of these scripts are launched.
+          these are currently all the python scripts in WebKitTools/Scripts.
+
+2009-09-01  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28601> bugzilla-tool post-commits posts commits backwards
+
+        Reviewed by Adam Barth.
+
+        * Scripts/modules/scm.py:
+        (Git.commit_ids_from_commitish_arguments): Reverse the list of
+        commits returned from git-rev-list since we always want to post
+        the oldest patches first to bugs.webkit.org.
+        * Scripts/modules/scm_unittest.py:
+        (run): Added return statement to return the output now that we
+        want it sometimes.
+        (SVNTestRepository._setup_test_commits): Added a fourth commit
+        so the GitTest.test_commitish_order() test has more commits to
+        work with.
+        (GitTest.test_commitish_order): Added unit test for change to
+        Git.commit_ids_from_commitish_arguments() in scm.py.
+
+2009-09-01  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28877> Implement bugzilla-tool mark-fixed
+
+        Reviewed by David Levin.
+
+        The mark-fixed subcommand is for those times when you don't use
+        bugzilla-tool to commit a patch, but you want to use it to close
+        the bug with a committed-revision message.
+
+        * Scripts/bugzilla-tool:
+        (bug_comment_from_svn_revision): Added.  Extracted from
+        bug_comment_from_commit_text().
+        (bug_comment_from_commit_text): Extracted
+        bug_comment_from_svn_revision() from this method.
+        (MarkBugFixed.__init__): Added.
+        (MarkBugFixed._fetch_commit_log): Added.  Retrieves the commit
+        log from the last commit if no svn revision is specified, else
+        the commit log for the specified svn revision.
+        (MarkBugFixed._determine_bug_id_and_svn_revision): Added.
+        Attempts to determine the bug id and svn revision if one or both
+        were not defined on the command line.
+        (MarkBugFixed.execute): Added.  Adds a comment about the
+        revision that fixed the bug and closes the bug.
+        (BugzillaTool.__init__): Added mark-fixed subcommand.
+        * Scripts/modules/bugzilla.py:
+        (Bugzilla.fetch_title_from_bug): Added.  Returns the title of a
+        bug given a bug id.
+        * Scripts/modules/scm.py:
+        (SCM.strip_r_from_svn_revision): Added.  Utility method to strip
+        the leading 'r' from an svn revision.
+        (SCM.svn_commit_log): Added.  Subclasses must override.
+        (SCM.last_svn_commit_log): Added.  Subclasses must override.
+        (SVN.svn_commit_log): Added.  Returns svn log for a given
+        revision.
+        (SVN.last_svn_commit_log): Added.  Uses svnversion to find the
+        last commit in an svn working directory and then runs svn log.
+        (Git.svn_commit_log): Added.  Returns svn log for a given
+        revision.
+        (Git.last_svn_commit_log): Added.  Runs git-svn-log with a limit
+        of one log message.
+
+2009-09-01  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28880> svn-apply --force doesn't actually work
+
+        Reviewed by Brady Eidson.
+
+        * Scripts/svn-apply:
+        (applyPatch): Add "--force" to $options arrayref if $force is
+        set.
+
+2009-09-01  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28725> resolve-ChangeLogs: determineVCSRoot() returns incorrect repository root during git filter-branch
+
+        Reviewed by Adam Roben.
+
+        When git-filter-branch has been invoked to rewrite ChangeLog
+        files on series of git commits, it changes directories into
+        .git-rewrite/t before re-running resolve-ChangeLogs.  This
+        causes determineVCSRoot() in VCSUtils.pm to return
+        ".git-rewrite/t", which causes that path to be prepended to all
+        ChangeLog paths, which results in an error like this:
+
+            error: pathspec '.git-rewrite/t/ChangeLog' did not match any file(s) known to git.
+            Died at WebKitTools/Scripts/resolve-ChangeLogs line 376.
+
+        The correct way to fix this is not to try to find the repository
+        root when invoked by git-filter-branch.
+
+        * Scripts/resolve-ChangeLogs: If isInGitFilterBranch() is true,
+        set $relativePath to '.' instead of calling
+        chdirReturningRelativePath(determineVCSRoot()).
+        (isInGitFilterBranch): Added.  Checks for the existence of the
+        MAPPED_PREVIOUS_COMMIT environment variable.
+
+2009-09-01  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add support for Fedora distros in the http tests
+        https://bugs.webkit.org/show_bug.cgi?id=28263
+
+        Add detection code for Fedora distribution, and use the proper
+        httpd conf file when needed.
+
+        * Scripts/run-webkit-httpd:
+        * Scripts/run-webkit-tests:
+        * Scripts/webkitdirs.pm:
+
+2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Gtk] DRT needs implementation of overridePreference
+        https://bugs.webkit.org/show_bug.cgi?id=28830
+
+        Implement overridePreference.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+        (setDefaultsToConsistentStateValuesForTesting):
+        (runTest):
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (toWebSettingKey):
+        (LayoutTestController::overridePreference):
+
+2009-09-01  Joseph Pecoraro  <joepeck@webkit.org>
+
+        <http://webkit.org/b/28623> svn-[un]apply should change directories to the repository root before [un]applying
+
+        Reviewed by Eric Seidel.
+
+        Jump back and forth between the repository root directory (to apply) and the
+        directory the script was run from (to find the patch).
+
+        * Scripts/svn-apply:
+        * Scripts/svn-unapply:
+
+2009-08-31  Adam Roben  <aroben@apple.com>
+
+        Fall back to a Release version of Safari if a Debug one doesn't exist
+
+        <http://webkit.org/b/28849>
+
+        Reviewed by Sam Weinig.
+
+        * Scripts/webkitdirs.pm:
+        (safariPath): If the user is working with a Debug build, but there's
+        no Debug version of Safari present, fall back to using a Release
+        version of Safari.
+
+2009-08-31  Adam Roben  <aroben@apple.com>
+
+        Make safariPath() work for Debug builds of Safari on Windows
+
+        <http://webkit.org/b/28849>
+
+        Reviewed by Sam Weinig.
+
+        * Scripts/webkitdirs.pm:
+        (safariPath): If the user is working with a Debug build, add the
+        _debug suffix to Safari.exe.
+
+2009-08-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue needs a master process
+        https://bugs.webkit.org/show_bug.cgi?id=28040
+
+        Add a bugzilla-tool commit-queue command
+        Keeps per-bug logs, but doesn't yet upload them anywhere.
+
+        * Scripts/bugzilla-tool: Add LandPatchesFromCommitQueue to handle 'commit-queue'
+        * Scripts/modules/buildbot.py: remove noisy log message
+        * Scripts/modules/logging.py: add a 'tee()' call for splitting outputs in python
+
+2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Geolocation needs permission API before being enabled by default
+
+        Build the Gtk port with geolocation enabled. This option is only
+        enabled for the buildbot. The autotools option will be enabled by
+        default once the permissions API is implemented.
+
+        * Scripts/build-webkit:
+
+2009-08-26  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by David Kilzer.
+
+        Make prepare-ChangeLog notice property changes
+        https://bugs.webkit.org/show_bug.cgi?id=28675
+
+        Make the generated ChangeLog entry include a short description of
+        property changes if there were such changes.  Also make
+        prepare-ChangeLog not bail if the only changes are property changes.
+
+        * Scripts/prepare-ChangeLog:
+
+2009-08-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Don't let local files access web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28480
+
+        A bunch of our LayoutTests rely on our old behavior, so we explicitly
+        grant local files universal access during testing.  Mainly, these tests
+        involve making XMLHttpRequests for data URLs.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::WebPage):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+
+2009-08-26  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Minor style correction and include fix for notifications
+        https://bugs.webkit.org/show_bug.cgi?id=28745
+
+        * DumpRenderTree/win/DRTDesktopNotificationPresenter.cpp:
+          change to correct EnumStyle
+        (DRTDesktopNotificationPresenter::checkNotificationPermission):
+
+2009-08-26  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        XMLHttpRequest.withCredentials=false shouldn't save cookies.
+        https://bugs.webkit.org/show_bug.cgi?id=28743
+
+        Added the support to the layout test controller on OSX and
+        Windows (for CFNETWORK) to allow for changing the accept cookie
+        policy.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController): Added a bool
+        to track the state of accepting cookies.
+        (setAlwaysAcceptCookiesCallback): Standard wrapper method
+        to go from js to a C++ method.
+        (LayoutTestController::staticFunctions): Added the
+        setAlwaysAcceptCookies method to the js layoutTestController.
+        * DumpRenderTree/LayoutTestController.h:
+        (LayoutTestController::alwaysAcceptCookies): Returns the value.
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setAlwaysAcceptCookies): Stub out method.
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues): Reset the accept cookie to
+        its default.
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::setAlwaysAcceptCookies): Does the work for
+        OSX to change the cookie accept policy.
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (setAlwaysAcceptCookies): Method to handle all the calls necessary
+        to change the accept cookie policy on Windows.
+        (resetDefaultsToConsistentValues): Reset the accept cookie to
+        its default.
+        * DumpRenderTree/win/DumpRenderTreeWin.h:
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::setAlwaysAcceptCookies): Stub out method.
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::setAlwaysAcceptCookies): Stub out method.
+
+2009-08-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed.
+
+        Remove accidentally left in clobber option.
+        https://bugs.webkit.org/show_bug.cgi?id=28400
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg: Removed clobber option.
+
+2009-08-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Add canary-style Chromium WebKit build slave to the waterfall.
+        https://bugs.webkit.org/show_bug.cgi?id=28400
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json: Added one Chromium/Windows slave
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg: Added support for Chromium slave commands.
+
+2009-08-25  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Darin Adler.
+
+        make-script-test-wrappers should be executable
+        https://bugs.webkit.org/show_bug.cgi?id=28669
+
+        Make make-script-test-wrappers and update-sources-list.py both be
+        executable.
+
+        * Scripts/update-sources-list.py:
+        * Scripts/make-script-test-wrappers:
+
+2009-08-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix
+
+        Revise Debug_Cairo targets to point inherit from the 
+        debug_wincairo.vsprops property sheet so that they link
+        against the proper libraries in Debug build.
+
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj:
+        * WinLauncher/WinLauncher.vcproj:
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        PLATFORM(CFNETWORK) should be USE(CFNETWORK).
+        https://bugs.webkit.org/show_bug.cgi?id=28713
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (main):
+
+2009-08-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt/Mac] Use CONFIG+=build_all only when building libraries
+
+        If no configuration is specified when building WebKit we pass the
+        debug_and_release option to QMake which results in Makefiles for
+        both configurations being generated.
+
+        Previously we built both of these configurations by default, for
+        all targets (both the QtWebKit framework/dyldlib and the various
+        executables such as QtLauncher and tests). This makes sense for
+        the libraries, which get the _debug suffix and can be loaded on
+        demand by setting the DYLD_IMAGE_SUFFIX, but for executables we
+        ended up building the same executable twice.
+
+        We now only build one instance of each executable, and since this
+        is a developer build we build the debug-version. Passing either
+        --debug or --release to build-webkit will override this, and
+        even in the default case the release version can still be built
+        by running 'make release' in the the build directory of each
+        target.
+
+        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
+        * Scripts/webkitdirs.pm:
+
+2009-08-24  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix Bug 27827 "[Chromium] Functions Keys don't work in google spreadsheet".
+        <https://bugs.webkit.org/show_bug.cgi?id=27827>.
+
+        Because of the lack of mappings from GDK key-codes to WebKit key-codes,
+        Chromium cannot send valid key-codes to JavaScript when a user types
+        function keys. This change just copies the mappings from 'KeyEventGtk.cpp'.
+
+        To write layout tests for this issue, added mappings from function-key
+        names to platform-specific key-codes to EventSendingController objects
+        so that eventSender.keyDown() can send function-key events without using
+        platform-specific key codes. (Unfortunately, this eventSender.keyDown() change
+        is only for Mac. So this change adds this new test to Skipped tests for other
+        platforms to prevent this change from crashing the build trees.)
+
+        * DumpRenderTree/mac/EventSendingController.mm:
+        (-[EventSendingController keyDown:withModifiers:]):
+
+2009-08-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] API for disabling local file access to web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28663
+
+        Enable this setting for DRT.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetWebViewToConsistentStateBeforeTesting):
+
+2009-08-22  Adam Barth  <abarth@webkit.org>
+
+        Revert 47684.  We're going to do this later once clients have had a
+        chance to opt into the setting they like.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::WebPage):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+
+2009-08-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't let local files access web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28480
+
+        A bunch of our LayoutTests rely on our old behavior, so we explicitly
+        grant local files universal access during testing.  Mainly, these tests
+        involve making XMLHttpRequests for data URLs.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::WebPage):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+
+2009-08-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Bring signed updates to the Mac nightly builds.
+
+        * WebKitLauncher/Info.plist:
+        * WebKitLauncher/WebKitLauncher.xcodeproj/project.pbxproj:
+        * WebKitLauncher/WebKitNightlyEnablerSparkle.m:
+        (initializeSparkle):
+        * WebKitLauncher/nightly.webkit.org.public.pem: Added.
+
+2009-08-21  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubberstamped by Simon Fraser.
+
+        Remove GNOME keyring support in build-webkit. This dependency's
+        already been removed in the Gtk port.
+
+        * Scripts/build-webkit:
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+        Based on original patch by Stephanie Lewis.
+
+        Added support of the Windows malloc history format to parse-malloc history, so we can
+        read and parse it.
+
+        * Scripts/parse-malloc-history:
+
+2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Enable various "grouping" ARIA roles
+        https://bugs.webkit.org/show_bug.cgi?id=28486
+
+        Expose the ability to retrieve the subrole through accessibility for DRT.
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+
+2009-08-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Unreviewed.
+
+        Added myself as a committer.
+
+        * Scripts/modules/committers.py:
+
+2009-08-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fix memory leaks.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::whiteListAccessFromOrigin):
+        (LayoutTestController::pauseAnimationAtTimeOnElementWithId):
+        (LayoutTestController::pauseTransitionAtTimeOnElementWithId):
+
+2009-08-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool post-diff can post partial diffs from SVN checkouts.
+        https://bugs.webkit.org/show_bug.cgi?id=28445
+
+        Pass the checkout root as the cwd.  Also wrote a test to ensure this.
+
+        * Scripts/modules/scm.py:
+        * Scripts/modules/scm_unittest.py:
+
+2009-08-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Don't leak the JSStringRef returned by AccessibilityUIElement::attributeValue.
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (attributeValueCallback):
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] The template-based qMax() compares two qreals.
+
+        * DumpRenderTree/qt/ImageDiff.cpp:
+        (main):
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        bugzilla-tool patch retrieval should handle 302 redirects.
+        https://bugs.webkit.org/show_bug.cgi?id=28485
+
+        * Scripts/modules/scm.py: Pass the --location parameter to curl
+        so that 302's are followed.
+
+2009-08-20  Aaron Boodman  <aa@chromium.org>
+
+        One more speculative build for gtk.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+
+2009-08-20  Aaron Boodman  <aa@chromium.org>
+
+        Speculative build for gtk.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::whiteListAccessFromOrigin):
+
+2009-08-20  Mark Rowe  <mrowe@apple.com>
+
+        Ignore some leaks that are known to originate from ImageIO.
+
+        * Scripts/run-webkit-tests:
+
+2009-08-20  Aaron Boodman  <aa@chromium.org>
+
+        With David Levin.
+
+        Speculative build fix for qt.
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (LayoutTestController::whiteListAccessFromOrigin):
+        * DumpRenderTree/qt/jsobjects.h:
+
+2009-08-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <http://webkit.org/b/28484> Plug-in-related leaks seen on the build bot
+
+        Update check-for-global-initializers to accommodate the new uses of RefCountedLeakCounter in WebKit.
+
+        * Scripts/check-for-global-initializers:
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        * DumpRenderTree/LayoutTestController.cpp: Expose whiteListAccessFromOrigin() to layout tests.
+        (whiteListAccessFromOriginCallback): Ditto.
+        (LayoutTestController::staticFunctions): Ditto.
+        * DumpRenderTree/LayoutTestController.h: Ditto.
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp: Ditto.
+        (LayoutTestController::whiteListAccessToOrigin): Ditto.
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm: Ditto.
+        (LayoutTestController::whiteListAccessFromOrigin): Ditto.
+        * DumpRenderTree/qt/jsobjects.cpp: Ditto.
+        (LayoutTestController::whiteListAccessFromOrigin): Ditto.
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp: Stub out whiteListAccessFromOrigin().
+        (LayoutTestController::whiteListAccessFromOrigin): Ditto.
+        * DumpRenderTree/gtk/DumpRenderTree.cpp: Reset origin access lists before each test.
+        (resetWebViewToConsistentStateBeforeTesting): Ditto.
+        * DumpRenderTree/mac/DumpRenderTree.mm: Ditto.
+        (resetWebViewToConsistentStateBeforeTesting): Ditto.
+        * DumpRenderTree/qt/DumpRenderTree.cpp: Ditto.
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting): Ditto.
+
+2009-08-19  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Ignore some leaks that are known to originate from QTKit.
+
+        * Scripts/run-webkit-tests:
+
+2009-08-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue/bugzilla-tool can get wedged if git is mid-rebase
+        https://bugs.webkit.org/show_bug.cgi?id=28436
+
+        Make clean_working_directory cancel rebases too (even though that's a bit of a hack).
+        This code will only ever be run when --force-clean is passed.
+
+        I also added a new unit test to make sure this code actually works. :)
+
+        * Scripts/modules/scm.py:
+        * Scripts/modules/scm_unittest.py:
+
+2009-08-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Levin.
+
+        WebKit needs a changelogs.py to hold changelog-related code
+        https://bugs.webkit.org/show_bug.cgi?id=28477
+
+        This is moving code and adding tests.  There was only one functional
+        change (which was removing a trailing newline from the last_entry() result).
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/changelogs.py: Added.
+        * Scripts/modules/changelogs_unittest.py: Added.
+        * Scripts/run-webkit-unittests:
+
+2009-08-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool needs a way to ask build.webkit.org if the bots are passing
+        https://bugs.webkit.org/show_bug.cgi?id=28222
+
+        Basic support for now.  This has been in testing for 24 hours now and worked great!
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/buildbot.py: Added.
+        * Scripts/modules/buildbot_unittest.py: Added.
+        * Scripts/run-webkit-unittests:
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Bump waitToDumpWatchdog interval to 15 seconds to match the
+        default timeout used by run-webkit-tests. Mac and Win ports were
+        recently bumped in http://trac.webkit.org/changeset/r47465.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setWaitToDump):
+
+2009-08-19  David D. Kilzer  <ddkilzer@webkit.org>
+
+        DumpRenderTreeSupport.pm: provide pre-generated swig source for Tiger
+
+        Reviewed by Mark Rowe.
+
+        Provide pre-generated swig source files for Tiger so it may
+        benefit from the faster run-webkit-tests.
+
+        * DumpRenderTree/mac/PerlSupport/DumpRenderTreeSupportTiger.pm:
+        Generated by swig.
+        * DumpRenderTree/mac/PerlSupport/DumpRenderTreeSupport_wrapTiger.c: Added.
+        Generated by swig.
+        (swig_type_info::SWIG_TypeNameComp):
+        (swig_type_info::SWIG_TypeEquiv):
+        (swig_type_info::SWIG_TypeRegisterTL):
+        (swig_type_info::SWIG_TypeCheck):
+        (swig_type_info::SWIG_TypeCast):
+        (swig_type_info::SWIG_TypeDynamicCast):
+        (swig_type_info::SWIG_TypeName):
+        (swig_type_info::SWIG_TypePrettyName):
+        (swig_type_info::SWIG_TypeQueryTL):
+        (swig_type_info::SWIG_TypeClientDataTL):
+        (swig_type_info::SWIG_PackData):
+        (swig_type_info::SWIG_UnpackData):
+        (swig_type_info::SWIG_PropagateClientDataTL):
+        (swig_type_info::SWIG_PackVoidPtr):
+        (swig_type_info::SWIG_UnpackVoidPtr):
+        (swig_type_info::SWIG_PackDataName):
+        (swig_type_info::SWIG_UnpackDataName):
+        * DumpRenderTree/mac/PerlSupport/Makefile: Updated to build on
+        Tiger using pre-generated files.
+
+2009-08-18  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        run-webkit-tests hangs when WebCore tries to log too much
+        https://bugs.webkit.org/show_bug.cgi?id=15743
+
+        Read stdout and stderr in parallel.
+
+        * Scripts/run-webkit-tests:
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Add a new build configuration that checks for leaks during the layout tests,
+        and hook a new machine up to it.
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json:
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+
+2009-08-18  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28412: Leak of WebCore::XMLHttpRequest object during layout tests.
+
+        No new tests: Already covered by existing tests.
+
+        * Scripts/check-for-global-initializers: Allow global initialization of WTF::RefCountedLeakCounter for XMLHttpRequest.
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        Bump waitToDumpWatchdogInterval to 15 seconds to match the time-out used by run-webkit-tests.
+
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+
+2009-08-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Changed use of CComBSTR in exceededDatabaseQuota to BSTRs, and free them,
+        and removed include to fix building on VC++ Express.
+
+        * DumpRenderTree/win/UIDelegate.cpp:
+        (UIDelegate::exceededDatabaseQuota):
+
+2009-08-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
+        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
+        
+        Implemenent setDatabaseQuota and added a new function to the IWebDatabaseManager interface.
+        Also added a console output on UIDelegate::exceededDatabaseQuota to match the mac.
+
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::setDatabaseQuota):
+        * DumpRenderTree/win/UIDelegate.cpp:
+        (UIDelegate::exceededDatabaseQuota):
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * record-memory-win/record-memory-win.vcproj:
+        * WinLauncher/WinLauncher.vcproj:
+        * WebKitLauncherWin/WebKitLauncherWin.vcproj:
+        * DumpRenderTree/win/ImageDiff.vcproj:
+        * FindSafari/FindSafari.vcproj:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        Added layoutTestController.workerThreadCount, and implementations on various platforms that call into WebKit.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (getWorkerThreadCountCallback):
+        (LayoutTestController::staticValues):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::workerThreadCount):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::workerThreadCount):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::workerThreadCount):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::workerThreadCount):
+
+2009-08-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Initialize x and y in the GtkAllocation structure to shut up
+        valgrind.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (runTest):
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Some HTMLs are modified by make-script-test-wrappers
+        https://bugs.webkit.org/show_bug.cgi?id=28213
+
+        Add fast/js/const.js and fast/canvas/canvas-2d-imageData-create-nonfinite.js into
+        the exclude list, modified fast/dom/Geolocation/resources/TEMPLATE.html, and
+        re-generated wml/* and Geolocation/* .
+
+        * Scripts/make-script-test-wrappers:
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        -webkit-box-orient:horizontal doesn't work on <button> tag
+        https://bugs.webkit.org/show_bug.cgi?id=34445
+
+        Make a flexible button's anonymous child flexible and pass the
+        parent's box-orient to the anonymous child.
+
+        Also, added a renderName for anonymous flexible boxes.
+
+        * Scripts/make-script-test-wrappers:
+
+2009-08-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Can no longer --reset-results of a layout test directory
+        https://bugs.webkit.org/show_bug.cgi?id=28336
+
+        --reset-results and --exit-after-n-failures are incompatible.
+
+        * Scripts/run-webkit-tests:
+
+2009-08-17  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/26920> bugzilla-tool dumps too much junk the the commit comment from git
+
+        Reviewed by Adam Roben.
+
+        New commit message:
+            Committed r12345: <http://trac.webkit.org/changeset/12345>
+
+        * Scripts/bugzilla-tool:
+        (bug_comment_from_commit_text): Print out a compact,
+        standardized commit message for both git and svn.
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * DumpRenderTree/win/ImageDiff.vcproj:
+        * DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj:
+
+2009-08-17  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28393> check-webkit-style: add check for use of std::max()/std::min() instead of MAX()/MIN()
+
+        Reviewed by David Levin.
+
+        * Scripts/modules/cpp_style.py:
+        (_ERROR_CATEGORIES): Added 'runtime/max_min_macros'.
+        (check_max_min_macros): Added.  Returns level 4 error when MAX()
+        and MIN() macros are used in header files and C++ source files.
+        (check_style): Added call to check_max_min_macros().
+        * Scripts/modules/cpp_style_unittest.py: Added unit tests.
+        (test_max_macro): Added.
+        (test_min_macro): Added.
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Move adjustLineToPixelBoundaries overlapping function to GraphicsContext.cpp
+        and remove from GraphicsContextCairo.cpp and GraphicsContextQt.cpp.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::adjustLineToPixelBoundaries):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2009-08-10  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes for DumpRenderTree/qt/jsobjects.cpp based on cpp_style.py and
+        WebKit style guide.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28161
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (findFrameNamed):
+        (LoadItem::invoke):
+        (LayoutTestController::provisionalLoad):
+        (LayoutTestController::timerEvent):
+        (LayoutTestController::pauseAnimationAtTimeOnElementWithId):
+        (LayoutTestController::pauseTransitionAtTimeOnElementWithId):
+        (LayoutTestController::numberOfActiveAnimations):
+        (EventSender::keyDown):
+        (EventSender::frameUnderMouse):
+        (TextInputController::doCommand):
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28370> check-webkit-style: add check for 'using std::foo;' statements
+
+        Reviewed by David Levin.
+
+        In <http://webkit.org/b/28355#c1>, it was noted that new source
+        files use 'using namespace std;' instead of individual
+        'using std::foo;' statements.  This adds a level 4 check for
+        such statements.
+
+        * Scripts/modules/cpp_style.py:
+        (_ERROR_CATEGORIES): Added 'build/using_std'.
+        (check_using_std): Added.
+        (check_style): Added call to check_using_std().
+        * Scripts/modules/cpp_style_unittest.py:
+        (WebKitStyleTest.test_using_std): Added unit test.
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        Backed out r47343 which was mistakenly committed
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/scm.py:
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28367> bugzilla.py: replace ScriptError class with BugzillaError class
+
+        Reviewed by David Levin.
+
+        The ScriptError class doesn't exist in bugzilla.py, so any
+        errors print error messages about ScriptError instead of the
+        actual error:
+
+            NameError: global name 'ScriptError' is not defined
+
+        * Scripts/modules/bugzilla.py:
+        (BugzillaError): Added class.  Modeled after ScriptError class
+        in scm.py.
+        (Bugzilla.authenticate): Changed to use BugzillaError instead of
+        ScriptError.
+        (Bugzilla._check_create_bug_response): Ditto.
+
+2009-08-14  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added EventSource to the build script (default on).
+        https://bugs.webkit.org/show_bug.cgi?id=14997 
+
+        * Scripts/build-webkit:
+
+2009-08-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed.
+
+        Add myself to list of committers.
+
+        * Scripts/modules/committers.py:
+
+2009-08-15  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Fix layout test failures after r47312.
+
+        Reviewed by Cameron Zwarich.
+
+        * DumpRenderTree/AccessibilityController.h:
+        Replaced logFocusEvents() with setLogFocusEvents(), which takes a
+        boolean argument to turn logging of focus events on or off.
+        Added a function to reset the AccessibilityController to a consistent
+        state.
+
+        * DumpRenderTree/AccessibilityController.cpp:
+        (logFocusEventsCallback):
+        Call setLogFocusEvents() to enable logging.
+        (AccessibilityController::resetToConsistentState):
+        Call setLogFocusEvents() to disable logging.
+
+        * DumpRenderTree/gtk/AccessibilityControllerGtk.cpp:
+        (AccessibilityController::setLogFocusEvents):
+        Update stub.
+
+        * DumpRenderTree/mac/AccessibilityControllerMac.mm:
+        (AccessibilityController::setLogFocusEvents):
+        Update stub.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetWebViewToConsistentStateBeforeTesting):
+        Call the FrameLoadDelegate's resetToConsistentState method.
+
+        * DumpRenderTree/mac/FrameLoadDelegate.h:
+        Declare the resetToConsistentState method.
+
+        * DumpRenderTree/mac/FrameLoadDelegate.mm:
+        (-[FrameLoadDelegate resetToConsistentState]):
+        Call the AccessibilityController's resetToConsistentState() function.
+
+        * DumpRenderTree/win/AccessibilityControllerWin.cpp:
+        (AccessibilityController::~AccessibilityController):
+        Turn off focus event logging when the controller is destroyed.
+        (AccessibilityController::setLogFocusEvents):
+        If the caller passes false, unhook the focus event, and clear
+        m_focusEventHook.
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetWebViewToConsistentStateBeforeTesting):
+        Call the FrameLoadDelegate's resetToConsistentState function.
+
+        * DumpRenderTree/win/FrameLoadDelegate.h:
+        Declare the resetToConsistentState() function.
+
+        * DumpRenderTree/win/FrameLoadDelegate.cpp:
+        (FrameLoadDelegate::resetToConsistentState):
+        Call the AccessibilityController's resetToConsistentState() function.
+
+
+2009-08-14  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add a mechanism for logging MSAA focus events.
+
+        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
+        nightly (20866)
+
+        https://bugs.webkit.org/show_bug.cgi?id=20866
+
+        Reviewed by Oliver Hunt.
+
+        * DumpRenderTree/AccessibilityController.cpp:
+        (logFocusEventsCallback):
+        Call the AccessibilityController's logFocusEvents() function.
+        (AccessibilityController::getJSClass):
+        Add a "logFocusEvents" function to the AccessibilityController's JS
+        class definition.
+
+        * DumpRenderTree/AccessibilityController.h:
+        On Windows, include windows.h, and add a member variable to hold the
+        handle to the event hook for focus events. Add a declaration for a
+        function that enables logging of focus events.
+
+        * DumpRenderTree/gtk/AccessibilityControllerGtk.cpp:
+        (AccessibilityController::logFocusEvents):
+        Stubbed.
+
+        * DumpRenderTree/mac/AccessibilityControllerMac.mm:
+        (AccessibilityController::logFocusEvents):
+        Stubbed.
+
+        * DumpRenderTree/win/AccessibilityControllerWin.cpp:
+        (AccessibilityController::AccessibilityController):
+        (AccessibilityController::~AccessibilityController):
+        If we hooked the focus event, unhook it.
+        (logFocusEventProc):
+        When we receive a focus event, get the accessible object for the event,
+        and log its name to stdout.
+        (AccessibilityController::logFocusEvents):
+        Setup the focus event hook to listen for events in the current process.
+
+2009-08-14  Eric Seidel  <eric@webkit.org>
+
+        No review.  Fix 5-space indent to be 4-spaces.
+
+        * Scripts/bugzilla-tool:
+
+2009-08-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Public API to configure the storage path for HTML5 localStorage
+        https://bugs.webkit.org/show_bug.cgi?id=28036
+
+        Turn on LocalStorage support for Qt DumpRenderTree since
+        LocalStorage is now disabled by defult for QtWebkit.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp: 
+        (WebCore::WebPage::WebPage):
+
+2009-08-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Do not unref the main webview, it's owned by its parent
+        container. Instead destroy the container, which should take care
+        of everything (not terribly important since we exit right after
+        that, but still).
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (main):
+
+2009-08-13  Eric Seidel  <eric@webkit.org>
+
+        No review, correcting obvious python error seen in the commit queue.
+
+        args can be a string or an array.  Assuming args is always an array results in
+        double-spaced text in error logs.
+
+        * Scripts/bugzilla-tool:
+
+2009-08-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Include stdio.h for using stdout, stderr,
+        and fprintf.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+
+2009-08-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        rename make-js-test-wrappers to make-script-test-wrappers
+        https://bugs.webkit.org/show_bug.cgi?id=28212
+
+        * Scripts/make-script-test-wrappers: Renamed from WebKitTools/Scripts/make-js-test-wrappers.
+
+2009-08-13  Drew Wilson <atwilson@chromium.org>
+
+        Unreviewed.
+
+        Add myself to list of committers.
+
+        * Scripts/modules/committers.py:
+
+2009-08-13  John Sullivan  <sullivan@apple.com>
+
+        Unreviewed.
+
+        Add myself to list of committers.
+
+        * Scripts/modules/committers.py:
+
+2009-08-13  Eric Seidel  <eric@webkit.org>
+
+        Correct spelling error in file name.  No review.
+
+        * Scripts/modules/committers_unittest.py: Renamed from WebKitTools/Scripts/modules/commiters_unittest.py.
+        * Scripts/run-webkit-unittests:
+
+2009-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION(r47175): error running run-webkit-tests
+        https://bugs.webkit.org/show_bug.cgi?id=28261
+
+        Fix "Use of uninitialized value in concatenation (.) or string at
+        WebKitTools/Scripts/run-webkit-tests line 191." by setting
+        $testsPerDumpTool to 1000 by default.
+
+        * Scripts/run-webkit-tests:
+
+2009-08-13  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed.
+
+        Add myself to list of committers.
+
+        * Scripts/modules/committers.py:
+
+2009-08-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed.
+
+        Add 'Brent Fulgham' to the committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-08-13  Adam Langley  <agl@chromium.org>
+
+        Review not required.
+
+        * Scripts/modules/committers.py:
+          Adding myself to this list because Eric told me to.
+
+2009-08-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Unreviewed.
+
+        Add 'Greg Bolsinga' to the committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-08-13  Adam Roben  <aroben@apple.com>
+
+        Fix off-by-one result comparisons in media tests on Windows Debug
+        builds
+
+        media/video-played.html seems always to time out in Windows Debug
+        builds. A race condition between media/video-test.js's "hang" timer and
+        DumpRenderTree's built-in "watchdog" timer was causing results for
+        media/video-played.html to be printed twice, causing all future media
+        tests to be compared to the previous test's results.
+
+        The fix is to make the watchdog timer got through the same code path
+        as calling notifyDone manually, so that the results will only get
+        printed once. A subsequent patch will remove video-test.js's hang
+        timer entirely, since it is redundant.
+
+        Fixes <http://webkit.org/b/28265>.
+
+        Reviewed by Mark Rowe.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::waitToDumpWatchdogTimerFired): Added. Code came
+        from Gtk/Mac/Win's watchdog timer handlers, but we now call
+        notifyDone() instead of dump() so that a subsequent call to
+        notifyDone() won't print the results out again.
+
+        * DumpRenderTree/LayoutTestController.h: Added
+        waitToDumpWatchdogTimerFired.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (waitToDumpWatchdogFired):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (waitUntilDoneWatchdogFired):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (waitUntilDoneWatchdogFired):
+        Changed to call waitToDumpWatchdogTimerFired.
+
+2009-08-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Unreviewed.
+
+        Added 'Eric Carlson' to the committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-08-13  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed.
+        Added 'Dirk Schulze' to the committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-08-13  Adam Roben  <aroben@apple.com>
+
+        Enable running testapi in run-javascriptcore-tests on Windows
+
+        Fixes <http://webkit.org/b/24856> run-javascriptcore-tests should run
+        testapi on Windows
+
+        Reviewed by Mark Rowe.
+
+        * Scripts/run-javascriptcore-tests: Allow testapi to run if we're in
+        the AppleWinWebKit configuration.
+
+2009-08-13  Adam Roben  <aroben@apple.com>
+
+        Re-enable testapi in run-javascriptcore-tests on Mac
+
+        This seems to have been mistakenly disabled in r47089.
+
+        Rubber-stamped by Mark Rowe.
+
+        * Scripts/run-javascriptcore-tests: Removed comment markers that were
+        preventing running testapi.
+
+2009-08-12  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Enable WCSS and XHTML-MP flags for build-webkit.
+
+        * Scripts/build-webkit:
+
+2009-08-12  David Kilzer  <ddkilzer@apple.com>
+
+        run-webkit-tests: document --nthly flag in help message
+
+        Reviewed by Simon Fraser.
+
+        * Scripts/run-webkit-tests: Added --nthly flag to $usage string.
+        Also noted that -1|--singly implies --nthly 1.
+
+2009-08-12  Eric Seidel  <eric@webkit.org>
+
+        No review, just fixing mismerged ChangeLogs.
+
+2009-08-12  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        run-webkit-tests needs a --exit-after-failures=N option
+        https://bugs.webkit.org/show_bug.cgi?id=28192
+
+        Added the option and deployed it to bugzilla-tool.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/run-webkit-tests:
+
+2009-08-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        bugzilla-tool : various improvements for running the commit-queue
+        https://bugs.webkit.org/show_bug.cgi?id=28199
+
+        Make run_and_throw_if_fail silence STDERR as well as STDIN.
+        I also changed run_and_throw_if_fail to use the /dev/null trick instead of .communicate() to avoid ever buffering the output (per abarth's suggestion).
+        Change a few "print" statements to "log" so they appear in the output.
+        Changed all string + uses to use string formatting instead (this is less error prone as it will automatically convert non-string objects).
+        Added a little more logging so that --quiet mode is easier to understand.
+        Changed clear_attachment_review_flag to clear_attachment_flags and made it clear the commit-queue flag as well.
+        Added the ability for bugzilla-tool to reject patches from the commit-queue when they fail to compile/apply/etc.
+        Added _find_select_element_for_flag to make the code for finding flag <select> elements clearer.
+        Made curl call (downloading patch files) quieter.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/bugzilla.py:
+        * Scripts/modules/scm.py:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Change pattern that strips all trailing whitespace to just remove EOL
+        chars (\r, \n), to make it clear that varying EOL chars is the primary
+        problem being solved.
+
+        * Scripts/prepare-ChangeLog:
+        * Scripts/resolve-ChangeLogs:
+        * Scripts/svn-create-patch:
+        * Scripts/update-webkit:
+
+2009-08-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx waf build fix, add new directories to the build.
+
+        * wx/build/settings.py:
+
+2009-08-11  Adam Roben  <aroben@apple.com>
+
+        Update DumpRenderTree for IWebUIDelegatePrivate changes
+
+        Reviewed by Dave Hyatt.
+
+        * DumpRenderTree/win/UIDelegate.h: Updated to match
+        IWebUIDelegatePrivate.
+
+2009-08-12  Adam Roben  <aroben@apple.com>
+
+        Don't try to seek to the end of stdin on Cygwin
+
+        Doing so seems to always cause an exception (for unknown reasons).
+
+        Fixes <http://webkit.org/b/28159> create-bug throws an exception in
+        Cygwin
+
+        Reviewed by Dave Kilzer.
+
+        * Scripts/bugzilla-tool:
+        (CreateBug.prompt_for_bug_title_and_comments): Ignore IOErrors
+        generated by calling sys.stdin.seek, since these seem to be generated
+        for no good reason on Cygwin.
+
+2009-08-12  Adam Roben  <aroben@apple.com>
+
+        Don't raise an exception when --cc is not passed to create-bug
+
+        Fixes <http://webkit.org/b/28158> create-bug throws an exception if
+        --cc is not specified
+
+        Reviewed by Dave Kilzer.
+
+        * Scripts/modules/bugzilla.py:
+        (Bugzilla.create_bug_with_patch): Only set the "cc" field if a CC
+        string was specified. Otherwise we'll generate an exception about the
+        "cc" variable not being a string.
+
+2009-08-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool : various improvements for running the commit-queue
+        https://bugs.webkit.org/show_bug.cgi?id=28199
+
+        Make run_and_throw_if_fail silence STDERR as well as STDIN.
+        I also changed run_and_throw_if_fail to use the /dev/null trick instead of .communicate() to avoid ever buffering the out
+        Change a few "print" statements to "log" so they appear in the output.
+        Changed all string + uses to use string formatting instead (this is less error prone as it will automatically convert non
+        Added a little more logging so that --quiet mode is easier to understand.
+        Changed clear_attachment_review_flag to clear_attachment_flags and made it clear the commit-queue flag as well.
+        Added the ability for bugzilla-tool to reject patches from the commit-queue when they fail to compile/apply/etc.
+        Added _find_select_element_for_flag to make the code for finding flag <select> elements clearer.
+        Made curl call (downloading patch files) quieter.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/bugzilla.py:
+        * Scripts/modules/scm.py:
+
+2009-08-11  Eric Seidel  <eric@webkit.org>
+
+        No review, script regression fix only.
+
+        run-webkit-tests --quiet hangs
+        https://bugs.webkit.org/show_bug.cgi?id=28202
+
+        Do a huge dance to get open3 to pipe to /dev/null w/o blocking.
+        This was what I came up with after discussions in #perl.
+
+        * Scripts/run-webkit-tests:
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Switch DumpRenderTree to contain a WebUIDelegate2, which extends
+        WebUIDelegate, so that the notifications tests will still work.
+        https://bugs.webkit.org/show_bug.cgi?id=28198
+
+        * DumpRenderTree/win/UIDelegate.h:
+
+2009-08-11  Darin Adler  <darin@apple.com>
+
+        Try to fix GTK build.
+
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::stringForRange): Added.
+
+2009-08-10  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Add processing for string constants used by the tests to trigger
+        common actions like up, down, left, right, etc. for the Qt
+        implementation of DumpRenderTree.
+
+        Note this allows fast/forms/textarea-arrow-navigation.html to pass
+        correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28161
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (EventSender::keyDown):
+
+2009-08-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 28200 - ListMarker should be included as part of the text value to parse
+        https://bugs.webkit.org/show_bug.cgi?id=28200
+
+        Add the ability to retrieve a string given a plain NSRange.
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (stringForRangeCallback):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::valueDescription):
+        (AccessibilityUIElement::stringForRange):
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::stringForRange):
+
+2009-08-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by NOBODY (Speculative fix for the layout test failure).
+
+        Fix fast/dom/prototype-inheritance.html
+        and fast/dom/prototype-inheritance-2.html
+        broken on Windows by http://trac.webkit.org/changeset/47018
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues): enable app cache in Windows DRT.
+
+2009-08-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool: Re-factor shared landing logic into helper class to share more code
+        https://bugs.webkit.org/show_bug.cgi?id=28193
+
+        Added new WebKitLandingScripts class to hold this shared logic.
+        Also added a view_source_url function to move more webkit-specific urls out of bugzilla-tool core.
+
+        * Scripts/bugzilla-tool:
+
+2009-08-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Treat.
+
+        Fix the current failures on the buildbot.
+
+        As Qt hooks up the maybeDump to loadFinished, we need to make
+        sure that calling dump() will not call maybeDump on loadFinished.
+
+        As dump is called my emitting done() which calls dump() and then
+        setting m_isLoading to false. So in the case m_isLoading is false,
+        do not dump again.
+
+        The current code is confusing, and should be made more clear
+        in another commit.
+
+        * DumpRenderTree/qt/jsobjects.cpp:
+        (LayoutTestController::maybeDump):
+        (LayoutTestController::notifyDone):
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add support for desktop notifications API to DumpRenderTree,
+        and support for ENABLE_NOTIFICATIONS flag to build-webkit.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (grantDesktopNotificationPermissionCallback):
+        (LayoutTestController::staticFunctions):
+        (LayoutTestController::grantDesktopNotificationPermission):
+        (LayoutTestController::checkDesktopNotificationPermission):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/win/DRTDesktopNotificationPresenter.cpp: Added.
+        (DRTDesktopNotificationPresenter::DRTDesktopNotificationPresenter):
+        (DRTDesktopNotificationPresenter::QueryInterface):
+        (DRTDesktopNotificationPresenter::AddRef):
+        (DRTDesktopNotificationPresenter::Release):
+        (DRTDesktopNotificationPresenter::showDesktopNotification):
+        (DRTDesktopNotificationPresenter::cancelDesktopNotification):
+        (DRTDesktopNotificationPresenter::notificationDestroyed):
+        (DRTDesktopNotificationPresenter::checkNotificationPermission):
+        (DRTDesktopNotificationPresenter::requestNotificationPermission):
+        * DumpRenderTree/win/DRTDesktopNotificationPresenter.h: Added.
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * DumpRenderTree/win/UIDelegate.cpp:
+        (UIDelegate::UIDelegate):
+        (UIDelegate::desktopNotificationsDelegate):
+        * DumpRenderTree/win/UIDelegate.h:
+        * Scripts/build-webkit:
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Handle arbitrary line endings when manufacturing patches for additions
+        with history.
+
+        * Scripts/svn-create-patch:
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28183
+        Support VS2008 as well as VS2005 in a few scripts.
+
+        * Scripts/pdevenv: Check both $VS80COMNTOOLS and $VS90COMNTOOLS.
+        * Scripts/webkitdirs.pm: Use $VSINSTALLDIR if available instead of hardcoding the VS2005 dir.
+
+2009-08-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        run-webkit-tests --quiet should not output build-dumprendertree output
+        https://bugs.webkit.org/show_bug.cgi?id=28189
+
+        * Scripts/run-webkit-tests:
+
+2009-08-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Exception in land-patches
+        https://bugs.webkit.org/show_bug.cgi?id=27962
+
+        Use ("%s" % object) instead of ("" + object).
+        Added unit tests for logging.py.
+
+        * Scripts/modules/logging.py:
+        * Scripts/modules/logging_unittest.py: Added.
+        * Scripts/run-webkit-unittests:
+
+2009-08-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by NOBODY (Windows layout tests fix).
+
+        Fix for layout tests failures. Need to initialize some preferences early
+        because WebView on Windows uses them during create time.
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (main):
+
+2009-08-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Originally implemented by Glenn Wilson  <gwilson@chromium.org>.
+
+        Added support for overriding default preferences per-test.
+        See https://bugs.webkit.org/show_bug.cgi?id=20534
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (overridePreferenceCallback): add wiring for layoutTestController.overridePreference.
+        (LayoutTestController::staticFunctions): same.
+        * DumpRenderTree/LayoutTestController.h: same.
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::overridePreference): added empty overridePreference method.
+        * DumpRenderTree/mac/DumpRenderTree.mm: implemented preference override.
+        (resetDefaultsToConsistentValues): new method, resets preferences to same set of value before every test.
+        (setDefaultsToConsistentValuesForTesting): new method, sets other details of testing environment, every time  DRT starts.
+        (resetWebViewToConsistentStateBeforeTesting): move some preference setting from here to new resetDefaultsToConsistentValues().
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::overridePreference):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues): new method, resets preferences to same set of value before every test.
+        (resetWebViewToConsistentStateBeforeTesting): move some preference setting from here to new resetDefaultsToConsistentValues().
+        (createWebViewAndOffscreenWindow): same.
+        (main): same.
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::overridePreference):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::overridePreference):
+
+2009-08-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added support for DRT to support arguments for eventSender.mouseDown and eventSender.mouseUp for Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=28166.
+        
+        This is a step towards fixing fast/events/mouse-click-events.html on Windows.
+
+        * DumpRenderTree/win/EventSender.cpp:
+        (mouseDownCallback):
+        (mouseUpCallback):
+        (replaySavedEvents):
+
+2009-08-11  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build the TestNetscapePlugin on Qt/Mac
+
+        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
+
 2009-08-11  Dmitry Titov  <dimich@chromium.org>
 
         Reviewed by NOBODY (build fix).
@@ -61,6 +3697,15 @@
 
 2009-08-10  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
+        Reviewed by Simon Hausmann.
+
+        Fix a bunch of build warnings in TestNetscapePlugin
+        
+        * DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.cpp:
+        * DumpRenderTree/gtk/TestNetscapePlugin/TestNetscapePlugin.cpp:
+
+2009-08-10  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
         Reviewed by Adam Roben.
         
         Allow TestNetscapePlugIn to fall back to the Carbon event model
diff --git a/WebKitTools/CommitQueueStatus/app.yaml b/WebKitTools/CommitQueueStatus/app.yaml
new file mode 100644
index 0000000..2756112
--- /dev/null
+++ b/WebKitTools/CommitQueueStatus/app.yaml
@@ -0,0 +1,11 @@
+application: webkit-commit-queue
+version: 1
+runtime: python
+api_version: 1
+
+handlers:
+- url: /stylesheets
+  static_dir: stylesheets
+
+- url: /.*
+  script: queue_status.py
diff --git a/WebKitTools/CommitQueueStatus/filters/__init__.py b/WebKitTools/CommitQueueStatus/filters/__init__.py
new file mode 100644
index 0000000..ef65bee
--- /dev/null
+++ b/WebKitTools/CommitQueueStatus/filters/__init__.py
@@ -0,0 +1 @@
+# Required for Python to search this directory for module files
diff --git a/WebKitTools/CommitQueueStatus/filters/webkit_extras.py b/WebKitTools/CommitQueueStatus/filters/webkit_extras.py
new file mode 100644
index 0000000..6a08727
--- /dev/null
+++ b/WebKitTools/CommitQueueStatus/filters/webkit_extras.py
@@ -0,0 +1,44 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from django.template.defaultfilters import stringfilter
+from google.appengine.ext import webapp
+
+import re
+
+bug_regexp = re.compile(r"bug (?P<bug_id>\d+)")
+patch_regexp = re.compile(r"patch (?P<patch_id>\d+)")
+
+@stringfilter
+def webkit_linkify(value):
+    value = bug_regexp.sub(r'<a href="http://webkit.org/b/\g<bug_id>">bug \g<bug_id></a>', value)
+    value = patch_regexp.sub(r'<a href="https://bugs.webkit.org/attachment.cgi?id=\g<patch_id>&action=prettypatch">patch \g<patch_id></a>', value)
+    return value
+
+register = webapp.template.create_template_register()
+register.filter(webkit_linkify)
diff --git a/WebKitTools/CommitQueueStatus/index.html b/WebKitTools/CommitQueueStatus/index.html
new file mode 100644
index 0000000..2b5aced
--- /dev/null
+++ b/WebKitTools/CommitQueueStatus/index.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+    <title>WebKit Commit Queue Status</title>
+    <link type="text/css" rel="stylesheet" href="/stylesheets/main.css" />
+</head>
+<body>
+    <center>
+    <div id="current_status">
+        {{ last_status.message|force_escape|urlize|webkit_linkify|safe }}
+        <div id="last_status_date">As of {{ last_status.date|timesince }} ago</div>
+    </div>
+
+    <table id="recent_status_table">
+        <tr>
+            <th colspan=2>Recent Status</th>
+        </tr>
+        {% for recent_status in recent_statuses %}
+        <tr>
+            <td class='status_date'>{{ recent_status.date|timesince }} ago</td>
+            <td class="recent_status">{{ recent_status.message|force_escape|urlize|webkit_linkify|safe }}</td>
+        </tr>
+        {% endfor %}
+    </table>
+
+    <div id="footer"><a href="https://bugs.webkit.org/buglist.cgi?query_format=advanced&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&field0-0-0=flagtypes.name&type0-0-0=equals&value0-0-0=commit-queue%2B">queued bugs</a> | <a href="http://trac.webkit.org/wiki/CommitQueue">documentation</a> | <a href="http://webkit.org/">webkit.org</a></div>
+    </center>
+</body>
+</html>
diff --git a/WebKitTools/CommitQueueStatus/index.yaml b/WebKitTools/CommitQueueStatus/index.yaml
new file mode 100644
index 0000000..a3b9e05
--- /dev/null
+++ b/WebKitTools/CommitQueueStatus/index.yaml
@@ -0,0 +1,11 @@
+indexes:
+
+# AUTOGENERATED
+
+# This index.yaml is automatically updated whenever the dev_appserver
+# detects that a new type of query is run.  If you want to manage the
+# index.yaml file manually, remove the above marker line (the line
+# saying "# AUTOGENERATED").  If you want to manage some indexes
+# manually, move them above the marker line.  The index.yaml file is
+# automatically uploaded to the admin console when you next deploy
+# your application using appcfg.py.
diff --git a/WebKitTools/CommitQueueStatus/queue_status.py b/WebKitTools/CommitQueueStatus/queue_status.py
new file mode 100644
index 0000000..30d2494
--- /dev/null
+++ b/WebKitTools/CommitQueueStatus/queue_status.py
@@ -0,0 +1,96 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import cgi
+import os
+
+# Request a modern Django
+from google.appengine.dist import use_library
+use_library('django', '1.1')
+
+from google.appengine.ext.webapp import template
+from google.appengine.api import users
+from google.appengine.ext import webapp
+from google.appengine.ext.webapp.util import run_wsgi_app
+from google.appengine.ext import db
+
+webapp.template.register_template_library('filters.webkit_extras')
+
+class QueueStatus(db.Model):
+    author = db.UserProperty()
+    active_bug_id = db.IntegerProperty()
+    active_patch_id = db.IntegerProperty()
+    message = db.StringProperty(multiline=True)
+    date = db.DateTimeProperty(auto_now_add=True)
+
+class MainPage(webapp.RequestHandler):
+    def get(self):
+        statuses_query = QueueStatus.all().order('-date')
+        statuses = statuses_query.fetch(6)
+        template_values = {
+            'last_status' : statuses[0],
+            'recent_statuses' : statuses[1:],
+        }
+        self.response.out.write(template.render('index.html', template_values))
+
+class UpdateStatus(webapp.RequestHandler):
+    def get(self):
+        self.response.out.write(template.render('update_status.html', None))
+
+    def _int_from_request(self, name):
+        string_value = self.request.get(name)
+        try:
+            int_value = int(string_value)
+        except ValueError, TypeError:
+            pass
+        return None
+
+    def post(self):
+        queue_status = QueueStatus()
+
+        if users.get_current_user():
+            queue_status.author = users.get_current_user()
+
+        queue_status.active_bug_id = self._int_from_request('bug_id')
+        queue_status.active_patch_id = self._int_from_request('patch_id')
+        queue_status.message = self.request.get('status')
+        queue_status.put()
+        self.redirect('/')
+
+routes = [
+    ('/', MainPage),
+    ('/update_status', UpdateStatus)
+]
+
+application = webapp.WSGIApplication(routes, debug=True)
+
+def main():
+    run_wsgi_app(application)
+
+if __name__ == "__main__":
+    main()
diff --git a/WebKitTools/CommitQueueStatus/stylesheets/main.css b/WebKitTools/CommitQueueStatus/stylesheets/main.css
new file mode 100644
index 0000000..55d3694
--- /dev/null
+++ b/WebKitTools/CommitQueueStatus/stylesheets/main.css
@@ -0,0 +1,26 @@
+body {
+  font-family: Verdana, Helvetica, sans-serif;
+}
+
+#current_status {
+    padding: 5px;
+    font-size: larger;
+}
+
+#last_status_date {
+    font-size: small;
+}
+
+.recent_status {
+    padding-left: 10px;
+}
+
+#recent_status_table {
+    font-size: small;
+    margin: 10px;
+}
+
+#footer {
+    font-size: small;
+    padding-top: 10px;
+}
diff --git a/WebKitTools/CommitQueueStatus/update_status.html b/WebKitTools/CommitQueueStatus/update_status.html
new file mode 100644
index 0000000..edafba4
--- /dev/null
+++ b/WebKitTools/CommitQueueStatus/update_status.html
@@ -0,0 +1,19 @@
+Update the current status of the commit-queue:
+<form name="update_status" method="post">
+ <div>
+     Active Bug Id:
+    <input name="bug_id">
+ </div>
+ <div>
+     Active Patch Id:
+    <input name="patch_id">
+ </div>
+ <div>
+     Space separated list of other bugs in queue:
+    <input name="bugs_in_queue">
+ </div>
+  <div>
+      <textarea name="status" rows="3" cols="60"></textarea>
+  </div>
+  <div><input type="submit" value="Add Status"></div>
+</form>
diff --git a/WebKitTools/DumpRenderTree/AccessibilityController.cpp b/WebKitTools/DumpRenderTree/AccessibilityController.cpp
index 6556f91..af1daf6 100644
--- a/WebKitTools/DumpRenderTree/AccessibilityController.cpp
+++ b/WebKitTools/DumpRenderTree/AccessibilityController.cpp
@@ -52,8 +52,28 @@ void AccessibilityController::makeWindowObject(JSContextRef context, JSObjectRef
     JSObjectSetProperty(context, windowObject, accessibilityControllerStr.get(), accessibilityControllerObject, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
 }
 
+static JSValueRef logFocusEventsCallback(JSContextRef ctx, JSObjectRef, JSObjectRef thisObject, size_t, const JSValueRef[], JSValueRef*)
+{
+    AccessibilityController* controller = static_cast<AccessibilityController*>(JSObjectGetPrivate(thisObject));
+    controller->setLogFocusEvents(true);
+    return JSValueMakeUndefined(ctx);
+}
+
+static JSValueRef logScrollingStartEventsCallback(JSContextRef ctx, JSObjectRef, JSObjectRef thisObject, size_t, const JSValueRef[], JSValueRef*)
+{
+    AccessibilityController* controller = static_cast<AccessibilityController*>(JSObjectGetPrivate(thisObject));
+    controller->setLogScrollingStartEvents(true);
+    return JSValueMakeUndefined(ctx);
+}
+
 JSClassRef AccessibilityController::getJSClass()
 {
+    static JSStaticFunction staticFunctions[] = {
+        { "logFocusEvents", logFocusEventsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "logScrollingStartEvents", logScrollingStartEventsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { 0, 0, 0 }
+    };
+
     static JSStaticValue staticValues[] = {
         { "focusedElement", getFocusedElementCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "rootElement", getRootElementCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -61,10 +81,16 @@ JSClassRef AccessibilityController::getJSClass()
     };
 
     static JSClassDefinition classDefinition = {
-        0, kJSClassAttributeNone, "AccessibilityController", 0, staticValues, 0,
+        0, kJSClassAttributeNone, "AccessibilityController", 0, staticValues, staticFunctions,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
     };
 
     static JSClassRef accessibilityControllerClass = JSClassCreate(&classDefinition);
     return accessibilityControllerClass;
 }
+
+void AccessibilityController::resetToConsistentState()
+{
+    setLogFocusEvents(false);
+    setLogScrollingStartEvents(false);
+}
diff --git a/WebKitTools/DumpRenderTree/AccessibilityController.h b/WebKitTools/DumpRenderTree/AccessibilityController.h
index 0af6613..a10e8be 100644
--- a/WebKitTools/DumpRenderTree/AccessibilityController.h
+++ b/WebKitTools/DumpRenderTree/AccessibilityController.h
@@ -27,6 +27,9 @@
 #define AccessibilityController_h
 
 #include <JavaScriptCore/JSObjectRef.h>
+#if PLATFORM(WIN)
+#include <windows.h>
+#endif
 
 class AccessibilityUIElement;
 
@@ -41,8 +44,18 @@ public:
     AccessibilityUIElement rootElement();
     AccessibilityUIElement focusedElement();
 
+    void setLogFocusEvents(bool);
+    void setLogScrollingStartEvents(bool);
+
+    void resetToConsistentState();
+
 private:
     static JSClassRef getJSClass();
+
+#if PLATFORM(WIN)
+    HWINEVENTHOOK m_focusEventHook;
+    HWINEVENTHOOK m_scrollingStartEventHook;
+#endif
 };
 
 #endif // AccessibilityController_h
diff --git a/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp b/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp
index 8a92766..5958ccb 100644
--- a/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp
+++ b/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp
@@ -140,6 +140,18 @@ static JSValueRef boundsForRangeCallback(JSContextRef context, JSObjectRef funct
     return JSValueMakeString(context, boundsDescription.get());    
 }
 
+static JSValueRef stringForRangeCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    unsigned location = UINT_MAX, length = 0;
+    if (argumentCount == 2) {
+        location = JSValueToNumber(context, arguments[0], exception);
+        length = JSValueToNumber(context, arguments[1], exception);
+    }
+    
+    JSRetainPtr<JSStringRef> stringDescription(Adopt, toAXElement(thisObject)->stringForRange(location, length));
+    return JSValueMakeString(context, stringDescription.get());    
+}
+
 static JSValueRef childAtIndexCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     int indexNumber = -1;
@@ -190,7 +202,8 @@ static JSValueRef attributeValueCallback(JSContextRef context, JSObjectRef funct
     JSStringRef attribute = NULL;
     if (argumentCount == 1)
         attribute = JSValueToStringCopy(context, arguments[0], exception);
-    JSValueRef result = JSValueMakeString(context, toAXElement(thisObject)->attributeValue(attribute));
+    JSRetainPtr<JSStringRef> attributeValue(Adopt, toAXElement(thisObject)->attributeValue(attribute));
+    JSValueRef result = JSValueMakeString(context, attributeValue.get());
     if (attribute)
         JSStringRelease(attribute);
     return result;
@@ -250,6 +263,12 @@ static JSValueRef getRoleCallback(JSContextRef context, JSObjectRef thisObject,
     return JSValueMakeString(context, role.get());
 }
 
+static JSValueRef getSubroleCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    JSRetainPtr<JSStringRef> role(Adopt, toAXElement(thisObject)->subrole());
+    return JSValueMakeString(context, role.get());
+}
+
 static JSValueRef getTitleCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
 {
     JSRetainPtr<JSStringRef> title(Adopt, toAXElement(thisObject)->title());
@@ -363,6 +382,7 @@ JSClassRef AccessibilityUIElement::getJSClass()
 {
     static JSStaticValue staticValues[] = {
         { "role", getRoleCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "subrole", getSubroleCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "title", getTitleCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "description", getDescriptionCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "language", getLanguageCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -392,6 +412,7 @@ JSClassRef AccessibilityUIElement::getJSClass()
         { "parameterizedAttributeNames", parameterizedAttributeNamesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "lineForIndex", lineForIndexCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "boundsForRange", boundsForRangeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "stringForRange", stringForRangeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "childAtIndex", childAtIndexCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "elementAtPoint", elementAtPointCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "attributesOfColumnHeaders", attributesOfColumnHeadersCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
diff --git a/WebKitTools/DumpRenderTree/AccessibilityUIElement.h b/WebKitTools/DumpRenderTree/AccessibilityUIElement.h
index d0b63c3..fffdad8 100644
--- a/WebKitTools/DumpRenderTree/AccessibilityUIElement.h
+++ b/WebKitTools/DumpRenderTree/AccessibilityUIElement.h
@@ -86,6 +86,7 @@ public:
     bool isAttributeSettable(JSStringRef attribute);
     bool isActionSupported(JSStringRef action);
     JSStringRef role();
+    JSStringRef subrole();
     JSStringRef title();
     JSStringRef description();
     JSStringRef language();
@@ -119,6 +120,7 @@ public:
     int lineForIndex(int);
     JSStringRef boundsForRange(unsigned location, unsigned length);
     void setSelectedTextRange(unsigned location, unsigned length);
+    JSStringRef stringForRange(unsigned location, unsigned length);
     
     // Table-specific
     AccessibilityUIElement cellForColumnAndRow(unsigned column, unsigned row);
diff --git a/WebKitTools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj b/WebKitTools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
index fd2c0d9..06f0599 100644
--- a/WebKitTools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
+++ b/WebKitTools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
@@ -35,6 +35,8 @@
 		1AC6C84A0D07638600CD3161 /* PluginObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC6C7800D07589B00CD3161 /* PluginObject.cpp */; };
 		1AC6C84B0D07638600CD3161 /* TestObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC6C7810D07589B00CD3161 /* TestObject.cpp */; };
 		23BCB8900EA57623003C6289 /* OpenGL.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 23BCB88F0EA57623003C6289 /* OpenGL.framework */; };
+		5185F6B210714E07007AA393 /* HistoryDelegate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5185F69F10714A57007AA393 /* HistoryDelegate.mm */; };
+		5185F6B310714E12007AA393 /* HistoryDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 5185F69E10714A57007AA393 /* HistoryDelegate.h */; };
 		5DB9AC970F722C3600684641 /* AHEM____.TTF in Copy Font Files */ = {isa = PBXBuildFile; fileRef = AA7F10C20CB3C1030003BDC9 /* AHEM____.TTF */; };
 		5DB9AC980F722C3600684641 /* WebKitWeightWatcher100.ttf in Copy Font Files */ = {isa = PBXBuildFile; fileRef = 375F09710DAC3CB600C8B4E5 /* WebKitWeightWatcher100.ttf */; };
 		5DB9AC990F722C3600684641 /* WebKitWeightWatcher200.ttf in Copy Font Files */ = {isa = PBXBuildFile; fileRef = 375F09720DAC3CB600C8B4E5 /* WebKitWeightWatcher200.ttf */; };
@@ -189,6 +191,8 @@
 		375F09770DAC3CB600C8B4E5 /* WebKitWeightWatcher700.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher700.ttf; path = fonts/WebKitWeightWatcher700.ttf; sourceTree = "<group>"; };
 		375F09780DAC3CB600C8B4E5 /* WebKitWeightWatcher800.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher800.ttf; path = fonts/WebKitWeightWatcher800.ttf; sourceTree = "<group>"; };
 		375F09790DAC3CB600C8B4E5 /* WebKitWeightWatcher900.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher900.ttf; path = fonts/WebKitWeightWatcher900.ttf; sourceTree = "<group>"; };
+		5185F69E10714A57007AA393 /* HistoryDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HistoryDelegate.h; path = mac/HistoryDelegate.h; sourceTree = "<group>"; };
+		5185F69F10714A57007AA393 /* HistoryDelegate.mm */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; name = HistoryDelegate.mm; path = mac/HistoryDelegate.mm; sourceTree = "<group>"; };
 		8465E2C60FFA8DF2003B8342 /* PixelDumpSupport.cpp */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 30; path = PixelDumpSupport.cpp; sourceTree = "<group>"; };
 		9335435F03D75502008635CE /* WebKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = WebKit.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		933BF5A90F93FA5C000F0441 /* PlainTextController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PlainTextController.h; path = mac/PlainTextController.h; sourceTree = "<group>"; };
@@ -388,6 +392,8 @@
 				BCA18B580C9B08C200114369 /* EditingDelegate.mm */,
 				BCA18B590C9B08C200114369 /* FrameLoadDelegate.h */,
 				BCA18B5A0C9B08C200114369 /* FrameLoadDelegate.mm */,
+				5185F69E10714A57007AA393 /* HistoryDelegate.h */,
+				5185F69F10714A57007AA393 /* HistoryDelegate.mm */,
 				BCA18B5B0C9B08C200114369 /* PolicyDelegate.h */,
 				BCA18B5C0C9B08C200114369 /* PolicyDelegate.mm */,
 				BCA18B5D0C9B08C200114369 /* ResourceLoadDelegate.h */,
@@ -531,6 +537,7 @@
 				BCA18B690C9B08C200114369 /* UIDelegate.h in Headers */,
 				BC9D90250C97472E0099A4A3 /* WorkQueue.h in Headers */,
 				BC9D90260C97472E0099A4A3 /* WorkQueueItem.h in Headers */,
+				5185F6B310714E12007AA393 /* HistoryDelegate.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -696,6 +703,7 @@
 				BCA18B6A0C9B08C200114369 /* UIDelegate.mm in Sources */,
 				BC9D90240C97472E0099A4A3 /* WorkQueue.cpp in Sources */,
 				BCA18B260C9B015C00114369 /* WorkQueueItemMac.mm in Sources */,
+				5185F6B210714E07007AA393 /* HistoryDelegate.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebKitTools/DumpRenderTree/LayoutTestController.cpp b/WebKitTools/DumpRenderTree/LayoutTestController.cpp
index 2a0871f..1f34325 100644
--- a/WebKitTools/DumpRenderTree/LayoutTestController.cpp
+++ b/WebKitTools/DumpRenderTree/LayoutTestController.cpp
@@ -33,26 +33,28 @@
 #include "WorkQueueItem.h"
 #include <JavaScriptCore/JSObjectRef.h>
 #include <JavaScriptCore/JSRetainPtr.h>
+#include <stdio.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
+#include <wtf/RefPtr.h>
 
 LayoutTestController::LayoutTestController(const std::string& testPathOrURL, const std::string& expectedPixelHash)
-    : m_dumpAsText(false)
-    , m_dumpAsPDF(false)
+    : m_dumpAsPDF(false)
+    , m_dumpAsText(false)
     , m_dumpBackForwardList(false)
     , m_dumpChildFrameScrollPositions(false)
     , m_dumpChildFramesAsText(false)
-    , m_dumpDatabaseCallbacks(false)
     , m_dumpDOMAsWebArchive(false)
+    , m_dumpDatabaseCallbacks(false)
+    , m_dumpEditingCallbacks(false)
+    , m_dumpFrameLoadCallbacks(false)
+    , m_dumpResourceLoadCallbacks(false)
+    , m_dumpResourceResponseMIMETypes(false)
     , m_dumpSelectionRect(false)
     , m_dumpSourceAsWebArchive(false)
     , m_dumpStatusCallbacks(false)
     , m_dumpTitleChanges(false)
-    , m_dumpEditingCallbacks(false)
-    , m_dumpResourceLoadCallbacks(false)
-    , m_dumpResourceResponseMIMETypes(false)
     , m_dumpWillCacheResponse(false)
-    , m_dumpFrameLoadCallbacks(false)
     , m_callCloseOnWebViews(true)
     , m_canOpenWindows(false)
     , m_closeRemainingWindowsWhenComplete(true)
@@ -63,7 +65,10 @@ LayoutTestController::LayoutTestController(const std::string& testPathOrURL, con
     , m_waitToDump(false)
     , m_willSendRequestReturnsNullOnRedirect(false)
     , m_windowIsKey(true)
+    , m_alwaysAcceptCookies(false)
     , m_globalFlag(false)
+    , m_isGeolocationPermissionSet(false)
+    , m_geolocationPermission(false)
     , m_testPathOrURL(testPathOrURL)
     , m_expectedPixelHash(expectedPixelHash)
 {
@@ -71,17 +76,17 @@ LayoutTestController::LayoutTestController(const std::string& testPathOrURL, con
 
 // Static Functions
 
-static JSValueRef dumpAsTextCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+static JSValueRef dumpAsPDFCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
-    controller->setDumpAsText(true);
+    controller->setDumpAsPDF(true);
     return JSValueMakeUndefined(context);
 }
 
-static JSValueRef dumpAsPDFCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+static JSValueRef dumpAsTextCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
-    controller->setDumpAsPDF(true);
+    controller->setDumpAsText(true);
     return JSValueMakeUndefined(context);
 }
 
@@ -127,6 +132,13 @@ static JSValueRef dumpEditingCallbacksCallback(JSContextRef context, JSObjectRef
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef dumpFrameLoadCallbacksCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setDumpFrameLoadCallbacks(true);
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef dumpResourceLoadCallbacksCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -362,6 +374,19 @@ static JSValueRef execCommandCallback(JSContextRef context, JSObjectRef function
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef grantDesktopNotificationPermissionCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // Has Windows implementation
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+
+    controller->grantDesktopNotificationPermission(JSValueToStringCopy(context, arguments[0], NULL));
+        
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef isCommandEnabledCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has Mac implementation.
@@ -377,6 +402,22 @@ static JSValueRef isCommandEnabledCallback(JSContextRef context, JSObjectRef fun
     return JSValueMakeBoolean(context, controller->isCommandEnabled(name.get()));
 }
 
+static JSValueRef overridePreferenceCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount < 2)
+        return JSValueMakeUndefined(context);
+
+    JSRetainPtr<JSStringRef> key(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+    JSRetainPtr<JSStringRef> value(Adopt, JSValueToStringCopy(context, arguments[1], exception));
+    ASSERT(!*exception);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->overridePreference(key.get(), value.get());
+
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef keepWebHistoryCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has mac implementation
@@ -505,6 +546,18 @@ static JSValueRef setAcceptsEditingCallback(JSContextRef context, JSObjectRef fu
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef setAlwaysAcceptCookiesCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // Has mac & windows implementation
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setAlwaysAcceptCookies(JSValueToBoolean(context, arguments[0]));
+
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef setAppCacheMaximumSizeCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has mac implementation
@@ -521,6 +574,46 @@ static JSValueRef setAppCacheMaximumSizeCallback(JSContextRef context, JSObjectR
 
 }
 
+static JSValueRef setAuthenticationPasswordCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // Has mac & windows implementation
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    JSRetainPtr<JSStringRef> password(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+
+    size_t maxLength = JSStringGetMaximumUTF8CStringSize(password.get());
+    char* passwordBuffer = new char[maxLength + 1];
+    JSStringGetUTF8CString(password.get(), passwordBuffer, maxLength + 1);
+    
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setAuthenticationPassword(passwordBuffer);
+    delete[] passwordBuffer;
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef setAuthenticationUsernameCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // Has mac & windows implementation
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    JSRetainPtr<JSStringRef> username(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+
+    size_t maxLength = JSStringGetMaximumUTF8CStringSize(username.get());
+    char* usernameBuffer = new char[maxLength + 1];
+    JSStringGetUTF8CString(username.get(), usernameBuffer, maxLength + 1);
+    
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setAuthenticationUsername(usernameBuffer);
+    delete[] usernameBuffer;
+
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef setAuthorAndUserStylesEnabledCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has mac & windows implementation
@@ -577,7 +670,71 @@ static JSValueRef setDatabaseQuotaCallback(JSContextRef context, JSObjectRef fun
         controller->setDatabaseQuota(static_cast<unsigned long long>(quota));
         
     return JSValueMakeUndefined(context);
+}
+
+static JSValueRef setMockGeolocationPositionCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount < 3)
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = reinterpret_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setMockGeolocationPosition(JSValueToNumber(context, arguments[0], NULL),  // latitude
+                                           JSValueToNumber(context, arguments[1], NULL),  // longitude
+                                           JSValueToNumber(context, arguments[2], NULL));  // accuracy
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef setMockGeolocationErrorCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount < 2)
+        return JSValueMakeUndefined(context);
+
+    int code = JSValueToNumber(context, arguments[0], NULL);
+    JSRetainPtr<JSStringRef> message(Adopt, JSValueToStringCopy(context, arguments[1], exception));
+    ASSERT(!*exception);
+
+    LayoutTestController* controller = reinterpret_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setMockGeolocationError(code, message.get());
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef setGeolocationPermissionCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // Has mac implementation
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setGeolocationPermission(JSValueToBoolean(context, arguments[0]));
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef setHandlesAuthenticationChallengesCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // Has mac & windows implementation
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setHandlesAuthenticationChallenges(JSValueToBoolean(context, arguments[0]));
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef setPOSIXLocaleCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    JSRetainPtr<JSStringRef> locale(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+    controller->setPOSIXLocale(locale.get());
 
+    return JSValueMakeUndefined(context);
 }
 
 static JSValueRef setIconDatabaseEnabledCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
@@ -785,6 +942,32 @@ static JSValueRef setStopProvisionalFrameLoadsCallback(JSContextRef context, JSO
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef showWebInspectorCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->showWebInspector();
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef closeWebInspectorCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->closeWebInspector();
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef evaluateInWebInspectorCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    double callId = JSValueToNumber(context, arguments[0], exception);
+    ASSERT(!*exception);
+    JSRetainPtr<JSStringRef> script(Adopt, JSValueToStringCopy(context, arguments[1], exception));
+    ASSERT(!*exception);
+
+    controller->evaluateInWebInspector(static_cast<long>(callId), script.get());
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef elementDoesAutoCompleteForElementWithIdCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -844,6 +1027,51 @@ static JSValueRef waitForPolicyDelegateCallback(JSContextRef context, JSObjectRe
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef whiteListAccessFromOriginCallback(JSContextRef context, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount != 4)
+        return JSValueMakeUndefined(context);
+
+    JSRetainPtr<JSStringRef> sourceOrigin(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+    JSRetainPtr<JSStringRef> destinationProtocol(Adopt, JSValueToStringCopy(context, arguments[1], exception));
+    ASSERT(!*exception);
+    JSRetainPtr<JSStringRef> destinationHost(Adopt, JSValueToStringCopy(context, arguments[2], exception));
+    ASSERT(!*exception);
+    bool allowDestinationSubdomains = JSValueToBoolean(context, arguments[3]);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->whiteListAccessFromOrigin(sourceOrigin.get(), destinationProtocol.get(), destinationHost.get(), allowDestinationSubdomains);
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef addUserScriptCallback(JSContextRef context, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount != 2)
+        return JSValueMakeUndefined(context);
+    
+    JSRetainPtr<JSStringRef> source(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+    bool runAtStart = JSValueToBoolean(context, arguments[1]);
+    
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->addUserScript(source.get(), runAtStart);
+    return JSValueMakeUndefined(context);
+}
+ 
+static JSValueRef addUserStyleSheetCallback(JSContextRef context, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount != 1)
+        return JSValueMakeUndefined(context);
+    
+    JSRetainPtr<JSStringRef> source(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+   
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->addUserStyleSheet(source.get());
+    return JSValueMakeUndefined(context);
+}
+
 // Static Values
 
 static JSValueRef getGlobalFlagCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
@@ -858,6 +1086,12 @@ static JSValueRef getWebHistoryItemCountCallback(JSContextRef context, JSObjectR
     return JSValueMakeNumber(context, controller->webHistoryItemCount());
 }
 
+static JSValueRef getWorkerThreadCountCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(context, controller->workerThreadCount());
+}
+
 static bool setGlobalFlagCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -904,6 +1138,7 @@ JSStaticValue* LayoutTestController::staticValues()
     static JSStaticValue staticValues[] = {
         { "globalFlag", getGlobalFlagCallback, setGlobalFlagCallback, kJSPropertyAttributeNone },
         { "webHistoryItemCount", getWebHistoryItemCountCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "workerThreadCount", getWorkerThreadCountCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { 0, 0, 0, 0 }
     };
     return staticValues;
@@ -913,9 +1148,12 @@ JSStaticFunction* LayoutTestController::staticFunctions()
 {
     static JSStaticFunction staticFunctions[] = {
         { "addDisallowedURL", addDisallowedURLCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "addUserScript", addUserScriptCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "addUserStyleSheet", addUserStyleSheetCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "clearAllDatabases", clearAllDatabasesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "clearBackForwardList", clearBackForwardListCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "clearPersistentUserStyleSheet", clearPersistentUserStyleSheetCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "closeWebInspector", closeWebInspectorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "decodeHostName", decodeHostNameCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "disableImageLoading", disableImageLoadingCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dispatchPendingLoadRequests", dispatchPendingLoadRequestsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -927,6 +1165,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "dumpDOMAsWebArchive", dumpDOMAsWebArchiveCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dumpDatabaseCallbacks", dumpDatabaseCallbacksCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dumpEditingCallbacks", dumpEditingCallbacksCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "dumpFrameLoadCallbacks", dumpFrameLoadCallbacksCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dumpResourceLoadCallbacks", dumpResourceLoadCallbacksCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dumpResourceResponseMIMETypes", dumpResourceResponseMIMETypesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dumpSelectionRect", dumpSelectionRectCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -936,11 +1175,14 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "dumpWillCacheResponse", dumpWillCacheResponseCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "elementDoesAutoCompleteForElementWithId", elementDoesAutoCompleteForElementWithIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "encodeHostName", encodeHostNameCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "evaluateInWebInspector", evaluateInWebInspectorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "execCommand", execCommandCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "grantDesktopNotificationPermission", grantDesktopNotificationPermissionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, 
         { "isCommandEnabled", isCommandEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "keepWebHistory", keepWebHistoryCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "notifyDone", notifyDoneCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "numberOfActiveAnimations", numberOfActiveAnimationsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "overridePreference", overridePreferenceCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pathToLocalResource", pathToLocalResourceCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pauseAnimationAtTimeOnElementWithId", pauseAnimationAtTimeOnElementWithIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pauseTransitionAtTimeOnElementWithId", pauseTransitionAtTimeOnElementWithIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -953,17 +1195,25 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "queueReload", queueReloadCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "repaintSweepHorizontally", repaintSweepHorizontallyCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAcceptsEditing", setAcceptsEditingCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
-        { "setAuthorAndUserStylesEnabled", setAuthorAndUserStylesEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setAlwaysAcceptCookies", setAlwaysAcceptCookiesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAppCacheMaximumSize", setAppCacheMaximumSizeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, 
+        { "setAuthenticationPassword", setAuthenticationPasswordCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setAuthenticationUsername", setAuthenticationUsernameCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setAuthorAndUserStylesEnabled", setAuthorAndUserStylesEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setCallCloseOnWebViews", setCallCloseOnWebViewsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setCanOpenWindows", setCanOpenWindowsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setCacheModel", setCacheModelCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setCloseRemainingWindowsWhenComplete", setCloseRemainingWindowsWhenCompleteCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setCustomPolicyDelegate", setCustomPolicyDelegateCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setDatabaseQuota", setDatabaseQuotaCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, 
+        { "setGeolocationPermission", setGeolocationPermissionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setHandlesAuthenticationChallenges", setHandlesAuthenticationChallengesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setPOSIXLocale", setPOSIXLocaleCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setIconDatabaseEnabled", setIconDatabaseEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setJavaScriptProfilingEnabled", setJavaScriptProfilingEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setMainFrameIsFirstResponder", setMainFrameIsFirstResponderCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setMockGeolocationPosition", setMockGeolocationPositionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setMockGeolocationError", setMockGeolocationErrorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setPersistentUserStyleSheetLocation", setPersistentUserStyleSheetLocationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setPopupBlockingEnabled", setPopupBlockingEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setPrivateBrowsingEnabled", setPrivateBrowsingEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -977,11 +1227,13 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "setUserStyleSheetLocation", setUserStyleSheetLocationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setWillSendRequestReturnsNullOnRedirect", setWillSendRequestReturnsNullOnRedirectCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setWindowIsKey", setWindowIsKeyCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "showWebInspector", showWebInspectorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "testOnscreen", testOnscreenCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "testRepaint", testRepaintCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "waitForPolicyDelegate", waitForPolicyDelegateCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "waitUntilDone", waitUntilDoneCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "windowCount", windowCountCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "whiteListAccessFromOrigin", whiteListAccessFromOriginCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { 0, 0, 0 }
     };
 
@@ -1012,3 +1264,41 @@ void LayoutTestController::queueReload()
 {
     WorkQueue::shared()->queue(new ReloadItem);
 }
+
+void LayoutTestController::grantDesktopNotificationPermission(JSStringRef origin)
+{
+    m_desktopNotificationAllowedOrigins.push_back(JSStringRetain(origin));
+}
+
+bool LayoutTestController::checkDesktopNotificationPermission(JSStringRef origin)
+{
+    std::vector<JSStringRef>::iterator i;
+    for (i = m_desktopNotificationAllowedOrigins.begin();
+         i != m_desktopNotificationAllowedOrigins.end();
+         ++i) {
+        if (JSStringIsEqual(*i, origin))
+            return true;
+    }
+    return false;
+}
+
+void LayoutTestController::waitToDumpWatchdogTimerFired()
+{
+    const char* message = "FAIL: Timed out waiting for notifyDone to be called\n";
+    fprintf(stderr, "%s", message);
+    fprintf(stdout, "%s", message);
+    notifyDone();
+}
+
+void LayoutTestController::setGeolocationPermission(bool allow)
+{
+    m_isGeolocationPermissionSet = true;
+    m_geolocationPermission = allow;
+}
+
+void LayoutTestController::setPOSIXLocale(JSStringRef locale)
+{
+    char localeBuf[32];
+    JSStringGetUTF8CString(locale, localeBuf, sizeof(localeBuf));
+    setlocale(LC_ALL, localeBuf);
+}
diff --git a/WebKitTools/DumpRenderTree/LayoutTestController.h b/WebKitTools/DumpRenderTree/LayoutTestController.h
index 5bc9d61..7c829ef 100644
--- a/WebKitTools/DumpRenderTree/LayoutTestController.h
+++ b/WebKitTools/DumpRenderTree/LayoutTestController.h
@@ -32,6 +32,7 @@
 #include <JavaScriptCore/JSObjectRef.h>
 #include <wtf/RefCounted.h>
 #include <string>
+#include <vector>
 
 class LayoutTestController : public RefCounted<LayoutTestController> {
 public:
@@ -53,6 +54,7 @@ public:
     bool isCommandEnabled(JSStringRef name);
     void keepWebHistory();
     void notifyDone();
+    void overridePreference(JSStringRef key, JSStringRef value);
     JSStringRef pathToLocalResource(JSContextRef, JSStringRef url);
     void queueBackNavigation(int howFarBackward);
     void queueForwardNavigation(int howFarForward);
@@ -66,6 +68,8 @@ public:
     void setCacheModel(int);
     void setCustomPolicyDelegate(bool setDelegate, bool permissive);
     void setDatabaseQuota(unsigned long long quota);
+    void setMockGeolocationPosition(double latitude, double longitude, double accuracy);
+    void setMockGeolocationError(int code, JSStringRef message);
     void setIconDatabaseEnabled(bool iconDatabaseEnabled);
     void setJavaScriptProfilingEnabled(bool profilingEnabled);
     void setMainFrameIsFirstResponder(bool flag);
@@ -81,15 +85,19 @@ public:
     void setUserStyleSheetLocation(JSStringRef path);
     void waitForPolicyDelegate();
     size_t webHistoryItemCount();
+    unsigned workerThreadCount() const;
     int windowCount();
     
-    bool elementDoesAutoCompleteForElementWithId(JSStringRef id);
+    void grantDesktopNotificationPermission(JSStringRef origin);
+    bool checkDesktopNotificationPermission(JSStringRef origin);
 
-    bool dumpAsText() const { return m_dumpAsText; }
-    void setDumpAsText(bool dumpAsText) { m_dumpAsText = dumpAsText; }
+    bool elementDoesAutoCompleteForElementWithId(JSStringRef id);
 
     bool dumpAsPDF() const { return m_dumpAsPDF; }
     void setDumpAsPDF(bool dumpAsPDF) { m_dumpAsPDF = dumpAsPDF; }
+
+    bool dumpAsText() const { return m_dumpAsText; }
+    void setDumpAsText(bool dumpAsText) { m_dumpAsText = dumpAsText; }
     
     bool dumpBackForwardList() const { return m_dumpBackForwardList; }
     void setDumpBackForwardList(bool dumpBackForwardList) { m_dumpBackForwardList = dumpBackForwardList; }
@@ -103,36 +111,36 @@ public:
     bool dumpDatabaseCallbacks() const { return m_dumpDatabaseCallbacks; }
     void setDumpDatabaseCallbacks(bool dumpDatabaseCallbacks) { m_dumpDatabaseCallbacks = dumpDatabaseCallbacks; }
 
-    bool dumpStatusCallbacks() const { return m_dumpStatusCallbacks; }
-    void setDumpStatusCallbacks(bool dumpStatusCallbacks) { m_dumpStatusCallbacks = dumpStatusCallbacks; }
-
     bool dumpDOMAsWebArchive() const { return m_dumpDOMAsWebArchive; }
     void setDumpDOMAsWebArchive(bool dumpDOMAsWebArchive) { m_dumpDOMAsWebArchive = dumpDOMAsWebArchive; }
 
-    bool dumpSelectionRect() const { return m_dumpSelectionRect; }
-    void setDumpSelectionRect(bool dumpSelectionRect) { m_dumpSelectionRect = dumpSelectionRect; }
-
-    bool dumpSourceAsWebArchive() const { return m_dumpSourceAsWebArchive; }
-    void setDumpSourceAsWebArchive(bool dumpSourceAsWebArchive) { m_dumpSourceAsWebArchive = dumpSourceAsWebArchive; }
-
-    bool dumpTitleChanges() const { return m_dumpTitleChanges; }
-    void setDumpTitleChanges(bool dumpTitleChanges) { m_dumpTitleChanges = dumpTitleChanges; }
-
     bool dumpEditingCallbacks() const { return m_dumpEditingCallbacks; }
     void setDumpEditingCallbacks(bool dumpEditingCallbacks) { m_dumpEditingCallbacks = dumpEditingCallbacks; }
 
+    bool dumpFrameLoadCallbacks() const { return m_dumpFrameLoadCallbacks; }
+    void setDumpFrameLoadCallbacks(bool dumpFrameLoadCallbacks) { m_dumpFrameLoadCallbacks = dumpFrameLoadCallbacks; }
+
     bool dumpResourceLoadCallbacks() const { return m_dumpResourceLoadCallbacks; }
     void setDumpResourceLoadCallbacks(bool dumpResourceLoadCallbacks) { m_dumpResourceLoadCallbacks = dumpResourceLoadCallbacks; }
     
     bool dumpResourceResponseMIMETypes() const { return m_dumpResourceResponseMIMETypes; }
     void setDumpResourceResponseMIMETypes(bool dumpResourceResponseMIMETypes) { m_dumpResourceResponseMIMETypes = dumpResourceResponseMIMETypes; }
 
-    bool dumpWillCacheResponse() const { return m_dumpWillCacheResponse; }
-    void setDumpWillCacheResponse(bool dumpWillCacheResponse) { m_dumpWillCacheResponse = dumpWillCacheResponse; }
+    bool dumpSelectionRect() const { return m_dumpSelectionRect; }
+    void setDumpSelectionRect(bool dumpSelectionRect) { m_dumpSelectionRect = dumpSelectionRect; }
 
-    bool dumpFrameLoadCallbacks() const { return m_dumpFrameLoadCallbacks; }
-    void setDumpFrameLoadCallbacks(bool dumpFrameLoadCallbacks) { m_dumpFrameLoadCallbacks = dumpFrameLoadCallbacks; }
+    bool dumpSourceAsWebArchive() const { return m_dumpSourceAsWebArchive; }
+    void setDumpSourceAsWebArchive(bool dumpSourceAsWebArchive) { m_dumpSourceAsWebArchive = dumpSourceAsWebArchive; }
+
+    bool dumpStatusCallbacks() const { return m_dumpStatusCallbacks; }
+    void setDumpStatusCallbacks(bool dumpStatusCallbacks) { m_dumpStatusCallbacks = dumpStatusCallbacks; }
 
+    bool dumpTitleChanges() const { return m_dumpTitleChanges; }
+    void setDumpTitleChanges(bool dumpTitleChanges) { m_dumpTitleChanges = dumpTitleChanges; }
+    
+    bool dumpWillCacheResponse() const { return m_dumpWillCacheResponse; }
+    void setDumpWillCacheResponse(bool dumpWillCacheResponse) { m_dumpWillCacheResponse = dumpWillCacheResponse; }
+    
     bool callCloseOnWebViews() const { return m_callCloseOnWebViews; }
     void setCallCloseOnWebViews(bool callCloseOnWebViews) { m_callCloseOnWebViews = callCloseOnWebViews; }
 
@@ -156,6 +164,7 @@ public:
 
     bool waitToDump() const { return m_waitToDump; }
     void setWaitToDump(bool waitToDump);
+    void waitToDumpWatchdogTimerFired();
 
     bool willSendRequestReturnsNullOnRedirect() const { return m_willSendRequestReturnsNullOnRedirect; }
     void setWillSendRequestReturnsNullOnRedirect(bool returnsNull) { m_willSendRequestReturnsNullOnRedirect = returnsNull; }
@@ -163,6 +172,18 @@ public:
     bool windowIsKey() const { return m_windowIsKey; }
     void setWindowIsKey(bool windowIsKey);
 
+    bool alwaysAcceptCookies() const { return m_alwaysAcceptCookies; }
+    void setAlwaysAcceptCookies(bool alwaysAcceptCookies);
+    
+    bool handlesAuthenticationChallenges() const { return m_handlesAuthenticationChallenges; }
+    void setHandlesAuthenticationChallenges(bool handlesAuthenticationChallenges) { m_handlesAuthenticationChallenges = handlesAuthenticationChallenges; }
+    
+    const std::string& authenticationUsername() const { return m_authenticationUsername; }
+    void setAuthenticationUsername(std::string username) { m_authenticationUsername = username; }
+    
+    const std::string& authenticationPassword() const { return m_authenticationPassword; }
+    void setAuthenticationPassword(std::string password) { m_authenticationPassword = password; }
+
     bool globalFlag() const { return m_globalFlag; }
     void setGlobalFlag(bool globalFlag) { m_globalFlag = globalFlag; }
     
@@ -172,24 +193,39 @@ public:
     bool pauseAnimationAtTimeOnElementWithId(JSStringRef animationName, double time, JSStringRef elementId);
     bool pauseTransitionAtTimeOnElementWithId(JSStringRef propertyName, double time, JSStringRef elementId);
     unsigned numberOfActiveAnimations() const;
-    
+
+    void whiteListAccessFromOrigin(JSStringRef sourceOrigin, JSStringRef destinationProtocol, JSStringRef destinationHost, bool allowDestinationSubdomains);
+
+    void addUserScript(JSStringRef source, bool runAtStart);
+    void addUserStyleSheet(JSStringRef source);
+
+    void setGeolocationPermission(bool allow);
+    bool isGeolocationPermissionSet() const { return m_isGeolocationPermissionSet; }
+    bool geolocationPermission() const { return m_geolocationPermission; }
+
+    void showWebInspector();
+    void closeWebInspector();
+    void evaluateInWebInspector(long callId, JSStringRef script);
+
+    void setPOSIXLocale(JSStringRef locale);
+
 private:
-    bool m_dumpAsText;
     bool m_dumpAsPDF;
+    bool m_dumpAsText;
     bool m_dumpBackForwardList;
     bool m_dumpChildFrameScrollPositions;
     bool m_dumpChildFramesAsText;
-    bool m_dumpDatabaseCallbacks;
     bool m_dumpDOMAsWebArchive;
+    bool m_dumpDatabaseCallbacks;
+    bool m_dumpEditingCallbacks;
+    bool m_dumpFrameLoadCallbacks;
+    bool m_dumpResourceLoadCallbacks;
+    bool m_dumpResourceResponseMIMETypes;
     bool m_dumpSelectionRect;
     bool m_dumpSourceAsWebArchive;
     bool m_dumpStatusCallbacks;
     bool m_dumpTitleChanges;
-    bool m_dumpEditingCallbacks;
-    bool m_dumpResourceLoadCallbacks;
-    bool m_dumpResourceResponseMIMETypes;
     bool m_dumpWillCacheResponse;
-    bool m_dumpFrameLoadCallbacks;
     bool m_callCloseOnWebViews;
     bool m_canOpenWindows;
     bool m_closeRemainingWindowsWhenComplete;
@@ -200,12 +236,20 @@ private:
     bool m_waitToDump; // True if waitUntilDone() has been called, but notifyDone() has not yet been called.
     bool m_willSendRequestReturnsNullOnRedirect;
     bool m_windowIsKey;
-
+    bool m_alwaysAcceptCookies;
     bool m_globalFlag;
+    bool m_isGeolocationPermissionSet;
+    bool m_geolocationPermission;
+    bool m_handlesAuthenticationChallenges;
 
+    std::string m_authenticationUsername;
+    std::string m_authenticationPassword; 
     std::string m_testPathOrURL;
     std::string m_expectedPixelHash;    // empty string if no hash
     
+    // origins which have been granted desktop notification access
+    std::vector<JSStringRef> m_desktopNotificationAllowedOrigins;
+    
     static JSClassRef getJSClass();
     static JSStaticValue* staticValues();
     static JSStaticFunction* staticFunctions();
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.cpp
index af60df4..0b32191 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.cpp
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.cpp
@@ -87,7 +87,7 @@ static void initializeIdentifiers(void)
     browser->getstringidentifiers(testMethodIdentifierNames, NUM_METHOD_IDENTIFIERS, testMethodIdentifiers);
 }
 
-static NPObject *testAllocate(NPP npp, NPClass *theClass)
+static NPObject *testAllocate(NPP /*npp*/, NPClass* /*theClass*/)
 {
     NPObject *newInstance = static_cast<NPObject*>(malloc(sizeof(NPObject)));
     
@@ -113,7 +113,7 @@ static bool testHasMethod(NPObject*, NPIdentifier name)
     return false;
 }
 
-static bool testInvoke(NPObject* header, NPIdentifier name, const NPVariant* args, uint32_t argCount, NPVariant* result)
+static bool testInvoke(NPObject* header, NPIdentifier name, const NPVariant* /*args*/, uint32_t /*argCount*/, NPVariant* /*result*/)
 {
     if (name == testMethodIdentifiers[ID_THROW_EXCEPTION_METHOD]) {
         browser->setexception(header, "test object throwException SUCCESS");
@@ -145,7 +145,7 @@ static bool testGetProperty(NPObject* npobj, NPIdentifier name, NPVariant* resul
 }
 
 
-static bool testEnumerate(NPObject *npobj, NPIdentifier **value, uint32_t *count)
+static bool testEnumerate(NPObject* /*npobj*/, NPIdentifier **value, uint32_t *count)
 {
     *count = NUM_ENUMERATABLE_TEST_IDENTIFIERS;
     
@@ -155,7 +155,7 @@ static bool testEnumerate(NPObject *npobj, NPIdentifier **value, uint32_t *count
     return true;
 }
 
-static bool testConstruct(NPObject* npobj, const NPVariant* args, uint32_t argCount, NPVariant* result)
+static bool testConstruct(NPObject* npobj, const NPVariant* /*args*/, uint32_t /*argCount*/, NPVariant* result)
 {
     browser->retainobject(npobj);
     
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp
index 704ba09..88618c3 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp
@@ -64,6 +64,8 @@ void NP_Shutdown(void)
 {
 }
 
+static void executeScript(const PluginObject* obj, const char* script);
+
 NPError NPP_New(NPMIMEType pluginType, NPP instance, uint16 mode, int16 argc, char *argn[], char *argv[], NPSavedData *saved)
 {
     bool forceCarbon = false;
@@ -101,7 +103,8 @@ NPError NPP_New(NPMIMEType pluginType, NPP instance, uint16 mode, int16 argc, ch
             for (int i = 0; i < argc; i++)
                 if (strcasecmp(argn[i], "src") == 0)
                     pluginLog(instance, "src: %s", argv[i]);
-        }
+        } else if (strcasecmp(argn[i], "cleardocumentduringnew") == 0)
+            executeScript(obj, "document.body.innerHTML = ''");
     }
         
 #ifndef NP_NO_CARBON
diff --git a/WebKitTools/DumpRenderTree/fonts/WebKit Layout Tests 2.ttf b/WebKitTools/DumpRenderTree/fonts/WebKit Layout Tests 2.ttf
new file mode 100644
index 0000000..e732fbc
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/fonts/WebKit Layout Tests 2.ttf
diff --git a/WebKitTools/DumpRenderTree/fonts/WebKit Layout Tests.ttf b/WebKitTools/DumpRenderTree/fonts/WebKit Layout Tests.ttf
new file mode 100644
index 0000000..f9f997e
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/fonts/WebKit Layout Tests.ttf
diff --git a/WebKitTools/DumpRenderTree/gtk/AccessibilityControllerGtk.cpp b/WebKitTools/DumpRenderTree/gtk/AccessibilityControllerGtk.cpp
index ab92e1d..593f2eb 100644
--- a/WebKitTools/DumpRenderTree/gtk/AccessibilityControllerGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/AccessibilityControllerGtk.cpp
@@ -61,3 +61,11 @@ AccessibilityUIElement AccessibilityController::rootElement()
     AtkObject* axObject = gtk_widget_get_accessible(GTK_WIDGET(view));
     return AccessibilityUIElement(axObject);
 }
+
+void AccessibilityController::setLogFocusEvents(bool)
+{
+}
+
+void AccessibilityController::setLogScrollingStartEvents(bool)
+{
+}
diff --git a/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp b/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
index be1bbed..9aa31a8 100644
--- a/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
@@ -67,9 +67,9 @@ void AccessibilityUIElement::getChildren(Vector<AccessibilityUIElement>& childre
     }
 }
 
-void AccessibilityUIElement::getChildrenWithRange(Vector<AccessibilityUIElement>& elementVector, unsigned location, unsigned length)
+void AccessibilityUIElement::getChildrenWithRange(Vector<AccessibilityUIElement>& elementVector, unsigned start, unsigned end)
 {
-    for (unsigned i = location; i < length; i++) {
+    for (unsigned i = start; i < end; i++) {
         AtkObject* child = atk_object_ref_accessible_child(ATK_OBJECT(m_element), i);
         elementVector.append(AccessibilityUIElement(child));
     }
@@ -94,7 +94,7 @@ AccessibilityUIElement AccessibilityUIElement::elementAtPoint(int x, int y)
 AccessibilityUIElement AccessibilityUIElement::getChildAtIndex(unsigned index)
 {
     Vector<AccessibilityUIElement> children;
-    getChildrenWithRange(children, index, 1);
+    getChildrenWithRange(children, index, index + 1);
 
     if (children.size() == 1)
         return children.at(0);
@@ -156,6 +156,11 @@ JSStringRef AccessibilityUIElement::role()
     return JSStringCreateWithUTF8CString(atk_role_get_name(role));
 }
 
+JSStringRef AccessibilityUIElement::subrole()
+{
+    return 0;
+}
+
 JSStringRef AccessibilityUIElement::title()
 {
     const gchar* name = atk_object_get_name(ATK_OBJECT(m_element));
@@ -377,6 +382,12 @@ JSStringRef AccessibilityUIElement::boundsForRange(unsigned location, unsigned l
     return JSStringCreateWithCharacters(0, 0);
 }
 
+JSStringRef AccessibilityUIElement::stringForRange(unsigned, unsigned) 
+{
+    // FIXME: implement
+    return JSStringCreateWithCharacters(0, 0);
+} 
+
 AccessibilityUIElement AccessibilityUIElement::cellForColumnAndRow(unsigned column, unsigned row)
 {
     // FIXME: implement
diff --git a/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
index ac82dd8..6ecd774 100644
--- a/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
@@ -32,6 +32,7 @@
 #include "DumpRenderTree.h"
 
 #include "AccessibilityController.h"
+#include "EventSender.h"
 #include "GCController.h"
 #include "LayoutTestController.h"
 #include "WorkQueue.h"
@@ -43,6 +44,10 @@
 
 #include <wtf/Assertions.h>
 
+#if PLATFORM(X11)
+#include <fontconfig/fontconfig.h>
+#endif
+
 #include <cassert>
 #include <getopt.h>
 #include <stdlib.h>
@@ -58,10 +63,12 @@ extern GList* webkit_web_history_item_get_children(WebKitWebHistoryItem*);
 extern GSList* webkit_web_frame_get_children(WebKitWebFrame* frame);
 extern gchar* webkit_web_frame_get_inner_text(WebKitWebFrame* frame);
 extern gchar* webkit_web_frame_dump_render_tree(WebKitWebFrame* frame);
+extern guint webkit_web_frame_get_pending_unload_event_count(WebKitWebFrame* frame);
 extern void webkit_web_settings_add_extra_plugin_directory(WebKitWebView* view, const gchar* directory);
 extern gchar* webkit_web_frame_get_response_mime_type(WebKitWebFrame* frame);
 extern void webkit_web_frame_clear_main_frame_name(WebKitWebFrame* frame);
 extern void webkit_web_view_set_group_name(WebKitWebView* view, const gchar* groupName);
+extern void webkit_reset_origin_access_white_lists();
 }
 
 volatile bool done;
@@ -73,6 +80,7 @@ AccessibilityController* axController = 0;
 LayoutTestController* gLayoutTestController = 0;
 static GCController* gcController = 0;
 static WebKitWebView* webView;
+static GtkWidget* window;
 static GtkWidget* container;
 WebKitWebFrame* mainFrame = 0;
 WebKitWebFrame* topLoadingFrame = 0;
@@ -122,6 +130,41 @@ static void appendString(gchar*& target, gchar* string)
     g_free(oldString);
 }
 
+#if PLATFORM(X11)
+static void initializeFonts()
+{
+    static int numFonts = -1;
+
+    // Some tests may add or remove fonts via the @font-face rule.
+    // If that happens, font config should be re-created to suppress any unwanted change.
+    FcFontSet* appFontSet = FcConfigGetFonts(0, FcSetApplication);
+    if (appFontSet && numFonts >= 0 && appFontSet->nfont == numFonts)
+        return;
+
+    const char* fontDirEnv = g_getenv("WEBKIT_TESTFONTS");
+    if (!fontDirEnv)
+        g_error("WEBKIT_TESTFONTS environment variable is not set, but it should point to the directory "
+                "containing the fonts you can clone from git://gitorious.org/qtwebkit/testfonts.git\n");
+
+    GFile* fontDir = g_file_new_for_path(fontDirEnv);
+    if (!fontDir || !g_file_query_exists(fontDir, NULL))
+        g_error("WEBKIT_TESTFONTS environment variable is not set correctly - it should point to the directory "
+                "containing the fonts you can clone from git://gitorious.org/qtwebkit/testfonts.git\n");
+
+    FcConfig *config = FcConfigCreate();
+    if (!FcConfigParseAndLoad (config, (FcChar8*) FONTS_CONF_FILE, true))
+        g_error("Couldn't load font configuration file");
+    if (!FcConfigAppFontAddDir (config, (FcChar8*) g_file_get_path(fontDir)))
+        g_error("Couldn't add font dir!");
+    FcConfigSetCurrent(config);
+
+    g_object_unref(fontDir);
+
+    appFontSet = FcConfigGetFonts(config, FcSetApplication);
+    numFonts = appFontSet->nfont;
+}
+#endif
+
 static gchar* dumpFramesAsText(WebKitWebFrame* frame)
 {
     gchar* result = 0;
@@ -262,7 +305,7 @@ static void invalidateAnyPreviousWaitToDumpWatchdog()
     waitForPolicy = false;
 }
 
-static void resetWebViewToConsistentStateBeforeTesting()
+static void resetDefaultsToConsistentValues()
 {
     WebKitWebSettings* settings = webkit_web_view_get_settings(webView);
     g_object_set(G_OBJECT(settings),
@@ -274,12 +317,25 @@ static void resetWebViewToConsistentStateBeforeTesting()
                  "enable-xss-auditor", FALSE,
                  "javascript-can-open-windows-automatically", TRUE,
                  "enable-offline-web-application-cache", TRUE,
+                 "enable-universal-access-from-file-uris", TRUE,
+                 "enable-scripts", TRUE,
+                 "default-font-family", "Times",
+                 "monospace-font-family", "Courier",
+                 "serif-font-family", "Times",
+                 "sans-serif-font-family", "Helvetica",
+                 "default-font-size", 16,
+                 "default-monospace-font-size", 13,
+                 "minimum-font-size", 1,
                  NULL);
 
     webkit_web_frame_clear_main_frame_name(mainFrame);
 
     WebKitWebInspector* inspector = webkit_web_view_get_inspector(webView);
     g_object_set(G_OBJECT(inspector), "javascript-profiling-enabled", FALSE, NULL);
+
+    webkit_reset_origin_access_white_lists();
+
+    setlocale(LC_ALL, "");
 }
 
 void dump()
@@ -354,16 +410,7 @@ static void setDefaultsToConsistentStateValuesForTesting()
 {
     gdk_screen_set_resolution(gdk_screen_get_default(), 72.0);
 
-    WebKitWebSettings* settings = webkit_web_view_get_settings(webView);
-    g_object_set(G_OBJECT(settings),
-                 "default-font-family", "Times",
-                 "monospace-font-family", "Courier",
-                 "serif-font-family", "Times",
-                 "sans-serif-font-family", "Helvetica",
-                 "default-font-size", 16,
-                 "default-monospace-font-size", 13,
-                 "minimum-font-size", 1,
-                 NULL);
+    resetDefaultsToConsistentValues();
 
     /* Disable the default auth dialog for testing */
     SoupSession* session = webkit_get_default_session();
@@ -372,6 +419,10 @@ static void setDefaultsToConsistentStateValuesForTesting()
 #if PLATFORM(X11)
     webkit_web_settings_add_extra_plugin_directory(webView, TEST_PLUGIN_DIR);
 #endif
+
+    gchar* databaseDirectory = g_build_filename(g_get_user_data_dir(), "gtkwebkitdrt", "databases", NULL);
+    webkit_set_web_database_directory_path(databaseDirectory);
+    g_free(databaseDirectory);
 }
 
 static void runTest(const string& testPathOrURL)
@@ -391,7 +442,7 @@ static void runTest(const string& testPathOrURL)
     gchar* url = autocorrectURL(pathOrURL.c_str());
     const string testURL(url);
 
-    resetWebViewToConsistentStateBeforeTesting();
+    resetDefaultsToConsistentValues();
 
     gLayoutTestController = new LayoutTestController(testURL, expectedPixelHash);
     topLoadingFrame = 0;
@@ -407,8 +458,10 @@ static void runTest(const string& testPathOrURL)
 
     bool isSVGW3CTest = (gLayoutTestController->testPathOrURL().find("svg/W3C-SVG-1.1") != string::npos);
     GtkAllocation size;
+    size.x = size.y = 0;
     size.width = isSVGW3CTest ? 480 : maxViewWidth;
     size.height = isSVGW3CTest ? 360 : maxViewHeight;
+    gtk_window_resize(GTK_WINDOW(window), size.width, size.height);
     gtk_widget_size_allocate(container, &size);
 
     if (prevTestBFItem)
@@ -418,7 +471,12 @@ static void runTest(const string& testPathOrURL)
     if (prevTestBFItem)
         g_object_ref(prevTestBFItem);
 
+#if PLATFORM(X11)
+    initializeFonts();
+#endif
 
+    // Focus the web view before loading the test to avoid focusing problems
+    gtk_widget_grab_focus(GTK_WIDGET(webView));
     webkit_web_view_open(webView, url);
 
     g_free(url);
@@ -462,8 +520,39 @@ static gboolean processWork(void* data)
     return FALSE;
 }
 
+static char* getFrameNameSuitableForTestResult(WebKitWebView* view, WebKitWebFrame* frame)
+{
+    char* frameName = g_strdup(webkit_web_frame_get_name(frame));
+
+    if (frame == webkit_web_view_get_main_frame(view)) {
+        // This is a bit strange. Shouldn't web_frame_get_name return NULL?
+        if (frameName && (frameName[0] != '\0')) {
+            char* tmp = g_strdup_printf("main frame \"%s\"", frameName);
+            g_free (frameName);
+            frameName = tmp;
+        } else {
+            g_free(frameName);
+            frameName = g_strdup("main frame");
+        }
+    } else if (!frameName || (frameName[0] == '\0')) {
+        g_free(frameName);
+        frameName = g_strdup("frame (anonymous)");
+    }
+
+    return frameName;
+}
+
 static void webViewLoadFinished(WebKitWebView* view, WebKitWebFrame* frame, void*)
 {
+    if (!done && !gLayoutTestController->dumpFrameLoadCallbacks()) {
+        guint pendingFrameUnloadEvents = webkit_web_frame_get_pending_unload_event_count(frame);
+        if (pendingFrameUnloadEvents) {
+            char* frameName = getFrameNameSuitableForTestResult(view, frame);
+            printf("%s - has %u onunload handler(s)\n", frameName, pendingFrameUnloadEvents);
+            g_free(frameName);
+        }
+    }
+
     if (frame != topLoadingFrame)
         return;
 
@@ -492,6 +581,10 @@ static void webViewWindowObjectCleared(WebKitWebView* view, WebKitWebFrame* fram
     axController->makeWindowObject(context, windowObject, &exception);
     ASSERT(!exception);
 
+    JSStringRef eventSenderStr = JSStringCreateWithUTF8CString("eventSender");
+    JSValueRef eventSender = makeEventSender(context);
+    JSObjectSetProperty(context, windowObject, eventSenderStr, eventSender, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, 0);
+    JSStringRelease(eventSenderStr);
 }
 
 static gboolean webViewConsoleMessage(WebKitWebView* view, const gchar* message, unsigned int line, const gchar* sourceId, gpointer data)
@@ -593,6 +686,23 @@ static gboolean webViewClose(WebKitWebView* view)
     return TRUE;
 }
 
+static void databaseQuotaExceeded(WebKitWebView* view, WebKitWebFrame* frame, WebKitWebDatabase *database)
+{
+    ASSERT(view);
+    ASSERT(frame);
+    ASSERT(database);
+
+    WebKitSecurityOrigin* origin = webkit_web_database_get_security_origin(database);
+    if (gLayoutTestController->dumpDatabaseCallbacks()) {
+        printf("UI DELEGATE DATABASE CALLBACK: exceededDatabaseQuotaForSecurityOrigin:{%s, %s, %i} database:%s\n",
+            webkit_security_origin_get_protocol(origin),
+            webkit_security_origin_get_host(origin),
+            webkit_security_origin_get_port(origin),
+            webkit_web_database_get_name(database));
+    }
+    webkit_security_origin_set_web_database_quota(origin, 5 * 1024 * 1024);
+}
+
 
 static WebKitWebView* webViewCreate(WebKitWebView*, WebKitWebFrame*);
 
@@ -617,6 +727,7 @@ static WebKitWebView* createWebView()
                      "signal::status-bar-text-changed", webViewStatusBarTextChanged, 0,
                      "signal::create-web-view", webViewCreate, 0,
                      "signal::close-web-view", webViewClose, 0,
+                     "signal::database-quota-exceeded", databaseQuotaExceeded, 0,
                      NULL);
 
     return view;
@@ -641,6 +752,11 @@ int main(int argc, char* argv[])
     g_thread_init(NULL);
     gtk_init(&argc, &argv);
 
+#if PLATFORM(X11)
+    FcInit();
+    initializeFonts();
+#endif
+
     struct option options[] = {
         {"notree", no_argument, &dumpTree, false},
         {"pixel-tests", no_argument, &dumpPixels, true},
@@ -657,11 +773,11 @@ int main(int argc, char* argv[])
                 break;
         }
 
-    GtkWidget* window = gtk_window_new(GTK_WINDOW_POPUP);
+    window = gtk_window_new(GTK_WINDOW_POPUP);
     container = GTK_WIDGET(gtk_scrolled_window_new(NULL, NULL));
     gtk_scrolled_window_set_policy(GTK_SCROLLED_WINDOW(container), GTK_POLICY_AUTOMATIC, GTK_POLICY_AUTOMATIC);
     gtk_container_add(GTK_CONTAINER(window), container);
-    gtk_widget_realize(window);
+    gtk_widget_show_all(window);
 
     webView = createWebView();
     gtk_container_add(GTK_CONTAINER(container), GTK_WIDGET(webView));
@@ -699,7 +815,7 @@ int main(int argc, char* argv[])
     delete axController;
     axController = 0;
 
-    g_object_unref(webView);
+    gtk_widget_destroy(window);
 
     return 0;
 }
diff --git a/WebKitTools/DumpRenderTree/gtk/EventSender.cpp b/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
new file mode 100644
index 0000000..c3c72c1
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
@@ -0,0 +1,545 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Zan Dobersek <zandobersek@gmail.com>
+ * Copyright (C) 2009 Holger Hans Peter Freyther
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EventSender.h"
+
+#include "DumpRenderTree.h"
+
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSRetainPtr.h>
+#include <JavaScriptCore/JSStringRef.h>
+#include <webkit/webkitwebframe.h>
+#include <webkit/webkitwebview.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/Platform.h>
+
+#include <gdk/gdk.h>
+#include <gdk/gdkkeysyms.h>
+#include <string.h>
+
+// TODO: Currently drag and drop related code is left out and
+// should be merged once we have drag and drop support in WebCore.
+
+extern "C" {
+    extern void webkit_web_frame_layout(WebKitWebFrame* frame);
+}
+
+static bool down = false;
+static bool dragMode = true;
+static bool replayingSavedEvents = false;
+static int lastMousePositionX;
+static int lastMousePositionY;
+
+static int lastClickPositionX;
+static int lastClickPositionY;
+static int clickCount = 0;
+
+struct DelayedMessage {
+    GdkEvent event;
+    gulong delay;
+    gboolean isDragEvent;
+};
+
+static DelayedMessage msgQueue[1024];
+
+static unsigned endOfQueue;
+static unsigned startOfQueue;
+
+static const float zoomMultiplierRatio = 1.2f;
+
+static JSValueRef getDragModeCallback(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    return JSValueMakeBoolean(context, dragMode);
+}
+
+static bool setDragModeCallback(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
+{
+    dragMode = JSValueToBoolean(context, value);
+    return true;
+}
+
+static JSValueRef leapForwardCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // FIXME: Add proper support for forward leaps
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef contextClickCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    webkit_web_frame_layout(mainFrame);
+
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    GdkEvent event;
+    memset(&event, 0, sizeof(event));
+    event.button.button = 3;
+    event.button.x = lastMousePositionX;
+    event.button.y = lastMousePositionY;
+    event.button.window = GTK_WIDGET(view)->window;
+
+    gboolean return_val;
+    down = true;
+    event.type = GDK_BUTTON_PRESS;
+    g_signal_emit_by_name(view, "button_press_event", &event, &return_val);
+
+    down = false;
+    event.type = GDK_BUTTON_RELEASE;
+    g_signal_emit_by_name(view, "button_release_event", &event, &return_val);
+
+    return JSValueMakeUndefined(context);
+}
+
+static void updateClickCount(int /* button */)
+{
+    // FIXME: take the last clicked button number and the time of last click into account.
+    if (lastClickPositionX != lastMousePositionX && lastClickPositionY != lastMousePositionY)
+        clickCount = 1;
+    else
+        clickCount++;
+}
+
+static JSValueRef mouseDownCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    down = true;
+
+    GdkEvent event;
+    memset(&event, 0, sizeof(event));
+    event.type = GDK_BUTTON_PRESS;
+    event.button.button = 1;
+    event.button.x = lastMousePositionX;
+    event.button.y = lastMousePositionY;
+    event.button.window = GTK_WIDGET(view)->window;
+
+    updateClickCount(1);
+
+    if (!msgQueue[endOfQueue].delay) {
+        webkit_web_frame_layout(mainFrame);
+
+        gboolean return_val;
+        g_signal_emit_by_name(view, "button_press_event", &event, &return_val);
+        if (clickCount == 2) {
+            event.type = GDK_2BUTTON_PRESS;
+            g_signal_emit_by_name(view, "button_press_event", &event, &return_val);
+        }
+    } else {
+        // replaySavedEvents should have the required logic to make leapForward delays work
+        msgQueue[endOfQueue++].event = event;
+        replaySavedEvents();
+    }
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef mouseUpCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    down = false;
+
+    GdkEvent event;
+    memset(&event, 0, sizeof(event));
+    event.type = GDK_BUTTON_RELEASE;
+    event.button.button = 1;
+    event.button.x = lastMousePositionX;
+    event.button.y = lastMousePositionY;
+    event.button.window = GTK_WIDGET(view)->window;
+
+    if ((dragMode && !replayingSavedEvents) || msgQueue[endOfQueue].delay) {
+        msgQueue[endOfQueue].event = event;
+        msgQueue[endOfQueue++].isDragEvent = true;
+        replaySavedEvents();
+    } else {
+        webkit_web_frame_layout(mainFrame);
+
+        gboolean return_val;
+        g_signal_emit_by_name(view, "button_release_event", &event, &return_val);
+    }
+
+    lastClickPositionX = lastMousePositionX;
+    lastClickPositionY = lastMousePositionY;
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef mouseMoveToCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    if (argumentCount < 2)
+        return JSValueMakeUndefined(context);
+
+    lastMousePositionX = (int)JSValueToNumber(context, arguments[0], exception);
+    g_return_val_if_fail((!exception || !*exception), JSValueMakeUndefined(context));
+    lastMousePositionY = (int)JSValueToNumber(context, arguments[1], exception);
+    g_return_val_if_fail((!exception || !*exception), JSValueMakeUndefined(context));
+
+    GdkEvent event;
+    event.type = GDK_MOTION_NOTIFY;
+    event.motion.x = lastMousePositionX;
+    event.motion.y = lastMousePositionY;
+    event.motion.time = GDK_CURRENT_TIME;
+    event.motion.window = GTK_WIDGET(view)->window;
+
+    if (dragMode && down && !replayingSavedEvents) {
+        msgQueue[endOfQueue].event = event;
+        msgQueue[endOfQueue++].isDragEvent = true;
+    } else {
+        webkit_web_frame_layout(mainFrame);
+
+        gboolean return_val;
+        g_signal_emit_by_name(view, "motion_notify_event", &event, &return_val);
+    }
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef mouseWheelToCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    if (argumentCount < 2)
+        return JSValueMakeUndefined(context);
+
+    int horizontal = (int)JSValueToNumber(context, arguments[0], exception);
+    g_return_val_if_fail((!exception || !*exception), JSValueMakeUndefined(context));
+    int vertical = (int)JSValueToNumber(context, arguments[1], exception);
+    g_return_val_if_fail((!exception || !*exception), JSValueMakeUndefined(context));
+
+    // GTK+ doesn't support multiple direction scrolls in the same event!
+    g_return_val_if_fail((!vertical || !horizontal), JSValueMakeUndefined(context));
+
+    GdkEvent event;
+    event.type = GDK_SCROLL;
+    event.scroll.x = lastMousePositionX;
+    event.scroll.y = lastMousePositionY;
+    event.scroll.time = GDK_CURRENT_TIME;
+    event.scroll.window = GTK_WIDGET(view)->window;
+
+    if (horizontal < 0)
+        event.scroll.direction = GDK_SCROLL_LEFT;
+    else if (horizontal > 0)
+        event.scroll.direction = GDK_SCROLL_RIGHT;
+    else if (vertical < 0)
+        event.scroll.direction = GDK_SCROLL_UP;
+    else if (vertical > 0)
+        event.scroll.direction = GDK_SCROLL_DOWN;
+    else
+        g_assert_not_reached();
+
+    if (dragMode && down && !replayingSavedEvents) {
+        msgQueue[endOfQueue].event = event;
+        msgQueue[endOfQueue++].isDragEvent = true;
+    } else {
+        webkit_web_frame_layout(mainFrame);
+        gtk_main_do_event(&event);
+    }
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef beginDragWithFilesCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    // FIXME: Implement this completely once WebCore has complete drag and drop support
+    return JSValueMakeUndefined(context);
+}
+
+void replaySavedEvents()
+{
+    // FIXME: This doesn't deal with forward leaps, but it should.
+
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return;
+
+    replayingSavedEvents = true;
+
+    for (unsigned queuePos = 0; queuePos < endOfQueue; queuePos++) {
+        GdkEvent event = msgQueue[queuePos].event;
+        gboolean return_val;
+
+        switch (event.type) {
+        case GDK_BUTTON_RELEASE:
+            g_signal_emit_by_name(view, "button_release_event", &event, &return_val);
+            break;
+        case GDK_BUTTON_PRESS:
+            g_signal_emit_by_name(view, "button_press_event", &event, &return_val);
+            break;
+        case GDK_MOTION_NOTIFY:
+            g_signal_emit_by_name(view, "motion_notify_event", &event, &return_val);
+            break;
+        default:
+            continue;
+        }
+
+        startOfQueue++;
+    }
+
+    int numQueuedMessages = endOfQueue - startOfQueue;
+    if (!numQueuedMessages) {
+        startOfQueue = 0;
+        endOfQueue = 0;
+        replayingSavedEvents = false;
+        return;
+    }
+
+    startOfQueue = 0;
+    endOfQueue = 0;
+
+    replayingSavedEvents = false;
+}
+
+static JSValueRef keyDownCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    static const JSStringRef lengthProperty = JSStringCreateWithUTF8CString("length");
+
+    webkit_web_frame_layout(mainFrame);
+
+    // handle modifier keys.
+    int state = 0;
+    if (argumentCount > 1) {
+        JSObjectRef modifiersArray = JSValueToObject(context, arguments[1], exception);
+        if (modifiersArray) {
+            for (int i = 0; i < JSValueToNumber(context, JSObjectGetProperty(context, modifiersArray, lengthProperty, 0), 0); ++i) {
+                JSValueRef value = JSObjectGetPropertyAtIndex(context, modifiersArray, i, 0);
+                JSStringRef string = JSValueToStringCopy(context, value, 0);
+                if (JSStringIsEqualToUTF8CString(string, "ctrlKey"))
+                    state |= GDK_CONTROL_MASK;
+                else if (JSStringIsEqualToUTF8CString(string, "shiftKey"))
+                    state |= GDK_SHIFT_MASK;
+                else if (JSStringIsEqualToUTF8CString(string, "altKey"))
+                    state |= GDK_MOD1_MASK;
+
+                JSStringRelease(string);
+            }
+        }
+    }
+
+    JSStringRef character = JSValueToStringCopy(context, arguments[0], exception);
+    g_return_val_if_fail((!exception || !*exception), JSValueMakeUndefined(context));
+    int gdkKeySym;
+    if (JSStringIsEqualToUTF8CString(character, "leftArrow"))
+        gdkKeySym = GDK_Left;
+    else if (JSStringIsEqualToUTF8CString(character, "rightArrow"))
+        gdkKeySym = GDK_Right;
+    else if (JSStringIsEqualToUTF8CString(character, "upArrow"))
+        gdkKeySym = GDK_Up;
+    else if (JSStringIsEqualToUTF8CString(character, "downArrow"))
+        gdkKeySym = GDK_Down;
+    else if (JSStringIsEqualToUTF8CString(character, "pageUp"))
+        gdkKeySym = GDK_Page_Up;
+    else if (JSStringIsEqualToUTF8CString(character, "pageDown"))
+        gdkKeySym = GDK_Page_Down;
+    else if (JSStringIsEqualToUTF8CString(character, "home"))
+        gdkKeySym = GDK_Home;
+    else if (JSStringIsEqualToUTF8CString(character, "end"))
+        gdkKeySym = GDK_End;
+    else if (JSStringIsEqualToUTF8CString(character, "delete"))
+        gdkKeySym = GDK_BackSpace;
+    else if (JSStringIsEqualToUTF8CString(character, "F1"))
+        gdkKeySym = GDK_F1;
+    else if (JSStringIsEqualToUTF8CString(character, "F2"))
+        gdkKeySym = GDK_F2;
+    else if (JSStringIsEqualToUTF8CString(character, "F3"))
+        gdkKeySym = GDK_F3;
+    else if (JSStringIsEqualToUTF8CString(character, "F4"))
+        gdkKeySym = GDK_F4;
+    else if (JSStringIsEqualToUTF8CString(character, "F5"))
+        gdkKeySym = GDK_F5;
+    else if (JSStringIsEqualToUTF8CString(character, "F6"))
+        gdkKeySym = GDK_F6;
+    else if (JSStringIsEqualToUTF8CString(character, "F7"))
+        gdkKeySym = GDK_F7;
+    else if (JSStringIsEqualToUTF8CString(character, "F8"))
+        gdkKeySym = GDK_F8;
+    else if (JSStringIsEqualToUTF8CString(character, "F9"))
+        gdkKeySym = GDK_F9;
+    else if (JSStringIsEqualToUTF8CString(character, "F10"))
+        gdkKeySym = GDK_F10;
+    else if (JSStringIsEqualToUTF8CString(character, "F11"))
+        gdkKeySym = GDK_F11;
+    else if (JSStringIsEqualToUTF8CString(character, "F12"))
+        gdkKeySym = GDK_F12;
+    else {
+        int charCode = JSStringGetCharactersPtr(character)[0];
+        if (charCode == '\n' || charCode == '\r')
+            gdkKeySym = GDK_Return;
+        else if (charCode == '\t')
+            gdkKeySym = GDK_Tab;
+        else if (charCode == '\x8')
+            gdkKeySym = GDK_BackSpace;
+        else {
+            gdkKeySym = gdk_unicode_to_keyval(charCode);
+            if (WTF::isASCIIUpper(charCode))
+                state |= GDK_SHIFT_MASK;
+        }
+    }
+
+    JSStringRelease(character);
+
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    // create and send the event
+    GdkEvent event;
+    memset(&event, 0, sizeof(event));
+    event.key.keyval = gdkKeySym;
+    event.key.state = state;
+    event.key.window = GTK_WIDGET(view)->window;
+
+    gboolean return_val;
+    event.key.type = GDK_KEY_PRESS;
+    g_signal_emit_by_name(view, "key-press-event", &event.key, &return_val);
+
+    event.key.type = GDK_KEY_RELEASE;
+    g_signal_emit_by_name(view, "key-release-event", &event.key, &return_val);
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef textZoomInCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    gfloat currentZoom = webkit_web_view_get_zoom_level(view);
+    webkit_web_view_set_zoom_level(view, currentZoom * zoomMultiplierRatio);
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef textZoomOutCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    gfloat currentZoom = webkit_web_view_get_zoom_level(view);
+    webkit_web_view_set_zoom_level(view, currentZoom / zoomMultiplierRatio);
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef zoomPageInCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    webkit_web_view_zoom_in(view);
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef zoomPageOutCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    webkit_web_view_zoom_out(view);
+    return JSValueMakeUndefined(context);
+}
+
+static JSStaticFunction staticFunctions[] = {
+    { "mouseWheelTo", mouseWheelToCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "contextClick", contextClickCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "mouseDown", mouseDownCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "mouseUp", mouseUpCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "mouseMoveTo", mouseMoveToCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "beginDragWithFiles", beginDragWithFilesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "leapForward", leapForwardCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "keyDown", keyDownCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "textZoomIn", textZoomInCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "textZoomOut", textZoomOutCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "zoomPageIn", zoomPageInCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "zoomPageOut", zoomPageOutCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { 0, 0, 0 }
+};
+
+static JSStaticValue staticValues[] = {
+    { "dragMode", getDragModeCallback, setDragModeCallback, kJSPropertyAttributeNone },
+    { 0, 0, 0, 0 }
+};
+
+static JSClassRef getClass(JSContextRef context)
+{
+    static JSClassRef eventSenderClass = 0;
+
+    if (!eventSenderClass) {
+        JSClassDefinition classDefinition = {
+                0, 0, 0, 0, 0, 0,
+                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+        classDefinition.staticFunctions = staticFunctions;
+        classDefinition.staticValues = staticValues;
+
+        eventSenderClass = JSClassCreate(&classDefinition);
+    }
+
+    return eventSenderClass;
+}
+
+JSObjectRef makeEventSender(JSContextRef context)
+{
+    down = false;
+    dragMode = true;
+    lastMousePositionX = lastMousePositionY = 0;
+    lastClickPositionX = lastClickPositionY = 0;
+
+    if (!replayingSavedEvents) {
+        // This function can be called in the middle of a test, even
+        // while replaying saved events. Resetting these while doing that
+        // can break things.
+        endOfQueue = 0;
+        startOfQueue = 0;
+    }
+
+    return JSObjectMake(context, getClass(context), 0);
+}
diff --git a/WebKitTools/DumpRenderTree/gtk/EventSender.h b/WebKitTools/DumpRenderTree/gtk/EventSender.h
new file mode 100644
index 0000000..272e8a9
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/gtk/EventSender.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Holger Hans Peter Freyther
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EventSender_h
+#define EventSender_h
+
+typedef const struct OpaqueJSContext* JSContextRef;
+typedef struct OpaqueJSValue* JSObjectRef;
+
+JSObjectRef makeEventSender(JSContextRef context);
+void replaySavedEvents();
+
+#endif
diff --git a/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp b/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
index 009cb97..0b4a38f 100644
--- a/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
@@ -38,6 +38,8 @@
 #include <JavaScriptCore/JSRetainPtr.h>
 #include <JavaScriptCore/JSStringRef.h>
 
+#include <iostream>
+#include <sstream>
 #include <stdio.h>
 #include <glib.h>
 #include <libsoup/soup.h>
@@ -48,6 +50,23 @@ bool webkit_web_frame_pause_animation(WebKitWebFrame* frame, const gchar* name,
 bool webkit_web_frame_pause_transition(WebKitWebFrame* frame, const gchar* name, double time, const gchar* element);
 unsigned int webkit_web_frame_number_of_active_animations(WebKitWebFrame* frame);
 void webkit_application_cache_set_maximum_size(unsigned long long size);
+unsigned int webkit_worker_thread_count(void);
+void webkit_white_list_access_from_origin(const gchar* sourceOrigin, const gchar* destinationProtocol, const gchar* destinationHost, bool allowDestinationSubdomains);
+}
+
+static gchar* copyWebSettingKey(gchar* preferenceKey)
+{
+    static GHashTable* keyTable;
+
+    if (!keyTable) {
+        // If you add a pref here, make sure you reset the value in
+        // DumpRenderTree::resetWebViewToConsistentStateBeforeTesting.
+        keyTable = g_hash_table_new(g_str_hash, g_str_equal);
+        g_hash_table_insert(keyTable, g_strdup("WebKitJavaScriptEnabled"), g_strdup("enable-scripts"));
+        g_hash_table_insert(keyTable, g_strdup("WebKitDefaultFontSize"), g_strdup("default-font-size"));
+    }
+
+    return g_strdup(static_cast<gchar*>(g_hash_table_lookup(keyTable, preferenceKey)));
 }
 
 LayoutTestController::~LayoutTestController()
@@ -110,6 +129,11 @@ size_t LayoutTestController::webHistoryItemCount()
     return 0;
 }
 
+unsigned LayoutTestController::workerThreadCount() const
+{
+    return webkit_worker_thread_count();
+}
+
 void LayoutTestController::notifyDone()
 {
     if (m_waitToDump && !topLoadingFrame && !WorkQueue::shared()->count())
@@ -152,6 +176,11 @@ void LayoutTestController::setAcceptsEditing(bool acceptsEditing)
     webkit_web_view_set_editable(webView, acceptsEditing);
 }
 
+void LayoutTestController::setAlwaysAcceptCookies(bool alwaysAcceptCookies)
+{
+    // FIXME: Implement this (and restore the default value before running each test in DumpRenderTree.cpp).
+}
+
 void LayoutTestController::setCustomPolicyDelegate(bool setDelegate, bool permissive)
 {
     // FIXME: implement
@@ -163,6 +192,17 @@ void LayoutTestController::waitForPolicyDelegate()
     setWaitToDump(true);
 }
 
+void LayoutTestController::whiteListAccessFromOrigin(JSStringRef sourceOrigin, JSStringRef protocol, JSStringRef host, bool includeSubdomains)
+{
+    gchar* sourceOriginGChar = JSStringCopyUTF8CString(sourceOrigin);
+    gchar* protocolGChar = JSStringCopyUTF8CString(protocol);
+    gchar* hostGChar = JSStringCopyUTF8CString(host);
+    webkit_white_list_access_from_origin(sourceOriginGChar, protocolGChar, hostGChar, includeSubdomains);
+    g_free(sourceOriginGChar);
+    g_free(protocolGChar);
+    g_free(hostGChar);
+}
+
 void LayoutTestController::setMainFrameIsFirstResponder(bool flag)
 {
     // FIXME: implement
@@ -213,17 +253,14 @@ void LayoutTestController::setSmartInsertDeleteEnabled(bool flag)
 
 static gboolean waitToDumpWatchdogFired(void*)
 {
-    const char* message = "FAIL: Timed out waiting for notifyDone to be called\n";
-    fprintf(stderr, "%s", message);
-    fprintf(stdout, "%s", message);
     waitToDumpWatchdog = 0;
-    dump();
+    gLayoutTestController->waitToDumpWatchdogTimerFired();
     return FALSE;
 }
 
 void LayoutTestController::setWaitToDump(bool waitUntilDone)
 {
-    static const int timeoutSeconds = 10;
+    static const int timeoutSeconds = 15;
 
     m_waitToDump = waitUntilDone;
     if (m_waitToDump && !waitToDumpWatchdog)
@@ -265,6 +302,18 @@ void LayoutTestController::disableImageLoading()
     // Also need to make sure image loading is re-enabled for each new test.
 }
 
+void LayoutTestController::setMockGeolocationPosition(double latitude, double longitude, double accuracy)
+{
+    // FIXME: Implement for Geolocation layout tests.
+    // See https://bugs.webkit.org/show_bug.cgi?id=28264.
+}
+
+void LayoutTestController::setMockGeolocationError(int code, JSStringRef message)
+{
+    // FIXME: Implement for Geolocation layout tests.
+    // See https://bugs.webkit.org/show_bug.cgi?id=28264.
+}
+
 void LayoutTestController::setIconDatabaseEnabled(bool flag)
 {
     // FIXME: implement
@@ -331,12 +380,13 @@ void LayoutTestController::clearPersistentUserStyleSheet()
 
 void LayoutTestController::clearAllDatabases()
 {
-    // FIXME: implement
+    webkit_remove_all_web_databases();
 }
  
 void LayoutTestController::setDatabaseQuota(unsigned long long quota)
-{    
-    // FIXME: implement
+{
+    WebKitSecurityOrigin* origin = webkit_web_frame_get_security_origin(mainFrame);
+    webkit_security_origin_set_web_database_quota(origin, quota);
 }
 
 void LayoutTestController::setAppCacheMaximumSize(unsigned long long size)
@@ -348,17 +398,91 @@ bool LayoutTestController::pauseAnimationAtTimeOnElementWithId(JSStringRef anima
 {    
     gchar* name = JSStringCopyUTF8CString(animationName);
     gchar* element = JSStringCopyUTF8CString(elementId);
-    return webkit_web_frame_pause_animation(mainFrame, name, time, element);
+    bool returnValue = webkit_web_frame_pause_animation(mainFrame, name, time, element);
+    g_free(name);
+    g_free(element);
+    return returnValue;
 }
 
 bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(JSStringRef propertyName, double time, JSStringRef elementId)
 {    
     gchar* name = JSStringCopyUTF8CString(propertyName);
     gchar* element = JSStringCopyUTF8CString(elementId);
-    return webkit_web_frame_pause_transition(mainFrame, name, time, element);
+    bool returnValue = webkit_web_frame_pause_transition(mainFrame, name, time, element);
+    g_free(name);
+    g_free(element);
+    return returnValue;
 }
 
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
     return webkit_web_frame_number_of_active_animations(mainFrame);
 }
+
+void LayoutTestController::overridePreference(JSStringRef key, JSStringRef value)
+{
+    gchar* name = JSStringCopyUTF8CString(key);
+    gchar* strValue = JSStringCopyUTF8CString(value);
+
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    ASSERT(view);
+
+    WebKitWebSettings* settings = webkit_web_view_get_settings(view);
+    gchar* webSettingKey = copyWebSettingKey(name);
+
+    if (webSettingKey) {
+        GValue stringValue = { 0, { { 0 } } };
+        g_value_init(&stringValue, G_TYPE_STRING);
+        g_value_set_string(&stringValue, const_cast<gchar*>(strValue));
+
+        WebKitWebSettingsClass* klass = WEBKIT_WEB_SETTINGS_GET_CLASS(settings);
+        GParamSpec* pspec = g_object_class_find_property(G_OBJECT_CLASS(klass), webSettingKey);
+        GValue propValue = { 0, { { 0 } } };
+        g_value_init(&propValue, pspec->value_type);
+
+        if (g_value_type_transformable(G_TYPE_STRING, pspec->value_type)) {
+            g_value_transform(const_cast<GValue*>(&stringValue), &propValue);
+            g_object_set_property(G_OBJECT(settings), webSettingKey, const_cast<GValue*>(&propValue));
+        } else if (G_VALUE_HOLDS_BOOLEAN(&propValue)) {
+            g_object_set(G_OBJECT(settings), webSettingKey,
+                         g_str_equal(g_utf8_strdown(strValue, -1), "true"),
+                         NULL);
+        } else if (G_VALUE_HOLDS_INT(&propValue)) {
+            std::string str(strValue);
+            std::stringstream ss(str);
+            int val = 0;
+            if (!(ss >> val).fail())
+                g_object_set(G_OBJECT(settings), webSettingKey, val, NULL);
+        } else
+            printf("LayoutTestController::overridePreference failed to override preference '%s'.\n", name);
+    }
+
+    g_free(webSettingKey);
+    g_free(name);
+    g_free(strValue);
+}
+
+void LayoutTestController::addUserScript(JSStringRef source, bool runAtStart)
+{
+    printf("LayoutTestController::addUserScript not implemented.\n");
+}
+
+void LayoutTestController::addUserStyleSheet(JSStringRef source)
+{
+    printf("LayoutTestController::addUserStyleSheet not implemented.\n");
+}
+
+void LayoutTestController::showWebInspector()
+{
+    // FIXME: Implement this.
+}
+
+void LayoutTestController::closeWebInspector()
+{
+    // FIXME: Implement this.
+}
+
+void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef script)
+{
+    // FIXME: Implement this.
+}
diff --git a/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/TestNetscapePlugin.cpp b/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/TestNetscapePlugin.cpp
index b7d14eb..6c62a7c 100644
--- a/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/TestNetscapePlugin.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/TestNetscapePlugin.cpp
@@ -46,13 +46,13 @@ extern "C" {
 }
 
 static NPError
-webkit_test_plugin_new_instance(NPMIMEType mimetype,
+webkit_test_plugin_new_instance(NPMIMEType /*mimetype*/,
                                 NPP instance,
-                                uint16_t mode,
+                                uint16_t /*mode*/,
                                 int16_t argc,
                                 char *argn[],
                                 char *argv[],
-                                NPSavedData *savedData)
+                                NPSavedData* /*savedData*/)
 {
     if (browser->version >= 14) {
         PluginObject* obj = (PluginObject*)browser->createobject(instance, getPluginClass());
@@ -85,7 +85,7 @@ webkit_test_plugin_new_instance(NPMIMEType mimetype,
 }
 
 static NPError
-webkit_test_plugin_destroy_instance(NPP instance, NPSavedData **save)
+webkit_test_plugin_destroy_instance(NPP instance, NPSavedData** /*save*/)
 {
     PluginObject* obj = static_cast<PluginObject*>(instance->pdata);
     if (obj) {
@@ -138,9 +138,9 @@ static void executeScript(const PluginObject* obj, const char* script)
 
 static NPError
 webkit_test_plugin_new_stream(NPP instance,
-                              NPMIMEType type,
+                              NPMIMEType /*type*/,
                               NPStream *stream,
-                              NPBool seekable,
+                              NPBool /*seekable*/,
                               uint16* stype)
 {
     PluginObject* obj = static_cast<PluginObject*>(instance->pdata);
@@ -160,7 +160,7 @@ webkit_test_plugin_new_stream(NPP instance,
 }
 
 static NPError
-webkit_test_plugin_destroy_stream(NPP instance, NPStream *stream, NPError reason)
+webkit_test_plugin_destroy_stream(NPP instance, NPStream* /*stream*/, NPError /*reason*/)
 {
     PluginObject* obj = (PluginObject*)instance->pdata;
 
@@ -171,28 +171,28 @@ webkit_test_plugin_destroy_stream(NPP instance, NPStream *stream, NPError reason
 }
 
 static void
-webkit_test_plugin_stream_as_file(NPP instance, NPStream *stream, const char* fname)
+webkit_test_plugin_stream_as_file(NPP /*instance*/, NPStream* /*stream*/, const char* /*fname*/)
 {
 }
 
 static int32
-webkit_test_plugin_write_ready(NPP instance, NPStream *stream)
+webkit_test_plugin_write_ready(NPP /*instance*/, NPStream* /*stream*/)
 {
     return 0;
 }
 
 static int32
-webkit_test_plugin_write(NPP instance,
-                         NPStream *stream,
-                         int32_t offset,
-                         int32_t len,
-                         void *buffer)
+webkit_test_plugin_write(NPP /*instance*/,
+                         NPStream* /*stream*/,
+                         int32_t /*offset*/,
+                         int32_t /*len*/,
+                         void* /*buffer*/)
 {
     return 0;
 }
 
 static void
-webkit_test_plugin_print(NPP instance, NPPrint* platformPrint)
+webkit_test_plugin_print(NPP /*instance*/, NPPrint* /*platformPrint*/)
 {
 }
 
@@ -258,7 +258,7 @@ webkit_test_plugin_get_value(NPP instance, NPPVariable variable, void *value)
 }
 
 static NPError
-webkit_test_plugin_set_value(NPP instance, NPNVariable variable, void *value)
+webkit_test_plugin_set_value(NPP /*instance*/, NPNVariable /*variable*/, void* /*value*/)
 {
     return NPERR_NO_ERROR;
 }
@@ -310,7 +310,7 @@ NP_Shutdown(void)
 }
 
 NPError
-NP_GetValue(void *future, NPPVariable variable, void *value)
+NP_GetValue(void* /*future*/, NPPVariable variable, void *value)
 {
     return webkit_test_plugin_get_value(NULL, variable, value);
 }
diff --git a/WebKitTools/DumpRenderTree/gtk/fonts.conf b/WebKitTools/DumpRenderTree/gtk/fonts.conf
new file mode 100644
index 0000000..3540c47
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/gtk/fonts.conf
@@ -0,0 +1,258 @@
+<?xml version="1.0"?>
+<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<fontconfig>
+
+<!--
+  Accept deprecated 'mono' alias, replacing it with 'monospace'
+-->
+	<match target="pattern">
+		<test qual="any" name="family">
+			<string>mono</string>
+		</test>
+		<edit name="family" mode="assign">
+			<string>monospace</string>
+		</edit>
+	</match>
+
+<!--
+  Accept alternate 'sans serif' spelling, replacing it with 'sans-serif'
+-->
+	<match target="pattern">
+		<test qual="any" name="family">
+			<string>sans serif</string>
+		</test>
+		<edit name="family" mode="assign">
+			<string>sans-serif</string>
+		</edit>
+	</match>
+
+<!--
+  Accept deprecated 'sans' alias, replacing it with 'sans-serif'
+-->
+	<match target="pattern">
+		<test qual="any" name="family">
+			<string>sans</string>
+		</test>
+		<edit name="family" mode="assign">
+			<string>sans-serif</string>
+		</edit>
+	</match>
+
+
+	<config>
+<!--
+  These are the default Unicode chars that are expected to be blank
+  in fonts.  All other blank chars are assumed to be broken and
+  won't appear in the resulting charsets
+ -->
+		<blank>
+			<int>0x0020</int>	<!-- SPACE -->
+			<int>0x00A0</int>	<!-- NO-BREAK SPACE -->
+			<int>0x00AD</int>	<!-- SOFT HYPHEN -->
+			<int>0x034F</int>	<!-- COMBINING GRAPHEME JOINER -->
+			<int>0x0600</int>	<!-- ARABIC NUMBER SIGN -->
+			<int>0x0601</int>	<!-- ARABIC SIGN SANAH -->
+			<int>0x0602</int>	<!-- ARABIC FOOTNOTE MARKER -->
+			<int>0x0603</int>	<!-- ARABIC SIGN SAFHA -->
+			<int>0x06DD</int>	<!-- ARABIC END OF AYAH -->
+			<int>0x070F</int>	<!-- SYRIAC ABBREVIATION MARK -->
+			<int>0x115F</int>	<!-- HANGUL CHOSEONG FILLER -->
+			<int>0x1160</int>	<!-- HANGUL JUNGSEONG FILLER -->
+			<int>0x1680</int>	<!-- OGHAM SPACE MARK -->
+			<int>0x17B4</int>	<!-- KHMER VOWEL INHERENT AQ -->
+			<int>0x17B5</int>	<!-- KHMER VOWEL INHERENT AA -->
+			<int>0x180E</int>	<!-- MONGOLIAN VOWEL SEPARATOR -->
+			<int>0x2000</int>	<!-- EN QUAD -->
+			<int>0x2001</int>	<!-- EM QUAD -->
+			<int>0x2002</int>	<!-- EN SPACE -->
+			<int>0x2003</int>	<!-- EM SPACE -->
+			<int>0x2004</int>	<!-- THREE-PER-EM SPACE -->
+			<int>0x2005</int>	<!-- FOUR-PER-EM SPACE -->
+			<int>0x2006</int>	<!-- SIX-PER-EM SPACE -->
+			<int>0x2007</int>	<!-- FIGURE SPACE -->
+			<int>0x2008</int>	<!-- PUNCTUATION SPACE -->
+			<int>0x2009</int>	<!-- THIN SPACE -->
+			<int>0x200A</int>	<!-- HAIR SPACE -->
+			<int>0x200B</int>	<!-- ZERO WIDTH SPACE -->
+			<int>0x200C</int>	<!-- ZERO WIDTH NON-JOINER -->
+			<int>0x200D</int>	<!-- ZERO WIDTH JOINER -->
+			<int>0x200E</int>	<!-- LEFT-TO-RIGHT MARK -->
+			<int>0x200F</int>	<!-- RIGHT-TO-LEFT MARK -->
+			<int>0x2028</int>	<!-- LINE SEPARATOR -->
+			<int>0x2029</int>	<!-- PARAGRAPH SEPARATOR -->
+			<int>0x202A</int>	<!-- LEFT-TO-RIGHT EMBEDDING -->
+			<int>0x202B</int>	<!-- RIGHT-TO-LEFT EMBEDDING -->
+			<int>0x202C</int>	<!-- POP DIRECTIONAL FORMATTING -->
+			<int>0x202D</int>	<!-- LEFT-TO-RIGHT OVERRIDE -->
+			<int>0x202E</int>	<!-- RIGHT-TO-LEFT OVERRIDE -->
+			<int>0x202F</int>	<!-- NARROW NO-BREAK SPACE -->
+			<int>0x205F</int>	<!-- MEDIUM MATHEMATICAL SPACE -->
+			<int>0x2060</int>	<!-- WORD JOINER -->
+			<int>0x2061</int>	<!-- FUNCTION APPLICATION -->
+			<int>0x2062</int>	<!-- INVISIBLE TIMES -->
+			<int>0x2063</int>	<!-- INVISIBLE SEPARATOR -->
+			<int>0x206A</int>	<!-- INHIBIT SYMMETRIC SWAPPING -->
+			<int>0x206B</int>	<!-- ACTIVATE SYMMETRIC SWAPPING -->
+			<int>0x206C</int>	<!-- INHIBIT ARABIC FORM SHAPING -->
+			<int>0x206D</int>	<!-- ACTIVATE ARABIC FORM SHAPING -->
+			<int>0x206E</int>	<!-- NATIONAL DIGIT SHAPES -->
+			<int>0x206F</int>	<!-- NOMINAL DIGIT SHAPES -->
+			<int>0x3000</int>	<!-- IDEOGRAPHIC SPACE -->
+			<int>0x3164</int>	<!-- HANGUL FILLER -->
+			<int>0xFEFF</int>	<!-- ZERO WIDTH NO-BREAK SPACE -->
+			<int>0xFFA0</int>	<!-- HALFWIDTH HANGUL FILLER -->
+			<int>0xFFF9</int>	<!-- INTERLINEAR ANNOTATION ANCHOR -->
+			<int>0xFFFA</int>	<!-- INTERLINEAR ANNOTATION SEPARATOR -->
+			<int>0xFFFB</int>	<!-- INTERLINEAR ANNOTATION TERMINATOR -->
+		</blank>
+<!--
+  Rescan configuration every 30 seconds when FcFontSetList is called
+ -->
+		<rescan>
+			<int>30</int>
+		</rescan>
+	</config>
+
+<!--
+  URW provides metric and shape compatible fonts for these 10 Adobe families.
+
+  However, these fonts are quite ugly and do not render well on-screen,
+  so we avoid matching them if the application said `anymetrics'; in that
+  case, a more generic font with different metrics but better appearance
+  will be used.
+  -->
+       	<match target="pattern">
+          <test name="family">
+            <string>Avant Garde</string>
+          </test>
+          <test name="anymetrics" qual="all" compare="not_eq">
+            <bool>true</bool>
+          </test>
+          <edit name="family" mode="append">
+            <string>URW Gothic L</string>
+          </edit>
+     	</match>
+       	<match target="pattern">
+          <test name="family">
+            <string>Bookman</string>
+          </test>
+          <test name="anymetrics" qual="all" compare="not_eq">
+            <bool>true</bool>
+          </test>
+          <edit name="family" mode="append">
+            <string>URW Bookman L</string>
+          </edit>
+     	</match>
+       	<match target="pattern">
+          <test name="family">
+            <string>Courier</string>
+          </test>
+          <test name="anymetrics" qual="all" compare="not_eq">
+            <bool>true</bool>
+          </test>
+          <edit name="family" mode="append">
+            <string>Nimbus Mono L</string>
+          </edit>
+     	</match>
+       	<match target="pattern">
+          <test name="family">
+            <string>Helvetica</string>
+          </test>
+          <test name="anymetrics" qual="all" compare="not_eq">
+            <bool>true</bool>
+          </test>
+          <edit name="family" mode="append">
+            <string>Nimbus Sans L</string>
+          </edit>
+     	</match>
+       	<match target="pattern">
+          <test name="family">
+            <string>New Century Schoolbook</string>
+          </test>
+          <test name="anymetrics" qual="all" compare="not_eq">
+            <bool>true</bool>
+          </test>
+          <edit name="family" mode="append">
+            <string>Century Schoolbook L</string>
+          </edit>
+     	</match>
+       	<match target="pattern">
+          <test name="family">
+            <string>Palatino</string>
+          </test>
+          <test name="anymetrics" qual="all" compare="not_eq">
+            <bool>true</bool>
+          </test>
+          <edit name="family" mode="append">
+            <string>URW Palladio L</string>
+          </edit>
+     	</match>
+       	<match target="pattern">
+          <test name="family">
+            <string>Times</string>
+          </test>
+          <test name="anymetrics" qual="all" compare="not_eq">
+            <bool>true</bool>
+          </test>
+          <edit name="family" mode="append">
+            <string>Nimbus Roman No9 L</string>
+          </edit>
+     	</match>
+       	<match target="pattern">
+          <test name="family">
+            <string>Zapf Chancery</string>
+          </test>
+          <test name="anymetrics" qual="all" compare="not_eq">
+            <bool>true</bool>
+          </test>
+          <edit name="family" mode="append">
+            <string>URW Chancery L</string>
+          </edit>
+     	</match>
+       	<match target="pattern">
+          <test name="family">
+            <string>Zapf Dingbats</string>
+          </test>
+          <test name="anymetrics" qual="all" compare="not_eq">
+            <bool>true</bool>
+          </test>
+          <edit name="family" mode="append">
+            <string>Dingbats</string>
+          </edit>
+     	</match>
+        <match target="pattern">
+          <test name="family">
+            <string>Symbol</string>
+          </test>
+          <test name="anymetrics" qual="all" compare="not_eq">
+            <bool>true</bool>
+          </test>
+          <edit name="family" mode="append" binding="same">
+            <string>Standard Symbols L</string>
+          </edit>
+        </match>
+
+<!--
+  Serif faces
+ -->
+	<alias>
+		<family>Nimbus Roman No9 L</family>
+		<default><family>serif</family></default>
+	</alias>
+<!--
+  Sans-serif faces
+ -->
+	<alias>
+		<family>Nimbus Sans L</family>
+		<default><family>sans-serif</family></default>
+	</alias>
+<!--
+  Monospace faces
+ -->
+ 	<alias>
+		<family>Nimbus Mono L</family>
+		<default><family>monospace</family></default>
+	</alias>
+
+
+</fontconfig>
diff --git a/WebKitTools/DumpRenderTree/mac/AccessibilityControllerMac.mm b/WebKitTools/DumpRenderTree/mac/AccessibilityControllerMac.mm
index a191495..67e0fa4 100644
--- a/WebKitTools/DumpRenderTree/mac/AccessibilityControllerMac.mm
+++ b/WebKitTools/DumpRenderTree/mac/AccessibilityControllerMac.mm
@@ -53,3 +53,12 @@ AccessibilityUIElement AccessibilityController::rootElement()
     id accessibilityObject = [[mainFrame frameView] documentView];
     return AccessibilityUIElement(accessibilityObject);
 }
+
+void AccessibilityController::setLogFocusEvents(bool)
+{
+}
+
+void AccessibilityController::setLogScrollingStartEvents(bool)
+{
+}
+
diff --git a/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm b/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm
index b2cbb34..375dbad 100644
--- a/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm
+++ b/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm
@@ -311,6 +311,12 @@ JSStringRef AccessibilityUIElement::role()
     return concatenateAttributeAndValue(@"AXRole", role);
 }
 
+JSStringRef AccessibilityUIElement::subrole()
+{
+    NSString* role = descriptionOfValue([m_element accessibilityAttributeValue:NSAccessibilitySubroleAttribute], m_element);
+    return concatenateAttributeAndValue(@"AXSubrole", role);
+}
+
 JSStringRef AccessibilityUIElement::title()
 {
     NSString* title = descriptionOfValue([m_element accessibilityAttributeValue:NSAccessibilityTitleAttribute], m_element);
@@ -362,7 +368,7 @@ double AccessibilityUIElement::clickPointX()
 double AccessibilityUIElement::clickPointY()
 {
     NSValue* positionValue = [m_element accessibilityAttributeValue:@"AXClickPoint"];
-    return static_cast<double>([positionValue pointValue].x);            
+    return static_cast<double>([positionValue pointValue].y);
 }
 
 double AccessibilityUIElement::intValue()
@@ -392,7 +398,7 @@ double AccessibilityUIElement::maxValue()
 JSStringRef AccessibilityUIElement::valueDescription()
 {
     NSString* valueDescription = [m_element accessibilityAttributeValue:NSAccessibilityValueDescriptionAttribute];
-     if ([valueDescription isKindOfClass:[NSString class]])
+    if ([valueDescription isKindOfClass:[NSString class]])
          return [valueDescription createJSStringRef];
     return 0;
 }
@@ -449,6 +455,16 @@ JSStringRef AccessibilityUIElement::boundsForRange(unsigned location, unsigned l
     return [boundsDescription createJSStringRef];
 }
 
+JSStringRef AccessibilityUIElement::stringForRange(unsigned location, unsigned length)
+{
+    NSRange range = NSMakeRange(location, length);
+    id string = [m_element accessibilityAttributeValue:NSAccessibilityStringForRangeParameterizedAttribute forParameter:[NSValue valueWithRange:range]];
+    if (![string isKindOfClass:[NSString class]])
+        return 0;
+    
+    return [string createJSStringRef];
+}
+
 JSStringRef AccessibilityUIElement::attributesOfColumnHeaders()
 {
     // not yet defined in AppKit... odd
diff --git a/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm b/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
index d49248b..0c33381 100644
--- a/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -38,6 +38,7 @@
 #import "EditingDelegate.h"
 #import "EventSendingController.h"
 #import "FrameLoadDelegate.h"
+#import "HistoryDelegate.h"
 #import "JavaScriptThreading.h"
 #import "LayoutTestController.h"
 #import "NavigationController.h"
@@ -116,6 +117,7 @@ static FrameLoadDelegate *frameLoadDelegate;
 static UIDelegate *uiDelegate;
 static EditingDelegate *editingDelegate;
 static ResourceLoadDelegate *resourceLoadDelegate;
+static HistoryDelegate *historyDelegate;
 PolicyDelegate *policyDelegate;
 
 static int dumpPixels;
@@ -354,7 +356,8 @@ static NSString *libraryPathForDumpRenderTree()
     return [@"~/Library/Application Support/DumpRenderTree" stringByExpandingTildeInPath];
 }
 
-static void setDefaultsToConsistentValuesForTesting()
+// Called before each test.
+static void resetDefaultsToConsistentValues()
 {
     // Give some clear to undocumented defaults values
     static const int NoFontSmoothing = 0;
@@ -384,15 +387,10 @@ static void setDefaultsToConsistentValuesForTesting()
     NSString *path = libraryPathForDumpRenderTree();
     [defaults setObject:[path stringByAppendingPathComponent:@"Databases"] forKey:WebDatabaseDirectoryDefaultsKey];
     [defaults setObject:[path stringByAppendingPathComponent:@"LocalCache"] forKey:WebKitLocalCacheDefaultsKey];
-    NSURLCache *sharedCache =
-        [[NSURLCache alloc] initWithMemoryCapacity:1024 * 1024
-                                      diskCapacity:0
-                                          diskPath:[path stringByAppendingPathComponent:@"URLCache"]];
-    [NSURLCache setSharedURLCache:sharedCache];
-    [sharedCache release];
 
     WebPreferences *preferences = [WebPreferences standardPreferences];
 
+    [preferences setAllowUniversalAccessFromFileURLs:YES];
     [preferences setStandardFontFamily:@"Times"];
     [preferences setFixedFontFamily:@"Courier"];
     [preferences setSerifFontFamily:@"Times"];
@@ -410,10 +408,58 @@ static void setDefaultsToConsistentValuesForTesting()
     [preferences setShouldPrintBackgrounds:YES];
     [preferences setCacheModel:WebCacheModelDocumentBrowser];
     [preferences setXSSAuditorEnabled:NO];
+    [preferences setExperimentalNotificationsEnabled:NO];
+    [preferences setExperimentalWebSocketsEnabled:NO];
+
+    [preferences setPrivateBrowsingEnabled:NO];
+    [preferences setAuthorAndUserStylesEnabled:YES];
+    [preferences setJavaScriptCanOpenWindowsAutomatically:YES];
+    [preferences setOfflineWebApplicationCacheEnabled:YES];
+    [preferences setDeveloperExtrasEnabled:NO];
+    [preferences setXSSAuditorEnabled:NO];
+    [preferences setLoadsImagesAutomatically:YES];
+    if (persistentUserStyleSheetLocation) {
+        [preferences setUserStyleSheetLocation:[NSURL URLWithString:(NSString *)(persistentUserStyleSheetLocation.get())]];
+        [preferences setUserStyleSheetEnabled:YES];
+    } else
+        [preferences setUserStyleSheetEnabled:NO];
 
     // The back/forward cache is causing problems due to layouts during transition from one page to another.
     // So, turn it off for now, but we might want to turn it back on some day.
     [preferences setUsesPageCache:NO];
+
+#if defined(BUILDING_ON_LEOPARD)
+    // Disable hardware composititing to avoid timeouts and crashes from buggy CoreVideo teardown code.
+    // https://bugs.webkit.org/show_bug.cgi?id=28845 and rdar://problem/7228836
+    SInt32 qtVersion;
+    OSErr err = Gestalt(gestaltQuickTimeVersion, &qtVersion);
+    assert(err == noErr);
+    // Bug 7228836 exists in at least 7.6.3 and 7.6.4, hopefully it will be fixed in 7.6.5.
+    // FIXME: Once we know the exact versions of QuickTime affected, we can update this check.
+    if (qtVersion <= 0x07640000)
+        [preferences setAcceleratedCompositingEnabled:NO];
+    else
+#endif
+        [preferences setAcceleratedCompositingEnabled:YES];
+
+    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:NSHTTPCookieAcceptPolicyOnlyFromMainDocumentDomain];
+
+    setlocale(LC_ALL, "");
+}
+
+// Called once on DumpRenderTree startup.
+static void setDefaultsToConsistentValuesForTesting()
+{
+    resetDefaultsToConsistentValues();
+
+    NSString *path = libraryPathForDumpRenderTree();
+    NSURLCache *sharedCache =
+        [[NSURLCache alloc] initWithMemoryCapacity:1024 * 1024
+                                      diskCapacity:0
+                                          diskPath:[path stringByAppendingPathComponent:@"URLCache"]];
+    [NSURLCache setSharedURLCache:sharedCache];
+    [sharedCache release];
+
 }
 
 static void crashHandler(int sig)
@@ -448,6 +494,7 @@ static void allocateGlobalControllers()
     editingDelegate = [[EditingDelegate alloc] init];
     resourceLoadDelegate = [[ResourceLoadDelegate alloc] init];
     policyDelegate = [[PolicyDelegate alloc] init];
+    historyDelegate = [[HistoryDelegate alloc] init];
 }
 
 // ObjC++ doens't seem to let me pass NSObject*& sadly.
@@ -1033,11 +1080,16 @@ void dump()
     done = YES;
 }
 
-static bool shouldLogFrameLoadDelegates(const char *pathOrURL)
+static bool shouldLogFrameLoadDelegates(const char* pathOrURL)
 {
     return strstr(pathOrURL, "loading/");
 }
 
+static bool shouldLogHistoryDelegates(const char* pathOrURL)
+{
+    return strstr(pathOrURL, "globalhistory/");
+}
+
 static void resetWebViewToConsistentStateBeforeTesting()
 {
     WebView *webView = [mainFrame webView];
@@ -1048,29 +1100,19 @@ static void resetWebViewToConsistentStateBeforeTesting()
     [webView setPolicyDelegate:nil];
     [policyDelegate setPermissive:NO];
     [policyDelegate setControllerToNotifyDone:0];
+    [frameLoadDelegate resetToConsistentState];
     [webView _setDashboardBehavior:WebDashboardBehaviorUseBackwardCompatibilityMode to:NO];
     [webView _clearMainFrameName];
     [[webView undoManager] removeAllActions];
+    [WebView _removeAllUserContentFromGroup:[webView groupName]];
 
-    WebPreferences *preferences = [webView preferences];
-    [preferences setPrivateBrowsingEnabled:NO];
-    [preferences setAuthorAndUserStylesEnabled:YES];
-    [preferences setJavaScriptCanOpenWindowsAutomatically:YES];
-    [preferences setOfflineWebApplicationCacheEnabled:YES];
-    [preferences setDeveloperExtrasEnabled:NO];
-    [preferences setXSSAuditorEnabled:NO];
-    [preferences setLoadsImagesAutomatically:YES];
-
-    if (persistentUserStyleSheetLocation) {
-        [preferences setUserStyleSheetLocation:[NSURL URLWithString:(NSString *)(persistentUserStyleSheetLocation.get())]];
-        [preferences setUserStyleSheetEnabled:YES];
-    } else
-        [preferences setUserStyleSheetEnabled:NO];
+    resetDefaultsToConsistentValues();
 
     [[mainFrame webView] setSmartInsertDeleteEnabled:YES];
     [[[mainFrame webView] inspector] setJavaScriptProfilingEnabled:NO];
 
     [WebView _setUsesTestModeFocusRingColor:YES];
+    [WebView _resetOriginAccessWhiteLists];
 }
 
 static void runTest(const string& testPathOrURL)
@@ -1120,6 +1162,11 @@ static void runTest(const string& testPathOrURL)
     if (shouldLogFrameLoadDelegates(pathOrURL.c_str()))
         gLayoutTestController->setDumpFrameLoadCallbacks(true);
 
+    if (shouldLogHistoryDelegates(pathOrURL.c_str()))
+        [[mainFrame webView] setHistoryDelegate:historyDelegate];
+    else
+        [[mainFrame webView] setHistoryDelegate:nil];
+    
     if ([WebHistory optionalSharedHistory])
         [WebHistory setOptionalSharedHistory:nil];
     lastMousePosition = NSZeroPoint;
diff --git a/WebKitTools/DumpRenderTree/mac/EventSendingController.mm b/WebKitTools/DumpRenderTree/mac/EventSendingController.mm
index 8c7c1c4..1cba53b 100644
--- a/WebKitTools/DumpRenderTree/mac/EventSendingController.mm
+++ b/WebKitTools/DumpRenderTree/mac/EventSendingController.mm
@@ -506,6 +506,15 @@ static NSEventType eventTypeForMouseButtonAndAction(int button, MouseAction acti
         eventCharacter = [NSString stringWithCharacters:&ch length:1];
     }
 
+    // Compare the input string with the function-key names defined by the DOM spec (i.e. "F1",...,"F24").
+    // If the input string is a function-key name, set its key code.
+    for (unsigned i = 1; i <= 24; i++) {
+        if ([character isEqualToString:[NSString stringWithFormat:@"F%u", i]]) {
+            const unichar ch = NSF1FunctionKey + (i - 1);
+            eventCharacter = [NSString stringWithCharacters:&ch length:1];
+        }
+    }
+
     NSString *charactersIgnoringModifiers = eventCharacter;
 
     int modifierFlags = 0;
diff --git a/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.h b/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.h
index 6c3cbdb..390a881 100644
--- a/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.h
+++ b/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.h
@@ -36,4 +36,7 @@ class GCController;
     AccessibilityController* accessibilityController;
     GCController* gcController;
 }
+
+- (void)resetToConsistentState;
+
 @end
diff --git a/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.mm b/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.mm
index 4bf02ed..2838d2e 100644
--- a/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.mm
+++ b/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.mm
@@ -48,6 +48,7 @@
 #import <WebKit/WebHTMLViewPrivate.h>
 #import <WebKit/WebKit.h>
 #import <WebKit/WebNSURLExtras.h>
+#import <WebKit/WebSecurityOriginPrivate.h>
 #import <wtf/Assertions.h>
 
 @interface NSURLRequest (PrivateThingsWeShouldntReallyUse)
@@ -123,6 +124,11 @@
         dump();
 }
 
+- (void)resetToConsistentState
+{
+    accessibilityController->resetToConsistentState();
+}
+
 - (void)webView:(WebView *)c locationChangeDone:(NSError *)error forDataSource:(WebDataSource *)dataSource
 {
     if ([dataSource webFrame] == topLoadingFrame) {
@@ -348,4 +354,16 @@
     }
 }
 
+- (void)webViewDidDisplayInsecureContent:(WebView *)sender
+{
+    if (!done && gLayoutTestController->dumpFrameLoadCallbacks())
+        printf ("didDisplayInsecureContent\n");
+}
+
+- (void)webView:(WebView *)sender didRunInsecureContent:(WebSecurityOrigin *)origin
+{
+    if (!done && gLayoutTestController->dumpFrameLoadCallbacks())
+        printf ("didRunInsecureContent\n");
+}
+
 @end
diff --git a/WebKitTools/DumpRenderTree/mac/HistoryDelegate.h b/WebKitTools/DumpRenderTree/mac/HistoryDelegate.h
new file mode 100644
index 0000000..c56d203
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/mac/HistoryDelegate.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#import <Cocoa/Cocoa.h>
+
+@interface HistoryDelegate : NSObject 
+{
+}
+
+@end
diff --git a/WebKitTools/DumpRenderTree/mac/HistoryDelegate.mm b/WebKitTools/DumpRenderTree/mac/HistoryDelegate.mm
new file mode 100644
index 0000000..9e2b836
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/mac/HistoryDelegate.mm
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+#import "config.h"
+#import "HistoryDelegate.h"
+
+#import "DumpRenderTree.h"
+#import "LayoutTestController.h"
+
+#import <WebKit/WebNavigationData.h>
+
+@interface NSURL (DRTExtras)
+- (NSString *)_drt_descriptionSuitableForTestResult;
+@end
+
+@implementation HistoryDelegate
+
+- (void)webView:(WebView *)webView didNavigateWithNavigationData:(WebNavigationData *)navigationData inFrame:(WebFrame *)webFrame
+{
+    NSURL *url = [navigationData url] ? [NSURL URLWithString:[navigationData url]] : nil;
+    bool hasClientRedirect = [[navigationData clientRedirectSource] length];
+    NSHTTPURLResponse *httpResponse = [[navigationData response] isKindOfClass:[NSHTTPURLResponse class]] ? (NSHTTPURLResponse *)[navigationData response] : nil;
+    bool wasFailure = [navigationData hasSubstituteData] || (httpResponse && [httpResponse statusCode] >= 400);
+            
+    printf("WebView navigated to url \"%s\" with title \"%s\" with HTTP equivalent method \"%s\".  The navigation was %s and was %s%s.\n", 
+        url ? [[url _drt_descriptionSuitableForTestResult] UTF8String] : "<none>", 
+        [navigationData title] ? [[navigationData title] UTF8String] : "",
+        [navigationData originalRequest] ? [[[navigationData originalRequest] HTTPMethod] UTF8String] : "",
+        wasFailure ? "a failure" : "successful", 
+        hasClientRedirect ? "a client redirect from " : "not a client redirect",
+        hasClientRedirect ? [[navigationData clientRedirectSource] UTF8String] : "");
+}
+                              
+- (void)webView:(WebView *)webView didPerformClientRedirectFromURL:(NSString *)sourceURL toURL:(NSString *)destinationURL inFrame:(WebFrame *)webFrame
+{
+    NSURL *source = [NSURL URLWithString:sourceURL];
+    NSURL *dest = [NSURL URLWithString:destinationURL];
+    printf("WebView performed a client redirect from \"%s\" to \"%s\".\n", [[source _drt_descriptionSuitableForTestResult] UTF8String], [[dest _drt_descriptionSuitableForTestResult] UTF8String]);
+}
+
+- (void)webView:(WebView *)webView didPerformServerRedirectFromURL:(NSString *)sourceURL toURL:(NSString *)destinationURL inFrame:(WebFrame *)webFrame
+{
+    NSURL *source = [NSURL URLWithString:sourceURL];
+    NSURL *dest = [NSURL URLWithString:destinationURL];
+    printf("WebView performed a server redirect from \"%s\" to \"%s\".\n", [[source _drt_descriptionSuitableForTestResult] UTF8String], [[dest _drt_descriptionSuitableForTestResult] UTF8String]);
+}
+
+- (void)webView:(WebView *)webView updateHistoryTitle:(NSString *)title forURL:(NSString *)url
+{
+    printf("WebView updated the title for history URL \"%s\" to \"%s\".\n", [[[NSURL URLWithString:url]_drt_descriptionSuitableForTestResult] UTF8String], [title UTF8String]);
+}
+
+@end
diff --git a/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm b/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
index 591bb81..233c5fd 100644
--- a/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
+++ b/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
@@ -51,7 +51,8 @@
 #import <WebKit/WebHTMLViewPrivate.h>
 #import <WebKit/WebHistory.h>
 #import <WebKit/WebHistoryPrivate.h>
-#import <WebKit/WebInspector.h>
+#import <WebKit/WebInspectorPrivate.h>
+#import <WebKit/WebGeolocationMockPrivate.h>
 #import <WebKit/WebNSURLExtras.h>
 #import <WebKit/WebPreferences.h>
 #import <WebKit/WebPreferencesPrivate.h>
@@ -59,6 +60,7 @@
 #import <WebKit/WebTypesInternal.h>
 #import <WebKit/WebView.h>
 #import <WebKit/WebViewPrivate.h>
+#import <WebKit/WebWorkersPrivate.h>
 #import <wtf/RetainPtr.h>
 
 @interface CommandValidationTarget : NSObject <NSValidatedUserInterfaceItem>
@@ -163,6 +165,11 @@ size_t LayoutTestController::webHistoryItemCount()
     return [[[WebHistory optionalSharedHistory] allItems] count];
 }
 
+unsigned LayoutTestController::workerThreadCount() const
+{
+    return [WebWorkersPrivate workerThreadCount];
+}
+
 void LayoutTestController::notifyDone()
 {
     if (m_waitToDump && !topLoadingFrame && !WorkQueue::shared()->count())
@@ -192,6 +199,16 @@ void LayoutTestController::setAcceptsEditing(bool newAcceptsEditing)
     [(EditingDelegate *)[[mainFrame webView] editingDelegate] setAcceptsEditing:newAcceptsEditing];
 }
 
+void LayoutTestController::setAlwaysAcceptCookies(bool alwaysAcceptCookies)
+{
+    if (alwaysAcceptCookies == m_alwaysAcceptCookies)
+        return;
+
+    m_alwaysAcceptCookies = alwaysAcceptCookies;
+    NSHTTPCookieAcceptPolicy cookieAcceptPolicy = alwaysAcceptCookies ? NSHTTPCookieAcceptPolicyAlways : NSHTTPCookieAcceptPolicyOnlyFromMainDocumentDomain;
+    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:cookieAcceptPolicy];
+}
+
 void LayoutTestController::setAppCacheMaximumSize(unsigned long long size)
 {
     [WebApplicationCache setMaximumSize:size];
@@ -218,6 +235,18 @@ void LayoutTestController::setDatabaseQuota(unsigned long long quota)
     [origin release];
 }
 
+void LayoutTestController::setMockGeolocationPosition(double latitude, double longitude, double accuracy)
+{
+    [WebGeolocationMock setPosition:latitude:longitude:accuracy];
+}
+
+void LayoutTestController::setMockGeolocationError(int code, JSStringRef message)
+{
+    RetainPtr<CFStringRef> messageCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, message));
+    NSString *messageNS = (NSString *)messageCF.get();
+    [WebGeolocationMock setError:code:messageNS];
+}
+
 void LayoutTestController::setIconDatabaseEnabled(bool iconDatabaseEnabled)
 {
     // FIXME: Workaround <rdar://problem/6480108>
@@ -293,6 +322,17 @@ void LayoutTestController::dispatchPendingLoadRequests()
     [[mainFrame webView] _dispatchPendingLoadRequests];
 }
 
+void LayoutTestController::overridePreference(JSStringRef key, JSStringRef value)
+{
+    RetainPtr<CFStringRef> keyCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, key));
+    NSString *keyNS = (NSString *)keyCF.get();
+
+    RetainPtr<CFStringRef> valueCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, value));
+    NSString *valueNS = (NSString *)valueCF.get();
+
+    [[WebPreferences standardPreferences] _setPreferenceForTestWithValue:valueNS forKey:keyNS];
+}
+
 void LayoutTestController::setPersistentUserStyleSheetLocation(JSStringRef jsURL)
 {
     RetainPtr<CFStringRef> urlString(AdoptCF, JSStringCopyCFString(0, jsURL));
@@ -320,14 +360,11 @@ void LayoutTestController::setSelectTrailingWhitespaceEnabled(bool flag)
     [[mainFrame webView] setSelectTrailingWhitespaceEnabled:flag];
 }
 
-static const CFTimeInterval waitToDumpWatchdogInterval = 10.0;
+static const CFTimeInterval waitToDumpWatchdogInterval = 15.0;
 
 static void waitUntilDoneWatchdogFired(CFRunLoopTimerRef timer, void* info)
 {
-    const char* message = "FAIL: Timed out waiting for notifyDone to be called\n";
-    fprintf(stderr, "%s", message);
-    fprintf(stdout, "%s", message);
-    dump();
+    gLayoutTestController->waitToDumpWatchdogTimerFired();
 }
 
 void LayoutTestController::setWaitToDump(bool waitUntilDone)
@@ -429,3 +466,45 @@ void LayoutTestController::waitForPolicyDelegate()
     [policyDelegate setControllerToNotifyDone:this];
     [[mainFrame webView] setPolicyDelegate:policyDelegate];
 }
+
+void LayoutTestController::whiteListAccessFromOrigin(JSStringRef sourceOrigin, JSStringRef destinationProtocol, JSStringRef destinationHost, bool allowDestinationSubdomains)
+{
+    RetainPtr<CFStringRef> sourceOriginCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, sourceOrigin));
+    NSString *sourceOriginNS = (NSString *)sourceOriginCF.get();
+    RetainPtr<CFStringRef> protocolCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, destinationProtocol));
+    NSString *destinationProtocolNS = (NSString *)protocolCF.get();
+    RetainPtr<CFStringRef> hostCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, destinationHost));
+    NSString *destinationHostNS = (NSString *)hostCF.get();
+    [WebView _whiteListAccessFromOrigin:sourceOriginNS destinationProtocol:destinationProtocolNS destinationHost:destinationHostNS allowDestinationSubdomains:allowDestinationSubdomains];
+}
+
+void LayoutTestController::addUserScript(JSStringRef source, bool runAtStart)
+{
+    RetainPtr<CFStringRef> sourceCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, source));
+    NSString *sourceNS = (NSString *)sourceCF.get();
+    [WebView _addUserScriptToGroup:@"org.webkit.DumpRenderTree" source:sourceNS url:nil worldID:1 whitelist:nil blacklist:nil injectionTime:(runAtStart ? WebInjectAtDocumentStart : WebInjectAtDocumentEnd)];
+}
+
+void LayoutTestController::addUserStyleSheet(JSStringRef source)
+{
+    RetainPtr<CFStringRef> sourceCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, source));
+    NSString *sourceNS = (NSString *)sourceCF.get();
+    [WebView _addUserStyleSheetToGroup:@"org.webkit.DumpRenderTree" source:sourceNS url:nil worldID:1 whitelist:nil blacklist:nil];
+}
+
+void LayoutTestController::showWebInspector()
+{
+    [[[mainFrame webView] inspector] show:nil];
+}
+
+void LayoutTestController::closeWebInspector()
+{
+    [[[mainFrame webView] inspector] close:nil];
+}
+
+void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef script)
+{
+    RetainPtr<CFStringRef> scriptCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, script));
+    NSString *scriptNS = (NSString *)scriptCF.get();
+    [[[mainFrame webView] inspector] evaluateInFrontend:nil callId:callId script:scriptNS];
+}
diff --git a/WebKitTools/DumpRenderTree/mac/PerlSupport/DumpRenderTreeSupportTiger.pm b/WebKitTools/DumpRenderTree/mac/PerlSupport/DumpRenderTreeSupportTiger.pm
index f0697fc..7b4ea34 100644
--- a/WebKitTools/DumpRenderTree/mac/PerlSupport/DumpRenderTreeSupportTiger.pm
+++ b/WebKitTools/DumpRenderTree/mac/PerlSupport/DumpRenderTreeSupportTiger.pm
@@ -1,52 +1,54 @@
-# Copyright (C) 2009 Apple Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-# 1. Redistributions of source code must retain the above copyright
-#    notice, this list of conditions and the following disclaimer.
-# 2. Redistributions in binary form must reproduce the above copyright
-#    notice, this list of conditions and the following disclaimer in the
-#    documentation and/or other materials provided with the distribution.
-#
-# THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-use strict;
-use warnings;
+# This file was automatically generated by SWIG
+package DumpRenderTreeSupport;
+require Exporter;
+require DynaLoader;
+@ISA = qw(Exporter DynaLoader);
+package DumpRenderTreeSupportc;
+bootstrap DumpRenderTreeSupport;
+package DumpRenderTreeSupport;
+@EXPORT = qw( );
+
+# ---------- BASE METHODS -------------
 
 package DumpRenderTreeSupport;
 
-BEGIN {
-   use Exporter   ();
-   our ($VERSION, @ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS);
-   $VERSION     = 1.00;
-   @ISA         = qw(Exporter);
-   @EXPORT      = qw(&processIsCrashing);
-   %EXPORT_TAGS = ( );
-   @EXPORT_OK   = ();
+sub TIEHASH {
+    my ($classname,$obj) = @_;
+    return bless $obj, $classname;
+}
+
+sub CLEAR { }
+
+sub FIRSTKEY { }
+
+sub NEXTKEY { }
+
+sub FETCH {
+    my ($self,$field) = @_;
+    my $member_func = "swig_${field}_get";
+    $self->$member_func();
+}
+
+sub STORE {
+    my ($self,$field,$newval) = @_;
+    my $member_func = "swig_${field}_set";
+    $self->$member_func($newval);
 }
 
-our @EXPORT_OK;
-
-sub processIsCrashing
-{
-    my $pid = shift;
-    my $tryingToExit = 0;
-    open PS, "ps -o state -p $pid |";
-    <PS>; # skip header
-    $tryingToExit = 1 if <PS> =~ /E/;
-    close PS;
-    return $tryingToExit;
+sub this {
+    my $ptr = shift;
+    return tied(%$ptr);
 }
 
+
+# ------- FUNCTION WRAPPERS --------
+
+package DumpRenderTreeSupport;
+
+*processIsCrashing = *DumpRenderTreeSupportc::processIsCrashing;
+
+# ------- VARIABLE STUBS --------
+
+package DumpRenderTreeSupport;
+
 1;
diff --git a/WebKitTools/DumpRenderTree/mac/PerlSupport/DumpRenderTreeSupport_wrapTiger.c b/WebKitTools/DumpRenderTree/mac/PerlSupport/DumpRenderTreeSupport_wrapTiger.c
new file mode 100644
index 0000000..f734989
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/mac/PerlSupport/DumpRenderTreeSupport_wrapTiger.c
@@ -0,0 +1,1167 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (http://www.swig.org).
+ * Version 1.3.24
+ * 
+ * This file is not intended to be easily readable and contains a number of 
+ * coding conventions designed to improve portability and efficiency. Do not make
+ * changes to this file unless you know what you are doing--modify the SWIG 
+ * interface file instead. 
+ * ----------------------------------------------------------------------------- */
+
+
+#ifndef SWIG_TEMPLATE_DISAMBIGUATOR
+#  if defined(__SUNPRO_CC) 
+#    define SWIG_TEMPLATE_DISAMBIGUATOR template
+#  else
+#    define SWIG_TEMPLATE_DISAMBIGUATOR 
+#  endif
+#endif
+
+/***********************************************************************
+ * swigrun.swg
+ *
+ *     This file contains generic CAPI SWIG runtime support for pointer
+ *     type checking.
+ *
+ ************************************************************************/
+
+/* This should only be incremented when either the layout of swig_type_info changes,
+   or for whatever reason, the runtime changes incompatibly */
+#define SWIG_RUNTIME_VERSION "1"
+
+/* define SWIG_TYPE_TABLE_NAME as "SWIG_TYPE_TABLE" */
+#ifdef SWIG_TYPE_TABLE
+#define SWIG_QUOTE_STRING(x) #x
+#define SWIG_EXPAND_AND_QUOTE_STRING(x) SWIG_QUOTE_STRING(x)
+#define SWIG_TYPE_TABLE_NAME SWIG_EXPAND_AND_QUOTE_STRING(SWIG_TYPE_TABLE)
+#else
+#define SWIG_TYPE_TABLE_NAME
+#endif
+
+#include <string.h>
+
+#ifndef SWIGINLINE
+#if defined(__cplusplus) || (defined(__GNUC__) && !defined(__STRICT_ANSI__))
+#  define SWIGINLINE inline
+#else
+#  define SWIGINLINE
+#endif
+#endif
+
+/*
+  You can use the SWIGRUNTIME and SWIGRUNTIMEINLINE macros for
+  creating a static or dynamic library from the swig runtime code.
+  In 99.9% of the cases, swig just needs to declare them as 'static'.
+  
+  But only do this if is strictly necessary, ie, if you have problems
+  with your compiler or so.
+*/
+#ifndef SWIGRUNTIME
+#define SWIGRUNTIME static
+#endif
+#ifndef SWIGRUNTIMEINLINE
+#define SWIGRUNTIMEINLINE SWIGRUNTIME SWIGINLINE
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void *(*swig_converter_func)(void *);
+typedef struct swig_type_info *(*swig_dycast_func)(void **);
+
+typedef struct swig_type_info {
+  const char             *name;
+  swig_converter_func     converter;
+  const char             *str;
+  void                   *clientdata;
+  swig_dycast_func        dcast;
+  struct swig_type_info  *next;
+  struct swig_type_info  *prev;
+} swig_type_info;
+
+/* 
+  Compare two type names skipping the space characters, therefore
+  "char*" == "char *" and "Class<int>" == "Class<int >", etc.
+
+  Return 0 when the two name types are equivalent, as in
+  strncmp, but skipping ' '.
+*/
+SWIGRUNTIME int
+SWIG_TypeNameComp(const char *f1, const char *l1,
+                  const char *f2, const char *l2) {
+  for (;(f1 != l1) && (f2 != l2); ++f1, ++f2) {
+    while ((*f1 == ' ') && (f1 != l1)) ++f1;
+    while ((*f2 == ' ') && (f2 != l2)) ++f2;
+    if (*f1 != *f2) return *f1 - *f2;
+  }
+  return (l1 - f1) - (l2 - f2);
+}
+
+/*
+  Check type equivalence in a name list like <name1>|<name2>|...
+*/
+SWIGRUNTIME int
+SWIG_TypeEquiv(const char *nb, const char *tb) {
+  int equiv = 0;
+  const char* te = tb + strlen(tb);
+  const char* ne = nb;
+  while (!equiv && *ne) {
+    for (nb = ne; *ne; ++ne) {
+      if (*ne == '|') break;
+    }
+    equiv = SWIG_TypeNameComp(nb, ne, tb, te) == 0;
+    if (*ne) ++ne;
+  }
+  return equiv;
+}
+
+/*
+  Register a type mapping with the type-checking
+*/
+SWIGRUNTIME swig_type_info *
+SWIG_TypeRegisterTL(swig_type_info **tl, swig_type_info *ti) {
+  swig_type_info *tc, *head, *ret, *next;
+  /* Check to see if this type has already been registered */
+  tc = *tl;
+  while (tc) {
+    /* check simple type equivalence */
+    int typeequiv = (strcmp(tc->name, ti->name) == 0);   
+    /* check full type equivalence, resolving typedefs */
+    if (!typeequiv) {
+      /* only if tc is not a typedef (no '|' on it) */
+      if (tc->str && ti->str && !strstr(tc->str,"|")) {
+        typeequiv = SWIG_TypeEquiv(ti->str,tc->str);
+      }
+    }
+    if (typeequiv) {
+      /* Already exists in the table.  Just add additional types to the list */
+      if (ti->clientdata) tc->clientdata = ti->clientdata;
+      head = tc;
+      next = tc->next;
+      goto l1;
+    }
+    tc = tc->prev;
+  }
+  head = ti;
+  next = 0;
+
+  /* Place in list */
+  ti->prev = *tl;
+  *tl = ti;
+
+  /* Build linked lists */
+  l1:
+  ret = head;
+  tc = ti + 1;
+  /* Patch up the rest of the links */
+  while (tc->name) {
+    head->next = tc;
+    tc->prev = head;
+    head = tc;
+    tc++;
+  }
+  if (next) next->prev = head;
+  head->next = next;
+
+  return ret;
+}
+
+/*
+  Check the typename
+*/
+SWIGRUNTIME swig_type_info *
+SWIG_TypeCheck(const char *c, swig_type_info *ty) {
+  swig_type_info *s;
+  if (!ty) return 0;        /* Void pointer */
+  s = ty->next;             /* First element always just a name */
+  do {
+    if (strcmp(s->name,c) == 0) {
+      if (s == ty->next) return s;
+      /* Move s to the top of the linked list */
+      s->prev->next = s->next;
+      if (s->next) {
+        s->next->prev = s->prev;
+      }
+      /* Insert s as second element in the list */
+      s->next = ty->next;
+      if (ty->next) ty->next->prev = s;
+      ty->next = s;
+      s->prev = ty;
+      return s;
+    }
+    s = s->next;
+  } while (s && (s != ty->next));
+  return 0;
+}
+
+/*
+  Cast a pointer up an inheritance hierarchy
+*/
+SWIGRUNTIMEINLINE void *
+SWIG_TypeCast(swig_type_info *ty, void *ptr) {
+  return ((!ty) || (!ty->converter)) ? ptr : (*ty->converter)(ptr);
+}
+
+/* 
+   Dynamic pointer casting. Down an inheritance hierarchy
+*/
+SWIGRUNTIME swig_type_info *
+SWIG_TypeDynamicCast(swig_type_info *ty, void **ptr) {
+  swig_type_info *lastty = ty;
+  if (!ty || !ty->dcast) return ty;
+  while (ty && (ty->dcast)) {
+    ty = (*ty->dcast)(ptr);
+    if (ty) lastty = ty;
+  }
+  return lastty;
+}
+
+/*
+  Return the name associated with this type
+*/
+SWIGRUNTIMEINLINE const char *
+SWIG_TypeName(const swig_type_info *ty) {
+  return ty->name;
+}
+
+/*
+  Return the pretty name associated with this type,
+  that is an unmangled type name in a form presentable to the user.
+*/
+SWIGRUNTIME const char *
+SWIG_TypePrettyName(const swig_type_info *type) {
+  /* The "str" field contains the equivalent pretty names of the
+     type, separated by vertical-bar characters.  We choose
+     to print the last name, as it is often (?) the most
+     specific. */
+  if (type->str != NULL) {
+    const char *last_name = type->str;
+    const char *s;
+    for (s = type->str; *s; s++)
+      if (*s == '|') last_name = s+1;
+    return last_name;
+  }
+  else
+    return type->name;
+}
+
+/*
+  Search for a swig_type_info structure
+*/
+SWIGRUNTIME swig_type_info *
+SWIG_TypeQueryTL(swig_type_info *tl, const char *name) {
+  swig_type_info *ty = tl;
+  while (ty) {
+    if (ty->str && (SWIG_TypeEquiv(ty->str,name))) return ty;
+    if (ty->name && (strcmp(name,ty->name) == 0)) return ty;
+    ty = ty->prev;
+  }
+  return 0;
+}
+
+/* 
+   Set the clientdata field for a type
+*/
+SWIGRUNTIME void
+SWIG_TypeClientDataTL(swig_type_info *tl, swig_type_info *ti, void *clientdata) {
+  swig_type_info *tc, *equiv;
+  if (ti->clientdata) return;
+  /* if (ti->clientdata == clientdata) return; */
+  ti->clientdata = clientdata;
+  equiv = ti->next;
+  while (equiv) {
+    if (!equiv->converter) {
+      tc = tl;
+      while (tc) {
+        if ((strcmp(tc->name, equiv->name) == 0))
+          SWIG_TypeClientDataTL(tl,tc,clientdata);
+        tc = tc->prev;
+      }
+    }
+    equiv = equiv->next;
+  }
+}
+
+/* 
+   Pack binary data into a string
+*/
+SWIGRUNTIME char *
+SWIG_PackData(char *c, void *ptr, size_t sz) {
+  static char hex[17] = "0123456789abcdef";
+  unsigned char *u = (unsigned char *) ptr;
+  const unsigned char *eu =  u + sz;
+  register unsigned char uu;
+  for (; u != eu; ++u) {
+    uu = *u;
+    *(c++) = hex[(uu & 0xf0) >> 4];
+    *(c++) = hex[uu & 0xf];
+  }
+  return c;
+}
+
+/* 
+   Unpack binary data from a string
+*/
+SWIGRUNTIME const char *
+SWIG_UnpackData(const char *c, void *ptr, size_t sz) {
+  register unsigned char *u = (unsigned char *) ptr;
+  register const unsigned char *eu =  u + sz;
+  for (; u != eu; ++u) {
+    register int d = *(c++);
+    register unsigned char uu = 0;
+    if ((d >= '0') && (d <= '9'))
+      uu = ((d - '0') << 4);
+    else if ((d >= 'a') && (d <= 'f'))
+      uu = ((d - ('a'-10)) << 4);
+    else 
+      return (char *) 0;
+    d = *(c++);
+    if ((d >= '0') && (d <= '9'))
+      uu |= (d - '0');
+    else if ((d >= 'a') && (d <= 'f'))
+      uu |= (d - ('a'-10));
+    else 
+      return (char *) 0;
+    *u = uu;
+  }
+  return c;
+}
+
+/*
+  This function will propagate the clientdata field of type to any new
+  swig_type_info structures that have been added into the list of
+  equivalent types.  It is like calling SWIG_TypeClientData(type,
+  clientdata) a second time.
+*/
+SWIGRUNTIME void
+SWIG_PropagateClientDataTL(swig_type_info *tl, swig_type_info *type) {
+  swig_type_info *equiv = type->next;
+  swig_type_info *tc;
+  if (!type->clientdata) return;
+  while (equiv) {
+    if (!equiv->converter) {
+      tc = tl;
+      while (tc) {
+        if ((strcmp(tc->name, equiv->name) == 0) && !tc->clientdata)
+          SWIG_TypeClientDataTL(tl,tc, type->clientdata);
+        tc = tc->prev;
+      }
+    }
+    equiv = equiv->next;
+  }
+}
+
+/* 
+   Pack 'void *' into a string buffer.
+*/
+SWIGRUNTIME char *
+SWIG_PackVoidPtr(char *buff, void *ptr, const char *name, size_t bsz) {
+  char *r = buff;
+  if ((2*sizeof(void *) + 2) > bsz) return 0;
+  *(r++) = '_';
+  r = SWIG_PackData(r,&ptr,sizeof(void *));
+  if (strlen(name) + 1 > (bsz - (r - buff))) return 0;
+  strcpy(r,name);
+  return buff;
+}
+
+SWIGRUNTIME const char *
+SWIG_UnpackVoidPtr(const char *c, void **ptr, const char *name) {
+  if (*c != '_') {
+    if (strcmp(c,"NULL") == 0) {
+      *ptr = (void *) 0;
+      return name;
+    } else {
+      return 0;
+    }
+  }
+  return SWIG_UnpackData(++c,ptr,sizeof(void *));
+}
+
+SWIGRUNTIME char *
+SWIG_PackDataName(char *buff, void *ptr, size_t sz, const char *name, size_t bsz) {
+  char *r = buff;
+  size_t lname = (name ? strlen(name) : 0);
+  if ((2*sz + 2 + lname) > bsz) return 0;
+  *(r++) = '_';
+  r = SWIG_PackData(r,ptr,sz);
+  if (lname) {
+    strncpy(r,name,lname+1);
+  } else {
+    *r = 0;
+  }
+  return buff;
+}
+
+SWIGRUNTIME const char *
+SWIG_UnpackDataName(const char *c, void *ptr, size_t sz, const char *name) {
+  if (*c != '_') {
+    if (strcmp(c,"NULL") == 0) {
+      memset(ptr,0,sz);
+      return name;
+    } else {
+      return 0;
+    }
+  }
+  return SWIG_UnpackData(++c,ptr,sz);
+}
+
+#ifdef __cplusplus
+}
+#endif
+
+/***********************************************************************
+ * common.swg
+ *
+ *     This file contains generic SWIG runtime support for pointer
+ *     type checking as well as a few commonly used macros to control
+ *     external linkage.
+ *
+ * Author : David Beazley (beazley@cs.uchicago.edu)
+ *
+ * Copyright (c) 1999-2000, The University of Chicago
+ * 
+ * This file may be freely redistributed without license or fee provided
+ * this copyright message remains intact.
+ ************************************************************************/
+
+
+#if defined(_WIN32) || defined(__WIN32__) || defined(__CYGWIN__)
+#  if !defined(STATIC_LINKED)
+#    define SWIGEXPORT(a) __declspec(dllexport) a
+#  else
+#    define SWIGEXPORT(a) a
+#  endif
+#else
+#  define SWIGEXPORT(a) a
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/*************************************************************************/
+
+
+/* The static type info list */
+
+static swig_type_info *swig_type_list = 0;
+static swig_type_info **swig_type_list_handle = &swig_type_list;
+  
+
+/* Register a type mapping with the type-checking */
+static swig_type_info *
+SWIG_TypeRegister(swig_type_info *ti) {
+  return SWIG_TypeRegisterTL(swig_type_list_handle, ti);
+}
+
+/* Search for a swig_type_info structure */
+static swig_type_info *
+SWIG_TypeQuery(const char *name) {
+  return SWIG_TypeQueryTL(*swig_type_list_handle, name);
+}
+
+/* Set the clientdata field for a type */
+static void
+SWIG_TypeClientData(swig_type_info *ti, void *clientdata) {
+  SWIG_TypeClientDataTL(*swig_type_list_handle, ti, clientdata);
+}
+
+/* This function will propagate the clientdata field of type to
+* any new swig_type_info structures that have been added into the list
+* of equivalent types.  It is like calling
+* SWIG_TypeClientData(type, clientdata) a second time.
+*/
+static void
+SWIG_PropagateClientData(swig_type_info *type) {
+  SWIG_PropagateClientDataTL(*swig_type_list_handle, type);
+}
+
+#ifdef __cplusplus
+}
+#endif
+
+/* ---------------------------------------------------------------------- -*- c -*-
+ * perl5.swg
+ *
+ * Perl5 runtime library
+ * $Header: /cvsroot/swig/SWIG/Lib/perl5/perlrun.swg,v 1.20 2004/11/29 23:13:57 wuzzeb Exp $
+ * ----------------------------------------------------------------------------- */
+
+#define SWIGPERL
+#define SWIGPERL5
+#ifdef __cplusplus
+/* Needed on some windows machines---since MS plays funny games with the header files under C++ */
+#include <math.h>
+#include <stdlib.h>
+extern "C" {
+#endif
+#include "EXTERN.h"
+#include "perl.h"
+#include "XSUB.h"
+
+/* Get rid of free and malloc defined by perl */
+#undef free
+#undef malloc
+
+#ifndef pTHX_
+#define pTHX_
+#endif
+
+#include <string.h>
+#ifdef __cplusplus
+}
+#endif
+
+/* Macro to call an XS function */
+
+#ifdef PERL_OBJECT 
+#  define SWIG_CALLXS(_name) _name(cv,pPerl) 
+#else 
+#  ifndef MULTIPLICITY 
+#    define SWIG_CALLXS(_name) _name(cv) 
+#  else 
+#    define SWIG_CALLXS(_name) _name(PERL_GET_THX, cv) 
+#  endif 
+#endif 
+
+/* Contract support */
+
+#define SWIG_contract_assert(expr,msg) if (!(expr)) { SWIG_croak(msg); } else
+
+/* Note: SwigMagicFuncHack is a typedef used to get the C++ compiler to just shut up already */
+
+#ifdef PERL_OBJECT
+#define MAGIC_PPERL  CPerlObj *pPerl = (CPerlObj *) this;
+typedef int (CPerlObj::*SwigMagicFunc)(SV *, MAGIC *);
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+typedef int (CPerlObj::*SwigMagicFuncHack)(SV *, MAGIC *);
+#ifdef __cplusplus
+}
+#endif
+
+#define SWIG_MAGIC(a,b) (SV *a, MAGIC *b)
+#define SWIGCLASS_STATIC
+#else
+#define MAGIC_PPERL
+#define SWIGCLASS_STATIC static
+#ifndef MULTIPLICITY
+#define SWIG_MAGIC(a,b) (SV *a, MAGIC *b)
+typedef int (*SwigMagicFunc)(SV *, MAGIC *);
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+typedef int (*SwigMagicFuncHack)(SV *, MAGIC *);
+#ifdef __cplusplus
+}
+#endif
+
+
+#else
+#define SWIG_MAGIC(a,b) (struct interpreter *interp, SV *a, MAGIC *b)
+typedef int (*SwigMagicFunc)(struct interpreter *, SV *, MAGIC *);
+#ifdef __cplusplus
+extern "C" {
+#endif
+typedef int (*SwigMagicFuncHack)(struct interpreter *, SV *, MAGIC *);
+#ifdef __cplusplus
+}
+#endif
+
+#endif
+#endif
+
+#if defined(WIN32) && defined(PERL_OBJECT) && !defined(PerlIO_exportFILE)
+#define PerlIO_exportFILE(fh,fl) (FILE*)(fh)
+#endif
+
+/* Modifications for newer Perl 5.005 releases */
+
+#if !defined(PERL_REVISION) || ((PERL_REVISION >= 5) && ((PERL_VERSION < 5) || ((PERL_VERSION == 5) && (PERL_SUBVERSION < 50))))
+#  ifndef PL_sv_yes
+#    define PL_sv_yes sv_yes
+#  endif
+#  ifndef PL_sv_undef
+#    define PL_sv_undef sv_undef
+#  endif
+#  ifndef PL_na
+#    define PL_na na
+#  endif
+#endif
+
+#include <stdlib.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define SWIG_OWNER 1
+#define SWIG_SHADOW 2
+
+/* Common SWIG API */
+
+#ifdef PERL_OBJECT
+#  define SWIG_ConvertPtr(obj, pp, type, flags) \
+     SWIG_Perl_ConvertPtr(pPerl, obj, pp, type, flags)
+#  define SWIG_NewPointerObj(p, type, flags) \
+     SWIG_Perl_NewPointerObj(pPerl, p, type, flags)
+#  define SWIG_MakePackedObj(sv, p, s, type) \
+     SWIG_Perl_MakePackedObj(pPerl, sv, p, s, type)
+#  define SWIG_ConvertPacked(obj, p, s, type, flags) \
+     SWIG_Perl_ConvertPacked(pPerl, obj, p, s, type, flags)
+
+#else
+#  define SWIG_ConvertPtr(obj, pp, type, flags) \
+     SWIG_Perl_ConvertPtr(obj, pp, type, flags)
+#  define SWIG_NewPointerObj(p, type, flags) \
+     SWIG_Perl_NewPointerObj(p, type, flags)
+#  define SWIG_MakePackedObj(sv, p, s, type) \
+     SWIG_Perl_MakePackedObj(sv, p, s, type )
+#  define SWIG_ConvertPacked(obj, p, s, type, flags) \
+     SWIG_Perl_ConvertPacked(obj, p, s, type, flags)
+#endif
+
+/* Perl-specific API */
+#ifdef PERL_OBJECT
+#  define SWIG_MakePtr(sv, ptr, type, flags) \
+     SWIG_Perl_MakePtr(pPerl, sv, ptr, type, flags)
+#  define SWIG_SetError(str) \
+     SWIG_Perl_SetError(pPerl, str)
+#else
+#  define SWIG_MakePtr(sv, ptr, type, flags) \
+     SWIG_Perl_MakePtr(sv, ptr, type, flags)
+#  define SWIG_SetError(str) \
+     SWIG_Perl_SetError(str)
+#  define SWIG_SetErrorSV(str) \
+     SWIG_Perl_SetErrorSV(str)
+#endif
+
+#define SWIG_SetErrorf SWIG_Perl_SetErrorf
+
+
+#ifdef PERL_OBJECT
+#  define SWIG_MAYBE_PERL_OBJECT CPerlObj *pPerl,
+#else
+#  define SWIG_MAYBE_PERL_OBJECT
+#endif
+
+static swig_type_info **
+SWIG_Perl_GetTypeListHandle() {
+  static void *type_pointer = (void *)0;
+  SV *pointer;
+
+  /* first check if pointer already created */
+  if (!type_pointer) {
+    pointer = get_sv("swig_runtime_data::type_pointer" SWIG_RUNTIME_VERSION SWIG_TYPE_TABLE_NAME, FALSE);
+    if (pointer && SvOK(pointer)) {
+      type_pointer = INT2PTR(swig_type_info **, SvIV(pointer));
+    }
+  }
+
+  return (swig_type_info **) type_pointer;
+}
+
+/*
+  Search for a swig_type_info structure
+ */
+SWIGRUNTIMEINLINE swig_type_info *
+SWIG_Perl_GetTypeList() {
+  swig_type_info **tlh = SWIG_Perl_GetTypeListHandle();
+  return tlh ? *tlh : (swig_type_info*)0;
+}
+
+#define SWIG_Runtime_GetTypeList SWIG_Perl_GetTypeList 
+
+static swig_type_info *
+SWIG_Perl_TypeCheckRV(SWIG_MAYBE_PERL_OBJECT SV *rv, swig_type_info *ty) {
+  swig_type_info *s;
+  if (!ty) return 0;        /* Void pointer */
+  s = ty->next;             /* First element always just a name */
+  do {
+    if (sv_derived_from(rv, (char *) s->name)) {
+      if (s == ty->next) return s;
+      /* Move s to the top of the linked list */
+      s->prev->next = s->next;
+      if (s->next) {
+        s->next->prev = s->prev;
+      }
+      /* Insert s as second element in the list */
+      s->next = ty->next;
+      if (ty->next) ty->next->prev = s;
+      ty->next = s;
+      s->prev = ty;
+      return s;
+    }
+    s = s->next;
+  } while (s && (s != ty->next));
+  return 0;
+}
+
+/* Function for getting a pointer value */
+
+static int
+SWIG_Perl_ConvertPtr(SWIG_MAYBE_PERL_OBJECT SV *sv, void **ptr, swig_type_info *_t, int flags) {
+  swig_type_info *tc;
+  void *voidptr = (void *)0;
+
+  /* If magical, apply more magic */
+  if (SvGMAGICAL(sv))
+    mg_get(sv);
+
+  /* Check to see if this is an object */
+  if (sv_isobject(sv)) {
+    SV *tsv = (SV*) SvRV(sv);
+    IV tmp = 0;
+    if ((SvTYPE(tsv) == SVt_PVHV)) {
+      MAGIC *mg;
+      if (SvMAGICAL(tsv)) {
+        mg = mg_find(tsv,'P');
+        if (mg) {
+          sv = mg->mg_obj;
+          if (sv_isobject(sv)) {
+            tmp = SvIV((SV*)SvRV(sv));
+          }
+        }
+      } else {
+        return -1;
+      }
+    } else {
+      tmp = SvIV((SV*)SvRV(sv));
+    }
+    voidptr = (void *)tmp;
+    if (!_t) {
+      *(ptr) = voidptr;
+      return 0;
+    }
+  } else if (! SvOK(sv)) {            /* Check for undef */
+    *(ptr) = (void *) 0;
+    return 0;
+  } else if (SvTYPE(sv) == SVt_RV) {  /* Check for NULL pointer */
+    *(ptr) = (void *) 0;
+    if (!SvROK(sv))
+      return 0;
+    else
+      return -1;
+  } else {                            /* Don't know what it is */
+    *(ptr) = (void *) 0;
+    return -1;
+  }
+  if (_t) {
+    /* Now see if the types match */
+    char *_c = HvNAME(SvSTASH(SvRV(sv)));
+    tc = SWIG_TypeCheck(_c,_t);
+    if (!tc) {
+      *ptr = voidptr;
+      return -1;
+    }
+    *ptr = SWIG_TypeCast(tc,voidptr);
+    return 0;
+  }
+  *ptr = voidptr;
+  return 0;
+}
+
+static void
+SWIG_Perl_MakePtr(SWIG_MAYBE_PERL_OBJECT SV *sv, void *ptr, swig_type_info *t, int flags) {
+  if (ptr && (flags & SWIG_SHADOW)) {
+    SV *self;
+    SV *obj=newSV(0);
+    HV *hash=newHV();
+    HV *stash;
+    sv_setref_pv(obj, (char *) t->name, ptr);
+    stash=SvSTASH(SvRV(obj));
+    if (flags & SWIG_OWNER) {
+      HV *hv;
+      GV *gv=*(GV**)hv_fetch(stash, "OWNER", 5, TRUE);
+      if (!isGV(gv))
+        gv_init(gv, stash, "OWNER", 5, FALSE);
+      hv=GvHVn(gv);
+      hv_store_ent(hv, obj, newSViv(1), 0);
+    }
+    sv_magic((SV *)hash, (SV *)obj, 'P', Nullch, 0);
+    SvREFCNT_dec(obj);
+    self=newRV_noinc((SV *)hash);
+    sv_setsv(sv, self);
+    SvREFCNT_dec((SV *)self);
+    sv_bless(sv, stash);
+  }
+  else {
+    sv_setref_pv(sv, (char *) t->name, ptr);
+  }
+}
+
+static SWIGINLINE SV *
+SWIG_Perl_NewPointerObj(SWIG_MAYBE_PERL_OBJECT void *ptr, swig_type_info *t, int flags) {
+  SV *result = sv_newmortal();
+  SWIG_MakePtr(result, ptr, t, flags);
+  return result;
+}
+
+static void
+  SWIG_Perl_MakePackedObj(SWIG_MAYBE_PERL_OBJECT SV *sv, void *ptr, int sz, swig_type_info *type) {
+  char result[1024];
+  char *r = result;
+  if ((2*sz + 1 + strlen(type->name)) > 1000) return;
+  *(r++) = '_';
+  r = SWIG_PackData(r,ptr,sz);
+  strcpy(r,type->name);
+  sv_setpv(sv, result);
+}
+
+/* Convert a packed value value */
+static int
+SWIG_Perl_ConvertPacked(SWIG_MAYBE_PERL_OBJECT SV *obj, void *ptr, int sz, swig_type_info *ty, int flags) {
+  swig_type_info *tc;
+  const char  *c = 0;
+
+  if ((!obj) || (!SvOK(obj))) return -1;
+  c = SvPV(obj, PL_na);
+  /* Pointer values must start with leading underscore */
+  if (*c != '_') return -1;
+  c++;
+  c = SWIG_UnpackData(c,ptr,sz);
+  if (ty) {
+    tc = SWIG_TypeCheck(c,ty);
+    if (!tc) return -1;
+  }
+  return 0;
+}
+
+static SWIGINLINE void
+SWIG_Perl_SetError(SWIG_MAYBE_PERL_OBJECT const char *error) {
+  if (error) sv_setpv(perl_get_sv("@", TRUE), error);
+}
+
+static SWIGINLINE void
+SWIG_Perl_SetErrorSV(SWIG_MAYBE_PERL_OBJECT SV *error) {
+  if (error) sv_setsv(perl_get_sv("@", TRUE), error);
+}
+
+static void
+SWIG_Perl_SetErrorf(const char *fmt, ...) {
+  va_list args;
+  va_start(args, fmt);
+  sv_vsetpvfn(perl_get_sv("@", TRUE), fmt, strlen(fmt), &args, Null(SV**), 0, Null(bool*));
+  va_end(args);
+}
+
+/* Macros for low-level exception handling */
+#define SWIG_fail       goto fail
+#define SWIG_croak(x)   { SWIG_SetError(x); goto fail; }
+#define SWIG_croakSV(x) { SWIG_SetErrorSV(x); goto fail; }
+/* most preprocessors do not support vararg macros :-( */
+/* #define SWIG_croakf(x...) { SWIG_SetErrorf(x); goto fail; } */
+
+
+typedef XS(SwigPerlWrapper);
+typedef SwigPerlWrapper *SwigPerlWrapperPtr;
+
+/* Structure for command table */
+typedef struct {
+  const char         *name;
+  SwigPerlWrapperPtr  wrapper;
+} swig_command_info;
+
+/* Information for constant table */
+
+#define SWIG_INT     1
+#define SWIG_FLOAT   2
+#define SWIG_STRING  3
+#define SWIG_POINTER 4
+#define SWIG_BINARY  5
+
+/* Constant information structure */
+typedef struct swig_constant_info {
+    int              type;
+    const char      *name;
+    long             lvalue;
+    double           dvalue;
+    void            *pvalue;
+    swig_type_info **ptype;
+} swig_constant_info;
+
+#ifdef __cplusplus
+}
+#endif
+
+/* Structure for variable table */
+typedef struct {
+  const char   *name;
+  SwigMagicFunc   set;
+  SwigMagicFunc   get;
+  swig_type_info  **type;
+} swig_variable_info;
+
+/* Magic variable code */
+#ifndef PERL_OBJECT
+#define swig_create_magic(s,a,b,c) _swig_create_magic(s,a,b,c)
+  #ifndef MULTIPLICITY
+     static void _swig_create_magic(SV *sv, char *name, int (*set)(SV *, MAGIC *), int (*get)(SV *,MAGIC *)) {
+  #else
+     static void _swig_create_magic(SV *sv, char *name, int (*set)(struct interpreter*, SV *, MAGIC *), int (*get)(struct interpreter*, SV *,MAGIC *)) {
+  #endif
+#else
+#  define swig_create_magic(s,a,b,c) _swig_create_magic(pPerl,s,a,b,c)
+static void _swig_create_magic(CPerlObj *pPerl, SV *sv, const char *name, int (CPerlObj::*set)(SV *, MAGIC *), int (CPerlObj::*get)(SV *, MAGIC *)) {
+#endif
+  MAGIC *mg;
+  sv_magic(sv,sv,'U',(char *) name,strlen(name));
+  mg = mg_find(sv,'U');
+  mg->mg_virtual = (MGVTBL *) malloc(sizeof(MGVTBL));
+  mg->mg_virtual->svt_get = (SwigMagicFuncHack) get;
+  mg->mg_virtual->svt_set = (SwigMagicFuncHack) set;
+  mg->mg_virtual->svt_len = 0;
+  mg->mg_virtual->svt_clear = 0;
+  mg->mg_virtual->svt_free = 0;
+}
+
+
+
+
+
+
+#ifdef do_open
+  #undef do_open
+#endif
+#ifdef do_close
+  #undef do_close
+#endif
+#ifdef scalar
+  #undef scalar
+#endif
+#ifdef list
+  #undef list
+#endif
+#ifdef apply
+  #undef apply
+#endif
+#ifdef convert
+  #undef convert
+#endif
+#ifdef Error
+  #undef Error
+#endif
+#ifdef form
+  #undef form
+#endif
+#ifdef vform
+  #undef vform
+#endif
+#ifdef LABEL
+  #undef LABEL
+#endif
+#ifdef METHOD
+  #undef METHOD
+#endif
+#ifdef Move
+  #undef Move
+#endif
+#ifdef yylex
+  #undef yylex
+#endif
+#ifdef yyparse
+  #undef yyparse
+#endif
+#ifdef yyerror
+  #undef yyerror
+#endif
+#ifdef invert
+  #undef invert
+#endif
+#ifdef ref
+  #undef ref
+#endif
+#ifdef ENTER
+  #undef ENTER
+#endif
+
+
+/* -------- TYPES TABLE (BEGIN) -------- */
+
+static swig_type_info *swig_types[1];
+
+/* -------- TYPES TABLE (END) -------- */
+
+#define SWIG_init    boot_DumpRenderTreeSupport
+
+#define SWIG_name   "DumpRenderTreeSupportc::boot_DumpRenderTreeSupport"
+#define SWIG_prefix "DumpRenderTreeSupportc::"
+
+#ifdef __cplusplus
+extern "C"
+#endif
+#ifndef PERL_OBJECT
+#ifndef MULTIPLICITY
+SWIGEXPORT(void) SWIG_init (CV* cv);
+#else
+SWIGEXPORT(void) SWIG_init (pTHXo_ CV* cv);
+#endif
+#else
+SWIGEXPORT(void) SWIG_init (CV *cv, CPerlObj *);
+#endif
+
+int processIsCrashing(int);
+#ifdef PERL_OBJECT
+#define MAGIC_CLASS _wrap_DumpRenderTreeSupport_var::
+class _wrap_DumpRenderTreeSupport_var : public CPerlObj {
+public:
+#else
+#define MAGIC_CLASS
+#endif
+SWIGCLASS_STATIC int swig_magic_readonly(pTHX_ SV *sv, MAGIC *mg) {
+    MAGIC_PPERL
+    sv = sv; mg = mg;
+    croak("Value is read-only.");
+    return 0;
+}
+
+
+#ifdef PERL_OBJECT
+};
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+XS(_wrap_processIsCrashing) {
+    {
+        int arg1 ;
+        int result;
+        int argvi = 0;
+        dXSARGS;
+        
+        if ((items < 1) || (items > 1)) {
+            SWIG_croak("Usage: processIsCrashing(pid);");
+        }
+        arg1 = (int) SvIV(ST(0));
+        result = (int)processIsCrashing(arg1);
+        
+        ST(argvi) = sv_newmortal();
+        sv_setiv(ST(argvi++), (IV) result);
+        XSRETURN(argvi);
+        fail:
+        ;
+    }
+    croak(Nullch);
+}
+
+
+
+/* -------- TYPE CONVERSION AND EQUIVALENCE RULES (BEGIN) -------- */
+
+
+static swig_type_info *swig_types_initial[] = {
+0
+};
+
+
+/* -------- TYPE CONVERSION AND EQUIVALENCE RULES (END) -------- */
+
+static swig_constant_info swig_constants[] = {
+{0,0,0,0,0,0}
+};
+#ifdef __cplusplus
+}
+#endif
+static swig_variable_info swig_variables[] = {
+{0,0,0,0}
+};
+static swig_command_info swig_commands[] = {
+{"DumpRenderTreeSupportc::processIsCrashing", _wrap_processIsCrashing},
+{0,0}
+};
+
+
+static void SWIG_Perl_SetTypeListHandle(swig_type_info **handle) {
+    SV *pointer;
+    
+    /* create a new pointer */
+    pointer = get_sv("swig_runtime_data::type_pointer" SWIG_RUNTIME_VERSION SWIG_TYPE_TABLE_NAME, TRUE);
+    sv_setiv(pointer, PTR2IV(swig_type_list_handle));
+}
+
+static swig_type_info **
+SWIG_Perl_LookupTypePointer(swig_type_info **type_list_handle) {
+    swig_type_info **type_pointer;
+    
+    /* first check if module already created */
+    type_pointer = SWIG_Perl_GetTypeListHandle();
+    if (type_pointer) {
+        return type_pointer;
+    } else {
+        /* create a new module and variable */
+        SWIG_Perl_SetTypeListHandle(type_list_handle);
+        return type_list_handle;
+    }
+}
+
+
+#ifdef __cplusplus
+extern "C"
+#endif
+
+XS(SWIG_init) {
+    dXSARGS;
+    int i;
+    static int _init = 0;
+    if (!_init) {
+        swig_type_list_handle = SWIG_Perl_LookupTypePointer(swig_type_list_handle);
+        for (i = 0; swig_types_initial[i]; i++) {
+            swig_types[i] = SWIG_TypeRegister(swig_types_initial[i]);
+        }
+        _init = 1;
+    }
+    
+    /* Install commands */
+    for (i = 0; swig_commands[i].name; i++) {
+        newXS((char*) swig_commands[i].name,swig_commands[i].wrapper, (char*)__FILE__);
+    }
+    
+    /* Install variables */
+    for (i = 0; swig_variables[i].name; i++) {
+        SV *sv;
+        sv = perl_get_sv((char*) swig_variables[i].name, TRUE | 0x2);
+        if (swig_variables[i].type) {
+            SWIG_MakePtr(sv,(void *)1, *swig_variables[i].type,0);
+        } else {
+            sv_setiv(sv,(IV) 0);
+        }
+        swig_create_magic(sv, (char *) swig_variables[i].name, swig_variables[i].set, swig_variables[i].get); 
+    }
+    
+    /* Install constant */
+    for (i = 0; swig_constants[i].type; i++) {
+        SV *sv;
+        sv = perl_get_sv((char*)swig_constants[i].name, TRUE | 0x2);
+        switch(swig_constants[i].type) {
+            case SWIG_INT:
+            sv_setiv(sv, (IV) swig_constants[i].lvalue);
+            break;
+            case SWIG_FLOAT:
+            sv_setnv(sv, (double) swig_constants[i].dvalue);
+            break;
+            case SWIG_STRING:
+            sv_setpv(sv, (char *) swig_constants[i].pvalue);
+            break;
+            case SWIG_POINTER:
+            SWIG_MakePtr(sv, swig_constants[i].pvalue, *(swig_constants[i].ptype),0);
+            break;
+            case SWIG_BINARY:
+            SWIG_MakePackedObj(sv, swig_constants[i].pvalue, swig_constants[i].lvalue, *(swig_constants[i].ptype));
+            break;
+            default:
+            break;
+        }
+        SvREADONLY_on(sv);
+    }
+    
+    ST(0) = &PL_sv_yes;
+    XSRETURN(1);
+}
+
diff --git a/WebKitTools/DumpRenderTree/mac/PerlSupport/Makefile b/WebKitTools/DumpRenderTree/mac/PerlSupport/Makefile
index 6c97877..56b2ed2 100644
--- a/WebKitTools/DumpRenderTree/mac/PerlSupport/Makefile
+++ b/WebKitTools/DumpRenderTree/mac/PerlSupport/Makefile
@@ -24,39 +24,45 @@
 CONFIGURATION_BUILD_DIR ?= .
 OUTPUT_DIR=$(CONFIGURATION_BUILD_DIR)
 
-WRAPPER=$(OUTPUT_DIR)/DerivedSources/DumpRenderTree/DumpRenderTreeSupport_wrap.c
+WRAPPER_DIR=$(OUTPUT_DIR)/DerivedSources/DumpRenderTree
+WRAPPER=$(WRAPPER_DIR)/DumpRenderTreeSupport_wrap.c
 PERL_MODULE=$(OUTPUT_DIR)/DumpRenderTreeSupport.pm
 DYLIB=$(OUTPUT_DIR)/DumpRenderTreeSupport.dylib
 DUMPRENDERTREE=$(OUTPUT_DIR)/DumpRenderTree
+PERL=/usr/bin/perl
 
 OSX_VERSION=$(shell sw_vers -productVersion | cut -d. -f 2)
 
 ifneq "$(OSX_VERSION)" "4"
 
-PERL=/usr/bin/perl
+
 SWIG=/usr/bin/swig
 
 all: $(DYLIB) $(PERL_MODULE)
 
 $(WRAPPER) $(PERL_MODULE): DumpRenderTreeSupport.c $(DUMPRENDERTREE)
-	mkdir -p $$(dirname $(WRAPPER))
+	mkdir -p $(WRAPPER_DIR)
 	$(SWIG) -o $(WRAPPER) -outdir $(OUTPUT_DIR) -perl -module DumpRenderTreeSupport $<
 
-$(DYLIB): DumpRenderTreeSupport.c $(WRAPPER)
-	gcc -g -dynamiclib -o $(DYLIB) `$(PERL) -MExtUtils::Embed -eperl_inc` `$(PERL) -MExtUtils::Embed -eldopts` $^
-
 
 else
 
 
-all: $(PERL_MODULE)
+all: $(DYLIB) $(PERL_MODULE)
+
+$(WRAPPER): DumpRenderTreeSupport_wrapTiger.c $(DUMPRENDERTREE)
+	mkdir -p $(WRAPPER_DIR)
+	cp DumpRenderTreeSupport_wrapTiger.c $(WRAPPER)
 
-$(PERL_MODULE): DumpRenderTreeSupportTiger.pm
-	cp $^ $(PERL_MODULE)
+$(PERL_MODULE): DumpRenderTreeSupportTiger.pm $(DUMPRENDERTREE)
+	cp DumpRenderTreeSupportTiger.pm $(PERL_MODULE)
 
 
 endif
 
+$(DYLIB): DumpRenderTreeSupport.c $(WRAPPER)
+	gcc -g -dynamiclib -o $(DYLIB) `$(PERL) -MExtUtils::Embed -eperl_inc` `$(PERL) -MExtUtils::Embed -eldopts` $^
+
 clean:
 	rm -f $(WRAPPER) $(PERL_MODULE) $(DYLIB)
 
diff --git a/WebKitTools/DumpRenderTree/mac/ResourceLoadDelegate.mm b/WebKitTools/DumpRenderTree/mac/ResourceLoadDelegate.mm
index 0089f7f..3aaba59 100644
--- a/WebKitTools/DumpRenderTree/mac/ResourceLoadDelegate.mm
+++ b/WebKitTools/DumpRenderTree/mac/ResourceLoadDelegate.mm
@@ -153,6 +153,20 @@
 
 - (void)webView:(WebView *)wv resource:(id)identifier didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge fromDataSource:(WebDataSource *)dataSource
 {
+    if (!gLayoutTestController->handlesAuthenticationChallenges())
+        return;
+    
+    const char* user = gLayoutTestController->authenticationUsername().c_str();
+    NSString *nsUser = [NSString stringWithFormat:@"%s", user ? user : ""];
+
+    const char* password = gLayoutTestController->authenticationPassword().c_str();
+    NSString *nsPassword = [NSString stringWithFormat:@"%s", password ? password : ""];
+
+    NSString *string = [NSString stringWithFormat:@"%@ - didReceiveAuthenticationChallenge - Responding with %@:%@", identifier, nsUser, nsPassword];
+    printf("%s\n", [string UTF8String]);
+    
+    [[challenge sender] useCredential:[NSURLCredential credentialWithUser:nsUser password:nsPassword persistence:NSURLCredentialPersistenceForSession]
+                              forAuthenticationChallenge:challenge];
 }
 
 - (void)webView:(WebView *)wv resource:(id)identifier didCancelAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge fromDataSource:(WebDataSource *)dataSource
diff --git a/WebKitTools/DumpRenderTree/mac/UIDelegate.mm b/WebKitTools/DumpRenderTree/mac/UIDelegate.mm
index 807ea08..a52d5be 100644
--- a/WebKitTools/DumpRenderTree/mac/UIDelegate.mm
+++ b/WebKitTools/DumpRenderTree/mac/UIDelegate.mm
@@ -34,6 +34,7 @@
 #import "EventSendingController.h"
 #import "LayoutTestController.h"
 #import <WebKit/WebFramePrivate.h>
+#import <WebKit/WebGeolocationPrivate.h>
 #import <WebKit/WebHTMLViewPrivate.h>
 #import <WebKit/WebSecurityOriginPrivate.h>
 #import <WebKit/WebView.h>
@@ -150,6 +151,12 @@ DumpRenderTreeDraggingInfo *draggingInfo = nil;
         printf("UI DELEGATE STATUS CALLBACK: setStatusText:%s\n", [text UTF8String]);
 }
 
+- (void)webView:(WebView *)sender frame:(WebFrame *)frame requestGeolocationPermission:(WebGeolocation *)geolocation securityOrigin:(WebSecurityOrigin *)origin
+{
+    if (gLayoutTestController->isGeolocationPermissionSet())
+        [geolocation setIsAllowed:gLayoutTestController->geolocationPermission()];
+}
+
 - (void)dealloc
 {
     [draggingInfo release];
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp
index 1afb761..83626ac 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp
@@ -45,6 +45,7 @@
 #include <QUrl>
 #include <QFocusEvent>
 #include <QFontDatabase>
+#include <QNetworkRequest>
 
 #include <qwebpage.h>
 #include <qwebframe.h>
@@ -83,9 +84,14 @@ public:
     bool javaScriptConfirm(QWebFrame *frame, const QString& msg);
     bool javaScriptPrompt(QWebFrame *frame, const QString& msg, const QString& defaultValue, QString* result);
 
+    void resetSettings();
+
 public slots:
     bool shouldInterruptJavaScript() { return false; }
 
+protected:
+    bool acceptNavigationRequest(QWebFrame* frame, const QNetworkRequest& request, NavigationType type);
+
 private slots:
     void setViewGeometry(const QRect &r)
     {
@@ -100,21 +106,42 @@ private:
 WebPage::WebPage(QWidget *parent, DumpRenderTree *drt)
     : QWebPage(parent), m_drt(drt)
 {
-    settings()->setFontSize(QWebSettings::MinimumFontSize, 5);
-    settings()->setFontSize(QWebSettings::MinimumLogicalFontSize, 5);
-    // To get DRT compliant to some layout tests lets set the default fontsize to 13.
-    settings()->setFontSize(QWebSettings::DefaultFontSize, 13);
-    settings()->setFontSize(QWebSettings::DefaultFixedFontSize, 13);
-    settings()->setAttribute(QWebSettings::JavascriptCanOpenWindows, true);
-    settings()->setAttribute(QWebSettings::JavascriptCanAccessClipboard, true);
-    settings()->setAttribute(QWebSettings::LinksIncludedInFocusChain, false);
-    settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    QWebSettings* globalSettings = QWebSettings::globalSettings();
+
+    globalSettings->setFontSize(QWebSettings::MinimumFontSize, 5);
+    globalSettings->setFontSize(QWebSettings::MinimumLogicalFontSize, 5);
+    globalSettings->setFontSize(QWebSettings::DefaultFontSize, 16);
+    globalSettings->setFontSize(QWebSettings::DefaultFixedFontSize, 13);
+
+    globalSettings->setAttribute(QWebSettings::JavascriptCanOpenWindows, true);
+    globalSettings->setAttribute(QWebSettings::JavascriptCanAccessClipboard, true);
+    globalSettings->setAttribute(QWebSettings::LinksIncludedInFocusChain, false);
+    globalSettings->setAttribute(QWebSettings::PluginsEnabled, true);
+    globalSettings->setAttribute(QWebSettings::LocalContentCanAccessRemoteUrls, true);
+    globalSettings->setAttribute(QWebSettings::JavascriptEnabled, true);
+    globalSettings->setAttribute(QWebSettings::PrivateBrowsingEnabled, false);
+    globalSettings->setAttribute(QWebSettings::OfflineWebApplicationCacheEnabled, false);
+
     connect(this, SIGNAL(geometryChangeRequested(const QRect &)),
             this, SLOT(setViewGeometry(const QRect & )));
 
     setPluginFactory(new TestPlugin(this));
 }
 
+void WebPage::resetSettings()
+{
+    // After each layout test, reset the settings that may have been changed by
+    // layoutTestController.overridePreference() or similar.
+
+    settings()->resetFontSize(QWebSettings::DefaultFontSize);
+
+    settings()->resetAttribute(QWebSettings::JavascriptCanOpenWindows);
+    settings()->resetAttribute(QWebSettings::JavascriptEnabled);
+    settings()->resetAttribute(QWebSettings::PrivateBrowsingEnabled);
+    settings()->resetAttribute(QWebSettings::LinksIncludedInFocusChain);
+    settings()->resetAttribute(QWebSettings::OfflineWebApplicationCacheEnabled);
+}
+
 QWebPage *WebPage::createWindow(QWebPage::WebWindowType)
 {
     return m_drt->createWindow();
@@ -143,12 +170,49 @@ bool WebPage::javaScriptPrompt(QWebFrame*, const QString& msg, const QString& de
     return true;
 }
 
+bool WebPage::acceptNavigationRequest(QWebFrame* frame, const QNetworkRequest& request, NavigationType type)
+{
+    if (m_drt->layoutTestController()->waitForPolicy()) {
+        QString url = QString::fromUtf8(request.url().toEncoded());
+        QString typeDescription;
+
+        switch (type) {
+        case NavigationTypeLinkClicked:
+            typeDescription = "link clicked";
+            break;
+        case NavigationTypeFormSubmitted:
+            typeDescription = "form submitted";
+            break;
+        case NavigationTypeBackOrForward:
+            typeDescription = "back/forward";
+            break;
+        case NavigationTypeReload:
+            typeDescription = "reload";
+            break;
+        case NavigationTypeFormResubmitted:
+            typeDescription = "form resubmitted";
+            break;
+        case NavigationTypeOther:
+            typeDescription = "other";
+            break;
+        default:
+            typeDescription = "illegal value";
+        }
+
+        fprintf(stdout, "Policy delegate: attempt to load %s with navigation type '%s'\n",
+                url.toUtf8().constData(), typeDescription.toUtf8().constData());
+        m_drt->layoutTestController()->notifyDone();
+    }
+    return QWebPage::acceptNavigationRequest(frame, request, type);
+}
+
 DumpRenderTree::DumpRenderTree()
     : m_dumpPixels(false)
     , m_stdin(0)
     , m_notifier(0)
 {
     qt_drt_overwritePluginDirectories();
+    QWebSettings::enablePersistentStorage();
 
     m_controller = new LayoutTestController(this);
     connect(m_controller, SIGNAL(done()), this, SLOT(dump()));
@@ -168,6 +232,8 @@ DumpRenderTree::DumpRenderTree()
             SLOT(titleChanged(const QString&)));
     connect(m_page, SIGNAL(databaseQuotaExceeded(QWebFrame*,QString)),
             this, SLOT(dumpDatabaseQuota(QWebFrame*,QString)));
+    connect(m_page, SIGNAL(statusBarMessage(const QString&)),
+            this, SLOT(statusBarMessage(const QString&)));
 
     m_eventSender = new EventSender(m_page);
     m_textInputController = new TextInputController(m_page);
@@ -210,6 +276,8 @@ void DumpRenderTree::resetToConsistentStateBeforeTesting()
     m_page->blockSignals(false);
 
     m_page->mainFrame()->setZoomFactor(1.0);
+
+    static_cast<WebPage*>(m_page)->resetSettings();
     qt_drt_clearFrameName(m_page->mainFrame());
 
     WorkQueue::shared()->clear();
@@ -217,6 +285,9 @@ void DumpRenderTree::resetToConsistentStateBeforeTesting()
     //WorkQueue::shared()->setFrozen(false);
 
     m_controller->reset();
+    QWebSecurityOrigin::resetOriginAccessWhiteLists();
+
+    setlocale(LC_ALL, "");
 }
 
 void DumpRenderTree::open(const QUrl& aurl)
@@ -463,6 +534,14 @@ void DumpRenderTree::dumpDatabaseQuota(QWebFrame* frame, const QString& dbName)
     origin.setDatabaseQuota(5 * 1024 * 1024);
 }
 
+void DumpRenderTree::statusBarMessage(const QString& message)
+{
+    if (!m_controller->shouldDumpStatusCallbacks())
+        return;
+
+    printf("UI DELEGATE STATUS CALLBACK: setStatusText:%s\n", message.toUtf8().constData());
+}
+
 QWebPage *DumpRenderTree::createWindow()
 {
     if (!m_controller->canOpenWindows())
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.h b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.h
index 28ae1b6..c5b4801 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.h
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.h
@@ -88,6 +88,7 @@ public Q_SLOTS:
     void titleChanged(const QString &s);
     void connectFrame(QWebFrame *frame);
     void dumpDatabaseQuota(QWebFrame* frame, const QString& dbName);
+    void statusBarMessage(const QString& message);
 
 Q_SIGNALS:
     void quit();
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
index ca97ed5..0daf8bd 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
@@ -9,8 +9,8 @@ DESTDIR = ../../../bin
 CONFIG += link_pkgconfig
 PKGCONFIG += fontconfig
 
-QT = core gui
-macx: QT += xml network
+QT = core gui network
+macx: QT += xml
 
 HEADERS = WorkQueue.h WorkQueueItem.h DumpRenderTree.h jsobjects.h testplugin.h
 SOURCES = WorkQueue.cpp DumpRenderTree.cpp main.cpp jsobjects.cpp testplugin.cpp
@@ -22,3 +22,5 @@ unix:!mac {
 lessThan(QT_MINOR_VERSION, 4) {
     DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
 }
+
+DEFINES+=USE_SYSTEM_MALLOC
diff --git a/WebKitTools/DumpRenderTree/qt/ImageDiff.cpp b/WebKitTools/DumpRenderTree/qt/ImageDiff.cpp
index 6aebced..704ca13 100644
--- a/WebKitTools/DumpRenderTree/qt/ImageDiff.cpp
+++ b/WebKitTools/DumpRenderTree/qt/ImageDiff.cpp
@@ -119,7 +119,7 @@ int main(int argc, char* argv[])
                     difference = 0;
                 } else {
                     difference = round(difference * 100) / 100;
-                    difference = qMax(difference, 0.01);
+                    difference = qMax(difference, qreal(0.01));
                 }
 
                 if (!count) {
diff --git a/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro b/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
index 686fbc1..7f502f8 100644
--- a/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
+++ b/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
@@ -1,14 +1,35 @@
 TEMPLATE = lib
-TARGET = TestNetscapePlugin
+TARGET = TestNetscapePlugIn
+
 VPATH = ../../gtk/TestNetscapePlugin ../../TestNetscapePlugIn.subproj
 include(../../../../WebKit.pri)
+
 DESTDIR = $$OUTPUT_DIR/lib/plugins
+
+mac {
+    CONFIG += plugin
+    CONFIG += plugin_bundle
+    QMAKE_INFO_PLIST = ../../TestNetscapePlugIn.subproj/Info.plist
+    QMAKE_PLUGIN_BUNDLE_NAME = $$TARGET
+    QMAKE_BUNDLE_LOCATION += "Contents/MacOS"
+
+    !build_pass:CONFIG += build_all
+    debug_and_release:TARGET = $$qtLibraryTarget($$TARGET)
+}
+
 INCLUDEPATH += ../../../../JavaScriptCore \
                ../../gtk/TestNetscapePlugin/ForwardingHeaders \
                ../../gtk/TestNetscapePlugin/ForwardingHeaders/WebKit \
                ../../../../WebCore \
                ../../../../WebCore/bridge \
                ../../TestNetscapePlugIn.subproj
-SOURCES = TestNetscapePlugin.cpp \
-          PluginObject.cpp \
-          TestObject.cpp \
+
+SOURCES = PluginObject.cpp \
+          TestObject.cpp
+
+mac {
+    SOURCES += ../../TestNetscapePlugIn.subproj/main.cpp
+    LIBS += -framework Carbon
+} else {
+    SOURCES += ../../gtk/TestNetscapePlugin/TestNetscapePlugin.cpp
+}
diff --git a/WebKitTools/DumpRenderTree/qt/jsobjects.cpp b/WebKitTools/DumpRenderTree/qt/jsobjects.cpp
index 7e5e168..b2d8528 100644
--- a/WebKitTools/DumpRenderTree/qt/jsobjects.cpp
+++ b/WebKitTools/DumpRenderTree/qt/jsobjects.cpp
@@ -27,19 +27,20 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <jsobjects.h>
-#include <qwebpage.h>
-#include <qwebhistory.h>
-#include <qwebframe.h>
-#include <qwebsecurityorigin.h>
-#include <qwebdatabase.h>
-#include <qevent.h>
+
+#include "DumpRenderTree.h"
+#include "WorkQueue.h"
+#include "WorkQueueItem.h"
+
 #include <qapplication.h>
 #include <qevent.h>
 #include <qtimer.h>
+#include <qwebdatabase.h>
+#include <qwebframe.h>
+#include <qwebhistory.h>
+#include <qwebpage.h>
+#include <qwebsecurityorigin.h>
 
-#include "DumpRenderTree.h"
-#include "WorkQueueItem.h"
-#include "WorkQueue.h"
 extern void qt_dump_editing_callbacks(bool b);
 extern void qt_dump_resource_load_callbacks(bool b);
 extern void qt_drt_setJavaScriptProfilingEnabled(QWebFrame*, bool enabled);
@@ -47,7 +48,7 @@ extern bool qt_drt_pauseAnimation(QWebFrame*, const QString &name, double time,
 extern bool qt_drt_pauseTransitionOfProperty(QWebFrame*, const QString &name, double time, const QString &elementId);
 extern int qt_drt_numberOfActiveAnimations(QWebFrame*);
 
-QWebFrame *findFrameNamed(const QString &frameName, QWebFrame *frame)
+QWebFrame* findFrameNamed(const QString &frameName, QWebFrame* frame)
 {
     if (frame->frameName() == frameName)
         return frame;
@@ -64,7 +65,7 @@ bool LoadItem::invoke() const
     //qDebug() << ">>>LoadItem::invoke";
     Q_ASSERT(m_webPage);
 
-    QWebFrame *frame = 0;
+    QWebFrame* frame = 0;
     const QString t = target();
     if (t.isEmpty())
         frame = m_webPage->mainFrame();
@@ -128,11 +129,12 @@ void LayoutTestController::reset()
     m_waitForDone = false;
     m_dumpTitleChanges = false;
     m_dumpDatabaseCallbacks = false;
+    m_dumpStatusCallbacks = false;
     m_timeoutTimer.stop();
     m_topLoadingFrame = 0;
+    m_waitForPolicy = false;
     qt_dump_editing_callbacks(false);
     qt_dump_resource_load_callbacks(false);
-    QWebSettings::globalSettings()->setAttribute(QWebSettings::PrivateBrowsingEnabled, false);
 }
 
 void LayoutTestController::processWork()
@@ -151,6 +153,12 @@ void LayoutTestController::maybeDump(bool success)
 {
     Q_ASSERT(sender() == m_topLoadingFrame);
 
+    // as the function is called on loadFinished, the test might
+    // already have dumped and thus no longer be active, thus
+    // bail out here.
+    if (!m_isLoading)
+        return;
+
     m_topLoadingFrame = 0;
     WorkQueue::shared()->setFrozen(true); // first complete load freezes the queue for the rest of this test
 
@@ -180,6 +188,8 @@ void LayoutTestController::notifyDone()
     m_timeoutTimer.stop();
     emit done();
     m_isLoading = false;
+    m_waitForDone = false;
+    m_waitForPolicy = false;
 }
 
 int LayoutTestController::windowCount()
@@ -237,7 +247,7 @@ void LayoutTestController::queueScript(const QString &url)
 
 void LayoutTestController::provisionalLoad()
 {
-    QWebFrame *frame = qobject_cast<QWebFrame*>(sender());
+    QWebFrame* frame = qobject_cast<QWebFrame*>(sender());
     if (!m_topLoadingFrame && m_isLoading)
         m_topLoadingFrame = frame;
 }
@@ -247,9 +257,8 @@ void LayoutTestController::timerEvent(QTimerEvent *ev)
     if (ev->timerId() == m_timeoutTimer.timerId()) {
         qDebug() << ">>>>>>>>>>>>> timeout";
         notifyDone();
-    } else {
+    } else
         QObject::timerEvent(ev);
-    }
 }
 
 QString LayoutTestController::encodeHostName(const QString &host)
@@ -279,14 +288,19 @@ void LayoutTestController::setFixedContentsSize(int width, int height)
 
 void LayoutTestController::setPrivateBrowsingEnabled(bool enable)
 {
-    QWebSettings::globalSettings()->setAttribute(QWebSettings::PrivateBrowsingEnabled, enable);
+    m_drt->webPage()->settings()->setAttribute(QWebSettings::PrivateBrowsingEnabled, enable);
+}
+
+void LayoutTestController::setPopupBlockingEnabled(bool enable)
+{
+    m_drt->webPage()->settings()->setAttribute(QWebSettings::JavascriptCanOpenWindows, !enable);
 }
 
 bool LayoutTestController::pauseAnimationAtTimeOnElementWithId(const QString &animationName,
                                                                double time,
                                                                const QString &elementId)
 {
-    QWebFrame *frame = m_drt->webPage()->mainFrame();
+    QWebFrame* frame = m_drt->webPage()->mainFrame();
     Q_ASSERT(frame);
     return qt_drt_pauseAnimation(frame, animationName, time, elementId);
 }
@@ -295,14 +309,14 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(const QString &p
                                                                 double time,
                                                                 const QString &elementId)
 {
-    QWebFrame *frame = m_drt->webPage()->mainFrame();
+    QWebFrame* frame = m_drt->webPage()->mainFrame();
     Q_ASSERT(frame);
     return qt_drt_pauseTransitionOfProperty(frame, propertyName, time, elementId);
 }
 
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
-    QWebFrame *frame = m_drt->webPage()->mainFrame();
+    QWebFrame* frame = m_drt->webPage()->mainFrame();
     Q_ASSERT(frame);
     return qt_drt_numberOfActiveAnimations(frame);
 }
@@ -330,23 +344,88 @@ void LayoutTestController::clearAllDatabases()
     QWebDatabase::removeAllDatabases();
 }
 
+void LayoutTestController::whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains)
+{
+    QWebSecurityOrigin::whiteListAccessFromOrigin(sourceOrigin, destinationProtocol, destinationHost, allowDestinationSubdomains);
+}
+
+void LayoutTestController::waitForPolicyDelegate()
+{
+    m_waitForPolicy = true;
+    waitUntilDone();
+}
+
+void LayoutTestController::overridePreference(const QString& name, const QVariant& value)
+{
+    QWebSettings* settings = m_topLoadingFrame->page()->settings();
+
+    if (name == "WebKitJavaScriptEnabled")
+        settings->setAttribute(QWebSettings::JavascriptEnabled, value.toBool());
+    else if (name == "WebKitTabToLinksPreferenceKey")
+        settings->setAttribute(QWebSettings::LinksIncludedInFocusChain, value.toBool());
+    else if (name == "WebKitOfflineWebApplicationCacheEnabled")
+        settings->setAttribute(QWebSettings::OfflineWebApplicationCacheEnabled, value.toBool());
+    else if (name == "WebKitDefaultFontSize")
+        settings->setFontSize(QWebSettings::DefaultFontSize, value.toInt());
+}
+
 EventSender::EventSender(QWebPage *parent)
     : QObject(parent)
 {
     m_page = parent;
 }
 
-void EventSender::mouseDown()
-{
+void EventSender::mouseDown(int button)
+{
+    Qt::MouseButton mouseButton;
+    switch (button) {
+    case 0:
+        mouseButton = Qt::LeftButton;
+        break;
+    case 1:
+        mouseButton = Qt::MidButton;
+        break;
+    case 2:
+        mouseButton = Qt::RightButton;
+        break;
+    case 3:
+        // fast/events/mouse-click-events expects the 4th button to be treated as the middle button
+        mouseButton = Qt::MidButton;
+        break;
+    default:
+        mouseButton = Qt::LeftButton;
+        break;
+    }
+
 //     qDebug() << "EventSender::mouseDown" << frame;
-    QMouseEvent event(QEvent::MouseButtonPress, m_mousePos, Qt::LeftButton, Qt::LeftButton, Qt::NoModifier);
+    QMouseEvent event(QEvent::MouseButtonPress, m_mousePos, mouseButton, mouseButton, Qt::NoModifier);
     QApplication::sendEvent(m_page, &event);
 }
 
-void EventSender::mouseUp()
-{
+void EventSender::mouseUp(int button)
+{
+    Qt::MouseButton mouseButton;
+    switch (button) {
+    case 0:
+        mouseButton = Qt::LeftButton;
+        break;
+    case 1:
+        mouseButton = Qt::MidButton;
+        break;
+    case 2:
+        mouseButton = Qt::RightButton;
+        break;
+    case 3:
+        // fast/events/mouse-click-events expects the 4th button to be treated as the middle button
+        mouseButton = Qt::MidButton;
+        break;
+    default:
+        mouseButton = Qt::LeftButton;
+        break;
+    }
+
 //     qDebug() << "EventSender::mouseUp" << frame;
-    QMouseEvent event(QEvent::MouseButtonRelease, m_mousePos, Qt::LeftButton, Qt::LeftButton, Qt::NoModifier);
+    QMouseEvent event(QEvent::MouseButtonRelease, m_mousePos, mouseButton, mouseButton, Qt::NoModifier);
     QApplication::sendEvent(m_page, &event);
 }
 
@@ -440,17 +519,71 @@ void EventSender::keyDown(const QString &string, const QStringList &modifiers)
             s = QString();
             code = Qt::Key_Home;
             modifs = 0;
-        } else {
+        } else
             code = string.unicode()->toUpper().unicode();
+    } else {
+        qDebug() << ">>>>>>>>> keyDown" << string;
+
+        if (string.startsWith(QLatin1Char('F')) && string.count() <= 3) {
+            s = s.mid(1);
+            int functionKey = s.toInt();
+            Q_ASSERT(functionKey >= 1 && functionKey <= 35);
+            code = Qt::Key_F1 + (functionKey - 1);
+        // map special keycode strings used by the tests to something that works for Qt/X11
+        } else if (string == QLatin1String("leftArrow")) {
+            s = QString();
+            code = Qt::Key_Left;
+        } else if (string == QLatin1String("rightArrow")) {
+            s = QString();
+            code = Qt::Key_Right;
+        } else if (string == QLatin1String("upArrow")) {
+            s = QString();
+            code = Qt::Key_Up;
+        } else if (string == QLatin1String("downArrow")) {
+            s = QString();
+            code = Qt::Key_Down;
+        } else if (string == QLatin1String("pageUp")) {
+            s = QString();
+            code = Qt::Key_PageUp;
+        } else if (string == QLatin1String("pageDown")) {
+            s = QString();
+            code = Qt::Key_PageDown;
+        } else if (string == QLatin1String("home")) {
+            s = QString();
+            code = Qt::Key_Home;
+        } else if (string == QLatin1String("end")) {
+            s = QString();
+            code = Qt::Key_End;
+        } else if (string == QLatin1String("delete")) {
+            s = QString();
+            code = Qt::Key_Delete;
         }
     }
     QKeyEvent event(QEvent::KeyPress, code, modifs, s);
     QApplication::sendEvent(m_page, &event);
+    QKeyEvent event2(QEvent::KeyRelease, code, modifs, s);
+    QApplication::sendEvent(m_page, &event2);
+}
+
+void EventSender::contextClick()
+{
+    QMouseEvent event(QEvent::MouseButtonPress, m_mousePos, Qt::RightButton, Qt::RightButton, Qt::NoModifier);
+    QApplication::sendEvent(m_page, &event);
+    QMouseEvent event2(QEvent::MouseButtonRelease, m_mousePos, Qt::RightButton, Qt::RightButton, Qt::NoModifier);
+    QApplication::sendEvent(m_page, &event2);
+}
+
+void EventSender::scheduleAsynchronousClick()
+{
+    QMouseEvent* event = new QMouseEvent(QEvent::MouseButtonPress, m_mousePos, Qt::LeftButton, Qt::RightButton, Qt::NoModifier);
+    QApplication::postEvent(m_page, event);
+    QMouseEvent* event2 = new QMouseEvent(QEvent::MouseButtonRelease, m_mousePos, Qt::LeftButton, Qt::RightButton, Qt::NoModifier);
+    QApplication::postEvent(m_page, event2);
 }
 
-QWebFrame *EventSender::frameUnderMouse() const
+QWebFrame* EventSender::frameUnderMouse() const
 {
-    QWebFrame *frame = m_page->mainFrame();
+    QWebFrame* frame = m_page->mainFrame();
 
 redo:
     QList<QWebFrame*> children = frame->childFrames();
@@ -478,81 +611,81 @@ void TextInputController::doCommand(const QString &command)
     if (command == "moveBackwardAndModifySelection:") {
         modifiers |= Qt::ShiftModifier;
         keycode = Qt::Key_Left;
-    } else if(command =="moveDown:") {
+    } else if (command =="moveDown:") {
         keycode = Qt::Key_Down;
-    } else if(command =="moveDownAndModifySelection:") {
+    } else if (command =="moveDownAndModifySelection:") {
         modifiers |= Qt::ShiftModifier;
         keycode = Qt::Key_Down;
-    } else if(command =="moveForward:") {
+    } else if (command =="moveForward:") {
         keycode = Qt::Key_Right;
-    } else if(command =="moveForwardAndModifySelection:") {
+    } else if (command =="moveForwardAndModifySelection:") {
         modifiers |= Qt::ShiftModifier;
         keycode = Qt::Key_Right;
-    } else if(command =="moveLeft:") {
+    } else if (command =="moveLeft:") {
         keycode = Qt::Key_Left;
-    } else if(command =="moveLeftAndModifySelection:") {
+    } else if (command =="moveLeftAndModifySelection:") {
         modifiers |= Qt::ShiftModifier;
         keycode = Qt::Key_Left;
-    } else if(command =="moveRight:") {
+    } else if (command =="moveRight:") {
         keycode = Qt::Key_Right;
-    } else if(command =="moveRightAndModifySelection:") {
+    } else if (command =="moveRightAndModifySelection:") {
         modifiers |= Qt::ShiftModifier;
         keycode = Qt::Key_Right;
-    } else if(command =="moveToBeginningOfDocument:") {
+    } else if (command =="moveToBeginningOfDocument:") {
         modifiers |= Qt::ControlModifier;
         keycode = Qt::Key_Home;
-    } else if(command =="moveToBeginningOfLine:") {
+    } else if (command =="moveToBeginningOfLine:") {
         keycode = Qt::Key_Home;
-//     } else if(command =="moveToBeginningOfParagraph:") {
-    } else if(command =="moveToEndOfDocument:") {
+//     } else if (command =="moveToBeginningOfParagraph:") {
+    } else if (command =="moveToEndOfDocument:") {
         modifiers |= Qt::ControlModifier;
         keycode = Qt::Key_End;
-    } else if(command =="moveToEndOfLine:") {
+    } else if (command =="moveToEndOfLine:") {
         keycode = Qt::Key_End;
-//     } else if(command =="moveToEndOfParagraph:") {
-    } else if(command =="moveUp:") {
+//     } else if (command =="moveToEndOfParagraph:") {
+    } else if (command =="moveUp:") {
         keycode = Qt::Key_Up;
-    } else if(command =="moveUpAndModifySelection:") {
+    } else if (command =="moveUpAndModifySelection:") {
         modifiers |= Qt::ShiftModifier;
         keycode = Qt::Key_Up;
-    } else if(command =="moveWordBackward:") {
+    } else if (command =="moveWordBackward:") {
         modifiers |= Qt::ControlModifier;
         keycode = Qt::Key_Up;
-    } else if(command =="moveWordBackwardAndModifySelection:") {
+    } else if (command =="moveWordBackwardAndModifySelection:") {
         modifiers |= Qt::ShiftModifier;
         modifiers |= Qt::ControlModifier;
         keycode = Qt::Key_Left;
-    } else if(command =="moveWordForward:") {
+    } else if (command =="moveWordForward:") {
         modifiers |= Qt::ControlModifier;
         keycode = Qt::Key_Right;
-    } else if(command =="moveWordForwardAndModifySelection:") {
+    } else if (command =="moveWordForwardAndModifySelection:") {
         modifiers |= Qt::ControlModifier;
         modifiers |= Qt::ShiftModifier;
         keycode = Qt::Key_Right;
-    } else if(command =="moveWordLeft:") {
+    } else if (command =="moveWordLeft:") {
         modifiers |= Qt::ControlModifier;
         keycode = Qt::Key_Left;
-    } else if(command =="moveWordRight:") {
+    } else if (command =="moveWordRight:") {
         modifiers |= Qt::ControlModifier;
         keycode = Qt::Key_Left;
-    } else if(command =="moveWordRightAndModifySelection:") {
+    } else if (command =="moveWordRightAndModifySelection:") {
         modifiers |= Qt::ShiftModifier;
         modifiers |= Qt::ControlModifier;
         keycode = Qt::Key_Right;
-    } else if(command =="moveWordLeftAndModifySelection:") {
+    } else if (command =="moveWordLeftAndModifySelection:") {
         modifiers |= Qt::ShiftModifier;
         modifiers |= Qt::ControlModifier;
         keycode = Qt::Key_Left;
-    } else if(command =="pageDown:") {
-        keycode = Qt::Key_PageDown;        
-    } else if(command =="pageUp:") {
-        keycode = Qt::Key_PageUp;        
-    } else if(command == "deleteWordBackward:") {
+    } else if (command =="pageDown:") {
+        keycode = Qt::Key_PageDown;
+    } else if (command =="pageUp:") {
+        keycode = Qt::Key_PageUp;
+    } else if (command == "deleteWordBackward:") {
         modifiers |= Qt::ControlModifier;
         keycode = Qt::Key_Backspace;
-    } else if(command == "deleteBackward:") {
+    } else if (command == "deleteBackward:") {
         keycode = Qt::Key_Backspace;
-    } else if(command == "deleteForward:") {
+    } else if (command == "deleteForward:") {
         keycode = Qt::Key_Delete;
     }
     QKeyEvent event(QEvent::KeyPress, keycode, modifiers);
diff --git a/WebKitTools/DumpRenderTree/qt/jsobjects.h b/WebKitTools/DumpRenderTree/qt/jsobjects.h
index 8e6dd20..c076bb9 100644
--- a/WebKitTools/DumpRenderTree/qt/jsobjects.h
+++ b/WebKitTools/DumpRenderTree/qt/jsobjects.h
@@ -53,9 +53,11 @@ public:
     bool shouldDumpBackForwardList() const { return m_dumpBackForwardList; }
     bool shouldDumpChildrenAsText() const { return m_dumpChildrenAsText; }
     bool shouldDumpDatabaseCallbacks() const { return m_dumpDatabaseCallbacks; }
+    bool shouldDumpStatusCallbacks() const { return m_dumpStatusCallbacks; }
     bool shouldWaitUntilDone() const { return m_waitForDone; }
     bool canOpenWindows() const { return m_canOpenWindows; }
     bool shouldDumpTitleChanges() const { return m_dumpTitleChanges; }
+    bool waitForPolicy() const { return m_waitForPolicy; }
 
     void reset();
 
@@ -70,6 +72,7 @@ public slots:
     void dumpAsText() { m_textDump = true; }
     void dumpChildFramesAsText() { m_dumpChildrenAsText = true; }
     void dumpDatabaseCallbacks() { m_dumpDatabaseCallbacks = true; }
+    void dumpStatusCallbacks() { m_dumpStatusCallbacks = true; }
     void setCanOpenWindows() { m_canOpenWindows = true; }
     void waitUntilDone();
     void notifyDone();
@@ -93,16 +96,23 @@ public slots:
     void setJavaScriptProfilingEnabled(bool enable);
     void setFixedContentsSize(int width, int height);
     void setPrivateBrowsingEnabled(bool enable);
+    void setPopupBlockingEnabled(bool enable);
 
     bool pauseAnimationAtTimeOnElementWithId(const QString &animationName, double time, const QString &elementId);
     bool pauseTransitionAtTimeOnElementWithId(const QString &propertyName, double time, const QString &elementId);
     unsigned numberOfActiveAnimations() const;
+
+    void whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains);
+
     void dispatchPendingLoadRequests();
     void disableImageLoading();
 
     void setDatabaseQuota(int size);
     void clearAllDatabases();
 
+    void waitForPolicyDelegate();
+    void overridePreference(const QString& name, const QVariant& value);
+
 private slots:
     void processWork();
 
@@ -115,6 +125,9 @@ private:
     bool m_waitForDone;
     bool m_dumpTitleChanges;
     bool m_dumpDatabaseCallbacks;
+    bool m_dumpStatusCallbacks;
+    bool m_waitForPolicy;
+
     QBasicTimer m_timeoutTimer;
     QWebFrame *m_topLoadingFrame;
     WebCore::DumpRenderTree *m_drt;
@@ -130,12 +143,14 @@ public:
     EventSender(QWebPage *parent);
 
 public slots:
-    void mouseDown();
-    void mouseUp();
+    void mouseDown(int button = 0);
+    void mouseUp(int button = 0);
     void mouseMoveTo(int x, int y);
     void leapForward(int ms);
     void keyDown(const QString &string, const QStringList &modifiers=QStringList());
     void clearKillRing() {}
+    void contextClick();
+    void scheduleAsynchronousClick();
 
 private:
     QPoint m_mousePos;
diff --git a/WebKitTools/DumpRenderTree/win/AccessibilityControllerWin.cpp b/WebKitTools/DumpRenderTree/win/AccessibilityControllerWin.cpp
index b6e45f2..ac64efb 100644
--- a/WebKitTools/DumpRenderTree/win/AccessibilityControllerWin.cpp
+++ b/WebKitTools/DumpRenderTree/win/AccessibilityControllerWin.cpp
@@ -32,13 +32,19 @@
 #include <WebCore/COMPtr.h>
 #include <WebKit/WebKit.h>
 #include <oleacc.h>
+#include <string>
+
+using namespace std;
 
 AccessibilityController::AccessibilityController()
+    : m_focusEventHook(0)
+    , m_scrollingStartEventHook(0)
 {
 }
 
 AccessibilityController::~AccessibilityController()
 {
+    setLogFocusEvents(false);
 }
 
 AccessibilityUIElement AccessibilityController::focusedElement()
@@ -82,3 +88,76 @@ AccessibilityUIElement AccessibilityController::rootElement()
 
     return rootAccessible;
 }
+
+static void CALLBACK logEventProc(HWINEVENTHOOK hWinEventHook, DWORD event, HWND hwnd, LONG idObject, LONG idChild, DWORD, DWORD)
+{
+    // Get the accessible object for this event.
+    COMPtr<IAccessible> parentObject;
+
+    VARIANT vChild;
+    VariantInit(&vChild);
+
+    HRESULT hr = AccessibleObjectFromEvent(hwnd, idObject, idChild, &parentObject, &vChild);
+    ASSERT(SUCCEEDED(hr));
+
+    // Get the name of the focused element, and log it to stdout.
+    BSTR nameBSTR;
+    hr = parentObject->get_accName(vChild, &nameBSTR);
+    ASSERT(SUCCEEDED(hr));
+    wstring name(nameBSTR, ::SysStringLen(nameBSTR));
+    SysFreeString(nameBSTR);
+
+    switch (event) {
+        case EVENT_OBJECT_FOCUS:
+            printf("Received focus event for object '%S'.\n", name.c_str());
+            break;
+
+        case EVENT_SYSTEM_SCROLLINGSTART:
+            printf("Received scrolling start event for object '%S'.\n", name.c_str());
+            break;
+
+        default:
+            printf("Received unknown event for object '%S'.\n", name.c_str());
+            break;
+    }
+}
+
+void AccessibilityController::setLogFocusEvents(bool logFocusEvents)
+{
+    if (!!m_focusEventHook == logFocusEvents)
+        return;
+
+    if (!logFocusEvents) {
+        UnhookWinEvent(m_focusEventHook);
+        m_focusEventHook = 0;
+        return;
+    }
+
+    // Ensure that accessibility is initialized for the WebView by querying for
+    // the root accessible object.
+    rootElement();
+
+    m_focusEventHook = SetWinEventHook(EVENT_OBJECT_FOCUS, EVENT_OBJECT_FOCUS, GetModuleHandle(0), logEventProc, GetCurrentProcessId(), 0, WINEVENT_INCONTEXT);
+
+    ASSERT(m_focusEventHook);
+}
+
+void AccessibilityController::setLogScrollingStartEvents(bool logScrollingStartEvents)
+{
+    if (!!m_scrollingStartEventHook == logScrollingStartEvents)
+        return;
+
+    if (!logScrollingStartEvents) {
+        UnhookWinEvent(m_scrollingStartEventHook);
+        m_scrollingStartEventHook = 0;
+        return;
+    }
+
+    // Ensure that accessibility is initialized for the WebView by querying for
+    // the root accessible object.
+    rootElement();
+
+    m_scrollingStartEventHook = SetWinEventHook(EVENT_SYSTEM_SCROLLINGSTART, EVENT_SYSTEM_SCROLLINGSTART, GetModuleHandle(0), logEventProc, GetCurrentProcessId(), 0, WINEVENT_INCONTEXT);
+
+    ASSERT(m_scrollingStartEventHook);
+}
diff --git a/WebKitTools/DumpRenderTree/win/AccessibilityUIElementWin.cpp b/WebKitTools/DumpRenderTree/win/AccessibilityUIElementWin.cpp
index cfcfc54..de3d9ff 100644
--- a/WebKitTools/DumpRenderTree/win/AccessibilityUIElementWin.cpp
+++ b/WebKitTools/DumpRenderTree/win/AccessibilityUIElementWin.cpp
@@ -157,6 +157,11 @@ JSStringRef AccessibilityUIElement::role()
     return JSStringCreateWithCharacters(roleText, _tcslen(roleText));
 }
 
+JSStringRef AccessibilityUIElement::subrole()
+{
+    return 0;
+}
+
 JSStringRef AccessibilityUIElement::title()
 {
     BSTR titleBSTR;
@@ -325,6 +330,11 @@ JSStringRef AccessibilityUIElement::boundsForRange(unsigned location, unsigned l
     return JSStringCreateWithCharacters(0, 0);
 }
 
+JSStringRef AccessibilityUIElement::stringForRange(unsigned, unsigned)
+{
+    return JSStringCreateWithCharacters(0, 0);
+}
+
 AccessibilityUIElement AccessibilityUIElement::cellForColumnAndRow(unsigned column, unsigned row)
 {
     return 0;
diff --git a/WebKitTools/DumpRenderTree/win/DRTDesktopNotificationPresenter.cpp b/WebKitTools/DumpRenderTree/win/DRTDesktopNotificationPresenter.cpp
new file mode 100644
index 0000000..b18b724
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/win/DRTDesktopNotificationPresenter.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "DRTDesktopNotificationPresenter.h"
+
+#include "DumpRenderTree.h"
+#include "LayoutTestController.h"
+#include <JavaScriptCore/JSStringRef.h>
+#include <JavaScriptCore/JSStringRefBSTR.h>
+#include <WebCore/NotificationPresenter.h>
+
+DRTDesktopNotificationPresenter::DRTDesktopNotificationPresenter()
+    : m_refCount(1) {} 
+
+HRESULT STDMETHODCALLTYPE DRTDesktopNotificationPresenter::QueryInterface(REFIID riid, void** ppvObject)
+{
+    *ppvObject = 0;
+    if (IsEqualGUID(riid, IID_IUnknown))
+        *ppvObject = static_cast<DRTDesktopNotificationPresenter*>(this);
+    else if (IsEqualGUID(riid, IID_IWebDesktopNotificationsDelegate))
+        *ppvObject = static_cast<DRTDesktopNotificationPresenter*>(this);
+    else
+        return E_NOINTERFACE;
+
+    AddRef();
+    return S_OK;
+}
+
+ULONG STDMETHODCALLTYPE DRTDesktopNotificationPresenter::AddRef()
+{
+    return ++m_refCount;
+}
+
+ULONG STDMETHODCALLTYPE DRTDesktopNotificationPresenter::Release()
+{
+    ULONG newRef = --m_refCount;
+    if (!newRef)
+        delete(this);
+
+    return newRef;
+}
+
+HRESULT STDMETHODCALLTYPE DRTDesktopNotificationPresenter::showDesktopNotification(
+    /* [in] */ IWebDesktopNotification* notification)
+{
+    BSTR title, text, url;
+    BOOL html;
+
+    if (!notification->isHTML(&html) && html) {
+        notification->contentsURL(&url);    
+        printf("DESKTOP NOTIFICATION: contents at %S\n", url ? url : L"");
+    } else {
+        notification->iconURL(&url);
+        notification->title(&title);
+        notification->text(&text);
+        printf("DESKTOP NOTIFICATION: icon %S, title %S, text %S\n", 
+            url ? url : L"", 
+            title ? title : L"", 
+            text ? text : L"");
+    }
+
+    // In this stub implementation, the notification is displayed immediately;
+    // we dispatch the display event to mimic that.
+    notification->notifyDisplay();
+
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE DRTDesktopNotificationPresenter::cancelDesktopNotification(
+    /* [in] */ IWebDesktopNotification* notification)
+{
+    BSTR identifier;
+    BOOL html;
+    notification->isHTML(&html);
+    if (html)
+        notification->contentsURL(&identifier);
+    else
+        notification->title(&identifier);
+
+    printf("DESKTOP NOTIFICATION CLOSED: %S\n", identifier ? identifier : L"");
+    notification->notifyClose(false);
+
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE DRTDesktopNotificationPresenter::notificationDestroyed(
+    /* [in] */ IWebDesktopNotification* notification)
+{
+    // Since in these tests events happen immediately, we don't hold on to
+    // Notification pointers.  So there's no cleanup to do.
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE DRTDesktopNotificationPresenter::checkNotificationPermission(
+        /* [in] */ BSTR origin, 
+        /* [out, retval] */ int* result)
+{
+#if ENABLE(NOTIFICATIONS)
+    JSStringRef jsOrigin = JSStringCreateWithBSTR(origin);
+    bool allowed = ::gLayoutTestController->checkDesktopNotificationPermission(jsOrigin);
+
+    if (allowed)
+        *result = WebCore::NotificationPresenter::PermissionAllowed;
+    else
+        *result = WebCore::NotificationPresenter::PermissionDenied;
+
+    JSStringRelease(jsOrigin);
+#endif
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE DRTDesktopNotificationPresenter::requestNotificationPermission(
+        /* [in] */ BSTR origin)
+{
+    printf("DESKTOP NOTIFICATION PERMISSION REQUESTED: %S\n", origin ? origin : L"");
+    return S_OK;
+}
diff --git a/WebKitTools/DumpRenderTree/win/DRTDesktopNotificationPresenter.h b/WebKitTools/DumpRenderTree/win/DRTDesktopNotificationPresenter.h
new file mode 100644
index 0000000..5679845
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/win/DRTDesktopNotificationPresenter.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2005, 2006, 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DRTDesktopNotificationPresenter_h
+#define DRTDesktopNotificationPresenter_h
+
+#include <WebKit/WebKit.h>
+#include <wtf/OwnPtr.h>
+#include <windef.h>
+
+class DRTDesktopNotificationPresenter : public IWebDesktopNotificationsDelegate {
+public:
+    DRTDesktopNotificationPresenter();
+
+    // IUnknown
+    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);
+    virtual ULONG STDMETHODCALLTYPE AddRef(void);
+    virtual ULONG STDMETHODCALLTYPE Release(void);
+
+    // IWebDesktopNotificationsDelegate
+    virtual HRESULT STDMETHODCALLTYPE showDesktopNotification(
+        /* [in] */ IWebDesktopNotification* notification);
+
+    virtual HRESULT STDMETHODCALLTYPE cancelDesktopNotification(
+        /* [in] */ IWebDesktopNotification* notification);
+
+    virtual HRESULT STDMETHODCALLTYPE notificationDestroyed(
+        /* [in] */ IWebDesktopNotification* notification);
+
+    virtual HRESULT STDMETHODCALLTYPE checkNotificationPermission(
+        /* [in] */ BSTR origin, 
+        /* [out, retval] */ int* result);
+
+    virtual HRESULT STDMETHODCALLTYPE requestNotificationPermission(
+        /* [in] */ BSTR origin);
+
+private:
+    ULONG m_refCount;
+};
+
+#endif
diff --git a/WebKitTools/DumpRenderTree/win/DraggingInfo.h b/WebKitTools/DumpRenderTree/win/DraggingInfo.h
index 2ead457..98982bc 100644
--- a/WebKitTools/DumpRenderTree/win/DraggingInfo.h
+++ b/WebKitTools/DumpRenderTree/win/DraggingInfo.h
@@ -36,6 +36,7 @@ public:
     DraggingInfo(IDataObject* object, IDropSource* source)
         : m_object(object)
         , m_source(source)
+        , m_performedDropEffect(DROPEFFECT_NONE)
     {
         m_object->AddRef();
         m_source->AddRef();
@@ -54,9 +55,13 @@ public:
     IDataObject* dataObject() const { return m_object; }
     IDropSource* dropSource() const { return m_source; }
 
+    DWORD performedDropEffect() const { return m_performedDropEffect; }
+    void setPerformedDropEffect(DWORD effect) { m_performedDropEffect = effect; }
+
 private:
     IDataObject* m_object;
     IDropSource* m_source;
+    DWORD m_performedDropEffect;
 };
 
 #endif // !defined(DraggingInfo_h)
diff --git a/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp
index d262826..7e013a7 100644
--- a/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp
@@ -50,14 +50,19 @@
 #include <wtf/RetainPtr.h>
 #include <wtf/Vector.h>
 #include <windows.h>
-#if PLATFORM(CFNETWORK)
-#include <CFNetwork/CFURLCachePriv.h>
-#endif
 #include <CoreFoundation/CoreFoundation.h>
 #include <JavaScriptCore/JavaScriptCore.h>
 #include <WebKit/WebKit.h>
 #include <WebKit/WebKitCOMAPI.h>
 
+#if USE(CFNETWORK)
+#include <CFNetwork/CFURLCachePriv.h>
+#endif
+
+#if USE(CFNETWORK)
+#include <CFNetwork/CFHTTPCookiesPriv.h>
+#endif
+
 using namespace std;
 
 #ifndef NDEBUG
@@ -108,6 +113,25 @@ void setPersistentUserStyleSheetLocation(CFStringRef url)
     persistentUserStyleSheetLocation = url;
 }
 
+bool setAlwaysAcceptCookies(bool alwaysAcceptCookies)
+{
+#if USE(CFNETWORK)
+    COMPtr<IWebCookieManager> cookieManager;
+    if (FAILED(WebKitCreateInstance(CLSID_WebCookieManager, 0, IID_IWebCookieManager, reinterpret_cast<void**>(&cookieManager))))
+        return false;
+    CFHTTPCookieStorageRef cookieStorage = 0;
+    if (FAILED(cookieManager->cookieStorage(&cookieStorage)) || !cookieStorage)
+        return false;
+
+    WebKitCookieStorageAcceptPolicy cookieAcceptPolicy = alwaysAcceptCookies ? WebKitCookieStorageAcceptPolicyAlways : WebKitCookieStorageAcceptPolicyOnlyFromMainDocumentDomain;
+    CFHTTPCookieStorageSetCookieAcceptPolicy(cookieStorage, cookieAcceptPolicy);
+    return true;
+#else
+    // FIXME: Implement!
+    return false;
+#endif
+}
+
 wstring urlSuitableForTestResult(const wstring& url)
 {
     if (!url.c_str() || url.find(L"file://") == wstring::npos)
@@ -657,6 +681,72 @@ static bool shouldLogFrameLoadDelegates(const char* pathOrURL)
     return strstr(pathOrURL, "/loading/") || strstr(pathOrURL, "\\loading\\");
 }
 
+static void resetDefaultsToConsistentValues(IWebPreferences* preferences)
+{
+#ifdef USE_MAC_FONTS
+    static BSTR standardFamily = SysAllocString(TEXT("Times"));
+    static BSTR fixedFamily = SysAllocString(TEXT("Courier"));
+    static BSTR sansSerifFamily = SysAllocString(TEXT("Helvetica"));
+    static BSTR cursiveFamily = SysAllocString(TEXT("Apple Chancery"));
+    static BSTR fantasyFamily = SysAllocString(TEXT("Papyrus"));
+#else
+    static BSTR standardFamily = SysAllocString(TEXT("Times New Roman"));
+    static BSTR fixedFamily = SysAllocString(TEXT("Courier New"));
+    static BSTR sansSerifFamily = SysAllocString(TEXT("Arial"));
+    static BSTR cursiveFamily = SysAllocString(TEXT("Comic Sans MS")); // Not actually cursive, but it's what IE and Firefox use.
+    static BSTR fantasyFamily = SysAllocString(TEXT("Times New Roman"));
+#endif
+
+    preferences->setStandardFontFamily(standardFamily);
+    preferences->setFixedFontFamily(fixedFamily);
+    preferences->setSerifFontFamily(standardFamily);
+    preferences->setSansSerifFontFamily(sansSerifFamily);
+    preferences->setCursiveFontFamily(cursiveFamily);
+    preferences->setFantasyFontFamily(fantasyFamily);
+
+    preferences->setAutosaves(FALSE);
+    preferences->setDefaultFontSize(16);
+    preferences->setDefaultFixedFontSize(13);
+    preferences->setMinimumFontSize(1);
+    preferences->setJavaEnabled(FALSE);
+    preferences->setPlugInsEnabled(TRUE);
+    preferences->setDOMPasteAllowed(TRUE);
+    preferences->setEditableLinkBehavior(WebKitEditableLinkOnlyLiveWithShiftKey);
+    preferences->setFontSmoothing(FontSmoothingTypeStandard);
+    preferences->setUsesPageCache(FALSE);
+    preferences->setPrivateBrowsingEnabled(FALSE);
+    preferences->setJavaScriptCanOpenWindowsAutomatically(TRUE);
+    preferences->setJavaScriptEnabled(TRUE);
+    preferences->setTabsToLinks(FALSE);
+    preferences->setShouldPrintBackgrounds(TRUE);
+    preferences->setLoadsImagesAutomatically(TRUE);
+
+    if (persistentUserStyleSheetLocation) {
+        Vector<wchar_t> urlCharacters(CFStringGetLength(persistentUserStyleSheetLocation.get()));
+        CFStringGetCharacters(persistentUserStyleSheetLocation.get(), CFRangeMake(0, CFStringGetLength(persistentUserStyleSheetLocation.get())), (UniChar *)urlCharacters.data());
+        BSTR url = SysAllocStringLen(urlCharacters.data(), urlCharacters.size());
+        preferences->setUserStyleSheetLocation(url);
+        SysFreeString(url);
+        preferences->setUserStyleSheetEnabled(TRUE);
+    } else
+        preferences->setUserStyleSheetEnabled(FALSE);
+
+    COMPtr<IWebPreferencesPrivate> prefsPrivate(Query, preferences);
+    if (prefsPrivate) {
+        prefsPrivate->setAllowUniversalAccessFromFileURLs(TRUE);
+        prefsPrivate->setAuthorAndUserStylesEnabled(TRUE);
+        prefsPrivate->setDeveloperExtrasEnabled(FALSE);
+        prefsPrivate->setExperimentalNotificationsEnabled(TRUE);
+        prefsPrivate->setExperimentalWebSocketsEnabled(FALSE);
+        prefsPrivate->setShouldPaintNativeControls(FALSE); // FIXME - need to make DRT pass with Windows native controls <http://bugs.webkit.org/show_bug.cgi?id=25592>
+        prefsPrivate->setXSSAuditorEnabled(FALSE);
+        prefsPrivate->setOfflineWebApplicationCacheEnabled(TRUE);
+    }
+    setAlwaysAcceptCookies(false);
+
+    setlocale(LC_ALL, "");
+}
+
 static void resetWebViewToConsistentStateBeforeTesting()
 {
     COMPtr<IWebView> webView;
@@ -673,30 +763,10 @@ static void resetWebViewToConsistentStateBeforeTesting()
         webIBActions->resetPageZoom(0);
     }
 
+
     COMPtr<IWebPreferences> preferences;
-    if (SUCCEEDED(webView->preferences(&preferences))) {
-        preferences->setPrivateBrowsingEnabled(FALSE);
-        preferences->setJavaScriptCanOpenWindowsAutomatically(TRUE);
-        preferences->setLoadsImagesAutomatically(TRUE);
-
-        if (persistentUserStyleSheetLocation) {
-            Vector<wchar_t> urlCharacters(CFStringGetLength(persistentUserStyleSheetLocation.get()));
-            CFStringGetCharacters(persistentUserStyleSheetLocation.get(), CFRangeMake(0, CFStringGetLength(persistentUserStyleSheetLocation.get())), (UniChar *)urlCharacters.data());
-            BSTR url = SysAllocStringLen(urlCharacters.data(), urlCharacters.size());
-            preferences->setUserStyleSheetLocation(url);
-            SysFreeString(url);
-            preferences->setUserStyleSheetEnabled(TRUE);
-        } else
-            preferences->setUserStyleSheetEnabled(FALSE);
-
-        COMPtr<IWebPreferencesPrivate> prefsPrivate(Query, preferences);
-        if (prefsPrivate) {
-            prefsPrivate->setAuthorAndUserStylesEnabled(TRUE);
-            prefsPrivate->setDeveloperExtrasEnabled(FALSE);
-            prefsPrivate->setShouldPaintNativeControls(FALSE); // FIXME - need to make DRT pass with Windows native controls <http://bugs.webkit.org/show_bug.cgi?id=25592>
-            prefsPrivate->setXSSAuditorEnabled(FALSE);
-        }
-    }
+    if (SUCCEEDED(webView->preferences(&preferences)))
+        resetDefaultsToConsistentValues(preferences.get());
 
     COMPtr<IWebViewEditing> viewEditing;
     if (SUCCEEDED(webView->QueryInterface(&viewEditing)))
@@ -715,8 +785,11 @@ static void resetWebViewToConsistentStateBeforeTesting()
         SetFocus(viewWindow);
 
     webViewPrivate->clearMainFrameName();
+    webViewPrivate->resetOriginAccessWhiteLists();
 
     sharedUIDelegate->resetUndoManager();
+
+    sharedFrameLoadDelegate->resetToConsistentState();
 }
 
 static void runTest(const string& testPathOrURL)
@@ -830,44 +903,6 @@ exit:
     return;
 }
 
-static void initializePreferences(IWebPreferences* preferences)
-{
-#ifdef USE_MAC_FONTS
-    BSTR standardFamily = SysAllocString(TEXT("Times"));
-    BSTR fixedFamily = SysAllocString(TEXT("Courier"));
-    BSTR sansSerifFamily = SysAllocString(TEXT("Helvetica"));
-    BSTR cursiveFamily = SysAllocString(TEXT("Apple Chancery"));
-    BSTR fantasyFamily = SysAllocString(TEXT("Papyrus"));
-#else
-    BSTR standardFamily = SysAllocString(TEXT("Times New Roman"));
-    BSTR fixedFamily = SysAllocString(TEXT("Courier New"));
-    BSTR sansSerifFamily = SysAllocString(TEXT("Arial"));
-    BSTR cursiveFamily = SysAllocString(TEXT("Comic Sans MS")); // Not actually cursive, but it's what IE and Firefox use.
-    BSTR fantasyFamily = SysAllocString(TEXT("Times New Roman"));
-#endif
-
-    preferences->setStandardFontFamily(standardFamily);
-    preferences->setFixedFontFamily(fixedFamily);
-    preferences->setSerifFontFamily(standardFamily);
-    preferences->setSansSerifFontFamily(sansSerifFamily);
-    preferences->setCursiveFontFamily(cursiveFamily);
-    preferences->setFantasyFontFamily(fantasyFamily);
-
-    preferences->setAutosaves(FALSE);
-    preferences->setJavaEnabled(FALSE);
-    preferences->setPlugInsEnabled(TRUE);
-    preferences->setDOMPasteAllowed(TRUE);
-    preferences->setEditableLinkBehavior(WebKitEditableLinkOnlyLiveWithShiftKey);
-    preferences->setFontSmoothing(FontSmoothingTypeStandard);
-    preferences->setUsesPageCache(FALSE);
-
-    SysFreeString(standardFamily);
-    SysFreeString(fixedFamily);
-    SysFreeString(sansSerifFamily);
-    SysFreeString(cursiveFamily);
-    SysFreeString(fantasyFamily);
-}
-
 static Boolean pthreadEqualCallback(const void* value1, const void* value2)
 {
     return (Boolean)pthread_equal(*(pthread_t*)value1, *(pthread_t*)value2);
@@ -1052,18 +1087,12 @@ IWebView* createWebViewAndOffscreenWindow(HWND* webViewWindow)
     if (FAILED(webView->setResourceLoadDelegate(sharedResourceLoadDelegate.get())))
         return 0;
 
-    COMPtr<IWebPreferences> preferences;
-    if (FAILED(webView->preferences(&preferences)))
-        return 0;
-
-    initializePreferences(preferences.get());
-
     openWindows().append(hostWindow);
     windowToWebViewMap().set(hostWindow, webView);
     return webView;
 }
 
-#if PLATFORM(CFNETWORK)
+#if USE(CFNETWORK)
 RetainPtr<CFURLCacheRef> sharedCFURLCache()
 {
     HMODULE module = GetModuleHandle(TEXT("CFNetwork_debug.dll"));
@@ -1138,7 +1167,7 @@ int main(int argc, char* argv[])
     standardPreferencesPrivate->setShouldPaintNativeControls(FALSE);
     standardPreferences->setJavaScriptEnabled(TRUE);
     standardPreferences->setDefaultFontSize(16);
-    
+
     COMPtr<IWebView> webView(AdoptCOM, createWebViewAndOffscreenWindow(&webViewWindow));
     if (!webView)
         return -1;
@@ -1153,7 +1182,7 @@ int main(int argc, char* argv[])
     if (FAILED(webView->mainFrame(&frame)))
         return -1;
 
-#if PLATFORM(CFNETWORK)
+#if USE(CFNETWORK)
     RetainPtr<CFURLCacheRef> urlCache = sharedCFURLCache();
     CFURLCacheRemoveAllCachedResponses(urlCache.get());
 #endif
diff --git a/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj b/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj
index b1bd3ab..dea2467 100644
--- a/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj
+++ b/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj
@@ -23,7 +23,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -55,7 +55,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib"

+				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib comsuppw.lib"

 				AdditionalLibraryDirectories=""

 				DelayLoadDLLs=""

 				SubSystem="1"

@@ -96,7 +96,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -128,7 +128,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib"

+				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib comsuppw.lib"

 				AdditionalLibraryDirectories=""

 				DelayLoadDLLs=""

 				SubSystem="1"

@@ -168,7 +168,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -200,7 +200,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib"

+				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib comsuppw.lib"

 				AdditionalLibraryDirectories=""

 				DelayLoadDLLs=""

 				SubSystem="1"

@@ -234,12 +234,12 @@
 		<Configuration

 			Name="Debug_Cairo|Win32"

 			ConfigurationType="1"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\WinCairo.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_wincairo.vsprops;$(WebKitLibrariesDir)\tools\vsprops\WinCairo.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -271,7 +271,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CFLite_Debug.lib cairo.lib jpeg.lib libpng.lib libcurl_imp.lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib"

+				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CFLite_Debug.lib cairo.lib libjpeg.lib libpng.lib libcurl_imp.lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib comsuppw.lib"

 				AdditionalLibraryDirectories=""

 				DelayLoadDLLs=""

 				SubSystem="1"

@@ -312,7 +312,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -344,7 +344,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CFLite.lib cairo.lib jpeg.lib libpng.lib libcurl_imp.lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib"

+				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CFLite.lib cairo.lib libjpeg.lib libpng.lib libcurl_imp.lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib comsuppw.lib"

 				AdditionalLibraryDirectories=""

 				DelayLoadDLLs=""

 				SubSystem="1"

@@ -432,6 +432,14 @@
 			Name="Delegates"

 			>

 			<File

+				RelativePath=".\DRTDesktopNotificationPresenter.cpp"

+				>

+			</File>

+			<File

+				RelativePath=".\DRTDesktopNotificationPresenter.h"

+				>

+			</File>

+			<File

 				RelativePath=".\EditingDelegate.cpp"

 				>

 			</File>

diff --git a/WebKitTools/DumpRenderTree/win/DumpRenderTreeWin.h b/WebKitTools/DumpRenderTree/win/DumpRenderTreeWin.h
index bf9b123..6eb468d 100644
--- a/WebKitTools/DumpRenderTree/win/DumpRenderTreeWin.h
+++ b/WebKitTools/DumpRenderTree/win/DumpRenderTreeWin.h
@@ -53,6 +53,7 @@ typedef HashMap<HWND, COMPtr<IWebView> > WindowToWebViewMap;
 WindowToWebViewMap& windowToWebViewMap();
 
 void setPersistentUserStyleSheetLocation(CFStringRef);
+bool setAlwaysAcceptCookies(bool alwaysAcceptCookies);
 
 extern UINT_PTR waitToDumpWatchdog;
 
diff --git a/WebKitTools/DumpRenderTree/win/EventSender.cpp b/WebKitTools/DumpRenderTree/win/EventSender.cpp
index ca897fb..721b238 100644
--- a/WebKitTools/DumpRenderTree/win/EventSender.cpp
+++ b/WebKitTools/DumpRenderTree/win/EventSender.cpp
@@ -151,7 +151,30 @@ static JSValueRef mouseDownCallback(JSContextRef context, JSObjectRef function,
         framePrivate->layout();
 
     down = true;
-    MSG msg = makeMsg(webViewWindow, WM_LBUTTONDOWN, 0, MAKELPARAM(lastMousePosition.x, lastMousePosition.y));
+    int mouseType = WM_LBUTTONDOWN;
+    if (argumentCount == 1) {
+        int mouseNumber = JSValueToNumber(context, arguments[0], exception);
+        switch (mouseNumber) {
+        case 0:
+            mouseType = WM_LBUTTONDOWN;
+            break;
+        case 1:
+            mouseType = WM_MBUTTONDOWN;
+            break;
+        case 2:
+            mouseType = WM_RBUTTONDOWN;
+            break;
+        case 3:
+            // fast/events/mouse-click-events expects the 4th button has event.button = 1, so send an WM_BUTTONDOWN
+            mouseType = WM_MBUTTONDOWN;
+            break;
+        default:
+            mouseType = WM_LBUTTONDOWN;
+            break;
+        }
+    }
+        
+    MSG msg = makeMsg(webViewWindow, mouseType, 0, MAKELPARAM(lastMousePosition.x, lastMousePosition.y));
     if (!msgQueue[endOfQueue].delay)
         dispatchMessage(&msg);
     else {
@@ -196,18 +219,42 @@ static void doMouseUp(MSG msg)
             if (hr == DRAGDROP_S_DROP && effect != DROPEFFECT_NONE) {
                 DWORD effect = 0;
                 webViewDropTarget->Drop(draggingInfo->dataObject(), 0, pointl(screenPoint), &effect);
+                draggingInfo->setPerformedDropEffect(effect);
             } else
                 webViewDropTarget->DragLeave();
 
-            delete draggingInfo;
-            draggingInfo = 0;
+            // Reset didDragEnter so that another drag started within the same frame works properly.
+            didDragEnter = false;
         }
     }
 }
 
 static JSValueRef mouseUpCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
-    MSG msg = makeMsg(webViewWindow, WM_LBUTTONUP, 0, MAKELPARAM(lastMousePosition.x, lastMousePosition.y));
+    int mouseType = WM_LBUTTONUP;
+    if (argumentCount == 1) {
+        int mouseNumber = JSValueToNumber(context, arguments[0], exception);
+        switch (mouseNumber) {
+        case 0:
+            mouseType = WM_LBUTTONUP;
+            break;
+        case 1:
+            mouseType = WM_MBUTTONUP;
+            break;
+        case 2:
+            mouseType = WM_RBUTTONUP;
+            break;
+        case 3:
+            // fast/events/mouse-click-events expects the 4th button has event.button = 1, so send an WM_MBUTTONUP
+            mouseType = WM_MBUTTONUP;
+            break;
+        default:
+            mouseType = WM_LBUTTONUP;
+            break;
+        }
+    }
+
+    MSG msg = makeMsg(webViewWindow, mouseType, 0, MAKELPARAM(lastMousePosition.x, lastMousePosition.y));
 
     if ((dragMode && !replayingSavedEvents) || msgQueue[endOfQueue].delay) {
         msgQueue[endOfQueue++].msg = msg;
@@ -277,12 +324,16 @@ void replaySavedEvents()
         msg = msgQueue[startOfQueue++].msg;
         switch (msg.message) {
             case WM_LBUTTONUP:
+            case WM_RBUTTONUP:
+            case WM_MBUTTONUP:
                 doMouseUp(msg);
                 break;
             case WM_MOUSEMOVE:
                 doMouseMove(msg);
                 break;
             case WM_LBUTTONDOWN:
+            case WM_RBUTTONDOWN:
+            case WM_MBUTTONDOWN:
                 dispatchMessage(&msg);
                 break;
             default:
@@ -317,12 +368,16 @@ void replaySavedEvents()
         msg = msgQueue[startOfQueue++].msg;
         switch (msg.message) {
             case WM_LBUTTONUP:
+            case WM_RBUTTONUP:
+            case WM_MBUTTONUP:
                 doMouseUp(msg);
                 break;
             case WM_MOUSEMOVE:
                 doMouseMove(msg);
                 break;
             case WM_LBUTTONDOWN:
+            case WM_RBUTTONDOWN:
+            case WM_MBUTTONDOWN:
                 dispatchMessage(&msg);
                 break;
             default:
diff --git a/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.cpp b/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.cpp
index 5f0e02b..939090a 100644
--- a/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.cpp
+++ b/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.cpp
@@ -76,8 +76,7 @@ string descriptionSuitableForTestResult(IWebFrame* webFrame)
     string frameName = (webFrame == mainFrame) ? "main frame" : "frame";
     frameName += " \"" + BSTRtoString(frameNameBSTR) + "\""; 
 
-    SysFreeString(frameNameBSTR);
-
+    SysFreeString(frameNameBSTR); 
     return frameName;
 }
 
@@ -101,6 +100,8 @@ HRESULT STDMETHODCALLTYPE FrameLoadDelegate::QueryInterface(REFIID riid, void**
         *ppvObject = static_cast<IWebFrameLoadDelegate*>(this);
     else if (IsEqualGUID(riid, IID_IWebFrameLoadDelegatePrivate))
         *ppvObject = static_cast<IWebFrameLoadDelegatePrivate*>(this);
+    else if (IsEqualGUID(riid, IID_IWebFrameLoadDelegatePrivate2))
+        *ppvObject = static_cast<IWebFrameLoadDelegatePrivate2*>(this);
     else
         return E_NOINTERFACE;
 
@@ -180,6 +181,9 @@ HRESULT STDMETHODCALLTYPE FrameLoadDelegate::didReceiveTitle(
     /* [in] */ BSTR title,
     /* [in] */ IWebFrame *frame)
 {
+    if (!done && gLayoutTestController->dumpFrameLoadCallbacks())
+        printf("%s - didReceiveTitle: %S\n", descriptionSuitableForTestResult(frame).c_str(), title);
+
     if (::gLayoutTestController->dumpTitleChanges() && !done)
         printf("TITLE CHANGED: %S\n", title ? title : L"");
     return S_OK;
@@ -196,6 +200,11 @@ void FrameLoadDelegate::processWork()
         dump();
 }
 
+void FrameLoadDelegate::resetToConsistentState()
+{
+    m_accessibilityController->resetToConsistentState();
+}
+
 static void CALLBACK processWorkTimer(HWND, UINT, UINT_PTR id, DWORD)
 {
     ::KillTimer(0, id);
@@ -346,3 +355,23 @@ HRESULT STDMETHODCALLTYPE FrameLoadDelegate::didFirstVisuallyNonEmptyLayoutInFra
 {
     return S_OK;
 }
+
+HRESULT STDMETHODCALLTYPE FrameLoadDelegate::didDisplayInsecureContent( 
+    /* [in] */ IWebView *sender)
+{
+    if (!done && gLayoutTestController->dumpFrameLoadCallbacks())
+        printf("didDisplayInsecureContent\n");
+
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE FrameLoadDelegate::didRunInsecureContent( 
+    /* [in] */ IWebView *sender,
+    /* [in] */ IWebSecurityOrigin *origin)
+{
+    if (!done && gLayoutTestController->dumpFrameLoadCallbacks())
+        printf("didRunInsecureContent\n");
+
+    return S_OK;
+}
+
diff --git a/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h b/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h
index 526e1b4..56325e2 100644
--- a/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h
+++ b/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h
@@ -35,13 +35,15 @@
 class AccessibilityController;
 class GCController;
 
-class FrameLoadDelegate : public IWebFrameLoadDelegate, public IWebFrameLoadDelegatePrivate {
+class FrameLoadDelegate : public IWebFrameLoadDelegate, public IWebFrameLoadDelegatePrivate2 {
 public:
     FrameLoadDelegate();
     virtual ~FrameLoadDelegate();
 
     void processWork();
 
+    void resetToConsistentState();
+
     // IUnknown
     virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);
     virtual ULONG STDMETHODCALLTYPE AddRef(void);
@@ -131,6 +133,14 @@ public:
         /* [in] */ IWebView *sender,
         /* [in] */ IWebFrame *frame);
 
+    // IWebFrameLoadDelegatePrivate2
+    virtual HRESULT STDMETHODCALLTYPE didDisplayInsecureContent( 
+        /* [in] */ IWebView *sender);
+
+    virtual HRESULT STDMETHODCALLTYPE didRunInsecureContent( 
+        /* [in] */ IWebView *sender,
+        /* [in] */ IWebSecurityOrigin *origin);
+
 protected:
     void locationChangeDone(IWebError*, IWebFrame*);
 
diff --git a/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj b/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj
index 8d79717..37bddeb 100644
--- a/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj
+++ b/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj
@@ -1,230 +1,230 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="ImageDiff"
-	ProjectGUID="{59CC0547-70AC-499C-9B19-EC01C6F61137}"
-	RootNamespace="ImageDiff"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib"
-				AdditionalLibraryDirectories=""
-				SubSystem="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt38.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt38$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin38$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin38$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc38$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc38$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"
-			CharacterSet="2"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib"
-				AdditionalLibraryDirectories=""
-				SubSystem="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt38.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt38$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin38$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin38$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc38$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc38$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_Internal|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib"
-				AdditionalLibraryDirectories=""
-				SubSystem="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt38.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt38$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin38$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin38$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc38$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc38$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<File
-			RelativePath="..\cg\ImageDiffCG.cpp"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="ImageDiff"

+	ProjectGUID="{59CC0547-70AC-499C-9B19-EC01C6F61137}"

+	RootNamespace="ImageDiff"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Debug|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"

+			CharacterSet="2"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib"

+				AdditionalLibraryDirectories=""

+				SubSystem="1"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			CharacterSet="2"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib"

+				AdditionalLibraryDirectories=""

+				SubSystem="1"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_Internal|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"

+			CharacterSet="2"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib"

+				AdditionalLibraryDirectories=""

+				SubSystem="1"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<File

+			RelativePath="..\cg\ImageDiffCG.cpp"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp b/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
index 7a80bab..cf3ac85 100644
--- a/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
+++ b/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
@@ -34,21 +34,22 @@
 #include "PolicyDelegate.h"
 #include "WorkQueue.h"
 #include "WorkQueueItem.h"
-#include <WebCore/COMPtr.h>
-#include <wtf/Platform.h>
-#include <wtf/RetainPtr.h>
-#include <wtf/Vector.h>
+#include <CoreFoundation/CoreFoundation.h>
 #include <JavaScriptCore/Assertions.h>
-#include <JavaScriptCore/JavaScriptCore.h>
 #include <JavaScriptCore/JSRetainPtr.h>
 #include <JavaScriptCore/JSStringRefBSTR.h>
+#include <JavaScriptCore/JavaScriptCore.h>
+#include <WebCore/COMPtr.h>
 #include <WebKit/WebKit.h>
 #include <WebKit/WebKitCOMAPI.h>
-#include <string>
-#include <CoreFoundation/CoreFoundation.h>
+#include <comutil.h>
 #include <shlwapi.h>
 #include <shlguid.h>
 #include <shobjidl.h>
+#include <string>
+#include <wtf/Platform.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
 
 using std::string;
 using std::wstring;
@@ -183,6 +184,17 @@ size_t LayoutTestController::webHistoryItemCount()
     return count;
 }
 
+unsigned LayoutTestController::workerThreadCount() const
+{
+    COMPtr<IWebWorkersPrivate> workers;
+    if (FAILED(WebKitCreateInstance(CLSID_WebWorkersPrivate, 0, __uuidof(workers), reinterpret_cast<void**>(&workers))))
+        return 0;
+    unsigned count;
+    if (FAILED(workers->workerThreadCount(&count)))
+        return 0;
+    return count;
+}
+
 void LayoutTestController::notifyDone()
 {
     // Same as on mac.  This can be shared.
@@ -260,6 +272,16 @@ void LayoutTestController::setAcceptsEditing(bool acceptsEditing)
     editingDelegate->setAcceptsEditing(acceptsEditing);
 }
 
+void LayoutTestController::setAlwaysAcceptCookies(bool alwaysAcceptCookies)
+{
+    if (alwaysAcceptCookies == m_alwaysAcceptCookies)
+        return;
+
+    if (!::setAlwaysAcceptCookies(alwaysAcceptCookies))
+        return;
+    m_alwaysAcceptCookies = alwaysAcceptCookies;
+}
+
 void LayoutTestController::setAuthorAndUserStylesEnabled(bool flag)
 {
     COMPtr<IWebView> webView;
@@ -290,6 +312,18 @@ void LayoutTestController::setCustomPolicyDelegate(bool setDelegate, bool permis
         webView->setPolicyDelegate(0);
 }
 
+void LayoutTestController::setMockGeolocationPosition(double latitude, double longitude, double accuracy)
+{
+    // FIXME: Implement for Geolocation layout tests.
+    // See https://bugs.webkit.org/show_bug.cgi?id=28264.
+}
+
+void LayoutTestController::setMockGeolocationError(int code, JSStringRef message)
+{
+    // FIXME: Implement for Geolocation layout tests.
+    // See https://bugs.webkit.org/show_bug.cgi?id=28264.
+}
+
 void LayoutTestController::setIconDatabaseEnabled(bool iconDatabaseEnabled)
 {
     // See also <rdar://problem/6480108>
@@ -615,14 +649,11 @@ void LayoutTestController::setSelectTrailingWhitespaceEnabled(bool flag)
     viewEditing->setSelectTrailingWhitespaceEnabled(flag ? TRUE : FALSE);
 }
 
-static const CFTimeInterval waitToDumpWatchdogInterval = 10.0;
+static const CFTimeInterval waitToDumpWatchdogInterval = 15.0;
 
 static void CALLBACK waitUntilDoneWatchdogFired(HWND, UINT, UINT_PTR, DWORD)
 {
-    const char* message = "FAIL: Timed out waiting for notifyDone to be called\n";
-    fprintf(stderr, message);
-    fprintf(stdout, message);
-    dump();
+    gLayoutTestController->waitToDumpWatchdogTimerFired();
 }
 
 void LayoutTestController::setWaitToDump(bool waitUntilDone)
@@ -707,9 +738,38 @@ void LayoutTestController::clearAllDatabases()
     databaseManager->deleteAllDatabases();
 }
 
+void LayoutTestController::overridePreference(JSStringRef key, JSStringRef value)
+{
+    COMPtr<IWebView> webView;
+    if (FAILED(frame->webView(&webView)))
+        return;
+
+    COMPtr<IWebPreferences> preferences;
+    if (FAILED(webView->preferences(&preferences)))
+        return;
+
+    COMPtr<IWebPreferencesPrivate> prefsPrivate(Query, preferences);
+    if (!prefsPrivate)
+        return;
+
+    BSTR keyBSTR = JSStringCopyBSTR(key);
+    BSTR valueBSTR = JSStringCopyBSTR(value);
+    prefsPrivate->setPreferenceForTest(keyBSTR, valueBSTR);
+    SysFreeString(keyBSTR);
+    SysFreeString(valueBSTR);
+}
+
 void LayoutTestController::setDatabaseQuota(unsigned long long quota)
 {
-    printf("ERROR: LayoutTestController::setDatabaseQuota() not implemented\n");
+    COMPtr<IWebDatabaseManager> databaseManager;
+    COMPtr<IWebDatabaseManager> tmpDatabaseManager;
+
+    if (FAILED(WebKitCreateInstance(CLSID_WebDatabaseManager, 0, IID_IWebDatabaseManager, (void**)&tmpDatabaseManager)))
+        return;
+    if (FAILED(tmpDatabaseManager->sharedWebDatabaseManager(&databaseManager)))
+        return;
+
+    databaseManager->setQuota(TEXT("file:///"), quota);
 }
 
 void LayoutTestController::setAppCacheMaximumSize(unsigned long long size)
@@ -779,3 +839,76 @@ unsigned LayoutTestController::numberOfActiveAnimations() const
 
     return number;
 }
+
+static _bstr_t bstrT(JSStringRef jsString)
+{
+    // The false parameter tells the _bstr_t constructor to adopt the BSTR we pass it.
+    return _bstr_t(JSStringCopyBSTR(jsString), false);
+}
+
+void LayoutTestController::whiteListAccessFromOrigin(JSStringRef sourceOrigin, JSStringRef destinationProtocol, JSStringRef destinationHost, bool allowDestinationSubdomains)
+{
+    COMPtr<IWebViewPrivate> webView;
+    if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
+        return;
+
+    webView->whiteListAccessFromOrigin(bstrT(sourceOrigin).GetBSTR(), bstrT(destinationProtocol).GetBSTR(), bstrT(destinationHost).GetBSTR(), allowDestinationSubdomains);
+}
+
+void LayoutTestController::addUserScript(JSStringRef source, bool runAtStart)
+{
+    COMPtr<IWebViewPrivate> webView;
+    if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
+        return;
+
+    webView->addUserScriptToGroup(_bstr_t(L"org.webkit.DumpRenderTree").GetBSTR(), 1, bstrT(source).GetBSTR(), 0, 0, 0, 0, 0, runAtStart ? WebInjectAtDocumentStart : WebInjectAtDocumentEnd);
+}
+
+
+void LayoutTestController::addUserStyleSheet(JSStringRef source)
+{
+    COMPtr<IWebViewPrivate> webView;
+    if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
+        return;
+
+    webView->addUserStyleSheetToGroup(_bstr_t(L"org.webkit.DumpRenderTree").GetBSTR(), 1, bstrT(source).GetBSTR(), 0, 0, 0, 0, 0);
+}
+
+void LayoutTestController::showWebInspector()
+{
+    COMPtr<IWebViewPrivate> webView;
+    if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
+        return;
+
+    COMPtr<IWebInspector> inspector;
+    if (SUCCEEDED(webView->inspector(&inspector)))
+        inspector->show();
+}
+
+void LayoutTestController::closeWebInspector()
+{
+    COMPtr<IWebViewPrivate> webView;
+    if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
+        return;
+
+    COMPtr<IWebInspector> inspector;
+    if (SUCCEEDED(webView->inspector(&inspector)))
+        inspector->close();
+}
+
+void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef script)
+{
+    COMPtr<IWebViewPrivate> webView;
+    if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
+        return;
+
+    COMPtr<IWebInspector> inspector;
+    if (FAILED(webView->inspector(&inspector)))
+        return;
+
+    COMPtr<IWebInspectorPrivate> inspectorPrivate(Query, inspector);
+    if (!inspectorPrivate)
+        return;
+
+    inspectorPrivate->evaluateInFrontend(callId, bstrT(script).GetBSTR());
+}
diff --git a/WebKitTools/DumpRenderTree/win/ResourceLoadDelegate.cpp b/WebKitTools/DumpRenderTree/win/ResourceLoadDelegate.cpp
index 06476e7..0edf69b 100644
--- a/WebKitTools/DumpRenderTree/win/ResourceLoadDelegate.cpp
+++ b/WebKitTools/DumpRenderTree/win/ResourceLoadDelegate.cpp
@@ -31,10 +31,13 @@
 
 #include "DumpRenderTree.h"
 #include "LayoutTestController.h"
+#include <comutil.h>
+#include <WebKit/WebKitCOMAPI.h>
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
 #include <sstream>
 
+
 using std::wstring;
 using std::wiostream;
 
@@ -251,6 +254,33 @@ HRESULT STDMETHODCALLTYPE ResourceLoadDelegate::willSendRequest(
     return S_OK;
 }
 
+HRESULT STDMETHODCALLTYPE ResourceLoadDelegate::didReceiveAuthenticationChallenge( 
+    /* [in] */ IWebView *webView,
+    /* [in] */ unsigned long identifier,
+    /* [in] */ IWebURLAuthenticationChallenge *challenge,
+    /* [in] */ IWebDataSource *dataSource)
+{
+    if (!gLayoutTestController->handlesAuthenticationChallenges())
+        return E_FAIL;
+    
+    const char* user = gLayoutTestController->authenticationUsername().c_str();
+    const char* password = gLayoutTestController->authenticationPassword().c_str();
+
+    printf("%S - didReceiveAuthenticationChallenge - Responding with %s:%s\n", descriptionSuitableForTestResult(identifier).c_str(), user, password);
+    
+    COMPtr<IWebURLAuthenticationChallengeSender> sender;
+    if (!challenge || FAILED(challenge->sender(&sender)))
+        return E_FAIL;
+        
+    COMPtr<IWebURLCredential> credential;
+    if (FAILED(WebKitCreateInstance(CLSID_WebURLCredential, 0, IID_IWebURLCredential, (void**)&credential)))
+        return E_FAIL;
+    credential->initWithUser(_bstr_t(user), _bstr_t(password), WebURLCredentialPersistenceForSession);
+
+    sender->useCredential(credential.get(), challenge);
+    return S_OK;
+}
+
 HRESULT STDMETHODCALLTYPE ResourceLoadDelegate::didReceiveResponse(
     /* [in] */ IWebView* webView, 
     /* [in] */ unsigned long identifier, 
diff --git a/WebKitTools/DumpRenderTree/win/ResourceLoadDelegate.h b/WebKitTools/DumpRenderTree/win/ResourceLoadDelegate.h
index c708147..924727b 100644
--- a/WebKitTools/DumpRenderTree/win/ResourceLoadDelegate.h
+++ b/WebKitTools/DumpRenderTree/win/ResourceLoadDelegate.h
@@ -60,7 +60,7 @@ public:
         /* [in] */ IWebView *webView,
         /* [in] */ unsigned long identifier,
         /* [in] */ IWebURLAuthenticationChallenge *challenge,
-        /* [in] */ IWebDataSource *dataSource) { return E_NOTIMPL; }
+        /* [in] */ IWebDataSource *dataSource);
         
     virtual HRESULT STDMETHODCALLTYPE didCancelAuthenticationChallenge( 
         /* [in] */ IWebView *webView,
diff --git a/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj b/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj
index 5ccd6ce..0e0918d 100644
--- a/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj
+++ b/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj
@@ -23,7 +23,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -93,7 +93,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -162,7 +162,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -224,6 +224,75 @@
 				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_Cairo|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_wincairo.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(ProjectDir)..\..\TestNetscapePlugin.subproj&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				PreprocessorDefinitions="_USRDLL;TESTNETSCAPEPLUGIN_EXPORTS;snprintf=_snprintf"

+				DisableSpecificWarnings="4819"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+				AdditionalIncludeDirectories=""

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix)\np$(ProjectName)$(WebKitConfigSuffix).dll"

+				ModuleDefinitionFile="TestNetscapePlugin$(WebKitConfigSuffix).def"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

diff --git a/WebKitTools/DumpRenderTree/win/UIDelegate.cpp b/WebKitTools/DumpRenderTree/win/UIDelegate.cpp
index 63f5441..b78fd3e 100755
--- a/WebKitTools/DumpRenderTree/win/UIDelegate.cpp
+++ b/WebKitTools/DumpRenderTree/win/UIDelegate.cpp
@@ -33,6 +33,7 @@
 #include "DraggingInfo.h"
 #include "EventSender.h"
 #include "LayoutTestController.h"
+#include "DRTDesktopNotificationPresenter.h"
 
 #include <WebCore/COMPtr.h>
 #include <wtf/Platform.h>
@@ -155,6 +156,7 @@ void DRTUndoManager::undo()
 UIDelegate::UIDelegate()
     : m_refCount(1)
     , m_undoManager(new DRTUndoManager)
+    , m_desktopNotifications(new DRTDesktopNotificationPresenter)
 {
     m_frame.bottom = 0;
     m_frame.top = 0;
@@ -174,6 +176,8 @@ HRESULT STDMETHODCALLTYPE UIDelegate::QueryInterface(REFIID riid, void** ppvObje
         *ppvObject = static_cast<IWebUIDelegate*>(this);
     else if (IsEqualGUID(riid, IID_IWebUIDelegate))
         *ppvObject = static_cast<IWebUIDelegate*>(this);
+    else if (IsEqualGUID(riid, IID_IWebUIDelegate2))
+        *ppvObject = static_cast<IWebUIDelegate2*>(this);
     else if (IsEqualGUID(riid, IID_IWebUIDelegatePrivate))
         *ppvObject = static_cast<IWebUIDelegatePrivate*>(this);
     else
@@ -499,6 +503,11 @@ HRESULT STDMETHODCALLTYPE UIDelegate::doDragDrop(
 
     draggingInfo = new DraggingInfo(object, source);
     replaySavedEvents();
+    if (draggingInfo) {
+        *performedEffect = draggingInfo->performedDropEffect();
+        delete draggingInfo;
+        draggingInfo = 0;
+    }
     return S_OK;
 }
 
@@ -561,6 +570,20 @@ HRESULT STDMETHODCALLTYPE UIDelegate::exceededDatabaseQuota(
         /* [in] */ IWebSecurityOrigin *origin,
         /* [in] */ BSTR databaseIdentifier)
 {
+    BSTR protocol;
+    BSTR host;
+    unsigned short port;
+
+    origin->protocol(&protocol);
+    origin->host(&host);
+    origin->port(&port);
+
+    if (!done && gLayoutTestController->dumpDatabaseCallbacks())
+        printf("UI DELEGATE DATABASE CALLBACK: exceededDatabaseQuotaForSecurityOrigin:{%S, %S, %i} database:%S\n", protocol, host, port, databaseIdentifier);
+
+    SysFreeString(protocol);
+    SysFreeString(host);
+
     static const unsigned long long defaultQuota = 5 * 1024 * 1024;
     origin->setQuota(defaultQuota);
 
@@ -604,3 +627,9 @@ HRESULT STDMETHODCALLTYPE UIDelegate::setStatusText(IWebView*, BSTR text)
         printf("UI DELEGATE STATUS CALLBACK: setStatusText:%S\n", text ? text : L"");
     return S_OK;
 }
+
+HRESULT STDMETHODCALLTYPE UIDelegate::desktopNotificationsDelegate(IWebDesktopNotificationsDelegate** result)
+{
+    m_desktopNotifications.copyRefTo(result);
+    return S_OK;
+}
diff --git a/WebKitTools/DumpRenderTree/win/UIDelegate.h b/WebKitTools/DumpRenderTree/win/UIDelegate.h
index 853031f..436e31a 100755
--- a/WebKitTools/DumpRenderTree/win/UIDelegate.h
+++ b/WebKitTools/DumpRenderTree/win/UIDelegate.h
@@ -29,13 +29,15 @@
 #ifndef UIDelegate_h
 #define UIDelegate_h
 
+#include <WebCore/COMPtr.h>
 #include <WebKit/WebKit.h>
 #include <wtf/OwnPtr.h>
 #include <windef.h>
 
 class DRTUndoManager;
+class DRTDesktopNotificationPresenter;
 
-class UIDelegate : public IWebUIDelegate, IWebUIDelegatePrivate {
+class UIDelegate : public IWebUIDelegate2, IWebUIDelegatePrivate {
 public:
     UIDelegate();
 
@@ -326,20 +328,11 @@ public:
 protected:
     // IWebUIDelegatePrivate
 
-    virtual HRESULT STDMETHODCALLTYPE webViewResizerRect( 
-        /* [in] */ IWebView *sender,
-        /* [retval][out] */ RECT *rect) { return E_NOTIMPL; }
+    virtual HRESULT STDMETHODCALLTYPE unused1() { return E_NOTIMPL; }
 
-    virtual HRESULT STDMETHODCALLTYPE webViewSendResizeMessage( 
-        /* [in] */ UINT uMsg,
-        /* [in] */ WPARAM wParam,
-        /* [in] */ LPARAM lParam) { return E_NOTIMPL; }
+    virtual HRESULT STDMETHODCALLTYPE unused2() { return E_NOTIMPL; }
     
-    virtual HRESULT STDMETHODCALLTYPE webViewDrawResizer( 
-        /* [in] */ IWebView *sender,
-        /* [in] */ HDC dc,
-        /* [in] */ BOOL overlapsContent,
-        /* [in] */ RECT *rect) { return E_NOTIMPL; }
+    virtual HRESULT STDMETHODCALLTYPE unused3() { return E_NOTIMPL; }
     
     virtual HRESULT STDMETHODCALLTYPE webViewScrolled( 
         /* [in] */ IWebView *sender) { return E_NOTIMPL; }
@@ -399,11 +392,16 @@ protected:
     virtual HRESULT STDMETHODCALLTYPE webViewDidInvalidate( 
         /* [in] */ IWebView *sender);
 
+    virtual HRESULT STDMETHODCALLTYPE desktopNotificationsDelegate(
+        /* [out] */ IWebDesktopNotificationsDelegate** result);
+
     ULONG                   m_refCount;
 
 private:
     RECT m_frame;
     OwnPtr<DRTUndoManager> m_undoManager;
+
+    COMPtr<IWebDesktopNotificationsDelegate> m_desktopNotifications;
 };
 
 #endif
diff --git a/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp b/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
index fa7e541..bfe1d99 100644
--- a/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
+++ b/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
@@ -100,6 +100,11 @@ void LayoutTestController::setAcceptsEditing(bool acceptsEditing)
 {
 }
 
+void LayoutTestController::setAlwaysAcceptCookies(bool alwaysAcceptCookies)
+{
+    // FIXME: Implement this (and restore the default value before running each test in DumpRenderTree.cpp).
+}
+
 void LayoutTestController::setCustomPolicyDelegate(bool, bool)
 {
     // FIXME: implement
@@ -217,6 +222,12 @@ unsigned LayoutTestController::numberOfActiveAnimations() const
     return 0;
 }
 
+unsigned LayoutTestController::workerThreadCount() const
+{
+    // FIXME: implement
+    return 0;
+}
+
 void LayoutTestController::setSelectTrailingWhitespaceEnabled(bool flag)
 {
     // FIXME: implement
@@ -228,6 +239,18 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(JSStringRef prop
     return false;
 }
 
+void LayoutTestController::setMockGeolocationPosition(double latitude, double longitude, double accuracy)
+{
+    // FIXME: Implement for Geolocation layout tests.
+    // See https://bugs.webkit.org/show_bug.cgi?id=28264.
+}
+
+void LayoutTestController::setMockGeolocationError(int code, JSStringRef message)
+{
+    // FIXME: Implement for Geolocation layout tests.
+    // See https://bugs.webkit.org/show_bug.cgi?id=28264.
+}
+
 void LayoutTestController::setIconDatabaseEnabled(bool iconDatabaseEnabled)
 {
     // FIXME: implement
@@ -260,3 +283,33 @@ void LayoutTestController::waitForPolicyDelegate()
 {
     // FIXME: Implement this.
 }
+
+void LayoutTestController::overridePreference(JSStringRef /* key */, JSStringRef /* value */)
+{
+    // FIXME: implement
+}
+
+void LayoutTestController::addUserScript(JSStringRef source, bool runAtStart)
+{
+    printf("LayoutTestController::addUserScript not implemented.\n");
+}
+
+void LayoutTestController::addUserStyleSheet(JSStringRef source)
+{
+    printf("LayoutTestController::addUserStyleSheet not implemented.\n");
+}
+
+void LayoutTestController::showWebInspector()
+{
+    // FIXME: Implement this.
+}
+
+void LayoutTestController::closeWebInspector()
+{
+    // FIXME: Implement this.
+}
+
+void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef script)
+{
+    // FIXME: Implement this.
+}
diff --git a/WebKitTools/GNUmakefile.am b/WebKitTools/GNUmakefile.am
index 487a479..c2029f3 100644
--- a/WebKitTools/GNUmakefile.am
+++ b/WebKitTools/GNUmakefile.am
@@ -60,6 +60,8 @@ Programs_DumpRenderTree_SOURCES = \
 	WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp \
 	WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp \
 	WebKitTools/DumpRenderTree/gtk/DumpRenderTreeGtk.h \
+	WebKitTools/DumpRenderTree/gtk/EventSender.h \
+	WebKitTools/DumpRenderTree/gtk/EventSender.cpp \
 	WebKitTools/DumpRenderTree/gtk/GCControllerGtk.cpp \
 	WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp \
 	WebKitTools/DumpRenderTree/gtk/WorkQueueItemGtk.cpp
@@ -85,7 +87,8 @@ Programs_DumpRenderTree_LDADD = \
 	$(CAIRO_LIBS) \
 	$(GTK_LIBS) \
 	$(GLIB_LIBS) \
-	$(LIBSOUP_LIBS)
+	$(LIBSOUP_LIBS) \
+	$(FREETYPE_LIBS)
 
 Programs_DumpRenderTree_LDFLAGS = \
 	-no-fast-install \
@@ -105,7 +108,8 @@ noinst_LTLIBRARIES += \
 	TestNetscapePlugin/libtestnetscapeplugin.la
 
 dumprendertree_cppflags += \
-	-DTEST_PLUGIN_DIR=\"${shell pwd}/${top_builddir}/TestNetscapePlugin/.libs\"
+	-DTEST_PLUGIN_DIR=\"${shell pwd}/${top_builddir}/TestNetscapePlugin/.libs\" \
+	-DFONTS_CONF_FILE=\"${shell pwd}/${srcdir}/WebKitTools/DumpRenderTree/gtk/fonts.conf\"
 
 TestNetscapePlugin_libtestnetscapeplugin_la_CPPFLAGS = \
 	-I$(srcdir)/WebKitTools/DumpRenderTree \
diff --git a/WebKitTools/Scripts/VCSUtils.pm b/WebKitTools/Scripts/VCSUtils.pm
index 571487d..6ec12c9 100644
--- a/WebKitTools/Scripts/VCSUtils.pm
+++ b/WebKitTools/Scripts/VCSUtils.pm
@@ -25,6 +25,7 @@
 # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 # Module to share code to work with various version control systems.
+package VCSUtils;
 
 use strict;
 use warnings;
@@ -34,21 +35,37 @@ use File::Basename;
 use File::Spec;
 
 BEGIN {
-   use Exporter   ();
-   our ($VERSION, @ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS);
-   $VERSION     = 1.00;
-   @ISA         = qw(Exporter);
-   @EXPORT      = qw(&chdirReturningRelativePath &determineSVNRoot &determineVCSRoot &isGit &isGitDirectory &isSVN &isSVNDirectory &makeFilePathRelative);
-   %EXPORT_TAGS = ( );
-   @EXPORT_OK   = ();
+    use Exporter   ();
+    our ($VERSION, @ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS);
+    $VERSION     = 1.00;
+    @ISA         = qw(Exporter);
+    @EXPORT      = qw(
+        &chdirReturningRelativePath
+        &determineSVNRoot
+        &determineVCSRoot
+        &gitBranch
+        &isGit
+        &isGitBranchBuild
+        &isGitDirectory
+        &isSVN
+        &isSVNDirectory
+        &isSVNVersion16OrNewer
+        &makeFilePathRelative
+        &pathRelativeToSVNRepositoryRootForPath
+        &svnRevisionForDirectory
+    );
+    %EXPORT_TAGS = ( );
+    @EXPORT_OK   = ();
 }
 
 our @EXPORT_OK;
 
-my $isGit;
-my $isSVN;
 my $gitBranch;
+my $gitRoot;
+my $isGit;
 my $isGitBranchBuild;
+my $isSVN;
+my $svnVersion;
 
 sub isGitDirectory($)
 {
@@ -68,7 +85,7 @@ sub gitBranch()
 {
     unless (defined $gitBranch) {
         chomp($gitBranch = `git symbolic-ref -q HEAD`);
-        $gitBranch = "" if exitStatus($?);
+        $gitBranch = "" if main::exitStatus($?); # FIXME: exitStatus is defined in webkitdirs.pm
         $gitBranch =~ s#^refs/heads/##;
         $gitBranch = "" if $gitBranch eq "master";
     }
@@ -106,6 +123,24 @@ sub isSVN()
     return $isSVN;
 }
 
+sub svnVersion()
+{
+    return $svnVersion if defined $svnVersion;
+
+    if (!isSVN()) {
+        $svnVersion = 0;
+    } else {
+        chomp($svnVersion = `svn --version --quiet`);
+    }
+    return $svnVersion;
+}
+
+sub isSVNVersion16OrNewer()
+{
+    my $version = svnVersion();
+    return eval "v$version" ge v1.6;
+}
+
 sub chdirReturningRelativePath($)
 {
     my ($directory) = @_;
@@ -128,28 +163,38 @@ sub determineSVNRoot()
     my $last = '';
     my $path = '.';
     my $parent = '..';
+    my $repositoryRoot;
     my $repositoryUUID;
     while (1) {
+        my $thisRoot;
         my $thisUUID;
         # Ignore error messages in case we've run past the root of the checkout.
         open INFO, "svn info '$path' 2> $devNull |" or die;
         while (<INFO>) {
+            if (/^Repository Root: (.+)/) {
+                $thisRoot = $1;
+            }
             if (/^Repository UUID: (.+)/) {
                 $thisUUID = $1;
-                { local $/ = undef; <INFO>; }  # Consume the rest of the input.
+            }
+            if ($thisRoot && $thisUUID) {
+                local $/ = undef;
+                <INFO>; # Consume the rest of the input.
             }
         }
         close INFO;
 
         # It's possible (e.g. for developers of some ports) to have a WebKit
         # checkout in a subdirectory of another checkout.  So abort if the
-        # repository UUID suddenly changes.
+        # repository root or the repository UUID suddenly changes.
         last if !$thisUUID;
-        if (!$repositoryUUID) {
-            $repositoryUUID = $thisUUID;
-        }
+        $repositoryUUID = $thisUUID if !$repositoryUUID;
         last if $thisUUID ne $repositoryUUID;
 
+        last if !$thisRoot;
+        $repositoryRoot = $thisRoot if !$repositoryRoot;
+        last if $thisRoot ne $repositoryRoot;
+
         $last = $path;
         $path = File::Spec->catdir($parent, $path);
     }
@@ -162,10 +207,16 @@ sub determineVCSRoot()
     if (isGit()) {
         return determineGitRoot();
     }
-    if (isSVN()) {
-        return determineSVNRoot();
+
+    if (!isSVN()) {
+        # Some users have a workflow where svn-create-patch, svn-apply and
+        # svn-unapply are used outside of multiple svn working directores,
+        # so warn the user and assume Subversion is being used in this case.
+        warn "Unable to determine VCS root; assuming Subversion";
+        $isSVN = 1;
     }
-    die "Unable to determine VCS root";
+
+    return determineSVNRoot();
 }
 
 sub svnRevisionForDirectory($)
@@ -206,8 +257,6 @@ sub pathRelativeToSVNRepositoryRootForPath($)
     return $svnURL;
 }
 
-
-my $gitRoot;
 sub makeFilePathRelative($)
 {
     my ($path) = @_;
diff --git a/WebKitTools/Scripts/bisect-builds b/WebKitTools/Scripts/bisect-builds
index 34230a9..93e9223 100755
--- a/WebKitTools/Scripts/bisect-builds
+++ b/WebKitTools/Scripts/bisect-builds
@@ -209,7 +209,7 @@ sub createTempFile($)
 
     my ($fh, $tempFile) = tempfile(
         basename($0) . "-XXXXXXXX",
-        DIR => File::Spec->tmpdir,
+        DIR => File::Spec->tmpdir(),
         SUFFIX => ".html",
         UNLINK => 0,
     );
diff --git a/WebKitTools/Scripts/bugzilla-tool b/WebKitTools/Scripts/bugzilla-tool
index b3c0d67..ec5aa0d 100755
--- a/WebKitTools/Scripts/bugzilla-tool
+++ b/WebKitTools/Scripts/bugzilla-tool
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 # Copyright (c) 2009, Google Inc. All rights reserved.
 # Copyright (c) 2009 Apple Inc. All rights reserved.
 #
@@ -30,19 +30,24 @@
 #
 # A tool for automating dealing with bugzilla, posting patches, committing patches, etc.
 
-import fileinput # inplace file editing for set_reviewer_in_changelog
 import os
 import re
 import StringIO # for add_patch_to_bug file wrappers
 import subprocess
 import sys
+import time
 
+from datetime import datetime, timedelta
 from optparse import OptionParser, IndentedHelpFormatter, SUPPRESS_USAGE, make_option
 
 # Import WebKit-specific modules.
-from modules.bugzilla import Bugzilla
-from modules.logging import error, log
-from modules.scm import CommitMessage, detect_scm_system, ScriptError
+from modules.bugzilla import Bugzilla, parse_bug_id
+from modules.changelogs import ChangeLog
+from modules.comments import bug_comment_from_commit_text
+from modules.logging import error, log, tee
+from modules.scm import CommitMessage, detect_scm_system, ScriptError, CheckoutNeedsUpdate
+from modules.buildbot import BuildBot
+from modules.statusbot import StatusBot
 
 def plural(noun):
     # This is a dumb plural() implementation which was just enough for our uses.
@@ -56,70 +61,21 @@ def pluralize(noun, count):
         noun = plural(noun)
     return "%d %s" % (count, noun)
 
-# These could be put in some sort of changelogs.py.
-def latest_changelog_entry(changelog_path):
-    # e.g. 2009-06-03  Eric Seidel  <eric@webkit.org>
-    changelog_date_line_regexp = re.compile('^(\d{4}-\d{2}-\d{2})' # Consume the date.
-                                  + '\s+(.+)\s+' # Consume the name.
-                                  + '<([^<>]+)>$') # And finally the email address.
-    
-    entry_lines = []
-    changelog = open(changelog_path)
-    try:
-        log("Parsing ChangeLog: " + changelog_path)
-        # The first line should be a date line.
-        first_line = changelog.readline()
-        if not changelog_date_line_regexp.match(first_line):
-            return None
-        entry_lines.append(first_line)
-        
-        for line in changelog:
-            # If we've hit the next entry, return.
-            if changelog_date_line_regexp.match(line):
-                return ''.join(entry_lines)
-            entry_lines.append(line)
-    finally:
-        changelog.close()
-    # We never found a date line!
-    return None
-
-def set_reviewer_in_changelog(changelog_path, reviewer):
-    # inplace=1 creates a backup file and re-directs stdout to the file
-    for line in fileinput.FileInput(changelog_path, inplace=1):
-        print line.replace("NOBODY (OOPS!)", reviewer.encode("utf-8")), # Trailing comma suppresses printing newline
-
-def modified_changelogs(scm):
-    changelog_paths = []
-    paths = scm.changed_files()
-    for path in paths:
-        if os.path.basename(path) == "ChangeLog":
-            changelog_paths.append(path)
-    return changelog_paths
-
-def parse_bug_id(commit_message):
-    message = commit_message.message()
-    match = re.search("http\://webkit\.org/b/(?P<bug_id>\d+)", message)
-    if match:
-        return match.group('bug_id')
-    match = re.search(Bugzilla.bug_server_regex + "show_bug\.cgi\?id=(?P<bug_id>\d+)", message)
-    if match:
-        return match.group('bug_id')
-    return None
-
 def commit_message_for_this_commit(scm):
-    changelog_paths = modified_changelogs(scm)
+    changelog_paths = scm.modified_changelogs()
     if not len(changelog_paths):
-        raise ScriptError("Found no modified ChangeLogs, cannot create a commit message.\n"
+        raise ScriptError(message="Found no modified ChangeLogs, cannot create a commit message.\n"
                           "All changes require a ChangeLog.  See:\n"
                           "http://webkit.org/coding/contributing.html")
 
     changelog_messages = []
-    for path in changelog_paths:
-        changelog_entry = latest_changelog_entry(path)
+    for changelog_path in changelog_paths:
+        log("Parsing ChangeLog: %s" % changelog_path)
+        changelog_entry = ChangeLog(changelog_path).latest_entry()
         if not changelog_entry:
-            error("Failed to parse ChangeLog: " + os.path.abspath(path))
+            error("Failed to parse ChangeLog: " + os.path.abspath(changelog_path))
         changelog_messages.append(changelog_entry)
-    
+
     # FIXME: We should sort and label the ChangeLog messages like commit-log-editor does.
     return CommitMessage(''.join(changelog_messages).splitlines())
 
@@ -183,10 +139,9 @@ class ApplyPatchesFromBug(Command):
     def __init__(self):
         options = [
             make_option("--no-update", action="store_false", dest="update", default=True, help="Don't update the working directory before applying patches"),
-            make_option("--force-clean", action="store_true", dest="force_clean", default=False, help="Clean working directory before applying patches (removes local changes and commits)"),
-            make_option("--no-clean", action="store_false", dest="clean", default=True, help="Don't check if the working directory is clean before applying patches"),
             make_option("--local-commit", action="store_true", dest="local_commit", default=False, help="Make a local commit for each applied patch"),
         ]
+        options += WebKitLandingScripts.cleaning_options()
         Command.__init__(self, 'Applies all patches on a bug to the local working directory without committing.', 'BUGID', options=options)
 
     @staticmethod
@@ -212,23 +167,110 @@ class ApplyPatchesFromBug(Command):
         self.apply_patches(patches, tool.scm(), options.local_commit)
 
 
-def bug_comment_from_commit_text(scm, commit_text):
-    match = re.search(scm.commit_success_regexp(), commit_text, re.MULTILINE)
-    svn_revision = match.group('svn_revision')
-    commit_text += ("\nhttp://trac.webkit.org/changeset/%s" % svn_revision)
-    return commit_text
-
+class WebKitLandingScripts:
+    @staticmethod
+    def cleaning_options():
+        return [
+            make_option("--force-clean", action="store_true", dest="force_clean", default=False, help="Clean working directory before applying patches (removes local changes and commits)"),
+            make_option("--no-clean", action="store_false", dest="clean", default=True, help="Don't check if the working directory is clean before applying patches"),
+        ]
 
-class LandAndUpdateBug(Command):
-    def __init__(self):
-        options = [
-            make_option("-r", "--reviewer", action="store", type="string", dest="reviewer", help="Update ChangeLogs to say Reviewed by REVIEWER."),
+    @staticmethod
+    def land_options():
+        return [
+            make_option("--ignore-builders", action="store_false", dest="check_builders", default=True, help="Don't check to see if the build.webkit.org builders are green before landing."),
             make_option("--no-close", action="store_false", dest="close_bug", default=True, help="Leave bug open after landing."),
             make_option("--no-build", action="store_false", dest="build", default=True, help="Commit without building first, implies --no-test."),
             make_option("--no-test", action="store_false", dest="test", default=True, help="Commit without running run-webkit-tests."),
             make_option("--quiet", action="store_true", dest="quiet", default=False, help="Produce less console output."),
             make_option("--commit-queue", action="store_true", dest="commit_queue", default=False, help="Run in commit queue mode (no user interaction)."),
         ]
+
+    @staticmethod
+    def run_command_with_teed_output(args, teed_output):
+        child_process = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+
+        # Use our own custom wait loop because Popen ignores a tee'd stderr/stdout.
+        # FIXME: This could be improved not to flatten output to stdout.
+        while True:
+            output_line = child_process.stdout.readline()
+            if output_line == '' and child_process.poll() != None:
+                return child_process.poll()
+            teed_output.write(output_line)
+
+    @staticmethod
+    def run_and_throw_if_fail(args, quiet=False):
+        # Cache the child's output locally so it can be used for error reports.
+        child_out_file = StringIO.StringIO()
+        if quiet:
+            dev_null = open(os.devnull, "w")
+        child_stdout = tee(child_out_file, dev_null if quiet else sys.stdout)
+        exit_code = WebKitLandingScripts.run_command_with_teed_output(args, child_stdout)
+        if quiet:
+            dev_null.close()
+
+        child_output = child_out_file.getvalue()
+        child_out_file.close()
+
+        if exit_code:
+            raise ScriptError(script_args=args, exit_code=exit_code, output=child_output)
+
+    # We might need to pass scm into this function for scm.checkout_root
+    @staticmethod
+    def webkit_script_path(script_name):
+        return os.path.join("WebKitTools", "Scripts", script_name)
+
+    @classmethod
+    def run_webkit_script(cls, script_name, quiet=False):
+        log("Running %s" % script_name)
+        cls.run_and_throw_if_fail(cls.webkit_script_path(script_name), quiet)
+
+    @classmethod
+    def build_webkit(cls, quiet=False):
+        cls.run_webkit_script("build-webkit", quiet)
+
+    @staticmethod
+    def ensure_builders_are_green(buildbot, options):
+        if not options.check_builders or buildbot.core_builders_are_green():
+            return
+        error("Builders at %s are red, please do not commit.  Pass --ignore-builders to bypass this check." % (buildbot.buildbot_host))
+
+    @classmethod
+    def run_webkit_tests(cls, launch_safari, fail_fast=False, quiet=False):
+        args = [cls.webkit_script_path("run-webkit-tests")]
+        if not launch_safari:
+            args.append("--no-launch-safari")
+        if quiet:
+            args.append("--quiet")
+        if fail_fast:
+            args.append("--exit-after-n-failures=1")
+        cls.run_and_throw_if_fail(args)
+
+    @staticmethod
+    def setup_for_landing(scm, options):
+        os.chdir(scm.checkout_root)
+        scm.ensure_no_local_commits(options.force_clean)
+        if options.clean:
+            scm.ensure_clean_working_directory(options.force_clean)
+
+    @classmethod
+    def build_and_commit(cls, scm, options):
+        if options.build:
+            cls.build_webkit(quiet=options.quiet)
+            if options.test:
+                # When running the commit-queue we don't want to launch Safari and we want to exit after the first failure.
+                cls.run_webkit_tests(launch_safari=not options.commit_queue, fail_fast=options.commit_queue, quiet=options.quiet)
+        commit_message = commit_message_for_this_commit(scm)
+        commit_log = scm.commit_with_message(commit_message.message())
+        return bug_comment_from_commit_text(scm, commit_log)
+
+
+class LandAndUpdateBug(Command):
+    def __init__(self):
+        options = [
+            make_option("-r", "--reviewer", action="store", type="string", dest="reviewer", help="Update ChangeLogs to say Reviewed by REVIEWER."),
+        ]
+        options += WebKitLandingScripts.land_options()
         Command.__init__(self, 'Lands the current working directory diff and updates the bug if provided.', '[BUGID]', options=options)
 
     def guess_reviewer_from_bug(self, bugs, bug_id):
@@ -252,17 +294,18 @@ class LandAndUpdateBug(Command):
             log("Failed to guess reviewer from bug %s and --reviewer= not provided.  Not updating ChangeLogs with reviewer." % bug_id)
             return
 
-        changelogs = modified_changelogs(tool.scm())
-        for changelog in changelogs:
-            set_reviewer_in_changelog(changelog, reviewer)
+        for changelog_path in tool.scm().modified_changelogs():
+            ChangeLog(changelog_path).set_reviewer(reviewer)
 
     def execute(self, options, args, tool):
         bug_id = args[0] if len(args) else None
         os.chdir(tool.scm().checkout_root)
 
+        WebKitLandingScripts.ensure_builders_are_green(tool.buildbot, options)
+
         self.update_changelogs_with_reviewer(options.reviewer, bug_id, tool)
 
-        comment_text = LandPatchesFromBugs.build_and_commit(tool.scm(), options)
+        comment_text = WebKitLandingScripts.build_and_commit(tool.scm(), options)
         if bug_id:
             log("Updating bug %s" % bug_id)
             if options.close_bug:
@@ -278,104 +321,66 @@ class LandAndUpdateBug(Command):
 
 class LandPatchesFromBugs(Command):
     def __init__(self):
-        options = [
-            make_option("--force-clean", action="store_true", dest="force_clean", default=False, help="Clean working directory before applying patches (removes local changes and commits)"),
-            make_option("--no-clean", action="store_false", dest="clean", default=True, help="Don't check if the working directory is clean before applying patches"),
-            make_option("--no-close", action="store_false", dest="close_bug", default=True, help="Leave bug open after landing."),
-            make_option("--no-build", action="store_false", dest="build", default=True, help="Commit without building first, implies --no-test."),
-            make_option("--no-test", action="store_false", dest="test", default=True, help="Commit without running run-webkit-tests."),
-            make_option("--quiet", action="store_true", dest="quiet", default=False, help="Produce less console output."),
-            make_option("--commit-queue", action="store_true", dest="commit_queue", default=False, help="Run in commit queue mode (no user interaction)."),
-        ]
+        options = WebKitLandingScripts.cleaning_options()
+        options += WebKitLandingScripts.land_options()
         Command.__init__(self, 'Lands all patches on a bug optionally testing them first', 'BUGID', options=options)
 
-    @staticmethod
-    def run_and_throw_if_fail(args, quiet=False):
-        child_stdout = subprocess.PIPE if quiet else None
-        child_process = subprocess.Popen(args, stdout=child_stdout)
-        if child_process.stdout:
-            child_process.communicate()
-        return_code = child_process.wait()
-        if return_code:
-            raise ScriptError("%s failed with exit code %d" % (" ".join(args), return_code))
-
-    # We might need to pass scm into this function for scm.checkout_root
-    @staticmethod
-    def webkit_script_path(script_name):
-        return os.path.join("WebKitTools", "Scripts", script_name)
-
-    @classmethod
-    def run_webkit_script(cls, script_name, quiet=False):
-        print "Running WebKit Script " + script_name
-        cls.run_and_throw_if_fail(cls.webkit_script_path(script_name), quiet)
-
-    @classmethod
-    def build_webkit(cls, quiet=False):
-        cls.run_webkit_script("build-webkit", quiet)
-
-    @classmethod
-    def run_webkit_tests(cls, launch_safari, quiet=False):
-        args = [cls.webkit_script_path("run-webkit-tests")]
-        if not launch_safari:
-            args.append("--no-launch-safari")
-        if quiet:
-            args.append("--quiet")
-        cls.run_and_throw_if_fail(args)
-
-    @staticmethod
-    def setup_for_landing(scm, options):
-        os.chdir(scm.checkout_root)
-        scm.ensure_no_local_commits(options.force_clean)
-        if options.clean:
-            scm.ensure_clean_working_directory(options.force_clean)
-
-    @classmethod
-    def build_and_commit(cls, scm, options):
-        if options.build:
-            cls.build_webkit(quiet=options.quiet)
-            if options.test:
-                cls.run_webkit_tests(launch_safari=not options.commit_queue, quiet=options.quiet)
-        commit_message = commit_message_for_this_commit(scm)
-        commit_log = scm.commit_with_message(commit_message.message())
-        return bug_comment_from_commit_text(scm, commit_log)
-
     @classmethod
     def land_patches(cls, bug_id, patches, options, tool):
         try:
             comment_text = ""
             for patch in patches:
                 tool.scm().update_webkit() # Update before every patch in case the tree has changed
+                log("Applying %s from bug %s." % (patch['id'], bug_id))
                 tool.scm().apply_patch(patch, force=options.commit_queue)
-                comment_text = cls.build_and_commit(tool.scm(), options)
-                tool.bugs.clear_attachment_review_flag(patch['id'], comment_text)
+                # Make sure the tree is still green after updating, before building this patch.
+                # The first patch ends up checking tree status twice, but that's OK.
+                WebKitLandingScripts.ensure_builders_are_green(tool.buildbot, options)
+                comment_text = WebKitLandingScripts.build_and_commit(tool.scm(), options)
+                tool.bugs.clear_attachment_flags(patch['id'], comment_text)
 
             if options.close_bug:
                 tool.bugs.close_bug_as_fixed(bug_id, "All reviewed patches have been landed.  Closing bug.")
+        except CheckoutNeedsUpdate, e:
+            log("Commit was rejected because the checkout is out of date.  Please update and try again.")
+            log("You can pass --no-build to skip building/testing after update if you believe the new commits did not affect the results.")
+            error(e)
         except ScriptError, e:
-            # We should add a comment to the bug, and r- the patch on failure
+            # Mark the patch as commit-queue- and comment in the bug.
+            tool.bugs.reject_patch_from_commit_queue(patch['id'], e.message_with_output())
             error(e)
 
-    def execute(self, options, args, tool):
-        if not len(args):
-            error("bug-id(s) required")
-
+    @staticmethod
+    def _fetch_list_of_patches_to_land(options, args, tool):
         bugs_to_patches = {}
         patch_count = 0
         for bug_id in args:
             patches = []
             if options.commit_queue:
-                patches = tool.bugs.fetch_commit_queue_patches_from_bug(bug_id)
+                patches = tool.bugs.fetch_commit_queue_patches_from_bug(bug_id, reject_invalid_patches=True)
             else:
                 patches = tool.bugs.fetch_reviewed_patches_from_bug(bug_id)
-            if not len(patches):
-                log("No reviewed patches found on %s." % bug_id)
-                continue
-            patch_count += len(patches)
-            bugs_to_patches[bug_id] = patches
+
+            patches_found = len(patches)
+            log("%s found on bug %s." % (pluralize("reviewed patch", patches_found), bug_id))
+
+            patch_count += patches_found
+            if patches_found:
+                bugs_to_patches[bug_id] = patches
 
         log("Landing %s from %s." % (pluralize("patch", patch_count), pluralize("bug", len(args))))
+        return bugs_to_patches
+
+    def execute(self, options, args, tool):
+        if not len(args):
+            error("bug-id(s) required")
 
-        self.setup_for_landing(tool.scm(), options)
+        # Check the tree status here so we can fail early
+        WebKitLandingScripts.ensure_builders_are_green(tool.buildbot, options)
+
+        bugs_to_patches = self._fetch_list_of_patches_to_land(options, args, tool)
+
+        WebKitLandingScripts.setup_for_landing(tool.scm(), options)
 
         for bug_id in bugs_to_patches.keys():
             self.land_patches(bug_id, bugs_to_patches[bug_id], options, tool)
@@ -405,11 +410,17 @@ class ObsoleteAttachmentsOnBug(Command):
 class PostDiffAsPatchToBug(Command):
     def __init__(self):
         options = [
+            make_option("-m", "--description", action="store", type="string", dest="description", help="Description string for the attachment (default: 'patch')"),
+        ]
+        options += self.posting_options()
+        Command.__init__(self, 'Attaches the current working directory diff to a bug as a patch file.', '[BUGID]', options=options)
+
+    @staticmethod
+    def posting_options():
+        return [
             make_option("--no-obsolete", action="store_false", dest="obsolete_patches", default=True, help="Do not obsolete old patches before posting this one."),
             make_option("--no-review", action="store_false", dest="review", default=True, help="Do not mark the patch for review."),
-            make_option("-m", "--description", action="store", type="string", dest="description", help="Description string for the attachment (default: 'patch')"),
         ]
-        Command.__init__(self, 'Attaches the current working directory diff to a bug as a patch file.', 'BUGID', options=options)
 
     @staticmethod
     def obsolete_patches_on_bug(bug_id, bugs):
@@ -420,7 +431,10 @@ class PostDiffAsPatchToBug(Command):
                 bugs.obsolete_attachment(patch['id'])
 
     def execute(self, options, args, tool):
-        bug_id = args[0]
+        # Perfer a bug id passed as an argument over a bug url in the diff (i.e. ChangeLogs).
+        bug_id = (args and args[0]) or parse_bug_id(tool.scm().create_patch())
+        if not bug_id:
+            error("No bug id passed and no bug url found in diff, can't post.")
 
         if options.obsolete_patches:
             self.obsolete_patches_on_bug(bug_id, tool.bugs)
@@ -436,49 +450,109 @@ class PostCommitsAsPatchesToBug(Command):
     def __init__(self):
         options = [
             make_option("-b", "--bug-id", action="store", type="string", dest="bug_id", help="Specify bug id if no URL is provided in the commit log."),
-            make_option("--no-comment", action="store_false", dest="comment", default=True, help="Do not use commit log message as a comment for the patch."),
-            make_option("--no-obsolete", action="store_false", dest="obsolete_patches", default=True, help="Do not obsolete old patches before posting new ones."),
-            make_option("--no-review", action="store_false", dest="review", default=True, help="Do not mark the patch for review."),
-            make_option("-m", "--description", action="store", type="string", dest="description", help="Description string for the attachment (default: 'patch')"),
+            make_option("--add-log-as-comment", action="store_true", dest="add_log_as_comment", default=False, help="Add commit log message as a comment when uploading the patch."),
+            make_option("-m", "--description", action="store", type="string", dest="description", help="Description string for the attachment (default: description from commit message)"),
         ]
+        options += PostDiffAsPatchToBug.posting_options()
         Command.__init__(self, 'Attaches a range of local commits to bugs as patch files.', 'COMMITISH', options=options, requires_local_commits=True)
 
+    def _comment_text_for_commit(self, options, commit_message, tool, commit_id):
+        comment_text = None
+        if (options.add_log_as_comment):
+            comment_text = commit_message.body(lstrip=True)
+            comment_text += "---\n"
+            comment_text += tool.scm().files_changed_summary_for_commit(commit_id)
+        return comment_text
+
+    def _diff_file_for_commit(self, tool, commit_id):
+        diff = tool.scm().create_patch_from_local_commit(commit_id)
+        return StringIO.StringIO(diff) # add_patch_to_bug expects a file-like object
+
     def execute(self, options, args, tool):
         if not args:
             error("%s argument is required" % self.argument_names)
 
         commit_ids = tool.scm().commit_ids_from_commitish_arguments(args)
-        if len(commit_ids) > 10:
-            error("Are you sure you want to attach %s patches?" % (pluralize('patch', len(commit_ids))))
-            # Could add a --patches-limit option.
+        if len(commit_ids) > 10: # We could lower this limit, 10 is too many for one bug as-is.
+            error("bugzilla-tool does not support attaching %s at once.  Are you sure you passed the right commit range?" % (pluralize('patch', len(commit_ids))))
 
         have_obsoleted_patches = set()
         for commit_id in commit_ids:
-            # FIXME: commit_message is the wrong place to look for the bug_id
-            # the ChangeLogs should have the bug id, but the local commit message might not.
             commit_message = tool.scm().commit_message_for_local_commit(commit_id)
 
-            bug_id = options.bug_id or parse_bug_id(commit_message)
+            # Prefer --bug-id=, then a bug url in the commit message, then a bug url in the entire commit diff (i.e. ChangeLogs).
+            bug_id = options.bug_id or parse_bug_id(commit_message.message()) or parse_bug_id(tool.scm().create_patch_from_local_commit(commit_id))
             if not bug_id:
-                log("Skipping %s: No bug id found in commit log or specified with --bug-id." % commit_id)
+                log("Skipping %s: No bug id found in commit or specified with --bug-id." % commit_id)
                 continue
 
             if options.obsolete_patches and bug_id not in have_obsoleted_patches:
                 PostDiffAsPatchToBug.obsolete_patches_on_bug(bug_id, tool.bugs)
                 have_obsoleted_patches.add(bug_id)
 
+            diff_file = self._diff_file_for_commit(tool, commit_id)
             description = options.description or commit_message.description(lstrip=True, strip_url=True)
-            comment_text = None
-            if (options.comment):
-                comment_text = commit_message.body(lstrip=True)
-                comment_text += "---\n"
-                comment_text += tool.scm().files_changed_summary_for_commit(commit_id)
-
-            diff = tool.scm().create_patch_from_local_commit(commit_id)
-            diff_file = StringIO.StringIO(diff) # add_patch_to_bug expects a file-like object
+            comment_text = self._comment_text_for_commit(options, commit_message, tool, commit_id)
             tool.bugs.add_patch_to_bug(bug_id, diff_file, description, comment_text, mark_for_review=options.review)
 
 
+class RolloutCommit(Command):
+    def __init__(self):
+        options = WebKitLandingScripts.land_options()
+        options += WebKitLandingScripts.cleaning_options()
+        options.append(make_option("--complete-rollout", action="store_true", dest="complete_rollout", help="Experimental support for complete unsupervised rollouts, including re-opening the bug.  Not recommended."))
+        Command.__init__(self, 'Reverts the given revision and commits the revert and re-opens the original bug.', 'REVISION [BUGID]', options=options)
+
+    @staticmethod
+    def _create_changelogs_for_revert(scm, revision):
+        # First, discard the ChangeLog changes from the rollout.
+        changelog_paths = scm.modified_changelogs()
+        scm.revert_files(changelog_paths)
+
+        # Second, make new ChangeLog entries for this rollout.
+        # This could move to prepare-ChangeLog by adding a --revert= option.
+        WebKitLandingScripts.run_webkit_script("prepare-ChangeLog")
+        for changelog_path in changelog_paths:
+            ChangeLog(changelog_path).update_for_revert(revision)
+
+    @staticmethod
+    def _parse_bug_id_from_revision_diff(tool, revision):
+        original_diff = tool.scm().diff_for_revision(revision)
+        return parse_bug_id(original_diff)
+
+    @staticmethod
+    def _reopen_bug_after_rollout(tool, bug_id, comment_text):
+        if bug_id:
+            tool.bugs.reopen_bug(bug_id, comment_text)
+        else:
+            log(comment_text)
+            log("No bugs were updated or re-opened to reflect this rollout.")
+
+    def execute(self, options, args, tool):
+        if not args:
+            error("REVISION is required, see --help.")
+        revision = args[0]
+        bug_id = self._parse_bug_id_from_revision_diff(tool, revision)
+        if options.complete_rollout:
+            if bug_id:
+                log("Will re-open bug %s after rollout." % bug_id)
+            else:
+                log("Failed to parse bug number from diff.  No bugs will be updated/reopened after the rollout.")
+
+        WebKitLandingScripts.setup_for_landing(tool.scm(), options)
+        tool.scm().update_webkit()
+        tool.scm().apply_reverse_diff(revision)
+        self._create_changelogs_for_revert(tool.scm(), revision)
+
+        # FIXME: Fully automated rollout is not 100% idiot-proof yet, so for now just log with instructions on how to complete the rollout.
+        # Once we trust rollout we will remove this option.
+        if not options.complete_rollout:
+            log("\nNOTE: Rollout support is experimental.\nPlease verify the rollout diff and use 'bugzilla-tool land-diff %s' to commit the rollout." % bug_id)
+        else:
+            comment_text = WebKitLandingScripts.build_and_commit(tool.scm(), options)
+            self._reopen_bug_after_rollout(tool, bug_id, comment_text)
+
+
 class CreateBug(Command):
     def __init__(self):
         options = [
@@ -533,9 +607,18 @@ class CreateBug(Command):
 
     def prompt_for_bug_title_and_comment(self):
         bug_title = raw_input("Bug title: ")
-        print("Bug comment (hit ^D on blank line to end):")
+        print "Bug comment (hit ^D on blank line to end):"
         lines = sys.stdin.readlines()
-        sys.stdin.seek(0, os.SEEK_END)
+        try:
+            sys.stdin.seek(0, os.SEEK_END)
+        except IOError:
+            # Cygwin raises an Illegal Seek (errno 29) exception when the above
+            # seek() call is made. Ignoring it seems to cause no harm.
+            # FIXME: Figure out a way to get avoid the exception in the first
+            # place.
+            pass
+        else:
+            raise
         comment_text = ''.join(lines)
         return (bug_title, comment_text)
 
@@ -548,6 +631,126 @@ class CreateBug(Command):
             self.create_bug_from_patch(options, args, tool)
 
 
+class CheckTreeStatus(Command):
+    def __init__(self):
+        Command.__init__(self, 'Print out the status of the webkit builders.')
+
+    def execute(self, options, args, tool):
+        for builder in tool.buildbot.builder_statuses():
+            status_string = "ok" if builder['is_green'] else 'FAIL'
+            print "%s : %s" % (status_string.ljust(4), builder['name'])
+
+
+class LandPatchesFromCommitQueue(Command):
+    def __init__(self):
+        options = [
+            make_option("--no-confirm", action="store_false", dest="confirm", default=True, help="Do not ask the user for confirmation before running the queue.  Dangerous!"),
+            make_option("--status-host", action="store", type="string", dest="status_host", default=StatusBot.default_host, help="Do not ask the user for confirmation before running the queue.  Dangerous!"),
+        ]
+        Command.__init__(self, 'Run the commit queue.', options=options)
+        self._original_stdout = None
+        self._original_stderr = None
+        self._files_for_output = []
+
+    queue_log_path = 'commit_queue.log'
+    bug_logs_directory = 'commit_queue_logs'
+
+    log_date_format = "%Y-%m-%d %H:%M:%S"
+    sleep_duration_text = "5 mins"
+    seconds_to_sleep = 300
+
+    def _tee_outputs_to_files(self, files):
+        if not self._original_stdout:
+            self._original_stdout = sys.stdout
+            self._original_stderr = sys.stderr
+        if files and len(files):
+            sys.stdout = tee(self._original_stdout, *files)
+            sys.stderr = tee(self._original_stderr, *files)
+        else:
+            sys.stdout = self._original_stdout
+            sys.stderr = self._original_stderr
+
+    @classmethod
+    def _sleep_message(cls, message):
+        wake_time = datetime.now() + timedelta(seconds=cls.seconds_to_sleep)
+        return "%s Sleeping until %s (%s)." % (message, wake_time.strftime(cls.log_date_format), cls.sleep_duration_text)
+
+    @classmethod
+    def _sleep(cls, message):
+        log(cls._sleep_message(message))
+        time.sleep(cls.seconds_to_sleep)
+
+    def _update_status_and_sleep(self, message):
+        status_message = self._sleep_message(message)
+        self.status_bot.update_status(status_message)
+        log(status_message)
+        time.sleep(self.seconds_to_sleep)
+
+    @staticmethod
+    def _open_log_file(log_path):
+        (log_directory, log_name) = os.path.split(log_path)
+        if log_directory and not os.path.exists(log_directory):
+            os.makedirs(log_directory)
+        return open(log_path, 'a+')
+
+    def _add_log_to_output_tee(self, path):
+        log_file = self._open_log_file(path)
+        self._files_for_output.append(log_file)
+        self._tee_outputs_to_files(self._files_for_output)
+        return log_file
+
+    def _remove_log_from_output_tee(self, log_file):
+        self._files_for_output.remove(log_file)
+        self._tee_outputs_to_files(self._files_for_output)
+        log_file.close()
+
+    def execute(self, options, args, tool):
+        log("CAUTION: commit-queue will discard all local changes in %s" % tool.scm().checkout_root)
+        if options.confirm:
+            response = raw_input("Are you sure?  Type 'yes' to continue: ")
+            if (response != 'yes'):
+                error("User declined.")
+
+        queue_log = self._add_log_to_output_tee(self.queue_log_path)
+        log("Running WebKit Commit Queue. %s" % datetime.now().strftime(self.log_date_format))
+
+        self.status_bot = StatusBot(host=options.status_host)
+
+        while (True):
+            # Either of these calls could throw URLError which shouldn't stop the queue.
+            # We catch all exceptions just in case.
+            try:
+                # Fetch patches instead of just bug ids to that we validate reviewer/committer flags on every patch.
+                patches = tool.bugs.fetch_patches_from_commit_queue(reject_invalid_patches=True)
+                if not len(patches):
+                    self._update_status_and_sleep("Empty queue.")
+                    continue
+                patch_ids = map(lambda patch: patch['id'], patches)
+                first_bug_id = patches[0]['bug_id']
+                log("%s in commit queue [%s]" % (pluralize('patch', len(patches)), ", ".join(patch_ids)))
+
+                if not tool.buildbot.core_builders_are_green():
+                    self._update_status_and_sleep("Builders (http://build.webkit.org) are red.")
+                    continue
+
+                self.status_bot.update_status("Landing patches from bug %s." % first_bug_id, bug_id=first_bug_id)
+            except Exception, e:
+                # Don't try tell the status bot, in case telling it causes an exception.
+                self._sleep("Exception while checking queue and bots: %s." % e)
+                continue
+
+            # Try to land patches on the first bug in the queue before looping
+            bug_log_path = os.path.join(self.bug_logs_directory, "%s.log" % first_bug_id)
+            bug_log = self._add_log_to_output_tee(bug_log_path)
+            bugzilla_tool_path = __file__ # re-execute this script
+            bugzilla_tool_args = [bugzilla_tool_path, 'land-patches', '--force-clean', '--commit-queue', '--quiet', first_bug_id]
+            WebKitLandingScripts.run_command_with_teed_output(bugzilla_tool_args, sys.stdout)
+            self._remove_log_from_output_tee(bug_log)
+
+        log("Finished WebKit Commit Queue. %s" % datetime.now().strftime(self.log_date_format))
+        self._remove_log_from_output_tee(queue_log)
+
+
 class NonWrappingEpilogIndentedHelpFormatter(IndentedHelpFormatter):
     def __init__(self):
         IndentedHelpFormatter.__init__(self)
@@ -571,6 +774,7 @@ class BugzillaTool:
     def __init__(self):
         self.cached_scm = None
         self.bugs = Bugzilla()
+        self.buildbot = BuildBot()
         self.commands = [
             { 'name' : 'bugs-to-commit', 'object' : BugsInCommitQueue() },
             { 'name' : 'patches-to-commit', 'object' : PatchesInCommitQueue() },
@@ -583,6 +787,9 @@ class BugzillaTool:
             { 'name' : 'obsolete-attachments', 'object' : ObsoleteAttachmentsOnBug() },
             { 'name' : 'post-diff', 'object' : PostDiffAsPatchToBug() },
             { 'name' : 'post-commits', 'object' : PostCommitsAsPatchesToBug() },
+            { 'name' : 'tree-status', 'object' : CheckTreeStatus() },
+            { 'name' : 'commit-queue', 'object' : LandPatchesFromCommitQueue() },
+            { 'name' : 'rollout', 'object' : RolloutCommit() },
         ]
 
         self.global_option_parser = HelpPrintingOptionParser(usage=self.usage_line(), formatter=NonWrappingEpilogIndentedHelpFormatter(), epilog=self.commands_usage())
diff --git a/WebKitTools/Scripts/build-webkit b/WebKitTools/Scripts/build-webkit
index fe6d3c7..4f78eef 100755
--- a/WebKitTools/Scripts/build-webkit
+++ b/WebKitTools/Scripts/build-webkit
@@ -1,6 +1,7 @@
 #!/usr/bin/perl -w
 
-# Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
+# Copyright (C) 2005, 2006 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -37,6 +38,9 @@ use lib $FindBin::Bin;
 use webkitdirs;
 use POSIX;
 
+sub formatBuildTime($);
+sub writeCongrats();
+
 my $originalWorkingDirectory = getcwd();
 chdirWebKit();
 
@@ -44,17 +48,18 @@ my $showHelp = 0;
 my $clean = 0;
 my $minimal = 0;
 my $makeArgs;
+my $startTime = time();
 
 my ($threeDCanvasSupport, $threeDRenderingSupport, $channelMessagingSupport, $databaseSupport, $datagridSupport, $domStorageSupport,
-    $filtersSupport, $geolocationSupport, $gnomeKeyringSupport, $iconDatabaseSupport,
-    $javaScriptDebuggerSupport, $offlineWebApplicationSupport, $rubySupport, $sharedWorkersSupport, 
+    $eventsourceSupport, $filtersSupport, $geolocationSupport, $iconDatabaseSupport,
+    $javaScriptDebuggerSupport, $mathmlSupport, $offlineWebApplicationSupport, $rubySupport, $sharedWorkersSupport, 
     $svgSupport, $svgAnimationSupport, $svgAsImageSupport, $svgDOMObjCBindingsSupport, $svgFontsSupport,
-    $svgForeignObjectSupport, $svgUseSupport, $videoSupport, $webSocketsSupport, $wmlSupport, $workersSupport,
-    $xpathSupport, $xsltSupport, $coverageSupport);
+    $svgForeignObjectSupport, $svgUseSupport, $videoSupport, $webSocketsSupport, $wmlSupport, $wcssSupport, $xhtmlmpSupport, $workersSupport,
+    $xpathSupport, $xsltSupport, $coverageSupport, $notificationsSupport);
 
 my @features = (
     { option => "3d-canvas", desc => "Toggle 3D canvas support",
-      define => "ENABLE_3D_CANVAS", default => 0, value => \$threeDCanvasSupport },
+      define => "ENABLE_3D_CANVAS", default => (isAppleMacWebKit() && !isTiger()), value => \$threeDCanvasSupport },
 
     { option => "3d-rendering", desc => "Toggle 3D rendering support",
       define => "ENABLE_3D_RENDERING", default => (isAppleMacWebKit() && !isTiger()), value => \$threeDRenderingSupport },
@@ -74,14 +79,14 @@ my @features = (
     { option => "dom-storage", desc => "Toggle DOM Storage Support",
       define => "ENABLE_DOM_STORAGE", default => 1, value => \$domStorageSupport },
 
+    { option => "eventsource", desc => "Toggle server-sent events support",
+      define => "ENABLE_EVENTSOURCE", default => 1, value => \$eventsourceSupport },
+
     { option => "filters", desc => "Toggle Filters support",
       define => "ENABLE_FILTERS", default => 0, value => \$filtersSupport },
 
     { option => "geolocation", desc => "Toggle Geolocation support",
-      define => "ENABLE_GEOLOCATION", default => 0, value => \$geolocationSupport },
-
-    { option => "gnomekeyring", desc => "Toggle GNOME Keyring Support (GTK+ port only)",
-      define => "WTF_USE_GNOMEKEYRING", default => 0, value => \$gnomeKeyringSupport },
+      define => "ENABLE_GEOLOCATION", default => isGtk(), value => \$geolocationSupport },
 
     { option => "icon-database", desc => "Toggle Icon database support",
       define => "ENABLE_ICONDATABASE", default => 1, value => \$iconDatabaseSupport },
@@ -89,6 +94,12 @@ my @features = (
     { option => "javascript-debugger", desc => "Toggle JavaScript Debugger/Profiler support",
       define => "ENABLE_JAVASCRIPT_DEBUGGER", default => 1, value => \$javaScriptDebuggerSupport },
 
+    { option => "mathml", desc => "Toggle MathML support",
+      define => "ENABLE_MATHML", default => 0, value => \$mathmlSupport },
+
+    { option => "notifications", desc => "Toggle Desktop Notifications Support",
+      define => "ENABLE_NOTIFICATIONS", default => 0, value => \$notificationsSupport },
+
     { option => "offline-web-applications", desc => "Toggle Offline Web Application Support",
       define => "ENABLE_OFFLINE_WEB_APPLICATIONS", default => 1, value => \$offlineWebApplicationSupport },
 
@@ -96,7 +107,7 @@ my @features = (
       define => "ENABLE_RUBY", default => 1, value => \$rubySupport },
 
     { option => "shared-workers", desc => "Toggle SharedWorkers support",
-      define => "ENABLE_SHARED_WORKERS", default => 0, value => \$sharedWorkersSupport },
+      define => "ENABLE_SHARED_WORKERS", default => (isAppleWebKit() || isGtk()), value => \$sharedWorkersSupport },
 
     { option => "svg", desc => "Toggle SVG support",
       define => "ENABLE_SVG", default => 1, value => \$svgSupport },
@@ -128,6 +139,12 @@ my @features = (
     { option => "wml", desc => "Toggle WML support",
       define => "ENABLE_WML", default => 0, value => \$wmlSupport },
 
+    { option => "xhtmlmp", desc => "Toggle XHTML-MP support",
+      define => "ENABLE_XHTMLMP", default => 0, value => \$xhtmlmpSupport },
+
+    { option => "wcss", desc => "Toggle WCSS support",
+      define => "ENABLE_WCSS", default => 0, value => \$wcssSupport },
+
     { option => "workers", desc => "Toggle Web Workers support",
       define => "ENABLE_WORKERS", default => (isAppleWebKit() || isGtk()), value => \$workersSupport },
 
@@ -205,18 +222,6 @@ if ($showHelp) {
 checkRequiredSystemConfig();
 setConfiguration();
 
-if (isWx()) {
-    $ENV{"WEBKITOUTPUTDIR"} = productDir();
-
-    my @opts = getWxArgs();
-
-    if ($clean) {
-        push(@opts, "clean");
-    }
-    system "WebKitTools/wx/build-wxwebkit @opts";
-    exit exitStatus($?);
-}
-
 my $productDir = productDir();
 
 # Check that all the project directories are there.
@@ -306,6 +311,19 @@ if (isGtk()) {
 # Force re-link of existing libraries if different than expected
 removeLibraryDependingOnSVG("WebCore", $svgSupport);
 
+if (isWx()) {
+    downloadWafIfNeeded();
+    push @projects, 'WebKitTools/wx/browser';
+    push @projects, 'WebKit/wx/bindings/python';
+}
+
+if (isChromium()) {
+    # Chromium doesn't build by project directories.
+    @projects = ();
+    my $result = buildChromium($clean, @options);
+    exit $result if $result;
+}
+
 # Build, and abort if the build fails.
 for my $dir (@projects) {
     chdir $dir or die;
@@ -327,6 +345,16 @@ for my $dir (@projects) {
         if ($dir eq "WebKit") {
             $result = buildVisualStudioProject("win/WebKit.vcproj/WebKit.sln", $clean);
         }
+    } elsif (isWx()) {
+        @options = ();
+        if (defined($makeArgs)) {
+            @options = split(/ /, $makeArgs);
+        }
+        if ($dir eq "WebKit" && isWx()) {
+            chdir 'wx' or die;
+        }
+            
+        $result = buildWafProject($dir, $clean, @options);
     }
 
     if (exitStatus($result)) {
@@ -339,21 +367,44 @@ for my $dir (@projects) {
         }
         exit exitStatus($result);
     }
-    chdir ".." or die;
+    chdirWebKit();
 }
 
 # Don't report the "WebKit is now built" message after a clean operation.
 exit if $clean;
 
 # Write out congratulations message.
+writeCongrats();
+
+exit 0;
 
-my $launcherPath = launcherPath();
-my $launcherName = launcherName();
+sub formatBuildTime($)
+{
+    my ($buildTime) = @_;
 
-print "\n";
-print "===========================================================\n";
-print " WebKit is now built. To run $launcherName with this newly-built\n";
-print " code, use the \"$launcherPath\" script.\n";
-print "===========================================================\n";
+    my $buildHours = int($buildTime / 3600);
+    my $buildMins = int(($buildTime - $buildHours * 3600) / 60);
+    my $buildSecs = $buildTime - $buildHours * 3600 - $buildMins * 60;
 
-exit 0;
+    if ($buildHours) {
+        return sprintf("%dh:%02dm:%02ds", $buildHours, $buildMins, $buildSecs);
+    }
+    return sprintf("%02dm:%02ds", $buildMins, $buildSecs);
+}
+
+sub writeCongrats()
+{
+    my $launcherPath = launcherPath();
+    my $launcherName = launcherName();
+    my $endTime = time();
+    my $buildTime = formatBuildTime($endTime - $startTime);
+
+    print "\n";
+    print "===========================================================\n";
+    print " WebKit is now built ($buildTime). \n";
+    if (!isChromium()) {
+        print " To run $launcherName with this newly-built code, use the\n";
+        print " \"$launcherPath\" script.\n";
+    }
+    print "===========================================================\n";
+}
diff --git a/WebKitTools/Scripts/check-for-global-initializers b/WebKitTools/Scripts/check-for-global-initializers
index e6c1a69..a74f57d 100755
--- a/WebKitTools/Scripts/check-for-global-initializers
+++ b/WebKitTools/Scripts/check-for-global-initializers
@@ -111,6 +111,11 @@ for my $file (sort @files) {
                 next if $shortName eq "RenderObject.o";
                 next if $shortName eq "SubresourceLoader.o";
                 next if $shortName eq "SVGElementInstance.o";
+                next if $shortName eq "XMLHttpRequest.o";
+            }
+            if ($target eq "WebKit") {
+                next if $shortName eq "HostedNetscapePluginStream.o";
+                next if $shortName eq "NetscapePluginInstanceProxy.o";
             }
         }
 
diff --git a/WebKitTools/Scripts/check-webkit-style b/WebKitTools/Scripts/check-webkit-style
index 14812a7..5709cf0 100755
--- a/WebKitTools/Scripts/check-webkit-style
+++ b/WebKitTools/Scripts/check-webkit-style
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 #
 # Copyright (C) 2009 Google Inc. All rights reserved.
 #
diff --git a/WebKitTools/Scripts/commit-log-editor b/WebKitTools/Scripts/commit-log-editor
index e2fc92d..e58b181 100755
--- a/WebKitTools/Scripts/commit-log-editor
+++ b/WebKitTools/Scripts/commit-log-editor
@@ -39,6 +39,7 @@ use VCSUtils;
 use webkitdirs;
 
 sub normalizeLineEndings($$);
+sub removeLongestCommonPrefixEndingInDoubleNewline(\%);
 
 sub usage
 {
@@ -216,6 +217,8 @@ for my $changeLog (@changeLogs) {
     $changeLogContents{$label} = $contents;
 }
 
+my $commonPrefix = removeLongestCommonPrefixEndingInDoubleNewline(%changeLogContents);
+
 my $first = 1;
 open NEWLOG, ">$log.edit" or die;
 if (isGit() && scalar keys %changeLogSort == 0) {
@@ -233,6 +236,7 @@ if (isGit() && scalar keys %changeLogSort == 0) {
         close CHANGELOG_ENTRIES;
     }
 } else {
+    print NEWLOG normalizeLineEndings($commonPrefix, $endl);
     for my $sortKey (sort keys %changeLogSort) {
         my $label = $changeLogSort{$sortKey};
         if (keys %changeLogSort > 1) {
@@ -273,3 +277,32 @@ sub normalizeLineEndings($$)
     $string =~ s/\r?\n/$endl/g;
     return $string;
 }
+
+sub removeLongestCommonPrefixEndingInDoubleNewline(\%)
+{
+    my ($hashOfStrings) = @_;
+
+    my @strings = values %{$hashOfStrings};
+    return "" unless @strings > 1;
+
+    my $prefix = shift @strings;
+    my $prefixLength = length $prefix;
+    foreach my $string (@strings) {
+        while ($prefixLength) {
+            last if substr($string, 0, $prefixLength) eq $prefix;
+            --$prefixLength;
+            $prefix = substr($prefix, 0, -1);
+        }
+        last unless $prefixLength;
+    }
+
+    return "" unless $prefixLength;
+
+    my $lastDoubleNewline = rindex($prefix, "\n\n");
+    return "" unless $lastDoubleNewline > 0;
+
+    foreach my $key (keys %{$hashOfStrings}) {
+        $hashOfStrings->{$key} = substr($hashOfStrings->{$key}, $lastDoubleNewline);
+    }
+    return substr($prefix, 0, $lastDoubleNewline + 2);
+}
diff --git a/WebKitTools/Scripts/make-js-test-wrappers b/WebKitTools/Scripts/make-script-test-wrappers
index a030d3b..133476c 100755
--- a/WebKitTools/Scripts/make-js-test-wrappers
+++ b/WebKitTools/Scripts/make-script-test-wrappers
@@ -62,7 +62,15 @@ my @templates = findTemplateFiles(@ARGV);
 for my $tfile (@templates) {
 
     my $tpath = $tfile;
-    $tpath =~ s:/resources/TEMPLATE.html$::;
+    my $templateDirectory;
+    my $templateRelativePath;
+    if ($tpath =~ s:/(script-tests)/TEMPLATE.html$::) {
+        $templateDirectory = $1;
+        $templateRelativePath = $1 . "/TEMPLATE.html";
+    } else {
+        print "Inappropriate position of a template: ${tpath}\n";
+        next;
+    }
 
     print "${tpath}\n";
 
@@ -73,64 +81,22 @@ for my $tfile (@templates) {
     my $fileFilter = sub {
         push @files, $File::Find::name if substr($_, -3) eq ".js";
     };
-    find({ preprocess => \&directoryFilter, wanted => $fileFilter }, "resources");
+    find({ preprocess => \&directoryFilter, wanted => $fileFilter }, $templateDirectory);
 
-    open TEMPLATE, "<resources/TEMPLATE.html";
+    open TEMPLATE, "<${templateRelativePath}";
     my $template = do { local $/; <TEMPLATE> };
     close TEMPLATE;
 
     my $templateNegative = $template;
-    if (-e "resources/TEMPLATE-n.html") {
-        open TEMPLATE, "<resources/TEMPLATE-n.html";
+    if (-e "${templateDirectory}/TEMPLATE-n.html") {
+        open TEMPLATE, "<${templateDirectory}/TEMPLATE-n.html";
         $templateNegative = do { local $/; <TEMPLATE> };
         close TEMPLATE;
     }
 
     for my $file (@files) {
-        next if $file =~ /js-test-.*\.js$/;
-        next if $file =~ /cookies-test-(post|pre)\.js$/;
-        next if $file =~ /standalone-.*\.js$/;
-        next if $file =~ /SVGTestCase\.js/;
-        next if $file =~ /WMLTestCase\.js/;
-
-        next if $file =~ m:resources/bom-in-file-retains-correct-offset\.js$:; # has a custom template
-        next if $file =~ m:resources/NSResolver-exceptions\.js$:;
-        next if $file =~ m:resources/WindowProperties\.js$:;
-        next if $file =~ m:resources/altGlyph-dom\.js$:;
-        next if $file =~ m:resources/attr-case-sensitivity\.js$:;
-        next if $file =~ m:resources/box-shadow-overflow-scroll\.js$:;
-        next if $file =~ m:resources/codegen-temporaries-multiple-global-blocks-1\.js$:;
-        next if $file =~ m:resources/codegen-temporaries-multiple-global-blocks-2\.js$:;
-        next if $file =~ m:resources/constructors-cached-navigate\.js$:;
-        next if $file =~ m:resources/frame-loading-via-document-write\.js$:;
-        next if $file =~ m:resources/id-fastpath-almost-strict\.js$:;
-        next if $file =~ m:resources/id-fastpath-strict\.js$:;
-        next if $file =~ m:resources/intersectsNode\.js$:;
-        next if $file =~ m:resources/p-in-scope\.js$:;
-        next if $file =~ m:resources/paste-blockquote-before-blockquote\.js$:;
-        next if $file =~ m:resources/reflection-overflow-scroll\.js$:;
-        next if $file =~ m:resources/script-element-gc\.js$:;
-        next if $file =~ m:resources/script-element-gc\.js$:;
-        next if $file =~ m:resources/script3\.js$:;
-        next if $file =~ m:resources/script4\.js$:;
-        next if $file =~ m:resources/script5\.js$:;
-        next if $file =~ m:resources/scripted-random\.js$:;
-        next if $file =~ m:resources/select-options-remove\.js$:;
-        next if $file =~ m:resources/shadow-offset\.js$:;
-        next if $file =~ m:resources/tabindex-focus-blur-all\.js$:;
-        next if $file =~ m:resources/use-instanceRoot-event-bubbling\.js$:;
-        next if $file =~ m:resources/use-instanceRoot-event-listeners\.js$:;
-        next if $file =~ m:resources/window-properties\.js$:;
-        next if $file =~ m:resources/wrapper-identity-base\.js$:;
-        next if $file =~ m:resources/xhtml-scripts\.js$:;
-        next if $file =~ m:resources/instanceof-operator-dummy-worker\.js$:;
-        next if $file =~ m:resources/json2-es5-compat\.js$:;
-        next if $file =~ m:resources/JSON-stringify\.js$:;
-        next if $file =~ m:resources/JSON-parse\.js$:;
-        next if $file =~ m:resources/textarea-input-event\.js$:;
-
         my $html = $file;
-        $html =~ s:resources/(.*)\.js:$1.html:;
+        $html =~ s:${templateDirectory}/(.*)\.js:$1.html:;
         next if -f "$html-disabled";
 
         system("grep -q 'successfullyParsed =' $file");
diff --git a/WebKitTools/Scripts/mark-bug-fixed b/WebKitTools/Scripts/mark-bug-fixed
new file mode 100755
index 0000000..c7086c2
--- /dev/null
+++ b/WebKitTools/Scripts/mark-bug-fixed
@@ -0,0 +1,141 @@
+#!/usr/bin/env python
+
+# Copyright (C) 2009 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer. 
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution. 
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Mark a bug as fixed on bugs.webkit.org.
+
+import os
+import re
+import sys
+
+from optparse import OptionParser
+
+from modules.bugzilla import Bugzilla, parse_bug_id
+from modules.comments import bug_comment_from_svn_revision
+from modules.logging import error, log
+from modules.scm import SCM, detect_scm_system
+
+
+class MarkBugFixedTool:
+    def __init__(self):
+        self.bugs = Bugzilla()
+        self.cached_scm = None
+        self.option_parser = OptionParser(usage="usage: %prog [options] [rNNNNN]")
+        self.option_parser.add_option("-b", "--bug-id", action="store", type="string", dest="bug_id", help="Specify bug id if no URL is provided in the commit log.")
+        self.option_parser.add_option("-m", "--comment", action="store", type="string", dest="comment", help="Text to include in bug comment.")
+        self.option_parser.add_option("-o", "--open", action="store_true", default=False, dest="open_bug", help="Open bug in default web browser (Mac only).")
+        self.option_parser.add_option("-u", "--update-only", action="store_true", default=False, dest="update_only", help="Add comment to the bug, but do not close it.")
+
+    def scm(self):
+        # Lazily initialize SCM to not error-out before command line parsing (or when running non-scm commands).
+        if not self.cached_scm:
+            original_cwd = os.path.abspath('.')
+            self.cached_scm = detect_scm_system(original_cwd)
+        return self.cached_scm
+
+    def _fetch_commit_log(self, scm, svn_revision):
+        if not svn_revision:
+            return scm.last_svn_commit_log()
+        return scm.svn_commit_log(svn_revision)
+
+    def _determine_bug_id_and_svn_revision(self, bug_id, svn_revision):
+        commit_log = self._fetch_commit_log(self.scm(), svn_revision)
+
+        if not bug_id:
+            bug_id = parse_bug_id(commit_log)
+
+        if not svn_revision:
+            match = re.search("^r(?P<svn_revision>\d+) \|", commit_log, re.MULTILINE)
+            if match:
+                svn_revision = match.group('svn_revision')
+
+        if not bug_id or not svn_revision:
+            not_found = []
+            if not bug_id:
+                not_found.append("bug id")
+            if not svn_revision:
+                not_found.append("svn revision")
+            error("Could not find %s on command-line or in %s."
+                  % (" or ".join(not_found), "r%s" % svn_revision if svn_revision else "last commit"))
+
+        return (bug_id, svn_revision)
+
+    def _open_bug_in_web_browser(self, bug_id):
+        if sys.platform == "darwin":
+            SCM.run_command(["open", self.bugs.short_bug_url_for_bug_id(bug_id)])
+            return
+        log("WARNING: -o|--open is only supported on Mac OS X.")
+
+    def _prompt_user_for_correctness(self, bug_id, svn_revision):
+        answer = raw_input("Is this correct (y/N)? ")
+        if not re.match("^\s*y(es)?", answer, re.IGNORECASE):
+            exit(1)
+
+    def main(self):
+        (options, args) = self.option_parser.parse_args(sys.argv[1:])
+
+        if len(args) > 1:
+            error("Only one revision may be specified.")
+
+        bug_id = options.bug_id
+
+        svn_revision = args[0] if len(args) == 1 else None
+        if svn_revision:
+            if re.match("^r[0-9]+$", svn_revision, re.IGNORECASE):
+                svn_revision = svn_revision[1:]
+            if not re.match("^[0-9]+$", svn_revision):
+                error("Invalid svn revision: '%s'" % svn_revision)
+
+        needs_prompt = False
+        if not bug_id or not svn_revision:
+            needs_prompt = True
+            (bug_id, svn_revision) = self._determine_bug_id_and_svn_revision(bug_id, svn_revision)
+
+        log("Bug: <%s> %s" % (self.bugs.short_bug_url_for_bug_id(bug_id), self.bugs.fetch_title_from_bug(bug_id)))
+        log("Revision: %s" % svn_revision)
+
+        if options.open_bug:
+            self._open_bug_in_web_browser(bug_id)
+
+        if needs_prompt:
+            self._prompt_user_for_correctness(bug_id, svn_revision)
+
+        bug_comment = bug_comment_from_svn_revision(svn_revision)
+        if options.comment:
+            bug_comment = "%s\n\n%s" % (options.comment, bug_comment)
+
+        if options.update_only:
+            log("Adding comment to Bug %s." % bug_id)
+            self.bugs.post_comment_to_bug(bug_id, bug_comment)
+        else:
+            log("Adding comment to Bug %s and marking as Resolved/Fixed." % bug_id)
+            self.bugs.close_bug_as_fixed(bug_id, bug_comment)
+
+
+def main():
+    tool = MarkBugFixedTool()
+    return tool.main()
+
+if __name__ == "__main__":
+    main()
diff --git a/WebKitTools/Scripts/modules/bugzilla.py b/WebKitTools/Scripts/modules/bugzilla.py
index 1eebe9d..daf3f19 100644
--- a/WebKitTools/Scripts/modules/bugzilla.py
+++ b/WebKitTools/Scripts/modules/bugzilla.py
@@ -92,10 +92,19 @@ def credentials_from_keychain(username=None):
 def is_mac_os_x():
     return platform.mac_ver()[0]
 
+def parse_bug_id(message):
+    match = re.search("http\://webkit\.org/b/(?P<bug_id>\d+)", message)
+    if match:
+        return match.group('bug_id')
+    match = re.search(Bugzilla.bug_server_regex + "show_bug\.cgi\?id=(?P<bug_id>\d+)", message)
+    if match:
+        return match.group('bug_id')
+    return None
+
 # FIXME: This should not depend on git for config storage
 def read_config(key):
     # Need a way to read from svn too
-    config_process = subprocess.Popen("git config --get bugzilla." + key, stdout=subprocess.PIPE, shell=True)
+    config_process = subprocess.Popen("git config --get bugzilla.%s" % key, stdout=subprocess.PIPE, shell=True)
     value = config_process.communicate()[0]
     return_code = config_process.wait()
 
@@ -119,6 +128,11 @@ def read_credentials():
 def timestamp():
     return datetime.now().strftime("%Y%m%d%H%M%S")
 
+
+class BugzillaError(Exception):
+    pass
+
+
 class Bugzilla:
     def __init__(self, dryrun=False, committers=CommitterList()):
         self.dryrun = dryrun
@@ -137,13 +151,21 @@ class Bugzilla:
     def bug_url_for_bug_id(self, bug_id, xml=False):
         content_type = "&ctype=xml" if xml else ""
         return "%sshow_bug.cgi?id=%s%s" % (self.bug_server_url, bug_id, content_type)
-    
+
+    def short_bug_url_for_bug_id(self, bug_id):
+        return "http://webkit.org/b/%s" % bug_id
+
     def attachment_url_for_id(self, attachment_id, action="view"):
         action_param = ""
         if action and action != "view":
-            action_param = "&action=" + action
+            action_param = "&action=%s" % action
         return "%sattachment.cgi?id=%s%s" % (self.bug_server_url, attachment_id, action_param)
 
+    def _parse_attachment_flag(self, element, flag_name, attachment, result_key):
+        flag = element.find('flag', attrs={'name' : flag_name})
+        if flag and flag['status'] == '+':
+            attachment[result_key] = flag['setter']
+
     def _parse_attachment_element(self, element, bug_id):
         attachment = {}
         attachment['bug_id'] = bug_id
@@ -153,24 +175,13 @@ class Bugzilla:
         attachment['url'] = self.attachment_url_for_id(attachment['id'])
         attachment['name'] = unicode(element.find('desc').string)
         attachment['type'] = str(element.find('type').string)
-
-        review_flag = element.find('flag', attrs={"name" : "review"})
-        if review_flag and review_flag['status'] == '+':
-            reviewer_email = review_flag['setter']
-            reviewer = self.committers.reviewer_by_bugzilla_email(reviewer_email)
-            attachment['reviewer'] = reviewer.full_name
-
-        commit_queue_flag = element.find('flag', attrs={"name" : "commit-queue"})
-        if commit_queue_flag and commit_queue_flag['status'] == '+':
-            committer_email = commit_queue_flag['setter']
-            committer = self.committers.committer_by_bugzilla_email(committer_email)
-            attachment['commit-queue'] = committer.full_name
-
+        self._parse_attachment_flag(element, 'review', attachment, 'reviewer_email')
+        self._parse_attachment_flag(element, 'commit-queue', attachment, 'committer_email')
         return attachment
 
     def fetch_attachments_from_bug(self, bug_id):
         bug_url = self.bug_url_for_bug_id(bug_id, xml=True)
-        log("Fetching: " + bug_url)
+        log("Fetching: %s" % bug_url)
 
         page = urllib2.urlopen(bug_url)
         soup = BeautifulSoup(page)
@@ -181,6 +192,12 @@ class Bugzilla:
             attachments.append(attachment)
         return attachments
 
+    def fetch_title_from_bug(self, bug_id):
+        bug_url = self.bug_url_for_bug_id(bug_id, xml=True)
+        page = urllib2.urlopen(bug_url)
+        soup = BeautifulSoup(page)
+        return soup.find('short_desc').string
+
     def fetch_patches_from_bug(self, bug_id):
         patches = []
         for attachment in self.fetch_attachments_from_bug(bug_id):
@@ -188,17 +205,45 @@ class Bugzilla:
                 patches.append(attachment)
         return patches
 
-    def fetch_reviewed_patches_from_bug(self, bug_id):
+    # _view_source_link belongs in some sort of webkit_config.py module.
+    def _view_source_link(self, local_path):
+        return "http://trac.webkit.org/browser/trunk/%s" % local_path
+
+    def _validate_setter_email(self, patch, result_key, lookup_function, rejection_function, reject_invalid_patches):
+        setter_email = patch.get(result_key + '_email')
+        if not setter_email:
+            return None
+
+        committer = lookup_function(setter_email)
+        if committer:
+            patch[result_key] = committer.full_name
+            return patch[result_key]
+
+        if reject_invalid_patches:
+            committer_list = "WebKitTools/Scripts/modules/committers.py"
+            failure_message = "%s does not have %s permissions according to %s." % (setter_email, result_key, self._view_source_link(committer_list))
+            rejection_function(patch['id'], failure_message)
+        else:
+            log("Warning, attachment %s on bug %s has invalid %s (%s)", (patch['id'], patch['bug_id'], result_key, setter_email))
+        return None
+
+    def _validate_reviewer(self, patch, reject_invalid_patches):
+        return self._validate_setter_email(patch, 'reviewer', self.committers.reviewer_by_bugzilla_email, self.reject_patch_from_review_queue, reject_invalid_patches)
+
+    def _validate_committer(self, patch, reject_invalid_patches):
+        return self._validate_setter_email(patch, 'committer', self.committers.committer_by_bugzilla_email, self.reject_patch_from_commit_queue, reject_invalid_patches)
+
+    def fetch_reviewed_patches_from_bug(self, bug_id, reject_invalid_patches=False):
         reviewed_patches = []
         for attachment in self.fetch_attachments_from_bug(bug_id):
-            if 'reviewer' in attachment and not attachment['is_obsolete']:
+            if self._validate_reviewer(attachment, reject_invalid_patches) and not attachment['is_obsolete']:
                 reviewed_patches.append(attachment)
         return reviewed_patches
 
-    def fetch_commit_queue_patches_from_bug(self, bug_id):
+    def fetch_commit_queue_patches_from_bug(self, bug_id, reject_invalid_patches=False):
         commit_queue_patches = []
-        for attachment in self.fetch_reviewed_patches_from_bug(bug_id):
-            if 'commit-queue' in attachment and not attachment['is_obsolete']:
+        for attachment in self.fetch_reviewed_patches_from_bug(bug_id, reject_invalid_patches):
+            if self._validate_committer(attachment, reject_invalid_patches) and not attachment['is_obsolete']:
                 commit_queue_patches.append(attachment)
         return commit_queue_patches
 
@@ -216,10 +261,10 @@ class Bugzilla:
 
         return bug_ids
 
-    def fetch_patches_from_commit_queue(self):
+    def fetch_patches_from_commit_queue(self, reject_invalid_patches=False):
         patches_to_land = []
         for bug_id in self.fetch_bug_ids_from_commit_queue():
-            patches = self.fetch_commit_queue_patches_from_bug(bug_id)
+            patches = self.fetch_commit_queue_patches_from_bug(bug_id, reject_invalid_patches)
             patches_to_land += patches
         return patches_to_land
 
@@ -245,7 +290,7 @@ class Bugzilla:
         # If the resulting page has a title, and it contains the word "invalid" assume it's the login failure page.
         if match and re.search("Invalid", match.group(1), re.IGNORECASE):
             # FIXME: We could add the ability to try again on failure.
-            raise ScriptError("Bugzilla login failed: %s" % match.group(1))
+            raise BugzillaError("Bugzilla login failed: %s" % match.group(1))
 
         self.authenticated = True
 
@@ -257,7 +302,7 @@ class Bugzilla:
             log(comment_text)
             return
         
-        self.browser.open(self.bug_server_url + "attachment.cgi?action=enter&bugid=" + bug_id)
+        self.browser.open("%sattachment.cgi?action=enter&bugid=%s" % (self.bug_server_url, bug_id))
         self.browser.select_form(name="entryform")
         self.browser['description'] = description
         self.browser['ispatch'] = ("1",)
@@ -287,7 +332,7 @@ class Bugzilla:
         if match:
             text_lines = BeautifulSoup(match.group('error_message')).findAll(text=True)
             error_message = "\n" + '\n'.join(["  " + line.strip() for line in text_lines if line.strip()])
-        raise ScriptError("Bug not created: %s" % error_message)
+        raise BugzillaError("Bug not created: %s" % error_message)
 
     def create_bug_with_patch(self, bug_title, bug_description, component, patch_file_object, patch_description, cc, mark_for_review=False):
         self.authenticate()
@@ -304,7 +349,8 @@ class Bugzilla:
         if not component or component not in component_names:
             component = self.prompt_for_component(component_names)
         self.browser['component'] = [component]
-        self.browser['cc'] = cc
+        if cc:
+            self.browser['cc'] = cc
         self.browser['short_desc'] = bug_title
         if bug_description:
             log(bug_description)
@@ -317,15 +363,23 @@ class Bugzilla:
 
         bug_id = self._check_create_bug_response(response.read())
         log("Bug %s created." % bug_id)
-        log(self.bug_server_url + "show_bug.cgi?id=" + bug_id)
+        log("%sshow_bug.cgi?id=%s" % (self.bug_server_url, bug_id))
         return bug_id
 
-    def clear_attachment_review_flag(self, attachment_id, additional_comment_text=None):
+    def _find_select_element_for_flag(self, flag_name):
+        # FIXME: This will break if we ever re-order attachment flags
+        if flag_name == "review":
+            return self.browser.find_control(type='select', nr=0)
+        if flag_name == "commit-queue":
+            return self.browser.find_control(type='select', nr=1)
+        raise Exception("Don't know how to find flag named \"%s\"" % flag_name)
+
+    def clear_attachment_flags(self, attachment_id, additional_comment_text=None):
         self.authenticate()
 
-        comment_text = "Clearing review flag on attachment: %s" % attachment_id
+        comment_text = "Clearing flags on attachment: %s" % attachment_id
         if additional_comment_text:
-            comment_text += "\n\n" + additional_comment_text
+            comment_text += "\n\n%s" % additional_comment_text
         log(comment_text)
 
         if self.dryrun:
@@ -334,9 +388,35 @@ class Bugzilla:
         self.browser.open(self.attachment_url_for_id(attachment_id, 'edit'))
         self.browser.select_form(nr=1)
         self.browser.set_value(comment_text, name='comment', nr=0)
-        self.browser.find_control(type='select', nr=0).value = ("X",)
+        self._find_select_element_for_flag('review').value = ("X",)
+        self._find_select_element_for_flag('commit-queue').value = ("X",)
         self.browser.submit()
 
+    # FIXME: We need a way to test this on a live bugzilla instance.
+    def _set_flag_on_attachment(self, attachment_id, flag_name, flag_value, comment_text, additional_comment_text):
+        self.authenticate()
+
+        if additional_comment_text:
+            comment_text += "\n\n%s" % additional_comment_text
+        log(comment_text)
+
+        if self.dryrun:
+            return
+
+        self.browser.open(self.attachment_url_for_id(attachment_id, 'edit'))
+        self.browser.select_form(nr=1)
+        self.browser.set_value(comment_text, name='comment', nr=0)
+        self._find_select_element_for_flag(flag_name).value = (flag_value,)
+        self.browser.submit()
+
+    def reject_patch_from_commit_queue(self, attachment_id, additional_comment_text=None):
+        comment_text = "Rejecting patch %s from commit-queue." % attachment_id
+        self._set_flag_on_attachment(attachment_id, 'commit-queue', '-', comment_text, additional_comment_text)
+
+    def reject_patch_from_review_queue(self, attachment_id, additional_comment_text=None):
+        comment_text = "Rejecting patch %s from review queue." % attachment_id
+        self._set_flag_on_attachment(attachment_id, 'review', '-', comment_text, additional_comment_text)
+
     def obsolete_attachment(self, attachment_id, comment_text = None):
         self.authenticate()
 
@@ -349,7 +429,8 @@ class Bugzilla:
         self.browser.select_form(nr=1)
         self.browser.find_control('isobsolete').items[0].selected = True
         # Also clear any review flag (to remove it from review/commit queues)
-        self.browser.find_control(type='select', nr=0).value = ("X",)
+        self._find_select_element_for_flag('review').value = ("X",)
+        self._find_select_element_for_flag('commit-queue').value = ("X",)
         if comment_text:
             log(comment_text)
             # Bugzilla has two textareas named 'comment', one is somehow hidden.  We want the first.
@@ -385,3 +466,17 @@ class Bugzilla:
         self.browser['bug_status'] = ['RESOLVED']
         self.browser['resolution'] = ['FIXED']
         self.browser.submit()
+
+    def reopen_bug(self, bug_id, comment_text):
+        self.authenticate()
+
+        log("Re-opening bug %s" % bug_id)
+        log(comment_text) # Bugzilla requires a comment when re-opening a bug, so we know it will never be None.
+        if self.dryrun:
+            return
+
+        self.browser.open(self.bug_url_for_bug_id(bug_id))
+        self.browser.select_form(name="changeform")
+        self.browser['bug_status'] = ['REOPENED']
+        self.browser['comment'] = comment_text
+        self.browser.submit()
diff --git a/WebKitTools/Scripts/modules/bugzilla_unittest.py b/WebKitTools/Scripts/modules/bugzilla_unittest.py
index 1e52140..f08031e 100644
--- a/WebKitTools/Scripts/modules/bugzilla_unittest.py
+++ b/WebKitTools/Scripts/modules/bugzilla_unittest.py
@@ -68,21 +68,21 @@ class BugzillaTest(unittest.TestCase):
         'url' : "https://bugs.webkit.org/attachment.cgi?id=33721",
         'name' : "Fixed whitespace issue",
         'type' : "text/plain",
-        'reviewer' : 'Test One',
-        'commit-queue' : 'Test Two'
+        'reviewer_email' : 'one@test.com',
+        'committer_email' : 'two@test.com'
     }
 
     def test_attachment_parsing(self):
-        reviewer = Reviewer('Test One', 'one@test.com')
-        committer = Committer('Test Two', 'two@test.com')
-        committer_list = CommitterList(committers=[committer], reviewers=[reviewer])
-        bugzilla = Bugzilla(committers=committer_list)
+        bugzilla = Bugzilla()
 
         soup = BeautifulSoup(self._example_attachment)
         attachment_element = soup.find("attachment")
         attachment = bugzilla._parse_attachment_element(attachment_element, self._expected_example_attachment_parsing['bug_id'])
         self.assertTrue(attachment)
 
+        # Make sure we aren't parsing more or less than we expect
+        self.assertEquals(attachment.keys(), self._expected_example_attachment_parsing.keys())
+
         for key, expected_value in self._expected_example_attachment_parsing.items():
             self.assertEquals(attachment[key], expected_value, ("Failure for key: %s: Actual='%s' Expected='%s'" % (key, attachment[key], expected_value)))
 
diff --git a/WebKitTools/Scripts/modules/buildbot.py b/WebKitTools/Scripts/modules/buildbot.py
new file mode 100644
index 0000000..4478429
--- /dev/null
+++ b/WebKitTools/Scripts/modules/buildbot.py
@@ -0,0 +1,102 @@
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# WebKit's Python module for interacting with WebKit's buildbot
+
+import re
+import urllib2
+
+# Import WebKit-specific modules.
+from modules.logging import log
+
+# WebKit includes a built copy of BeautifulSoup in Scripts/modules
+# so this import should always succeed.
+from .BeautifulSoup import BeautifulSoup
+
+class BuildBot:
+    def __init__(self, host="build.webkit.org"):
+        self.buildbot_host = host
+        self.buildbot_server_url = "http://%s/" % self.buildbot_host
+        
+        # If any of the Leopard build/test bots or the Windows builders are red we should not be landing patches.
+        # Other builders should be added to this list once they're known to be stable.
+        self.core_builder_names_regexps = [ 'Leopard', "Windows.*Build" ]
+
+    # If WebKit's buildbot has an XMLRPC interface we could use, we could do something more sophisticated here.
+    # For now we just parse out the basics, enough to support basic questions like "is the tree green?"
+    def _parse_builder_status_from_row(self, status_row):
+        status_cells = status_row.findAll('td')
+        builder = {}
+
+        name_link = status_cells[0].find('a')
+        builder['name'] = name_link.string
+        # We could generate the builder_url from the name in a future version of this code.
+        builder['builder_url'] = self.buildbot_server_url + name_link['href']
+
+        status_link = status_cells[1].find('a')
+        if not status_link:
+            # We failed to find a link in the first cell, just give up.
+            # This can happen if a builder is just-added, the first cell will just be "no build"
+            builder['is_green'] = False # Other parts of the code depend on is_green being present.
+            return builder
+        revision_string = status_link.string # Will be either a revision number or a build number
+        # If revision_string has non-digits assume it's not a revision number.
+        builder['built_revision'] = int(revision_string) if not re.match('\D', revision_string) else None
+        builder['is_green'] = not re.search('fail', status_cells[1].renderContents())
+        # We could parse out the build number instead, but for now just store the URL.
+        builder['build_url'] = self.buildbot_server_url + status_link['href']
+
+        # We could parse out the current activity too.
+
+        return builder
+
+    def _builder_statuses_with_names_matching_regexps(self, builder_statuses, name_regexps):
+        builders = []
+        for builder in builder_statuses:
+            for name_regexp in name_regexps:
+                if re.match(name_regexp, builder['name']):
+                    builders.append(builder)
+        return builders
+
+    def core_builders_are_green(self):
+        for builder in self._builder_statuses_with_names_matching_regexps(self.builder_statuses(), self.core_builder_names_regexps):
+            if not builder['is_green']:
+                return False
+        return True
+
+    def builder_statuses(self):
+        build_status_url = self.buildbot_server_url + 'one_box_per_builder'
+        page = urllib2.urlopen(build_status_url)
+        soup = BeautifulSoup(page)
+
+        builders = []
+        status_table = soup.find('table')
+        for status_row in status_table.findAll('tr'):
+            builder = self._parse_builder_status_from_row(status_row)
+            builders.append(builder)
+        return builders
diff --git a/WebKitTools/Scripts/modules/buildbot_unittest.py b/WebKitTools/Scripts/modules/buildbot_unittest.py
new file mode 100644
index 0000000..461e5a2
--- /dev/null
+++ b/WebKitTools/Scripts/modules/buildbot_unittest.py
@@ -0,0 +1,118 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from modules.buildbot import BuildBot
+
+from modules.BeautifulSoup import BeautifulSoup
+
+class BuildBotTest(unittest.TestCase):
+
+    _example_one_box_status = '''
+    <table>
+    <tr>
+    <td class="box"><a href="builders/Windows%20Debug%20%28Tests%29">Windows Debug (Tests)</a></td>
+      <td align="center" class="LastBuild box success"><a href="builders/Windows%20Debug%20%28Tests%29/builds/3693">47380</a><br />build<br />successful</td>
+      <td align="center" class="Activity building">building<br />ETA in<br />~ 14 mins<br />at 13:40</td>
+    <tr>
+    <td class="box"><a href="builders/SnowLeopard%20Intel%20Release">SnowLeopard Intel Release</a></td>
+      <td class="LastBuild box" >no build</td>
+      <td align="center" class="Activity building">building<br />< 1 min</td>
+    <tr>
+    <td class="box"><a href="builders/Qt%20Linux%20Release">Qt Linux Release</a></td>
+      <td align="center" class="LastBuild box failure"><a href="builders/Qt%20Linux%20Release/builds/654">47383</a><br />failed<br />compile-webkit</td>
+      <td align="center" class="Activity idle">idle</td>
+    </table>
+'''
+    _expected_example_one_box_parsings = [
+        {
+            'builder_url': u'http://build.webkit.org/builders/Windows%20Debug%20%28Tests%29',
+            'build_url': u'http://build.webkit.org/builders/Windows%20Debug%20%28Tests%29/builds/3693',
+            'is_green': True,
+            'name': u'Windows Debug (Tests)',
+            'built_revision': 47380
+        },
+        {
+            'builder_url': u'http://build.webkit.org/builders/SnowLeopard%20Intel%20Release',
+            'is_green': False,
+            'name': u'SnowLeopard Intel Release',
+        },
+        {
+            'builder_url': u'http://build.webkit.org/builders/Qt%20Linux%20Release',
+            'build_url': u'http://build.webkit.org/builders/Qt%20Linux%20Release/builds/654',
+            'is_green': False,
+            'name': u'Qt Linux Release',
+            'built_revision': 47383
+        },
+    ]
+
+    def test_status_parsing(self):
+        buildbot = BuildBot()
+
+        soup = BeautifulSoup(self._example_one_box_status)
+        status_table = soup.find("table")
+        input_rows = status_table.findAll('tr')
+
+        for x in range(len(input_rows)):
+            status_row = input_rows[x]
+            expected_parsing = self._expected_example_one_box_parsings[x]
+
+            builder = buildbot._parse_builder_status_from_row(status_row)
+
+            # Make sure we aren't parsing more or less than we expect
+            self.assertEquals(builder.keys(), expected_parsing.keys())
+
+            for key, expected_value in expected_parsing.items():
+                self.assertEquals(builder[key], expected_value, ("Builder %d parse failure for key: %s: Actual='%s' Expected='%s'" % (x, key, builder[key], expected_value)))
+
+    def test_builder_name_regexps(self):
+        buildbot = BuildBot()
+
+        example_builders = [
+            { 'name': u'Leopard Debug (Build)', },
+            { 'name': u'Leopard Debug (Tests)', },
+            { 'name': u'Windows Release (Build)', },
+            { 'name': u'Windows Debug (Tests)', },
+            { 'name': u'Qt Linux Release', },
+        ]
+        name_regexps = [ 'Leopard', "Windows.*Build" ]
+        expected_builders = [
+            { 'name': u'Leopard Debug (Build)', },
+            { 'name': u'Leopard Debug (Tests)', },
+            { 'name': u'Windows Release (Build)', },
+        ]
+
+        # This test should probably be updated if the default regexp list changes
+        self.assertEquals(buildbot.core_builder_names_regexps, name_regexps)
+
+        builders = buildbot._builder_statuses_with_names_matching_regexps(example_builders, name_regexps)
+        self.assertEquals(builders, expected_builders)
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/Scripts/modules/changelogs.py b/WebKitTools/Scripts/modules/changelogs.py
new file mode 100644
index 0000000..a407d23
--- /dev/null
+++ b/WebKitTools/Scripts/modules/changelogs.py
@@ -0,0 +1,92 @@
+# Copyright (C) 2009, Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# WebKit's Python module for parsing and modifying ChangeLog files
+
+import fileinput # inplace file editing for set_reviewer_in_changelog
+import re
+
+# FIMXE: This doesn't really belong in this file, but we don't have a better home for it yet.
+# Maybe eventually a webkit_config.py?
+def view_source_url(revision_number):
+    return "http://trac.webkit.org/changeset/%s" % revision_number
+
+
+class ChangeLog:
+    def __init__(self, path):
+        self.path = path
+
+    # e.g. 2009-06-03  Eric Seidel  <eric@webkit.org>
+    date_line_regexp = re.compile('^(\d{4}-\d{2}-\d{2})' # Consume the date.
+                                + '\s+(.+)\s+' # Consume the name.
+                                + '<([^<>]+)>$') # And finally the email address.
+
+    @staticmethod
+    def _parse_latest_entry_from_file(changelog_file):
+        entry_lines = []
+        # The first line should be a date line.
+        first_line = changelog_file.readline()
+        if not ChangeLog.date_line_regexp.match(first_line):
+            return None
+        entry_lines.append(first_line)
+
+        for line in changelog_file:
+            # If we've hit the next entry, return.
+            if ChangeLog.date_line_regexp.match(line):
+                return ''.join(entry_lines[:-1]) # Remove the extra newline at the end
+            entry_lines.append(line)
+        return None # We never found a date line!
+
+    def latest_entry(self):
+        changelog_file = open(self.path)
+        try:
+            return self._parse_latest_entry_from_file(changelog_file)
+        finally:
+            changelog_file.close()
+
+    def update_for_revert(self, revision):
+        reviewed_by_regexp = re.compile('Reviewed by NOBODY \(OOPS!\)\.')
+        removing_boilerplate = False
+        # inplace=1 creates a backup file and re-directs stdout to the file
+        for line in fileinput.FileInput(self.path, inplace=1):
+            if reviewed_by_regexp.search(line):
+                print reviewed_by_regexp.sub("No review, rolling out r%s." % revision, line),
+                print "        %s\n" % view_source_url(revision)
+                # Remove all the ChangeLog boilerplate between the Reviewed by line and the first changed file.
+                removing_boilerplate = True
+            elif removing_boilerplate:
+                if line.find('*') >= 0 : # each changed file is preceded by a *
+                    removing_boilerplate = False
+
+            if not removing_boilerplate:
+                print line,
+
+    def set_reviewer(self, reviewer):
+        # inplace=1 creates a backup file and re-directs stdout to the file
+        for line in fileinput.FileInput(self.path, inplace=1):
+            print line.replace("NOBODY (OOPS!)", reviewer.encode("utf-8")), # Trailing comma suppresses printing newline
diff --git a/WebKitTools/Scripts/modules/changelogs_unittest.py b/WebKitTools/Scripts/modules/changelogs_unittest.py
new file mode 100644
index 0000000..dd14cb7
--- /dev/null
+++ b/WebKitTools/Scripts/modules/changelogs_unittest.py
@@ -0,0 +1,145 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+from changelogs import *
+
+import os
+import tempfile
+from StringIO import StringIO
+
+class ChangeLogsTest(unittest.TestCase):
+
+    _example_entry = '''2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * DumpRenderTree/win/ImageDiff.vcproj:
+        * DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj:
+'''
+
+    # More example text than we need.  Eventually we need to support parsing this all and write tests for the parsing.
+    _example_changelog = '''2009-08-17  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28393> check-webkit-style: add check for use of std::max()/std::min() instead of MAX()/MIN()
+
+        Reviewed by David Levin.
+
+        * Scripts/modules/cpp_style.py:
+        (_ERROR_CATEGORIES): Added 'runtime/max_min_macros'.
+        (check_max_min_macros): Added.  Returns level 4 error when MAX()
+        and MIN() macros are used in header files and C++ source files.
+        (check_style): Added call to check_max_min_macros().
+        * Scripts/modules/cpp_style_unittest.py: Added unit tests.
+        (test_max_macro): Added.
+        (test_min_macro): Added.
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        Backed out r47343 which was mistakenly committed
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/scm.py:
+
+2009-06-18  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        * DumpRenderTree/mac/DumpRenderTreeWindow.mm:
+        (-[DumpRenderTreeWindow close]): Resolved crashes seen during regression
+        tests. The close method can be called on a window that's already closed
+        so we can't assert here.
+
+== Rolled over to ChangeLog-2009-06-16 ==
+'''
+
+    def test_latest_entry_parse(self):
+        changelog_contents = "%s\n%s" % (self._example_entry, self._example_changelog)
+        changelog_file = StringIO(changelog_contents)
+        latest_entry = ChangeLog._parse_latest_entry_from_file(changelog_file)
+        self.assertEquals(self._example_entry, latest_entry)
+
+    @staticmethod
+    def _write_tmp_file_with_contents(contents):
+        (file_descriptor, file_path) = tempfile.mkstemp() # NamedTemporaryFile always deletes the file on close in python < 2.6
+        file = os.fdopen(file_descriptor, 'w')
+        file.write(contents)
+        file.close()
+        return file_path
+
+    @staticmethod
+    def _read_file_contents(file_path):
+        file = open(file_path)
+        contents = file.read()
+        file.close()
+        return contents
+
+    _new_entry_boilerplate = '''2009-08-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by NOBODY (OOPS!).
+
+        Need a short description and bug URL (OOPS!)
+
+        * Scripts/bugzilla-tool:
+'''
+
+    def test_set_reviewer(self):
+        changelog_contents = "%s\n%s" % (self._new_entry_boilerplate, self._example_changelog)
+        changelog_path = self._write_tmp_file_with_contents(changelog_contents)
+        reviewer_name = 'Test Reviewer'
+        ChangeLog(changelog_path).set_reviewer(reviewer_name)
+        actual_contents = self._read_file_contents(changelog_path)
+        expected_contents = changelog_contents.replace('NOBODY (OOPS!)', reviewer_name)
+        os.remove(changelog_path)
+        self.assertEquals(actual_contents, expected_contents)
+
+    _expected_revert_entry = '''2009-08-19  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r12345.
+        http://trac.webkit.org/changeset/12345
+
+        * Scripts/bugzilla-tool:
+'''
+
+    def test_update_for_revert(self):
+        changelog_contents = "%s\n%s" % (self._new_entry_boilerplate, self._example_changelog)
+        changelog_path = self._write_tmp_file_with_contents(changelog_contents)
+        changelog = ChangeLog(changelog_path)
+        changelog.update_for_revert(12345)
+        actual_entry = changelog.latest_entry()
+        os.remove(changelog_path)
+        self.assertEquals(actual_entry, self._expected_revert_entry)
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/Scripts/modules/comments.py b/WebKitTools/Scripts/modules/comments.py
new file mode 100755
index 0000000..eeee655
--- /dev/null
+++ b/WebKitTools/Scripts/modules/comments.py
@@ -0,0 +1,39 @@
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# Copyright (c) 2009 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# A tool for automating dealing with bugzilla, posting patches, committing patches, etc.
+
+from modules.changelogs import view_source_url
+
+def bug_comment_from_svn_revision(svn_revision):
+    return "Committed r%s: <%s>" % (svn_revision, view_source_url(svn_revision))
+
+def bug_comment_from_commit_text(scm, commit_text):
+    svn_revision = scm.svn_revision_from_commit_text(commit_text)
+    return bug_comment_from_svn_revision(svn_revision)
diff --git a/WebKitTools/Scripts/modules/committers.py b/WebKitTools/Scripts/modules/committers.py
index 6a7f436..e157fb4 100644
--- a/WebKitTools/Scripts/modules/committers.py
+++ b/WebKitTools/Scripts/modules/committers.py
@@ -45,13 +45,43 @@ class Reviewer(Committer):
 # All reviewers are committers, so this list is only of committers
 # who are not reviewers.
 committers_unable_to_review = [
+    Committer("Aaron Boodman", "aa@chromium.org"),
+    Committer("Adam Langley", "agl@chromium.org"),
     Committer("Albert J. Wong", "ajwong@chromium.org"),
+    Committer("Antonio Gomes", "tonikitoo@webkit.org"),
+    Committer("Anthony Ricaud", "rik@webkit.org"),
     Committer("Ben Murdoch", "benm@google.com"),
+    Committer("Brent Fulgham", "bfulgham@webkit.org"),
+    Committer("Brian Weinstein", "bweinstein@apple.com"),
+    Committer("Cameron McCormack", "cam@webkit.org"),
+    Committer("Daniel Bates", "dbates@webkit.org"),
+    Committer("Drew Wilson", "atwilson@chromium.org"),
+    Committer("Dirk Schulze", "krit@webkit.org"),
+    Committer("Dmitry Titov", "dimich@chromium.org"),
+    Committer("Eli Fidler", "eli@staikos.net"),
+    Committer("Eric Roman", "eroman@chromium.org"),
+    Committer("Fumitoshi Ukai", "ukai@chromium.org"),
+    Committer("Greg Bolsinga", "bolsinga@apple.com"),
+    Committer("Jeremy Moskovich", "playmobil@google.com"),
     Committer("Jeremy Orlow", "jorlow@chromium.org"),
+    Committer("Jian Li", "jianli@chromium.org"),
+    Committer("John Abd-El-Malek", "jam@chromium.org"),
+    Committer("Joseph Pecoraro", "joepeck@webkit.org"),
+    Committer("Julie Parent", "jparent@google.com"),
+    Committer("Kenneth Rohde Christiansen", "kenneth@webkit.org"),
+    Committer("Laszlo Gombos", "laszlo.1.gombos@nokia.com"),
+    Committer("Nate Chapin", "japhet@chromium.org"),
+    Committer("Ojan Vafai", "ojan@chromium.org"),
+    Committer("Pam Greene", "pam@chromium.org"),
     Committer("Peter Kasting", "pkasting@google.com"),
     Committer("Pierre d'Herbemont", "pdherbemont@free.fr"),
-    Committer("Shinichiro Hamaji", "hamaji@google.com"),
-    Committer("Zoltan Horvath", "hzoltan@inf.u-szeged.hu"),
+    Committer("Ryosuke Niwa", "rniwa@webkit.org"),
+    Committer("Scott Violet", "sky@chromium.org"),
+    Committer("Shinichiro Hamaji", "hamaji@chromium.org"),
+    Committer("Tony Chang", "tony@chromium.org"),
+    Committer("Yael Aharon", "yael.aharon@nokia.com"),
+    Committer("Yong Li", "yong.li@torchmobile.com"),
+    Committer("Zoltan Horvath", "zoltan@webkit.org"),
 ]
 
 reviewers_list = [
@@ -71,12 +101,15 @@ reviewers_list = [
     Reviewer("David Kilzer", "ddkilzer@webkit.org"),
     Reviewer("David Levin", "levin@chromium.org"),
     Reviewer("Dimitri Glazkov", "dglazkov@chromium.org"),
+    Reviewer("Eric Carlson", "eric.carlson@apple.com"),
     Reviewer("Eric Seidel", "eric@webkit.org"),
     Reviewer("Gavin Barraclough", "barraclough@apple.com"),
+    Reviewer("Geoffrey Garen", "ggaren@apple.com"),
     Reviewer("George Staikos", "staikos@kde.org"),
     Reviewer("Gustavo Noronha", "gns@gnome.org"),
     Reviewer("Holger Freyther", "zecke@selfish.org"),
     Reviewer("Jan Alonzo", "jmalonzo@gmail.com"),
+    Reviewer("John Sullivan", "sullivan@apple.com"),
     Reviewer("Justin Garcia", "justin.garcia@apple.com"),
     Reviewer("Kevin McCullough", "kmccullough@apple.com"),
     Reviewer("Kevin Ollivier", "kevino@theolliviers.com"),
@@ -111,13 +144,10 @@ class CommitterList:
         return self._committers_by_email
 
     def committer_by_bugzilla_email(self, bugzilla_email):
-        committer = self._email_to_committer_map().get(bugzilla_email)
-        if not committer:
-            raise Exception("Unknown committer: %s" % bugzilla_email)
-        return committer
+        return self._email_to_committer_map().get(bugzilla_email)
 
     def reviewer_by_bugzilla_email(self, bugzilla_email):
         committer = self.committer_by_bugzilla_email(bugzilla_email)
-        if not committer.can_review:
-            raise Exception("Committer %s does not have review rights." % committer)
+        if committer and not committer.can_review:
+            return None
         return committer
diff --git a/WebKitTools/Scripts/modules/commiters_unittest.py b/WebKitTools/Scripts/modules/committers_unittest.py
index d221c8b..045e20e 100644
--- a/WebKitTools/Scripts/modules/commiters_unittest.py
+++ b/WebKitTools/Scripts/modules/committers_unittest.py
@@ -42,11 +42,11 @@ class CommittersTest(unittest.TestCase):
         self.assertEqual(committer_list.committer_by_bugzilla_email('two@test.com'), reviewer)
 
         # Test that a known committer is not returned during reviewer lookup
-        self.assertRaises(Exception, committer_list.reviewer_by_bugzilla_email, 'one@test.com')
+        self.assertEqual(committer_list.reviewer_by_bugzilla_email('one@test.com'), None)
 
         # Test that unknown email address fail both committer and reviewer lookup
-        self.assertRaises(Exception, committer_list.committer_by_bugzilla_email, 'bar@bar.com')
-        self.assertRaises(Exception, committer_list.reviewer_by_bugzilla_email, 'bar@bar.com')
+        self.assertEqual(committer_list.committer_by_bugzilla_email('bar@bar.com'), None)
+        self.assertEqual(committer_list.reviewer_by_bugzilla_email('bar@bar.com'), None)
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/WebKitTools/Scripts/modules/cpp_style.py b/WebKitTools/Scripts/modules/cpp_style.py
index 86c0401..0c9dfa0 100644
--- a/WebKitTools/Scripts/modules/cpp_style.py
+++ b/WebKitTools/Scripts/modules/cpp_style.py
@@ -3,6 +3,7 @@
 #
 # Copyright (C) 2009 Google Inc. All rights reserved.
 # Copyright (C) 2009 Torch Mobile Inc.
+# Copyright (C) 2009 Apple Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
@@ -117,6 +118,7 @@ _ERROR_CATEGORIES = '''\
     build/namespaces
     build/printf_format
     build/storage_class
+    build/using_std
     legal/copyright
     readability/braces
     readability/casting
@@ -138,6 +140,7 @@ _ERROR_CATEGORIES = '''\
     runtime/int
     runtime/init
     runtime/invalid_increment
+    runtime/max_min_macros
     runtime/memset
     runtime/printf
     runtime/printf_format
@@ -1545,7 +1548,7 @@ def check_spacing(filename, clean_lines, line_number, error):
     # Alas, we can't test < or > because they're legitimately used sans spaces
     # (a->b, vector<int> a).  The only time we can tell is a < with no >, and
     # only if it's not template params list spilling into the next line.
-    matched = search(r'[^<>=!\s](==|!=|<=|>=)[^<>=!\s]', line)
+    matched = search(r'[^<>=!\s](==|!=|\+=|-=|\*=|/=|/|\|=|&=|<<=|>>=|<=|>=|\|\||\||&&|>>|<<)[^<>=!\s]', line)
     if not matched:
         # Note that while it seems that the '<[^<]*' term in the following
         # regexp could be simplified to '<.*', which would indeed match
@@ -1558,7 +1561,7 @@ def check_spacing(filename, clean_lines, line_number, error):
               'Missing spaces around %s' % matched.group(1))
     # We allow no-spaces around << and >> when used like this: 10<<20, but
     # not otherwise (particularly, not when used as streams)
-    matched = search(r'[^0-9\s](<<|>>)[^0-9\s]', line)
+    matched = search(r'[^0-9\s](<<|>>)[^0-9\s=]', line)
     if matched:
         error(filename, line_number, 'whitespace/operators', 3,
               'Missing spaces around %s' % matched.group(1))
@@ -1741,6 +1744,58 @@ def check_namespace_indentation(filename, clean_lines, line_number, file_extensi
             break
 
 
+def check_using_std(filename, clean_lines, line_number, error):
+    """Looks for 'using std::foo;' statements which should be replaced with 'using namespace std;'.
+
+    Args:
+      filename: The name of the current file.
+      clean_lines: A CleansedLines instance containing the file.
+      line_number: The number of the line to check.
+      error: The function to call with any errors found.
+    """
+
+    # This check doesn't apply to C or Objective-C implementation files.
+    if filename.endswith('.c') or filename.endswith('.m'):
+        return
+
+    line = clean_lines.elided[line_number] # Get rid of comments and strings.
+
+    using_std_match = match(r'\s*using\s+std::(?P<method_name>\S+)\s*;\s*$', line)
+    if not using_std_match:
+        return
+
+    method_name = using_std_match.group('method_name')
+    error(filename, line_number, 'build/using_std', 4,
+          "Use 'using namespace std;' instead of 'using std::%s;'." % method_name)
+
+
+def check_max_min_macros(filename, clean_lines, line_number, error):
+    """Looks use of MAX() and MIN() macros that should be replaced with std::max() and std::min().
+
+    Args:
+      filename: The name of the current file.
+      clean_lines: A CleansedLines instance containing the file.
+      line_number: The number of the line to check.
+      error: The function to call with any errors found.
+    """
+
+    # This check doesn't apply to C or Objective-C implementation files.
+    if filename.endswith('.c') or filename.endswith('.m'):
+        return
+
+    line = clean_lines.elided[line_number] # Get rid of comments and strings.
+
+    max_min_macros_search = search(r'\b(?P<max_min_macro>(MAX|MIN))\s*\(', line)
+    if not max_min_macros_search:
+        return
+
+    max_min_macro = max_min_macros_search.group('max_min_macro')
+    max_min_macro_lower = max_min_macro.lower()
+    error(filename, line_number, 'runtime/max_min_macros', 4,
+          'Use std::%s() or std::%s<type>() instead of the %s() macro.'
+          % (max_min_macro_lower, max_min_macro_lower, max_min_macro))
+
+
 def check_switch_indentation(filename, clean_lines, line_number, error):
     """Looks for indentation errors inside of switch statements.
 
@@ -2174,6 +2229,8 @@ def check_style(filename, clean_lines, line_number, file_extension, error):
 
     # Some more style checks
     check_namespace_indentation(filename, clean_lines, line_number, file_extension, error)
+    check_using_std(filename, clean_lines, line_number, error)
+    check_max_min_macros(filename, clean_lines, line_number, error)
     check_switch_indentation(filename, clean_lines, line_number, error)
     check_braces(filename, clean_lines, line_number, error)
     check_exit_statement_simplifications(filename, clean_lines, line_number, error)
@@ -3087,6 +3144,7 @@ def use_webkit_styles():
     #        modify the implementation and enable them.
     global _DEFAULT_FILTERS
     _DEFAULT_FILTERS = [
+        '-whitespace/end_of_line',
         '-whitespace/comments',
         '-whitespace/blank_line',
         '-runtime/explicit',  # explicit
diff --git a/WebKitTools/Scripts/modules/cpp_style_unittest.py b/WebKitTools/Scripts/modules/cpp_style_unittest.py
index ad01fc3..322356e 100644
--- a/WebKitTools/Scripts/modules/cpp_style_unittest.py
+++ b/WebKitTools/Scripts/modules/cpp_style_unittest.py
@@ -3,6 +3,7 @@
 #
 # Copyright (C) 2009 Google Inc. All rights reserved.
 # Copyright (C) 2009 Torch Mobile Inc.
+# Copyright (C) 2009 Apple Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
@@ -950,7 +951,7 @@ class CppStyleTest(CppStyleTestBase):
         self.assert_lint('int a[sizeof(struct Foo)];', '')
         self.assert_lint('int a[128 - sizeof(const bar)];', '')
         self.assert_lint('int a[(sizeof(foo) * 4)];', '')
-        self.assert_lint('int a[(arraysize(fixed_size_array)/2) << 1];', '')
+        self.assert_lint('int a[(arraysize(fixed_size_array)/2) << 1];', 'Missing spaces around /  [whitespace/operators] [3]')
         self.assert_lint('delete a[some_var];', '')
         self.assert_lint('return a[some_var];', '')
 
@@ -1208,6 +1209,62 @@ class CppStyleTest(CppStyleTestBase):
         self.assert_lint('typedef hash_map<Foo, Bar', 'Missing spaces around <'
                          '  [whitespace/operators] [3]')
         self.assert_lint('typedef hash_map<FoooooType, BaaaaarType,', '')
+        self.assert_lint('a<Foo> t+=b;', 'Missing spaces around +='
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo> t-=b;', 'Missing spaces around -='
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t*=b;', 'Missing spaces around *='
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t/=b;', 'Missing spaces around /='
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t|=b;', 'Missing spaces around |='
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t&=b;', 'Missing spaces around &='
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t<<=b;', 'Missing spaces around <<='
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t>>=b;', 'Missing spaces around >>='
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t>>=&b|c;', 'Missing spaces around >>='
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t<<=*b/c;', 'Missing spaces around <<='
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo> t -= b;', '')
+        self.assert_lint('a<Foo> t += b;', '')
+        self.assert_lint('a<Foo*> t *= b;', '')
+        self.assert_lint('a<Foo*> t /= b;', '')
+        self.assert_lint('a<Foo*> t |= b;', '')
+        self.assert_lint('a<Foo*> t &= b;', '')
+        self.assert_lint('a<Foo*> t <<= b;', '')
+        self.assert_lint('a<Foo*> t >>= b;', '')
+        self.assert_lint('a<Foo*> t >>= &b|c;', 'Missing spaces around |'
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t <<= *b/c;', 'Missing spaces around /'
+                         '  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t <<= b/c; //Test', ['At least two spaces'
+                         ' is best between code and comments  [whitespace/'
+                         'comments] [2]', 'Should have a space between // '
+                         'and comment  [whitespace/comments] [4]', 'Missing'
+                         ' spaces around /  [whitespace/operators] [3]'])
+        self.assert_lint('a<Foo*> t <<= b||c;  //Test', ['Should have a space'
+                         ' between // and comment  [whitespace/comments] [4]',
+                         'Missing spaces around ||  [whitespace/operators] [3]'])
+        self.assert_lint('a<Foo*> t <<= b&&c;  // Test', 'Missing spaces around'
+                         ' &&  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t <<= b&&&c;  // Test', 'Missing spaces around'
+                         ' &&  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t <<= b&&*c;  // Test', 'Missing spaces around'
+                         ' &&  [whitespace/operators] [3]')
+        self.assert_lint('a<Foo*> t <<= b && *c;  // Test', '')
+        self.assert_lint('a<Foo*> t <<= b && &c;  // Test', '')
+        self.assert_lint('a<Foo*> t <<= b || &c;  /*Test', 'Complex multi-line '
+                         '/*...*/-style comment found. Lint may give bogus '
+                         'warnings.  Consider replacing these with //-style'
+                         ' comments, with #if 0...#endif, or with more clearly'
+                         ' structured multi-line comments.  [readability/multiline_comment] [5]')
+        self.assert_lint('a<Foo&> t <<= &b | &c;', '')
+        self.assert_lint('a<Foo*> t <<= &b & &c;  // Test', '')
+        self.assert_lint('a<Foo*> t <<= *b / &c;  // Test', '')
 
     def test_spacing_before_last_semicolon(self):
         self.assert_lint('call_function() ;',
@@ -2959,7 +3016,7 @@ class WebKitStyleTest(CppStyleTestBase):
             'Missing space after ,  [whitespace/comma] [3]')
         self.assert_multi_line_lint(
             'c = a|b;',
-            '')
+            'Missing spaces around |  [whitespace/operators] [3]')
         # FIXME: We cannot catch this lint error.
         # self.assert_multi_line_lint(
         #     'return condition ? 1:0;',
@@ -3425,6 +3482,49 @@ class WebKitStyleTest(CppStyleTestBase):
             'if (othertrue == fontType)',
             '')
 
+    def test_using_std(self):
+        self.assert_lint(
+            'using std::min;',
+            "Use 'using namespace std;' instead of 'using std::min;'."
+            "  [build/using_std] [4]",
+            'foo.cpp')
+
+    def test_max_macro(self):
+        self.assert_lint(
+            'int i = MAX(0, 1);',
+            '',
+            'foo.c')
+
+        self.assert_lint(
+            'int i = MAX(0, 1);',
+            'Use std::max() or std::max<type>() instead of the MAX() macro.'
+            '  [runtime/max_min_macros] [4]',
+            'foo.cpp')
+
+        self.assert_lint(
+            'inline int foo() { return MAX(0, 1); }',
+            'Use std::max() or std::max<type>() instead of the MAX() macro.'
+            '  [runtime/max_min_macros] [4]',
+            'foo.h')
+
+    def test_min_macro(self):
+        self.assert_lint(
+            'int i = MIN(0, 1);',
+            '',
+            'foo.c')
+
+        self.assert_lint(
+            'int i = MIN(0, 1);',
+            'Use std::min() or std::min<type>() instead of the MIN() macro.'
+            '  [runtime/max_min_macros] [4]',
+            'foo.cpp')
+
+        self.assert_lint(
+            'inline int foo() { return MIN(0, 1); }',
+            'Use std::min() or std::min<type>() instead of the MIN() macro.'
+            '  [runtime/max_min_macros] [4]',
+            'foo.h')
+
     def test_names(self):
         # FIXME: Implement this.
         pass
diff --git a/WebKitTools/Scripts/modules/logging.py b/WebKitTools/Scripts/modules/logging.py
index ea03a48..cbccacf 100644
--- a/WebKitTools/Scripts/modules/logging.py
+++ b/WebKitTools/Scripts/modules/logging.py
@@ -35,5 +35,14 @@ def log(string):
     print >> sys.stderr, string
 
 def error(string):
-    log("ERROR: " + string)
+    log("ERROR: %s" % string)
     exit(1)
+
+# Simple class to split output between multiple destinations
+class tee:
+    def __init__(self, *files):
+        self.files = files
+
+    def write(self, string):
+        for file in self.files:
+            file.write(string)
diff --git a/WebKitTools/Scripts/modules/logging_unittest.py b/WebKitTools/Scripts/modules/logging_unittest.py
new file mode 100644
index 0000000..7d41e56
--- /dev/null
+++ b/WebKitTools/Scripts/modules/logging_unittest.py
@@ -0,0 +1,61 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+import subprocess
+import StringIO
+import tempfile
+import unittest
+
+from modules.logging import *
+from modules.scm import ScriptError
+
+class LoggingTest(unittest.TestCase):
+
+    def assert_log_equals(self, log_input, expected_output):
+        original_stderr = sys.stderr
+        test_stderr = StringIO.StringIO()
+        sys.stderr = test_stderr
+
+        try:
+            log(log_input)
+            actual_output = test_stderr.getvalue()
+        finally:
+            original_stderr = original_stderr
+
+        self.assertEquals(actual_output, expected_output, "log(\"%s\") expected: %s actual: %s" % (log_input, expected_output, actual_output))
+
+    def test_log(self):
+        self.assert_log_equals("test", "test\n")
+
+        # Test that log() does not throw an exception when passed an object instead of a string.
+        self.assert_log_equals(ScriptError(message="ScriptError"), "ScriptError\n")
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/Scripts/modules/scm.py b/WebKitTools/Scripts/modules/scm.py
index ec1f362..3daecbc 100644
--- a/WebKitTools/Scripts/modules/scm.py
+++ b/WebKitTools/Scripts/modules/scm.py
@@ -78,8 +78,43 @@ class CommitMessage:
 
 
 class ScriptError(Exception):
-    pass
+    def __init__(self, message=None, script_args=None, exit_code=None, output=None, cwd=None):
+        if not message:
+            message = 'Failed to run "%s"' % script_args
+            if exit_code:
+                message += " exit_code: %d" % exit_code
+            if cwd:
+                message += " cwd: %s" % cwd
+
+        Exception.__init__(self, message)
+        self.script_args = script_args # 'args' is already used by Exception
+        self.exit_code = exit_code
+        self.output = output
+        self.cwd = cwd
+
+    def message_with_output(self, output_limit=500):
+        if self.output:
+            if len(self.output) > output_limit:
+                 return "%s\nLast %s characters of output:\n%s" % (self, output_limit, self.output[-output_limit:])
+            return "%s\n%s" % (self, self.output)
+        return str(self)
+
 
+class CheckoutNeedsUpdate(ScriptError):
+    def __init__(self, script_args, exit_code, output, cwd):
+        ScriptError.__init__(self, script_args=script_args, exit_code=exit_code, output=output, cwd=cwd)
+
+
+def default_error_handler(error):
+    raise error
+
+def commit_error_handler(error):
+    if re.search("resource out of date", error.output):
+        raise CheckoutNeedsUpdate(script_args=error.script_args, exit_code=error.exit_code, output=error.output, cwd=error.cwd)
+    default_error_handler(error)
+
+def ignore_error(error):
+    pass
 
 class SCM:
     def __init__(self, cwd, dryrun=False):
@@ -88,24 +123,28 @@ class SCM:
         self.dryrun = dryrun
 
     @staticmethod
-    def run_command(args, cwd=None, input=None, raise_on_failure=True, return_exit_code=False):
+    def run_command(args, cwd=None, input=None, error_handler=default_error_handler, return_exit_code=False):
         stdin = subprocess.PIPE if input else None
-        process = subprocess.Popen(args, stdout=subprocess.PIPE, stdin=stdin, cwd=cwd)
+        process = subprocess.Popen(args, stdin=stdin, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=cwd)
         output = process.communicate(input)[0].rstrip()
         exit_code = process.wait()
-        if raise_on_failure and exit_code:
-            raise ScriptError('Failed to run "%s"  exit_code: %d  cwd: %s' % (args, exit_code, cwd))
+        if exit_code:
+            script_error = ScriptError(script_args=args, exit_code=exit_code, output=output, cwd=cwd)
+            error_handler(script_error)
         if return_exit_code:
             return exit_code
         return output
 
+    def scripts_directory(self):
+        return os.path.join(self.checkout_root, "WebKitTools", "Scripts")
+
     def script_path(self, script_name):
-        return os.path.join(self.checkout_root, "WebKitTools", "Scripts", script_name)
+        return os.path.join(self.scripts_directory(), script_name)
 
     def ensure_clean_working_directory(self, force):
         if not force and not self.working_directory_is_clean():
-            print self.run_command(self.status_command(), raise_on_failure=False)
-            raise ScriptError("Working directory has modifications, pass --force-clean or --no-clean to continue.")
+            print self.run_command(self.status_command(), error_handler=ignore_error)
+            raise ScriptError(message="Working directory has modifications, pass --force-clean or --no-clean to continue.")
         
         log("Cleaning working directory")
         self.clean_working_directory()
@@ -123,7 +162,7 @@ class SCM:
     def apply_patch(self, patch, force=False):
         # It's possible that the patch was not made from the root directory.
         # We should detect and handle that case.
-        curl_process = subprocess.Popen(['curl', patch['url']], stdout=subprocess.PIPE)
+        curl_process = subprocess.Popen(['curl', '--location', '--silent', '--show-error', patch['url']], stdout=subprocess.PIPE)
         args = [self.script_path('svn-apply'), '--reviewer', patch['reviewer']]
         if force:
             args.append('--force')
@@ -131,7 +170,7 @@ class SCM:
 
         return_code = patch_apply_process.wait()
         if return_code:
-            raise ScriptError("Patch %s from bug %s failed to download and apply." % (patch['url'], patch['bug_id']))
+            raise ScriptError(message="Patch %s from bug %s failed to download and apply." % (patch['url'], patch['bug_id']))
 
     def run_status_and_extract_filenames(self, status_command, status_regexp):
         filenames = []
@@ -144,6 +183,25 @@ class SCM:
             filenames.append(filename)
         return filenames
 
+    def strip_r_from_svn_revision(self, svn_revision):
+        match = re.match("^r(?P<svn_revision>\d+)", svn_revision)
+        if (match):
+            return match.group('svn_revision')
+        return svn_revision
+
+    def svn_revision_from_commit_text(self, commit_text):
+        match = re.search(self.commit_success_regexp(), commit_text, re.MULTILINE)
+        return match.group('svn_revision')
+
+    # ChangeLog-specific code doesn't really belong in scm.py, but this function is very useful.
+    def modified_changelogs(self):
+        changelog_paths = []
+        paths = self.changed_files()
+        for path in paths:
+            if os.path.basename(path) == "ChangeLog":
+                changelog_paths.append(path)
+        return changelog_paths
+
     @staticmethod
     def in_working_directory(path):
         raise NotImplementedError, "subclasses must implement"
@@ -177,9 +235,24 @@ class SCM:
     def create_patch(self):
         raise NotImplementedError, "subclasses must implement"
 
+    def diff_for_revision(self, revision):
+        raise NotImplementedError, "subclasses must implement"
+
+    def apply_reverse_diff(self, revision):
+        raise NotImplementedError, "subclasses must implement"
+
+    def revert_files(self, file_paths):
+        raise NotImplementedError, "subclasses must implement"
+
     def commit_with_message(self, message):
         raise NotImplementedError, "subclasses must implement"
-    
+
+    def svn_commit_log(self, svn_revision):
+        raise NotImplementedError, "subclasses must implement"
+
+    def last_svn_commit_log(self):
+        raise NotImplementedError, "subclasses must implement"
+
     # Subclasses must indicate if they support local commits,
     # but the SCM baseclass will only call local_commits methods when this is true.
     @staticmethod
@@ -211,16 +284,21 @@ class SVN(SCM):
     def in_working_directory(path):
         return os.path.isdir(os.path.join(path, '.svn'))
     
-    @staticmethod
-    def find_uuid(path):
-        if not SVN.in_working_directory(path):
+    @classmethod
+    def find_uuid(cls, path):
+        if not cls.in_working_directory(path):
             return None
-        info = SVN.run_command(['svn', 'info', path])
-        match = re.search("^Repository UUID: (?P<uuid>.+)$", info, re.MULTILINE)
+        return cls.value_from_svn_info(path, 'Repository UUID')
+
+    @classmethod
+    def value_from_svn_info(cls, path, field_name):
+        svn_info_args = ['svn', 'info', path]
+        info_output = cls.run_command(svn_info_args)
+        match = re.search("^%s: (?P<value>.+)$" % field_name, info_output, re.MULTILINE)
         if not match:
-            raise ScriptError('svn info did not contain a UUID.')
-        return match.group('uuid')
-    
+            raise ScriptError(script_args=svn_info_args, message='svn info did not contain a %s.' % field_name)
+        return match.group('value')
+
     @staticmethod
     def find_checkout_root(path):
         uuid = SVN.find_uuid(path)
@@ -236,11 +314,11 @@ class SVN(SCM):
             (path, last_component) = os.path.split(path)
             if last_path == path:
                 return None
-    
+
     @staticmethod
     def commit_success_regexp():
         return "^Committed revision (?P<svn_revision>\d+)\.$"
-    
+
     def svn_version(self):
         if not self.cached_version:
             self.cached_version = self.run_command(['svn', '--version', '--quiet'])
@@ -274,19 +352,44 @@ class SVN(SCM):
         return "svn"
 
     def create_patch(self):
-        return self.run_command(self.script_path("svn-create-patch"))
+        return self.run_command(self.script_path("svn-create-patch"), cwd=self.checkout_root)
+
+    def diff_for_revision(self, revision):
+        return self.run_command(['svn', 'diff', '-c', str(revision)])
+
+    def _repository_url(self):
+        return self.value_from_svn_info(self.checkout_root, 'URL')
+
+    def apply_reverse_diff(self, revision):
+        # '-c -revision' applies the inverse diff of 'revision'
+        svn_merge_args = ['svn', 'merge', '--non-interactive', '-c', '-%s' % revision, self._repository_url()]
+        log("WARNING: svn merge has been known to take more than 10 minutes to complete.  It is recommended you use git for rollouts.")
+        log("Running '%s'" % " ".join(svn_merge_args))
+        self.run_command(svn_merge_args)
+
+    def revert_files(self, file_paths):
+        self.run_command(['svn', 'revert'] + file_paths)
 
     def commit_with_message(self, message):
         if self.dryrun:
-            return "Dry run, no remote commit."
-        return self.run_command(['svn', 'commit', '-m', message])
+            # Return a string which looks like a commit so that things which parse this output will succeed.
+            return "Dry run, no commit.\nCommitted revision 0."
+        return self.run_command(['svn', 'commit', '-m', message], error_handler=commit_error_handler)
+
+    def svn_commit_log(self, svn_revision):
+        svn_revision = self.strip_r_from_svn_revision(str(svn_revision))
+        return self.run_command(['svn', 'log', '--non-interactive', '--revision', svn_revision]);
 
+    def last_svn_commit_log(self):
+        # BASE is the checkout revision, HEAD is the remote repository revision
+        # http://svnbook.red-bean.com/en/1.0/ch03s03.html
+        return self.svn_commit_log('BASE')
 
 # All git-specific logic should go here.
 class Git(SCM):
     def __init__(self, cwd, dryrun=False):
         SCM.__init__(self, cwd, dryrun)
-    
+
     @classmethod
     def in_working_directory(cls, path):
         return cls.run_command(['git', 'rev-parse', '--is-inside-work-tree'], cwd=path) == "true"
@@ -303,22 +406,29 @@ class Git(SCM):
     @staticmethod
     def commit_success_regexp():
         return "^Committed r(?P<svn_revision>\d+)$"
-    
+
+
     def discard_local_commits(self):
         self.run_command(['git', 'reset', '--hard', 'trunk'])
     
     def local_commits(self):
         return self.run_command(['git', 'log', '--pretty=oneline', 'HEAD...trunk']).splitlines()
 
+    def rebase_in_progress(self):
+        return os.path.exists(os.path.join(self.checkout_root, '.git/rebase-apply'))
+
     def working_directory_is_clean(self):
         return self.run_command(['git', 'diff-index', 'HEAD']) == ""
-    
+
     def clean_working_directory(self):
         # Could run git clean here too, but that wouldn't match working_directory_is_clean
         self.run_command(['git', 'reset', '--hard', 'HEAD'])
-    
+        # Aborting rebase even though this does not match working_directory_is_clean
+        if self.rebase_in_progress():
+            self.run_command(['git', 'rebase', '--abort'])
+
     def update_webkit(self):
-        # FIXME: Should probably call update-webkit, no?
+        # FIXME: Call update-webkit once https://bugs.webkit.org/show_bug.cgi?id=27162 is fixed.
         log("Updating working directory")
         self.run_command(['git', 'svn', 'rebase'])
 
@@ -340,10 +450,44 @@ class Git(SCM):
     def create_patch(self):
         return self.run_command(['git', 'diff', 'HEAD'])
 
+    @classmethod
+    def git_commit_from_svn_revision(cls, revision):
+        # git svn find-rev always exits 0, even when the revision is not found.
+        return cls.run_command(['git', 'svn', 'find-rev', 'r%s' % revision])
+
+    def diff_for_revision(self, revision):
+        git_commit = self.git_commit_from_svn_revision(revision)
+        return self.create_patch_from_local_commit(git_commit)
+
+    def apply_reverse_diff(self, revision):
+        # Assume the revision is an svn revision.
+        git_commit = self.git_commit_from_svn_revision(revision)
+        if not git_commit:
+            raise ScriptError(message='Failed to find git commit for revision %s, git svn log output: "%s"' % (revision, git_commit))
+
+        # I think this will always fail due to ChangeLogs.
+        # FIXME: We need to detec specific failure conditions and handle them.
+        self.run_command(['git', 'revert', '--no-commit', git_commit], error_handler=ignore_error)
+
+        # Fix any ChangeLogs if necessary.
+        changelog_paths = self.modified_changelogs()
+        if len(changelog_paths):
+            self.run_command([self.script_path('resolve-ChangeLogs')] + changelog_paths)
+
+    def revert_files(self, file_paths):
+        self.run_command(['git', 'checkout', 'HEAD'] + file_paths)
+
     def commit_with_message(self, message):
         self.commit_locally_with_message(message)
         return self.push_local_commits_to_server()
 
+    def svn_commit_log(self, svn_revision):
+        svn_revision = self.strip_r_from_svn_revision(svn_revision)
+        return self.run_command(['git', 'svn', 'log', '-r', svn_revision])
+
+    def last_svn_commit_log(self):
+        return self.run_command(['git', 'svn', 'log', '--limit=1'])
+
     # Git-specific methods:
 
     def create_patch_from_local_commit(self, commit_id):
@@ -357,8 +501,9 @@ class Git(SCM):
         
     def push_local_commits_to_server(self):
         if self.dryrun:
-            return "Dry run, no remote commit."
-        return self.run_command(['git', 'svn', 'dcommit'])
+            # Return a string which looks like a commit so that things which parse this output will succeed.
+            return "Dry run, no remote commit.\nCommitted r0"
+        return self.run_command(['git', 'svn', 'dcommit'], error_handler=commit_error_handler)
 
     # This function supports the following argument formats:
     # no args : rev-list trunk..HEAD
@@ -373,9 +518,9 @@ class Git(SCM):
         commit_ids = []
         for commitish in args:
             if '...' in commitish:
-                raise ScriptError("'...' is not supported (found in '%s'). Did you mean '..'?" % commitish)
+                raise ScriptError(message="'...' is not supported (found in '%s'). Did you mean '..'?" % commitish)
             elif '..' in commitish:
-                commit_ids += self.run_command(['git', 'rev-list', commitish]).splitlines()
+                commit_ids += reversed(self.run_command(['git', 'rev-list', commitish]).splitlines())
             else:
                 # Turn single commits or branch or tag names into commit ids.
                 commit_ids += self.run_command(['git', 'rev-parse', '--revs-only', commitish]).splitlines()
diff --git a/WebKitTools/Scripts/modules/scm_unittest.py b/WebKitTools/Scripts/modules/scm_unittest.py
index 5bf2726..58494a0 100644
--- a/WebKitTools/Scripts/modules/scm_unittest.py
+++ b/WebKitTools/Scripts/modules/scm_unittest.py
@@ -1,4 +1,5 @@
 # Copyright (C) 2009 Google Inc. All rights reserved.
+# Copyright (C) 2009 Apple Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
@@ -26,18 +27,40 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import base64
 import os
+import re
+import stat
 import subprocess
 import tempfile
 import unittest
-from modules.scm import detect_scm_system, SCM, ScriptError
+import urllib
+from modules.scm import detect_scm_system, SCM, ScriptError, CheckoutNeedsUpdate, ignore_error, commit_error_handler
 
 
 # Eventually we will want to write tests which work for both scms. (like update_webkit, changed_files, etc.)
 # Perhaps through some SCMTest base-class which both SVNTest and GitTest inherit from.
 
-def run(args):
-    SCM.run_command(args)
+def run(args, cwd=None):
+    return SCM.run_command(args, cwd=cwd)
+
+def run_silent(args, cwd=None):
+    process = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=cwd)
+    process.communicate() # ignore output
+    exit_code = process.wait()
+    if exit_code:
+        raise ScriptError('Failed to run "%s"  exit_code: %d  cwd: %s' % (args, exit_code, cwd))
+
+def write_into_file_at_path(file_path, contents):
+    file = open(file_path, 'w')
+    file.write(contents)
+    file.close()
+
+def read_from_path(file_path):
+    file = open(file_path, 'r')
+    contents = file.read()
+    file.close()
+    return contents
 
 # Exists to share svn repository creation code between the git and svn tests
 class SVNTestRepository:
@@ -57,13 +80,23 @@ class SVNTestRepository:
         
         run(['svn', 'commit', '--quiet', '--message', 'second commit'])
         
-        test_file.write("test3")
-        test_file.close()
+        test_file.write("test3\n")
+        test_file.flush()
         
         run(['svn', 'commit', '--quiet', '--message', 'third commit'])
 
+        test_file.write("test4\n")
+        test_file.close()
+
+        run(['svn', 'commit', '--quiet', '--message', 'fourth commit'])
+
+        # svn does not seem to update after commit as I would expect.
+        run(['svn', 'update'])
+
     @classmethod
     def setup(cls, test_object):
+        test_object.original_path = os.path.abspath('.')
+
         # Create an test SVN repository
         test_object.svn_repo_path = tempfile.mkdtemp(suffix="svn_test_repo")
         test_object.svn_repo_url = "file://%s" % test_object.svn_repo_path # Not sure this will work on windows
@@ -83,29 +116,161 @@ class SVNTestRepository:
         run(['rm', '-rf', test_object.svn_checkout_path])
 
 
-class SVNTest(unittest.TestCase):
+class SCMTest(unittest.TestCase):
+    def _create_patch(self, patch_contents):
+        patch_path = os.path.join(self.svn_checkout_path, 'patch.diff')
+        write_into_file_at_path(patch_path, patch_contents)
+        patch = {}
+        patch['reviewer'] = 'Joe Cool'
+        patch['bug_id'] = '12345'
+        patch['url'] = 'file://%s' % urllib.pathname2url(patch_path)
+        return patch
+
+    def _setup_webkittools_scripts_symlink(self, local_scm):
+        webkit_scm = detect_scm_system(self.original_path)
+        webkit_scripts_directory = webkit_scm.scripts_directory()
+        local_scripts_directory = local_scm.scripts_directory()
+        os.mkdir(os.path.dirname(local_scripts_directory))
+        os.symlink(webkit_scripts_directory, local_scripts_directory)
+
+    def test_error_handlers(self):
+        git_failure_message="Merge conflict during commit: Your file or directory 'WebCore/ChangeLog' is probably out-of-date: resource out of date; try updating at /usr/local/libexec/git-core//git-svn line 469"
+        svn_failure_message="""svn: Commit failed (details follow):
+svn: File or directory 'ChangeLog' is out of date; try updating
+svn: resource out of date; try updating
+"""
+        command_does_not_exist = ['does_not_exist', 'invalid_option']
+        self.assertRaises(OSError, SCM.run_command, command_does_not_exist)
+        self.assertRaises(OSError, SCM.run_command, command_does_not_exist, error_handler=ignore_error)
+
+        command_returns_non_zero = ['/bin/sh', '--invalid-option']
+        self.assertRaises(ScriptError, SCM.run_command, command_returns_non_zero)
+        self.assertTrue(SCM.run_command(command_returns_non_zero, error_handler=ignore_error))
+
+        self.assertRaises(CheckoutNeedsUpdate, commit_error_handler, ScriptError(output=git_failure_message))
+        self.assertRaises(CheckoutNeedsUpdate, commit_error_handler, ScriptError(output=svn_failure_message))
+        self.assertRaises(ScriptError, commit_error_handler, ScriptError(output='blah blah blah'))
+
+
+    # Tests which both GitTest and SVNTest should run.
+    # FIXME: There must be a simpler way to add these w/o adding a wrapper method to both subclasses
+    def _shared_test_commit_with_message(self):
+        write_into_file_at_path('test_file', 'more test content')
+        commit_text = self.scm.commit_with_message('another test commit')
+        self.assertEqual(self.scm.svn_revision_from_commit_text(commit_text), '5')
+
+        self.scm.dryrun = True
+        write_into_file_at_path('test_file', 'still more test content')
+        commit_text = self.scm.commit_with_message('yet another test commit')
+        self.assertEqual(self.scm.svn_revision_from_commit_text(commit_text), '0')
+
+    def _shared_test_reverse_diff(self):
+        self._setup_webkittools_scripts_symlink(self.scm) # Git's apply_reverse_diff uses resolve-ChangeLogs
+        # Only test the simple case, as any other will end up with conflict markers.
+        self.scm.apply_reverse_diff('4')
+        self.assertEqual(read_from_path('test_file'), "test1test2test3\n")
+
+    def _shared_test_diff_for_revision(self):
+        # Patch formats are slightly different between svn and git, so just regexp for things we know should be there.
+        r3_patch = self.scm.diff_for_revision(3)
+        self.assertTrue(re.search('test3', r3_patch))
+        self.assertFalse(re.search('test4', r3_patch))
+        self.assertTrue(re.search('test2', r3_patch))
+        self.assertTrue(re.search('test2', self.scm.diff_for_revision(2)))
+
+
+class SVNTest(SCMTest):
 
     def setUp(self):
         SVNTestRepository.setup(self)
         os.chdir(self.svn_checkout_path)
+        self.scm = detect_scm_system(self.svn_checkout_path)
 
     def tearDown(self):
         SVNTestRepository.tear_down(self)
+        os.chdir(self.original_path)
+
+    def test_create_patch_is_full_patch(self):
+        test_dir_path = os.path.join(self.svn_checkout_path, 'test_dir')
+        os.mkdir(test_dir_path)
+        test_file_path = os.path.join(test_dir_path, 'test_file2')
+        write_into_file_at_path(test_file_path, 'test content')
+        run(['svn', 'add', 'test_dir'])
+
+        # create_patch depends on 'svn-create-patch', so make a dummy version.
+        scripts_path = os.path.join(self.svn_checkout_path, 'WebKitTools', 'Scripts')
+        os.makedirs(scripts_path)
+        create_patch_path = os.path.join(scripts_path, 'svn-create-patch')
+        write_into_file_at_path(create_patch_path, '#!/bin/sh\necho $PWD')
+        os.chmod(create_patch_path, stat.S_IXUSR | stat.S_IRUSR)
+
+        # Change into our test directory and run the create_patch command.
+        os.chdir(test_dir_path)
+        scm = detect_scm_system(test_dir_path)
+        self.assertEqual(scm.checkout_root, self.svn_checkout_path) # Sanity check that detection worked right.
+        patch_contents = scm.create_patch()
+        # Our fake 'svn-create-patch' returns $PWD instead of a patch, check that it was executed from the root of the repo.
+        self.assertEqual(os.path.realpath(scm.checkout_root), patch_contents)
 
     def test_detection(self):
         scm = detect_scm_system(self.svn_checkout_path)
         self.assertEqual(scm.display_name(), "svn")
         self.assertEqual(scm.supports_local_commits(), False)
 
-class GitTest(unittest.TestCase):
+    def test_apply_small_binary_patch(self):
+        patch_contents = """Index: test_file.swf
+===================================================================
+Cannot display: file marked as a binary type.
+svn:mime-type = application/octet-stream
+
+Property changes on: test_file.swf
+___________________________________________________________________
+Name: svn:mime-type
+   + application/octet-stream
+
+
+Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==
+"""
+        expected_contents = base64.b64decode("Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==")
+        self._setup_webkittools_scripts_symlink(self.scm)
+        patch_file = self._create_patch(patch_contents)
+        self.scm.apply_patch(patch_file)
+        actual_contents = read_from_path("test_file.swf")
+        self.assertEqual(actual_contents, expected_contents)
+
+    def test_apply_svn_patch(self):
+        scm = detect_scm_system(self.svn_checkout_path)
+        patch = self._create_patch(run(['svn', 'diff', '-r4:3']))
+        self._setup_webkittools_scripts_symlink(scm)
+        scm.apply_patch(patch)
+
+    def test_apply_svn_patch_force(self):
+        scm = detect_scm_system(self.svn_checkout_path)
+        patch = self._create_patch(run(['svn', 'diff', '-r2:4']))
+        self._setup_webkittools_scripts_symlink(scm)
+        self.assertRaises(ScriptError, scm.apply_patch, patch, force=True)
+
+    def test_commit_logs(self):
+        # Commits have dates and usernames in them, so we can't just direct compare.
+        self.assertTrue(re.search('fourth commit', self.scm.last_svn_commit_log()))
+        self.assertTrue(re.search('second commit', self.scm.svn_commit_log(2)))
+
+    def test_commit_text_parsing(self):
+        self._shared_test_commit_with_message()
+
+    def test_reverse_diff(self):
+        self._shared_test_reverse_diff()
+
+    def test_diff_for_revision(self):
+        self._shared_test_diff_for_revision()
+
+
+class GitTest(SCMTest):
 
     def _setup_git_clone_of_svn_repository(self):
         self.git_checkout_path = tempfile.mkdtemp(suffix="git_test_checkout")
-        # --quiet doesn't make git svn silent, so we redirect output
-        args = ['git', 'svn', '--quiet', 'clone', self.svn_repo_url, self.git_checkout_path]
-        git_svn_clone = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-        git_svn_clone.communicate() # ignore output
-        git_svn_clone.wait()
+        # --quiet doesn't make git svn silent, so we use run_silent to redirect output
+        run_silent(['git', 'svn', '--quiet', 'clone', self.svn_repo_url, self.git_checkout_path])
 
     def _tear_down_git_clone_of_svn_repository(self):
         run(['rm', '-rf', self.git_checkout_path])
@@ -114,26 +279,81 @@ class GitTest(unittest.TestCase):
         SVNTestRepository.setup(self)
         self._setup_git_clone_of_svn_repository()
         os.chdir(self.git_checkout_path)
+        self.scm = detect_scm_system(self.git_checkout_path)
 
     def tearDown(self):
         SVNTestRepository.tear_down(self)
         self._tear_down_git_clone_of_svn_repository()
+        os.chdir(self.original_path)
 
     def test_detection(self):
         scm = detect_scm_system(self.git_checkout_path)
         self.assertEqual(scm.display_name(), "git")
         self.assertEqual(scm.supports_local_commits(), True)
 
-    def test_commitish_parsing(self):
+    def test_rebase_in_progress(self):
+        svn_test_file = os.path.join(self.svn_checkout_path, 'test_file')
+        write_into_file_at_path(svn_test_file, "svn_checkout")
+        run(['svn', 'commit', '--message', 'commit to conflict with git commit'], cwd=self.svn_checkout_path)
+
+        git_test_file = os.path.join(self.git_checkout_path, 'test_file')
+        write_into_file_at_path(git_test_file, "git_checkout")
+        run(['git', 'commit', '-a', '-m', 'commit to be thrown away by rebase abort'])
+
+        # --quiet doesn't make git svn silent, so use run_silent to redirect output
+        self.assertRaises(ScriptError, run_silent, ['git', 'svn', '--quiet', 'rebase']) # Will fail due to a conflict leaving us mid-rebase.
+
         scm = detect_scm_system(self.git_checkout_path)
+        self.assertTrue(scm.rebase_in_progress())
+
+        # Make sure our cleanup works.
+        scm.clean_working_directory()
+        self.assertFalse(scm.rebase_in_progress())
+
+        # Make sure cleanup doesn't throw when no rebase is in progress.
+        scm.clean_working_directory()
 
+    def test_commitish_parsing(self):
+        scm = detect_scm_system(self.git_checkout_path)
+    
         # Multiple revisions are cherry-picked.
         self.assertEqual(len(scm.commit_ids_from_commitish_arguments(['HEAD~2'])), 1)
         self.assertEqual(len(scm.commit_ids_from_commitish_arguments(['HEAD', 'HEAD~2'])), 2)
-
+    
         # ... is an invalid range specifier
         self.assertRaises(ScriptError, scm.commit_ids_from_commitish_arguments, ['trunk...HEAD'])
 
+    def test_commitish_order(self):
+        scm = detect_scm_system(self.git_checkout_path)
+
+        commit_range = 'HEAD~3..HEAD'
+
+        actual_commits = scm.commit_ids_from_commitish_arguments([commit_range])
+        expected_commits = []
+        expected_commits += reversed(run(['git', 'rev-list', commit_range]).splitlines())
+
+        self.assertEqual(actual_commits, expected_commits)
+
+    def test_apply_git_patch(self):
+        scm = detect_scm_system(self.git_checkout_path)
+        patch = self._create_patch(run(['git', 'diff', 'HEAD..HEAD^']))
+        self._setup_webkittools_scripts_symlink(scm)
+        scm.apply_patch(patch)
+
+    def test_apply_git_patch_force(self):
+        scm = detect_scm_system(self.git_checkout_path)
+        patch = self._create_patch(run(['git', 'diff', 'HEAD~2..HEAD']))
+        self._setup_webkittools_scripts_symlink(scm)
+        self.assertRaises(ScriptError, scm.apply_patch, patch, force=True)
+
+    def test_commit_text_parsing(self):
+        self._shared_test_commit_with_message()
+
+    def test_reverse_diff(self):
+        self._shared_test_reverse_diff()
+
+    def test_diff_for_revision(self):
+        self._shared_test_diff_for_revision()
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/WebKitTools/Scripts/modules/statusbot.py b/WebKitTools/Scripts/modules/statusbot.py
new file mode 100644
index 0000000..9c9ba04
--- /dev/null
+++ b/WebKitTools/Scripts/modules/statusbot.py
@@ -0,0 +1,66 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# WebKit's Python module for interacting with the Commit Queue status page.
+
+# WebKit includes a built copy of BeautifulSoup in Scripts/modules
+# so this import should always succeed.
+from .BeautifulSoup import BeautifulSoup
+
+try:
+    from mechanize import Browser
+except ImportError, e:
+    print """
+mechanize is required.
+
+To install:
+sudo easy_install mechanize
+
+Or from the web:
+http://wwwsearch.sourceforge.net/mechanize/
+"""
+    exit(1)
+
+class StatusBot:
+    default_host = "webkit-commit-queue.appspot.com"
+
+    def __init__(self, host=default_host):
+        self.statusbot_host = host
+        self.statusbot_server_url = "http://%s" % self.statusbot_host
+        self.update_status_url = "%s/update_status" % self.statusbot_server_url
+        self.browser = Browser()
+
+    def update_status(self, status, bug_id=None, patch_id=None):
+        self.browser.open(self.update_status_url)
+        self.browser.select_form(name="update_status")
+        if bug_id:
+            self.browser['bug_id'] = str(bug_id)
+        if patch_id:
+            self.browser['patch_id'] = str(patch_id)
+        self.browser['status'] = status
+        self.browser.submit()
diff --git a/WebKitTools/Scripts/parse-malloc-history b/WebKitTools/Scripts/parse-malloc-history
index 76ca74b..177de1c 100755
--- a/WebKitTools/Scripts/parse-malloc-history
+++ b/WebKitTools/Scripts/parse-malloc-history
@@ -70,8 +70,6 @@ sub main()
     for (my $i = 0; $i < @file; $i++) {
         my $line = $file[$i];
         my ($callCount, $byteCount);
-        
-        next if $line =~ /^\-/;
 
         # First try malloc_history format
         #   6 calls for 664 bytes thread_ffffffff |0x0 | start
@@ -93,6 +91,28 @@ sub main()
             }
         }
         
+        # Then try LeakFinder format
+        # --------------- Key: 213813, 84 bytes ---------
+        # c:\cygwin\home\buildbot\webkit\opensource\webcore\rendering\renderarena.cpp(78): WebCore::RenderArena::allocate
+        # c:\cygwin\home\buildbot\webkit\opensource\webcore\rendering\renderobject.cpp(82): WebCore::RenderObject::operator new
+        if (!$callCount || !$byteCount) {
+            $callCount = 1;
+            ($byteCount) = ($line =~ /Key: (?:\d+), (\d+) bytes/);
+            if ($byteCount) {
+                $line = $file[++$i];
+                my @tempStack;
+                while ($file[$i+1] !~ /^(?:-|\d)/) {
+                    if ($line =~ /\): (.*)$/) {
+                        my $call = $1;
+                        $call =~ s/\r$//;
+                        unshift(@tempStack, $call);
+                    }
+                    $line = $file[++$i];
+                }            
+                $line = join(" | ", @tempStack);
+            }
+        }
+        
         # Then give up
         next if (!$callCount || !$byteCount);
         
diff --git a/WebKitTools/Scripts/pdevenv b/WebKitTools/Scripts/pdevenv
index 9128912..818e4ee 100755
--- a/WebKitTools/Scripts/pdevenv
+++ b/WebKitTools/Scripts/pdevenv
@@ -11,8 +11,22 @@ my ($fh, $path) = tempfile(UNLINK => 0, SUFFIX => '.cmd') or die;
 chomp(my $vcBin = `cygpath -w "$FindBin::Bin/../vcbin"`);
 chomp(my $scriptsPath = `cygpath -w "$FindBin::Bin"`);
 
+my $vsToolsVar;
+if ($ENV{'VS80COMNTOOLS'}) {
+    $vsToolsVar = "VS80COMNTOOLS";
+} elsif ($ENV{'VS90COMNTOOLS'}) {
+    $vsToolsVar = "VS90COMNTOOLS";
+} else {
+    print "*************************************************************\n";
+    print "Cannot find Visual Studio tools dir.\n";
+    print "Please ensure that \$VS80COMNTOOLS or \$VS90COMNTOOLS\n";
+    print "is set to a valid location.\n";
+    print "*************************************************************\n";
+    die;
+}
+
 print $fh "\@echo off\n\n";
-print $fh "call \"\%VS80COMNTOOLS\%\\vsvars32.bat\"\n\n";
+print $fh "call \"\%" . $vsToolsVar . "\%\\vsvars32.bat\"\n\n";
 print $fh "set PATH=$vcBin;$scriptsPath;\%PATH\%\n\n";
 print $fh "IF EXIST \"\%VSINSTALLDIR\%\\Common7\\IDE\\devenv.com\" (devenv.com /useenv " . join(" ", @ARGV) . ") ELSE ";
 print $fh "VCExpress.exe /useenv " . join(" ", @ARGV) . "\n";
diff --git a/WebKitTools/Scripts/prepare-ChangeLog b/WebKitTools/Scripts/prepare-ChangeLog
index c3e2cef..ed31005 100755
--- a/WebKitTools/Scripts/prepare-ChangeLog
+++ b/WebKitTools/Scripts/prepare-ChangeLog
@@ -5,6 +5,7 @@
 #  Copyright (C) 2000, 2001 Eazel, Inc.
 #  Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007 Apple Inc.  All rights reserved.
 #  Copyright (C) 2009 Torch Mobile, Inc.
+#  Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 #  prepare-ChangeLog is free software; you can redistribute it and/or
 #  modify it under the terms of the GNU General Public
@@ -73,12 +74,16 @@ sub statusCommand(@);
 sub createPatchCommand($);
 sub diffHeaderFormat();
 sub findOriginalFileFromSvn($);
+sub determinePropertyChanges($$$);
+sub pluralizeAndList($$@);
 sub generateFileList(\@\@\%);
 sub gitConfig($);
+sub isUnmodifiedStatus($);
 sub isModifiedStatus($);
 sub isAddedStatus($);
 sub isConflictStatus($);
-sub statusDescription($$);
+sub statusDescription($$$$);
+sub propertyChangeDescription($);
 sub extractLineRange($);
 sub canonicalizePath($);
 sub testListForChangeLog(@);
@@ -146,8 +151,6 @@ $isSVN || $isGit || die "Couldn't determine your version control system.";
 my $SVN = "svn";
 my $GIT = "git";
 
-my $svnVersion = `svn --version --quiet` if $isSVN;
-
 # Find the list of modified files
 my @changed_files;
 my $changed_files_string;
@@ -326,7 +329,7 @@ if (@logs && $updateChangeLogs && $isSVN) {
     my @conflictedChangeLogs;
     while (my $line = <ERRORS>) {
         print STDERR "    ", $line;
-        push @conflictedChangeLogs, $1 if $line =~ m/^C\s+(.*\S+)\s*$/;
+        push @conflictedChangeLogs, $1 if $line =~ m/^C\s+(.+?)[\r\n]*$/;
     }
     close ERRORS;
 
@@ -1323,7 +1326,7 @@ sub createPatchCommand($)
 
 sub diffHeaderFormat()
 {
-    return qr/^Index: (\S+)\s*$/ if $isSVN;
+    return qr/^Index: (\S+)[\r\n]*$/ if $isSVN;
     return qr/^diff --git a\/.+ b\/(.+)$/ if $isGit;
 }
 
@@ -1333,7 +1336,7 @@ sub findOriginalFileFromSvn($)
     my $baseUrl;
     open INFO, "$SVN info . |" or die;
     while (<INFO>) {
-        if (/^URL: (.*\S+)\s*$/) {
+        if (/^URL: (.+?)[\r\n]*$/) {
             $baseUrl = $1;
         }
     }
@@ -1341,7 +1344,7 @@ sub findOriginalFileFromSvn($)
     my $sourceFile;
     open INFO, "$SVN info '$file' |" or die;
     while (<INFO>) {
-        if (/^Copied From URL: (.*\S+)\s*$/) {
+        if (/^Copied From URL: (.+?)[\r\n]*$/) {
             $sourceFile = File::Spec->abs2rel($1, $baseUrl);
         }
     }
@@ -1349,6 +1352,76 @@ sub findOriginalFileFromSvn($)
     return $sourceFile;
 }
 
+sub determinePropertyChanges($$$)
+{
+    my ($file, $isAdd, $original) = @_;
+
+    my %changes;
+    if ($isAdd) {
+        my %addedProperties;
+        my %removedProperties;
+        open PROPLIST, "$SVN proplist '$file' |" or die;
+        while (<PROPLIST>) {
+            $addedProperties{$1} = 1 if /^  (.+?)[\r\n]*$/ && $1 ne 'svn:mergeinfo';
+        }
+        close PROPLIST;
+        if ($original) {
+            open PROPLIST, "$SVN proplist '$original' |" or die;
+            while (<PROPLIST>) {
+                next unless /^  (.+?)[\r\n]*$/;
+                my $property = $1;
+                if (exists $addedProperties{$property}) {
+                    delete $addedProperties{$1};
+                } else {
+                    $removedProperties{$1} = 1;
+                }
+            }
+        }
+        $changes{"A"} = [sort keys %addedProperties] if %addedProperties;
+        $changes{"D"} = [sort keys %removedProperties] if %removedProperties;
+    } else {
+        open DIFF, "$SVN diff '$file' |" or die;
+        while (<DIFF>) {
+            if (/^Property changes on:/) {
+                while (<DIFF>) {
+                    my $operation;
+                    my $property;
+                    if (/^Added: (\S*)/) {
+                        $operation = "A";
+                        $property = $1;
+                    } elsif (/^Modified: (\S*)/) {
+                        $operation = "M";
+                        $property = $1;
+                    } elsif (/^Deleted: (\S*)/) {
+                        $operation = "D";
+                        $property = $1;
+                    } elsif (/^Name: (\S*)/) {
+                        # Older versions of svn just say "Name" instead of the type
+                        # of property change.
+                        $operation = "C";
+                        $property = $1;
+                    }
+                    if ($operation) {
+                        $changes{$operation} = [] unless exists $changes{$operation};
+                        push @{$changes{$operation}}, $property;
+                    }
+                }
+            }
+        }
+        close DIFF;
+    }
+    return \%changes;
+}
+
+sub pluralizeAndList($$@)
+{
+    my ($singular, $plural, @items) = @_;
+
+    return if @items == 0;
+    return "$singular $items[0]" if @items == 1;
+    return "$plural " . join(", ", @items[0 .. $#items - 1]) . " and " . $items[-1];
+}
+
 sub generateFileList(\@\@\%)
 {
     my ($changedFiles, $conflictFiles, $functionLists) = @_;
@@ -1356,32 +1429,40 @@ sub generateFileList(\@\@\%)
     open STAT, "-|", statusCommand(keys %paths) or die "The status failed: $!.\n";
     while (<STAT>) {
         my $status;
+        my $propertyStatus;
+        my $propertyChanges;
         my $original;
         my $file;
 
         if ($isSVN) {
             my $matches;
-            if (eval "v$svnVersion" ge v1.6) {
-                $matches = /^([ACDMR]).{6} (.*\S+)\s*$/;
+            if (isSVNVersion16OrNewer()) {
+                $matches = /^([ ACDMR])([ CM]).{5} (.+?)[\r\n]*$/;
                 $status = $1;
-                $file = $2;
+                $propertyStatus = $2;
+                $file = $3;
             } else {
-                $matches = /^([ACDMR]).{5} (.*\S+)\s*$/;
+                $matches = /^([ ACDMR])([ CM]).{4} (.+?)[\r\n]*$/;
                 $status = $1;
-                $file = $2;
+                $propertyStatus = $2;
+                $file = $3;
             }
             if ($matches) {
                 $file = normalizePath($file);
                 $original = findOriginalFileFromSvn($file) if substr($_, 3, 1) eq "+";
+                my $isAdd = isAddedStatus($status);
+                $propertyChanges = determinePropertyChanges($file, $isAdd, $original) if isModifiedStatus($propertyStatus) || $isAdd;
             } else {
                 print;  # error output from svn stat
             }
         } elsif ($isGit) {
             if (/^([ADM])\t(.+)$/) {
                 $status = $1;
+                $propertyStatus = " ";  # git doesn't have properties
                 $file = normalizePath($2);
             } elsif (/^([CR])[0-9]{1,3}\t([^\t]+)\t([^\t\n]+)$/) { # for example: R90%    newfile    oldfile
                 $status = $1;
+                $propertyStatus = " ";
                 $original = normalizePath($2);
                 $file = normalizePath($3);
             } else {
@@ -1389,11 +1470,11 @@ sub generateFileList(\@\@\%)
             }
         }
 
-        next unless $status;
+        next if !$status || isUnmodifiedStatus($status) && isUnmodifiedStatus($propertyStatus);
 
         $file = makeFilePathRelative($file);
 
-        if (isModifiedStatus($status) || isAddedStatus($status)) {
+        if (isModifiedStatus($status) || isAddedStatus($status) || isModifiedStatus($propertyStatus)) {
             my @components = File::Spec->splitdir($file);
             if ($components[0] eq "LayoutTests") {
                 $didChangeRegressionTests = 1;
@@ -1401,14 +1482,15 @@ sub generateFileList(\@\@\%)
                     if isAddedStatus($status)
                        && $file =~ /\.([a-zA-Z]+)$/
                        && $supportedTestExtensions{lc($1)}
-                       && !scalar(grep(/^resources$/i, @components));
+                       && !scalar(grep(/^resources$/i, @components))
+                       && !scalar(grep(/^script-tests$/i, @components));
             }
             push @{$changedFiles}, $file if $components[$#components] ne "ChangeLog";
-        } elsif (isConflictStatus($status)) {
+        } elsif (isConflictStatus($status) || isConflictStatus($propertyStatus)) {
             push @{$conflictFiles}, $file;
         }
         if (basename($file) ne "ChangeLog") {
-            my $description = statusDescription($status, $original);
+            my $description = statusDescription($status, $propertyStatus, $original, $propertyChanges);
             $functionLists->{$file} = $description if defined $description;
         }
     }
@@ -1429,6 +1511,17 @@ sub gitConfig($)
     return $result;
 }
 
+sub isUnmodifiedStatus($)
+{
+    my ($status) = @_;
+
+    my %statusCodes = (
+        " " => 1,
+    );
+
+    return $statusCodes{$status};
+}
+
 sub isModifiedStatus($)
 {
     my ($status) = @_;
@@ -1470,15 +1563,18 @@ sub isConflictStatus($)
     return $git{$status} if $isGit;
 }
 
-sub statusDescription($$)
+sub statusDescription($$$$)
 {
-    my ($status, $original) = @_;
+    my ($status, $propertyStatus, $original, $propertyChanges) = @_;
+
+    my $propertyDescription = defined $propertyChanges ? propertyChangeDescription($propertyChanges) : "";
 
     my %svn = (
         "A" => defined $original ? " Copied from \%s." : " Added.",
         "D" => " Removed.",
         "M" => "",
         "R" => defined $original ? " Replaced with \%s." : " Replaced.",
+        " " => "",
     );
 
     my %git = %svn;
@@ -1486,9 +1582,33 @@ sub statusDescription($$)
     $git{"C"} = " Copied from \%s.";
     $git{"R"} = " Renamed from \%s.";
 
-    return sprintf($svn{$status}, $original) if $isSVN && exists $svn{$status};
-    return sprintf($git{$status}, $original) if $isGit && exists $git{$status};
-    return undef;
+    my $description;
+    $description = sprintf($svn{$status}, $original) if $isSVN && exists $svn{$status};
+    $description = sprintf($git{$status}, $original) if $isGit && exists $git{$status};
+    return unless defined $description;
+
+    $description .= $propertyDescription unless isAddedStatus($status);
+    return $description;
+}
+
+sub propertyChangeDescription($)
+{
+    my ($propertyChanges) = @_;
+
+    my %operations = (
+        "A" => "Added",
+        "M" => "Modified",
+        "D" => "Removed",
+        "C" => "Changed",
+    );
+
+    my $description = "";
+    while (my ($operation, $properties) = each %$propertyChanges) {
+        my $word = $operations{$operation};
+        my $list = pluralizeAndList("property", "properties", @$properties);
+        $description .= " $word $list.";
+    }
+    return $description;
 }
 
 sub extractLineRange($)
diff --git a/WebKitTools/Scripts/resolve-ChangeLogs b/WebKitTools/Scripts/resolve-ChangeLogs
index 9107fd2..db497f9 100755
--- a/WebKitTools/Scripts/resolve-ChangeLogs
+++ b/WebKitTools/Scripts/resolve-ChangeLogs
@@ -48,6 +48,7 @@ sub fixChangeLogPatch($);
 sub fixMergedChangeLogs($;@);
 sub fixOneMergedChangeLog($);
 sub hasGitUnmergedFiles();
+sub isInGitFilterBranch();
 sub mergeChanges($$$);
 sub parseFixMerged($$;$);
 sub removeChangeLogArguments($);
@@ -63,8 +64,6 @@ my $isSVN = isSVN();
 my $SVN = "svn";
 my $GIT = "git";
 
-my $svnVersion = `svn --version --quiet` if $isSVN;
-
 my $fixMerged;
 my $gitRebaseContinue = 0;
 my $printWarnings = 1;
@@ -77,7 +76,7 @@ my $getOptionsResult = GetOptions(
     'w|warnings!'    => \$printWarnings,
 );
 
-my $relativePath = chdirReturningRelativePath(determineVCSRoot());
+my $relativePath = isInGitFilterBranch() ? '.' : chdirReturningRelativePath(determineVCSRoot());
 
 my @changeLogFiles = removeChangeLogArguments($relativePath);
 
@@ -255,11 +254,11 @@ sub findUnmergedChangeLogs()
         if ($isSVN) {
             my $matches;
             my $file;
-            if (eval "v$svnVersion" ge v1.6) {
-                $matches = /^([C]).{6} (.*\S+)\s*$/;
+            if (isSVNVersion16OrNewer()) {
+                $matches = /^([C]).{6} (.+?)[\r\n]*$/;
                 $file = $2;
             } else {
-                $matches = /^([C]).{5} (.*\S+)\s*$/;
+                $matches = /^([C]).{5} (.+?)[\r\n]*$/;
                 $file = $2;
             }
             if ($matches) {
@@ -432,6 +431,11 @@ sub hasGitUnmergedFiles()
     return $output ne "";
 }
 
+sub isInGitFilterBranch()
+{
+    return exists $ENV{MAPPED_PREVIOUS_COMMIT} && $ENV{MAPPED_PREVIOUS_COMMIT};
+}
+
 sub mergeChanges($$$)
 {
     my ($fileMine, $fileOlder, $fileNewer) = @_;
diff --git a/WebKitTools/Scripts/run-javascriptcore-tests b/WebKitTools/Scripts/run-javascriptcore-tests
index 21d63c2..865ae1d 100755
--- a/WebKitTools/Scripts/run-javascriptcore-tests
+++ b/WebKitTools/Scripts/run-javascriptcore-tests
@@ -124,7 +124,7 @@ sub testapiPath($)
 }
 
 #run api tests
-if (isAppleMacWebKit()) {
+if (isAppleMacWebKit() || isAppleWinWebKit()) {
     chdirWebKit();
     chdir($productDir) or die;
     my $testapiResult = system testapiPath($productDir);
diff --git a/WebKitTools/Scripts/run-launcher b/WebKitTools/Scripts/run-launcher
index 24a4c32..ee462ba 100755
--- a/WebKitTools/Scripts/run-launcher
+++ b/WebKitTools/Scripts/run-launcher
@@ -61,6 +61,15 @@ if (isQt()) {
     if (isGtk()) {
         $launcherPath = catdir($launcherPath, "Programs", "GtkLauncher");
     }
+    
+    if (isWx()) {
+        if (isDarwin()) {
+            $launcherPath = catdir($launcherPath, 'wxBrowser.app', 'Contents', 'MacOS', 'wxBrowser');
+        } else {
+            $ENV{LD_LIBRARY_PATH} = $ENV{LD_LIBRARY_PATH} ? "$productDir:$ENV{LD_LIBRARY_PATH}" : $productDir;
+            $launcherPath = catdir($launcherPath, 'wxBrowser');
+        }
+    }
 
     print "Starting webkit launcher.\n";
 }
diff --git a/WebKitTools/Scripts/run-sunspider b/WebKitTools/Scripts/run-sunspider
index 154c9fa..367fd06 100755
--- a/WebKitTools/Scripts/run-sunspider
+++ b/WebKitTools/Scripts/run-sunspider
@@ -43,6 +43,7 @@ my $runShark20 = 0;
 my $runSharkCache = 0;
 my $ubench = 0;
 my $v8 = 0;
+my $parseonly = 0;
 my $setBaseline = 0;
 my $showHelp = 0;
 my $testsPattern;
@@ -60,6 +61,7 @@ Usage: $programName [options] [options to pass to build system]
   --shark-cache     Like --shark, but performs a L2 cache-miss sample instead of time sample
   --ubench          Use microbenchmark suite instead of regular tests (to check for core execution regressions)
   --v8              Use the V8 benchmark suite.
+  --parse-only      Use the parse-only benchmark suite
 EOF
 
 GetOptions('root=s' => sub { my ($x, $value) = @_; $root = $value; setConfigurationProductDir(Cwd::abs_path($root)); },
@@ -70,6 +72,7 @@ GetOptions('root=s' => sub { my ($x, $value) = @_; $root = $value; setConfigurat
            'shark-cache' => \$runSharkCache,
            'ubench' => \$ubench,
            'v8' => \$v8,
+           'parse-only' => \$parseonly,
            'tests=s' => \$testsPattern,
            'help' => \$showHelp);
 
@@ -84,7 +87,7 @@ sub buildJSC
         push(@ARGV,  "--" . $configuration);
         
         chdirWebKit();
-        my $buildResult = system "WebKitTools/Scripts/build-jsc", @ARGV;
+        my $buildResult = system currentPerlPath(), "WebKitTools/Scripts/build-jsc", @ARGV;
         if ($buildResult) {
             print STDERR "Compiling jsc failed!\n";
             exit exitStatus($buildResult);
@@ -127,6 +130,7 @@ push @args, "--shark20" if $runShark20;
 push @args, "--shark-cache" if $runSharkCache;
 push @args, "--ubench" if $ubench;
 push @args, "--v8" if $v8;
+push @args, "--parse-only" if $parseonly;
 push @args, "--tests", $testsPattern if $testsPattern;
 
-exec "./sunspider", @args;
+exec currentPerlPath(), "./sunspider", @args;
diff --git a/WebKitTools/Scripts/run-webkit-httpd b/WebKitTools/Scripts/run-webkit-httpd
index 62eae14..9a97190 100755
--- a/WebKitTools/Scripts/run-webkit-httpd
+++ b/WebKitTools/Scripts/run-webkit-httpd
@@ -90,6 +90,7 @@ my $httpdConfig = "$testDirectory/http/conf/httpd.conf";
 $httpdConfig = "$testDirectory/http/conf/cygwin-httpd.conf" if isCygwin();
 $httpdConfig = "$testDirectory/http/conf/apache2-httpd.conf" if `$httpdPath -v` =~ m|Apache/2|;
 $httpdConfig = "$testDirectory/http/conf/apache2-debian-httpd.conf" if isDebianBased();
+$httpdConfig = "$testDirectory/http/conf/fedora-httpd.conf" if isFedoraBased();
 my $documentRoot = "$testDirectory/http/tests";
 my $typesConfig = "$testDirectory/http/conf/mime.types";
 my $sslCertificate = "$testDirectory/http/conf/webkit-httpd.pem";
diff --git a/WebKitTools/Scripts/run-webkit-tests b/WebKitTools/Scripts/run-webkit-tests
index f51cf53..a08a53c 100755
--- a/WebKitTools/Scripts/run-webkit-tests
+++ b/WebKitTools/Scripts/run-webkit-tests
@@ -5,6 +5,7 @@
 # Copyright (C) 2007 Matt Lilek (pewtermoose@gmail.com)
 # Copyright (C) 2007 Eric Seidel <eric@webkit.org>
 # Copyright (C) 2009 Google Inc. All rights reserved.
+# Copyright (C) 2009 Andras Becsi (becsi.andras@stud.u-szeged.hu), University of Szeged
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -70,80 +71,86 @@ use webkitdirs;
 use VCSUtils;
 use POSIX;
 
-sub launchWithCurrentEnv(@);
-sub openDiffTool();
-sub openDumpTool();
+sub buildPlatformResultHierarchy();
+sub buildPlatformTestHierarchy(@);
+sub closeCygpaths();
 sub closeDumpTool();
-sub dumpToolDidCrash();
 sub closeHTTPD();
 sub countAndPrintLeaks($$$);
+sub countFinishedTest($$$$);
+sub deleteExpectedAndActualResults($);
+sub dumpToolDidCrash();
+sub epiloguesAndPrologues($$);
+sub expectedDirectoryForTest($;$;$);
 sub fileNameWithNumber($$);
+sub htmlForResultsSection(\@$&);
+sub isTextOnlyTest($);
+sub launchWithCurrentEnv(@);
 sub numericcmp($$);
+sub openDiffTool();
+sub openDumpTool();
 sub openHTTPDIfNeeded();
+sub parseLeaksandPrintUniqueLeaks();
 sub pathcmp($$);
+sub printFailureMessageForTest($$);
 sub processIgnoreTests($$);
+sub readFromDumpToolWithTimer(**);
+sub recordActualResultsAndDiff($$);
+sub sampleDumpTool();
+sub setFileHandleNonBlocking(*$);
 sub slowestcmp($$);
 sub splitpath($);
 sub stripExtension($);
-sub isTextOnlyTest($);
-sub expectedDirectoryForTest($;$;$);
-sub countFinishedTest($$$$);
+sub stripMetrics($$);
 sub testCrashedOrTimedOut($$$$$);
-sub sampleDumpTool();
-sub printFailureMessageForTest($$);
 sub toURL($);
 sub toWindowsPath($);
-sub closeCygpaths();
 sub validateSkippedArg($$;$);
-sub htmlForResultsSection(\@$&);
-sub deleteExpectedAndActualResults($);
-sub recordActualResultsAndDiff($$);
-sub buildPlatformResultHierarchy();
-sub buildPlatformTestHierarchy(@);
-sub epiloguesAndPrologues($$);
-sub parseLeaksandPrintUniqueLeaks();
-sub readFromDumpToolWithTimer(*;$);
-sub setFileHandleNonBlocking(*$);
 sub writeToFile($$);
 
 # Argument handling
 my $addPlatformExceptions = 0;
 my $complexText = 0;
+my $exitAfterNFailures = 0;
+my $generateNewResults = isAppleMacWebKit() ? 1 : 0;
 my $guardMalloc = '';
 my $httpdPort = 8000;
 my $httpdSSLPort = 8443;
+my $ignoreMetrics = 0;
 my $ignoreTests = '';
+my $iterations = 1;
 my $launchSafari = 1;
-my $platform;
+my $mergeDepth;
 my $pixelTests = '';
+my $platform;
 my $quiet = '';
+my $randomizeTests = 0;
+my $repeatEach = 1;
 my $report10Slowest = 0;
 my $resetResults = 0;
+my $reverseTests = 0;
+my $root;
+my $runSample = 1;
 my $shouldCheckLeaks = 0;
 my $showHelp = 0;
-my $testsPerDumpTool;
+my $stripEditingCallbacks = isCygwin();
 my $testHTTP = 1;
 my $testMedia = 1;
 my $testResultsDirectory = "/tmp/layout-test-results";
+my $testsPerDumpTool = 1000;
 my $threaded = 0;
+# DumpRenderTree has an internal timeout of 15 seconds, so this must be > 15.
+my $timeoutSeconds = 20;
 my $tolerance = 0;
 my $treatSkipped = "default";
-my $verbose = 0;
-my $useValgrind = 0;
-my $strictTesting = 0;
-my $generateNewResults = isAppleMacWebKit() ? 1 : 0;
-my $stripEditingCallbacks = isCygwin();
-my $runSample = 1;
-my $root;
-my $reverseTests = 0;
-my $randomizeTests = 0;
-my $mergeDepth;
-my $timeoutSeconds = 15;
 my $useRemoteLinksToTests = 0;
+my $useValgrind = 0;
+my $verbose = 0;
+
 my @leaksFilenames;
 
-# Default to --no-http for Qt, and wx for now.
-$testHTTP = 0 if (isQt() || isWx());
+# Default to --no-http for wx for now.
+$testHTTP = 0 if (isWx());
 
 my $expectedTag = "expected";
 my $actualTag = "actual";
@@ -167,7 +174,15 @@ if (isAppleMacWebKit()) {
         $platform = "mac";
     }
 } elsif (isQt()) {
-    $platform = "qt";
+    if (isDarwin()) {
+        $platform = "qt-mac";
+    } elsif (isLinux()) {
+        $platform = "qt-linux";
+    } elsif (isWindows() || isCygwin()) {
+        $platform = "qt-win";
+    } else {
+        $platform = "qt";
+    }
 } elsif (isGtk()) {
     $platform = "gtk";
 } elsif (isWx()) {
@@ -186,19 +201,21 @@ my $launchSafariDefault = $launchSafari ? "launch" : "do not launch";
 my $httpDefault = $testHTTP ? "run" : "do not run";
 my $sampleDefault = $runSample ? "run" : "do not run";
 
-# FIXME: "--strict" should be renamed to qt-mac-comparison, or something along those lines.
 my $usage = <<EOF;
 Usage: $programName [options] [testdir|testpath ...]
   --add-platform-exceptions       Put new results for non-platform-specific failing tests into the platform-specific results directory
   --complex-text                  Use the complex text code path for all text (Mac OS X and Windows only)
   -c|--configuration config       Set DumpRenderTree build configuration
   -g|--guard-malloc               Enable malloc guard
-  --help                          Show this help message
+  --exit-after-n-failures N       Exit after the first N failures instead of running all tests
+  -h|--help                       Show this help message
   --[no-]http                     Run (or do not run) http tests (default: $httpDefault)
   -i|--ignore-tests               Comma-separated list of directories or tests to ignore
+  --iterations n                  Number of times to run the set of tests (e.g. ABCABCABC)
   --[no-]launch-safari            Launch (or do not launch) Safari to display test results (default: $launchSafariDefault)
   -l|--leaks                      Enable leaks checking
   --[no-]new-test-results         Generate results for new tests
+  --nthly n                       Restart DumpRenderTree every n tests (default: $testsPerDumpTool)
   -p|--pixel-tests                Enable pixel tests
   --tolerance t                   Ignore image differences less than this percentage (default: $tolerance)
   --platform                      Override the detected platform to use for tests and results (default: $platform)
@@ -207,16 +224,17 @@ Usage: $programName [options] [testdir|testpath ...]
   --reset-results                 Reset ALL results (including pixel tests if --pixel-tests is set)
   -o|--results-directory          Output results directory (default: $testResultsDirectory)
   --random                        Run the tests in a random order
+  --repeat-each n                 Number of times to run each test (e.g. AAABBBCCC)
   --reverse                       Run the tests in reverse alphabetical order
   --root                          Path to root tools build
   --[no-]sample-on-timeout        Run sample on timeout (default: $sampleDefault) (Mac OS X only)
-  -1|--singly                     Isolate each test case run (implies --verbose)
+  -1|--singly                     Isolate each test case run (implies --nthly 1 --verbose)
   --skipped=[default|ignore|only] Specifies how to treat the Skipped file
                                      default: Tests/directories listed in the Skipped file are not tested
                                      ignore:  The Skipped file is ignored
                                      only:    Only those tests/directories listed in the Skipped file will be run
   --slowest                       Report the 10 slowest tests
-  --strict                        Do a comparison with the output on Mac (Qt only)
+  --ignore-metrics                Ignore metrics in tests
   --[no-]strip-editing-callbacks  Remove editing callbacks from expected results
   -t|--threaded                   Run a concurrent JavaScript thead with each test
   --timeout t                     Sets the number of seconds before a test times out (default: $timeoutSeconds)
@@ -229,38 +247,41 @@ EOF
 setConfiguration();
 
 my $getOptionsResult = GetOptions(
+    'add-platform-exceptions' => \$addPlatformExceptions,
     'complex-text' => \$complexText,
+    'exit-after-n-failures=i' => \$exitAfterNFailures,
     'guard-malloc|g' => \$guardMalloc,
-    'help' => \$showHelp,
+    'help|h' => \$showHelp,
     'http!' => \$testHTTP,
+    'ignore-metrics!' => \$ignoreMetrics,
     'ignore-tests|i=s' => \$ignoreTests,
+    'iterations=i' => \$iterations,
     'launch-safari!' => \$launchSafari,
     'leaks|l' => \$shouldCheckLeaks,
+    'merge-leak-depth|m:5' => \$mergeDepth,
+    'new-test-results!' => \$generateNewResults,
+    'nthly=i' => \$testsPerDumpTool,
     'pixel-tests|p' => \$pixelTests,
     'platform=s' => \$platform,
     'port=i' => \$httpdPort,
     'quiet|q' => \$quiet,
+    'random' => \$randomizeTests,
+    'repeat-each=i' => \$repeatEach,
     'reset-results' => \$resetResults,
-    'new-test-results!' => \$generateNewResults,
     'results-directory|o=s' => \$testResultsDirectory,
+    'reverse' => \$reverseTests,
+    'root=s' => \$root,
+    'sample-on-timeout!' => \$runSample,
     'singly|1' => sub { $testsPerDumpTool = 1; },
-    'nthly=i' => \$testsPerDumpTool,
     'skipped=s' => \&validateSkippedArg,
     'slowest' => \$report10Slowest,
-    'threaded|t' => \$threaded,
-    'tolerance=f' => \$tolerance,
-    'verbose|v' => \$verbose,
-    'valgrind' => \$useValgrind,
-    'sample-on-timeout!' => \$runSample,
-    'strict' => \$strictTesting,
     'strip-editing-callbacks!' => \$stripEditingCallbacks,
-    'random' => \$randomizeTests,
-    'reverse' => \$reverseTests,
-    'root=s' => \$root,
-    'add-platform-exceptions' => \$addPlatformExceptions,
-    'merge-leak-depth|m:5' => \$mergeDepth,
+    'threaded|t' => \$threaded,
     'timeout=i' => \$timeoutSeconds,
+    'tolerance=f' => \$tolerance,
     'use-remote-links-to-tests' => \$useRemoteLinksToTests,
+    'valgrind' => \$useValgrind,
+    'verbose|v' => \$verbose,
 );
 
 if (!$getOptionsResult || $showHelp) {
@@ -275,8 +296,6 @@ my $skippedOnly = $treatSkipped eq "only";
 
 my $configuration = configuration();
 
-$testsPerDumpTool = 1000 if !$testsPerDumpTool;
-
 $verbose = 1 if $testsPerDumpTool == 1;
 
 if ($shouldCheckLeaks && $testsPerDumpTool > 1000) {
@@ -286,8 +305,8 @@ if ($shouldCheckLeaks && $testsPerDumpTool > 1000) {
 # Stack logging does not play well with QuickTime on Tiger (rdar://problem/5537157)
 $testMedia = 0 if $shouldCheckLeaks && isTiger();
 
-# Generating remote links causes a lot of unnecessary spew on GTK and Qt build bot
-$useRemoteLinksToTests = 0 if (isGtk() || isQt());
+# Generating remote links causes a lot of unnecessary spew on GTK build bot
+$useRemoteLinksToTests = 0 if isGtk();
 
 setConfigurationProductDir(Cwd::abs_path($root)) if (defined($root));
 my $productDir = productDir();
@@ -297,10 +316,30 @@ $productDir .= "/Programs" if isGtk();
 chdirWebKit();
 
 if (!defined($root)) {
-    # Push the parameters to build-dumprendertree as an array
+    print STDERR "Running build-dumprendertree\n";
+
+    local *DEVNULL;
+    my ($childIn, $childOut, $childErr);
+    if ($quiet) {
+        open(DEVNULL, ">", File::Spec->devnull) or die "Failed to open /dev/null";
+        $childOut = ">&DEVNULL";
+        $childErr = ">&DEVNULL";
+    } else {
+        # When not quiet, let the child use our stdout/stderr.
+        $childOut = ">&STDOUT";
+        $childErr = ">&STDERR";
+    }
+
     my @args = argumentsForConfiguration();
+    my $buildProcess = open3($childIn, $childOut, $childErr, "WebKitTools/Scripts/build-dumprendertree", @args) or die "Failed to run build-dumprendertree";
+    close($childIn);
+    waitpid $buildProcess, 0;
+    my $buildResult = $?;
+    close($childOut);
+    close($childErr);
+
+    close DEVNULL if ($quiet);
 
-    my $buildResult = system "WebKitTools/Scripts/build-dumprendertree", @args;
     if ($buildResult) {
         print STDERR "Compiling DumpRenderTree failed!\n";
         exit exitStatus($buildResult);
@@ -320,7 +359,7 @@ checkFrameworks() unless isCygwin();
 
 if (isAppleMacWebKit()) {
     push @INC, $productDir;
-    eval 'use DumpRenderTreeSupport;';
+    require DumpRenderTreeSupport;
 }
 
 my $layoutTestsName = "LayoutTests";
@@ -351,16 +390,17 @@ if ($pixelTests) {
     }
 }
 
-my @tests = ();
-my %testType = ();
-
 system "ln", "-s", $testDirectory, "/tmp/LayoutTests" unless -x "/tmp/LayoutTests";
 
-my %ignoredFiles = ();
+my %ignoredFiles = ( "results.html" => 1 );
 my %ignoredDirectories = map { $_ => 1 } qw(platform);
-my %ignoredLocalDirectories = map { $_ => 1 } qw(.svn _svn resources);
+my %ignoredLocalDirectories = map { $_ => 1 } qw(.svn _svn resources script-tests);
 my %supportedFileExtensions = map { $_ => 1 } qw(html shtml xml xhtml pl php);
 
+if (!checkWebCoreMathMLSupport(0)) { 
+    $ignoredDirectories{'mathml'} = 1;
+}
+
 # FIXME: We should fix webkitdirs.pm:hasSVG/WMLSupport() to do the correct feature detection for Cygwin.
 if (checkWebCoreSVGSupport(0)) { 
     $supportedFileExtensions{'svg'} = 1;
@@ -388,6 +428,10 @@ if (!checkWebCore3DRenderingSupport(0)) {
     $ignoredDirectories{'transforms/3d'} = 1;
 }
 
+if (!checkWebCore3DCanvasSupport(0)) {
+    $ignoredDirectories{'fast/canvas/webgl'} = 1;
+}
+
 if (checkWebCoreWMLSupport(0)) { 
     $supportedFileExtensions{'wml'} = 1;
 } else {
@@ -404,105 +448,13 @@ if (!checkWebCoreWCSSSupport(0)) {
     $ignoredDirectories{'fast/wcss'} = 1;
 }
 
-if ($ignoreTests) {
-    processIgnoreTests($ignoreTests, "ignore-tests");
-}
-
-sub fileShouldBeIgnored {
-    my($filePath) = @_;
-    foreach my $ignoredDir (keys %ignoredDirectories) {
-        if ($filePath =~ m/^$ignoredDir/) {
-            return 1;
-        }
-    }
-    return 0;
-}
-
-if (!$ignoreSkipped) {
-    foreach my $level (@platformTestHierarchy) {
-        if (open SKIPPED, "<", "$level/Skipped") {
-            if ($verbose) {
-                my ($dir, $name) = splitpath($level);
-                print "Skipped tests in $name:\n";
-            }
-
-            while (<SKIPPED>) {
-                my $skipped = $_;
-                chomp $skipped;
-                $skipped =~ s/^[ \n\r]+//;
-                $skipped =~ s/[ \n\r]+$//;
-                if ($skipped && $skipped !~ /^#/) {
-                    if ($skippedOnly) {
-                        if (!&fileShouldBeIgnored($skipped)) {
-                            push(@ARGV, $skipped);
-                        } elsif ($verbose) {
-                            print "    $skipped\n";
-                        }
-                    } else {
-                        if ($verbose) {
-                            print "    $skipped\n";
-                        }
-                        processIgnoreTests($skipped, "Skipped");
-                    }
-                }
-            }
-            close SKIPPED;
-        }
-    }
-}
-
+processIgnoreTests($ignoreTests, "ignore-tests") if $ignoreTests;
+readSkippedFiles() unless $ignoreSkipped;
 
-my $directoryFilter = sub {
-    return () if exists $ignoredLocalDirectories{basename($File::Find::dir)};
-    return () if exists $ignoredDirectories{File::Spec->abs2rel($File::Find::dir, $testDirectory)};
-    return @_;
-};
-
-my $fileFilter = sub {
-    my $filename = $_;
-    if ($filename =~ /\.([^.]+)$/) {
-        if (exists $supportedFileExtensions{$1}) {
-            my $path = File::Spec->abs2rel(catfile($File::Find::dir, $filename), $testDirectory);
-            push @tests, $path if !exists $ignoredFiles{$path};
-        }
-    }
-};
-
-for my $test (@ARGV) {
-    $test =~ s/^($layoutTestsName|$testDirectory)\///;
-    my $fullPath = catfile($testDirectory, $test);
-    if (file_name_is_absolute($test)) {
-        print "can't run test $test outside $testDirectory\n";
-    } elsif (-f $fullPath) {
-        my ($filename, $pathname, $fileExtension) = fileparse($test, qr{\.[^.]+$});
-        if (!exists $supportedFileExtensions{substr($fileExtension, 1)}) {
-            print "test $test does not have a supported extension\n";
-        } elsif ($testHTTP || $pathname !~ /^http\//) {
-            push @tests, $test;
-        }
-    } elsif (-d $fullPath) {
-        find({ preprocess => $directoryFilter, wanted => $fileFilter }, $fullPath);
-
-        for my $level (@platformTestHierarchy) {
-            my $platformPath = catfile($level, $test);
-            find({ preprocess => $directoryFilter, wanted => $fileFilter }, $platformPath) if (-d $platformPath);
-        }
-    } else {
-        print "test $test not found\n";
-    }
-}
-if (!scalar @ARGV) {
-    find({ preprocess => $directoryFilter, wanted => $fileFilter }, $testDirectory);
-
-    for my $level (@platformTestHierarchy) {
-        find({ preprocess => $directoryFilter, wanted => $fileFilter }, $level);
-    }
-}
+my @tests = findTestsToRun();
 
 die "no tests to run\n" if !@tests;
 
-@tests = sort pathcmp @tests;
-
 my %counts;
 my %tests;
 my %imagesPresent;
@@ -537,20 +489,31 @@ my $isHttpdOpen = 0;
 sub catch_pipe { $dumpToolCrashed = 1; }
 $SIG{"PIPE"} = "catch_pipe";
 
-print "Testing ", scalar @tests, " test cases.\n";
+print "Testing ", scalar @tests, " test cases";
+print " $iterations times" if ($iterations > 1);
+print ", repeating each test $repeatEach times" if ($repeatEach > 1);
+print ".\n";
+
 my $overallStartTime = time;
 
 my %expectedResultPaths;
 
-# Reverse the tests
-@tests = reverse @tests if $reverseTests;
-
-# Shuffle the array
-@tests = shuffle(@tests) if $randomizeTests;
+my @originalTests = @tests;
+# Add individual test repetitions
+if ($repeatEach > 1) {
+    @tests = ();
+    foreach my $test (@originalTests) {
+        for (my $i = 0; $i < $repeatEach; $i++) {
+            push(@tests, $test);
+        }
+    }
+}
+# Add test set repetitions
+for (my $i = 1; $i < $iterations; $i++) {
+    push(@tests, @originalTests);
+}
 
 for my $test (@tests) {
-    next if $test eq 'results.html';
-
     my $newDumpTool = not $isDumpToolOpen;
     openDumpTool();
 
@@ -648,14 +611,12 @@ for my $test (@tests) {
     # The first block is the output of the test (in text, RenderTree or other formats).
     # The second block is for optional pixel data in PNG format, and may be empty if
     # pixel tests are not being run, or the test does not dump pixels (e.g. text tests).
-    
-    my $actualRead = readFromDumpToolWithTimer(IN);
-    my $errorRead = readFromDumpToolWithTimer(ERROR, $actualRead->{status} eq "timedOut");
+    my $readResults = readFromDumpToolWithTimer(IN, ERROR);
 
-    my $actual = $actualRead->{output};
-    my $error = $errorRead->{output};
+    my $actual = $readResults->{output};
+    my $error = $readResults->{error};
 
-    $expectedExtension = $actualRead->{extension};
+    $expectedExtension = $readResults->{extension};
     my $expectedFileName = "$base-$expectedTag.$expectedExtension";
 
     my $isText = isTextOnlyTest($actual);
@@ -663,12 +624,12 @@ for my $test (@tests) {
     my $expectedDir = expectedDirectoryForTest($base, $isText, $expectedExtension);
     $expectedResultPaths{$base} = "$expectedDir/$expectedFileName";
 
-    unless ($actualRead->{status} eq "success" && $errorRead->{status} eq "success") {
-        my $crashed = $actualRead->{status} eq "crashed" || $errorRead->{status} eq "crashed";
+    unless ($readResults->{status} eq "success") {
+        my $crashed = $readResults->{status} eq "crashed";
         testCrashedOrTimedOut($test, $base, $crashed, $actual, $error);
         countFinishedTest($test, $base, $crashed ? "crash" : "timedout", 0);
         next;
-     }
+    }
 
     $durations{$test} = time - $startTime if $report10Slowest;
 
@@ -682,15 +643,9 @@ for my $test (@tests) {
         }
         close EXPECTED;
     }
-    my $expectedMac;
-    if (!isAppleMacWebKit() && $strictTesting && !$isText) {
-      if (!$resetResults && open EXPECTED, "<", "$testDirectory/platform/mac/$expectedFileName") {
-        $expectedMac = "";
-        while (<EXPECTED>) {
-          $expectedMac .= $_;
-        }
-        close EXPECTED;
-      }
+
+    if ($ignoreMetrics && !$isText && defined $expected) {
+        ($actual, $expected) = stripMetrics($actual, $expected);
     }
 
     if ($shouldCheckLeaks && $testsPerDumpTool == 1) {
@@ -776,57 +731,6 @@ for my $test (@tests) {
         }
     }
 
-    if (!isAppleMacWebKit() && $strictTesting && !$isText) {
-      if (defined $expectedMac) {
-        my $simplified_actual;
-        $simplified_actual = $actual;
-        $simplified_actual =~ s/at \(-?[0-9]+,-?[0-9]+\) *//g;
-        $simplified_actual =~ s/size -?[0-9]+x-?[0-9]+ *//g;
-        $simplified_actual =~ s/text run width -?[0-9]+: //g;
-        $simplified_actual =~ s/text run width -?[0-9]+ [a-zA-Z ]+: //g;
-        $simplified_actual =~ s/RenderButton {BUTTON} .*/RenderButton {BUTTON}/g;
-        $simplified_actual =~ s/RenderImage {INPUT} .*/RenderImage {INPUT}/g;
-        $simplified_actual =~ s/RenderBlock {INPUT} .*/RenderBlock {INPUT}/g;
-        $simplified_actual =~ s/RenderTextControl {INPUT} .*/RenderTextControl {INPUT}/g;
-        $simplified_actual =~ s/\([0-9]+px/px/g;
-        $simplified_actual =~ s/ *" *\n +" */ /g;
-        $simplified_actual =~ s/" +$/"/g;
-
-        $simplified_actual =~ s/- /-/g;
-        $simplified_actual =~ s/\n( *)"\s+/\n$1"/g;
-        $simplified_actual =~ s/\s+"\n/"\n/g;
-        
-        $expectedMac =~ s/at \(-?[0-9]+,-?[0-9]+\) *//g;
-        $expectedMac =~ s/size -?[0-9]+x-?[0-9]+ *//g;
-        $expectedMac =~ s/text run width -?[0-9]+: //g;
-        $expectedMac =~ s/text run width -?[0-9]+ [a-zA-Z ]+: //g;
-        $expectedMac =~ s/RenderButton {BUTTON} .*/RenderButton {BUTTON}/g;
-        $expectedMac =~ s/RenderImage {INPUT} .*/RenderImage {INPUT}/g;
-        $expectedMac =~ s/RenderBlock {INPUT} .*/RenderBlock {INPUT}/g;
-        $expectedMac =~ s/RenderTextControl {INPUT} .*/RenderTextControl {INPUT}/g;
-        $expectedMac =~ s/\([0-9]+px/px/g;
-        $expectedMac =~ s/ *" *\n +" */ /g;
-        $expectedMac =~ s/" +$/"/g;
-
-        $expectedMac =~ s/- /-/g;
-        $expectedMac =~ s/\n( *)"\s+/\n$1"/g;
-        $expectedMac =~ s/\s+"\n/"\n/g;
-        
-        if ($simplified_actual ne $expectedMac) {
-          writeToFile("/tmp/actual.txt", $simplified_actual);
-          writeToFile("/tmp/expected.txt", $expectedMac);
-          system "diff -u \"/tmp/expected.txt\" \"/tmp/actual.txt\" > \"/tmp/simplified.diff\"";
-
-          $diffResult = "failed";
-          if ($verbose) {
-            print "\n";
-            system "cat /tmp/simplified.diff";
-            print "failed!!!!!";
-          }
-        }
-      }
-    }
-
     if (dumpToolDidCrash()) {
         $result = "crash";
         testCrashedOrTimedOut($test, $base, 1, $actual, $error);
@@ -971,6 +875,17 @@ for my $test (@tests) {
     }
 
     countFinishedTest($test, $base, $result, $isText);
+
+    # --reset-results does not check pass vs. fail, so exitAfterNFailures makes no sense with --reset-results.
+    if ($exitAfterNFailures && !$resetResults) {
+        my $passCount = $counts{match} || 0; # $counts{match} will be undefined if we've not yet passed a test (e.g. the first test fails).
+        my $failureCount = $count - $passCount; # "Failure" here includes new tests, timeouts, crashes, etc.
+        if ($failureCount >= $exitAfterNFailures) {
+            print "\nExiting early after $failureCount failures. $count tests run.";
+            closeDumpTool();
+            last;
+        }
+    }
 }
 printf "\n%0.2fs total testing time\n", (time - $overallStartTime) . "";
 
@@ -990,8 +905,7 @@ if ($isDiffToolOpen && $shouldCheckLeaks) {
 if ($totalLeaks) {
     if ($mergeDepth) {
         parseLeaksandPrintUniqueLeaks();
-    }
-    else { 
+    } else { 
         print "\nWARNING: $totalLeaks total leaks found!\n";
         print "See above for individual leaks results.\n" if ($leaksOutputFileNumber > 2);
     }
@@ -1025,31 +939,7 @@ if ($resetResults || ($counts{match} && $counts{match} == $count)) {
     exit;
 }
 
-
-my %text = (
-    match => "succeeded",
-    mismatch => "had incorrect layout",
-    new => "were new",
-    timedout => "timed out",
-    crash => "crashed",
-    error => "had stderr output"
-);
-
-for my $type ("match", "mismatch", "new", "timedout", "crash", "error") {
-    my $c = $counts{$type};
-    if ($c) {
-        my $t = $text{$type};
-        my $message;
-        if ($c == 1) {
-            $t =~ s/were/was/;
-            $message = sprintf "1 test case (%d%%) %s\n", 1 * 100 / $count, $t;
-        } else {
-            $message = sprintf "%d test cases (%d%%) %s\n", $c, $c * 100 / $count, $t;
-        }
-        $message =~ s-\(0%\)-(<1%)-;
-        print $message;
-    }
-}
+printResults();
 
 mkpath $testResultsDirectory;
 
@@ -1060,6 +950,10 @@ print HTML "<title>Layout Test Results</title>\n";
 print HTML "</head>\n";
 print HTML "<body>\n";
 
+if ($ignoreMetrics) {
+    print HTML "<h4>Tested with metrics ignored.</h4>";
+}
+
 print HTML htmlForResultsSection(@{$tests{mismatch}}, "Tests where results did not match expected results", \&linksForMismatchTest);
 print HTML htmlForResultsSection(@{$tests{timedout}}, "Tests that timed out", \&linksForErrorTest);
 print HTML htmlForResultsSection(@{$tests{crash}}, "Tests that caused the DumpRenderTree tool to crash", \&linksForErrorTest);
@@ -1143,6 +1037,13 @@ sub countAndPrintLeaks($$$)
         );
     }
 
+    if (isSnowLeopard()) {
+        push @callStacksToExclude, (
+            "readMakerNoteProps", # <rdar://problem/7156432> leak in ImageIO
+            "QTKitMovieControllerView completeUISetup", # <rdar://problem/7155156> leak in QTKit
+        );
+    }
+
     my $leaksTool = sourceDir() . "/WebKitTools/Scripts/run-leaks";
     my $excludeString = "--exclude-callstack '" . (join "' --exclude-callstack '", @callStacksToExclude) . "'";
     $excludeString .= " --exclude-type '" . (join "' --exclude-type '", @typesToExclude) . "'" if @typesToExclude;
@@ -1172,7 +1073,7 @@ sub countAndPrintLeaks($$$)
 
         writeToFile($leaksFilePath, $leaksOutput);
         
-        push( @leaksFilenames, $leaksFilePath );
+        push @leaksFilenames, $leaksFilePath;
     }
 
     return $adjustedCount;
@@ -1414,6 +1315,9 @@ sub openHTTPDIfNeeded()
     } elsif (isDebianBased()) {
         $httpdPath = "/usr/sbin/apache2";
         $httpdConfig = "$testDirectory/http/conf/apache2-debian-httpd.conf";
+    } elsif (isFedoraBased()) {
+        $httpdPath = "/usr/sbin/httpd";
+        $httpdConfig = "$testDirectory/http/conf/fedora-httpd.conf";
     } else {
         $httpdConfig = "$testDirectory/http/conf/httpd.conf";
         $httpdConfig = "$testDirectory/http/conf/apache2-httpd.conf" if `$httpdPath -v` =~ m|Apache/2|;
@@ -1476,7 +1380,8 @@ sub fileNameWithNumber($$)
     return $base;
 }
 
-sub processIgnoreTests($$) {
+sub processIgnoreTests($$)
+{
     my @ignoreList = split(/\s*,\s*/, shift);
     my $listName = shift;
 
@@ -1541,7 +1446,8 @@ sub expectedDirectoryForTest($;$;$)
     return $isText ? $expectedDirectory : $platformResultHierarchy[$#platformResultHierarchy];
 }
 
-sub countFinishedTest($$$$) {
+sub countFinishedTest($$$$)
+{
     my ($test, $base, $result, $isText) = @_;
 
     if (($count + 1) % $testsPerDumpTool == 0 || $count == $#tests) {
@@ -1563,7 +1469,6 @@ sub countFinishedTest($$$$) {
     $count++;
     $counts{$result}++;
     push @{$tests{$result}}, $test;
-    $testType{$test} = $isText;
 }
 
 sub testCrashedOrTimedOut($$$$$)
@@ -1833,6 +1738,9 @@ sub buildPlatformResultHierarchy()
         for (; $i < @macPlatforms; $i++) {
             push @platforms, $macPlatforms[$i];
         }
+    } elsif ($platform =~ /^qt-/) {
+        push @platforms, $platform;
+        push @platforms, "qt";
     } else {
         @platforms = $platform;
     }
@@ -1854,7 +1762,8 @@ sub buildPlatformTestHierarchy(@)
     return ($platformHierarchy[0], $platformHierarchy[$#platformHierarchy]);
 }
 
-sub epiloguesAndPrologues($$) {
+sub epiloguesAndPrologues($$)
+{
     my ($lastDirectory, $directory) = @_;
     my @lastComponents = split('/', $lastDirectory);
     my @components = split('/', $directory);
@@ -1890,7 +1799,8 @@ sub epiloguesAndPrologues($$) {
     return @result;
 }
     
-sub parseLeaksandPrintUniqueLeaks() {
+sub parseLeaksandPrintUniqueLeaks()
+{
     return unless @leaksFilenames;
      
     my $mergedFilenames = join " ", @leaksFilenames;
@@ -1926,11 +1836,12 @@ sub extensionForMimeType($)
 }
 
 # Read up to the first #EOF (the content block of the test), or until detecting crashes or timeouts.
-sub readFromDumpToolWithTimer(*;$)
+sub readFromDumpToolWithTimer(**)
 {
-    my ($fh, $dontWaitForTimeOut) = @_;
+    my ($fhIn, $fhError) = @_;
 
-    setFileHandleNonBlocking($fh, 1);
+    setFileHandleNonBlocking($fhIn, 1);
+    setFileHandleNonBlocking($fhError, 1);
 
     my $maximumSecondsWithoutOutput = $timeoutSeconds;
     $maximumSecondsWithoutOutput *= 10 if $guardMalloc;
@@ -1939,11 +1850,14 @@ sub readFromDumpToolWithTimer(*;$)
     my $timeOfLastSuccessfulRead = time;
 
     my @output = ();
+    my @error = ();
     my $status = "success";
     my $mimeType = "text/plain";
     # We don't have a very good way to know when the "headers" stop
     # and the content starts, so we use this as a hack:
     my $haveSeenContentType = 0;
+    my $haveSeenEofIn = 0;
+    my $haveSeenEofError = 0;
 
     while (1) {
         if (time - $timeOfLastSuccessfulRead > $maximumSecondsWithoutOutput) {
@@ -1951,37 +1865,48 @@ sub readFromDumpToolWithTimer(*;$)
             last;
         }
 
-        my $line = readline($fh);
-        if (!defined($line)) {
+        # Once we've seen the EOF, we must not read anymore.
+        my $lineIn = readline($fhIn) unless $haveSeenEofIn;
+        my $lineError = readline($fhError) unless $haveSeenEofError;
+        if (!defined($lineIn) && !defined($lineError)) {
+            last if ($haveSeenEofIn && $haveSeenEofError);
+
             if ($! != EAGAIN) {
                 $status = "crashed";
                 last;
             }
 
-            if ($dontWaitForTimeOut) {
-                last;
-            }
-
             # No data ready
             usleep($microsecondsToWaitBeforeReadingAgain);
             next;
         }
 
         $timeOfLastSuccessfulRead = time;
-        
-        if (!$haveSeenContentType && $line =~ /^Content-Type: (\S+)$/) {
-            $mimeType = $1;
-            $haveSeenContentType = 1;
-            next;
+
+        if (defined($lineIn)) {
+            if (!$haveSeenContentType && $lineIn =~ /^Content-Type: (\S+)$/) {
+                $mimeType = $1;
+                $haveSeenContentType = 1;
+            } elsif ($lineIn =~ /#EOF/) {
+                $haveSeenEofIn = 1;
+            } else {
+                push @output, $lineIn;
+            }
+        }
+        if (defined($lineError)) {
+            if ($lineError =~ /#EOF/) {
+                $haveSeenEofError = 1;
+            } else {
+                push @error, $lineError;
+            }
         }
-        last  if ($line =~ /#EOF/);
-        
-        push @output, $line;
     }
 
-    setFileHandleNonBlocking($fh, 0);
+    setFileHandleNonBlocking($fhIn, 0);
+    setFileHandleNonBlocking($fhError, 0);
     return {
         output => join("", @output),
+        error => join("", @error),
         status => $status,
         mimeType => $mimeType,
         extension => extensionForMimeType($mimeType)
@@ -2016,3 +1941,167 @@ sub sampleDumpTool()
     my $outputFile = "$outputDirectory/HangReport.txt";
     system "/usr/bin/sample", $dumpToolPID, qw(10 10 -file), $outputFile;
 }
+
+sub stripMetrics($$)
+{
+    my ($actual, $expected) = @_;
+
+    foreach my $result ($actual, $expected) {
+        $result =~ s/at \(-?[0-9]+,-?[0-9]+\) *//g;
+        $result =~ s/size -?[0-9]+x-?[0-9]+ *//g;
+        $result =~ s/text run width -?[0-9]+: //g;
+        $result =~ s/text run width -?[0-9]+ [a-zA-Z ]+: //g;
+        $result =~ s/RenderButton {BUTTON} .*/RenderButton {BUTTON}/g;
+        $result =~ s/RenderImage {INPUT} .*/RenderImage {INPUT}/g;
+        $result =~ s/RenderBlock {INPUT} .*/RenderBlock {INPUT}/g;
+        $result =~ s/RenderTextControl {INPUT} .*/RenderTextControl {INPUT}/g;
+        $result =~ s/\([0-9]+px/px/g;
+        $result =~ s/ *" *\n +" */ /g;
+        $result =~ s/" +$/"/g;
+
+        $result =~ s/- /-/g;
+        $result =~ s/\n( *)"\s+/\n$1"/g;
+        $result =~ s/\s+"\n/"\n/g;
+        $result =~ s/scrollWidth [0-9]+/scrollWidth/g;
+        $result =~ s/scrollHeight [0-9]+/scrollHeight/g;
+    }
+
+    return ($actual, $expected);
+}
+
+sub fileShouldBeIgnored
+{
+    my ($filePath) = @_;
+    foreach my $ignoredDir (keys %ignoredDirectories) {
+        if ($filePath =~ m/^$ignoredDir/) {
+            return 1;
+        }
+    }
+    return 0;
+}
+
+sub readSkippedFiles
+{
+    foreach my $level (@platformTestHierarchy) {
+        if (open SKIPPED, "<", "$level/Skipped") {
+            if ($verbose) {
+                my ($dir, $name) = splitpath($level);
+                print "Skipped tests in $name:\n";
+            }
+
+            while (<SKIPPED>) {
+                my $skipped = $_;
+                chomp $skipped;
+                $skipped =~ s/^[ \n\r]+//;
+                $skipped =~ s/[ \n\r]+$//;
+                if ($skipped && $skipped !~ /^#/) {
+                    if ($skippedOnly) {
+                        if (!&fileShouldBeIgnored($skipped)) {
+                            push(@ARGV, $skipped);
+                        } elsif ($verbose) {
+                            print "    $skipped\n";
+                        }
+                    } else {
+                        if ($verbose) {
+                            print "    $skipped\n";
+                        }
+                        processIgnoreTests($skipped, "Skipped");
+                    }
+                }
+            }
+            close SKIPPED;
+        }
+    }
+}
+
+my @testsToRun;
+
+sub directoryFilter
+{
+    return () if exists $ignoredLocalDirectories{basename($File::Find::dir)};
+    return () if exists $ignoredDirectories{File::Spec->abs2rel($File::Find::dir, $testDirectory)};
+    return @_;
+}
+
+sub fileFilter
+{
+    my $filename = $_;
+    if ($filename =~ /\.([^.]+)$/) {
+        if (exists $supportedFileExtensions{$1}) {
+            my $path = File::Spec->abs2rel(catfile($File::Find::dir, $filename), $testDirectory);
+            push @testsToRun, $path if !exists $ignoredFiles{$path};
+        }
+    }
+}
+
+sub findTestsToRun
+{
+    @testsToRun = ();
+
+    for my $test (@ARGV) {
+        $test =~ s/^($layoutTestsName|$testDirectory)\///;
+        my $fullPath = catfile($testDirectory, $test);
+        if (file_name_is_absolute($test)) {
+            print "can't run test $test outside $testDirectory\n";
+        } elsif (-f $fullPath) {
+            my ($filename, $pathname, $fileExtension) = fileparse($test, qr{\.[^.]+$});
+            if (!exists $supportedFileExtensions{substr($fileExtension, 1)}) {
+                print "test $test does not have a supported extension\n";
+            } elsif ($testHTTP || $pathname !~ /^http\//) {
+                push @testsToRun, $test;
+            }
+        } elsif (-d $fullPath) {
+            find({ preprocess => \&directoryFilter, wanted => \&fileFilter }, $fullPath);
+            for my $level (@platformTestHierarchy) {
+                my $platformPath = catfile($level, $test);
+                find({ preprocess => \&directoryFilter, wanted => \&fileFilter }, $platformPath) if (-d $platformPath);
+            }
+        } else {
+            print "test $test not found\n";
+        }
+    }
+
+    if (!scalar @ARGV) {
+        find({ preprocess => \&directoryFilter, wanted => \&fileFilter }, $testDirectory);
+        for my $level (@platformTestHierarchy) {
+            find({ preprocess => \&directoryFilter, wanted => \&fileFilter }, $level);
+        }
+    }
+
+    @testsToRun = sort pathcmp @testsToRun;
+
+    # Reverse the tests
+    @testsToRun = reverse @testsToRun if $reverseTests;
+
+    # Shuffle the array
+    @testsToRun = shuffle(@testsToRun) if $randomizeTests;
+
+    return @testsToRun;
+}
+
+sub printResults
+{
+    my %text = (
+        match => "succeeded",
+        mismatch => "had incorrect layout",
+        new => "were new",
+        timedout => "timed out",
+        crash => "crashed",
+        error => "had stderr output"
+    );
+
+    for my $type ("match", "mismatch", "new", "timedout", "crash", "error") {
+        my $typeCount = $counts{$type};
+        next unless $typeCount;
+        my $typeText = $text{$type};
+        my $message;
+        if ($typeCount == 1) {
+            $typeText =~ s/were/was/;
+            $message = sprintf "1 test case (%d%%) %s\n", 1 * 100 / $count, $typeText;
+        } else {
+            $message = sprintf "%d test cases (%d%%) %s\n", $typeCount, $typeCount * 100 / $count, $typeText;
+        }
+        $message =~ s-\(0%\)-(<1%)-;
+        print $message;
+    }
+}
diff --git a/WebKitTools/Scripts/run-webkit-unittests b/WebKitTools/Scripts/run-webkit-unittests
index 83aaea9..8d0ef1d 100755
--- a/WebKitTools/Scripts/run-webkit-unittests
+++ b/WebKitTools/Scripts/run-webkit-unittests
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 # Copyright (c) 2009 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -30,9 +30,12 @@
 import unittest
 
 from modules.bugzilla_unittest import *
-from modules.commiters_unittest import *
+from modules.buildbot_unittest import *
+from modules.changelogs_unittest import *
+from modules.committers_unittest import *
 from modules.cpp_style_unittest import *
 from modules.diff_parser_unittest import *
+from modules.logging_unittest import *
 from modules.scm_unittest import *
 
 if __name__ == "__main__":
diff --git a/WebKitTools/Scripts/sunspider-compare-results b/WebKitTools/Scripts/sunspider-compare-results
index d219896..ce87a23 100755
--- a/WebKitTools/Scripts/sunspider-compare-results
+++ b/WebKitTools/Scripts/sunspider-compare-results
@@ -67,7 +67,7 @@ sub buildJSC
 {
     if (!defined($root)){
         chdirWebKit();
-        my $buildResult = system "WebKitTools/Scripts/build-jsc", "--" . $configuration;
+        my $buildResult = system currentPerlPath(), "WebKitTools/Scripts/build-jsc", "--" . $configuration;
         if ($buildResult) {
             print STDERR "Compiling jsc failed!\n";
             exit WEXITSTATUS($buildResult);
@@ -124,4 +124,4 @@ my @args = ("--shell", $jscPath);
 push @args, "--ubench" if $ubench;
 push @args, "--v8" if $v8;
 
-exec "./sunspider-compare-results", @args, @ARGV;
+exec currentPerlPath(), "./sunspider-compare-results", @args, @ARGV;
diff --git a/WebKitTools/Scripts/svn-apply b/WebKitTools/Scripts/svn-apply
index 4b88a37..19c8c56 100755
--- a/WebKitTools/Scripts/svn-apply
+++ b/WebKitTools/Scripts/svn-apply
@@ -1,6 +1,7 @@
 #!/usr/bin/perl -w
 
 # Copyright (C) 2005, 2006, 2007 Apple Inc.  All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -80,6 +81,7 @@ sub isDirectoryEmptyForRemoval($);
 sub patch($);
 sub removeDirectoriesIfNeeded();
 sub setChangeLogDateAndReviewer($$);
+sub removeEOL($);
 sub svnStatus($);
 
 # These should be replaced by an scm class/module:
@@ -109,10 +111,6 @@ if (!$optionParseSuccess || $showHelp) {
     exit 1;
 }
 
-my $isGit = isGitDirectory(".");
-my $isSVN = isSVNDirectory(".");
-$isSVN || $isGit || die "Couldn't determine your version control system.";
-
 my %removeDirectoryIgnoreList = (
     '.' => 1,
     '..' => 1,
@@ -121,6 +119,11 @@ my %removeDirectoryIgnoreList = (
     '_svn' => 1,
 );
 
+my $globalExitCode = 0;
+
+my $pathScriptWasRunFrom = Cwd::getcwd();
+my $pathForRepositoryRoot = determineVCSRoot();
+
 my %checkedDirectories;
 my %copiedFiles;
 my @patches;
@@ -172,7 +175,7 @@ if ($patch && !$copiedFromPath) {
 }
 
 if ($merge) {
-    die "--merge is currently only supported for SVN" unless $isSVN;
+    die "--merge is currently only supported for SVN" unless isSVN();
     # How do we handle Git patches applied to an SVN checkout here?
     for my $file (sort keys %versions) {
         print "Getting version $versions{$file} of $file\n";
@@ -192,7 +195,7 @@ for $patch (@patches) {
 
 removeDirectoriesIfNeeded();
 
-exit 0;
+exit $globalExitCode;
 
 sub addDirectoriesIfNeeded($)
 {
@@ -226,16 +229,22 @@ sub addDirectoriesIfNeeded($)
 sub applyPatch($$;$)
 {
     my ($patch, $fullPath, $options) = @_;
+    chdir $pathForRepositoryRoot;
     $options = [] if (! $options);
+    push @{$options}, "--force" if $force;
     my $command = "patch " . join(" ", "-p0", @{$options});
     open PATCH, "| $command" or die "Failed to patch $fullPath\n";
     print PATCH $patch;
     close PATCH;
+    chdir $pathScriptWasRunFrom;
 
     my $exitCode = $? >> 8;
-    if ($exitCode != 0) {
-        print "patch -p0 \"$fullPath\" returned $exitCode.  Pass --force to ignore patch failures.\n";
-        exit($exitCode);
+    if ($exitCode) {
+        if (!$force) {
+            print "$command \"$fullPath\" returned $exitCode.  Pass --force to ignore patch failures.\n";
+            exit $exitCode;
+        }
+        $globalExitCode = $exitCode;
     }
 }
 
@@ -320,7 +329,10 @@ sub gitdiff2svndiff($)
 sub handleBinaryChange($$)
 {
     my ($fullPath, $contents) = @_;
-    if ($contents =~ m#((\n[A-Za-z0-9+/]{76})+\n[A-Za-z0-9+/=]{4,76}\n)#) {
+    # [A-Za-z0-9+/] is the class of allowed base64 characters.
+    # One or more lines, at most 76 characters in length.
+    # The last line is allowed to have up to two '=' characters at the end (to signify padding).
+    if ($contents =~ m#((\n[A-Za-z0-9+/]{76})*\n[A-Za-z0-9+/]{2,74}?[A-Za-z0-9+/=]{2}\n)#) {
         # Addition or Modification
         open FILE, ">", $fullPath or die;
         print FILE decode_base64($1);
@@ -369,7 +381,7 @@ sub patch($)
     my $addition = 0;
     my $isBinary = 0;
 
-    $addition = 1 if ($patch =~ /\n--- .+\(revision 0\)\r?\n/ || $patch =~ /\n@@ -0,0 .* @@/);
+    $addition = 1 if ($patch =~ /\n--- .+\(revision 0\)\r?\n/ || $patch =~ /\n@@ -0,0 .* @@/) && !exists($copiedFiles{$fullPath});
     $deletion = 1 if $patch =~ /\n@@ .* \+0,0 @@/;
     $isBinary = 1 if $patch =~ /\nCannot display: file marked as a binary type\./;
 
@@ -401,7 +413,7 @@ sub patch($)
             unlink("$fullPath.orig") if -e "$fullPath.orig" && checksum($fullPath) eq checksum("$fullPath.orig");
             scmAdd($fullPath);
             # What is this for?
-            system "svn", "stat", "$fullPath.orig" if $isSVN && -e "$fullPath.orig";
+            system "svn", "stat", "$fullPath.orig" if isSVN() && -e "$fullPath.orig";
         }
     }
 }
@@ -435,6 +447,14 @@ sub setChangeLogDateAndReviewer($$)
     return $patch;
 }
 
+sub removeEOL($)
+{
+    my ($line) = @_;
+
+    $line =~ s/[\r\n]+$//g;
+    return $line;
+}
+
 sub svnStatus($)
 {
     my ($fullPath) = @_;
@@ -448,10 +468,10 @@ sub svnStatus($)
         my $normalizedFullPath = File::Spec->catdir(File::Spec->splitdir($fullPath));
         while (<SVN>) {
             # Input may use a different EOL sequence than $/, so avoid chomp.
-            $_ =~ s/[\r\n]+$//g;
+            $_ = removeEOL($_);
             my $normalizedStatPath = File::Spec->catdir(File::Spec->splitdir(substr($_, 7)));
             if ($normalizedFullPath eq $normalizedStatPath) {
-                $svnStatus = $_;
+                $svnStatus = "$_\n";
                 last;
             }
         }
@@ -461,7 +481,7 @@ sub svnStatus($)
     }
     else {
         # Files will have only one status returned.
-        $svnStatus = <SVN>;
+        $svnStatus = removeEOL(<SVN>) . "\n";
     }
     close SVN;
     return $svnStatus;
@@ -472,10 +492,10 @@ sub svnStatus($)
 sub scmWillDeleteFile($)
 {
     my ($path) = @_;
-    if ($isSVN) {
+    if (isSVN()) {
         my $svnOutput = svnStatus($path);
         return 1 if $svnOutput && substr($svnOutput, 0, 1) eq "D";
-    } elsif ($isGit) {
+    } elsif (isGit()) {
         my $gitOutput = `git diff-index --name-status HEAD -- $path`;
         return 1 if $gitOutput && substr($gitOutput, 0, 1) eq "D";
     }
@@ -485,7 +505,7 @@ sub scmWillDeleteFile($)
 sub scmKnowsOfFile($)
 {
     my ($path) = @_;
-    if ($isSVN) {
+    if (isSVN()) {
         my $svnOutput = svnStatus($path);
         # This will match more than intended.  ? might not be the first field in the status
         if ($svnOutput && $svnOutput =~ m#\?\s+$path\n#) {
@@ -493,7 +513,7 @@ sub scmKnowsOfFile($)
         }
         # This does not handle errors well.
         return 1;
-    } elsif ($isGit) {
+    } elsif (isGit()) {
         `git ls-files --error-unmatch -- $path`;
         my $exitCode = $? >> 8;
         return $exitCode == 0;
@@ -503,9 +523,9 @@ sub scmKnowsOfFile($)
 sub scmCopy($$)
 {
     my ($source, $destination) = @_;
-    if ($isSVN) {
+    if (isSVN()) {
         system "svn", "copy", $source, $destination;
-    } elsif ($isGit) {
+    } elsif (isGit()) {
         system "cp", $source, $destination;
         system "git", "add", $destination;
     }
@@ -514,9 +534,9 @@ sub scmCopy($$)
 sub scmAdd($)
 {
     my ($path) = @_;
-    if ($isSVN) {
+    if (isSVN()) {
         system "svn", "add", $path;
-    } elsif ($isGit) {
+    } elsif (isGit()) {
         system "git", "add", $path;
     }
 }
@@ -524,7 +544,7 @@ sub scmAdd($)
 sub scmRemove($)
 {
     my ($path) = @_;
-    if ($isSVN) {
+    if (isSVN()) {
         # SVN is very verbose when removing directories.  Squelch all output except the last line.
         my $svnOutput;
         open SVN, "svn rm --force '$path' |" or die "svn rm --force '$path' failed!";
@@ -534,7 +554,7 @@ sub scmRemove($)
         }
         close SVN;
         print $svnOutput if $svnOutput;
-    } elsif ($isGit) {
+    } elsif (isGit()) {
         system "git", "rm", "--force", $path;
     }
 }
diff --git a/WebKitTools/Scripts/svn-create-patch b/WebKitTools/Scripts/svn-create-patch
index 75c82bc..3f40783 100755
--- a/WebKitTools/Scripts/svn-create-patch
+++ b/WebKitTools/Scripts/svn-create-patch
@@ -77,14 +77,15 @@ sub testfilecmp($$);
 $ENV{'LC_ALL'} = 'C';
 
 my $showHelp;
-my $svnVersion = `svn --version --quiet`;
+my $ignoreChangelogs = 0;
 my $devNull = File::Spec->devnull();
 
 my $result = GetOptions(
     "help"       => \$showHelp,
+    "ignore-changelogs"    => \$ignoreChangelogs
 );
 if (!$result || $showHelp) {
-    print STDERR basename($0) . " [-h|--help] [svndir1 [svndir2 ...]]\n";
+    print STDERR basename($0) . " [-h|--help] [--ignore-changelogs] [svndir1 [svndir2 ...]]\n";
     exit 1;
 }
 
@@ -156,7 +157,7 @@ sub findBaseUrl($)
     my $baseUrl;
     open INFO, "svn info '$infoPath' |" or die;
     while (<INFO>) {
-        if (/^URL: (.+)/) {
+        if (/^URL: (.+?)[\r\n]*$/) {
             $baseUrl = $1;
         }
     }
@@ -200,7 +201,7 @@ sub findSourceFileAndRevision($)
     my $sourceRevision;
     open INFO, "svn info '$file' |" or die;
     while (<INFO>) {
-        if (/^Copied From URL: (.+)/) {
+        if (/^Copied From URL: (.+?)[\r\n]*$/) {
             $sourceFile = File::Spec->abs2rel($1, $baseUrl);
         } elsif (/^Copied From Rev: ([0-9]+)/) {
             $sourceRevision = $1;
@@ -265,6 +266,11 @@ sub generateDiff($$)
 {
     my ($fileData, $prefix) = @_;
     my $file = File::Spec->catdir($prefix, $fileData->{path});
+    
+    if ($ignoreChangelogs && basename($file) eq "ChangeLog") {
+        return;
+    }
+    
     my $patch;
     if ($fileData->{modificationType} eq "additionWithHistory") {
         manufacturePatchForAdditionWithHistory($fileData);
@@ -292,7 +298,7 @@ sub generateFileList($\%)
         $line =~ s/[\r\n]+$//g;
         my $stat;
         my $path;
-        if (eval "v$svnVersion" ge v1.6) { 
+        if (isSVNVersion16OrNewer()) {
             $stat = substr($line, 0, 8);
             $path = substr($line, 8);
         } else {
diff --git a/WebKitTools/Scripts/svn-unapply b/WebKitTools/Scripts/svn-unapply
index 964b51e..a4cec9a 100755
--- a/WebKitTools/Scripts/svn-unapply
+++ b/WebKitTools/Scripts/svn-unapply
@@ -1,6 +1,7 @@
 #!/usr/bin/perl -w
 
 # Copyright (C) 2005, 2006, 2007 Apple Inc.  All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -65,11 +66,16 @@ use File::Spec;
 use File::Temp qw(tempfile);
 use Getopt::Long;
 
+use FindBin;
+use lib $FindBin::Bin;
+use VCSUtils;
+
 sub checksum($);
 sub fixChangeLogPatch($);
 sub gitdiff2svndiff($);
 sub patch($);
 sub revertDirectories();
+sub removeEOL($);
 sub svnStatus($);
 sub unapplyPatch($$;$);
 sub unsetChangeLogDate($$);
@@ -80,6 +86,9 @@ if (!GetOptions("help!" => \$showHelp) || $showHelp) {
     exit 1;
 }
 
+my $pathScriptWasRunFrom = Cwd::getcwd();
+my $pathForRepositoryRoot = determineVCSRoot();
+
 my @copiedFiles;
 my %directoriesToCheck;
 
@@ -133,7 +142,9 @@ for $patch (@copiedFiles) {
     patch($patch);
 }
 
-revertDirectories();
+if (isSVN()) {
+    revertDirectories();
+}
 
 exit 0;
 
@@ -289,6 +300,7 @@ sub patch($)
 
 sub revertDirectories()
 {
+    chdir $pathForRepositoryRoot;
     my %checkedDirectories;
     foreach my $path (reverse sort keys %directoriesToCheck) {
         my @dirs = File::Spec->splitdir($path);
@@ -318,6 +330,14 @@ sub revertDirectories()
     }
 }
 
+sub removeEOL($)
+{
+    my ($line) = @_;
+
+    $line =~ s/[\r\n]+$//g;
+    return $line;
+}
+
 sub svnStatus($)
 {
     my ($fullPath) = @_;
@@ -331,10 +351,10 @@ sub svnStatus($)
         my $normalizedFullPath = File::Spec->catdir(File::Spec->splitdir($fullPath));
         while (<SVN>) {
             # Input may use a different EOL sequence than $/, so avoid chomp.
-            $_ =~ s/[\r\n]+$//g;
+            $_ = removeEOL($_);
             my $normalizedStatPath = File::Spec->catdir(File::Spec->splitdir(substr($_, 7)));
             if ($normalizedFullPath eq $normalizedStatPath) {
-                $svnStatus = $_;
+                $svnStatus = "$_\n";
                 last;
             }
         }
@@ -344,7 +364,7 @@ sub svnStatus($)
     }
     else {
         # Files will have only one status returned.
-        $svnStatus = <SVN>;
+        $svnStatus = removeEOL(<SVN>) . "\n";
     }
     close SVN;
     return $svnStatus;
@@ -353,11 +373,13 @@ sub svnStatus($)
 sub unapplyPatch($$;$)
 {
     my ($patch, $fullPath, $options) = @_;
+    chdir $pathForRepositoryRoot;
     $options = [] if (! $options);
     my $command = "patch " . join(" ", "-p0", "-R", @{$options});
     open PATCH, "| $command" or die "Failed to patch $fullPath: $!";
     print PATCH $patch;
     close PATCH;
+    chdir $pathScriptWasRunFrom;
 }
 
 sub unsetChangeLogDate($$)
diff --git a/WebKitTools/Scripts/update-sources-list.py b/WebKitTools/Scripts/update-sources-list.py
index e565059..433d04a 100644..100755
--- a/WebKitTools/Scripts/update-sources-list.py
+++ b/WebKitTools/Scripts/update-sources-list.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 
 # Copyright (C) 2007 Kevin Ollivier  All rights reserved.
 #
diff --git a/WebKitTools/Scripts/update-webkit b/WebKitTools/Scripts/update-webkit
index 5f72869..e562cc0 100755
--- a/WebKitTools/Scripts/update-webkit
+++ b/WebKitTools/Scripts/update-webkit
@@ -1,6 +1,7 @@
 #!/usr/bin/perl -w
 
-# Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+# Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -34,6 +35,7 @@ use lib $FindBin::Bin;
 use File::Basename;
 use File::Spec;
 use Getopt::Long;
+use VCSUtils;
 use webkitdirs;
 
 sub runSvnUpdate();
@@ -43,6 +45,8 @@ sub normalizePath($);
 my $quiet = '';
 my $showHelp;
 
+determineIsChromium();
+
 my $getOptionsResult = GetOptions(
     'h|help'  => \$showHelp,
     'q|quiet' => \$quiet,
@@ -51,6 +55,7 @@ my $getOptionsResult = GetOptions(
 if (!$getOptionsResult || $showHelp) {
     print STDERR <<__END__;
 Usage: @{[ basename($0) ]} [options]
+  --chromium  also update dependencies of the chromium port
   -h|--help   show the help message
   -q|--quiet  pass -q to svn update for quiet updates
 __END__
@@ -60,6 +65,9 @@ __END__
 my @svnOptions = ();
 push @svnOptions, '-q' if $quiet;
 
+# Don't prompt when using svn-1.6 or newer.
+push @svnOptions, qw(--accept postpone) if isSVNVersion16OrNewer();
+
 chdirWebKit();
 print "Updating OpenSource\n" unless $quiet;
 runSvnUpdate();
@@ -68,6 +76,8 @@ if (-d "../Internal") {
     chdir("../Internal");
     print "Updating Internal\n" unless $quiet;
     runSvnUpdate();
+} elsif (isChromium()) {
+    system("perl", "WebKitTools/Scripts/update-webkit-chromium") == 0 or die $!;
 } elsif (isAppleWinWebKit()) {
     system("perl", "WebKitTools/Scripts/update-webkit-auxiliary-libs") == 0 or die;
 }
@@ -80,7 +90,7 @@ sub runSvnUpdate()
     my @conflictedChangeLogs;
     while (my $line = <UPDATE>) {
         print $line;
-        $line =~ m/^C\s+(.*\S+)\s*$/;
+        $line =~ m/^C\s+(.+?)[\r\n]*$/;
         if ($1) {
           my $filename = normalizePath($1);
           push @conflictedChangeLogs, $filename if basename($filename) eq "ChangeLog";
diff --git a/WebKitTools/Scripts/update-webkit-chromium b/WebKitTools/Scripts/update-webkit-chromium
new file mode 100644
index 0000000..a0cc19a
--- /dev/null
+++ b/WebKitTools/Scripts/update-webkit-chromium
@@ -0,0 +1,51 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer. 
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution. 
+# 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+#     its contributors may be used to endorse or promote products derived
+#     from this software without specific prior written permission. 
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Update script for the WebKit Chromium Port.
+
+# Check if gclient is installed.
+if (not `gclient --version`) {
+    print STDERR "gclient is required for updating chromium dependencies.\n";
+    print STDERR "Install depot_tools and add gclient to the environment\n";
+    print STDERR "path. For more information, refer to:\n";
+    print STDERR "http://dev.chromium.org/developers/how-tos/install-gclient\n";
+    die;
+}
+
+chdir("WebKit/chromium") or die $!;
+if (! -e ".gclient") {
+    # If .gclient configuration file doesn't exist, create it.
+    print "Configuring gclient...\n";
+    system("gclient", 
+           "config", 
+           "--spec=solutions=[{'name':'./','url':None}]") == 0 or die $!;
+}
+
+# Execute gclient sync.
+print "Updating chromium port dependencies using gclient...\n";
+system("gclient", "sync") == 0 or die $!;
diff --git a/WebKitTools/Scripts/update-webkit-localizable-strings b/WebKitTools/Scripts/update-webkit-localizable-strings
index 350bf21..1d1f413 100755
--- a/WebKitTools/Scripts/update-webkit-localizable-strings
+++ b/WebKitTools/Scripts/update-webkit-localizable-strings
@@ -43,4 +43,4 @@ my $exceptionsFile = "WebKit/StringsNotToBeLocalized.txt";
 chdirWebKit();
 
 system "sort -u $exceptionsFile -o $exceptionsFile";
-exec "extract-localizable-strings", $exceptionsFile, $fileToUpdate, @directoriesToScan;
+exec "./WebKitTools/Scripts/extract-localizable-strings", $exceptionsFile, $fileToUpdate, @directoriesToScan;
diff --git a/WebKitTools/Scripts/webkitdirs.pm b/WebKitTools/Scripts/webkitdirs.pm
index d8ccd3a..d5177dd 100644
--- a/WebKitTools/Scripts/webkitdirs.pm
+++ b/WebKitTools/Scripts/webkitdirs.pm
@@ -1,4 +1,5 @@
 # Copyright (C) 2005, 2006, 2007 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -28,8 +29,10 @@
 
 use strict;
 use warnings;
+use Config;
 use FindBin;
 use File::Basename;
+use File::Spec;
 use POSIX;
 use VCSUtils;
 
@@ -83,6 +86,15 @@ sub determineSourceDir
     $sourceDir = "$sourceDir/OpenSource" if -d "$sourceDir/OpenSource";
 }
 
+sub currentPerlPath()
+{
+    my $thisPerl = $^X;
+    if ($^O ne 'VMS') {
+        $thisPerl .= $Config{_exe} unless $thisPerl =~ m/$Config{_exe}$/i;
+    }
+    return $thisPerl;
+}
+
 # used for scripts which are stored in a non-standard location
 sub setSourceDir($)
 {
@@ -468,9 +480,17 @@ sub safariPath
         # Use Safari.app in product directory if present (good for Safari development team).
         if (isAppleMacWebKit() && -d "$configurationProductDir/Safari.app") {
             $safariBundle = "$configurationProductDir/Safari.app";
-        } elsif (isAppleWinWebKit() && -x "$configurationProductDir/bin/Safari.exe") {
-            $safariBundle = "$configurationProductDir/bin/Safari.exe";
-        } else {
+        } elsif (isAppleWinWebKit()) {
+            my $path = "$configurationProductDir/Safari.exe";
+            my $debugPath = "$configurationProductDir/Safari_debug.exe";
+
+            if (configurationForVisualStudio() =~ /Debug/ && -x $debugPath) {
+                $safariBundle = $debugPath;
+            } elsif (-x $path) {
+                $safariBundle = $path;
+            }
+        }
+        if (!$safariBundle) {
             return installedSafariPath();
         }
     }
@@ -539,6 +559,25 @@ sub libraryContainsSymbol
     return $foundSymbol;
 }
 
+sub hasMathMLSupport
+{
+    my $path = shift;
+
+    return libraryContainsSymbol($path, "MathMLElement");
+}
+
+sub checkWebCoreMathMLSupport
+{
+    my $required = shift;
+    my $framework = "WebCore";
+    my $path = builtDylibPathForName($framework);
+    my $hasMathML = hasMathMLSupport($path);
+    if ($required && !$hasMathML) {
+        die "$framework at \"$path\" does not include MathML Support, please run build-webkit --mathml\n";
+    }
+    return $hasMathML;
+}
+
 sub hasSVGSupport
 {
     my $path = shift;
@@ -618,6 +657,26 @@ sub checkWebCore3DRenderingSupport
     return $has3DRendering;
 }
 
+sub has3DCanvasSupport
+{
+    return 0 if isQt();
+
+    my $path = shift;
+    return libraryContainsSymbol($path, "CanvasShader");
+}
+
+sub checkWebCore3DCanvasSupport
+{
+    my $required = shift;
+    my $framework = "WebCore";
+    my $path = builtDylibPathForName($framework);
+    my $has3DCanvas = has3DCanvasSupport($path);
+    if ($required && !$has3DCanvas) {
+        die "$framework at \"$path\" does not include 3D Canvas Support, please run build-webkit --3d-canvas\n";
+    }
+    return $has3DCanvas;
+}
+
 sub hasWMLSupport
 {
     my $path = shift;
@@ -788,6 +847,11 @@ sub isDebianBased()
     return -e "/etc/debian_version";
 }
 
+sub isFedoraBased()
+{
+    return -e "/etc/fedora-release";
+}
+
 sub isChromium()
 {
     determineIsChromium();
@@ -810,6 +874,16 @@ sub isDarwin()
     return ($^O eq "darwin") || 0;
 }
 
+sub isWindows()
+{
+    return ($^O eq "MSWin32") || 0;
+}
+
+sub isLinux()
+{
+    return ($^O eq "linux") || 0;
+}
+
 sub isAppleWebKit()
 {
     return !(isQt() or isGtk() or isWx() or isChromium());
@@ -894,7 +968,7 @@ sub relativeScriptsDir()
 sub launcherPath()
 {
     my $relativeScriptsPath = relativeScriptsDir();
-    if (isGtk() || isQt()) {
+    if (isGtk() || isQt() || isWx()) {
         return "$relativeScriptsPath/run-launcher";
     } elsif (isAppleWebKit()) {
         return "$relativeScriptsPath/run-safari";
@@ -907,6 +981,8 @@ sub launcherName()
         return "GtkLauncher";
     } elsif (isQt()) {
         return "QtLauncher";
+    } elsif (isWx()) {
+        return "wxBrowser";
     } elsif (isAppleWebKit()) {
         return "Safari";
     }
@@ -931,7 +1007,7 @@ sub checkRequiredSystemConfig
             print "http://developer.apple.com/tools/xcode\n";
             print "*************************************************************\n";
         }
-    } elsif (isGtk() or isQt() or isWx()) {
+    } elsif (isGtk() or isQt() or isWx() or isChromium()) {
         my @cmds = qw(flex bison gperf);
         my @missing = ();
         foreach my $cmd (@cmds) {
@@ -952,23 +1028,21 @@ sub setupCygwinEnv()
     return if !isCygwin();
     return if $vcBuildPath;
 
-    my $programFilesPath = `cygpath "$ENV{'PROGRAMFILES'}"`;
-    chomp $programFilesPath;
-    $vcBuildPath = "$programFilesPath/Microsoft Visual Studio 8/Common7/IDE/devenv.com";
+    my $vsInstallDir;
+    my $programFilesPath = $ENV{'PROGRAMFILES'} || "C:\\Program Files";
+    if ($ENV{'VSINSTALLDIR'}) {
+        $vsInstallDir = $ENV{'VSINSTALLDIR'};
+    } else {
+        $vsInstallDir = "$programFilesPath/Microsoft Visual Studio 8";
+    }
+    $vsInstallDir = `cygpath "$vsInstallDir"`;
+    chomp $vsInstallDir;
+    $vcBuildPath = "$vsInstallDir/Common7/IDE/devenv.com";
     if (-e $vcBuildPath) {
         # Visual Studio is installed; we can use pdevenv to build.
         $vcBuildPath = File::Spec->catfile(sourceDir(), qw(WebKitTools Scripts pdevenv));
     } else {
         # Visual Studio not found, try VC++ Express
-        my $vsInstallDir;
-        if ($ENV{'VSINSTALLDIR'}) {
-            $vsInstallDir = $ENV{'VSINSTALLDIR'};
-        } else {
-            $programFilesPath = $ENV{'PROGRAMFILES'} || "C:\\Program Files";
-            $vsInstallDir = "$programFilesPath/Microsoft Visual Studio 8";
-        }
-        $vsInstallDir = `cygpath "$vsInstallDir"`;
-        chomp $vsInstallDir;
         $vcBuildPath = "$vsInstallDir/Common7/IDE/VCExpress.exe";
         if (! -e $vcBuildPath) {
             print "*************************************************************\n";
@@ -1032,6 +1106,50 @@ sub buildVisualStudioProject
     return system @command;
 }
 
+sub downloadWafIfNeeded
+{
+    # get / update waf if needed
+    my $waf = "$sourceDir/WebKitTools/wx/waf";
+    my $wafURL = 'http://wxwebkit.wxcommunity.com/downloads/deps/waf';
+    if (!-f $waf) {
+        my $result = system "curl -o $waf $wafURL";
+        chmod 0755, $waf;
+    }
+}
+
+sub buildWafProject
+{
+    my ($project, $shouldClean, @options) = @_;
+    
+    # set the PYTHONPATH for waf
+    my $pythonPath = $ENV{'PYTHONPATH'};
+    if (!defined($pythonPath)) {
+        $pythonPath = '';
+    }
+    my $sourceDir = sourceDir();
+    my $newPythonPath = "$sourceDir/WebKitTools/wx/build:$pythonPath";
+    if (isCygwin()) {
+        $newPythonPath = `cygpath --mixed --path $newPythonPath`;
+    }
+    $ENV{'PYTHONPATH'} = $newPythonPath;
+    
+    print "Building $project\n";
+
+    my $wafCommand = "$sourceDir/WebKitTools/wx/waf";
+    if ($ENV{'WXWEBKIT_WAF'}) {
+        $wafCommand = $ENV{'WXWEBKIT_WAF'};
+    }
+    if (isCygwin()) {
+        $wafCommand = `cygpath --windows "$wafCommand"`;
+        chomp($wafCommand);
+    }
+    if ($shouldClean) {
+        return system $wafCommand, "clean", "distclean";
+    }
+    
+    return system $wafCommand, 'configure', 'build', 'install', @options;
+}
+
 sub retrieveQMakespecVar
 {
     my $mkspec = $_[0];
@@ -1187,26 +1305,28 @@ sub buildQMakeProject($@)
         push @buildArgs, "CONFIG-=release";
         push @buildArgs, "CONFIG+=debug";
     } else {
-        push @buildArgs, "CONFIG+=release";
         my $passedConfig = passedConfiguration() || "";
         if (!isDarwin() || $passedConfig =~ m/release/i) {
+            push @buildArgs, "CONFIG+=release";
             push @buildArgs, "CONFIG-=debug";
         } else {
+            push @buildArgs, "CONFIG+=debug";
             push @buildArgs, "CONFIG+=debug_and_release";
-            push @buildArgs, "CONFIG+=build_all";
         }
     }
 
-    my $dir = baseProductDir();
+    my $dir = File::Spec->canonpath(baseProductDir());
+    my @mkdirArgs;
+    push @mkdirArgs, "-p" if !isWindows();
     if (! -d $dir) {
-        system "mkdir", "-p", "$dir";
+        system "mkdir", @mkdirArgs, "$dir";
         if (! -d $dir) {
             die "Failed to create product directory " . $dir;
         }
     }
-    $dir = $dir . "/$config";
+    $dir = File::Spec->catfile($dir, $config);
     if (! -d $dir) {
-        system "mkdir", "-p", "$dir";
+        system "mkdir", @mkdirArgs, "$dir";
         if (! -d $dir) {
             die "Failed to create build directory " . $dir;
         }
@@ -1217,7 +1337,7 @@ sub buildQMakeProject($@)
     print "Calling '$qmakebin @buildArgs' in " . $dir . "\n\n";
     print "Installation directory: $prefix\n" if(defined($prefix));
 
-    my $result = system $qmakebin, @buildArgs;
+    my $result = system "$qmakebin @buildArgs";
     if ($result ne 0) {
        die "Failed to setup build environment using $qmakebin!\n";
     }
@@ -1250,6 +1370,30 @@ sub buildGtkProject($$@)
     return buildAutotoolsProject($clean, @buildArgs);
 }
 
+sub buildChromium($@)
+{
+    my ($clean, @options) = @_;
+
+    my $result = 1;
+    if (isDarwin()) {
+        # Mac build - builds the root xcode project.
+        $result = buildXCodeProject("WebKit/chromium/webkit",
+                                    $clean,
+                                    (@options));
+    } elsif (isCygwin()) {
+        # Windows build - builds the root visual studio solution.
+        $result = buildVisualStudioProject("WebKit/chromium/webkit.sln",
+                                           $clean);
+    } elsif (isLinux()) {
+        # Linux build
+        # FIXME support linux.
+        print STDERR "Linux build is not supported. Yet.";
+    } else {
+        print STDERR "This platform is not supported by chromium.";
+    }
+    return $result;
+}
+
 sub setPathForRunningWebKitApp
 {
     my ($env) = @_;
diff --git a/WebKitTools/WebKitLauncher/Info.plist b/WebKitTools/WebKitLauncher/Info.plist
index 1eba038..83564a7 100644
--- a/WebKitTools/WebKitLauncher/Info.plist
+++ b/WebKitTools/WebKitLauncher/Info.plist
@@ -441,6 +441,8 @@
 	<false/>
 	<key>SUAllowsAutomaticUpdates</key>
 	<false/>
+	<key>SUPublicDSAKeyFile</key>
+	<string>nightly.webkit.org.public.pem</string>
 	<key>NSPrincipalClass</key>
 	<string>BrowserApplication</string>
 	<key>CFBundleHelpBookFolder</key>
diff --git a/WebKitTools/WebKitLauncher/WebKitLauncher.xcodeproj/project.pbxproj b/WebKitTools/WebKitLauncher/WebKitLauncher.xcodeproj/project.pbxproj
index b8d7a6d..36eacc5 100644
--- a/WebKitTools/WebKitLauncher/WebKitLauncher.xcodeproj/project.pbxproj
+++ b/WebKitTools/WebKitLauncher/WebKitLauncher.xcodeproj/project.pbxproj
@@ -23,6 +23,7 @@
 /* Begin PBXBuildFile section */
 		5D1067640FE63758002A2868 /* WebKitLauncherURLProtocol.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D1067620FE63758002A2868 /* WebKitLauncherURLProtocol.h */; };
 		5D1067650FE63758002A2868 /* WebKitLauncherURLProtocol.m in Sources */ = {isa = PBXBuildFile; fileRef = 5D1067630FE63758002A2868 /* WebKitLauncherURLProtocol.m */; };
+		5D18A1FF103FE255006CA7C7 /* nightly.webkit.org.public.pem in Resources */ = {isa = PBXBuildFile; fileRef = 5D18A1FE103FE255006CA7C7 /* nightly.webkit.org.public.pem */; };
 		5D41141C0A50A9DE00C84CF0 /* VERSION in Resources */ = {isa = PBXBuildFile; fileRef = 5D41141B0A50A9DE00C84CF0 /* VERSION */; };
 		5D4DF982097F89FB0083D5E5 /* start.html in Resources */ = {isa = PBXBuildFile; fileRef = 5D4DF981097F89FB0083D5E5 /* start.html */; };
 		5D650F3609DB8B370075E9A8 /* WebKitNightlyEnabler.m in Sources */ = {isa = PBXBuildFile; fileRef = 5D650F3509DB8B370075E9A8 /* WebKitNightlyEnabler.m */; };
@@ -65,6 +66,7 @@
 		29B97316FDCFA39411CA2CEA /* main.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = main.m; sourceTree = "<group>"; };
 		5D1067620FE63758002A2868 /* WebKitLauncherURLProtocol.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitLauncherURLProtocol.h; sourceTree = "<group>"; };
 		5D1067630FE63758002A2868 /* WebKitLauncherURLProtocol.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = WebKitLauncherURLProtocol.m; sourceTree = "<group>"; };
+		5D18A1FE103FE255006CA7C7 /* nightly.webkit.org.public.pem */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = nightly.webkit.org.public.pem; sourceTree = "<group>"; };
 		5D41141B0A50A9DE00C84CF0 /* VERSION */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = VERSION; sourceTree = "<group>"; };
 		5D4DF981097F89FB0083D5E5 /* start.html */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text.html; path = start.html; sourceTree = "<group>"; };
 		5D650F3409DB8B280075E9A8 /* WebKitNightlyEnabler.dylib */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.dylib"; includeInIndex = 0; path = WebKitNightlyEnabler.dylib; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -148,9 +150,10 @@
 		29B97317FDCFA39411CA2CEA /* Resources */ = {
 			isa = PBXGroup;
 			children = (
-				5D41141B0A50A9DE00C84CF0 /* VERSION */,
 				8D1107310486CEB800E47090 /* Info.plist */,
+				5D18A1FE103FE255006CA7C7 /* nightly.webkit.org.public.pem */,
 				5D4DF981097F89FB0083D5E5 /* start.html */,
+				5D41141B0A50A9DE00C84CF0 /* VERSION */,
 				5DB70524097B94CD009875EC /* webkit.icns */,
 			);
 			name = Resources;
@@ -257,6 +260,7 @@
 				5D41141C0A50A9DE00C84CF0 /* VERSION in Resources */,
 				5DB70525097B94CD009875EC /* webkit.icns in Resources */,
 				5D650F3A09DB8B410075E9A8 /* WebKitNightlyEnabler.dylib in Resources */,
+				5D18A1FF103FE255006CA7C7 /* nightly.webkit.org.public.pem in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebKitTools/WebKitLauncher/WebKitNightlyEnablerSparkle.m b/WebKitTools/WebKitLauncher/WebKitNightlyEnablerSparkle.m
index 3927131..8b13ab8 100644
--- a/WebKitTools/WebKitLauncher/WebKitNightlyEnablerSparkle.m
+++ b/WebKitTools/WebKitLauncher/WebKitNightlyEnablerSparkle.m
@@ -43,13 +43,6 @@ static NSString* updatePermissionPromptDescription(id self, SEL _cmd)
     return @"Should WebKit automatically check for updates? You can always check for updates manually from the Safari menu.";
 }
 
-// -[SUBasicUpdateDriver downloadDidFinish:] requires that the download be served over SSL or signed
-// using a public key.  We're not interested in dealing with that hassle just at the moment.
-static void skipSignatureVerificationInDownloadDidFinish(id self, SEL _cmd, id download)
-{
-    objc_msgSend(self, @selector(extractUpdate));
-}
-
 static NSPanel *updateAlertPanel(id updateItem, id host)
 {
     NSString *hostName = objc_msgSend(host, @selector(name));
@@ -139,9 +132,6 @@ void initializeSparkle()
     Method methodToPatch = class_getInstanceMethod(objc_getRequiredClass("SUUpdatePermissionPrompt"), @selector(promptDescription));
     setMethodImplementation(methodToPatch, (IMP)updatePermissionPromptDescription);
 
-    methodToPatch = class_getInstanceMethod(objc_getRequiredClass("SUBasicUpdateDriver"), @selector(downloadDidFinish:));
-    setMethodImplementation(methodToPatch, (IMP)skipSignatureVerificationInDownloadDidFinish);
-
     methodToPatch = class_getInstanceMethod(objc_getRequiredClass("SUUpdateAlert"), @selector(initWithAppcastItem:host:));
     setMethodImplementation(methodToPatch, (IMP)updateAlertInitForAlertPanel);
 
diff --git a/WebKitTools/WebKitLauncher/nightly.webkit.org.public.pem b/WebKitTools/WebKitLauncher/nightly.webkit.org.public.pem
new file mode 100644
index 0000000..174c1e4
--- /dev/null
+++ b/WebKitTools/WebKitLauncher/nightly.webkit.org.public.pem
@@ -0,0 +1,20 @@
+-----BEGIN PUBLIC KEY-----
+MIIDOjCCAi0GByqGSM44BAEwggIgAoIBAQCkQLoVjuu3dPn1dO8N6xIFf4riPVuJ
+XOVpx+QlFMno+qzqGJcJxqhfqZhIRwLq62eHpeuYKIuuPG8fqXY/hquHQIjrtEFZ
+euCW8cxqC7iBg3PlX6RsKUXHD+WY82HJ5Hdkd+5G3jD9qO+Ka7RXgOnL7fTRcbkW
+rtBjL7lVAlMBSVG54+zvti/h1CmdfpO83JAnoGl8c+WGgKlwt5nR7jxp4PgBdAw2
+aJt+UqrMkZOr4Npik1a8IzW+KTlBn96DbF5M6PP6Uh9TblnYtt0ic/Vnr6MKS60X
+WNCb/2/HFjQYaINYtJfXpBaGUMZ0dsAyMxn/Sf1vApmVWh2t0TRMgI4JAhUAtL7E
+pauM+spqaZnAxcMNMP0uFaECggEAe1lF6yZHJh89QdPQvmwROKFHOXYvEX5/IFRw
+pFJDdJJdw53nS/yXWKy8o/wBqESzeVCbktYRqQE84ApO/KJs4KdwiL2LU32FiMD0
+c4UCkRf/RxSLxE4/FGKQzTaBB5TGMfuNLn6C/4aoNXnxcB399QxKF2slBp1GQgsC
+6/4KZZYN+kxGxqAfA1UqrleVtv9OwmaCJwMYYqq20zxYhryuBjTSAD+VN6ncerUf
+IxUceX83mWriBMtXHHR0x12WUDfnFQZg583MeMguFc8qESqZX7mWtzSnblsGmez3
+pD028APHFWJSdruT2YI1NJf08S7A9GLdkLRaUNQTABygANviQwOCAQUAAoIBAGDn
+SFRJ3o/wKBm1PwQyaMfE8dtFt1NVOqTA2/VL3CVfqPV6tizRSvto45HSBn96R6nC
+cxZCi3knJy/9V9ITtlCw1UtqeYOW7sp0PRAgct93XuzlMpOFQr5Q8jydvqMEymOD
+c55QE2vbSgHYbQH362uNXsyMWN1xRVSlT13MBi+fmZ86Z5CkRWvIPWg2NRO16bnx
+jK6l0LGvBKiU79HIrH7DlEfX0zVJBYi6NnJqvFSDeoKyiOMWaCAquWDgu00k3NOl
+gndPnl+mVzEEgNvvN0H6KGVTf55H7KR1LqtWFWCw0VXy5oFgRB359hrLvxe91U4M
+iN3jD7YxuENTOTefu9c=
+-----END PUBLIC KEY-----
diff --git a/WebKitTools/WebKitLauncher/webkit.icns b/WebKitTools/WebKitLauncher/webkit.icns
index bf629bf..b1e1017 100644
--- a/WebKitTools/WebKitLauncher/webkit.icns
+++ b/WebKitTools/WebKitLauncher/webkit.icns
diff --git a/WebKitTools/WebKitLauncherWin/WebKitLauncherWin.vcproj b/WebKitTools/WebKitLauncherWin/WebKitLauncherWin.vcproj
index ee007ca..bf99228 100644
--- a/WebKitTools/WebKitLauncherWin/WebKitLauncherWin.vcproj
+++ b/WebKitTools/WebKitLauncherWin/WebKitLauncherWin.vcproj
@@ -1,123 +1,123 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="WebKitLauncherWin"
-	ProjectGUID="{D09806DB-E58B-4646-8C9B-61101906C1E2}"
-	RootNamespace="WebKitLauncherWin"
-	Keyword="Win32Proj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Release|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"
-			CharacterSet="1"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="shlwapi.lib"
-				OutputFile="$(OutDir)\WebKit$(WebKitConfigSuffix).exe"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<Filter
-			Name="Source Files"
-			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
-			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
-			>
-			<File
-				RelativePath=".\WebKitLauncherWin.cpp"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Header Files"
-			Filter="h;hpp;hxx;hm;inl;inc;xsd"
-			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
-			>
-			<File
-				RelativePath=".\Resource.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Resource Files"
-			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"
-			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
-			>
-			<File
-				RelativePath=".\webkit.ico"
-				>
-			</File>
-			<File
-				RelativePath=".\WebKitLauncherWin.rc"
-				>
-			</File>
-		</Filter>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WebKitLauncherWin"

+	ProjectGUID="{D09806DB-E58B-4646-8C9B-61101906C1E2}"

+	RootNamespace="WebKitLauncherWin"

+	Keyword="Win32Proj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Release|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="shlwapi.lib"

+				OutputFile="$(OutDir)\WebKit$(WebKitConfigSuffix).exe"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<Filter

+			Name="Source Files"

+			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"

+			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"

+			>

+			<File

+				RelativePath=".\WebKitLauncherWin.cpp"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="Header Files"

+			Filter="h;hpp;hxx;hm;inl;inc;xsd"

+			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"

+			>

+			<File

+				RelativePath=".\Resource.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="Resource Files"

+			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"

+			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"

+			>

+			<File

+				RelativePath=".\webkit.ico"

+				>

+			</File>

+			<File

+				RelativePath=".\WebKitLauncherWin.rc"

+				>

+			</File>

+		</Filter>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/WebKitTools/WinLauncher/WinLauncher.vcproj b/WebKitTools/WinLauncher/WinLauncher.vcproj
index 7e3c761..5fddb48 100644
--- a/WebKitTools/WinLauncher/WinLauncher.vcproj
+++ b/WebKitTools/WinLauncher/WinLauncher.vcproj
@@ -23,6 +23,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -94,6 +95,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

 			/>

 		</Configuration>

 		<Configuration

@@ -105,6 +107,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -176,6 +179,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

 			/>

 		</Configuration>

 		<Configuration

@@ -186,6 +190,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -257,6 +262,90 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_Cairo|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_wincairo.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				Optimization="0"

+				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(IntDir)\Include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

+				PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_CRT_SECURE_NO_DEPRECATE"

+				MinimalRebuild="true"

+				ExceptionHandling="0"

+				BasicRuntimeChecks="3"

+				RuntimeLibrary="3"

+				RuntimeTypeInfo="false"

+				UsePrecompiledHeader="2"

+				WarningLevel="1"

+				Detect64BitPortabilityProblems="false"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				LinkLibraryDependencies="false"

+				AdditionalDependencies="comctl32.lib shlwapi.lib user32.lib ole32.lib oleaut32.lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib"

+				LinkIncremental="2"

+				AdditionalLibraryDirectories="&quot;$(WebKitOutputDir)\lib&quot;;&quot;$(ProjectDir)\..\..\..\&quot;"

+				GenerateDebugInformation="true"

+				SubSystem="2"

+				TargetMachine="1"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+				TypeLibraryFile=""

+				ComponentFileName=""

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -295,6 +384,14 @@
 						UsePrecompiledHeader="1"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+						UsePrecompiledHeader="1"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath=".\WinLauncher.cpp"

diff --git a/WebKitTools/wx/browser/wscript b/WebKitTools/wx/browser/wscript
index fb8d81f..530cd75 100644
--- a/WebKitTools/wx/browser/wscript
+++ b/WebKitTools/wx/browser/wscript
@@ -45,7 +45,7 @@ def build(bld):
         includes = ' '.join(include_paths),
         source = 'browser.cpp',
         target = 'wxBrowser',
-        uselib = 'WX CURL ICU XSLT XML WXWEBKIT ' + waf_configname,
+        uselib = 'WX CURL ICU SQLITE3 XSLT XML WXWEBKIT ' + get_config(),
         libpath = [output_dir],
         uselib_local = '',
         install_path = output_dir)
diff --git a/WebKitTools/wx/build-wxwebkit b/WebKitTools/wx/build-wxwebkit
index db03251..3e4c414 100755
--- a/WebKitTools/wx/build-wxwebkit
+++ b/WebKitTools/wx/build-wxwebkit
@@ -368,7 +368,7 @@ if [ $do_build == 1 -o $do_clean == 1 ]; then
                 PY_LIBDIR=`python -c "import distutils.sysconfig; import sys; sys.stdout.write(distutils.sysconfig.PREFIX)"`
                 PY_LIBDIR="$PY_LIBDIR\\Libs"
                 PY_LIB=`python -c "import sys; sys.stdout.write('python' + sys.version[:3])"`
-                PY_LIB=`python -c "sys.stdout.write('$PY_LIB'.replace('.', ''))"`
+                PY_LIB=`python -c "import sys; sys.stdout.write('$PY_LIB'.replace('.', ''))"`
             else
                 PY_LIB=`python-config --libs`
                 PY_LIBDIR=`python-config --ldflags`
diff --git a/WebKitTools/wx/build/build_utils.py b/WebKitTools/wx/build/build_utils.py
index f6daf3a..0a795a8 100644
--- a/WebKitTools/wx/build/build_utils.py
+++ b/WebKitTools/wx/build/build_utils.py
@@ -23,8 +23,11 @@
 #
 # Helper functions for the WebKit build.
 
+import commands
 import glob
 import os
+import platform
+import shutil
 import sys
 import urllib
 import urlparse
@@ -35,8 +38,11 @@ def get_output(command):
     """
     Windows-compatible function for getting output from a command.
     """
-    f = os.popen(command)
-    return f.read().strip()
+    if sys.platform.startswith('win'):
+        f = os.popen(command)
+        return f.read().strip()
+    else:
+        return commands.getoutput(command)
     
 def get_excludes(root, patterns):
     """
@@ -100,7 +106,7 @@ def download_if_newer(url, destdir):
     
     return None
     
-def update_wx_deps(wk_root, msvc_version='msvc2008'):
+def update_wx_deps(conf, wk_root, msvc_version='msvc2008'):
     """
     Download and update tools needed to build the wx port.
     """
@@ -114,7 +120,10 @@ def update_wx_deps(wk_root, msvc_version='msvc2008'):
         sys.exit(1)
 
     # since this module is still experimental
-    #swig_module = download_if_newer('http://wxwebkit.wxcommunity.com/downloads/deps/swig.py', os.path.join(wk_root, 'WebKit', 'wx', 'bindings', 'python'))
+    wxpy_dir = os.path.join(wk_root, 'WebKit', 'wx', 'bindings', 'python')
+    swig_module = download_if_newer('http://wxwebkit.wxcommunity.com/downloads/deps/swig.py.txt', wxpy_dir)
+    if swig_module:
+        shutil.copy(os.path.join(wxpy_dir, 'swig.py.txt'), os.path.join(wxpy_dir, 'swig.py'))
 
     if sys.platform.startswith('win'):
         Logs.info('downloading deps package')
@@ -123,6 +132,10 @@ def update_wx_deps(wk_root, msvc_version='msvc2008'):
             os.system('unzip -o %s -d %s' % (archive, os.path.join(wklibs_dir, msvc_version)))
     
     elif sys.platform.startswith('darwin'):
+        # export the right compiler for building the dependencies
+        if platform.release().startswith('10'): # Snow Leopard
+            os.environ['CC'] = conf.env['CC'][0]
+            os.environ['CXX'] = conf.env['CXX'][0]
         os.system('%s/WebKitTools/wx/install-unix-extras' % wk_root)
         
 def includeDirsForSources(sources):
diff --git a/WebKitTools/wx/build/settings.py b/WebKitTools/wx/build/settings.py
index b09f0bc..4019273 100644
--- a/WebKitTools/wx/build/settings.py
+++ b/WebKitTools/wx/build/settings.py
@@ -26,8 +26,11 @@
 import commands
 import os
 import platform
+import re
 import sys
 
+import Options
+
 from build_utils import *
 from waf_extensions import *
 
@@ -56,6 +59,24 @@ common_libs = []
 common_libpaths = []
 common_frameworks = []
 
+ports = [
+    'CF',
+    'Chromium',
+    'Gtk', 
+    'Haiku',
+    'Mac', 
+    'None',
+    'Qt',
+    'Safari',
+    'Win', 
+    'Wince',
+    'wx',
+]
+
+port_uses = {
+    'wx': ['CURL','PTHREADS', 'WXGC'],
+}
+
 jscore_dirs = [
     'API',
     'bytecode',
@@ -84,13 +105,15 @@ webcore_dirs = [
     'dom/default',
     'editing', 
     'history', 
-    'html', 
+    'html',
+    'html/canvas',
     'inspector', 
     'loader', 
     'loader/appcache', 
     'loader/archive', 
-    'loader/icon', 
-    'page', 
+    'loader/icon',
+    'notifications',
+    'page',
     'page/animation', 
     'platform', 
     'platform/animation', 
@@ -103,7 +126,8 @@ webcore_dirs = [
     'platform/image-decoders/jpeg', 
     'platform/image-decoders/png', 
     'platform/image-decoders/xbm', 
-    'platform/image-decoders/zlib', 
+    'platform/image-decoders/zlib',
+    'platform/mock',
     'platform/network', 
     'platform/sql', 
     'platform/text', 
@@ -111,6 +135,7 @@ webcore_dirs = [
     'rendering', 
     'rendering/style', 
     'storage', 
+    'websockets', 
     'xml'
 ]
 
@@ -120,18 +145,35 @@ config = 'Debug'
 if os.path.exists(config_file):
     config = open(config_file).read()
 
-output_dir = os.path.join(wk_root, 'WebKitBuild', config)
+config_dir = config
 
-waf_configname = config.upper()
+try:
+    branches = commands.getoutput("git branch --no-color")
+    match = re.search('^\* (.*)', branches, re.MULTILINE)
+    if match:
+        config_dir += ".%s" % match.group(1)
+except:
+    pass
+
+output_dir = os.path.join(wk_root, 'WebKitBuild', config_dir)
 
 build_port = "wx"
 building_on_win32 = sys.platform.startswith('win')
 
-if building_on_win32:
-    if config == 'Release':
-        waf_configname = waf_configname + ' CRT_MULTITHREADED_DLL'
-    else:
-        waf_configname = waf_configname + ' CRT_MULTITHREADED_DLL_DBG'
+def get_config():
+    waf_configname = config.upper().strip()
+    if building_on_win32:
+        isReleaseCRT = (config == 'Release')
+        if build_port == 'wx':
+            if Options.options.wxpython:
+                isReleaseCRT = True
+        
+        if isReleaseCRT:
+            waf_configname = waf_configname + ' CRT_MULTITHREADED_DLL'
+        else:
+            waf_configname = waf_configname + ' CRT_MULTITHREADED_DLL_DBG'
+            
+    return waf_configname
 
 create_hash_table = wk_root + "/JavaScriptCore/create_hash_table"
 if building_on_win32:
@@ -140,6 +182,16 @@ os.environ['CREATE_HASH_TABLE'] = create_hash_table
 
 feature_defines = ['ENABLE_DATABASE', 'ENABLE_XSLT', 'ENABLE_JAVASCRIPT_DEBUGGER']
 
+msvc_version = 'msvc2008'
+
+msvclibs_dir = os.path.join(wklibs_dir, msvc_version, 'win')
+
+def get_path_to_wxconfig():
+    if 'WX_CONFIG' in os.environ:
+        return os.environ['WX_CONFIG']
+    else:
+        return 'wx-config'
+
 def common_set_options(opt):
     """
     Initialize common options provided to the user.
@@ -149,38 +201,66 @@ def common_set_options(opt):
     opt.tool_options('python')
     
     opt.add_option('--wxpython', action='store_true', default=False, help='Create the wxPython bindings.')
+    opt.add_option('--wx-compiler-prefix', action='store', default='vc',
+                   help='Specify a different compiler prefix (do this if you used COMPILER_PREFIX when building wx itself)')
 
 def common_configure(conf):
     """
     Configuration used by all targets, called from the target's configure() step.
     """
+    
+    conf.env['MSVC_VERSIONS'] = ['msvc 9.0', 'msvc 8.0']
+    conf.env['MSVC_TARGETS'] = ['x86']
+    
+    if sys.platform.startswith('cygwin'):
+        print "ERROR: You must use the Win32 Python from python.org, not Cygwin Python, when building on Windows."
+        sys.exit(1)
+    
+    if sys.platform.startswith('darwin') and build_port == 'wx':
+        import platform
+        if platform.release().startswith('10'): # Snow Leopard
+            # wx currently only supports 32-bit compilation, so we want gcc-4.0 instead of 4.2 on Snow Leopard
+            # unless the user has explicitly set a different compiler.
+            if not "CC" in os.environ:
+                conf.env['CC'] = 'gcc-4.0'
+            if not "CXX" in os.environ:
+                conf.env['CXX'] = 'g++-4.0'
     conf.check_tool('compiler_cxx')
     conf.check_tool('compiler_cc')
-    conf.check_tool('python')
-    conf.check_python_headers()
+    if Options.options.wxpython:
+        conf.check_tool('python')
+        conf.check_python_headers()
     
     if sys.platform.startswith('darwin'):
         conf.check_tool('osx')
     
-    msvc_version = 'msvc2008'
+    global msvc_version
+    global msvclibs_dir
+    
     if building_on_win32:
         found_versions = conf.get_msvc_versions()
         if found_versions[0][0] == 'msvc 9.0':
             msvc_version = 'msvc2008'
         elif found_versions[0][0] == 'msvc 8.0':
             msvc_version = 'msvc2005'
-       
-    msvclibs_dir = ''
-    if build_port == "wx":
-        update_wx_deps(wk_root, msvc_version)
+        
         msvclibs_dir = os.path.join(wklibs_dir, msvc_version, 'win')
+        conf.env.append_value('CXXFLAGS', ['/wd4291','/wd4344','/wd4396','/wd4800'])
+    
+    for use in port_uses[build_port]:
+       conf.env.append_value('CXXDEFINES', ['WTF_USE_%s' % use])
     
-        conf.env.append_value('CXXDEFINES', ['BUILDING_WX__=1', 'WTF_USE_WXGC=1'])
+    if build_port == "wx":
+        update_wx_deps(conf, wk_root, msvc_version)
+    
+        conf.env.append_value('CXXDEFINES', ['BUILDING_WX__=1'])
 
         if building_on_win32:
             conf.env.append_value('LIBPATH', os.path.join(msvclibs_dir, 'lib'))
             # wx settings
-            wxdefines, wxincludes, wxlibs, wxlibpaths = get_wxmsw_settings(wx_root, shared=True, unicode=True, wxPython=True)
+            global config
+            is_debug = (config == 'Debug')
+            wxdefines, wxincludes, wxlibs, wxlibpaths = get_wxmsw_settings(wx_root, shared=True, unicode=True, debug=is_debug, wxPython=Options.options.wxpython)
             conf.env['CXXDEFINES_WX'] = wxdefines
             conf.env['CPPPATH_WX'] = wxincludes
             conf.env['LIB_WX'] = wxlibs
@@ -193,6 +273,14 @@ def common_configure(conf):
     
         conf.env.append_value('CPPPATH', wklibs_dir)
         conf.env.append_value('LIBPATH', wklibs_dir)
+        
+        # WebKit only supports 10.4+
+        mac_target = 'MACOSX_DEPLOYMENT_TARGET'
+        if mac_target in os.environ and os.environ[mac_target] == '10.3':
+            os.environ[mac_target] = '10.4'
+        
+        if mac_target in conf.env and conf.env[mac_target] == '10.3':
+            conf.env[mac_target] = '10.4'
     
     #conf.env['PREFIX'] = output_dir
     
@@ -240,26 +328,22 @@ def common_configure(conf):
         conf.env['LIB_XSLT'] = ['libxslt']
     else:    
         if build_port == 'wx':
-            conf.env.append_value('LIB', ['png', 'pthread'])
+            conf.env.append_value('LIB', ['jpeg', 'png', 'pthread'])
             conf.env.append_value('LIBPATH', os.path.join(wklibs_dir, 'unix', 'lib'))
             conf.env.append_value('CPPPATH', os.path.join(wklibs_dir, 'unix', 'include'))
             conf.env.append_value('CXXFLAGS', ['-fPIC', '-DPIC'])
             
-            conf.check_cfg(path='wx-config', args='--cxxflags --libs', package='', uselib_store='WX')
+            conf.check_cfg(path=get_path_to_wxconfig(), args='--cxxflags --libs', package='', uselib_store='WX', mandatory=True)
             
-        conf.check_cfg(path='xslt-config', args='--cflags --libs', package='', uselib_store='XSLT')
-        conf.check_cfg(path='xml2-config', args='--cflags --libs', package='', uselib_store='XML')
-        conf.check_cfg(path='curl-config', args='--cflags --libs', package='', uselib_store='CURL')
+        conf.check_cfg(msg='Checking for libxslt', path='xslt-config', args='--cflags --libs', package='', uselib_store='XSLT', mandatory=True)
+        conf.check_cfg(path='xml2-config', args='--cflags --libs', package='', uselib_store='XML', mandatory=True)
+        conf.check_cfg(path='curl-config', args='--cflags --libs', package='', uselib_store='CURL', mandatory=True)
         if sys.platform.startswith('darwin'):
             conf.env.append_value('LIB', ['WebCoreSQLite3'])
         
         if not sys.platform.startswith('darwin'):
-            conf.check_cfg(package='cairo', args='--cflags --libs', uselib_store='WX')
-            conf.check_cfg(package='pango', args='--cflags --libs', uselib_store='WX')
-            conf.check_cfg(package='gtk+-2.0', args='--cflags --libs', uselib_store='WX')
-            conf.check_cfg(package='sqlite3', args='--cflags --libs', uselib_store='SQLITE3')
-            conf.check_cfg(path='icu-config', args='--cflags --ldflags', package='', uselib_store='ICU')
-
-
-
-
+            conf.check_cfg(package='cairo', args='--cflags --libs', uselib_store='WX', mandatory=True)
+            conf.check_cfg(package='pango', args='--cflags --libs', uselib_store='WX', mandatory=True)
+            conf.check_cfg(package='gtk+-2.0', args='--cflags --libs', uselib_store='WX', mandatory=True)
+            conf.check_cfg(package='sqlite3', args='--cflags --libs', uselib_store='SQLITE3', mandatory=True)
+            conf.check_cfg(path='icu-config', args='--cflags --ldflags', package='', uselib_store='ICU', mandatory=True)
diff --git a/WebKitTools/wx/build/waf_extensions.py b/WebKitTools/wx/build/waf_extensions.py
index fcf34df..6816441 100644
--- a/WebKitTools/wx/build/waf_extensions.py
+++ b/WebKitTools/wx/build/waf_extensions.py
@@ -34,10 +34,9 @@ def exec_command(s, **kw):
     filename = ''
     if sys.platform.startswith('win') and len(' '.join(s)) > 32000:
         import tempfile
-        file = tempfile.NamedTemporaryFile(delete=False)
-        filename = file.name
-        file.write(' '.join(s[1:]))
-        file.close()
+        (fd, filename) = tempfile.mkstemp()
+        os.write(fd, ' '.join(s[1:]))
+        os.close(fd)
         
         s = [s[0], '@' + filename]
         
diff --git a/WebKitTools/wx/build/wxpresets.py b/WebKitTools/wx/build/wxpresets.py
index 677720c..3d6b693 100644
--- a/WebKitTools/wx/build/wxpresets.py
+++ b/WebKitTools/wx/build/wxpresets.py
@@ -24,6 +24,37 @@
 # Library for functions to determine wx settings based on configuration
 
 import os
+import re
+
+import Options
+
+def parse_build_cfg(filename):
+    cfg_file = open(filename, 'r')
+    cfg = {}
+    for cfg_line in cfg_file.readlines():
+        key = None
+        value = None
+        parts = cfg_line.split('=')
+        if len(parts) >= 1:
+            key = parts[0].strip()
+        
+        if len(parts) >= 2:
+            value = parts[1].strip()
+            if value.isdigit():
+                value = int(value)
+        
+        if key:
+            cfg[key] = value
+
+    return cfg
+
+def get_wx_version(wx_root):
+    versionText = open(os.path.join(wx_root, "include", "wx", "version.h"), "r").read()
+    
+    majorVersion = re.search("#define\swxMAJOR_VERSION\s+(\d+)", versionText).group(1)
+    minorVersion = re.search("#define\swxMINOR_VERSION\s+(\d+)", versionText).group(1)
+    
+    return (majorVersion, minorVersion)
 
 def get_wxmsw_settings(wx_root, shared = False, unicode = False, debug = False, wxPython=False):
     if not os.path.exists(wx_root):
@@ -40,11 +71,13 @@ def get_wxmsw_settings(wx_root, shared = False, unicode = False, debug = False,
     ext = ''
     postfix = 'vc'
     
+    version_str_nodot = ''.join(get_wx_version(wx_root))
+    
     if shared:
         defines.append('WXUSINGDLL')
-        libdir = os.path.join(libdir, 'vc_dll')
+        libdir = os.path.join(libdir, Options.options.wx_compiler_prefix + '_dll')
     else:
-        libdir = os.path.join(libdir, 'vc_lib')
+        libdir = os.path.join(libdir, Options.options.wx_compiler_prefix + '_lib')
         
     if unicode:
         defines.append('_UNICODE')
@@ -59,18 +92,27 @@ def get_wxmsw_settings(wx_root, shared = False, unicode = False, debug = False,
         depext += 'd'
 
     configdir = os.path.join(libdir, 'msw' + ext)
+    
+    monolithic = False 
+    cfg_file = os.path.join(configdir, 'build.cfg')
+    if os.path.exists(cfg_file):
+        cfg = parse_build_cfg(cfg_file)
+        if "MONOLITHIC" in cfg:
+            monolithic = cfg["MONOLITHIC"]
     libpaths.append(libdir)
     includes.append(configdir)
     
     def get_wxlib_name(name):
-        prefix = 'wxmsw'
         if name == 'base':
-            return 'wxbase28%s' % (ext)
+            return 'wxbase%s%s' % (version_str_nodot, ext)
         
-        return "wxmsw28%s_%s" % (ext, name)
+        return "wxmsw%s%s_%s" % (version_str_nodot, ext, name)
     
     libs.extend(['wxzlib' + depext, 'wxjpeg' + depext, 'wxpng' + depext, 'wxexpat' + depext])
-    libs.extend([get_wxlib_name('base'), get_wxlib_name('core')])
+    if monolithic:
+        libs.extend(["wxmsw%s%s" % (version_str_nodot, ext)])
+    else:
+        libs.extend([get_wxlib_name('base'), get_wxlib_name('core')])
     
     if wxPython or debug:
         defines.append('__WXDEBUG__')
diff --git a/WebKitTools/wx/install-unix-extras b/WebKitTools/wx/install-unix-extras
index b3088c0..68d81e4 100755
--- a/WebKitTools/wx/install-unix-extras
+++ b/WebKitTools/wx/install-unix-extras
@@ -68,7 +68,7 @@ ICONV_URL="http://ftp.gnu.org/pub/gnu/libiconv/$ICONV_TARBALL"
 
 LIBJPEG_VERSION="6b"
 LIBJPEG_TARBALL="jpegsrc.v$LIBJPEG_VERSION.tar.gz"
-LIBJPEG_URL="http://www.ijg.org/files/$LIBJPEG_TARBALL"
+LIBJPEG_URL="http://wxwebkit.wxcommunity.com/downloads/deps/$LIBJPEG_TARBALL"
 
 LIBPNG_VERSION="1.2.33"
 LIBPNG_TARBALL="libpng-$LIBPNG_VERSION.tar.gz"
diff --git a/autotools/webkit.m4 b/autotools/webkit.m4
index ece54d2..5bb4f65 100644
--- a/autotools/webkit.m4
+++ b/autotools/webkit.m4
@@ -6,7 +6,7 @@ dnl WebKit and JavaScriptCore builds.
 # global states
 m4_define([initialized], [no])
 
-AC_DEFUN([BEFORE_AC_PROG_CXX],
+AC_DEFUN([INIT_C_CXX_FLAGS],
 [dnl
 # If CXXFLAGS and CFLAGS are unset, default to empty.
 # This is to tell automake not to include '-g' if CXXFLAGS is not set
@@ -19,11 +19,14 @@ if test -z "$CFLAGS"; then
 fi
 ])
 
-# check for pkg-config
 AC_DEFUN_ONCE([WEBKIT_INIT],
 [dnl
 dnl check if we have the required packages to have successful checks
 dnl
+# Make sure CXXFLAGS and CFLAGS are set before expanding AC_PROG_CXX to avoid
+# building with '-g -O2' on Release builds.
+AC_REQUIRE([INIT_C_CXX_FLAGS])
+
 # check for -fvisibility=hidden compiler support (GCC >= 4)
 saved_CFLAGS="$CFLAGS"
 CFLAGS="$CFLAGS -fvisibility=hidden -fvisibility-inlines-hidden"
@@ -36,6 +39,7 @@ CFLAGS="$saved_CFLAGS"
 AC_SUBST(SYMBOL_VISIBILITY)
 AC_SUBST(SYMBOL_VISIBILITY_INLINES)
 
+# check for pkg-config
 AC_PATH_PROG(PKG_CONFIG, pkg-config, no)
 if test "$PKG_CONFIG" = "no"; then
    AC_MSG_ERROR([Cannot find pkg-config, make sure it is installed in your PATH])
@@ -56,12 +60,10 @@ if test -z "$MV"; then
    AC_MSG_ERROR([You need 'mv' to compile WebKit])
 fi
 
+AC_REQUIRE([AC_PROG_CC])
+AC_REQUIRE([AC_PROG_CXX])
 AM_PROG_CC_STDC
 AM_PROG_CC_C_O
-# Make sure CXXFLAGS and CFLAGS are set before expanding AC_PROG_CXX to avoid
-# building with '-g -O2' on Release builds.
-AC_REQUIRE([BEFORE_AC_PROG_CXX])
-AC_REQUIRE([AC_PROG_CXX])
 AC_PROG_INSTALL
 AC_SYS_LARGEFILE
 
@@ -101,7 +103,7 @@ AC_DEFUN_ONCE([_WEBKIT_CHECK_GLIB],
 [dnl
 dnl check for glib
 # Version requirements
-GLIB_REQUIRED_VERSION=2.0
+GLIB_REQUIRED_VERSION=2.21.3
 GOBJECT_REQUIRED_VERSION=2.0
 GTHREAD_REQUIRED_VERSION=2.0
 
@@ -158,7 +160,7 @@ if test "$with_unicode_backend" = "icu" -o "$with_unicode_backend" = "glib"; the
 		# necessarily want, like debugging and optimization flags
 		# See man (1) icu-config for more info.
 		UNICODE_CFLAGS=`$icu_config --cppflags`
-		UNICODE_LIBS=`$icu_config --ldflags`
+		UNICODE_LIBS=`$icu_config --ldflags-libsonly`
 	fi
 fi